UNCLASSIFIED//FOUO UNITED STATES CYBER COMMAND Mission Analysis Brief Cyber Support to Counter ISIL 12 April 2016 Complete Deck (Version 34) The overall classification of this briefing is: TOP SECRET//REL TO USA, FVEY Classified By: (b)(3) USSC Derived From: USCYBERCOM SCG Dated: 20121220 AND Derived From: NSA/CSSM 1-52 Dated: 20070108 Declassify On: 20371220 UNCLASSIFIED//FOUO 1

SECRET//REL TO USA, FVEY

Guidance, Direction, and Task

• Secretary of Defense:
  • "Top priority is to thwart ISIL attacks against the United States and Western Europe" – 27JAN16
  • Focus on the AOR (Iraq and Syria)
  • (b)(1) Sec 1.4(a) USSC
• OIR EXORD MSN Statement: CDRUSCENTCOM leads coalition military operations to degrade, dismantle and ultimately defeat ISIL IOT restore regional stability
  • USSTRATCOM: Conduct Cyberspace Operations ISO CENTCOM

(b)(1) Sec 1.4(a),(b) USSC

"Expand targets, introduce new capabilities to counter ISIL in the AOR, tie in Coalition to increase effects" – Commander, USCYBERCOM

SECRET//REL TO USA, FVEY 2

SECRET//REL TO USA, FVEY

# Specified Tasks

*   **SECDEF**
    *   Support broader effort to thwart ISIL attacks against the United States and Western Europe
*   **CDR USCYBERCOM**
    *   Conduct C-ISR, C-OPE and OCO to counter ISIL (b)(1) Sec 1.4(a) USSC operations, counter ISIL media, support coalition military operations against ISIL, and to counter ISIL sustainment capabilities within Iraq and Syria
    *   (b)(1) Sec 1.4(a) USSC
    *   
*   (b)(1) Sec 1.4(a) USSC
    *   (b)(1) Sec 1.4(a),(b) USSC
    *   
    *   
    *   
    *   
*   (b)(1) Sec 1.4(a) USSC
    *   (b)(1) Sec 1.4(a),(b) USSC
    *   
    *   
    *   

SECRET//REL TO USA, FVEY
3

SECRET//REL TO USA, FVEY

Implied and Essential Tasks

• Implied Tasks
  • Prevent attacks against all coalition partners
  • Ensure early coordination with interagency partners (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC
  • Coordinate with USCENTCOM (b)(1) Sec 1.4(a) USSC on target engagement
  • Streamline targeting cycle to support dynamic nature of adversary
  • Surge analytical efforts to understand adversary use of the cyber domain
  • Integrate, synchronize, and deconflict OCO with (b)(1) Sec 1.4(a),(b) USSC partners
  • Identify and develop capabilities that support the delivery of cyber effects in parallel with CONOPs and target development
  • Gain and maintain (b)(1) Sec 1.4(a) USSC
• Essential Tasks
  • Support WOG efforts to prevent attacks against the US and coalition partners
  • Integrate, synchronize, and deconflict with (b)(1) Sec 1.4(a),(b) USSC partners in Phase 2 planning and operations
  • Disrupt ISIL's use of the cyberspace domain
  • Support CENTCOM's effort to dismantle and ultimately defeat ISIL in Iraq and Syria

SECRET//REL TO USA, FVEY 4

TOP SECRET//REL TO USA, FVEY

Facts and Assumptions

Facts

• ISIL has self-declared a caliphate since June 2014 with Raqqah as the capital
• ISIL has a developed a sophisticated media campaign incorporating a capable propaganda program
• ISIL forces have gained/seized control of large tracts of land within Syria and Iraq with epicenters located in Raqqah and Mosul
• ISIL forces have created additional provinces outside of Iraq and Syria and desire to expand globally
• ISIL's use of cyberspace is dynamic
• ISIL extensively leverages social networking sites
• ISIL's ideology incited individuals to execute lone wolf attacks globally
• Complex cyber environment; multiple actors(b)(1) (b)(1) Sec 1.4(a),(b) USSC
• ISIL is operating as a quasi-nation state and global terrorist organization
• Indigenous forces(b)(1) Sec 1.4(a),(b) USSC are not under direct US control
• The Caliphate will continue to seek its global expansion
• ISIL conducted doxing attacks (PII) and will continue to advocate these releases
• (b)(1) Sec 1.4(a) USSC

(b)(1) Sec 1.4(a),(b) USSC

TOP SECRET//REL TO USA, FVEY 5

TOP SECRET//REL TO USA, FVEY

Limitations (Constraints and Restraints)

• Constraints:

  • Must conduct (b)(1) Sec 1.4(a) USSC
    • Must comply with (b)(1) Sec 1.4(a) USSC
    • Must receive (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC
  • Must continue to support USCENTCOM (b)(1) Sec 1.4(a) USSC military operations
  • Must coordinate with (b)(1) Sec 1.4(a) USSC and minimize equity concerns (b)(1) Sec 1.4(a) USSC

• Restraints:

  • Cannot conduct (b)(1) Sec 1.4(a) USSC
  • Cannot exceed a (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC
  • Cannot conduct (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC

Identify opportunities or authority gaps that expand beyond existing limitations. TOP SECRET//REL TO USA, FVEY 6

SECRET//REL TO USA, FVEY (b)(1) Sec 1.4(a) USSC Analysis in the Cyberspace Domain (b)(1) Sec 1.4(a),(b) USSC SECRET//REL TO USA, FVEY Critical Requirements in Cyberspace 7

TOP SECRET//SI//REL TO USA, FVEY (b)(1) Sec 1.4(a),(b),(c) USSC

TOP SECRET//SI//REL TO USA, FVEY 8

TOP SECRET//SI//ORCON/REL TO USA, FVEY/FISA (b)(1) Sec 1.4(a),(b),(c) USSC TOP SECRET//SI//ORCON/REL TO USA, FVEY/FISA 10

TOP SECRET//SI//REL TO USA, FVEY (b)(1) Sec 1.4(a), (c) USSC TOP SECRET//SI//REL TO USA, FVEY 11

TOP SECRET//SI//REL TO USA, FVEY (b)(1) Sec 1.4(a), (c) USSC TOP SECRET//SI//REL TO USA, FVEY 11

SECRET//REL TO USA, FVEY

Phase II Mission Statement

• Mission Statement: (S//REL TO USA, FVEY) USCYBERCOM denies ISIL's use of the cyberspace domain through a multipronged approach, (b)(1) Sec 1.4(a),(b) USSC (b)(1) Sec 1.4(a),(b) USSC (b)(1) Sec 1.4(a),(b) USSC, support the broader effort to dismantle ISIL in Iraq and Syria, and posture for follow-on (b)(1) Sec 1.4(a) USSC cyberspace operations.

SECRET//REL TO USA, FVEY 12

SECRET//REL TO USA, FVEY

Commander's Intent

• Purpose:

  • Create the cyberspace conditions to support the effort to dismantle ISIL in Iraq and Syria ISO USCENTCOM and disrupt ISIL's ability to plan and execute attacks against the United States and coalition partners (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC

• Method:

  • USC YBERCOM will employ cyberspace forces and integrate, synchronize, and deconflict (b)(1) Sec 1.4(a),(b) USSC to deliver effects against ISIL.

• End State:

  • ISIL is denied use of the cyberspace domain to enable their critical capabilities (b)(1) Sec 1.4(a),(b) USSC (b)(1) Sec 1.4(a),(b) USSC

SECRET//REL TO USA, FVEY 13

SECRET//REL TO USA, FVEY Lines of Effort (LOEs) (b)(1) Sec 1.4(a),(b) USSC

1. Counter ISIL (b)(1) Sec 1.4(a) USSC Ops
2. Counter ISIL Media
3. Support Coalition/Military Ops
4. Counter ISIL Sustainment Capes
5. (b)(1) Sec 1.4(a) USSC PHASE II END STATE ISIL is denied use of the cyberspace domain to enable their critical capabilities (b)(1) Sec 1.4(a),(b) USSC (b)(1) Sec 1.4(a),(b) USSC SECRET//REL TO USA, FVEY 14

TOP SECRET//REL TO USA, FVEY (b)(1) Sec 1.4(a),(b) USSC TOP SECRET//REL TO USA, FVEY 15

SECRET//REL TO USA, FVEY Tasks across all LOEs

• Gain and maintain (b)(1) Sec 1.4(a) USSC
• Conduct (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC
• Identify requirements for capabilities, infrastructures, accesses, personnel, intelligence.
• Provide support to (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC
• Coordinate and integrate actions with (b)(1) Sec 1.4(a),(b) USSC (b)(1) Sec 1.4(a) USSC
• Identify opportunities (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC
• Conduct strategic engagements to support PAO, CDR, Congress, Interagency, Coalition, and others as required.
• Pass (b)(1) Sec 1.4(a),(b) USSC (b)(1) Sec 1.4(a),(b) USSC SECRET//REL TO USA, FVEY 16

SECRET//REL TO USA, FVEY Tasks for LOE 1: Counter ISIL (b)(1) Sec 1.4(a) USSC Ops (b)(1) Sec 1.4(a),(b) USSC SECRET//REL TO USA, FVEY 17

SECRET//REL TO USA, FVEY

Tasks for LOE 2: Counter ISIL Media

• (b)(1) Sec 1.4(a),(b) USSC

SECRET//REL TO USA, FVEY 18

SECRET//REL TO USA, FVEY Tasks for LOE 3: Support Coalition / Military Operations (b)(1) Sec 1.4(a),(b) USSC

SECRET//REL TO USA, FVEY 19

SECRET//REL TO USA, FVEY

Tasks for LOE 4: Counter ISIL Sustainment

• (b)(1) Sec 1.4(a) USSC SECRET//REL TO USA, FVEY 20

SECRET//REL TO USA, FVEY (b)(1) Sec 1.4(a) USSC SECRET//REL TO USA, FVEY 21

UNCLASSIFIED//FOUO Force Allocation UNCLASSIFIED//FOUO 22

SECRET//REL TO USA, FVEY

Assumptions for Force Allocation

• Components identified forces unconstrained by current disposition (e.g., alignment, mission, etc...), training completed, and risks to other mission sets
• Forces identified assumes current posture and operational tempo
• Augmented forces identified to fill gaps will require (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC
• Certain work roles may benefit from being utilized as a pooled resource (b)(1) Sec 1.4(a) USSC
• C2 commander will be authorized to task organize forces as necessary to achieve objectives

SECRET//REL TO USA, FVEY 23

TOP SECRET//REL TO USA, FVEY Force Requirements for LOE 1: Counter ISIL Ops (b)(1) Sec 1.4(a) USSC

1. Counter ISIL (b)(1) Sec 1.4(a) USSC Ops (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a),(b) USSC TOP SECRET//REL TO USA, FVEY 24

TOP SECRET//REL TO USA, FVEY Force Requirements for LOE 2: Counter ISIL Media 2. Counter ISIL Media (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a),(b) USSC TOP SECRET//REL TO USA, FVEY 25

TOP SECRET//REL TO USA, FVEY Force Requirements for LOE 3: Support Coalition / Military Operations 3. Support Coalition/Military Ops (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a),(b) USSC TOP SECRET//REL TO USA, FVEY 26

TOP SECRET//REL TO USA, FVEY

Force Requirements for LOE 4: Counter ISIL Sustainment

(b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC 4. Counter ISIL Sustainment Capes (b)(1) Sec 1.4(a),(b) USSC

TOP SECRET//REL TO USA, FVEY 27

(b)(1) Sec 1.4(a),(b) USSC TOP SECRET//REL TO USA, FVEY TOP SECRET//REL TO USA, FVEY 28

TOP SECRET//REL TO USA, FVEY

Overall Staff Estimate

• LOE 1: Counter ISIL (b)(1) Sec 1.4(a) USSC Operations
  • Approximately (b)(1) Sec 1.4(a) USSC
• LOE 2: Counter ISIL Media
  • Approximately (b)(1) Sec 1.4(a) USSC
• LOE 3: Support Coalition / Military Operations
  • Approximately (b)(1) Sec 1.4(a) USSC
• LOE 4: Counter ISIL Sustainment
  • Approximately (b)(1) Sec 1.4(a) USSC
• (b)(1) Sec 1.4(a),(b) USSC

(b)(1) Sec 1.4(a),(b) USSC

TOP SECRET//REL TO USA, FVEY 29

SECRET//REL TO USA, FVEY

Force Requirement Observations

• Overall force requirement can be reduced via optimization and centralization
• Enabling unity of effort against LOEs can be amplified (b)(1) Sec 1.4(a) USSC with effective integration of interagency, coalition, and other partners
• Effectively leading the Phase II C-ISIL effort (synchronization, logistics, prioritization, organization, training, KM, funding, infrastructure) will require (b)(1) Sec 1.4(a) USSC HQ staff

SECRET//REL TO USA, FVEY 30

TOP SECRET//REL TO USA, FVEY Step 1: Current (b)(1) Sec 1.4(a) USSC Teams Available by Work Role for Phase II

*Additional details available in backup slides *Optimization may reduce force requirements further *Some work roles have an excess of capacity which can be reallocated to other missions as req'd (b)(1) Sec 1.4(a) USSC *Includes: (b)(1) Sec 1.4(a) USSC

Current teams require (b)(1) Sec 1.4(a) USSC identified force requirements

TOP SECRET//REL TO USA, FVEY 31

Step 1: Lines of Effort (LOEs) – Current Available Teams SECRET//REL TO USA, FVEY (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC

1. Counter ISIL Ops (b)(1) Sec 1.4(a) USSC
2. Counter ISIL Media
3. Support Coalition/Military Ops
4. Counter ISIL Sustainment Capes
5. (b)(1) Sec 1.4(a) USSC SECRET//REL TO USA, FVEY (b)(1) Sec 1.4(a) USSC 32

SECRET//REL TO USA, FVEY (b)(1) Sec 1.4(a),(b) USSC SECRET//REL TO USA, FVEY 33

SECRET//REL TO USA, FVEY
Lines of Effort (LOEs) – Forces
(b)(1) Sec 1.4(a) USSC
1. Counter ISIL (b)(1) Sec 1.4(a) USSC Ops
2. Counter ISIL Media
3. Support Coalition/Military Ops
4. Counter ISIL Sustainment Capes
5. (b)(1) Sec 1.4(a) USSC
* (-) Indicates partial team
SECRET//REL TO USA, FVEY
(b)(1) Sec 1.4(a) USSC
34

SECRET//REL TO USA, FVEY Lines of Effort (LOEs) – Cyber Partner Support (b)(1) Sec 1.4(a),(b) USSC

1. Counter ISIL (b)(1) Sec 1.4(a) USSC Ops
2. Counter ISIL Media
3. Support Coalition/Military Ops
4. Counter ISIL Sustainment Capes
5. (b)(1) Sec 1.4(a) USSC SECRET//REL TO USA, FVEY 35

SECRET//REL TO USA, FVEY

Coalition Integrated Planning

• Planning Factors
  • Final Phase II C2 model may impact (b)(1) Sec 1.4(a) USSC into staff
• Recommendations
  • (b)(1) Sec 1.4(a) USSC
    • (b)(1) Sec 1.4(a),(b) USSC
  • (b)(1) Sec 1.4(a) USSC
    • Facilitate the integration of US and Coalition cyber planning against ISIL.
    • Increase coalition integration at all levels (b)(1) Sec 1.4(a) USSC
    • Increase intelligence support (b)(1) Sec 1.4(a) USSC
    • Explore the feasibility to delineate (b)(1) Sec 1.4(a) USSC (b)(1) Sec 1.4(a) USSC with terms of reference.
    • Identify and overcome barriers to integration in the C-ISIL fight
  • The COS will direct staff actions to
    • Ensure coalition integration cell is broadly integrated and aligned with overall effort and part of routine senior leader dialogue and engagements
    • Ensure (b)(1) Sec 1.4(a) USSC are trained and certified in order to improve information sharing & collaboration
    • (b)(1) Sec 1.4(a),(b) USSC
    • Recommend what senior C-ISIL battle rhythm events would include senior coalition counterparts
    • (b)(1) Sec 1.4(a) USSC processes that will need to occur (b)(1) Sec 1.4(a),(b) USSC
      • (b)(1) Sec 1.4(a),(b) USSC

SECRET//REL TO USA, FVEY 36

UNCLASSIFIED//FOUO UNITED STATES CYBER COMMAND Command and Control UNCLASSIFIED//FOUO 37

SECRET//REL TO USA, FVEY C2 Way Ahead

• CDRUSCYBERCOM will establish a Joint Task Force
  • (b)(3) USSC as JTF CDR but maintains other current responsibilities
  • (b)(1) Sec 1.4(a) USSC

SECRET//REL TO USA, FVEY 38

UNCLASSIFIED//FOUO UNITED STATES CYBER COMMAND Target Sets and Capabilities UNCLASSIFIED//FOUO 39

TOP SECRET//REL TO USA, FVEY Expanding Targeting Guidance Phase I - Accelerant Phase II – AOH Focus Phase III – Beyond the AOH Target Types (b)(1) Sec 1.4(a) USSC Capabilities Infrastructure (b)(1) Sec 1.4(a) USSC TOP SECRET//REL TO USA, FVEY 40

TOP SECRET//SI//REL TO USA, FVEY

CYBERCOM Tactical Capabilities Overview

(b)(1) Sec 1.4(a), (c) USSC

TOP SECRET//REL TO USA, FVEY CYBERCOM MILITARY INFRASTRUCTURE 41

NATIONAL SECURITY ARCHIVE

National Security Archive, Suite 701, Gelman Library, The George Washington University, 2130 H Street, NW, Washington, D.C., 20037, Phone: 202/994-7000, Fax: 202/994-7005, nsarchiv@gwu.edu