Lawmakers force NSA and Cyber Command to weigh divorce

Capitol Hill debate about maintaining the National Security Agency and U.S. Cyber Command's shared leadership structure is about to become an annual occurrence — adding momentum to a steady push to break up the agencies' long-questioned relationship.

Driving the news: The recently Senate-passed annual defense policy bill — the National Defense Authorization Act — would require the defense secretary to give Congress an annual briefing, from next year through 2028, about the NSA and Cyber Command's relationship.

Why it matters: Annual briefings often set the stage for lawmakers to make major legislative moves down the line.

• The new reviews would also set a foundation for Congress and the Pentagon to study the relationship more regularly, further preparing the agencies for a possible split.

The big picture: The two Defense Department agencies are run by the same person, but in recent years, Washington has become more interested in possibly giving each agency its own leader.

• Since 2016, the two agencies have been disentangling their most critical operations, as required by Congress, in preparation for a possible split.
• The "dual-hat" structure nearly faced its end during the Obama administration and twice during the Trump administration.
• A group commissioned by the Biden administration recently wrapped up a review of the dynamic — but didn't reach a conclusive decision, per The Record.

State of play: When Cyber Command was stood up in 2010, it pulled heavily from the NSA for staff, since the intelligence agency was one of the first to explore offensive cyber missions.

• But the two offices think about cyber differently: The NSA focuses on intelligence gathering and surveillance, while Cyber Command pursues offensive and defensive military cyber operations.

Between the lines: Proponents of the dual-hat structure argue that Cyber Command and the NSA still rely heavily on the same intelligence skill sets and talent to conduct their operations. Having one leader at the top to balance how collected intelligence informs missions is essential, supporters argue.

• But opponents of the shared leadership structure worry that the two agencies use intelligence in completely different — and often compromising — ways. The NSA likes to remain in the shadows on the networks it accesses, while Cyber Command leans toward disruptive missions.

Yes, but: Cyber Command still lacks the resources it needs to operate on its own, former officials tell Axios.

• "The ability to effectively accomplish both missions continues to benefit from a single commander/director," said retired Lt. Gen. Charles Moore, who recently stepped down as deputy commander of Cyber Command, in a statement to Axios.

The intrigue: At the center of Washington's ongoing debate is the question of what the future of Cyber Command, and cyber warfare in general, should look like, one of the command's founding members, Josh Lospinoso, tells Axios.

• Lospinoso argues that Cyber Command could stand up on its own faster if it focused missions on disrupting "relatively poorly defended cyber physical systems," rather than replicating or leaning heavily on the NSA's IT knowledge.

The bottom line: No one expects the Biden administration to overhaul the leadership structure anytime soon — if at all. But the annual reviews would give lawmakers and the Pentagon more insight into how sustainable the dual-hat arrangement actually is.

• "It's a little bit like a marriage," says Jonathan Reiber, a former DoD official during the Obama administration. "You look at it from the outside, and it looks one way and it sounds one way, but unless you live in it, you actually don't know whether or not to split up or not."

Sign up for Axios’ cybersecurity newsletter Codebook here.