A new wide-ranging report issued from the Government Accountability Office examines what the advantages and disadvantages are of the dual-hat arrangement for the head of the National Security Agency and U.S. Cyber Command, among other things.
For the past few years, there has been much discussion regarding the separation of these two agencies as CYBERCOM was co-located with NSA at its standing up to help get the organization on its feet. As their capabilities and capacities mature, there has arisen a heated argument between some in the executive branch and in Congress to split the two, something that was always envisioned with no clear timeline indicated.
“According to officials, DoD does not have an official position on the advantages and disadvantages of the dual-hat leadership arrangement of NSA/CSS and CYBERCOM,” GAO’s report said. “As of March 2017, DoD officials informed us that DoD had not determined whether it would end the dual-hat leadership arrangement and was reviewing the steps and funding necessary to meet the requirements established in the law.”
Advantages include more in-depth coordination and collaboration, faster decision-making and more efficient use of resources.
Disadvantages, meanwhile, citing comments from officials canvased, include:
- Concerns about unfair prioritization of requests for support: Officials from CYBERCOM reported concerns that CYBERCOM priorities could be prioritized over those of other commands, which creates problems given that NSA is a combatant command support agency;
- Increased potential for exposure of NSA tools and operations: Officials noted that NSA and Cyber Command share tools very often creating a risk of undue exposure to exploits need to gain access to adversarial networks for intelligence purposes;
- Broad span of control: DoD officials said the responsibilities of each organization may be too broad for a single individual;
- Tension between military operations and intelligence operations/actions: war fighting and intelligence missions might not always be mutually achievable and, thus, lead to increased tension between NSA and Cyber Command staff, officials from each organization and a senior official told GAO. Often times, there are equities that must be reconciled; for example, when to shut down a particular network that could be yielding important intelligence insights, and;
- Limited understanding of resourcing: DoD officials told GAO that while the dual-hat allows for mutually beneficial sharing of resources, it results in resource allocation that is not always easily understood by all personnel.
Congress has stipulated a series of measures the government must meet prior to severing the dual-hat, one of which is the cyber mission force must reach full operational capability, something that is not slated to occur until September 2018.
The GAO report also outlined, based on conversations with DoD officials, efforts to mitigate risks associated with ending the dual-hat. They include:
- FOC of the cyber mission force;
- Formalization of agreements between NSA and CYBERCOM to ensure collaboration on key issues, which have been drafted but not approved as of March 2017;
- Development of a persistent cyber training environment, which is being spearheaded by the Army;
- Elevation of CYBERCOM to a unified combatant command. Lt. Gen. Paul Nakasone, commander of Army Cyber Command said during the DefenseOne Tech Summit in July that this decision rests with the president;
- Completion of NSA-21, the NSA’s agency-wide reorganization initiative, which is slated for FOC in December 2017.
Mark Pomerleau is a reporter for C4ISRNET, covering information warfare and cyberspace.
