Multi-Domain Information

Operations and the

Brigade Combat Team
Lessons from Cyber Blitz 2018
Maj. John P. Rodriguez, U.S. Army

M ulti-domain operations is the Army’s new

future fighting concept, but what does this
mean for the brigade combat team (BCT)?
Cyber Blitz 2018 attempted to answer this question
with a focus on identifying how a BCT integrates
cyberspace operations, electronic warfare (EW), intel-
ligence, and information operations (IO) to conduct
operations across multiple domains, the electromagnet-
ic spectrum (EMS), and the information environment
against a regional peer.1 Cyber Blitz demonstrated

MILITARY REVIEW July-August 2019 33

the promise of BCT-level multi-domain operations. The Army must field formations at various echelons
However, it also showed that the Army must ensure capable of operating across multiple domains. The Army
the proper doctrine and staff organization to reap the cannot allow multi-domain convergence to occur only at
full benefit of multi-domain operations. The perceived the corps level or above. General purpose Army maneu-
divide between IO and cyber-electromagnetic activities ver units must also be able to fight in a multi-domain
(CEMA) is a major unresolved challenge. Many par- fashion to win against near-peer threats. Even if higher
ticipants did not embrace the doctrinal view that IO echelons retain control of some national-level assets,
functions as the integrator and synchronizer of infor- select multi-domain capabilities must be pushed down-
mation-related capabilities (IRCs), including CEMA, ward. More importantly, units at the tactical edge must
to affect an adversary’s decision-making. A narrow fo- be thinking in multi-domain terms so they can appropri-
cus on CEMA and a limited view of IO could increase ately plan for outside support just as BCTs incorporate
stovepipes and prevent synchronized multi-domain air assets into planning.
operations. One solution to make BCT multi-domain
operations more effective is to restore the IO officer Cyber Blitz 2018
position on the brigade staff and place more emphasis Through Cyber Blitz, which is a series of exper-
on the role of IO as an integrator at brigade level. iments co-led by the Communications-Electronics
Research, Development and Engineering Center
Multi-Domain Operations (CERDEC) and the Cyber Center of Excellence, the
The U.S. Army in Multi-Domain Operations 2028, Army is bringing multi-domain operations to the
released on 6 December 2018, describes the Army’s tactical level. The experiments inform how the Army
concept for how to win future wars against near-peer can employ CEMA and IO across the full spectrum of
competitors.2 According to the “Summary of the 2018 Army doctrine, organization, training, material, lead-
National Defense Strategy,” the joint force faces a more ership and education, personnel, facilities, and policy.5
complex security environment “defined by rapid tech- CERDEC conducted Cyber Blitz 2018 at Fort Dix, New
nological change, [and] challenges from adversaries in Jersey, over three weeks in September 2018.
every operating domain.”3 Gen. Joseph Dunford, the Cyber Blitz adapted the decisive action training
chairman of the Joint Chiefs of Staff, wrote that “the U.S. environment used in other Army training environments.
military’s long-held competitive advantage has eroded” CERDEC modified the scenario to increase adversary
as adversaries have adapted to counter U.S. capabilities.4 cyberspace and EW capabilities as well as to adapt the
The central idea behind multi-domain operations is that scenario to Fort Dix terrain. The scenario was set in
Army formations, as part of the joint force, must be able 2025 to test emerging technologies, some still in research
to fight across all domains (land, maritime, air, space, and and development, and to experiment with force design
cyberspace), the EMS, and the information environment. updates and delegation of authorities. The experiment
Due to resource constraints and more dangerous adver- occurred in the friendly nation of Atropia, which was suf-
saries, Army formations must maximize every capability, fering from a separatist insurgency. Ariana, a neighboring
synchronize operations across domains, and mass at the country, supported the separatists and threatened to in-
decisive point to win future battles. tervene with conventional forces. Most participants were
familiar with the decisive action training environment
scenario, which allowed them to focus on the CEMA and
IO aspects of the scenario during Cyber Blitz.
Previous page: A soldier participates in Cyber Blitz 2018 on 21 The 3rd Infantry Brigade (Patriot Brigade)
September 2018 at Joint Base McGuire-Dix-Lakehurst, New Jersey.
The Cyber Blitz exercise helped inform the Army on how to employ Combat Team of the 10th Mountain Division provid-
evolving cyber-electromagnetic activities and information operations ed the core of the forces for Cyber Blitz. The brigade
during multi-domain operations. The series of experiments examined formed an organic EW platoon by consolidating
how the integration of cyberspace, electronic warfare, intelligence,
EW personnel from throughout the brigade to test a
space, and information operations could help a brigade combat team
gain and maintain the advantage against a regional peer adversary in a force design update. Additional personnel attached to
decisive action training environment. (Photo by Steven Stover) the brigade rounded out the signal staff and the EW

34 July-August 2019 MILITARY REVIEW

 CYBER BLITZ 2018

platoon. An IO officer and a cyberspace planner also separate IO section including a civil affairs (CA) captain
augmented the brigade staff. and a psychological operations (PSYOP) sergeant first
The primary external support to the brigade was the class, who respectively planned operations for the CA
expeditionary cyber team (ECT), which contained both and PSYOP elements notionally attached to the brigade.
offensive cyberspace operations (OCO) and defensive The brigade public affairs officer was also part of the IO
cyberspace operations personnel as well as an IO plan- section for all practical purposes. Additionally, the IO
ner. The ECT had the capability to conduct remote section assumed responsibility for deception and opera-
operations and close target reconnaissance. The division tional security (OPSEC) planning.
retained operational control of the ECT during the Dividing IRCs into two separate sections made
experiment. However, the brigade was able to request cy- integration more difficult. The brigade treated the
berspace effects from the ECT through the division. The IO section and CEMA section as separate but equal
ECT conducted multiple missions for both the division entities. This meant CEMA and IO equities only
and the brigade throughout Cyber Blitz. formally converged at the brigade operations officer
The experiment almost entirely simulated maneuver (S-3), creating a situation ripe for fragmented and
forces while primarily conducting CEMA activities live disjointed planning. Therefore, the IO officer worked
with supplemental simulations. The ECT conducted cy- through the S-3 to develop overarching IO concepts
berspace operations live on networks simulating the global of support to nest CEMA efforts with other IRCs.
internet and the brigade Secret Internet Protocol Router Fortunately for the S-3, the nature of Cyber Blitz,
Network. CERDEC emplaced a range of emitters simulat- with its dictated scheme of maneuver, allowed him
ing enemy, friendly, and neutral emissions on various Fort the time to focus on incorporating CEMA and other
Dix ranges. This allowed the EW teams to detect, charac- IRCs into the plan. The IO officer was also able to
terize, geolocate, and jam a variety of signals. exert influence over the CEMA section due to his
The brigade’s mission was to secure the area of op- or her rank and experience despite having no formal
erations (AO) and defeat enemy conventional forces to authority over the section.
protect an adjacent unit AO.6 The brigade’s scheme of
maneuver began with an air assault to secure an airfield Information Operations at Cyber Blitz
and was followed by the buildup of combat power via The brigade successfully integrated and synchro-
air landing. After this, the brigade planned to secure key nized IRCs to support its scheme of maneuver through-
infrastructure in the sector and establish a defense. out Cyber Blitz. Beyond
The experiment planners dictated the scheme of individually supporting Maj. John P. Rodriguez,
maneuver, and the staff did not have to conduct detailed the scheme of maneu- U.S. Army, is an in-
planning for the movements of the maneuver battalions. ver, the brigade’s IRCs formation operations
This simplified the task facing the brigade staff and freed often worked together officer in the Maryland
them to focus on integrating CEMA into their maneu- in a mutually supportive Army National Guard
ver plan. The brigade also planned to defend against manner achieving synergy. assigned to Plans and
enemy multi-domain operations. The brigade staff con- During an early phase of Policy Division, Intelligence
ducted an abbreviated military decision-making process the operation, the IRCs Directorate, the Joint Staff.
during the first week of Cyber Blitz. The deputy brigade focused on supporting an He holds a BA from Mount
commander directed the staff to include CEMA and IO air assault. Later, when the Saint Mary’s University and
to the maximum extent possible. enemy launched a pow- an MA from Georgetown
The brigade possessed multiple IRCs, but the or- erful attack with both con- University. He served as
ganization of the staff split the IRCs between various ventional and insurgent the director of information
sections (see figure, page 36). The brigade EW officer, a forces, a preplanned multi- operations for Combined
captain, served as the brigade’s CEMA chief and an EW IRC response delayed the Joint Task Force–Horn of
warrant officer and master sergeant supported her. The attack and added friction Africa from 2017 to 2018
cyberspace planner attached to the brigade nominally into enemy mission com- and participated in Cyber
worked for the CEMA chief. The attached IO major led a mand networks. Blitz 2018.

MILITARY REVIEW July-August 2019 35

 Deputy brigade
commander
O5

Personal staff

Staff judge advocate Public affairs officer

O3 O4

Intelligence (S2) Operations (S3) Signal (S6)

O4 O4 O4

Brigade intelligence Brigade aviation Fires Cyber-electromagnetic Information

support element element W3 activities operations
W2 W2 O3 O4

Military information
Cyber Electronic warfare Civil affairs support operations
O3 W2/E8 O3 E7
(Figure by author)

Figure. Cyber Blitz Brigade Headquarters Organization

Initially, IO focused on supporting the brigade’s PSYOP forces to influence broader target audiences and
decisive operation, an air assault to seize the airfield at reinforce MISO messages delivered with other means.
Objective Desoto, located in the eastern portion of the The feint did not give the enemy a windfall; instead, it
AO. The deputy brigade commander sought to prevent presented the enemy with many different pieces that
the enemy from massing combat power against the air pointed to the decoy landing zone. The PSYOP planner
assault since it would take multiple lifts to get the whole also attempted to use EW platforms to deliver MISO
assault force on the objective. The IO officer used OPSEC messages, which was initially unsuccessful. In a later
as the construct to synchronize the IRCs. The overarch- phase of the experiment, EW and PSYOP overcame
ing concept was to protect the timing and location of the these hurdles and did disseminate MISO messages with
air assault. Ideally, this would cause the enemy to misallo- EW capabilities. EW also provided effects in the EMS
cate forces, but at a minimum, the goal was to disrupt en- to produce a signature consistent with an air assault and
emy decision-making to prevent the enemy from massing to degrade enemy collection assets and communication
combat power against the air assault. links that could discover or report on the feint.
The IO concept had two overlapping phases. The first The second phase was direct support of the actual
phase was a feint to make the adversary believe the main air assault. Both EW and OCO attempted to disrupt
friendly attack was occurring in the western portion of enemy command and control on the objective and
the AO. This required multiple mutually reinforcing el- along the air corridor. The effects were overlapping to
ements. An airfield was located just outside the brigade’s provide redundancy. This proved fortunate because
western boundary, which provided a realistic objective some capabilities were unable to achieve the desired
for the feint. There were also suitable landing zones in effects. However, staff swiftly communicated the
the vicinity of the false objective. EW, PSYOP, and OCO setback, and other assets achieved the desired effects.
forces supported the feint. In addition to disrupting en- The results were seamless for the assault force.
emy communications, OCO delivered military informa- The enemy began a multi-domain attack during a
tion support operations (MISO) messages. This allowed later phase of the operation that stressed the brigade’s

36 July-August 2019 MILITARY REVIEW

 CYBER BLITZ 2018

defenses. The enemy initiated insurgent attacks and enemy with a more complex challenge and prevented
popular uprisings as an enemy motorized rifle brigade the piecemeal employment of IRCs. The feint presented
began advancing. Enemy unmanned aerial systems observables in multiple ways, including the EMS and
and electronic attack platforms supported the advance social media, which targeted various conduits to enemy
and degraded friendly mission command. The enemy decision-makers. The feint was more likely to convince
also attempted to disrupt critical infrastructure with the decision-makers because it used diverse observables.
OCO. This presented the brigade with multiple di- The brigade’s counterattack created more friction
lemmas. The situation became dire when enemy OCO for the enemy because it combined OCO and PSYOP.
penetrated the brigade network as enemy forces began A purely OCO attack on enemy command networks
to pressure the brigade’s screen line. would have had limited effects because it would have
The brigade executed a preplanned IO counterattack been a singular execution. Instead, the brigade’s actions
to delay the enemy advance. This allowed the signal staff continued for the remainder of the fight as OCO con-
to reestablish the network and the infantry battalions to tinued delivering MISO messages. Additional MISO
finish preparing their defensive positions. The counter- executions, not exclusively delivered by OCO, extended
attack began with OCO against enemy mission com- the duration of the effects and exploited every oppor-
mand networks. OCO corrupted the integrity of the en- tunity provided by enemy missteps. Furthermore, this
emy systems and delivered MISO content. This induced counterattack was critical because it occurred at a deci-
friction into enemy decision-making, and the confusion sive point in the battle. The brigade identified the enemy
caused the enemy to make mistakes. PSYOP elements mission command network as a high payoff target during
exploited the enemy blunders with additional MISO mission analysis and the ECT gained access early in the
messages to degrade cohesion and increase rifts be- battle. The deputy brigade commander held this capabil-
tween enemy conventional and insurgent forces. OCO ity in reserve so he could use it for maximum effect. His
continued attacking the mission command network and patience carried risks because the ECT could have lost
delivering MISO messages for the rest of battle. access in the interim, but in this case, it paid off.

Information Operations Lessons from The Bad

Cyber Blitz 2018: The Good The biggest obstacle to effective IO during Cyber
The two most important lessons from Cyber Blitz Blitz was that many participants and observers did not
2018 are the importance of information operations embrace the doctrinal definition of IO. Joint Publication
to conduct multi-domain operations at the BCT level 3-13, Information Operations, defines information oper-
and how an antiquated view of IO impedes unified ations as “the integrated employment, during military
multi-domain operations. The brigade’s operations were operations, of information-related capabilities in con-
much more effective because the staff integrated and cert with other lines of operation to influence, disrupt,
synchronized all available IRCs to affect the enemy’s corrupt, or usurp the decision-making of adversaries and
decision-making. The BCT faced a multi-domain threat potential adversaries while protecting our own.”7 Many
throughout Cyber Blitz and responded in a multi-do- did not view IO as an overarching function that integrat-
main manner. The brigade achieved speed because ed all IRCs including CEMA. Instead, they treated IO as
it could plan and execute operations without always something separate and distinct from CEMA. While the
relying on outside support. However, this success oc- new multi-domain operations concept advocates chang-
curred in spite of the brigade’s staff organization and the ing IO to information environment operations, it still
framing of IO’s role in the experiment. emphasizes IO/information environment operations’ role
During the air assault, the IO concept of support of synchronizing IRCs to achieve effects.8
served to provide unity of effort across the IRCs allowing The framing of the experiment reinforced the sepa-
the brigade to mass effects. The IO approach ensured ration between CEMA and IO. The problem statement
the IRCs were mutually supporting and identified for the experiment was “how does an IBCT with external
opportunities for IRCs to collaborate, such as OCO and support in 2025 integrate cyberspace, electronic warfare,
EW delivery of MISO messages. This presented the intelligence, space, and information operations to gain

MILITARY REVIEW July-August 2019 37

and maintain the advantage in multi-domain operations have missed many opportunities to multiply the effect
against a regional peer?”9 The brigade leadership had of operations without a unified concept. The IO officer
limited IO or CEMA experience, so this phrasing shaped also ensured the incorporation of OPSEC and deception
how they approached their task. Their initial inclination into planning. These are critical IRCs and can be great
was to ask in turn what each cyberspace operations, EW, approaches to frame an integrated IO plan.
and IO could do to support a phase of the operation. This The Army should consider putting an IO officer
approach increases the risk of disjointed approaches that back in the BCT. As brigades gain more IRCs and
do not mass effects on the enemy. cyberspace operations increase supporting echelons be-
Many participants seemed to believe IO focuses low corps, the importance of an IO planner in the BCT
solely on themes and messages. This leads to pushing will grow. Providing an OPSEC- and deception-trained
IO to concentrate on social media and publicly avail- IO officer will also ensure the routine incorporation
able information, which, while important, are not the of OPSEC and deception into operations. A BCT that
only spaces IO should operate in. The old concept of does not plan for multi-domain OPSEC will increas-
inform-and-influence activities, which specifically ingly be vulnerable against near-peer adversaries with
mentioned themes and messages in its definition, may advanced collection capabilities.
explain this belief.10 This is a very human-centric ap- A division IO officer, or one in an ECT, is no sub-
proach drawing lessons from the last seventeen years of stitute for an IO officer within the brigade. It is ideal to
counterinsurgency operations. But IO must also focus incorporate IO into military decision-making pro-
on enemy mission command networks as the joint force cesses from the start and the best way is an IO officer
focuses more on great power competition. on staff. A division IO officer will likely only have an
A reduced view of IO’s role means the onus to inte- opportunity to inject ideas late in the decision-making
grate the IRCs falls on the S-3 if the IO officer in not em- process when path dependency may have already set
powered to do so. In Cyber Blitz, the organization of the in. Similarly, the IO planner in the ECT was ineffective
staff meant the S-3 was officially fulfilling the IO officer’s at influencing BCT plans during Cyber Blitz. Mission
primary duty of integrating and synchronizing the IRCs. command relies upon trust to speed decision-mak-
If the experiment had not dictated the scheme of maneu- ing and ensure we seize and retain the initiative.
ver, the requirement to coordinate both traditional fire Unfortunately, it is very difficult for brigade leadership
and maneuver and IRCs likely would have overwhelmed to trust a planner outside their organization, especially
the S-3. This would degrade synergy and result in di- if they are using capabilities new to brigade leadership.
minished effects on the enemy. However, even if Army An IO officer should lead a consolidated information
leaders embrace an expansive role for the IO function, the warfare section within the S-3. The information warfare
S-3 will still be the integrator since the Army no longer section could plan cyberspace operations, EW, MISO,
authorizes an IO officer on the brigade staff. OPSEC, and deception. Instead of a discreet CEMA sec-
tion, an IO section consolidates IRC planners under one
The Way Ahead field grade officer who reports directly to the S-3. The
The brigade’s multi-domain operations would have brigade public affairs officer is an exception and should
been much less successful without the attached IO officer. remain on the personal staff to maintain credibility with
Even though in Cyber Blitz the S-3 had more bandwidth the press and public. Combined Joint Task Force–Horn
than usual to focus on integrating IRCs, this was no sub- of Africa successfully used a similar staff organization
stitute for a trained IO officer. The IO officer’s perspec- by having all primary IRCs, including CEMA, fall under
tive on IO led him to fight to overcome the stovepipes the IO directorate except CA and public affairs. This
between the IRCs. The cyberspace and EW planners greatly increased the unity of effort.
were incredibly busy and focused on the detailed plan- Regularly attaching Army Reserve and National
ning of their individual efforts. Successful EW and OCO Guard IO officers to BCTs is another solution if
require this concentration but also expecting IRC plan- manpower constraints prevent adding an active duty
ners to develop a holistic IO plan to support the scheme IO officer. Reservists could supplement BCTs during
of maneuver is impractical. However, the brigade would deployments. This would mitigate the tendency to

38 July-August 2019 MILITARY REVIEW

 CYBER BLITZ 2018

misuse IO planners and saddle them with additional Maj. Alex J. Duffy, 3rd Brigade Combat Team, 10th Mountain Division
duties unrelated to IO in garrison. Ideally, the reserv- operations officer (right), and Capt. Jacob M. Allen, assistant operations
officer, use a map overlaid with operational graphics to back-up digi-
ists would also support the BCTs at combat readiness tal mission command systems and provide redundancy 17 September
center rotations in addition to deployments so units 2018 during Cyber Blitz 2018 at Joint Base McGuire-Dix-Lakehurst,
could train as they would fight. However, it could New Jersey. This alternate method to battle track temporarily became
place a strain on reservists to support month-long the primary method when an enemy cyberattack knocked the digital
systems off-line. (Photo courtesy of U.S. Army Communications-Elec-
training center rotations habitually while already tronics Research, Development and Engineering Center [CERDEC])
attending many schools and supporting numerous
exercises in addition to regular deployments. Relying
on reservists to fill this gap could further stress the
force and be impractical. and staff organization, these capabilities will not be used
to their full potential. It also showed how an IO officer
Conclusion on the brigade staff can drastically improve the brigade’s
The Army must embrace IO’s integration function to effectiveness. The Army cannot accept piecemeal em-
institutionalize the Patriot Brigade’s success at Cyber Blitz ployment of IRCs and a divide between CEMA and IO.
2018. Cyber Blitz demonstrated that, while new equip- The U.S. military “has no preordained right to victory,”
ment and organizations are necessary to enable BCT and we must relentlessly improve our capabilities to win
multi-domain operations, without the proper doctrine the multi-domain battles of tomorrow.11

MILITARY REVIEW July-August 2019 39

 Notes
1. Cyber Blitz Team, “Cyber Blitz 2018 (CB18)
Distinguished Visitor Day” (PowerPoint presentation,
Fort Dix, NJ, 26–27 September 2018).
2. U.S. Army Training and Doctrine Command
(TRADOC) Pamphlet (TP) 525-3-1, The U.S. Army
in Multi-Domain Operations 2028 (Washington, DC:
U.S. Government Publishing Office [GPO], 2018),
accessed 21 March 2019, https://www.tradoc.army.
mil/Portals/14/Documents/MDO/TP525-3-1_30N-
ov2018.pdf.
3. Office of the Secretary of Defense (OSD),
“Summary of the 2018 National Defense Strategy
of the United States of America” (Washington, DC:
Department of Defense, 2018), accessed 21 March
2019, https://dod.defense.gov/Portals/1/Documents/
pubs/2018-National-Defense-Strategy-Summary.pdf.
4. Joseph Dunford, “Gen. Dunford: The Character
of War & Strategic Landscape Have Changed,” DoD-
Live, 30 April 2018, accessed 21 March 2019, http://
www.dodlive.mil/2018/04/30/dunford-the-character-
of-war-strategic-landscape-have-changed/.
5. Steven Stover, “Cyber Blitz 2018 Gives ARCY-
BER Opportunity to Test New Concepts, Capabil-
ities and Techniques,” Defense Visual Information

FUTURE WARFARE
Distribution Service, 3 October 2018, accessed 21
March 2019, https://www.dvidshub.net/news/295282/
cyber-blitz-2018-gives-arcyber-opportuni-

WRITING PROGRAM
ty-test-new-concepts-capabilities-and-techniques.
6. Cyber Blitz Team, “Cyber Blitz 2018 (CB18)
Distinguished Visitor Day.”
7. Joint Publication 3-13, Information Operations
Call for Speculative Essays and (Washington, DC: U.S. Government Printing Office, 27
November 2012).
Short Works of Fiction 8. TP 525-3-1, The U.S. Army in Multi-Domain
Operations 2028, GL-5. Information environment
operations is defined as “integrated employment of
information related capabilities (IRC) in concert with
Military Review calls for short works of fiction for inclusion in the other lines of operation to influence, deceive, disrupt,
Army University Press Future Warfare Writing Program (FWWP) for corrupt, or usurp the decision-making of enemies and
adversaries while protecting our own; to influence
2019. The purpose of this program is to solicit serious contemplation enemy formations and populations to reduce their
of possible future scenarios through the medium of fiction in order will to fight; and influence friendly and neutral popu-
lations to enable friendly operations.”
to anticipate future security requirements. As a result, well-written 9. Cyber Blitz Team, “Cyber Blitz 2018 (CB18)
works of fiction in short-story format with new and fresh insights Distinguished Visitor Day.”
10. Field Manual 3-13, Inform and Influence Ac-
into the character of possible future martial conflicts and domes- tivities (Washington, DC: U.S. Government Printing
tic unrest are of special interest. Detailed guidance related to the Office, 2013 [obsolete]). Revised to Field Manual
3-13, Information Operations (Washington, DC: U.S.
character of such fiction together with submission guidelines GPO, 2016).
can be found at https://www.armyupress.army.mil/Special-Topics/ 11. OSD, “Summary of the 2018 National Defense
Strategy.”
Future-Warfare-Writing-Program/Future-Warfare-Writing-Pro-
gram-Submission-Guidelines/. To read previously published FWWP
submissions, visit https://www.armyupress.army.mil/Special-Topics/
Future-Warfare-Writing-Program/.

Army University
Press
July-August 2019 MILITARY REVIEW