Added Cyber Challenges

In a year in which National Guard soldiers and airmen have battled wildfires, picked up after hurricanes, secured the U.S. Capitol and vaccinated millions of Americans against COVID-19, the Guard cyber mission has largely flown under the radar.

Digital Version

But that isn’t due to a lack of cyberattacks or Guard responses.

“America’s power plants, food supply, water supply, health care, law enforcement and defense sectors have all come under attack,” Gen. Daniel R. Hokanson, the chief of the National Guard Bureau, said in June. “These cyber threats extend our adversaries’ reach across borders and time zones, and it could have devastating consequences.”

Hokanson said there have been attacks in every U.S. state. And while the Guard has not responded to every assault, it often plays a role in helping to strengthen vulnerable state and local networks.

“We have emerged as a trusted and valuable resource in helping our local, state and federal partners defend and mitigate against cyberattacks,” he said.

The growing frequency of such attacks have slowly captured the public’s attention. Most have impacted limited populations — a single town or branch of a municipal government. But when an attack on the Colonial Pipeline caused gas shortages from Washington, D.C. to Florida earlier this year, the nation began to pay closer attention, says Maj. Gen. Johanna Clyborne, the chair of the NGAUS task force on cyber issues.

Clyborne is dual-hatted as assistant adjutant general for Minnesota and deputy commanding general of the Army Cyber Center of Excellence at Fort Gordon, Georgia. She assumed her NGAUS duties earlier this year.

She says high-profile cyberattacks have raised concerns for local leaders, who in turn have looked to the Guard for help, much as they have throughout the force’s history.

“The Guard is best known for responding to floods, riots and natural disasters, but it’s also uniquely positioned to help at the state and local level for cyber defense,” Clyborne says.

While election security has garnered much of the headlines for the Guard’s cyber force in recent years, she notes the Guard has also responded to attacks on government websites and other critical infrastructure, with missions increasing as states develop how to best deploy their cyber personnel.

Speaking earlier this year, Lt. Gen. Jon A. Jensen, the Army Guard director, noted that much of the Guard’s cyber force structure was still maturing, with some states relying on “ad hoc units with ad hoc capability.”

Despite that, the nation has clearly recognized the “untapped capability” of the Guard in the nation’s cyber defenses, he said.

As of October, three Guard cyber teams were conducting cybersecurity missions on behalf of their states, while others were also deployed on Title 10 (federal) status in support of U.S. Cyber Command.

Overall, the Guard’s cyber force includes 3,900 service members in 59 cyber units across nearly 40 states. But every state and territory has some capability.

The dual nature of the Guard along with its large number of soldiers and airmen with civilian-acquired cyber skills makes it uniquely qualified to provide cyber support. But it has also led to numerous issues and questions over gray areas that currently exist in state and federal laws and regulations written well before the term “cyber” was commonplace.

The Guard is...uniquely positioned to help at the state and local level for cyber defense.

—Maj. Gen. Johanna Clyborne, the assistant adjutant general - Army of Minnesota and the chair of the NGAUS task force on cyber issues

Unlike other state responses, the cyber mission cannot be treated as a natural disaster where the force responds to an act of nature. Instead, it must be an ongoing security operation.

“It’s been pretty clear we have folks who have the needed skillsets who can be incredible assets to their states,” Clyborne says. “But some states have struggled with how best to leverage those assets due to differing laws.”

NGAUS, the Adjutants General Association of the United States and the nation’s governors have been working with federal authorities to ensure that Guardsmen can conduct both preventative and response cyber missions in their home states in a Title 32 (state) status.

Pending legislation in the Senate would help. Sponsored by Sen. Maggie Hassan, D-N.H., and Sen. John Cornyn, R-Texas, it would make clear that states are authorized to use the Guard to provide cyber support services to states and localities.

Meanwhile, the Guard continues to invest in cyber capabilities, with cyber training ranges in several states, partnerships with universities and local and state government IT offices, and large-scale cyber training exercises.

NGAUS believes the Guard should continue to be a critical partner in planning, developing and executing strategy within the cyber domain. The association has lobbied Capitol Hill for several initiatives that would improve the cyber training pipeline, better allow the Guard to be a conduit for cyber operations between federal, state and local governments and the private sector, and to add full-time staffing for defensive cyber operations.

Some of those issues were raised in early October, when Jensen, the Army Guard director, hosted a panel of Guard leaders to talk about a range of Army issues during the annual meeting of the Association of the U.S. Army in Washington, D.C.

Col. Daniel Lister, the chief information officer for the Idaho National Guard, said the Guard’s typical bonuses and incentives, such as college tuition, can’t compete with what’s offered in the private sector.

Instead, he urged Army leaders to consider unconventional incentives and benefits while fostering an environment where soldiers can apply their cyber skills while also innovating and developing new processes that can benefit the Guard and nation.

”Cyberspace is another fighting domain, and we as an Army need to be completely agile in being able to develop and leverage IT methodologies to transform in to a more agile and software-enabled force,” he said. “We have an immense amount of knowledge, experience and skills in the National Guard that allow us to develop technologies and capabilities we can put out to the force.”

Much of that knowledge is civilian-acquired, which is not formally recognized by the U.S. military.

“We do enjoy folks coming to the National Guard that arrive with all kinds of certifications, but what we end up doing is telling them they have to go to school to get certified in the skills they already have,” said Maj. Gen. Laura L. Yeager, the commander of the 40th Infantry Division and the California Army Guard. “That’s additional time away from their families and employers.”

Clyborne says Guard cyber leaders are hoping Army and Air Force officials will begin to recognize and give credit for those civilian skillsets. Limiting time away from civilian jobs and families will be a recruiting and retention asset, she says.

Officials are also pushing for incentive pay for cyber professionals, similar to what military pilots receive for their unique skillsets.

Lister, the Idaho Guard leader, said the Guard must look at its cyber force differently than it has in the past in order to avoid losing Guardsmen to better pay and benefits in the private sector. Instead of leaning on its soldiers’ and airmen’s civilian skillsets, he said, it must strive to bolster them with training that could help them prosper out of uniform.

“Training should be relevant to what they’re experiencing out in their civilian careers,” he said. “They should gain knowledge and skills within military service that can be applied to their careers outside.”

The author can be reached at drew.brooks@ngaus.org.