The Air Force was recently the punching bag for harsh jabs made by the chairman of the Senate Armed Services Committee.
"Out of the 127 Air Force cyber officers, that completed their first tour on the cyber mission force, none went back to a cyber-related job," Sen. John McCain, R-Ariz., said during a May hearing. "That is unacceptable and suggests a troubling lack of focus. It should be obvious that the development of steady pipeline of talent and retention of the ones we've trained already is essential of the success of the cyber mission force."
The commander of U.S. Cyber Command, Adm. Michael Rogers, who was testifying in front of the committee at the time, was the subject of McCain's and other senators' derision pertaining to the Air Force's cyber warriors.
"I'm trying to make the argument with the services, what we need to do is … I think something along the order of a third should stay with us [CYBERCOM], the rest we should look [at] how do we put them elsewhere within the cyber enterprise to build the cyber level of expertise across the department," Rogers told the committee.
He was also sure to clarify that these officers weren't cycling out of the cyber mission force into non-cyber-related jobs.
"If could say, when we say 'not in that field,' the experience we're seeing is they're taking officers that are rolling out of the cyber mission force … and employing them in other areas in cyber in the department," Rogers added. "That's why I say one of the challenges if you're a service, you have a wide spectrum of cyber requirements beyond what Cyber Command is responsible for."
[ Big changes coming for Air Force Cyber Command]
The cyber mission force is the 133 teams that each service is proportionally providing to CYBERCOM — while some teams will be retained by each service's cyber component — that will address high-level cyber problem sets.
The Air Force is responsible for providing 39 of the 133 cyber mission force teams to CYBERCOM of all stripes to include offensive and defensive. On the active-duty side, the Air Force has roughly 2,500 cyber officers, according to the director of Air Force cyber strategy, Maj. Gen. Patrick Higby, who spoke to C4ISRNET in a recent interview. Those 2,500 cyber officers must fill the requirement of the cyber mission force, as well as exclusive Air Force cybersecurity requirements.
Officials have previously indicated 24th Air Force's cyber mission force personnel on the 39 teams will equal roughly 1,700 individuals.
Air Force cyber operations officers "are short manned right now in terms of the number of billets that we have to fill across the Air Force versus how many officers we have in the inventory," Higby said, when asked about the 127 officers that cycled out of the cyber mission force. Cyber is a high-demand, low-density asset, he added.
Two years ago, he said, the Air Force made a deliberate decision to provide back-to-back assignments for those officers in any 24th Air Force, or Air Force Cyber, unit, which encompasses the Air Force's contribution to the cyber mission force, or CMF, but is not limited to it.
When it comes to retention rates in the Air Force for cyber, Higby said, the cyber mission force is manned at 100 percent, meaning the 39 Air Force teams will get 100 percent of their manning from an Air Force perspective and the service has to take risk in other areas across the force that could be manned up to an entitlement level that. depending on the rank. might only be 60 percent.
While the Air Force is retaining at an average of 70 to 74 percent, the problem for the cyber field is that the service — and the cyber field across the nation — is "chronically undermanned," and the Air Force must retain officers at 90 percent in order to keep all manpower lines looking healthy. This means the service has to "do some exceptional things to retaining at a higher-than-average rate," Higby said.
Cyber SWAT teams
The Air Force is trying to leverage cyber training to get the best return on investment because it's rigorous and takes time for a lieutenant fresh out of college to be mission-effective on a keyboard, he added.
The feeling for these officers is mutual. They came to the Air Force to be cyber warriors and "they're jazzed about that," Higby said, and they don't want to cycle out to the cyber workforce either.
The other services are also trying to retain their cyber warriors for the duration of their career as to not lose personnel in which time and money were invested.
[ Marines look to dominate in information environment ]
There are other cyber jobs within the Air Force aside from the CMF that require some degree of skill and training to get at organic problem sets, specifically the five core Air Force missions:
- Air and space superiority.
- Intelligence, surveillance and reconnaissance.
- Rapid global mobility.
- Global strike.
- Command and control.
[Services integrating cyber and traditional military forces]
One such mission is aimed at something called the cyber squadron initiative, which seeks to ensure the individual squadron level can fight through cyber incidents — whether from adversaries or insiders — to make sure the wing commander can complete their mission even if it's in a degraded state.
This effort is separate from the CMF and is being manned with mission defense teams, or MDT. On the surface, Higby equated MDTs to looking similar to cyber protection teams, which are part of the CMF even though cyber protection teams are much larger.
He envisions MDTs as "beat cops," meaning cyber protection teams are the SWAT teams, an analogy that has been made by other commanders.
[ Cyber 'beat cop' needed to add context for SWAT teams ]
The beat cop patrols the network on a regular basis, knows what normal might be and can deal with certain threats. However, if the problem is too big to handle, the cop will call in the cyber SWAT team (or CPT), which is essentially a quick-reaction force.
The way these locally focused MDTs could interface with CYBERCOM at the higher, strategic level, could be if an MDT at a location is seeing some adversarial activity that causes concern, Higby said he would expect that activity would ultimately get elevated up to CYBERCOM, and the head of CYBERCOM would have to decide what, if anything, needed to be done.
Higby also added that as the services are in charge of organizing, training and equipping war fighters, and are always looking at potential changes that can be made to figure out whether there's a better way to organize the Air Force around the cyber mission. "That's all being evaluated and discussed right now," he said.
Mark Pomerleau is a reporter for C4ISRNET, covering information warfare and cyberspace.
