Think tank outlines framework for a would-be Cyber Force

Staff Sgt. Wendell Myler, a cyber warfare operations journeyman assigned to the 175th Cyberspace Operations Group of the Maryland Air National Guard monitors live cyber attacks on the operations floor of the 27th Cyberspace Squadron. (U.S. Air Force photo by J.M. Eddins Jr.)

WASHINGTON — Should President Donald Trump decide to establish a Cyber Force, a new think tank report offers an implementation framework for actually getting the wheels turning on what would be a new, highly specialized service branch.

“There’s a chance that President Trump makes the decision in six to 12 weeks. If that’s the case, someone needs to have done a blueprint,” Mark Montgomery, senior director of the Center on Cyber and Technology Innovation at The Foundation for Defense of Democracies, who also served as executive director of the Cyberspace Solarium Commission, told reporters Tuesday ahead of the blueprint’s launch.

In the event that decision is made, “we don’t want to be scrambling to build the aircraft as we’re flying it, but to have some sort of ideas thought out in advance to guide the implementation,” said Montgomery’s co-author, Erica Lonergan, adjunct fellow at FDD’s Center on Cyber and Technology Innovation and assistant professor of International and Public Affairs at Columbia University.

“There are a lot of additional decisions that will need to be made if a service is created, but our hope is that this product can provide the blueprint to help guide whatever team is responsible for ultimately making those tough decisions,” she said.

The White House has not said it will push for the creation of an independent Cyber Force, but the move has long been debated, and experts previously told Breaking Defense it’s a fair bet given that Trump created the Space Force during his first term. Not everyone is convinced a new force is necessary. Today Sen. Angus King, who sits on the Senate Armed Services Committee and served as co-chair of the Cyberspace Solarium Commission, told a Politico panel he thought the US just needed to better use the “tools” it already has.

But in case it comes to pass, last year FDD laid out its broad vision for the need of a Cyber Force, which it said could be organized under the Army in the same way Space Force lives within the Department of the Air Force. But this new framework, published today, dives into the details for how such a force could work, including suggesting that the service’s military billets could be all-officer, and it should follow the National Security Agency’s lead in incorporating a larger number of civilians.

And, crucially, the new force would have to be flexible.

Creating A Cyber Force

The cyber mission force, the 147 teams each service provides to CYBERCOM, has faced readiness shortfalls and issues for years, which Congress has sought to in fits and starts study and address. The fiscal 2025 National Defense Authorization Act mandated a study for alternate organizational models for military cyber elements, to include a Cyber Force, which was considered a watered-down version from previous drafts.

First and foremost, the report’s authors articulate that the new service would not take on CYBERCOM’s responsibilities of what the authors call force employment, or the actual conducting of operations. As it currently stands, each of the armed services are responsible for providing a set number of cyber mission force teams to CYBERCOM, known as force generation, which employs those forces in operations.

More broadly within the military, the services are responsible for providing the right number of trained personnel with weapons — known as “man, train and equip” — to the combatant commands that conduct the warfighting. A Cyber Force would do the same for CYBERCOM, the report says.

The Cyber Force, for example, would not itself wade into information operations, DoD Information Network operations or cyber-related emerging technology such as AI and quantum, the framework says.

The FDD authors’ argument is every domain has a service and each of those services have a specific and unique culture, and that for CYBERCOM to be more effective, there should be a Cyber Force to support it.

As for slotting the Cyber Force under the Army, the main reason for this arrangement is overhead costs associated with a standalone department — which requires its own secretary along with a chief of staff — will be too great in the short- to medium-term.

But Lonergan noted there would be specific and unique challenges associated with creating a Cyber Force.

For example, Space Force largely pulled personnel from the Air Force’s space responsibilities, while each service currently contributes to the cyber mission force. A new Cyber Force would have to coordinate across all those services.

The authors also note in their report initial billets would be on a volunteer basis from each of the services.

Additionally is the issue of culture. Cyber is unique in its mission set and personnel. Outside experts have long advocated for a different set of rules for attracting and maintaining the best cyber operators from some of the other military requirements.

“Another reason why it’s important to think about this carefully is because the cyber domain presents really these unique challenges around who are the right personnel that we need for warfighting in the cyber domain? They probably look a little bit different from what you might need to excel at warfighting on the land, the maritime domain,” Lonergan said. “How do you structure service that has a culture and that has a force structure and that’s defined a career progression model that’s matched to maximizing our effectiveness in cyber conflict, which will look different from all the other services?”

That’s one impetus behind the idea of an all-officer force, which, the report argues, would help address problems related to competitive pay and ensure higher educational baseline of the force. The authors also offered a model that had more civilians in its ranks similar to the NSA model.

The report offers a slightly different force structure model that is more flexible to adapt to the dynamic cyber and technology environment than the rigid and static set of teams and personnel that currently exists.

“We really need to make sure that the force structure that we establish reflects the dynamic nature of the cyber domain. This is different from the current CMF force structure where you have a set number of personnel organized into a team structure,” she said. “Instead, we argue for some smaller, more specialized elements that can be combined and put together in various ways that match the requirements of the mission, the changing nature of the threat, the changing technological environment and so on.”

A proposed implementation plan outlines an initial phase to set the conditions for the first three months. It focuses on key leaders to help get the new service on the right footing. Phase one also include the initial force structure, personnel, basing location selection and key policy updates.

Phase two would take place over approximately two years and would see a progressive build with important decisions focusing on sequencing and phasing this build. The authors also envision a National Guard aspect to accompany a new Cyber Force, a key component to realizing larger, whole of nation capacity and expertise in time of crisis.

FDD’s report isn’t the only one expected from experts. In August, the Center for Security and International Studies created another commission to similarly develop a pathway rather than just studying the merits of a new service and the status quo. That commission officially launches next week and its work is expected to take several months.