A Cryptologic Network Warfare Specialist performs initial cryptologic digital analysis to establish target identification and operational patterns. (Army)
- Filed Under
The Army is looking for a few good cyber warriors — smart soldiers to work behind the scenes protecting the service's networks and strike back when called upon.
The service is ramping up its first cyber brigade, the 780th Military Intelligence Brigade, and filling the ranks of its cryptologic network warfare specialists in military occupational specialty 35Q.
"There are things that don't make headlines that we're doing on our networks all the time, and we're getting away from just being reactive. We're being proactive," said Sgt. 1st Class Dan Gutierrez, the cryptologic network warfare senior enlisted adviser with the Office of the Chief of Military Intelligence at Fort Huachuca, Ariz. "Bottom line, these soldiers are going to be very busy."
The Army has 500 to 600 slots for 35Qs, an evolving career track open to soldiers in E-3 to E-7 with high aptitude test scores. Qualified soldiers can receive roughly two years of cyberwarfare training. They may be eligible for thousands of dollars in retention bonuses for ranks of private through sergeant.
Lt. Col. Kurt Connell, Human Resources Command's enlisted branch chief for military intelligence, said he expects there to be more authorizations as the Army creates a career path for senior noncommissioned officers.
"This doesn't represent a growth in force structure, but certainly this is an MOS that's growing, and if you're in an MOS that's shrinking, this is an opportunity to come into one with a bright future," Connell said.
The Army has begun to reclassify as 35Qs soldiers with related training and who perform similar work. Reclassifying soldiers make up 20 percent of the latest class of 35Qs; the rest are new recruits.
Cryptologic network warfare specialists fill a range of work roles, some too sensitive for Army officials to discuss publicly — particularly the offensive ones.
The 35Qs might be called upon to find and identify intrusions and malware on unclassified and classified networks. They would also "deny adversaries" access and "take the fight to them, to their spaces," Connell said.
A countercyber support analyst, for example, would probe the Army's networks for malware or signs of a breach, discern how widespread the breach is and attempt to mitigate the effects — cleaning up and hardening the network against a future attack.
Other analysts and operators might retrace the malware's path to where it originated or work to ensure that soldiers can access their networks in spite of the malware.
Many — though not all — of these 35Qs are slated to serve in the 780th MI Brigade. The unit operates outside of the Army's firewalls, finding and defining cyber threats, including rogue-state- and nonstate-affiliated hackers, and shadowy criminal enterprises — all in defense of military networks.
Col. Jennifer Buckner, the commander of 780th, called it the "BCT of cyber." She said its troops "need to respond proactively to eliminate threats," consciously echoing public statements by Lt. Gen. Mary Legere, the Army's deputy chief of staff for intelligence.
The 35Qs are meant to have a skill set that is primarily for defense but can be used to prevent a looming cyber attack, too.
"When we train an infantryman, we don't just train him in the defense. He learns a set of skills that can be applied to a problem set depending upon the mission, the situation and the threat," Buckner said. "Our 35Qs offer us that capability, as well. They have skill sets that can, when there's a need, enable them to act proactively."
Assigned to Intelligence and Security Command, the brigade is under the operational control of Army Cyber Command, which is subordinate to U.S. Cyber Command. Army Cyber Command vets taskings from combatant commands for the brigade.
"Threats are increasing, activity against our network is increasing, so it follows that our force would be engaged on a regular basis," Buckner said. "Our Army force works with our joint cyber partners, too, and we are part of this larger cyber force working against these national-level threats."
The brigade's structure calls for 1,023 people, of which more than 500 are meant to be 35Qs, Buckner said. The goal is to reach its approved end strength in fiscal 2014 or 2015. Today, the brigade stands at roughly 600 soldiers.
Although 35Q is the core specialty and competency of the brigade, many of the soldiers work in purpose-built teams with signals intelligence specialists, whom Buckner called "equally critical and interdependent."
The brigade consists of the 781st Military Intelligence Battalion, the 780th's operational battalion, which is based at Fort Meade, Md. The 782nd Battalion, which is based at Fort Gordon, Ga., and works with the 706th MI Group, has about 40 of its planned 300 people.
Other detachments in the works for Texas and Hawaii would be connected to the 470th and 500th military intelligence brigades, respectively.
Bonuses and training
The Army is offering retention bonuses of between $3,200 and $13,100 to soldiers ranging from private to sergeant, according to an Army Times analysis. Army officials would not confirm the figures, however, saying the new career field's retention strategy is still evolving.
Gutierrez said he doesn't expect to have trouble recruiting or retaining soldiers into the field.
"It's a pretty exciting field. It's something the younger recruits are familiar with — they've lived in the digital age their entire lives," Gutierrez said.
Soldiers in the 35N, 35S and 35T MOSs were performing portions of what is now the 35Q mission set, and they received additional skill identifiers related to their individual schooling levels. Those soldiers were reclassified as 35Qs in September and October.
The new 35Q MOS gives the Army a way to track these soldiers and provide a uniform level of training.
In October, the Army began its first accessions class. New soldiers enlisted to become 35Qs in June.
The Army is making a "significant investment" in these new cyber soldiers, providing roughly two years of training, Connell said. Follow-on developmental assignments could take longer.
That training begins with the six-month Joint Cyber Analysis Course in Pensacola, Fla., a broad course that covers the gamut of computer network operations.
Soldiers in the top 10 percent of their classes are meant to go on the advanced six-month Remote Interactive On-Net Training course and work in some of the most difficult roles, which will require additional training both on and off the job, Buckner said.
Buckner said the 35Q career field is attractive because of the individualized training within the 780th, whether the soldier has an interest in forensic analysis, malware or otherwise.
"You can't approach the growth of 35Qs as everyone is the same," Buckner said. "You have to enable individual potential and tailor training to a soldier's specific education, and also what they're good at and what they want to do."