Cyber Operators’ Dreaded Question: "What Do You Do?”

Hidden behind their monitors while upholding the United States’ national security are cybersecurity professionals. Most situations feel critical and rarely is there a gratifying return to success. Security restraints and the handling of sensitive operations reduce the amount of information professionals can share with others. A sense of isolation, lack of work-life balance and extreme pressures to deliver are just a few of the high-stress-inducing factors of frontline cyber workers. For the cyber operations community, mission must come first. 

Richard Schaeffer, former National Security Agency (NSA) information assurance director, worked for the organization for 38 years. He spelled out the reality of this profession. “The people who try to develop technology and root out the perpetrators, it’s not just people who are trying to steal money, it’s people who are trying to do very evil things in our society. And that’s a very stressful thing because most of us don’t want to think about the horrible things that human beings will do to each other. So, I don’t think anyone goes into this with the foreknowledge of how bad things are—they learn over time, and they react just as normal human beings would react in any sort of stressful situation.” 

The National Alliance on Mental Illness lists suicide as the second leading cause of death among people aged 10-34. A rise in anxiety, depression and suicide rates has led to the recent creation of 9-8-8, a nationwide phone number, which connects callers directly to the Suicide and Crisis Lifeline. In his first State of the Union, President Joe Biden addressed the growing mental health crisis in the United States. It’s no secret that mental health concerns have increased significantly throughout the years. 

Access to mental health care is necessary, but for this community specifically, awareness, trust and preparedness are of utmost importance, experts say.

Due to myths and rumors surrounding the topic, many cleared individuals fear seeking mental health care because they believe it may impact their security clearance eligibility. The Defense Counterintelligence and Security Agency (DCSA) clearly states in its Mental Health and Security Clearances fact sheet that “this is not the case.” A 2017 campaign launched by DCSA has worked to destigmatize seeking mental health care. “Seeking mental health care is the most common way that adjudicators mitigate out potential psychological concerns,” said Dr. Michael Priester, clinical psychologist at DCSA. 

For those working in a national security setting, including cyber professionals, self-reliance and pride play a key role. “I think it’s hard for that group of individuals, personality speaking, to seek help in a variety of ways, and mental health notwithstanding,” Priester added. Prior to 2017, DCSA’s Standard Form 86 (SF-86) Section 21 asked broad questions regarding mental health care, which Priester recognized as a cause for concern among applicants. “I think that it, unfortunately, gave many individuals who were entering cleared service belief that somehow the government didn’t want you to seek mental health care because most of the questions on SF-86 deal with things we don’t want to see.” Refining questions to be more specific clearly made a difference. “It’s not the mental health care that we’re interested in, it’s certain behaviors of concern that might impact one's judgment or reliability.” 

Preparedness is fundamental. Cybersecurity professor Natalia Bell says that cyber students come from different groups: high school graduates; military veterans; and those who have decided to switch careers and degrees. The various backgrounds play a role in each student’s and future cyber professional’s career. For example, those with a military background may enter the cyber field with an existing post-traumatic stress disorder. Although that is not an issue on its own, it is nevertheless important to note understanding each individual and how to prepare them for a new and different high-level stress environment. “We really want to see where people are coming from because this will explain a lot of things in their career path,” Bell says.

Bell and Schaeffer agreed that a trend among those in the cyber field is that they tend to be more introverted. Schaeffer referred to a time when Myers-Briggs was a popular NSA tool to determine employee personality types. “I think 80% of NSA were ISTJ [introverted, sensing, thinking and judging],” otherwise known as reserved, practical and quiet. 

The vital issue of the adverse effects of stress in the cyber domain is the subject of a recent white paper written by members of AFCEA’s Cyber Committee, who sought to draw attention to the crisis and the need to allocate funding and attention to helping cyber warriors, said James “F.X.” Payne, the lead author of “The Danger of Cognitive Stress on Tactical Cyber Operations.” 

"I think we all have responsibilities to take this on as a mission and see what we can do to help,” to include appropriating additional funding for targeted research and interventions in this field, Payne said. He added that the committee members’ research noted that cyber professionals experience striking similarities to stress-inducing factors as do first responders: rapid decision making in an imperfect data set, danger to business and the requirement to work long hours. 

Payne noted an interesting concept to emerge from the authors’ research—the notion of leveraging the gaming culture and incorporating a “meet them where they are” approach to counseling. "If this white paper has saved one life, my mission has been accomplished," Payne said. 

In many cases, those in the cyber field will spend hours on the job, forgetting to eat or even drink water. Bell suggests finding healthy coping mechanisms that align with their passions and have nothing to do with their jobs. Physical exercises such as working out or joining a soccer team will force students and professionals to interact with others and help them feel better outside of their usual in-front-of-the-screen comfort zone. Bell, a cybersecurity professional and an educator herself, admits to reaching a breaking point while working in the industry and pursuing a PhD. “I did call for help. I’m not ashamed to say it.” 

Some universities offer free mental health resources for students, which Bell highly recommends taking full advantage of. “Particularly, for security professionals, if they start early enough [in seeking mental health care], we can prevent some of the mental health issues later on.” 

Stephen Boyce is a former information technology specialist at the National Branch of the FBI and currently works at Magnet Forensics. “I think throughout my career I’ve witnessed the evolution of mental health in the workplace,” Boyce said, recalling that mental health wasn’t too frequently discussed. Toward the end of his time at the FBI, however, he noticed a culture shift. “It became less taboo if you will … especially surrounding security clearance and mental health. There are a lot of misconceptions, and much of that has been cleared up.” 

In his current role as director for a private sector firm, Boyce applauds the mental health efforts made by his own employers. “I think they have the autonomy to do that,” he mentioned, referencing four mental health days provided to staff throughout the summer, annual graphic content training and access to services outside their health plan. Employees taking similarly scheduled days off is also beneficial. “If you take time off and the rest of the team’s on, you’re missing out and there’s this pressure, especially with cybersecurity being 24/7, that you step away and an incident happens.” For cyber professionals, stepping away voluntarily is extremely difficult, which is why “forcing folks to do that brings them back refreshed and recharged.” 

The latest announced number of cybersecurity operation vacancies surpasses 700,000. The lack of employees means additional responsibility for those in their current roles, therefore causing burnout and effectively deteriorating mental health. 

“The demand is really high for cyber professionals.” Bell also added that she sees a lot of students with intellectual differences—including those on the spectrum—looking to enter the workforce. “The workforce should be ready to receive these people and give them the environment to feel comfortable,” she noted.  

When it comes to dealing with the high-stress environment, experts shared their own experiences and recommendations. Schaeffer recollected his time as a senior at the NSA. “I used to hold quarterly roundtable discussions, and I would bring relatively new employees  from across the agency (from different groups) just to talk about challenges they were having in their office environment.” Though the meetings were not held for the announced purpose of mental health, beneath the surface it was a way to keep an open-door environment where people felt comfortable enough to share. “The job of every leader is to have that empathetic side that allows people to come and just have honest conversations,” Schaeffer added. 

DCSA’s Priester, when speaking on preparedness, also mentioned a leader’s role in positive mental health conversation reinforcement. “When we have had leaders express how they’ve dealt with their own mental health care issues and it has affected their jobs positively and not negatively, that tends to be a tremendous modeling for people to follow suit.”

Bell and Boyce suggest partaking in physical exercises such as dance or yoga. And while Boyce recommends stepping away from your electronic devices to give yourself a mental break—Microsoft has a capability that will calculate times in your calendar during which it reminds you to get up and move around—Bell encourages students to use technology for good. For example, if COVID-19 has any silver lining, it’s that virtual therapy has become more accepted and even encouraged for those who don’t have access to in-person sessions. Other technologies and apps that offer meditation tools and breathing exercises can also make a difference. 

The question “what do you do?” is quickly shrugged off with an automatic vague response by most who work in national security operations. "[My family] knew I work for the government, but they didn’t know where, and that extends into family life and those kinds of stressors,” Schaeffer noted while speaking about his first 15 years at the NSA. The inability to share an extremely limited amount of information, even with those closest, leads to isolation and stress in and outside the job. 

The Employee Assistance Program offered by federal agencies provides resources available to employees from onboarding through employment. Various other resources are also available to cyber professionals within the federal, private, public or education sectors. 

The key is to ensure that all present and future cyber professionals are aware that speaking up and seeking help will aid in the effort to prevent mental health care crises for those in cyber professions, the experts agree. 

If you or your loved one are in crisis, please dial 9-8-8 for immediate mental health assistance.