October 2018

Fight Tonight in the Cyber Domain

Three recommendations senior leadership can adopt today
Volume 102, Issue 10
We can do a better job of aligning civilian experience and training with our cyber requirements and MOSs.
Cpl Holly Pernell

The Marine Corps requires new capabilities and added capacity to “fight tonight” in the cyber domain, especially at the tactical level. In January 2016, our Commandant issued FRAGO 01/2016: [i Advance to Contact, which ended with “Let’s Go!” However, our organization reliance on linear, top-down processes such as the Joint Capabilities Integration and Development System and the related analysis of doctrine, organization, training, materiel, leadership and education, personnel facilities, and policy makes it difficult to adapt to emerging threats. Meanwhile, our adversaries have adopted cutting-edge tools available on the commercial market to rapidly advance cyber exploitation capabilities (e.g., hacking, jamming, and tracking). During July of this year, our Commandant decided to accelerate the fielding of the Selected Marine Corps Reserve (SMCR) Defensive Cyberspace Operations-Interna Defensive Measures (DCO-IDM) concept; however, now, we need to make it a reality.

This is a call to action. The Marine Corps should address our tactical cyber vulnerabilities today and to this end, leverage cybersecurity talent found in the Reserve Component (RC) to provide new capabilities and added capacity to our total cyber force. This approach goes beyond using Reserve talent to fill gaps in the Active Component (AC). The RC has valuable skills and experience found among a growing number o Reservists who work in cyber roles for hundreds of civilian employers. Oftentimes, these Marines posses unique expertise for which there will never be a military school. By effectively integrating the Reserve with AC cyber forces, the Marine Corps will be better prepared to exercise maneuver warfare in cyberspace and execute full-spectrum cyber operations against highly adaptive, motivated, sophisticated, and well-resourced adversaries. To address our cyber capability gaps and capacity shortfalls, the Marine Corp should expand current efforts to fast-track the creation of SMCR DCO-IDM companies, establish competency-based MOS certification path for Reservists with qualifying civilian experience, and develop fully integrated training programs for AC/RC cyber Marines.

Fast-Track SMCR DCO-IDM Companies

DCO-IDM companies will eventually exist within each MEF Information Group (MIG) to defend critical digital assets at the tactical level. MIGs will lead the planning, integration, and execution of information warfare into the single battle. According to an II MEF press release.

the DCO-IDM Company will perform a variety of capabilities which include missio assurance actions actively hunting for advanced persistent threats that evade routine security measures. The company will dynamically reestablish, re-secure, reroute, reconstitute, or isolate degraded or compromised local network in response to attack, exploitation, intrusion, or effects of malware on the Department of Defense Interna Network or other assets they are directed to defend. The company will support active cyber defense t proactively defend against anticipated attacks in cyberspace.[superscript]1[/superscript.

Our first DCO-IDM company formed in July in support of the II MEF MIG.

Information-related weapons are increasingly common and lethal on the battlefield. For example, in 2007 the Israelis conducted Operation ORCHARD, which employed cyber capabilities and electronic attack t suppress an enemy air defense network in order to destroy a suspected nuclear facility.[superscript 2[/superscript]More recently, in Ukraine, Russia employed electronic warfare to target Ukrainian formations using long-range fires. Russian information operations continue to manipulate public opinions an affect the operational environment.[superscript]3[/superscript] Going forward, the Marine Corps mus understand how new technologies, such as artificial intelligence, machine learning, autonomous systems robotics, electronic warfare, cyber warfare, the Internet, and social media, will impact our need for cyberspace capabilities. With respect to defense, the demand signal is clear: we need more.

Marine Forces Cyberspace Command (MARFORCYBER) operates several highly skilled cyber protection teams to defend the Marine Corps Enterprise Network. However, these teams do not provide dedicated protection for each MEF and its subordinate tactical units. Additionally, in the event of a geographic or functional combatant commander’s request for forces, United States Cyber Command may direct MARFORCYBER to reassign any and all cyber protection teams to support competing joint force requirements. To successfully operate in a contested cyber environment, the Marine Corps will rely on the emerging DCO-IDM companies. I addition to the AC DCO-IDM companies assigned to each communications battalion, the RC will establish two DCO-IDM companies (East Coast and West Coast). Demonstrating the importance of establishing a surge capacity within the RC in short order, the Commandant recently approved accelerating the creation of the related SMC DCO-IDM force structure by one year. While establishing RC DCO-IDM companies in fiscal year 2020 vice 2021 is a step in the right direction, the Marine Corps needs to take further action to attract the most qualified RC Marines and equip them with the same DCO weapons system planned for the AC teams.

To ensure the SMCR DCO-IDM companies are ready to fight tonight, we must take the following actions:

  • Authorize the immediate creation of 30 funded billets for allocation to qualified R Marine prepared to assist with developing an immediate operational capability
  • Identify personnel within Manpower and Reserve Affairs who are authorized to assist with various administrative issues that would delay assignment to an SMCR DCO-IDM billet (e.g., reenlistment, medical waivers, Reserve commissioning of separated officers, etc.)
  • Establish a program of record for the proposed DCO-IDM weapons system, thereby permitting the use of the National Guard and Reserve Equipment Appropriation to purchase required technical capabilities fo SMCR DCO-IDM companies

Establish a Competency-Based MOS Certification for RC

To address our cyber capability gaps and capacity shortfalls, the Marine Corps should establish competency-based MOS certification path for Reservists with qualifying civilian experience in the near term Today there are not enough RC Marines with a relevant MOS (e.g., communications or intelligence) to fill the proposed SMCR DCO-IDM structure. The Marine Corps must be willing to accept Marines who lack a formal MO but have developed the required experience through civilian employment, formal academic education, or both RC Marines offer valuable experience, rare skills, and/or systems knowledge for which there will never be a military school. Some employ the latest tools and techniques used by leading technology companies such as Amazon, Google, Facebook, and Microsoft. Some work in industries such as transportation, energy, telecom banking, health, or logistics. (See common job titles in Table 1.)

Table 1.

If the Marine Corps has a supply officer who works as a software engineer in his civilian employment, then we ought to be flexible enough to recognize that Reservist’s special skills and employ him in that capacity, contributing to the Marine Corps’ cyber total force. In the future, the Marine Corps will need to optimize recruiting at the high school and collegiate levels, identifying civilian skills using “skill tags” similar to LinkedIn and matching “troops to task” as Marines advance through RC units.

Once a new MOS certification path is proven successful, the same process could apply to A Marines wh developed cyber skills during high school or college and have an interest in a lateral move to the newly established cyber space operations occupational field (17XX).

Integrate Training for AC/RC Cyber Marines

Assembling a group of RC Marines with civilian cyber experience is not sufficient to create the integrated AC/RC capability we seek to achieve. RC DCO-IDM teams must participate in integrated training with A DCO-IDM teams to ensure the development of consistent methodologies and proficiency with Marine Corp standard defensive cyberspace capabilities. Beyond consistency and interoperability, the proposed integrate training will permit the identification of unique capability gaps such as supervisory control and data acquisition systems used extensively within manufacturing environments, which the RC could address through the creation of sub-element teams comprised of cyber Marines who perform similar functions in their civilian employment. During this critical period of development, any exercise that includes an AC or RC DCO-ID company should include both. At the very least, a sub-element team or liaison should participate to promote knowledge sharing across the cyber total force.

To ensure the SMCR DCO-IDM companies are ready to fight tonight, we must take the following actions:

  • Embrace the principles of a learning organization by allowing AC/RC DCO-IDM companies to share expertise, training materials, and custom tool sets
  • Provide opportunities for SMCR DCO-IDM units to send four- to six-person teams to work alongside AC teams during large-scale exercises
  • Allocate a proportional number of formal school seats to SMCR DCO-IDM personnel.

Fight Tonight in the Cyber Domain

The MFR G-9 currently has fifteen Marines on deck, which will become the leadership nucleus of the SMC DCO-IDM companies. An additional fifteen Marines will be added in fiscal year 2019, to build out the initial platoons and serve as a bridging function until the SMCR structure is in place for their initial operational capability in fiscal year 2020. Recognizing that much work lies ahead, the G-9 seizes every opportunity to identify qualified Marines to become a part of this new endeavor.

Conclusion

We are on the right path but need to do more to fast-track the creation of SMCR DCO-ID companies. A heavy emphasis on recruiting talented Marines is needed over the next several years. To address our cyber capability gaps and capacity shortfalls, the Marine Corps needs to establish the proposed competency-base MOS certification path for Reservists who have qualifying civilian experience. We need to get these R Marines into the fight today! Furthermore, RC DCO-IDM companies must participate in integrated training with their AC DCO-IDM companies to ensure consistency with Marine Corps standard defensive cyberspace capabilities. Anything less will render our tactical units highly vulnerable for several years to come as adaptive adversaries will continue to exploit our organizational and technical vulnerabilities.

Notes

>Authors’ Note: MFR G-9 advises the Commander, MFR, on difficult, near-term challenges such as establishing an operational cyberspace capability in the Reserve Component, and develop corresponding implementation plans

1. “DCO-IDM Activation of Command Ceremony,” Defense Visual Information Distribution Service, (Online: 16 July 2018), available at https://www.dvidshub.net

2. Department of Defense, “17xx Cyber Occupational Field Update,” (Washington, DC: 1 Jul 2018)

3. Ibid.

MFR G-9 advises the Commander, MFR, on difficult, near-term challenges such as establishing an operational cyberspace capability in the Reserve Component, and develops corresponding implementation plans.