# US Cyber Command The unified combatant command responsible for U.S. military operations in cyberspace — offensive hacking, defensive network protection, and information warfare. Headquartered at Fort George G. Meade, Maryland, alongside the [[NSA]], with which it shares a commander under the controversial "dual-hat" arrangement. Currently led by General [[Joshua Rudd]] (since March 2026). CYBERCOM's mission is to "direct, synchronize, and coordinate cyberspace planning and operations — to defend and advance national interests." In practice, this means the command conducts offensive cyber operations against adversary military and intelligence networks, defends DOD networks, and supports conventional military operations with cyber effects. Its operational authorities derive from Title 10 (military operations), distinguishing it from the [[NSA]]'s Title 50 (intelligence collection) — a legal distinction that creates persistent tension in the dual-hat structure. ## Structure CYBERCOM comprises four service components providing forces to the command: Army Cyber Command, Fleet Cyber Command (Navy), Marine Forces Cyberspace Command, and 16th Air Force (Air Forces Cyber). Two subordinate unified commands conduct standing operations: the Cyber National Mission Forces (CNMF), responsible for defending the nation against significant cyber threats, and DOD Cyber Defense Command, responsible for defending DOD networks. The command operates through the Cyber Mission Force — approximately 6,200 personnel organized into 133 teams when it reached full operational capability in 2018. ## The Dual-Hat Debate Since its creation, CYBERCOM's commander has simultaneously served as Director of the [[NSA]] — a structural choice made when CYBERCOM was a nascent sub-unified command that relied on NSA's existing infrastructure, personnel, and tools. The arrangement was intended to be temporary. It has persisted for over 15 years. The core tension: the NSA collects signals intelligence by maintaining persistent, covert access to adversary networks — it wants to stay hidden. CYBERCOM conducts offensive operations that are inherently noisy — it wants to disrupt, degrade, and destroy. A single commander must balance intelligence equities (keep the access) against operational demands (burn the access for a kinetic effect). Defenders of the dual-hat argue that only a single decision-maker can make these tradeoff decisions responsibly; critics argue the structure inevitably subordinates one mission to the other. Congress has repeatedly debated splitting the roles but has never mandated separation. The FY2017 NDAA elevated CYBERCOM from a sub-unified to a full unified combatant command — increasing its bureaucratic standing — but preserved the dual-hat. ## History | Date | Event | |------|-------| | **2009** | Secretary of Defense Robert Gates directs the creation of CYBERCOM as a sub-unified command under USSTRATCOM, headquartered at Fort Meade | | **2010** | CYBERCOM achieves initial operational capability under Gen. Keith Alexander (who simultaneously served as NSA Director) | | **2016** | FY2017 NDAA elevates CYBERCOM to a full unified combatant command | | **2018** | Cyber Mission Force reaches full operational capability (133 teams, ~6,200 personnel) | | **Apr 2025** | Trump fires Gen. Timothy Haugh from the dual-hat role — reportedly at the urging of Laura Loomer, who called him "disloyal." Lt. Gen. William Hartman serves as acting commander for nearly a year | | **Mar 2026** | Gen. [[Joshua Rudd]] confirmed 71–29; takes command March 20. First commander with no prior cyber or intelligence experience — career Special Forces | | **Feb–Jun 2026** | CYBERCOM operates as "first mover" in the [[Iran War 2026]], conducting offensive cyber operations against Iranian military infrastructure before and during Operation Epic Fury | ## The Iran War and AI The [[Iran War 2026]] marked CYBERCOM's most significant combat deployment. The command was described as the first mover when hostilities began February 28 — launching cyber operations against Iranian command-and-control, air defense, and communications infrastructure ahead of kinetic strikes. The war also exposed CYBERCOM's intersection with the AI debate tracked across the KB. A June 15, 2026 DOJ filing revealed that xAI's Grok had been integrated into [[Project Maven]] for targeting in Iran — 2,000 munitions directed at 2,000 targets in 96 hours during Operation Epic Fury. [[Anthropic]] had been removed from Project Maven specifically because it refused autonomous strike and mass-surveillance uses ([[Anthropic Government Ban]]). CYBERCOM's operational environment is now inseparable from the question of which AI systems the military is permitted to use and how. The [[Anthropic Model Export Directive]] — the June 2026 order suspending [[Claude Fable 5]] and [[Claude Mythos 5]] access for foreign nationals — touches CYBERCOM's domain directly. [[Claude Mythos 5]]'s cybersecurity capabilities (finding vulnerabilities in major operating systems) are precisely the kind of tool CYBERCOM's mission requires, and the partial restoration of Mythos 5 to ~100 trusted organizations likely included CYBERCOM or its components. ## See Also - [[NSA]] — the signals intelligence agency sharing CYBERCOM's commander - [[Joshua Rudd]] — the current dual-hat commander - [[Iran War 2026]] — CYBERCOM's most significant combat deployment - [[Combatant Commands]] — the broader military command structure - [[Project Maven]] — the Pentagon AI program integrated into military operations - [[Claude Mythos 5]] — the frontier AI model with cybersecurity capabilities relevant to CYBERCOM's mission - [[Anthropic Government Ban]] — the Pentagon's exclusion of Anthropic from defense AI - [[Dual-Use AI]] — the framework for AI serving both civilian and military purposes - [[Pete Hegseth]] — the Defense Secretary overseeing CYBERCOM