United States Cyber Command Concept of Operations CONOP I OPERATION GLOWING Signature Position Date JUN 2 7 2013 FDIA review completed BMW Portions of this document longer meets the classification standards established by Executive Order 13525 Classified National Securitv Information Section 1 4 As such I am downgrading specific portion-marked paragraphs as Partial classi cation downgrade executive bv R055 A MYERS Rear Admiral U S Navy Chief of Staff Glassi-f-ied BY mg Derived From NSAICSSM 1-52 Dated 20130930 Declassify 0n 20410913 OPERATION INHERENT WI mm Sec 1 4 a mu Sec REFICIDOCI U W TRILATERAL MEMORANDUM OF AGREEMENT AMONG THE DOD DOJ AND INTELLIGENCE COMMUNITY REGARDING COMPUTER NETWORK ATTACK CNA AND COMPUTER NETWORK - I Sec 1 4 a FVEYWSCENTCOMIM 15 10 2 NOV ISIOPORD 24H USCYBERCOM OPORD 15-055 IN SUPPORT OF OPERATION INHERENT RESOLVE SHREL TO USA MAR 15 DEPARTMENT OF DEFENSE INSTRUCTION O- 3600 03 TECHNICAL ASSURANCE STANDARD TAS FOR COMPUTER NETWORK ATTACK CNA CAPABILITIES UHFOUOYU APR 2010 OPORDI SHREL TO USA FRA REFINE A VAL 0 TACTICS TOI mm Sec 1 4m SHREL TO USA W OP GLOWING bli1ISec1-4ia -DOCUMENT OPERATION GLOWING IS AN OFFENSIVE CYBERSPACE OPERATION I ISLAMIC STATE IN IRAQ AND THE LEVANT WITHIN IRAQ AND SYRIA 1 IDES-59W LA W General Situation I I Sec 1 4 a 1 A 1 TO USA Sec 1 4 3 1 B 43W Area of Operations The area of operations Sec 1-4lal LC U Enem1 1 C 1 primary cyberSpace initiative uses the Internet as a I conduit to target global audiences to recruit and rad icalize Speci cally ISIL creates media to provide legitimacy to their self-proclaimed caliphate and to recruit sympathizers to convert to their ideology and join their cause messages are primarily meant to appeal to bll1l Sec 14 8 1 3 1431 however ISIL 'tailors their messages to attract others globally In addition to itis nternet messaging ISIL provides media to the local populacel 1 4 a blt1lSEc1-4la 1 C 2 U ISIL also uses media to threaten and intimidate For example gruesome videos are meant to intimidate and strike fear into their adversaries and local populace to reduce their will to ght and ensure local pepulations remain compliant with IS IL rule ISIL messages that threaten foreign governments are meant to deter foreign military intervention or demand ransom for foreign hostages 1 C 3 W high quality propaganda has effectively enabled personnel recruitment from susceptible local and foreign Muslim pcpulations In addition to the recruitment of personnel for combat ISIL actively I IISIL is struggling to attract a suf cient number of recruits 3 with th-gxpertise needed to provide governing and social services however those current struggles are not likely to deter ISIL from maintaining these aspirations l C 4 W ISIL has inedia establishments responsible for the group s strategic media and propaganda production I These outlets serve as the group s primary arms for communicating leadership and religious guidance as Emil as highlighting activities agrees ISIL- controlled territory Although these establishments hilt Sec 1-4ta lcreate speci c products In order to IOT make the highest quality media products central media developers have access to multiple media sources This includes raw and nished media les developed by the _nedia establishments access to the Internet to download media les and the ability to recor and create their own organic media les 1 C 5 W ISIL employs cadres of personnel with varying levels of expertise and responsibility to acquire develop administer and maintain information networks utilizing both private and public Internet infrastructure These individuals are reaponsible for the management of data communications projects such as the creation and establishment of websites and mobile applications in support of ISO ISIL media as well as the creation and management of network projects designed toI that Sec 1 4 a 1 06 MSW The self-preclaimed Islamic State of Iraq and the Levant ISIL 1 mm Sec 1 4ta I support to ISIL media organizations and supports ISIL ability to distribute propaganda and facilitate I 1 0 7 W The self-proclaimed Islamic State ofIraq and the Levant blt li Sec 1 4m 1 4 13 Isupport to ISIL media organizations and supports ISIL ability to distribute propaganda and facilitate 1 0 3 W The self-proclaimed Islamic State efIt-ae and the Levant bit1JSec1-4ta 4 1 C 9 W1 11111 See 1 41 3 am See 1 41 1 self-declared Caliphate external provinces and globally dispersed supportersl 111 1 Sec 1 4m lsupport to ISIL media organizations and supports ISIL ability to distribute propaganda and facilitate I Sec 1 4 3 1 0 10 W 11111 See 1 4m mm Sec 1 4 a privileges to establish maintain and troubleshoot software and deal with terms of service 131 1 Sec 1 413 1 0 11 To USA FVEYIFISAH 1mm Sec 1 41s See 1 C 12 TSHSIHREL TO USA FVEYIFISAH Sec 1 4 a 1 1 U Friendly 1 D l W US CYBERCOM directs assigned andfor supporting forces IOT support the dismantlement of ISIL in accordance with IAW Ref A USCYBERCOM forces are staffed trained and equipped to collect report intelligence information and when authorized and directed posture to and conduct cybersoace operations CO againstdum Sec 1 4 Ivalid military targets approved by Commander United States Cyber Command CDRUSCYBERCOM IAW Ref mu Sec 1 4 a IJoint Task Force ARES J TF-ARES I 1 D 2 tn- in unction with Federal Bureau of Investigation FBI National Security Agencyr NSA and Coalition partner effortsI I IandL hm Sec 1 4 a mm Sec 1 4 3 I media applications thatI Organizations These accounts and infrastructure wereI I I 1 D 3 According to Intelligence Community 1C reporting I I Sec 1 4051 Operation GLOWING 0GB is an operationalI mm Sec 1 49 Sec 1 4 a 1 D 4 The intended cyber effects in this concept of operations CONOP are part of I am Sec 1 4 a more favorable I am See 1 4 a IThis operation is supporting USCENTCOM and CJTF-OIR Operational I hm Sec 1 4 a 6 MESH-1W I bittisec 1 4 a hf externally-hosted U S and bio Sec 1 4 al I land worldwide accounts and infrastructure will generate I I I IUnited States Central Command USCENTCOM and- Special Operations US SOCOM efforts in Iraq and Syria 1 13 5 JTF-ARES will implement the method described in this CONOP and coordinate with appropriate interagency IA and coalition Sec 1 4 3 1 D 6 TTF- ARES in association with USCYBERCOM will coordinate with U S government and coalition partners I I 1 D 7 Within this CONOP all references of Operators and will refer to personnel on teams operationally-controlled OPCON by JTF-ARES unless otherwise speci ed 1- D 8 W Within this CONOP and net RefI bll1ISBc1-4ta him See 1 4m Iapproved USCYBERCOMI him Sec 1 4 3 1 4m whi_ allowing USCYBERCOM operators toImmj Sec will AccounliI mm Sec 14 3 I 1 E U Constraints LE 1 WI tbioi Sec 1 4rai 1m Sec the control of ISIL or a surrogate entity 1 E 2 Operational objectives will be achieved using only the minimum etreets necessarv The intended effects under this order wil eitt see 1 4m IAW the de nition in Ref B 1 E 3 W- Actions and effects will bel IThere will be b 1 Sec 1 4 a the United StatesI bl- 11566 Mia 7 1 E 4 W311 Actions in this operationl I 1 E 5 Overall freedom of Internet usage is to be maintained with 11111 See 1 41a 1 F U Restraints 1 1 WI hunger 1 4131 1 I 1111113121 14 3 _lthe S or its territories GENTEXTIMISSIONIZ Mission On Order Commander Joint Task Force ARES conducts offensive cyberspace operations and 11111139 1 4 3 GENTEXTIEXECUTIONIB 3 A U Concept of Operations 3 A l U Commander s Intent 3 A 1 A W Pumose Iso operations Syria to dismantle and ultimately defeat ISIL USCYBERCOM conductsl 113 1 Sec 1 412 I 111 1 Sec 1 4 a MW Method JTF-ARES actions 1 413 11111 See 1 41 1 mommies i 11111115991111a1_ him See 1 4151 lockout TF-ARES personnel will use Sac 1 4 a 3 IJTF-ARES will execute for a duration not tor I 3 A 1 C W Endstate freedom of movement in cyberspace to distribute andI oit1i5ec 1 4m I ' statesma 3 B U Obiectives and Effects BB 1 Obiective 15 the Internet 3 B 1 A SW Effect 1A I 1 4 a network services and applications I 3 B 1 A 1 UHEQUQ Measure of Performance 1 Assigned forces execut- I th I See me I 3 B 1 A 2 MOP 2 accountsi tum Sec 1 4091 initiation 3 13 2 W Obiective 3 media 3 B 2 A Effect 2A media products is t-t 3 B 2 A 1 W MOP lug-upcoums 3 B 2 A 1 A WM Measure of Effectiveness 1 him Sec 1-4taJ am See 1 4 a accounts 3 B 2 A 2 W MOP 3 B 2 A 2 A W MOE 2 I b 1 Sec 1 4 3 I I Iavailabie for use in support of media 3 B 2 A 1 B Wlndicator I I 3 B 2 A 3 W MOP 3b 3 B 2 A 3 A W MOB 3 Observedl Indicator reconstituted elsewhere disrupted 1 Sec1 4 56133 Sec 1 41121 IVPSs 121 1 See 1 4 e 3 B 2 B 1 MOP 3 B 2 B 1 A Stags poem MOB 1 Observedl ls-H1 Sec 1 4 a 3 B 2 B 2 MOP mains 3 B 2 B 2 A SW MOB 2 Observedl inanies available for use in support of media dissemination 3 2 B 2 B Indicator ebpages_ Sec 1 4 a or reconstituted elsewhere media products is owned email 3 B 2 B 3 WMOP 313-31133 3 B 2 B 3 A MOE 3 Observedl 3 B 2 B 3 B Indicator webpagesi reconstituted elsewhere 3 B 3 JTF-ARES Obiective 4 I social media 3 B 3 A WE Effect medial disrupted 131 1 Sec 1 4 a VPSs am See 1 4 a b21111 Sec 1 4 a 3 B 3 A 1 MOP Observed accounts 3 B 3 A 2 WMOP 3b Sec 1 4 3 1 Sec 1 4 domains 10 3 B 3 A 2 A MOE 2 Observedl Imedia applications 3 B 3 A 2 B Indicator ObservedI 1-4ia Irnedia applications 3 B 3 A 3 W3 3 B 3 A 3 A 68W m Observed I hm Sec 1 4 a IVPSs 3 B 3 A 3 B Indicator applicationsl mm Sec 1 4 a I or reconstituted elsewhere 3 0 U Concept of Operations This is aI only functions planned to be utilized 3 C 1 A Upon the em Sec 1 4 a I IThis operation will be conducted in six phases I Sec 1 4 3 3 02 98W Phase II I JTF-ARES operators will Sec 1 4 a 1 4 a IThe operators will mm Sec 1 4a I TF -ARES operators will utilize mm Sec 14 3 I am Sect-#651 I ll Sec 1 4 a 3 0 3 Phase him Sec 1 4 a IJTF-ARES operators WiilI b 1 Sec 1 4 a em 1 Sec 1 4m hm Sec 1 4 a IJTF-ARES operators These willI hm See 1_4 a I earn Sec 1 4 a This phase will be accomplished using two techniques l IThe two techniques for this phase will be executed as follows 3 C 3 A W I TF-ARES operators will utilize l_ 1 4 a I TF- The operators will enter the IJTF-ARES operators will utilizeI I IJTF-ARES 3 c 3 B hm Sec 1 4 a IJTF-ARES certi ed on net I blt1JSec1-4ta IJTFHARESI than Sec 1 4a - IJTF- ARES operators willI I TF -ARES operators will utilizel I Operators will utilizel b1g113ee1aga1 Sec 1 4 a jAs required TF ARES Sec 1 4 a I 2 b 1 Sec 1 4 a 3 04 Phase ml Sec 1 4 a 1 4 a I operators will utilizel Sec 1 4 a operators will utilizel I I IJTF-ARES operators will accomplish 1 4 a 3 05 Phase IVI operators will utilizel 1 4 a I This phase will be accomplished utilizing two techniqueszl lThe two techniques for this phase will be executed as follows 3 C 5 A tam ea 1 4a operators Sec 1 4 3 3 05 3 ml Sec 1 4 a b1t1 Sec1 4la I operators will utilize the Sec 1 4 a mu Sec 1 4 a TF- ARES will utilize I 3 6 Phase VF See 1 4 a I l3 3 0 7 Phase V1 moi Sec 1 4a These actions fall into three distinct categories 3 C 7 A WI I will utilizel IOperators will utilize the normal and hm Sec 1 4 a 3 C 7 B WI eec 1 4 3 will utilize new See Sec 1 4 a B JTF-ARES will em Sec 1 4 e I USCYBERCOM JTF-ARES operatorsl 3 09 U Fires Sunnort Coordination Measures 3 C 9 A UHEQUQ Decon iction Aim points will bel Sec 3 C 9 B UHEOUO Pre-Mission Pre-mission requirements are contained in the pre-mission checklist which is maintainedl in the USCYBERCOM Joint Operations Center JOC Set ALERT CONDITIONS IAW the Cyber Tasking Order CTO 3 C 9 C UMEOUO Fires Execution List The mission will be executed IAW the CTO and the mission execution checklist The mission execution checklist is maintainedl b 1 Sec bit-itslhe USCYBERCOM JOC 3 C 9 D SW Mission Abort The USCYBERCOM JOC or the Mission Commander ma r order mission abort headquarters or agencies must be veri ed with the supported command and the USCYBERCOM l4- hm Sec 1 4 a 3 C 9 E Abort Procedures When the order to abort mission is received or veri ed by proper authority the USCYBERCOM 0C Watch Of cer will immediately contact the Mission Commander to relay the order The Mission Commander will i the USCYBERCOM 0C Watch Of cer 3 C 9 F Cease Fire Authorit The USCYBERCOM JOC or the JTF- ARES Commander may order cease re lheadquarters or agencies must be veri ed with the supported command and the USCYBERCOM OCllilo Sec 3 C 9 G Cease Fire Procedures I received or veri ed by proper authority the blt1lsec1 411a iwill immediately contact the Mission Commander to relay the order The Mission Commander mm Sec 1 4 a I The Mission Commander am See 1 4 a USCYBERCOM JOC Watch Of cer 3 C 9 H SW Re-En a Authorit The order to re en can be iven by the USCYBERCOM mm as 1 4 a I -1eadquarters must be veri ed with the supported command and the US CYBERCOM 0C 3 C 9 I SW Re-Engage Procedures When the order to re-engage is received or veri ed bv proper authoritv the USCYBERCOM 0C Watch Of cer will immediately contact tb 1 3ec 1 4ia ito relay the order The Mission Commander will IThe Mission Commander will USCYBERCOM OC Watch Of cer 3 C 9 J WW Continued Engagement and Targets Elements-of- Opportunity bit 1 Sec 14 3 JTF-ARES will monitor for Sec 1 4 3 b 1 Sec will ensure that 1 4 a I 1 4g Noti cation from IUSCYBERCOM JOC will 15 3 010 U Risk Analysis 3 C 10 A if-SW31 Infrastructure JTF-ARES will usel i Sec 1 4 3 SALRE-LJEQ-USATBLESQ Risk Analvsis and Mitigation I 3 C 10 C Risk 1 USCYBERCOM operations couldl 3 0101 93W Mitigation 1 mm Sec 1 4m Sec 1 4 a 3 C 10 E SW Risk 2 I I Sec 1 4 a 3 C 10 F Mitigation 2 JTF-ARBS retains Sec Mia i t 10 SHREL T0 USA 3 1 4a 3 C 10 H Mitigation 3 JTF-ARES I 3 D U Tasks 3 D 1 U JTF-ARES 3 D 1 A UHEOUQ Joint Intelligence Support Element Provide intelligence analysis and planning as required including intelligence assessments estimates and other 16 intelligence products ISO the commander s decision-making process I 3 D 1 B JTF-ARES 12 Collection Coordinate and provide end-to end collection management support to all-source intelligence with the IC ensuring management of needsr requirements 3 D 1 C LOE 2 Identify partnerships with external organisations to implement method 3 D 1 D JTF-ARES LOE 2 Re ne planning with partners for execution of identi ed method 3 D 1 E JTF-ARES J3 Coordinate and ensure menswear ltd- 1 Sec 1 4 a 3 D 1 F W J3 Assign an OGS blt1JSEc1-4fal Sec1 4 a 3 D 1 G UHLEQUQ Fires Ensure OGS is integrated and executed Sec 3 D 2 UHEQUQ CMT 701 Sec 1 4 a and execute OGS 3 D 2 SAW Support JTF-ARES assessmentsl I Sec1 Ma 3 D 2 C U Forward requests for additional capabilities to JTF-ARES as required 3 D 2 D GULLEQUQ Withiniom inellmtification by implement tasked method IAW standard procedures - 3 D 2 mono Provide mission reports MISREPS withi - ission execution to support assessment of operation to TF-ARES CUOPS CUOPS will disseminate report to other organizations as required 3 D 2 F BPT support long-term assessments to operational effectiveness and performance 3 D 2 G UH-130149 BPT provide mission planning updates to TF-ARES 3 133 U Assigned JTF-ARES Forces 3 3 A BPT provide Mission Commanders operators and ISO this operation 3 D 3 B Ensure qualificationi bin Sec Mia Iso this operation As directedJ 1 4 121 i 3 D 4 U 3 114 111 W USCYBERCOM J3 coordinate wit leverage individual agency authorities and capabilities to support the objectives and effects as outlined above Ensure all agency-speci c actions are and decon icted with all other participating agenc r actions 3 D 4 B UHEQUQ USCYBERCOM J3 provideMpersonnel to support research rehearsals and executions of this operation 3 D 4 C W Coordinate and de-con ict with 131 1 see 1 4m mm Sec 1 4 a accounts 3 D 4 D U USCYBERCOM Staff Judge Advocate SJA provide legal opinion to CDRUSCYBERCOM ISO 008 3 D 4 E USCYBERCOM SJA providel om Sec 1 4 a I opinion regarding thel b 1 Sec 1 4 a during the course of this operation 3 D 4 F W311 12 coordinate withl 3 D 4 F U USCYBERCOM J2 provide intelligence support to JTF-ARES as requested 3 3 13 5 U Requested Support from IA Partners 3 D 5 A W Support and participate in the process 1 4 a land execution 3 D 5 B U Provide intelligence support prior to and during execution Speci c intelligence requirements will be passed by USCYBERCOM J2 prior to execution 3 D 5 C U Participate 1n USCYBERCOM appropriate boards bureaus cells committees and working groups events ISO this operation 3 D 5 D For units involved in thel Iof the operation provide or designate a representative for coordination requests and questions to be routed through 3 D 6 U Requested Support from NSA 3 D 6 A Partnering and support as authorized and appropriate in 3 D 6 B SW RequestI I 3 D 6 C SW Support and participate in the processI him See 1-4ta I I 121 1 Sec 1 4 a Iexecution of OGS 3 D 6 D Designate a representativeI bit li Sec 1-4ta I IUSCYBERCOM Operations 3 D 7 U Requested Support from FBI 3 13 7 9 W Request FBII tam Sec 1 4 a 3 D 7 B Designate a representativ I I IUSCYBERCOM Operations 3 D 8 U Requested Support from GCHO 19 19W 3 D 8 A W319 Request GCHQ tom Sec 1 4a Sec 1 4 3 3 D 3 B SW Designate a representative from GCHQ I Operations 3 D 9 U Reguested Support from ASD 3 D 9 A Request ASD Sec 1 4 1 3 3 D 9 B SW Designate a representative from ASD I Sec 1 4 a IUSCYBERCOM Operations 3 E UHEQ-UQ Coordinating Instructions USCYBERCOM JOC Goccbc@nsa ic gov joccbc@nsa smi1 mil NSTS 966873018772 COMM 240-373 3142f3111f8115 STE 240-3 3- 8130 will serve as the point of contact POC for cyberspace operations and decon icticnl Ipartners are re-uested to provide liaison of cer coordination to- I we _@nsa ie gov@nsasmilmil NSTS 969-3452 no later than three days after receipt of this order ease see Ref for other concerns 20 This document is from the holdings of The National Security Archive Suite 701 Gelman Library The George Washington University 2130 H Street NW Washington D C 20037 Phone 202 994-7000 Fax 202 994-7005 nsarchiv@gwu edu