Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Next-Generation Technologies & Secure Development

GAO: Army's New Cyber Units Understaffed and Underequipped

Audits Finds Army Rushed New Units Into Service
GAO: Army's New Cyber Units Understaffed and Underequipped
Soldiers With the ICEWS unit (Photo: U.S. Army)

To better prepare for cyberthreats posed by Russia and China, the U.S. Army has been building cyber and electronic warfare units. But a new report from the Government Accountability Office finds that these units are understaffed, underequipped and in need of better training.

See Also: Malware Analysis Spotlight: Why Your EDR Let Pikabot Jump Through

The GAO report comes at a time when the Army is changing part of its mission, organizational structure and training to develop new capabilities that can effectively counter Russia and China, especially when it comes to cyberwarfare. The Army also plans to develop what it calls "multidomain operations" by 2028 to confront adversaries on land, air, sea, cyber and space, according to the GAO report.

Over the last two years, the Army has established two of these new units, and more are planned in 2020. The 915th Cyber Warfare Support Battalion, which is based in Fort Gordon, Georgia, is focusing on providing offensive cyber capabilities. Another new unit Army division with a similar mission is the Intelligence, Cyber, Electronic Warfare and Space unit.

The GAO determined, however, that while the Army has accelerated its plans for cyberdefense and cyberwarfare, top officials have not adequately staffed these new units. There have also been shortfalls when it comes to properly training and equipping soldiers assigned to the these new units, the report finds.

"The army is establishing new cyber and electronic warfare units for multidomain operations, but did not fully assess the risk of activating some units at an accelerated pace and is experiencing staffing, equipping and training challenges," the GAO investigators note.

According to the Army's own guidelines, a unit's activation date needs to be established one to two years in advance to allow time to build up the necessary trained personnel and equipment for deployment, according to the report. The GAO audit notes, however, that the accelerated pace of building these cyber units meant that many positions were left vacant.

Recruiting Talent

The Army has had difficulty filling open positions with the ICEWS unit and the 915th Cyber Warfare Support Battalion, according to the GAO report. For example, the ICEWS was activated as a pilot test program in October 2018, but has only 32 percent of its positions filled.

The GAO reports that Army commanders told investigators finding the right personnel has been a slow process.

As of March, only 30 of the 171 positions were filled in the 915th Cyber Warfare Support Battalion, according to the GAO. In response to the GAO audit, Army brass acknowledged that this battalion may not meet the authorized staffing levels for fiscal year 2019 if higher priorities arise within the Army.

GAO also warned that staffing all of these new cyber and electronic warfare units could be challenging. An Army official told the GAO that the high demand for cyber personnel is creating competition among the military, other government entities and the private sector.

"Army headquarters officials said they are exploring options to address the challenges and have taken steps to retain the personnel that they have, mostly in the form of retention bonuses and incentive pay," the GAO report notes.

Equipment Shortage

In addition to trying to find enough skilled personnel, these cyber units are also facing an equipment shortage, the report notes.

In November 2018, an Army headquarters’ official responsible for building the ICEWS unit stated that the Army was having a difficult time identifying a source for the unit’s equipment, the report finds.

"By the end of January 2019, the official said the situation was improving and that 55 percent of the equipment had been identified, but the Army was trying to find a source for the remaining 45 percent," according to the report.

The report also notes that much of the equipment is common to the Army and does include highly specialized cyber gear that the unit will need to perform its missions, such as a communications system designed to transfer data beyond the line of sight during air defense operations.

Updated Training

The report also looked at training within these new units, which found that the Army is still creating new doctrines and materials.

Officials with the Army Cyber School and the Army’s Combined Arms Center told the GAO that they are working on revisions to the current U.S. Army Cyberspace Operations Training Strategy to include new and updated sections for a variety of topics, including electronic and cyber warfare.

The ICEWS unit and the 915th Cyber Warfare Support Battalion were activated without this updated training strategy - and this could continue as other units are activated in 2020 and beyond.

"Without the new strategy, [U.S. Army Training and Doctrine Command] officials said they would have difficulty designing training for the new units, and soldiers will not have a clear understanding of their tasks and missions," according to the report.

GAO Recommendations

The GAO made several recommendations to the Secretary of the Army. These include conducting a risk assessment of staffing, equipment and training of the ICEWS unit and the 915th Cyber Warfare Support Battalion. The report also recommends a similar risk assessment of staffing, equipment and training of any new units the Army plans to activate in 2020 or beyond.

In response to the report, Army officials partially agreed with the recommendations made about the ICEWS unit and the 915th Cyber Warfare Support Battalion. Army officials will consider conducting what they call a force integration functional area analysis - a type of risk assessment that helps determine if a unit is meeting its military objectives.

In addition, Army officials fully agreed with creating risk assessments associated with any new units that are planned for 2020 and beyond. Commanders told the GAO that they plan to learn lessons from the creation of the other two units.

"The Army added that any lessons learned from the activation of the first ICEWS unit and the 915th Cyber Warfare Future Warfare Support Battalion will be taken into consideration when assessing the risk before the activation of these new organizations," according to the report.

About the Author

Apurva Venkat

Apurva Venkat

Special Correspondent

Venkat is special correspondent for Information Security Media Group's global news desk. She has previously worked at companies such as IDG and Business Standard where she reported on developments in technology, businesses, startups, fintech, e-commerce, cybersecurity, civic news and education.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.