Air Force looks to revamp its definition of cyberspace

Friday - 10/12/2012, 2:10pm EDT

Jared Serbu, DoD reporter, Federal News Radio

Download mp3

The Air Force says it's committed to operationalizing its approach to cyberspace and exercising control over the new warfighting domain as convincingly as it does in air and space. But the service is doing some serious soul searching as it tries to wrestle its definition of "cyber" into something that's manageable and understandable.

The concern about murky definitions of cyberspace goes all the way to the top of the Air Force. Gen. Mark Welsh, the service's new chief of staff, recently said he's worried that the service's understanding of cyber is so broad that it could turn into a "black hole" for programs and money. And when Lt. Gen. Mike Basla took over as Air Force chief information officer earlier this year, Michael Donley, the Air Force secretary, directed him to convene a summit of the Air Force's most senior leaders to get everyone on the same page. Basla said he will host that summit in November.

"The truth of the matter is that if I asked our four-star generals, our chief and our secretary, what is cyberspace, what is the Air Force role in cyberspace, what is our current capability in cyberspace?' we would truly get 15 different answers," Basla told an industry conference Thursday. "So we're going to baseline it internally, get our heads around it and understand that joint warfighter requirement."

Gen. William Shelton is one of those four-star leaders, and also happens to be the Air Force's core function lead integrator for cyberspace as the commander of Air Force Space Command. He said it's incumbent on the service to narrow down its understanding of cyber.

"Our actual working definition is still evolving as we gain operational experience and understanding, but I grow impatient as we watch evolution take its course," Shelton told the annual Air Force IT Day hosted by the northern Virginia chapter of AFCEA. "In 2006, the Air Force published a forward-looking document on cyber, but I think we'd all agree now that we started out too big and too ambitious, so we had to narrow our definition. In those days, some wanted to define cyber as the entire electromagnetic spectrum. In hindsight, I think this breadth had the unintended consequence of confusing everyone, including ourselves."

Shelton said the confusion has had operational consequences because of a lack of clarity about roles and missions within the Air Force.

"I know Mike Basla would back me up on this: I've personally observed confusion in roles, functions, lanes in the road, etcetera, due to the lack of precision in our operating definitions," Shelton said. "We owe it to our people, from the most junior airman to the secretary and chief of staff, to narrowly define what we mean when we talk about cyber. And once we've arrived at that agreed upon working definition, we must clearly communicate that to the field."

Shelton said the Air Force also owes that definition to the other military services, so decisions can be made about which parts of the military are responsible for which missions in a joint environment like U.S. Cyber Command and regional combatant commands, which draw their staff from each of the military services. First though, he said the Air Force has answer questions for itself about which capabilities it can offer.

"Certainly we have to operate and defend our networks. But what about exploitation and offensive operations? Is that Air Force business, or do we count on others to provide what I would call "high end" services? How we answer these questions obviously has major implications for Title 10 and Title 50 authorities within the Air Force," he said.

The Air Force is asking itself other big questions, like how it will acquire cyber capabilities before they're obsolete, how to set realistic expectations for securing its corner of cyberspace, and exactly what composition its cyber workforce should take.

"Just as we spooked the herd with our DC-to-daylight definition of cyber, I believe we've correspondingly confused ourselves when we transitioned all of our legacy communications professionals into the cyber operations career field. Is everyone in the new cyber operations career field doing real cyber work? One could argue it depends on the cyber definition we choose," Shelton said. "If our definition is narrow, it follows that our cyber force should be narrowly circumscribed as well. Do we need to recruit to high-end operations capability for the entire force? Or are we bound to create some haves and have nots in this career field?"

Shelton says the Air Force also needs a new paradigm for how it thinks about security. The current way of thinking, based on the objective of complete information assurance, is unrealistic given the huge spectrum of potential attackers facing the military. Instead, he said the Air Force should think about mission assurance.