Franklin Holcomb is a graduate student from the U.S. at the University of Tartu, Estonia and a former research analyst on Eastern European security issues in Washington, D.C. Divergent Options’ content does not contain information of an official nature nor does the content represent the official position of any government, any organization, or any group.
Title: Assessment of Militia Forces as a Model for Recruitment and Retention in Cyber Security Forces
Date Originally Written: September 25, 2019.
Date Originally Published: November 18, 2019.
Author and / or Article Point of View: The author is a graduate student from the U.S. at the University of Tartu, Estonia and a former research analyst on Eastern European security issues in Washington, D.C. He is a strong believer in the Euro-American relationship and the increasing relevance of innovation in security and governance.
Summary: U.S. and Western Armed Forces are struggling with recruitment and retention in their cyber units, which leaves their countries vulnerable to hostile cyber actors. As society becomes increasingly digitalized in coming years, the severity of these vulnerabilities will increase. The militia model adopted by the Baltic states provides a format to attract civilian experts and decrease vulnerabilities.
Text: The U.S. Armed Forces are facing difficulties recruiting and retaining cyber-security talent. To meet this challenge the U.S. Marine Corps announced in April 2019 that it would establish a volunteer cyber-auxiliary force (Cyber Aux) consisting of a “small cadre of highly-talented cyber experts who train, educate, advise, and mentor Marines to keep pace with constantly-evolving cyber challenges.” The Cyber Aux will face many of the issues that other branches, and countries, have in attracting and retaining cyber-security professionals. Cyber Aux takes notably important steps towards increasing the appeal of participation in the U.S. armed forces for cyber-security experts, such as relaxing grooming and fitness standards. But Cyber Aux will struggle to attract enough professionals due to factors such as its role as a mentorship organization, rather than one that conducts operations, and the wide military-civilian pay gap in the cyber-security field. These factors will ensure U.S. and North Atlantic Treaty Organization (NATO) military forces will have suboptimal and likely understaffed cyber components; increasing their vulnerabilities on and off the battlefield.
Estonia, Latvia, and Lithuania have been on the geographic and virtual frontlines of many challenges faced by NATO. The severity of threats facing them has made security innovation a necessity rather than a goal. While not all innovations have succeeded, these countries have created a dynamic multi-layered defense ecosystem which combines the skillsets of civil society and their armed forces to multiply their defense capabilities and increase national resilience. There are numerous organizations that play a role in these innovations including civilian groups as well as the militias of each state. The militias, non-professional military forces who gain legitimacy and legality from state authorization, play a key role in increasing the effective strength of forces in the region. The Estonian Defense League, the Latvian National Guard, and the Lithuanian Riflemen’s Association all draw on civilian talent to form militias. These organizations are integrated, to different extents, with military structures and play supporting roles in a time of crisis that would free regular forces to conduct operations or support their operations directly.
These militias have established cyber units which are models for integrating civilian cyber-security professionals into military structures. The Baltic cyber-militias engage directly in practical cyber-security concerns, rather than being restricted to academic pursuit or mentoring like Cyber Aux. In peacetime, these organizations conduct training for servicemen and civilians with the goal of raising awareness of the risks posed by hostile cyber actors, increasing civilian-military collaboration in cyber-security, and improving cyber-security practices for critical systems and infrastructure. In crisis, these units mobilize to supplement state capabilities. The Estonian Defense League and Latvian National Guard have both established cyber-defense units, and Lithuania intends to complete a framework through which its militia could play a role in supporting cyber-defense capabilities by January 2020.
The idea of a cyber-militia is not new, yet the role these organizations play in the Baltic states as a talent bridge between the armed forces and civil society provides a very useful policy framework for many Western states. Currently cyber-auxiliaries are used by many states such as Russia and China who rely on them to supplement offensive cyber capacities. This situational, and often unofficial use of auxiliaries in cyber operations has advantages, prominently including deniability, but these should not overshadow the value of having official structures that are integrated into both civil society and national cyber-defense. By creating a reserve of motivated civilian professionals that can be called on to supplement military cyber units during a time of crisis, the Baltic states are also effectively increasing not only their resilience to a major cyber incident while it is underway, but raising the up-front cost of conducting such an attack in the first place.
As NATO and European policymakers consider the best courses available to improve their Armed Forces’ cyber capacities, the models being adopted in Estonia, Latvia, and Lithuania are likely of value. Estonia pioneered the concept in the region, but as the model spreads to other states Western states could learn from the effectiveness of the model. Cyber-militias, which play a supportive role in cyber operations, will strengthen the cyber forces of militaries in other NATO states which are undermined by low recruitment and retention.
 (2019, May 13). Marine Corps Establishes Volunteer Cyber Auxiliary to Increase Cyberspace Readiness. Marines.mil. Retrieved September 25, 2019. https://www.marines.mil/News/Press-Releases/Press-Release-Display/Article/1845538/marine-corps-establishes-volunteer-cyber-auxiliary-to-increase-cyberspace-readi
 Moore E., Kollars N. (2019, August 21). Every Marine a Blue-Haired Quasi-Rifleperson? War on the Rocks. Retrieved on September 25, 2019. https://warontherocks.com/2019/08/every-marine-a-blue-haired-quasi-rifleperson/; Cancian M., (2019, September 05) Marine Cyber Auxiliaries Aren’t Marines, and Cyber “Warriors” aren’t Warriors. War on the Rocks. Retrieved September 25, 2019. https://warontherocks.com/2019/09/marine-cyber-auxiliaries-arent-marines-and-cyber-warriors-arent-warriors/
 Thompson T. (2019, January 9) Countering Russian Disinformation the Baltic nations’ way. The Conversation. Retrieved September 25, 2019. http://theconversation.com/countering-russian-disinformation-the-baltic-nations-way-109366
 (2019, September 24). Estonian Defense League’s Cyber Unit. Estonian Defense League. Retrieved on September 25, 2019. http://www.kaitseliit.ee/en/cyber-unit; (2013). National Armed Forces Cyber Defense Unit (CDU) Concept. Latvian Ministry of Defense. Retrieved September 25, 2019. https://www.mod.gov.lv/sites/mod/files/document/cyberzs_April_2013_EN_final.pdf; (2015, January 15). National Guard opens cyber-defense center. Public Broadcasting of Latvia. Retrieved September 25, 2019. https://eng.lsm.lv/article/society/society/national-guard-opens-cyber-defense-center.a113832/; Kaska K, Osula A., Stinnissen J. (2013) The Cyber Defence Unit of the Estonian Defense League NATO Cooperative Cyber Defense Centre of Excellence. Tallinn, Estonia. Retrieved September 25, 2019. https://ccdcoe.org/uploads/2018/10/CDU_Analysis.pdf; Pernik P. (2018, December). Preparing for Cyber Conflict: Case Studies of Cyber Command. International Centre for Defense and Security. Retrieved on September 25, 2019. https://icds.ee/wp-content/uploads/2018/12/ICDS_Report_Preparing_for_Cyber_Conflict_Piret_Pernik_December_2018-1.pdf
 (2019, July 03) The Government of the Republic of Lithuania: Ruling on the Approval of the Interinstitutional Action Plan for the Implementation of National Cybernet Security Strategy. Lithuanian Parliament. Retrieved September 25, 2019. https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/faeb5eb4a6c811e9aab6d8dd69c6da66?jfwid=dg8d31595
 Applegate S. (2011, September/October) Cybermilitias and Political Hackers- Use of Irregular Forces in Cyberwarfare. IEEE Security and Privacy. Retrieved on September 25, 2019. https://www.researchgate.net/publication/220497000_Cybermilitias_and_Political_Hackers_Use_of_Irregular_Forces_in_Cyberwarfare
 Ruiz M. (2018.January 9) Is Estonia’s Approach to Cyber Defense Feasible in the United States? War on the Rocks. Accessed: September 25, 2019. https://warontherocks.com/2018/01/estonias-approach-cyber-defense-feasible-united-states/; Drozdiak N. (2019, February 11) One of Russia’s Neighbors Has Security Lessons for the Rest of Us. Bloomberg. Retrieved on September 25, 2019. https://www.bloomberg.com/news/articles/2019-02-11/a-russian-neighbor-has-cybersecurity-lessons-for-the-rest-of-us