Getting to Ground Truth on the Elevation of U.S. Cyber Command
One of my biggest frustrations during my time in the Office of the Secretary of Defense’s cyber policy office was the way elevating U.S. Cyber Command became overhyped. Cyber Command was created as a subordinate command within the military’s premier nuclear deterrence command, U.S. Strategic Command. There were good historical reasons for this, but my analysis convinced me there was nothing Cyber Command could undertake if it became a unified command that it could not already do as a subordinate command. Yet as cyber operations became more prominent, the chorus grew to elevate it to its own, independent command. While I never found reason to oppose such a move, I did not think the benefits were all that remarkable. The more consequential question would be when and how to separate the leadership of Cyber Command from the National Security Agency.
Ultimately, Obama administration officials deferred elevating Cyber Command because they viewed it as linked to this related issue of separating the command from the NSA — because they did not undertake the latter, they passed on the former.
On Friday, Aug. 18, President Donald Trump took a different approach. He elevated U.S. Cyber Command to the status of a “full unified command” within the U.S. military but deferred the decision to appoint a new Cyber Command commander independent of the NSA director. I spoke with Bobby Chesney and Susan Hennessey before the announcement about what might be in store, and Kate Charlet had a great write-up in War on the Rocks a few days later. In this piece, I’d like to assess the validity of various arguments in favor of elevating Cyber Command to this “unified command” status.
My bottom line: While I support the administration’s decision to elevate Cyber Command, its stated reasons for doing so are overdrawn. The true benefits are long-term and bureaucratic. Elevating Cyber Command is only one step on the road to turning it into something else: an institution less intertwined with the intelligence community and better integrated with the other elements of the military. Before turning to what I see as the real benefits, let’s review the administration’s arguments for why elevation matters.
Elevation makes us better at everything “cyber.” Trump’s statement announcing the elevation puts a lot of weight on the idea — so much so that we are left to wonder, what took so long? Trump asserts that elevation will “strengthen our cyberspace operations,” “create more opportunities to improve our Nation’s defense,” “reassure our allies and partners,” “deter our adversaries,” and for good measure, “[demonstrate] our increased resolve against cyberspace threats.” At best, these assertions greatly overstate the impact of elevation. At worst, they obscure more than they reveal. I do not know how elevation “strengthens” cyberspace operations or creates more “opportunities” for defense, though I can’t see how it hurts either objective. The latter three assertions rest on a premise that other countries understood that Cyber Command was subordinate to U.S. Strategic Command (did you?) and believed that such subordination was consequential. Either way, it is hard for me to see how an organizational promotion accomplishes all these critical objectives.
Elevation secures cash money for Cyber Command. Trump claims that “elevation will also ensure that critical cyberspace operations are adequately funded.” I am all for adequate funding, even more than adequate funding! The only issue is that I know of no significant funding shortfall for the Department of Defense’s cyber mission, though Charlet is correct when she points out that there are some longer-term underfunded challenges. In fact, funding for cyber-related issues was one of the few protected budget areas during my time at the Department of Defense — issues that leadership prioritized so much they were willing to cut accounts of almost anything else. Even if Cyber Command remained a sub-unified command, I’m pretty confident its operations would have been “adequately funded.”
Elevation streamlines command and control. This is true on paper, but I doubt it matters much in practice. Elevation removes Strategic Command from the formal line of communication between the secretary of defense and the commander of Cyber Command. So if the secretary of defense issues an order to Cyber Command, that order can now be sent to the commander of U.S. Cyber Command without being routed through the commander of U.S. Strategic Command. However, I always wondered how much this formal “routing” was adhered to, especially for “time-sensitive cyberspace operations.” Ironically, the bigger winner here may be Strategic Command because it can now devote more focus to its original, core mission of nuclear deterrence. With a series of nuclear-related mishaps over the last several years, it makes sense to reduce Strategic Command’s span of control and remove cyber issues from its formal purview so that it concentrates on its nuclear-related missions.
These three rationales represent the conventional wisdom about why elevating Cyber Command is a good idea. To be clear, I support the administration’s decision to elevate Cyber Command. But I believe elevation is best understood as an internal move — a way to separate Cyber Command from the intelligence community and integrate it with other elements of the military.
Greater independence from the intelligence community. The fact that the commander of Cyber Command is the same individual who leads the NSA (he is “dual-hatted”) and that both organizations are located at Fort Meade (the NSA’s longtime home) are among many factors that create the impression that Cyber Command is just an extension of the intelligence community. Indeed, former NSA Director Michael Hayden recalls that in 2004-2005, cyber forces would be “living off a lot of NSA resources to backstop what were unarguably combat rather than intelligence activities.” When Secretary Robert Gates formally established Cyber Command through a 2009 memo, the objective was not to replicate the NSA and undertake more intelligence collection, but rather for the command to be able to generate “warfighting effects” like disrupting critical systems during a conflict. Elevating the command is a necessary first step towards breaking the dual hat and more formally separating Cyber Command from the NSA and the intelligence community. Otherwise, Strategic Command would need to advocate on behalf of Cyber Command for support of mission priorities and allocation of resources.
Greater integration into combined arms. In Gates’ 2009 memo, he wrote that the Department of Defense needed to stay focused on “the integration of cyberspace operations.” Integrating them into what? Into how the rest of the military plans, organizes, trains, and equips to execute warfighting missions. For those steeped in military process, think of this as force development: for too long, cyber issues have been relegated to what a colleague calls the “geek ghetto” — off to the side, separate from the Department of Defense’s normalized approaches to preparing for possible conflict. As a result, this integration has yet to take hold across the military.
Relatedly, Gates stated that Cyber Command “must be capable of synchronizing warfighting effects across the global security environment.” If and when conflict breaks out, whatever actions the U.S. military undertakes — at sea, in the air, on land, in space, and in cyberspace — must be coordinated. Again, for those more familiar with the military, consider this force employment. The only way this kind of integration will happen is if cyber issues are seen as equal alongside the core military domains. Despite all the rhetoric that cyber issues keep everyone up at night, the traditional and more familiar areas of air, land, and sea power continue to dominate the bureaucracy’s agenda during the day.
Elevation offers Cyber Command a better seat at the table for more effective future force development and employment. We won’t see the payoff immediately. But over time, a more empowered Cyber Command stands a better chance of ensuring its priorities become routine throughout the military. It will not surprise anyone to learn that rank and hierarchy matter when it comes to the armed forces. It is in the context of these internal battles within the military — not the external security environment and our adversaries’ perceptions of our power — that elevating Cyber Command makes the most difference.
Sen. John McCain had it spot on when he said, “While we welcome this elevation, there is much more to be done to prepare our nation and our military to meet our cybersecurity challenges.” If the original arrangement to dual-hat the commander of NSA as a component of Strategic Command was only “a way station en route to a full-up cyber command,” then the next stop will be the eventual appointment of two different individuals to lead the NSA and Cyber Command. But the journey will not end there. As I’ve highlighted previously, maybe elevation will empower leaders at Cyber Command to think more broadly about what an information warfare command might look like. Or, perhaps elevation gets us a step closer to retired Admiral Jim Stavridis’ proposal of establishing a separate cyber military service. Regardless, getting to ground truth on the true benefits and costs of these reforms is essential if cyber forces are to be truly integrated into the U.S. military.
Michael Sulmeyer directs the Cyber Security Project at the Harvard Kennedy School’s Belfer Center for Science and International Affairs. Follow him on Twitter at @SultanOfCyber.
Image: U.S. Navy photo by Petty Officer 2nd Class Joshua J. Wahl
