Shaping U.S. Cyber Strategy

During the Obama administration, Belfer Center alumni had a unique role crafting cyber policy at the Department of Defense (DoD).

While they all had different roles within DoD in the years that bridged the two Obama terms, current Secretary of Defense Ashton B. Carter, Center Senior Fellow James Miller, and Carter's Chief of Staff Eric Rosenbach set the stage during that time for the creation of a full-scale cybersecurity strategy to defend the nation and its military operations.

Before this, cyber operations had been viewed as part of the “dark arts”—conducted in the shadows by special forces and other specialized units, usually with the intelligence community in the driver’s seat. Together, Carter, Miller, and Rosenbach crafted many of the initial policies for how the military would defend itself in cyberspace, how it would integrate offensive cyber operations into broader campaigns, and how it would defend the nation from a large-scale  attack.

Conceptualizing a Cyber Strategy

Knowing that people would be the most important component of a smart approach to cybersecurity, they crafted a roadmap for the military’s first cyber force. Through perseverance and nimble bureaucratic maneuvering, they generated a consensus around a Cyber Mission Force of 133 teams, made up of service members from the Army, Navy, Marines, and Air Force.

Aware that cyber threats to the United States were growing, and that maintaining America’s leadership as a top-tier cyber power required a clear-minded strategy, Carter and Miller entrusted the Department’s new cyber strategy to Rosenbach, who completed the groundwork in 2013. A key component of this new strategy was to provide guidance for civilian oversight of cyberspace operations and planning for different military scenarios.

Rosenbach hired Michael Sulmeyer from Miller’s front office as a senior advisor to help him oversee the military’s plan and operations in this new domain. This was the first unclassified strategy for the department to focus directly on offensive activities.

During 2013-14, Rosenbach and his team wrote the strategy and built momentum around it throughout the military and the rest of the national security establishment.

Implementing the Cyber Strategy

Carter’s appointment as secretary of defense in 2015 created a perfect window for the new strategy to get a top-level hearing. One of his first priorities was to announce the new strategy, making cyber a front-burner issue for the first 100 days of his tenure.

Carter and Rosenbach determined that an important aspect of the new strategy would be  to publicly call out perpetrators who had been “caught” hacking into government systems.

For this part of the plan, Rosenbach turned to Sulmeyer, who by then was running Rosenbach’s plans and operations team. Sulmeyer had been tracking a sensitive hacking issue, and with Rosenbach’s support, he slowly won over enough colleagues throughout the Pentagon to support exposing the hackers.

Secretary Carter unveiled the new strategy at Stanford University in April 2015 and, for the first time, exposed hackers that penetrated DoD.

“Earlier this year,” Carter said, “the sensors that guard DoD’s unclassified networks detected Russian hackers accessing one of our networks. They’d discovered an old vulnerability in one of our legacy networks that hadn’t been patched....After learning valuable information about their tactics, we analyzed their network activity, associated it with Russia, and then quickly kicked them off the network, in a way that minimized their chances of returning."

Reconnecting with the Belfer Center

Rosenbach, who by then had been promoted to assistant secretary of defense, learned that the Belfer Center planned to make a new investment in cyber security research. He introduced Center Executive Director for Research Gary Samore to Sulmeyer, while simultaneously Miller recommended him to Director Graham Allison. The Center hired Sulmeyer to head its expanding cybersecurity efforts. His mission was to recruit and lead a group of scholars to develop a “conceptual arsenal” for cyber conflict.

The creation of the Cyber Security Project would, in a sense, be a return to the Center’s roots, where scholars in the 1970s developed the conceptual arsenal for how policymakers should think about nuclear policy during the Cold War. A generous gift from the Belfer family and operating support from the Hewlett Foundation late in 2015 provided essential funding to launch the Center’s cyber initiative.