Army Commands Transfer DODIN Cyber Defense Duties

The U.S. Army Cyber Command is transferring some of its cyber defense responsibilities for the service’s networks to the Army Network Enterprise Technology Command, commonly known as NETCOM. The change, which officially took effect on June 1, transfers authority for the Army’s worldwide regional cyber centers to NETCOM, allows Cyber Command to increase its focus on electronic warfare and information operations and provides one primary point of contact for warfighters in need of network support.

Lt. Gen. Stephen Fogarty,USA, commanding general for Army Cyber Command (ARCYBER) approved the change, which has been in the works for about two years. It began with a suggestion from former NETCOM commander Maj. Gen. John Baker, who has since retired. According to Army officials, Gen. Baker recognized that his command, which is led by a two-star general, and ARCYBER, which is led by a three-star general, had much the same focus when it came to defending the Army’s portion of the Department of Defense Operational Network (DODIN). NETCOM is now commanded by Maj. Gen. Maria Barrett, USA.

Col. Ian Tarasevitsch, USA, cyberspace operations officer, ARCYBER, indicates the change places ARCYBER headquarters squarely at the operational and strategic level of warfare while NETCOM takes responsibility for a broader array of tactical operations. “NETCOM was already doing some of that work for a significant portion of the Army’s network, but what we’ve done is that we’ve further delegated down the authorities to apply that level of control for all Army networks and delegated down the commanding general’s authority for enforcement of that as well.”

Col. Scott Bird, USA, defensive cyber operations chief, NETCOM, suggests the biggest change is NETCOM’s taking over responsibility for the service’s regional cyber operations centers located in multiple theaters around the world. “From my foxhole, the benefit of it is that now we have one very capable two-star commander, and she’s responsible for both the network service providers, in the form of the theater signal commands and theater signal brigades, and the cybersecurity service providers for those same networks in the form of the regional cyber centers.”

Having one commander in charge of both the network service providers and cybersecurity service providers creates additional efficiencies. “It increases the unity of command for both aspects of DODIN operations because … it’s not about providing the network or defending the network, it’s about balancing the risk,” Col. Bird adds. “The best way to secure a network is to not let anybody on it, but then it’s useless. And the best way to extend it to as many people as possible is to not worry about security, in which case it’s useless. Commanders have to balance both of those tasks in order to provide secure, reliable networks for the Army.”

NETCOM will also offer cyber support to more organizations within the Army, including the Army National Guard, Army Reserve Command, the Army Corps of Engineers and West Point.

Col. Shawn Carden, USA, cyberspace operations and plans officer, ARCYBER, explains that the delegation of additional authorities creates a single point of contact for signal officers in need of higher-level network support. “Really, it’s an attaboy to the Network DODIN Fusion Center that took on all these additional roles with all these additional commands because if you’re a [signal officer] out in a theater, a division, a corps, you have one-stop shopping for any problem with DODIN operations. As a former G-6 at an infantry division, NETCOM solved a lot of complex problems for me as we were deploying to Europe, and now this just allows them the opportunity to solve it for a larger audience of the Army ranging from West Point to the Army National Guard.”

The change also frees up ARCYBER to focus on parts of its mission that it previously had little time for, namely information operations, electronic warfare and support for allied networks. “Part of the recognition is that I was spending so much of my effort focused on the Army network and operations that I was not well positioned to inform the commanding general of all the other operations that he had an interest in,” Col. Tarasevitsch says. “What’s that done is to allow me to step back and focus on the broader information space as opposed to my previous focus which was mostly as a network service provider.”

His inability to focus on the information operations piece of the mission was largely because the Army Cyber Operations Integration Center originally grew out of the network operations center, he explains. “The challenge is that ARCYBER’s mission is significantly larger than that, and yet, I still ended up spending 80 to 90 percent of my time focused on the Army’s network, which left a lot of the rest of the mission space that I should have been watching competing very heavily for resources.”

The shift in responsibilities also requires a reorganization within ARCYBER itself. “We took all of the DODIN operations and all of the defensive operations that were under three or four different colonels, and we merged all of those individuals under one collective that now works for me,” Col. Carden reports. “Now I’m essentially the single point of contact within Army Cyber for network operations or defensive cyber operations.”

He adds that having all of the ARCYBER “planners” in one “planning shop” enhances efficiency for defensive cyber operations (DCO) as well. “In the past, I owned the DCO planners, and we would plan DCO operations, but we didn’t really plan the exercises. So when it came time to deconflict resources, we would have to come together within those two different organizations. By putting all those planners together now, they understand where the resources are and what they’re allocated. If an exercise requires other DCO operations, we don’t have to form an operational planning team or working group to solve that.”

In some cases, Army signal officers will find themselves training to acquire new skills. “We’re going to take signal officers that have been focused on network operations, and we’re going to open their minds to cyber electromagnetic activities, electronic warfare and information operations and use them in those roles. It’s going to be a fun experiment. I’m looking forward to it,” Col. Carden says.

While there are some challenges associated with the shift, the officials report that it seems to be working well so far. They intend to meet every 90 days to reassess and adjust as necessary. “As NETCOM continues to go build and go through some of the things they haven’t had to do to this scale in a while, we’re still with them in that left seat ride guiding them along and assisting. If they can’t support something, we’re definitely picking it up,” Col. Carden states.

For more news on Army cyber and signal corps operations, follow coverage of the AFCEA Army Signal Conference July 14-16.