The National Guard Has Cyber Capabilities That Could Support Civil Authorities

• Communications directorates: The National Guard has a communications directorate[27] within each state, territory, and the District of Columbia that operates and maintains that state’s part of the National Guard information network called GuardNet.[28] In this capacity, the directorate conducts information assurance, information operations, and internal defensive activities. The size of each National Guard unit’s communications directorate varies between state, territory, and federal district. For example, Nevada National Guard officials told us that there were 26 full-time Army National Guard personnel staffed to their communications directorate in fiscal year 2016. Also, Maryland National Guard officials told us that there were 30 full-time personnel staffed to their Army National Guard communications directorate in fiscal year 2016. According to National Guard officials, personnel who work within a communications directorate, if requested and approved, could support a DSCA mission in a cyber incident. For example, Washington National Guard officials told us that their communications directorate’s cyber personnel can conduct vulnerability assessments, support cyber recovery efforts, provide cyber incident response support, and provide cyber and communication capabilities during cyber-related emergencies. Further, National Guard officials told us that the Georgia, Washington, and Maryland National Guard units have developed partnerships with state agencies and local governments to provide cybersecurity support.
• Computer network defense teams: The National Guard has computer network defense teams[29] in each state, three territories, and the District of Columbia with a mission to protect National Guard information systems against cyber threats within the respective state, territory, or federal district.[30] According to the 2015 Concept of Operations Army National Guard Computer Network Defense Team (CND-T), the teams could serve as first responders for states for cyber emergencies and may provide surge capacity to national capabilities. For example, Colorado National Guard officials told us that their computer network defense team—if requested—could provide cyber capabilities to support civil authorities. In preparation for such a request, the team developed a planning document that identified specific cyber capabilities—such as cyber analysis, threat assessment, and incident response—that the team could provide to civil authorities for a cyber-related emergency or incident. Georgia National Guard officials also told us that their computer network defense team’s primary mission is to provide direct cybersecurity support to the network enterprise center and the team also conducts cybersecurity assessments, incident response, network analysis, and forensic support.[31] As of October 2015, 50 states, three territories, and the District of Columbia had computer network defense teams that ranged from 1 to 23 personnel.
• National Guard cyber units: The Army and Air Force are in the process of setting up National Guard units with cyber capabilities to support U.S. Cyber Command’s missions. For example, the Army and the Air Force are planning to establish National Guard cyber protection teams to conduct defensive cyberspace operations.[32] National Guard officials stated that while the Army National Guard and Air National Guard are approaching the organization of the teams differently, both sets of teams will have capabilities that could support civil authorities in a domestic cyber incident. Specifically, within the Army National Guard, the Army has 1 full-time cyber protection team in place and is developing 10 part-time cyber protection teams that would conduct defensive cyberspace operations, and could support DSCA missions if called upon. Also, within the Air National Guard, the Air Force plans to develop 2 full-time cyber protection teams that will be filled by 12 Air National Guard units on a rotational basis that would support U.S. Cyber Command to defend DOD networks and would be available as surge capacity in a cyber incident. According to the 2017 National Guard Bureau Posture Statement, the National Guard will activate the cyber teams by the end of fiscal year 2019.[33] According to National Guard officials, the cyber protection teams are authorized to have 39 personnel each and Georgia National Guard officials told us that in fiscal year 2016 their cyber protection team had 34 assigned personnel. In addition to the cyber protection teams, the Air National Guard has 3 additional cyber units whose mission—as members of U.S. Cyber Command’s national mission teams—is to stop cyber attacks and malicious cyber activity of significant consequence against the United States. The Air National Guard also has 7 cyber intelligence, surveillance, and reconnaissance units whose mission is to produce tailored all-source intelligence products that enable cyberspace operations.[34] In addition, according to DOD’s cyber mission analysis report,[35] the Virginia National Guard Data Processing Unit, when activated, conducts cyberspace operations in support of U.S. Cyber Command and other organizations.[36]

DOD Does Not Have Full Visibility of All National Guard Cyber Capabilities

DOD Has Conducted and Participated in Exercises to Prepare to Support Civil Authorities During or After a Cyber Incident

• U.S. Cyber Command’s Cyber Guard—The command conducted exercises in fiscal years 2013, 2014, and 2015 to explore the ability of DOD, other federal agencies, and the private sector to respond in cyberspace to a destructive or disruptive attack of significant consequence on U.S. critical infrastructure. In the 2015 Cyber Guard exercise, DOD participants supported DHS network defense as part of a simulated DSCA response. National Guard teams also conducted activities to coordinate, train, advise, and assist civil authorities in a state active duty status. The exercises also included legal and policy tabletop review sessions to explore legal and policy issues related to a national response to significant domestic cyberspace incidents.
• Army National Guard’s Cyber Shield—The Army National Guard conducted Cyber Shield exercises in fiscal years 2013, 2014, and 2015 to train computer network defense teams on the detection, analysis, identification, reporting, and mitigation of cyber threats. The Army National Guard focused the fiscal year 2013 and 2014 exercises on defense of the GuardNet, and in the fiscal year 2015 exercise, changed the focus to support for civil authorities. Specifically, the Cyber Shield 2015 exercise included a scenario where industrial-control systems for electric grid infrastructure and hydroelectric dams were under cyber threat. According to Army National Guard officials, this change to focus on civil support was in response to requests from states for an exercise that would involve National Guard support for information technology infrastructure in the states.
• Vista Host II—In this May 2015 tabletop exercise, North American Aerospace Defense Command and U.S. Northern Command focused on examining planning assumptions, potential resource requirements, and the roles and responsibilities for cyber-related defense support of civil authorities. Specifically, the exercise scenario involved civil support to an electric power generator in responding to a disaster caused by a cyber attack on the generator’s industrial-control systems that controlled hydroelectric and nuclear power generation systems. According to U.S. Northern Command officials, the exercise showed that there was a lack of clarity on roles and responsibilities for supporting civil authorities during a cyber incident.
  In addition to conducting the 7 exercises, from fiscal year 2013 through 2015, DOD components participated in 2 exercises conducted by non-DOD organizations.
• DHS’s Cyber Storm IV—The department’s Cyber Storm IV exercises, which consisted of a series of 15 exercises focused on cybersecurity preparedness and response capabilities, ran from fiscal year 2011 through fiscal year 2014. The exercise series was designed to, among other things, improve the processes, procedures, interactions, and information-sharing mechanisms that exist or should exist under the interim National Cyber Incident Response Plan. According to DHS officials involved in planning the exercise series, DOD officials assisted in designing the exercise scenarios and DOD officials also participated in multiple exercises that included a tabletop exercise component designed to examine policy issues. U.S. Cyber Command officials also noted that Cyber Storm IV helped participants better understand federal cyber capabilities.
• North American Electric Reliability Corporation’s GridEx II—The not-for-profit international organization conducted the GridEx II exercise in fiscal year 2014 on responding to cyber attacks on electric grid components.[40] The exercise included both executive decision making in a tabletop exercise and a response to simulated cyber attacks on electric grid networks. According to a North American Electric Reliability Corporation official, DOD components such as U.S. Northern Command, U.S. Cyber Command, and two state National Guard units participated in GridEx II.

DOD Has Experienced Challenges in Its Civil-Support Exercises and Has Not Conducted a Tier 1 Exercise That Could Address Challenges

• Limited access because of classified exercise environments: According to documents we reviewed and officials we interviewed, DOD’s tendency to exercise in a classified environment limited the ability of other federal agencies and critical infrastructure owners to participate in DSCA exercises. In one example, Washington National Guard officials told us that utility personnel who had flown across the country to participate in a civil support exercise that the National Guard unit had invited them to participate in were not admitted into the classified exercise environment. According to DHS’s Cyber Guard 15 after-action report, DOD’s requirement for the exercise environment to be closed and classified prohibited a more active participation by industry partners and DHS components, including the National Cybersecurity and Communications Integration Center. According to the DHS Cyber Guard 15 exercise after-action report, the exercise has experienced this challenge since 2013. Similarly, according to U.S. Cyber Command’s after-action report for its February 2016 Cyber Guard 16 tabletop exercise, the exercise experienced issues because officials of state and local governments and the private sector did not have security clearances, which hindered information sharing.
• Limited inclusion of other federal agencies and critical infrastructure owners: Some of the exercises DOD conducted included key federal agencies such as DHS and critical infrastructure owners such as power providers. However, the exercises DOD conducted did not include other key federal agencies (e.g., State and Treasury departments), or other critical infrastructure owners (e.g., bank owners). According to an official from ODASD for Cyber Policy, DOD recognizes that such organizations potentially would be involved in a cyber incident. Similarly, according to the DOD Cyber Strategy, the private sector owns and operates over 90 percent of all of the networks and infrastructure of cyberspace and is thus the first line of defense. In Vista Host II, DOD officials reportedly learned that the critical infrastructure owner would contact its security vendors first because of their familiarity with the critical infrastructure’s industrial-control systems; however, none of the DOD exercises we reviewed included such vendors.
• Inadequate incorporation of joint physical-cyber scenarios: The 7 DOD-conducted exercises we reviewed did not fully explore a scenario in which multiple DOD components and commanders would be responding to a cyber incident that causes an emergency or disaster with physical effects or occurs during such an emergency. The Joint Action Plan for State-Federal Unity of Effort on Cybersecurity, which was approved by DOD, recognizes the possibility of a cyber incident with physical effects as well as a physical incident with cyber implications.[41] DOD recognizes that a cyber incident could cause physical effects, including cascading failures of multiple, interdependent, critical, life-sustaining infrastructure sectors. Similarly, Washington National Guard officials told us that bad actors may take advantage of a disaster or emergency to conduct cyber attacks on information and communications systems in that geographic area. In its planning, DOD has recognized that this is an area that needs to be addressed. Specifically, a planning document that the ODASD for Cyber Policy, the National Guard Bureau, U.S. Northern Command, and U.S. Cyber Command developed to implement the DOD Cyber Strategy states that the department should conduct an exercise that will incorporate cybersecurity as part of broader exercise scenarios.[42] DOD officials acknowledged that DOD exercises to date, such as the Cyber Guard exercises, have not been ideal for a nationwide exercise that addresses multiple complexities of cyber incidents and physical consequences.
  In addition to these challenges, we also observed that DOD has not addressed its goals by conducting a tier 1 exercise involving various partners in highly complex environments. Specifically, while DOD conducted 7 exercises that evaluated in some part civil support for a cyber incident, these exercises varied from tabletop exercises to other exercises that do not meet Joint Staff’s’ tier 1 exercise criteria.[43] DOD’s Cyber Strategy exercise planning document states that DOD needs to conduct a tier 1 exercise to achieve the DOD Cyber Strategy goal of exercising its DSCA capabilities in support of DHS and other agencies, including state and local authorities, to help defend the federal government and the private sector, if directed, in an emergency. Similarly, U.S. Northern Command and ODASD for Cyber Policy officials told us that the department needs to conduct a tier 1 exercise to explore a disaster with physical and cyber effects. DOD’s Cyber Strategy planning document states and officials agree that the department needs to conduct such an exercise to prepare its forces to support civil authorities during or after a cyber incident. However, DOD has not conducted a tier 1 exercise that would prepare DOD forces and enable the department to achieve one of the goals in the DOD Cyber Strategy because the department has not identified an exercise to do so. According to U.S. Northern Command officials, the command wanted to incorporate a cyber civil-support scenario in its 2016 Ardent Sentry exercise, which is a tier 1 exercise.[44] However, the command cancelled its plans after U.S. Cyber Command—a DOD component that would potentially provide critical capabilities in supporting civil authorities—stated that the command had to focus its exercise resources on the Cyber Guard exercise to certify DOD’s cyber protection teams. Until DOD identifies and conducts a tier 1 exercise, DOD will miss an opportunity to fully test response plans, evaluate response capabilities, assess the clarity of established roles and responsibilities, and improve proficiency in supporting DHS, other federal agencies, and state and local authorities, if directed, in an emergency. In addition, identifying and conducting a tier 1 exercise would provide DOD an opportunity to address the challenges the department has experienced in previous exercises. For example, the tier 1 exercise could be conducted in part on an open network, include additional federal agencies and other critical infrastructure owners that would be involved in a response, and incorporate scenarios where both cyber threats and physical effects were involved.