A Quest for Answers on Army Expeditionary Cyber Teams

For three years, the U.S. Army has been asking questions about how to converge cyberspace operations, electronic warfare and spectrum management capabilities at the corps level and below to deny, degrade, destroy and manipulate enemy capabilities. Now, officials say, they are drawing closer to answers.

In 2015, the service created a pilot program known as Cyberspace Electromagnetic Activity (CEMA) Support to Corps and Below. The CEMA concept integrates elements from offensive and defensive cyber, electronic warfare, and intelligence into expeditionary teams that support tactical units.

Because the program is new for the Army, officials are using a series of exercises and experiments at the Army National Training Center, Fort Irwin, California, and at the Joint Readiness Training Center, Fort Polk, Louisiana, to help answer an array of questions about force structure; tactics, techniques and procedures; and technological capabilities. They are doing so largely by deploying CEMA teams to support brigade combat teams during training rotations.

The Army also has begun deploying a CEMA team to Cyber Blitz, which removes some barriers to cyber experimentation. The most recent Cyber Blitz took place in September. The service is processing lessons learned, but officials say they believe that Cyber Blitz will help deliver the answers they seek. “We came out last year and provided the cyber forces to facilitate last year’s experiment, and it was very helpful to us,” says CW4 Justin Cecil, USA, who works with Army Cyber Command. “It really allows us to get after some of the questions we’ve been trying to tackle since we started the pilot.”

Those questions include which personnel and capabilities should be provided at corps and below, when and how the CEMA team should be integrated into the combat unit, what the team’s mission-essential task list should be, and what processes they should use before, during and after deployment. “This experiment is going to get us a lot closer,” says the chief warrant officer. “We’re trying to test concepts that there’s really no doctrine for.”

Richard Wittstruck, associate director for field-based experimentation and integration with the Space and Terrestrial Communications Directorate, Communications-Electronics Research, Development and Engineering Center (CERDEC), also indicates that the service is making progress. “This year, we’re taking that next step. We’ve assigned our CEMA doctrine. We start to integrate with our maneuver doctrine. Now, we need to start fleshing out how this all enables information warfare,” Wittstruck offers.

One reason Cyber Blitz is so helpful is that the tactical units participating are not being graded. As a result, Army officials have more freedom and flexibility to experiment. During more traditional training exercises, the units have specific goals they must meet, which curbs experimentation in the cyber realm. “In the other training environments, we were limited with what we could do. A lot of the things we want to get after we can’t because it doesn’t line up with the brigade combat team’s training objectives,” Chief Cecil elaborates.

CW2 James Gill, USA, who works with the Cyber Center of Excellence, echoes that point. “The National Training Center is the crown jewel of Army training. However, the training there does not always lend itself completely to the cyberspace training,” Chief Gill says. “This is so new, we have to have another venue so that we can really get all of these cyberspace operators and electronic warfare operators together with the maneuver folks, with the commanders, with the staff to talk through how they would integrate into maneuver operations. Cyber Blitz provides that.”

Army officials point out that the various exercises and experiments build on one another. “There is an integrated campaign plan the Army is executing, and it starts with events like Cyber Quest, where the schoolhouse is encouraging both insourced and outsourced, traditional and nontraditional technology candidates to come in and help the Cyber Center of Excellence determine how to inform requirements for future doctrine in CEMA,” Wittstruck says.

Cyber Blitz, for example, incorporates technologies and lessons learned from Cyber Quest and other events. Organizations such as Special Operations Command, U.S. Army Europe and U.S. Army Pacific also include lessons learned in their training exercises. “There really is a connective tissue with the integrated campaign plan. Sometimes it’s hard to follow from the outside because there are so many moving parts,” Wittstruck says.

Among the lessons learned so far: Speed of cyber is more than just a buzz phrase. “Speed matters,” Wittstruck notes, especially when decisions must be made in milliseconds or microseconds. “That means a lot of automation, if not semi-automation, to work some of these issues in CEMA.”

Capt. Adam Schinder, USA, who commands an Expeditionary Cyber Support Detachment (ECSD) with the 780th Military Intelligence Brigade (Cyber), 782nd Military Intelligence Battalion (Cyber Legion), Fort Gordon, Georgia, says it is clear from the experiments and exercises his team has been involved in that CEMA teams provide critical benefits to commanders. “When you have these additional disciplines, you can provide so many more options to a commander,” Capt. Schinder states.

On the defensive side, for example, CEMA team members can “fortify the network, provide additional sensors, and capture and mitigate enemy activity on the network.” They can provide the additional “capability of refining their risk mitigation plan” and “conducting a really advanced information assurance validation” and can “conduct full-spectrum information operations,” the captain adds.

“It’s all about cross-warfighting function synchronization. I bring the offensive cyberspace operations edge to the expeditionary CEMA team, and it enables us to conduct other kinds of synchronized operations across the other disciplines. We are each other’s combat multiplier,” Capt. Schinder explains. “We plug into [maneuver units], and we help generate those options for the commander and synchronize the effects.”

The commander also emphasizes the need for remote operations in the cyber realm. “We do know we want to leverage remote operations. Leveraging the great enterprise of the cyber mission forces really is a key lesson learned,” he asserts.

It is not yet clear exactly what capabilities CEMA teams will provide and what tactical units will need to request from higher echelons. Capt. Schinder notes that with intelligence, surveillance and reconnaissance assets, tactical units will control some, while others, such as large unmanned aerial vehicles, must be requested from higher headquarters. Similarly, the Army must define which units control which CEMA assets. “Figuring out what kinds of things should be pushed to this level is kind of an ongoing thing,” he says.

The captain says he hopes the CEMA teams will ultimately be able to write computer code as needed. For now, that ability rests mostly within the larger cyber mission force, but Capt. Schinder says his team can “get something together to achieve dimension” when necessary. “We do it all the time. I wouldn’t say it is a primary function of the Expeditionary Cyber Support Detachment per se. We’re really looking forward to the future—as this program grows—having personnel dedicated to doing that sort of thing. But I couldn’t really answer to what that’s going to look like.”

Capt. Schinder has worked with commanders from an array of maneuver units, including infantry, armor and Stryker brigade combat teams, as well as Ranger regiments. So far, he reports, those commanders have welcomed the expeditionary cyber elements. “Certainly, some commanders are more skeptical than others, but I’ve experienced far more openness and eagerness to learn than I have any kind of animosity or skepticism,” the captain says.

He said it is really up to him and his team to explain to commanders during initial briefings what capabilities they offer. “We’ve been re-engineering and re-engineering and re-engineering that brief and those comments. Every exercise has a slightly different tweak as to how I present the information,” he elaborates.

Capt. Schinder, who started his Army career as an armor officer before transitioning to the cyber career field, stresses that the CEMA Support to Corps and Below program has kept his team extraordinarily busy. “It’s been a heck of a lot of work. I sometimes wonder if I’m busier now than I was as a tank platoon leader, or a mortar platoon leader,” he says. “I think everyone involved in the program wants to see it outfitted with more soldiers and more equipment, and moving on to bigger and better things. There’s a large appetite for this.”