Army building a new expeditionary cyber battalion

The Army is adding more expeditionary cyber teams and creating a new battalion focused on cyber — a validation that the concept has proven its worth.

In late February, the Army Force Structure Transformation (ARSTRUC) plan directed the activation of two more so-called expeditionary cyber and electromagnetic activities teams (ETCs) in the 11^th Cyber Battalion — a total of 90 authorizations — rounding out that battalion and an additional 390 authorizations for ECTs to begin building the 12^th Cyber Battalion, Lt. Gen. Maria Barrett, commander of Army Cyber Command, said in an interview with DefenseScoop.  

“We’re doubling down on what the expeditionary [Cyberspace and Electromagnetic Activities] teams have been doing to date. I think that is a good sign,” Barrett said.

The battalion provides tactical, on-the-ground cyber operations (mostly through radio-frequency effects), electronic warfare and information operations. The unit consists of four companies with over 300 personnel total and five ECTs — scalable formations designed to augment units upon request.

They’re expected to maneuver with units, plan tactical operations for commanders and conduct operations on the ground.

The decision to expand the teams — and the overall concept — comes after what initially began as a pilot effort over six years ago to test how the Army could integrate tactical cyber and electronic warfare effects for brigades on the ground without having to rely upon the remote, strategic resources of U.S. Cyber Command, which are not only in high demand but, at the time of the pilot, limited in authorities to conduct operations.

According to Army Cyber, based on lessons learned over the last five years, the command has refined the operational concept of the ECTs to account for Army doctrinal and organizational changes, now accounting for employment in competition as well as crisis and contingency scenarios. That feedback has included real-world operations — such as when, in the run-up to Russia’s invasion of Ukraine in 2022, an ECT was sent forward to Europe to support the Army’s regional theater headquarters to provide subject matter expertise in electronic warfare, information operations, and defensive cyber and offensive cyber planning — lessons learned from Ukraine and other regions, over two dozen combat training center rotations, multiple Warfighter and theater-level exercises, and the Project Convergence experimentation series. As the ECTs continue to mature, ARCYBER will refine their concepts of operations to provide better support and consequential effects to commanders, according to a spokesperson.

Integration with Special Operations Forces and space forces is one of several operational use cases for the ECTs. Going forward, most use cases — particularly in conflict — for the ECTs will involve their placement with conventional combined arms formations to provide specialized EW and cyberspace effects against operational and tactical targets at corps and below, the spokesperson added. Other use cases could involve integration with space and special operations forces under what the Army dubs the modern triad, a play on the nuclear triad consisting of the combination of space, special operations and cyber to create a deterrent effect greater than the sum of its parts.

The Army continues to experiment with the concept and how those forces can augment or support the operations of a division, including Summit Strike, a first-of-its-kind home station training event for 10^th Mountain Division to test and train multidomain operations and capabilities that took place Nov. 19-21.

11^th Cyber Battalion participated in the event to better understand how it fits into a division fight and what targets it can assist to create effects against and provide tactics they can bring back for their own training objectives in the future.  

“11^th Cyber is a tactical cyber unit and that is a first-of-its-kind ability or effect that the Army has to call on. There’s a lot of question on how that unit would actually come and like support a division,” said Capt. Sean Thorpe, 10^th Mountain Division CEMA officer in charge for 10^th Mountain Division. “11^th Cyber is able to gain access to certain unique enemy capabilities that are always on the high payoff target list for a division. Things that we want to destroy, so that way the enemy isn’t able to use those so they can support their maneuver units. 11th Cyber gives us the unique capability of providing access to those things so that we can provide cyber effects.”

The Army is examining appropriate command relationships to ensure that Army Cyber can employ trained ECTs with appropriate intelligence and authorities in support of theater Army missions for joint force commanders throughout the competition continuum, according to a spokesperson.

When the new battalion comes online, Barrett noted it will likely be a carbon copy of what the 11^th currently does. The Army is examining holistically how it does electronic warfare, what that looks like at the edge and what kind of capabilities it needs. Similarly, it is taking a look at whether it needs to make any adjustments in the new battalion, but those are all pre-decisional.  

Building information forces

Barrett said that from Army Cyber’s perspective, the ARSTRUC’s directions came in two buckets: to finish building the first cyber battalion and building the Theater Information Advantage Detachment. The latter is one of three organizations being developed by the Army to synchronize information capabilities at the theater level: one in the Pacific, one in Europe and another that Army Cyber is focusing on transregional threats.

As part of all these builds, the ARSTRUC is sunsetting 1^st Information Operations Command, which provides information operations support and training.

“Taking the success of realizing that we do need information operations. We need to understand this environment. Commanders need to integrate information advantage as part of their scheme of maneuver, both in campaigning and in conflict, and have those forces ready to go and not small teams being deployed out as 1st IO was doing,” Barrett said. “Instead of [that capability] just being focused on the information operations disciplines, we’re now complementing them with, it’s cyber, it’s IO, it’s EW, it’s fires. Bringing all of those competencies together to create this just really composite effects in the theaters or, as we take a look at global from an Army Cyber TIAD standpoint, transregional challenges in the information environment.”