We Are All Cyber Airmen
The "Whole Airman Concept" isn't just about volunteering and education.
For as long as I can recall, the U.S. Air Force has pushed an idea called the "Whole Airman Concept." According to our doctrine, the Whole Airman Concept is about:
How Airmen adopt and internalize our core values.
How they devote themselves to the personal and professional development of their teammates and themselves.
How they promote esprit de corps in their unit and enhance community relations.
For most Airmen, this usually boils down to a couple of bullets on an Enlisted Performance Report that will typically break down to bullets about volunteer work and off-duty education.
In a world where end strength numbers continue to spiral down while mission requirements spiral up, much of the perceived "fat" has been sliced from vital support functions. These functions have often been taken for granted, yet touch every Airman's life, including personnelists, finance technicians, logisticians, and communications technicians. As a result, I prefer to see the modern "Whole Airman Concept" less about what an Airman does off-duty, and more to how each must clumsily perform all of their own support functions. As the modern Air Force forges a path ahead to pioneer both offensive and defensive cyber capabilities, we need to relook at how we have over-specialized our Airmen instead of intentionally creating those "Whole Airmen" and baking it into our ethos.
In other services, when an E-7 tells and E-4 to do something, it's executed. There will be some grumbling and shuffling, and it may not be pretty, but the job gets done. I've seen this multiple times throughout my career, making it tempting as I have climbed the enlisted ranks to go lord over my joint partners like a petty tyrant. Our Airmen - good or bad - are very different. As I recently discussed in my article, What is an Airman?, Airmen identify as their career fields by default. The next time you're in an airport and see someone you think is a Marine, ask them what they do. I'll bet you they respond with "I serve in the Marine Corps" or something similar. Ask an Airman the same thing, and you'll hear an extensive breakdown of the occupational specialty.
As a result, the feedback I consistently hear from my joint partners is how they have a love/hate relationship working with our younger Airmen. On the one hand, the consistent level of intelligence and autonomy most Airmen bring when asked to work their craft is unparalleled. On the other hand, an Airman will rarely blindly follow an order, instead preferring to ceaselessly ask, "why?" If it fails to satisfy, most Airmen will simply respond, "that's not my job."
That's not my job.
Think about how that sounds. Now imagine an Army Sergeant Major (E-9) hearing that from a young Air Force Staff Sergeant (E-5). It's not a good look for our Air Force in the joint community, but it also speaks to an unnecessary siloing of skills and understanding without our own force. I encourage questions at the right time or place, but at a certain point, the questions stop, and we have to move forward. In the Air Force, we have a few specifically trained fields in combat arms, yet we are all given a basic level of marksmanship training. If our forward operating base was under attack, could you imagine a personnelist getting asked to cover a fighting position with their M4 carbine retorting, "that's not my job"?
What is an Airman?
I opened the discussion a few weeks ago, but let's further unpack the idea of an Airman, starting with my idea of the Whole Airman Concept. While I started with the idea that it was a bit of a joke in the face of dwindling support Airmen, I have grown to believe that it's important for Airmen to understand functions outside of their career field; notably, support functions that directly impact their ability to maneuver and work. I have worked hard to learn the jargon of our logisticians to help move my teammates and equipment around the world. I have strived to understand the archaic language at the bottom of my monthly Leave and Earnings Statement (LES) to understand better my Airmen's entitlements and when something needs to be corrected. I work hard to wrap my mind around our various personnel management systems and their unique codes and processes. And sometimes - when asked - I pick up my weapon and man a fighting position. With all of these hard-earned administrative skills, I have become more effective at interfacing with the skeleton crews of outstanding technicians who continue to perform these daunting and often thankless tasks while helping to offload some of their work.
What is an Airman? It's whatever my Air Force, my teammates, and my joint/interagency partners need of me to execute our mission and deliver devastating airpower to our nation's enemies. In addition to our air domain, I need to understand how we can forge teams with our joint partners to influence the sea, land, and space domains... and now the cyber domain.
Every Airman a Cyber Airman
While I've spoken on the importance of understanding many other support functions, one that touches our lives every day, yet goes unheralded: the services supported by our communications Airmen. These folks are asked to do a wide range of incredibly technical jobs to keep our networks securely running while (often) under-resourced, undermanned, and saddled with regulations written by people who still need help opening their e-mail on a phone or figuring out why they shouldn't click on random links in those e-mails. We all should be backing them up; the future of our mission demands it.
Each element of my Whole Airman Concept is important, but the idea that we're all cyber Airmen is right at the top. While a junior non-commissioned officer may look at their LES once per month (or less), how do they view it? Via a network. When they need to update something about it, how do they usually send that information out? Via a network. In the age of COVID-19 and teleworking, what are we utterly dependent on to execute our mission? Our networks. This is why I demand our Airmen become as savvy as possible to how networks work and how to operate safely and productively on them. Importantly, this isn't just about Air Force networks; my personal watch, cell phone, laptop, and car are all producing exploitable data while I am on duty.
Do you park in a particular location every day? Keep your phone (with its bundle of microphones, cameras, and motions sensors) with you? Do you leave it in your car or a lockbox? What kind of smart home functions are you using? What are you doing to mitigate the exploitation of any of these innocuous sensors? All of these are exploits waiting to happen, even if you haven't installed Tik Tok (also, please don't install Tik Tok). All of this happens well before an Airmen inserts their Common Access Card an accesses an official Air Force network.
In 2014, the Crimea in Ukraine was invaded by so-called зелёные человечки or "little green men." Russian authorities attempted to play these off as local separatists, etc., but savvy watchers knew better. One of the most significant unintended pieces of evidence that it was Russian special forces (and not local separatists) was activity on their social media accounts. Despite removing their flags and insignia (and the appropriate legal authority and accountability for their actions), the Russian government's direct role became apparent because their troops have not yet embraced the idea that they're cyber warriors as well.
Each of us stands to be a risk to our service and our mission if we do not quickly learn to adapt to this new landscape and train accordingly. Like many other vital functions, we cannot afford to roll back on our heels and declare, "this is not my job."
So how do we embrace this and indoctrinate it early? First, we need to address our culture and challenge the assumption that younger generations are somehow more savvy and comfortable with technology. I recently had a young Airman who had to be walked through the process of writing his first e-mail and understanding what the CC line was for. We also need to challenge the older generations still serving who throw up their hands and say, "I'm just not good at this stuff." No self-respecting member of the profession of arms would dare suggest that they aren't competent at their technical specialty, core leadership skills, or marksmanship; we shouldn't accept any different with cyber skills.
Additionally, we need to attack the issue earlier, starting with basic military training and a hands-on cyber fundamentals course. While it adds significant complexity, requiring trainees to wait until their technical training to learn about things like e-mail from personnel who may not fully understand, it is far too late. Additionally, it's all trial-and-error learning while "on the job" with little deliberate development other than a single computer-based training (CBT) course required annually that is the butt of many jokes. An initial skills course that addresses both military networks and personal devices is essential.
Finally, we need to place a greater focus on critical thinking skills across the force. While the intelligence fields have started aggressively pursuing more critical thinking training in recent years, too many others are left in the dark. Cyber operations include more than just malicious software; they include information operations, such as the kind we gleefully fall for on our social media networks every day. While the individual effects may seem mild and limited, they can be devastating when aggregated.
To me, the Whole Airman Concept is about more than volunteerism and self-development; it's about deliberately stepping into roles that Airmen would expect other dedicated career fields to support. Our Air Force doesn't need us to be experts! We still have some folks dedicated to these tasks, but we should each strive to become competent enough that we only bring the hard problems to our support technicians. Nowhere is this more apparent and important than in the cyber domain. Our activities on both our military networks and our personal devices expose our missions to significant risk, creating significant avenues for exploitation, manipulation, and destruction.
We need to start by addressing the culture and our assumptions about how both the young and old handle information technology. We need to integrate hands-on cyber fundamentals training earlier in an Airman's career. We need to build valuable critical thinking skills. While these are hardly the only solutions, I believe making progress in these three steps will make us less vulnerable in this emerging domain while enhancing our capacity for lethality. In short, we need to fully embrace the idea that we are all cyber Airmen.