Nominee to be next Army chief wants to boost civilian hiring to address cyber shortfalls

The Army’s pick to be its next top officer wants to address shortfalls and readiness issues with its uniformed cyber warriors by supplementing them with civilian personnel and increasing the length of their tours of duty.

Gen. Randy George testified before the Senate Armed Services Committee on Wednesday during a confirmation hearing to be the next Army chief of staff. During the hearing — and in a prepared questionnaire beforehand — senators pressed George on the state of the cyber mission force.

The U.S. cyber mission force — the 133 teams the military services staff for U.S. Cyber Command to conduct cyber operations — has faced significant issues in recent years. This is, in part, due to the fact that each service has its own identity, culture, and way of classifying and providing forces to Cybercom.

“The readiness of the Cyber Mission Forces assigned to U.S. Cyber Command is substantially below acceptable levels. This shortfall is due primarily to the lack of sufficient numbers of personnel in each of the services in three critical work roles that are especially demanding: tool developers, exploitation analysts, and interactive on-net operators,” senators wrote in the questionnaire accompanying George’s confirmation.

Senators asked George how the Army plans to correct the shortfall.

“While an [Office of the Secretary of Defense]-led force-generation study is ongoing to recommend cross-[Department of Defense] opportunities to correct readiness shortfalls across the Cyber Mission Force, the Army is looking to expand the application of the Cyber Excepted Service to provide expedited recruiting and more flexible retention options for civilians,” he wrote in response. “The Army will also assess the length of tours to ensure the Army realizes the full return on its investment in those personnel who have been through the most rigorous training. Finally, the Army will always look to expand and offer other broadening retention opportunities.”

Last year’s annual defense policy called for the DOD to conduct the force generation study and asked the department to examine the current cyber enterprise; how the services should man, train and equip for cyber; if a single military service should be responsible for basic, intermediate and advanced cyber training of the cyber mission force; and if the DOD should create a separate service.

The Cyber Excepted Service is a mechanism that allows enhanced authorities and flexibilities to enhance the recruiting, retention and development of cybersecurity talent across the civilian force.

While the cyber mission force teams are typically thought of in terms of uniformed members, there are also civilians who serve and contribute to the teams — though due to rules of international war, those civilians can’t be the so-called “trigger pullers,” which in the cyber parlance means they can’t lead cyber mission force teams.

In 2019, the Army created Career Program 71 for cyberspace effects, a specific work role for civilians that provides a centralized approach for civilian training, education and professional development in the cyber discipline.

And last year, Army Secretary Christine Wormuth said the service wants to boost its use of Cyber Excepted Service to help it keep pace in the race for top talent.  

On the uniformed side, George pointed to increasing tour lengths as an option to address challenges. An ongoing concern is that military personnel change out of their positions too quickly — as is commonplace across service structures — despite the lengthy investment needed to train them for their highly technical roles.

For example, training to be an Interactive On-Net Operator (ION) — the role largely associated with offensive operations that break into adversaries’ systems for either effects or reconnaissance — can take between one to three years to complete and can cost between $220,000 to $500,000 per service member.

Extending tour lengths could be a way to ensure greater continuity of work roles on mission while gaining better return on investment for training.

The Senate Armed Services Committee’s version of the National Defense Authorization Act for fiscal 2024 calls for a more standard approach to how the military services present forces to Cybercom, to include a plan to require common enlistment and general tour lengths across the services for the cyber mission force, and enlistment terms that are appropriate given the training required and sufficient enough to meet readiness requirements.

The Army was the first service to create a branch and military occupational specialty for cyber in 2014, in part, to address this very issue.

George, in response to senators, also noted the Army’s — and wider DOD’s — issues competing for top talent in the cyber field with the private sector.

“In this field, competition for top talent with the private sector will be an enduring challenge. The Army must balance both quantitative goals, in the number of developers, analysts, and operators, as well as qualitative goals to ensure these individuals are highly trained and experienced to conduct challenging defensive and offensive cyber assignments,” he said.

This sentiment was shared by President Joe Biden’s pick to be the military’s top officer a day prior.

“One of the key areas is, one, to meet the needs of Cyber Command, but at the same time align some of our policies and processes so we’re not competing amongst ourselves for talent,” Gen. Charles “CQ” Brown, nominee to be chairman of the Joint Chiefs of Staff, said at his confirmation hearing Tuesday in response to how he’d work with the service chiefs to better align the needs of Cybercom. “If we have similar approaches, it helps us to bring in all talent across the nation and then also help to retain that talent within the services as well.”

Brown, in his own questionnaire, said he supports the DOD’s cyber workforce strategy to address the persistent readiness problem of the cyber mission force.

“I fully support the 2023-2027 DoD Cyber Workforce (CWF) Strategy … which sets the foundation for how the Department will foster a cyber workforce capable of executing the Department’s complex and varied cyber missions. The strategy enables the Department to prioritize retaining highly skilled cyber talent by closing workforce development gaps,” he wrote.

Brown continued: “If confirmed, I will support implementation of the CWF Strategy in coordination with the DoD Chief Information Officer (CIO), the Joint Staff, United States Cyber Command, and the Services to focus Department efforts on cyber-related human capital initiatives in support of the 2022 National Defense Strategy. This would include surging capabilities through our reserve components and an initiative to maintain connections with service members and DoD civilians who have separated allowing them to retain their security clearance gain access to additional professional development opportunities. Additionally, I would support USCYBERCOM’s execution of its service-like authorities and roles, such as enhanced budgetary control, and acquisition authorities.”