2 o _ _ _ 0 9- o ' v a ill - - o _ -_ o o at - o o l - o 7 o -- o o o oo I o - o i o 'til I MCIP 3-40 02 Io o 1 o o I 1 -o o o o o o - - o o o o r -- o -' o o o o M __ ' r -'-o o ' i I o ai ' I US Marine Corps -- -- I o r _ 1 ' o o _Ill o 1 1 o ' - 'J o o _ o o o ' t - t ' o DISTRIBUTION STATEMENT B Distribution authorized to US Government agencies only for official use only - PCN 14600002000 - o oo - o oI o - - -- o o o o To Our Readers Changes Readers of this publication are encouraged to submit suggestion s and changes through the Universal Need Statement UNS process The UNS subrmssIOn process is delineated in Marine Corps Order 3900 15_ Marine Co ps Exp dll Onar Force Development System which can be obtained from the on-hne Manne Corp Publications Electronic Library http www marines millNewslPublicationsIELECTRONICLIBRARY aspx The UNS recommendation should include the following information o Location of change Publication number and title Current page number Paragraph number if applicable Line number Figure or table number if applicable o Nature of change AdditiOn deletion of text Proposed new text Additional copies If this publication is not an electronic only distribution a printed copy may be obtained from Marine Corps Logistics Base Albany GA 31704-5001 by following the instructions in MCBul 5600 Marine Corps Doctrinal Publications Status An electronic copy may be obtained from the United States Marine Corps Doctrine web page https l www doctrine usmc mi1 Unless otherwise stated whenever the masculine gender is used both men and women are included o o o o o DEPARTMENT OF THE NAVY Headquarters United States Marine Corps Washington D C 20350-3000 6 October 2014 FOREWORD Marine Corps Interim Publication MCIP 3-40 02 Marine Corps Cyberspace f pera tions elaborates on Marine Corps-specific infollnation and procedures addressed III J lIlt Publication 3-12 Cyberspace Operations dated 5 February 2013 SECRET Pro ldlllg an introd ucti on to cyberspace MCIP 3-40 02 discusses how the Marine Corps IS currently organi zed to conduct cyberspace operati ons planning considerations and emerging changes that will affect our cyberspace operations capability and capacity The Marine Corps depends on cyberspace to enable the successful execution of warfighting functions across the range of military operations and in the fulfillment of business practices In order to maintain freed om of action within cyberspace the Marine Corps must develop and maintain robust capabilities to operate and defend the Marine Corps information enterprise Additionally the Marine Corps requires the capability to utilize cyberspace operations in concert with other lines of operation to identify understand disrupt attack and defeat a wide range of adversaries This interim publication is a first effort to indoctrinate the force on cyberspace operations The target audience is Marine air-ground task force commanders their staffs and other personnel involved in cyberspace operations As that audience gains experience incorporating cyberspace into operational design and execution doctrine will be further refined and developed Reviewed and approved this date BY DIRECTION OF THE COMMANDANT OF THE MARINE CORPS K 1 GLUECK JR Lieutenant General U S Marine Corps Deputy Commandant for Combat Development and Integration PUBLICATION CONTROL NUMBER 14600002000 DISTRIBUTION STATEMENT B Distribution authorized to U S Government agencies only for ollicinl use on ly Other requests for this document will be referred to Headquarters Marine Corps Deputy Commandant for Co mbat Development and Integration Capabiliti es Development Directorate Command and ControllCyber and Electronic Warfare Integrati on Division Quantico VA This Page Intentionally La Blank o o o TABLE OF CONTENTS o o o Chapter 1 Overview Fundamentals of Cyberspace Physical Network Layer Logical Network Layer Cyber-Persona Layer Fundamentals of Cyberspace Operations Lines of Operation Threats and Actors in Cyberspace Targets Marine Corps Perspective National Joint Concepts and Policy Presidential Policy Directive 20 Department of Defense Strategy for Operating in Cyberspace Joint Concept for Cyberspace 1-2 1-2 1-2 1-2 1-2 1-2 1-3 1-4 1-4 1-4 1-4 1-5 1-5 Chapter 2 Organization COmmand Authorities and Organizations 2-1 Commander United States Strategic Command 2-1 Commander United States Cyber Command 2-1 Marine Corps Roles and Responsibilities 2-2 Headquarters and Supporting Establishment 2-2 Marine Corps Operating Forces 2-4 Cyberspace Operations Within the Marine Expeditionary Force 2-5 Authorities 2-7 Legal Considerations 2-7 Application of the Law of War 2-7 Lawfu l Mi litary Attacks 2-7 Chapter 3 Planning Planning Cyberspace Operations 3-1 Considerations 3-1 Cyberspace Operations Planner 3-2 Cyberspace Operations and the Marine Corps Planning Process 3-4 Integrating Cyberspace Operations into MAGTF Operations 3-7 Cyberspace Operations and Targeting 3-7 Cyberspace Information Requirements 3-10 Cyberspace and Information Operations 3-10 Cyberspace and Electronic Warfare 3-11 o o IV o o o o o Chapter 4 Emerging Capabilities 4-1 Cyber Mission Force o o o o o o National Mission Team 4-1 Combat Mission Team o o o o o o o o o o o 4-1 Combat Support Team o o o o o o o o o 4-1 o Cyber Protection Team ' ' ' ' '1'1 o o o o 4-2 MAGTF Cyberspace and Electronic Warfare CoordmatIOn e 4-2 Joint Information Environment o c Glossary References and Related Publications o o - o CHAPTER 1 OVERVIEW - early Info - - every aspect of modern life depends on rrnatlon technology to some extent Not many decades ago compute rs were highly spec iali zed dvanced technology device s that were very x penslve dIfficult to operate and largely unfamlltar to the general publi c However in recent years computer processors have simultaneously become smaller cheaper more energy efficient and much more powerful Likewise telecommunication s infrastructure was largely oriented on transporting voice communication via wires and cables Today te lecommunications technology can transmit vast amounts of data among mUltiple global locations at nearly the speed of light Likewise secondary storage devices such as hard disks and so li d state drives have become more capable and m ore affordable Software applications have also become more powerful and more user-friendly While information technology continues to playa large ro le in the activities of governments infTastructure providers industry and academia it has a lso proli ferated among consumers around the world in the form of products and services Key products and ser vices include personal computers tablets smartphones embedded processors In automobi les and appliances wired and wireless broadband Inte rnet-based services and the software that enables al l of them -rh IS o same technology influences corec functions within the Marine Corps and the Jomt lorce o Enables the personnel center to m re promptly urately execute admlntstratlve actions d an acc b'l' th e m telligence section 's capab T I Illes Enhances o h' the intelligence cyc le Such capa I lUes In d to inform commanders' declslOnmakaWIt re use ing processes o Provides the operations staff with tools to conduct planning to effectively integrate the actIOns of all elements of the Marine air-ground task force MAGTF and or joint task force o Enhances logisticians ' ability to track the status of supplies at remote outposts and o develop and execute plans to resupply them m an efficient manner o Provides commanders with text-based voice and video communication tools to facilitate the exercise of command and control Just as the financial communications transportation utilitie s and other sectors have become dependent on the availability of information technology serv ice s so have many core functions performed by elements of the Marine Corps such as headquarters supporting establishment and operating forces However along with the benefits of informati on technology come vulnerabilities Marine Corps syste ms are at risk to adversary attempts to deny disrupt degrade exploit or destroy these sys tem s or the data therein via lethaVnonlethal means Marine Corps Doctrinal Publication I -0 Marine Corps Operations states The Marine Corps derives its agility from its expeditionary mindset flexible structure and Marines can adapt quickly across an extraordinary range of military operations with the organizational design and training to transition seamlessly between these operations providing the necessary capability to operate effectively Marines have long excelled in the domains of air land and sea Now and into the foreseeable future Marines will increasingly be called Upon to excel at operating in cyberspace 1-2 - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ I MCIP 3-40 02 o Fundamentals of Cyberspace layer is the first point where the connection to the physical dimension of the information environ- Cyberspace is a global do mam within the Infolllla- tion enviro networks e t cons stmg of the interdependent tures and m ormatIo n technology infrastruccomm res dent data including the Internet teleun catlOns netwo ks ' embedded r computer systems and operatio processors and controllers Cyberspace capabilit'ns are the emp lo yment 0 f cy b erspace cyb les to achIeve objectives in or through erspace Cyberspace can be viewed as con slstm g of three I h' n etwork ayers p YSlcal network logical get' ' and cyber-persona See figure 1-1 Tarm g m yberspace operations presents a 'chalI enge to Identify d' t' coor mate and deconflict ac lVltles occurring across those layers ment is lost Physical Network Layer T h physical network layer is the medium in wh ic h the data travels It includes wired e g land and undersea cable and wireless e g radio radIO-relay cellular sate llite trans mi ss ion means It IS the fust point of reference for determmmg Jurisdiction and application of authori I es It IS also t he primary layer for geospati al mtellIgence which can also contribute data useful fo r targeting in cyberspace Cyber Persona Layer The cyber-persona layer is the digital representa tion of individual or group online identities It holds important implications for Marine forces in tellll S of positive target identification and affilia tion and activity attribution Cyber-personas can be complex with elements in many virtual locations and not necessarily linked to a single physical location or form therefore Marines require significant intelligence collection and analysis capabilities to gain sufficient insight and situational awareness of a cyber-persona to enable effective targeting and generation of the Marine commander's desired effects Fundamentals of Cyberspace Operations The fundamentals of cyberspace operations consist of understanding the various threats in cyberspace and their impact across its three lines of operation LOOs within the context of the Marine Corps Logical Network Layer Lines of Operation The logical network layer constitutes an abstraction of the physical network layer depicting how n odes in the physical dimension of the i nformation environment logically relate to one another to form e ntiti es in cyberspace The logical network Physical Network Layer The three LOOs within cyberspace are Department of Defense infoltnation networks DOOrN operations defensive cyberspace operations DCO and ' offensive cyberspace operations OeO Logical Network Layer Cyber-Persona Layer o Lto Figure 1-1 The Three Layers of Cyberspace I I Marine Corps Cyberspace Operations _ __ _ _ __ _ _ _ _ __ - The DODIN operations are actions taken to design build configure secure operate maintain _ and sustain Department of Defense DOD como munications systems and networks in a way that creates and preserves data availability integrity c onfidentiality as well as user e ntity authentication and nonrepudiation Defensive cyberspace operations can be passive and active and are intended to preserve the ability to use friendly cyberspace capabilities and protect data networks net-centric capabilities and other designated systems Offensive cyberspace operations are intended to project power by the application of force in or through cyberspace Threats and Actors in Cyberspace Actors o oo A growing range of state or nonstate actors may develop or acquire the capability to conduct both physical and virtual attacks against information technology infrastructu re Unlike actors in the physical domains actors in cyberspace can acqu ire significant capabilities in a short amount of time w ith a small amount of capital Acqu isition of an OCO capability by state or nonstate actors in order to conduct operations against friendly critical infrastructure could represent a significant threat to infollnation dependencies and communication flows of friendly fo rces Foreign Nations A growing array of nation-states is targeting information infrastructures for reconnaissance survei ll ance exploitation and potential disruption or destr uc ti on S uch in fras truc tu res inc lude the Internet telecomm unications networks computer systems and embedded processors and controllers in critical industries o o Criminal Groups Cyberspace intrusio ns by crimi nal groups who attack information systems for mone tary and informational gain are increasing Criminals' toolkits are evolving rapidly to use new technologies - - 1-3 that increase the sophi stication of attacks Often such groups may offer their toolkits and software robot networks also known as botnets networks of infected computers of unwitting victims that perform automated tasks to achieve the goals of the cyber criminals for rent to the highest bidder thereby increasing the threat capacity of less advanced actors Hackers Hackers may infiltrate networks for the thrill of the challenge or for bragging rights in the hacker community Whereas remote hacking once required a fair amount of skill or computer knowledge hackers can now download attack scripts and toolkits from the Internet and launch them against victim sites Thus attack tools have become simultaneously more sophisticated and easier to use Hacktivism Hacktivism refers to politically motivated attacks on publicly available assets Groups and individuals may overload e-mail or Web servers through denial -of-service attacks or may hack into Web sites to send a political message Insiders Insiders have been perpetrators of computer crimes Insiders may not need a great deal of knowledge about computer intrusions because they often have enough access to systems to cause dama e or steal data The insider threat may include mIlitary DOD civilian and contractor personnel Terrorists Terrorists may seek to destroy incapacitate 0 explo it critical infrastructures to threaten nati na secunty cause mass casualties weaken the economy and damage public morale and confiden H' ce o owever terronst adversaries of the United Sta have typically been less developed in their co te puter network cap bilities than state adversari s ave been Terronsts may now focus on traditional attack methods but growing cyberspace 1-4 - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 threats should be anticipated as a more techni ' cally competent generation enters the ranks -Targets o Every tar e has distinct intrinsic or acquired cha ractenstlcs These characteristics form the basls for target detection location identification t arget value w thin the adversary target system a d c sslficahon for future surveillance analySlS stnke and assessment While this is true from an offensive point of view Marine planners and cyberspace operations personnel must recognize those otential adversaries will view friendly assets m cyberspace similarly as potential targets There ore the same types of defensive princlples Mannes employ in the physical domains such as active security and defense in depth mus be employed in cyberspace Additional information on cyberspace targets at the SECRET level can be found in Joint Publication JP 3-12 Cyb ' rspace Operations JP 3-60 Joint Targeting and Department of Defense Strategy for Operating in Cyberspace Marine Corps Perspective The Marine Corps must be prepared through organic and nonorganic means to operate and defend information technology resources and generate effects in cyberspace in support of assigned missions Commanders at all levels must be aware of the opportunities and threats inherent in depending on cyberspace both for friendly and adversary operations in cyberspace Freedom of action in cyberspace facilitates freedom of action in the physical domains of air sea land and space Similarl y an inability to freely act in cyberspace would severely limit Marine forces' ability to operate in the operational environment For example imagine the level of difficulty inv lved in commanding controlling and supportmg a widely dispersed MAGTF without the benefit of computers telephones and dat a nelworks Conversely imagine the opportUnitles afforded the MAGTF commander when a technologically advanced adversary is denied access to critical information technology-dependent systems It is not envisioned that every Marine in the MAGTF will be capable of conducting full spectrum cyberspace operations DODIN operations DCa and OCO However Marines at every level must recognize that the information technology systems on which they depend are potential points of entry for adversaries Cyberspace affords adversaries the potential to achieve an asymmetric advantage hence dependence on cyberspace is deemed a weakness that adversaries seek to take advantage of for relatively little cost and at minimal physical risk As the Marine Corps' involvement in cyberspace operations increases and as new operational imperatives exceed the scope of Service and joint doctrine feedback will be crucial to ensure that doctrine is updated and operational knowledge diffused National Joint Concepts and Policy There are national and joint concepts and policies that outline strategic initiatives national interests priorities and challenges regarding the role of the nation DOD and joint forces in cyberspace It is imperative that the Marine Corps and lts leaders understand their roles in cyberspace operations in the broader context 0 f national and joint concepts and policies Presidential Policy Directive 20 u s The Presidential Policy Directive 20 Cyber Operations PoliCY issued in October 2012 addresses cyberspace operations of the milita ' and federal agencies The directive establishesry stnct set of guidelines for dealing with cYber space threats and makes a distinction betwe offensive and defensive cyberspace operations en Marine Corps Cybe pace Operations _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ 1-5 o o o Department of Defense Strategy for Operating in Cyberspace ' be Departmem of Defense Straregy for Operar' g Cyberspace issued in july 20 II estabhshes Sl t ra eglc lrutJatlves that provide a roadmap for the DOD to operate effectively in cyberspace defen national interests and achieve nationai secunty objectives The strategy focuses on a Ilmbe of centra aspects of the cyberspace threat Including external threat actors insider threats supply chain vulnerabilities and threats to DOD's operatIOnal ability The DOD must address vulnerabilities and the concerted efforts of both state and nonstate actors to gain unauthorized access to I e works and system There are five strategic trutlatlves associated with this document In o Treat cyberspace as an operati onal domain to organize train and equip so that DOD can take ll advantage of its potential in military mtelhgence and business operations o Employ new defense operating concepts including active cyberspace defense to protect DOD networks and systems o Partner closely with other US government departments and agencies and the private sector to enable a whole-of-government strategy and a nationally integrated approach to cybersecurity o Build robust relationships with US allies and international partners to enable informati on sharing and strengthen collective cybersecurity o Leverage the nation's ingenuity by rccmiting and ret ining an exceptional cyberspace work force and enabling rapid technology mnovatlon Joint Concept for Cyberspace FOUO The Joinr Concepr for ybe space was approved 21 August 2012 and Identilies hlghlevel operational effects and broad military capabilities for achieving cyberspace superiority Cyberspace superiority is securing friendly freedom of action within cyberspace while denying the same to the adversary Although extremely difficult for any actor in cyberspace to monopolize cyberspace superiority it is realized and achieved through a concerted effort with the right balance and integration of advanced technology and cyberspace capabilities a responsive and streamlined command and control structure clear guidance policies and legal framework and a trained and mission-ready workforce The Joinr Concept for Cyberspace proposes the need for centralized control and decentralized execution as one of several possible command and control structures for cyberspace operations and effects Such a construct enables joint force commanders to satisfy mission objec tives and requirements supporting the perfO mance of synchronized joint force operations in and through cyberspace The Joinr Concepr for Cyberspace also identifies the need to fully integrate cyberspace with joint functions and operations to assist warfighters in meeting the full range of national challenge identified in the Capsrone Conceprfor Joint Operations FOR OFFICIAL USE ONLY 1 o _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 o o o o o This Page Intentionally Left Blank o o I I o o o o o CHAPTER 2 ORGANIZATION Command Authorities and Organizations Cy erspace operations are organized across a wide var lety of com mand s and organizations each of whIch employs the organic and nonorganic cyberspace capabi lities at their disposal in accordance with their respective authorities Each command nd organization is organized in hierarchy authorIty and scope of responsibili ty to ensure the most ffective use of its capabi liti es within cyberspace m relallon to its hi gher adjacent and subordinate commands and organ izations The fo ll ow in g s ubpa rag raphs outlin e the missions roles and responsibilities of key organizations at the national and joint levels Commander United States Strategic Command FOUO The Commander United States Strategic Command USSTRA TCOM has responsibility to direct DODIN operations a nd defense th rough the subunifi ed command United States Cybe r Command USCYBERCOM In miss ions ass ig ned by the U ni fied Command Plan the Commander USSTRA TCOM o Plans synchroni zes advocates and employs capab ilities to meet the Un ited States strategic deterrence space operations cyberspace operations global strike and missile defense intelligence surveillance and reconnai ssance ISR and combating weapons of mass destruction o Provides planning and cyberspace support to coalition force s in theater Commander United States Cyber Command The Commander USCYBERCOM in support of the Commander USSTRATCOM has the following duties o Directs DODTN operati ons and defense o Plans against designated cyberspace threats o Coordinates with other combatant commanders and government agencies for effects that cross areas of responsibility o Plans operational preparation of the environment OPE and executes or synchronizes OPE in coordination with the geographic combatant commands CCMDs o Provides military representation to US national agencies US commercial entities and international agencies for matters related to cyberspace as directed o Executes cyberspace operations as directed Service Components to the United States Cyber Command The Marine Corps Service component t o USCYBERCOM is United States Marine Corps Forces Cyber Command MARFORCYBER The Marme Corps Network Operations and Security Cente MCNOS C and Company L Marine Cryptologlc SuPPOrt Battalion is under the operatIOnal control of MARFORCYBER The Commander MARFORCYBER advises Commander USCYBERCOM on the proper employment and support of Marine Co rps f orees Coor d mates deployment employment o FOR OFFICIAL USE ON LY 2-2 - - - - - - - - - - - - - - - - - - - - - - - - - - - - MCIP 3-40 02 and re deployment plannin g and execution of assigned attached forces and conducts full- spec rum cyberspace operations Such o p e ration s - Includ e DODlN operations DCO and when directed OCO Tho se operations Support the MAGTF joint and combined forces in order to enable freedom of action through o ut the operational environment and deny the same to adversari al forces The M CN OSC is located in Quantico Virginia It directs global network operations and defen se of the Marine Co rps Enterpri se Network MCEN and provide s technical lead e rs hip to Supp o rt seam less information exchange in s upp o rt of Marine and loint Forces operating worldwide It is the operational organ ization a l and technical construct for operati ng and defendin g the MCEN It provides continuous sec ure global communication s and operational sustainm ent and defen se of the MCEN for Marine fo rce s w o rldwide Operationally the MCNOSC function s as the network operations a lso called NetOps entero prise lead re s pon s ible for all c ross- reg ional information technology issues Company L plans and when directed co nducts OCO in support of Service joint and combined cyberspace requirements When directed it also provides support to OCO Like the Marine Corps each military Service has a Service component to USCYBERCOM These include Fleet Cyber Command Army Cybe r Command and Air Forces Cy ber Each Service compone t commander to USC YB ERCOM is r es pon s ible for advising Co mm a nd er USC YB ERCOM with regard to the empl oyment of its forces relative to cyberspace Cyberspace Support Element o Cyberspace support e lements are organized from USC YB ERCOM forces and deployed to CCM Os for full integration with their staffs Cy ers pac e s upp o rt e Ie m e n t re so urce s are pr OV id e d I byf USCYBERCO M and are drawn from a poo 0 trained indi vid ua ls both at USC YB ERCOM and the Service components S uch s upport pro v ides the CCMDs with j o int cyberspace operatIOns planners and other s ubject matter expe ts o n cyberspace operations These perso nel facdltate development of cyberspace r e q lrements and coordinate integrate and deco ntllct cyberspace operations into the command's planning process Marine Corps Roles and Responsibilities Cyberspace operations role s span the entire Marine Corps from the headquarters and supporting establi shment to the operating forces and their unit-level organizations Each organization's role either directly or indi rectly supports the ability of the Marine Co rps to perform cyberspace operati ons across the three LOOs while continually reevaluating and reshaping its capabilities to retain freedom of action within cyberspace Headquarters and Supporting Establishment The supporti ng establishment consists of 16 major bases trainin g activities formal schools Marine Corps Recruiting Command Marine Corps Combat Development Command Marine Corps Systems Command and Headquarters Marine Corps The supportin g establishment's contributions are vital to the overall cyberspace read iness of the Marine Corps This Support is necessary to effectively deploy and implement modern infOllllation technology in support of the MAGTF both in garrison and when deployed Deputy Commandant Plans Policies and Operations The Deputy Commandan t Plans Policies and Operations se rves as the Marine Corps advocate for cyberspace operations He provides expert advice to the Commandant of the Marine Corps to develop Ihe Marine Corps position on cyberspace operations issues and represent those positions and enabli ng capabi lities that suPpOrt the Marine Corps operating forces and the support_ ing establi shment I Marine Corps Cyberspace Operations _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 2-3 Director Command Control Comm ' t' unlca Ions and Computers Department o The Director Command Contro l Communications and Computers Department'plans directs and d' ' f u co or mates all staff activitIes relating to such n tlOns He supports the Commandant of the M lne Corps in his role as a member of the Joint ChIefs of Staff A Sec th h'Ie f'mformatlOn officer of the Marine Corps the director provides over I ght of Marine Corps information technology Infr astructure cybersec urity governance and 0hcy e also represents the Marine Corps at OJ Jomt and Department of the Navy informatl n technology forums As the authorizing officIal he o versees implements and directs the ormal se unty accreditation process ensuring all information systems operate within acceptable level s of risk He also serves as the lead for Marine Corps information technology portfolios and establishes Marine Corps information techno ogy portfolio management policy processes gUldance and oversight o o - 6 o o Director of Intelligence I I I o oo o The Director of intelligence DIRINT is responsible for policy plans programming budgets and staff supervision of intelligence and supporting activities within the Marine Corps The DIRlNT has Service staff responsibility to ensure there is a single synchronized st rategy for the development of the Marine Corps ISR enterprise to support the intelligence needs of Marine commanders throughout the operational environment The DIRINT also manages the Marine Corps' sensitive compartmented information SCI computer network in close coordination with the director Command Control Communications and Computers to ensure that the enterprise-level management of SCI networks is comparable to that of the genera l service networks This relationship between the two directors recogni zes that special measures are requ ired for the protection handling of foreign intelligenc countenntelligence or other need-t o-know mformatlOn Accordingly implementatIOn o f these measures mu st be tailored to comply WIth separate and coordinated Director of National Intelligence directives and intelligence community policies Systems that combine SCI and general service capabilities will be under the authority of the director Command Control Communications and Computers with the exception of specific SCI security activities Deputy Commandant Combat Development and Integration The Deputy Commandant Combat Development and Integration is responsible for the integration and execution for all Marine Corps warfighting development activities associated with cyberspace Specifically the Command and Controll Cyber and Electronic Warfare Integration Division coordinates with the operating forces supporting establishment and mission partners Together they identify prioritize and integrate command and control expedi tionary cyberspace and electronic warfare capability solutions across the pillars of DOTMLPF doctrine organization training materiel leadership and education personnel facilities policy warfighting functions and joint requirements Deputy Commandant Installations and Logistics The Deputy Commandant Installations and Logisti cs shapes logistic plans and policies to sustain excellence in warfighting The focus of effort is to increase MAGTF lethality by providing superior support through modernizing logistic processes implementing proven technology and best prac tices developing standards of performance and fully integrating the supporting establishme'nt as the fifth element of the MAGTF Ma ine Corps Installation Command The Marme Corps Installation Command MCICOM exercIses command and control of Marine C II' orps msta atlOns vIa regional commanders to prOvide verslgh dIrectIOn and coordination of installa_ lt n services and to optimize support to the operatmg forces tenants and activities For installations under the command and COntrol of the 2-4 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 commanding general of Marine Corps Training ' a d E ucation Command MCICOM only provides mstallation Support capabilities provided by MCIA shoul be leveraged by Marines planning and conductmg operations throughout the operational environment o MAGTF Information Technology Support Centers Seven of the eight MAGTF information technology SUpport centers MITSCs are under the operational control OPCON of MCICOM T he MlTSCs execute NetOps functions for the eight subregions in support of the Regional Network Operations and Security Centers RNOSCs by p oviding information technology services to Manne expeditionary forces MEFs in garrison and Marine Corps supporting establishment elements within its area of responsibility The eight subregions supported by the MITSCs are o o o o o o o o Headquarters Marine Corps The national capital region East supporting the US mid-Atlantic region West supporting the US Pacific region United States Marine Corps Reserves Mid Pacific Hawaii West Pacific Europe Unlike the other MITSCs MITSC Europe is not under the OPCON of MCICOM rather it has a unique command relationship with United States Marine Corps Forces Europe due to lack of a Marine Corps installation in Europe The MITSCs are the support centers for the bases posts and stations within their region providing information technology support and enforcing established information technology policies I o The DlRINT Headquarters Marine Corps is responsible for implementing and managl g Marine Corps SCI architecture in accordance With intelligence community directives and refere c s The Marine Corps SCI Executive Office admm lsters and operates the Marine Corps SCI enterpnse by providing policy implementation governance technical support and assistance in establishing and sustaining Marine Corps SCI networks The SCI Executive Office provides enterprise management network operations network security information assurance and asset management across the Marine Corps in accordance with relevant directives and guidance from the Office of the Director of National Intelligence Defense Intelligence Agency and National Security Agency Marine Crypt%gic Support Battalion Marine Cryptologic Support Battalion is under the OPCON of the Director National Security Agency Chief Central Security Service via the DIRlNT in his role as the Marine Corps Service Cryptologic Component Chief This battalion trains employs and deploys Marines to conduct signals intelligence SIGlNT information assurance and national-tactical integration activities that satisfy National Security Agency Central Security Service MAGTF and joint force intelligence requirements Marine Corps Operating Forces Marine Corps Intelligence Activity Staff Capabilities The Marine Corps Intelligence Activity provi es tailored intelligence and services to the Manne Corps other Services and the ntelligence co - nity based on expeditionary miSSIOn profiles In It- toral areas It supports the development of Ser lce doctrine force structure trainin and educatl n 't' Reachback analYSIS and productIOn and acquisl IOn Marine Corps forces are assigned to CCMDs Staffs advise combatant commanders on the proper employment and support of Marine Corps forces conduct deployment redeployment planning and execution of assigned attached Marine Corps forces and accomplish other operational missions as assigned Marine Corps forces are the --- Marine Corps Cyberspace Operations bridge between the CCMDs and deployed emp loyed MAGTFs With the exception of ARFORCYBER few Marine Corps forces - ' ve robust organic cyberspace planning capabilIties Some have none however the Marine Corps forces can and should levera e cyberspace planning s upp o rt from their CCMD's Joint Cyberspace Ce nter and the cyberspace support elements wh ich are in direct support of the Joint Yberspace Center Add itionally Marine Corps b s shou ld leverage cyberspace' planning capaI ItIes resident In their assigned MAGTFs and the MEFs wh o h h ' IC ave prImary and secondary lannIng support respons ibilities to their respectIve Manne Corps forces o o T he MAGTFs have long been staffed trained and e d qUlppe to plan and conduct certain aspects of cyberspace operations such as NetOps and D O At this wr itin g additional structure is beIng phased into the operating forces fiscal ears 2013- 2016 to help enable MAGTFs to I tegr te all three LOOs of cyberspace opera Ions Into broader MAGTF operations This I vo l ves not just em-ploy ing organic capabili tIes but also planning fo r requesting and integratIng externally available capabilities Regional Network Operations and Security Centers T he fo ur RNOSCs support the four regions that collectively for m the backbone of all DODIN operati ons for the Marine Corps o o o o o o United States Marine Corps Forces Pacific U nited States Marine Corps Forces Reserve United States Marine Corps Forces Command National capital region The RNOSCs e nco mp ass a total of eight subregio ns called MlTSCs described earlier in this chapter The RNOSCs provide policy and regional oversight the taskIn g and reportIng framework decision support and recommendations to their respective MITSCs The OS Cs rovided gu idance and operatIonal directIOn P are ' bl by the MCNOSC The RNOSCs are responsl e 2-5 to implement the direction and then report back to the MCNOSC Cyberspace Operations Within the Marine Expeditionary Force The MEF is the principal Marine Corps warfighting organization for larger crises or contingencies While the MEF command elements have limited re so urces to perform specific DODIN functions the preponderance of cyberspace operations capabilities reside in organizations subordinate to the command element Within the MEF the communication battalion major subordinate commands the radio battalion and the intelligence battalion conduct cyberspace operations Communication Battalion The communication battalion is the senior MAGTF organization that conducts cyberspace operations that is DODIN operations and DCO The communication battal ion deploys as a task-organized unit or deploys task-organized detachments in support of MAGTF command e lem ents The communication battalion is equipped to serve as the hub for linking MAGTF networks to the DODIN and leading the extensive coordination required for DCO Subordinate units execute the same kinds of activities with backbone connectivity provided by the communication battalion Specific communication battalion actions include o Installing operating and maintaining the transmission systems that enable cyberspace operatIOns o Installing operating and maintaining the digital backbone that routes network traffic to the appropnate nodes o o o Installing operating and maintaining the local area networkS wide area networks for the MEF command element Leading changes to the network directed by higher headquarters Installing operating and maintaining bound defense devices in support of DCO ary 2-6 - - - - - - -_ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ MCIP 340 02 Additional in formation on the communication ' attalion an be fo und in Marine Corps Warfightm g PublicatIOn MCWP 3-40 3 Co mmunica tlons and Information Systems o r Major Subordinate Commands Unit Level Defensive Cyberspace Operations and Department of Defense Information Networks Operations o Th d' e IVISlon a ir wing and logistic group each have communications units that conduct DODIN operations and DCO at their levels of command Di ision and logistic groups each have communicatto ns ompanies while the air wing has a commUntcatlons squadron The specific actions they execute are comparable to the communication battalion Additional information on MAGTF communications units can be found in MCWP 3-40 3 o o o o o o o o o o Radio Battalion FOUO Each MEF has an organic radio battalion Radio battalions are task-organized to sup port any size MAGTF The mission of radio battalion is to provide SIGINT ground e lec tronic warfare limited cyberspace operations and special intelligence communications support to the MAGTF and joint force comma nd er as directed Specificall y radio battalion support to the MAGTF includes the following o o o o o Briefs the MAGTF commander and his staff on the capabilities and limitations of SrGINT and when directed limited OCO support Provides access to special intelligence networks to faci litate reachbacklcoordination with higher headquarters for cyberspace operations Provides SIGINT support to cyberspace operations DODIN operations DCO and OCO Researches the availability of organic and exte rnall y available resources to meet the MAGTF commander's requirements Identifies and collects on networks of interest to satisfy mi ssion requirements Conducts analysis to refine the collectio e ort and validate follow-on targeting and explOItatIOn Produces Digital Network Intelligence Reports Manages cyberspace ISR collection ssets Supports all-source intelligence fusIOn operations Coordinates with appropriate agencies for the deconfliction of activities in cyberspace Conducts operations in and through cybersp ce to affect designated targets in accordance wIth the supported commander's intent Plans and conducts ground electronic warfare to generate effects in cyberspace Provides technical information to support mission planning Applies legal consideration to OCO as required Supports the development of measures of effectiveness MOEs and or battle damage assessment criteria Additional information on the radio battalion can be found in MCWP 2-22 Signals Intelligence Intelligence Battalion FOUO The intelligence battalion plans directs collects produces and disseminates intelligence and provides counterintelligence support to the MEF major subordinate commands subordinate MAGTFs and other commands as directed The fo ll owing are among its responsibilities o Install required communications and networking gear to support the Joint Worldwide Intelligence Communications System JWICS connectivity to the MEF command element and the intelligence battalion o Operates JWlCS at the MEF and intelligence battalion in support of garrison requirements When deployed supports operations and exercises with communications terminals in order to establish general service and SCI connectivity o FOR OFFICIAL USE ONLY Marine Corps Cyberspace Operations _ _ _ _ _ _ __ _ _ _ __ _ _ _ _ _ _ _ __ ' Authorities o Authority for actions undertaken by the Armed Forces of the United States is derived from the l S Constitution and Federal law These authori lI s establi sh ro les and responsibiliti es that proVId e o u s for o r gan i zat io n s to develop capabI lItI es and expertise including those for cyberspace Key statutory authorities that apply to the Marine Corps include United States Code TItle 10 Armed Forces and Title 50 War and National Defense Legal Considerations o o o o Marines and the entire joint force must conduct cyberspace operations consistent with US domestic law app licable international law and relevant US government and DOD policie s The legal framework applicable to conduct cyberspace operations depends on the nature of the activities to be conducted such as offensive or defensive military operations Before conducting cyberspace operations commanders planners and operators must understand the relevant legal framework so as to comply with laws and policies 2-7 Application of the Law of War The law of war is defined as that part of international law that regulates the conduct of anned hostilities It encompasses all international law for the conduct of hostilities binding on the United States or its individual citizens including treaties and international agreements to which the United States is a party and applicable customary internationallaw The law of war rests on the fundamental principles of military necessity unnecessa ry suffering proportionality and dlstmctIOn dIScrimination which will apply to the conduct of cyberspace operations For more infollnation o the law of war see JP 1-04 Legal Support to MIlitary Operations and Chairman of the loint Chiefs of Stafflnstruction 58 I 0 010 Implementation of he DOD Law of War Program Lawful Military Attacks Attacks will be directed only at military targets Only a military target is a lawful object of direct attack By their nature locati on purpose or use military targets are those obj ects whose total or partial destruction capture or neutralization offer a direct and concrete military advantage 2-8 - - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 o o o o o o o o o o This Page Intcntionally Left Blank o o CHAPTER 3 PLAN G o o o o o Planning Cyberspace Operations F O Cyberspace operations share many simi- o o Ian tIes with operations in the physical domains' moreover it has unique tactical command and control planning and resource considerations uCh as a signi ficant need for reach back support e ntegratlOn of cyberspace operations must be wlthm the construct of the Marine Corps Plannin g Process MCPP That is the commander and staff must be made aware of cyberspace operatIons principles capabilities limitations and planning considerations Cyberspace consideratIons must be integrated into all six steps of the MCPP taking into account the complexities added by the authority considerations not traditionally associated with operational planning Likewise outputs of the MCPP must reflect considerations and planned activities for cyberspace operations Considerations FOUO Given the three LOOs that make up cyberspace operations DODfN operations DCO and OCO the following are examples of appendices and tabs that will reflect cyberspace operations o o o o o o o o o o o Information operations Priority intelligence requirements SIGINT Human intelligence Co unterintelligence Targeting intelligence Infollnation operations intelligence integration National intelligence support team Intelligence estimate Intelligence products o o o o o o o o o o Intelligence collection plan Intelligence operations Electronic warfare Cyberspace operations formerly known as computer network operations Rules of engagement ROE Targeting Information systems security Communications planning Space operations Integrated joint special technical operations FOUO When the MCPP is initiated whether informally in response to indications and warnings or more formally when an order or directive is received the cyberspace operations planner should be aware of what information is required during each step Whether conducting contingency or crisis action planning the input to the MCPP is the same There are planning directives and strategic or operatio nal guidance that wi II support the initiation of the process along with ongoing intelligence preparation of the battlespace IPB Included in IPB are attempts to determine the adversary's possible courses of action CO As and those cyberspace ISR efforts to gather and analyze intelligence information about target and adversary systems The planning coordination and support process should begin as early as possible with the commander submitting a request for support message to the supported joint force commander Early submission allows sufficient time for resource prioritization The request message must include as much intelligence detail from the G-2 S-2 as possible The level of detail in the infollllation request will have a significant bearing on how the request fares in the requirements review process The more detailed the request input the more readily o FOR OFFICIAL USE ONLY 3-2 - - - - - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 coordination and d fl rga econ IctIon with interagency nt za tlons can occu R b details will also r 0 ust IntellIgence o 'h fi greatly assist staff elements in e per onnance of their support missions Cyberspace Operations Planner The cyberspace I operatIons planner is responsible lor p anntng a II L cross a OOs and integrating orgaruc and externall 'l bl tions y aval a e cyberspace operab' capabllIues in support of the commander's J lves scheme of maneuver and end state y space operations planners ensure the effectIVe Integration of cyberspace capabilities to accompl h IS mi SSIO n SUpport activities which Include d COor Inatlng activities to counter the a versary's u se of cyberspace and to enable fne n l freedom of action in cyberspace These activities support planning for operations in a degraded environment and conso lidating operatIOnal requirements for cyberspace capabilities in support of the commander's single-battle concept Cy erspace operations planners develop viable optIOns to enable effective shaping of the situation and response to contingencies To ensure successful integration and synchronization of cyberspace operations with all other elements of multinational oo o JOint Interagency and Marine Corps operations cyberspace operations planners are involved in all stages of the Joint Operation Planning Process and or MCPP as appropriate In order to increase the MAGTF's capacity to plan and conduct cyberspace operations additional personnel possessing technical cyberspace operations skills began arriving at all Marine expedi tionary force and uni t sta ffs in 20 l3 Through 2016 these new billets will continue to be filled at the Marine expeditionary forces battalions and units The structure consists of the 8834 0689 and 2611 MOSs The officers assigned to the technical infomlation operations officer cyberspace operallons plann r MOS 8834 billets will each hold a aster s de ree in information warfare systems engmeenng fr m the Naval Postgraduatc School and will be familiar with the MCPP These officers serve as the MAGTF 's functional and technical planners for cyberspace operations The cyberspace operations planner is capable of providing support for planning and mission execution through expert knowledge of joint cyberspace components processes capabilities authorities and partner operations They maintain situational awareness of ongoing and planned cyberspace operations by coordinating with the G-2 S-2 G-3 S-3 and G-6 S-6 subject matter experts to ensure operations align with the commander's objectives Cyberspace security defensive cyberspace technical planner MOS 0689 Marines assist in ensuring the data availability integrity authentication confidentiality nonrepudiation and mission assurance of Marine Corps information systems Defensive cyberspace technical planners coordinate closely with the intelligence staff to incorporate focused proactive defensive measures based upon the latest tipping and queuing from cyberspace intelligence They advise and assist in the planning and identification of cyberspace defense requirements associated with MAGTF operational requirements operational risk management and mitigation processes with respect to cyberspace vulnerabilities and threats The primary focus of this Marine will be on DODIN operations and DCO efforts Cryptologic digital network operator analyst offen_ sive cyberspace technical planner MOS 26l1 Marines are involved in all facets of planning and coordinating OCO Offensive cyberspace technical planners coordinate closely with the intelligence staff to ensure that intelligence requirements reflect targets and threats in cyberspace They also assist in coordinating support from external OCO organizations units These Marines provide technical advice regarding the applicability of available OCO capabilities to the mission at hand coordinate with appropriate agencies to deconflict activities in cyberspace conduct or assist in conducting planning for electronic warfare to generate effects in cyberspace and support the development of MOEs and or battle damage assessment criteria FOR OFFICIAL USE ONLY Marine Corps Cyberspace Operations o ' o - - - - - - - - - - - - - - 3-3 ybcrspace operations planners must be engaged In the following activities o Identify threats risks and oPportunities in cyberspace that may affect operational planning ure cy erspace operations are adequately o ns ddressed In relevant operation plans and contingency plans o fOUO Maintain situational awareness of current operations o btain current cyberspace intelligence includIng b ' cy erspace ISR or cyberspace OPE status for potential OCO R' o eVlew Intelligence and create requests for Intelltgence and intelligence requirements to fill intelligence gaps o o Review all SOurces for cyberspace information lncludlng other government agencies to Identi fy Possible cyberspace intelligence conflicts or coll aboration opportunities o Include current cyberspace situational assessments in meetings with the commander and staff e g during staff meetings working groups and intelligence updates o Use these engagements as foundation building opPortunities for future cyberspace operations o Maintain situational awareness of updated cyberspace topographies of enemy computer networks hi gh-value indi vid uals and hi ghvalue targets and functions of id entified centers of gravity through reachback capabilities o Investigate cyberspace communities of interest and database resources to include informati on on previous cyberspace operations for effective methods and lessons learned Depending on the planner's current level of clearance and access additional access and or accounts may be required to review all resources li sted or referenced in this document including the fo ll owi ng o Intelli gence o OCO target li sts o Local intelligence officer o Local G-3 current operations o Lethal nonlethal weapon systems o Cyberspace threat intelligence acquired by the Central Intelligence Agency o USSTRA TCOM Strategic Knowledge Integration Web o Integrated Strategic Planning Analysis Network o National Securi ty Agency Central Security Service Threat Operations Center o USCYBERCOM including countering the adversary's use of the Internet portal library files and available intelligence o Review USCYBERCOM's cyberspace capabilities registry for existing cyberspace tools Contact USCYBERCOM for permission to access this registry via JWICS The cyberspace capabilities registry is the centralized Web-based resource for the cyberspace community where developers operators and planners may obtain information about cyberspace tools o Consult the supponing Joint Cyberspace Center to identify a suitable cyberspace tool or to document requirements o Review current combat ready cyberspace strike packages and detellnine compatibility with the developing situation Intelligence accesses staff judge advocate review capability readiness and deconfliction status should all be complete Determine which packages require additional refinement development coordination or accesses The US CYB ERCOM combatant commands or local Joint Cyberspace Center will have the ta- tus of OCO strike packages and engage in the following activities o FOUO Integrate with planning and targeting process o Participate in infO Illation Operations workin group IOWG joint planning group opera Banal plannll1 team and special technical operatIOns working group as reqUired FOR OFFICIAL USE ONLY 3-4 - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 ' Use these forums as a conduit to establish worko Ing relationships with other lethal nonlethal pl ers and related subject matter experts o o ReView avail ble local standing operating procedures paYing particular attention to how they will affect DODlN operations DCO and OCO planning o FOUO Review restricted and no-strike target Itsts Sources could include the local and affected command agencies USCYBERCOM and other entities o FOUO Review standing ROE supplemental measures and multinational ROEs as required Cyberspace Operations and the Marine Corps Planning Process The following subparagraphs discuss the six MCPp s eps in terms of the tasks input and out put reqUired by cyberspace operations planners Problem Framing o Since freedom of action in cyberspace facilitates freedom of action throughout the operational environment plartners must incorporate both offensive and defensive aspects of cyberspace operations into their approach During problem framing the cyberspace operations planner develops the cyberspace operations portion of the problem framing brief In support of this effort cyberspace operations infollnation requirements are developed and tasks are defined Cyberspace operati ons objectives are determined and evaluated in terms of scope levels and duration of effects collateral damage friendly and enemy reversibility planning and execution timelines and access required Cyberspace ISR support for this type of information is included in the SIGINT support plan generated by the staff for fusion and coordination As part of this step cyberspace policies and ROE are evaluated as potential limitations cyberspace high va lue targets are considered as critical factors and cyberspace information eeds are folded into the comma nd er's critical informatIOn requirements CCIRs as applicable Cyberspace operations planner tasks directed by the G-3 S-31o o o Conduct initial assessment of the mission across the three LOOs o Analyze commander's mission objectives and guidance o Detellnine initial cyberspace lSR DCO and OCO requirements o Analyze how to integrate cyberspace lSR DCO and OCO into mission objectives o Coordinate with G-2 S-2 for cyberspace lSR support o Coordinate with G-6 S-6 for DCO support o Coordinate with a special technical operations officer for the review and approval process RAP o Coordinate tasks with IOWG o Define and analyze the information envlronment and threat o o Detellnine DCO planning factors to ensure system and network availability is achieved through visibility and control over the system and network resources o Scope OCO tasks consider desired effects duration reversibility collateral damage and target accessibility o Assist 0-2 S-2 in developing related cyberspace operations infolluation needs o Identify organic cyberspace capabi lities and vulnerabilities o Identify specified implied and essential cyberspace operations tasks o Identify friendly cyberspace operations centers of gravity and critical vulnerabilities o Identify adversary cyberspace operations centers of gravity and critical vulnerabilities Cyberspace operations plartner inputto Cyberspace operations input to initial staff estimate o H gher headquarters center of gravity analysis o Higher headquarters cyberspace OPE and inforo o mallon operallons-related intelligence products FOR OFFICIAL USE ONLY Marine Corps CYberspace Operations _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ 3-5 ' o Cyberspace operations planner outputConvene the c b R' Y erspace operations cell eVlew higher h ad S e quarters orders and guidance ubmn initial requests for intelligence Develop a cybe rspace operatlOns mission statement 0 o ' 0 o o o Identi fy facts assumptions restraints ' constraints and Dev I e op InlormatlOn requirements Idenhfy 't' I b lnl la cy erspace operati ons shortfall s and ri sks o o o o Recommend inl'tl'al CC IRs I cyberre ated to space operations o Input cyberspace operati ons to the IOWG Submit recommended commander's cybers pace operatlOns planning guidance o assist in developing input to the OCO RAP The RAP package will consist of the concept of operations CONOPS legal reviews intelligence and technical gains ve rsus losses political and military assessment operational security and a detailed description of the operation Cyberspace operations planner tasks Assist in eval uation request message and Cyberspace Effects Reque st Form devel opment to identify desired OCO effects Review the evaluation request messages received from supporting components Pl an integration of OCO with other information-related capabilities IRCs and the overa ll mission plan Assist in developing cyberspace operations concept of support Review standing operating procedures standing ROE and supplemental measures and multinational ROE as required o o o o Course of Action Development o o During thi s step the cyberspace operations planner develops the cyberspace operations concepts 111 support of COAs that use objectives and tasks developed during problem framing to determining possible MOEs A DCa analysis is conducted to determine me trics for informati on assurance requirements that protect and defend information and information sys tem s protect and defend informati o n and netwo rk s and id entify critical infrastructure protection requirements Additionally the cyberspace o perati ons target development validation and nomination process occurs during this step and helps drive the identi fication of desired OCO effects Additionally the cybe rspace operations planner may include recommend atio ns for cyberspace capabilities to be used s uch that they may be analyzed for measure of performance MOPs and possible interference or atlribution issues in cyberspace o o For cyberspace operations actions that fall under s pec ial technical operations an eva l atlO n request message a lso known as an EReqM IS sent as part of the integrated joint special technical operatlOns pro cess Th e c Yberspace operations planner wdl o Cyberspace operations planner input Center of gravity products o Problem framing products o Cyberspace operations-related commander's planning guidance o Cyberspace OPE and combined information overlay o Cyberspace operations planner outputo o o o o o o o Cyberspace operations concept of support Cyberspace operations tasks and MOE Cyberspace operations target development validation and nomination Cyberspace operations input to the information operations synchronization matrix Cyberspace operations CONOPS aIrative sketch Required supplemental ROE for cyberspace operations Desired DCa objectives identified 3-6 - - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 Defense of infonnation and infonnation syso tems their availability integrity authenticao hon confidentiality and nonrepudiation o ' Inco f o rporatton 0 protection detection and capabilities reactIon Defense of infonnation and networks from disruption denial degradation or destruction Prevention remediation or mitigation of the n sks resulting from critical infrastructure vulnerabilities OCO effects Development of an evaluation request message Input o o o o of the weapons used there is far greater concern about interference with other cyberspace operations and attribution of the weapons FOUO Cyberspace operations planner tasksr Employ technical tools in the cyberspace and information environments to enhance situati onal awareness n conjunction with 0-2 wargame cyberspace operations concept of support against how the enemy will employ its inforillation systems assets and cyber-enabled weapons when applicable o o o o Review of evaluation request message o Cyberspace operations input to combatant commander RAP o - 0 Legal reviews traditional law of war intema tlonal law and effect of domestic and foreign law Cyberspace operations planner inputo o Intelligence gain versus loss Commander's cyberspace operations guidance for the wargame Cyberspace operations input to infolluation operations concept of support Cyberspace operations target nominations o o Impact of OCO on intelligence collection activities o o Refined CCIRs with cyberspace operations input Additional cyberspace operations-related shortfalls Cyberspace operations planner output - o o Updated cyberspace operations input to staff estimate o o o o o Course of Action Wargaming o Cyberspace operations are incorporated into the COA analyses Refinement s are made to all aspects of the cyberspace operations plan including but not limited to targets synchronization branches and sequels decision points MOEs MOPs objectives and tasks Using a synchronization matrix helps the staff visually synchronize the COA across time and space in relation to the adversary's possible COAs The wargame and synchro ni zation matrix efforts are parttcularly useful in identifying cross-component support resource requirements These efforts result In mature cyberspace operations inputs to the staff estimate The difference for cyberspace o e a- o tions planning is the emphasis on characterIStics o Refined cyberspace operations concept of support Refined cyberspace operati ons tasks and MOE Refined cyberspace operati ons targets Refined cyberspace operations-related risks Refined cyberspace operations-related decision points Updated cyberspace operations input to information operations staff estimates Course of Action Comparison and Decision The cyberspace operations planners assigned to support the commander will identify the advantages and disadvantages of the cyberspace operations CONOPS for each COA They should also examine each cyberspace COA for deconfliction of their proposed actions with national combatant command command authority and other pertinent efforts Once deconfliction is accom_ plished the cyberspace operations planners wi assist in updating the staff estimate FOR OFFICIAL USE ONLY Marino Corps Cyborspaco Operations _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ ' Cyberspace operat ions planner tasks- Cyberspace operations planner output o o o Analyze and evaluate cyberspace operations SUpport to each COA o Ide nti fy the best COA to recommend to the cOmmander with suppo rting rationale ' o 3-7 Cyberspace operati ons planner inputo Cyberspace operations input to information operatIOns concept of SUpport o COmmander's cyberspace operations related gU Idance for COAs Cyberspace operations inputs to such documents as the operation plans and OPORD o Staff coordination o Backbriefs from subordinate cyberspace operations cells and rehearsals o Synchronization of cyberspace operations o Considerations across the range of military operations o Assessment of cyberspace operations o MOEs o MOPs o Cyberspace operations plalUler output o o o o o o Transition Adva tages and disadvantages of cyberspace operalions concept of support identified Up ated cyberspace operations input to informatIon operations staff esti mate Recommended COA to G-3 S-3 Submit cyberspace ope rations inputs to COA approval brief Transition the sixth step of MCPP is universal There are no unique cyberspace operations planner tasks input or output Integrating Cyberspace Operations into MAGTF Operations Orders Development Cyberspace operations planners prepare the cyberspace operations appendices and tabs to be inserted into annex C of the commander's operation plan T hose products are appendix 3 Tab F OCO and Tab G DCO Cybe rspace ISR is in c lud ed in Annex B Intelli gence of the commander's operatio n plan In order to be of greatest value to Marine Corps forces and MAGTF commanders cyberspace operations must be integrated with operations throughout the operational enviromnent Cyberspace operations should be pi armed coordinated conducted and assessed in concert with operahons 1t1 the operational environment in the context of specific missions and commander's intent Cyberspace operati ons planner tasks - Cyberspace Operations and Targeting o o o o Assist in cyberspace operations mission CONOPS development Co nsider command a nd co ntro l a uth o riti es request for forces equipment and intelligence gain loss Prepare cyberspace operations appendixes and tabs Tab F OCO and Tab G DCa Assist in preparation of Annex S Special Technical Operations if applicable The cyberspace operations plann r input is the commander's approved COA WIth th e corresponding cybe rspace operations concept F UO Targeting is the process of selecting and pnontlZlng targets and matching the appropriate re s ponse to them conSidering operational reqUIrements and capabilities Integrating cyberspace operatIOns mto the process is the same as mtegratmg any other capability the MAGTF commander and staff have available FOUO -ime is a major consideration for plannmg and mtegratmg cyberspace operations int 0 the targetmg process Much like most conve _ tional lethal capabilities the MAGTF Command r employs cyberspace operations will also be time FOR OFFICIAL USE ONLY 3-8 _ - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 constra ned However the planning horizon for mp oYlng some cyberspace operations capabili- t es IS considerably greater than for most conven ilonal capabilities o FOUO I t IS paramount that targets are identifiIe d early in th I e p annmg process During the in i I tla phases of the MCPp the G-3 S-3 and G-2 S-2 mlul st enSUre that possible targets are identified to a ow for the d I eve opment of those targets and h t e lime requ' d C h Ire or t e approval process OUO In June 20 I 0 United States Strategic om mand's Joint Test and Evaluation Activity ubl shed Joint Non-Kinetic Effects Integration tlCS Techniques and Procedures ITP It pro I es an excellent foundation for planners integratmg nonlethal effects These tactics techniques and proc d e ures are mtended to complement not replace eXlstmg Service and joint doctrine Targeting Process FOUO The targeting process supports the comman der's decisions It helps the targeting team decide which targets must be acqu ired and attacked to support achievement of the command e r's objectives It helps in the decision of which attack option s to use to engage the targets Options can be lethal or no nlethal and organic or supporting Given the range of military operations to which Marines are assigned and the present security environment impacting US national interests Marine commanders can expect to operate in situations in which lethal options are extremely limited Therefore MAGTF commanders and their staffs must be skilled at applying the targeting process to use nonlethal opti ons such as cyberspace operations and electronic warfare Due to the long lead times often associated with cyberspace ISR IPB and OCO planning approval and execution commanders must ensure that contingency planning considers cyberspace options and execution timelines o FOUO The targeting process is detailed in MCWP 3-43 3 Marine Air-Ground Task Force Fires The functional steps in the targeting process are decide detect deliver and assess FOUO Decide Identifying ' 'potential targe ts will allow organic and supportmg assets to begm the process of cyberspace ISR and IPS Early identification of potential targets will Ilow the approval process to begin prior to miSSion planning and the decide phase of the targetmg process FOUO Detect Maintaining situational a are- ness and identi fying potential targets Within an area of responsibility allow the organic and supporting assets to detect and develop those t g ts early in the process Conventional capablltt les typically require less detailed technical detectIOn than cyberspace capabilities do FOUO Deliver Several driving factors in the delivery of fires and generation of effects whether cyberspace or conventional are the ability to support commander's scheme of maneuver the integrat ion with other fires effects to create a combined arms effect and effective MOE and MOP FOUO Assess Assessment is a process that measures progress of the MAGTF toward mission accomplishment Categories of Offensive Cyberspace Operations Effects FOUO The oeo planning process is dependent on the availability of and access to OCO tools This will drive the development of MOPs and MOEs based on the tools' perfollllance characteristics There are five categories of oeo effects deny degrade disrupt destroy and manipulate FOUO Deny To degrade disrupt or destroy access to operation of or availability of a target by a speCified level for a specified time Denial prevents adversary use of resources FOUO Degrade To deny access a function of amount to o r operation of a target to a level represented as a percentage of capacity Level of degradatIOn must be specified If a specific time IS reqUITed It can be specified FOUO Disrupt To completely but tempora '1 deny a function of time access to or operatio FOR OFFICIAL USE ONLY r Marine Corps Cyberspace Operations _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ a target for a period represented as a function of ' time A desired start and stop time are normally specified Disruption can be considered a special case of degradation where the degradation level selected is 100 percent o FOUO Destroy To permanently compl etely and rreparably deny time and am unt are both m aXUhlzed access to or operation of a target F UO Manipulate To Control or change In orn atlon information systems andlor networks In a mann h ' er t at supports the commander's bJe ctlves Including deception decoying conditIOning SPOofing and falsification Manipulation u ses an adversary's information resource s for fr iendly purposes Cyberspace Effects Request Form o FOUO The MAGTF commander must request and Coordinate OCO support via hi gher head uarters The Cyberspace Effects Request Form IS the mechanism by which tactical commanders request cyberspace effects on a target This format conta ins the baseline in formation end users must provide to facilitate the planners' requests for cyberspace fires to support tactical operations A Cyberspace Effects Request FOIIll must be submitted whether the capability desired to be e mpl oyed is organic o r supporting A detailed description and example s of Cyberspace Effects Request Forms a re located in MCRP 3- 16 6A Multi-Service TactiCS Techniques and Procedures MITP jar the Joint Appiicalion of Firepower JFJRE Additionally the description in th e reference provided a l so de sc ribe s the approval chain Assessment of Cyberspace Operations o FOUO The focus is o n measuring progress toward the end state and delivering relevant reliable feedback into the planning process to adjust operat i o n s during execution Assessment involves deliberately comparing forecasted outcomes with actual events to determine the overall effectiveness of force employment 3-9 FOUO Cyberspace planners adjust their OPs and MOEs during COA development analYSIS and wargaming comparison approval and p an s orders development Planners must stay aCllvely engaged because the plan changes and must be adj usted during every step of the MCPP and during execution since MOPs and MOEs - 111 change in the plan Any change has the pote lal to affect the criteria of re levance measurablllty responsiveness and proper resourcmg o FOUO Measures of Effectiveness The MOEs assess changes in system behavior capability or the operational environment They measu re the attainment of an end state achievement of an objective or generation of an effect When expressed quantitatively MOEs generally reflect a trend or show progress toward a measu rable threshold The MOEs enable cyberspace operations planners to ma intain updated cyberspace topographies of enemy computer networks engineering programming high-value targets and functions of identified centers of gravity FOUO In order for any MOE to be valid it must have the following characteristics o Relevant to the intended effects and objectives o Measurable from a baseline that demonstrates movement toward or away from the effects and objectives o Responsive enough to enable a commander to make timely follow-on decisions or veri fy expectations of mission accomplishment along With assessments of projected and unexpected secondary and tertiary effects o Supported by sensors and reporting systems Without proper commitment of reSOurces it would be nearly impossible to obtain an ac u- rate responsive assessment of the action results FOUO Measures of Performance The MOPs are Criteria for measuring task performance or a ccompitshment They are generally quantitative and are used in most aspects of combat assessment which tYpically seeks sp ' f' eCI IC quantttahve data or a direct observatio n of an FOR OFFICIAL USE ONLY 3-10 vent to deterll1ine accomplishment of tactical task s In cyberspace operations an appropriate MOP might pertain to the ability to obtain a 'required access or implant a particular exploit or defen se Analysis of data collected on MOE MOP will allow the planners to make a deteIlllination on the success of the cyberspace ope rao t10ns across all three LOOs DODIN ope rati ons DCO OCO For example the cyberspace operations planner can assess effects on a target and any reattack recommendations if needed as well as assess the reliability and resilience of the network Inherent latencies often exist between OCO actions and effects hence indications of first second and third order effects may vary greatly in time from hours to years FOUO A detailed deSCription of cyberspace targeting and OCO tactics techniques and procedu res can be found in Joim No n-Kinetic Effects Integration Tactics Techniques and Procedures Additional information can be found in JP 3-60 and JP 3-12 Cyberspace Information Requirements FOUO Information requirements are general or specific subjects upon which there is a need for the co ll ection of information or the production of intelligence During problem framing the MAGTF staff identifies gaps in what is known about the adversary the operational environment and friendly forces In follnation requirements can be general or specifi c and requi re an answer to facilitate mi ssion success The two broad categories of information req uirements are friend ly force and adversary operational environment requirements Friendly Information FOUO Information gaps related to f iendly forces are answered by the relevant orgamzallons within or in s upport of the MAGTF The exact number of vehicles or aircraft available to support a particular COA cou ld be a n exan 'ple of a question that need s to be answered pnor to mi ss ion Th '1 bility of communications executIOn e aval a eOA would be an data networks to support a ent to which example of an infoIlJlatIOn reqUlrem cyberspace planners may need to respond Intelligence Requirements FOUO Information gaps related to the adversary or the operational environment are referre d to as intelligence requirements Th G-2 S -2 IS responsible for coordinating collectIOn assets to support the collection analysis and productIon of intelligence to answer intelligence requ rements Cyberspace-related intelligence reqU1reme ts may require long lead times to coordmate wI th theater- national-level collection assets It IS therefore important that the planning staff specifically the G 6 S-6 and SIGINT electroruc warfare organizations collaborate and identify intelligence requirements early in the planning process The current nodal construct of an adversary's data network or the specific technical details of a proposed target are examples of cyberspace related intelligence requirements For additional infollnation on information intelligence requirement s see MCWP 2-2 MAGTF Intelligence Collections and MCWP 2-1 Imelligence Operations Cyberspace and Information Operations FOUO Infollllation operations is the integrated employment during military operations of IRCs in concert with other LOOs to influence disrupt corrupt orusurp the decisionmaking of adversary and potential adversaries while protecting that of friendly forces The IRCs are tools techniques or activIties employed across all dimensions of the Information environment that can be used to create effects and operationally desirable conditions Therefore cyberspace operations capabilities offenSive or defensive are IRes that may be e ployed to support Information operations obJect1v s For example cyberspace can be used as a medIUm to support military information support operations or mllttary deception FOR OFFICIAL USE ONLY Marine Corps Cyberspace Operations o _ _ _ _- - - - - - - - - 3 - 1 1 Cyberspace and Electronic Warfare o FOUO The existence of the virtual layer of cyberspace is largely dependent on the physical eXistence of the electromagnetic spectrum EMS In telInS of tact'IcaI ml'1'ltary operations electronic wan are an d cyberspace operations can ' and to the extent possible should be mutually supp rting Even m cases in which they are not used synergistically they must be deconflicted with each other and with other EMS-dependent activities The overarching goal of electronic warfare is to enable co manders to gain and maintain freedom of aCti n across the physical domains and the information environment which includes cyberspace through control of the EMS Control of the EMS is ac ieved by the effective management and coordmatlon of friendly EMS-dependent systems such as communications and ISR while counter mg and exploiting adversary systems o ' o o o FOUO Electronic warfare which includes electro nic warfare support electronic attack and electronic protection are all the military activities conducted within the EMS to influence the operational environment in support of the commander' s objectives In practical tell us electromagnetic spectrum operations EMSO merge electronic warfare with spectrum management and closely coordinates the efforts of EMS-reliant disciplines particularly SIGINT cyberspace operations space operations and information ope rati ons Electromagnetic spe ct rum ope rati ons do not replace electronic warfare and spectrum management instead EMSO align the two disciplines most respon sib le for transmissions across the EMS Additionally EMSO support management of EMS collections and the require ent to accurately characterize the electromagnetic operalIonal ent It supports integratIOn With cyberenvlronrn nfi space operations as well as space and I ormatton operations and encourages op ratlOnal synchro l - zation between mission-essenttal EM -rehant diSciplines in support of commander's obJecttves FOUO Technological advances continually redefine how operations wlthm cyberspace and the EMS converge Payloads techniques and tactics are rapidly created and rendered obs lete while the processes by which these capablltttes are planned requested approved and employed evolve at a much slower pace To maintain operational tempo and leverage combined arms to the greatest extent the Marine Corps employs the MAGTF Cyberspace and Electronic Warfare Coordination Cell CEWCC The CEWCC concept originates from the traditional Elect ronic Warfare Coordination Cell but with additional capability for planning requesting and or coordinating organic and external support for cyberspace operations The CEWCC is the principal mean s for the commander to plan coordinate synchronize and deconflict operations in and through the EMS and cyberspace and assess their potential impacts on the electromagnetic operational environment and cyberspace respectively By leveraging the staff section's expertise and relationships in an integrated planning process the CEWCC can enhance collaborative decision support and feedback reduce apparent cyberspacelEMS technical complexity and enhance nonorganic capabilities and reachback support FOR OFFICIAL USE ONLY I o 3-12 -'- - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 o o o o o o o o This Page Intentionally Left Blank o o CHAPTER 4 o EMERGING CAPABILmES o o o o New organizations and network architecture efforts have been established within DOD to address the challenge of cyberspace operations merglDg capabilities that will sil nificanth' lDcrease the Marine Corps' capacit -to condu cyberspace operations include Cvber Mission Force MAGTF Cyberspace and EI ctronic Warfare Coordination Cell and the Joint Information Environment lanned ooerarions to IDeet mis sion t e-eds f 'r problem set and to rapijly ey limte decide_ and take acUoo in nS 'C to u x 'xf cted and in llie simarions in C o The ' IT d e 'eleiruOlced b ' intdligence support te IS wb '-b prO ice zrlditio'nal capaci ' in the i'Olm of 3ml 'sis lin auistics_ reporting c X'bili ' 1001 dcwlormenL and tan etin9 'These team are prepared to defend the narlon response to ioreign oo ile peciiie - action or immjrQ1 thtcCls Cyber Mission Force o o Combat Mission Tearn FOUO On II December 2012 the Deputy Sec retary of Defense'S Management ACtion Group approved the cyberspace force presentation model with implementation that began in 2013 This model builds upon existing cyberspace forces such as Service computer network defense service providers and network operations and seeuri ty centers It establishes the DOD cybe space mission force which contains national mission teams NMTs combat mission teams combat support team and cyber protection teams The Marine Corps through MARFORCYBER has been tasked to provide 13 teams I NMT 3 combat mission teams I combat support team and 8 cyber protection teams by fiscal year 20 I 6 National Mission Team o in bc sp3C'e FOUO A n NMT is a USCYBERCOM force co nstituted and designated by Commander USCY B ERCOM The NMT is supported by the Natio nal Secu ri ty Agency Central Security Service It co n s ists of dedicated offensive and defensive operators analysts planners targetee rslli res pl a n ne rs and leadership to conduct FOGO The combat mission team prmide s combatant command suppon and wben authorized assists the delivery of cyberspace effects against combatanl command prioritized tal gelS Combat Support Team FOGO The combat suppon team ill suppon the combat mission team to provide additional levels of analysis and fusion of all-source intelligence planning capability development and when directed conduct of oeO Cyber Protection Team FOUO The cyber protection team focuses on protecting tbe Department of Defense info mation networks and when authorized and directed may suppon other US government networks and the Nation's critical inflastJUcture A cyber protectIOn team consists of personnel organized under a leadership element with subelements task -organized around mission requirements Each member is trained to execute DCO to sustain cyberspace superiority against nation state and asymmetric threats within cyberspace o FOR OFFICIAL US E ONLY 4-2 - - - - - - - - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 340 02 oMAGTF Cyberspace and -- Electronic Warfare Coordination Cell o o o The CEWCC coordinates the integrated plannIng execution and as sessment of cyberspace and EMS actions across the MAOTF's operattonal e vlronment to increase operational tempo an d achieve military advantage To perf01111 this pnmary function the CEWCC is placed within the MAOTF at the commander's discretion but should be established within the command' element S-3 0-3 in order to ensure it can support all phases of the COmmander's scheme of maneuver with EMSO and cyberspace operations Such operations can be complex technical highly classified and may have global consequences Wherever the CEWCC exists it is responsible for coordinating across principal staff sections e g G-2 S-2 0-3 S-3 0-6 S-6 major subordi nate commands major subordinate elements ' working groups boards bureaus and higher head quarters to enhance the integration of cyberspace and EMS-dependent capabilities applicable to all warfighting functions and MAOTF objectives During planning the CEWCC supports the development of the MAOTF's scheme of maneuver concept of fires support and appropriate detailed plans and annexes During mission execution the CEWCC supports coordinated actions in cyberspace and the EMS by providing enhanced collaborativ e decision support and visualization tool s to MAOTF staff sections and those organization s responsible for planning and employing various cyberspace- and EMS-dependent capabilities The CEWCC concept is consistent With emerging joint doctrine for EMSO and perfollns the function of the traditional electrol11c war are coordination cell but with additional planning and coo rdinati on considerations for relevant cyberspace operatio ns and EMS management functions performed by the G-2 S -2 and 0-6 S-6 capac I' t y CEWCC planners will o In thiS II often th support these s taff sections as we as e - infollllation operatIOns wor k'In g group ' the radio battalion detachment and unmanned aena sys tern p Ianners S ummarizing the aforementJone II the CEWCC performs the fo oWing actIOns h MAGTF basic organizational tasks to en ance mission accomplishment o Enhance collaborative decision support and feedback o Reduce apparent cyberspacelEMS technical complexity o Enhance nonorganic capabilities and reach back support Joint Information Environment In November of 2011 the Commander USCYBERCOM briefed the Joint Chiefs of Staff on the risk associated with the inability to see the entire DOD network in order to protect and defend it and made recommendations to consolidate information technology infrastructure to improve effectiveness In response the Joint Chiefs of Staff directed the J-6 and USCYBERCOM to work with the DOD chief information officer to develop a joint information environment The overarching concept of the Joint Infollllation Environment was to develop and engineer a network arch itecture with endUring flexibility to support existing and future capabilities identified by components and other future department programs The objective is to provide a secure joint information environment consisting of shared information technology infrastructure enterprise services and single security architecture to achieve full spectrum superiority improve mission effectiveness increase security and realize information technology efficiencies The joint information environment will be operated and managed per the Unified Command Plan using enforceable standards specifications and common tactics techniques and procedures Oy her laOIl 0fl r llrlll' Marine Corp o o o o o - 6- - - - _ - - J III etall MBE Mac o o MA Ul If III I Q w nll I 101 lil llIlIn 1111111 1111 1 -- - III1 IIU ' 1 1- oo h IIII II IUlw u 1 U I Wi _I I I flo II A w I '_I o I 'II I- ' hUl 'hl l I ' u I 1 1 II 111111 'I I I oI'I Ol I'l Il II IIIII'I'''IIIII 1111 III 1'''''I''1I1I 11 '11 II HII III II I 111 111'1 II ' t Wt 'L'I'lhlll 1111 II ' W'H I I ' 1 1111 10 ' ' 1 1'1 11 1 I' w I IoW' I'w'tI I J II tl l' I ' h' II'oIl IIIU W 1 I ' I I II ' 11 I IHI'hl I' 'L1 I t I 'h I''''hl''' II I'II''II hli'' III'f 111 1- '110 Ii I II h' 1 'hlll 10111'1' 1'11 1 1'1 11 o J U 11611 II b 1 1 1 I t tl nil I ' II I 1 1 I iI IUlh WI wIlt IIII Iii r II 1 1 1 ' I'''IIIIIIIII II''11 I 1 'I II I ll I I II I It l I' IllIh' II M h I ' I ' I t III I III 1 '111 l EGIi NO CE CO lllIlIlrll1ll I I 1I11 EM EW 1 l lIllh 1 1 1 11 110111 ' lIlltUI Dh 11 lIl ll1lJ I1 110 flNSA Dla Ih lll' Wl l iI lIa JlllnlhUh41 nW U III''' 11111 Ii III I loI' hll IIIIIH I ali lDI Ffee FIiR G '0 I FOC Mac MSE OPT ul III 4 I nll 'l hUI P b h tll h u u l1u vlDw IllltliJI 1111 11 111 1111 III 111'PI 1lh 'II l hlllll'lI 1 11 a Illlal II Hilitul II lnJ1l1 1 1111111 1 1 111111111111 1 IIht lll ' 110 '101111 111 1111111111111 o 1 1'''I l hUIIIII'I'lI l lIIiU h h llli FIOlIre 4-1 CYbllrapa e IIIHI o 1 1 II IH lIf1j'l It III 1111111 II II oo b JII II W Ijfjllu f t ' r WI ' '''''i II I W 1 1 'lhlll l'I III loIlI 1 11 Ihlll 111 01 1 ' 1 1111 H I h 1 t Aj o o t't III' 'I'1 I l u nl l JOC I Of Sh Ul-ht oo Itt '''' ' I WI' ' l hIHI - ' E uernal C 11flhllll y Pro lcll1h' I' III l ronl o Warfllrll I j llll ' III 11' 11 t WtlA HIIII I IiI WI f ttUlllltft 1 q lw' lllI D o o 4-4 - - - - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 I Io o o o o o oo o o o o Thi s Page Intentionally Left Blank o o o GLOSSARY o o o o oo SECTION CCD R combatant commander CCIR com man d' I er s cntlca CCM informati on requirement D com batant command CEWCC Cyberspace and Electronic COA Warfare Coordination ell CO course of actIOn NOPS concept of operations DCO defensive cyberspace operations DIRINT director of intelligence USMC DOD Department of Defense DODIN Department of Defense inform ation networks o o EMS electromagnetic spectrum EMSO electromagnetic spectrum operations FOUO for official use only G-2 assistant chjef of staff intelligence G-3 assistant cruef of staff operations G-6 assistant chief of staff communications system IOWG information operations working group IPB o intelligence preparation of the banlespace IR intelligence requirement IRC information-related capability ISR intelligence surveillance and reconnaissance o J-6 communications system directorate of a joint staff command control commlmications and computer systems staff section JP joint publication JWI CS Joint Worldwide Intelligence Communi cations System LOO line of operati on I ACRONYMS MAGTF Marine air-ground task force MARFORCYBER United States Manne Corps Forces Cyber Command MCEN Marine Corps enterpris networ MCICOM Manne Corp Installation Command MCNOSC Marine Corps Network Operations and Secunty Center MCPP Marine Corps Plannm P cess MCWP Manne 0 ps warfighting publicatIOn MEF Marine expeditionary force MEU Marine expeditionary unit MlTSC Marine Air-Ground Task Force Infolmation Technology Support Center MOE measure of effectiveness MOP measure of perrol mance MOS military occupational specialty NMT national mission team OCO offensive cyberspace operations OPCON operational control OPE operational preparation of the environment RAP review and approval process RNOSC Regional Network Operations and Security Center ROE rules of engagement S-2 intelligence officer S-3 operations officer S-6 commurucations system officer SCI sensitive compartmented infolmation SIGINT signals intelligence TFSMS o Total Force Structure Management System USCYBERCOM Uruted States Cyber Command USSTRA TCOM United States Strategic Command I I Glossary_2 - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 I o o o o oo SECTION II TERMS AND DEFINITIONS clcc rontagnetic spectrunt operations The totalIty of military activities conducted within the EMS to influence the operational environment in SUpport of the commander 's objectives Al so called EMSO c1ech'onic attack A division of electronic warfare invol ving the use of electromagnetic energy directed energy or antiradiation weapons to attack personnel faci liti es or equipment with the intent of degrading neutralizing or destroying enemy combat capabi lit y and is considered a form of fires JP 1-02 electronic protection A division of electronic warfare involving actions taken to protect person nel facilitie s and equ ipm ent from any effects of l frJ end ly or enemy u se of the electromagneti c spectrum that degrade neutra li ze o r destroy friendly combat capability IP 1-02 electronic warfare Support A divi sion of electronic warfare involving actions tasked by o r under direct control of operational commander to o search for intercept identify an locate or loca - ces of intentional and umntentIOnal radlIze sour C' th ose of ated electromagnetic energy lor e purp immediate threat recognition targetIng planmng and conduct of future operations JP 1-02 information environment The aggregate of individuals organizati ons and systems that collect process disseminate or act on infOIl nation operational environment A composite of the co nditi ons ci rcumstances and influences that affect the employment of capabilities and bear on the decisions of the commander IP 1-02 operational preparation of the environment The conduct of activities in likely or potential areas of operations to prepare and shape the operational environment Also called OPE JP 1-02 target I An entity o r object that performs a function for the adversary considered for possible engagement or other action JP I -02 part I of a 4-part definition o o o o o o Federal Publications o Presidential Policy Directive PPD 20 U S Cyber Operations Policy United States Code Title 10 Armed Forces United States Code Title 50 War and National Defense Department of Defense Directive DODD 8500 1 lnfonnat ion Assurance Chairman of the Joint Chiefs of Staff Publications o Chairman of the Joint Chiefs of Staff Manuals CJCSMs USTO Supplement to Joint Operation Planning and Execution System JOPES 3122 07_ Vo lume I Planni ng PoliCies and Procedures 3122 08_ lJSTO Supplement to Joi nt Operational Planning and Execution System Volume II Planning Formats and Gu idance 3139 01 _ Review and Approval Process fo r Cyberspace Operations U 3150 07_ Joint Reporting Structure for Cyberspace Operations Status 32 13 02_ Joint Staff Focal Point Program 6510 01_ Cyber Incident Handling Program Chairman of the Joint Chiefs of Staff Instructions CJCSls 58 10 01 D Implementation of the DOD Law of War Program 65 10 0 1D Information Assurance IA and Computer Network Defense CND Joint Publications JPs 1-02 1-04 2-01 3 3-0 3- 12 3- 13 3-13 1 3-60 6-0 Department of Defense Dictionary of Military and Associated Terms Legal Support to Military Operations Joint Intelligence Preparation of the Operational Environment Joint Operations Cyberspace Operations Info nnation Operations Electronic Warfare Joint Targeting Joint Communications System Marine Corps Publications Marine Corps Doctrinal Publication CDP 1-0 Marine Corps Operations o - - References_2 - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ MCIP 3-40 02 Marine Co s Warn htin Publications MCWPs o '5-40 3 Communications and Information Systems o 3-43 3 Ma ' A' o nne Ir-Ground Task Force Fires o -I Intelligence Operations 1 2-2 MAGTF Intelligence Collection 2-22 Signals Intelligence 5-1 Marine Corps Planning Process arine Cor 6C 6 6A s Reference Publications MCRPs Tactics Techniques and Procedures for Fire Support for the Combined Arms MUltt-Service Tactics Techniques and Procedures MTIP for the Jomt AppitcatlOn of Firepower JFIRE ommander arine Corps Orders MCOs 10004 5230 21 5239 2A Cyberspace Operations Information Technology Portfoli o Management Marine Corps Cybersecurity Program MCCS P Miscellaneous Marine orps Regional NETOPS Tasking and Reporting Structure 30 july 2012 United States Marine Forces Cyberspace Command Campaign Plan FY 12-15 o MAGTF Cyberspace and Electronic Warfare Coordination Cell CEWCC Concept I Miscellaneous Capstone Concept for Joint Operations Department of Defense Strategy for Operating in Cyberspace Execute Order to Implement Cyberspace Operations Command and Control C2 Framework 21 lune2013 loint Concept for Cyberspace USSTRATCOM Unified Command Plan United States Strategic Command's l oint Test and Evaluation Activity published loint Non-Kinetic Effects Integration Tactics Techniques and Procedures TIP o o                     National Security Archive    Suite 701  Gelman Library  The George Washington University    2130 H Street  NW  Washington  D C  20037    Phone  202 994‐7000  Fax  202 994‐7005  nsarchiv@gwu edu