EDITOR’S NOTE: This story has been updated to include comments from Cyber Command and to correct which DoD organizations need new cybersecurity-related hires.

The Department of Defense’s 10-year-old cyber war-fighting outfit is facing growing pains despite a concerted effort by the Pentagon to make cyber a higher priority.

Sources speaking to Fifth Domain described a two-pronged problem with staffing shortfalls at U.S. Cyber Command’s headquarters, as well as the headquarters elements of the four service cyber components. These four headquarters, called Joint Force Headquarters-Cyber, are commanded by each of the service cyber component commanders and plan and coordinate cyber operations for combatant commands they’re assigned to.

In addition, Cyber Command still needs to hire a significant number of coders or tool developers to build the cyber tools that operators need.

A Cyber Command spokesman said the organization’s full-time staff numbers over 1,000 military and civilians (that figure also include contractors). While it is not clear exactly how many new employees DoD’s cyber organizations will require, including Cyber Command and the service cyber components, sources say the department likely needs 1,000 additional employees over the next several years.

Cyber Command spokesman, Col. Daniel King, disputes those figures.

The shortage covers two different pools of employees.

The first includes the command’s headquarters. Cyber Command is staffed predominantly with mid-level and senior Air Force civilians, Jaime Evans Woodard, Cyber Command’s Manpower and Personnel Directorate Cyber recruiting lead, told Fifth Domain in written responses to questions.

When DoD leaders started Cyber Command, the organization relied heavily on U.S. Strategic Command and the National Security Agency for a variety of functions.

Now that it operates separately from STRATCOM and is growing more independent from the NSA, leaders will need to build out staffing and administrative functions, such as operations, acquisition, readiness, logistics and intelligence, all of which require new employees.

The Pentagon reprogrammed about $27.3 million in fiscal year 2017 funds for initial elevation efforts, which includes hiring new headquarters personnel. Cyber Command, as the new global integrator for cyber operations, will act as the connective tissue between combatant commands and Joint Force Headquarters-Cyber elements planning in their respective theaters.

RELATED

In addition, there are staffing concerns at the Joint Force Headquarters-Cybers within the individual service cyber components, which are still subordinate to Cyber Command. With the decision to stand these up, the services needed to request additional personnel to staff them.

These headquarters elements are also not yet fully staffed, requiring operations staff, intelligence personnel and planning personnel.

More coders and developers

Most notably, sources are concerned that the command does not have enough coders or tool developers within its cyberwarrior cadre, known as the cyber mission force.

The full operational capability designation of the cyber mission force means only that the billets on all the teams have been filled. These teams still need more resources and training. The Defense Science Board’s most recent report said, "Cyber operators will need more experience in actually undertaking cyber operations and greater readiness before an effective and credible strategic cyber capability is achieved,” as “cyber operators do not get the exposure they need to make them proficient at their craft.”

According to sources, when DoD leaders designed the cyber mission force, they leaned too heavily on operators and the tools developed by others and as a result not did adequately consider the staffers needed to create new tools.

Cyber Command historically has heavily relied upon the NSA’s for developers to provide exploits or to repurpose NSA’s intelligence tools for war-fighting missions.

A House Armed Services Committee staffer told Fifth Domain that the committee is tracking staffing and manning issues.

Getting the command fully staffed and resourced is critically important, the staffer said. While the new defense policy bill doesn’t specifically help cyber components add staff, it helps lay the groundwork for more hiring.

Hiring efforts

DoD, Cyber Command and the services have been trying to increase their efforts to attract, train and retain top coder talent, as well as staff up various headquarters elements.

Evans Woodard, the manpower and personnel lead, said the command has partnered with the Air Force Personnel Center’s Talent Acquisition Division, given that the command is staffed mainly with mid and senior level Air Force civilians, to assist with its recruitment of an outstanding civilian workforce.

Evans Woodard said the command is trying to fill civilian position to include cyber planners and support to cyber operators such as intelligence support, as only uniformed personnel can be the “trigger pullers,” so to speak, under international law, along with all support function civilians such as logisticians, resource managers and HR professionals.

Cyber Command has begun to leverage unique authorities to help it compete with the private sector in the ongoing battle for cyber talent. One tool is the Cyber Excepted Service, which “promotes a culture that is based upon mission requirements and employee capabilities while offering flexibilities for the recruitment, retention, and development of professionals across DoD supporting cyberspace,” Evans Woodard said.

She added that while Cyber Command transitioned to the Cyber Excepted Service in February 2018 under Phase I implementation, the service cyber components will transition during Phase II, which extends through 2020. Until Phase II, however, these organizations have direct hire authority, which, according to an August 2017 memo, enables recruitment for cyber positions without applying competitive rating and ranking procedures.

The memo lists a series of work roles for which a critical hiring need exists. They include telecommunications, computer science, electrical engineering, computer engineering, electronics engineering, electronics technical and IT management. Additional roles in which a cyber work role code must be assigned in order to direct hire include security administration; human resources; miscellaneous administration and program; program management; management and program analysis; general engineering; general business and industry; operations research; mathematics; general education and training; training instruction; general inspection, investigation, enforcement and compliance; investigative analysis; and criminal investigation.

The services are trying to fill similar positions and roles. A Fleet Cyber Command spokesperson told Fifth Domain it is interested in hiring computer scientists, cybersecurity experts, data scientists, software developers and information assurance technicians and managers.

Army Cyber Command has identified network operations, cybersecurity, malware and forensic analysis, and general problem-solving roles they need.

The Defense Digital Service out of the Pentagon is helping Army Cyber Command with its talent management through a pilot effort known as the Jyn projects. Named after a character in the Star Wars franchise film “Rogue One,” the project seeks to leverage the top technical talent already brought in from the private sector through DDS and pair them with the top technical talent that ARCYBER has identified, Nicole Camarillo, executive director of talent strategy at ARCYBER, told Fifth Domain in an interview.

She added the program aims to fill a gap of mid- to senior-level mentorship on the tech talent side for tool developers to enhance their skillsets.

Marine Corps Forces Cyberspace command is nearly doubling the size of its staff, adding more than 500 uniformed and civilian personnel, a spokeswoman said. The growth, which is programmed to occur in the next five years, includes increased critical capacity at the MARFORCYBER headquarters staff, increasing the size of Marine Corps Cyberspace Warfare Group to focus on improving readiness and creating a fully staffed JFHQ-C.

The Air Force’s cyber component, 24th Air Force/Air Forces Cyber, is looking to bolster its workforce with cyber, intelligence, linguistic analysts and exercise and operational planners, a spokeswoman told Fifth Domain.

They added that unique to the Air Force, the service integrated Guard and Reserve units to its overall build of the cyber mission force. As such, they will need to maintain a constant need for intelligence professionals, planners, data architects/scientists, computer scientists, cybersecurity experts and software developers.

In such a dynamic field, the current force might not resemble the force of the future.

Speaking at the Aspen Security Forum July 21, Cyber Command chief Gen. Paul Nakasone articulated how different the cyber force might look from the traditional military force that has always existed.

“This is probably not going to be a force that’s going to be like myself that comes in and anticipates doing 20 years or 30 years and then has a nice retirement,” Nakasone said during his first public remarks since taking command. “This is a dynamic force that comes and goes.”

About Mark Pomerleau

Mark Pomerleau is a reporter for C4ISRNET, covering information warfare and cyberspace.

Share:
More In Cyber