Perspectives

The Future of Warfighting: SOF-Cyber Training

Accelerating effective special operations forces–cyber integration

In any future competition, crisis, or conflict, the importance of the joint force’s ability to integrate and synchronize special operations forces (SOF), space, and cyber capabilities across all warfighting domains cannot be overstated. More specifically, SOF’s ability to deliver the effects of the SOF-Space-Cyber triad in permissive to denied environments will become critical for national efforts to project power, compete, and deter adversaries while remaining under the threshold of armed conflict. Now more than ever, the readiness of the U.S. military to meet these new operational requirements will depend on the training that SOF cyber operators receive to maximize the triad’s potential.

The Department of Defense (DOD) and U.S. Special Operations Command (SOCOM) have begun developing tomorrow’s SOF cyber training. In a 2019 memo concerning the governance of cyberspace operational forces, the secretary of defense designated SOCOM’s force-generation responsibilities as separate from U.S. Cyber Command’s (CYBERCOM) responsibilities for the Cyber Operations Forces (COF) and the Cyber Mission Force (CMF).¹SOCOM has service-like training responsibilities under Title 10 as a joint force trainer and as such must ensure SOF cyber forces are trained, certified, integrated, and interoperable with conventional and other joint forces. SOCOM has made some progress in establishing training requirements, resources, and interoperability standards for the SOF service components and theater special operations commands (TSOC).

The unique nature of SOF-peculiar cyber operations compared to conventional cyber missions requires the development of skills and capabilities that are not the focus of CMF/COF training, and programs like the Persistent Cyber Training Environment (PCTE) are not architected to meet the needs of SOF cyber. For example, the preponderance of cyber training and exercises across the joint force focuses on the tasks of a remote operator leveraging substantial infrastructures to gain access to the target and massive reachback support capabilities to achieve effects. The implementation of SOF-peculiar cyber will occur at or near the target with close physical access being the initial vector and limited-to-no reachback support available. These skills will need to be honed with realistic training that reflects how SOF personnel continuously deploy around the world, in all environments from permissive to hostile, because it is there, at the tactical edge, that SOF cyber operations will occur. SOF cyber is reliant upon other SOF skills to be effective, and the effects of SOF cyber will be more immediate and localized than traditional cyber, thus a unique training and exercise capability that blends the cyber and physical realms, like the SOF Cyber Physical Test Beds capability, needs to be expanded and normalized throughout the SOF training enterprise.

SOF personnel already meet substantial training-and-education requirements to become proficient. SOF operations in the cyber domain will levy additional, substantial knowledge-and-skills requirements. This burden and the likely absence of reachback support create an obvious need to lower the cognitive load on operators and increase lethality via artificial intelligence and machine learning (AI/ML) integration. Thus, SOF cyber training and exercise capabilities will need to incorporate the use of edge-hosted AI/ML capabilities. SOCOM’s J3 Joint Collective Training Division (JCT) has begun this effort by incorporating the Booz Allen-developed SOF Operator AI Toolkit into some of their events.

^{1 Mark Esper, “Definition of ‘Department of Defense Cyberspace Operations Forces (DOD COF)’” (official memorandum, Washington, DC, Department of Defense, 2019)}

An Integrated Approach to Training and Employing New Technologies

SOF cyber forces will play a leading and outsized role in future operations by providing offensive, defensive, and influence capabilities across the full range of SOF missions. As the former SOCOM commander, Gen. Richard Clarke, stated, “We need coders … the most important person on the mission is no longer the operator kicking down the door, but the cyber operator who the team has to actually get to the environment so he or she can work their cyber tools into the fight.” While not every SOF operator will become a coder or deliver cyber effects, there is an opportunity to build cyber skills for select personnel while also evolving training for all SOF forces. We have seen the SOF components have already looked internally at how to best develop their ranks to integrate cyber into their core activities. This is a key step toward equipping traditional SOF forces with greater insights about cyber capabilities and what their organic cyber operator teammates need to put these new capabilities into action.

Elite U.S. forces understand the value of realistic training: Accelerating the integration of SOF and cyber in training is a natural next step. By integrating cyber terrain into training areas, SOF teams can gain hands-on experience working with SOF cyber operators to fully understand how to best incorporate new cyber tactics, techniques, and procedures (TTP) into their operations across all SOF missions. SOF-cyber integration should span all SOF core activities, not just direct action and special reconnaissance, but also information operations and irregular warfare. To improve confidence in the value proposition of such integration, cyber activities should not be “white carded”—merely simulated—during training and exercise events: Instead, they should be realistically embedded in live, virtual, and constructive parts of the joint operational and readiness training cycle. Success and failure in realistic environments will accelerate innovation, refine use cases, advance joint interoperability, and increase trust in cyber capabilities.

Next Steps

It takes years to train operational SOF units to the level of proficiency needed to accomplish their missions. Integrating new cyberspace capabilities into SOCOM’s forces requires investments in time, resources, and partnerships. To accelerate this integration, the following three recommendations are offered.

1. Prioritize training for full-spectrum cyber training simulations, content, and ranges:

The complexity of cyberspace activities is like that of multiflow dynamic combat clearance—it requires countless repetitions and TTP refinement to instill confidence in the operator’s capability to execute the mission. Like combat clearance, cyber training needs to be integrated into training environments using physical hardware and software to depict adversary terrain as realistically as possible. For teams to fully integrate full-spectrum cyber capabilities across the SOF disciplines, operators need to witness them in action—like, for instance, the cyber manipulation of a target vessel during an interdiction operation or cyber destruction of an adversary surveillance system during direct action. SOCOM requires deliberate and continuous investment to enable SOF cyber operators to rapidly build the skillsets required for future mission success.

Funded prioritized cyber training, aligned to SOF-peculiar operational planning requirements, makes the cyber domain applicable and valuable to SOF operator roles and mission requirements, and enables cyber to fully integrate (live, virtual, and constructive) into SOF training exercises. This would evolve SOF exercises from “white carding” cyber activities, to enabling operator use of friendly and adversarial cyber effects that are operationally relevant and realistic. For instance, exercises can leverage catalogs of the latest known vulnerabilities concerning networks, hardware, and software—and leading manufacturing capabilities can help put such capabilities into play. Exercising in this manner will build stronger connectivity and interoperability between SOF and CYBERCOM cyber teams, resulting in more effective SOF-enabled cyber operations and cyber-enabled special operations. For example, realistic joint exercises will enable the cross-pollination of SOF cyber and conventional cyber operations to develop shared practices and greater interdependence. SOF-peculiar exercise environments will also provide operators with a sandbox to experiment with innovative technologies like AI/ML to support forward-deployed operators who may only have minutes to integrate cyber tools into any given mission.

2. Establish a SOF cyber indefinite delivery/indefinite quantity (IDIQ) program:

SOCOM and the service components are developing SOF-specific cyberspace requirements for training, exercises, and operational use. The force requires a program office and method to accelerate the acquisition, distribution, and sustainment of these unique capabilities. The traditional acquisition process cannot keep up with the rate of technological change for cyberspace, even with the Special Operations Forces Capabilities Integration and Development System (SOFCIDS). Teams need ready access to cyber industry subject matter experts, innovative training programs, and cutting-edge tools to develop, test, and evaluate cyber capabilities that could be rendered ineffective by patching on any given day. Establishing a robust IDIQ at SOCOM would be the quickest and most efficient means of supporting the warfighter.

3. Implement the SOF-Space-Cyber Triad:

The asymmetric advantage offered by integrating the unique capabilities of SOCOM, CYBERCOM, and U.S. Space Command (SPACECOM) will only be realized if cross-functional experiments and training drive a campaign of learning. The outcomes of such an effort will be better-defined use cases, increased speed, and operational agility. Critically, these joint efforts will also identify friction such as differences in doctrine, interpretation of authorities, and potential cultural challenges. An essential outcome is improved trust, a prerequisite to creating the cultural change required to optimize the potential of the triad. It is only through close collaboration and demonstration that the operators and frontline leaders will fully understand the cross-functional and cross-organizational capabilities for mission execution.

Immediately and effectively improving the training for SOF-cyber capabilities will better enable the full range of SOF missions on the future battlefield. One of SOCOM’s SOF Truths states, “Competent special operations forces cannot be created after emergencies occur.” This is also true for cyber forces and capabilities. Now is the time to refine and implement the doctrine, policy, organizations, capabilities, training, and resources required to improve SOF’s success in competition, crisis, and conflict against all adversaries. Now is the time for SOCOM and the joint force to fully invest in bringing SOF cyber capabilities to the forefront of joint force operations.

Learn more about Booz Allen’s approach to National Cyber

For more information on our next demonstration day or, to join us during SOF Week at our booth in the convention center, or to learn how Booz Allen can integrate our cutting-edge, full-spectrum cyber training and exercise capabilities and extensive cyber force development experience into your team and mission, please contact us below.