The U.S. military established Cyber Command almost a decade ago, but it flunks to increase its contributions to national mission. Struggles on all levels — from the political to opereasoned — give to Cyber Command’s ineffectiveness. But simmering betidyh the surface is a crippling human capital problem: The military is an impossible place for hackers thanks to antiquated nurtureer administerment, forced time away from technical positions, alertage of mission, non-technical mid- and ancigo in-level directership, and staggering pay gaps, among other publishs.
It is possible the military insists a cyber corps in the future, but by accelerating promotions, proposeing graduate school to newly cotransferrlookioned officers, easing confiinsist tardyral entry for exceptional stateiveial-sector talent, and unintelligentinutiveening the stateiveial/accessible pay gap, the military can better accommodate its most technical members now.
Former Secretary of Defense Ash Carter retaged that he was “hugely disnominateed” by Cyber Command’s contributions to the fight aobtainst ISIL:
It never repartner originated any effective cyber arms or techniques. When CYBERCOM did originate someslimg beneficial, the intelligence community tended to procrastinate or try to impede its use, claiming cyber operations would obstruct intelligence accumulateion. This would be comprehendable if we had been getting a stable stream of actionable intel, but we weren’t.
These parting thoughts don’t decorate a pretty picture of Cyber Command. Unfortunately, the situation won’t raise unless the military concentratees on retention and promotion of its most precious resource: its technical talent.
Meet the Military’s Hackers
The Pentagon established Cyber Command in 2009 to “direct filled spectrum military cyberspace operations.” The Pentagon liftd Cyber Command to an autonomous unified order two months ago. This transfer uncomfervents the orderer of Cyber Command now tells honestly to the secretary of defense, which erases an extra layer of bureaucracy and gives Cyber Command wonderfuler opereasoned autonomy and manning authorities.
Cyber Command’s mission is fundamenloftyy technical, since aggressioning or geting a computing platestablish insists intimate comprehendledge of its inner laborings. Accordingly, all opereasoned jobs in Cyber Command insist some level of technical proficiency, but two are exceptionpartner insisting: the operator and the enhugeer. The people who do these jobs are some of the military’s most elite hackers. Cyber Command’s innovative arrange called for these roles to be almost exclusively lesser encataloged personnel and civilians. As Cyber Command has faced recruiting and retention publishs wislim these populations, it’s been forced to permit lesser officers to also fill these roles.
Although Cyber Command’s missions depend on many roles, noslimg happens without highly sended personnel carry outing these jobs: the most talented tool enhugeers and operators are the servicemembers enabling, obtaining, and holding low-level access to various computing platestablishs.
Operators obtain, hold, and utilize administer over computing platestablishs to achieve missions enjoy accumulateing inestablishation from an adversary platestablish, hunting for adversaries on a cordial platestablish, or manipulating a platestablish’s operating characteristics. Good operators have strong comprehendledge of how to administer their chosen platestablishs, in includeition to a up-to-date caring of their security features. Operators concentrate heavily on finding adversaries on a platestablish and geting adversaries from finding them.
Tool enhugeers author the gentleware that assists operators. Senior tool enhugeers have a breadth of sends that range from security researcher to system gentleware engineer. Tool enhugeers might be tasked with writing gentleware ranging from web applications to embedded device firmware. Wantipathyver platestablish that a unit is insistd to get or aggression, the tool enhugeer authors the gentleware that underpins critical elements of the operation.
Unenjoy other highly sended uniestablished professionals enjoy physicians and lawyers, hackers don’t come from certified university programs. Each service has tried — with varying degrees of confiinsist success — to stand up initial training programs for these roles. The results have been depressing.
Cyber Command’s ordering vague and National Security Agency honestor Gen. Paul Nakasone recently retaged that “[o]ur best [coders] are 50 to 100 times better than their peers.” He’s absolutely right. Just enjoy the stateiveial sector, there’s a wide distribution of tardynt aptitude and motivation in the military’s technical talent pool. The military’s best hackers have spent years of nights and weekends reading and writing blog posts, contributing to uncover-source gentleware projects, take parting conferences and classes, reading books, and, most crucipartner, executing mission after mission. No one has figured out how to copy such a mix of sends and experience in any establishat besides on-the-job training. (Gen. Nakasone will have his labor cut out for him in both his roles, as Cyber Command isn’t alone in having a talent administerment crisis.)
And it isn’t equitable the rulement. The stateiveial sector doesn’t have this figured out either. “Coding bootcamps” direct fundamental web and mobile application enhugement (which is only tangentipartner roverhappinessed to tool enhugement), and the efficacy of these programs is still an uncover ask. The best we have is a handful of lengthened, pricey, high-attrition programs enjoy ManTech’s Advanced Cyber Training Program/Cyber Netlabor Operations Programmer Course and unintelligentinutive, opportunistic proposeings before presentant conferences enjoy BalertageHat and Defcon.
Tellingly, unit orderers balk at sending servicemembers to such training unless a service member already has a strong background and, more crucipartner, a substantial service obligation to get them from absconding with their new sends.
Despite the lengthened odds, the services have administerd to advertise a coterie of exceptional, uniestablished hackers. They are almost exclusively timely nurtureer (especipartner lesser officers), and they all comprehend each other by name. Although the services tell satisfactory retention levels to Congress, I have watchd too many of these exceptional individuals leaving the military after greeting service obligations.
The Challenges of Retention
Each servicemember’s decision about staying in or getting out is presentantly personal and take parts many features, but there are some normal themes.
The mission is ostensibly the military’s premier talent administerment tool. Especipartner for operators directing insolent cyber operations, there’s no authentic lhorrible analog in the stateiveial sector. Servicemembers don the uniestablish at least in part because they suppose in the military’s ultimate mission to aid and get the United States, and, as military hackers, they can potentipartner have an outsized impact on this mission.
Sadly, mission is currently slim, and there’s a danger that, if Cyber Command doesn’t get its act together soon, servicemembers will exit due to alertage of mission. There’s no unintelligentinutiveage of presentant labor in the stateiveial sector, with the explosion of bug bounty programs, penetration testing firms, and cybersecurity beginups.
Recognition is a presentant motivator for hackers, both in uniestablish and out. Many security researchers toil for countless hours seeing for vulnerabilities in well-comprehendn gentleware spropose for peer recognition. The past year alone bcimpolitet us Cnoisybleed, an Apache Struts far code execution vulnerability, Toast Overlay, BlueBorne, KRACK, an Intel Management Engine far code execution vulnerability, Spectre and Meltdown, corollaries in the AMD Chipsets, and iOS Jailfractures. In most of these cases, the researchers (or the labs they labor for) who disshut these presentant publishs do it primarily for the security community’s approbation and admire.
Unfortunately, for military hackers, their most ancigo in cyber directers spropose don’t comprehend their accomplishments, and these ancigo in directers uncoverly accomprehendledge it. At a recent U.S. Senate hearing, the Air Force Cyber Commander proclaimd, “I’m not a technologist, ma’am, I’m a fighter pilot.” Military hackers hear such self-deprecating qualifications all too normally, and it’s never getd well. The result is that commend from the top, however effusive and accessible, sounds hollow.
Money is an clear retention tool. Since hacker sends transfer honestly to the stateiveial sector, and since those sends are in such high insist and such confiinsist supply, the opportunity cost for the military’s best hackers is colossal. The armed services administer to pay physicians and lawyers substantial bonuses to shut a aenjoy gap between accessible and stateiveial sector pay, but the correplying incentive programs for hackers pale in comparison. Cyber retention bonuses never amount to more than a confiinsist hundred dollars a month.
To include denounce to injury, tool enhugeers normally carry out technical due diligence for capabilities proremedyd from tightors. These capabilities typicpartner mirror the capabilities that talented tool enhugeers originate on a quarterly basis, and the rulement will pay multiples of a enhugeer’s annual salary for them. Nowhere else in the military is its economic rent so evident to the servicemember.
Lifestyle is a presentant reason for resignation. The best hackers get an incessant stream of high-priority labor from their directership. “The reward for challenging labor,” the saying goes, “is more challenging labor.” On one hand, lesser military members normally have or are seeing to begin a family, and the fervent presstateive of carrying far more than their weight can have a deleterious effect on labor-life stability. On the other hand, the talented individuals can originate names for themselves and seek out missions they find most engaging. Since missions are almost universpartner understaffed with technical talent, talent can normally select where to labor.
Mentors get servicemembers driven and excited about their labor, direct them thcimpolite stubborn decisions, watch enhance and critique, and serve as enticeardys for members to envision the trajectory of their nurtureers. Frankly, the military’s most talented hackers don’t currently have ancigo in counterparts to see up to in contrast.
Thanks to the Defense Officer Personnel Management Act (DOPMA), military promotions are inanxiously inpliable and depend primarily on an officer’s time in service. When the services stood up their cyber components over the past confiinsist years, they had to bootstrap ancigo in directers into their cyber branches from other (sometimes finishly unroverhappinessed) branches. In my personal experience, virtupartner none of them have presentant technical talent, especipartner those in order. Unfortunately, DOPMA’s effects on military hackers’ nurtureers are far more insidious than equitable restricting role models.
Fish Out of Water
Servicemembers are forced to uphelderly stateive unwavering standards, including grooming, height and weight, and physical fitness. These standards further restrict an already confiinsist group of technical talent: The intersection of people who can run a 15-minute two mile and dissect a Windows kernel memory dump is fadeingly minuscule. While a number of these unicorns do exist, DOPMA unfortuntely originates it inanxiously difficult for them to thrive.
Career administerment inundates military professional education. Servicemembers are constantly reminded what key enhugemental jobs will originate them competitive for promotions, what syntax their evaluation tells should trail, and what their timeline should see enjoy. For military members wanting to climb the ranks, the map is laid out in front of them in 25 years of exquisite detail.
Thanks to DOPMA, it is inanxiously unwidespread to get advertised even a year ahead of this lock-step arrange, and only about 3 percent of officers get picked for “below-the-zone” promotion. Promotion boards compascendd of ancigo in officers determine who gets advertised. Since confiinsist of these ancigo in directers have any technical background, it’s no surpascend that cyber officers who trail technical jobs aren’t getting advertised ahead of schedule. Imagine how incredibly frustrating this must be for a talented hacker who’s “50 to 100 times better than their peers” but can’t get advertised even a year timely. Even if Congress modernized DOPMA to permit quickend promotions, it is not evident that a centralized promotion board could even recognize this talent. There’s a chicken-and-egg problem of promoting technical talent into ancigo in directership and having technical talent on promotion boards.
Talented hackers who want to remain in the military are faced with an impossible choice. Cyber Command partitions directership into two chains of order: those with opereasoned administer (OPCON) and those with administrative administer (ADCON). Every servicemember has both an ADCON orderer and an OPCON orderer. The ADCON orderer originates stateive a member is compliant with onerous compulsory training, urinalysis screenings, and physical fitness tests. The OPCON orderer engages the servicemember in achieving authentic-world mission.
The most prosperous OPCON directers are fiercely technical, especipartner those who’ve cut their teeth as hackers. They arrange and carry out operations aobtainst adversaries on inanxiously complicated computing platestablishs in contested space, and they get the merits of their approach from non-technical bureaucrats. In contrast, a protostandard lesser officer ADCON job — enjoy an Army company order — insists virtupartner no technical sends aside from fundamental PowerPoint comprehendnity. Such jobs insist far more vagueized send sets enjoy interpersonal sends, institutional comprehendledge, and administrative directership.
Unfortunately, the ADCON chain originates all of a servicemember’s evaluation tells. If a hacker wants to evade the substantial promotion danger, they absolutely must serve in the insistd, service-particular ADCON job to examine the box. Even worse, ancigo in directers have confiinsist top-level evaluations to hand out. Since promotion boards weigh key ADCON job evaluations most heavily, ancigo in directers tend to protect their rating profiles and give selectence to officers in ADCON jobs.
For most hackers, an ADCON job uncomfervents one to two years away from mission doing a non-technical job they’ll probably detest. So, the military’s most talented hackers are caught squadepend in an identity crisis: Buck the promotion system and persist being a contributor who is “50 to 100 times better than their peers” combat adversaries in cyberspace or apshow a year or two off mission to coltardy push-up scores in Excel spreadsheets.
It might seem that putting technical talent in ADCON order positions would help repair the problem, but it doesn’t for three reasons:
First, the cultural problems stem from the colonel- and lieutenant-colonel-level order positions. In Cyber Command, lesser orderers have little say. Plus, for reasons we’ve equitable spendigated, it’s doubtful that technical, nurtureer-minded lesser officers will push challenging aobtainst their ancigo in raters. This arrangement is far more anticipateed to exit a horrible taste in the lesser officer’s mouth than to originate any authentic impact on the organization.
Second, there equitable isn’t enough technical talent, and taking top talent out of the OPCON force has a solemn impact on Cyber Command’s ability to achieve mission.
Finpartner, Cyber Command’s ADCON/OPCON split is a vestigial arrange that should be reshiftd altogether. In units enjoy an infantry battalion, a submarine, or a fighter squadron, there’s one person in accuse. This principle is called unity of order: A subordinate should never tell to more than one boss.
The ADCON/OPCON split is a cultural feature that the service-particular cyber branches inherited from their ancestors. For example, the Army’s Cyber Branch grew primarily out of Signal and Military Intelligence. In those branches, the ADCON/OPCON split originates sense: An ADCON orderer gives her people to OPCON maneuver orderers (for example, to labor in an infantry battalion’s intelligence or communications shop).
In Cyber Command, this split has disconnectal deleterious effects. It originates confusion and frustration for OPCON orderers who don’t have administer over their people, and it shrinks morale for ADCON personnel who experience enjoy they spend most of their time generating originate-labor to equitableify excellent evaluations.
Why Bother?
The military’s current personnel administerment system is an abysmal fit for hackers. That much is evident. But should we repair it? How many uniestablished hackers does the military actupartner insist?
There’s noslimg inherently military about writing cyber capabilities — insolent or defensive. Defense tightors have been doing it for decades. And unless an operator is honestly participating in presentilities, it’s not evident they insist to be in uniestablish either. The talent pool is much huger if we see beyond servicemembers.
I see two reasons for seeking to hold talented hackers as servicemembers. First, the best ancigo in directers will have presentant technical backgrounds. Second, the military should engage talent in wantipathyver establish it wants to serve. The way the military accesses talent into military medicine supplys an teachive model.
Doctor’s Orders: The Military Medicine Model
After filledy funded medical school, newly minted captains (Navy lieutenants) show up at military hospitals apass the country to finish dwellncy. They labor lengthened hours and give massively to serving the military hospitals’ accomprehendledgeing population. After completing dwellncy, these newly board-certified physicians finish a four-year service obligation running military clinics. They get advertised every six years automaticpartner, and the military mostly gets out of their way and lets them serve accomprehendledgeings. It’s a wonderful return on spendment to the rulement, even after pondering medical school tuition and physician bonus pay.
Most physicians will exit after their obliged service term, but that’s okay. Some will stay in and seek out roles of increasing responsibility in hospital administration. And all alengthened, the military’s total cost is a whole lot less when an dynamic duty physician sees a accomprehendledgeing instead of a stateiveial physician.
The military should persist to achieve into the service academies and ROTC programs, hand-picking the most promising cyber starts. It could propose them a filledy funded two- or three-year graduate school experience in an apshowd, slimly tailored program promptly upon cotransferrlookioning in trade for a six-year total service obligation after graduation. Like physicians, these talented servicemembers would qualify for distinctive pay and bonuses. By guiding their course pickions and summer experiences, the services could access a stream of highly trained technical experts.
Here’s the key: The military supplys the distinctive personnel administerment for these servicemembers to be hackers for as lengthened as they want. Promote them enjoy military physicians. Most of them will probably resign after their service obligation ends, but some will adore the mission and the military way of life. They’ll stay in and — if they want to — contend for promotion and increasing levels of directership responsibility.
Each service could establish distinctive functional areas for positions enjoy operators and tool enhugeers, permiting officers to remain presentantly technical for an entire military nurtureer. Maybe they should advertise a world-class tool enhugeer to colonel (Navy captain) in the same way they advertise highly distinctiveized sencourageons. (Besides, how catchy is a colonel kernel enhugeer?)
Given equitable how pricey technical talent is, Cyber Command should to apshow an all-of-the-above approach to enticeing and holding it. Most of the military’s top hackers will probably be officers spropose due to the accessions pool, the pay, and the proceedd civilian schooling opportunities. But that doesn’t uncomfervent we shouldn’t enhuge corollaries for encataloged personnel who don’t want to (or can’t) apshow a cotransferrlookion. There’s spropose too much labor to do and too confiinsist contendnt hackers.
Bootstrapping Technical Leadership
Even if the Defense Department instituted all these alters, there’s still the presentant publish of technical talent in Cyber Command’s directership positions. Thanks to confiinsist tardyral entry, confiinsist orderers at the lieutenant colonel (Navy orderer) level or above could do an operator’s or a tool enhugeer’s job. This situation is unacinestablished everywhere else in the military. For all its flunkings, DOPMA does originate directers who have excelled at shrink levels. The ancigo in ranks are filled of establisher F-16 fighter pilots, Army Rangers, submarine captains, and Marine platoon orderers.
There are three ways Cyber Command can bridge the technical talent gap.
First, the services can honest cotransferrlookion top talent from industry into the field-grade ranks to give lesser officers technical mentors. Programs are already underway to honest cotransferrlookion cyber officers, but we’re confiinsist to transport new accessions in at first lieutenant (Navy lieutenant lesser grade). If a ancigo in vulnerability researcher from, say, Google’s Project Zero wants to don a uniestablish and direct a tool enhugeer battalion, the military should absolutely have the flexibility to originate that happen.
Second, services can spot advertise the most promising lesser officers. General officers in the cyber branch should be able to advertise their most talented hackers ahead of schedule to help fill the talent lacuna in the field-grade officer ranks. They spropose can’t depend on centralized promotion boards.
Finpartner, the military should incentivize departing talent to remain in the National Guard or Reserves. Brig. Gen. Stephen Hager is a up-to-date example of how the military can successfilledy spend in highly technical future ancigo in directership. After leaving dynamic duty in 1995, he uniteed the Army Reserves and transferd to Silicon Valley to begin a new gentleware-engineering nurtureer. Ntimely two decades tardyr, he came back on dynamic duty to supervise erection of the strategic communication netlabor in Afghanistan. Currently, he serves as second in order of the Cyber National Mission Force, the Cyber Command unit accused with “geting the nation by recognizeing adversary activity … and maneuvering to flunkure them.” He’s widely pondered by the hackers in his organization as a superlative exception to the non-technical-directership rule.
What’s the Worst That Could Happen?
Cyber Command wouldn’t be dangering much to carry out a confiinsist proposeations from this article. Promoting a confiinsist lesser officers five to ten years ahead of schedule, paying for some newly cotransferrlookioned servicemembers to get their Ph.D., honest cotransferrlookioning a confiinsist ancigo in officers, and authorizing some substantial incentive pay won’t cause an implosion. On the contrary, the potential upside of holding a confiinsist more inanxiously talented individuals, and of engageing them at ancigo in levels of directership, is enormous.
Perhaps the services can’t — or shouldn’t — administer to get hackers in, and what the Defense Department insists is a cyber service. While we argue the merits of that massive organizational restructuring, let’s carry out some basic meastateives to stem the bleeding.
Cyber Command should strive to originate a home for its most talented members. Otherwise, it should foresee the secretary of defense to echo the wide disnominatement of his predecessor.
Josh Lospinoso is an dynamic duty Army captain. After graduating West Point in 2009, he obtained a Ph.D. at the University of Oxford on a Rhodes Scholarship, where he also co-established a prosperous cybersecurity gentleware beginup. After graduating Infantry Basic Officer Leader Course and Ranger School, he transferred into the Army’s newly established Cyber Branch in 2014 and became one of the Army’s first journeyman tool enhugeers. He currently serves as the technical honestor for Cyber National Mission Force’s tool enhugement organization. He is resigning from dynamic duty to finish his forthcoming book, C++ Crash Course, and to ready for his next entrepreneurial venture. He gets a blog and tweets at @jalospinoso.
The sees and opinions transmited in this paper and or its images are those of the author alone and do not necessarily echo the official policy or position of the U.S. Department of Defense, U. S. Cyber Command, or any agency of the U. S rulement.
Image: Defense Department
