This is the last part of the series. If you missed the first three, the short version is that this was MWX, the Marine Air Ground Task Force Warfighting Exercise, and my team was running the cyber cell. We had spent the first phase in a hotel room building the access we needed against a new web proxy capability, then moved on-site and worked our way up inside the exercise network to a position where we were producing real intel and real effects on the wargame. Five or six days in, the Commanding General of the Marine Corps’ computing enterprise showed up and asked to sit down with me.
That is where this part begins.
Getting Presentable
A few things had to happen before the meeting.
I had been wearing the same uniform for longer than I would like to admit. I had not slept more than a few hours at a stretch in close to a week. The coffee in my hand was somewhere in its third day of existence. The room I was working out of was not the room you would choose to receive a general officer in, and I was not in the shape you would choose to be in either.
I slammed the old coffee and grabbed a razor out of my bag. It was a dry razor. I had no shaving cream and no time. I dry shaved at the workstation while the other team’s leads watched. I am told the looks on their faces were memorable. The phrase I heard later was something like “what the hell is wrong with this guy and the Marine Red Team.”
I do not blame them for the look. This was a Marine op, and Marine ops have a particular cadence. You go hard, you stay in the work until the work is done, and when leadership shows up, you make yourself presentable and you go talk to them. It is Marine Corps rules first and cyber rules second. The order matters. I told my team I would be back, and I went to the meeting.
The Conversation
I sat down with the general and his staff. Two leads from the other team came with me. We had walked over in silence. I was too far gone on no sleep to make small talk, and they were not in a talking mood either.
He asked me how the Marine Corps does cyber.
I gave him an honest answer. I do not remember the exact words I used. I remember the substance, which was that I told him a lot of things he might not have wanted to hear. I told him that we do not train the way we would train if we actually intended to win. I told him that we push people through schools and call that proficiency, that we spend a disproportionate share of our time on administrative overhead instead of getting better at the work, and that the way we resource the discipline does not match the way we talk about it.
I want to be careful here, because the easy misreading of what I said is that the Marine Corps is bad at cyber. That is not what I told him and it is not what I believe. The Marine Corps is not bad at cyber. The problem is that it has never given the discipline the full effort it would take to be great at it. For a long time cyber was treated as a check in the box rather than a real discipline, something you stood up because you were supposed to have it, not something you invested in because you intended to be dangerous with it. There is a difference between having a capability and being good at using it, and that difference was what I was trying to put in front of him.
Take the schools point, because that is the one I feel most strongly about. The field leaned hard on courses and certificates as the way to mature an operator or a defender. Send them to a school, hand them a cert, call them proficient. I have never seen that actually work. Courses and certs can make you more talented. They can hand you techniques and vocabulary and a framework for thinking about the problem. What they cannot do is make you mature, because maturity in this work takes time and reps and there is no way to rush it. A large part of cyber is intuition, the thing that tells you a box is wrong before you can articulate why, and you cannot teach intuition in a classroom. You build it by doing the work, failing at the work, and doing it again. A pipeline built on schools produces people with a lot of knowledge and very little of that intuition, and then we are surprised when they freeze on a live network.
The administrative overhead point is about the defenders more than the red team. There is a thing I say about the Marine Corps, which is that any job in the Corps is sixty percent being a Marine and forty percent the actual job. Billets, the general running of the unit, inventory, whatever the unit needs done that week. That split is fine for a lot of roles. It is a problem for a discipline where the forty percent is the whole point and it still needs ten thousand hours to get good. Defenders rarely get real time to just practice the skill and test themselves against a live opponent. They go to exercises, but there is only so often someone is playing the bad guy, and when there is no opponent the exercise quietly turns into standing up the network and securing it in a cybersecurity sense rather than defending it in a cyber sense. The reps end up being about supporting the unit’s training instead of the defenders getting their own. They spend the event making someone else better and go home no sharper than they arrived.
I used a comparison that I have used a few times since. Cyber, in the Marine Corps as I knew it, was like charity. Everyone loves to talk about how great it is. Very few people give a real damn about it or do anything meaningful to change it.
The general’s staff were also very interested in the content of the conversation. Partway through they asked if they could chime in with questions of their own. They were as appreciative of the candor as he was. What came through in their questions was that they had suspected something like this for a while. The picture they were briefed on was not wrong, exactly. It was shaped. Given to them in a way that made each piece seem like the full story when it was not. They had just never been able to get the unshaped version from someone who had been at the keyboard.
I could see, on the side of the room, the leads from the other team going pale. There is a particular look that people get when they realize they are watching someone end their career in real time. They were wearing that look.
I was a Gunnery Sergeant. I was the chief of the Red Team. I was getting out soon, because my body had taken enough wear that I could see the math on a full career and the math was not adding up. I was the person in that room with the least to lose by telling the general the truth, and the truth was what the general had come to hear. He did not need a sales pitch. He needed someone in a uniform a few ranks below his own who had been doing the work and could tell him, plainly, what the work looked like from where I was sitting.
He was not taken aback. He was grateful.
That is the thing that happens to people once they have stars on their collar. They get insulated. People start treating them like they live in the clouds, and people keep them there, because telling the truth to someone who can route a career into a wall takes a particular kind of willingness. They are real people and they need real facts. One of the most useful things I have learned in this career is that the best way to catch someone off guard is to tell them the truth. I will write more about that in a future post.
I am not going to claim that single conversation changed anything structural. I do not know whether it did. What I know is that the conversation was the right one to have, and the general thanked me for it, and the team leads from the other team did not say very much for the rest of the day. I went back to the workstation. There was an op to finish.
The Final Push
Near the end of the exercise our “friendly” forces were moving against an “enemy” town. This was the big climax to the exercise where everyone gets to do cool things in a last hoorah before everyone packs up and leaves. The plan was a combined arms assault, and someone in the planning element had the good sense to want cyber tied into the kinetic action. They walked over to our cell and asked what we could do, what position we were in, and how we could help. We strategized with them on what would be good training without causing any real problems.
What they wanted is something a lot of clients want: a structured denial of service. Non-damaging, reversible, the kind of thing every force should train against and that is not uncommon in a fight. It is also the kind of effect we always tell people has to be structured carefully, because a denial of service can go badly very quickly if you do not understand the environment you are doing it in. So we worked with the planners to get as many details as possible. What depended on those comms paths, what would break if they went down in a way we did not intend, how fast we could reverse it when they called it. This was an exercise. The only thing we wanted to produce was training value, not real effects, so everything we built was non-damaging and set up so we could stop it or switch it back the moment they asked.
This is worth sitting with for a second, because in Part 3 I spent a lot of words on why the destructive option is usually the wrong one. Take the network down and you lose the network as a sensor. Everything I argued for during this op was the quiet version, the network left up and used to watch. The blackout was the opposite move, and it was the right call here, because the kinetic planners had a specific moment where a few minutes of lost coordination was worth more than anything the access could tell us. We also were not really destroying anything. We structured the effect so it looked like a blackout to the defending force and reversed cleanly for us. The destructive option is the wrong default. It is not the wrong answer every time. The skill is knowing which moment you are in.
We planned it over a few hours. Once we had everything ready, we told the planners we were set, got into position, and waited for the signal.
Eventually the signal came. The network the defending force was using to coordinate its defense went dark. At the same instant, our forces stepped off.
You could hear the effect on the radios. The exercise control element was running a feed of the defender side’s traffic, and what came across the speakers was the sound of a force trying to recover comms while an assault was already underway. People asking where their links had gone. People trying to push by voice because they could not log in anymore. It was disorienting on their side, exactly the way it was supposed to be.
The assault went in. Our forces did the job they had spent the exercise preparing to do, and our piece of it had the effect we had spent the exercise preparing to deliver.
That is what cyber synchronized with kinetic action looks like when it works. It is not a movie scene. It is comms going quiet at a moment chosen by the kinetic planners, and the defending force losing a few minutes of coordination at the moment those minutes were most expensive. That is the entire effect, and it is enough.
The Other Team
Once things wound down, I sat down with the leads from the other team. The way that team is built, they send a few leads out for an op: enlisted leads who manage the team and run the actual work, and a civilian lead who handles the relationship with the client. I talked with all of them. I asked, plainly, how they thought they had performed and whether they thought they could do this same work without us next time.
The reads were not the same across the leads. The civilian lead thought they had done a good job overall and mostly wished they had gotten more opportunities to operate, which is the answer you would expect from the person whose job is to show the client what the team can do. The enlisted leads, the ones who had actually been at the keyboard, were a little relieved they had not gotten more rope, and they were immensely grateful we had been there. This was the first time this team had come to do this for the Marine Corps, and MWX is not a gentle place to learn what one of these is. They knew how badly it could have gone if they had walked in cold, without guidance and without anyone who had done it before, and found out in front of the client what they did not know.
This is where the thing I said back in Part 3 comes home. Sending an entirely junior crew into a tasking on a short timeline is a bad trade, and it is not the junior crew’s fault. They told me themselves, without me having to lead them to it, that they could not have done this without us yet. I respected that enormously. Looking at a hard week and saying out loud that you came up short is how you get better. Whether they took it home, I have no way of knowing. I hope they brought it back to their team and used it to push for the training and the resourcing they needed. That kind of honest reckoning is the most valuable thing you can carry out of an exercise like this. The op itself is notional. The lessons are not.
Going Home
We packed up, slept, and wrote the reports.
There was another op behind this one and another behind that, and looking back from where I am now, every one of them taught me something I did not know going in. This MWX taught me more than most.
The hotel nights. The general. The kid with the solitaire game. The wargame managers telling me it was too much intel. Pete going off about how we needed to get food. Lance, myself, and the rest of the team trying to figure out RBI on no sleep. Sleeping on the floor with a curtain so my Marine could have the warmer spot.
It was the longest op of my life. It might also have been the best one.
Thanks for reading.
This was a wargame, not an operation. Everything described is notional, generalized, and presented at a level intended to convey the experience and the lessons rather than the tradecraft. No personnel beyond those who have written publicly under their own names are identifiable. No units, dates, locations, techniques, or outcomes are presented in a way that would identify specific systems or people. Where details have been generalized, they have been generalized on purpose.