Before a Cyber Force, Fix Cyber Governance

Join War on the Rocks and gain access to content trusted by policymakers, military leaders, and strategic thinkers worldwide. Let’s not start picking out uniforms just yet. The chorus calling for a Cyber Force continues to grow by the day, but the debate has its priorities backward. In June, an amendment from Sen. Kirsten Gillibrand (D-NY) calling for the creation of a cyber service within the Department of the Army failed in the Senate Armed Services Committee by a single vote. Support is popular on both sides of the aisle, with Rep. Pat Fallon (R-TX) quoted as saying that a “Cyber Force is inevitable.” The highly anticipated June 2026 Center for Strategic and International Studies report skips the question of whether the Department needs a Cyber Force and goes straight to planning how to do so, treating the new service as just a matter of when. The report builds on an earlier Foundation for Defense of Democracies cyber force study and provides strong recommendations for how to man, train, and equip. Neither fully addresses the dysfunction of cyber governance. Two years ago, I was a career submariner being detailed to U.S. Cyber Command to pay my joint penance, unsure how a non-cyber officer could support. Seeing the successes but also cyber’s unrealized potential, I left the command equal parts Cyber Force acolyte and skeptic. I won’t relitigate whether the force-generation model is broken because smarter and more experienced professionals have documented that failure, and on the man-train-equip problems, they are certainly right. But before the Cyber community starts to debate what to call these new Cyber Force warriors, the Department should answer the question the Senate was one vote away from skipping. The debate should answer the question of who will govern cyberspace. Start with what the advocates have gotten right, and they have absolutely gotten a great deal right. In every other warfare domain, the division of labor is clean: the Services man, train, and equip forces, and the combatant commands employ them. Cyber is the exception. Cyber Command depends on the Services to generate its forces, the same Services for which cyberspace will never be the priority. As a line officer working in the cyber world, I kept asking the same question: What makes this so special? The prevailing answer from those inside the community has been constant: force generation. The argument goes that the technical complexity of manning, training, and equipping cyber requires that it be treated as special. That never sat well with a submarine officer whose entire community is underwritten by complex technology. More than a decade of readiness shortfalls, training gaps, and congressional patches produced a common consensus that what has been done so far in cyber will likely not work in the future. Erica Lonergan and Mark Montgomery, two of the most persistent voices in this public debate, have shown that even Cybercom 2.0, the Department’s own attempt to improve the force-generation model, lacks the levers needed to compel the Services to prioritize a warfighting space that belongs to none of them. Congress repeats the diagnosis annually — each annual defense bill directing another study, another commission, and another attempt to patch a construct that no one will defend. Not long after I arrived at Cyber Command, I could not help but notice the cultural aversion to direct tasking, or at the very least, the general preference for consensus-building over direct decision-making. In the submarine force, task orders are how business is conducted. Authority flows through the chain of command, orders are issued, and the submarines execute them. Routine tasking within the cyber enterprise required coordination with the very organizations being tasked. Drafts were circulated for comment, wording was negotiated, and if consensus could not be reached, seniors had to get involved. None of the coordination was unreasonable and buy-in often produced better outcomes. But it reflected something larger culturally across all the Department’s cyber forces. It showed that the command was primarily a coordinator among organizations that owned different pieces of the problem and had motivations that did not always align. So what makes cyber so special? Nothing. Nothing, except that no one owns it because everyone owns it. I found myself preaching Admiral Rickover’s culture of accountability in a field whose structure gave it nothing to attach to. Rickover, the founder of the Nuclear Navy, knew that responsibility cannot be diluted, that you must be able to poke the man in the chest when it fails. That culture was not conjured by force of personality. It was possible because the nuclear propulsion program had a single owner with genuine authority over the entire enterprise — the reactor plants, the training pipeline, the industrial base, and the money that paid for all of it. The structure made the culture enforceable. Now imagine an enterprise without that culture, without that governance, and you have what the last few decades have built for cyber. The error at the center of the Cyber Force conversation is the conflation of systemic force-generation problems with the deeper issues rooted in the field’s lack of governance. Force generation answers the issues of manning, training, and equipping the cyber and information technology forces. Governance answers who will own the budget, set policy, provide civilian oversight, and stand before Congress and the taxpayers to account for the warfighting domain. The Department has spent the last several decades making cyberspace into both a commodity and something so special that it must be treated differently from all other warfare domains. Cyber is considered so special that it warrants its own combatant command and a seat at the warfighter’s table; then, in the same breath, it is treated like a commodity to be governed like enterprise information technology. Through accretion rather than design, cyber and its terrain are scattered across the Services. Resourcing is done on an ad hoc basis by the Services, combatant commands, and various agencies. Accountability remains perpetually undefined. The contradiction between cyber as warfighting and cyber as a utility service is not a force-generation problem, and no Cyber Force, no matter how well designed, resolves the governance question alone. Congress, to its credit, has already begun addressing the governance question. The House Armed Services Committee’s cyber subcommittee’s mark of this year’s defense bill, approved in early June, contains no cyber service. It does, however, contain Section 1502, which would direct the Secretary of Defense to establish clear accountability for the cybersecurity of Department of Defense information networks, “including identification of one official designated as the single accountable official.” In short, the House’s first move is to name who owns the problem. The Senate went a step further and proposes an answer. The Senate’s possible solution is a new Undersecretary of Defense for Cyber, Information, and Networks, dual-hatted as the Department’s Chief Information Officer and Principal Cyber Advisor — a single official consolidating the enterprise defense and operational advisory functions whose seams, exposed by the maturing of cyber warfare, are now evident. That is the single accountable official, drafted into statute. And the same Senate committee, having declined the Cyber Force by one vote, directed its own reviews of whether Cyber Command is adequately organized for its expanding authorities and of the roles and resourcing of the Principal Cyber Advisors. Now consider for a moment what both chambers did this cycle. Given an opportunity for a new cyber service, the House declined to take it up, and the Senate rejected it by the narrowest possible margin. Yet, both chambers instead opted for the governance solution. Naming an official is just the beginning of accountability. The Senate’s construct is the right skeleton. Fusing the Chief Information Officer’s enterprise network architecture and requirements role with the Principal Cyber Advisor’s operational advisory role closes a real seam — particularly between the lines of what constitutes cyber operations and what keeps cyber running in the background. The Principal Cyber Advisor owns the cyber-operations budget, and the Chief Information Officer controls much of the cybersecurity and information technology budget and oversees the Services’ cyber budgets. Fusing these two roles puts both priorities, operations and information technology, in the hands of one person who answers for the balance. That is the point of a single accountable official. But an undersecretary who only advises and coordinates, without controlling funding, would just be a more senior version of today’s undefined lanes. Genuine accountability requires directive authority over the domain’s terrain and real ownership of the force-generation and systems dollars the Services primarily control. Congress should designate someone who controls the money, sets the requirements, and compels the Services to resource the field. Otherwise, they will have picked the person to poke without giving them the authority to prevent failure. Cyber Force advocates’ own work points in this same direction. The commission behind the June report spent months producing what is likely the most rigorous implementation study yet, drawing in dozens of the most highly qualified individuals in the field. Still, it could not resolve the question of where a Cyber Force should be institutionally housed within the Department of Defense. The most qualified people in the field addressed command and control, force size, personnel recruitment and retention models, and training pipelines, but they could not solve the question of governance. The hardest question in that room is the one this article argues is the first question — and their honest inability to answer it is better evidence than anything a skeptic could write. The commission’s scoping decision points in the same direction. Its proposed force would organize, train, and equip for cyber operations, but would not absorb the Services’ individual networks. The Services would continue to operate and secure the systems associated with their respective missions. That is a reasonable hedge against the sprawling bureaucracy objection. It is also a quiet concession that, under the proposal, cyberspace’s terrain remains fragmented across Services whose first priorities — by the advocates’ own argument — lie elsewhere. The conclusion that launched this whole debate, cyber as everyone’s responsibility and no one’s priority, would survive the creation of a Cyber Force fully intact at the network layer, failing to solve where most of the operational friction lives. Two of the community’s stewards saw the same gap: testifying before the National Academies committee, former Cyber Command commanders, Generals Timothy Haugh and Paul Nakasone, warned that a new service risks a top-heavy bureaucracy and confusion over who defends the other Services’ networks. Cyber Force advocates often cite the Air Force as a precedent for forming a new force. They call on this historical point because the lesson is directly applicable to today’s conversation. The emergence of a new warfare domain, which had not previously been shepherded by any of the legacy organizations, is an almost perfect historical parallel. One detail is lost in this analogy. The detail is that, before creating a new service, Congress first rebuilt the governance of the entire defense establishment through the National Security Act, creating the Secretary of Defense, the Department of the Air Force, and a new structure of civilian oversight, before establishing the Air Force as a Service within it. The initial decision was governance; the Service followed. History points in the same direction as the Nunn-Cohen reforms that created Special Operations Command. In a single act, Congress assembled the command, civilian oversight, authorities, and resources as an integrated design. Congress gave the special operations enterprise its own service-like funding line, Major Force Program 11, and, with it, real ownership of its resourcing. That budget authority, arguably more than any four-star billet, is what converted responsibility from an org-chart abstraction into something a person could answer for. Cyber has accumulated components analogous to those given to special operations forces — but piecemeal over nearly two decades rather than by initial or deliberate design. The question before Congress today is whether those pieces need continued refinement or complete reconstruction. Governance reform and service creation are not necessarily sequential problems. One could argue that both can proceed in parallel, and in a fast-evolving field, a potential multi-year pause could cost more in readiness than it buys in coherence. This argument fails the design problem. It is a plan that begins with action before its purpose is finalized. Does the new Service own the Department’s networks or only its operational forces? Who is the customer — Cyber Command? The Services? An undersecretary who does not yet exist? Where does its force-generation budget sit, and who defends it before Congress? Every one of those answers is an output of the governance decision, not an input to it. This means a service designed in parallel is a service designed against assumptions that the governance debate may ultimately prove incorrect. This is the naval equivalent of laying the keel for the first in the class while the naval architects are still arguing over the hull form. The Cyber Force advocates’ own commission made the same point this year: The one question it could not resolve was where the proposed force should live. First, regardless of what survives congressional conference, the governance question must be answered. Above all, be willing to name the single accountable official and arm that office with the budget and directive authority the job requires. Whether that answer arrives through the House or Senate’s proposals or some other legislative vehicle matters less than answering the question. That is because whoever owns the terrain and the funding will define the purpose of any future service. A service designed before that answer has been resolved is a force built for an undefined customer. Second, Congress should fix the governance layer. Do this by determining where cyber policy, civilian oversight, and budget authority reside, and by ensuring it is staffed for success. Construct an organization that can move the levers that compel organizations to make cyber the priority they would not otherwise have made. Finally, take up the service question, with the National Academies’ assessment in hand, inside a structure actually built to receive a new service. That sequence would cost perhaps two years relative to the Cyber Force advocates’ timeline. The alternative costs more. A service commissioned before the governance fight is settled inherits the fragmentation as a birth defect, institutionalizing it right beside its brand-new flag and its birthday. The pundits and critics keep asking whether cyber requires its own service, but that is the incorrect first question. Facing new warfighting realities in 1947 that legacy institutions could not govern or prioritize, the United States began by redesigning the entire governance of the defense establishment. Only then did it establish a new force. The Department must first answer who owns cyberspace before it tries to answer the question of whether it should establish a Cyber Force. The uniforms can wait. Justin Hardy is a career U.S. Navy submarine officer who commanded the ballistic missile submarine USS Alaska and is currently assigned as a federal executive fellow at the U.S. Naval Institute. He previously served as acting deputy director of operations and chief of Mission Assurance Division at U.S. Cyber Command. The views expressed are the author’s own and do not reflect the official position of the U.S. Navy, the Department of Defense, or the U.S. government. Image: Josef Cole via DVIDS