Cyber Command creates task force with Coast Guard for port defense exercise

During its most recent capstone exercise, U.S. Cyber Command created a joint task force with the Coast Guard to defend ports against cyberattacks.

Cyber Guard, the command’s premier annual exercise, integrated with Pacific Sentry. As cyber has matured within the Department of Defense, leaders have sought to integrate it deeper with other defense functions, using real-world exercises to game out how it can support others.

“When I was a young officer, we would deploy and we would do an exercise in [Indo-Pacific Command] or [European Command]. And it was a Eucom exercise[or] it was an Indo-Pacom exercise. Very stovepiped … But today, the chairman is driving the joint force to exercise together to ensure that when time comes, we can operate seamlessly at the highest level,” Rear Adm. Dennis Velez, acting deputy commander of Cybercom, said Thursday at HammerCon, hosted by the Military Cyber Professionals Association. “Cyber Guard this year was part of the Pacific Sentry exercise … to ensure that we could put it all together and really operate again at the highest levels as the joint force.”

The exercise, which encompassed several combatant commands, sought to execute a defense of Taiwan scenario against China.

As part of the scenario, the enemy was attacking multiple ports, forcing the participants to figure out the best way to defend them and exercise greater command and control over that effort.

The newly minted and sub-unified command under Cybercom, DOD Cyber Defense Command, formerly Joint Force Headquarters-DOD Information Network, sought to co-opt the Coast Guard to undertake that defensive effort under Task Force Port.

The Coast Guard possesses unique authorities as a uniformed service that falls under the Department of Homeland Security, such as law enforcement.

There are some Coast Guard members that are on Cybercom’s cyber mission force teams, the units each service provides the command to conduct offensive and defensive operations.

Port security has been a mainstay of Cyber Guard in the past under previous iterations, a precursor to the command’s premier exercise then dubbed Cyber Flag, where Cyber Guard would focus on defense of the homeland and Cyber Flag would then transition to a military operation.

This time, however, port security was a key part of the military component. Outside experts and wargames have warned that China will likely try to target U.S. ports and critical infrastructure ahead of any military action it takes against Taiwan to prevent or slow a mobilization and response from America’s armed forces that might try to intervene.

“As we were running the exercise, we were just coming with new ideas,” Velez said. “We needed to fight. How do we defend force? How do we defend electrical power, distribution centers, electrical generation? How do we do that at scale?”

Using its memorandum of agreement with the Coast Guard, DCDC created Task Force Port for the exercise and charged a Coast Guard official with leading it.

That MOA gives Cybercom the ability to quickly provide capabilities and forces to the Coast Guard for emergent needs that cannot be met through the Defense Support to Civil Authorities process, which is how DOD supports efforts outside its scope, such as work on the homeland, when requested, according to a Cybercom spokesperson.

They added that the MOA process is vital to ensure U.S. government capabilities are rapidly used in support of national security missions and closely mirrors similar processes used in support of homeland defense and other missions.

That portion of Cyber Guard took place about a week after Secretary of Defense Pete Hegseth designated DCDC as a sub-unified command, leading cyber officials to figure out how to utilize this new, higher-profile entity and perform the defensive portion.

While the elevation to sub-unified command doesn’t portend any immediate new resources, Lt. Gen. Paul Stanton, commander of DCDC, noted it comes with a mindset shift.

“There’s a culture shift. There’s a mindset shift. Gain and maintain contact with the enemy and impose cost,” Stanton said at the conference. “Don’t randomly chase incidents. Don’t chase events. Think in context. Think about what the enemy is attempting to accomplish. Think about what missions are relevant to us. Think about where our missions and the enemy’s intent capabilities overlap, the center of that Venn diagram, build your engagement area, and then … beat the enemy.”

Task Force Port fits within that shift to provide more context and purpose to cyber defense, Stanton added.

“When we were in the process of supporting the exercise, because in the exercise, the enemy was attacking multiple ports simultaneously. Again, don’t look at them individually, but what’s the intermediate level of headquarters that can command and control multiple different maneuver elements, CSSPs, industry partners, mission elements in cyber protection teams, together, synchronized, coordinated in support of an operational mission when we know that the enemy is campaigning against us,” he said, “The way that they’re attacking one port probably looks a lot like the way that they’re attacking another. Let’s synthesize that under one command-and-control headquarters so that we’re synchronized in our execution.”