The 2023 NDAA Emphasizes AI Investment for Cybersecurity, JADC2

The 2023 National Defense Authorization Act (NDAA) outlines the Pentagon’s spending priorities, including provisions to further develop artificial intelligence (AI) capabilities and digital twin technology, strengthen cybersecurity, identify costs associated with underperforming software, and provide funding for emerging technologies to further the department’s mission.

A major takeaway is the substantial increase in research and development (R&D) focused on artificial intelligence to support the Joint All-Domain Command-and-Control (JADC2) strategy and cybersecurity efforts across the department. Total R&D spending comes to $137 billion, a $20 billion increase from the 2022 NDAA.

The defense spending bill authorizes approximately $858 billion in spending, including roughly $817 billion for the Pentagon, $30.3 billion for programs within the Department of Energy (DOE), and $10.6 billion for “defense-related activities outside NDAA jurisdiction.”

Artificial Intelligence

The 2023 NDAA requires the secretary of defense, along with the director of national intelligence, to assist DOD’s new chief digital and artificial intelligence officer (CDAO) with implementing JADC2.

“The pace of innovation taking pace [with AI, RPA] — it’s not slowing down, it’s accelerating,” said Douglas Bush, assistant secretary for logistics and technology at the Army, during the National Defense Industry Association’s JADC2 Symposium in July. “How do we make sure JADC2 elements are continuously open to state-of-the-art technologies?”

The NDAA defines JADC2 interoperability concerns as a lack of interoperability between warfighting systems and other technology, which “could potentially be resolved” with the help of mission integration software and without upgrading current hardware or switching existing system software.

Mission integration software is “software that supports military operations by creating interoperability between systems, tools, and applications, intelligence fusion systems tasking systems, tactical data links, cyberspace and electronic warfare systems, communication systems, communications and command and control systems, common operating pictures, and commanders’ decision aids.”

Some of the CDAO’s duties will include researching mission integration software to increase interoperability between the warfighting systems, software, and data for JADC2.

“AI is at the center of the JADC2 framework,” Maj. Ryan Harth, AI Division Deputy Director in the Force Modernization Center at U.S. Army Special Operations Command (USASOC), told GovCIO Media & Research in an interview earlier this year. “The [USASOC] AI Division has a strong focus on architecting solutions that facilitate this versus prescribing one piece of software, this focuses on enabling organizationss within the USASOC to leverage the data.”

When standing up the office in June 2022, CDAO Craig Martell described improving user experience and data management as his two top priorities for the office to meet JADC2 demands.

“If this is about decision-making at speed, we ought to divide up our problem at speed,” said Marine Lt. Gen. Dennis Crall, who serves as director for Command, Control, Communications, and Computers / Cyber and CIO for the Joint Chiefs of Staff (J6), discussing how AI applications can harness data for decision-making much faster than a human. “If you have to make decisions in milliseconds, where is the data? We’ve always had the right data for the right solutions, we just don’t know how to harness it. We should have due diligence to make sure IT solutions have warfighter input. We need to make sure IT storage solutions make sense at the tactical edge and make sure policies don’t get in the way.”

Underperforming IT and Software

To combat IT bloat and streamline IT and software modernization efforts, the 2023 NDAA requires the secretary of defense to conduct an independent study on the costs and challenges associated with using underperforming or outdated software and IT and possible solutions.

The study will include a survey identifying the most pressing software and IT challenges that result in lost working hours, negative impact on mission, and contribute to the high turnover rate. It will also focus on the policies or technological challenges that limit each department’s ability to implement needed software or IT, as well as recommendations to address those challenges.

Digital Literacy Training

The Defense Acquisition University (DAU) is required to develop training to increase digital literacy among service members.

This curriculum would cover topics such as cybersecurity, IT systems, computer networks, cloud computing, AI, ML, distributed ledger technologies, quantum technologies, cyber threats and capabilities, operational efforts of USCYBERCOM to combat cyber threats; mission requirements, current capabilities and systems of USCYBERCOM, activities related to threat reduction, deterrence, resiliency and recovery policy, the industry best practices related to software acquisitions and cybersecurity software.

“We need a dedicated workforce strategy … looking not only at cyber, but broader STEM efforts, and what we’re doing across the enterprise era,” DOD CIO John Sherman said in September. “So, we have a strategy specifically on this as we look to diversify the workforce … this really is our generation space race.”

The increased focus on strengthening the digital and cybersecurity workforces continues garner more attention from defense and civilian federal CIOs as workforce shortages rise. Experts estimate there are more than half a million unfilled cybersecurity jobs, which poses a national security threat.

The Federal Cyber Workforce Management and Coordinating Working Group released a cyber workforce report detailing challenges and coordinated, interagency response in October to this end.

The bill requires the DAU president and the secretary of defense to submit an implementation plan no later than 180 days after the NDAA enactment and implement the project by one year after the plan is submitted.

Cybersecurity

The 2023 NDAA establishes a five-year implementation plan to adopt AI to the warfighting cyber missions within DOD and a strategy for converged cyber and electronic warfare to support combatant commanders. It also authorizes an increase of roughly $56 million for CYBERCOM Joint Cyber Warfighting Architecture.

“At maturity, it [AI] will impact vulnerability management, threat hunting and boost network security,” Department of the Navy CISO Tony Plater said during GovCIO Media & Research’s CyberScape: Data & Automation Security event in October. “It’s become trendier to use it to track transactions, logs, real-time data to detect threats. So AI is highly sought after to help us secure our cloud services.”

The 2022 NDAA gave CYBERCOM more budgetary control over investments at the joint force and military service levels, which allowed CYBERCOM to pivot and adjust funding and priorities as needed to address the onslaught of cyberattacks and cyber threats over the past few years.

In June, CYBERCOM Executive Director Dave Frederick said CYBERCOM’s innovation unit, DreamPort, is working closely with the CDAO, Defense Innovation Unit (DIU) and the Defense Advanced Research Projects Agency (DARPA) to expand AI for “a whole range of missions.”

To strengthen DOD’s cybersecurity posture, the 2023 NDAA authorizes an increase of $168 million for Cyber Mission Force operational support, a $20 million increase for the Defense Advanced Research Projects Agency’s (DARPA) cyber modeling and simulation activities, and a $20 million increase for an Academic Excellence cybersecurity workforce pilot program at the National Security Agency Center.

The 2023 NDAA also allows more capacity for foreign partnerships in cyber, including establishing a pilot program for the defense secretary to share cyber capabilities with international partners.

Emerging Tech

Another 2023 NDAA priority is accelerating the procurement of innovative technologies. The secretary of defense is required to provide a proposal selected for an award 30 days after receiving funding.

The NDAA requires each secretary of the military services to carry out a pilot program in no more than three new areas where digital twin technology can be used to improve the forces’ operations. The secretaries have 90 days after the NDAA is enacted to submit a digital twins technology implementation plan.

“The philosophy of [model-based engineering and digital twin] design has proliferated over time, and I think this is a model for the future, program offices living on the same digital platform as the contractors doing the design … and they work together to develop functionality. I think that’s going to be the norm going forward,” Air Force Secretary Frank Kendall said at the Air Force Summit in July.

The NDAA also authorizes an increase of $15 million for robotics supply chain research and an increase of 20 million for utility-scale quantum computing activities at DARPA.

IT for Sustainability and Climate Resilience

The secretary of defense is required to establish a research program for a commercially viable fuel system that uses biofuel for vehicles, including developing technologies that enable fuel cell durability and testing.

The NDAA also authorizes funding for the use of sustainable aviation fuel at al least two or more geographically diverse facilities. The pilot program encourages collaboration with commercial airports as well as sustainable aviation fuel refineries to further sustainable efforts laid out in the Air Force’s climate action plan.