Multi-Domain Intelligence Support for Sustainment

Multi-Domain Intelligence Support for Sustainment

Matthew E. Miller

“Your logistics lines and your lines of communications are going to be under intense stress, (and) the electromagnetic spectrum is going to be at least degraded if not completely disrupted.”

-- GEN Mark A. Milley, Chief of Staff of the Army[1]

Introduction

In the last 18 years of counterterrorism and counterinsurgency campaigns, sustainment unit’s intelligence sections have been “focused on protecting the convoys that carried supplies and equipment to the warfighter daily.”[2] This is a task intelligence personnel have performed since antiquity, identifying potential threats and analysing the enemy’s effort to attack friendly supply lines. Today, the threats to sustainment are changing as near-peer “adversaries have … expanded the battlefield geographically … multi-domain capabilities are less bound by geographic and time constraints.”^[3] Theater Sustainment Command (TSC) G-2 Intelligence Sections need to build a capability to identify multi-domain threats to logistics, which may or may not emanate from the combat theater.

One historical axiom of battle is desire of commanders to destroy or cut-off the enemy’s supply lines. Today, technology offers the enemy the ability to target supply-lines from an adjacent state or the other side of the globe. Russian and Chinese counterspace strategies, offensive electronic warfare (EW), and offensive cyber capabilities can jam, spoof, exploit, or destroy space-based reconnaissance and communications platforms preventing U.S. mission command.^[4] These offensive technological capabilities, based in the electromagnetic spectrum, have the potential to frustrate or confound theater-wide sustainment operations. Consider the consequences of the wrong munitions delivered to an U.S. ground task force at the culmination of a conventional battle or the joint precision aerial delivery system delivering a special operations units resupply to the enemy. Was the ‘mistake’ human error or an enemy cyber unit inside a logistics computer network? The TSC G-2 section needs to have an understanding and the ability to identify multi-domain threats to advise the theater sustainment commander.

The Center for Army Lessons Learned Handbook 18-28, Operating in a Denied, Degraded, and Disrupted Space Operational Environment: Lessons and Best Practices, recommends Army units Prepare, Recognize, React, and Report for any attacks against space-enabled assets.^[5] In this type of environment, the G-2 section’s responsibility is to ‘Recognize’ and ‘Report’ indicators and warnings of electromagnetic effects, recognize them for what they are, and not mistake them for a computer glitch or human error.  If the attacks can be recognized in the ‘disrupted’ phase, the potential for mitigation or counterattack increases, which reduces the likelihood of avoiding a ‘denied’ environment.  A denied environment means theater-wide sustainment will done by hand with pencil and paper.

Intelligence Support of Sustainment Functions

In recent years, there have been several articles examining intelligence support to sustainment at the tactical level, but little mention of intelligence support at the theater level.[6] Multi-domain attacks on sustainment functions can be employed during all levels of conflict from peacetime humanitarian operation to counterinsurgency, and potentially most dangerous in near-peer conventional conflict.  Sustainment functions—base development, theater opening, reception, staging, onward movement, and integration—are key throughout the spectrum of conflict and all subject to an electromagnetic or cyber-attack.[7] Military intelligence personnel assigned to TSC G-2 sections need understand and recognize the effects of non-traditional threats during preoperational planning and throughout an expeditionary campaign.

The Department of Defense, Dictionary of Military and Associated Terms defines a campaign as “a series of related operations aimed at achieving strategic and operational objectives within a given time and space.”[8] The five sustainment functions play a significant role in supporting the deployment, scale, and duration of any campaign in peacetime or war. In recent deployments, the Expeditionary Sustainment Commands (ESC) intelligence section and its subordinate brigade intelligence sections have handled security manager functions and the difficult challenges of tactical intelligence support to logistics to include attacks against the staging of supplies, logistics bases, and convoy route security.  At the TSC G-2, level there is a need for a dedicated effort to increase awareness of indicators and warnings of the effects of cyber, EW, or counterspace operations against this expeditionary supply-chain.

Intelligence support to sustainment does not “conduct lethal targeting, nor do they own any organic intelligence, surveillance, and reconnaissance assets.”^[9] Additionally, they are not responsible for securing computer networks from cyber-attack, negating the impact of enemy counterspace systems, or countering adversary EW.  The responsibility of intelligence is to identify enemy capabilities, search for these often-disparate indicators and warnings of enemy actions, advise the commander, and share the information with those who need to know.[10] These indicators and warnings of the enemy’s use of cyber, EW, or counterspace activities may not be theater-wide, but targeted against different sustainment functions in different locations. What looks like a broken Blue Force Track in one convoy might be one piece of a pattern of use against the varied elements of the theater-level supply chain.

This emphasis on importance of theater level intelligence support to the TSC commander is a reflection on the importance of the combat logistics chain. “In a theater area of operations, mission command of sustainment operations is the senior sustainment commander’s authority to direct all sustainment based on the sustainment priorities established by the combatant commander.”[11] Therefore, TSC G-2 Section needs to prioritize the analysis of enemy kinetic and non-kinetic capabilities to avoid the trap of an overemphasis on the tactical reports. Tactical analysis should instead be a priority at the ESC level, in order to free up intelligence analysis at the theater level for the multi-domain fight.  If possible, a dedicated ‘multi-domain intelligence cell’ should be established to focus on the theater-wide cyber, EW, and counterspace threats to help prevent the enemy from using the electromagnetic spectrum to cut our physical supply lines. 

Cyber and Electronic Warfare Threats to Sustainment

In 2017, the commander of U.S. Transportation Command, Air Force Gen. Darren McDew, noted in his PRISM 7 article, “Power Projection in the Digital Age: The Only Winning Move is to Play,” that “the adversary only needs to deny our ability to move the force by attacking our virtual lines of communication or injecting doubt into the system, causing us to question our operations or the integrity of our deployment data.”[12] If the enemy changed, corrupted, or simply deleted logistics data on the battlefield it would greatly amplify the confusion experienced in an expeditionary environment, which Clausewitz referred to as the ‘fog of war.’  In the DOD, parlance that logistics runs from the ‘factory to foxhole’ sustainment intelligence needs to train and exercise for threat from the cyber, EW, or counterspace activities. 

Russian cyber and EW capabilities are some of the most effective in the world and has demonstrated a willingness to use them across the spectrum of war. It must be assumed a near-peer, with similar capabilities, would target U.S. sustainment operations paring physical with electromagnetic and cyber-attacks. In recent years, Russia has demonstrated a capacity to employ these capabilities in the Georgian, Ukrainian, and Syrian conflicts.  In Crimea and Ukraine, Russia jammed and spoofed navigation satellites that incapacitated GPS for radios, phones, and even some drones.  It is likely Russia sees Ukraine, Crimea, and Syria as test grounds for its use of cyber, EW, and counterspace against any possible war with West.

China has highly developed cyber capabilities that it has used to ‘hack’ foreign governments networks to steal sensitive information.  A ‘hack’ or penetration of a sustainment network by an enemy could result in numerous nefarious outcomes. The ability of the TSC to serve as the sustainment integrator of the wide variety of units that support the logistics enterprise would be highly degraded with an enemy in the network. China’s EW and counterspace capabilities are also expanding and being tested in places like the South China Sea.[13] Both Russia and China have developed and tested cyber, EW, and counterspace capabilities and currently reside in both countries’ arsenals.

Other Vulnerabilities to the Logistics Chain

Cyber, EW, and counterspace threats to sustainment functions are not beholden only to near-peer actors.  The robust means to jam communications, integration functions, and conduct cyber-attacks already exist in smaller states and some terrorist groups, such as Islamic State group, due to the relatively lost cost of these capabilities. Small states and non-state actors might not be sophisticated enough to compromise a U.S. sustainment computer network, but the U.S. military does not go to war alone. What about our coalition partners or commercial logistics providers that make up the ‘factory to foxhole’ network?

According to U.S. TRANSCOM, roughly 50 percent of wartime transport capability comes from commercial industry. In theater, commercial logistics firms have played an essential role in the last 18 years of armed conflict. These non-DOD entities poses a vulnerability. These potential coalition and commercial industry partner vulnerabilities could send theater sustainment functions into chaos without ever breaking U.S. networks.  Commercial truck convoy’s GPS spoofed routing them into an ambush could be disastrous and offer the enemy a propaganda victory. As noted earlier, the protection of these systems, DOD or otherwise, is not the role of the TSC G-2 Section, but it is responsible of the G-2 to cognizant of indicators and warnings of these capabilities in its area of responsibility.

Conclusion

Offensive cyber, EW, and counterspace operations against sustainment enterprise could create a ‘shockwave’ across the theater of operations. The TSC G-2 sections need to emphasize analysis and collection against these multi-domain threats to the sustainment forces from both inside and outside of theater. Leadership should emphasize the pre-deployment training of analyst in cyber, EW, and space-based threats through formal training such as the Army Space Cadre Course and Electronic Warfare Integration Courses.  Training in cyber indicators and warning is available to intelligence analysis and should be pursued aggressively in coordination with the unit’s G-6 Information Technology section.

Additionally, the intelligence section should embrace the Army’s recommendations to exercise operating in a denied, degraded, and disrupted environment by including indicators and warning of cyber, EW, and counterspace effects into staff and field exercises. The TSC G-2 section needs a ‘multi-domain intelligence cell’ with trained intelligence analysis to understand and identify cyber, EW, and counterspace threats. This will ensure the theater sustainment commander can effectively maintain mission command over sustainment functions.

End Notes