Let’s not begin choosing out uniforms simply but. The refrain calling for a Cyber Power continues to develop by the day, however the debate has its priorities backward. In June, an modification from Sen. Kirsten Gillibrand (D-NY) calling for the creation of a cyber service throughout the Division of the Military failed within the Senate Armed Companies Committee by a single vote. Help is standard on either side of the aisle, with Rep. Pat Fallon (R-TX) quoted as saying {that a} “Cyber Power is inevitable.” The extremely anticipated June 2026 Heart for Strategic and Worldwide Research report skips the query of whether or not the Division wants a Cyber Power and goes straight to planning how to take action, treating the brand new service as only a matter of when. The report builds on an earlier Basis for Protection of Democracies cyber drive examine and offers sturdy suggestions for how you can man, practice, and equip. Neither totally addresses the dysfunction of cyber governance.
Two years in the past, I used to be a profession submariner being detailed to U.S. Cyber Command to pay my joint penance, not sure how a non-cyber officer might help. Seeing the successes but additionally cyber’s unrealized potential, I left the command equal components Cyber Power acolyte and skeptic. I gained’t relitigate whether or not the force-generation mannequin is damaged as a result of smarter and extra skilled professionals have documented that failure, and on the man-train-equip issues, they’re actually proper. However earlier than the Cyber group begins to debate what to name these new Cyber Power warriors, the Division ought to reply the query the Senate was one vote away from skipping. The talk ought to reply the query of who will govern our on-line world.
Begin with what the advocates have gotten proper, they usually have completely gotten an ideal deal proper. In each different warfare area, the division of labor is clear: the Companies man, practice, and equip forces, and the combatant instructions make use of them. Cyber is the exception. Cyber Command relies on the Companies to generate its forces, the identical Companies for which our on-line world won’t ever be the precedence. As a line officer working within the cyber world, I saved asking the identical query: What makes this so particular? The prevailing reply from these contained in the group has been fixed: drive technology. The argument goes that the technical complexity of manning, coaching, and equipping cyber requires that or not it’s handled as particular. That by no means sat properly with a submarine officer whose complete group is underwritten by advanced know-how.
Greater than a decade of readiness shortfalls, coaching gaps, and congressional patches produced a typical consensus that what has been achieved to date in cyber will probably not work sooner or later. Erica Lonergan and Mark Montgomery, two of probably the most persistent voices on this public debate, have proven that even Cybercom 2.0, the Division’s personal try to enhance the force-generation mannequin, lacks the levers wanted to compel the Companies to prioritize a warfighting house that belongs to none of them. Congress repeats the analysis yearly — every annual protection invoice directing one other examine, one other fee, and one other try to patch a assemble that nobody will defend.
Not lengthy after I arrived at Cyber Command, I couldn’t assist however discover the cultural aversion to direct tasking, or on the very least, the final choice for consensus-building over direct decision-making. Within the submarine drive, job orders are how enterprise is performed. Authority flows via the chain of command, orders are issued, and the submarines execute them. Routine tasking throughout the cyber enterprise required coordination with the very organizations being tasked. Drafts had been circulated for remark, wording was negotiated, and if consensus couldn’t be reached, seniors needed to get entangled. Not one of the coordination was unreasonable and buy-in usually produced higher outcomes. However it mirrored one thing bigger culturally throughout all of the Division’s cyber forces. It confirmed that the command was primarily a coordinator amongst organizations that owned totally different items of the issue and had motivations that didn’t at all times align.
So what makes cyber so particular? Nothing. Nothing, besides that nobody owns it as a result of everybody owns it. I discovered myself preaching Admiral Rickover’s tradition of accountability in a discipline whose construction gave it nothing to connect to. Rickover, the founding father of the Nuclear Navy, knew that duty can’t be diluted, that it’s essential to have the ability to poke the person within the chest when it fails. That tradition was not conjured by drive of persona. It was potential as a result of the nuclear propulsion program had a single proprietor with real authority over the complete enterprise — the reactor crops, the coaching pipeline, the commercial base, and the cash that paid for all of it. The construction made the tradition enforceable. Now think about an enterprise with out that tradition, with out that governance, and you’ve got what the previous couple of a long time have constructed for cyber.
The error on the heart of the Cyber Power dialog is the conflation of systemic force-generation issues with the deeper points rooted within the discipline’s lack of governance. Power technology solutions the problems of manning, coaching, and equipping the cyber and knowledge know-how forces. Governance solutions who will personal the funds, set coverage, present civilian oversight, and stand earlier than Congress and the taxpayers to account for the warfighting area. The Division has spent the final a number of a long time making our on-line world into each a commodity and one thing so particular that it have to be handled in a different way from all different warfare domains. Cyber is taken into account so particular that it warrants its personal combatant command and a seat on the warfighter’s desk; then, in the identical breath, it’s handled like a commodity to be ruled like enterprise data know-how. Via accretion somewhat than design, cyber and its terrain are scattered throughout the Companies. Resourcing is completed on an advert hoc foundation by the Companies, combatant instructions, and numerous companies. Accountability stays perpetually undefined. The contradiction between cyber as warfighting and cyber as a utility service just isn’t a force-generation downside, and no Cyber Power, irrespective of how properly designed, resolves the governance query alone.
Congress, to its credit score, has already begun addressing the governance query. The Home Armed Companies Committee’s cyber subcommittee’s mark of this 12 months’s protection invoice, permitted in early June, comprises no cyber service. It does, nonetheless, include Part 1502, which might direct the Secretary of Protection to set up clear accountability for the cybersecurity of Division of Protection data networks, “together with identification of 1 official designated as the only accountable official.” Briefly, the Home’s first transfer is to call who owns the issue.
The Senate went a step additional and proposes a solution. The Senate’s potential answer is a brand new Undersecretary of Protection for Cyber, Data, and Networks, dual-hatted because the Division’s Chief Data Officer and Principal Cyber Advisor — a single official consolidating the enterprise protection and operational advisory capabilities whose seams, uncovered by the maturing of cyber warfare, are actually evident. That’s the single accountable official, drafted into statute. And the identical Senate committee, having declined the Cyber Power by one vote, directed its personal evaluations of whether or not Cyber Command is sufficiently organized for its increasing authorities and of the roles and resourcing of the Principal Cyber Advisors. Now contemplate for a second what each chambers did this cycle. Given a chance for a brand new cyber service, the Home declined to take it up, and the Senate rejected it by the narrowest potential margin. But, each chambers as an alternative opted for the governance answer.
Naming an official is just the start of accountability. The Senate’s assemble is the correct skeleton. Fusing the Chief Data Officer’s enterprise community structure and necessities function with the Principal Cyber Advisor’s operational advisory function closes an actual seam — notably between the strains of what constitutes cyber operations and what retains cyber operating within the background. The Principal Cyber Advisor owns the cyber-operations funds, and the Chief Data Officer controls a lot of the cybersecurity and knowledge know-how funds and oversees the Companies’ cyber budgets. Fusing these two roles places each priorities, operations and knowledge know-how, within the arms of 1 one that solutions for the steadiness. That’s the level of a single accountable official. However an undersecretary who solely advises and coordinates, with out controlling funding, would simply be a extra senior model of right now’s undefined lanes. Real accountability requires directive authority over the area’s terrain and actual possession of the force-generation and methods {dollars} the Companies primarily management. Congress ought to designate somebody who controls the cash, units the necessities, and compels the Companies to useful resource the sphere. In any other case, they are going to have picked the particular person to poke with out giving them the authority to stop failure.
Cyber Power advocates’ personal work factors on this similar route. The fee behind the June report spent months producing what’s probably the most rigorous implementation examine but, drawing in dozens of probably the most extremely certified people within the discipline. Nonetheless, it couldn’t resolve the query of the place a Cyber Power must be institutionally housed throughout the Division of Protection. Probably the most certified individuals within the discipline addressed command and management, drive dimension, personnel recruitment and retention fashions, and coaching pipelines, however they might not clear up the query of governance. The toughest query in that room is the one this text argues is the primary query — and their sincere incapacity to reply it’s higher proof than something a skeptic might write.
The fee’s scoping resolution factors in the identical route. Its proposed drive would manage, practice, and equip for cyber operations, however wouldn’t take up the Companies’ particular person networks. The Companies would proceed to function and safe the methods related to their respective missions. That could be a cheap hedge towards the sprawling forms objection. It’s also a quiet concession that, underneath the proposal, our on-line world’s terrain stays fragmented throughout Companies whose first priorities — by the advocates’ personal argument — lie elsewhere. The conclusion that launched this complete debate, cyber as everybody’s duty and nobody’s precedence, would survive the creation of a Cyber Power totally intact on the community layer, failing to resolve the place many of the operational friction lives. Two of the group’s stewards noticed the identical hole: testifying earlier than the Nationwide Academies committee, former Cyber Command commanders, Generals Timothy Haugh and Paul Nakasone, warned {that a} new service dangers a top-heavy forms and confusion over who defends the opposite Companies’ networks.
Cyber Power advocates usually cite the Air Power as a precedent for forming a brand new drive. They name on this historic level as a result of the lesson is immediately relevant to right now’s dialog. The emergence of a brand new warfare area, which had not beforehand been shepherded by any of the legacy organizations, is an virtually good historic parallel. One element is misplaced on this analogy. The element is that, earlier than creating a brand new service, Congress first rebuilt the governance of the complete protection institution via the Nationwide Safety Act, creating the Secretary of Protection, the Division of the Air Power, and a brand new construction of civilian oversight, earlier than establishing the Air Power as a Service inside it. The preliminary resolution was governance; the Service adopted.
Historical past factors in the identical route because the Nunn-Cohen reforms that created Particular Operations Command. In a single act, Congress assembled the command, civilian oversight, authorities, and assets as an built-in design. Congress gave the particular operations enterprise its personal service-like funding line, Main Power Program 11, and, with it, actual possession of its resourcing. That funds authority, arguably extra than any four-star billet, is what transformed duty from an org-chart abstraction into one thing an individual might reply for. Cyber has gathered parts analogous to these given to particular operations forces — however piecemeal over almost two a long time somewhat than by preliminary or deliberate design. The query earlier than Congress right now is whether or not these items want continued refinement or full reconstruction.
Governance reform and repair creation usually are not essentially sequential issues. One might argue that each can proceed in parallel, and in a fast-evolving discipline, a possible multi-year pause might price extra in readiness than it buys in coherence. This argument fails the design downside. It’s a plan that begins with motion earlier than its goal is finalized. Does the brand new Service personal the Division’s networks or solely its operational forces? Who’s the shopper — Cyber Command? The Companies? An undersecretary who doesn’t but exist? The place does its force-generation funds sit, and who defends it earlier than Congress? Each a kind of solutions is an output of the governance resolution, not an enter to it. This implies a service designed in parallel is a service designed towards assumptions that the governance debate could in the end show incorrect. That is the naval equal of laying the keel for the primary within the class whereas the naval architects are nonetheless arguing over the hull kind. The Cyber Power advocates’ personal fee made the identical level this 12 months: The one query it couldn’t resolve was the place the proposed drive ought to reside.
First, no matter what survives congressional convention, the governance query have to be answered. Above all, be keen to call the only accountable official and arm that workplace with the funds and directive authority the job requires. Whether or not that reply arrives via the Home or Senate’s proposals or another legislative automobile issues lower than answering the query. That’s as a result of whoever owns the terrain and the funding will outline the aim of any future service. A service designed earlier than that reply has been resolved is a drive constructed for an undefined buyer. Second, Congress ought to repair the governance layer. Do that by figuring out the place cyber coverage, civilian oversight, and funds authority reside, and by guaranteeing it is staffed for fulfillment. Assemble a company that may transfer the levers that compel organizations to make cyber the precedence they might not in any other case have made. Lastly, take up the service query, with the Nationwide Academies’ evaluation in hand, inside a construction really constructed to obtain a brand new service. That sequence would price maybe two years relative to the Cyber Power advocates’ timeline. The choice prices extra. A service commissioned earlier than the governance combat is settled inherits the fragmentation as a delivery defect, institutionalizing it proper beside its brand-new flag and its birthday.
The pundits and critics preserve asking whether or not cyber requires its personal service, however that’s the incorrect first query. Going through new warfighting realities in 1947 that legacy establishments couldn’t govern or prioritize, america started by redesigning the complete governance of the protection institution. Solely then did it set up a brand new drive. The Division should first reply who owns our on-line world earlier than it tries to reply the query of whether or not it ought to set up a Cyber Power. The uniforms can wait.
Justin Hardy is a profession U.S. Navy submarine officer who commanded the ballistic missile submarine USS Alaska and is at the moment assigned as a federal govt fellow on the U.S. Naval Institute. He beforehand served as appearing deputy director of operations and chief of Mission Assurance Division at U.S. Cyber Command.
The views expressed are the creator’s personal and don’t mirror the official place of the U.S. Navy, the Division of Protection, or the U.S. authorities.
**Please observe, as a matter of home type, Battle on the Rocks is not going to use a unique identify for the U.S. Division of Protection till and except the identify is modified by statute by the U.S. Congress.
Picture: Josef Cole through DVIDS
