What Does the Future Hold for Jack Voltaic Cyber Exercise?

With Congressional funding having run out for the Jack Voltaic critical infrastructure cybersecurity exercise, which has provided insights and affected the Army operations manual, Army Cyber Institute (ACI) leaders seek ways to continue the work, spread the benefits and make the lessons learned a way of life.

Because effects of a major cyber attack on critical infrastructure would likely be felt first at the local level, the exercise takes a “bottom-up approach to critical infrastructure resilience that informs our understanding of existing cybersecurity capabilities and identifies gaps,” according to ACI documentation. The exercise explores the interdependencies, roles and responsibilities among military installations and cities, which often share critical infrastructure.

The 2018 exercise, Jack Voltaic 2.0, garnered widespread attention, including with AFCEA leadership and SIGNAL Magazine. Hosted by the city of Houston, the event provided participants with a full view of potential critical infrastructure crises while also offering a path to security and resiliency and exposed critical infrastructure issues to 200 participants from 44 organizations.

Lessons learned included:

• Current frameworks are inadequate to meet the growing threat to urban communities. 
• The U.S. military and its allies depend on civil and commercial infrastructure, and its vulnerabilities are the military’s vulnerabilities.
• The National Guard plays an important role in physica security and development of cybersecurity capabilities.
• States should develop, fund and implement statewide incident response campaigns.
• Policy and legal authorities at federal and state levels do not sufficiently empower cities to respond to cyber incidents.
• The private sector is uniquely positioned to inform, develo and provide its own solutions.

The tabletop exercise has been conducted in multiple cities, including New York City, Houston, Savannah, Georgia, and Richmond, Virginia. The most recent allowed participants to explore response plans, “particularly when military force projection operations have to flow through some of these important cities,” Lt. Col. Jason Brown, director of the ACI’s Cyber Law and Policy Division, told SIGNAL Media. Questions that were explored included what happens when a city critical to a military force deployment gets hit by ransomware or when a natural disaster in a city coincides with a cyber attack, “buckling the city’s knees.”

Col. Brown recalled last year’s reported ransomware attack on the city of Augusta, Georgia. Russia’s criminal BlackByte group claimed responsibility and released gigabytes of data it claimed to have stolen from the city. “It was just the recognition that the military base has an obligation to at least have a relationship with the cities that are outside the gates because of the dependencies,” Col. Brown offered.

Congress has provided funding to the institute for Jack Voltaic research and projects, some of which have been awarded as grants to universities. For example, Indiana University received a grant to develop a library of videos, training modules and coursework to inform users about critical infrastructure protection and resiliency, especially regarding cybersecurity. Also, the Rochester Institute of Technology is developing a video game and a tabletop game that allow users to play different roles—a mayor, police chief or a public works official, for example—and work through the problems and critical infrastructure issues during a cyber attack.

Meanwhile, Norwich University has developed a platform called Decide, an exercise management tool that allows tabletop exercises, and Stanford University has been conducting interviews to research Army bases resilience and dependence on nearby civilian infrastructure.

“We’ve provided some grants and contracts to help federate education, to help develop tools and training modules. Army customers can come and talk about critical infrastructure protection as a force protection mechanism, or universities and cities can have access to the training materials, and if they wanted to, create their own tabletop exercise,” Col. Brown offered.

He reported that the Congressional funding for this year has run out, prompting the ACI to determine how to continue to educate and inform Army customers and the municipalities that surround Army bases. “We’re still trying to adjust our intent for the Jack Voltaic research over the next five years or so. That’s an ongoing project because the congressional money ran out for this year. So, we’re done with it.”

The colonel noted that some of the findings from Jack Voltaic have influenced the Army’s field manual for operations known as FM 3-0 and said ACI leaders continue to examine the strategy for the exercises. “We had a meeting this week to reshape our Jack Voltaic strategy and where we want to take it, how we want to continue to give it a heartbeat, so that our work doesn’t just disappear behind websites that are not updated, and where we can continue to have the conversations,” he said. “Because it, frankly, is an extremely important bit of research and findings and it’s also kind of a way of thinking. That’s what we’re trying to do next is push Jack Voltaic into a way of thinking just like we have multidomain operations now as a way of thinking within Army doctrine.”

He explained that critical infrastructure protection could become as integral to Army doctrine as force protection. “We have military police every year who do active shooter drills and exercises on base, and we have these gate guards because physical force protection is just a way of life. I think our goal is to really push for Jack Voltaic as a way of life, a standard way of thinking, not just a tabletop exercise by that name.”

The next steps, he said, involve asking a lot of hard questions, along with networking and relationship building, especially military and civil government relationships. “It’s about connecting organizations who may have some money,” he suggested. Remaining challenges include getting communities to seek related government grants, continuing dialogues between the military bases and municipalities and getting everyone to use the same language about smart grids and smart cities, he indicated.

The ACI is now looking for others to help carry on the work. The institute could teach others how to conduct tabletop exercises and share training, education, tools and lessons learned. “We’d love to be able to have an advocate who is willing to do this on a more regular basis and a more robust basis across both U.S. internal bases and camps and also foreign ones,” Col. Brown said.

U.S. Army North, which supports U.S. Northern Command in defending the homeland and the North American theater and supports civil authorities, could play a significant role. ACI officials have held conversations with Army North about the possibility. “The care and feeding of Jack Voltaic needs to be in more places than just the ACI. We need to find more people who think about it the same way we do, who have the same passion that we do,” he added.

The Homeland Security Department, specifically the Cybersecurity and Infrastructure Security Agency (CISA), is another possibility. “We have reached out with CISA. They have an exercise branch, and they have some other folks within CISA that we have talked to,” the colonel revealed. “Right now, they’re at max capacity looking at other variants of their mission.”

But that possibility presents some challenges regarding roles and authorities. “We think there’s a lot of overlap with CISA, but an Army research institute is probably not the right national- level kind of organization to interface on a regular basis with CISA,” he said. “We would love to be in the room. But there’s some politics and authorities. There’s some funding things that have to be solved and worked through for this space between the military responsibility, and then the DHS and the civilian responsibility.”

Universities and nonprofit organizations offer another possibility. “Love it. Love it. We do have several universities that we’ve worked very closely with. There are people that are asking the right questions from us, and we’re providing them the best answers that we have available to us with the resources that we do have,” Col. Brown stated.

In the near term, Jack Voltaic’s future likely will involve a reassessment of stakeholders and possibly an exercise closer to the ACI’s home at the U.S. Military Academy West Point, which is located next to the city of West Point, New York. “There’s one community that is right next to West Point. The gate touches the city. And there’s several other small communities that many people commute from, 15-minute or 20-minute drives, and we haven’t yet even exercised with these folks that are right outside our window,” Col. Brown pointed out, suggesting that if the local communities are open to working with the ACI, the West Point installation itself might become more secure and resilient.

And then in the fall, the ACI may host a workshop with its partners. “I think we’re going to bring in many of our university and contracted partners who have been working with us for the last year, and we’re going to talk about some of the lessons learned over developing each of the different products and interoperabilities.”