Cyber supports Red Flag like never before

by 2nd Lt. Meredith Hein
24th Air Force Public Affairs

3/12/2014 - JOINT BASE SAN ANTONIO-LACKLAND, Texas -- 

For the first time in Red Flag's nearly 40-year history, the Cyber Mission Force construct was used in conjunction with kinetic Air Force forces. 

Red Flag, an Air Combat Command-sponsored exercise held four times annually at Nellis Air Force Base, Nev., combines a series of complex scenarios and a robust simulated Integrated Air Defense Systems which challenge exercise participants to collaboratively plan and execute missions in support of operational and tactical objectives, according to Mr. Michael Connolly, Director of Operations, 90th Information Operations Squadron. 

24th Air Force, as the Air Force component to U.S. Cyber Command, played a significant role in the CMF construct as it pertains to Red Flag.  In fact, for the first time, the 24th AF had simultaneous participation in Red Flag from all of its major units, to include the 67th and 688th Cyberspace Wings, 624th Operations Center and 5th Combat Communications Group. 

The goal for 24th Air Force in Red Flag 14-1 was to demonstrate Air Forces Cyber's progress in implementing U.S. Cyber Command's CMF construct through the employment of Combat Mission Teams from the 91st and 315th Network Warfare Squadrons and Cyber Protection Teams from the 92nd Information Operations Squadron, supported by the 177th Information Warfare Aggressor Squadron of the Kansas Air National Guard.  Red Flag also provided an opportunity for operational test and evaluation activities associated with cyber, which is a huge cost savings to the Air Force. 

Cyber Mission Teams provided full-spectrum cyber capability for combatant commanders.  They are more offensive in nature than Cyber Protection Teams, which protect a specific target and provide mission assurance.  In the case of Red Flag, the CPTs protected the combined air operations center at Nellis AFB.  Though CPTs have been used in the past, this was the first time that CMTs were used in this configuration for Red Flag.

"This is an asymmetric capability that we're scratching at the surface to employ.  We are more engaged with Red Flag, allowing more opportunities to provide mission effects at the point of our choosing and at the drop of a hat for joint force commanders to use," said Brig. Gen. Robert J. Skinner, AFCYBER deputy commander. 

In addition to the CMTs and CPTs provided by 24th AF, the 33rd Network Warfare Squadron and the 26th, 83rd and 561st Network Operations Squadrons acted as the Cyber Defense Service Provider, which located general threats against the network and practiced enterprise protection. 

One of the other key cyber components for Red Flag was the 318th Cyberspace Operations Group, Detachment 2, whose daily mission is to establish cyber operations as credible, replicable combat capability across air, space and cyberspace domains. 

The detachment worked with the U.S. Air Force Warfare Center community to integrate cyber into the Red Flag scenarios, which allowed cyber operators to fully participate in the exercise.  In order for this to happen, effective ranges were built to represent the operating environment for U.S. and coalition forces; and intelligence was created to fulfill the needs of the exercise. 

The detachment worked closely with providers such as the 346th Test Squadron to build a replica of the Air Force Network for the "blue team" to defend during the exercise, as well as create targets for the "red forces" to attack. 

In addition, the Det. 2 worked with intelligence units, such as the 547th Intelligence Squadron at Nellis Air Force Base, Nev., to create a realistic back story for the cyber operators to work under. 

Red Flag is truly an integration exercise, said Maj. Robert Biggers, 318^th COG, Det. 2 commander.  "Operators participated from planning to execution, and all forces--air, space and cyberspace-- worked as a collective body to understand how each of their actions affects one another and the mission."

The U.S. Air Force Warfare Center fundamentally changed how Red Flag is being carried out this year in an effort to fully integrate non-kinetic operations and intelligence, surveillance and reconnaissance capabilities.

Changes to the Red Flag construct, which now links scenarios across several days, allowed intelligence to be gathered in a more realistic world setting.  This Red Flag was also the first time 24th AF has been fully integrated with the Air Force Intelligence, Surveillance and Reconnaissance Agency. 

"Developments happening with cyber and ISR are all in preparation for operations in a contested environment," said Capt. Andrew Caulk, spokesman for AFISRA.  "We train like we fight."

"We had to look at how everything complemented each component.  How can you effectively use the tools you have to accomplish the mission?" said Mr. Michael Homsy, Cyber Range Coordinator, 24th Air Force. 

In addition, the Red Flag model integrated cyber operations as it would other operations.  The red forces and blue forces engaged in a campaign plan against one another, "...two thinking, near-peer adversaries tactically engaged in combat with one another, responding and adjusting to each other as they would in a real-world conflict," said Biggers. 

Cyber was utilized in conjunction with kinetic operations through different mission problems each day of the exercise. 

"Lessons were learned and operators applied what they learned from day to day to refine how we can most effectively operate together," said Biggers.  "This is exactly the type of advanced training cyberspace operators need today."

Running the cyber portion of Red Flag was a collective effort, involving operators from six different locations.  24th AF sent 17 personnel to Nellis AFB for Red Flag, and another 30 from the various 67th and 688th Cyberspace Wing units participated in the San Antonio area. 

Other 24th AF units also played a role in Red Flag for the first time.  The 51st Combat Communications Squadron, part of the 5th Combat Communications Group, stood up a forward operating base at the exercise range and provided air traffic control advisories for air operations as well as support for combat search and rescue operations during the exercise. 

The Air Force was not the only service which provided cyber support to Red Flag.  Army Cyber Command brought a CMT, and coalition forces participated as well. 

"Not only did each country bring their own weapon systems to be integrated into the fight, but they brought unique perspectives and expertise.  The reality is that we fight alongside our coalition brothers and sisters every day.  I am glad we are training together at this level, in the Air Force's largest and most advanced exercise," said Biggers. 

The integration of these different units, branches and partner nations has far-reaching effects. 

 "We use Red Flag for advanced training to hone our skills, and we continue to learn great lessons to employ in the next one.  You can see us taking advantage of operations to become better, faster and leaner," said Skinner.  "The expertise, professionalism and teamwork displayed throughout the activities, teams that don't normally work together, watching them be an integrated team shows how far we have come to provide effects for our mission and operations."