Train Like You Fight, Even in Cyberspace

Flight Lt. Herman Pieterse, RAAF, works at a computer while Maj. Brandon Havron, USA, discusses battlefield coordination with Flight Lt. Ben Miedecke, RAAF, in 2006, inside a Combined Air Operations Center in Southwest Asia. Recently, representatives from Australia and U.S. service branches have begun training together for work in such centers. Members of the Royal Australian Air Force and the U.S. Army, as well as the U.S. Marine Corps, have attended the U.S. Air Force’s 39th Information Operation Squadron’s Information Operations Integration Course, which teaches the skills necessary to operate effectively in such centers.

Joint and coalition relationships that begin long before forces meet on the field have become a cornerstone of defense policies and officials in the military’s cybersecurity training arena are working to make sure the same holds true in the newest battlespace domain as well. Troops from the various armed forces branches already are attending education courses together, no matter which service sponsors the class, and in some cases coalition partners also are participating.

The U.S. Air Force has graduated two soldiers and a Marine from its Information Operations Integration Course (IOIC) at the 39th Information Operations Squadron (IOS). In addition, over a seven-month period, three Royal Australian Air Force officers and one enlisted student, in ranks ranging from corporal to squadron leader, attended. The class focuses on the operational level of cyberwarfare, preparing all students to work together in the joint environment. An Army chief warrant officer also went through a class under the 39th IOS, attending the undergraduate network warfare training.

Lt. Col. Brian Denman, USAF, 39th IOS commander, explains that his squadron’s school teaches courses at different levels. Some are tactical in nature and apply to jobs that are Air Force-specific; others, such as the IOIC, focus at the broader, higher level of operations. The officer explains that the integration course trains people who serve on information operations teams in air and space operations centers (AOCs). “That’s a prime place where we collaborate with our coalition partners,” Col. Denman says. He believes it makes sense for individuals from other military organizations to come to the IOIC course where they learn how to work together during real-world missions. The colonel says that cybercapabilities are in great demand, and various entities are pushing to move training forward in different ways.

Class participants mirror the personnel makeup generally found in functioning AOCs; mid- to field-grade officers and mid to senior noncommissioned officers are the main categories of students. Col. Denman explains that a staff sergeant is probably the most junior Air Force member who would attend, while the most senior likely would be a lieutenant colonel.

Though the military world increasingly relies on joint and coalition partnerships, the arrangements create certain concerns such as security. When course leaders prepare to start a class that contains coalition partners, they have to review their materials for release-related issues. The colonel explains that his organization has brought in some systems that allow it to handle coalition data more easily; on rare occasions, instructors must change what they plan to deliver. “That is by far the exception rather than the rule,” Col. Denman says, adding that they do face limitation issues, but these exist for everyone who works in a coalition environment.

While the 39th IOS runs the courses, the Air Combat Command (ACC) serves as the registrar. “All prospective students go through the ACC for course attendance,” Col. Denman explains. The integration operations course and other classes are listed in the Air Force’s security systems catalogue, so non-Air Force personnel interested in attending can choose their class based on syllabus and international agreements. The catalogue specifies who can attend what courses according to established deals among different organizations. These agreements include what information the Air Force can share with specific students. Col. Denman notes that not all countries can send students to attend every course offered.

Bringing partner-military troops into the 39th IOS courses began with senior-level dialogue regarding efforts to expand the cyber domain. Air Staff officials and other counterparts who work on international partnering agreements made a decision to open up existing courses for joint and coalition partners. However, overall, courses at the school were developed to provide specific initial or mission qualification training for Air Force positions.

Because of the main purpose of the courses, Air Force students are the prime beneficiaries of open seats in any class, and priority is given to their needs and the roles they will assume. Training officials set aside opportunities for other personnel as they are available and when there is interest. Fortunately, priority seating has yet to become an issue. “To my knowledge we’ve never turned away a request” from people representing organizations with standing training agreements in place, Col. Denman says. Usually, decisions come down to logistics regarding how to send non-Air Force personnel to the courses as they become available.

Students in the Joint Cyber Analysis Course train for six months, learning how to look at problems in cyberspace, not at specific systems. Though the U.S. Navy serves as the program executive agent for the class, participants come from every military branch, and all the services provide input into its development.

Most of the work is advanced learning that either trains supplementary skills or is specifically designated advanced training for the cybercommunity. Other categories include knowledge new to the cybercommunity or recurring training for those moving on to different missions in the cyber and information operations realms.

As the Air Force has developed the pipeline of personnel who come to work in the cybermission area, it also has been creating the classes necessary to enable troops to attend to obtain the skills they need at the right time in their careers. Col. Denman says the same paradigm holds true even from a traditional information operations standpoint. People who attend the IOIC are en route to a job at an AOC or a role at a similar level in another place. The students receive “just in time” training before moving on to their new assignments.

The effort the Air Force already has put into accommodating joint and coalition students, as well as plans to expand the mutual education, is only a small part of shared cybertraining. Col. Denman shares that his group closely partners with both the Army and the U.S. Navy in all sorts of training activities, such as planning courses for the various services’ schools. The various educators compare notes about how they run classes. Col. Denman says he coordinates with Navy trainers in Florida and Army personnel at Fort Gordon, Georgia. The Air Force sends its personnel to training courses outside of the Air Force as it deems appropriate.

To date, he also has shared experiences with counterparts in coalition training establishments, but they have not traded any courseware. Though the exchanges between countries have not yet evolved to that level, Col. Denman states they do certainly share expertise, and coalition partners are moving forward in the cybertraining space as well.

Behind all the levels of cooperation is what Col. Denman says may be an overused, but is definitely an applicable, phrase: Train like we fight. All these partners are conducting operations together, and they need to train in that capacity as well. Another significant point he highlights is the global nature of the cyber battlefield. “Risks shared by one are shared by others,” he explains. Because limits in cyberspace lack any type of traditional boundaries, groups must work together to become more secure in their operations. The courses at the 39th IOS help partners operate more effectively when they combine efforts during mission scenarios.

Another important partner in this type of battle is industry. Though the colonel knows of no plans to include private-sector students in Air Force courses, the 39th IOS does work with industry to develop the classes because of the tight coupling between industry and the military in the cyber domain.

Cyberthreats will remain a problem into the future, and Air Force officials are working to ensure that allies stay connected as well. Col. Denman says his people are collaborating with their partners at Air Staff to determine what courses might be offered in the future that could include more joint and coalition students. Other discussions center around how to create interagency information sharing. Col. Denman believes that, moving forward, more opportunities for the Air Force to work with civilian government agencies will surface.

“Partnerships really are what the course sharing is all about,” Col. Denman says. Through the joint training, students can communicate with a common lexicon, improving idea exchange. He explains that joint training gives airmen a greater appreciation for the operations of sister services and coalition nations, which results in benefits in terms of future operations. When they work together in the field, they already have a foundation of understanding. Mutual training also helps build trust among partners, forging relationships to enable the best actions in the field.

Conversations between various personnel are another benefit students in a mixed class receive. Though the IOIC is designed to address joint and coalition situations, discussions generated by the presence of non-Air Force personnel enhance the learning experience. Officials plan to continue promoting this type of dialogue and offering training in ways that make sense for everyone involved.

Another joint training course, with an even broader interservice mix, is the Joint Cyber Analysis Course (JCAC), for which the U.S. Navy serves as the program executive agent. The class begins almost every two weeks at the Center for Information Dominance Corry Station, Florida. In addition to sailors, warfighters from every branch of the military along with some civilian personnel attend, learning side by side. “We subscribe to the Department of Defense notion that you train joint when you can,” says Lt. Joseph Anderson, USN, cyber and signals intelligence branch officer. He adds that the Navy strives for as much interservice training as possible, with some exceptions that pertain to knowledge that is fleet specific.

Lt. Anderson explains that while joint training is almost always a benefit because it exposes students to more ideas and experiences, it is especially valuable for cyberoperations. “It’s not a mission that’s going to fall under the old paradigms. ... The cyberthreat is wide ranging,” he says. “It’s going to affect everyone. If we try to teach it under the old paradigm, we would be wrong.”

In the JCAC, instructors focus not on specifics, but on methods and ways to look at a problem. Instead of highlighting particular systems, students learn tools and techniques to overcome adversities. The course is not geared to a Navy mission, but rather for a national one, though differences among the service branches still exist.

For example, the Navy sends certain sailors to the course straight out of boot camp, while the other services select only experienced troops at present. Navy officials choose whom to send based on overall Armed Services Vocational Aptitude Battery, or ASVAB, score, and the score from cyber-related questions. The sea service also enrolls in the class seasoned sailors—some from technology fields, some from other jobs—who can help the new personnel learn the ways of the Navy while instructors focus on course material.

Because the Navy decides whom to send based on test scores, the JCAC is designed to take even individuals who have minimal computer experience and make them proficient in cyberanalysis within six months. Lt. Anderson says there is no guarantee who will pass; he knows a former Navy cook who went through with flying colors and programmers who failed. “It’s a very challenging course,” the officer explains, adding that everyone anticipates that level of difficulty. When students graduate, they are expected to enter directly into operations and successfully complete their missions.

In addition to the joint environment in the class, determining the curriculum is a multiservice experience. Each military branch sends a signatory to represent it to help decide how the course should develop. The individuals meet to voice concerns and ideas. “It’s a really adaptive system that allows us to respond to the changing world and the ever-evolving cyberthreat,” Lt. Anderson explains. He expects to see even more joint classes and training opportunities in the future and says officials already are looking toward the next version of the JCAC.

WEB RESOURCES
Center for Information Dominance Corry Station: https://www.netc.navy.mil/centers/ceninfodom
24th Air Force: www.24af.af.mil
Royal Australian Air Force: www.airforce.gov.au