DQUTZSZ NOV 15

FROM: USCYBERCOM

WW

JUN 272015

FOIA review completed on E?ll?l .

Portions Ul-ll?llS document no longer meets
the classi?cation standards established by
Executive Order 13526, Classified National

T0: 241:?: Security Information, Section 1.4. As suclLI
SSOARCYBER am downgrading specific portion-marked I
COMTEN FLT paragraphs as Partial
MARFORCYBERCOM classi?cation downgrade executive by:
USCYBERCOM CNMF ROSS A. 

NAVY Rear Admiral, US Nav}r

ARMY (Iliiefof Stall?

CDRINSCOM

NSACSS

FBI

ASD

GCHQ

IN F0: JOINT STAFF
sso 

sso COGARD

sso AFRICOM
NCR CENTCOM
HO. USEUCDM
sso NORTHCOM
550 so ussocom
550 SOUTHCOM
550 STRATCOM
cso TRANSCOM
AFRICDM mo
CENTCOM ISR
USNORTHCOM
Ho USPACOM
ussourHcom
sso STRATCOM
sso DIA
USCYBERCOM

PASS TO: CDR JTF-ARES FT GEORGE MEADE MD
AIR FORCE LACKLAND AFB TX

Wr

SUBJECT: (UHFBHE) USCYBERCOM OPORD 16-0188 OPERATION GLOWING 



15-0133 OPERATION GLOWING 
TO USA, FVEWFISAW

OPERATION INHERENT RESOLVE - PHASE II 
(W . 1

 

 

 



 

 



MEMORANDUM OF AGREEMENT AMONG THE
DOD, DOJ AND INTELLIGENCE COMMUNITY REGARDING COMPUTER NETWORK ATTACK (CNA) AND
COMPUTER NETWORK EXPLOITATION 

 

REFIDIFRAGOI WEI-WI (qu0 Sec 

I Sec 1.4m} 

O1Sec1.4a

USCYBERCOM OPORD 15-055 IN SUPPORT OF OPERATION RESOLVE
TO USA, MAR 

OF DEFENSE INSTRUCTION 03500.03, TECHNICAL ASSURANCE
STANDARD FOR COMPUTER NETWORK ICNAI CAPABILITIES (UHFOUOHUSDIIZZ APR


JTF-ARES OPOR01 TO USA, FRA, 

 

 

 

 

 

APPROVAL DFI (mm Sec 1.4m
TO USA, 
OP GLOWING mm Sec 1.4m

 



AGREED OGS NOTIFICATION TO USA, AUS,


OGS IS-JS DDRO AUTH (SAINFITIS IS 
OPERATION INHERENT RESOLVE - PHASE II MOD 001 

REFIMIFRAGOHU) FRAGORD 04 TO OPORD SUPPORT TO USCENTCOM OIR PHASE II


OGS EXECUTIVE UPDATE TO USA,




 

 

. FRAGDRD 05 TO BOOB-17 


DUE TO FISA REQUIREMENTS, REF AND ARE LOCATED AT THE FOLLOWING WEBSITE:

PHonv.asgx}.?

 

 

 

 

 

 

 

 

 

 

 


NARRHW Operation GLOWING isl (?(115961 4m
i 

I Iin support of (I50)
operations to dismantle and ultimately defeat the (bii1) 53? 14(3) 


1.A. GENERAL SITUATIDNI (bin) Sec 1.4{a}

1.A.1. To USA, FVEWFISAH (mm Sec 1.4{a}

 

 



 

1.13. AREA OF OPERATIONS. The area of operations includes! (hm) Sec 1.4{a} I



 

 

 

 

1.c. ENEMY.

1.C.1. primary cyberspace initiative uses the Internet as a conduit to target
global audiences to recruit and radicalize. Specifically, creates media to provide legitimacy to their
self-proclaimed caliphate and to recruit sympathizers to convert to their ideology and join their cause.

 

 

 

messages are primarily meant to appeal to[ however, ISIL tailors their
messages to attract others globally. In addition to its lnternet messaging, ISIL provides media to the local
populace inl (hm) Sec 1.4(3) I 

 

ICI I
. .

 

 

1.C.2. (U) ISIL also uses media to threaten and intimidate. For example, gruesome videos are
meant to intimidate and strike fear into their adversaries and local populace to reduce their will to fight
and ensure local populations remain compliant with ISIL rule. ISIL messages that threaten foreign
governments are meant to deter foreign military intervention or demand ransom for foreign hostages.

1.C.3. high quality propaganda has effectively enabled personnel
recruitment from susceptible local and foreign Muslim populations. In addition to the recruitment of
personnel for combat, ISIL activelyi (b)1{1)Sec 1.4(a) 

. is struggling to attract a sufficient number of recruits with tm-eitpertise
needed to provide governing and social services; however, those current struggles are not likely to deter
ISIL from maintaining these aspirations.

 

 

1.C.4. WISE haslom) Sec 1.4(almeclia establishments responsible for the group?s
strategic media and propaganda productionL I
[bx-Tame outlets serve as the group's primary arms for communicating leadership and religious

guidance, as well as highlighting activities across ISIL-controlled territory. Although these establishments
I {b)[1)Seo 1.4(a)  create
specific products. In order to make the highest quality media products, central media developers
have access to multiple media sources. This includes raw and finished media files developed by the

I l'nedia establishments, access to the Internet to download media files, and the
ability to record and create their own organic media files.

 

 

 

 

 

1.C.5. (15W ISIL employs cadres of personnel with varying levels of expertise and
responsibility to acquire, develop, administer, and maintain information networks utilizing both private

and public Internet infrastructure. These individuals are responsible for the management of data
communications projects, such as the creation and establishment of websites and mobile applications in
support of ISIL media, as well as the creation and management of network projects designed to

 



 

 

 

 

1.c.s. (W . . 



 

 

 

 

 

 

 

1 {mm Sec 14(3)  upport to ISIL media organizations and
supports ability to distribute propaganda and facilitatel 1.4{al I
To USA, FVEWFISAII (bli1)Sec1-4iai 

 

 



 

 

 

 

 



 

 

1.C.3. 

 



 

 

 

 

 

 

 

(bli1)Sec 1.4m] self-declared Caliphate, external provinces, and
globally diSpersed supportersl hupport to ISIL media organizations and
supports lSlL?s abiliti,f to distribute propaganda and facilitate} I

 

 

[b)(1)Sec1l4(a}

 

 

 

1.C.9. - - i

 



 

 

privileges to establish, maintain, and troubleshoot software and deal with terms of service noti?cations

 

 



 

 

 

1.C.1?l TO USA, FVEWFISAH 

 

 

Sec 1.4(a}

 

 

 

 

1.C.11. TO USA, FVEWFISAH 

 

 



 

 

1.0. FRIENDLY.

WSW

1.D.1. USCYBERCDM directs assigned andfor coordinates with supporting forces .
IDT support the dismantlement of ISIL in accordance with Ref A. USCYBERCDM forces are staffed,
trained, and equipped to collect, report intelligence, information, and, when authorized and directed,

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

posture to and conduct cyberspace operations againstI {bill} Sec 1.4(a} I

I [mm Sec 1.4m) Ivalid military targets approved by Commander, United States
Cyber Command IAW Ref BI I I 

I {bJI1ISec1.4(e) IJoint Task Force ARES

1.o.2. Sec 1.4a) 

{oil-ammonjunction with Federal Bureau of Investigation National Security Agency

and Coalition partner effortsl . (but) Sec 1.4(a) land

I lbil1lSachal Iapplications that

I 1.4(a) I 
Organizations. These accounts and infrastructure wereI 

(him Sec 1.4(ai Imaintain the initiative
and continue the conductI I I

 

1.0.3. The intended cyber effects in this operational order are part

 

 

 

 

 

 

 

 

 

 

 

 

 

of a larger initiativeI Iof more
favorableI IThis operation is supporting USCENTCOM and
CJTF-DIR operations.I (hm) Sec 1.4(a) I
[bil1?i Sec 1.4m I
of U.5. and worldwideI I
I Sec 1.4(aI Icoordinated actions against the U.S. 
and worldwide accounts and infrastructure will generateI I
I {hm} Sec 1.4(a) _IUnited States Central Command

 

and United States Special Operations Command efforts in Iraq and Syria.

1.0.4. JTF-ARES will implement the method described in and

coordinate with appropriate interagency (IA) and coalition partners (am) See 14(3) of OGS.

1.D.5. JTF-ARES, in association with USCYBERCOM, will coordinate with U.S.
government and coalition partners,l (him Sec 1.4m 

 

 

{mm Sec 1.4(aI

 

 

 

1.D.5. Within this OPORD, all references of ?Operators" and will refer to
personnel on teams operationally-controlled by unless otherwise spetified.

 

1.D.7. Within this OPORD and per Ref Sec 1.4(a) I
approved USCYBERCOMI 1.4a) 

I - 
I [tam Sec 1.4(a) I

 

 ]while allowing USCYBERCOM operators t?
at will. Account} (hm) Sac 1.4(a) lor other user

 

accounts.

1.5. (U) CONSTRAINTS.

 

1.E.1. ml (amass Lea: I

under the control of ISIL.

 

1.E.2. The intended effects under this order will} 

IAW the definition in Ref 3.

1.E.3. There will bel (mm Sec 1.4m}  Within the United States.

 

 

1.E.4. Actions in this operation will occur within I

 

 



 

 

 

 

laccountsare notauthorized.

1.F. RESTRAINTS.

1.F.1. .
U.S. or its territories.

 

 

 

 

 

1.F.2. Wawons under this may only be takenl IIAW
RefJ.
1.F.3.I 

 

 



 

 

 

 

 

 

 

1.F.4. Upon approvaIJ (mo) Sec 14(3)
i
1.F.5. Wax} USCYBERCOM I

 

 


i (am) 59.31.4451) lresolve ICW the Department of State}!

 

GENTEXTIMISSIDNIZ. MISSION. On or about kD-Day,? 
Commander, Joint Task Force conducts 

 



 

 

 

GENTEXTKEXECUTIDNXB.

3A. (U) COM MAN INTENT.

 

3.A.1. W. ISD operationsl [him Sec lto dismantle
and ultimately defeat ISIL, USCYBERCOM conductsl {bii1i Sgp_1.4iai I

 

(him See 1.4m;

 

 

 

 

METHOD. JTF-AHES actions Will {bll1lSEC1-4la) 
I (aim Seo 1.4(a) 
I 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(biti) Sec 1.4(a) IJTF-ARES will utilizel (bli?ll Sec 14(3) 

I

I (am) Sec 1.4{3} IJTF-

ARES wiill {aim Sec 1.4m 

1.4(a) personnel will use 1 
ibii1lSec1.4(ai will execute for a

duration not toL (mi1iSec1.4(a: 

 

(blii) Sec. 1.4(3)

 

 

 

3.43;. ENDSTATE. freedom of movement in cyberspace to distribute and

 

 

(him See 1.4(a)

 

 

3.3.0.1} OBJECTIVESAND EFFECTS.

 

3.3.1. JTF-ARES lthe internet.

 

33.1%. EFFECT 1A.l lnetwork services and applications is
I

 

 

 

 

 

3.3.1.A.1. MEASURE OF PERFORMANCE (MOP) 1. Assigned forces execute (bi{1}Seo 
Sec 

WW MOP 2 accounts! ibii1i3ec1.4iai
initiation.

 

JTF-ARES OBJECTIVE 3.l inii1i5ec1.4iai lmedia.

 

 I: I: ?l 

 

3.3.2.31. WW) EFFECT 2A.l _lmedia 
3.3.2.331. MOP b-aizcounts.

3.3.2.A.1.A. Wang?s} MEASURE OF EFFECTIVENESS (MOE) 1. Observed 
?accounts. .

3.32.3.2. Mom-(mains.

3.8.2.A.2.A. MOE 2. Obsewedl 
names available for use in support of media.

i

1? {31(1) Sec 1.433) I

 

 

 



 

MOE 3. Observed I NPS.

 

 

3.3.23.3.3. {mm Sec: 1.43:) 
elsewhere.

 

3.3.2.3. Magma-33W EFFECT 23.  lmedia products?

3.3.2.3.1. MOP Isa?{counts

 

3.3.2.3123. Were?35mm MOE 1. Observedl Iemail.
3.3.2.3.2. Mona-domains.

 

3.B.Z.B.2.A. MOE 2. Observedl 
_names available for use I50 of media dissemination.


?elsewhere. . -

3.32.3.1W Mom-355?s.
3.3.2.5.3.A. MEL-11W MOE 3. Observed] 

 

 

 

 

3.3.2.333. webpagesl 
_elsewhere.

 

 

3.3.3. {wage?19W JTF-ARES OBJECTIVE 4.I Sec 1.4m hocial media.

 

3.3.3.3.. medial 

3.3.33.1. MOP ?ts-accounts.

 

3.B.S.A.1.A. MOE 1. Observedl accounts.

 

3.3.33.2. MORE-domains.
3.B.S.A.2.A. MOE 2. Observed {tom Sec 1.4.1.3) - eclia applications.

momentum lmediaapplications.

 

3.B.B.A.3. WW 

 

3.3.3.A.3.A. Mauro?W MOE 3. Observedl 

 

applications] [mm 3331.4{33 
elsewhere.

3.C. (U) CONCEPT OF OPERATIONS.

 

3.C.1. OVERVIEW. This is al 

 

 



 

 

 

(hm) Sec 1.4(a)  functions
planned to be utilized. -

3.C.1.A. DATA COLLECTION. Information and data collected during this operation

 

(mm Sec 1.4{a}

 

 

 

lpolicies and

 

 

 

 

 

procedures.
3.C.1.B. WEI-tat} Upon thel 
lb)(1} Sec Lil-la}
I [This Operation will be conducted in six stages.  (billi 33? Hi3! 

 

In

 

 I i:i A m: i

 

{bl(1l Sec 1.4(3)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

3.c.2. STAGE ll operators wiliEm} Sec WEB
{bll1lSeo 1.4(ai
(trim Sec 1.4{3} IThe
operators will I 14(3) I
I (bin) Sec 1.4{al I
operators will utilize-L ibii1} Sec I

I (om) Seo Lilia} 
accounts.
3.c.s; pzs?swesirusATsusiL} STAGE Ill (him Sec Mia) 
(om) See 1.4m IJTF-ARES operators ?1,3331%, 

 

(bll1JSeo 1.4(al

 

 

 

IJTF-ARES operators. These
will bEl I
provider. This stage will be accomplished using two techniquesl I

?The two techniques for this stage will he executed as follows:

 

 

3.C.3.A. 1.4(al operators will utilize the

(trim Sec 1.4(oi

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

lThE Operators I

- 

IJTF-ARES operators will
utilize] (bll1)Seo 1.4(a) 

I lb){1 i Sec 1.4[a] 
JTF-ARES 1.4m) 

(oil?i) Lora} 

 

Sec 1.4(a)

 

 

 

 

3-C-3-3- Wl [bll1JSeo 1.4(al I
[him See 1.4(a) 7
{him See 1.4(al will

 

Er A a

 

I

 

 

 

 

 

 

 

 

i

I IJTF-ARES operators I

I I
operators will utilize] In)? i Sec 1.4m} I

 

-u .. m. I
(aim Sec 1.4{a} I

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

IJTF-ARES operators will utilizerEusg-c 14(35
IbiI1) Sec 1 
I(b1I1)Seo required, JTF-ARES willI (bii1iSEc1-4iai 
IThese actions will
I
domains and VPSI 1.49) I
I Sec 1.4(a) 
3.c.4. Arum?cum STAGE I (bII1)Sec 1.4m I
ibii?li Sec 1.4ia} JTF-ARES operators will utilizeI . I

 

 

 

Sec 114(3)

 

 

I . - IJTF-ARES operators will utilizeI (am) Sec 1.4{a} I
I {mm Sec 1.4m IJTF-ARES
operators will accomplishI I

 



 

 

 

 

3.C.5. STAGE IV I {oI[1)Sec 1.4(a) I

{bll1l53f3 14(3) TF-ARES operators will utilizeI {bill} Sec 14(3) I
IThis stage will be accomplished utilizing two techniquesII?m Sec 1.4g)
{hm} Sec 1.4{aJ IThe two techniques for this stage will be executed as follows:

 

 

 

 

{bii1JSBC1-4iai. IJTF-ARESoperatorswillutilizeI I


(mm Sec 1.4(a) IJTF-ARES operators I

 

 

 



3.C.5.B. [bilil SEC 1.4ta} I



 

 

 

 

 

 

 

 

[b}(1}Sec 1.4(a) IJTF-ARES operators will utilizeI 

 



 

 

 

I In .i'tA

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

will utilizeI . (mu) Sec 1.4{a} I
I I
312.5. STAGE VI 14(3) I
JTF-ARES operators wilII _(bl(113931.4la} I
{-21 
s.c.7. STAGE VII IStage VI is 3 "Be Prepared To 
task.I I
I (mm Sec 1.4(a) I
I {bli1ISec1.4lal IThese actions fall into three distinct
categories:
3cm. {sweet?muss}! 
I I
Sec 1.4EJTF-ARES wi   utilizeI [bjm Set: 1.4(a1 I Operators will utilize

 

 

1.4(a)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

s.c.7.e.41s#eeuusAreuan 

I (hm) Sec 1,4(3) IJTF-ARES will utilizeI I
{mm willi I
I 
IJTF-ARES operators willL 1.4(a} I I

I (bI[1] Sec 1.642;} I

 

3.C.8. (U) FIRES SUPPORT COORDINATION MEASURES.

3.C.8.A. PRE-MISSION. Pre-mission requirements are contained in the pre-mission checklist

which is maintainedI Iin the USCYBERCOM Joint Operations Center Set
ALERT CONDITIONS IAW the Cyber Tasking Order (CTO).

3113.3. FIRES EXECUTION LIST. The mission will be executed the CTO and the mission

execution checklist. The mission execution checklist is maintainedI Iin the
USCYBERCOM JOC.

 

 

3.C.3.C. MISSION ABORT. CDRUSCYBERCOM may order mission abort.
USCYEERCUM JOC nOtif?f supporting commandsI Sec 1.4(aI headquarters

 

TOP SECRETHSIHREL TO USA, 

 

or agencies must be verified with CDRUSCYBERCOM via the USCYBERCOM I

I I
the USCYBERCUM JUC.

3.C.3.D. ABORT PROCEDURES. When CDRUSCYBERCOM issues an abort. the
USCYBERCOM .IOC (bli1iSec1-4ta) will immediately contact JTF-ARES and the Mission Commander to
relay the order.I I

I lbli1 Sec 1.4(a) . I

ion-dar-ARES and JTF-ARES will submit the request with a recommendation to USCYBERCOM JOC for
CDRUSCYBERCOM decision.

3.C.8.E. CEASE FIRE AUTHORITY. The USCYBERCOM .13, Director of Operation

 

 

 

 

 

I IJTF-ARES Commander, and Mission Commander may call
Cease Fire. I leI1JSeo 
for Sec: 1.4m I
Ifor situational awareness 

 

 

3.C.3.F. CEASE FIRE the order to cease fire is received
and verified by proper authority, JTF-ARES will immediately contact the Mission Commander to relay the
order. The Mission Commander will] IThe Mission Commander
will! I

3.c.s.o. RE-ENGAGE AUTHORITY. The order to re-engege can be given by the
USCYBERCOM JOCI Iheadquerters

I (him Sec: 1.4{a} I
USCYBERCOM J3.

3.C.8.H. RE-ENGAGE PROCEDURES. When the order to re-engage is received or
verified, the USCYBERCOM JDC Watch Officer will immediately contact JTF-ARES to relay the order. The
Mission Commander 1.4(a) IThe Mission Commander
willI (bll1ISac1-4lal 

I 

3.C.3.l. CONTINUED ENGAGEMENT AND TARGET ELEM 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

lb?ll1lSEc 1.4lal IJTF-ARES 

I 1.4m) I

I IJTF-ARES will
ensure that these target elements are ofthe same type as the initial target elements 

I land that they reside within the target locations approved within this

operationl- {hll1ISBc1-4ia} 



{him See 1.4(aj JTF-ARESI 1.4(a) I
USCYBERCOM JOC willI (him See 1.4Ia) I

I I

 

.lr

 I: Ch EV

 

3.C.8.J. Wage?ml (mm Sec 1.4(a} I

I (b}{1}5eo 1.4{a} IUSCYBERCDM will generate a newfragmentarv order to this
operational order and will convene a Joint Targeting Coordination Board to approve the target and
validate the new fragmentary order as described in REF N.

 

3.C.9. RISK ANALYSIS.

 

3.C.9.A. INFRASTRUCTURE. JTF-ARES will useI (bII1)Sec 1.49:? I

(am) See 1.4(a)

 

 

 

 

 

 

RISK 1.I I

during execution.

3.09.3.1. MITIGATION 1. JTF-ARES will notify' for
recommendation to CDRUSCYBERCOMI {him SEC 14(3)

 



 

 

 

3.C.9.B.2. CCIR 1. 


3.c.9.c. Weston RISK 2.I Ioperational concern.

 

 

3.C.9.C.1. MITIGATION 2. Confirm reporting with responsible agencv. Notifv

 

 

 

for recommendation to CDRUSCYBERCOMI Sec 14(3) I
process.
3.09.02. REL TO USA, I

 

 

I [bil1i5eo1.4(a}

3.c.9.o. RISK 3. Dperatio 

 

 

 

 

 

3.C.9.D.1. MITIGATION 3. ConductI I
I Ifor mitigation. Notifv for recommendation to
CDRUSCYBERCOM. 

3.C.9.D.2. (SHREL TO USA, FUEY) I

 

 

I 

3.C.9.E. RISK 4. 

I, 

 

 

3.C.9.E.1. MITIGATION 4. Notify for recommendation to
CDRUSCYBERCOMI (mm Sec 1.4(a) I
(131(1) Sec 1.4{aJ I

 

 

 

 

 

3.C.9.E.2. (SHREL TO USA, FVEYJI (bio) Sec 1.4(a)

Sec 

 

 

 

3.0. TASKS.
3.0.1. JTF-ARES.

Upon receiving authorization from USCYBERCOM 13, establish C2 of all assigned forces and
execute 065 as outlined in this order.

3.0.1.3. JTF-ARES JOINT ELEMENT (NEE). Provide intelligence
analysis and planning as required, including intelligence assessments, estimates, and other intelligence
products ISO the commander?s decision-making process,  Sec I

I Sec 

 

 

 

 

3.D.1.C. JTF-ARES J2 COLLECTION. and provide end-to-end
collection management support to all-source intelligence with the IC ensuring management of
needsfrequirements.

3.D.1.D. JTF-ARES LOE 2. USCYBERCOM 15, identify partnerships with external
organizations to implement method.

3.D.1.E. {unwed} JTF-ARES LOE 2. Refine planning with partners for execution of identified method.

 

3.0.1.F. WJTF-ARES 13. Assign additional forces! 
[Min 330 Mia) as required.

3.0.1.6. WJTF-ARES JB. Assign forces to support this operation?

 



 

 

 

 

3.0.1.H. (UHFOUO) JTF-ARES FIRES. Ensure 065 is integrated, and  ibi?iSer: 

 

 

I I

 

 

 

 

 

 

 

 

3.0.1-I. Plan and coordinate this operationl {him} 330 1-4'Iai

1.4m: I?z-xecute oes.

3.D.I.I. WW Support assessmentsl (hm) Sec 1.4(a) I
I Iprocess improvements.

 

Er? I 

Forward requests for additional capabilities to USCYBERCOM as required.

 

3.0.1.L. (mm Sec IAW standard procedures.

 

 

3.D.l.lv1. (UN-F009) Provide mission reports Jto support
assessment of operation. JTF-ARES CUOPS will disseminate report IAW coordinating instructions and to
other organizations as required.

 

3.0.1.N. (Willa-00} Be prepared to support long-term assessments to Operational effectiveness
and performance.

3.0.1.0. BPT provide mission planning updates.

3.0.1.P. Coordinate with coalition and interagencv partners to transfer new

(mm Sec 1.4m

 

 

 

 

 

 

 

 

 

 

 

3.0.1.0.. Provide defensive overwatcl'l 
during the course of this operation. 
3.0.1.R. Provide {mm Sec 1.4{3}

I loperations.

 

3.0.2. CYBER MISSION FORCES.

3.0.2.A. JOINT FORCE HEADQUARTERS CYBER ARMY 

 

 

 

 

 

 

 

 

 

3.0.2.A.1. ml i
I 
I Ioperations are preferred.

some. WI Sec 1.4m 1
Sec: 1.4(a) lof this operation.

 

3.0.2.A.3. BPT provide personnel to fill other mission critical roles.

3.o.2.a. (urssouo) (U) MARINES MARINE cones FORCES CYBER COMMAND 

 

3.o.2.a.1. WI 1.4a; 

I Iof this operation.

 

3.0.2.3.2. BPT provide personnel to fill other mission critical roles.

 

3.o.2.c. {um-Que) CYBER NATIONAL MISSION FORCE 

 

 

 

 

 

 

 

 

(bll1lseoi.4(al . 
Sec 1.4{a} - I
loperations are preferred.

3.0.2112. WM 
I {bl(1)5ec 1.4iai bf this operation.

 

BPT provide personnel to fill other mission critical roles.

 

meme?seem 

?:operations 150 this operation.

 

directed,

operations ISO this
operation.

 

 

 

3.0.3. [Ul USCYBERCOM.

3.D.S.A. WUSCYBERCOM 13. Coordinate with Sec 1.413) 0 IEverage individual
agency authorities and capabilities to support the objectives and effects as outlined above. Ensure all
agency-specific actions are and deconflicted with all other participating agency actions.

3.D.S.A.1. USCYBERCOM JDC. Coordinate with to maintain current reporting

{b)(1)Sec lReport any objections immediately to CDRUSCYBERCDM and IAW
Para 3.C.9.C. 

 

3.D.3.B. USCYBERCDM 13. Provide to support research, rehearsals, and

execution of this operation.

   

3.0.312. - 



3.D.S.ID. USCYBERCOM J3. Establish Assessment Working Group ICW USCYBERCOM 15.

  

USCYBERCOM 13. Coordinate and tie-conflict wit 



3.D.S.E. (U) USCYBERCOM STAFFJUDGE ADVOCATE (51A). Provide legal support as required ISO 065. 

3. D. 3. F. USCYBERCDM 12. Coordinate with the If. to provide necessary
comprehensive! (mm Sec 1 4(3) 1
mission dictates.

3.D.3.G. (U) USCYBERCOM 12. Provide intelligence support to JTF-ARES as requested Battle Damage
Assessment 

 

 

 

 

3.D.3.H. USCYBERCOM CDG. Coordinate and oversee the] (min) Sec 1.4{a} 
I lanalvsis.

 

 

 

3.0.4. (U) REQUESTED SUPPORT

3.0.4.A. INTERAGENCY

 

3.0.4.A.1. Support and participate in the process forl 
I  and execution.

 

 

3.D.4.A.2. (U) Provide intelligence support prior to and during execution. Specific intelligence
requirements will be passed by USCYBERCDM 12 prior to eiecution.

3.D.4.A.3. (U) Participate in USCYBERCOM appropriate boards, bureaus, cells, committees, and working
groups events [50 this operation.

3.D.4.A.4. For units involved in t_of the operation, provide or

designate a representative for coordination, requests, and questions to be routed through.

3.0.4.A.5. NSA.

3.0.4.A.5.1. WEE-W Partnering and support, as authorized and appropriate, in identifying

 

(mm Sec 1.4(a}

 

 

 

3.D.4.A.5.2. Wags} Requesll {mm Sec 1.4m)

 

 



 

 

 

3.0.4.A.5.3. Support and participate in the processl (him See 1,49] 
(mu) San 1.4(a) 

3.D.4.A.5.4. . Designate a representativel 
. (om) Sec 1.4{3} operations.

FBI.

 

 

 

 

 

3.0.4.A.6.1. (SHREL T0 USA, - {bli1JSEC1-4'lal

 

(mm Sec 1.4(ar

 

 

 

Designate a representativel 
1.4(a) Operations.

 

NEW

 

3.0.4.A.6.3. BPT receive additional previouslvl 
I 1.4(3) lcourse of this operation.

 

 

 

3.0.4.3. GCHQ.

 

 

 

 

 

 

 

 

3.0.4.3.1. Request (bun Sec 1.4a] 

Sec 1.4{aj I
3.0.4.3.1W Designate a representative from (but) Sac 1.4m)

I - {him Sec 1.4{ai Operations.
3.0.4.33. BPT receive additional previouslvl (hm) Sec 14(3) 1

 

 

{b}(1}Sec 1.40s) [course ofthis operation.

 

3.0.4.c. eso.

 

 

 

 

 

 

 

 

 

 

3.0.4.c.1. Request (me Sec 1.4m


3.D.4.C.2. Designate a representative from ASD tol 1.4Iai
{bitiiSec1-4lai land USCYBERCOM Operations.

3.D.4.C.3. Receive additional previouslvl (mm Sec 1343.}

Sec 1,4(Fourse ofthis operation.

(U) INTELLIGENCE AND SECURITY COMMAND Staff extra maintenance personnel to
support malfunctions.

3.E. COORDINATING INSTRUCTIONS.

3.E.1. (um?ow} USCYBERCOM JOC. Serve as the point of contact for cyberspace operations
and Sec Ln?partners are requested to provide liaison officer

 

. . 
coordination to  (bus) (bus)

 

NLT three days after receipt ofthis order. Please see Ref for other concerns.

 

 

 

 

3-E-2- WL SEC 14(3) lforces will share] 



 

 

 

3.E.3. ESCALATION PROCEDURES. IAW Para 3.09.

3.E.4. CCIR. See Para 

I 

 .r

GENTEXTIADMINISTRATION AND LOGISTICSM.

4.A. OPERATIONS SECURITY IOPSECI. Integrate OPSEC throughout the planning effort to
protect critical information, with emphasis on vulnerabilities associated with internet-based capabilities
(to include. social media} and force protection. Use JTF-ARES Classi?cation Aid to facilitate classification
of material associated with this operation. The desired overall security classification for this planning
effort is to be as low and releasable as allowed bv mission requirements to ensure our coalition partners
can be informed of our effortsj,f

GENTEXTICOMMAND AND CONTROLIS.
5.A. COMMAND Commander United States Strategic Command

ICDRUSSTRATCOM) is the supported combatant commander for activities ISO this operatiqb-a)
Sec 1.4m) Ito conuscveeacom.

 

 

5.A.1. All other are designated as supporting commands for this operation.
5.A.2. JTF-ARES AND (SERVICES).
5.A.2.A. OPCON to USCYBERCOM.

5.A.2.B. Provide general support as required to JTF-ARES in
execution of this operation.

 

5.A.2.C. W?ansferl I

Ifrom the CNM F, as-required through the duration of execution of this

operation. Personnel must be presen . 1-4IEI Forces DPCON to .ITF-ARES will be returned to
parent command upon operations completion or based on mission requirements.

 

5.3. DOD COMPONENTS. Acknowledge receipt and understanding of this TASKORD within 24
hours via official message traf?c, email to JOCocansachov or via 



5.C. (U) PUBLIC AFFAIRS (PA) GUIDANCE. PA posture is response to query only. Release of information
regarding this effort shall be IAW REF N.

5.C.1. (U) MEDIA OU ERIES. Refer without comment to OSD info Office of CJCS PA, USSTRATCOM
PA, and USCYBERCOM PA.

5cm. oso 
osn: 312-123-5131
COMM: 703-697-5131

 

5.C.1.B. {Ul Of?ce of CJCS PA
DSN: 312-227-42?2
COMM: 

5.C.1.C. USSTRATCOM PA
COMM: 402-294-4130

5.C.1.D. USCYBERCOM PA
COMM: 443-654-4?32

5.C.2. NON-DOD ORGANIZATIONS. Any additional PA guidance will be coordinated through the
National Security Council (NSC) Staff as necessary.

5D. POC:

5. D. 1. Request for information regarding execution ofthis order amplifying guidance andfor
additional details are to be submitted to:

USCYBERCOM SIPR RFI portal:


IWICS RFI portal:


5.D.2. PRIMARY: USCYBERCOM .IOC
NSTS: 965-8730f8?72

(W3) I

(mo) 

JWICS: ioccbc@ nsa.ic.goy

SIPR: joccbc@nsa.smil.mi 

 

5.D.3. SECONDARY: JTF-ARES CUOPS
NETS: 969-4900
COMM: {hlI3l

JWICS: ares cuops@nsa.ic.goy?

 

THE coal (bli3) USA, uscrasncom 13, DIRECTOR
OF 

 



Classified By: {Inna}

Derived From: Multiple Sources
Dated: Multiple
Declass On: 20411106ff

 

I I

 

C-2 Mission Checklist? ?Operation GLOWING (v11)

 

. OPR 
JTF ARES 07 NOV2016

 

 

 

 

 

 

 

 

 

 

 

 

Notes:
Ob'ectiveIPur use: This A roved OPORD which describes United States ber Command
Iand the
Levant?s (mm Sac Mia} accordance with (IAW) Operation
Inherent Resolve (01R), OCO authorities are granted,I 1.4(3)

Sec 1.4(a)


REF A: OPERATION GLOWING (OGS) COMMUNICATIONS CA RD

NOTES:
-Decon?iction, both technicalItactical and operational has been completed

THE FOLLOWING ARE USCYBERCOM NOTIFICATIONS WITHIN OGS (indicated in BOLD text):

EXECUTION (DATE (D Day) and H-Hour)
(2) OPERATIONAL UPDATE and every 6 hours
(3) (As required; IMMEDIATE for Non Concur and Isseus)

THE FOLLOWING ARE USCYBERCOM CCIRs and SIRS WITHIN OGS

 

 

 

(1)1 1.2; CCIR SIR SIR 1.2)
(2) CHANGE IN OPSECI l? (CCIR 3; SIR 3. I SIR 8.5)
(3) CHANGE IN STATUS I-

 

 

SIR SIR L2)
(4) COCOM, FVEY OR EXTERNAL AGENCY CALL FOR CEASE FIRE - (CCIR 4; SIR 4. I)

THE FOLLOWING ARE JTF ARES CCIRs and SIRs WITHIN OGS:

 

 

 

 

 

1. Changel IbImSec 1.4Ia3

2. I [with OGS execution.

3. Notificationl OGS execution.
4. I Iwith OGS execution.

5. I  established for OGS.

 

THESE CCIRS WILL ALSO BE REPORTED ON THE DAILY QUICKREP.

NOTE: CONTACT NUMBERS WITH INTERAGENCY LIAISONS ARE CONTAINED IN REF D. THERE
WILL BE CONTINUOUS COMMUNICATIONS BETWEEN USCYBERCOM JOC AND JTF-ARES ON
STATUS OF OPERATIONS AND VERIFICATION OF NOTIFICATIONS.

All times are ZULU

 

 

Page 1 of 5
I

 

.. .F

 

(3-22 Mission Checklist? Operation GLOWING (v11)

 

 

   
  

  
 
 

   

??23222?? ??22212; OPR DATEITIME

22.22 2222..- 2 2325222..
WING ?fth, :?323 2 JTF ARES 0? NOV 2016

 
 

     

 

 

 

 

 

 

 

Sec 1.4(3)

 

 

 

 

Salted .- ITEM - Actual

 

 

 

 

 

 

 

 

i2?



 



 

 

 

 

 

 

Page 2 of5


 



.

 

C-2 Mission Checklist? Operation GLOWING (v11)

 

   

?my Fi?-?a .- ?11. 
r. lag-22f. 1 
. GLO

 

 
 

 

 

OPR

 

DATEITINIE
07 NOV 2016

 

 

 

Actual

 

 

 

ll.

 

12.

 

13.

 

14.

 

15.

 

16.

 

17.

 

13.

 

 

20.

 

21.

 

 

22.

 

1.4(a)

 

 

 

 

 

nu- I

 

C-2 Missiml Checklist? Operation GLOWING (v11)

 

  

?in OPR 
+2551? JTF ARES .07 NOV 2016

 

 

 

 

 

Sched ITEM Actual .

 

 

 

 

 

24.

 

 

25.

 

 

26.

 

 

27.

 

 

23.

 

 

29.

 

 

30.

 

 

31.



 

 

32. 

 

 

33.

 

 

34.

 

 

35.

 

 

36.

 

 

37.-

 

 

 

38.

 

 

 

 

Page 4 of5


   

 

If 

 

C-Z Mission Checklist Operation GLOWING (v11)

 

 
 

OPR
JTF ARES

 

 

DATEFTIME
07 NOV 2016

 

 

39.

Sched

 

Actual

 

 

 

40.

 



 

42.

 

43.

 

 

44.

 

 



 

 

Page 5 of 5

1 'n



 

 0722303 JUL 1?
FROM: USCYBERCOM FT GEORGE MEADE MD

TO: CDR USSTRATCOM OFFUTT AFB NE

CDR USCENTCOM MACDILL AFB FL

HQ USSTRATCOM OFFUTT AFB NE

HQ USCENTCOM MACDILL AFB FL

USSTRATCOM COMMAND CENTER OFFUTT AFB NE
OSD WASHINGTON DC

INFO: USCYBERCOM FT GEORGE MEADE MD
CDR USAFRICOM STUTTGART GE

CDR USEUCOM VAIHINGEN GE

CDR USNORTHCOM PETERSON AFB CO

CDR USPACOM HONOLULU HI

CDR USSOCOM MACDILL AFB FL

CDR USSOUTHCOM MIAMI FL

CDR USTRANSCOM SCOTT AFB IL

HQ AFRICOM STUTTGART GE

HQ USEUCOM VAIHINGEN GE

HQ USNORTHCOM

HQ USPACOM HONOLULU HI

HQ USSOCOM MACDILL AFB FL

HQ USSOUTHCOM MIAMI FL

24AF LACKLAND AFB TX

CDRUSACYBER FT BELVOIR VA

COGARD CYBERCOM WASHINGTON DC
FT GEORGE MEADE MD
MARFORCYBERCOM FT MEADE MD

CNMF FT GEORGE MEADE MD

JFHQ DODIN FT GEORGE MEADE MD

DIA WASHINGTON DC

DISA FT GEORGE MEADE MD

DSS WASHINGTON DC

DTRA OPSCENTER WASHINGTON DC

MDA WASHINGTON DC

NGA WASHINGTON DC

NRO WASHINGTON DC

NSA FT GEORGE MEADE MD

NSACSS FT GEORGE MEADE MD

JOINT STAFF WASHINGTON DC

JOINT STAFF J3 DEP-DIR GLOBAL OPS WASHINGTON DC
DEPT OF HOMELAND SECURITY WASHINGTON DC
DHS OPERATIONS DIRECTORATE WASHINGTON DC
FBI WASHINGTON DC

DEPT OF STATE WASHINGTON DC

DEPT OF TREASURY WASHINGTON DC

DEPT OF JUSTICE WASHINGTON DC

DEPT OF JUSTICE COMMAND CENTER WASHINGTON DC
CIA WASHINGTON DC

CDRUSACYBER PASS TO: CDR JTF-ARES FT GEORGE MEADE MD





SUBJECT: (U) USCYBERCOM GENADMIN 17-0093 EXTENSION OF OPERATION

GLOWING 

OF OPERATION GLOWING
TO USA, 

2?



THE PURPOSE OF THIS MESSAGE IS TO NOTIFY COMBATANT

 

COMMANDS, SERVICES, AGENCIES, AND FIELD ACTIVITIESI 

EXTENSION OF UNITED STATES CYBER (USCYEERCOM)

GLOWING 


United States Cyber Command

(USCYBERCOM) intends toI



1 Sec 1.4(a)

Sac: 

Sec 1 
Sec 1.4{a}
IUSCYBERCOM will continue to

OPERATION

1

 

operate IAW all elements detailed in the CONOP 



 

 

Sec 1.4{a}

 

 

recognizing any deviations from this will require'
coordination and approval via the] 

process.ff

 

 

GENTEXTXZ. 

 

 

mxu3m1am)

 

Iw?nSanaw?nmdia line of effort and United States Central Command's

ongoing operation5./f

GENTEXTXCOMMAND AND CONTROLXB.

3.A. POINT OF CONTACT

(POC).

3 .A . 1 . {mm} 

NSTS: 969-6671
tbh?3i I

 

NSANET 1 {mm} . IC . GOV

 

 

 

 

 

3.A.2. 

(MB)

 

USAF, 

 

NSTS: 969~0092

COMM: {mg}

 

 



NSANET: INSA.IC.GOV

3.B. ALL DOD COMPONENTS WILL ACKNOWLEDGE RECEIPT AND UNDERSTANDING
OF THIS MESSAGE WITHIN 24 HOURS VIA OFFICIAL MESSAGE TRAFFIC OR TO:



3.C. (U) REQUESTS FOR INFORMATION REGARDING THIS MESSAGE, AMPLIFYING
GUIDANCE, ADDITIONAL DETAILS ARE TO BE SUBMITTED TO:

3.C.l. USCYBERCOM SIPR RFI PORTAL -


3.C.2. USCYBERCOM JWICS RFI PORTAL 

I

 

THE AHA GEN,
USAF, USCYBERCOM J3, DIRECTOR OF 

 



CLASSIFIED BY:
FROM: USCTEERCOM SCG
DATED: 20170707

DECLASS ON: 20430707/f



 

JUN 2722013
?Foln relate-w completed on Eh 

 

. Portions of this document no,lo 1ger meets
the classification standards established by
Executive Order 13525, Classified National

 

Security Information, Section 1.4. As such, 
FRAGORD 0 6 am downgrading specific portion-marked
paragraphs as Partial
3W classification downgrade executive by:

R035 A. MYERS
Rear Admiral, U.S New
Chief of Staff

SUBJ: (U) moon]: 06 to USSTRATCOM omen 3000-47:
Authorization to Conduct Operation GLOWING 
-

DTG: 8818282 NOV 16

 

 

MSGIDIORDERICDRUSSTRATCOMKX

OCT l?f/
USSTRATCOM CAMPAIGN OPORD 8000-17 (Biff

MAY 
Atlel-Ilf Counter Adversary Use of the Internet Execute Order


NOV 16!!

EMAIL from Assistant to the President for Homeland
Security and Counterterrorism to Office of the Secretary of-Defense
and Joint 

Sep 

USCYBERCOM Operation Glowing Concept of
Operations 

NOV 

CJCS GENADMIN Message: Authorization to

Conduct Operation Glowing 


{Sm} This order authorizes the CDRUSCYBERCOM to
execute Operation GLOWING 


{U}Situation. 


.



2. (U) MISSION. Per Ref 



3. (U) Execution.

3.A. Concept of Operations. CDRUSCYBERCOM

conducts offensive cyberspace operations and supporting activities

 



 

 

3.B. (U) Tasks.
3.E.l. (U) CDRUSCYEERCOM.

Under the authorities provided in Ref B, and the
guidance provided by the National Security Council Staff and the
Deputies Committee in Ref C, Operation GLOWING Ref has
been approved for execution. . 

 

Sec1.4(a) I
GENTEXTXADMIN AND 
4. Administration and Logistics. Per Ref 
GENTEXTXCOMMAND AND 
5. (U) Command and Signal.

5.A. (U) Points of Contact.
5.A.l. USSTRATCOM Battle Watch Commander:

COMM
(402) 294-1800, DSN 2Tl-1800.

 

 

 

 

 

 

 

 

 

 

 

 

 

 



GENTEKTXAUTHENTICATIONXHEIDI U. BROWN, MAJOR-GENERAL, DIRECTOR,
GLOBAL 



5.A.2. USSTRATCOM mum 

mum  mil@mail.smil.mil; COMM 402-294?4410, DSN 271?4410 or
(mm) icimaail.smil.mil, m?m 
Us? {bus} I

5.A.3. (U) USSTRATCOM mus ICOMMI (ms) I
DSNI (mm) Iciv@mai1.smil.mil ori one

COMMI (mm) {mm} Fiv?mail.smil.mil.fi

 

SEGREFMDEQRN

Classified By: MG Heidi V. Brown, USSTRATCOM J3.
Reason: 1.4 
DECLASSIFY ON: 08 Nov 2041


Distribution:
FM USSTRATCOM J3 DIR GLOBAL OPS OFFUTT AFB NE

TO GEORGE MEADE MD

INFO USSTRATCOM J3 DIR GLOBAL OPS OFFUTT AFB NE
USSTRATCOM J33 CURRENT OPERATIONS DIV OFFUTT AFB NE
USSTRATCOM J35 OPERATIONS PLANS DIV OFFUTT AFB NE
USSTRATCOM J39 INFORMATION OPERATIONS DIV OFFUTT AFB NE
USSTRATCOM CMD CENTER OFFUTT AFB NE

 

 



 

 

 

The overall classification of this briefing Is: 
Classified By: 

Derived From: USCYBERCOM SCG
Dated: 20121220

AND

Derived From: 1-52
Dated: 20070108

Declassi?lr 0n: 20371220:-

WW



QEOperation GLOWING Overview

- in conjunction with interagency and Coalition
Partners will conduct Operations . 

 

 

 

 

Sec 1.4[a}

 

 

 

within Iraq and Syria.

 


i? m!

DEVELOP

Create, edit. 8: finish
ISIL products

  
  

DISTRIBUTE DISSEMINATE

Prepare, stage 8: Proliferate ISIL
publish ISIL prodL_ic:_ts . message



ISIL Media Framework and Functions

DEFEND .

Sustain ISIL
messaqe

 

 



 

 


(mm Sec: 1.4(a)

 

 

 

 

I

 

 

 

 

 

FEE-PUBLICATION POST PUBLICATION 

 m, GLOWING Overview

Offensive Cyber Operations

 



 

 

 

 





   

Operation GLOWING 22:23:;

(blt1JSec1 Ma} ISIL Infrastructure

 

 

 

 

 



 

 

 

 



 United States Cyber Command Concept of

Operations (CONOP) I







OPERATION GLOWING 

 

Signature

 

Position

 

Date

 

JUN ,2 7 2013

 

FDIA review completed BMW.
Portions of this document longer
meets the classification standards
established by Executive Order 13525,
Classified National Securitv Information,
Section 1.4. As such, I am downgrading
specific portion-marked paragraphs as
Partial classi?cation
downgrade executive bv: R055 A. MYERS
Rear Admiral, U.S Navy Chief of Staff

 

 

Glassi-f-ied BY: {mg}

Derived From: NSAICSSM 1-52
Dated: 20130930

Declassify 0n: 20410913

 OPERATION INHERENT 

 

 

WI (mm Sec 1.4{a}

{mu} Sec 

 

 

 



REFICIDOCI (U) (W TRILATERAL MEMORANDUM OF
AGREEMENT AMONG THE DOD, DOJ AND INTELLIGENCE COMMUNITY
REGARDING COMPUTER NETWORK ATTACK (CNA) AND COMPUTER NETWORK
. -


 


I Sec 1.4(a)
FVEYWSCENTCOMIM 15 10.2 NOV ISIOPORD 24H.

USCYBERCOM OPORD 15-055 IN SUPPORT OF OPERATION
INHERENT RESOLVE (SHREL TO USA, MAR 15! 

DEPARTMENT OF DEFENSE INSTRUCTION O-
3600.03, TECHNICAL ASSURANCE STANDARD (TAS) FOR COMPUTER NETWORK
ATTACK (CNA) CAPABILITIES (UHFOUOYU APR 2010! 
OPORDI (SHREL TO USA, FRA,


 

REFINE A VAL 0 TACTICS TOI (mm Sec 1.4m)
(SHREL TO USA,


 

 

 

(W OP GLOWING {bli1ISec1-4ia}

 

 

(-DOCUMENT 

OPERATION GLOWING IS AN
OFFENSIVE CYBERSPACE OPERATION I

 



 

 

 

ISLAMIC STATE IN IRAQ AND THE LEVANT WITHIN IRAQ AND SYRIA.

1.

 

 

 

IDES-59W

 

 

LA. (W General Situation. I I

Sec 1.4{a}

 

 

 

1.A.1. TO USA, 

 

Sec 1.4{3}

 

 

1.B. 43W Area of Operations The area of operations Sec 1-4lal

 



 

 

LC. (U)Enem1.
1.C.1. primary cyberSpace initiative uses the Internet as a I

conduit to target global audiences to recruit and rad icalize. Speci?cally, ISIL creates media to
provide legitimacy to their self-proclaimed caliphate and to recruit sympathizers to convert to
their ideology and join their cause. messages are primarily meant to appeal to {bll1l Sec 14(8)

?1,3,,1431 however, ISIL 'tailors their messages to attract others globally. In addition to itis

nternet messaging, ISIL provides media to the local populacel 1.4(a)
{blt1lSEc1-4la) 

 

 

1.C.2. (U) ISIL also uses media to threaten and intimidate. For example, gruesome videos
are meant to intimidate and strike fear into their adversaries and local populace to reduce their
will to ?ght and ensure local pepulations remain compliant with IS IL rule. ISIL messages that
threaten foreign governments are meant to deter foreign military intervention or demand ransom

for foreign hostages.

1.C.3. (W high quality propaganda has effectively enabled 
personnel recruitment from susceptible local and foreign Muslim pcpulations. In addition to the

recruitment of personnel for combat, ISIL actively I 
IISIL is struggling to attract a suf?cient number of recruits

 

3

with th-gxpertise needed to provide governing and social services; however, those
current struggles are not likely to deter ISIL from maintaining these aspirations.

l.C.4. (W ISIL has inedia establishments responsible
for the group?s strategic media and propaganda production 

I These outlets serve as the group?s primary arms for
communicating leadership and religious guidance, as Emil as highlighting activities agrees ISIL-
controlled territory. Although these establishments (hilt) Sec 1-4ta}

lcreate speci?c products. In order to
(IOT) make the highest quality media products, central media developers have access to multiple
media sources. This includes raw and ?nished media ?les developed by the?

(_nedia establishments, access to the Internet to download media ?les, and the ability to

recor and create their own organic media ?les.

 

 

 

 

 

 

 

 

 

1.C.5. (W ISIL employs cadres of personnel with varying levels of

expertise and responsibility to acquire, develop, administer, and maintain information networks
utilizing both private and public Internet infrastructure. These individuals are reaponsible for the
management of data communications projects, such as the creation and establishment of websites
and mobile applications in support of (ISO) ISIL media, as well as the creation and management
of network projects designed toI that} Sec 1.4(a) 

 

 



 

 

 

1.06. (MSW The self-preclaimed Islamic State of Iraq and the
Levant (ISIL) 1 {mm Sec 1.4ta} I

 



 

 

 

 

 support to ISIL media organizations and supports ISIL ability to distribute

 

 

 

propaganda, and facilitate  I
1.0.7. (W The self-proclaimed Islamic State ofIraq and the
Levant {blt?li Sec 1.4m 

 



 

 

 

1.4.13) Isupport to ISIL media
organizations and supports ISIL ability to distribute propaganda, and facilitate?


1.0.3. (W The self-proclaimed Islamic State efIt-ae and the
Levant {bit1JSec1-4ta)

 

 

 



 

 

 

4

 

 



 

 

1.C.9. (W1 {11111) See 1.41:3}

 



 

 

 

(am) See 1.41:1) self-declared Caliphate, external provinces, and
globally dispersed supportersl (111(1) Sec 1.4m) lsupport to ISIL media
organizations and supports ISIL ability to distribute propaganda, and facilitate] I

 

 

Sec 1.4{3}

 

 

 

 

1.0.10. (W (11111) See 1.4m 



 

 

{mm Sec 1.4{a}  privileges to
establish, maintain and troubleshoot software and deal with terms of service 

 

 

(131(1) Sec 1.413)

 

 

 

1.0.11. To USA, FVEYIFISAH 1mm Sec 1.41s} 

 

 

See 

 

 

 

 

1.C.12. (TSHSIHREL TO USA, FVEYIFISAH 

 

Sec 1.4{a}

 

 

 

1.1). (U) Friendly.

1.D.l. (W US CYBERCOM directs assigned andfor supporting forces
IOT support the dismantlement of ISIL in accordance with (IAW) Ref A. USCYBERCOM

forces are staffed, trained, and equipped to collect, report intelligence, information, and, when
authorized and directed, posture to and conduct cybersoace operations (CO) againstdum) Sec 1.4(
Ivalid military targets
approved by Commander, United States Cyber Command (CDRUSCYBERCOM) IAW Ref 


(mu) Sec 1.4{a}
IJoint Task Force ARES (J TF-ARES).

 

I 

1.D.2. 

(tn-{in unction with Federal Bureau of Investigation (FBI), National
Security Agencyr (NSA), and Coalition partner effortsI 

I IandL (hm) Sec 1.4(a) 
(mm Sec 1.4(3) I

media applications thatI
Organizations. These accounts and infrastructure wereI I

I

 

 

1.D.3 According to Intelligence Community (1C) reporting, I I

 

Sec 1.4051}

 

 

 

 

Operation GLOWING (0GB) is an operationalI (mm Sec 1,49}

Sec 1.4{a}

1.D.4. The intended cyber effects in this concept of operations

 

 

 

 

 

 

 

(CONOP) are part of I (am) Sec 1.4{a}
more favorable I (am) See 1.4(a} IThis operation is
supporting USCENTCOM and CJTF-OIR Operational 

 

I (hm) Sec 1.4{a}

 

6

MESH-1W

 

 

 

 

 

I (bittisec 1.4(a) hf externally-hosted U.S. and 

(bio Sec 1.4(al 
I land worldwide accounts and
infrastructure will generate I I
I IUnited States Central Command (USCENTCOM) and-

 

Special Operations (US SOCOM) efforts in Iraq and Syria.

 

1.13.5. JTF-ARES will implement the method described in this
CONOP and coordinate with appropriate interagency (IA) and coalition 

Sec 1.4{3}

 

 

 

1 .D. 6. .TTF- ARES in association with USCYBERCOM, will
coordinate with U. S. government and coalition partners I I

 



 

 

 

1.D.7. Within this CONOP, all references of ?Operators? and will refer
to personnel on teams operationally-controlled (OPCON) by JTF-ARES, unless otherwise

speci?ed.

 

 

1-.D.8. (W Within this CONOP and net RefI. {bll1ISBc1-4ta} 
{him See 1.4m) Iapproved USCYBERCOMI (him Sec 1.4{3}

 



 

 

1.4m.)  whi_
allowing USCYBERCOM operators toImmj Sec will. AccounliI (mm Sec 14(3)
I 

 

1.E. (U) Constraints.

 

 

 

 

 

 

 

 

 

 

 

 

LE. 1. WI tbioi Sec 1.4rai
{1m} Sec the control of ISIL or a surrogate entity.

1.E.2. Operational objectives will be achieved using only the

minimum etreets necessarv. The intended effects under this order wil?

(eitt) see 1.4m) IAW the de?nition in Ref B.

1.E.3. (W- Actions and effects will bel 

IThere will be  {b)(1)Sec 1.4(a)
the United StatesI (bl-{11566 Mia}
7

 

1.E.4. (W311) Actions in this operationl 

 



 

 

 

I 1.E.5. Overall freedom of Internet usage is to be maintained with

{11111) See 1.41a}

 

 

 

 

1.F. (U) Restraints.

1 1 WI (hunger, 1.4131 1

I (1111113121: 14(3) _lthe S. or its territories

 

 

GENTEXTIMISSIONIZ. Mission. On Order, Commander Joint Task
Force ARES conducts offensive cyberspace operations and

 

(11111139.: 1.4{3}

 

 

 

GENTEXTIEXECUTIONIB.
3.A. (U) Concept of Operations.
3.A.l. (U) Commander?s Intent.

3.A.1.A. (W Pumose. Iso operations?
Syria to dismantle and ultimately defeat ISIL, USCYBERCOM conductsl (113(1) Sec 1.412.) I

 

 

(111(1) Sec 1.4(a)

 

 

 

 

(MW Method. JTF-ARES actions 1.413) 

[11111) See 1.41:1}

 

 

 

 

 

 

 

 

 

 

 

 

 

 

{mommies} i 

11111115991111a1_ 
{him See 1.4151) 
lockout, TF-ARES personnel will use Sac 1.4{a}
3

 

IJTF-ARES will execute for a
duration not tor I

 



 

 

 

3.A.1.C. (W Endstate. freedom of movement in cyberspace to
distribute andI (oit1i5ec 1.4m) 

 

I '"(statesma? 

3.B. (U) Obiectives and Effects.

 

BB. 1. Obiective 15. the Internet.

 

 

 

 

3.B.1.A. (SW Effect 1A.I 1.4{a} network services and
applications I

 

3.B.1.A.1. (UHEQUQ) Measure of Performance 1. Assigned forces execut- 
I th?I) See me) I

 

 

 

 

 

 

 

 

 

 

 

 

3.B.1.A.2. MOP 2. accountsi 
{tum Sec 1 .4091) initiation. 

3.13.2. (W Obiective 3. media.
3.B.2.A. Effect 2A. media products is

 

 

 

t-t
3.B.2.A.1. (W MOP lug-upcoums.

3.B.2.A.1.A. WM Measure of Effectiveness 1. {him Sec 1-4taJ
{am} See 1.4(a) accounts. .

 

3.B.2.A.2. (W MOP 

 

 

 

 

 

 

3.B.2.A.2.A. (W MOE 2. I (b}(1}Sec 1.4(3) I
I Iavailabie for use in support of media.
3.B.2.A.1.B. Wlndicator. I I

 

 

 



3.B.2.A.3. (W MOP 3b

3.B.2.A.3.A. (W MOB 3. Observedl
Indicator. 

reconstituted elsewhere.



disrupted.

 

 

[1}Sec1.4

 

[56133.

 

 

Sec 1.41121}

IVPSs.

 

{121(1) See 1.4{e}

 

 



 

 

3.B.2.B.1. MOP 

3.B.2.B.1.A. (Stags?"poem MOB 1. Observedl

 

{ls-H1) Sec 1.4(a)

 

3.B.2.B.2. MOP . mains.

 

3.B.2.B.2.A. (SW MOB 2. Observedl

inanies available for use in support of media dissemination.

3. 2. B. 2. B. Indicator. ebpages_

Sec 1.4(a)

or reconstituted elsewhere

media products is

owned email.

 

3.B.2.B.3. WMOP 313-31133.

3.B.2.B.3.A. MOE 3. Observedl
3.B.2.B.3.B. Indicator. webpagesi

reconstituted elsewhere.

3.B.3. JTF-ARES Obiective 4. I

social media.

3. B. 3. A. WE Effect medial

disrupted.



 

(131(1) Sec 1.4(a)

 

VPSs.

 

 



 

(am) See 1.4{a}

 

(b21111) Sec 1.4(a)

 

3.B.3.A.1. MOP 

Observed

accounts.

3.B.3.A.2. (WMOP 3b

 

 

Sec 1.4(3)

 

 

 

 

(1) Sec 1.4

 

domains.

 

10



 

3.B.3.A.2.A. MOE 2. Observedl Imedia

applications. 

 

3 .B.3 .A.2.B. Indicator. ObservedI 1-4ia} Irnedia

applications.

3.B.3.A.3. W3.) 

3.B.3.A.3.A. 68W m. Observed I (hm) Sec 1.4(a) IVPSs.
3.B.3.A.3.B. Indicator. ?applicationsl {mm Sec 1.4(a) I

or reconstituted elsewhere

 

 

 

3.0. (U) Concept of Operations.

This is aI 

 

 



 

 

 

only functions planned to be utilized.

 

3.C.1.A. Upon the (em) Sec 1.4{a}

 



 

 

 

I IThis operation will be conducted in
six phases. I 

 

 

Sec 1.4{3}

 

 

 

3.02. 98W Phase II I JTF-ARES operators will

 

Sec 1.4[a)

 

 

1.4(a} IThe operators will

 



 

 

 

(mm Sec 1.4a} I TF -ARES operators will utilize] (mm Sec 14(3) I
{am} Sect-#651) I

ll

 

 

Sec 1.4[a}

 

 

 

3.0.3. Phase 

(him Sec 1.4(a) IJTF-ARES operators WiilI(b}(1}Sec 1.4(a) 

 

 

{em 1 Sec 1.4m}

 

 

{hm} Sec 1.4(a) IJTF-ARES operators. These willI (hm) See 1_4(a) I

(earn Sec 1.4{a}  This phase will be accomplished

using two techniques:l IThe two
techniques for this phase will be executed as follows:

3.C.3.A. (W I TF-ARES operators will utilize





l_

 

1.4(a) I TF-

[The operators will enter the

 



 

 

IJTF-ARES operators will utilizeI I

 



 

 

IJTF-ARES 

 

 



 

 

 

 

 

3.c.3.B. (hm) Sec 1.4(a) IJTF-ARES certi?ed on?net



 

 

 

 

I (blt1JSec1-4ta) IJTFHARESI 
than Sec 1.4a) - IJTF-
ARES operators willI I

 



TF -ARES operators will utilizel I

 



 

 

 

 

 

 

 

 

 

Operators will utilizel {b1g113ee1aga1
Sec 1.4{a}
jAs required, TF ARES 
Sec. 1.4{a} I
[2

 

 

 

(b){1)Sec 1.4{a}

 

3.04. Phase ml
Sec 1.4{a}

1.4(a) I
operators will utilizel

 



 

Sec 1.4{a}
operators will utilizel I
I IJTF-ARES operators will accomplish

 

 

1.4{a}

 

 

 

 

 

 

 

 

3.05. Phase IVI 
operators will utilizel 1.4(a) 
I {This phase will be accomplished
utilizing two techniqueszl lThe two techniques for
this phase will be executed as follows:

 

  

3.C.5.A.

 

   
 

(tam ea: 1.4a)

operators 

 



 

 

Sec 1.4(3)

 

 

3.05.3. ml



 

 

Sec 1.4[a}

 

 

 

 

 

 

 

 

 

 

 

 

 

  

 

 

 

{b1t1}Sec1.4la} I operators will utilize the
Sec 1.4(a)
{mu Sec 1.4{a} TF-
ARES will utilize  
I . 
3 6 Phase VF 
See 1.4(a}
I

 

 

 

l3

 

 

 

 

3.0.7. Phase V1 (moi Sec 1.4a;



 

 

 

 

These actions fall into three distinct categories:

3.C.7.A. WI 
.I will
utilizel IOperators will utilize the normal and

 

 

(hm) Sec 1.4(a)

 

 

 

 

3.C.7.B. WI 

 

 

 

 

 

 

 

 

 

 

 

 

eec 1.4(3) will utilize [new See 

Sec 1.4{a}
B) JTF-ARES will  (em) Sec 1.4(e} I

USCYBERCOM, JTF-ARES operatorsl 

 



 

 

 

3.09. (U) Fires Sunnort Coordination Measures.

 

3.C.9.A. (UHEQUQ) Decon?iction. Aim points will bel 

Sec 

 

 

 

 

3.C.9.B. (UHEOUO) Pre-Mission. Pre-mission requirements are contained in the pre-mission
checklist which is maintainedl . in the USCYBERCOM Joint
Operations Center (JOC). Set ALERT CONDITIONS IAW the Cyber Tasking Order (CTO).

 

 

3.C.9.C. (UMEOUO) Fires Execution List. The mission will be executed IAW the CTO and the
mission execution checklist. The mission execution checklist is maintainedl (b}(1}Sec 
(bit-itslhe USCYBERCOM JOC.

 

3.C.9.D. (SW Mission Abort. The USCYBERCOM JOC, or the Mission
Commander ma},r order mission abort. headquarters or

agencies must be veri?ed with the supported command and the USCYBERCOM 

 

 

l4-

 

(hm) Sec 1.4(a}

 

 

 

3.C.9.E. Abort Procedures. When the order to abort mission is
received or veri?ed by proper authority, the USCYBERCOM 0C Watch Of?cer will
immediately contact the Mission Commander to relay the order. The Mission Commander will

i  the USCYBERCOM 0C
Watch Of?cer.

3.C.9.F. Cease Fire Authorit . The USCYBERCOM JOC or the JTF-
ARES Commander may order cease ?re. lheadquarters or
agencies must be veri?ed with the supported command and the USCYBERCOM OCllilo) Sec 



 

 

 

 

 

 

 

 

 

3. C. 9. G. Cease Fire Procedures. I

received or veri?ed by proper authority, the! (blt1lsec1 411a} iwill immediately contact the
Mission Commander to relay the order. The Mission Commander (mm Sec 1.4(a) I

?The Mission Commander (am) See 1.4{a}

USCYBERCOM JOC Watch Of?cer.

3.C.9.H. (SW Re-En a Authorit . The order to re?en can be iven
by the USCYBERCOM (mm as; 1.4(a) I

(-1eadquarters must be veri?ed with the supported command and the US CYBERCOM
0C.

 

 

 

3.C.9.I. (SW Re-Engage Procedures. When the order to re-engage is
received or veri?ed bv proper authoritv. the USCYBERCOM 0C Watch Of?cer will

immediately contact  tb}(1}3ec 1.4ia) ito relay the order.
The Mission Commander will] IThe Mission
Commander will] 
USCYBERCOM OC Watch Of?cer. 

 

 

 

3.C.9.J. WW Continued Engagement and Targets Elements-of-
Opportunity. (bit 1) Sec 14(3) JTF-ARES will monitor for

 

 

 

Sec 1.4{3}

 

 

 

(b){1)Sec will ensure that? 1.4(a) I

 

 

1.4g.)

 

 

 

Noti?cation from IUSCYBERCOM JOC will

 

15

 



 

 

 

3.010. (U) Risk Analysis.
3.C.10.A. (if-SW31) Infrastructure. JTF-ARES will usel i

Sec 1.4(3)

 

 

 

 

 

(SALRE-LJEQ-USATBLESQ Risk Analvsis and Mitigation. I

 

 

 



 

 

3.C.10.C. Risk 1. USCYBERCOM operations couldl 

 

 



 

 

 

 

3.0101). 93W Mitigation 1. (mm Sec 1.4m)

Sec 1.4{a}

 

 

 

 

 

3.C.10.E. (SW Risk 2. I 

I Sec 1.4(a}

 

 

3.C.10.F. Mitigation 2. JTF-ARBS retains  Sec Mia)

 

 



 

 

 

?i t" 10 (SHREL T0 USA. 3. 
1.4a.)

3.C.10.H. Mitigation 3. JTF-ARES I



 

 

 

 

 

 

 

 

 

 

3.D. (U) Tasks.

3.D.1. (U) JTF-ARES.

3.D.1.A. (UHEOUQ) Joint Intelligence Support Element Provide intelligence

analysis and planning as required, including intelligence assessments, estimates, and other

16

intelligence products ISO the commander?s decision-making process, 
I 

 

 

3.D.1.B. JTF-ARES 12 Collection. Coordinate, and provide end-to?end
collection management support to all-source intelligence with the IC ensuring management of
needsr?requirements.

3.D.1.C. LOE 2. Identify partnerships with external organisations to
implement method. 

3.D.1.D. JTF-ARES LOE 2. Re?ne planning with partners for execution of
identi?ed method.

3.D.1.E JTF-ARES J3. Coordinate and ensure (menswear 

ltd-(1) Sec 1.4(a)

 

 

 

 

3.D.1.F. (W J3. Assign an OGS (blt1JSEc1-4fal

Sec1.4(a)

 

 

 

 

3.D.1.G. (UHLEQUQ) Fires. Ensure OGS is integrated and executed
Sec 

 

3.D.2. (UHEQUQ) CMT 701.

 

 

Sec 1.4[a]

 

and execute OGS.

 

3. D. 2. (SAW Support JTF-ARES assessmentsl I

Sec1. Ma)

 

 

 

 

3.D.2.C. (U) Forward requests for additional capabilities to JTF-ARES as required.

 

3.D.2.D. GULLEQUQ) Withiniom) inellmtification by implement tasked method
IAW standard procedures. -

3 D. 2. mono) Provide mission reports (MISREPS) withi ..- ission execution to
support assessment of operation to TF-ARES CUOPS. CUOPS will disseminate report to other
organizations as required.



 

3.D.2.F. BPT support long-term assessments to operational effectiveness and
performance.

3.D.2.G. (UH-130149) BPT provide mission planning updates to TF-ARES.
3.133 (U) Assigned JTF-ARES Forces.

3. .3 A. BPT provide Mission Commanders, operators and ISO this
operation.

3.D.3.B. Ensure qualificationi . 
(bin) Sec Mia)  Iso this operation.

As directedJ 1.4.121) i

 

 

 

 

 

 

3.D.4. (U) 

3.114.111. (W USCYBERCOM J3 coordinate wit 

leverage individual agency authorities and capabilities to support the objectives and effects as
outlined above. Ensure all agency-speci?c actions are and decon?icted with all
other participating agenc}r actions.

3. D. 4. B. (UHEQUQ) USCYBERCOM J3 provideMpersonnel to support research
rehearsals and executions of this operation.

3.D.4.C. (W Coordinate and de-con?ict with (131(1) see 1.4m

(mm Sec 1.4{a} accounts.

 

 

 

 

 

 

3. D. 4. D. (U) USCYBERCOM Staff Judge Advocate (SJA) provide legal opinion to
CDRUSCYBERCOM ISO 008.

3.D.4.E. USCYBERCOM SJA providel (om) Sec 1.4{a} I
opinion regarding thel {b}[1}Sec 1.4{a}  during the course of this
operation.

 

 

 

3.D.4.F. (W311) 12 coordinate withl 


 

 

3.D.4.F. (U) USCYBERCOM J2 provide intelligence support to JTF-ARES as requested.

[3

 

 

3.13.5. (U) Requested Support from IA Partners.

 

 

 

3.D.5.A. (W Support and participate in the process 
1.4(a) land execution.

 

3.D.5.B. (U) Provide intelligence support prior to and during execution. Speci?c intelligence
requirements will be passed by USCYBERCOM J2 prior to execution.

3. D. 5. C. (U) Participate 1n USCYBERCOM appropriate boards, bureaus cells committees and
working groups events ISO this operation

 

3.D.5.D. For units involved in thel Iof the operation,
provide or designate a representative for coordination, requests, and questions to be routed

through.
3.D.6. (U) Requested Support from NSA.

3.D.6.A. Partnering and support. as authorized and appropriate. in

 



 

 

 

3 .D.6.B. (SW RequestI I



 

 

 

 

 

3.D.6.C. (SW Support and participate in the processI (him See 1-4ta) I

 

 

 

 

 

 

 

I (121(1) Sec 1.4{a} Iexecution of OGS.
3.D.6.D. Designate a representativeI {bit?li Sec 1-4ta) I
IUSCYBERCOM Operations.

3.D.7. (U) Requested Support from FBI.

 

3.13.7.9. (W Request FBII 

{tam Sec 1.4(a)

 

 

 

 

3.D.7.B. Designate a representativ I 
I IUSCYBERCOM Operations.

 

 

3.D.8. (U) Requested Support from GCHO.

19

 

 

19W

 

 

3.D.8.A. (W319 Request GCHQ tom Sec 1.4a;

Sec 1.4(3)

 

 

3.D.3.B. (SW Designate a representative from GCHQ 
I Operations.

3.D.9. (U) Reguested Support from ASD.
3.D.9.A. Request ASD Sec 1.4.1.3)



 

 

 

 

 

 

 

3.D.9.B. (SW Designate a representative from ASD 
I Sec 1.4(a) IUSCYBERCOM Operations.

3.E. (UHEQ-UQ) Coordinating Instructions. USCYBERCOM JOC Goccbc@nsa.ic.gov,
joccbc@nsa.smi1.mil, NSTS 966873018772, COMM 240-373?3142f3111f8115, STE 240-3?3-
8130) will serve as the point of contact (POC) for cyberspace operations and
decon?icticnl Ipartners are re-uested to provide liaison of?cer coordination to-
I {we} _@nsa.ie.gov@nsasmilmil, NSTS 969-3452) no later
than three days after receipt of this order. ease see Ref for other concerns}!

 

 

20



100100 DEC 16
FROM: USCYBERCOM FT GEORGE MEADE MD

TO: CDR USSTRATCOM OFFUTT AFB NE

CDR USCENTCOM MACDILL AFB FL

HQ USSTRATCOM OFFUTT AFB NE

HQ USCENTCOM MACDILL AFB FL

USSTRATCDM COMMAND CENTER OFFUTT AFB NE
03D WASHINGTON DC

INFO: USCYBERCOM FT GEORGE MEADE MD
CDR USAFRICOM STUTTGART GE

CDR USEUCOM VAIHINGEN GE

CDR USNORTHCOM PETERSON AFB CO

CDR USPACOM HONOLULU HI

CDR USSOCOM MACDILL AFB FL

CDR USSOUTHCOM MIAMI FL

CDR USTRANSCOM SCOTT AFB IL

HQ AFRICOM STUTTGART GE

HQ USEUCOM VAIHINGEN GE

HQ USNORTHCOM

HQ USPACOM HONOLULU HI

HQ USSOCOM MACDILL AFB FL

HQ USSOUTHCOM MIAMI FL

24AF LACKLAND AFB TX

CDRUSACYBER FT BELVOIR VA

COGARD CYBERCOM WASHINGTON DC
FT GEORGE MEADE MD
MARFORCYBERCOM FT MEADE MD

CNMF FT GEORGE MEADE MD .

JFHQ DODIN FT GEORGE MEADE MD

DIA WASHINGTON DC

DISA FT GEORGE MEADE MD

DSS WASHINGTON DC

DTRA OPSCENTER WASHINGTON DC

MDA WASHINGTON DC

NGA WASHINGTON DC

NRO WASHINGTON DC

NSA FT GEORGE MEADE MD

NSACSS FT GEORGE MEADE MD

JOINT STAFF WASHINGTON DC

JOINT STAFF J3 DEP-DIR GLOBAL OPS WASHINGTON DC
DEPT OF HOMELAND SECURITY WASHINGTON DC
DHS OPERATIONS DIRECTORATE WASHINGTON DC
FBI WASHINGTON DC

DEPT OF STATE WASHINGTON DC

DEPT OF TREASURY WASHINGTON.DC

DEPT OF JUSTICE WASHINGTON DC

DEPT OF JUSTICE COMMAND CENTER WASHINGTON DC
CIA WASHINGTON DC

CDRUSACYBER PASS TO: CDR JTF-ARES FT GEORGE MEADE MD

$0 USAT 

WW

SUBJECT: USCTEERCOM GENAOMIN 16H0210 {mn)SecL?m) OPERATION GLOWING


OPERXOPERATION INHERENT 

OPERATION GLOWING

TO USA, PUEyifx





THE PURPOSE OF THIS MESSAGE IS TO NOTIPT COMBATANT COMMANDS,

SERVICES, AGENCIES, AND FIELD ACTIVITIES OF 
STATES CHEER OPERATIO YMPHONY

SUPPORT OF OPERATION INHERENT RESOLUE 

 

12 (SIERRA TO UNITED STATES CYBER COMMAND 
INTENOS I

 

GLOWING 
DAYS. USCYBERCOM WILL CONTINUE TO OPERATE IAW ALL ELEMENTS DETAILED IN THE

 

 



 

 

 

2. TO REESE THISI {MOISecm4g}

 



 

 

3.A. (U) PRIMARY POINTS OF CONTACT (POC):

3.A.I. (UIIEQUO) mum VEO-OPT

NSTS: 969*6671

COMM: 
NSANET: (mm) -NSA.IC.GOU

3.A.2. mum USAF, 
NSTS: 959?0092



mum -NSA.IC.GOV

3.3. (U) ALL DOD COMPONENTS WILL ACKNOWLEDGE RECEIPT AND UNDERSTANDING OF
THIS MESSAGE WITHIN 24 HOURS VIA OFFICIAL MESSAGE TRAFFIC OR EMAIL TO:



 

 

3.C (U) REQUESTS FOR INFORMATION REGARDING THIS MESSAGE, AMPLIFYING GUIDANCE,
ANDKOR ADDITIONAL DETAILS ARE TO BE SUBMITTED TO:

USCYEERCOM SIPR RFI PORTAL -


 

 

USCYBERCOM JWICS RFI PORTAL 


 

THE HG, USA, USCYBERCOM,
J3, DIRECTOR OF 

 



CLASSIFIED EY: 
DERIVED FROM: USCYEERCOM SCG
DATED: 20161208

DECLASS ON: 20411207/f

WHEY

 

. 5:Progress Review

 

.-

 

 

 

OP GLOWING 

 

56:: 1.4[aj

 

 

07 OCT 2016

 

The overall CLASSIFICATION of this brie?ng is:



Classified mum

Derived From: USCYEERCOM SCG
Dated: 20160722

AND

Derived From: 1-52
Dated: 20070108

Declassi?r On: <25 Years from date of
document, format 

 Roll. Call
USCYBERCOM

POLAD



beer Components
CNMF



ARCYBER
JFHQ-C IMARF ORCYB ER
FLEETCYBER
AFCYBER



artment of Defense


USSTRATCOM

USCENTCOM

USSOCOM

USPACOM

USEUCOM

USSOUTHCOM

USAFRICOM

USNORTHCOM

 

EllnterAgency



CIA

DIA

NSA

NGA (non-voting)
DOS



FBI

TREASURY

Agenda

Decision Flow Chart

Recommendations for Approval

 

 

Operation GLOWING [buns-ac Ute}

 

 

Technique 1' Tactic

Collateral Effects Estimation (CEE)
Intelligence GainILoss

Political Military Assessment (PMA)
Blowback Assessment

Legal Review

Approve TNL to JIPTL

Decision Roll-Call

Guidance Questions



Executive Summary



 

Sec 

 

OGS Decision Point Fl Chart

 

chm) Sec 1.4m; 

 

 

 

 

 

 

 

 

 

 

 

 

0p GLOWING Executive Summary

man-n. 
i - L. 1 :12 53:.

 

- TABS Elle-ii 

 

CDNOPIOPORD

Target

Capability Tactic i Technique

Operational Law Review

Intelligence Gain Loss :th Sac 1.4m
Assessment 

Political Military:r Assessment
(FHA)

Collateral Effects Estimation

Blowbaok Assessment

 

 

 

 

1 Complete

 

- NotStarted In Progress

 

 

Operation GLOWING 

 

 

Sec 

 

organized campaigns. Operation GLOWING 

 

 

1.41:3)

 

 

(MU) Sec 1.4m}

 

 

 

[bj?l Sec 1.4113}

We assess GLOWING

 

 

will

 

(mm Sac 1.4m

 

 

mm Sec. 1.41.3}

 

 

 

 

Operation GLOWING Overview

 

 

 

 

 

 

 

 

USCYBERCOM will 

Sec 1.4[3]

 

 

 

(mm Sec 1.4(31

 

 

 

 

 

GLOWING Overview

Offensive Cyber Operations

 

 

1.4m}

 

 

 

 ISIL Media Framework and Functions

 

DEVELOP DISTRIBUTE DISSEMINATE DEFEND
Create, edit. ?nish Prepare. stage 8; Proliferate ISIL Sustain ISIL
ISIL products publish ISIL products message message

 

 

Sec 1.4(a}

 

 

 

 

 

 

 

 

Techni uelTactic Descri tion

 

 

 

 

 

 

 

 

 

 

Approval: Technique I Tactic

Operational Impact

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

{mm Sec 1.41:3}

 

 

 

 

(him Set: 1.4[3]

 

 

 

 

 

 

 

1- (U) - (TSHSIHREL USA. FVEY) 
2. (U) {bHHSeoLdl?a} I
3. (U) - (TSNSIHREL USA. ?Home, 1
4- (U) 
5. (U)
Sec 1.4m;
Recovery Methods Current Status
- (TSHSIHREL USA. meme . (TSHSIHREL USA, FVEYH ertuSetha:
are valid

10

2522 

 

u'l
I .

WM, iApproval: intelligence 

 

(U) Intelligence Gain Assessment:

 

 

 

Overall Gain Assessment (mitts-3314(3) 

 

(?sesame-me estimated intelligence gain from this operations is assessed

 

(bit-?Ii Sec1.4(a}

 

 

 

(U) Intelligence Loss Assessment:

 

Overall Loss Assessment [him See 1.4m

 

 

 

overall estimated intelligence loss is asaesse- 1 Sec 1.4 a

 

(NH) Sec 141(8)

 

 

 

 

 

. . 
"1:151 IlJ_l it: 

(U) Probabilitv of Detection (POD):

 

 

Overall Assessment

Effect I . 1er Sec 1.4m:-

 

 

Capab?ky



 

 

 



 

 

 

(Ln Probabilitv of Attribution POA):

Overall Assessment

 

Perceived thit1i Sac 1-4tai

 

 

 

Technical

 

 

 

 

estimated probability of attribution is tbitii 56: 1.4m)

 

(him See 1.4m)

 

 

 

tb]{1} Sec 1.4m

 

[him See 1.4m}

   

 

(U) Political Military Assessment (PMA)

(U) Middle East Countries: 
(mam-4m

 

(hm) Sec 1.4{21

 

 

 

 

Countries in the region[ 

- (U) RUSSIA and China:

 

 

 

 

 

 

Wer th}i1iSethai the cyber operational 
and use it as an opportunity to place the UST i
(SHN F) I {him Seo1.4(a} i

 

(mm Sec 1.4m} I

(U) Third Party Host Targets Worldwide

 

 

 

 

 

 

 

 

 

(SHNF (mm Sec 1.402: I
(SHNF) (mm 1.4{31 I
Sec 1.4m 
(mm Sec 
(SH-NF) For several third partyl 

 

 

(mm See 1.4m; I

 

seesaw-em

I Approval: Blowback Assessment

 

 

 

 

 

PURPOSE: This blowback assessmentl i
I Sec1.4{a} I

USCYBERCOM against the Islamic State in Iraq and the Levant 

 

 

 

 

 

 

 

 

(Wrobabilitv of Attribution lPoAl: Confidence to Defend DODIN:
USCYBERCOM has a variety of capabilities that could be {hil135ec1.4la] I- At this time ISIL has no demonstrated capability
[hm] Sec-14(3)
{hm} Sec 1.4[3]

 

 

 

 

 

 

 

 

Overall Assessment: USCYBERCOM J3F Ops assesses that risk of
blowbacki ibll1lSEcl4tai I

 

 

 

{him 32:: 1.49}

 

 

 

(U) USCYBERCOM SJA

There IS no Ie al ob ection to conductin the activities ro
GLOWING CONOP

Approval: Legal Review

(hm) Sec 1.4m}

 

osedinthe



 

 

{hm} Sec 1.4[2]

 

 

15

 

 

{mm Sec1.4(a}

 

 

Network

NOMINATED BY: 

 

muusacma:
Sec 1.4{3}

ampaign. (W

 

 

 

 

 

 

 

 

 

 

 

 

$301413}

 

 

 

 

 

 

 

 

 

 

 

I
(mm sec 1.4(31

(mm Sec1.4[a]
TARGET LOGAHON: (emu-Hm ?31(1) Set: 1.4m; 
{hm} 5961-4113} . 

i

 

 

?31(1) Sec 1 

 



 

Target Priority and Target Assignment

Primary Target Set

 



COUNTRY.

 

 

[mm Sac 1.4m)

usacokunok-i?

usaooA?noN'l'

. 5:31;: ..

 

.- sea?cme mm: 
. usammnou

us a mmnou -

Us oonuno? 
UaacoALmlo

ue 

usfa. domino?
Usaeomnou 
us' - ..
u's'aoomnou . -
u's'a coauhok':
,Uaaconunong
3? - Tus??
Us..


. .. .us

US I


 

+r'u nrr- EHEVIEI l'l

 

PRIORITY

Follow-on Target Set

- COUNTRY



 

 

(bi{1}5ac 1.4m

Coaiition
Coalition
Unknown
Unknown
Unknown
Unknown
Coalition
Coa??on

Unknown
Unknown

Coalition
Unknown
Unknown
Unknown
Unknown

 

 

 

Legend

Unknown

 

 

1. 5e: 1.4m

 

 

 

 

 

Sec 1+4(a}

 

 

 

 

 

nr-l vnllen 

Recommendations

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Primary Target Set Follow-on Target Set
mam senwcma AGENCY Pal aancma AGENCY . .1hlt115961+4{33'
US COALITION Caa??nlf II . .
USE-COALIHOH . . I
usacoALmaH . I. Unkna'wr'lI" - a
USE-COALITION Unk?own. - 
usa. conunou - Unknown 
. USS-COALITION I 
US .. -T 'Caariti'cn}
usacoanon I Coalition 
usacoALmnH 3 II (DJ-I??ecmcaj - Unknuw'n': 
us Uriknoir'n" 
us a common Coall?an'
US - -. Unkn?wrl'.
tbu1:5ac1.4ca) bn115ec1.4:a . Unknown-,I-
us Unknown . I
us Unknown-
?5 Unknaim --
us 
us Legend
Coalition 0
us
us

 

 

 

 

 

 

 

 

 

 

{mm San: 1.4m

 

 

 

 

 

I I Recommendation for Approval

 

USCYBERCOM JTCB Chair Approval and JIATF Concurrence

 

 

 

{me Sec 1 Alia} ROVAL Approve Disapproye

Operation GLOWING 
approval 

 

 

 

 

 

 

 

 

 

 

"De

 

artment of Defense Comments
- .

USSTRATCOM 
USCENTCOM 
USSOCOM
USPACOM
USEUCOM
USSOUTHCOM
USAFRICOM
USNORTHCOM

 

 

 



 

[mm Sec 1.4m;

 

 

 

19

U?m:m 20:50:23

Eng

 

 

m3 :3

 

 

ma

 063 Proposed Public Affairs Guidance

. Public affairs posture is ?response to query? only

0 OSD PA retains release authority

 

 

 

 

Statement If in general 
networks:

 

 

{bj?j {?11115}

 

 

 

 

If asked momma} Iby credible third-party cyberseourity expert or
cyberseourity corp):

 

 

thii?l) 59G 

 

 

 

 

 

Overarohing theme,l museums loyber operations:

[him See 13(3)

 

 

 

0 Approved by OSD-PA

21

 

Guidance and Questions

. 22

 0.02.3.0: 9.05.20 m<



 



 

 

 

man fig

 

 

 

Operation GLOWING 

I Prioritized Country List

 

 

Sec: 1.4[a]

 

 

AG REED OPEEATION NOTIFICATION PLAN

 



 

 

 

 

No

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

m} NSTS: gas-352553141093?
mm mama

Netherlands lie-cm? H515: 953-3111

 

 

 

{mm Sec 1.4(a}

 

 

 

 

Non:- ?t NA him
I um (blt1JSBG1-j48) - mmaegmga: 

 

 

 

 

 

Sec 1.4(a)

 

 

 

 

None

 

None
Mane.
Nana
None
None
None



Sec 14-53

A



 

 

 

an roam! runs: 959-33253931-3709 mm 
krael mm: mm: 919-1??

Ne'lhmlands PD I ?3 

 

JTF-ARES
Operation GLO WING 

THE OVERALL CLASSIFICATION OF THIS BRIEFING IS
WEN 
Derived from: MuI?pIe Sources






Operation GLOWING 

 

 

 

 

 

 

a r: is seeking an em} 5e: men Operation GLome authoritiesm
I See 1.4m I

 

 

 

 

 

Background: Operation GLOWING {him See 1.4m ['l'herefore, CONOP as
a- -roved  (hm) See 1.4m ICONOPs is not addresse -M=i
i-Mr?his brie?ng provides mm, Sen W, on for conuscvasncom's

consideration.

 

 

 

 

 

OGS Purgose: (ADM Rogers)

 

(him See 1.4{3}

 

 

 

065 End state: (065 

 

{hm} See 1.4(3)

 

 

 

 

 

 

chm) Sec Mia) Op GLOWING We anticipate that conductin a M11 596 Mia)
(b)(1)3ec 1.4m)

jCyber Operations and ultimately. the desired end state.

 

  

 

 

 

 

 

Operation GLO WING YMPH 0N Assessment


 

 

 

 

 

 

 

 

USCYBERCOM assesses that 065 has 

Sec 1.4m}

 

 

 

 

 

 

(rammecmcay Further OGS (b1t115ecmta:

 

 

 

 

 

 

 

Sec 1.4{aJ

 

 

 

 

 

 

 

Sec 1.4(2)

I .1..-

Phase 2 Phase 3

 

(Inn) Sec 1.4{a)

 

 

 

Reflections

 

 

 

{b}(1}3ec 1.4(a)

 

 

 

 

[131(1) Sec 1.46:]

 

 

Sec 1.4(31

 

-

.- sue-:5 Mann?.4.

       

 

 

 

 

Operation GLO WIN 

Future Operations

 

- Intelligence Operations

 

I
Sec 1.4{a}

 

 

 

 

- Cyberspace Effects Operations

Sec 1.4{a}

 

 

 

 

 

(hm) Sec 1.4{a}

 

 

 

 

 

{hm} 5ac1.4[a)

 

 

 

 

Operation GLOWING IMPHONY
COA Comparison

 

 

(hm) Sec 1.4(a)

 

 

 

 

 

There is no legal objection to the proposed COAs.

 

031(5)

 

 

 

. . 
L511 

 

operation GLOWING 
COA Recommendation

 

Recommend approval of COA 2:

 

Sec 1.4{a}

 

 

 

 

  

.9. Operation GLOWING MPH ONY
egg Lessons Learned (what we did not expect)



 

(bm) Sec 1.4m

 

 

 

 

Operation GLOWING smpHoNY
ta i 

 

 

(mm Sec 1.4(a)

 

 

 

 

 

Phase 1 Phase 2 - Phase 3 Phase 4

(bun SEC 1.4(31

 

 

 

 

 

 

Targd?'ll Sec 1.5km

 

. (hm) Sec 1.4(a)

 

 

 

Ob'ective and Effects

 

 

 

Sec 131(8)

 

 

 

 

 

{hm} 335 14(3) .W su- - aim-1T? j. 

  

?3-1113?. 



lnitial Ex ectatians

 

 

(mm Sec1_4(a)

?51(1) Sec 131(3)

 

 

 

 

 

      

Lina!- gagi Operational Assessment Framework
as Task Accomplishment

'4

  

 

OPERATION GLOWING 

 

 

Sec 1.4(a)

 

 

INDICATORS:

 

Legend
. Successful task accomplishment

Successful with some limitations
. Unsuccessful
. Not evaluated

(bif?li 1 Information Cut-eff: 16

THIS CHART IS CLASSIFIED: TOP SECRETHSIHRELTD USA. WET

memes -