What is cyberpower? In this guide it means the ability to gain and hold advantage in cyberspace, which AFDP 3-12 treats as the aim of its offensive, defensive and network-operations missions. The doctrine itself never uses the word.
The definitions quoted below are the doctrine’s own.
Air Force Doctrine Publication (AFDP) 3-12, Cyberspace Operations, calls achieving and maintaining advantage in cyberspace “a foundational component of overall operational and strategic advantage,” especially against peer and near-peer adversaries. The doctrine organizes that advantage into three kinds of mission, a layered view of the domain, and a command structure that runs from the Air Force through 16th Air Force to US Cyber Command (USCYBERCOM).
This guide explains those pieces in plain language. It is an independent explainer, not an official Air Force product. For the wider event context, see the AFITC conference guide. The rules, agencies and careers around this mission are covered in the defense cybersecurity guide.
How doctrine defines cyberspace
AFDP 3-12, dated 1 February 2023, defines cyberspace as “a global domain within the information environment consisting of the interdependent networks of information technology infrastructures and resident data, including the internet, telecommunications networks, computer systems, and embedded processors and controllers.”
The publication stresses that cyberspace differs from air, land, maritime, and space. It is man-made, wholly contained within the information environment, and needs continued human attention to persist. Physical cyberspace nodes reside in every domain, so activity in other domains can create effects in and through cyberspace, and the reverse.
Joint Publication (JP) 3-12, Joint Cyberspace Operations, supplies the joint-force terminology that the Air Force publication follows. As AFDP 3-12 puts it, JP 3-12 describes cyberspace operations as “the employment of cyberspace capabilities where the primary purpose is to achieve objectives in or through cyberspace.”
Three layers
Following JP 3-12, AFDP 3-12 describes cyberspace through a layer model of three interrelated layers: the physical network, the logical network, and the cyber-persona. Planners look at all three because each shows a different aspect of the same domain.
The three mission types
AFDP 3-12 says cyberspace missions can be categorized as offensive cyberspace operations (OCO), defensive cyberspace operations (DCO), or DOD information network (DODIN) operations. The category depends on the intent or objective of the issuing authority, not on the technical actions, the forces, or the capabilities used.
| Mission type | Doctrinal definition |
|---|---|
| OCO | Missions intended to project power in and through cyberspace. |
| DCO | Missions to preserve friendly cyberspace capabilities and protect data, networks, devices, and other designated systems by defeating on-going or imminent malicious cyberspace activity. |
| DODIN operations | Operations to secure, configure, operate, extend, maintain, and sustain DOD cyberspace to create and preserve the confidentiality, availability, and integrity of the DODIN. |
Source: AFDP 3-12, Cyberspace Operations, 1 February 2023.
The line between DCO and DODIN operations matters. DCO defeats threats that have bypassed, breached, or are threatening to breach security measures, while DODIN operations secure DOD cyberspace against all threats in advance of any threat activity. Zero trust architecture sits mostly on the DODIN operations side; see the guide to zero trust for defense networks.
Control of cyberspace
Doctrine measures advantage in cyberspace through “control,” a level of influence relative to an adversary. AFDP 3-12 describes three degrees:
- Parity: no force has control of cyberspace, and both sides may meet significant interference.
- Superiority: a degree of dominance that lets one force and its related land, air, maritime, and space forces operate securely and reliably at a given time and place without prohibitive interference.
- Supremacy: a degree of control in which the opposing force is incapable of effective interference. The publication calls supremacy probably unattainable.
The publication also states that, because of cyberspace’s complexity, global superiority is not achievable and even localized superiority may be impractical in some cases. Commanders are told to expect contested cyberspace operations and to plan for degraded capabilities. Required control can be limited by place, by time, and by mission.
Cyberspace operations are also not the same thing as operations in the information environment (OIE). Per AFDP 3-12, cyberspace operations are one of six principal information warfare capabilities the Air Force presents to the joint force, and OIE combines them with other information activities.
Who does what: USCYBERCOM and the services
AFDP 3-12 states the USCYBERCOM commander’s mission as directing, synchronizing, and coordinating cyberspace planning and operations to defend and advance national interests in collaboration with domestic and international partners. Three focus areas follow: defend the DODIN, support combatant command global mission execution, and strengthen the nation’s ability to withstand and respond to cyberspace attack.
The services organize, train, and equip cyberspace units and present them to USCYBERCOM. Per the same publication, forces are organized into three Cyber Mission Force elements: the Cyber Protection Force, the Cyber National Mission Force, and the Cyber Combat Mission Force. The Air Force presents cyberspace protection teams, national mission teams, and combat mission teams to those elements.
Each service has a service cyberspace component. AFDP 3-12 lists Air Forces Cyber (AFCYBER) for the Air Force, Army Cyber Command (ARCYBER), Fleet Cyber Command (FLTCYBER), and Marine Forces Cyber Command (MARFORCYBER).
The role of 16th Air Force
AFDP 3-12 says AFCYBER is aligned with 16th Air Force (16 AF), and its commander serves as the cyberspace air component commander, the sole entity responsible for presenting Air Force cyberspace forces to USCYBERCOM. That commander is triple-hatted: commander of 16 AF, of AFCYBER, and of Joint Force Headquarters-Cyberspace (Air Force). In the doctrine’s wording, the 16 AF commander reports directly to Air Combat Command, organizes, trains, and equips cyberspace operators, and maintains and defends the Air Force portion of the DODIN.
The 16th Air Force fact sheet describes the unit as the Air Force’s Information Warfare Numbered Air Force, headquartered at Joint Base San Antonio-Lackland, Texas. The Secretary of the Air Force directed its stand-up through Program Guidance Letter 19-05 to synchronize cyberspace, electromagnetic spectrum, information, intelligence, surveillance, reconnaissance, weather, and related capabilities. The fact sheet says it operates across nine wings and two centers.
How the pieces fit together
A single mission shows how the layers connect. The service organizes, trains, and equips the operators, and the service component presents them to USCYBERCOM. USCYBERCOM, as the coordinating authority for global cyberspace operations, plans and executes activities to secure and defend the DODIN and conducts cyberspace operations outside it in support of national objectives. AFDP 3-12 says individual services present forces through the joint force headquarters-cyberspace and directly through the service cyberspace component, and that each component commander is dual-hatted by the USCYBERCOM commander as a commander of one of four such headquarters.
Daily work is coordinated through a cyber tasking order. Per AFDP 3-12, missions are consolidated into a daily cyber tasking order to ensure unity of command and effort. Air Force DODIN operations are standing missions that involve day-to-day security of the network, and daily operations are tasked by 16th Air Force elements or the Air Force network mission assurance center.
Directive authority adds one more layer. According to AFDP 3-12, the USCYBERCOM commander exercises directive authority for cyberspace operations, meaning the authority to issue orders and directives to all DOD components for global DODIN operations and defensive cyberspace operations-internal defensive measures. In the Air Force, the 16th Air Force commander described above carries both the service’s own network responsibilities and the presentation of forces to the joint force.
Where to go from here
These terms (mission types, control of cyberspace, and the command chain) are the vocabulary behind military cyber and IT discussions. Readers comparing events can use the overview of government cybersecurity conferences, and contractors who handle defense data should read about CMMC.
Frequently asked questions
What is the difference between cyberspace operations and cyberpower?
Cyberspace operations are the doctrinal term for the missions: OCO, DCO, and DODIN operations. “Cyberpower” is not a doctrinal term in AFDP 3-12; this guide uses it informally for the broader ability, built from forces, authorities, and control of the domain, to use those missions to reach objectives.
Which document is the Air Force’s main cyber doctrine?
Air Force Doctrine Publication 3-12, Cyberspace Operations, dated 1 February 2023. Its terminology follows the joint publication of the same number.
Is 16th Air Force the same as USCYBERCOM?
No. USCYBERCOM is the joint command. 16th Air Force, through AFCYBER, is the Air Force’s service cyberspace component that presents forces to it.
Can any one force achieve global cyberspace superiority?
Per AFDP 3-12, no. It states global superiority is not achievable, and even local superiority may be impractical.
Photo credits: Tima Miroshnichenko / Pexels (Pexels License); Brett Sayles / Pexels (Pexels License).
