CHIPS Articles: Interview with Air Force Maj. Gen. William T. Lord, AFCYBER (Provisional) Commander

AFCYBER (Provisional) was activated Sept. 17, 2007, at Barksdale Air Force Base, La. The need is urgent, so in 2003, the White House issued "The National Strategy to Secure Cyberspace," part of an overall effort to protect the nation against cyber threats. The strategy presents cyberspace security as a subset of homeland security and defines a wide range of initiatives to "protect against the debilitating disruption of the operation of information systems for critical infrastructures and, thereby, help to protect the people, economy, and national security of the United States."

One of those initiatives calls for the government to "improve coordination for responding to cyber attacks within the U.S. national security community." According to "The National Strategy to Secure Cyberspace," "a spectrum of malicious actors can and do conduct attacks against our critical information infrastructures. Of primary concern is the threat of organized cyber attacks capable of causing debilitating disruption to our Nation's critical infrastructures, economy, or national security."

In this regard, AFCYBER will act as both a deterrent and a combatant to safeguard the nation's cyber structure.

Gen. Lord and his staff are working many of the items needed for initial operations capability including: establishing a budget, articulating details of organizational realignments, developing and assigning manpower requirements, and establishing policies and procedures for daily operations. Many of these details are either still being defined or are under review.

CHIPS spoke with Maj. Gen. Lord May 5, 2008.

CHIPS: When the Secretary of the Air Force announced the stand up of the Cyberspace Command in 2005; many saw it as a bold move into new ground. Do you think that AFCYBER will serve as a blue print to other defense and federal organizations in regard to offensive, tactical use of the cyber domain?

Maj. Gen. Lord: I hope we can be a blueprint for other defense and federal organizations as a virtual organization. We can show other elements of government how we can operate from about a dozen different locations — a major air command headquarters and a couple hundred people with four wings assigned to us all over the United States — and not have laid one brick for any brick and mortar construction.

I think that could be a great example. We have talked to Naval Network Warfare Command and the Army's NETCOM because they have been established longer than we have.

CHIPS: Will you be working with the Army and Navy?

Maj. Gen. Lord: At the operational level, there is not a huge overlap, but we all provide forces for U.S. Strategic Command. Our work with other services has been more administrative than operational, to date.

CHIPS: I read that AFCYBER is going to be more of a tactical command, taking on the offensive approach to network operations.

Maj. Gen. Lord: The work of an AF MAJCOM is the organizing, training and equipping of forces … not tactical operations. As the operator of the AF portion of the network, I believe the majority of that work is in the defensive business. One of the reasons that the Air Force decided to stand up this capability is because of the Air Force's dependence on technology in command and control of our own forces.

If you are flying a Predator from Las Vegas over Afghanistan, that is a thin command and control link. We want to make sure that we are not just assuming that it will always be there but have the ability to defend it.

Offensive capabilities, that is force employment, belongs to combatant commanders. We, as the Air Force, don't do that; we give forces to U.S. Strategic Command for employment. Principally, we're an 'organize, train and equip' command. We will be educating those young people to be able to do both (offensive and defensive), but in the employment mode, they don't belong to us.

CHIPS: There is speculation in the trade press that the Air Force stood up AFCYBER to prepare for cyber conflicts with China, given that many attacks against U.S. government networks come from the Chinese mainland.

Maj. Gen. Lord: I have read the same stories, but I don't believe that they are completely correct. It is really about the Air Force's dependence on cyber and our ability to defend our own command and control, so that we can continue to operate in the joint fight as the COCOM wishes.

Clearly, there are nation-states that are developing this capability, but a 12-year-old kid in the Philippines wrote malicious software code that froze the world's economy for a day and a half. It's cyber criminals, cyber terrorists, and potentially nation-states, but this AF initiative isn't because of one nation-state.

CHIPS: AFCYBER will apply the Laws of Armed Conflict, which include rules of engagement, delivering proportional responses to attacks and observing distinctions between combatants and civilians. This can be a gray area when attacks may come from civilians acting under state sponsorship. Have the Laws of Armed Conflict been clearly defined to allow you to operate tactically as well as defensively?

Maj. Gen. Lord: I think they are, however, when that begins to go over into commercial systems, the Internet, for example, now we are not so sure. As we apply the rules of engagement to kinetic weapons, we must do so with the same due diligence with non-kinetic weapons — same rules — and they already exist.

CHIPS: You've been quoted as saying that future conflicts will be fought in the electromagnetic spectrum and in non-kinetic ways. Do you think the U.S. may be lagging behind in what rogue nations and non-state players are already doing in cyberspace?

Maj. Gen. Lord: I don't think we are lagging; the trouble is the price of admission into this kind of conflict is low. When it's the price of a computer and a network connection, our adversaries don't have to have a large offensive army, navy, marine corps or air force. Whether a nation-state or a bunch of criminals, they can attack asymmetrically. We need to have the same capability, and we need to have the ability to counter those kinds of things. You have to stay nimble.

CHIPS: Many have said that we are already engaged in cyber warfare and claim that it is the Cold War of the 21st century.

Maj. Gen. Lord: We are attacked all the time, whether it is a malicious attack or a device coming up on the network that we haven't ever seen before, and we have to figure that out and identify it. We have no way of knowing if it's a new device on the network that is attempting to ping other devices or if it's somebody attempting to penetrate a network.

You have to respond to all those very quickly and in a manner such that you don't assume that it's always just another device trying to come up in the network when maybe it's not.

Is that warfare? No, but if you are on the inside watching somebody trying to ping your network, you consider it warfare until you figure it out.

CHIPS: Is AFCYBER's role duplicative in terms of what the National Security Agency and Department of Homeland Security do to protect the homeland's information infrastructure?

Maj. Gen. Lord: The Air Force Cyberspace Command role is principally aimed at the Air Force. NSA, DHS, the Department of Justice and the Department of Defense all operate under different titles of U.S. Code: Title 50, Title 10, Title 18, and potentially Title 32, and many different activities, and we have great relationships between us, but what we need are the processes that allow us to exchange information more quickly.

CHIPS: Does AFCYBER have a permanent location yet? I've read that states from Louisiana to Maine are vigorously lobbying to have AFCYBER located within their borders.

Maj. Gen. Lord: No. We haven't completed the analysis on that and don't expect to announce a location until late 2009. When we stand up in October, it will be in the provisional location in Louisiana. As a virtual organization, we will be at about 12 operating locations throughout the United States. We exist where the expertise exists today.

CHIPS: Have you had a typical day at AFCYBER yet?

Maj. Gen. Lord: No, I don't think there is one yet. In the development of a new organization we have a lot of questions to answer such as what units will be assigned, how to develop the manpower, what are the skills we need to teach to cyber warriors of the future, and what courses do we need for the 'old warriors' that need to be re-crafted.

Some things we do are changing our culture, while some of it is just the mechanics of how you build a budget, for example. Every day is a new adventure.

There are those who think it will be a great capability … while some are still hesitant.

CHIPS: Why is that?

Maj. Gen. Lord: It is mostly about change. Change is hard, and that's why it's so important that we have such great standardbearers in the Chief of Staff of the Air Force and in the Secretary of the Air Force, who are pushing the institution to create this capability.

It's not as if we are new in the cyber business; we have been doing it awhile. The reason to stand up the command is to focus mass and energy at the resource problem. We have been doing this in pockets all over the Air Force for a long time; it really is to get it all organized under one command.

CHIPS: What progress have you made thus far in making AFCYBER fully operational?

Maj. Gen. Lord: We now have a strategic vision published, manpower documents built, and we have Air Force doctrine in cyber that's going through the coordination stage. We have ensured that there are cyber activities happening in every one of our major exercises throughout the Air Force.

We are building the budget and collecting it from already existing Air Force programs, which amount to between $5 billion and $6 billion. We have had a lot of positive movement in a short time to do the organizing, training and equipping so that our Air Force command and control systems are protected. We have trained forces to give to combatant commanders to execute whatever it is they need to execute during their operations.

CHIPS: Do you have staffing levels set yet?

Maj. Gen. Lord: For the headquarters itself, it is about 400 to 500 people spread between 12 locations. When you add the wings, some of which already exist today, it brings the total to a little over 8,000 people.

CHIPS: Can you envision what a typical day at AFCYBER will be like once you are fully operational?

Maj. Gen. Lord: From the standpoint of an AF MAJCOM, it's mostly finding the resources to make sure there's enough manpower, money and training to do what we need to do because MAJCOMs don't fight battles — other than budget battles.

We will be fighting for the resources to make sure that operational wings can perform their combat missions. The operational wings will be doing electronic warfare, network attack, network defense and exploitation, and watching directed-energy weapon development and information operations.

At the major command level, it involves mostly resources policy to support those operational units. That's no different than what the other 10 Air Force major commands do.

CHIPS: Will warfighters on the ground be able to call on AFCYBER for air cover or electronic warfare assets?

Maj. Gen. Lord: Yes, and they do that through a combatant commander, who is either a theater combatant commander, like U.S. Central Command, or global commanders that provide regional flex, like U.S. Strategic Command.

In the case of jamming, it could be airborne jammers, it could be space-borne jammers, or it can be jamming provided by a cyber effect. The integration of all the air, space and cyber capabilities is to create an effect to destroy the enemy's capability or render it unusable.

At the operational unit, Airmen — men and women — would be tasked to do that. Those taskings come through the combatant commanders, not through me as a resource provider.

CHIPS: Can you talk about the skill sets of your staff?

Maj. Gen. Lord: It's everything from the men and women who establish this domain, the communications, the radar, or the tactical airborne data link folks that establish the domain or use the domain, to the folks who pay attention to router switches and hubs.

It can be our network attackers, our network defenders or our electronic warfare officers. It also includes influence operations, such as behavioral scientists, cultural linguists, psychologists and psychiatrists, for example.

There are many different skills, not just computer skills or electrical engineering skills. If we are changing the nature of warfare — and it is about changing the behavior of an enemy — we don't have to do that with a 2,000-pound bomb. Perhaps we can do that with a message.

CHIPS: Will AFCYBER be issuing policy and monitoring networks, combat systems and the command and control structure?

Maj. Gen. Lord: Yes, there is a direct correlation to what NETWARCOM does and what we will do for the Air Force. Terrestrial networks and airborne networks will be our responsibility.

CHIPS: Will this include the Air Force's shore infrastructure?

Maj. Gen. Lord: Yes, I think the Navy does that under the contract with Navy Marine Corps Intranet, and that is done differently in the Air Force. We have a common configuration for desktops. There are use licenses that we buy from Microsoft. We do asset visibility and push out patches to maintain both the network fixes and the vulnerabilities. Most places do that routinely every day. We will monitor that activity from AFCYBER for the entire Air Force.

Units currently receive policy doctrine direction from the Commander of Air Force Network Operations, which resides under 8th Air Force. Their policies cross all commands. That will change Oct. 1, and AFNETOPS will be in Air Force Cyberspace Command.

CHIPS: AFCYBER is a great recruiting tool for young adults. It's a domain they grew up in. Next to the thrill of being an Air Force pilot, being a cyber warrior sounds like an amazing adventure.

Maj. Gen. Lord: Many of them bring high-tech skills, and we want to bring them to a high-tech organization. The matching of those skills is important, and we are getting a lot of response.

There is a cyber awareness ad that the Air Force has been airing on television since 'March Madness.' The Air Force also aired ones about intelligence, surveillance and reconnaissance, and space-related specialties as well.

We have developed a career field roadmap that will map today's specialties into tomorrow's cyber specialties. Young men and women, enlisted and officers, will have cyber careers.

CHIPS: The Navy consolidated ratings to develop the information systems technician rating and created information professional officers to meet the challenges of changing technology. Has the Air Force looked at its personnel structure in this regard?

Maj. Gen. Lord: We are driving that consolidation, and recently the Secretary of the Air Force signed a roadmap that gives us a 10-year plan for how we will develop our forces. Our officers assigned in this 'domain' will be cyberspace operations officers.

CHIPS: Will they do the same things that IPs do in the Navy? Maj. Gen. Lord: It will be bigger than just IT because it involves electronic warfare and directed energy. It also consists of work not normally included in the communications and information career fields, which is what I would have called it in the old days in the Air Force.

The enlisted personnel get mapped into cyber operations, cyber maintenance and some of those are the more traditional skills, like ETs, electronics technicians in the Navy. In this business there will also be enlisted offensive operators which will be unusual for the Air Force.

CHIPS: How is it unusual?

Maj. Gen. Lord: In the Air Force, most of our people who are providing kinetic options, that drop the bombs, are officers flying aircraft. In the network attack business, it can be officers and enlisted personnel.