What will the elevation of Air Forces Cyber look like?
When Air Force Secretary Frank Kendall announced a sweeping reorganization Feb. 12, one of the shifts was to elevate Air Forces Cyber to a standalone service component command to reflect the importance of the cyber mission to the joint force and across the department. However, not much detail has been provided regarding what exactly that means or what an elevated AFCYBER will look like.
The so-called reoptimization — a list of up to 24 changes to include reorganizations, shuffles and brand new commands — was necessary, officials said, to better posture the Department of the Air Force against top nation-state competitors, namely, China.
The service has maintained it could be months until any additional details are available regarding the elevation and how the new organization could take shape. A DAF spokesperson told DefenseScoop that each of the initiatives listed in the reoptimozation plan are on various timelines and officials are still developing an implementation plan for the AFCYBER elevation — but they don’t have any established timelines yet.
“What is going to be in that command? Details to follow, as we look forward and understand,” Lt. Gen. Kevin Kennedy said at the AFA Warfare Symposium where the reoptomization was announced regarding AFCYBER’s impending elevation.
The appropriations bill for fiscal 2024 that passed Congress at the end of March, noted that to date, the Air Force had not “provided thorough justification for this reorganization, a comprehensive implementation plan, or detailed budgetary information necessary for the Subcommittees to assess this plan.” As a result, the legislation noted that any fiscal 2024 funding that is utilized for the reorganization is designated a congressional special interest item and the secretary must provide a briefing to congressional defense committees 30 days prior to executing any organizational changes.
Lawmakers also directed the comptroller general to submit a report to the House and Senate defense appropriations subcommittees on the proposed reorganization no later than 180 days after enactment of the legislation.
AFCYBER, the Air Force’s service cyber component to U.S. Cyber Command, is part of 16th Air Force, the service’s first information warfare entity. It was established in 2019 and combined a variety of capabilities to include cyber, electromagnetic spectrum operations, intelligence, surveillance, reconnaissance, information ops and weather.
Previously, personnel for AFCYBER were spread across two numbered Air Forces with 24th Air Force serving as the primary AFCYBER entity and pulling intelligence personnel from 25th Air Force. This created difficulties with command relationships and oversight of teams since the intelligence operators served beneath a separate Air Force command with a separate commander.
16th Air Force, a three-star command, now sits beneath Air Combat Command, a four-star entity.
According to former Air Force cyber officials — all of whom had no inside knowledge of exactly what the elevation will portend — the most likely outcome of the elevation of AFYBER will be to pull it out from under Air Combat Command and place it directly under the chief of staff and/or secretary like a major command or MAJCOM.
Kennedy somewhat affirmed this sentiment.
“The decision was made to elevate Air Forces Cyber as a command, reporting directly to the chief and the secretary,” he said at the AFCEA Rocky Mountain Cyberspace Symposium a week after the AFA Warfare Symposium. “This decision was made after a significant amount of discussion, [and] in my assessment, was made for a few key reasons. One that stands out is the recognition of the importance of operating in, through and from the cyber domain that cuts across the entire department, both services and all commands. It is also the recognition of the value that cyber, ISR, weather and information operations and electronic warfare enterprises within the 16th Air Force bring to our security.”
Removing AFCYBER from Air Combat Command also loosens bureaucratic hurdles that simply exist as a function of being beneath another organization, sources indicated.
“Being underneath one MAJCOM, frankly, historically has been challenging. Not because they haven’t wanted to support cyber, but it gets into, Air Combat Command flies jets and fighters and Space Command flies satellites. It always was a budgetary challenge,” Bill Marion, executive and managing director at Accenture Federal and former deputy chief information officer of the Air Force, told DefenseScoop.
Elevation will also raise the profile of a new AFCYBER when competing for resources within the Air Force.
“The obvious advantage [of elevation out from under ACC] will be that when it comes to resources, both people and money, you are competing for the prioritization of those requirements at a higher level,” Charles “Tuna” Moore, a retired Air Force three-star who served as the deputy commander of Cybercom, told DefenseScoop. “Does that mean you automatically are going to get more people and more budget? No. It’s going to depend on how well you can make your case for your requirements.”
Elevation also raises the profile of cyber and non-kinetic capabilities, which are expected to play a larger role in conflicts going forward.
“The writing’s on the wall. Globally, cyber is truly a warfighting capability, it’s truly transcending all the mission areas,” Marion said. “The biggest thing is this much larger aperture of cyber as a warfighting mission in totality, not underneath kinetic effects, but in concert with kinetic effects. Because it is a reality we live in. I mean, you look at the Ukrainian war and as an example, I mean, it’s as much cyber as it is kinetic. We see the bombs drop and you don’t see the non-kinetic but, it’s on par, it’s not above.”
One of the biggest challenges for a new organization like this will be how it will acquire and procure new systems.
If made a reality, this would put AFCYBER on par with its other service cyber component counterparts: Army Cyber Command and 10th Fleet/Fleet Cyber Command — an Echelon II that reports directly to the chief of naval operations.
However, putting operational units beneath the chief of staff or secretary has its own challenges, especially given they aren’t in operations on a day-to-day basis, but are rather focused on policy and running the organization, according to some that spoke to DefenseScoop.
Sources did, however, indicate that this elevation is a natural progression. It also could, according to some experts, begin to set the stage as a precursor for a potential independent uniformed service focused solely on cyber — making a cleaner break if that were to occur.
Discussions on that topic have grown louder over the last two years, with Congress poised to introduce legislation to one degree or another to begin the evaluation process for such a prospect.
The proposed elevation also likely won’t have a major impact on the way the Air Force provides personnel to — or its relationship with — Cybercom all that much, but rather, will be more internally focused to non-Cybercom forces and issues.
“I don’t think that’s going to affect force presentation to Cybercom that much. I do think it’s going to allow the Air Force to focus a lot more on its service-specific cyber capabilities that they need to develop and field,” Moore said.
While Cybercom owns the authorities to conduct offensive cyber operations with forces the services provide it, each service still is responsible for a variety of defensive and IT-related tasks. The Air Force has been in the process of building and deploying what it calls mission defense teams for the past several years. These are specialized groups that protect critical Air Force missions and installations, such as critical infrastructure or computers associated with aircraft and remotely piloted systems. They are separate from the cyber protection teams each of the services provide to Cybercom. The Air Force is looking to evolve those teams and concept in the future, officials have noted.
Information warfare
The creation of 16th Air Force was lauded by outside experts for the service’s recognition of the burgeoning need to bolster information warfare capabilities and integrate them in a meaningful way after after the U.S. military writ large languished in this area after the Cold War. U.S. adversaries had been reorganizing their forces to create more integrated information warfare units and had begun to either approach parity or in some cases eclipse the United States in this realm.
It remains unclear if a new elevated AFCYBER will retain most of those information capabilities or if it will include just the cyber pieces.
“If I had to bet today, I think you’ll probably see the flying organizations moved out of the new entity. I think you’ll see the weather organization moved out,” Moore said. “I think you’re going to see AFCYBER be much more scoped down to focus on cyberspace operations, information operations and the retention of the service cryptologic component responsibilities. You are still coalescing around the idea of an information warfare type of organization. It won’t be called that, but the most important thing is doing your best to keep those types of capabilities aligned and under the same commander where you can benefit from unity of command and effort … Right now, it’s a very large command with a lot of related but disparate responsibilities.”
Currently, there are some units under 16th Air Force responsible for flying operations mostly in the ISR space, such as the 9th Reconnaissance Wing that flies U-2 Dragon Ladies and RQ-4 Global Hawks, the 55th Wing and the 319th Reconnaissance Wing.
16th Air Force also serves as the cryptologic component that reports to the National Security Agency performing signals intelligence. Given the close relationship cyber and signals intelligence enjoy — not to mention the fact NSA and Cybercom are co-located and share a leader — some obervers are hopeful that the new organization won’t lose its SIGINT units or its status as the cryptologic component.
Kenndey stated that the Air Force’s information warfare mission likely won’t be changing anytime soon.
“Just know that the emphasis on the cyber and the information domain in the Air Force is not changing. It’s there. The structure may change, but the emphasis isn’t going to change,” he said at the AFA conference in February.
Warrant officers
Additionally, as part of the reoptimization plan, the Air Force announced the return of warrant officers for the first time in 40 years, which initially will be focused specifically on IT and cyber roles.
Experts that DefenseScoop talked to were all in agreement that this is a positive development for the service and signifies the importance of cyber going forward.
“I think it’s a good sign, too, because if you go back to the height of the Global War on Terrorism, the main pressure was on RPA pilots and generating more and more of them. There was a huge push then and a lot of discussion of do we need to bring back to warrant officer force to deal with this specific problem. We didn’t do it even though there was immense pressure to increase our capacity,” Moore said. “To do it now, in the cyber domain, I think is a recognition of how important this domain is to the success of the Air Force and that we have to be willing to do whatever it takes to be successful.”
Others cautioned that the warrant officers that are brought in should possess specific skills — in areas such as cloud, AI and data — and be true experts rather than just being extra bodies in the ranks.
