How NSA and US Cyber Command undertook the largest and longest offensive cyber operation in US military history to disrupt ISIS's media operations in 2016
Toggle more options — The crowded room was awaiting one word: “Fire.” — Everyone was in uniform; there were scheduled briefings …
Context & Ripple Effects
The NPR account sits at the midpoint of a documented arc: the US military had openly announced cyber attacks on ISIS in Mosul in March 2016 — likely the first such public acknowledgment — and by mid-2017 the New York Times was assessing that the use of cyberweapons against a group that recruits, spreads propaganda, and communicates through encrypted channels had been a consistent disappointment. This piece explains what that campaign actually looked like from inside: the largest and longest offensive cyber operation in US military history, run jointly by the NSA and US Cyber Command.
Why it matters is what came after. The operational muscle built against ISIS reappears two years later when Cyber Command and the NSA describe taking unspecified actions against Iranian hackers to deter election interference, and by 2022 the Cyber National Mission Force had been deployed to 20 countries since 2018 to confront Russian, Chinese, and North Korean hackers.
First-order effects
- ISIS's media and recruitment infrastructure faced sustained disruption from the operation, though the 2017 reporting indicates the effect on the group's web-based recruiting and encrypted communications fell short of expectations.
- US Cyber Command gained a proven template for large-scale joint offensive operations with the NSA, converting a counterterrorism experiment into repeatable capability.
Second-order effects
- The gap between the operation's scale and its disappointing results pushed Cyber Command toward the proactive 'persistent engagement' posture its director described ahead of the 2020 election, rather than one-off takedowns.
- The same NSA–Cyber Command pairing was redeployed against state adversaries — Iranian hackers before the 2020 election and the state-backed crews the Mission Force now pursues abroad — making election defense and great-power competition the follow-on mission set.
Third-order effects
- Offensive cyber has been institutionalized as a standing military instrument rather than an emergency tool: the force built against a terrorist group's propaganda network now operates continuously in dozens of countries against nation-state hackers, with public acknowledgment shifting from exceptional (Mosul, 2016) to routine (the 2020 deterrence announcements).
- If that trajectory holds, expect the legal and policy questions around acknowledged offensive operations — who is targeted, under what authority, with what disclosure — to move from classified after-action debates into recurring public oversight territory, since each successive campaign has been announced more openly than the last.
The trend: US offensive cyber is evolving from a bespoke counterterrorism campaign against ISIS into a permanent, forward-deployed instrument aimed primarily at state-backed hackers, with each operation announced more publicly than the last.