NOTE-025: Joint Publication 3-12, Cyberspace Operations

Contribution

The publication sets out the unclassified US joint doctrine for cyberspace operations, replacing the classified 5 February 2013 edition (Summary of Changes, p. iii; supersession, p. D-1). It provides:

• a single taxonomy that assigns every non-routine military action in cyberspace to one of three missions (OCO, DCO, DODIN operations) and one of four actions (security, defense, exploitation, attack);
• the Cyber Mission Force structure under USCYBERCOM (CPF, CNMF, CCMF);
• two command-and-control models, routine and crisis/contingency (Figs. IV-1, IV-2);
• ten new or revised definitions approved for the DOD Dictionary (pp. GL-4–GL-5).

According to the Summary of Changes, the revision also reflects USCYBERCOM as a functional combatant command and adds “information” as a joint function (p. iii).

Key insight

The publication’s organizing rule is that a mission’s category follows from the issuing authority’s intent, not from what is done on the network. Missions “are categorized as OCO, DCO, or DODIN operations based only on the intent or objective of the issuing authority, not based on the cyberspace actions executed, the type of military authority used, the forces assigned to the mission, or the cyberspace capabilities used” (p. II-2). Location then decides which authorities are needed:

• Standing orders cover DODIN operations and DCO-IDM inside blue cyberspace.
• Any action in foreign (gray/red) cyberspace “requires separate OCO or DCO-RA mission authorities” (p. II-5).

The same technical act, such as exploitation of a foreign node, can therefore fall under OCO or DCO-RA, and the difference is the commander’s intent.

Assumptions

What the publication rests on. These are authorities and premises it names; it does not argue for them.

• Source of authority: the US Constitution and federal law, with Titles 10 (Armed Forces), 50 (War and National Defense) and 32 (National Guard) named as key (pp. xiii, III-2). The primary references also list:
  • EO 12333 and EO 13800;
  • PPD-20 (US Cyber Operations Policy), PPD-21 and PPD-41;
  • HSPD-5 and NSPD-54/HSPD-23;
  • NSD-42;
  • the 9 May 2007 Trilateral MOA among DOD, DOJ and the IC on CNA/CNE;
  • the Goldwater-Nichols Act (App. C, p. C-1).
• Delegated/order-based authority: specific CO authorities come from SecDef policies and from EXORDs/OPORDs authorized by the President or SecDef. This includes DACO, established by CJCS EXORD (p. III-2). C2 follows the “CJCS 011612Z February 2016, EXORD to Implement Updated Cyberspace Operations Command and Control Framework” (p. C-3; cited as “existing CJCS C2 EXORD”, p. IV-11).
• Legal frame: DOD conducts CO consistent with US domestic law, applicable international law, and USG/DOD policy. “The laws that restrict military actions in US territory also apply to cyberspace” (p. III-11). The executive summary says “regulate” (p. xiv).
• Law of war: it applies “during all armed conflicts and in all other military operations”. Its principles are military necessity, proportionality, distinction, and avoidance of unnecessary suffering, “all of which may apply to certain CO” (p. III-11).
• Premises about the domain, stated as fact: cyberspace is “wholly contained within the information environment” (p. I-7); “there is no stateless maneuver space” (p. I-12); and “Permanent global cyberspace superiority is not possible” (p. I-2).
• Scope: “the military component of CO is the only one guided by joint doctrine” (p. II-1). National intelligence and ordinary business operations are mentioned only for context.
• Authority of the document itself: it is “authoritative”, to be followed “except when, in the judgment of the commander, exceptional circumstances dictate otherwise”. It takes precedence over Service publications unless the CJCS has given more current guidance (Preface ¶3.b, p. i).

Key results

What the publication establishes, defines or holds.

Definitions

• Cyberspace: “A global domain within the information environment consisting of the interdependent networks of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers” (GL-4; source JP 3-12). The body says “the domain” (p. I-1).
• CO: “the employment of cyberspace capabilities where the primary purpose is to achieve objectives in or through cyberspace” (p. I-1). “Cyberspace forces are those personnel whose primary duty assignment is to a CO mission” (p. I-1).
• Three-layer model (p. I-2–I-4; Fig. I-1):
  • The physical network layer is “the first point of reference CO use to determine geographic location and appropriate legal framework” (p. I-3).
  • The logical network layer: logical-layer targets “can only be engaged with a cyberspace capability” (p. I-4).
  • The cyber-persona layer: user accounts, human or automated, and their relationships. One person may hold many personas and one persona may have many users (p. I-4).
• Blue/red/gray cyberspace (pp. I-4–I-5):
  • Blue: areas protected by the US, its mission partners, and others DOD may be ordered to protect. DOD’s standing orders are to protect only the DODIN.
  • Red: owned or controlled by an adversary. “Controlled” means “the ability to direct the operations of a link or node … to the exclusion of others”, not mere presence.
  • Gray: everything else.
• Access: “a sufficient level of exposure to, connectivity to, or entry into a device, system, or network to enable further operations”. Access “is not guaranteed” (p. I-5).
• Missions (pp. II-2–II-5; GL-4–GL-5):
  • DODIN operations: “secure, configure, operate, extend, maintain, and sustain DOD cyberspace …”. They are network-focused and threat-agnostic, include red-teaming, and exclude CIO provisioning under statutory authority.
  • DCO: “Missions to preserve the ability to utilize blue cyberspace capabilities and protect data, networks, cyberspace-enabled devices, and other designated systems by defeating on-going or imminent malicious cyberspace activity” (GL-4). DCO are threat-specific.
    • DCO-IDM: within the defended network; authorized by standing order; “Most DCO missions are DCO-IDM”.
    • DCO-RA: “external to the defended network … without the permission of the owner of the affected system”. Normally in foreign cyberspace. Some DCO-RA “may include actions that rise to the level of use of force”.
  • OCO: in the body, “CO missions intended to project power in and through foreign cyberspace through actions taken in support of CCDR or national objectives” (p. II-5). In the glossary, “in and through cyberspace” (GL-5). Rule: “All CO missions conducted outside of blue cyberspace with a commander’s intent other than to defend blue cyberspace from an ongoing or imminent cyberspace threat are OCO missions” (p. II-5).
• Actions (pp. II-5–II-7; GL-4):
  • Cyberspace security: preventive, within protected cyberspace.
  • Cyberspace defense: defeats threats that have breached or threaten to breach. Security and defense together are called “protection”.
  • Cyberspace exploitation: includes “all actions in gray or red cyberspace that do not create cyberspace attack effects”.
  • Cyberspace attack: “noticeable denial effects (i.e., degradation, disruption, or destruction)” or manipulation leading to denial in the physical domains. It is “a form of fires” and is coordinated with other USG departments.
  • Deny sub-effects:
    • degrade: a percentage of capacity;
    • disrupt: complete but temporary, “a special case of degradation where the degradation level is 100 percent”;
    • destroy: complete and irreparable, “scoped according to the span of a conflict”.
  • Manipulate: deception, spoofing and similar, “to create physical denial effects”.
• Countermeasures (pp. II-7–II-8):
  • Internal countermeasures fall under DCO-IDM.
  • External countermeasures fall under DCO-RA or OCO. External defensive countermeasures “are normally nondestructive/nonlethal”, typically affect only the malicious activity, and “terminate when the threat stops”.
• Cyberspace-enabled activities (p. II-1) are uses of cyberspace that are not one of the three missions, such as running C2 or logistics systems or sending e-mail. They need no special authority beyond being an authorized user. The publication says it is “through these uses of cyberspace that the majority of DODIN vulnerabilities are exposed”.
• Terminology: “cyberspace security” (the tactical action) is deliberately distinguished from the policy term “cybersecurity”, which in DOD/USG policy covers both security and defense (note box, p. II-6).
• Adversary activity is called “malicious cyberspace activity”, because intent is usually unknown (pp. II-9, IV-7).
• Also defined: DACO; cyberspace superiority; and “information assurance: None. (Approved for removal from the DOD Dictionary.)” (GL-4–GL-5).

Forces and command relationships

• CDRUSCYBERCOM commands “a preponderance of the cyberspace forces that are not retained by the Services” (p. I-8) and exercises COCOM of the CMF. USCYBERCOM has three lines of operation: secure, operate and defend the DODIN; defend the nation; and support CCDRs (p. I-8).
• CMF components (p. I-9, Fig. I-2):
  • CPF, made up of CPTs;
  • CNMF, made up of NMTs, NSTs and national CPTs;
  • CCMF, made up of CMTs and CSTs.
• Normal assignment: DCO-RA goes to NMTs, OCO to CMTs (p. II-8).
• The Coast Guard Commandant retains OPCON of Coast Guard cyber forces supporting DOD (p. I-9).
• Routine C2 (pp. IV-12–IV-15; Fig. IV-1):
  • CDRUSCYBERCOM has COCOM of all GFMIG-assigned cyberspace forces.
  • CNMF commander has OPCON of NMTs/NSTs and national CPTs.
  • JFHQ-C commanders have OPCON of CMTs/CSTs.
  • JFHQ-DODIN has OPCON of DODIN CPTs, TACON of SCCs (for DODIN operations/DCO-IDM only), and delegated DACO over all DOD components.
  • CCDRs have COCOM of assigned cyberspace forces and OPCON of CCMD CPTs.
• Crisis/contingency C2 (p. IV-15; Fig. IV-2): USCYBERCOM retains OPCON of forces it provides. The receiving CCDR gets TACON of a mission-tailored force package “to control the timing and tempo”.
• Supported/supporting: CDRUSCYBERCOM is the supported commander for CO spanning multiple geographic AORs and for global CO (pp. III-5, IV-11). CCDRs are supported for CO in their AOR (p. IV-12).
• CDRUSCYBERCOM is “the DOD focal point for interagency deconfliction of all actions proposed for OCO and DCO-RA missions” (p. IV-18).

Roles of other departments (Ch. III §3.n–o)

• DHS: “responsibility to secure US cyberspace, at the national level, by protecting non-DOD USG networks”. Per PPD-41, DHS is lead for “cyberspace incident asset response” (pp. III-10–III-11).
• DOJ/FBI: leads counterterrorism and CI investigations. The FBI is lead for “significant cybersecurity incident threat response activities, except those that affect the DODIN or the IC” (p. III-11).
• DOD’s national defense missions, “when authorized by Presidential orders or standing authorities, take primacy over the standing missions of other departments or agencies” (p. III-1).
• Outside the DODIN, DOD cyberspace forces “are generally limited to operating in gray and red cyberspace only, unless they are issued different ROE or conducting DSCA under appropriate authority” (p. III-11).

Planning and assessment holdings

• Non-DOD DCI: CCDRs may act to prevent loss or degradation only in coordination with CJCS and USD(P), and at SecDef direction per DODD 3020.40 (p. III-2).
• A collateral-effects estimate “is separate from the proportionality analysis required by the law of war”. A CO permissible under the estimate must still pass law-of-war proportionality (p. IV-3).
• Effects are classed as operator-reversible or non-operator-reversible (p. IV-3).
• An intelligence gain/loss assessment is required “to the maximum extent practicable” before maneuver or fires in red/gray cyberspace (p. IV-7).
• All target-access efforts require IC coordination for deconfliction (p. IV-10).
• Certain OCO and DCO-RA missions require review under CJCSM 3139.01 (p. IV-8).
• Development of operational-level MOPs/MOEs for CO “is still an emerging aspect of operational art” (p. IV-22).

Claims

id	claim	strength	support
C1	Authority for CO derives from the Constitution and federal law; Titles 10, 50 and 32 are key.	assertion (citing statute by title only)	p. III-2, Fig. III-1. No section of any title is cited.
C2	Specific CO authorities are set by SecDef policy and President/SecDef orders, including DACO by CJCS EXORD.	assertion; the orders themselves are not reproduced	p. III-2. Details are deferred to classified App. A.
C3	All non-cyberspace-enabled military actions in cyberspace fall into exactly three missions, which “comprehensively cover” cyberspace-force activity.	definitional (doctrine by stipulation)	pp. x–xi, II-2
C4	Mission category is set by the issuing authority’s intent alone.	definitional	p. II-2
C5	Any action in foreign cyberspace needs separate OCO or DCO-RA authorities; standing orders cover DODIN operations and DCO-IDM.	assertion of existing policy	p. II-5
C6	Some DCO-RA and OCO actions “may … rise to the level of use of force”.	assertion; no legal test given	pp. II-4, II-5
C7	The law of war applies to CO, and a collateral-effects estimate does not replace proportionality analysis.	doctrine grounded in DOD Law of War Program (cited: DODD 2311.01E, CJCSI 5810.01, DOD Law of War Manual)	pp. III-11–III-12, IV-3
C8	DOD cyber forces outside the DODIN are “generally limited” to gray and red cyberspace, because laws restricting military action in US territory apply to cyberspace.	assertion; no statute named (Posse Comitatus is not cited)	p. III-11
C9	DHS leads national-level protection of non-DOD USG networks and asset response; the FBI leads threat response except for DODIN/IC.	cites authority: Homeland Security Act 2002, HSPD-5, PPD-41	pp. III-10–III-11
C10	”In cyberspace, there is no stateless maneuver space”, so maneuver in foreign cyberspace may be clandestine, without the host state’s knowledge.	assertion	pp. ix–x, I-12
C11	Permanent global cyberspace superiority is not possible.	informal argument (complexity, private ownership, low cost of entry)	p. I-2
C12	The majority of DODIN vulnerabilities are exposed through routine cyberspace-enabled use.	assertion; no data	p. II-1
C13	Command relationships for routine and crisis CO are as in Figs. IV-1/IV-2.	cites CJCS C2 EXORD (Feb 2016), not reproduced	pp. IV-11–IV-15, C-3

Concepts

• cyberspace-enabled activities: uses of cyberspace that are not OCO, DCO or DODIN operations. They need no special authority beyond being an authorized user (p. II-1).
• blue / gray / red cyberspace: defined by protection and control. “Controlled” means the ability to direct a node’s operations to the exclusion of others (pp. I-4–I-5).
• key terrain in cyberspace: holding it gives “a position of marked advantage”. It may need only secure presence, not exclusive control, and the US and an adversary may occupy it at once (p. I-6).
• DACO: authority to issue orders to all DOD components for global DODIN operations and DCO-IDM (GL-5).
• mission-tailored force package (MTFP): a force USCYBERCOM tailors for a CCMD crisis. USCYBERCOM keeps OPCON; the CCDR gets TACON (p. IV-15).
• CO-IPE: a USCYBERCOM planning element co-located with each CCMD in direct support (p. III-6).
• cyberspace security vs cybersecurity: the first is a tactical action; the second is a policy term covering both security and defense (p. II-6).
• operator-reversible effect: one that friendly forces can recall, recover or terminate after execution (p. IV-3).

Connections

It supersedes JP 3-12 (5 Feb 2013), which was classified (p. D-1), and it was itself revised in December 2022 (secondary sources only; see corrections). It depends on JP 3-0 for the joint functions, and on JP 3-60 (targeting), JP 3-13 series (IO/EW/OPSEC/MILDEC), JP 5-0 and JP 6-0. Among classified or unpublished references it cites PPD-20, CJCSM 3139.01 and the 2016 C2 EXORD (App. C). Opening quotations are from the 2015 DoD Cyber Strategy (pp. I-1, III-1), Gen. Dunford (Feb 2016, p. IV-1) and Lt. Gen. Nakasone (1 Mar 2018 testimony, p. II-1). The publication does not engage the Tallinn Manual or any scholarly literature.

Bearing on the record

This is a doctrinal and definitional source for work on military cyber operations, not ML. It carries nothing for ML practice, so there is nothing for the Anthology of the SOTA. Any document in this record that quotes US definitions of OCO, DCO, DODIN, cyber-persona or cyberspace attack should:

• quote from here, with page;
• say which wording it uses for OCO (the body’s “foreign cyberspace” or the glossary’s “cyberspace”);
• note the 2022 revision.

Any claim that this publication explains the legal basis of US offensive cyber operations, or the Title 10/Title 50 division, overstates it. The unclassified text names the titles and defers the substance to Appendix A.

Limitations

• The authorities discussion is thin by design. The operative authorities (PPD-20, CJCS EXORDs, CJCSM 3139.01, Appendix A) are classified or unreleased, so the unclassified text cannot show what is actually authorized or by whom.
• Several load-bearing statements are unsupported. Examples: use-of-force thresholds, the gray/red limitation, and “no stateless maneuver space” are asserted without legal analysis or citation to specific statutory sections.
• Internal inconsistencies:
  • the OCO definition, body vs glossary;
  • “regulate” vs “restrict” (p. xiv vs p. III-11);
  • the garbled self-defense sentence on p. I-12;
  • “the domain” (p. I-1) vs “A global domain” (GL-4).
• Organizational details are dated. US Pacific Command (p. III-8) was renamed in 2018, and the Defense Security Service (p. III-1) was later renamed as well. The CMF structure and C2 relationships describe 2018.

Open questions

• What does the December 2022 revision change? DefenseScoop’s headline (seen only in search results) says it “defines ‘expeditionary cyberspace operations’”. Is the OCO definition’s “foreign” qualifier restored or dropped? A copy of the 2022 text would settle this.
• What do classified Appendix A and the 2016 C2 EXORD say about authorities, including any Title 10/Title 50 allocation? This cannot be settled from open sources.

Sources for the later-edition check: DefenseScoop, 12 May 2023; DoD Strategic Cyberspace Operations Guide (Oct 2023).

Corrections to the seeded skim

• The dossier’s framing of the authorities chapter is wrong. It calls Chapter III “the most analytically load-bearing part” and says it covers “the Title 10/Title 50 boundary”. Chapter III contains no discussion of a Title 10/Title 50 boundary. Its Authorities section (§2, p. III-2) is two short paragraphs:

  • (a) authority derives from the Constitution and federal law, “Key laws” being Titles 10, 50 and 32;
  • (b) authorities for specific missions are set in SecDef policies (DOD instructions, directives, memoranda) and in EXORDs/OPORDs authorized by the President or SecDef. This includes DACO, “established by CJCS EXORD”.

  It then refers the reader to classified Appendix A “for additional information on authorities” (p. III-2). Figure III-1 (p. III-3) is a descriptive table, not an analysis. It covers eight titles (6, 10, 18, 28, 32, 40, 44, 50); Titles 18 and 28 share one DOJ row. Most of the chapter (§3, pp. III-2–III-11) is a roles-and-responsibilities list.

• “Title 10 and related” undercounts the figure. Figure III-1 lists Title 6 (DHS), 10 (DOD), 18 and 28 (DOJ), 32 (National Guard), 40 and 44 (all federal departments: CIO roles, information-security policy) and 50 (DOD and IC agencies under ODNI).

• The dossier’s advice to check for a later edition is answered: there is one. A web search surfaced reports that JP 3-12 was revised in December 2022 with release limited to CAC holders: DefenseScoop (12 May 2023) and a DoD Strategic Cyberspace Operations Guide (Oct 2023). I saw only the search-result summaries. I did not open those pages or the 2022 document, so the revision’s date and content are unverified at the primary level.

• The OCO definition differs between body and glossary. The dossier says OCO “projects power in and through foreign cyberspace”. That wording is the body’s (pp. xi, II-5). The glossary definition, marked “Approved for incorporation into the DOD Dictionary”, omits “foreign”: “Missions intended to project power in and through cyberspace” (p. GL-5). The glossary wording is the one that went to the DOD Dictionary.

• The attribution sentence is quoted from the executive summary; the body is garbled. “attribution … is crucial for any actions external to the defended cyberspace beyond authorized self-defense” is the executive summary’s wording (p. ix). The body reads “beyond that authorized as authorized self-defense” (p. I-12). The body also says separately that “attribution is not necessarily required for self-defense” (p. IV-7).

• Minor: the dossier dates the document “published: 2018-06-01”. The cover date is 8 June 2018, and the dossier’s own access note says so.