USAF is considering proposals for a new software system to support cyber-weapons development so that US Cyber Command can be better-equipped. Public domain photo via Flickr.
The Air Force wants to buy a cyber weapons platform that can arm the online warriors of US Cyber Command at the warp speed of the internet rather than the tortoise pace of acquisition—and it’s looking at proposals now.
The Air Force Life Cycle Management Center (LCMC) in San Antonio, Texas, is seeking proposals for its Unified Platform (UP), a software system to support development of new cyber weapons. Because the cyber domain changes so rapidly, with new vulnerabilities emerging every day and others disappearing without warning as they are fixed, cyber weapons can’t be developed on conventional acquisition timelines. The initial program is funded for almost $30 million in FY2019.
This will not be a weapons platform in the way people are used to thinking about it, said Bill Leigher, director of DOD cyber programs at Raytheon’s Intelligence, Information, and Services business unit. “There’s no really good analogy for it.”
But one way to view it is like a multimission aircraft that can adapt the sensors and weapons it carries for different missions based on need.
“It’s a platform you can put other [cyber] capabilities onto,” said Chris Valentino, director of joint cyberspace programs for Northrop Grumman Mission Systems.
Indeed, the very name, Unified Platform, comes from the system’s role as a single platform through which all the cyber capabilities of US Cyber Command combat teams can be deployed.
David Hathaway, a cyber solutions executive with Lockheed Martin, said the contract winner will become “the system coordinator” for UP, responsible to “create, operate, and maintain a scaled, agile framework” for developing cyber weapons. It will first integrate legacy cyber capabilities and later build and deploy new ones.
The Air Force is leaving it up to the companies to announce whether the plan to bid on the project. Raytheon Intelligence, Information and Services; Lockheed Martin; Northrop Grumman; and Booz Allen have all said they have submitted proposals.
An LCMC spokesman declined to comment because the center is still evaluating proposals for the system, which it is buying for US Cyber Command to be used by cyber combat teams for all four services. The RFP was not released publicly, but a version will be released once the winning bid is known.
“The projected award date is only a short time away,” he said.
“In cyberspace, … the whole internet ecosystem in which you’re operating can change in seconds or minutes,” Hathaway said. A vulnerability that was ripe for exploitation in an adversary’s network this morning could be patched by the afternoon.
LCMC is taking an agile, startup-like approach to the program, seeking to stand up the service-oriented architecture that will provide a “minimally viable product” by the end of March 2019 and a fully working system by the end of 2021. UP will begin delivering capabilities to the warfighter at the minimally viable stage, according to an Air Force budget justification.
“They intend to build it in an iterative or spiral fashion… Block by block,” Leigher said. Once the existing weapons systems are integrated into the new framework, the services and Cyber Command will begin adding requirements for additional capabilities, which will be prioritized and made available in a series of development sprints.
Following an agile software development model, Valentino said, means new tools could be released within “as little as two weeks, once you have the infrastructure set up.”
UP will have an “execution and delivery cycle” for new requirements, he explained, which might have for example 90 day development sprints to incorporate new capabilities, and major releases to update the entire system perhaps every six to 12 months.
“You’re delivering that development constantly,” Valentino said.
Raytheon’s Leigher praised the approach. “With this first-of-a-kind system, it would not have been wise to force an operational element to completely describe what it is they want,” he said. To do so would be to risk “locking themselves in to a systems of systems which would quickly become obsolescent, given the speed at which cyber [warfare] is developing.”
Until 2015, Hathaway said, each of the services had been moving forward on the cyber front independently, developing indigenous cyber capabilities as part of their mission to train and equip forces. There was a need to “put all the pieces together,” and integrate offensive, defensive, and intelligence or surveillance tools into a single system that would let US Cyber Command deploy all of its capabilities in an integrated fashion.
The following year, Air Force Space Command launched an “analysis of alternatives” process to examine possible approaches to UP. The program was eventually transferred to LCMC, which issued its final RFP in July.
The program is not quite as ambitious as once conceived, Hathaway said. But only slightly less so.
“They’re still aiming to eat the whole elephant,” he said, “Just not all at once.”