The New Veterans

The Essentials Newsletter, Thirty-third Edition

About a year ago, in the ninth edition of this newsletter, I discussed the intersection between the electric sector and the defense industrial base (DIB). I just realized, however, that I haven’t yet addressed the military itself, at least not directly. Doing so the week of Veterans Day and not the day of is intentional…that day is often one of gratitude, reflection and family time, and I did not want to interfere, even in a small way, with those feelings and activities.

Note that, technically, the military is not part of our domestic, critical infrastructure (CI).?In our Constitution, it is intentionally positioned under the executive branch and lead by civilians and is not its own branch of government .?As I noted last year, quoting from a report by the Congressional Research Service:

In the context of a new, experimental, and democratic Republic, the Founding Fathers believed that subordination of the military to the authority of civil masters was critically important to prevent the emergence of a new form of tyranny or dictatorship. The principle of civilian control of the military places ultimate authority over U.S. armed services in the hands of civilian leadership, with civilian responsibility and control of the military balanced between the executive and legislative branches of the government. In some ways, the relationship between the military and the civil society it serves is a paradox: the military, by its very nature, has coercive power that could threaten civil society. Yet without a sufficiently strong and capable military, civil society becomes vulnerable to attack, and the former might not be able to defend the latter. [emphasis added]

Frequent readers of this newsletter know that I come from a military family but have not served myself (a blown-out knee from soccer in high school prevented me from doing so). My father, Col. John Ditto, was killed on active duty in the Marine Corps when I was almost 10, my brother served 20 years as a Marine, my grandfathers both served in WWII, one as a Marine officer in the Pacific and another as an enlisted Marine in Europe. My stepfather, Capt. Jerry Coffee, was a Naval aviator who took key pictures of Soviet missiles during the Cuban Missile Crisis, and several years later was shot down in Vietnam and spent seven years in the infamous “Hanoi Hilton” as a prisoner of war. Despite the sacrifices made by members of my family (or maybe because of them), I am a big fan of our military, including the spouses and children of active-duty military service men and women. Yet, I also deeply appreciate the skepticism the Founding Fathers had about consolidated military power – a skepticism that was warranted, given subsequent despotic military regimes across the world.

Since 9/11, and with the advent of the now pervasive cybersecurity threat to mostly privately owned CI, the lines have blurred between what’s in the military’s purview versus what’s handled by these CI owners and operators. Of course, the DIB (that it, the network of organizations, facilities, and resources that provides the government with defense-related materials, products, and services) has been deeply interwoven with the military since the 1950s, but, with a few exceptions, the rest of CI has been mostly at arms’ length until these last 20 years.? As with almost everything, this evolving relationship has both challenges and opportunities for both.?

A report released by the Defense Science Board in August of this year entitled “Department of Defense Dependencies on Critical Infrastructure,” highlights the evolution:

“Attacks on the U.S. Homeland are an implicit part of near-peer adversary warfighting doctrine. More recently, there has been a heightened awareness and discussion of their infiltration into civilian infrastructure…The Task Force observed immediately that the distinction between “competition” and “conflict” is not serving the Department well. Adversaries have already moved past simple competition to campaigns with actions that disrupt, degrade, and/or cripple civilian infrastructure that DoD and the American public rely on…”?

The report goes on to recommend a more collaborative approach by Department of Defense (DoD) and the four specific CI sectors most important to military success – energy, transportation, water/wastewater, and telecommunications. Interestingly, I identified these four in my last couple of newsletters about the recent hurricanes. The report notes the need to perform exercises with red teams (e.g. mock adversaries) to ensure proper coordination.?While the authors are primarily referencing cybersecurity, this makes me wonder, couldn’t some of this cross-sector/military planning and real-world application be done for hurricane response? As I delved into previously, our nation’s hurricane response could certainly use another look.

But I’m getting ahead of myself a bit. To rewind, the lines are blurring because our adversaries can reach into our backyards (and we can reach into theirs) with cyber attacks on CI. This is already happening, causing a massive paradigm shift. This shift involves increased co-dependence amongst CI sectors as well as between CI and the federal government, including DoD. CI sectors’ major need is actionable intelligence from the federal government so they can prioritize their cybersecurity.?The government, in turn, wants to know that the CI sectors will be there for the military and other essential government functions when it matters.?

While against our collective DNA, we must continue to enhance these relationships between CI and the federal government, including with the military/DoD in order to ensure both sides of the coin can do their jobs. At the same time, civilian leadership of our armed forces remains foundational. The tricky part is when bad things happen to or around CI in the “homeland,” on American soil. The Federal Emergency Management Agency, Federal Bureau of Investigation, U.S. Border Patrol, Transportation Safety Administration, Bureau of Alcohol, Tobacco and Firearms, etc., are the federal response and law enforcement agencies tasked with handling civilian crimes and attacks, such as the coordinated attack on a key electric substation in 2012 (known as Metcalf).?There is also a distinct bifurcation between the military and civilian judicial systems. Calling in the troops to help with civilian CI matters, even if significant, is not done lightly, nor should it ever be.?

However, as called for in the Defense Science Report referenced above, some level of ongoing dialogue, joint exercises, and, generally, relationship-building should happen between civilian CI and the DoD such that assessing when to call in those troops is clearer. The report recommends several actions, but the primary one is to establish a “Mission Infrastructure Resiliency” Task Force, led by two senior members of DoD, to recommend a permanent organizational construct that “must be enabled by intelligence and threat assessment focused on CI, a strong analytical function that informs a “living” strategy that adapts to the changing threat, and gaming and exercising that includes disruptions to the homeland as integral parts.” The Mission Infrastructure Resiliency Task Force would also initiate low-hanging fruit steps, such as establishing pathways for partnership and engagement with each of the four CI sectors mentioned above.

I would also add one other group to the mix – the governors.?Governors are the ones authorized to ask for “the troops” in the rare circumstances when they are called on. Typically, those troops are the National Guard, who already function as a sort of bridge between the military and civilian sides of our society. Governors lead responses to crises in their states, working with their localities and first responders in so doing.?

As I started to note earlier in this newsletter, we know we have major storms to contend with on an annual basis, and we know the response doesn’t always go smoothly. Why not establish a pilot program with DoD, the four CI sectors (energy, water/wastewater, telecom, and transportation), and the governors to respond to actual storms? It could be invaluable to aiding such response and to establishing playbooks, chains of command and triggers as to when to call in the troops. Of course, holding table-top and other exercises for potential events, such as cyber-attacks resulting in operational problems, will also be needed.??

In my mind, it usually comes down to people. Is trust established? Do they know who to call/text/email when the “you-know-what” is hitting the fan? It is tricky, though, because the military imperative might end up, in certain dire circumstances, conflicting with the CI sectors’ imperatives to provide life-saving services to their broader, non-military, customers. These circumstances should be understood and discussed, even if there is ultimately no good answer.

In essence, we need people in both the military and CI sectors who are willing to roll up their sleeves, leave their egos at the door, and work through these relationships and overlaps, all while keeping the Constitution top of mind.