The idea to establish a new military service dedicated to cyber warfare reared its head again this week thanks to a proposal in Congress and a think tank report. But essential questions about how a so-called “Cyber Force” would be manned and work with the other services remain.
Sen. Kirsten Gillibrand (D-N.Y.) plans to introduce an amendment to the 2027 defense policy bill establishing a Cyber Force under the Department of the Army, her office confirmed to Air & Space Forces Magazine. Defense One first reported the amendment.
Meanwhile, a commission led by the Center for Strategic and International Studies and Foundation for Defense of Democracies think tanks released a report June 3 treating the new service as an inevitability and looking at how the Pentagon should organize and sustain it.
The report, based on 10 months of research by a 22-member commission made up of retired field grade and general grade officers, industry leaders, and former leaders of key military cyber organizationsm, recommends a force of:
- 20,000 Active-Duty personnel
- Up to 5,000 Cyber Guard members
- As many as 6,000 civilian employees
Such a force would have no enlisted ranks, only commissioned and warrant officers and be responsible for all offensive and defensive cyber operations, leaving the other services to manage their own internal information networks.
But while the report looked at the option of putting a Cyber Force in the Department of the Army, it noted drawbacks to that approach and didn’t settle on a recommendation for the potential service’s alignment with the Pentagon and other services.
And other experts raised questions about the mix of civilian and military operators and noted the different services have made investments and taken specific approaches with cyber.
Uniformed vs. Civilian
The 70-page “Commission on Cyber Force Generation” summary report covers an array of topics related to creating a new force but focuses primarily on building up the personnel needed to man it.
Its recommendations would create a military service unlike any of the traditional branches. It would be small—comparable to the Space Force and just a fraction of the estimated 225,000 cyber personnel currently assigned to the Department of Defense. It would have a Guard but no Reserve, and a far greater proportion of civilians than most services. And its lack of enlisted personnel would make it more like the U.S. Public Health Service than the rest of the military.
Todd Harrison, a senior fellow at the American Enterprise Institute and defense budget expert, said that in order to justify such an independent service, two key questions need to be answered: does the Pentagon need uniformed service members conducting cyber operations, and how many does it need?
“If the answer ends up being most of these positions need to be military, then that does lead you in the direction of, you know, maybe standing up in an independent service,” Harrison said.
While the report recommends a force that’s about one-quarter civilian when not counting the Cyber National Guard, one of the commission members behind it, retired Navy Rear Adm. Mark Montgomery, told reporters that some operational units in a Cyber Force could have a mix of 50 percent civilian and 50 percent military.
That’s because the Cyber Force, due to its highly technical focus, would lean heavily on civilian expertise. The report emphasizes that there will be a “greater emphasis on permeability and lateral entry than the other services.”
Still, the uniform/civilian divide carries weight—Jen Easterly, a former Army cyber officer, director of the Cybersecurity and Infrastructure Security Agency, and head of Morgan Stanley’s cybersecurity division, told a National Academies committee in May that some cyber defense operations that CISA helps with, like protecting civilian infrastructure, are perhaps more suited for non-uniformed personnel.
“I can certainly say from my time in the private sector … it would not feel like a natural thing to have people on Active-Duty defending that U.S. private critical infrastructure,” she said. “Is that something that somehow we can actually evolve into? I don’t know. Maybe.”
How a potential Cyber Force would interact with other cyber-focused government agencies is one question. How it would fit with other military services is another.
Other Services
Right now, the military branches recruit, pay, and retain cyber personnel. They also conduct some cyber operations of their own, though U.S. Cyber Command has started using its authorities to train, equip and field cyber operators.
Increasingly, though, the military is wielding cyber in tactical settings, said Bryan Clark, senior fellow at the Hudson Institute.
While there’s still a need for cyber specialists operating from the homeland and using the internet to attack adversary networks, a combination of electronic warfare and cyber tools from ground radios, airplanes, and satellites means that cyber operators have to be in theater to achieve effects.
Clark pointed to the Air Force’s EA-37 Compass Call aircraft as a prime example.
Operators use the militarized Gulfstream G550 jet to conduct theater-level electronic attacks, but cyber effects piggyback on those invisible strikes to disable enemy defenses in ways that are far more complicated than simple jamming.
That’s because adversaries are firewalling their operations, making self-contained networks and not using the internet, which they know is vulnerable from anywhere on the planet, Clark said.
“I’ve got to now have some people that get this capability down range,” Clark said. “So, we’re doing more and more of this locally.”
Each of the services approach tactical cyber in different ways. The Air Force and Navy are much more about delivering cyber effects using a variety of delivery methods, Clark said.
The commission report found that putting a Cyber Force within the Department of the Army makes sense in that both the Cyber Force and the Army “are similarly focused on the individual as the central element in operational planning, particularly when compared to the platform-centric view of the Navy or Air Force.”
But the report also warned that doing so risks the smaller Cyber Force not getting enough focus compared to the much larger Army, and some commission members warned that the Army’s service culture has struggled to incorporate cyber operators. A new Cyber Force might face a similar challenge as the Space Force, which worked to establish a culture separate from the Air Force as it incorporated personnel from across the services used to doing things in different ways.
What’s Next
This is not the first time Congress or experts have looked at the idea of a Cyber Force. Indeed, Gillibrand and other lawmakers pushed for language in the 2025 National Defense Authorization Act directing a “consensus study” on the issue. The National Academies is conducting that study, and the results are expected in the coming months.
Even without it, though, Gillibrand is ready to start pressing for a new service in the 2027 bill.
“I believe, and many experts agree, that the creation of a dedicated Cyber Force will ensure the United States is ready to fight and win on the modern battlefield and protect our national security,” Gillibrand’s office said in an email statement to Air & Space Forces Magazine.
Gillibrand did not lay out the structure of the service she is proposing or a timeline for it to stand up. The commission report estimated initial costs would likely fall at around $11 billion to stand up the force and about $20 billion to operate it annually, with 12 to 18 months needed to reach initial operational capability.
Other lawmakers like Rep. Pat Fallon (R-Texas) have expressed support for a Cyber Force as well. It remains to be seen whether he will introduce an amendment similar to Gillibrand’s when the House Armed Services Committee marks up its version of the 2027 NDAA on June 4.
Regardless, the idea is likely to face pushback. Already, former CYBERCOM commanders retired Air Force Gen. Timothy Haugh and Army Gen. Paul Nakasone have advocated for more time for the CYBERCOM 2.0 effort, launched in November, to provide its findings as the Pentagon implements an updated cyber force generation model before founding a new service, Air & Space Forces Magazine previously reported.