Ch. 2 Cyber Ops and EW Fundamentals

Cyberspace Operations and Electromagnetic Warfare Fundamentals

• This chapter outlines types of cyberspace operations and electromagnetic warfare including common effects achievable through them.
• It also addresses the link between them and other Army operations, including Soldier training for relevant missions.

Cyberspace Operations

• Synchronizing cyberspace operations and EW with other Army capabilities, using a combined arms approach, benefits objectives against enemy forces.
• These operations provide commanders with advantageous positions in multi-domain fights.
• Effects from cyberspace can extend into the physical domain and be used against adversaries.
• A cyberspace capability incorporates devices or computer programs (software, firmware, hardware) to create effects within cyberspace.
• Law enforcement and counterintelligence may impact cyberspace by disrupting/degrading enemy activities.
• Electromagnetic spectrum superiority allows operations without interference while affecting the threat's capabilities.
• EW capabilities involve systems and weapons for lethal and non-lethal effects in the EMS, aiding commanders in gaining EMS superiority during Army operations.

Russia's Application of Cyberspace Operations and Electronic Warfare during the Russo-Ukrainian War

• In 2013, Ukraine favored closer ties with Russia's Eurasian Economic Union instead of the European Union, leading to protests.
• Russia, competing with the U.S. and China, aimed to expand commerce and access Black Sea ports.
• Vladimir Putin and Russia saw Ukraine's chaos as an opportunity to seize Crimea for Mediterranean trade access and challenge U.S. military power, hindering NATO expansion.
• Ukraine's reliance on Russian C4ISR made them vulnerable to Russian exploitation via thematic denial and deception.
• Hybrid campaigns mixing regular and irregular actions targeted Ukraine's C4ISR and telecommunications with Russian infiltration.
• Ukraine's communication device use aided Russia's targeting.
• Russia injected chaos via cyberspace operations/EW (denial of service, social media manipulation) on C4ISR nodes, proving lethal at a tactical level.
• The Ukrainian Army moved mechanized brigades to counter equipment shipments to Eastern Ukraine rebels.
• On July 11, 2014, a Ukrainian brigade was hit by a 9A52-4 Tornado multiple rocket system after spotting a drone.
• Rockets with high explosive, cluster, and thermobaric munitions rained down, followed by artillery, killing 37 and wounding 100 Ukrainian soldiers.
• The Russian Army's intelligence and geo-location, combined with targeting Ukrainian communication nodes, enabled the destruction of a Ukrainian combat arms brigade.
• Russia created chaos in Ukraine’s civil/military leadership, limiting Western leaders’ response.
• Their cyberspace/EW capabilities enabled the seizure of Crimea and strategic access to Black Sea ports.

Joint Force and Army

• The joint force and the Army divide cyberspace operations into three categories based on where they occur and the type of forces involved.
• Each category has different authorities, approval levels, and coordination needs.
• The three types of cyberspace operations include:
  • DODIN operations
  • DCO
  • OCO
• The Army uses signal forces for DODIN operations on its and DOD networks/systems.
• Cyberspace forces conduct DCO, which includes DCO-IDM and DCO-RA.
• DCO-IDM defends DODIN or authorized friendly networks from imminent attacks.
• DCO-RA acts against threat actors in neutral/adversary networks, needing more authorities and coordination.
• Cyberspace forces deliberately target threat capabilities in neutral, adversary, and enemy-held cyberspace via OCO.
• Cyberspace forces include joint forces from the DOD cyber mission forces or Army-retained forces.

Department of Defense Information Network Operations

• The DOD information network is a set of information capabilities and processes for managing information to warfighters, policymakers, and support personnel.
• Also called DODIN, includes communications/computing systems, software, data, security, and national security systems.
• DODIN operations secure, configure, operate, extend, maintain, and sustain DOD cyberspace to ensure confidentiality, availability, and integrity.
• DODIN operations provide authorized users secure, reliable network access.
• Signal forces install networks, maintain security, and conduct testing.
• Signal forces performing DODIN operations may conduct limited DCO-IDM.
• Standing orders for DODIN operations and DCO-IDM cover cyberspace security/defense tasks.
• The Army secures DODIN-A using layered defense, using multiple physical, policy, and technical controls to guard against threats.
• Layering integrates people, technology, and operations to establish security barriers across layers.
• Security barriers include antivirus software, firewalls, data encryption, physical/technical measures, continuous training, and network monitoring.
• Security barriers are protective measures against acts that may impair the network, and therefore the mission command system.
• Layering includes perimeter, enclave, host, physical, and personnel security, along with cybersecurity policies and standards. It protects the cyberspace domain at physical, logical, and administrative levels.

Defensive Cyberspace Operations

• These preserve the ability to utilize blue cyberspace capabilities and protect data, networks, devices by defeating malicious activities.
• Blue cyberspace is protected by the U.S., mission partners, and other designated areas.
• DCO is categorized by action location:
  • DCO-IDM
  • DCO-RA

Defensive Cyberspace Operations-Internal Defensive Measures

• These operations involve authorized defense actions within the defended portion of cyberspace (JP 3-12).
• DCO-IDM is conducted within friendly cyberspace to locate and eliminate cyber threats within friendly networks.
• Cyberspace forces neutralize/eliminate threats and restore compromised DODIN portions.
• Cyberspace forces conducting DCO-IDM primarily conduct cyberspace defense tasks, but may also perform some tasks similar to cyberspace security.
• Cyberspace defense includes actions to defeat specific threats that have breached or are threatening to breach cyberspace security measures.
• Actions include to detect, characterize, counter, and mitigate threats.
• Cyberspace forces act on cybersecurity or intelligence alerts within friendly networks. DCO-IDM includes hunting threats, deploying countermeasures, and responding to/mitigating effects.

Defensive Cyberspace Operations-Response Actions

• These are operations that are part of a defensive cyberspace operations mission that are taken external to the defended network, and require permission of the owner of the affected system.
• DCO-RA takes place outside the boundary of the DODIN.
• Some DCO-RA may involve actions that rise to the level of use of force and may include physical damage or destruction of enemy systems.
• DCO-RA consist of conducting cyberspace attacks and cyberspace exploitation similar to OCO.
• However, DCO-RA use these actions for defensive purposes only, unlike OCO that is used to project power in and through cyberspace.
• DCO-RA decisions depend heavily on the broader strategic and operational contexts such as the existence or imminence of open hostilities, the degree of certainty in attribution of the threat; the damage the threat has or is expected to cause, and national policy considerations
• DCO-RA are conducted by national mission team(s) and require a properly coordinated military order, coordination with interagency and unified action partners, and careful consideration of scope, rules of engagement, and operational objectives.

Offensive Cyberspace Operations

• These are missions intended to project power in and through cyberspace.
• Cyberspace forces conduct OCO outside of DOD networks to gain advantages via cyberspace exploitation/attack in support of commanders' objectives.
• Commanders integrate OCO within the combined arms scheme of maneuver to achieve optimal effects.
• The Army provides trained cyberspace forces to perform OCO to the joint force, under a joint force commander's authority.
• Targets may need extended planning/approval, synchronization, and deconfliction with external partners.

Cyberspace Actions

• These operations entail specific tasks referred to as cyberspace actions, and the employment of one or more cyberspace capabilities.
• The four cyberspace actions are:
  • Cyberspace security
  • Cyberspace defense
  • Cyberspace exploitation
  • Cyberspace attack

Cyberspace Security

• These are actions taken within protected cyberspace to prevent unauthorized access to, exploitation of, or damage to computers, electronic communications systems, and other information technology.
• Measures include protecting DODIN information, ensuring availability, integrity, authentication, confidentiality, and nonrepudiation.
• Cyberspace security is generally preventative and continues throughout DCO-IDM and responding to cyber threats.
• This involves:
  • Password management
  • Software patching
  • Encryption of storage devices
  • Cybersecurity training for all users
  • Restricting access to suspicious websites
  • Implementing procedures for managing DODIN operations

Cyberspace Exploitation

• These actions are taken in cyberspace to gain intelligence, maneuver, collect information, or perform other actions required to prepare for future military operations.
• Must be authorized, and a part of OCO or DCO-RA actions in gray or red cyberspace that does not create cyberspace attack effects.
• Cyberspace exploitation includes supporting operational preparation by gaining/maintaining access to military networks/systems, maneuvering within cyberspace, and positioning capabilities.
• Actions are deconflicted with other U.S. Government departments and agencies.

Cyberspace Attack

• These actions are taken in cyberspace that create noticeable denial effects in cyberspace or manipulation that leads to denial effects in the physical domains.
• Modification/destruction of cyberspace capabilities controlling physical processes affects the physical domains.
• Effects include:
  • Deny: Prevents access to, operation of, or availability of a target function
  • Degrade: Denies access to, or operation of, a target to a level represented as a percentage of capacity
  • Disrupt: Temporarily denies access to, or operation of, a target
  • Destroy: Completely and irreparably denies access to, or operation of, a target.
  • Manipulate: Controls or changes information in cyberspace to create physical denial effects using techniques lie deception

Electromagnetic Warfare

• Modern militaries rely on communications equipment using broad portions of the EMS to conduct military operations allowing forces to talk, transmit data, and provide navigation and timing information, and command and control troops worldwide.
• They also rely on the EMS for sensing and awareness of the OE.
• The Army conducts EW to gain and maintain positions of relative advantage within the EMS.
• The Army's contribution to electromagnetic spectrum operations is accomplished by integrating and synchronizing EW and spectrum management operations.
• EW refers to military actions involving the use of electromagnetic and directed energy to control the EMS or to attack the enemy.
• EW consists of three distinct divisions:
  • EA
  • EP
  • ES
• These divisions often mutually support each other in operations.
• Radar-jamming EA can provide protection to penetrate defended airspace and also prevent an adversary from having a complete operating picture.

Electromagnetic Attack

• Army forces conduct offensive and defensive EA to fulfill the commander's objectives in support of the mission.
• EA projects power in and through the EMS by implementing active and passive actions to deny enemy capabilities and equipment, or by employing passive systems to protect friendly capabilities.
• EA requires systems/weapons that radiate electromagnetic energy as active measures and systems that do not radiate or re-radiate electromagnetic energy as passive measures.
• Offensive EA prevents or reduces an enemy's effective use of the EMS by employing jamming and directed energy weapon systems against enemy spectrum-dependent systems and devices. Offensive EA systems and capabilities include:
  • Jammers
  • Directed energy weaponry
  • Self-propelled decoys
  • Electromagnetic deception
  • Antiradiation missiles
• Defensive EA protects against lethal attacks by denying enemy use of the EMS to target, guide, and trigger weapons that negatively impact friendly systems.
• Defensive EA supports force protection, self- protection and OPSEC efforts by degrading, neutralizing, or destroying an enemy's surveillance capabilities against protected units.
• Defensive EA systems and capabilities include:
  • Expendables (flares/decoys)
  • Jammers
  • Towed decoys
  • Directed energy infrared countermeasure systems
  • RCIED systems
  • C-UAS
• Available EA effects include:
  • Destroy : eliminate targeted enemy personnel, facilities, or equipment
  • Degrade : reduces the effectiveness or efficiency of an enemy EMS-dependent system
  • Disrupt : temporarily interrupts the operation of an enemy EMS-dependent system
  • Deceive : misleading information designed to induce them to react in a manner prejudicial to their interests

Electromagnetic Attack Tasks

• EA has the unique potential to affect enemy use of the EMS and attack the enemy through the EMS.
• Concurrently, EA's potential to cause EMS fratricide necessitates caution and coordination in its employment.
• EA tasks include:
  • Employing directed energy weaponry
  • Electromagnetic pulse
  • Reactive countermeasures
  • Deception measures
  • Electromagnetic intrusion

Directed Energy

• It an umbrella term covering technologies that relate to the production of a beam of concentrated electromagnetic energy or atomic or subatomic particles.
• Directed energy becomes a directed energy weapon when used to conduct EA. EA involving the use of directed-energy weapons is called directed-energy warfare.
• The purpose is to disable, cause direct damage, or destroy enemy equipment/personnel.

Electromagnetic Pulse

• There is a strong burst of electromagnetic radiation caused by a nuclear explosion, energy weapon, or by natural phenomenon, that may couple with electrical or electronic systems to produce damaging current and voltage surges
• The effects can extend hundreds of kilometers depending on height and power output.
• The most affected portion of EMS is the radio spectrum.
• An indirect impact includes electrical fires caused by the overheating of systems/components.

Reactive Countermeasures

• EA includes these as a response to an enemy attack in the EMS.
• Response to enemy attack may include employing radio frequency countermeasures in disrupting enemy systems and weapons.
• Reactive countermeasures may provoke the employment of directed energy weaponry or electromagnetic pulse and can include the use of lethal fires.
• Army forces can disrupt enemy guided weapons and sensor systems by deploying passive and active electro-optical-infrared countermeasures.

Deception Measures

• Designed to mislead the enemy by manipulation, distortion, or falsification of evidence to induce them to react in a manner prejudicial to their interests.
• EW supports all deceptions plans, both Joint military deception and tactical deception, using electromagnetic deception measures and scaling appropriately for the desired effect.

Electromagnetic Intrusion

• It is the intentional insertion of electromagnetic energy into transmission paths in any manner, with the objective of deceiving operators or of causing confusion.
• Can also create deception or confusion in a threat aircraft's intelligent flight control system.

Electromagnetic Jamming

• This is the deliberate radiation, reradiation, or reflection of electromagnetic energy for the purpose of preventing or reducing an enemy's effective use of the electromagnetic spectrum.
• It can also prevent or reduce the effectiveness of an enemy's integrated air defense system
• Targets include radios, navigational systems, radars, and satellites.

Electromagnetic Probing

• Defined as the intentional radiation designed to be introduced into the devices or systems of an adversary for the purpose of learning the functions and operational capabilities of the devices or systems.
• May provide information about threat capabilities and their ability to affect or detect friendly operations.
• Army forces may conduct overt electromagnetic probing to elicit a response from an enemy, exposing their location.

Meaconing

• Consists of receiving radio beacon signals and rebroadcasting them on the same frequency to confuse navigation.

Electromagnetic Protection

• Involves actions taken to protect personnel, facilities, and equipment from any effects of friendly, neutral, or enemy use of the electromagnetic spectrum that degrade, neutralize, or destroy friendly combat capability (JP 3-85).
• EP measures eliminate or mitigate the negative impact resulting from friendly, neutral, enemy, or naturally occurring EMI.
• Both EP and defensive EA can have protective effects. However, EP focuses explicitly on protecting friendly EMS-dependent capabilities.

Tasks of Electromagnetic Protection

• EP tasks are to increase survivability and decrease any diminishment effect, includes:
  • Electromagnetic environmental effects deconfliction
  • Compatibility
  • Hardening
  • Emission Control
  • Masking
  • Preemptive countermeasures
  • Security
  • Wartime reserve modes

Electromagnetic Environmental Effects Deconfliction

• Electromagnetic vulnerability has characteristics of a system that cause it to suffer a definite degradation as a result of having been subjected to a certain level of electromagnetic environmental effects.
• Any system operating in the EMS is susceptible to electromagnetic environmental effects.

Electromagnetic Compatibility

• Includes having the ability of systems and equipment that use the electromagnetic spectrum to used as intended without issues
• The CEMA spectrum manager assists the G-6 or S-6 spectrum manager with implementing electromagnetic compatibility to mitigate electromagnetic vulnerabilities by applying sound spectrum planning, coordination, and management of the EMS.

Electromagnetic Hardening

• Defined as actions to protect personnel, facilities, and/or equipment by blanking, filtering, attenuating, grounding, bonding, and/or shielding against undesirable effects of electromagnetic energy.
• Electromagnetic hardening can protect friendly spectrum-dependent devices from the impact of EMI or threat EA such as lasers, high-powered microwave, or electromagnetic pulse

Emission Control

• Emission control is the selective and controlled use of electromagnetic, acoustic, or other emitters to optimize command and control capabilities while minimizing detection by enemy sensors, mutual interference among friendly systems, and/or enemy interference with the ability to execute a military deception plan
• Emission control enables OPSEC by:
  • Decreasing detection probability and countering detection range by enemy sensors
  • identifying and mitigating EMI among friendly spectrum-dependent devices
  • identifying enemy EMI that allows execution of military deception planning.

Electromagnetic Masking

• Defined as controlled radiation of electromagnetic energy on friendly frequencies in a manner to protect the emissions of friendly communications and electronic systems against enemy electromagnetic support measures/signals intelligence without significantly degrading the operation of friendly systems.
• Electromagnetic masking is an essential component of military deception, OPSEC, and signals security.

Preemptive Countermeasures

• Defined as that form of military science that, by the employment of devices and/or techniques, has as its objective the impairment of the operational effectiveness of enemy activity.
• Can be passive/active and deployed preemptively or reactively.

Electromagnetic Security

• Defined as protection resulting from all measures designed to deny unauthorized persons information of value that might be derived from their interception and study of noncommunications electromagnetic radiation

Wartime Reserve Modes

• Those are the characteristics and operating procedures of sensor, communications, navigation aids, threat recognition, weapons, and countermeasure systems that will contribute to military effectiveness if unknown to or misunderstood by opposing commanders before they are used, but could be exploited or neutralized if known in advance.
• Wartime reserve modes are held deliberately in reserve for wartime or emergency use.

Electromagnetic Support

• Division of electromagnetic warfare involving actions tasked by an commander to search for sources of intentional and unintentional energy of a potential threat.
• In multi-domain operations, commanders work to dominate the EMS and shape the operational environment
• Simultaneously, they also work to protect and enable U.S. and Allied forces' freedom of action in and through the EMS.
• The purpose is to acquire adversary combat information in support of a commander's maneuver plan.
• Data is used for planning or conducting combat operations that is acquired under Command authority Signals intelligence personnel performing under Director, National Security Agency are the only ones who can make decrypting communications

Tasks of Electromagnetic Support

• ES tasks include:
  • Reconnaissance
  • Threat Warning
  • Direction finding

Electromagnetic Reconnaissance

• Defined as detection, location, identification, and evaluation of foreign electromagnetic radiations
• Used to support information collection and information used may lead to an attack.
• Information from reconnaissance, in conjunction with intelligence, is used for precision geolocation

Threat Warning

• Enables commander to quickly identify threats to forces and countermeasures. Coordinates with G-2 or S-2 on the long-term impact of detected enemy emitters.
• Assists the commander's decision making process

Direction Finding

• The direction of bearings occurs through various ES tactics as described in JP 3-85.
• ES platforms are deployed in various formations to create a baseline and increase the area of coverage.

Electromagnetic Support and Signals Intelligence

• These often share the same assets and personnel and should be required to collect both the data they're looking for.
• They are very similar however differs by whoever has operational asset control, capabilities, and why they are needed.
• Information collected becomes signals intelligence when cryptologic are applied to a signal to determine its relevance or value for intelligence.

Electromagnetic Warfare Reprogramming

• Defined as the deliberate alteration or modification of electromagnetic warfare or target sensing systems, or the tactics and procedures that employ them, in response to validated changes in equipment, tactics, or the electromagnetic environment.
• Supports maintaining the effectiveness of systems. Includes software equipment such as self-defense systems, and the three EW divisions; EA, EP, and ES

This lesson explores the different effects of cyberspace attacks, including destroy, disrupt, manipulate, and deceive. It emphasizes the importance of coordination and planning to achieve desired outcomes in cyberspace operations.