Before Iran war, Army NETCOM transferred network and C2 services between theaters for first time

AUGUSTA, Ga. — Before Operation Epic Fury, the Army’s Network Enterprise Technology Command transferred digital services across theaters for the first time, according to the unit’s top officer, so the Army’s Middle East hub could have network support in the event Iran targeted its critical communication infrastructure.

Maj. Gen. Jacqueline McPhail, the Army’s NETCOM commander, said that the service moved network and C2 capabilities from Southwest Asia to Europe as part of a “digital passage of lines,” positioning the latter theater to take over network workloads for units in the Middle East.

For years, the Army has been developing a unified network ecosystem, moving away from dozens of disparate networks isolated to geographic commands that officials say are unsuited to respond to modern, fast-moving global crises. The digital passage of lines, according to McPhail, demonstrated the benefit of having a more unified network.

The point, McPhail told a panel at the annual TechNet Augusta conference last week, was so that “theaters in crisis can focus on the crisis, and theaters outside of that crisis can focus on delivering the network and the services.”

The 12-Day War, which culminated with the U.S. bombing three of Iran’s nuclear facilities last year, catalyzed preparation for the digital passage of lines, according to McPhail. She said the “impacts” from network infrastructure attacks during the conflict meant NETCOM had to understand where U.S. Army Central’s critical nodes were in the event they went down.

Those nodes included the Army Enterprise Data Center, which provides a majority of network and security services, and the satellite communication-oriented Regional Hub Node. McPhail said the NETCOM and ARCENT conducted exercises to determine where in Europe or other hubs SATCOM capability needed to be transferred if those sites were compromised.

A NETCOM spokesperson, Gabriel Archer, told DefenseScoop the transfer included configuration privileges, bandwidth allocations, cloud services and other common digital parts of the network infrastructure.

“Each theater was designed with their own underlying network and service delivery, and so we had to replicate that,” according to McPhail, who also said that a separate service’s network infrastructure was attacked during the 12-Day War, but didn’t specify which one. 

The network replication was commanded and controlled by Regional Cyber Center personnel from Southwest Asia, who moved to Europe to deliver the network that was also coming from their own theater. 

“Probably the most concerning part to me was I didn’t want to take away from one theater while I was trying to ensure that we had the network for the theater to go to major combat operations,” McPhail said. “So when we think about that digital passage of lines, it was the first time anyone had done it. It also gave me the ability as the commander of NETCOM to truly maneuver the network at the speed of need.”

During the Iran war, Tehran’s attacks have damaged communication infrastructure, including at Naval Support Activity Bahrain where two satellite terminals were struck early on in the conflict. 

But the extent to which U.S. infrastructure in the region has been damaged is likely greater than what the military has disclosed so far, according to several reports analyzing available satellite imagery, now more scant after the government requested private providers to withhold publicizing imagery related to the Iran war over security concerns.

The Pentagon has asked Congress for at least tens of billions of dollars to cover the cost of the Iran war, though officials have previously left infrastructure estimates off the table. 

Archer, the NETCOM spokesperson, declined to say whether the redundant network was used during Operation Epic Fury. But the passage of lines “emboldened” NETCOM to begin applying those lessons to other theaters, including Europe and the Pacific, according to McPhail.

“That’s gotta be nearly seamless,” she said, so commanders can “respond at speed, with mass, and with purpose.”

The service began developing the Army Unified Network in 2021, publishing a plan to create such a capability with common standards, systems and processes so commands could quickly respond to an increasingly “volatile” world and quickly onboard new technologies that will help them face it.

McPhail said the service had nearly 70 disparate networks it needed to unify into a more agile, streamlined, secure, “data-centric” ecosystem. The sentiment has been echoed across several Army initiatives — such as the Next Generation Command and Control prototype — and as other leaders warn that success in modern conflict amounts to which side can access data for faster decision-making.

The Army published an addendum to the plan last year, which focuses on establishing the unified network, posturing the force to support “multi-domain operations,” securing the ecosystem based on a zero trust model, changing the network’s governance and policy, and further improving the capability. 

As part of the security architecture, McPhail said that every endpoint across the Army can now be viewed from a single dashboard to better monitor threats to the network and deliver patches. The service has also transitioned up to 93% of its devices to the Army Unified Directory Service, a cloud-based device management tool “which just really allows us that seamless movement from your office desktop to a foxhole,” McPhail said.

NETCOM is currently in phase two of the plan, “operationalizing” the unified network, which entails updating the Army’s portion of the Department of Defense Information Network (DODIN), establishing a funding strategy for hardware, software and personnel, and baking in AI-enabled reporting. 

Over the next several years, NETCOM will continue to modernize the unified network, finally integrating zero trust architecture while adding emerging technologies for transport, computing and sensing. The plan also references more AI use, and Army cyber leaders have recently said they were already deploying autonomous agents into the DODIN for network defense.

“We’re going to continue to transform into that global warfighting platform, and we will not be satisfied with incremental gains,” McPhail said. “We’re going to break down the distances, we’re going to collapse the timelines, and we’re going to deliver that information advantage everywhere our formations must operate.”