Building Better Cyberwarriors

Sept. 1, 2010

A year after becoming the focus of Air Force cyber warfare activities, 24th Air Force is combining information operations, network defense, cryptology, and more into a major new USAF career field. The numbered air force, working with Air Education and Training Command, has launched a full-scale effort to find and develop future cyber warriors.

This secretive and highly complex mission is growing quickly. SrA. Desiree Lozano is an evaluator and advisor with the 68th Network Warfare Squadron. She notes that, in the old days, “if you were using checklists, [it meant] you didn’t know how to do your job.” Now, says Lozano, cyber operators use checklists because “they want to be sure [they] don’t miss a thing.”

The 68th NWS, tucked inside a secure facility at Brooks City-Base in San Antonio, falls under Air Force Space Command—the home for all things cyberspace in the US Air Force today.

To build the capabilities needed to succeed in the mission, the Air Force needs to establish a career path giving airmen a strong incentive to come into the field.

SMSgt. Shane Flynt, superintendent of the 315th NWS at Ft. Meade, Md. (home of the National Security Agency), said his unit is getting people as fast as the billets are approved. Flynt expects the squadron to be 50 percent manned by October. It is receiving 69 more billets for Fiscal 2011, and even this new influx won’t be enough for the surge of work.

Last summer, the Air Force stood up 24th Air Force to be USAF’s new home for cyber warfare—establishing the numbered air force at Lackland AFB, Tex., and putting its efforts under the command of a two-star general officer, Maj. Gen. Richard E. Webber.

Webber—a career space and missile officer—said in a June interview that the development of cyber warriors will resemble the Air Force’s methods for developing aircrews. In that field, USAF has built up an effective career path, from undergraduate training to check rides to combat qualifications, all of which are aimed at certifying, educating, and promoting its aircrews through the ranks and eventually to leadership positions.

(Staff ilustration by Zaur Eylanbekov)

The task ahead of 24th Air Force and Air Education and Training Command is to create a new “cyber culture” out of the various components of the cyber mission—more than 5,400 personnel (active duty, civilian, and contractor)—across the US and at overseas installations, conducting cyber operations across a range of activities.

At the 315th, airmen are tasked with some of the most innovative cyber missions in the military. These are referred to as “full spectrum operations”—exploiting, attacking, or infiltrating networks. Training and aptitude standards are high.

In evaluating talent, Flynt said, the basics are critical. All airmen must, of course, stay up to date with security and programming architectures, in addition to some of the “latest and greatest” technology used by the squadron.

Over the course of two years, the Air Force will invest some $100,000 in the average airman working with network technology. The squadron also partners with the University of Maryland, he added, for advanced network and information technology training.

The cyber mission demands the merger of career fields which, until previously, operated autonomously, said Lt. Col. Robin Mason, the chief of current operations at 24th Air Force.

Critical Fields

Computer-and-communications airmen and intelligence personnel represent two of the most critical fields in cyber operations. “We’re merging comms and intel in a way that’s never been done before,” Mason said.

Cyberspace officers now are dealing with a blend of communications, intelligence, engineering, net defense, network operations, information operations, and other specialties in one career field, Mason added.

Air Force Space Command has brought in more than 10,000 reserve component personnel from existing Guard and Reserve units associated with the combat communications mission of the 689th Combat Communications Wing at Robins AFB, Ga., and the network operations of the 67th Network Warfare Wing at Lackland.

These two wings, along with Lackland’s 688th Information Operations Wing, provide 24th Air Force’s current three-combat-wing force structure.

SSgt. Gabriel Scarberry instructs SrA. Denise Gonzalez during training at RAF Lemming, Britain. The cyber mission will require USAF to bring together previously separate career fields. (USAF photo by MSgt. Robert Talenti)

The task of creating a career path for the service’s cyber warriors is not new; the Air Force has been at it for several years, starting long before the establishment of 24th Air Force.

“In the past, the Air Force human resources system, as it was, didn’t recognize cyber,” said Lt. Col. Dean A. Clothier, commander of the 39th Information Operations Squadron at Hurlburt Field, Fla. The 39th IOS has served as a sort of incubator for formal training of the Air Force’s cyber warriors, because of the unit’s involvement in information operations and network warfare.

In 2006, when the Air Force created a major, blue-ribbon cyber task force, the 39th IOS was tapped to start initial formal training for cyber warriors. It began the first course in October 2007. By 2008, the squadron was spending more time with its rapidly expanding undergraduate cyber training course than it was working with its traditional network warfare instruction.

The development of cyber career fields for airmen began to move forward, Clothier said, when Lt. Gen. Robert J. Elder Jr., former commander of 8th Air Force at Barksdale AFB, La., pushed reforms, clearing a path for 24th Air Force to assume the cyber mission and stand up career fields for cyber airmen.

Old Careers, New Areas

The reforms established mandates for personnel known as “17 Deltas.” The identifier 17D denotes an Air Force cyberspace operations officer, a career field created in April. It draws into the new career field some 3,000 communications officers in other assignments, according to Capt. Brian Black, the 24th’s chief of operations training. An equivalent enlisted cyber operations airman course will begin in October.

Training has been put together into a course called “undergraduate cyber training” (UCT), Black said. “They will get all of their basic knowledge,” and know what the cyber realm is and what happens in it, he added.

This provides cyber training for operations officers, base-level communications airmen who conduct “touch maintenance,” and all airmen singled out for operations—the ones who “create effects,” as Black puts it. From there, officers will progress into initial qualification training of those who are being tasked with specific mission sets.

Cyber operators will then be sent to mission qualification training, to learn what is known as network attack, network defense, and network exploitation—three related but different tasks in the cyber world.

These are the special mission areas, Black said. “You learn how to defend that network, but continue to operate” while experiencing attacks.

Lt. Gen. William Lord, chief information officer for the Air Force, pins the new cyberspace badge on 1st Lt. Thomas McGrevey, who is assigned to the 844th Communications Group at Bolling AFB, D.C. (USAF photo by MSgt. Russell P. Petcoff)

In addition to the undergraduate training, there will also be a “cyber bridge course” that will take certain communicators and cyber folks from other career fields and channel them into cyber operations.

“We [want to] leverage their knowledge and experiences,” Black said. “Initial accessions will be through UCT cyber training, but if you have a really bright pilot, captain or major, from another field, we could bring them into [this career].”

The cyberspace mission under 24th Air Force is pushing those in old career fields into new areas, said SMSgt. Terrence A. Edwards, the chief enlisted manager for the numbered air force’s intelligence shop.

Edwards, a veteran intelligence airman with a background in special operations, said the unique requirements of the revamped cyber operations field are taking airmen who work in computers and communications and putting them together with intelligence in a unique manner. “Intel is what we call a ‘one series’ specialty,” Edwards said. “We’re an operations kind of area; it’s more of a mindset we’re used to dealing with.”

On the other hand, communications airmen are coming from a different field—one more studied in the sophistication of networks, routers, firewalls, and other aspects of the cyber mission.

“Intel guys know the adversary, … [comm guys] understand networks,” he said. Old specialties are being merged with new requirements and objectives and new reporting chains—operating on a whole new battlefield, in many aspects.

The construct is coming together in pieces to create a pipeline, cyber officials say. On June 22, 24th Air Force assisted Air Education and Training Command in standing up its inaugural UCT course at Keesler AFB, Miss.

The curriculum, first developed by the 39th IOS, now resides at the 333rd Training Squadron at Keesler. It is part of the effort to standardize and shape cyber training across the force. It allows the 39th’s operators to focus on training for advanced network warfare skills.

The UCT course teaches not only cyber fundamentals but also ways to connect various capabilities for operational effect, tying in the various mission components of the cyber mission. The initial class of 15 will be trained to establish, secure, operate, assess, and actively defend seven types of networks.

The new course is only the first step in what the service hopes will be a fully functional cyber warfare career path within a few years. According to AFSPC plans, officers will also receive professional continuing education and advanced academic degrees as they progress through tours in operations, as a schoolhouse instructor, on the Air Staff, in major commands, and in joint duty assignments.

Across the service, the broader goal of these efforts is to build a culture of “cyber wingmen,” said CMSgt. Kevin Slater, the command chief for 24th Air Force. Cyber education will not just be aimed at those entering the 24th but also at others in noncommissioned officer courses.

The Air Force’s intelligence schoolhouse at Goodfellow AFB, Tex., is considering addition of a cyber component to its ground level intel instruction.

“When I was at the 1st Fighter Wing, there were strict guidelines on anyone stepping out onto the flight line and anyone touching the aircraft,” Slater recalled. “We’re trying to get that kind of awareness of the cyber world, of the network, for all airmen to appreciate.”

Maj. Gen. Richard Webber (r), commander of 24th Air Force, greets MSgt. James Fleming. The numbered air force is finalizing its training, operations, and procedures and should be fully operational this fall. (USAF photo by Ted Koniares)

From network defense operators, those who protected and secured Air Force networks, to network attack operators—the airmen who infiltrated networks to create shadowy “full spectrum effects”—policies and requirements have long existed at the squadron level, but none were standardized, said MSgt. Gene Lloyd, an evaluator with 24th Air Force’s standardization and evaluation program.

This has all changed.

Now, at Lackland, evaluators and airmen are spreading out and visiting the new organization’s units, gathering input to assemble the new instruction sets for training, development, and guidance for future cyber airmen to be signed off on by Webber.

The new standards and evaluation instructions were approved, Lloyd said in June; by October, when 24th Air Force declares full operational capability, instructions for training, operations, and standard operating procedures are to be approved.

“The hardest part is getting the mindset to shift,” he said. “Traditional computer operator guys just did traditional training in the Air Force. They weren’t really subject to a rigorous evaluation and constant recertification.”

Damage Control

Col. David Weismiller, head of future programs for the 24th, noted, “We need to build a mentality, at the officer to mid- to senior NCO level down to airmen, with the understanding we are conducting battle every single day.”

Practices such as acquisition cycles more associated with satellite systems or large aircraft production runs don’t apply in the fast-moving world of cyber and network operations, Weismiller said.

Barriers to entry into the cyber domain are much lower, he said. Getting on a network, whether through a computer, a mobile device, or other means is relatively inexpensive for potential adversaries, and USAF’s cyber efforts should reflect the same attitude. “It doesn’t cost contractors or developers … a lot of money to tool up and do research for solutions for cyber effects, … and we take advantage of that,” as the needs are changing constantly, he said.

Webber has delegated authority to field new technology without having to go through a long-term acquisition strategy—a change that has taken timelines for development into days and weeks as opposed to months and years.

We have to posture ourselves appropriately, said Weismiller. The Air Force is in a nonkinetic fight, and kinetic terms don’t always apply. “The policy and doctrine of this mission area have not caught up to the speed of development, the speed of need.”

Many units working in communications and networks under their old command structure were accustomed to a culture of supporting operations. Now, they are being asked to become front-line warriors, on a battlefield with no flight line, no borders, and often a nebulous and constantly evolving enemy.

“Right now, we are in damage control mode a bit,” Clothier mused. “We have the tools and the policy to get a ‘score card’ for our efforts, and we need one.” He said the Air Force is “the furthest along in the cyber enterprise, because the risk is highest” to its network. “We have the most to lose.”