By U.S. Army Cyber CommandJune 14, 2016
FORT BELVOIR, Va. -- U.S. Army Cyber Command and Second Army is at the heart of efforts to develop how the Army will maneuver and fight in the cyber domain, efforts that are evolving rapidly as ARCYBER helps to train the 1st Armored Brigade Combat Team, 1st Infantry Division.
The ongoing ARCYBER-led Cyber Support to Corps and Below pilot program continues to be a cornerstone in the Army's development of operational cyberspace capabilities.
The pilot, launched early last year, is helping the Army define every facet of cyber operations at the tactical level. Under the CSCB program, cyber experts have partnered with maneuver units to develop, test and make recommendations to Army leadership about everything from how units will be manned, trained and equipped for cyber, to perfecting tactics and techniques, to developing plans, policies and doctrine.
CSCB efforts have focused primarily on figuring out cyber at the brigade combat team level, working with units at home station and major training events at the National Training Center and Joint Readiness Training Center to simultaneously improve those units' cyber posture and defense and build a framework for future Army cyberspace operations. Over the past few months the program has centered primarily on 1st Armored Brigade Combat Team, 1st Infantry Division, following earlier iterations with brigades under the 2nd and 25th Infantry Divisions and 82nd Airborne Division.
Perhaps the most significant development in the CSCB program is the evolution of Cyber Electromagnetic Activities and the integration of cyber and electronic warfare capabilities.
What was known as an Expeditionary Cyber Team just months ago is now an Expeditionary CEMA Team that pulls together elements of offensive and defensive cyber, electronic warfare, military intelligence, information operations and network operations.
In support of the 1st ABCT and the CSCB pilot an ECT comprised of personnel from Army cyber units, 1st Information Operations Command, the Army Cyber School and the 504th Expeditionary Military Intelligence Brigade has taken part in brigade situational training exercises; provided planning support to brigade field exercises; and will participate in the brigade's Army Leader's Cyberspace Operations Course training in late June. Elements of the team will also conduct validation training at the NTC at Fort Irwin, Calif., prior to participating in 1st ABCT's rotation there in late July and early August, explained Maj. Luis Gaytan, the team's officer-in-charge. Thus the CEMA Team is integral to both the 1st ABCT's readiness and the Army's development of CEMA operations as a whole.
The brigade's situational training exercises in late April and early May provide a good example of how an ECT currently operates. During STX the ECT conducted coordinated offensive cyberspace and electronic warfare operations to provide situational awareness and enable and challenge the brigade's decisive action, while also defending the unit's networks by employing active reconnaissance and force protection measures. At the same time the exercise helped to integrate the team into the 1st ABCT's operations and planning before the brigade heads to NTC.
Meshing the cyber, IO and EW perspectives for the NTC rotation creates "layered effects" that will add greater realism to challenge the brigade and help it to meet its overall training objectives, Gaytan said.
Capt. Lisa Toney from the Army Space and Missile Defense Command took part in the STX training as officer-in-charge of the Space Home Station Training Team. Toney said her team enabled the training by providing instruction in concert with the 1st ABCT operations staff to help brigade Soldiers to understand normal and contested space environments, space-enabled equipment and space operations. Operating alongside a cyber team, the SHST also supported the STX training by executing electronic warfare effects and providing space situational awareness and ways to use space assets to mitigate enemy attack.
"The Soldiers appreciated how our training team related the training to electronic warfare officer operations and how they can best support their brigade," she said.
Partnering with the cyber team is a "wonderful, powerful" way for both elements to discuss capabilities and share operational effects, she added, and helps to mitigate cyber attacks on space systems.
"This is a great experience for our future evolution as we increase our training and the complexity of our information technology capabilities," she said. "The growing concern over cyber threats has made us focus more intently on mission resilience."
Before the 1st ABCT deploys from Kansas to Fort Irwin, members of its CEMA staff and working groups -- including intelligence, operations, signal, Fires section, space operations, information operations and electronic warfare -- will take part in another major cyber training event. The Army Leader's Cyberspace Operations Course is a 40-hour course on integrating cyberspace and electronic warfare operations into a unit's planning process.
Maj. Charlie Lewis, chief of the Cyber Leader College at the Army Cyber School at Fort Gordon, Ga., said ALCOC is a combination of classes and scenarios designed to educate staffs on cyber and electronic warfare capabilities at the corps level and below and how those effects fit into the military decision-making process and unit targeting cycles. Course topics include CEMA, the foundations of cyber, the DoD Information Network, offensive and defensive cyber operations, electronic warfare, intelligence, intelligence support to cyber, mission analysis and course of action development and execution.
ALCOC was developed by the Cyber Support Element at Fort Leavenworth, Kansas, last year and tested in two pilots. ARCYBER experts helped write the course's program of instruction, and will help Cyber Support Element and Cyber School staffers to teach it.
The course is adjusted for each training unit's specific needs, Lewis explained. For the 1st ABCT it is being tailored to the brigade's training scenarios. That tailoring can be challenging, the major added, because ALCOC trainers want to educate units with the most up-to-date material possible, while each unit has a different mission set and the cyber domain changes so rapidly.
With the equally rapid development of the integration of cyber and electronic warfare, "it (the ALCOC) needed to happen, and it needed to happen quickly" to educate and train staffs, the major said, but must also continue to be integrated with the needs of each unit and the CSCB program. The material developed for ALCOC is now also being used at CGSC, at the Signal School, and in other senior leader courses.
In a recent Army News Service article Brig. Gen. Patricia Frost, ARCYBER's deputy commanding general for operations, used the example of a unit on patrol to illustrate how CEMA synchronization supports operations. The patrol has intelligence, surveillance and reconnaissance capabilities that can see itself and the environment it's operating in, she explained, but added that there's "also a logical environment operating alongside that patrol that is feeding the enemy position, navigation, timing, targeting information, that fits in the cyberspace domain." Commanders are central to CEMA operations, the general said, and in her opinion brigade commanders need to be able to better see that battlespace.
CSCB pilot activities during the 1st ABCT's rotation at NTC will be supported by Soldiers from the 780th Military Intelligence Brigade, 1st Information Operations Command, Army Cyber Protection Brigade and 504th EMIB who will be embedded into the brigade. Additional members of those units and personnel from the ARCYBER headquarters will provide support and expertise to NTC for the training while gathering observations and recommendations to help the Army determine how it will train, man, equip, sustain and develop doctrine to define and conduct cyber operations in tactical environments.