National Guard expects expanded role in cybersecurity

The National Guard’s role in cybersecurity began in 1999 thanks to the uncertainty created by Y2K.

With concerns of potential computer chaos looming when dates on systems turned over to 2000, the National Guard was given a new force structure called a computer network defense team. Renamed Defensive Cyber Operations Elements, the eight-to 10-person teams are organized on the state level, while support for the 10 Federal Emergency Management Agency regions is handled by  Cyber Protection Teams, Lt. Col. Brad Rhodes, the commander of the Colorado National Guard's Cyber Protection Team 178, said in an interview with GCN.

The Guard wants to grow its DCOEs to at least 2,800 personnel by 2019, according to Jack Harrison, a spokesperson for Department of Defense's National Guard Bureau. The Guard has some kind of cybersecurity operation in all 50 states and four U.S. territories, Harrison said in an email. And last year, the Army and Air Force National Guard expanded their cyber units into more states.

This expansion comes as multiple government reports have looked to the National Guard as a resource for states and localities to lean on as cyber threats continue to multiply. The most recent example came in the final report from the White House’s Commission on Enhancing National Cybersecurity.

“The Guard represents a talent pool that can be regularly trained, equipped, and called on to protect and defend against attacks on information assets or computer systems and networks,” the report reads. “The Guard could also be deployed after a cybersecurity incident to help recover or restore systems and services to normal operations.

Citing the "growing investments in developing sophisticated cyber defense capabilities in the National Guard," the commission suggested that "state legislatures should give serious consideration to providing governors with the necessary authorities and resources to train and equip the National Guard to serve their states and safeguard the public from malicious cyber activity.”

The recommendation is meant to build on the success the Guard has been able to show in the cybersecurity space, according to Kiersten Todt, the executive director of the Commission on Enhancing National Cybersecurity.

“It’s not about changing [the Guard's cyber responsibilities],” Todt said. “But it’s about getting more resources and more focus.”

The role of the Guard when it comes to cybersecurity has a couple of different pieces, according to Rhodes. The Guard protects its piece of the Department of Defense’s information network known as Guard-Net. But Guard members also have sworn an oath to respond to disasters when called upon by the governor in their state. This has not happened much for cybersecurity situations, Rhodes said.

“If you have to deploy the National Guard that’s a big deal, and governors tend to not want to do that,” said Herbert Lin, a senior research scholar for cyber policy at Stanford University and member of the Commission on Enhancing National Cybersecurity

But Rhodes said there were incidents, like cyberattacks in Flint, Mich., earlier this year that resulted in the Guard being called upon. Virginia has used its National Guard’s cybersecurity capabilities to look at localities’ vulnerabilities. 

Where to focus requests for more resources can differ depending on circumstances because of the Guard’s unique relationship with both the state and federal government. The federal government covers training for the Guard, which includes cybersecurity training. But if a governor calls on the Guard to respond to an incident, then expenses for that work will be coming from state accounts.

Lin said this left the state government with a couple of different roles to fill related to funding. The first, Lin said, would be advocating on behalf of their state’s Guard for more federal money. But the states may have to allocate funds to the Guard to cover elements of their systems that are unique: “They should be training on the systems that match what they would see throughout that state,” he said. “That’s just common sense.”

At the end of the day, though, the Guard needs qualified cybersecurity professional, though finding and retaining such talent is an issue for the Guard, just as it is for countless other agencies, governments and businesses. The Guard is working on growing this workforce, Rhodes said. And the main tool to get qualified people into the positions is certifications. “That’s what the civilian folks look at,” he said.

The Guard can be especially valuable for state and local level cybersecurity because of the crossover that many of its members have between military training and civilian day jobs, Todt said.

“One of the things that is very appealing about it is it's not just a military-based workforce because these individuals may not have military jobs during the week,” she said, adding that allows for a “hybrid” approach between government and private business. “I think the most simple answer is that this is a resource that is available, so not using it is a waste.”

In order to put that resource to better use, Rhodes said, the Guard must continue to build relationships with local governments, academia and private businesses.

“We’re in the build process right now, so we have a lot of work to do,” he said.