President's Commentary: The Imperative for Foundational Cyber Intelligence
As some of you know, U.S. Cyber Command has proposed significantly expanding cyber intelligence capabilities in support of cyber operations. Whatever the ultimate solution, the argument for enhancing intelligence on adversarial cyber forces is powerful and compelling and merits endorsement.
Requirements for full-spectrum cyber effects within the Defense Department—and by extension, the operations and intelligence support to achieve them—preceded Cyber Command’s establishment 12 years ago as a combatant command. The 2022 National Defense Strategy, along with more than a dozen Presidential determinations and memorandums, provides more current strategic validation. These documents provide essential guidance to functional and geographic combatant commands that are turning more frequently to cyber-domain operations to achieve military objectives below the level of armed conflict.
Air Force Brig. Gen. Matteo Martemucci, Cyber Command’s director of intelligence, briefed the proposal to AFCEA’s Cyber Committee in early November. Cyber Command envisions a center that would complement the existing science and technology intelligence centers, which include the National Air and Space Intelligence Center, Office of Naval Intelligence, National Ground Intelligence Center and the National Space Intelligence Center.
Cyber Command recognizes the challenges inherent with change and the vigorous competition with industry, academia and the rest of government to attract, train and retain cyber talent. The most vigorous debate will likely focus on the competition for scarce resources. However, the fact that more resources should be applied to cyber intelligence is probably not contentious.
While the existing organizations offer bits and pieces of cyber intelligence, they are ill equipped to provide the comprehensive data needed to fight day-to-day in the cyber domain against adversarial cyber forces. As Gen. Martemucci pointed out, our competitors—China, Russia, North Korea, Iran and a host of criminal and terrorist organizations—are creating cyber armies. The Chinese government, for example, targets our industries and organizations, including healthcare, financial services, defense contractors and other national critical infrastructure targets, as well as our Defense Department.
Meanwhile, Cyber Command reports that Cyber Mission Forces conduct more than 400 operations in adversaries’ cyberspace every month, and the command has deployed more than 600 forward operating cyber warriors to 16 countries. Additionally, our forces have operated in enemy cyber territory for more than 20 years, and hundreds of cyber operators spend tens of thousands of hours combatting our adversaries, often at risk to themselves, their families and their respective organizations.
None can question the rapidly growing importance of cyberspace to U.S. defense and national security or the burgeoning need for real-time, worldwide intelligence to support operations in this crucial arena. This expansive—and expanding—operational environment creates a high demand for tailored, all-source intelligence.
Operating forces need answers to traditional questions such as how numerous enemy cyber forces are; how rapidly they are growing; what tactics, techniques and technologies they use, what policies and procedures they follow, what networks they connect with and which networks they target.
The cyber domain is not unique in its foundational intelligence requirements, but the quantity, adaptability and agility of cyber-threat actors create new challenges. Little of the critical intelligence is as readily available today as it needs to be because intelligence support to full-spectrum cyber operations is not yet fully optimized.
While we are not sure exactly how, or if, Cyber Command’s vision may ultimately take form, we do know that intelligence support to combatant commanders is critical and that the department will strive to mature its organization and capabilities to support operations in the cyber domain.
In the meantime, we at AFCEA stand ready to play our role in fostering informed discussion on the programmatic, policy, operational or other challenges to meeting foundational cyber intelligence needs and tapping into the combined experience, wisdom and innovation of the broader community to find solutions that support mission success.
