The Department of Defense plans to complete the establishment of a new Cyber Mission Force made up of 133 teams of more than 6000 “cyber operators” by 2018, and it’s already nearly halfway there.

From FY2014-2018, DoD intends to spend $1.878 billion dollars to pay for the Cyber Missions Force consisting of approximately 6100 individuals in the four military services, DoD said in response to a question for the record that was published in a congressional hearing volume last month.

“This effort began in October 2013 and today we have 3100 personnel assigned to 58 of the 133 teams,” or nearly 50% of the intended capacity, DoD wrote in response to a question from Rep. Rick Larsen (D-WA) of the House Armed Services Committee. The response was included in the published record of a February 26, 2015 Committee hearing (page 67).

The DoD Cyber Mission Force was described in an April 2015 DoD Cyber Strategy and in April 2015 testimony by Assistant Secretary of Defense Eric Rosenbach:

“The Department of Defense has three primary missions in cyberspace: (1) defend DoD information networks to assure DoD missions, (2) defend the United States against cyberattacks of significant consequence, and (3) provide full-spectrum cyber options to support contingency plans and military operations,” Mr. Rosenbach said.

“To carry out these missions, we are building the Cyber Mission Force and equipping it with the appropriate tools and infrastructure to operate in cyberspace. Once fully manned, trained, and equipped in Fiscal Year 2018, these 133 teams will execute USCYBERCOM’s three primary missions with nearly 6,200 military and civilian personnel,” Mr. Rosenbach said at an April 14 hearing of the Senate Armed Services Committee.

The new Cyber Mission Force will naturally have both defensive and offensive characteristics.

“Congressman, we are building these cyber teams… in order to, one, protect ourselves from cyber attacks,” said Adm. Cecil D. Haney, commander of U.S. Strategic Command. “We are being probed on a daily basis by a variety of different actors.”

“The protection side is one thing,” said Rep. Larsen at the February hearing of the House Armed Services Committee. “What about the other side?”

“The other aspect of it, we are distributing these forces out to the various combatant commands so that they can be integrated into our overall joint military force capability,” Adm. Haney replied.

*    *    *

“Worldwide Cyber Threats” was the subject of an open hearing of the House Intelligence Committee on Thursday.

The foreign intrusions suffered by U.S. government and private networks have yielded some useful lessons, said Director of National Intelligence James R. Clapper.

“Of late, unauthorized disclosures and foreign defensive improvements have cost us some technical accesses, but we are also deriving valuable new insight from cyber security investigations of incidents caused by foreign actors and new means of aggregating and processing big data. Those avenues will help offset some more traditional collection modes that are obsolescent,” he told the Committee.

A newly disclosed Department of Defense doctrinal publication acknowledges the reality of offensive cyberspace operations, and provides a military perspective on their utility and their hazards.

Attacks in cyberspace can be used “to degrade, disrupt, or destroy access to, operation of, or availability of a target by a specified level for a specified time.” Or they can be used “to control or change the adversary’s information, information systems, and/or networks in a manner that supports the commander’s objectives.”

However, any offensive cyber operations (OCO) must be predicated on “careful consideration of projected effects” and “appropriate consideration of nonmilitary factors such as foreign policy implications.”

“The growing reliance on cyberspace around the globe requires carefully controlling OCO, requiring national level approval,” according to the newly disclosed Cyberspace Operations, Joint Publication 3-12(R).

That publication was first issued by the Joint Chiefs of Staff as a SECRET document in February 2013 (as JP 3-12, without the R). But this week it was reissued as a public document. It is unclear whether the public document has been redacted or modified for release.

The discussion of “offensive cyberspace operations” in the original, classified version of JP 3-12 led to adoption of that term in the official DoD lexicon for the first time in March 2013, where it has remained through the latest edition.

Offensive cyberspace operations (OCO) are “intended to project power by the application of force in and through cyberspace. OCO will be authorized like offensive operations in the physical domains, via an execute order (EXORD).”

The DoD document is fairly candid about the challenges and limitations of cyberspace operations.

“Activities in cyberspace by a sophisticated adversary may be difficult to detect” and to attribute to their source. Yet such detection and attribution capabilities are “critical” for enabling offensive and defensive cyberspace operations.

By the same token, “first-order effects of [US cyberspace operations] are often subtle, and assessment of second- and third-order effects can be difficult,” requiring “significant intelligence capabilities and collection efforts” to evaluate.

Not only that, but US cyberspace operations “could potentially compromise intelligence collection activities. An IGL [Intelligence Gain/Loss] assessment is required prior to executing a CO to the maximum extent practicable.”

In any event, offensive cyber operations are to be used discriminatingly. “Military attacks will be directed only at military targets. Only a military target is a lawful object of direct attack.” But military targets are defined broadly as “those objects whose total or partial destruction, capture, or neutralization offers a direct and concrete military advantage.”

Meanwhile, there are persistent vulnerabilities inherent in DoD information systems, DoD said. “Many critical [US] legacy systems are not built to be easily modified or patched. As a result, many of the risks incurred across DOD are introduced via unpatched (and effectively unpatchable) systems on the DODIN [DoD Information Network].”

The risks are increased because “DOD classified and unclassified networks are targeted by myriad actions, from foreign nations to malicious insiders.”

“Insider threats are one of the most significant threats to the joint force,” the DoD document said.  “Whether malicious insiders are committing espionage, making a political statement, or expressing personal disgruntlement, the consequences for DOD, and national security, can be devastating.”

Overall, “Developments in cyberspace provide the means for the US military, its allies, and partner nations to gain and maintain a strategic, continuing advantage,” the Cyberspace Operations publication said.

But “access to the Internet provides adversaries the capability to compromise the integrity of US critical infrastructures in direct and indirect ways.”

These features represent “a paradox within cyberspace: the prosperity and security of our nation have been significantly enhanced by our use of cyberspace, yet these same developments have led to increased vulnerabilities….”