They should be used to gain physical access to hardware and people, for the purpose of applying the xkcd decryption heuristic[1]. Leave the hacking to the experts.
Not all Soldiers are incompetent. Some of the most brilliant people I've met are people that I met while I was in the Army. China has created numerous units that focus on offensive hacking, and they are wildly successful.
Now, to clarify, I'm not saying that we should have troops performing cyber attacks, I'm just saying that it isn't necessarily an endeavor that's doomed to failure. You seem to be making the assumption that people in the military can't be as good at something as a civilian. That's simply not true. There is a lot of talent in the Army, its just that the organization and its rules are making it hard to be effective.
On the other hand, while this is admittedly very anecdotal, one really obvious common thread that I see in the vast majority of great hackers I've met has been a distrust (if not borderline disdain) for authority and seemingly needless process; which I have to imagine (having never served myself) doesn't fly really well in the military.
You are right, and I am one of those people, but there are some brilliant people out there who for some strange reason I cannot comprehend, love every fucking thing about the military. There are also those of us who do feel the way you described, that stay because we foolishly think we might some day be able to make the military a better place.
Where I work now, there are lots of former military members. All of us are happy that we don't have to deal with the bureaucracy, but most of us don't regret the time we did spend in the service.
I specifically said that I wasn't advocating this as a military mission. I was just stating that if it was a military mission, the Soldiers themselves wouldn't be the reason that it fails.
>Grunts wearing camouflage sitting in front of a laptop trying to outbrain someone seems humorously perverse.
A grunt is an infantryman. Not all Soldiers are grunts. The Soldiers that work as security analysts do it as a full time job. They still have to take a couple PT tests each year and qualify once or twice a year with an M16, but they spend most of their time doing their job.
I'm not sure how wearing camofluage affects a person's ability to use a computer? They are people like everyone else.
The biggest downside, I think? As a civilian, it is my right to walk off a job at any time. Sure, there are expectations that I'll give you some notice (and I will) but worst comes to worst? I can always walk, and the worst my employer can do is call me bad names.
In the military, those contracts? they mean something. Yeah, you can ask to be transferred around; hell, I know someone who was able to actually quit the navy half way through basic, but it was a big fucking deal.
I mean, there are advantages to the military, too. I'm not saying it's a bad choice for everyone. I'm just saying that wearing dorky pants doesn't even make the list.
The military, like most government jobs, makes a lot of sense for someone who values stability. There are plenty of skilled people that value stability over the ability to leave; I'm just not one of them.
Amusing side note, the MD5 hash of CYBERCOM's mission statement, "9ec4c12949a4f31474f299058ce2b22a", is to my knowledge the only hash emblazoned on an agency seal.
Also, if you were an officer, how willing would you be to trust a hacker from another agency, if you didn't have someone you trusted to vet their advice?
There'd also be concerns about red tape. If a low ranking officer isn't sure about something, can they put in a tech support ticket to a three letter agency?
I say that flippantly, but I mean that quite seriously. With the amount of resources available to the US military, I see no reason why they should constrain themselves to only a subset of capabilities, especially if the one they're cutting is less capital-intensive.
I absolutely agree that the "$5 wrench algorithm" is a rational choice for the military to pursue: not only is it more available to them than to other organizations, it also aligns more closely with some of their existing core competencies. But that doesn't need to, and shouldn't be, pursued to the exclusion of other approaches.
Can you imagine the difference in reaction if we sent door-kickers on the ground to Natanz and smashed the Iranian centrifuges, rather than using Stuxnet?
The problem here is that there is a fundamental tension between hacking (or "advanced penetration testing" or "ethical hacking" or whatever) and the structure of the military.
The military relies upon rules and procedures to accomplish repeatable tasks at massive scale. Hacking is an individual or small collective endeavor that involves non-linear thinking and creative leaps.
Right now, they're trying to figure out how to work around that tension, and all we're seeing now are the early tests.
The uniformed forces might have hackers, sure. The Coast Guard has heavy machine guns, but the US doesn't rely on them for naval defence - it's also got a whole other force (the Navy) which can do the heavy lifting.
If the Army doesn't have hackers to win cyber wars, it has hackers because it's a huge organisation that needs internal cyber security expertise.
First, you have to find it...