As U.S. Cyber Command continues to mature its workforce, operations and tactics, so too are allied nations, some of which are also standing up cyber commands.
Just as the U.S. enjoys information sharing, intelligence sharing and cooperative battlefield integration with friendly international forces, the it is seeking to do the same in cyberspace.
CYBERCOM is currently working on a concept of operations draft about defensive cyber ops with the Five Eyes nations, which includes the U.K., Canada, Australia and New Zealand.
Brig. Gen. Maria Barrett, deputy of operations J-3 at CYBERCOM, at a June keynote address hosted by AFCEA’s Northern Virginia Chapter announced the development of the draft.
"This included a tabletop exercise with the participants to better understand the friction point when it came to how we might operate in defensive operations together," she said.
Beginning with the Five Eyes partners made sense given the robust intelligence sharing information the already exists, Lt. Cmdr. Brian Evans, lead strategist and defensive cyber operations planner in the Defense Department Information Network Operations and Defensive Planning Division at CYBERCOM, told C4ISRNET on the sidelines of the Defensive Cyber Operations Symposium in Baltimore, Maryland, on June 15.
"When it comes to the sharing of information with regards to defensive cyberspace operations, the mechanisms are already there," he said.
In regard to what defense cyber operations would look like between countries, Evans said there are different forms: It could be sharing threat intelligence information where each nation is acting independently but synchronized; it could be one nation supporting another with capability or capacity on another nation’s host networks; it could be integrated operations on a shared environment such as the mission partner environment where multiple nations touch a partner network or piece of terrain.
The goal is to operate together in cyberspace, coordinating and synchronizing to achieve a desired objective.
Such a partnership could be a template for future coalition operations in a multi-domain, multinational campaign across a theater of operations aimed toward a joint objective. However, Evans noted that CYBERCOM — which is still an infant organization — along with other nations have to crawl, walk and then run.
"We’re going to start with the Five Eye partners where that information sharing is the easiest," he said. "We are much closer in the way that we operate and think, and once we’ve accomplished that, we will look to then: How do we integrate with NATO? how do we integrate with potentially partners outside of NATO for various purposes when required?"
According to Barrett, the hope is to be conducting joint defensive cyber ops in the fall. In the meantime, Evans said the questions surrounding defensive cyber ops with Five Eyes partners remain: How do they do that command and control? What are the capabilities that each country brings to bear? How do they integrate and synchronize those capabilities to maximize their operational advantage?
Mark Pomerleau is a reporter for C4ISRNET, covering information warfare and cyberspace.
