By Franklin Holcomb
Summary: U.S. and Western Armed Forces are struggling with recruitment and retention in their cyber units, which leaves their countries vulnerable to hostile cyber actors. As society becomes increasingly digitalized in coming years, the severity of these vulnerabilities will increase. The militia model adopted by the Baltic states provides a format to attract civilian experts and decrease vulnerabilities.
Text: The U.S. Armed Forces are facing difficulties recruiting and retaining cyber-security talent. To meet this challenge the U.S. Marine Corps announced in April 2019 that it would establish a volunteer cyber-auxiliary force (Cyber Aux) consisting of a “small cadre of highly-talented cyber experts who train, educate, advise, and mentor Marines to keep pace with constantly-evolving cyber challenges[1].” The Cyber Aux will face many of the issues that other branches, and countries, have in attracting and retaining cyber-security professionals. Cyber Aux takes notably important steps towards increasing the appeal of participation in the U.S. armed forces for cyber-security experts, such as relaxing grooming and fitness standards. But Cyber Aux will struggle to attract enough professionals due to factors such as its role as a mentorship organization, rather than one that conducts operations, and the wide military-civilian pay gap in the cyber-security field[2]. These factors will ensure U.S. and North Atlantic Treaty Organization (NATO) military forces will have suboptimal and likely understaffed cyber components; increasing their vulnerabilities on and off the battlefield.
Estonia, Latvia, and Lithuania have been on the geographic and virtual frontlines of many challenges faced by NATO. The severity of threats facing them has made security innovation a necessity rather than a goal. While not all innovations have succeeded, these countries have created a dynamic multi-layered defense ecosystem which combines the skillsets of civil society and their armed forces to multiply their defense capabilities and increase national resilience. There are numerous organizations that play a role in these innovations including civilian groups as well as the militias of each state[3]. The militias, non-professional military forces who gain legitimacy and legality from state authorization, play a key role in increasing the effective strength of forces in the region. The Estonian Defense League, the Latvian National Guard, and the Lithuanian Riflemen’s Association all draw on civilian talent to form militias. These organizations are integrated, to different extents, with military structures and play supporting roles in a time of crisis that would free regular forces to conduct operations or support their operations directly.
These militias have established cyber units which are models for integrating civilian cyber-security professionals into military structures. The Baltic cyber-militias engage directly in practical cyber-security concerns, rather than being restricted to academic pursuit or mentoring like Cyber Aux. In peacetime, these organizations conduct training for servicemen and civilians with the goal of raising awareness of the risks posed by hostile cyber actors, increasing civilian-military collaboration in cyber-security, and improving cyber-security practices for critical systems and infrastructure[4]. In crisis, these units mobilize to supplement state capabilities. The Estonian Defense League and Latvian National Guard have both established cyber-defense units, and Lithuania intends to complete a framework through which its militia could play a role in supporting cyber-defense capabilities by January 2020[5].
The idea of a cyber-militia is not new, yet the role these organizations play in the Baltic states as a talent bridge between the armed forces and civil society provides a very useful policy framework for many Western states. Currently cyber-auxiliaries are used by many states such as Russia and China who rely on them to supplement offensive cyber capacities[6]. This situational, and often unofficial use of auxiliaries in cyber operations has advantages, prominently including deniability, but these should not overshadow the value of having official structures that are integrated into both civil society and national cyber-defense. By creating a reserve of motivated civilian professionals that can be called on to supplement military cyber units during a time of crisis, the Baltic states are also effectively increasing not only their resilience to a major cyber incident while it is underway, but raising the up-front cost of conducting such an attack in the first place.
As NATO and European policymakers consider the best courses available to improve their Armed Forces’ cyber capacities, the models being adopted in Estonia, Latvia, and Lithuania are likely of value. Estonia pioneered the concept in the region[7], but as the model spreads to other states Western states could learn from the effectiveness of the model. Cyber-militias, which play a supportive role in cyber operations, will strengthen the cyber forces of militaries in other NATO states which are undermined by low recruitment and retention.
No comments:
Post a Comment