Cyber Conscription Experience and Best Practice from Selected Countries - Report - icds.ee
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Report Cyber Conscription Experience and Best Pr actice from Selected Countries | Martin Hurt | Tiia Sõmer | February 2021
Title: Cyber Conscription: Experience and Best Practice from Selected Countries
Authors: Hurt, Martin; Sõmer, Tiia
Publication date: February 2021
Category: Report
Cover page photo: Ardi Hallismaa/ Estonian Defence Forces
Keywords: compulsory military service; cyber conscript; cyber reservist; defence; military training
Disclaimer: The views and opinions contained in this paper are solely those of its authors and do
not necessarily represent the official policy or position of the International Centre for Defence and
Security or any other organisation.
ISSN 2228-0529
ISBN 978-9949-7484-8-8 (print)
ISBN 978-9949-7484-9-5 (pdf)
© International Centre for Defence and Security
63/4 Narva Rd., 10120 Tallinn, Estonia
info@icds.ee, www.icds.ee
I Cyber Conscription IAcknowledgements
We are very grateful to all the representatives of the Royal Danish Army Joint Signal Regiment
3 CISOPS Battalion, the Estonian Defence Forces Cyber Command, the Estonian Defence League
Cyber Defence Unit, the Estonian Defence Resources Agency, Tallinn University of Technology
(TalTech), Defence Command Finland, the Norwegian Armed Forces Cyber Defence, the Swedish
Armed Forces Headquarters, the KTH Royal Institute of Technology (Sweden) and the Armed Forces
Staff of the Swiss Armed Forces, who agreed to be interviewed for this study and who were generous
with their time and frank in their opinions.
While we have received much valuable help from others, the conclusions and recommendations of
this study, and any errors of fact or judgement, are ours alone.
Cyber Conscription IIAbout the authors
Martin Hurt
Martin Hurt is a Research Fellow at the International Centre for Defence and Security (ICDS) in
Tallinn, Estonia. His areas of research include developments in NATO and the EU, as well as national
security- and defence-related topics in the Nordic-Baltic region. He has worked as Defence Counsellor
at the Estonian Permanent Representation to NATO, in various positions at the Estonian Ministry of
Defence, and at the Swedish Armed Forces Headquarters.
Tiia Sõmer
Tiia Sõmer is a researcher and PhD student at Tallinn University of Technology, Estonia. Her PhD
research concentrates on modelling of cybercrime. Other research interests include cyberwarfare,
cybersecurity workforce challenges, and cybersecurity education and training. Before an academic
career, she served for over 20 years in the Estonian Defence Forces, in posts including international
assignments at NATO and the EU.
Cyber Conscription IIIExecutive Summary
Cyber conscription is quite a new phenomenon and, while there are differences between the
countries that make use of it, there are also similarities. This report aims to identify best practices,
exploring how countries can make best use of conscripts and reservists with information and
communications technology (ICT)-related education and/or experience, bearing in mind the limited
time that is available during their service. The report examines cyber conscription in six countries:
Denmark, Estonia, Finland, Norway, Sweden and Switzerland. It focuses on the selection, training
and employment of cyber conscripts and reservists.
The purpose of cyber conscription varies between the nations and depends on the overall purpose
of conscription itself.
In the countries analysed, the number of volunteers applying for cyber conscription today exceeds
the military’s needs, meaning there is no immediate need to increase the attractiveness of cyber
conscription. This may change, however, since several nations plan to increase the annual number
of cyber conscripts to be called up.
All the countries have medical and physical requirements that conscripts of all types must fulfil.
In general, these requirements apply also for cyber conscripts, with a small number of exceptions
possible. In most countries the conscripts are also subject to a specific ICT-related test.
Cyber conscripts in the studied countries are selected first and foremost based on personal will
and motivation, education and experience. Most cyber conscripts have IT-related educational or
professional backgrounds. Few have been called up directly from high school without any IT-related
education.
The interviews confirmed that cyber conscripts receive basic military training that mostly follows a
uniform pattern common to all conscripts. Only after completing basic military training are cyber
conscripts subjected to more specific training, including on cyberspace operations.
The interviews indicated that a dedicated reserve organisation that could draw upon citizens who
have completed cyber conscription is still not fully developed in some of the studied nations that
have this ambition.
Several of the studied countries’ armed forces cooperate with universities and have either developed
or are planning to launch partnerships with the private sector. Some provide their cyber conscripts
with training that gives them a specialist certificate or university credit points.
We recommend that military authorities:
• improve their communication in order to better manage the expectations of conscripts because
of the potential for misunderstandings related to the very different aspects that are linked with
the term “cyber conscription”
• ensure that cyber conscription is a win-win deal from which both the armed forces and the
individual conscripts clearly benefit
• develop cognitive tests that are suited for larger numbers of future cyber conscripts
• consider partnering with academia and the private sector to exploit the potential for effective
specialised training as well as more efficient use of resources.
Cyber Conscription IVList of Abbreviations
C2 Command and control
CDIS Centre for Cyber Defense and Information Security (KTH, Sweden)
CDU Cyber Defence Unit
CFCS Centre for Cyber Security (Denmark)
CIRC Computer Incident Response Capability
CISOPS Communication Information System Operations
CMS Compulsory military service
CNO Computer network operation
ECTS European Credit Transfer and Accumulation System
EDF Estonian Defence Forces
EDL Estonian Defence League
EHIS Estonian Educational Information System
FDFC5A Finnish Defence Forces C5 Agency
ICT Information and communications technology
ISR Intelligence, surveillance and reconnaissance
IT Information technology
KTH Kungliga Tekniska Högskolan (Royal Institute of Technology, Sweden)
NCO Non-commissioned officer
Stratcom Strategic communications
TalTech Tallinn University of Technology
VET Vocational Education and Training
Cyber Conscription Vinteractions and services, gives rise to new
needs of society in general and armed forces
in particular. An increasing number of nations
relying on conscription intend or have already
started to train conscripts for a role in cyber
defence. Their exact roles and responsibilities
may vary and the term “cyber conscription” is
therefore rather broad and covers everything
from raising awareness of cyber threats among
conscripts to assigning them an active role in
Introduction safeguarding military and/or civilian networks.
How successful are governments in harnessing
Cyber defence and conscription have in recent the ICT-related skills of conscripts and reservists
years gained more importance and visibility. for national defence?
There are obviously several reasons for this,
but two important developments can be This report aims to identify best practices by
distinguished: the recognition of cyber as a exploring how countries can make best use of
domain of operations comparable to more conscripts with ICT-related education and/or
traditional ones and the deteriorating security experience, bearing in mind the limited time
environment that involves not only the Euro- that is available during their service.
Atlantic area but also increasing tensions
between China and the West. The report looks at various examples of how
nations use conscripts for cyber defence.
In July 2016 at the Warsaw Summit, NATO It focuses on the selection, training and
recognised cyberspace as a domain of employment of conscripts and reservists while
operations in which the Alliance must defend paying less attention to their specific tasks for
itself as effectively as it does in the air, on land security reasons. The study was conducted
and at sea.1 In addition, a number of nations, based on information from six nations:
including the United States, Germany, the Denmark, Estonia, Finland, Norway, Sweden
Netherlands and Estonia, have established a and Switzerland.
separate cyber command alongside traditional
army, navy and air force commands or Cyber conscription is quite a new form of
conscription in all countries and, while there
headquarters.2 This underlines the importance
were differences between them, there are
of cyber capabilities, both defensive and
offensive. also similarities. Cyber conscription has been
conducted for a short period of time
in all the countries studied, so it is too
An increasing number of nations relying on early to draw far-reaching conclusions.
conscription intend or have already started to The aim of this report is to provide a
general overview of cyber conscription
train conscripts for a role in cyber defence as conducted in the countries studied.
Following Russia’s occupation and illegal The work is divided into five parts. Part 1
annexation of Crimea in 2014, a number provides background to why conscription and
of European countries have reintroduced cyberspace operations are relevant and gives
conscription as a means of staffing their armed definitions. Part 2 explains the purpose of cyber
forces. The evolving security environment conscription in the studied countries. Part
and cyber threats, linked to digitalisation of 3 explains the career management of cyber
conscripts and cyber reservists by describing
1
“Cyber defence,” Topics, North Atlantic Treaty Organisation, how cyber conscripts are recruited, selected,
last modified 25 September 2020, https://www.nato.int/cps/ trained and employed. Part 4 describes
en/natohq/topics_78170.htm.
examples of cooperation between the armed
2
Piret Pernik, Preparing for Cyber Conflict: Case Studies
of Cyber Command (Tallinn: International Centre for forces and educational institutions. Part 5
Defence and Security, 2018), 1, http://icds.ee/wp-content/ looks at the benefits, risks and challenges of
uploads/2018/12/ICDS_Report_Preparing_for_Cyber_
Conflict_Piret_Pernik_December_2018-1.pdf. cyber conscription.
Cyber Conscription 11. Background, hybrid systems consisting of both mobilisable
reserves and all-volunteers.
Methodology and
Definitions The current duration of conscript training
and the number of citizens called up for
1.1. Background conscription is set out in Table 1.
1.1.1. Conscription Whether the main reason for conscription is to
persuade youngsters to join the armed forces
Conscription, also called the draft, is often as professionals or to prepare them to fill
defined as compulsory enrolment for service in reserve positions, it is easy to agree with the
a country’s armed forces and it has existed as statement from a report recently submitted
both universal and selective service.3 Since it is to the Norwegian Ministry of Defence:
often perceived as negative and linked with the conscription and CMS offer the armed forces
notion of a mass army, some countries prefer opportunities that the private sector can only
to use the term “compulsory military service” dream of.5
(CMS).
The main reason for conscription is to
Nations use conscription for different
purposes and in different forms. persuade youngsters to join the armed
Some nations have relatively small forces as professionals or to prepare them
populations compared to the size
of their territories and CMS has to fill reserve positions
historically been used to increase
the numerical size of the forces, accepting A more detailed description of conscription in
an offset in terms of quality in comparison the analysed countries is given in Annex A.
with all-volunteer forces. The armed forces of
Estonia, Finland and Switzerland are largely 1.1.2. Cyberspace operations
made up of mobilisable reserves maintained
through a significant annual intake of Cyberspace is now widely recognised as an
youngsters who undergo CMS. Denmark has essential element of national security. As a
focused more on exploiting conscription as a consequence, many nations are developing
base for recruitment of volunteers although the role the military plays as an instrument of
in recent years the Danish authorities have national defence.6 Cyberspace operations can
started to emphasise the need to be able to be defined as “the employment of cyberspace
mobilise reservists who have undergone basic capabilities where the primary purpose is to
military training.4 Norway and Sweden have achieve objectives in or through cyberspace”.
Denmark Estonia Finland Norway Sweden Switzerland
Duration 4–12 8–11 5.5–11.5 12–16 6–15 4.5
(months)
Conscripts
trained 4,200–4,700 3,200–4,000 20,000 8,000 5,000 20,000
per year
Table 1. Conscript training by country 5
Berit Svendsen et al., Økt evne til å kombinere menneske og
teknologi. Veier mot et høyteknologisk forsvar [Increased
Ability to Combine Humans and Technology. Roads to a High-
tech Defence] (Oslo: Svendsen-utvalget, 2020), 87, https://
www.regjeringen.no/contentassets/374492dfae2f41a18f9b0
1e8678b468a/svendsen-utvalget--okt-evne-til-a-kombinere-
menneske-og-teknologi.pdf.
6
Brad Bigelow, “What are Military Cyberspace Operations
3
Britannica Online Encyclopaedia, “Conscription,” https:// Other Than War?,” in 2019 11th International Conference
www.britannica.com/topic/conscription. on Cyber Conflict: Silent Battle, ed. T. Minárik, S. Alatalu,
4
Forsvarsministeriet (Ministry of Defence) (Denmark), S. Biondi, M. Signoretti, I. Tolga and G. Visky, (Tallinn:
“Defence Agreement 2018–2023,” https://fmn.dk/ NATO CCD COE Publications, 2019), https://ccdcoe.org/
globalassets/fmn/dokumenter/forlig/-danish-defence- uploads/2019/06/Art_10_What-Are-Military-Cyberspace-
agreement-2018-2023-pdfa-2018.pdf. OperationsOther-Than-War.pdf.
Cyber Conscription 2They may be categorised as: The Swedish Armed Forces monitor and
1. defensive cyberspace operations analyse network traffic continuously and have
2. intelligence, surveillance and the capability to carry out any type of computer
reconnaissance (ISR) cyberspace operations network operation (CNO), including defensive
3. offensive cyberspace operations.7 and offensive actions.12
In Switzerland, the Federal Department
The armed forces of the studied countries of Defence, Civil Protection and
are responsible first and foremost for Sport has sufficient qualitative and
quantitative competences and
protecting their own networks but, in capacities to disrupt, prevent or slow
addition, some also fulfil tasks in the down attacks on critical infrastructure
protection of other organisations where necessary. The Armed Forces
play a crucial role as a strategic
reserve for the subsidiary support of
The armed forces of the studied countries are civilian administrative units and in the event
responsible first and foremost for protecting of mobilisation. The Armed Forces must
their own networks but, in addition, some therefore be able to guarantee operational
also fulfil tasks in the protection of other readiness across all situations in the area of
organisations. As a consequence, in some cyber defence, including active measures to
nations cyber conscripts are also trained to identify threats and attackers and to disrupt
meet the needs of stakeholders other than the and suppress attacks.13
armed forces.
1.2. Methodology
In Estonia, a Cyber Command has been set
up with the aim of carrying out cyber and The work conducted relies on qualitative data
information operations in cyberspace and the sources: interviews, observations and articles,
information sphere.8 Its mission is to defend and public documents. The interviews were
the information systems of the Estonian undertaken in late 2019 and early 2020 with
Defence Forces (EDF) and of its allies while key individuals involved in cyber defence or
maintaining readiness to conduct active cyber training of cyber conscripts. Our interviewees
defence operations.9 included personnel from and representatives
of the Royal Danish Army Joint Signal Regiment
The Finnish Defence Forces are developing 3 CISOPS Battalion, the EDF Cyber Command,
the capability to maintain cyber situational the Estonian Defence League Cyber Defence
awareness, for planning and implementing Unit, the Estonian Defence Resources Agency
cyber operations, and for protecting and responsible for recruitment, Tallinn University
monitoring their systems in the cyber domain.10 of Technology (TalTech), Defence Command
The Norwegian Armed Forces Cyber Defence Finland, the Norwegian Armed Forces
branch develops, runs and protects the Cyber Defence, the Swedish Armed Forces
military communications systems and digital Headquarters, the KTH Royal Institute of
infrastructure.11 From 2021, the Norwegian Technology (Sweden) and the Armed Forces
Armed Forces will monitor networks of the Staff of the Swiss Armed Forces.
whole defence sector.
7
Pernik, Preparing for Cyber Conflict, 2.
8
Ministry of Defence (Estonia), “Estonian Military Defence
2026,” https://www.kaitseministeerium.ee/sites/default/
files/sisulehed/eesmargid_tegevused/rkak2026-a6-spreads_
eng-v6.pdf. 12
“Cyber Defence,” Organisation, Swedish Armed Forces, last
9
Pernik, Preparing for Cyber Conflict, 6. accessed 27 October 2020, https://www.forsvarsmakten.se/
10
Prime Minister’s Office (Finland), Government’s Defence en/about/organisation/cyber-defence/.
Report (Helsinki: Prime Minister’s Office Publications, 13
Federal Council (Switzerland), National Strategy for the
7/2017), https://www.defmin.fi/files/3688/J07_2017_ Protection of Switzerland Against Cyber Risks (NCS) 2018–
Governments_Defence_Report_Eng_PLM_160217.pdf. 2022 (Bern: Federal IT Steering Unit, April 2018), https://
11
“Norwegian Cyber Defence,” Organisation, Norwegian www.ncsc.admin.ch/dam/ncsc/en/dokumente/strategie/
Armed Forces, last modified 11 October 2020, https://www. Nationale_Strategie_Schutz_Schweiz_vor_Cyber-Risiken_
forsvaret.no/en/organisation/norwegian-cyber-defence. NCS_2018-22_EN.pdf.
Cyber Conscription 31.3. Definitions 2. Purpose
“Cyber conscription” is a term that has come to In general, the purpose of cyber conscription
be used widely. However, there is no generally is to increase or support cyber capabilities
agreed definition. The tasks performed by in a country’s armed forces, ranging from IT
cyber conscripts vary between the countries support to cyber defence, as explained below.
studied. Like cyberwarfare in general, the The specific purpose varies between the
definitions, where they exist, are national nations and depends to a certain extent on the
and can cover a wide range of areas. There is overall purpose of conscription, as explained in
therefore no common approach to the term. subsection 1.1.
It includes technical cybersecurity and
cyber defence as well as IT support, In general, the purpose of cyber conscription
programming and development, but
often also more traditional branches is to increase or support cyber capabilities
such as communications/signals, in a country’s armed forces, ranging from
intelligence, and even social media.
For the purpose of this paper, the
IT support to cyber defence
terms “cyber conscription” and “cyber
conscripts” are used in the same way as the Denmark is trialling the training of cyber
countries analysed use them. conscripts over three years from 2020 with
the main purpose of recruiting professionals
Throughout this report, the term “basic military after they have finished their cyber training.
training” is used to describe the introductory However, no dedicated positions for personnel
military training in fundamental skills to which with cyber skills currently exist in the military
all conscripts are subjected for between two organisation. The aim is to implement them
and four months to enable them to function in different levels in the organisation pending
as individuals in a military organisation. All the outcome of the three-year testing project.
conscripts undergo basic military training Denmark was able to recruit more than 50%
before receiving specialised training, including of the 2020 intake of cyber conscripts as
cyber-related training. professionals to the three services (army, navy
and air force) after the end of their
conscription period.
“Cyber conscription” is a term that has
come to be used widely. However, there is In the Estonian Defence Forces, cyber
conscription is used in a supporting
no generally agreed definition role to reinforce some of the functions
fulfilled by the Cyber Command, such
For the purpose of this paper, the terms as IT security and IT support, programming and
“reservists” and “reserves” are used for citizens development, by assisting full-time military and
who have finished their military training, fill civilian employees. This is particularly necessary
positions in the armed forces reserve and can when the demand for IT services increases
be mobilised or called up for refresher training. to levels above normal, e.g. during larger
exercises or operations.14 The first conscripts
“Cyber reservist” describes the status of a focusing on IT-related tasks were called up in
cyber conscript who has completed his or her 2014 when a pilot project was launched. Due
military training and is assigned to the reserve. to the modernisation and development of EDF
IT systems, there was a need for additional
“Refresher training” is the term for calling personnel to conduct various tasks. As the EDF
up reservists and updating their military
knowledge during shorter periods of time, 14
Linda-Liis Laikoja, “‘Kübersõdur’ on sõna, mis kõlab nagu
often ranging from a couple of days to several terminaatorlik tegelane kuskilt ulmefilmist, kuid mille taga
weeks depending on the country and legal tegelikult peitub meie riigi turvalisus” [‘Cyber soldier’ is a
word that sounds like a Terminator-like character from a
specificities. science-fiction movie while in fact protecting our state],
DigiPRO, 17 December 2020, https://digipro.geenius.
ee/eksklusiiv/paev-kubersoduri-elus-on-nagu-startupis-
tootamine/.
Cyber Conscription 4is an organisation that uses civilian resources to communications and guard duties.15 Since
and capabilities extensively, it was suggested the Armed Forces will monitor the networks
that the IT knowledge and experience of of the entire defence sector from 2021, the
conscripts should be used. Initially the size of the cyber conscript unit will increase.
number of conscripts was relatively small Cyber conscription is also important because it
(a squad-size unit) and they were used as IT forms a base from which professionals can be
support personnel, but later those with more recruited.
experience and knowledge were given tasks in
programming and development. The Swedish Armed Forces’ training of cyber
conscripts is primarily aimed at addressing
Before cyber conscription was explicitly the requirements of the Armed Forces but
introduced in Estonia, conscripts served in also to meet the needs of other defence
various ICT-related positions. These positive organisations, including the National Defence
experiences gave reason to introduce cyber Radio Establishment, the Swedish Defence
conscription and this has been running for a Materiel Administration and the Intelligence
number of years. All conscripts who undertake and Security Service, law enforcement and
their CMS in the Cyber Command are currently rescue organisations, including the Swedish
formally regarded as cyber conscripts. Civil Contingencies Agency, and the country’s
Informally and in a narrower sense, cyber defence industry.16
conscripts are those who work in IT-related
areas in three main roles: IT development, IT In Switzerland, the main purpose of training
support and IT security. cyber conscripts corresponds with the overall
principle of the Swiss Armed Forces: to
In Finland, cyber conscripts are male, or train personnel for the militia system. Cyber
voluntary female, citizens who undergo CMS conscripts support the professional cyber
and who have voluntarily applied, passed a specialist teams of the Swiss Armed Forces
specific cyber test and been selected to serve Command Support Organisation.
in the Finnish Defence Forces C5 Agency
(FDFC5A). Typically, they have relevant
education or special interests and knowledge 3. Career Management
in the subject. Conscripts who are trained
to serve on an ICT helpdesk or with combat of Cyber Conscripts
cameras are not considered cyber conscripts
as they are not required to pass the cyber test This chapter explains how cyber conscripts’
that is mandatory for cyber conscripts. careers are managed, describing how they
are recruited, selected, trained and employed
The Finnish Defence Forces have a well- during their CMS (service) and later (reserve).
developed reserve-based wartime organisation It is a summary of all findings. More detailed
that requires a steady inflow of new personnel descriptions by country are available in Annex B.
consisting of trained conscripts. Finland has run
cyber conscription since 2015 and appears to In all countries studied, the overall career
have the greatest amount of experience of the management of cyber conscripts follows a
countries studied. The annual intake of cyber pattern illustrated by the following chart.
conscripts is between two and 20; there is no
quota. The skills of the individual conscripts
are considered the most important factor, so it
15
Norwegian Armed Forces, “Norwegian Cyber Defence”;
takes time to fill all reserve positions. and Svendsen et al., Økt evne til å kombinere menneske og
teknologi, 24.
In Norway, cyber conscripts have a supporting 16
The National Defence Radio Establishment is the Swedish
national authority for signals intelligence. The Swedish
role and help to monitor armed forces Defence Materiel Administration procures equipment and
networks. The Norwegian Armed Forces services for the Swedish Armed Forces. The Intelligence and
Cyber Defence, which runs, secures and Security Service collects and processes information on global
political developments and external threats to Sweden and
protects the Armed Forces’ communications Swedish interests and prepares and protects the Armed
systems and digital infrastructure, has only Forces from security threats. The Swedish Civil Contingencies
Agency (MSB) is responsible for helping society prepare for
11% conscripted personnel, primarily related major accidents, crises and the consequences of war.
Cyber Conscription 5All countries have their own specific medical
and physical requirements that conscripts
must fulfil. In general, such requirements are
the same for cyber conscripts, with a small
number of exceptions possible. The aim of
conscription is to prepare new recruits for their
military tasks; they are given basic military
training followed by training according to their
specialisation (infantry, artillery, air defence,
etc.). Cyber conscription is different as, due
to its nature, cyber conscripts should ideally
possess theoretical ICT-related education,
either vocational education and training (VET)
or a pre-university senior high school or by
having started their studies at a university,
Chart 1. Career management of cyber conscripts or gained practical experience in the field.
It would not be feasible to teach conscripts
First, cyber conscripts are recruited together everything from scratch during a short period
with other conscripts who will be later allocated of CMS, as is possible in more traditional
to various units and functions within the armed military specialisations.
forces. From this overall pool, some will
be selected to become cyber conscripts
based on separate criteria. These will Cyber conscripts in the studied countries
undergo different training, after which are selected first and foremost based on
some will also practice their skills by
serving in positions. From these trained
personal will and motivation and
conscripts, all six countries try to recruit previous ICT experience
full-time employees. In addition, some
nations also have a well-developed
reserve organisation similar to other traditional 3.2. Selection
branches, while other countries have a more
general pool of reserves. This subsection describes how the most
suitable individuals are selected for cyber
3.1. Recruitment conscript training from among other conscripts.
In Denmark and Sweden, this selection process
This subsection explains how the authorities starts before the individuals are called up for
identify the youngsters who are called up for CMS. In Finland and Switzerland, the cyber
CMS, regardless of what position they will serve conscripts are selected among youngsters
in. It will also describe examples of how armed who have already been called up and are
forces approach and attract potential cyber undergoing basic military training. Estonia
conscripts in order to make them aware of the employs a hybrid version combining elements
possibility of serving as a cyber conscript. of both approaches.
In all the countries analysed, the number of Children today start computer and
cyber security education early. In most
volunteers applying for cyber conscription countries the number of applicants
currently exceeds the military’s requirements for cyber conscription exceeds the
number of positions available, as more
and more young people are educated
In all the countries analysed, the number of or simply very knowledgeable about cyber
volunteers applying for cyber conscription security. The area is interesting to them and
currently exceeds the military’s requirements, the armed forces therefore face the challenge
so there is no immediate need to increase of how to select the best people for cyber
attractiveness of cyber-defence training for conscription. Cyber conscripts need to be
conscripts. qualified for the job, but also very motivated.
Cyber Conscription 6Test to measure computer skills
Denmark Previous skills and motivation
Pre-identification: own Interview to understand
Estonia application or by Cyber Command IT-test
personality and motivation
Block test to measure cognitive
Finland Previous knowledge abilities
Norway Hacker arena
Sweden Preliminary identification Tests (theoretical and practical) Interview
Two-day assessment in military
Switzerland Online selection exam training facility Personality evaluation
Chart 2. Selection of cyber conscripts
Each country has its own rules, regulations training, including on cyberspace operations.
and procedures for this.17 In general, cyber Some of the training is provided by civilian
conscripts in the studied countries are selected teachers, from either vocational schools or
first and foremost based on personal will and universities, and sometimes as a result of
motivation and previous ICT experience. In formal cooperation agreements between the
most countries the conscripts are also subject armed forces and the particular vocational
to a specific ICT-related test. school or university.
The method of selecting cyber conscripts in the Most interviewees stressed that cyber conscripts
six countries is illustrated in Chart 2. are treated more as individuals since they have
to be very skilled and to function as members of
This chart does not aim to show an exhaustive small teams, unlike traditional soldiers trained
list of activities forming part of the selection to serve in larger units such as battalions.
process, but it indicates the different steps that Some claimed that cyber conscripts differ from
are used in the analysed countries. conscripts serving in more traditional roles.
In Sweden and Switzerland, cyber-
Cyber conscripts receive basic military specific training enables conscripts to
earn university credit points that will
training mostly following a uniform pattern be useful for later study. Military cyber
common to all conscripts. Only after training is considered an additional
qualification when applying for a
completing basic military training job after completing cyber conscript
are the cyber conscripts subjected to service.
more specific training 3.4. Service
After completing their cyber-specific training,
3.3. Tr aining cyber conscripts are used in different ways. In
some countries most of the cyber conscript
The interviews confirmed that cyber conscripts period is devoted to training, thus leaving little
receive basic military training mostly following or no time for practising the learned skills by
a uniform pattern common to all conscripts. carrying out operational tasks. In such cases,
Only after completing basic military training are on-the-job training is the closest they get to
the cyber conscripts subjected to more specific service. In other nations, cyber conscripts who
have completed their specialised training play a
17
Tiia Sõmer et al., “Developing Military Cyber Workforce in supporting role by assisting full-time personnel
a Conscript Armed Forces: Recruitment, Challenges and in monitoring networks, participating in
Options,” in Proceedings of the 14th International Conference
on Cyber Warfare and Security (ICCWS 2019), ed. Noelle development or maintaining IT equipment.
van der Waag-Cowling and Louise Leenen (Reading, UK:
Academic Conference and Publishing International, 2019),
413−421.
Cyber Conscription 73.5. Reserve hours.18 Different possibilities for service in the
defence forces are explained, including active
The interviews indicated that the cyber reserve duty after conscription. Often these classes are
organisations involving cyber conscripts delivered by EDF personnel. In recent years and
who have finished their training are still not as part of the national defence course, Cyber
fully developed in most of the countries Command personnel have started to visit high
under review. The main exceptions appear schools, vocational schools and universities to
to be Finland, which has chosen to invest in introduce cyber conscription.
quality rather than quantity when designing
its cyber reserve organisation, and Estonia. The Cyber Command intends that cyber
Countries benefit from the work experience conscript training and service should count
of cyber reservists who have developed their towards university studies by earning academic
professional skills after finishing conscript credit points. This is currently handled on a
training. Denmark does not appear to aim to case-by-case basis, according to need. Also,
develop a cyber reserve organisation. the Defence Forces and the Kehtna Vocational
Education Centre signed an agreement in late
2020 that allows students of the school’s IT
4. Cooper ation specialty to complete an internship during
with Educational cyber conscript service starting in 2022 but
this still requires formal blessing from the
Institutions and Ministry of Education and Research and the
Industry Ministry of Defence. In order to formalise the
arrangements, a specific agreement between
In several of the studied countries, armed both ministries is required; discussions are
forces cooperate with universities and either ongoing.
have developed or are planning to launch
partnerships with both academia and industry. Young talent can also be identified from
High schools are not specifically targeted, and other activities. In 2019 Estonia introduced
in some countries this is prohibited. a dedicated voluntary cybersecurity course
in secondary schools, which teaches both
Danish Defence cooperates with a university technical and non-technical aspects of the
that provides some of the training to cyber subject. In addition to the national defence
conscripts to ensure that they have the latest curriculum and the voluntary cybersecurity
standards when it comes to IT and cyber course, one school (Põltsamaa Secondary
knowledge. Other civilian institutions also School) has introduced an in-depth IT and
cyber defence specialisation to its
students.19 Outside the national
In several of the studied countries, school curriculum, additional activities
armed forces cooperate with universities are offered by schools, various
organisations and the private sector.
and either have developed or are The Ministry of Defence also sponsors
planning to launch partnerships with cybersecurity competitions, which has
identified many young talents who
both academia and industry have later joined cyber conscription.
provide some of the education. In Finland, high schools are “targeted” with
In Estonia, national defence is a voluntary general defence-related education. No high
course in the secondary school curriculum,
18
Vabariigi Valitsus (Government of the Republic) (Estonia),
in which students are briefed about national “Gümnaasiumi riiklik õppekava 2011” [State Curriculum
defence, including but not limited to the role for Secondary Schools 2011], Riigi Teataja (Estonian State
of conscription. The aim of national defence Gazette), RT I, 14 January 2011, 2, https://www.riigiteataja.
ee/akt/128072020013?leiaKehtiv.
teaching is not military-specific learning, but 19
“Infotehnoloogia (IT)- ja küberkaitse õppesuund”
“good citizenship” development in general. [Information Technology (IT) and cyber defence
National defence is an elective course for specialisation], Põltsamaa Ühisgümnaasium (Põltsamaa
Secondary School), last modified 17 March 2020, https://
upper secondary school students, lasting 70 www.poltsamaa.edu.ee/en/node/468.
Cyber Conscription 8schools offer programmes on cybersecurity, energy). The external internship is part of the
focusing more generally on sports or natural practical training during basic military training
sciences. Universities in Finland play no role in and lasts eight to ten weeks. Cyber conscripts
training conscripts since the Finnish Defence can also participate in exercises and training
Forces have the biggest training organisations abroad. Some conscripts may also be offered
for cyber defence. the option to register for NATO or civilian cyber
defence courses.
Training in theory for cyber conscripts is
constrained by the limited time available and
much is on-the-job training. It is therefore 5. Benefits, Risks and
important that selected conscripts already Challenges
possess cybersecurity skills. The Finnish
Defence Forces cooperate more frequently The interviews suggested that cyber
with private companies than with universities conscription offers benefits as well as risks and
in order to learn from their experience and the challenges that need to be mitigated.
same applies for learning from the experience
of individual reservists. 5.1. Benefits
In Sweden, conscripts who pass the theoretical Cyber conscription provides many
block offered by KTH will receive about 30 opportunities:
credit points, which is a good reason for • recruiting skilled people to the armed forces
serving as a cyber conscript. The Swedish • providing armed forces with up-to-date
Armed Forces seek to launch partnerships both innovative knowledge from civil society
with academia (e.g. with KTH) and with the • providing young people with work
private sector aimed at maintaining its skills experience that can be useful in their careers
and competences on cybersecurity and cyber • raising awareness of cyber issues in wider
defence. As in Finland, the Armed Forces are society.
not allowed to promote themselves at
Swedish secondary schools.
One of the more obvious benefits of cyber
The Swiss Armed Forces also do not conscription is that it brings to the armed
cooperate with secondary schools
on this subject for legal reasons. forces qualified citizens with up-to-date
They do, however, cooperate with knowledge on IT and cybersecurity who
several universities in Switzerland.
The completion of the military
would otherwise probably not have served
cyber defence course for conscripts in the military
is credited by the European Credit
Transfer and Accumulation System
(ECTS) towards Bachelor’s degrees at several One of the more obvious benefits of cyber
universities and schools of applied sciences. conscription is that it brings to the armed
Academics and university employees forces qualified citizens with up-to-date
(professors, Ph.D students) are also invited to knowledge on IT and cybersecurity who
lecture on the cyber defence course. would otherwise probably not have served
in the military. While most conscripts leave
The Swiss Armed Forces reserve system the military after the training period, some
provides good opportunities to be successful are offered full-time service. A report of April
in the cyber domain since it exploits the 2020 concluded that the primary benefit of
knowledge and skills of citizens. Participants cyber conscripts and reservists resides in the
in the cyber defence course are also able to fact that they help the armed forces to conduct
complete an internship outside the Armed relevant tasks and thus close the workforce gap
Forces during their training. The Swiss Armed in the field of cybersecurity. All armed forces
Forces cooperate with civilian authorities have difficulty hiring permanent personnel,
(e.g. the police) and operators of critical but reserve positions seem to be valued more
infrastructure (e.g. telecommunications and
Cyber Conscription 9highly and filled more easily.20 As stated in a will graduate as a Cyber Security Specialist
report recently submitted to the Norwegian with a Swiss Federal Specialist Certificate. Due
Ministry of Defence, conscription and CMS to the increasing shortage of ICT and cyber
offer the armed forces opportunities that the experts in the economy, these specialists are
private sector can only dream of.21 According very attractive for Swiss companies.
to one interviewee who contributed to the
ICDS report, the salary levels of the Finnish The approach of Swedish authorities – that the
Defence Forces mainly attract two categories armed forces train cyber conscripts primarily to
of people: young university graduates and meet their own requirements but also to meet
more experienced people in their 50s who the needs of other organisations involved in
value interesting tasks more than money. national defence as well as law enforcement,
rescue organisations and the defence industry
One clear benefit for both the armed forces – merits consideration by decision-makers in
and conscripts is the potential for future full- other nations. To what extent should the annual
time service. number of trained cyber conscripts depend on
the requirements of the military, and how far
To the individual, cyber conscription offers the can the government afford to increase supply
possibility to increase cybersecurity- and cyber beyond the needs of the military and other
defence-related skills through training and organisations vital for defence and security
practice. Another clear benefit for youngsters in order to create a positive spillover effect
is receiving ECTS points or other certificates of that will benefit society at large, including the
training after completing service. Interviewees private sector? This is a relevant question not
put forward different aspects. In Sweden, the least because critical national infrastructure
30 credit points that conscripts receive after essential for the functioning of a society and
completing their CMS are a good motivator. an economy is often owned and operated by
Finns receive a certificate that proves they private companies.
have been cyber conscripts, which is
beneficial in their future studies or
work careers.
One risk is the possibility that the cyber
training that will be offered by the military
In addition, the word “cyber” attracts
young people, which is why it is more
differs from the youngsters’ expectations,
effective to talk about “cyber soldiers” especially operational tasks. This risk implies
than “IT soldiers”. The armed forces that it is important to manage expectations
exploit this phenomenon and highlight
the benefits of cyber conscription for and that the information provided before
future career opportunities as cyber- call-up is precise and thus leaves less room
defence specialists or for academic
studies. for disappointment
The Swiss Armed Forces draw on the
knowledge of the country’s citizens. Due to 5.2. Risks and Challenges
the reserve system, members of the army
can incorporate the skills they acquire in their While cyber conscription offers obvious
civilian profession into the armed forces. benefits both to the armed forces and to
From the conscript’s point of view, this offers conscripts, there are also risks and challenges.
the opportunity to prepare for a civilian Conscripts are young people and their social
cybersecurity exam during military service. maturity might not be adequate to carry
After passing a three-day exam, the conscript the responsibility of a cyber conscript.22
During their service they may have access to
sensitive or classified information, or to critical
20
Marie Baezner, “Study on the use of reserve forces in military
cybersecurity: A comparative study of selected countries,” information systems. The most obvious risks
Center for Security Studies (CSS), ETH Zürich, 35, https://doi.
org/10.3929/ethz-b-000413590.
21
Svendsen et al., Økt evne til å kombinere menneske og 22
Sõmer et al., “Developing Military Cyber Workforce in a
teknologi, 87. Conscript Armed Forces.”
Cyber Conscription 10are information leaks or the use of tools and Conclusions and
skills for unlawful purposes after conscription,
to a certain degree comparable with the Recommendations
potential misuse of knowledge of how to
handle weapons. This report has examined cyber conscription
in six countries to identify best practices
Another risk is that it may become difficult and has focused on the selection, training
in future to recruit cyber conscripts if they and employment of cyber conscripts and
are not motivated to undergo basic military reservists. Based on the interviews, documents
training. This risk is obviously more relevant and articles, it is possible to draw a number of
in those countries where cyber conscripts are conclusions.
recruited among youngsters who have the
option not to serve at all. Today most cyber 1. The purpose of cyber conscription
conscripts volunteer for their cyber service. varies between the countries analysed
This risk is less likely to materialise in Finland, and depends on the overall purpose of
for example, where cyber conscripts are conscription. In some countries, cyber
selected from among those who already have conscription is not only intended to
started their CMS. increase the cyber capabilities of the
armed forces but also to support other
One risk that has been highlighted is the organisations involved in national defence.
possibility that the cyber training that
will be offered by the military differs from 2. There is no generally agreed definition of
the youngsters’ expectations, especially the term “cyber conscription”. It may include
operational tasks and perhaps even hacking. cybersecurity and cyber defence more
This risk implies that it is important to manage narrowly but also IT support, programming
expectations and that the information provided and development, as well as more traditional
before call-up is precise and thus leaves less branches such as communications/signals,
room for disappointment. intelligence and strategic communications
Another challenge is how to avoid the potential (stratcom).
perception that conscripts (or reservists) are
used as “free labour”, especially in cases where 3. Among the countries surveyed, the
the employment of cyber conscripts exceeds number of volunteers applying for cyber
the amount of training they receive. This can conscription today exceeds the military’s
be mitigated as long as the armed forces are requirements, so there is no immediate
able to offer a win-win deal for both parties need to increase the attractiveness of
by ensuring that every person (conscript or cyber conscription.
reservist) will gain knowledge. A second risk
is related to enlarging the pool of reservists: 4. All six countries have medical and physical
the smart use of the increasing number of requirements that all conscripts must
reservists. fulfil. In general, these apply also for
cyber conscripts, with a small number of
There are opportunities to be exploited by exceptions.
widening the scope of recruitment of conscripts
beyond those who fulfil all medical and other 5. Cyber conscripts in the studied countries
requirements. This may not seem urgent today are selected first and foremost based on
since there is no lack of volunteers, but the personal will and motivation, education
situation may change in the future. and experience. Most cyber conscripts
Several countries have declared their intention have IT-related educational or professional
to increase the number of cyber conscripts backgrounds. Few have been called up
taken on each year. Consequently, a big risk directly from high school without any IT-
is a lowering of quality standards due to the related education.
increase in quantity.
6. In most countries the conscripts are also
subject to a specific ICT test.
Cyber Conscription 117. The interviews confirmed that cyber full-time military and civilian personnel may
conscripts receive basic military training prefer to spend less resources on training them.
that mostly follows a uniform pattern Those that wish to educate citizens beyond the
common to all conscripts. Only after peacetime requirements of the armed forces
completing the basic military training are to fulfil the needs of a reserve organisation or
the cyber conscripts subjected to more other actors in the public and private sector
specific training, including on cyberspace that are vital for national defence may deem
operations. that training conscripts is the right way forward.
8. The length of cyber-specific training We recommend that military authorities
varies between the countries. In
some, cyber conscripts undergo
improve their communication to better
a bespoke curriculum that is manage the expectations of conscripts;
implemented in cooperation
with universities and/or external
ensure that cyber conscription is a
individual lecturers, while in others win-win deal; develop cognitive tests and;
the amount of cyber-specific consider partnering with academia and
training is more modest.
the private sector
9. Several of the studied countries’
armed forces have either developed or are The following recommendations may be useful
planning to launch partnerships with the for countries that train or consider starting
private sector. training conscripts for cyber defence. Based on
the best practice identified in this report, we
10. Some armed forces provide their cyber recommend that military authorities:
conscripts with training that gives them
a specialist certificate or academic credit • Improve their communication in order
points. to better manage the expectations of
conscripts because of the potential for
11. The interviews indicated that a dedicated misunderstandings related to the very
reserve organisation that could draw different aspects linked to the term
upon citizens who have completed cyber “cyber conscription”. Although there
conscription is still not fully developed in is no immediate need to increase the
some of the studied nations that have this attractiveness of cyber conscription as
ambition. there are enough volunteers, armed forces
should consider devoting more effort to
12. Several countries plan to increase the explaining the content of cyber conscription
number of cyber conscripts who will be and communicate this effectively to
called up each year. In addition, the armed youngsters in order to manage their
forces are still considering how to design expectations and avoid misunderstanding.
cyber conscription in order to maximise
the value it adds. • Ensure that cyber conscription is a win-
win deal from which both the armed
The use of conscripts for relatively complicated forces and the individual conscripts clearly
cybersecurity- and cyber defence-related tasks benefit. While there is no shortage of
requires extensive training. Some armed forces volunteers to join cyber conscription today,
provide training with in-house resources, while the armed forces should strive to retain
others involve universities and the private its current positive image by providing a
sector. Decisions on whether a lot of resources challenging and interesting environment in
should be invested in providing conscripts with which young people gain knowledge and
high-level education depend on the purpose develop their skillsets. In the case of cyber
of conscription, as described in Section 2, and conscription, a lot of information travels
the differing purposes of cyber conscription. by word of mouth and a single negative
Countries that mainly call up cyber conscripts experience could ruin years of hard
in order to create a pool from which to recruit work. This would mitigate the potential
Cyber Conscription 12perception that conscripts and reservists conscripts will increase in the future. This
are exploited as “free labour”. can be mitigated by developing specific
cognitive tests to measure mindset,
• Develop cognitive tests that are suited to skillset, stress management, leadership
larger numbers of future cyber conscripts. skills and personal qualities. The flexible
All six countries studied currently use and individual approach towards recruiting
selection procedures to identify people used by most countries today should be
with suitable mindsets and skillsets for retained to the extent possible.
cyber conscription. While the selection
procedures work well and often are • Consider partnering with academia and
individually tailored, they appear to be the private sector to exploit the potential
rather resource-heavy bearing in mind that for effective specialised training as well as
all countries assume the number of cyber more efficient use of resources.
Cyber Conscription 13Annex A. young male citizens undergo CMS each year.27
Depending on the training, military service
Conscription in lasts 165, 255 or 347 days. Conscripts trained
gener al for rank-and-file duties serve for 165 days (five
and a half months), while those trained for
Cyber conscription should be seen in a broader rank-and-file duties requiring special skills and
context of conscription as a means to recruit those completing unarmed service serve for
personnel to the armed forces of the studied 255 days (eight and a half months). Conscripts
countries. trained to be officers or non-commissioned
officers, or for the most demanding special
In Denmark, conscription comprises a relatively duties in the rank-and-file, serve for 347 days
insignificant number of young males. Overall, (11.5 months).28 CMS is regarded very highly
the length of training depends on the unit and and youngsters who have neither received
the position and varies between four and 12 military training nor undergone the alternative
months.23 Until recently, Denmark’s basic, civilian training are often considered less
four-month training period was intended attractive on the labour market.
above all to encourage conscripts to join as
professionals. The latest Defence Agreement, In Norway, citizens have the obligation to serve a
covering the period 2018 to 2023, increases total of 575 days (19 months), divided between
the number of conscripts trained each year by military training (“Førstegangstjeneste” in
500 (from 4,200 to 4,700) and extends training Norwegian, meaning “first-time service”) with
for some of them from the current four months a duration of 12 or 16 months and participation
to eight.24 in refresher exercises and service in the
Norwegian Home Guard. Since 2015, both men
In Estonia, a significant part of the EDF consists and women must undergo CMS; the annual
of a reserve component that is maintained by number of citizens to be trained is 8,000.29 The
an annual intake of conscripts who are trained aim is to select the most suitable and the most
and later assigned to a reserve unit. CMS lasts motivated for CMS.
eight or 11 months, depending on the
assignment and the amount of training In Norway, citizens have the obligation
it requires. Some 3,200 conscripts are
trained annually; this number will to serve a total of 575 days (19 months),
increase to 4,000 by 2026. 25
divided between military training with
In Finland, general conscription and a duration of 12 or 16 months and
training the entire able-bodied annual participation in refresher exercises and
intake of men produce the Defence
Forces’ wartime organisation in a cost-
service in the Norwegian Home Guard
effective manner.26 More than 20,000
Due to the deteriorating security environment
combined with difficulties in staffing the
Swedish Armed Forces as an all-volunteer
organisation, the Swedish government decided
23
“Efter Forsvarets Dag” [After Defence Day], Forsvaret (Danish
Defence), last accessed 10 November 2020, https://karriere. in March 2017 to reactivate conscription, this
forsvaret.dk/varnepligt/forsvaretsdag/efter/.
24
Piotr Szymański, “Overstretched? Denmark’s security policy
and armed forces in light of the new Defence Agreement,” 27
Anti Rinne, Hallituksen esitys eduskunnalle valtion
OSW Commentary no. 266, 20 April 2018, http://aei.pitt. talousarvioksi vuodelle 2020 [Government Proposal to
edu/93810/1/commentary_266.pdf. Parliament for State Budget of 2020] (Helsinki: Edita
25
Kaitseministeerium (Ministry of Defence) (Estonia), Aruanne Prima Oy, 2019), 260, https://www.eduskunta.fi/FI/vaski/
kaitseväekohustuse täitmisest ja kaitseväeteenistuse HallituksenEsitys/Documents/HE_29+2019.pdf.
korraldamisest 2019. aastal [Report on the Fulfilment of 28
“Conscription - a Finnish choice,” Conscription, Finnish
Military Service and on the Organisation of Conscription Defence Forces, last accessed 20 October 2020, https://
in 2019] (Tallinn: Kaitseministeerium, 2020), https://www. puolustusvoimat.fi/en/finnish-conscription-system.
kra.ee/static/aruanne_kaitsevaekohustuse_taitmisest_ 29
“Verneplikt”[Conscription], Forsvaret (Norwegian
riigis_2019.pdf; Ministry of Defence (Estonia), “Estonian Armed Forces), last accessed 3 November 2020, https://
Military Defence 2026.” forsvaret.no/forstegangstjeneste/verneplikt; Store Norske
26
Prime Minister’s Office (Finland), Government’s Defence Leksikon (Great Norwegian Encyclopaedia), “Verneplikt”
Report. [Conscription], https://snl.no/verneplikt.
Cyber Conscription A–1You can also read
