Lt. Col. Graham Williams, U.S. Army
Download the PDF 
One believes things because one has been conditioned to believe them.
—Aldous Huxley
The Time Is 2337/Execution Plus 22
“Col. Brady. You can go in now, sir.”
“Uh, what?” I snapped out of it. I had zoned out for a minute.
A captain who worked at the division headquarters was standing in front of me. “The briefing area is set up. You may enter.” He motioned his arm toward a door across the hall from where I was standing.
“Oh, thanks. Sorry, I was daydreaming.” I was, in fact, exhausted. I had not slept for days as the division’s G-3 operations officer.
I walked into the briefing room of the division tactical assault command (DTAC). The division occupied an old, abandoned wheat co-op as our command-and-control location. The idea was genius—to hide in plain sight. The division commander always explained that survivability of command nodes, in the conflict we were currently in, is about looking unimportant. So, we tried to do just that.
The room I entered is a video teleconference office off the command center in a dilapidated office. Wires ran under the door to provide light, and on a small old table was a singular tablet used for video conferences. There were no frills with the DTAC. We operated using minimal power, were paperless, and the staff hot bunked work locations to allow our equipment and vehicle footprint to be as small as possible. A large footprint meant more of an electronic signature and potential detection by our enemy. We also had to be mobile and ready to relocate to a new location on short notice.
I entered the room and sat at the table. The deputy commander for operations and I were scheduled to receive guidance from the division commander using a data link teleconference. The deputy commander arrived right before we deployed, and we worked well together so far. I had yet to form a full opinion on him and was unsure of his thoughts of the division commander.
The division commander was like no other leader I had worked with. He was a visionary and seemed well ahead of his time. It was as if the Army had handcrafted him for this conflict.
The early part of his career was normal. However, at some point, he became a futurist and began to theorize how the Army would fight in future conflict. He was an academic, an adaptive pragmatist, and also a technophile, meaning he was an advocate for a digital army of tomorrow. This Army could gain the technological advantage over adversaries as the way to win any future conflict. As his career progressed, he became increasingly critical of the maneuver tactics the Army had used for decades, and he yearned to develop an alternative method of fighting. He led the division at the combat training center and developed a plan that created maneuver space in all domains. He slowed the tempo to allow combat enablers to set the conditions that made maneuver forces more successful. Instead of focusing on standard tactics and the rinse and repeat method used by most commanders, he focused on winning the battle of narratives in infospace.
The deputy commander arrived. “Sir, good to see you again,” I said as I extended my hand.
“Hey G-3, how ya doin’?” he said as he shook my hand. “Any read ahead as to what the boss is going to tell us this morning?”
“No idea, sir,” I replied. “We will find out together. You know how he is with OPSEC.”
The deputy commander and I sat down at the table in front of the tablet and waited for the meeting to begin. Before the commander joined, I spent the time reflecting on the current situation the division was in.
We deployed over a month ago and were rushed to the front as part of a multinational corps in a defensive posture along an international boundary. The overarching plan was confusing and lacked intent. Part of the division’s focus was partnering with local national security forces while acting as a deterrence force. As of right now, there was no plan to cross the boundary. But our forward units were beginning to feel the reality of the situation against a determined enemy. Probing attacks were taking place. The enemy was becoming increasingly aggressive, targeting command and control nodes using unconventional methods we did not anticipate. The units on the boundary dug in and were living in austere and miserable conditions. Even the division C2 nodes had to be creative. The DTAC occupied an old structure, and the main CP (command post) was miles away from us set up outside a village in numerous buildings. The main CP acted as a COOP (continuity of operations) site for us if we had to displace due to detection.
The VTC screen clicked on, and the division commander appeared. He was in a dimly lit room, with light illuminating only part of his face, as he hulked over the tablet in a Col. Kurtz fashion. He looked tired.
“Good morning, gentlemen,” he said.
“Good morning, sir,” we replied.
“Gentlemen, I want to use this communication window to provide you with some intelligence and commander’s intent. G3, please ensure that this information is sent to the brigades in the next comms blast.”
“Will do, sir,” I replied.
He continued, “The first thing I want to talk about is OPSEC. We recently had a violation from one of the brigades where an individual used an unsecure device to communicate with someone back home. This was immediately detected and the unit, who had been digging into their positions for quite some time, had to relocate. I cannot stress enough the importance of OPSEC and the Big Three rules I created to remind soldiers.”
The division commander was constantly dwelling on OPSEC. With good reason. After our deployment was announced, the division’s public website was defaced by a malicious cyber actor. He constantly posed the question, “Why are we, as an Army, openly broadcasting everything we plan to do? Well, not anymore.” He developed three simple rules to remind soldiers that their carelessness could get others killed. Especially with an adversary that was so advanced with surveillance and detection.
“Next, I want to talk about winning in infospace. We have become increasingly data centric and operating in a contested environment exposes our vulnerabilities. This includes our electromagnetic signature, our artillery target acquisition equipment, and our reconnaissance and surveillance sensors we have emplaced. All of these items must be defended in the cyber domain. We have dedicated cyber defense teams located stateside that are monitoring these systems. Since we have deployed, in a little less than month, there have been twenty thousand intrusion attempts on our networks. It is not a matter of if but when we are compromised. That is why we need to stress to the units the importance of communication windows and minimizing our electronic signature to not appear as an easy target.
“I fully anticipate that our subordinate commands will be cut off communication wise with the division. That is why I plan on providing my commander’s intent to allow them to execute operations without requiring daily communications from me.”
He went on, “Maneuver wise, I do not see us going on the offensive as early as we planned, and this is out of our control. I have highlighted the risk associated with sitting in defensive posture for long durations to the corps commander. My counterpart, the local national defense unit commander, has also expressed his concern. We must remember, the local national forces are defensive in nature. We are required to mimic this with how we use our forces. Once we are given the go ahead, we will set the conditions in the cyber, electromagnetic, and fires domains, at slower tempo to facilitate maneuver operations. I believe our long-range aviation is so far back from the front line, and easily detected once airborne, that the risk is not worth the reward for employing them at this time. But we will determine that when the opportunity presents itself.
“Survivability of our command-and-control nodes is of the utmost importance. I think some of the brigades and battalion nodes are very well hidden and dug into covered and concealed positions. Earlier today during one of our protection windows, we flew the division’s dedicated UAVs over the battlefield, and we did not spot any of the forward-deployed elements. We have done a good job digging in and hopefully the soldiers are not too miserable as bad weather rolls in.
“That is why our common operational picture (COP) is so important for the division. We need to know where all our forward electronic warfare sensors are, command nodes, and forward battle elements. This includes the local national elements. The command COP program on my tablet shows the number of electronic signatures we are picking up from both the enemy and ourselves. G-3, we need to continue to work the COP to the best of our abilities.”
“Roger, sir,” I replied.
“Lastly, I received an intelligence report that we need to disseminate to the units on the next comms window. It was passed to me from my local national counterpart who received a tip from loyalists on the other side of the boundary. They believe that an attack in our sector is imminent, and after one of his forces was attacked yesterday, I tend to agree with him. The information states that enemy forces are trying to disable command-and-control nodes along the defensive battle positions to conduct reconnaissance and in preparation for future attacks. They will most likely use plain clothes agents and UAVs during these attacks. G-3, I recommend using the ORSA (operations research and systems analysis) to conduct predictive analysis to identify where such an attack would occur on our front.”
“Acknowledged, sir. And we will develop a sensor and intelligence detection plan to provide early warning for such an attack,” I replied.
The meeting ended in an unspectacular manner and the deputy commander and I parted ways. I decided to head back to the main command center to get to work.
The Time Is 0210/Execution Plus 23
I sat down on a folding chair in the middle of the command post as staff officers quietly milled around the room. I wrote down a few notes as I prepared to give my guidance. They looked exhausted but were still motivated.
“All right, team,” I said. “Gather around so I can put out some notes.”
The group of officers gathered around a large table with a map on it. Most had tablets in their hand.
“I forwarded you all some notes that the division commander relayed to us. The first task is for the ORSA and intelligence officer. I need the two of you to run some predictive analysis based on the intelligence report from the commander. This analysis will include a prediction of where and when such an event would occur on the battlefield. I need to know your prediction as to which unit so we can war-game the scenario.
“Roger, sir,” the ORSA replied.
I continued, “Once we have this information, I want to look at all of the forward sensors we have and program them for detection. This includes the TITAN, the HADES when we have a safe aerial flight window, and electronic warfare sensors near the forward units. I do not want to be caught off guard if there is an attack.
“Next for the maneuver planners. I need you to work with the division fires and effects elements to war-game a course of action where we transition from the defensive to the offensive and back to the defense. Determine what conditions will need to be set for when we cross the international boundary. I recommend pulling in the protection cell to determine what critical capabilities need to be protected when we execute this. Include the lead engineer so we can account for potential mine clearing operations.
“This leads me to protection. More specifically, for the DTAC. Electronic warfare officer, please give an update on the MEMSS.”
The protection and electronic warfare officers moved forward. The protection officer began first. “Sir, the modular electromagnetic spectrum system is a system that surrounds the DTAC with an electromagnetic bubble. Think of it as our number one protection capability for the command post using deception.”
The electronic warfare officer cut him off. “While the MEMSS has been around for a while, the DTAC has the newest variant. We can obfuscate our electromagnetic signature by either masking our emissions or using AI generated false traffic to hide in plain sight. The MEMSS is smart in that it can pick up on other sensors we have in place, which creates similar traffic, and assists in confusing the enemy with electronic detection. This variant also has an emitter that protects the DTAC within a certain range from small UAVs.”
“It’s not all rainbows and unicorns,” the operation sergeant major spoke up. “There are two issues we have with this and other intelligence collection equipment. First is the classification of the system and the data that it produces. There is a lag between signals interception, analysis, and dissemination of the intelligence.”
I was aware of this issue. The Army was able to add to their cyber, electronic warfare, and intelligence capabilities with success. The issue units face is the classification associated with the systems. The division could no longer operate with a sensitive compartmented information facility (SCIF) since we did not have the space and manpower. We had to accept some risk with the sensitive nature of classified information to facilitate information sharing.
He continued, “The second issue is, you guessed it, power generation.”
Power generation was a significant issue for the DTAC. In the past, we had numerous generators running day and night outside of the division’s structures. This had to change now that we were located so far forward. We were issued quiet-running generators that ran on fuel sources other than petroleum, including solar. However, the cost of these generators was incredible, and we were limited to the number we had on hand.
“Sergeant major, I need you and the section leaders to develop a power generation plan. This plan should include determining peak-usage times and what needs to be turned off to support operations. For example, what equipment needs to be running during communication windows.”
“Will do, sir,” he replied.
I turned my attention to the large map on the table in front of me. The map was covered with acetate overlay sheets and different colored symbols annotating different things.
“Here is my assessment of current operations and our common operational picture. Please tell me if I am correct,” I moved around the map and grabbed something to point with.
“Our maneuver brigades and the local national elements are in the defense along the international border. They are operating in noncontagious areas of operations, meaning that the area in between them is controlled by us. We have our long-range artillery batteries located back here in their hide positions. The DTAC is thirteen kilometers from the front line with the division main command post forty-five kilometers away collocated with the aviation element. Someone confirm the location of forward sensors and assets.”
“Roger, sir,” the electronic warfare office spoke up. “Three of the brigades have SIRENS located near their positions. They emit an electromagnetic flurry of information to help obfuscate the units using AI decoy technology. Each battalion has terrestrial layer systems manpacks at the platoon level. The locations of the electronic warfare platoons are marked on the map, sir. Located as these locations,” he said, pointing to the map.
“Okay. We need to ensure that the units have the same picture of the battlefield that we have. Make sure that it is pushed out in the next comms blast. Let’s reconvene in a few hours to make any necessary adjustments.”
The Time Is 0435/Execution Plus 23
A few hours passed and I began to put together a message to send to the division commander. As I finished, I noticed a few staff officers gathering around the large map in the center.
“Sir, do you have a minute for an update?” one of the officers asked.
“Yes, please go get the deputy commander,” I replied.
The deputy commander and I gathered around the table and one of the officers spoke up, “Gentlemen, this is an update from the instructions given to us earlier. We were tasked to conduct predicative analysis on the location of an attack on our defensive positions. We analyzed a tremendous amount of data to come to this conclusion. This data came from emplaced sensors, aerial intelligence platforms, and other national intelligence assets. The analysis we compiled is also on your tablets.”
I looked at my tablet and opened the message to look at the report. It appeared that a lot of hard work was put into it. I noticed the graphs and tables as well as graphics on a map to reinforce the points they were making.
He continued, “From this data, we came to the conclusion that an attack will most likely occur in the first battalion area of operation at dawn this morning.”
“This morning? That’s not a whole lot of a warning,” the deputy commander exclaimed.
The intelligence officer spoke up, “If I may, sir … this analysis, combined with signals intelligence from the forward emplaced assets suggests that enemy forces are preparing for the first stages of their assault. This includes reconnaissance attacks across the border and setting the conditions for conventional units.”
“What are your recommendations?” the deputy commander inquired.
The intelligence officer spoke up, “I recommend we break the communication window immediately and notify the unit. This will give them time to queue their sensors and be prepared.”
“G-3, I agree we need to notify the unit. I’ll let the division commander know we are breaking OPSEC protocol. It’s too risky to wait and not notify the battalion,” the deputy commander whispered to me.
“Watch officer, establish a satellite link between us and first brigade,” I ordered.
“Roger, sir. The link is established now,” the watch officer replied. “Send your traffic, sir.”
The connection was grainy at first and then it cleared up. I sat down in my chair behind my table. The video connection established and saw a lieutenant colonel on the other end in the brigade command post.
“This is Col. Brady, the G-3 operations officer. We have a validated report that there is an imminent probing attack within your AO templated within the next twelve hours. Take all necessary survivability precautions. Report outside of the comms window and update ONLY if events are per the commander’s critical information requirements. If not, wait until the next comms window. The assessment is coming through now. Acknowledge, over.”
“Roger, sir, acknowledged,” the lieutenant colonel on the other end replied.
The link terminated.
“Watch officer, send the assessment report to the first brigade command post as soon as possible. Once sent, disconnect the satellite link,” I ordered.
A few seconds went by.
“Message sent,” the watch officer exclaimed.
I sat back and thought about what to do next. What instructions should I give the watch officer and the staff? I knew I was violating the division commander’s guidance and any action I instructed them to perform could run the risk of exposing both the DTAC and the brigade to detection and a potential attack.
I was flanked by the current operations officer and the staff stood around the map board as if we were awaiting a reply from the brigade. However, we disconnected the communications link between us and them. If we were to prepare to support them, we would have to have communications established. But again, this could be risky.
“What are your instructions, sir?” the current operations officer asked.
I spoke up, “Well, team, here is the predicament we are in. We need to be able to support the brigade if called upon. But we also need verification that the attack is eminent. Unfortunately for now, all we can do is prepare and wait. In the meantime, here is what I want to happen. I want to ensure all our forward sensors are operational and can validate an attack. Next, I want to ask the division commander to expedite the next communication and movement window to within the next hour or so. This means that we will need to task aerial electronic warfare assets to our area of operations. Then we need to prepare the long-range artillery for fire support but to be staged in their current hide positions. Then, prepare a message to send to the electronic warfare elements under the division’s control to detect any counterdrone assets in the brigade’s AO. Lastly, I want to know which of the electronic warfare SIRENS are turned on and emitting between now and an hour from now.”
The crew moved out and started to work.
The Time Is 0530/Execution Plus 23
About an hour or so went by, and I was discussing the situation with the deputy commander. It seemed that he felt his role was keeping the division commander informed and ensuring we were implementing his guidance to the best of our ability.
“Sir, what’s the boss thinking?” I asked the deputy commander.
“Well, I think his thoughts are similar to ours. On one hand, he does not want to expose our forces to attack. But he also knows how critical each force is to include their manpower and the terrain they hold, which needs to be protected. I feel as if this is a damned if you do and damned if you don’t situation,” he replied.
“Roger, sir, I think that—” I was interrupted.
“Sir,” the watch officer yelled, “Message sent from first brigade. They have a company in visual contact with enemy drones and reconnaissance elements.”
“Connect me via satellite link with the brigade,” I instructed as I moved around to my desk.
“Established, sir,” he replied.
I looked at my tablet and pulled up the communication icon. When the connection was established, I could see the face of the lieutenant colonel I spoke with previously. The connection was fuzzy, and his voice traffic was distorted and unreadable. Just then, the connection dropped.
“What happened? Reestablish the link,” I asked.
“Roger, sir. I’m trying. There seems to be an issue with the satellite link connection,” the watch officer replied.
I saw an NCO run into an adjacent room we were in to check the ground terminal.
Upon his return, the NCO stated, “The ground terminal appears to be offline. I cycled power to reestablish the connection, but it didn’t work.”
The electronic warfare officer jumped up, “Sir, the cyber protection team supporting our headquarters believes there was a cyberattack on the satellite station. They are working to remedy the situation now.”
“I need an estimate, please. In the meantime, communications section I need you to establish comms with first brigade using high frequency. Let me know when this is complete and when we received an update from them.”
The communications team ran out of the room and ran outside where the high frequency antennas were located.
I knew I was getting too involved in the fight and needed the current operations cell and the staff to come up with options. I pulled certain staff aside and gave them instructions. I told them we needed communications reestablished with the division main command post to allow us to keep the commander informed. The division commander was the one that held the authority to fire long-range artillery. I told them that we needed to retask any aerial electronic warfare assets that were airborne to support the unit in contact. This included linking the DTAC into video feed to observe what was happening on the ground. We would be able to do this without the satellite connection based on our alternate communications plan. I told the fires cell to use the communications plan to establish communications with the fires element at the brigade in case artillery support was requested. The team rushed around carrying out my instructions.
The Air Force liaison spoke up, “Sir! We have the feed from our UAS to view what’s on the ground.” He ran over to a projector in the center of the room and plugged his tablet into it. This allowed him to project on a blank wall so all could see.
The view was slightly distorted, but we could make out a dense pine forest area. We could not see any of our elements on the ground in their fighting positions. We knew generally where they were located.
“What is that at the top of the screen? Ask the operator to pan to the north of their central view,” I instructed.
The Air Force liaison officer used a chat function on his tablet to provide instructions to the operator. The camera panned north where you could see fast moving figures in the woods moving from west to east.
“It looks like dirt bikes or motorcycles,” someone called out. “Moving away from their positions.”
We continued to watch the projection and felt helpless. We were doing things to prepare to provide support but also wanted the brigade to fight their own fight. We were ready to assist with any assets we had available.
“Look,” someone yelled out. “They are receiving indirect artillery fire!”
We watched in horror as the UAS zoomed out and rounds impacted around the fighting positions. My thoughts turned to the poor soldiers who were feeling the concussion from the rounds. Despite this, I realized that the company was dug into the ground in their fighting positions. This would give them a better chance of survivability. It reminded me that we could be next.
A runner ran into the room, “Sir, we have high frequency communications between us and division and us and the brigade in contact. Here is the update, sir.”
The runner handed me a tablet with some notes scribbled on it. I quickly read it and handed it to the watch officer.
He read it out loud, “First brigade reports multiple enemy probing attacks in the vicinity of grid 35V NC 564962. Probing attacks had numerous mounted reconnaissance elements looking for targets of opportunity. Involved the use of multiple drone swarms as reconnaissance and target acquisition. The unit is currently under indirect fire at this time.”
“Okay, we need to ensure we have long-range artillery in position and ready to fire. We will contact the division main command post for authorization. Air Force LNO, have the UAS scan to the east of the fighting positions,” I said.
The Air Force officer got the message to the UAS controllers. We watched the projection as the grainy feed slewed toward the east. The operator did successive zoom in and outs to identify any threats.
“Wait. Tell them to go back to their last position and zoom in,” I called out.
“Roger, sir,” he replied.
As the UAS camera went back and zoomed in. You could see numerous shaded objects on the ground. Around twenty to thirty in total were scattered across a few hundred kilometers. It looked as if individuals were emerging from the darks spots to clear off brush or camouflage netting. It was soldiers preparing tanks for movement! Then, at the bottom of the screen appeared numerous tanks in a column, maneuvering between the pine trees, making their way from west to east.
As we were observing the main power of the DTAC began to fluctuate. It was as if someone was intentionally lowering the power levels of our generators. Then, after one last power surge, the power cut out.
----------
After the main battle subsided, the deputy commander and I provided an update to the division commander over a secure link.
The video on the tablet turned on and the commander appeared, “Good afternoon, gentlemen.”
“Good to see you again, sir,” I replied.
He began, “I am looking to get an update on the current situation along the front lines where first brigade is located.”
“Roger, sir, we are sending data and information that shows the current situation via secure link. While that downloads, I have just a few comments.
“Currently, the front line has stabilized. The enemy reconnaissance forces that aimed to defeat out C2 nodes were unsuccessful. This is because all the C2 elements were well concealed undetectable. Of course, our local national brethren did not fare as well.”
“Yes, I heard,” he interjected. “I saw some data that showed their forces were decimated.”
“As for the cyberattack on the DTAC, the enemy was able to access the electronic grid we used for power generation. While they were able to manipulate the power controls, that was the limit to their access. The cyber protection team dedicated to the division was able to quickly isolate the enemy threat and remedy the situation.
“The enemy used drone swarms in conjunction with armored elements. This included weaponized Lancet drones looking for targets of opportunity as tanks pushed forward. Again, because of our concealed fighting positions, they were unable to identify our fighting positions.
“Lastly, I cannot give enough praise to our sensors on the ground. The data they provided and their ability to provide an electronic warfare distraction for the enemy allowed us time to target the tanks using long-range precision fires,” I concluded.
The division commander leaned forward, “This is all great news. I will ask you gentlemen to not get too cocky with our success. My sense is that this was all too easy, and our victory might be short lived. Spend some time analyzing the data and develop options for other future scenarios. I feel as if we are missing something.”
Will do, sir,” the deputy commander answered.
A staff officer came over as the connection disconnected. “Sir, I think there is something you have to see.”
“What is it?” I replied.
We walked over to the tablet that ran the connectivity for the entire DTAC.
The staff officer continued, “I noticed we have a few new users on the DTAC communication system. When I went back to see when they were established, I saw the time was during the enemy attack. I can also see that there is an outbound connection initiated that is extracting data.”
“Is the cyber protection team tracking this?” I asked.
Just then the tablet’s connection cut out. One by one, devices on the DTAC infrastructure began to shut down. A look of panic came over the staff’s faces as their workstations turned off and monitors went black.
The attack was a diversion for something much larger. …
Note 
- Epigraph. Aldous Huxley, Brave New World (Harper Perennial Classics, 2014), chap. 17, EPUB.
Lt. Col. Graham Williams, U.S. Army, is a former infantry officer turned cyber officer who works as a J-35 planner in the Joint Force Headquarters-Cyber (Army). His assignments include the 101st Airborne Division, 10th Mountain Division, and the 4th Infantry Division. He also worked as a J-35 planner at U.S. Cyber Command.
Back to Top