Created in 2019, 16th Air Force consolidated several commands and capabilities for intelligence, surveillance, reconnaissance, cyber, electronic warfare, information operations and weather, to set up an integrated information warfare command.

Given the breadth of its new missions and the consolidation of all these capabilities, the organization sought a different approach to generating new requirements and engaging with those outside the military through what it dubbed the Phoenix Initiative.

“What we want to be able to do is be more deliberate in our engagements with [industry, academic institutions and then government, science and technology, and research-and-development organizations], so that we can leverage that creativity, the innovative thoughts, to help harness those and then help us not only look at modern technology, but maybe help us to modernize from a process perspective within our structure,” Brian Cook, technical director of 16th Air Force, said in an interview Monday at AFA’s Air, Space and Cyber conference.

“Trying to be, again, more deliberate and looking at the holistic nature of our mission sets and making sure that our organizations understood there are a lot of things going on for research and development within industry and within faculty and staff at various academic institutions, that we should really be leveraging that thought leadership to help us mature and modernize moving forward. That was really it. Because we don’t think that we were really doing that very well early on,” he added.

Cook noted that in the spheres of offensive cyber and electromagnetic attack, the Air Force and U.S. military are the leaders. However, for the other areas under 16th Air Force’s purview, industry and academic organizations are the main drivers.

The Phoenix Initiative, which began around August 2023, was initially focused on 16th Air Force’s no-fail missions through Project Phoenix, a subset of the larger initiative.

Overall, the effort provides a venue for engagement with key non-government partners to include sessions on the sidelines of conferences. In fact, at the annual AFCEA Alamo ACE conference in November, Cook said officials will start to pull the veil back and have classified briefings that go beyond the typical mission briefs.

“We don’t want mission briefs. Don’t give us mission briefs. We can get your mission briefs outside every day. No big deal. We want to know the tough problems that you’re attempting to tackle, so that as we look at our research-and-development dollars, as we look at other opportunities to work for and with you, if we understand your tough problems and we’re able to do that. That’s a venue by which we’re attempting to do some of those things,” Cook said.

Overall, this is a more collaborative process with industry and academia than previously.

“We’re doing data calls that go out to our organizations and say, ‘What are the tough problems, what are the research interests, what are you trying to solve?’ Then taking those in and then trying to be able to explain and share those in a manner,” Cook said.

Some of the outcomes have been new concepts, such as industry highlighting different ways to employ existing capabilities, while the majority of the efforts have resulted in new contracts being let through commercial solutions openings.

The command has more leeway through that vehicle than others, allowing them to be able to release solicitations online and get organizations on contract quicker as a direct result of two-way collaboration with those outside government.

The first such effort was related to innovative ways to train intelligence, surveillance and reconnaissance airmen in cryptologic missions supporting special operations forces, while others were actually kicked up to the Air Force chief information officer level for them to consider.

Cook noted that officials are also trying to take more advantage of small business and technology transfer dollars, working closer with Air Force Research Laboratory and AFWERX.

“In that regard, it’s really allowed small businesses to start to provide proposals. And what they’ll do is they’ll pitch them to us and then we’ll look for operational sponsorship of [them], and then that goes in to compete and then AFRL, and then we’ll make those selections,” he said. “But what happened before is a lot of folks thought like you needed a hard ‘R’ requirement in the system, and then it was really about if you went forth with a phase — whatever it is within that process — then if it was successful, you were signing up to be the long-term sustainment of the capability. That is not what that is meant for. It’s looking for, how do we solve tough problems, are there innovative ways to do it? Then if you can provide the operational support to and it get selected, there’s opportunities then later to maybe bring it in to transfer over.”

The post 16th Air Force looking to reevaluate how it generates requirements with Phoenix Initiative appeared first on DefenseScoop.

Described as the competition force — meaning it is engaging adversaries below the threshold of armed conflict — 16th Air Force combines cyber, electromagnetic spectrum operations, intelligence, surveillance, reconnaissance, information operations and weather, among others, into a single organization for unity of effort.

The command is experimenting with a nascent initiative to take the convergence of capabilities and authorities to support air components with their operations — dubbed the information warfare operations cell within the 616^th Operations Center, known as the glue pulling information warfare together.

“How can we best support their OAIs [operations, activities and investments] with the IW capabilities and authorities that we have to amplify, to enhance, to produce outcomes?” Lt. Gen. Thomas Hensley, the new commander of 16^th Air Force as of Aug. 1, told reporters Thursday during a media call. “We’ve had a couple of syncs with the air components. We’re going through a crawl, walk, run phase, if you will. We’re now at the walk phase and we have generated some outstanding lessons learned on how we can support the air components all the way from the unit level up to the Office of Competitive Activities level and everywhere in between.”

For example, Air Combat Command, Headquarters Air Force and the Office of Competitive Activities are involved in this process and “we’re making strides every single day,” he added.

The Office of Competitive Activities is a new organization spurred on by Air Force Secretary Frank Kendall’s charge to “reoptimize” the service for great power competition against China, though little is publicly known about it. Documents released when the initiative was announced in February this year indicated that it aims to combine disparate efforts to oversee and coordinate sensitive activities.

From a friendly-force aspect, Hensley said this information warfare operations cell will look to determine how much to reveal to the adversary and how much to conceal.

The common trope from the nuclear deterrence era of the Cold War was that deterrence doesn’t work if the adversary doesn’t know what capabilities friendly forces have. Thus, there is a common balance in deciding what to demonstrate to the adversary and what to keep hidden so as not to expose capabilities to countermeasures.

Meanwhile, the organization is looking at how to expose adversary activity and disrupt it via information warfare.

The inaugural commander of 16th Air Force — Gen. Timothy Haugh, who now commands U.S. Cyber Command and directs the NSA — noted when he departed that the command and IW must scale across the Air Force.

As part of that scaling, 16th Air Force is also working on multiple efforts to improve the synchronization and development of information warfare concepts.

One is to develop an information warfare operations center concept, to more closely integrate capabilities. That involves developing campaign plans and operation designs to better understand who says what and when, what is the target audience for content, how effectiveness is measured, and did the adversary even recognize what the command was trying to do.

That along with other efforts — to include developing roles and requirements for what information warfare means — are being worked across multiple levels of the service from the command, the nascent Office of Competitive Analysis, Air Combat Command and the Air Staff.

A challenge for 16th Air Force’s effort is consolidating and integrating the various capabilities, mission areas and authorities under its purview — a huge portfolio ranging from signals intelligence to U-2 spy plane operations to cyber.

Hensley noted that many of the other services began to replicate the efforts of 16th Air Force in terms of converging capabilities.

“The Marines actually followed suit with what 16th Air Force did. In many ways, we’re working through the same things,” he said, referencing the 2023 creation of the Marine Corps Information Command, designed to more tightly link the service’s information forces — including cyber, intelligence and space — in theater with the broader joint force.

“When it comes to Title 10 and Title 50 and cyber authorities and SIGINT authorities, we certainly want to keep those together in one organization so that we have unity of command, unity of action, so that we can move with speed and agility to produce IW outcomes,” he added.

All these efforts come as Kendall has charged Air Forces Cyber — the cyber component to U.S. Cyber Command that sits within 16th Air Force — to elevate. Details regarding that elevation remain vague, with top officials saying they want to take their time to ensure all the various equities are taken into account.

That effort has been spurred on, in large part, by concerns about China.

“The most important challenge that we face is maybe the general public’s lack of understanding about the gravity of the Chinese threat. As we consider the things the secretary has mentioned, why we’re doing great power competition, reoptimization, revitalization, why we’re doing some of these things, is to posture ourselves for great power competition — and quite frankly, as he said, before possible conflict with China,” Hensley said, suggesting earlier this week that the secretary didn’t think the service was postured and thus asked for a reorganization. “I don’t think the general public really understands the things that [China is] trying to do to advance their government at the expense of democratic governance, processes, institutions.”

Hensley was cagey regarding where AFCYBER’s elevation stands now and what that means for 16th Air Force, despite indicating that an integrated information warfare approach with like-capability organized under the same command is likely here to stay.

“The secretary has said that he wants to elevate ACYBER and we’re going to elevate AFCYBER to be a service component command. But that brings in the question, then, what is the future status of 16th Air Force in its totality?” he said. “The only thing I can offer at this point is that we have some very senior leaders that are going through a very deliberate process to determine what is the right way forward with AFCYBER being elevated in 16th Air Force. I think we’re getting pretty close to a decision on that one, but that’s all I can comment on at this time. We have very, very senior leaders that are trying to determine the future of both those commands.”

The post Air Force maturing its information warfare enterprise appeared first on DefenseScoop.

Hensley, who pinned on his third star prior to the ceremony, was previously the organization’s deputy commander.

The ceremony was presided over by Gen. Ken Wilsbach, commander of Air Combat Command — which 16th Air Force currently sits under — and Gen. Timothy Haugh, commander of U.S. Cyber Command and the inaugural commander of 16th Air Force, with several retired military cyber officials from all the services in attendance.

Hensley takes over from Lt. Gen. Kevin B. Kennedy, who came into the job in summer 2022 and is retiring after over 34 years in uniform.

16th Air Force is the service’s integrated information warfare entity, which encompasses cyber, intelligence, surveillance, reconnaissance, electromagnetic spectrum operations and weather, among others. It serves as the service component to U.S. Cyber Command and the cryptologic component to the National Security Agency conducting signals intelligence.

The organization was created in 2019 to integrate the disparate functions of information warfare across the Air Force, one of the first in a series of reorganizations across the U.S. military to address the growing field of IW and combat similar integrated and reorganized factions of adversary militaries such as China and Russia.

The unit has some unique missions, Wilsbach said. “In fact, there’s some of them that are happening as we speak inside of cyberspace, in the air, with reconnaissance aircraft. And certainly we have analysts, intel analysts, that are looking at collections that we’ve been making over the last few days. They’re doing that right now and they do that seven days a week, 24/7.”

Wilsbach noted that under Kennedy’s leadership, the command established an information warfare operations center to synchronize all the activities associated with information warfare for the air component and combatant commanders and launched something called Project Phoenix that gathers subject matter experts across numerous organizations to improve the way intelligence, cyber and reconnaissance products are delivered.

It has played a critical part in recent operations as the main entity responsible for conducting and planning cyber ops across U.S. European Command, helping harden networks against Russian cyber threats in the midst of the war in Ukraine.

Kennedy “led the longest Cyber Command tenured mission packaging campaign cyber response for Ukraine. They’re doing some amazing work. I can’t tell you about any of it — but amazing work and that’s happening 24/7,” Wilsbach said.

Haugh noted that 16th Air Force supports four separate combatant commands and has played a major role in aiding their efforts:

• European Command: defending networks and supporting Eucom in its efforts to aid Ukraine against “the unlawful invasion by Russia.”
• Strategic Command: defending the highest priority networks within the Department of Defense that relate to nuclear systems.
• Space Command: integrating with the newest combatant command as it grew its headquarters
• Cyber Command: aiding in election security efforts over the last few years to prevent foreign interference.

“Each of those roles take synchronization, it takes time and what it also takes is a really great leadership team,” Haugh said.

One of the issues Hensley will navigate is the elevation of AFCYBER, part of Air Force Secretary Frank Kendall’s sweeping changes to the service as part of a reoptimization plan to better organize the department to fight China, which was first announced in February.

As part of that plan, the Air Force intends to elevate AFCYBER, and while details on that effort have been sparse, it is believed it will be taken out from under Air Combat Command.

“We have some changes that are going to happen with AFCYBER and 16th Air Force that are going to occur in the near future,” Wilsbach said. “If you could pick anybody we would pick [Hensley] to lead us through that transition because he has the expertise and he has the experience too. A lot of joint time, a lot of time overseas, a lot of different missions. So right guy, right time.”

Gen. David Allvin, chief of Staff of the Air Force, told reporters in June that the service is being very meticulous in getting this elevation right.

“We want to make sure we measure twice and cut once because there’s different elements of that with respect to where the manpower belongs and … comes from different sources,” he said.   

The post New commander takes charge of Air Force’s information warfare unit appeared first on DefenseScoop.

“AFCYBER is one of those … we want to make sure we measure twice and cut once because there’s different elements of that with respect to where the manpower belongs and … comes from different sources,” Gen. David Allvin, chief of Staff of the Air Force, told reporters at the Pentagon Friday.

In February, the Air Force announced a sweeping shakeup aimed at better organizing the department for a potential fight against China, which the Pentagon views as the “pacing threat.”

As part of that so-called reoptimization — which also includes a list of up to 24 changes to include reorganizations, shuffles and brand new commands — the decision was made to elevate Air Forces Cyber to a standalone service component command to reflect the importance of the cyber mission to the service and the joint force.

Details have been sparse since the announcement regarding exactly what an elevated Air Forces Cyber would look like.

Currently, Air Forces Cyber is part of 16th Air Force, an integrated information warfare command that was established in 2019, which sits beneath Air Combat Command. The elevation would remove it from that bureaucracy and put it directly under U.S. Cyber Command, in line with how other services have organized their service cyber components. This push is part of the Air Force’s wider plan to better organize its service components to combatant commands.

However, in addition to being the force generator for Cybercom — in which it provides 39 cyber mission force teams to conduct operations, with six additional teams the Air Force is building as part of authorized growth to the cyber mission force — 16th Air Force includes a variety of other information warfare capabilities and commands.

The organization includes cyber, electromagnetic spectrum operations, intelligence, surveillance, reconnaissance, information operations, weather as well as the service’s cryptologic component to the National Security Agency to provide an integrated information warfare organization — a move that was lauded back in 2019 given that adversaries were organizing their forces under an integrated information warfare framework.

One of the reasons it is taking so long to determine AFCYBER’s future, is the Air Force is trying to ensure it provides the right organization with the right forces to project power, which could mean taking out some of the forces from the current 16th Air Force.

“We want to make sure as we do that, those that are strictly internal — we make sure we have those resident in the other ISR wings — because there’s some things in 16th Air Force that are reconnaissance wings that aren’t necessarily on the cyber” side, Allvin said. “We are really looking how we do that exactly right, so we make sure that the Cyber Command commander gets what he or she needs, and we still have the resident capability within our Air Force to project power … We’re being very careful to ensure that we’re still meeting the combatant commander needs and still developing the cyber relationship.”

Allvin noted they are about 90 percent of the way there and will likely have more specifics in the next month or two, telling reporters that just this morning he had a virtual teleconference with the 16th Air Force commander and Cybercom commander, who is also an Air Force officer and was the inaugural 16th Air Force commander.

As the Air Force pushes ahead with its internal changes, Allvin noted that it will be reexamining what a major command, or MAJCOM, is within the service.

At the time the reoptmizaion plan was released, many outside commentators speculated that elevating Air Forces Cyber meant it would become a major command, like Air Combat Command.

Allvin noted the disjointed nature of major commands in the Air Force currently with three- and four-star major commands and entities that are also service components, such as Pacific Air Forces.

“There’ll be big service component commands — [United States Air Forces in Europe–Air Forces Africa], PACAF, huge. And there will be smaller ones. But they will all have the same relationship as a service component command to a combat command. So you know that’s what your Air Force looks like, not sort of things here or there,” he said, noting that part of the reorganization is making Air Force units easier to plug into joint combatant commands and for those combatant commanders to better understand those units.

“I don’t know if the term MAJCOM will eventually sort of fade away,” Allvin added.

The post ‘Measure twice, cut once’ — Gen. Allvin takes cautious approach to changing Air Forces Cyber appeared first on DefenseScoop.

Hensley is currently the deputy commander of 16^th Air Force, the service’s integrated information warfare entity, which encompasses cyber, intelligence, surveillance, reconnaissance, electromagnetic spectrum operations and weather, among others. It serves as the service component to U.S. Cyber Command and the cryptologic component to the National Security Agency conducting signals intelligence.

The organization was created in the fall of 2019 to integrate the disparate functions of information warfare across the Air Force, one of the first in a series of reorganizations across the U.S. military to address the growing field of IW and combat similar integrated and reorganized factions of adversary militaries such as China and Russia.

If confirmed, Hensley will pin on a third star and take over for Lt. Gen. Kevin Kennedy, who has served in the role since the summer of 2022.

Previously, Hensley has primarily served in intelligence roles, with a recent stint as the deputy director of operations for combat support at NSA, and little to no dedicated cyber roles.

Hensley takes over at a pivotal time for 16^th Air Force. Air Force Secretary Frank Kendall in February announced sweeping changes to the service as part of a reoptimization plan to better organize the department to fight China. As part of that revamp, Air Forces Cyber will be elevated.

However, what that means in practice is less clear, even months later, as the Air Force is still gaming out what that will look like.

The post Officer nominated to lead 16th Air Force, information warfare command appeared first on DefenseScoop.

The so-called reoptimization — a list of up to 24 changes to include reorganizations, shuffles and brand new commands — was necessary, officials said, to better posture the Department of the Air Force against top nation-state competitors, namely, China.

The service has maintained it could be months until any additional details are available regarding the elevation and how the new organization could take shape. A DAF spokesperson told DefenseScoop that each of the initiatives listed in the reoptimozation plan are on various timelines and officials are still developing an implementation plan for the AFCYBER elevation — but they don’t have any established timelines yet.   

“What is going to be in that command? Details to follow, as we look forward and understand,” Lt. Gen. Kevin Kennedy said at the AFA Warfare Symposium where the reoptomization was announced regarding AFCYBER’s impending elevation.

The appropriations bill for fiscal 2024 that passed Congress at the end of March, noted that to date, the Air Force had not “provided thorough justification for this reorganization, a comprehensive implementation plan, or detailed budgetary information necessary for the Subcommittees to assess this plan.” As a result, the legislation noted that any fiscal 2024 funding that is utilized for the reorganization is designated a congressional special interest item and the secretary must provide a briefing to congressional defense committees 30 days prior to executing any organizational changes.

Lawmakers also directed the comptroller general to submit a report to the House and Senate defense appropriations subcommittees on the proposed reorganization no later than 180 days after enactment of the legislation.

AFCYBER, the Air Force’s service cyber component to U.S. Cyber Command, is part of 16^th Air Force, the service’s first information warfare entity. It was established in 2019 and combined a variety of capabilities to include cyber, electromagnetic spectrum operations, intelligence, surveillance, reconnaissance, information ops and weather.

Previously, personnel for AFCYBER were spread across two numbered Air Forces with 24^th Air Force serving as the primary AFCYBER entity and pulling intelligence personnel from 25^th Air Force. This created difficulties with command relationships and oversight of teams since the intelligence operators served beneath a separate Air Force command with a separate commander.

16^th Air Force, a three-star command, now sits beneath Air Combat Command, a four-star entity.

According to former Air Force cyber officials — all of whom had no inside knowledge of exactly what the elevation will portend — the most likely outcome of the elevation of AFYBER will be to pull it out from under Air Combat Command and place it directly under the chief of staff and/or secretary like a major command or MAJCOM.

Kennedy somewhat affirmed this sentiment.

“The decision was made to elevate Air Forces Cyber as a command, reporting directly to the chief and the secretary,” he said at the AFCEA Rocky Mountain Cyberspace Symposium a week after the AFA Warfare Symposium. “This decision was made after a significant amount of discussion, [and] in my assessment, was made for a few key reasons. One that stands out is the recognition of the importance of operating in, through and from the cyber domain that cuts across the entire department, both services and all commands. It is also the recognition of the value that cyber, ISR, weather and information operations and electronic warfare enterprises within the 16th Air Force bring to our security.”

Removing AFCYBER from Air Combat Command also loosens bureaucratic hurdles that simply exist as a function of being beneath another organization, sources indicated.

“Being underneath one MAJCOM, frankly, historically has been challenging. Not because they haven’t wanted to support cyber, but it gets into, Air Combat Command flies jets and fighters and Space Command flies satellites. It always was a budgetary challenge,” Bill Marion, executive and managing director at Accenture Federal and former deputy chief information officer of the Air Force, told DefenseScoop.

Elevation will also raise the profile of a new AFCYBER when competing for resources within the Air Force.

“The obvious advantage [of elevation out from under ACC] will be that when it comes to resources, both people and money, you are competing for the prioritization of those requirements at a higher level,” Charles “Tuna” Moore, a retired Air Force three-star who served as the deputy commander of Cybercom, told DefenseScoop. “Does that mean you automatically are going to get more people and more budget? No. It’s going to depend on how well you can make your case for your requirements.”

Elevation also raises the profile of cyber and non-kinetic capabilities, which are expected to play a larger role in conflicts going forward.

“The writing’s on the wall. Globally, cyber is truly a warfighting capability, it’s truly transcending all the mission areas,” Marion said. “The biggest thing is this much larger aperture of cyber as a warfighting mission in totality, not underneath kinetic effects, but in concert with kinetic effects. Because it is a reality we live in. I mean, you look at the Ukrainian war and as an example, I mean, it’s as much cyber as it is kinetic. We see the bombs drop and you don’t see the non-kinetic but, it’s on par, it’s not above.”

One of the biggest challenges for a new organization like this will be how it will acquire and procure new systems.

If made a reality, this would put AFCYBER on par with its other service cyber component counterparts: Army Cyber Command and 10^th Fleet/Fleet Cyber Command — an Echelon II that reports directly to the chief of naval operations.

However, putting operational units beneath the chief of staff or secretary has its own challenges, especially given they aren’t in operations on a day-to-day basis, but are rather focused on policy and running the organization, according to some that spoke to DefenseScoop.

Sources did, however, indicate that this elevation is a natural progression. It also could, according to some experts, begin to set the stage as a precursor for a potential independent uniformed service focused solely on cyber — making a cleaner break if that were to occur.

Discussions on that topic have grown louder over the last two years, with Congress poised to introduce legislation to one degree or another to begin the evaluation process for such a prospect.

The proposed elevation also likely won’t have a major impact on the way the Air Force provides personnel to — or its relationship with — Cybercom all that much, but rather, will be more internally focused to non-Cybercom forces and issues.

“I don’t think that’s going to affect force presentation to Cybercom that much. I do think it’s going to allow the Air Force to focus a lot more on its service-specific cyber capabilities that they need to develop and field,” Moore said.

While Cybercom owns the authorities to conduct offensive cyber operations with forces the services provide it, each service still is responsible for a variety of defensive and IT-related tasks. The Air Force has been in the process of building and deploying what it calls mission defense teams for the past several years. These are specialized groups that protect critical Air Force missions and installations, such as critical infrastructure or computers associated with aircraft and remotely piloted systems. They are separate from the cyber protection teams each of the services provide to Cybercom. The Air Force is looking to evolve those teams and concept in the future, officials have noted.

Information warfare

The creation of 16^th Air Force was lauded by outside experts for the service’s recognition of the burgeoning need to bolster information warfare capabilities and integrate them in a meaningful way after after the U.S. military writ large languished in this area after the Cold War. U.S. adversaries had been reorganizing their forces to create more integrated information warfare units and had begun to either approach parity or in some cases eclipse the United States in this realm.

It remains unclear if a new elevated AFCYBER will retain most of those information capabilities or if it will include just the cyber pieces.

“If I had to bet today, I think you’ll probably see the flying organizations moved out of the new entity. I think you’ll see the weather organization moved out,” Moore said. “I think you’re going to see AFCYBER be much more scoped down to focus on cyberspace operations, information operations and the retention of the service cryptologic component responsibilities. You are still coalescing around the idea of an information warfare type of organization. It won’t be called that, but the most important thing is doing your best to keep those types of capabilities aligned and under the same commander where you can benefit from unity of command and effort … Right now, it’s a very large command with a lot of related but disparate responsibilities.”

Currently, there are some units under 16^th Air Force responsible for flying operations mostly in the ISR space, such as the 9^th Reconnaissance Wing that flies U-2 Dragon Ladies and RQ-4 Global Hawks, the 55^th Wing and the 319^th Reconnaissance Wing.

16^th Air Force also serves as the cryptologic component that reports to the National Security Agency performing signals intelligence. Given the close relationship cyber and signals intelligence enjoy — not to mention the fact NSA and Cybercom are co-located and share a leader — some obervers are hopeful that the new organization won’t lose its SIGINT units or its status as the cryptologic component.

Kenndey stated that the Air Force’s information warfare mission likely won’t be changing anytime soon.

“Just know that the emphasis on the cyber and the information domain in the Air Force is not changing. It’s there. The structure may change, but the emphasis isn’t going to change,” he said at the AFA conference in February.

Warrant officers

Additionally, as part of the reoptimization plan, the Air Force announced the return of warrant officers for the first time in 40 years, which initially will be focused specifically on IT and cyber roles.

Experts that DefenseScoop talked to were all in agreement that this is a positive development for the service and signifies the importance of cyber going forward.

“I think it’s a good sign, too, because if you go back to the height of the Global War on Terrorism, the main pressure was on RPA pilots and generating more and more of them. There was a huge push then and a lot of discussion of do we need to bring back to warrant officer force to deal with this specific problem. We didn’t do it even though there was immense pressure to increase our capacity,” Moore said. “To do it now, in the cyber domain, I think is a recognition of how important this domain is to the success of the Air Force and that we have to be willing to do whatever it takes to be successful.”

Others cautioned that the warrant officers that are brought in should possess specific skills — in areas such as cloud, AI and data — and be true experts rather than just being extra bodies in the ranks.

The post What will the elevation of Air Forces Cyber look like? appeared first on DefenseScoop.

The 16th Air Force announced in January that it is partnering with Space Operations Command (SpOC) in order to integrate space-based capabilities into all of its warfighting operations. Through the agreement — which will see Space Force personnel embedded with 16th Air Force — the two organizations are seeking a greater understanding of how to defend space assets from cyber attacks. 

“In order to perform the different capabilities within Information Warfare, the forces are dependent on and need space-based assets,” Lt. Col. Theresa Kopecky, 16th Air Force and Space Force liaison officer, said in a statement. “A key partnership between the 16th Air Force and the Space Force is essential to understand the combatant commander’s requirements for effects during strategic and operational planning that is done together.” 

Space Operations Command and its mission deltas are responsible for a range of warfighting functions, including space domain awareness, missile warning and satellite communications. The organization is the Space Force’s service component for U.S. Space Command, which carries out military operations across the space domain.

Specifically, SpOC’s Delta 6 unit has multiple cyberspace squadrons that are tasked with defensive cyberspace ops in support of the Space Force’s other mission deltas. Other units within Delta 6 are also responsible for operating the Satellite Control Network — a global network of antennas and links that communicate with and control both Pentagon and non-military satellites.

16th Air Force is the Air Force’s information warfare organization housing cyber, electronic warfare, information operations, intelligence and weather units all under one commander. 

Increasingly, space and space-based capabilities are falling into the fold of information warfare within the Department of Defense, with some services, such as the Navy and Marine Corps, including space in their cyber and information warfare commands.

Additionally, Space Command created a new position specifically dedicated to information warfare within the last year. 

A 16th Air Force spokesperson told DefenseScoop that integrating mission support between their organization and SpOC is part of an effort to maximize resources in order to generate the desired information warfare outcomes for combatant commanders and air components. 

As part of the agreement, the two organizations are looking to ensure the Pentagon’s on-orbit systems and the links connecting them are protected against adversary cyber effects, the release stated.

A Space Force spokesperson told DefenseScoop in an email that liaison officers working with the 16th Air Force will facilitate collaboration between the two organizations “across the strategic, operational, and tactical level.” The SpOC liaisons — embedded within the 616th Operations Center, which is described as the “glue” holding 16th Air Force’s capabilities together — will share technical expertise about the Space Force’s systems and operations with the 16th Air Force.

“Creating synergy amongst all cyberspace operations elements within the Department of the Air Force, including setting foundations with our Delta endeavors, allows for seamless integration across all echelons of our persistent defensive mission,” a 16th Air Force spokesperson said. “This opens the door for enabling mutually supporting functions across enterprise-scale cyber operations, converging cybersecurity service provider capabilities, and evolving our Defensive Cyber Operations approach for the strongest, collective defense in cyberspace.”

Officials also said the partnership creates a stronger link when it comes to cyber support to Space Command. Cyber operations, on behalf of U.S. Cyber Command, are conducted through a construct known as Joint Force Headquarters-Cyber, which provides planning, targeting, intelligence and cyber capabilities to assigned combatant commands. Each service cyber component commander also serves as their respective JFHQ-C commander.

16th Air Force, through JFHQ-C Air Force, supports Space Command.

 “This partnership enables a better mutual understanding of the defensive cyber operations for space-based systems. As such, JFHQ-C(AF) and SpOC can more effectively plan and execute defensive operations and more efficiently employ our forces,” the spokesperson said.

The post New Department of Air Force partnership brings cyber, space and information units closer appeared first on DefenseScoop.

The most recent iteration of Cyber Coalition took place Nov. 27–Dec. 1 and included 28 nations. The initiative gathers allied countries together regardless of their cyber expertise to address a common scenario to bolster NATO and each other collectively, according to Candace Sanchez, a senior exercise planner at 16th Air Force.

“The fact that it’s what I would say a quote/unquote ungraded event, makes it a much more welcoming exercise and event for nations who may not be as mature in the cybersecurity realm to come and participate and sharpen their skills,” she said in an interview. For those that are more advanced, it’s also an opportunity to learn tactics, techniques and procedures (TTPs) from other nations to better their defenses, she noted.

The 16^th Air Force — the Air Force’s information warfare organization that includes its cyber component, AFCYBER — has led the exercise the last five years, due primarily to the fact it’s the main coordinating authority for cyber operations in the European theater for U.S. European Command on behalf of U.S. Cyber Command, under a setup called Joint Force Headquarters-Cyber Air Force. Each service cyber component beneath Cybercom has a Joint Force Headquarters-Cyber component that is responsible for conducting cyber ops on behalf of assigned combatant commands.

Sanchez said the exercise is focused on a common adversary that introduces threats to specific coalition networks that can impact a fictional mission. Those could include things like supply chain interdiction attacks, exploitation of common networks or electrical grid vulnerabilities that can be threaded into the larger scenario.

Participants in a range environment then seek to identify those vulnerabilities and remediate them — reporting up the chain and helping each other along the way.

“If one nation identifies a vulnerability and another one might be struggling or just hasn’t caught up, they can get some of those nuggets from that nation to help them in their investigation,” Sanchez said. “It’s heartwarming to see that the other nations are open with how well or not how well their teams are doing, as we are ready to share our successes and our challenges with our partners and allies so that we can learn and grow.”

These types of exercises are meant to not only improve skills and capabilities, but enhance collective defense and information sharing for the alliance. In some cases, U.S. forces can take lessons from other nations’ cyber techniques.

“We’ve used the last four years to expand our footprint in the exercise and take advantage of the opportunities to engage with our allies and partners,” Sanchez said. “Specifically on how do we share information in the cyberspace domain, specifically defensive cyber operational information, in a timely manner against the common adversary so that if we face threats, that we use a common platform to share that information, so that we can go after the threats, remediate any vulnerabilities that are identified and share that information across the board.”

Shaping American exercises, forces and concepts

Cyber Coalition can be thought of as one event in a continuum of exercises to improve U.S. military skills and information sharing.

While it doesn’t go as far as some other exercises in terms of integrating cyber to the timing and tempo of operations — given that it’s solely focused on defensive cyber — lessons learned are captured and can be pulled into other exercises the Defense Department may be conducting. This could include events such as Eucom’s Austere Challenge that Cybercom also participates in.

“Collectively, we bring this all together and we work with each other as cyber components to U.S. Cybercom in other exercises. Because even though this scenario for Cyber Coalition is very specific to NATO and to the Eucom theater, the lessons that we learned from it can be applied globally, no matter what exercise that we might participate in,” Sanchez said. “It’s a safe environment to learn new techniques, understand current processes for people who may not be familiar. It’s an opportunity to assess each other’s capabilities, garner that trust that we need to have before we move into a crisis where we’re going to depend on each other to operationalize those relationships.”

In practice, from an operational and strategic perspective, Sanchez said this means having Joint Force Headquarters-Department of Defense Information Networks — a subordinate headquarters under Cybercom responsible for protecting and defending the Pentagon’s network globally — work on the information-sharing framework. If AFCYBER finds something, they can work on routing that up the U.S. channels to others and eventually to a partner or ally, Sanchez said, explaining information sharing is also a large part of what JFHQ-DODIN’s role is.

JFHQ-DODIN participated from a staff level at the Cyber Coalition event.

From a more tactical standpoint, the Air Force had a cyber protection team (CPT) — defensive teams under Cybercom that hunt for and eradicate threats from the network — and a cybersecurity service provider (CSSP) from AFCYBER — local defenders and maintainers of a network at any given organization or installation — sit side-by-side. While this isn’t something that happens operationally, it was an opportunity for the CSSP to learn from the cyber protection team, which has more strength and insight given the nature of what it does day-to-day.

“That was a big win for us. And we plan on continuing to do that in future iterations of Cyber Coalition and possibly … other exercises as well,” Sanchez said.

While these two teams were the only U.S. tactical forces that actually participated in the exercise beyond a staff perspective, Sanchez said next time around, she hopes to have more tactical participation.

“I hope for the next iteration that continues and that we further our footprint in the exercise and maybe introduce some more tactical teams into the event, because it was really fruitful for our cyber defenders, our CPT, CSSP,” she said. “Even though they were here in San Antonio supporting the exercise, virtually they were able to engage with their counterparts from other allied nations and understand how they approach the cyberspace domain and cyberspace security. They were able to glean some new TTPs from those nations. That was really exciting to see for this exercise.”

The post US, allies share skills and tactics at annual NATO cyber exercise appeared first on DefenseScoop.

A revised version of Joint Publication 3-12 Cyberspace Operations — published in December 2022 and while unclassified, is only available to those with DoD common access cards, according to a Joint Staff spokesperson — officially provides a definition for “expeditionary cyberspace operations,” which are “[c]yberspace operations that require the deployment of cyberspace forces within the physical domains.”

DefenseScoop has seen a copy of the updated publication.

The last version was published in 2018 and was publicly available. The Joint Staff spokesman noted that five years has been the norm for updates.

The definition, recognition and discussion of such operations are indicative of not only the maturity of cyberspace and associated operations, but the need for more tactical capabilities to get at targets that the current cyber force might not be able to access.

U.S. Cyber Command owns the offensive cyber capabilities within DOD, and the services conduct offensive cyber ops through Cybercom and the cyber mission forces that each service provides to the command. Authorities to launch cyber effects have traditionally been held at the highest levels of government. In recent years, those authorities have been streamlined and delegated. However, most cyber operations are still conducted from remote locations by the cyber mission force (CMF) and primarily focused on IP-based networks.

Many of the services have begun investing in capabilities and forces for their own offensive cyber, however, that is mostly in the blended electronic warfare or radio frequency-enabled sphere at the tactical level.

The updated doctrine recognizes that these capabilities, which will still have to be coordinated centrally, could provide access to targets that remote operators might not be able to get for a variety of reasons.

“Developing access to targets in or through cyberspace follows a process that can often take significant time. In some cases, remote access is not possible or preferable, and close proximity may be required, using expeditionary [cyber operations],” the joint publication states. “Such operations are key to addressing the challenge of closed networks and other systems that are virtually isolated. Expeditionary CO are often more regionally and tactically focused and can include units of the CMF or special operations forces … If direct access to the target is unavailable or undesired, sometimes a similar or partial effect can be created by indirect access using a related target that has higher-order effects on the desired target.”

It also notes that these effects and operations should be coordinated with the intelligence community to deconflict intelligence gain/loss.

Moreover, the updated doctrine recognizes the complexity of cyberspace and how in-demand cyber capabilities might be. Thus, global cyber support might need to “reach-forward” to support multiple combatant commands simultaneously.

“Allowing them to support [combatant commands] in this way permits faster adaptation to rapidly changing needs and allows threats that initially manifest only in one [area of responsibility] to be mitigated globally in near real time. Likewise, while synchronizing CO missions related to achieving [combatant commander] objectives, some cyberspace capabilities that support this activity may need to be forward-deployed; used in multiple AORs simultaneously; or, for speed in time-critical situations, made available via reachback,” it states. “This might involve augmentation or deployment of cyberspace capabilities to forces already forward or require expeditionary CO by deployment of a fully equipped team of personnel and capabilities.”

When it comes to internalizing the new doctrine, the Air Force sees this as additional access points for operations.

“How do we leverage folks that are and forces that are at the tactical edge for access? That’s primarily how I think about the expeditionary capabilities we have … is empowering or enabling the effect they’re trying to create or using their access or position physically, to help enable some of our effects,” Lt. Gen. Kevin Kennedy, commander of 16^th Air Force/Air Forces Cyber, told DefenseScoop at the AFCEA TechNet Cyber conference.

He noted that these access-enabling capabilities could be across the services, but primarily from an Air Force perspective, “I’m looking at looking within the Air Force, from aerial platforms down to ground-based airmen, as well about how we would do that,” he said.

Officials have described how the services are seeking to build their own forces separate from Cybercom.

“There was a lot of language that came out the [National Defense Authorization Act] that talked about force design in general. All the services to one degree or another are really — I’m not going to say rethinking — but evaluating what their contribution to the joint force is, as well as what their own … service-retained cyber teams are,” Chris Cleary, principal cyber advisor for the Department of Navy, told DefenseScoop at the AFCEA conference.

Last year’s NDAA directed the Pentagon to develop a strategy for converged cyber and electronic warfare conducted by deployed military and intelligence assets, specifically for service-retained assets.

As electronic warfare and cyber capabilities are expected to be a big part of the battlefield in 2030 — a key waypoint the Army has been building toward — it recognizes those capabilities can’t be held from remote sanctuary, Maj. Gen. Paul Stanton, commander of the Army Cyber Center of Excellence, told DefenseScoop in an interview on the sidelines of the AFCEA conference.

In fact, the Army’s principal cyber adviser has tasked the Cyber Center of Excellence with clarifying certain authorities and capabilities.

“How do you execute electronic attack to achieve effects? How do you differentiate a cyber-delivered capability that benefits from proximity based on owning the land, owning the ground?Because that’s what the Army does. The principal cyber advisor, Dr. [Michael] Sulmeyer is tasking me with conducting a study to clearly define and delineate where those lines are,” Stanton said. “This study is going to help us be able to clearly define that. I expect to be tasked to kick that off here in the very near future with about 90 days to complete.”

When it comes to service-retained forces and capabilities, the Army has built the 11^th Cyber Battalion, formerly the 915^th Cyber Warfare Battalion, which provides tactical, on-the-ground cyber operations — mostly through radio-frequency effects — electronic warfare and information ops. The unit will help plan tactical operations for commanders and conduct missions in coordination with deployed forces. It consists of several expeditionary cyber and electromagnetic activities (CEMA) teams that are scalable and will maneuver with units and conduct operations on the ground for commanders.

The Navy, meanwhile, is building what it’s calling non-kinetic effects teams, which will augment afloat forces with critical information warfare capabilities. Cleary has previously noted that the service is still working through what cyber ops at sea will look like.

“As we continue to professionalize this, [information warfare commanders within carrier strike groups] will become more and more important as it fully combines all aspects of the information warfare space, the electromagnetic spectrum, command and control of networks, eventually potentially offensive cyber being delivered from sea, information operations campaigns,” Cleary said.

“That job will mature over time, and then the trick is to get the Navy and the Marine Corps to work together because we are back to our roots of being an expeditionary force. Even the Marines through [Commandant] Gen. [David] Berger’s new force design is really about getting the Marines back to being what the Marines were designed to be, which is an expeditionary fighting force that goes to sea with the Navy. We work together to achieve our objectives as a team, and we’re getting back to our blocking [and] tackling them.”

For the Marine Corps’ part, officials have been building Marine Expeditionary Force Information Groups (MIGs), which were created in 2017 and support each MEF within the Corps, integrate electronic warfare with intelligence, communications, military information support operations, space, cyber and communication strategy — all to provide MEF commanders with an information advantage.

The service has also recently established Marine Corps Information Command (MCIC), which was designed to more tightly link the service’s information forces — including cyber, intelligence and space — in theater with the broader joint force across the globe.

Mission elements the Marines have created and sent forward with Marine expeditionary units are “right in line with [Joint Publication] 3-12,” Maj. Gen. Joseph Matos, deputy commander of Marine Corps Forces Cyberspace Command, told DefenseScoop at the AFCEA conference.

“How do we take what we do at the fort, or back at Fort Meade [where Cybercom is headquartered], and be able to extend that out to the services? That’s what we’re in the process of doing right now … We started about two years ago doing that. That capability is starting to mature pretty well,” he said. “It’s to extend Cyber Command out to those forward units.”

Matos said the recently created MCIC will act as the integrator for a lot of these capabilities throughout the force, acting as a bridge of sorts.

The organization will help tactical forces understand the authorities and capabilities that cyber can provide to help them conduct their missions.

“You kind of hit a glass ceiling of the capability [of] the lower elements being able to reach out and do cyberspace operations,” Matos said of the process prior to establishing that entity. “We’re able to say, OK, here’s a team, trained, capable,’ understand the capabilities that we can bring, give them to the deployed forces to say, ‘OK, you want to do cyber operations, here’s how we can help you do that.’ We know who to talk to, the authorities and so on so forth, and we can do that. I think it’s right in line with what the [Joint Publication] 3-12 is trying to do.”

That command essentially acts as the glue between the high-end cyber forces and the tactical elements, bridging the gap between Cybercom forces and the deployed forces.

“The genesis of the Marine Corps Information Command to tie all these elements together is to address that concern, is to be that integration point between the forces below the tactical edge who have these requirements to operate in a rapidly changing environment. But also tie that to the Marine Corps Information Command knows who to talk to at Cyber Command, or at NSA, or at Space Command. To be able to be that touchpoint between the two organizations so you don’t have to have an infantry battalion going all the way to” a combatant command, Matos said during a presentation at the AFCEA conference.

“I think as we operate in this rapidly changing cyberspace world, that Marine Corps Information Command’s going to be a tremendous benefit to the [Marine Air Ground Task Force], but also to the joint world and the intelligence and cyber world,” he added.

The post New DOD doctrine officially outlines and defines ‘expeditionary cyberspace operations’ appeared first on DefenseScoop.

The Operations in the Information Environment Strategic Plan identifies key activities and milestones to transform how the Air Force operates in this space to achieve a vision where information is foundational to all military activities, Department of the Air Force spokesperson Rose Riley told DefenseScoop.

“There have been recent updates as the dynamic nature of the information environment drives regular adaptation and iteration for continued effectiveness,” she said.

The publication of the strategy follows several moves by the Department of Defense recently to elevate information ops, which many outside experts believe has been neglected for some time — to the benefit of sophisticated adversaries.

“The more Airmen recognize that influence operations can, and likely have, affected them, the faster we can recover and rebuild our defense against these attacks. The concept of information warfare is not new, and neither are the core strategies behind it. What is new are the tactics our adversaries are using to conduct these operations at scale. We must empower our Airmen not only to recognize this threat, but also to actively combat it,” Chief Master Sergeant of the Air Force JoAnne Bass wrote in an article that appeared in the Spring 2022 edition of Æther: A Journal of Strategic Airpower & Spacepower.

“We need collaborative solutions, developed and implemented at all levels, that truly seek to understand conflict across the gray zone,” she wrote. “We need our Airmen to understand what Russia understood in the 1950s when Aleksandr Sakharovsky, former head of the First Chief Directorate of the KGB, said, ‘World War III was conceived to be a war without weapons—a war the Soviet bloc would win without firing a single bullet. It was a war of ideas.’”

The concept is nestled under the information joint function, Riley noted. In 2017, the DOD designated information the seventh joint function, along with command and control, intelligence, fires, movement and maneuver, protection and sustainment. These are capabilities grouped together to help integrate, synchronize and direct joint operations.  

Operations in the information environment leverage the inherent information aspects of military activities to affect behavior and meet joint force commanders’ intent, according to Riley.

The Air Force in 2019 created 16^th Air Force, the service’s first information warfare organization combining other numbered Air Forces and housing information warfare capabilities and commands such as cyber, intelligence, surveillance and reconnaissance, electromagnetic spectrum operations and information ops under a single commander.

The service later created the first initial skills training course for its information operations personnel, 14F.

Under the new plan, the Air Force is setting a direction to prepare airmen to lead military operations with a focus on the information environment to shape perceptions, attitudes and behaviors of adversaries, Riley said. The plan aims to equip them with training, tools and technology necessary to understand and shape that environment.

The post Air Force keeping information environment strategic plan out of public view appeared first on DefenseScoop.