New Military Program Aids Cyber Defenses in Latin America and the Caribbean

The 12th Air Force, known as Air Forces South (AFSOUTH), which supports and operates in the U.S. Southern Command area of responsibility along with the other U.S. military service components, is working to combat the predominance of malicious cyber threats in the region. AFSOUTH is the air component of U.S. Southern Command, led by Gen. Laura J. Richardson, USA, commander, who is focusing on integrated deterrence and expanding U.S. relationships with allies, partners, interagency, nongovernmental organizations and industry to benefit the region.

The work is part of a new beta effort AFSOUTH began almost two years ago to assist Caribbean, Central and South America partner nations and their militaries in developing cyber defenses, cyber military tactics and their cyber workforce in the face of countless nefarious cyber attacks and malicious activities. AFSOUTH is headquartered at Davis-Monthan Air Force Base in Tucson, Arizona, and has forward operations across Latin America and the Caribbean.

The numbered Air Force’s so-called A6, Col. James Hamilton, director of communication, is leading the effort that has already made inroads in cybersecurity information sharing, workforce development and cyber defense capabilities.

Thirty-one countries and 12 dependencies—such as the island of Bermuda—are part of U.S. Southern Command’s area of responsibility. Among the partner nations, each entity has differing cybersecurity needs and maturity and given the knowledge of the cyber threats to their nation, military systems and critical infrastructure, they know what they need as far as cyber defenses, Col. Hamilton explained.

“In AFSOUTH, we are solely focused on defensive cyber,” the colonel explained. “We are looking at how do we help each of the countries mature and utilize their own capabilities. Because each one of these countries is smart. They know what they need, and they have an understanding of what they want to do. We are just trying to help them as much as we can, as the United States, to get there. How can we help them get to that level of defensive capability that they want.”

Similar to what the United States and countries in Europe and around the world are facing, the cyber threats to Caribbean and Latin American nations are relentless and damaging.

For example, a wide-ranging ransomware attack during COVID-19 in November 2020 targeted Brazil’s Superior Tribunal of Justice, shutting down video conference judgment sessions and reaching encrypting case files and backup systems. “They were shut down for 26 hours, and it took 17 days and over 100 information technology professionals from multiple technology giants to achieve system recovery at an estimated $4.5 million in costs,” the colonel explained. “And that’s just in Brazil.”

In September 2023, 17 countries across the region fell victim to ransomware attacks, which targeted web hosting services by Via FX, the top service provider in Latin America, affecting some 760 companies and various hospitals. Another insidious attack in Latin America, identified by Korean intelligence officials that month, involved maliciously planted code on hardware of Chinese-made equipment. The U.S. military is seeing supply chain vulnerabilities in software, firmware and hardware of equipment from Chinese companies under the People’s Republic of China (PRC), Col. Hamilton said. Huawei ZTE and others are reported to be executing supply chain tampering across the Latin American theater, the colonel said.

SIGNAL Media reached out to the companies for comment shortly before going to press and they were not able to comment. To help partner nations, AFSOUTH prepared translated warnings and education about the supply chain risks for non-cyber professionals in the theater, through the embassies, the colonel said.

The cyber threat landscape has especially shifted in the last 18 months, Col. Hamilton stressed, given the rapid advancement of artificial intelligence, quantum and other emerging technologies that can or will be leveraged by nefarious cyber actors, including reported state-sponsored activities by the PRC. Regarding the post-quantum encryption risks, U.S. leaders have laid out a timeline to the partners for quantum-related encryption use.

The United States is also helping the countries address physical security, through the protection of their critical infrastructure. “As we have continued the dialogue with our partners, we are having critical infrastructure protections conversations more and more,” the A6 shared.

In addition, AFSOUTH relies on other tools of engagement and participation with the partner nations, including subject matter expert exchange events, Air Chiefs summits, cyber conferences and military exercises.

Joint cyber defense and cybersecurity subject matter expert exchanges provide a key way for AFSOUTH to share cyber knowledge tailored to the specific needs of the partner nations. For instance, with Brazil in April, Col. Hamilton conducted an exchange event between the Brazilian Air Force and a U.S. cyber defense subject matter expert to examine cyber threat intelligence, cyber defense center operations and cyber defense training.

In February, Col. Hamilton led another joint cyber defense and cybersecurity subject matter expert exchange, this time with Panama that included their Ministry of Security and the Panamanian Public Forces. The leaders and officials discussed cyber threat intelligence using the MITRE ATT&CK Framework that tracks adversary tactics and techniques, approaches for cyber workforce development, cyber doctrine and policy and joint task force structures and organizations.

The Colombian Air Force hosted its annual CYBERWINGS conference in December 2023, in which Air Forces South participated. The event brought in air force cyber officials from partner nations—including Argentina, Brazil, Canada, Chile, Colombia, Ecuador, Spain, Italy, Mexico, Panama and Peru. The air force officials discussed cyber policy, doctrine, procedures and standards. Colombia’s officials also showed the integration of cyber capabilities of ADL’s Digital Lab Facilities and the University de los Andes in Bogota.

“The Colombian-led CYBERWINGS conference focused on bringing regional air force cyber leaders together,” the A6 offered. “It was very well done. And what the Colombians are doing in and around their theater is advanced as well. And so, we were lucky to be able to be included in on that, to be able to partner with them to bring our perspectives and join in that discussion. They talked of course about policy, doctrine, procedures and standards. And there were several topics that we brought up, including future aspects that we need to prepare for, to include quantum capability and encryption, but also some of the planning that we need to do in preparation.”

At the end of last year, the A6 also participated in the South American Air Chiefs conference, where air chiefs from the U.S. Air Force and partner nations in South America meeting in Tucson to consider various partnership opportunities—Gen. David Allvin is the chief of the U.S. Air Force. Col. Hamilton provided the groups emerging cyber threat information and how the U.S. Air Force could provide assistance through cyber defend forward operations, led by U.S. Cyber Command.

“12th Air Force hosted the South American Air Chiefs conference, and I was one of the speakers afforded that honor, if you will, to speak to the South American air chiefs,” he stated. “They all met to discuss future partnerships, opportunities and everything. And we were talking about emerging threats, and then potentially how the Air Force can provide defensive actions through some of the defend forward operations and how they go about requesting those. There’s a specific way you have to request that if you’re one of those countries that wants their assistance.”

Another key forum for engaging with partner nations on cybersecurity is through the National Guard State Partnership Program, Col. Hamilton noted. The program is well-established with a wide global reach—for example it is sponsoring the training of Ukrainian pilots on F-16 fighter planes at U.S. Morris Air National Guard Base in Tucson, Arizona. For AFSOUTH, the National Guard State Partnership Program is key to expanding cybersecurity through already established channels.

“Air Forces South wants to nest in with that state partnership,” Col. Hamilton clarified. “Let’s say Kentucky goes down to Ecuador and they’re engaging with their partner nation. Or maybe it’s West Virginia, with their robust cyber capability. We assist ... so that we are not just doing something independently so that we can have an efficiency of resources and capabilities.”

For example, Air Forces South participated in a Kentucky Army National Guard State Partnership Program event in December in Ecuador where the Ecuadorian military and U.S. subject matter experts discussed the considerations of applying military decision-making processes to cyber operations and joint planning process. They also delved into how the military “Plan-Brief-Execute-Debrief” (PBED) process could be applied to cyber operations and communications planning. The United States has long advanced cyber defense operational methods across tactical missions, sorties and duty station operations, with the PBED process aiding effectiveness.

In addition, the A6 led a joint cyber defense and cybersecurity subject matter expert exchange with Paraguay’s Joint Cyber Command, known as DIGETIC, along with the country’s corresponding civilian cyber organization, MITIC, where they discussed cyber workforce development, cybersecurity operations and future support. The parties discussed plans for cyber-related engagements with U.S. Southern Command, Air Forces South and the Paraguayan military services and other efforts—including the National Guard State Partnership Program, Col. Hamilton reported.

“We’ve had a number of discussions with several partner countries about their workforce development, and how they train, equip and enable the capability for their cyber workforce to deliver defensive capabilities, and not just to their network, but for their overall cyber defense of the country.”

The colonel also noted how AFCEA chapter events have provided a venue for Air Forces South to increase its knowledge of cyber technologies to see applicable capabilities not only for the U.S. Air Force but also for the many partner militaries of U.S. Southern Command.

Here, Col. Hamilton emphasized how Spanish-language cyber capabilities are crucial, along with Spanish-speaking representatives who can explain the attributes of the cyber technologies and solutions.