It's time to found a U.S. Cyber Force.
- By James StavridisJames Stavridis is a retired four-star U.S. Navy admiral and NATO supreme allied commander who serves today as the dean of the Fletcher School of Law and Diplomacy at Tufts University.
Throughout the long decades of my military career, the backbone of U.S. national security was the "strategic triad" of delivery systems for nuclear weapons: ballistic-missile submarines and their associated nuclear-tipped missiles, land-based intercontinental ballistic missiles operated from silos deep in the earth, and long-range manned bombers, which could deliver nuclear bombs and eventually nuclear-tipped cruise missiles.
America’s reliance on this Cold War triad continues through the present day, though the systems have changed somewhat as a result of both advances in technology and changes in treaty limits, most recently reflected in the New START treaty.
As we sail more deeply into the turbulent 21st century, however, there is another triad that bears considering that will be a critical part of U.S. security in the decades to come. This new triad will be far less abstract and hidden-away than the Cold War strategic triad and much more frequently employed — often in kinetic ways.
This "New Triad" consists of special operations forces, unmanned vehicles, and cybercapabilities. Each has an important individual role to play, but taken together, the sum of their impacts will be far greater than that of each of the parts when used alone.
First, consider special operations forces, or SOF. They have become a tool of choice in a wide variety of actions in today’s world, from the spectacular mission that finally killed Osama bin Laden to training African partners to thwart the brutal Lord’s Resistance Army in Africa, and from helping Colombian forces fight the FARC insurgency in Latin America to providing security for disaster relief operations in Pakistan.
Today’s SOF are capable of operating across the entire spectrum of operations, from soft power and training to the ultimate "red dots on foreheads" missions epitomized by the killing of bin Laden and popularized by film and television.
Because they are trained in languages, cultural mores, high-tech communications, medicine, concealment, and many other discrete skills, they can operate in the widest imaginable variety of geographical settings. They are also small in number, highly motivated, and relatively cost-effective. They are generally precision-guided in their approach, can limit collateral damage, and blend in when needed.
The second capability in the New Triad is unmanned vehicles and sensors. This branch of the triad includes not only the airborne attack "drones" that are endlessly debated at the moment, but unmanned surveillance vehicles in the air, on the ground, and on the ocean’s surface. They also operate at depth in the world’s oceans, both in the water column and on the ocean’s floor. For example, the use of "underwater drones" might someday allow attacks on enemy shipping or ports, as well as the exploitation of underwater fiber-optic cables deep on the ocean floor. This could one day provide a rich environment for intelligence collection, "blinding" communication pathways, and the conduct of cyberoperations.
While expensive, such systems have the obvious advantage of not requiring the most costly component of all: people. Also, without people operating them, they can perform in far harsher environments and hold a higher degree of political deniability for covert and clandestine operations. And they are highly accurate, are largely networked together via overhead systems, and can provide direct feeds to conventional and special operations forces.
Finally, and potentially most powerfully, there is the world of offensive cybercapability that is just beginning to emerge. This part of the New Triad has the potential to operate with devastating effect, possibly able to paralyze an opponent’s electric grid, transportation network, financial centers, energy supplies, and the like.
Cybersystems can also collect information and intelligence, manipulate enemy navigation and operational systems, and perform in clandestine and unattributable ways. Although expensive to design and create, they become quite cost-effective to operate over time.
Several points emerge as we consider the potential of this New Triad.
First, these are all key investment areas for creating security. A dollar spent in these three segments is generally more efficient and — most importantly — has a vastly higher chance of being put to use than many other defense investments, including strategic nuclear ones. There is simply no serious question that we will be repeatedly using the components of the New Triad "early and often" as the coming decades unfold.
Second, the Defense Department needs to think through how each of these parts of the New Triad will be managed in the procurement, oversight, personnel, and operational senses. For example, it is probably time to consolidate the myriad cyberforces owned and operated by the separate services and other parts of the Defense Department and merge them into a single organization, much as was done with today’s U.S. Special Operations Command in Tampa, Florida.
Today, each of the military services, the Defense Intelligence Agency, the National Security Agency, the National Reconnaissance Office, and each of the combatant commands (Pacific Command, European Command, Central Command, etc.) have significant cyber-efforts under way. We need to consolidate them significantly to achieve unity of effort. This means their procurement, command/control, acquisition, and manning will gradually come under a single commander, probably the newly created Cyber Command, headed at present by Gen. Keith Alexander.
Frankly, putting the military side of the nation’s cybercapability under Cyber Command is at best an interim solution. Ultimately, we need to create a separate cyberservice, just as we have an Army, Navy, Marine Corps, Air Force, and Coast Guard. Just as we finally grasped that the skies were a new domain and created the U.S. Air Force over 60 years ago, it will soon be time to see that cyber is, in fact, a permanent new domain that requires a U.S. Cyber Force. Beginning now to think seriously about this will be part of the implementation of the New Triad.
And let’s face it: A new cyberservice will need more than a new style of uniform. It will probably need, for example, a very different personnel system. The type of young woman or man who is deeply engaged in the world of cyber probably isn’t looking for a "high and tight" haircut, eight weeks of boot camp, and a long, slow crawl up a largely seniority-based system for promotion. A U.S. Cyber Force will require a large civilian component and will need to be instinctively oriented toward working with the interagency process and the private sector — not baseline competencies in today’s Defense Department, despite some improvement over the past decade.
Third, we should be actively exploring how to create synergies between the branches of this New Triad. We are, of course, already doing so in an ad hoc way. But as the capabilities of each branch expand, there needs to be a conscious effort, overseen by the Pentagon’s top brass. In a well-meaning way, each of the services will try to retain as much control as they can over all three of these capabilities — but if we are to realize the power of combining them operationally, we will need to rise above individual service priorities. We have done this somewhat in the world of special forces, but we need to move further in this direction.
Fourth, our research and development teams, especially the Defense Advanced Research Projects Agency and the other laboratories in the department, should work together on the abilities of all three of these areas to enhance them individually and, more importantly, to think about how they can be fused effectively. For example, a project that connects offensive cybersoftware with insertion via special operations or drones would probably be highly useful.
Fifth, the component commanders — both geographical and functional — should consider how to draw on the capabilities of the New Triad in their area of responsibility. How can U.S. Transportation Command use unmanned vehicles in delivery systems? What does U.S. Special Operations Command do to use cyber- and unmanned vehicles? In Europe, a highly cyber-oriented part of the world, does U.S. European Command support Cyber Command in convening expert civilian panels to discuss private-public collaboration? At each of the commands, there will be ways these capabilities can be employed both singly and together, both unilaterally and in concert with allies and partners. Learning how to fit them together will be an important operational task, the surface of which we are only just beginning to scratch.
Sixth, the policy and defense intellectual community needs to think through the strategic impact of these systems. The current beginnings of a debate about offensive cyberoperations are a good example. Is there a "deterrent theory" that will apply to cyber as it does to nuclear forces? In the world of unmanned vehicles, the legalities and norms related to so-called "targeted killings" will need to be established. Special forces are a more mature domain in this regard, but to the degree that they are used in conjunction with the other two legs of the New Triad, policy questions concerning their use on clandestine and covert missions should be fully considered.
Finally, we must get the interagency balance right in operating this New Triad. All three of its elements — and especially cyber — will be tools for the Department of Homeland Security, the CIA, and other interagency actors. Competition among the departments and agencies for a limited pool of talented cyberpersonnel is already intense. Balancing the civilian and military sides of all three capabilities will be crucial to their most efficient procurement and use over time.
None of this is to say that the traditional nuclear triad is no longer relevant or important, or that conventional forces — from aircraft carriers to tanks to advanced fighters to infantry battalions — won’t be useful tools of U.S. security policy. But it seems increasingly clear that the capabilities represented by the New Triad will be frequently used indeed, and we need to spend more time and resources ensuring that they are ready for the inevitable and frequent calls for fire that they will continue to receive.