COMMAND AND CONTROL IN OPERATIONS AND CYBER
SECURITY
Jiří Černý, Petr Hrůza
Abstract: Command of armies is one of the areas where there occur frequent changes and
which is the object of examination in all armies. The combat power of the armed forces does
not depend only on equipping them with modern weapons and equipment, but it also depends
on how their actions will be planned before the fight and how they are managed in combat.
Every military operation conducted around the world is enabled by space as well as cyber
operations, domains closely linked and threatened alike. Cyberspace is increasingly becoming
a contested domain.
Keywords: Command and Control, Communication, Cyber Security
1. Introduction
Command and control is a multifaceted art and creative activity consisting of deliberate
regulation of combat power to achieve its goals within the specified time and with
minimum losses. Commander plays crucial and irreplaceable role. In the process of
command, he decides how to use military force and imprints to subordinates his will
and intentions. In the process of control, he and his staff, manage and coordinate
activities of subordinates to meet the set task.
To ensure reliable and effective command and control of combat forces, it is necessary
to develop command and control system. It consists of three interlinked components:
authorities, processes and means of command and control. Role of Command and
Control System (Command and Control - C2) in command of troops is so crucial that no
one questions it. Yet, it has to be clear that the system of command is an open system, in
which constant changes take place. This system thus directly presupposes the search for
ways and means to further improve the system itself.
C2 and the communication is a sum of facilities, equipment, methods, procedures and
staff, which enable commanders and their staffs to carry out command and control. It
also includes command and control communications systems - that provide
information transmission between command posts.
2. Command and Control
From security standpoint, communication systems can be divided into classified and
unclassified. Cryptography means are those, in which the use of technical means secret
cryptographic are of sufficient value for the transmission of classified information along
the entire route of communications. These must be certified by the National Security
Authority under applicable legislation. Unclassified communications systems are those,
in which uncertified technical means or no means at all are used. To transmit classified
information, it is necessary to use encryption and cryptography appropriate for
18
cryptographic values.
For effective command and control of troops in the operation, place from which
commander commands and controls combat is highly important. Generally, the
commander should be in such places, where during crucial situations, he can effectively
influence the activities of subordinate forces. Therefore, for the command of troops it is
practice to set up command posts. At all the command posts, there works at every level
of command and control a commander, his staff, liaison teams (Liaison Teams) and
a control of group assigned to the elements - the modules of military branches.
The current command posts are centers of control, coordination and communication on
the respective level of command and control, which maintain a permanent
communication and coordination with the superior level of command, subordinates and
adjacent units.
3. Communication and Information System
Commanders and staffs of task forces constantly utilize communication and
information systems (Communication and Information System - CIS) to continuously
collect information from command posts in near real time and maintain a common
operating picture (Common Operational Picture - COP) up to date. Data and
information are shared jointly between command posts. Under normal circumstances,
the information (data) are transmitted and shared through command and control
systems. In this way subordinate officers send messages to their superiors in specified
format and with specified purpose. The flow of information during the operation,
therefore, takes place both in the vertical and in the horizontal plane in the vertical plane
for the implementation of the command (command includes situations) and in the
horizontal plane to ensure the synchronization between the units on the sides and other
common components.
"Without a communication there is no leadership" may be trite, but valid saying that
have a permanent applicability. Due to the developments in cyberspace, however, the
present time requires a new adage that "without encrypted communication there is
no leadership." That conclusion follows from the fact that every military
communication (starting with radiostations at the tactical level) is encrypted. It remains
a fact that due to the advancement of technology, it is a matter of time before it will be
possible to break the key and debunk the transmitted information.
4. Protection against detection, against analysis and against deception
Particularly vulnerable in terms of security of communication are radio communication
systems, including classified systems. To achieve the maximum possible level of safety,
basic security measures should be continuously and skillfully conducted. These
measures can be divided into three groups - protection against detection, against
analysis and against deception.
Detection means searching, interception and recording of radio communications and
other electromagnetic radiation for the purpose of obtaining information. No radio
transmissions are safe from detection. Scouting devices are more sensitive receivers,
and effective antennas are usually able to find out the position of radio stations.
Analysis means examining and evaluating the intercepted communications and
radiation in order to obtain valuable information.
Deceit means an unauthorized entry into the communication system, in order to pretend
plausible broadcasting with the intent to bring the system into confusion and misleading
19
information. In peacetime, this activity is unlikely. It is almost exclusively carried out
during conflicts. This increases its hazards. Unprepared operators and users facing
urgent tactical issues may become an easy target for such an attack.
5. Sharing of information between components
Multinational (joint) operations will always require the sharing of information
between components of the individual branches of the forces (Ground Forces, Air
Force, Navy, Special Forces). Information exchange is critical for the successful
coordination of the operation. Therefore, as a minimum, the COP is required, in order to
provide other components of armed forces to have good knowledge of the situation and
the possibility of retaliation by supporting components in favor of supported
components. Different branches of forces must exchange information through their
national communication means and CIS in the operational area actively and effectively,
in order to contribute to the creation of effective and efficient information transmission
infrastructure.
Although the details of the information requirements for the exchange of information
will be specific to each operation, there exists a number of different types of information
to be exchanged horizontally and vertically in any context of operations. These types of
information can be divided into following categories:
• Documents for command and control - operational orders (OPORD),
instructions and plans.
• Knowledge of the situation, including our own, hostile and neutral (civilian)
forces and information about the environment, including the operation of
meteorological information.
• Information about control measures (including orders to control, such as orders
for firing tasks and to control airspace (Air Control - ACO) and the results of
control and information).
• Information on combat support and services of combat support.
• Reports.
• Information from specialist’s areas, such as artillery, combat engineers, aviation
and others.
6. Security and system requirements
Security management is the identification of an organization's assets, followed by the
development, documentation, and implementation of policies and procedures for
protecting these assets. An organization uses such security management procedures as
information classification, risk assessment, and risk analysis to identify threats,
categories assets, and rate system vulnerabilities so that they can implement effective
controls.
Security and system requirements require that certain information is designated as
classified or designated as nationally sensitive and such information should not be
passed over. The key requirement is to maintain the security of information
exchange between the CIS at the each respective level. Standard protection from
sender to recipient should be up to the level "SECRET".
When planning a military mission at command posts, it is important to take
measures to ensure that all participants have access to the information essential to
conduct combined joint operations. There must be guaranteed integrity and availability
of information. Modern computers, which are now standard equipment of
20
command posts, offer new possibilities to support the military decision making process
by providing commanders with data quickly and better, both horizontally and vertically.
Thus increase the quality, quantity and level of detail of the plans (including partial and
crisis), which are commanders able to process. Using computers for a wide range of
manual activities, commanders and staffs can use the saved time to focus at intellectual
activities on higher levels, those which help them transform information into knowledge
and understanding of the situation.
Information storage is the process of keeping important information in various
forms until this information is necessary for the exercise of command and control.
The information is stored, because not all the information that is collected or processed,
may be shown at the same time, and not all of it is important.
Shared databases represent a powerful tool for transforming data into information and
knowledge, both of which are necessary for the adoption of military decisions.
Databases are the bridge through which the various systems with multiple purposes can
work together. Using databases allows operators and analysts to sort out, store and
organize data through the identification unit, its location, status, or consumption of
resources.
Development of resources and technologies of command and control system will
gradually allow the "remote" support decision-making processes of commanders to
command posts deployed units (Reachback).
7. Cyber Security
The term cyber war for many people evokes the idea of destructive, malicious programs
that cause computer system freezes and weapon systems fails, and use such miracles of
technical prowess for a bloodless victory. This picture, in which cyber war is isolated
from broader conflict, unfolded in an environment totally different from traditional
warfare and offers a bloodless alternative to the dangers and expenses of modern
warfare, is indeed attractive, but unrealistic. Cyberwarfare will almost certainly have
very real physical effects.
Cyber-attack is any type of offensive maneuver employed by individuals or whole
organizations that targets computer information systems, infrastructures, computer
networks, and/or personal computer devices by various means of malicious acts usually
originating from an anonymous source that either steals, alters, or destroys a specified
target by hacking into a susceptible system.
Cyberwarfare utilizes techniques of defending and attacking information and computer
networks that inhabit cyberspace, often through a prolonged cyber campaign or series of
related campaigns.
In the US, General Keith B. Alexander, first head of the recently formed
USCYBERCOM, told the Senate Armed Services Committee that computer network
warfare is evolving so rapidly that there is a "mismatch between our technical
capabilities to conduct operations and the governing laws and policies. Cyber
Command is the newest global combatant and its sole mission is cyberspace, outside the
traditional battlefields of land, sea, air and space.”[1] It will attempt to find and, when
necessary, neutralize cyberattacks and to defend military computer networks.
When modern military systems are involved in hostilities of military nature, the key
objective is to achieve information superiority or information dominance on the
battlefield. But this does not lead to cyber attacks only on battlefields. First and
foremost, there are several tens of cyber attacks per day on different servers ministries,
21
mainly the Ministry of Defense and its components. Their aim is to gain access to
sensitive data on armament contracts and on the specifics of current and future military
operations. Any disclosure of sensitive information relating to specific operations could
endanger the lives of soldiers and the success of the operation.
To verify the capability and preparedness to defend against possible cyber attacks, cyber
exercises are organized every year. The aim of these exercises is to verify the technical
capabilities for the analysis of the modified hardware, malicious code, infected files or
media and detecting anomalies in systems and networks. Another important objective is
the establishment of international and national cooperation and the creation of teams of
specialists.
Locked Shields is a real-time network defence exercise, organised annually since 2010
by the NATO Cooperative Cyber Defence Centre of Excellence. The Estonian Cyber
Range forms the backbone of the game-based exercise, with new attack vectors and
technologies being introduced every year, in sync with market developments. 16 nations
and NATO Computer Incident Response Capability participated as the Blue Teams of
Locked Shields 2015. A total of 400 people were involved in the exercise. The training
audience of the exercise were the national Blue Teams: computer emergency response
specialists, playing the role of the rapid reaction teams of the fictional country of Berlya.
The team from NATO Computer Incident Response Capability (NCIRC) came out as a
winner, Estonia and Poland took second and third place respectively. The largest of its
kind globally, Locked Shields is unique in using realistic technologies, networks and
attack methods. In 2015, new attack vectors included ICS/SCADA systems and
Windows 8 and 10 operating systems, as well as an element of active defence. In
addition to technical and forensic challenges, Locked Shields also includes media and
legal injects. It thus provides insight into how complex a modern cyber defence crisis
can be, and what is required from nations in order to be able to cope with these threats.
Locked Shields 2015 was supported by the Government of Canada. The grant covered
purchase of technical equipment for the NATO Cooperative Cyber Defence Centre of
Excellence cyber lab and supporting services that allowed to increase the capacity of the
annual Locked Shields cyber defence exercise.
Cyber Europe 2016 “Are you ready for the next cyber crisis?” ENISA, with the
cooperation of EU and EFTA Member States, organises the Cyber Exercise series to
prepare Europe for major cybersecurity crises. ENISA Cyber Europe 2016 will take
place autumn/2016.
NATO Cooperative Cyber Defence Centre of Excellence is a NATO accredited
research and training facility dealing with education, consultation, lessons learned,
research and development in the field of cyber security. Membership at the Centre is
open to all NATO nations but cooperation projects are also conducted jointly with
NATO's Partner countries, academia and the private sector. The Centre’s current
Sponsoring Nations are the Czech Republic, Estonia, France, Germany, Greece,
Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, Turkey, the
United Kingdom and the United States. In addition Austria and Finland have joined the
Centre as a Contributing Participants. The Centre is funded and staffed by the
aforementioned nations. The organization is funded, directed and tasked by the
multinational Steering Committee consisting of the representatives of the Sponsoring
Nations. NATO does however task the Centre via Allied Command Transformation
(ACT) and all products of the Centre are available to NATO nations unless restricted by
the organization requesting that product. Becoming a Sponsoring or Contributing Nation
22
gives a nation the possibility to contribute and shape the understanding of cyber security
in NATO and among NATO nations. Representatives of the Sponsoring Nations also
receive premium access to the Centre’s products, trainings and events.
8. Conclusions
To ensure reliable and effective command and control of combat forces, it is necessary
to develop command and control system. For effective command and control of troops
in the operation, place from which commander commands and controls combat is highly
important. Commanders and staffs of task forces constantly utilize communication and
information systems to continuously collect information from command posts in near
real time and maintain a common operating picture up to date. Particularly vulnerable in
terms of security of communication are radio communication systems, including
classified systems. Modern computers, which are now standard equipment of command
posts, offer new possibilities to support the military decision making process by
providing commanders with data quickly and better, both horizontally and vertically,
and thus increase the quality, quantity and level of detail of the plans. Cyberwarfare
utilizes techniques of defending and attacking information and computer networks that
inhabit cyberspace, often through a prolonged cyber campaign or series of related
campaigns. Cyber-attack is any type of offensive maneuver employed by individuals or
whole organizations that targets computer information systems, infrastructures,
computer networks, and/or personal computer devices by various means of malicious
acts usually originating from an anonymous source that either steals, alters, or destroys a
specified target by hacking into a susceptible system.
References
[1]
[2]
[3]
[4]
[5]
STATEMENT OF GENERAL KEITH B. ALEXANDER, [online], 2013
http://online.wsj.com/public/resources/documents/GeneralAlexanderRemarkstoS
AC-D06122013.PDF
AJP 3.2.2 Command and Control of Allied Land Forces. Ratofication 2005
ATP-3.2.2 Command and Control of Allied Land Forces. North Atlantic Treaty
Organization. 2009
FM 6-0 Mission Command: Command and control of Army Forces, HGD of the
Army, Washington DC, 2003
ATTP 5-0.1 Commander and Staff Officer Headquarters, Department of the
ArmyGuide Washington, DC, 14 September 2011
23