The US military is having a hard time getting people with essential information technology and information security skill sets as the services struggle to build a force of "cyber-warriors." During a Senate Armed Services Committee hearing today, senators focused in part on how the work force problem is affecting the US Cyber Command's (US CYBERCOM's) ability to deal with the demands of information warfare and threats both to the Defense Department's networks and those of other agencies and industry.
Admiral Michael Rogers, appearing in his capacity as commander of US CYBERCOM (a role he holds as well as that of director of the National Security Agency), told the committee that he was confident that CYBERCOM would meet a 2018 deadline for the command to reach full operational capability. But he acknowledged that there was still a shortage of service members throughout the military required to sustain CYBERCOM long-term.
DOD's "Cyber Strategy" is based on the creation of a Cyber Mission Force, made up of 133 "cyber mission teams." Those teams will be spread across national infrastructure defense, DOD network defense, delivering "cyber effects" to combat units, and providing analytics and threat intelligence. But the demand for information technology skills of any kind in the military is so high that some services are even cannibalizing their trained "cyber" workforce just to keep the networks up.
Senator John McCain (R-Ariz.) pointed out during the hearing that, of the 124 Air Force network operations officers who had done tours at CYBERCOM, "not a single one stayed in cyber" when they were rotated out of a tour with a cyber mission team.
Rogers explained that the Air Force was "taking officers out of the Cyber Mission Force (CMF) and deploying them in cyber roles elsewhere in the department." But he said that he's been pressuring the services to keep some of those trained on CYBERCOM's mission teams permanently assigned to the cyber warfare mission. "I have been saying to the services that a third [of those assigned to the CMF] should stay with us," he told McCain. "The rest should be distributed elsewhere in the cyber enterprise."
The government has tried a number of ways to develop a "cyber-skilled" workforce. On the civilian side, the Office of Personnel Management, National Science Foundation, and the Department of Homeland Security have developed the CyberCorps scholarship program, which funds undergraduate and graduate studies related to "information assurance" in exchange for government service. The Air Force has developed a Network Operations Officer path for college graduates to get Air Force commissions.
But as Rogers noted in his testimony, "We need a broad range of skills, and many of the best candidates won't necessarily have advanced educations but have deep experience in the field." And the problem won't be fixed with the military's current approach to workforce development, Rogers acknowledged. "We can't keep relying on five- to ten-year development cycles in terms of manpower," he said.
That will require a radical departure from the military's usual approach to recruiting—particularly since few people who already have the skills the DOD wants would be drawn to the typical military recruitment cycle. People who are usually drawn to the military would require years of training to meet the services' needs. But Rogers was insistent that, whatever the solution, it wouldn't be a separate "cyber force," because the military needs personnel who had the context of the overall mission. Only people embedded in the military would have that.
Skipping basic
One of the possible solutions that the DOD has looked at is bringing people with experience and skills essential to offensive and defensive cyber operations into the service "laterally." That means giving them ranks (and pay grades) commensurate to their skills and entirely bypassing the normal recruitment and advancement process.
Even the Marine Corps, which has long required all marines to go through the same basic rifleman training, is considering changes. The potential changes include allowing people with sought-after skills to enter the Corps directly as noncommissioned officers and skip boot camp.
In a speech at a US Naval Institute event in December, the Marine Corps Times reported, Commandant of the Marine Corps Robert B. Neller said that having a skilled cyber workforce within the service was critical: "If you don’t have those things, whatever formation you put on the battlefield is not going to be as survivable or combat effective without them."
Marine Corps force planners are discussing the option of "lateral entry" for people with the desired skillsets to join as uniformed Marines, following the same model used to recruit musicians for the Marine Corps Band ("The President's Own"), which takes in members based on audition.
Maj. Gen. Lori Reynolds, commander of the Marine Forces Cyberspace Command, told the Marine Corps Times' Jeff Schogol, "We need to start thinking outside of the box on some of this stuff because, monetarily, it’s really difficult to keep up with industry offers."
Considering the going pay rate in the civilian world for many information security jobs, the DOD will have to make a significant investment to attract the right people to uniformed service, even after taking patriotism into account.
reader comments
188