Pentagon’s Unclassified Cyber Strategy is Influenced by Russia-Ukraine War, China

The Defense Department’s unclassified summary of its 2023 cyber strategy presents a broad-ranging plan informed by the lessons learned from the Russia-Ukraine war, as well as the growing tensions between the U.S. and China in cyberspace.

“There are some shifts that reflect our real-world experience for the department in the time period between 2018 and 2023 to include our experiences of observing the conflict in Russia-Ukraine that have shaped and refined our understanding of the role of cyber in warfare, the ways in which we defend the homeland, and, of course, the importance of working on strengthening the cybersecurity of our partners and allies,” Deputy Assistant Secretary of Defense for Cyber Policy Mieke Eoyang told reporters at a roundtable organized by George Washington University.

The Pentagon’s unclassified cyber strategy comes on the heels of the White House’s national cybersecurity strategy implementation plan providing federal agencies with actionable steps to improve the nation’s security posture. While it is unclear whether a similar implementation plan will follow the Pentagon’s new cyber strategy, Eoyang said there are “mechanisms in the Department of Defense that we use to make sure that we are moving forward with that.”

Some lessons learned from the Russia-Ukraine war include the importance of cloud migration, the impacts of satellite communications disruption, as well as people’s ability to tell their story to the world during an armed conflict.

“The ability of Ukrainians to move their data extraterritorially, but still maintain access to it was really important,” Eoyang said. “We saw the Russian attempts to disrupt satellite communications as something that, I think, many people are still trying to understand that aggregate effect of that on the conflict. But certainly, it is something that we are looking at very carefully.”

Securing the 2024 Presidential Election  

While the Cybersecurity and Infrastructure Security Agency (CISA) has been gearing up security in upcoming elections, DOD is sounding the alarm about foreign actors like China using artificial intelligence (AI) to spread misinformation and disinformation and to “get better foreign policy outcomes by trying to change the minds of the American people.”

“Certainly, generative AI as a means to try and help people who may not have a particularly wide range of language skills affect a nation where they don’t speak the same language is a concern and their ability to get better at — that is a challenge,” said Eoyang.

Earlier this month, Microsoft released a report stating that China has been using generative AI to create believable images for their social media campaigns since at least March. In the meantime, The New York Times reported that the China leveraged AI-generated images and text to launch a misinformation campaign suggesting that the destructive wildfires in Maui were a result of “a weather weapon” the U.S. government was testing.

“Certainly, PRC is one of the actors that we are quite concerned about when it comes to elections defense and foreign malign influence. And I think our concern is that they will see the value in that kind of misinformation and disinformation and use those tools to get better,” she added.

Calling for an Independent Cyber Service 

DOD will study creating a Space Force-like independent cyber service, though Eoyang noted it would not necessarily address the Pentagon’s current cyber challenges.

“We’re going to study the question. And we’ve been directed to do that. … We already have an effort underway to do that,” Eoyang said. “I think the question is that for people who think the cyber service is the answer to … our current challenges in cyber personnel management: be careful what you wish for.”

“Cyber service might have some benefits in ease of administrative management. But we have a variety of services in the Department of Defense … who perform a variety of missions,” she added. “Those missions are enabled by technologies that are particular to those mission sets. Having a cyber service that is divorced from those particular mission sets may pose some challenges in understanding the warfighting of the services to provide cyber to enable that fight.”