1. Director NCSA
22/04/2017
“Running NATO’s Networks in Operations” LtGen Ulrich Wolf Director NCSA AFCEA Europe Symposium SHAPE 1 June 2006
Good morning, Ladies and Gentlemen,
as Director of the NATO Communications and Information Systems Services Agency (NCSA) I am – together with my Agency – responsible to ensure the provision of NATO’s secure end-to-end information exchange services. One important – if not the most important – part of this mission is the support to deployed forces, deployed in operations and exercises that are outside the traditional NATO operating areas. What this means to NATO’s networks will be covered by my briefing in the next 20 minutes.
I will start with a view on my organization and on NATO’s networks to set the scope for challenges that deployments pose to NATO’s networks.
I will specifically highlight challenges that come with the participation of non-NATO partners as well as with contractors that provide parts of the CIS support for operations.
CLICK

2. NCSA mission “To ensure the provision
Director NCSA
22/04/2017
NCSA mission
“To ensure the provision
of secure end-to-end information exchange services
required for NATO Consultation, Command and Control
using fielded Communications and Information Systems in the most cost effective manner.”
The NCSA mission is stated here.
The important words here are ‘to ensure the provision of’ as this does not mean NCSA should only provide end-to-end services, but, more comprehensively, that NCSA is to ensure that end-to-end services can be provided through our own NATO resources or those provided by Nations or leased from commercial providers. So NCSA is operating, controlling and managing NATO’s networks.
Another important aspect is the use of ‘fielded CIS systems’ – NCSA is not procuring or building up systems, but is only running and operating them why NCSA is also named the Service Provision Authority.
That means NCSA is supposed to be NATO’s centralized overall service provider for CIS services – within and between headquarters out of NATO’s command structure, to nations and to operations and exercises.
CLICK

3. NCSA Structure NCSA HQs MONS 1 NATO Signal Bn Maastricht
Director NCSA
22/04/2017
NCSA Structure
NCSA HQs
MONS
NCISS Latina
Sector Lisbon
Sector Naples
Sector Brunssum
Sector Izmir
Sector Norfolk
Sector Heidelberg
Sector Northwood
Sector Mons
Sector Madrid
Sector Ramstein
The NCSA structure is shown here:
To fulfil its mission NCSA comprises of NCSA HQs with 515 personnel at SHAPE, 10 NCSA Sectors, 2 NATO Signal Battalions with deployable CIS capabilities and the NATO CIS School in LATINA, all in all NCSA’s PE asks for 3666 personnel.
CLICK
1 NATO Signal Bn
Maastricht
2 NATO Signal Bn
Naples

4. NSB End State Structure
Director NCSA
22/04/2017
NSB End State Structure
1NSB
2NSB
Non –
ESPE
1NSB HQ
2NSB HQ
DCMs
1NSB M&S
2NSB M&S
Coy
Coy
Maastricht, NL (*)
Naples, IT (*)
Wesel
, GE
Verona, IT (*)
Wesel
, GE
Wesel
, GE
Verona, IT (*)
Haderslev, DA
Here you can see the structure of NCSA’s deployable CIS Battalions.
These NATO Signal Battalions (NSBs) have been structured and equipped to support the CJTF concept. (CJTF = Combined Joint Task Force)
Basically each NSB comprises of four Deployable Communication Modules (DCMs), comparable to Signal Companies. These NSBs are a scarce resource and once deployed DCMs could not easily be used elsewhere. So there are some limitations and priorities for the use of NSBs.
The challenges to deploy CIS in an operational environment differ from operation to operation. There is no one-fits-all solution for every ongoing or future operation. Depending on the available trained personnel and the available equipment every deployment has to be mission tailored.
I am currently re-enforcing these battalions so that they can concentrate on and meet all requirements coming out of current operations as well as all requirements coming from the NATO Response Force (NRF) with respect to exercises and stand-by for real operations. This could then be supported on a sustainable mode. The support of CJTF concept has recently been pushed to the right of the timeline.
CLICK
Wesel
, GE
Naples, IT (*)
Izmir, TU
Bruggen
, GE (*)
Naples, IT (*)
(*) Long run
Brunssum, NL
(*) Long run
Grazzanise, IT

5. NATO’s CIS network Service Interface Maritime ISAF NATO Core Network
Director NCSA
22/04/2017
NATO’s CIS network
Maritime
ISAF
NATO
Core Network
(Voice / Data / VTC)
Service Interface
BALKANS
What is then NATO’s core static network?
The NATO General Purpose Communication Segment (NGCS) is made up of multiple systems, subsystems and subnets to provide voice, data and VTC services. With the rapid operational expansion of NATO in outer theatre areas, large and sometimes independent sub-networks are supporting operational commanders and linking them back into Europe.
Service interface gateways (sometimes referred to as Black Box) must be carefully designed, maintained and controlled with the same architectural and management principals of those within NCSA. It includes, but are not limited to security, quality of service and total interoperability to established NATO standards.
Often these subnets are largely supported and operated by a total or partially outsourced solution, and must be kept at the same operational level of any military provided network.
This means that NCSA must be involved early, from the very beginning of the requirements development stage, writing of the Type B Cost Estimate and active collaboration with the contractor once the project has been awarded, all the way through implementation. The complexity and interdependency of systems throughout the network dictates that this process cannot be ignored.
CLICK
NTM-I
Exercise

6. NATO General Purpose Communication Segment (NGCS)
Director NCSA
22/04/2017
NATO’s CIS network
NATO General Purpose Communication Segment (NGCS)
NGCS T R M P T C C S B M E
The NATO General Purpose Communication Segment (NGCS) consists of four major Pillars;
A Transmission Pillar providing transmission media such as satellite links, VSat links, Direct Line of Sight connections (DLOS), commercial E1 links, etc ….
The Bandwidth Management Equipment (BME), bundling all transmission media into a common pool for access to the other pillars CSC and PTC components in a dynamic and cost effective way.
Circuit Switch Component (CSC), providing a NATO wide ISDN network with state of the art compression and dynamic routing capabilities with BME inter working.
Packet Transport Component (PTC), providing the IP infrastructure for layer 3,2,1 data transfer providing NATO Secret and NATO Unclassified packet transport.
All these pillars or this complete system of different components need careful monitoring and configuration to ensure seamless information flow. Every negative impact on this system as a whole by trying to integrate new components has to be avoided!
CLICK

7. Reach back Capacity 9Mbps
Director NCSA
Support to ISAF
22/04/2017
SKYNET 4E
Reach back Capacity 9Mbps
Euskirchen
SGT F2
FEYZABAD
MAZAR-E-SHARIF
KONDUZ RC
North
TSGT
MEYMANAH
POL-E-KHOMRI
NATO BME
Network
D55 RC
West
ISAF
Kaboel Area
HERAT
CIS support to ISAF continues to be our highest and most immediate priority in This operational theatre is provided with four different computer networks: NATO Secret, NATO Unclassified, Mission Secret, US provided CENTRIXS, in addition to a host of Functional Services, Video Teleconferencing, as well as voice services.
Currently ISAF utilizes both military and contracted CIS equipment
Contracted equipment maintained by both military and contractors: VSAT hub network located at different PRTs (blue and red dots) with hubs at KAIA airport and at HQ ISAF in KABUL.
NATO CIS equipment (Transportable Satellite Ground Terminals TSGT) located at ISAF HQ and KABUL Multinational Brigade KMNB.
BME Network via TSGT links reach back to NATO cloud over the civilian Satellite SKYNET 4 Echo.
A complete migration of satellite links to the now used consortium satellites had very little impact on service to ISAF, however, as the mission expands, additional space segment will have to be resourced in order to meet the increasing requirements.
In addition to the SatCom connectivity, an emergency rear link has been installed as a fall back position since last year through a US network – light line on slide – this maintains critical services to theatre in the absence of NATO satellite links.
We also recently sent a team from NCSA to ISAF to expand installations of NATO to military elements in Kandahar and reset services and nodes in preparation for the Stage III expansion.
One of our greatest challenges in the coming months will be to fully integrate the FOC contractor (THALES) into the current ISAF network, while allowing for a seamless transition to the user community.
CLICK RC
East
Izmir
SGT F13
12 PRT’s RC
South
FARAH
TSGT
US BME Network

8. Support to ISAF Roles and responsibilities of contractors
Director NCSA
Support to ISAF
22/04/2017
Roles and responsibilities of contractors
network Jigsaw solution
different technologies and ownership
multiple partner co-ordination
overarching NCSA role
involvement of partners
CENTRIXS
NATO
KABUL
AREA
CDS
FOC
IOC
National
Resources
But NCSA responsibility as an end-to-end provider of CIS services goes well beyond the physical responsibility. As Director of NCSA, I must ensure that the WEB of multiple partners operate seamlessly and focus towards one solution. Information exchange requirements demands that all available CIS providers understand their roles and responsibilities and are able to response in a timely manner and understand that if they fail in doing so, that the impact on the overall network goes well beyond their area of responsibility.
As an example, the extension of CENTRIXS (US Secret) to NATO forces in ISAF requires an air-gap approach in order to protect and prevent unwanted and classified material not releasable to NATO to accidentally past from the US side to NATO elements. US and NATO Secret Servers sit side by side, with very specific information being passed manually from one to the other after being screened by a human (swivel chair solution).
Additionally, local CIS providers such as Afghan company Roshan, provide and maintain critical E-1 links interconnecting command and control nodes within the network, demanding high performance standards on their part to in order to provide a solid infrastructure.
CLICK
IOC = Initial Op. Capability
FOC = Full Op. Capability
CDS = Cross Domain Solution
(CENTRIXS – NATO systems)

9. Information sharing with non-NATO partners
Director NCSA
Support to ISAF
22/04/2017
Information sharing with non-NATO partners
releasability of classified material or equipment
compatibility of equipment
“air-gap”-solutions
inter-operability (standards – protocols – gateways)
Today’s battle space requires operational & maneuver commanders to share and exchange information instantaneously or in near real-time. However, NATO ran operations continue to present enormous challenges to this emerging demands. Non-NATO partners operating alongside NATO forces often deploy with non compatible equipment, resulting time consuming, risky, and non-standard patches (Black Boxes) in order to totally integrate forces into one common (Mission Secret) network.
As an example with today’s environment in ISAF, and mentioned earlier, NATO CIS services are provided through several sources and methods. First, the continued operation & maintenance (O&M) of the Initial Operating Capability (IOC). Second, the continued O&M of individual independent projects, and finally, the Final Operating Capability (FOC) which is a full service based commercial contract provided by civilians on the battlefield.
The challenges to ensure that all of these sub-networks are integrated in one common picture and able to be viewed and managed centrally are just some of the major endeavors NCSA is currently undertaking.
We also demand that we are involved at the earliest stages of the requirement identification process to insure that what ever solution is accepted and implemented fits into the NATO CIS architecture with little or no patches applied.
CLICK

10. Command and Control Option 1 Option 2 SACEUR OpCon D-NCSA OpCon
Director NCSA
22/04/2017
Command and Control
SACEUR
OpCon
D-NCSA
OpCon
JFC Brunssum
NCSA Sector Brunssum **
OpCon
** for on-site spt at Brunssum only
HQ ISAF [J6 * ]
AdCon
Another issue to address on NCSA support to theatres is the command relationship.
You can easily draw a command and control relationship for ISAF along the military chain of command: SACEUR, through Commander JFC BRUNSSUM, controls Commander ISAF on the ground in Afghanistan. Com ISAF then relies on nationally provided ISAF forces under his command. This chain is shown on the left side of this picture, the customer side – so to speak – in yellow.
The local HQ ISAF J6 is depicted in a dark green shade because he would be controlling assigned CIS assets in behalf of the commander ISAF and thus not only be the customer but also - to some extent - his own provider, as well.
There are two options – Option 1 – these forces would come from one of the NCSA owned NSB, which are normally detached – with OpCon being delegated down the operational chain of command - to the in-theatre commander and thus become part of his force set up. They could assume role and denomination of a Signal Support Group (SSG) to that HQ. Option 2 – the in-theatre CIS forces would come from other than NCSA.
On the right side the NCSA entities as the service providers are shown in light green. NCSA Sector Brunssum is shown “off side the chain”, because the Sector would be involved in the operation only as it regards local CIS support at the Brunssum site.
The technical in-theatre set up is shown separately, also in green, on the right bottom of the slide, with an arrow indicating the responsibility to “run” it on behalf of the in-theatre HQ commander. It has become clear that NCSA does have and should have a responsibility as both a service provider and a networks operator also regarding theatres. But clearly the command and control arrangements which have been used for theatres so far, do leave room for questions. The current practice is blurry in terms of assignment of responsibilities and does not fully match with NCSA’s overall service provisioning role for both the NATO static organization and deployed operations in theatres. (CLICK)
OpCon
ISAF forces
NCSA NSB forces
in-theatre CIS assets
... run ...
Option 1
in-theatre CIS forces
* J6 „controlling“ the CIS set up including attached NCSA forces
Option 2

11. NCSA Sector Brunssum **
Director NCSA
22/04/2017
Command and Control
SACEUR
OpCon
D-NCSA
JFC Brunssum
NCSA Sector Brunssum **
Option B
HQ ISAF [J6 * ]
Option A
OpCon
** for on-site spt at Brunssum only
TechCon?
In order to resolve this issue I see basically two options:
Under Option A any CIS assets in theatres would be put under OpCon of D-NCSA. This would be true for NCSA organic NSB, but also for any CIS forces from national sources.
This would
take out the J6 as his own provider; rather he would be a customer
ensure unity of command and control of all forces and assets under the service provisioning authority.
However, this option may be perceived as somewhat too radical against current practice.
Under Option B a new term for “CIS service related command relationship” would have to be created: Technical control. All details of what that exactly means would still have to be worked out. This would be much easier to achieve but would fall short of a true unity of command solution and would still end up with some kind of mixed responsibilities for service provision in theatres.
I think this issue will have to be addressed to and discussed with SACEUR in due course. ISAF expansion would be a good case against which to achieve clarification.
CLICK
ISAF forces
in-theatre CIS forces
in-theatre CIS assets
... run ...
* J6 „controlling“ the CIS set up including attached NCSA forces

12. Challenges Impact on NATO’s networks
Director NCSA
22/04/2017
Challenges
Impact on NATO’s networks
Long-term planning for procuring CIS equipment
Mission-tailoring
Interoperability
To summarize challenges of running NATO’s networks in operations and highlight to you where industry fits into that picture.
I have elaborated in depths the difficult task to keep dynamic networks running and undisturbed by integrating new sub-networks as for operations, exercises or newly introduced contractor solutions.
NATO has its origin in the years after the second world war and has been influenced and formed for a long time during the Cold War – and so have some procurement regulations within NATO. Of course NATO is focussing its main effort to deployments and assets like the NRF since the Prague Summit But procuring CIS equipment is still a long-term undertaking in NATO that does not always reflect the rapid changes that NATO’s Level of Ambition or changes in technology.
As mentioned earlier, every operation as well as all exercises ask for mission tailored solutions. There is no one-fits-all solution that could be procured, stored and being used when necessary. Flexibility and the need for cooperation between NATO and industry are required.
The example of NCSA’s support to ISAF have proven that interoperability between NATO entities has the same weight as interoperability between NATO and participating nations or other partners. We have to avoid any negative impacts on NATO’s network as a whole.
CLICK

13. Director NCSA
22/04/2017
In conclusion, no matter where and how far away NATO forces are deployed, NCSA’s responsibility for providing end-to-end communications and information services can only be successfully accomplished through the single network construct. I recognize that due to limited military CIS resources, the need to outsource parts of the NATO CIS requirements and services are inevitable and will continue.
However, whether it is military or commercially provided, positive end-to-end control and management of the network must be maintained, end-to-end, utilizing set standards and procedures and understood by all.
In doing so, providing the best service, the integrity of the network, security of all information and the ability to quickly recover and re-establish critical services to the users remain my top priorities.
Are there any questions?