WICHITA, Kan. -- Stepping away from their civilian careers and traditional drill statuses, a joint team of Kansas Army and Air National Guardsmen activated under state active-duty orders to provide critical cyber defense for the state during the FIFA World Cup, held June 11 to July 19.
When the Kansas National Guard conducts a cyber state active-duty mission, members are called upon by the governor to serve as emergency technical support for state agencies during crises or major events.
Acting on requests made by the State Chief Information Officer to the Adjutant General, the joint task force operated in a purely defensive role.
Operating in coordination with the Kansas Security Operations Center and various government organizations, the team focused on proactive threat hunting, mitigating vulnerabilities, and safeguarding critical infrastructure across the state’s 105 counties throughout the tournament.
The state active-duty team began their mission with two main objectives. First, they aimed to improve cyber hygiene and harden systems through robust security protocols. Second, the team was there to assist state assets in recovering from a possible cyber event by restoring access and data.
Kansas Leads the Way
The operation required Guardsmen to immediately integrate into civilian security operations to monitor networks and analyze potential breaches.
The stakes were high, with the FIFA World Cup bringing an estimated 650,000 global visitors to the region, creating a $653 million economic impact.
“We’ve been threat hunting and looking for anything related to FIFA,” explained Master Sgt. Macaela Miller, an information security analyst with the 184th Intelligence Support Squadron, regarding the team's operational tempo during the event.
Coordinating with 11 different state, federal, and regional mission partners, Miller explained how the team tracked and mitigated counterfeit ticketing platforms, falsified websites, and a phishing campaign that compromised hundreds of accounts.
Kansas Guardsmen stepped in to help remediate the threat and conducted forensics to determine the extent of the data exposure.
Beyond daily incident response, the task force focused heavily on building long-term operational capabilities that will outlast the tournament.
“We're figuring out our requirements from a technical perspective and how we're going to move forward if we had to go out and respond to ransomware, or a network went down, or a water utility went down,” said Senior Airman Aaron Trekell, a weapons and tactics specialist with the 127th Cyberspace Operations Squadron.
To ensure future readiness, Miller, Trekell, and the rest of the team began developing a deployable incident response toolkit. The kit is designed to allow future state active-duty teams to conduct on-site forensic imaging and help affected entities maintain basic operations while fully recovering from a cyberattack.
Total Force Integration
The success of the cyber task force stemmed from combining different skill sets and operational perspectives from both the Army and Air National Guard into one integrated team.
Pfc. Dennis Smith, a cyber operations specialist assigned to Kansas Joint Force Headquarters, utilized his civilian experience as a nightshift IT administrator alongside his military training with the Kansas Cyber Protection Team.
“During my time on SAD orders, I had the opportunity to collaborate with 11 different state, federal, and government organizations,” Smith explained. “Working alongside these agencies helped strengthen Kansas' overall cybersecurity posture while also building valuable relationships that will improve future coordination and information sharing.”
Smith noted that having operators from diverse backgrounds accurately replicate real-world scenarios created a highly effective operating environment.
“The SAD, KSOC, and Office of Information Technology Services teams each brought different experiences and perspectives, which made problem-solving more effective and gave me the opportunity to learn from everyone around me,” Smith said, highlighting the value of joint tabletop exercises. “They encouraged collaboration, allowed everyone to contribute, and created an environment where the team could support one another.”
The environment also provided unprecedented professional development for drill status guardsmen.
Senior Airman Jack Hall, an electrical engineering student and member of the 184th ISS, emphasized the unique exposure to civilian sector operations. He noted that working alongside civilian agencies required Guardsmen to adapt their methodologies.
“It gives us a lot of experience outside of the military, because [civilian agencies] do things a very specific way, and it does not translate 100% to [our standard procedures],” Hall stated.
Creating Critical Partnerships
With over 6,000 Kansas Guardsmen living across the state, protecting vital infrastructure like water, power, communications, and transportation makes this mission personal.
Moving forward, the task force aims to continue bridging the gap for state entities that may lack manpower to improve their cybersecurity. Miller emphasized how the Kansas National Guard is here to help.
“We could potentially build a pool of Airmen together as a tiger team and send them out to a location, assess a situation, and say, 'Hey, we found this weak point, you need to fix this, and we're happy to help you,'” she explained.
By establishing these connections now, the National Guard ensures a rapid, coordinated response during future state emergencies.
“We want to connect with them and build those early relationships that will be key to our success later on,” Trekell added.
Following the conclusion of the FIFA World Cup, members viewed the activation as a vital opportunity to build resiliency across the force.
“State Active-Duty orders are an incredible opportunity to grow—not only in your technical specialty but also as a Soldier or Airman,” Smith concluded. “The experience, professional development, and relationships you build are well worth it.”