Cyber-strategy competitions helping develop future leaders

WASHINGTON -- A surge of cyber activity worldwide has forced DOD to identify cyberspace as an operational domain and Chief of Staff of the Army Gen. Mark A. Milley said the first shots of the next war will likely be fired in cyberspace with devastating effects.

In an effort to cultivate future leaders and their understanding of cyber strategy, the U.S. Military Academy fields a cyber-policy competition team.

The team participates in the Atlantic Council's Cyber 9/12 Strategy Challenges and other cyber competitions. This helps reinforce the current curriculum on strategy and policy, said Maj. Patrick Bell, assistant professor with the Department of Social Sciences at West Point.

"We provide these opportunities to cadets to try and tackle those policy issues, and set the groundwork for successful cyber officers -- or any officer -- since policy skills translate from one discipline to another," Bell said.

THE SCENARIO

A typical competition scenario had five airports struck by ransomware attack, disrupting operations and forcing flights to be delayed, canceled, and diverted. The attack was similar to a malware attack at a European airport last month. No group has claimed responsibility, and the cause of the attack remains unknown.

Additionally, the airline industry lost 8 percent in market-share value as the result of the alleged terrorist attacks. However, financial organizations noticed some questionable market activity from compromised accounts, targeting specific airlines and generating upward of $7 million.

In response, citizens resorted to social media -- sharing their panic as they feared for the safety of their loved ones. Adding to the chaos, terrorists created fake social media accounts and started posting photos of downed aircraft, demanding that the ransom be paid in full.

CHALLENGES FACED

Although the aforementioned scenario was fictitious, the threat of a cyberattack is more than real and could have worldwide implications, according to Atlantic Council officials.

"During a cyberattack, [responders] have to look at how suppliers are impacted. What is the public trust and how is economics involved? And what role does this have on potential elections?" said Cadet Amanda Roper, a third-year computer science major at the United States Military Academy at West Point.

"Cyber impacts everything. I think that's the most important part. You can't look at cyber as isolated from the rest of the world," she added.

Overall, initiating a "perfect" response to a cyber incident is near impossible, Bell said.

"Our cyber officers need to be technically competent, but they also need to have that broad view and see how cyber policy fits into the larger picture," he said.

Additionally, correctly attributing the source of an attack can be difficult, especially when an actor is capable of moving through different networks and infrastructure, said Capt. Erik Korn, a research scientist with the Army Cyber Institute.

"Attributing a cyber incident can be muddy." Korn said. "For example, during the most recent Olympics, an actor was allegedly using the same technique as another advanced persistent threat.

"This paints the picture of how difficult attribution can be, especially if there's an actor who is trying to insight misattribution on purpose," he added.

LEVERAGING CYBER STRATEGY

The Cyber 9/12 Challenges are designed to provide students across various academic disciplines with a better understanding of the policy challenges associated with a cyber crisis and conflict, according to Atlantic Council officials.

"I believe that the first shots could very well be fired in the cyber domain," Roper said. "However, my rationale is that we have poorly defined what it means to be attacked. By ensuring that our policies are in place, we can set up the framework for better offensive and defensive capabilities to be used.

"We have to have the framework underlying everything to be able to fully implement the incredible new tools and technologies that are being developed each day," she added. "That is why I believe cyber policy is so critical, and it is a major area of focus as we move into this new era."

Each cyber challenge combines an interactive learning experience with a competitive scenario exercise. Moreover, each event requires teams to respond to a "realistic, evolving cyberattack and analyze the threat it poses to national, international, and private-sector interests," according to Atlantic Council officials.

"The competition forces you to be able to think on your feet and understand why you are taking the actions that you are," Roper said. "The amount of knowledge and attention that is being paid to cyber policy, and how we can best prepare ourselves against cyber threat, is stunning."

In addition to West Point, the Air Force Academy, the Naval Academy, Naval War College, and National Defense University have fielded teams to compete against other students from universities in the U.S., Europe, Middle East, and Indo-Pacific.

During the past year, "Team Black Knights' have won Cyber 9/12 Student competitions in Geneva, Switzerland, Sydney, Australia, as well as been finalists in Washington D.C. and New York City

"The Army [and the cyber branch] has a lot to offer. We are fighting for America. We are fighting for all of the ideals that we as a nation possess. It's very selfless, and we train each other to be the best that we can be," Roper said.