DOD and U.S. Cyber Command Have Broadly Identified Roles and Responsibilities for Cyberspace Operations, but Additional Clarity Is Needed

DOD and U.S. Cyber Command have made progress in identifying the roles  and responsibilities of the various organizations that support DOD  cyberspace operations. Our analysis showed that U.S. Cyber Command’s  Concept of Operations generally meets joint guidance, but a greater level  of detail is needed with regard to the categories of personnel—military,  government civilian, or civilian contractor—that may conduct cyberspace  operations in order for the military services to organize, train, and equip  operations forces. U.S. Cyber Command has developed a Concept of Operations. Accompanying annexes are  expected to provide greater detail about the command’s plans to conduct  cyberspace operations. However, DOD and service officials told us that DOD is still  reviewing the appropriate roles for government civilians in the cyberspace  domain and service officials indicated that DOD policy guidance was  insufficient to determine precisely what civilian activities or duties are  permissible or prohibited in the cyberspace domain as direct participation  in hostilities. Certain Specific Command and Control Relationships for Cyberspace Operations Remain Unresolved

U.S. Cyber Command’s Concept of Operations generally describes the  command and control relationships between U.S. Cyber Command and the  other combatant commands; however, more detailed guidance is needed  to clarify these relationships between U.S. Cyber Command and the  geographic combatant commands. U.S. Cyber Command’s  Concept of Operations recognizes that a majority of cyber operations will  originate at the theater and local levels, thereby placing them under the  immediate control of the geographic combatant commanders and their  components, and recognizes that nearly all cyberspace operations can  simultaneously affect the global, theater, and local levels because  cyberspace operations can be virtually unconstrained by geography. However, officials from all four of the military services told us they require  further specificity regarding command and control relationships for  cyberspace operations, and officials from U.S. Cyber Command agreed. Military Services Are Pursuing Diverse Service-Specific Approaches in the Absence of Information on Long- Term Mission Requirements and Capabilities Needs

The military services are pursuing diverse service-specific approaches to  establishing cyberspace capabilities because, although U.S. Cyber  Command has made progress in operational planning for its missions, it  has not fully defined long-term mission requirements and capabilities for  the military services to fulfill. To guide the services’ efforts to organize, train, and equip forces for  assignment to combatant commands, DOD’s guidance requires that  combatant commanders provide mission requirements that the services  should meet. However, U.S. Cyber Command has not yet  developed the next level of planning guidance, which would identify  mission requirements and desired capabilities to guide the services’ efforts  to recruit, train, and provide forces with appropriate skill sets. To assist the military services in fulfilling their responsibilities to organize,  train, and equip cyber forces, we recommend that the Secretary of Defense  set a timeline and direct the:    Under Secretary of Defense for Policy and the Under Secretary of  Defense for Personnel and Readiness, in consultation with the DOD  Office of General Counsel, to develop and publish detailed policies and  guidance pertaining to categories of personnel that can conduct the  various forms of cyberspace operations;    Chairman of the Joint Chiefs of Staff to develop and publish  authoritative and specific guidance regarding the supporting and  supported command and control relationships between U.S. Cyber  Command and the geographic combatant commands for cyberspace  operations; and    Commander, U.S. Strategic Command, in conjunction with U.S. Cyber  Command, to develop and publish authoritative and specific guidance  regarding the mission requirements and capabilities, including skill  sets, that the services should meet to provide long-term operational  support to U.S. Cyber Command. Appendix I: Scope and Methodology

	Objectives

This report addresses the extent to which the Department of Defense  (DOD) and U.S. Cyber Command have identified for the military services  (1) roles and responsibilities including categories of personnel that can  conduct various cyberspace operations; (2) command and control  relationships, to include the geographic combatant commands; and   (3) mission requirements and capabilities in support of U.S. Cyber  Command to enable them to organize, train, and equip for cyberspace  operations.
Why GAO Did This Study

The U.S. military depends heavily on computer networks, and potential adversaries see cyberwarfare as an opportunity to pose a significant threat at low cost---a few programmers could cripple an entire information system. The Department of Defense (DOD) created U.S. Cyber Command to counter cyber threats, and tasked the military services with providing support. GAO examined the extent to which DOD and U.S. Cyber Command have identified for the military services the (1) roles and responsibilities, (2) command and control relationships, and (3) mission requirements and capabilities to enable them to organize, train, and equip for cyberspace operations. GAO reviewed relevant plans, policies, and guidance, and interviewed key DOD and military service officials regarding cyberspace operations.

What GAO Found

DOD and U.S. Cyber Command have made progress in identifying the roles and responsibilities of the organizations that support DOD cyberspace operations, but additional detail and clarity is needed. GAO's analysis of U.S. Cyber Command's November 2010 Concept of Operations showed that it generally meets joint guidance and maps out U.S. Cyber Command's organizational and operational relationships in general terms. However, greater specificity is needed as to the categories of personnel that can conduct various types of cyberspace operations in order for the military services to organize, train, and equip cyber forces. The services may use military, civilian government, and contractor personnel to conduct cyberspace operations, and U.S. Cyber Command's Concept of Operations describes general roles and responsibilities for cyberspace operations performed by U.S. Cyber Command's directorates, the military services, and the respective service components. However, service officials indicated that DOD guidance was insufficient to determine precisely what civilian activities are permissible for certain cyber activities, that DOD is still reviewing the appropriate roles for government civilians in this domain, and that the military services may be constrained by limits on their total number of uniformed personnel, among other things. Without the specific guidance, the services may in the future have difficulty in meeting personnel needs for certain types of cyber forces. U.S. Cyber Command's Concept of Operations generally describes the command and control relationships between U.S. Cyber Command and the geographic combatant commands, but additional specificity would enable the military services to better plan their support for DOD cyberspace operations. DOD guidance calls for command and control relationships to be identified in the planning process. The Concept of Operations recognizes that a majority of cyberspace operations will originate at the theater and local levels, placing them under the immediate control of the geographic combatant commanders and requiring U.S. Cyber Command to provide cyberspace operations support. However, officials from the four military services cited a need for additional specificity as to command and control relationships for cyberspace operations between U.S. Cyber Command and the geographic combatant commands, to enable them to provide forces to the appropriate command. DOD recognizes this challenge in command and control and is conducting exercises and studies to work toward its resolution. U.S. Cyber Command has made progress in operational planning for its missions but has not fully defined long-term mission requirements and desired capabilities to guide the services' efforts to recruit, train, and provide forces with appropriate skill sets. DOD guidance requires that combatant commanders provide mission requirements the services can use in plans to organize, train, and equip their forces. However, GAO determined that in the absence of detailed direction from U.S. Strategic Command, the services are using disparate, service-specific approaches to organize, train, and equip forces for cyberspace operations, and these approaches may not enable them to meet U.S. Cyber Command's mission needs.

What GAO Recommends

GAO recommends that DOD set a timeline to develop and publish specific guidance regarding U.S. Cyber Command and its service components' cyberspace operations, including: (1) categories of personnel that can conduct various cyberspace operations; (2) command and control relationships between U.S. Cyber Command and the geographic combatant commands; and (3) mission requirements and capabilities, including skill sets, the services must meet to provide longterm operational support to the command. DOD agreed with the recommendations.