Final defense bill drops Cyber Force study

Congress' annual defense policy bill doesn’t include a provision that would have required the Pentagon to commission an independent study on establishing a U.S. Cyber Force.

The compromise measure, released late Wednesday night, omits an amendment to the Senate’s version of the massive legislation from Sen. Kirsten Gillibrand (D-NY) that would have mandated the Defense Department tap the National Academy of Public Administration to examine the feasibility of creating a seventh, cyber-specific military service.

The House did not include the language in its draft of the National Defense Authorization Act, which likely hindered its chances of making it into the final text.

Gillibrand’s proposal comes after years of mounting bipartisan frustration over the long-running failure by the existing military branches to provide U.S. Cyber Command with personnel who are ready to fight foreign adversaries online. Concerns about those deficiencies have grown following the digital skirmishes seen in Russia’s war on Ukraine and the conflict between Israel and Hamas.

Pentagon brass have resisted the idea of creating a cyber service, arguing that Cyber Command is still maturing and such a move could cause confusion or, potentially, lead the other services to write off the digital mission altogether.

“For people who think the cyber service is the answer to our current challenges in cyber personnel management, be careful what you wish for,” Mieke Eoyang, deputy assistant secretary of Defense for cyber policy, told reporters at a Defense Writers Group meeting in September.

“We need to understand what the pros and cons are,” she said. “The question is, which set of problems are we willing to live with and taking a look at all these things to understand that better before we throw out what we have in favor of something else or decide actually what we have needs to be fixed or there’s something else completely.”

Eoyang said DoD will weigh the viability of creating an independent Cyber Force due to a provision in last year’s defense policy roadmap that required the department to examine “the prospect of a new force generation model” for Cyber Command.

“We’re going to study the question and we’ve been directed to do that, as you know, we have this … study, which tells us to look at our model and current and alternate models. We’ll certainly look at the question. We already have an effort underway to do that.”

The results of that congressionally mandated study aren’t expected to be delivered until next summer.

Mark Montgomery, the former executive director of the Cyberspace Solarium Commission, said while it’s “unfortunate” the outside appraisal was cut, the report “was not a requirement for Congress to take action.”

Lawmakers “can study the readiness rates of the individual services’ cyber elements and see that they're very inconsistent and generally unsuccessful in meeting an overall cyber operations force that is necessary for the United States,” said Montgomery, a member of the board of advisors for the Military Cyber Professional Association, which previously called for the creation of a Cyber Force.

Montgomery, who now heads the Center on Cyber and Technology Innovation at Foundation for Defense of Democracies, said the think tank would soon publish a paper on the merits of establishing a cyber military branch and predicted Congress would try to call for an independent assessment again in next year’s defense bill.

He also shrugged off the study Eoyang cited.

“This is the Department of Defense grading its own homework. So Congress has to put it through the prism of that,” Montgomery said. “Independent actors can do reports to help inform congressional decision-making. They don't have to be NDAA authorized.”