A tale of two Allied Defence Departments: New assurance initiatives for managing increasing system complexity, interconnectedness, and vulnerability

Over the last three decades, defence communication and information systems have been increasing the interconnectedness of systems that has pervaded society more broadly throughout the Information Age. Even more than society in the broad, Western Departments of Defence (DoDs) have sought to attain information dominance. The result has been a large number of complex systems, system-of-systems and families-of-system-of-systems. In seeking to assure such interconnected systems, defence forces initially focused on specifying the high-level functions that this interconnectivity enabled: first command and control (C2, circa 1970s), then adding communications and computers (C4, circa 1980s) and finally adding intelligence, surveillance and reconnaissance (C4ISR, circa 1990s); all while defining connections through interoperability protocols. The ability of highly interconnected systems to enable higher-order human thinking has arguably gone beyond functions and even the informational, leading to synthetic systems. Furthermore, evolving cyber threats are now seeking to exploit the vulnerabilities of the broad informational attack surfaces of these complex interconnected DoD systems. This paper systematically examines the key assurance initiatives pursued systematically by the US DoD to effect these more integrated, interoperable and information-assured (I3) capabilities, while also ensuring these capabilities remain resilient to the new cyber threats. Such approaches include major interconnected test networks that enable live, virtual and constructive distributed simulations between current operational systems and new systems, as well as many dedicated experimental exercises that straddle the divide between individual system development and operational exercises, helping keep project requirements up-to-date and providing valuable annual cost-effective opportunities to experiment, test, evaluate, and iterate upon their proper integration into the necessary DoD systems-of-systems and families-of-systems. These advanced assurance approaches are compared to the Australian DoD’s strategies and appropriate recommendations are made in each area comparing how Australia could substantially recover I3 assurance with the US and other allied forces. The contrast between the two allies makes this a useful reflection for DoDs in other countries, and more generally to society’s assurance strategies when dealing with similar technological and societal inter-connectedness of systems and the inherent cyber vulnerabilities that this creates