Turning Cyber Command Loose

An article in The Hill yesterday made me shudder.  [ Week ahead: Lawmakers divided over Pentagon's cyber unit, at http://thehill.com/policy/cybersecurity/282133-week-ahead-lawmakers-divided-over-pentagons-cyber-unit ].  The debate between the House and Senate have split the versions of the National Defense Authorization Act, in part, on Cyber Command being independent of its parent command at StratCom.

I have a great fear of Cyber Command because its reach far exceeds its grasp.  DoD has published a policy that describes the scope of what Cyber Command would be taking over in Department of Defense Instruction NUMBER 8530.01 March 7, 2016. It includes such things as private contractors of the Defense Department, network service and cloud providers, and anything DoD.  That far exceeds any mandate for a Combatant Command and certainly gets us into some clearly debatable issues on the authority of a military in law enforcement and security of civilian functions.  They certainly do not belong there unless it relates to Nuclear Command and Control or the White House National Command Authority.

We went through this 7 years ago with the same people.  They never give up;  they never stop expanding their empire, until Congress says to stop as it did the last time.  DoD can't even secure its own networks, and there is no way they can be expected to do someone else's Security.  The main problem is the alternatives.

Cyber Command is quick to tell us that there really is no alternative to their control of these network elements.   The track record of DoD security should be the measure of that.  This is similar to the national elections where we have two candidates that many of the people feel are not trustworthy.  The choice is between the two.  This is a false argument that is paper thin.  Cyber Command can't even make policy for the networks in DoD and get people to follow it.  We can have better security of the Federal networks, but it won't come from the military taking it over.  It is partly a budget issue.  Somebody needs to pay attention to what those security dollars are going to.  When the Army builds a golf course with the Cyber Security money, you have to wonder if it is possible for the military to take this function over.