A new Government Accountability Office (GAO) report says the U.S. Army is currently unequipped to meet the cyber threat from adversaries such as China and Russia.
The Army’s preparations to counter cyber attacks include new cyber and electronic warfare units. GAO’s review found that some of these units are being created on an accelerated schedule, and in some cases, activated before cyber training and equipment have been updated.
The Army is revising its doctrine to guide how the force and specific units will function. This includes training its combat forces for multi-domain operations in part by increasing the focus on cyber operations. GAO found that while the Army is establishing new cyber and electronic warfare units for multi-domain operations, it does not fully assess the risk of activating some units at an accelerated pace and is experiencing staffing, equipping, and training challenges.
For example, the Army activated a cyber battalion in December 2018, and as of March 2019, this unit was understaffed by more than 80 percent, according to GAO’s report.
During the review, officials at Army headquarters and the Army Cyber School cited equipment challenges as one of the key issues that must be addressed when activating a unit on an accelerated basis. For example, in November 2018, an Army headquarters’ official responsible for building one of the new units stated that the Army was having a difficult time identifying where the unit’s equipment would be coming from. By the end of January 2019, the official said the situation was improving and that 55 percent of the equipment had been identified, but the Army was trying to find a source for the remaining 45 percent. However, most of this is common Army equipment, such as firearms, according to an Army official; those percentages do not include the specialized cyber equipment that the unit will need to perform its missions, such as a communications system designed to transfer data beyond the line of sight during air defense operations. An Army headquarters’ official stated that the Army is prototyping different types of specialized equipment in order to expedite the acquisition of such capabilities.
Equipment priority is given to the units over the school. However, if the Army does not acquire new equipment quickly enough, the result could be that soldiers in the Army Cyber School will be trained on outdated equipment, which they will not use when they get to the field.
Army leadership believe threat intelligence justifies developing these units at an accelerated pace. Consequently, the Army did not assess the staffing, equipping, and training risk before activating one unit, and only conducted an initial risk assessment before activating a second unit. Army officials told GAO that as these units evolve, it is uncertain when more comprehensive risk assessments would take place.
GAO recommends that the Army should assess the risk associated with staffing, equipping and training, and conduct a comprehensive risk assessment prior to full operational capability. The Army partially concurs with the recommendation for it to conduct a risk assessment, such as a force integration functional area analysis. The Army states that it does not perform force integration functional area analyses for experimental or pilot organizations, and that because the first Intelligence, Cyber, Electronic Warfare, and Space (ICEWS) unit was activated as a pilot, no such assessment was performed. The Army added that it would conduct a risk assessment at the conclusion of the pilot if and when the Army decides to establish ICEWS units.
