Tiia Sõmer: Cyber conscription – thinking outside the box?

Tiia Sõmer 
Ph.D., Junior Research Fellow
Centre for Digital Forensics and Cyber Security, Tallinn University of Technology
Estonia

The two topics in the title – cyber (defence) and conscription – have gained a lot of prominence recently, mainly due to two things. First, cyberspace has been declared as being a separate domain of warfare (similar to land, sea and air) and many things happen in cyberspace, both good and bad. Secondly, due to the security situation in the world today, many countries have decided to re-introduce conscription for defence. And many countries which use conscription, have started to train their conscripts for management, development and defence of their IT systems.

Information technology – and cyber security – are integrated into all fields of our lives, from interaction of people and machines to offer of public and vital services. Defence forces are not an exception, but in themselves are an attractive target of cyber attacks. Cyber operations, especially intelligence, defensive and offensive operations, are capabilities which are being developed by most countries. Defence sector, as the ICT sector in general, are looking for innovative solutions to challenges facing it. One of the biggest challenges identified by many organisations and in studies, is that of manpower shortage in cyber security sector. Cyber conscription can be seen as innovation in defence: the country is not defended by traditional weapons only, but also behind computers.

Cyber conscription does not have a common understanding internationally, and neither do cyber war or cyber defence. Cyber conscription can be purely IT-technical, related to strategic communications, or intelligence operations. The topic can be viewed even more widely – where in addition to IT technical cyber security, the knowledge of conscripts is used in fields related to drones, robots, forensics, but also information warfare. 

Our understanding today is that background in IT means technical knowledge. In our study on cyber conscription, most countries view service in cyber conscription mainly as a technical ICT service. At the same time, there are many fields where technical knowledge is not primary: analysts, social media specialists, strategic communications, some areas of information warfare, etc. There are many youngsters, who want to do something useful – for defence, society in general, or the whole world – but who are not interested in programming as a means, but as a tool to achieve a goal. Perhaps we should start thinking outside the box and offer an opportunity for cyber conscription even for those without IT technical background? For example, in business, the task of “translator” is becoming more important: how to translate business or organisational goals to technological possibilities, options and risks. As any CEO, the defence forces commander does not need to understand IT or cyber security in detail, but needs to have specialists who can explain in layman terms, what can be achieved using information technology or what are the threats. In case cyber conscription can produce such people – who speak “two languages” – it can be useful for our societies as a whole.

Anyone with specific skills can potentially become a cyber conscript. Of course, simply being able to use a computer or device and modern office software is not enough. The service time of a cyber conscript is relatively short – up to 11 months. This time will include soldier basic training, specialised training and then performing their speciality related tasks. 

Research shows that young people want to experience exciting activities and challenges during conscription. Cyber security is definitely a field, that seems mysterious, and can certainly offer challenges, exciting opportunities, as well as provide skills and knowledge for people’s future lives. 

We conducted a study of cyber conscription used by 6 countries: Estonia, Norway, Sweden, Finland, Denmark and Switzerland . The countries studied are different in their size, geographical location and population. The aim of conscription in countries with relatively small population – Estonia, Finland and Switzerland – is to prepare soldiers for reserves; in Denmark the aim of conscription is to attract motivated citizens to join defence forces as active duty soldiers. Norway and Sweden use a combination of the two models. Naturally, the aim of conscription influences cyber conscription. The aim of cyber conscription in Denmark is to recruit people, Norway considers that very important as well. Estonia, Finland and Switzerland use cyber conscription to conduct cyber defence tasks and train people for reserves. In Sweden, the aim is to train people so that they would be able to work not only in defence, but also in other public service institutions and (defence) industry. 

Having passed cyber conscription could be seen as a sign of quality, where young people have gained useful cutting-edge practical experience in addition to formal training and education. It can be valuable source of qualified personnel not only for defence sector, but also to other public or private sector organisations. Life-long career in just one institution is not attractive to young people today. They want to see exciting new challenges that influence the world and bring value somewhere. Cyber security is a field which is constantly changing, where there are many challenges and where real value can be brought to societies. There are many groups of people in the society, the inclusion of whom to defence and ICT sectors would be beneficial to themselves and societies: women, people with slight disabilities, people with immigrant background, etc. ICT sector, including cyber security, is a very male-dominated field. During World War II, women were very actively involved in cryptography for example – how can we attract more women there today? Conscription means that the youngsters joining service should be very fit and in perfect health – but why can’t we recruit those a little less fit and with a little less perfect health? Perhaps we can integrate non-citizens to our societies better by training them for defence? It is also a well-known fact, that former Israeli cyber conscripts are very active cyber security startup founders. Can we do it in other parts of the world?