America is falling behind in its ability to carry out and defend against cyberattacks. And one reason, according to a new report, is that the U.S. military is recruiting too many jocks and not enough nerds.
“They’re going for the kids that are physically fit, mentally able, and that means they’re sitting outside the basketball locker rooms, the men’s and women’s soccer locker rooms, the football locker room,” retired Rear Adm. Mark Montgomery said. “If they’re recruiting the right Cyber Force, they would be sitting outside the robotics lab, the e-gaming basement, hub, whatever it is, at the school.”
Montgomery, former executive director of the congressionally mandated Cyberspace Solarium Commission, is coauthor of the report published by the Foundation for Defense of Democracies, where he is senior director of its Center on Cyber and Technology Innovation.
Along with Erica Lonergan, who was lead writer of the Pentagon’s 2023 Cyber Posture Review and is now an associate professor at Columbia University, the authors interviewed with more than 75 active-duty and recently retired military personnel. They all said the current system, in which each military service recruits its own cyber warriors, is failing to produce a force robust enough to counter China, Russia, and a host of other malign cyber adversaries.
“The consensus was nearly universal,” Lonergan said. “It was overwhelming in that everyone who was interviewed agreed that the status quo is not sustainable.”
“In the U.S. military, an officer who had never fired a rifle would never command an infantry unit. Yet officers with no experience behind a keyboard are commanding cyber warfare units,” the authors wrote in the just-published monograph U.S. Cyber Force: A Defense Imperative. In it, they call for a new, separate branch of the armed services that would recruit, train, and employ at least 10,000 troops who would be singularly focused on offensive and defensive battles in cyberspace.
“There is ample precedent for this approach; battlefield evolutions led to the establishment of the Air Force in 1947 and the Space Force in 2019,” they wrote.
When then-President Donald Trump became enamored of the idea of a separate Space Force, during his second year in office, the Air Force initially resisted. The military branch insisted it could handle the space mission without creating a whole new bureaucracy, and the proposal quickly became the target of internet mockery and the subject of a farcical, short-lived Netflix series.
But the logic of having one service concentrating on the increasingly import warfighting domain of space won over the critics, despite the running jokes about Star Trek-like logo and “Space Cadets” in funny uniforms.
“The crazy uniform thing has already been taken by Space Force. I don’t think we have to worry there,” Montgomery said at a recent virtual event, where he laid out the vision of a Cyber Force that would appeal to young people who otherwise might never consider a career in the military.
“We’re recruiting the wrong people,” Montgomery said, asserting that because the services look for the best candidates overall, the question of whether they are computer savvy is an afterthought.
“We get the best, most cyber-relevant person the service happened to have recruited. Unless, of course, that person’s needed as a special operator, a nuclear operator in the Navy, or an AEGIS technician in the Navy,” Montgomery said. “What I’m talking about is going for people that you probably don’t even show up at the door if you haven’t learned Python (a popular computer programming language), if you haven’t learned basic coding.”
Currently each service has its own cyber warriors who can be employed by the U.S. Cyber Command, which is led by a four-star officer who wears two hats and is also director of the National Security Agency.
What Montgomery and Lonergan propose is a small service, beginning with about 10,000 people, and growing to maybe 17,000, with full autonomy and a distinct culture oriented to the unique and requirements of operating in cyberspace.
“Cyber Force should be initially stood up within the Department of the Army, similar to how the Space Force is within the Department of the Air Force, the Marine Corps is within the Department of the Navy,” Montgomery said.
The way it works now, with cyber forces distributed among all the services, commanders have to spread their human resources among multiple important priorities.
“The inefficient division of labor between the Army, Navy, Air Force, and Marine Corps prevents the generation of a cyber force ready to carry out its mission,” the report concludes. “Recruitment suffers because cyber operations are not a top priority for any of the services, and incentives for new recruits vary wildly.”
“Trying to grow it by going to services and saying, ‘Could you man one less destroyer or one less F-35 squadron, or one less battalion, and give us the troops?’ They’re not going to do that,” Montgomery argued. “The only way you’re going to raise this is a Cyber Force commander, joined at the hip with a Cyber Command commander, going to the Secretary of Defense or the Chairman and getting it.”
As was the case with the birth of the Space Force, there are doubters who question the need to establish another new service, but one skeptic who has been won over is Rep. Mike Gallagher (R-WI), who though one of the most respected members of Congress on national security affairs, is quitting the House on April 19.
“I came in skeptical, right because … we’ve just created Space Force. We don’t need more different uniforms. The risk is you create more bureaucracy, and it isn’t an efficiency over time,” Gallagher said.
But Gallagher found the report “powerful” and said that it has persuaded him that “the status quo is unacceptable.”
“For the past decade, my colleagues in Congress, both Republicans and Democrats, working together, have tried to address force design and readiness,” Gallagher said. “We’ve passed dozens of pieces of legislation to try and fix the problem in the military cyber workforce acquisition and overall force readiness. And yet, we are seemingly no better off because of it.”
At the end of January, Gallagher’s bipartisan House Select Committee on the Chinese Communist Party heard testimony from the FBI and the U.S. Cyber Command about an effort known as “Volt Typhoon,” a Chinese attempt to embed malicious software in vulnerable office routers that could later be activated to cripple America’s water treatment plants, electrical grid, oil and gas pipelines, and transportation systems.
“China’s hackers are positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities, if and when China decides the time has come to strike,” FBI Director Christopher Wray testified at the Jan. 31 hearing.
The attack was thwarted, but Gallagher warned it was the kind of cyberwarfare that could presage a Chinese invasion of Taiwan.
“This is the cyberspace equivalent of placing bombs on American bridges, water treatment facilities, and power plants,” Gallagher said. “It’s an active and direct threat to our homeland, to our military, our ability to surge forces forward in the event of a conflict, and it’s not a hypothetical.”
“To quantify what we’re up against, the [People’s Republic of China] has a bigger hacking program than that of every major nation combined,” Wray said. “In fact, if you took every single one of the FBI’s cyber agents and intelligence analysts and focused them exclusively on the China threat, China’s hackers would still outnumber FBI cyber personnel by at least 50-1.”
CLICK HERE TO READ MORE FROM THE WASHINGTON EXAMINER
“The future of our nation, the future of our economy is tied so closely to the future of our ability to operate in cyberspace,” Gen. Paul Nakasone, commander of U.S. Cyber Command, said when asked if he had a message for young Americans.
“If you’re looking for challenge, if you’re looking for fulfillment, I would tell you that any of the agencies that you see here provide a mission and a responsibility that would dwarf your imaginable expectations.”
