UNCLASSIFIED US EUROPEAN COMMAND AFTER ACTION REPORT Date of Event Directorate Branch Event Name DD MMM YY 25-26 January 2017 CJ64 - JCC BALTIC GHOST 2017 - IPC MPC Background U BALTIC GHOST BG is a USEUCOM-supported series of workshops culminating in a Cyber Defense Table Top Exercise TTX between Estonia Latvia and Lithuania US DOD participation includes USEUCOM DISA USCYBERCOM and National Guard units from Maryland Michigan and Pennsylvania participating as part of the National Guard State Partnership Program SPP International observers will include Denmark Sweden Finland and the United Kingdom Baltic Ghost 2017 BG17 the fourth of the Baltic Ghost series will focus on crisis action collaboration mechanisms between m ilitary national and commercial cyber security organizations to enable identification of key cyber terrain and critical infrastructure protection response actions through Cyber The scenario will exercise the coordination gaps within each Baltic nation NATO and USEUCOM Baltic Ghost BG directly supports two USEUCOM lines of effort Deter Russia and Support NATO BG17 IPC MPC objectives • • • • • U U U U U Determine participating nation objectives and team makeup Discuss scenario and inject possibilities Determine academic topics and possible speakers for TTX Begin building individual crisis action playbooks to be exercised during TTX Finalize schedule for remaining events to include the TTX Discussion Points • • • • U Discussions were focused on TTX planning to include scenario development audience participation location and dates of events and academic focus U The BG17 scenario will focus on the civilian military energy sector with a focus on those impacting military bases Estonia would like a possible air defense issues to be included however will need to receive approval Lithuania would like to include critical transportation sectors which might affect troop or equipment movement U Teams will consist small cells travelling to Stuttgart and training audience remaining in country Exercise cell will most likely consist of organizational representatives versus technical subject matter experts U Academics will include Road to Crisis and country organizational briefs Other possible topics include Cyber Threat Analysis Forensics Information Control Systems etc USEUCOM Takeaways • -S • U • U • • • • • - U U U U U Distribution Signature and Report Date EUCOM DCOM ECJ3 ECJ6 ECJ6 JCC ECJ2X ECJS 31 Jan 2017 ________J Coordination D Concur D Nonconcur D Concur D Nonconcur UNCLASSIFIED D Concur D Nonconcur D Concur D Nonconcur