Sergeant Silicon: Lessons From An Army Cyber NCO

WASHINGTON: “I have not come across a single country down there that has said that they would rather work with China,” the Army’s most senior sergeant in Latin America told me.

After helping stand up the Army’s first offensive cyber battalion – more on that below – and its cyber center at Fort Gordon, William Rinehart was tapped two years ago to be Command Sergeant Major for US Army South because, as he put it, militaries around the region were “screaming” for help on cybersecurity. At last year’s Panamax wargames, for example – the first time the international exercise included a cyber element – Rinehart asked a tent full of Latin American officers if any of them had not been hacked by the Chinese.

Not a single hand went up, he said.

Had anyone not had Russian infiltration in their networks?

Again, no one raised their hand.

“Chile, they were the first country that I remember saying, ‘hey, we really want some help with cyber,’” Rinehart recalled. “Countries like Colombia, Brazil, Peru, they started talking about, ‘hey, we want to do cyber stuff. We need help. We want the US to be our partner of choice. We’re getting a lot of pressure from the Chinese and Russians.’”

Even as China and Russia slip into New World networks, they’re often offering to help those same countries with their technology – but these countries aren’t too comfortable with Old World authoritarians bearing gifts. All of them except Cuba, Nicaragua, and Venezuela are at least aspiring democracies, and for all their uneasy history with the United States, they at least have a history with us, as well as longstanding cultural and economic ties.

“Our Latin American partners, they want to work with folks that are more like them,” Rinehart said. “Now they do say that China is cheaper, but China probably comes up with some strings attached.”

But aren’t Latin American nations historically prickly about US intervention in their internal affairs, whether that’s politics or networks?

“We should work together on the things that we can work together on,” Rinehart replied. “I’m not asking anybody to give up any sovereignty and talk about secret stuff, but a lot of this training is unclassified.”

“The US Army Cyber Center of Excellence [at Fort Gordon] has cybersecurity classes that are available through the International Student Exchange Program,” Rinehart said. “IAAFA, the Inter-American Air Forces Academy in San Antonio, Texas has cybersecurity courseware in Spanish that’s available to our partners. West Point has the Army Cyber Institute — a completely unclassified environment.”

That night during Panamax, Rinehart recalled, “I pointed out these things and said, ‘We can work together on building defendable infrastructure, cyber security, without really talking about those things that our countries hold close to our hearts and don’t talk about in public.”

The Army Cyber NCO Corps

The irony of Rinehart advising allied officers is that, although his 30 years in uniform often make him the most experienced person in the room, he’s also often technically the lowest-ranking. That’s because he’s an enlisted man, a non-commissioned officer.

“You want to find out who’s doing some work on keyboard in the cyber realm, you want to a find out who’s walking through the woods on the ground, it’s the NCOs and their soldiers,” Rinehart said.

Unlike most militaries, including in Latin America, the US has not only a strong NCO corps, advising leadership at every level, but a lot of technically expert NCOs as well. Sergeant Rock is giving way to Sergeant Silicon.

“The NCO of today certainly is not the NCO of the ’40s, ’50s, ’60s, ’70s,” Rinehart told me. “Just in the last two, three years, we rebuilt, revamped, and redesigned NCO education. It’s completely different than what it used to be – all the way up to the Sergeants Major Academy which is now a degree-granting institution.”

As of this June, the academy is officially accredited to grant bachelor’s degrees, but many NCOs have master’s degrees and more. The level of education is particularly high in the cyber field. Rinehart knows one female NCO with three PhDs: two she’s earned in uniform, one from before she enlisted.

“She’s not of these multiple-PhD people that you can’t talk to,” Rinehart reassured me. “You would never know unless she told you.”

Now, that’s not a typical soldier. “She came into the Army a little later than most; she wasn’t an 18-year-old private,” Rinehart acknowledged. But when it comes to highly educated cyber NCOs, he said, “she’s just one of many.”

In his time in the cyber branch, “I have come across some of the most intelligent people that I will probably ever meet for the rest of my life,” Rinehart told me. “I think the biggest lesson I learned in that journey was, it’s about the people. It’s 100 percent about the people.”

Hacking The System

Rinehart played a leading role in standing up both the Army’s offensive cyber warfare unit, the 781^st Military Intelligence Battalion at Fort Meade and its cyber branch, headquartered at Fort Gordon.

“We were standing up a detachment in Texas; we stood up a detachment in Hawaii; and then we stood up the schoolhouse down in Georgia,” Rinehart recalled, “and, in doing so, some business processes the Army has used for decades just weren’t flexible enough or fast enough.”

At one point, he said, personnel management bureaucrats told him it was impossible to transfer expert cyber soldiers from their current assignments to the new units in less than 90 days, the standard timeframe for what the military calls a PCS (Permanent Change of Station). So Rinehart got on the phone with generals – one of the unusual things about senior US NCOs is their close working and personal relationships with officers at the very highest ranks – and found a workaround.

While no one could order the cyber soldiers to show up at their new jobs in less than 90 days, they could permit them to show up earlier. So Rinehart and his colleagues found volunteers who’d report to duty in 30 days, the fastest timeframe allowed. “I couldn’t make them move,” he told me, “but I did not have a shortage of folks that were willing to be a part of standing up these detachments.”

Once Rinehart & co. had gotten these highly talented NCOs in place, the next challenge was to keep them. “Retention was a tough one because we spent a lot of time training folks, and then we spent time losing folks to industry,” he said. “We were able to institute special duty pays and assigned incentive pays, and we increased the initial required enlistments for those soldiers from four years to six years, so we get more out of the dollar spent on the training. Those [measures] are still in place today.”

Likewise, Rinehart said, some of the shortcuts used to equip the cyber units with cutting-edge computers and software – without having to wait for the ponderous procurement system – are now commonplace in Army acquisition.

There’s much more work ahead as the Army works to integrate cyber, electronic warfare, and information operations and allocate skilled soldiers at every level of organization. “One of the things that we’ve got to look at where we’re going to place our cyber personnel within our different echelons, whether it’s a corps, division, or the brigades,” he said. “We’re building out these tactical level formations for Multi-Domain Battle,” the Army’s rapidly evolving concept for future combat.

And, Rinehart said, as with the 781^st MI Battalion, standing up new units is only the beginning: The training and updating goes on forever. “This thing called the internet, it’s a manmade domain that changes every day, every minute,” he said. “They’re never done with their training, because it’ll continue to change.”
“We’ve got to continue refining and not think that we’re ever done,” Rinehart told me. “ If we ever think that we’re done, then we’re probably about to fail.”