SENATE ARMED SERVICES HEARING ON CYBER SECURITY 1100 TO 1200
SENATE ARMED SERVICES COMMITTEE HEARING ON CYBER SECURITY
Agenda
To receive testimony on United States Cybersecurity policy and threats.
Witnesses
Honorable James Clapper
Director Of National Intelligence
Honorable Robert Work
Deputy Secretary Of Defense
Admiral Michael Rogers, USN
Commander, U.S. Cyber Command/ Director, National Security Agency/ Chief, Central Security Services
MCCAIN:
The committee meets today to receive testimony from Deputy Secretary of Defense Robert Work, Director of the National Intelligence James Clapper, and Admiral Mike Rogers, the commander of U.S. Cyber Command, director of the National Security Agency and chief of the Central Security Service.
We thank each of the witnesses for their service, and for appearing before the committee.
We meet at a critical time for the defense of our nation from cyber attacks. In just the past year, as we all know, the United States has been attacked by cyberspace -- in cyberspace by Iran, North Korea, China and Russia. Indeed, since our last cyber hearing in March, the attacks have only increased, crippling or severely disrupting networks across the government and private sector, and compromising sensitive national security information.
Recent attacks against the Joint Chiefs of Staff, the Pentagon, and the Office of Personnel Management are just the latest examples of the growing boldness of our adversaries and their desire to push the limits of acceptable behavior in cyberspace.
New intrusions, breaches and hacks are occurring daily; the trends are getting worse; but it seems the administration has still not mounted an adequate response. They say they will, quote, "Respond at the time and manner of our choosing," unquote. But then either take no action or pursue, largely, symbolic responses that have zero impact on our adversaries' behavior.
Not surprisingly, the attacks continue. Our adversaries steal, delete, and manipulate our data at will, gaining a competitive economic edge in improving their military capability. They demonstrate their own means to attack our critical infrastructure, and they do all of this in a time and manner of their choosing.
More and more, they are even leaving behind what Admiral Rogers recently referred to as, quote, "cyber fingerprints." Showing that they feel confident that they can attack us with impunity and without significant consequences.
Just consider the recent case with China. After much hand- wringing, it appears the president will not impose sanctions in response to China's efforts to steal intellectual property, pillage the designs of our critical weapons systems, and wage economic espionage against U.S. companies.
Instead, last week's state visit for the president of China simply amounted to more vague commitments not to conduct or knowingly support cyber-enabled theft of intellectual property.
What's worse, the White House has chosen to reward China with diplomatic discussions about establishing norms of behavior that are favorable to both China and Russia. Any internationally agreed upon rules of the road in cyberspace must explicitly recognize the right of self defense. That's contained in Article 51 of the U.N. Charter, along with meaningful human rights of intellectual property rights protections.
The administration should not concede this point to autocratic regimes that seek to distort core principles of the international order, to our detriment.
Make no mistake -- we are not wining the fight in cyberspace. Our adversaries view our response to malicious cyber activity as timid and ineffectual.
Put simply, the problem is a lack of deterrence. As Admiral Rogers has previously testified, the administration has not demonstrated to our adversaries that the consequences of continued cyber attacks against us outweigh the benefit.
Until this happens, the attacks will continue and our national security interests will suffer. Establishing cyber deterrence requires a strategy to defend, deter, and aggressively respond to the challenges to our national security in cyberspace.
That is exactly what the Congress required in the fiscal year of 2014 National Defense Authorization Act. That strategy is now over a year late and counting.
MCCAIN:
And while the Department of Defense's 2015 cyber strategy is a big improvement over previous such efforts, it still does not integrate the ends, ways and means to deter attacks in cyberspace. Establishing a cyber deterrent also requires robust capabilities, both offensive and defensive, that can pose a credible threat to our adversaries. A goal, on which the Congress, and specifically this committee, remains actively engaged.
The good news here is that significant progress has been made over the past few years in developing our cyber force. That force will include a mix of professionals trained to defend the nation against cyber-attacks to support the geographic combatant commands in meeting their objectives and to defend DOD networks. This is good, but the vast majority of our DOD resources have gone towards shoring up our cyber-defenses.
Far more needs to be done to develop the necessary capabilities to deter attacks, fight, and win in cyberspace. Policy indecision, should not become a impediment to capability development. We do not develop weapons because we want to use them, we develop them, so as we do not have too.
And yet, in the cyber-domain, as Admiral Rogers testified in March, quote, "we're at a tipping point." He said, quote, "we've got to broaden our capabilities to provide policy makers and operational commanders with a broader range of options."
We must invest more in the offensive capabilities that our cyber- mission teams need to win on the cyber-battlefield. The fiscal year 2016, NDAA seeks to address this challenge in a number ways, including a pilot program to provide the commander of Cyber Command with limited rapid acquisition authority.
Finally, we know the Defense Department is in the process of assessing whether the existing combatant command structure, adequately addresses the mission of cyber-warfare, and whether to elevate Cyber Command to a unified command. There are worthwhile arguments on both sides of this debate.
I look forward to hearing Admiral Rogers views on this question and his assessment of how an elevation of Cyber Command, might enhance our overall cyber-defense posture. I also look forward from our witness what -- if any progress has been made on addressing disagreements within the inter-agency on the delegation and exercise of authority to use cyber-capabilities.
I thank the witness again for appear before the committee. I look forward to their testimony.
Senator Reed?
REED:
I thank you very much, Mr. Chairman, and let me command for scheduling this very important hearing. It's an appropriate to discuss a number of important cyber-issues with our witnesses, especially in light of the cyber agreements announced last Friday, between President Obama and the president of China.
I want to thank, Director Clapper, Deputy Secretary Work and Cyber Commandeer Admiral Rogers for their testimony today and for their service to the nation. Thank you gentleman, very much.
Let me start with the series of cyber agreements with China. The apparent commitment (ph) by China to cease stealing U.S. intellectual property for their economical gain is notable. And, I expect we will have a robust discussion about China's compliance in our course of action, if it does not.
China's leaders must be aware that it's reputation in standing in the eyes of the America people will continue to decline if this piracy does not stop. Which ultimately, will have a tremendously negative impact on our relations with China. I would also emphasize the potential importance of China embracing a set of international norms besides themselves (ph) based, developed by the United Nations; which includes a commitment to refrain from attacks on other nation's critical infrastructure.
Next, I would highlight that we are facing the reoccurring issue of whether or when to elevate Cyber Command from a sub-unified command to a full unified command. And whether, to sustain the current dual hat arrangement under which the commander of Cyber Command also serves as Director of NSA. I understand that the department may be nearing a recommendation to the president that the next unified command plan elevates Cyber Command to a unified command.
The committee in the past, has questioned whether Cyber Command is mature enough to want it (ph) or in elevation to a unified command; and whether the dual hat arrangement should continue when a decision is made to elevate the command. Put simply, if Cyber Command is so reliant on NSA, that common leadership is so necessary, is the command ready to stand on it's own as a unified combatant command?
This is an issue that Senator McCain has drawn attention to, and something that I think is very critical that I would forward (ph) to this committee. Directly related to that question, is the maturity of Cyber Command as a status to the military cyber-mission unit that the department only began fielding as little as two years.
Commendably, the department is leading it's schedule by standing up these units with trained personnel, but by it's own admission, the equipment, tools, and capabilities of these forces will remain limited. Indeed, the committee's proposed F.Y. '16 National Council Authorization Act, includes a mandate that the Secretary of Defense, designates executive agents from among the services to build a so- called, unified platform for assisting, training environment and command, and control systems that are necessary for these forces to operate effectively.
It will take a number of years to build these capabilities. We are behind in developing these military capabilities for our cyber forces because our Defense Department was persuaded that the systems and capabilities, that NSA already has, will be adequate and appropriate to use by Cyber Command. This is an important example in assumed critical dependency on NSA and an assumed commonality between intelligence operations and military operations in cyberspace; and in some cases, turned out to be inaccurate.
For a number of years, this committee has been urging the executive branch to work diligently to identify all practical methods that deter malicious actions of cyberspace and articulate a strategy for implementing them. Some believe, that relation of a kind, in cyberspace is a necessary and effective component of such a strategy.
I look forward to hearing the views of our witnesses on this matter. As my colleagues and our witnesses are well are, the Senate went into recess for the August break having recent agreement for bringing the Cyber Information Sharing bill to the floor debate. I know the Chairman is in full agreement on the needs to debate, amend, and pass that legislation this year, and the interest to national security and so among it.
We must also recognize that the Defense Department and intelligence community are not operating alone to protect America's cyber-infrastructure. Most notably, we (ph) rely on the Department of Homeland Security for protection of America's critical infrastructure.
The use of overseas contingency operations fund to avoid the Budget Control Act (inaudible) does nothing to help the DHS or another non-defense partners avoid of effects of sequestration. This is yet, another argument for why we need a comprehensive solution to the problem of sequestration.
Finally, I think it is important that we hear from our witness on the subject of encryption. (inaudible) U.S. technology companies fearful of losing business at home and abroad are encrypting communications and offer encryption services, for which even the companies themselves have no technical capabilities to unlock.
FBI Director Comey has given multiple speeches warning the law enforcement agencies and intelligence agencies that they will be going dark, with serious consequences to public safety and national security.
These and other questions, gentleman, are vitally important, and I look forward to your testimony.
MCCAIN:
I thank the witnesses.
Director Clapper, I've to impress on members of this committee to show difference to old age and so we'd like to begin with you.
CLAPPER:
Senator McCain, Ranking Member Reed, members of the committee.
When I testified on the intelligence community's World Wide Threat Assessment, at the end of February, cyber threats again, led our annual threat report for the third year in a row. We're here today, to respond to the several requests in your invitation letter, and I will focus on an overview of cyber-threats briefly that face our nations and their intended national security implications.
CLAPPER:
And then Secretary Work, Admiral Rogers will follow as well.
We will, as you understand, perhaps run into some classified aspects that we won't be able to discuss as fully in this open televised hearing. I do want to take note of and thank the members of the committee who are engaged on this issue and have spoken to it publicly as the two of you just have.
So by way of overview, cyber threats to the U.S. national and economic security are increasing in frequency, scale, sophistication and severity of impact. Although we must be prepared for large Armageddon-scaled strike that would debilitate the entire U.S. infrastructure, that is not, we believe, the most likely scenario.
Our primary concern now is low to moderate-level cyber-attacks from a variety of sources which will continue and probably expand. This imposes increasing costs to our business, to U.S. economic competiveness and -- and to national security.
Because of our heavy dependence on the Internet, nearly all information communication technologies and I.T. networks and systems will be perpetually at risk. These weaknesses provide an array of possibilities for nefarious activity by cyber threat actors including remote hacking instructions, supply chain operations to insert compromised hardware or software, malicious actions by insiders and simple human mistakes by system users.
These cyber threats come from a range of actors including nation states which fall into two broad categories, those with highly sophisticated cyber programs, most notably Russia and China, our -- our peer competitors. And those with lesser technical capabilities but more nefarious intent, such as Iran and North Korea who are also more -- but who are also much more aggressive and unpredictable.
Then there are non-nation state entities, criminals motivated by profit, hackers or extremists motivated by ideology. Profit-motivated cyber criminals rely on loosely networked online marketplaces often referred to as the cyber underground or dark web that provide a forum for the merchandising of illicit tools, services and infrastructure, and stolen personal information and financial data.
The most significant financial cybercriminal threats to U.S. entities and our international partners come from a relatively small subset of actors, facilitators and criminal forums. And terrorist groups will continue to experiment with hacking which could serve as the foundation for developing more advanced capabilities.
Cyber espionage, criminal and terrorist entities, all undermine data confidentiality. Denial of service operations and data deletion attacks undermine availability. And in the future I believe we'll -- we'll see more cyber operations that will change or manipulate electronic information to compromise its integrity. In other words, compromised attackers (inaudible) liability instead of deleting it or disrupting access to it.
As illustrated so dramatically in the OPM breaches, counter- intelligence risks are inherent when foreign intelligence agencies obtain access to an individual's identity information, of course a problem that the Department of Defense has encountered. Foreign intelligence agencies or non-state entities could target the individual, family members, co-workers and neighbors using a variety of physical and electronic methods for extortion or recruiting purposes.
Speaking of the OPM breaches, let me say a couple words about attribution. It is not a simple process, involves at least three related but distinct determinations, the geographic point of origin, the identity of the actual perpetrator doing the keystrokes, and the responsibility for directing the act. In case of OPM, we had differing degrees of confidence in our assessment of -- of the actual responsibility for each of these three elements.
Such malicious cyber activity will continue and probably accelerate until we establish and demonstrate the capability to deter malicious state-sponsored cyber activity, and establishing a credible deterrent depends on reaching agreement on norms of cyber behavior by the international community.
So, in summary, the cyber threats to U.S. national and economic security have become increasingly diverse, sophisticated and harmful. There are a variety of federal entities that work this cyber problem, and DHS, FBI, NSA and other law enforcement intelligence and sector- specific agencies like Treasury and Energy. And every day each these centers and entities get better at what they do individually. But I believe now we've reached the point where we -- we think it's time to knit together all the intelligence these separate activities need to defend our networks because, while these entities may be defending different networks, they are often defending against the same threats.
So that's one reason the President directed me to form a small center to integrate cyber threat intelligence. And I strongly believe the time's come for the creation of such a center to parallel the centers that we operate for counter terrorism, counter proliferation and counter intelligence and security.
With that, let me turn to Deputy Secretary Work.
WORK:
Chairman McCain, Ranking Member Reed, distinguished members of the committee, thank you very much for inviting us here this morning to talk about the threats of cyber -- of cyber. This committee has led the way in discussing the threats and the response to these threats and the Department looks forward to working with the committee to get better in this regard.
As DNI Clapper has said, cyber intrusions and attacks by both state and non-state actors have increased dramatically in recent years, and particularly troubling are the increased frequency and scale of state-sponsored cyber actors breaching U.S. government and business networks. These adversaries continually adapt and evolve in response to our cyber countermeasures, threatening our networks and systems of the Department of Defense, our nation's critical infrastructure and U.S. companies and interests globally.
The recent spate of cyber events conclude the intrusions into OPM, the attacks on Sony, and the Joint Staff networks by three separate state actors is not just espionage of convenience, but a threat to our national security.
As one of our responses to this growing threat, we released in 2015 the DOD cyber strategy which will guide the development of our cyber forces and strengthen our cyber-security and cyber deterrence posture; that is its aim.
The Department is pushing hard to achieve the Department's three core missions as defined in the strategy. The first and absolutely most important mission is to defend DOD network systems and information. Secretary Carter has made this the number one priority in the Department and we are really getting after it now.
Second, to defend the nation against cyber events of significant consequence, and third, to provide cyber support to operational and contingency plans. And in this regard, the U.S. Cyber Command may be directed to conduct cyber operations in coordination with other government agencies as appropriate to deter or defeat strategic threats in other domains.
Now, my submitted statement, Mr. Chairman, contains additional detail on how we're moving out to achieve these three strategic goals but I'd like to highlight a particular focus on deterrence, especially since I know this is key in the minds of most of the members here.
I want to acknowledge upfront that the Secretary and I recognize that we are not where we need to be in our deterrent posture. We do believe that there are some things the Department is doing that are working, but we need to improve in this area without question. And that's why we've revised our cyber strategy.
WORK:
Deterrence is a function of perception. It works by convincing any potential adversary that the costs of conducting the attack far outweigh the potential benefits, and therefore our three main pillars of our cyber deterrence strategy in terms of deterrence are denial, resilience, and cost imposition.
Denial means preventing a cyber adversary from achieving the -- his objectives. Resilience is ensuring that our systems will continue to perform their essential military tasks even when they are contested in a cyber environment. And cost imposition is our ability to make our adversaries pay a much higher price for their malicious activities than they hoped for.
I'd like to briefly discuss these three elements. To deny the attacker the ability to adversely impact our military missions we have to better defend our own information networks and data. And we think the investments we have made in these capabilities are starting to bear fruit, but we recognize that technical upgrades are only part of the solution.
Nearly every single one of the successful network exploitations that we have had to deal with can be traced to one or more human errors which allowed entry into our network. So raising the level of individual cybersecurity awareness in performance is absolutely paramount. Accordingly, we're working to transform our cybersecurity culture, something that we ignored for a long time, by the long term by improving human performance and accountability in this regard.
As part of this effort, we have just recently published the cybersecurity discipline implementation plan and scorecard. It is brought before the secretary and me every month and they're critical to achieving this goal of securing our data and our networks and mitigating risks to DOD missions.
This scorecard holds commanders accountable for hardening and protecting their end-points and critical systems, and also help them hold accountable their personnel. And directs, as I said, the compliance reporting to the secretary and me on a monthly a basis. The first scorecard was published in August of this year and it is being added to and improved as we go.
Denial also means defending the nation against cyber threats of significant consequence. The president has directed DOD, working in partnership with our other agencies, to be prepared to blunt and stop the most dangerous cyber events. There may be times where the president and the secretary of defense directed the DOD and others to conduct a defensive cyber operation to stop a cyber attack from impacting our national interests. And that means building and maintaining the capabilities to do that -- just that.
This is a challenging mission requiring high-end capabilities and extremely high-trained teams. We're building our cyber mission force and deepening our partnership with the law enforcement and the intelligence community to do that.
The second principle is improving resiliency by reducing the ability of our adversaries to attack us through cyberspace, and protecting our ability to execute missions in a degraded cyber environment. Our adversaries view DOD cyber-dependency as a potential wartime vulnerability. Therefore, we view our ability to fight through cyber attacks as a critical mission function.
That means normalizing cybersecurity as part of our mission assurance efforts, building redundancy whenever our systems are vulnerable, and training constantly to operate in a contested cyber environment. Our adversaries have to see that these cyber attacks will not provide them with significant operational advantage.
And the third aspect of deterrence is having to demonstrate the capability to respond through cyber and non-cyber means to impose costs on a potential adversary. The administration has made clear that we will respond to cyber attacks in the time, manner and place of our choosing, and the department has developed cyber options to hold an aggressor at risk in cyberspace if required.
Successfully executing our missions requires a whole-of- government and whole-of-nation approach. And for that reason, DOD continues to work with our partners in the other federal departments and agencies and the private sector, and our partners around the world to address the shared challenges we face. Secretary Carter has placed particular emphasis on partnering with the private sector. The department doesn't have all of the answers and is working with industry we think will be very, very critical.
Finally, our relationship with Congress is absolutely critical. The secretary and I very much appreciate the support provided to DOD cyber activities throughout, from the very beginning. And we understand and we are looking forward to the National Defense Authorization Act to see if there are other improvements that we have -- we can do. I encourage continued efforts to pass legislation on cybersecurity information sharing. We think that is absolutely critical to data-breach motivation and law enforcement provisions related to cybersecurity, which were included in the president's legislative proposal submitted earlier this year.
I know you agree that the American people expects us to defend the country against cyber threats of significant consequence. The secretary and I look forward to working with this committee and Congress to ensure we take every step possible to confront the substantial risks we face in the cyber realm.
Thank you again for inviting us here today and giving the attention that you have always given to this urgent matter.
I'd like to pass it on now to Admiral Rogers, if that's OK, Mr. Chairman.
MCCAIN:
(OFF-MIKE)
ROGERS:
Chairman McCain, Ranking Member Reed, distinguished members of the committee, I am honored to appear before you today to discuss U.S. cyber policy and the state of cyber threats worldwide. I'd like to thank you for convening this forum and for your efforts in this important area.
I'm also honored to be sitting alongside Director Clapper and Deputy Secretary of Defense Work.
It gives me great pride to appear before you today to highlight and commend the accomplishments of the uniformed and civilian personnel of U.S. Cyber Command. I'm both grateful for and humbled by the opportunity I've been given to lead our cyber team in the important work they do in the defense of our nation and our department.
We are being challenged as never before to defend our nation's interests and values in cyberspace against state, group, and individuals that are using sophisticated capabilities to conduct cyber coercion, cyber aggression and cyber exploitation. The targets of their efforts extend well beyond government and into privately owned businesses and personally identifiable information.
Our military is in constant contact with agile, learning adversaries in cyberspace -- adversaries that have shown the capacity and the willingness to take action against soft targets in the United States. There are countries that are integrating cyber operations into a total strategic concept for advancing their regional ambitions, who use cyber operations both to influence the perceptions and actions of states around them, and to shape what we see as our options in supporting allies and friends in a crisis. We need to deter these activities by showing that they are unacceptable, unprofitable and risky for the instigators.
U.S. Cyber Command is building capabilities that can contribute to cross-domain deterrence, and thus make our commitments even more credible. We are hardening our networks and showing an opponent cyber aggression won't be easy. We are creating the mission force, trained and ready like any other maneuver element, that is defending DOD networks, supporting joint force commanders, and helping to defend critical infrastructure within our nation.
We are partnering with federal, foreign and industry partners, and exercising together regularly to rehearse concepts and responses to destructive cyber attacks against critical infrastructures. We are generating options for commanders and policymakers across all phases of the conflict, and particularly in phase zero (ph) to hold at risk what our adversaries truly value.
ROGERS:
The demand for our cyber force far outstrips supply, but we continue to rapidly mature based on real-world experiences and the hard work of the men and women of the U.S. Cyber Command and our service cyber components as well as our broader partners.
I'd like to assure the committee that U.S. Cyber Command has made measurable progress. We're achieving significant operational outcomes and we have a clear path ahead.
With that, thank you again, Mr. Chairman and members of the committee, for convening this forum and inviting all of us to speak. Our progress has been made possible in no small part because of the support from this committee and other stakeholders. Unity of the effort within our department and across the U.S. government in this mission set is essential. And I appreciate our continued partnership as we build our nation's cyber defenses. And I welcome your questions.
MCCAIN:
Well, thank you admiral and thank the witnesses. Director Clapper recently, former Chairman of the Joint Chief, Dempsey was asked about various threats to the United States security and he said that in a whole range of threats we have a significant advantage except in cyber. Do you agree with that assessment?
CLAPPER:
It's probably true. We haven't I guess, exhibited what our potential capability there is. I think that's one of the reasons -- implicit reasons why I highlighted cyber threats in the last three years of my world wide threat assessments.
MCCAIN:
I thank you and you have done that and I think at least to great effect before this committee. As a result of the Chinese leader in Washington there was some agreement announced between the United States and China. Do you believe that that will result in an elimination of Chinese cyber attacks?
CLAPPER:
Well, hope springs eternal. I think we will have to watch what they're behavior is and it will be incumbent on the intelligence community I think to depict, portray (ph) to policymakers what behavioral changes if any, result from this agreement.
MCCAIN:
Are you optimistic?
CLAPPER:
No.
MCCAIN:
Thank you. Admiral Rogers, you recently stated quote, "There's is a perception, there is..." quote "...little price to pay for engaging in some pretty aggressive behaviors and because of the lack of repercussions you see actors, nation states indeed willing to do more." And that was what he stated. What is required? What action is required to deter these attacks since there is little price to pay? What do we have to do to make it a heavy price to pay?
ROGERS:
So I think we have to clearly articulate in broad terms what is acceptable and is unacceptable: the norms if you will, of behavior. I think we have to clearly articulate that as a nation, we are developing a set of capabilities. We are prepared to use those capabilities if required. They're not necessarily our preferences. We clearly want to engage in a dialogue with those around us.
But on the other hand we do have to acknowledge the current situation we find ourselves in. I don't there's anyone who would agree that it is acceptable and that it is in our best long-term interest as a nation.
MCCAIN:
Well, I say with respect I understand it's not acceptable but in other words, what would an act of price would it be? Relations in other areas? Would it be counterattacks? In other words, what actions would be in our range of arsenals to respond?
ROGERS:
So I think it's potentially all of those things. The first comment I would make, I think Sony is a very instructive example. One of the things I always remind people of. We need to think about deterrents much more broadly, not just focus within the cyber arena.
I thought the response to Sony where we for example, talked about the economic options as a nation we would exercise was a good way to remind the world around us that there are a broad set of capabilities and levers that are available to us as a nation and that we're prepared to do more than just respond in kind if you will.
MCCAIN:
Director Clapper, one of the things that has been disappointing to the committee is that in the fiscal year the Defense Authorization bill as you know it required the president to develop an integrated policy. The strategy is now a year late. Can you tell us where we are in that process and what you feel is what might bring the administration in compliance?
CLAPPER:
You're asking me about policy development?
MCCAIN:
Yes.
CLAPPER:
I think I would defer to Secretary Work on that.
WORK:
Well, Mr. Chairman, as we have said over and over, we believe our cyber deterrent strategy is evolving and getting stronger.
MCCAIN:
I'm talking about a policy, not a strategy Mr. Secretary. It required a policy that fiscal year '14 National Defense Authorization Act.
WORK:
The policy is still in development. We believe we have a good cyber strategy. The policy has been outlined in broad strokes by the ...
Not broad enough I would think. It is -- describe what are -- whether we deter or whether we respond, or whether we -- in other words, as far as know and the committee knows, that there has been no specific policy articulated in compliance of the requirement of the Defense of Authorization Act. If you believe that it has, I would be very interested in hearing how it has.
WORK:
I believe the broad strokes are will respond to...
MCCAIN:
I'm not asking about broad strokes. Suppose there is an attack, a cyber attack like the one on OPM. Do we have a policy as to what we do?
WORK:
Yes we do.
MCCAIN:
And what is that?
WORK:
The first is to try. First we deny and then we first find out. We do the forensics...
MCCAIN:
I'm not asking about the methodology. I'm asking the policy. Do you respond by counter attacking? Do you respond by trying to enact other measures? What do we do in case of a cyber attack?
WORK:
We respond in the time, manner and the place
MCCAIN:
Does that mean that we counter attack?
WORK:
That may be one of the options.
MCCAIN:
That's not a policy Secretary Work. That is an exercise in options. We have not got a policy and for you to sit there and tell me that you do a broad stroke strategy is frankly not in compliance with the law.
Senator Reed?
REED:
Well, thank you very much Mr. Chairman. Director Clapper, we are constantly engaged euphemistically, information operations with many other nations and they're involved with mission (ph) operations trying to, as you indicated in your testimony, influence the opinion, disguise activities, disrupt, et cetera. What agencies under your purview or outside your purview are actively engaged in information operations in the United States in the cyber world?
CLAPPER:
Actually sir, from an intelligence perspective we would feed that in that we don't at least, in what I can speak to publicly engage in that as a part of our normal intelligence activities. So we feed other arms, support other arms of the government, notably the State Department. And those responsible for messaging of the National Counter Terrorism Center has an office that is devoted to countering violent extremism context, helping to develop themes or recommending themes based on what we glean from intelligences for potential vulnerabilities and messages that would appear to various group that would obfuscate the message, disrupt it or compete with it.
But generally speaking, intelligence writ large doesn't actively engage in information operations.
REED:
From your perspective, are these other agencies that you provide the information to adequately resourced and staffed so they can use it effectively or are they getting a lot of good insights and sitting around wondering what they can do after...
CLAPPER:
If I were king which I am not, I think I'd have a much more robust capability from the standpoint of resource commitment to counter messaging.
REED:
And that would fall, well outside of the purview of intelligence or the State Department as other agencies?
CLAPPER:
Correct.
REED:
Again, I think we're old enough to remember the voice of America when it was, you know, a pretty dominant sort of source of information.
CLAPPER:
Well, personal opinion only not company policy I would -- I think perhaps, you know, a U.S.I.A. on steroids that would address these messages more broadly and more robustly but that's strictly personal opinion.
REED:
But I think in terms of what you're observing, particularly some of our competitors have a extraordinarily robust information operation. They don't lack for resources or personnel and they're constantly engaged in these types of information operations: enhancing their image, discrediting their opponents, actively engaging local groups in other countries of interest et cetera. And we're sort of on the sidelines.
CLAPPER:
I think that's quite right and our -- in contrast to us, Russian intelligence services are very active and very aggressively engaged in messaging.
REED:
Thank you. Admiral Rogers, so this issue of encryption that Director Coleman pointed to. I think your thoughts would be very helpful.
ROGERS:
So the issue that we find ourselves -- this is less for me and the U.S. cyber (inaudible) side and much more on the NSA side is communications in the world around us increasingly going to end to end encryption, where every aspect of the path is encrypted and the data and the communication is protected at a level under -- with the current state of technology is difficult to overcome.
Clearly that is in the best interest of the nation in broad terms and strong encryption is important to a strong Internet defense and a well defended Internet is in our best interest and in the nation's and the world's best interest.
Within that broad framework though, the challenge we're trying to figure out is, realizing that that communication path is used by very law-abiding citizens, nation states and companies engaged in lawful activity, is also being used by criminals, terrorists, nation states who would attempt to generate advantage against the United States and against our allies and partners.
And so we're trying to figure out how do we balance these two important imperatives of privacy and security and realizing that the technical world around us is changing in a foundational way. And so we're trying to come to grips broadly with how do we deal with the reality of technical world around us and yet the broader legal and social imperatives that we have.
I'm the first to acknowledge we do not have a defined way ahead here. In the end I think this is about how do we get the best minds together as a nation to address this. Cause when I look at our capabilities as a nation, there is no problem that we can't overcome when we work together in an integrative way to in the private sector, industry, business, the academic world. I think that is that's the way ahead here in broad terms.
REED:
Thank you very much.
Thank you Mr. Chairman.
MCCAIN:
(OFF-MIKE)
SESSIONS (?):
Senator Inhofe is chairing the EPW Committee; that's why he couldn't be here today.
You've given us a good summary on the threats that we faced and the threats that are actually occurring today, and I appreciate that. Senator McCain, asked you about established reporting on the policy that Congress has asked you to report, and that not having been done. Mr. Secretary Work, in the 2014 NDAA, the Senate and House agreed on a provision that required the services to report on the cyber- vulnerabilities weapons and communications systems connected by networks.
That was something that came out of our Strategic Subcommittee on a bipartisan basis and was eventually expanded to include all weapon systems, not just satellite, and missiles, and national missile defense. We don't have that final report, I believe it's overdue.
This budget, I believe, has two hundred million in it, to help fund this effort. What can you tell us about that?
First, let me say, it may take some time. If it does, I understand, but I don't think we've had any report from the DOD to state that; what progress you've made, and how much longer it will take.
WORK:
Well again, on both of the points, on the policy, we expect that is in the final deliberations. It's an interagency effort. You know, generally, trying to establish norms and deterrence is central to the policy. Again, it's the denial, resilience, and cost imposition.
I'm the first to admit, that we are the farthest ahead on the denial and the resilience part, those are the areas where we are moving faster. The cost imposition part, because we have elected to retain the retaliatory mechanism of cyber-attacks at the national level. Just like nuclear weapons, because of the risk of escalation.
SESSIONS (?):
What about the...
WORK:
As far as the -- I'm sorry, sir.
SESSIONS (?):
The other...
WORK:
Yes, sir.
SESSIONS (?):
The vulnerabilities of our weapon systems?
WORK:
It is a big -- big problem. Many of the weapons systems that we have now, were not built to withstand a concerted cyber- threat. So going through every single one of the weapon systems, what Frank Kendall done, is he's prioritized the weapon systems and he is working through very carefully. And, I expect this work to be done very soon.
We now have new requirements in our KPPs, our Key Performance Parameters...
SESSIONS (?):
So you have assigned an individual?
WORK:
Absolutely.
SESSIONS (?):
... to be responsible for this?
WORK:
Yes, Frank Kendall, is the one who is going through all of the different -- working with, obviously, our CIO, also the Cyber Command, and all our cyber experts. But he's responsible for taking a look at the weapon systems and also requiring KPPs, Key Performance Parameters, for new weapon systems. So that when we build they will have cyber defenses built in from the beginning.
SESSIONS (?):
What about our defense contractors, Admiral Rogers? They maintain and build these systems and have highly sensitive information, are we satisfied they're sufficiently protected?
ROGERS:
So we've acknowledged there's a vulnerability there. We've been very public about our concerns about foreign nation-states trying to access some of our key operational technology through penetration in the cleared defenses contractor arena for us.
We've made changes to the contractual relationships between us and those companies where they have to meet minimum cyber-security requirements. They have to inform us now of penetrations. We're clearly not where we need to be but we continue to make progress.
SESSIONS (?):
Well, I think it's a bipartisan commitment on Congress to help you with that.
Secretary Work, if it takes more money, let us know. We'll have to evaluate it. And, I also understand that some of protections can be done without much cost; some may require considerable cost. So we hope that you will complete that.
Admiral Rogers, you -- I believe last week, reported in the Los Angeles Times about the threat from China. You note one thing, that they are involved in obtaining U.S. commercial and trade data. Foreign nation, advanced nation, ally of ours; I was told that one of their companies bid on a contract and that the Chinese had gathered all the bid data from the web. And his comment was, "It's hard to win a bid when your competitor knows what you're bidding." Is that kind thing happening?
ROGERS:
It has been, we've been very public of it. I think that's reflected in the agreement that you saw raised during the President of China's visit last week. We were very explicit about that concern.
SESSIONS (?):
Well, my time is up but I would just ask; you're not allowed -- if you saw an American business being damaged through improper actions, you're not allowed to advise them or share any information with, while our adversary do assist their business? Is that basically correct?
ROGERS:
The way this works right now, is I would provide information and insight, both in my intelligence hat as the Director of NSA as well as the Commander of U.S. Cyber Command. If under that authority, I became aware of activity, I would share the insights with DHS and the FBI, who have a mission associated with interfacing with the private sector in a much more direct way than I do.
MCCAIN:
(OFF-MIKE)
(UNKNOWN)
Thank you, Mr. Chairman.
And thank all three of you for your service and for being here today.
Admiral Rogers, let's start with you.
Which country is the most committed, and determined, and successful hacker of the U.S.?
ROGERS:
Could you say that one more time?
(UNKNOWN)
Which country, do you believe, is the most committed, successful hacker of the U.S.?
ROGERS:
If you look at volume and nation-state wise -- nation- state wise, I would -- China, the PRC, has been the one that we've been the most vocal about. They're not the only one by any the stretch of the imagination.
(UNKNOWN)
I thought the last time you were here, I recall you saying that you had more concerns over Russia, having more of the ability or expertise to do us damage.
ROGERS:
I thought your question was really focused more on volume. If the perspective is capability if you will, then we've been very public about saying -- I would probably put the Russians.
(UNKNOWN)
Russians?
ROGERS:
In a higher capability.
(UNKNOWN)
But it seems like that China is more committed and determined to do it.
ROGERS:
They certainly do it at a volume level.
(UNKNOWN)
Gotcha, I understand.
And, Director Clapper, if I may? I know that you just said, no -- emphatically no, you don't believe that this agreement that the president of China and our president has made last week will work.
With that saying, what are the penalties? Is there any penalties in this agreements if one or other violates it or is it just basically what we've agreed and let it go at that?
CLAPPER:
The terms that I've seen, I don't think it treats specifically a penalty. There certainly are implied penalties. I think the threat of economic sanctions which brought Minister Meng (ph) to this country, I think it's (inaudible), what would mean something to the Chinese if they transgress or violate this agreement?
I think as Admiral Rogers was discussing earlier, with respect to sanctions, there certainly are a whole of government possibilities that don't have to do -- necessarily a cyber eye for an eye, it can be some other form of retribution -- of retaliation. But I don't think to answer your question, at least what I'm aware of that there are specific penalties if the agreement is violated.
(UNKNOWN)
That's why I think you were pretty quick in saying you don't think it will work. You said "no" to that, I think when the Chairman asked you.
CLAPPER:
Well, the reason I said "no," of course, is the extent to which the Chinese forewarning (ph) of our data, our intellectual property, is pretty pervasive. I think there's a question about the extent to which the government actually orchestrates all of it, or not?
So, I think we're in the bottom of the barrel -- President Reagan term, "trust but verify," motives, at least as far as intelligence is concerned and we are inherently skeptics.
WORK:
Sir, if I could?
(UNKNOWN)
I have a question for you, Secretary, then you can go ahead and add to that.
The recent news article that examines similarities between China's J-315 and our F-35 Strike Fighter, and what they've been able to do in such a rapid period of time without any R&D. Do you believe that gives them an competitive advantage? I mean, you can -- I understand that there might be some differences as far as, in the software, the weapons, and this and that. But they're making leaps which are uncommon at the behest of us and we know this, I understand, but we're not taking any actions against them.
WORK:
Well, I'd like work this in to your -- to follow up with your first question.
(UNKNOWN)
Yes, go ahead.
WORK:
At the highest levels, we have made it clear that we believe that Chinese actions in the cyber sphere are totally unacceptable as a nation-state. And, we made that clear in a wide variety of different was, and I would characterize the agreement that we have as a confidence building measure with the Chinese. Where we are asking them to prove to us that they are serious about what they say, about what they do to control these efforts.
So we-- there were really four things, that we agreed to do. First, we would give timely responses to information when we say, "Hey, we believe that there is a problem here and we have agreed to exchange information on cyber-crimes, we've agreed to possibly collect electronic evidence, and to mitigate malicious cyber activity that's occurring on our soil."
We both agreed, that we would not knowingly conduct cyber enabled theft of intellectual property, which as you say senator, has been a problem. We have told them, "It's a problem; it's unacceptable." They have said that they will work to curb that. Then we've agreed to have common effort to promote international norms.
And the final thing is, we'll high level joint mechanism, where we can meet at least twice a year and say, "Look, this is just not working. You are not coming through with you've said." So this isn't a treaty or anything like that, it's a confidence building measure for us to find out if China is going to act responsibly.
I agree tonally with Director Clapper, they've got to prove to us. And we know, that they have stolen information from our defense contractors.
(UNKNOWN)
Right.
WORK:
And, it has helped them develop systems, and we have hardened our systems through the Defense Industrial Base Initiative; and we've trying to make...
(UNKNOWN)
I understand, we know the J-20 is pretty much, mirroring our F-22. We know that their J-31 is pretty mirroring our F-35. When we know this and the cost to the American taxpayers -- and let them get a -- I mean, why wouldn't we take hard actions against them? Why wouldn't we come down -- I just don't understand, why we wouldn't retaliate from a financial standpoint?
WORK:
There are a wide variety of cost and position options that we have. They're developed through the interagency and, again, it's not necessarily a kind -- I mean, tit-for-tat, it is proportional response, and we're working through all of those right now.
(UNKNOWN)
My time is up, sir, and if I could just follow up on that later, if we could meet with you later, I'd...
WORK (?):
Absolutely, sir.
(UNKNOWN)
... (inaudible) appreciate it.
CLAPPER (?):
Senator, if I may, just add a word here about -- this is a point Admiral Rogers has made in the past about, you know, terminology, lexicon, nomenclature, definitions are important. And so what this represents, of course, is espionage, economic...
(UNKNOWN)
Absolutely.
CLAPPER (?):
... cyber espionage, and, of course, we too practice cyber espionage and in a public forum to, you know, say how successful we are but we're -- we're not bad at it. So when we talk about what are we going to do for -- to counter espionage or punish somebody or retaliate for espionage, well, we -- I think it's a good idea to at least think about the old saw about people live in glass houses...
(UNKNOWN)
That's (inaudible).
CLAPPER (?):
... shouldn't throw rocks.
MCCAIN (?):
So it's OK for them to steal our secrets that are most important (inaudible)...
CLAPPER:
I -- I didn't say that, sir...
MCCAIN (?):
(inaudible) because we...
CLAPPER (?):
I -- I didn't say that, Senator.
MCCAIN (?):
... because we live in a glass house. That is astounding.
Senator Ayotte?
CLAPPER (?):
I did not say it's a -- it's a good thing. I'm just saying that both nations engage in this.
AYOTTE:
I want to thank all of you for being here.
With regard to the Chinese, I want to follow up on -- we -- we've talked about the stealing of the highest secrets in terms of our weapons system, but what about the 21 million people whose background check and personal information has been, of course, associated publicly with the Chinese. And the fact that we know that 5 million sets of fingerprints, as well, leading to potential vulnerability for our citizens. And if you put that in the context of these other issues that we've raised, it seems to me -- I -- I looked very carefully, for example, Secretary Work, at some of the language you've been using. You -- you gave a speech at the Royal United Services Institute in London; you said deterrents must be demonstrated to be effective. Secretary Clapper, in your prepared statement, you said the muted response by most victims to cyber-attacks has created a permissive environment.
So I'm trying to figure out based on what you've said how we're not in a permissive environment in light of what they've stolen on our weapons systems but also this huge infringement on 21 million people in this country. And also could you comment on the vulnerability of that data and where we are in terms of how...
CLAPPER:
Well...
AYOTTE:
... it would be used against us?
CLAPPER:
First, that -- that is an assessment of what was taken. We actually don't know in terms of specific -- specifics but that's -- I think, frames the magnitude of this theft and it is potentially very serious -- has very serious implications first close -- close to home from the standpoint of the intelligence community, and the potential for identifying people who may be under covered status, just one -- one small example. And of course it poses all kinds of potential -- and, unfortunately, this is a gift that's going to keep on giving for years.
So it -- it's a very serious situation. What we try to do is educate people what to look for and how to protect themselves but, again, this is a huge threat of theft and it has potentially damaging implications for lots of people in the intelligence community and lots of people in the Department of Defense and other employees of government.
AYOTTE:
So I think what you're hearing from some of us up here is just a -- now, what are we going to do about it, is the issue as opposed to a -- a shared agreement on generic principles with the Chinese. This is a pretty significant issue that is going to impact millions of Americans. I'm not hearing what we're going to do about it, but that may be a higher level of decision going up to the President.
But seems to me, if we're going to talk about deterrence, if we don't follow up with action, and if you look at that combined with the testimony we heard last week about the artificial islands being built by the Chinese and the fact that we won't even go within I believe its 12 nautical miles of those islands, if you put that all from the Chinese perspective, I think you think, hmm, we can pretty much do what we want to do because we haven't seen a response.
Now, I'm not asking for -- from all of you to -- to answer that because it probably needs to be answered by the President and his national security team, but it seems to me that they aren't seeing a response right now from us and therefore we're going to see -- continue to see bad behavior from the Chinese.
Before I go, I have an important question on another topic, Secretary Work, and that is yesterday we heard public reports about a potential violent -- violation of the INF Treaty by the Russians and that essentially Russia tested -- flight tested a new ground-launched cruise missile this month that U.S. intelligence agencies say further violates the 1987 INF Treaty. And, of course, this is going back also to the reports as early as 2008 of the -- Russia conducting tests of -- of another ground-launched cruise missile in potential violation of the INF Treaty that we've raised with them, and when Secretary Carter came before our committee on his confirmation, he listed three potential responses to these INF violations.
So now we have the Russians violating the INF Treaty yet again and I guess my question is, Secretary Carter rightly identified that we should respond either through missile defense, counterforce or countervailing measures. What are we doing about it?
WORK:
Senator, this is a long-standing issue that we have been discussing with the Russians. The system that you're talking about is in development; has not been fielded yet. We are -- we have had different discussions with them on our perception of the violation of the INF and they have come back. This is still in discussions and we have not decided on any particular action at this point.
AYOTTE:
So are you saying that you don't think they violated the INF Treaty?
WORK:
We believe very strongly that they did.
AYOTTE:
That's what I thought. So what are we going to do about it, because they're claiming that they haven't, going back to the 2008 violations, and now here we have another situation.
WORK:
It's still under -- because they have not fielded the system, we are still in the midst of negotiating this position. We are giving ours but if they do field a system that violates the INF, I would expect us to take one of the three options that Secretary Carter outlined before the committee.
AYOTTE:
So my time is up but I see two consistent themes here, both with the Chinese and the Russian. A lot of talk, no action, unfortunately, and people take their cues from that and that worries me.
Thank you, all.
MCCAIN:
(OFF-MIKE)
HIRONO:
Thank you, Mr. Chairman.
Director Clapper, you testified before the House Intelligence Committee recently that they -- while the United States makes distinctions between cyber-attacks conducted for economic purposes or to gain foreign intelligence, I would -- that's the espionage arena, I think that you're referring to, or to cause damage our adversaries do not. Would you consider the OPM breach to the extent that we believe it is a state actor who did that, that that would be in the category of espionage?
CLAPPER:
Yes.
HIRONO:
So...
CLAPPER:
That was the tenor of the discussion at the HPSCI hearing that Admiral Rogers and I engaged in. And, of course, that has to do with the -- as I mentioned earlier to Senator Manchin, the importance of definition, nomenclature and terms. So -- and the definition of these terms. And so what the theft of the OPM data, as egregious as it was, we wouldn't necessarily consider it as an attack. Rather, it would be...
HIRONO:
Yes.
CLAPPER:
... a form of...
HIRONO:
Well, (inaudible)...
CLAPPER:
... theft or espionage.
HIRONO:
And, as you say, other countries, including our own, engages in such activities. My understanding of the recent agreement between the United States and China, though, has to do with commercial cyber theft, and I think that's a very different category that has to do with obtaining information about corporations, et cetera, and -- and therefore, that that is in the category of economic attacks.
So, Director Clapper, would you consider that kind of an agreement to be helpful? I realize that you are skeptical but to the extent that we are defining a particular kind of -- of cyber-attack and -- and that we're contemplating through this agreement an ability of our two countries to engage in high level dialogue regarding these kinds of -- of attacks, is it -- is that a helpful situation?
CLAPPER:
Well, it would be -- it would be -- it'd be very helpful if, of course, the Chinese actually live up to what they agreed to. So if -- and -- and what the agreement pertained to was theft of data for economic purposes, to give Chinese commercial concerns an advantage or their defense industries an advantage. As opposed to -- I don't believe they -- that we've agreed with the Chinese to stop spying on each other.
HIRONO:
Yes.
CLAPPER:
And so there -- there is a -- for purely espionage purposes and there is a distinction.
HIRONO:
Mr. Secretary, you can weigh in on this also. To the extent that we've created an -- a potential for dialogue or an environment where there's a process to be followed and the -- cases where we suspect commercial cyber-attacks, that at least we have a way that we can talk to the -- the Chinese.
Because you also mentioned, Director Clapper, that attribution is not the easiest thing, although we are getting better at figuring out who actually were the actors that did these cyber-attacks. So one hopes that even with a -- a great deal of skepticism going forward that this agreement may create this space for us to have a -- more than a conversation but one that would lead to some kind of a -- a change in behavior on the part of these state actors. Mr. Secretary, feel free to give us your opinion.
WORK:
Senator, I think that's exactly right.
WORK:
I mean, as Director Clapper said, first you have to find out the geographical location from the -- where the attack came from. Then you have to identify the actor, then you have to identify whether the government of that geographic space was either controlling (inaudible)...
HIRONO:
Recognize that's not the easiest to do, yes.
WORK:
And what we have done is we have confronted China and China in some cases has said, "Look, this was a hacker; it was inside our country, but we have no control of it." What this allows us to do is say, "OK, well what are you going to do about that? That's a cyber crime. Are you going to provide us the information we need to prosecute this person? Are you going to take care of it on your own?"
So I believe this type of confidence-building measure and this way to discuss these things will -- the truth will be in the pudding, how the Chinese react to this.
HIRONO:
Mr. Secretary, I think you mentioned that this particular agreement allows -- contemplates meeting at least twice a year. Is there anything that prevents more frequent dialogue between our two countries in suspected cases of commercial cyber attacks?
WORK:
Senator, I believe that if there was a significant cyber event that suspected the Chinese of doing, or they suspected us, that we would be able to meet (inaudible). This is going to be a high- level joint dialogue. The Chinese will have it at the ministerial level. Our U.S. secretary of homeland security and the U.S. attorney general will co-lead on our part. We're going to have the first meeting of this group by the end of this calendar year, and then at least twice a year.
So I believe that -- Director Clapper (inaudible) -- I think all of us have some healthy skepticism about this, but I believe it's a good confidence-building measure and good first step, and we will see if it leads to better behavior on the part of the Chinese.
HIRONO:
Thank you.
MCCAIN:
Mr. Secretary, I can't help -- (inaudible) comment. We have identified the PLA building in which they operate. Now, please don't deceive this committee as if we don't know who's responsible for it. That's just -- that's just very disingenuous. There have been public reports that we've identified the PLA building in which these cyber attacks come from.
Senator Ernst?
ERNST:
Thank you, Mr. Chair.
Thank you, gentlemen, for joining us today.
Admiral Rogers, I'll start with you, sir. Two of the president's nine lines of effort in defeating ISIL are, first, exposing ISIS's true nature, and second, disrupting the foreign fighter flow. And over the weekend, the New York Times reported that 30,000 recruits joined ISIS over the past year, and that's double the previous recruitment year.
Earlier this month, in reference to ISIS recruiting, the State Department's ambassador at large and coordinator for counterterrorism said that ISIS's recruiting trend is still upward, and this information came of no surprise to her. The ambassador also said the upward trend was primarily due to Internet and social media.
So, sir, do you believe the administration's efforts have so far succeeded on these two lines of effort in cyberspace and social media? Just please, simple yes or no.
ROGERS:
No.
ERNST:
OK. In light of that, with the record recruiting numbers for ISIS, how would you then assess the effectiveness of the U.S. government's counter-ISIS effort in cyberspace? So, what specifically is your assessment of the State Department's think again, turn away program in support of efforts to disrupt ISIS's online recruiting effort?
ROGERS:
Senator, I'm not in a position to comment on the State Department -- the specifics of their program. I honestly am just not know knowledgeable about it. I will say this broadly, to get to I think your broader point, I have always believed that we must contest ISIL in the information domain every bit as aggressively as we are contesting them on the battlefield; that the information dynamic is an essential component of their vision, their strategy and ultimately their success. And we have go to be willing to attempt to fight them in that domain just like we are on the battlefield and we clearly at not there yet.
ERNST:
I agree. I think we are failing in this effort. And some of the programs that we have seen obviously are not working. So are there areas where you could recommend how the U.S. government better partner with various NGOs or private entities to more effectively counter the ISIS propaganda?
ROGERS:
Again, the contesting the propaganda piece is much broader than Cyber Command's mission. I will say from a technical and operational perspective, we broadly within the DOD, the Cyber Command, Strategic Command and CENTCOM, are looking at within our authorities, within our capabilities, let's look in the realm of the possible in terms of what can we do to help contest them in this domain.
ERNST:
We have a larger problem coming forward, too, in regards to ISIS and ISIL in the Middle East. We seem to see the emergence of a trifecta between Syria, Iran and Russia. And now it seems that Iraq has begun information sharing with Russia, with Iran, with Syria.
Director Clapper, can you speak to that and the broader implications of Russia emerging as a leader in the Middle East while we seem to be frittering away our opportunity with ISIL?
CLAPPER:
Well, that's certainly their objective. I think they have several objectives here, one of which is that I think protect their base, their presence in Syria, ergo their buildup in the northwest part of Syria; clearly want to prop up Assad. And I think a belated motivation for them is fighting ISIL.
As far as the joint intelligence arrangement is concerned, I can't go into detail here in this forum, but I will say they are -- each of the parties entering into this are a little bit suspicious of just what is entailed here. So we'll have to see just how robust a capability that actually provides.
ERNST:
OK. I appreciate that.
Secretary Work, do you have any thoughts on the emergence of Russia with the intelligence sharing, how that might impact the operations that we have ongoing in Iraq against ISIS?
WORK:
Well, I think we were caught by surprise that Iraq entered into this agreement with Syria and Iran and Russia. Obviously, we are not going to share intelligence with either Syria or Russia or Iran. So we are in the process -- our -- we are in the process of working to try to find out exactly what Iraq has said. Certainly, we're not going to provide any classified information to help those actors on the battlefield.
Really, what we're trying to do is de-conflict. And that is the primary purpose of the discussion between President Obama and President Putin yesterday is if you are going to act on this battlefield, we have to de-conflict.
The other thing we have made clear is they would like to do the military first, followed by a political transition. We would -- we believe those two things have to go in parallel and that has been our consistent message. This is early days. We are still in the midst of discussing what exactly this means. So I don't have any definitive answers for you at this point, Senator.
ERNST:
Well, I'm very concerned that we have abdicated our role in the Middle East, and in so many other areas, as have been pointed out earlier -- a grave concern to all of us. And I think we need to be working much more diligently on this.
Thank you, Mr. Chair.
MCCAIN:
(OFF-MIKE)
NELSON:
Thank you, Mr. Chairman.
Gentlemen, thank you for your public service.
Admiral, I'm concerned about all of these private telecoms that are going to encrypt. If you have encryption of everything, how in your opinion does that affect section 702 and 215 collection programs?
ROGERS:
It certainly makes it more difficult.
NELSON:
Does the administration have a policy position on this?
ROGERS:
No. I think we're still -- I mean, we're the first to acknowledge that this is an incredibly complicated issue, with a lot of very valid perspectives. And we're still I think collectively trying to work our way through sort of what's the right way ahead, recognizing that there's a lot of very valid perspectives.
But from the perspective of Cyber Command and NSA, that I look at the issue, there's a huge challenge for us here that we have got to deal with.
NELSON:
A huge challenge. And I have a policy position, and that is that the telecoms better cooperate with the United States government, or else it just magnifies the ability for the bad guys to utilize the Internet to achieve their purposes.
Speaking of that, we have a fantastic U.S. military. We are able to protect ourselves. It's the best military in the world, but we have a vulnerability. And it's a cyber attack. Do you want to see if you can make me feel any better about our ability to protect ourselves going forward?
ROGERS:
I would tell you that current state of capability in the department, if I just look at where we were 18 months ago, two years ago, it is significantly improved. We currently defeat probably 99 point some-odd percentage of attempts to penetrate DOD systems on a daily basis.
The capability in terms of both the amount of teams; their capability just continues to improve -- our speed, our agility. The challenge for us fundamentally to me is we are trying to overcome decades of a thought process in which redundancy, defensibility, and reliability were never core-designed characteristics for our networks; where we assumed in the development of our weapons systems that external interfaces, if you will, with the outside world were not something to be overly concerned with.
They represented opportunity for us. They were remotely monitored activity to generate data as to how aircraft, for example, or ships holds (ph) were doing in different (inaudible) around the world -- all positives (inaudible) China developed the next generation, for example, of cruiser destroyers for the Navy. But in a world in which those public interfaces, if you were, increasingly represent also potential points of vulnerability, you get this clash of strategy, if you will. And that's where we find ourselves now.
So one of the things I try to remind people is it took us decades to get here. We are not going to fix this set of problems in a few years. It takes dedicated prioritization, dedicated commitment, resources, and we've got to do this in a smart way.
ROGERS:
We've got to prioritize and we've got to figure out what's the greatest vulnerability and where's the greatest return (ph) for us...
WORK:
Senator, is it OK if I jump in here for a second? I just want to add to that...
ROGERS:
... and for us to let our potential enemies understand that we have the capabilities of doing to them what they do to us. However, that gets more complicated when you're dealing with a rogue group of people stuck in a room somewhere that are not part of a nation state.
NELSON:
Yes, sir, Mr. Secretary.
WORK:
Well, I was just going to echo what Admiral Rogers said. When Secretary Carter came in he said, look we are absolutely not where we need to be and he made job number one defense of the networks. So we're going from 15,000 enclaves to less than 500. We're going to have -- we're going from 1,000 defendable firewalls to less than 200, somewhere between 50 and 200. So, you're absolutely right. We have recognized this as a terrible vulnerability.
We are working, first to defend our networks as we talked about earlier. We're looking at our systems and we're also trying to change the culture. Right now if you discharge a weapon, you are held accountable for that. Negligent discharge is one of the worst things you can do. But we need to do is inoculate a culture where cyber discharge is just as bad and make sure that culture is inoculated throughout the force.
NELSON:
I agree, but now the Admiral is assaulted by the telecoms who want tie his hands behind his back by doing all of the encryption.
Thank you Mr. Chairman.
MCCAIN:
(OFF-MIKE)
(UNKNOWN)
Thank you Mr. Chairman.
In our state, naval surface warfare (ph), Senator Cardin (ph) has taken the lead on much of our efforts to protect against the threat of counterfeit electronics. And so, Secretary Work and Director Clapper, the global supply chain for micro electronics presents a growing challenge for cyber-security.
One of the things we saw recently, IBM sold it's chip-making facilities with DOD trusted foundry status to a foreign-owned competitor. So I was wondering your top priorities in managing the risk posed by the globalization of our micro electronics manufacturing capabilities and our abilities to protect our systems in that area.
WORK:
That's a big question Senator, in fact it's going to be one of the key things we look at in this fall review because of the recent -- as you said, the recent sale of the IBM chips.
Now, there are two schools of thought on this. Secretary Carter personally has jumped into this and some say you do not need a trusted foundry. Another group says you absolutely have to have it. Having confidence in the chips that we put in our weapons system is important and I would expect that come February we would be able to report out the final decisions through the fall review on how we're going to tackle this problem.
(UNKNOWN)
Who within DOD's leadership has primary responsibility for overseeing the supply chain risk management.
WORK:
That would be Frank Kendall and DLA. DLA has the supply chain and Frank Kendall is really focused on the trusted chip, the fabrication of trusted chips.
(UNKNOWN)
One of the areas that we look at in regards to cyber and in some ways you know, technology in particular parts of it, not advancing it has been a good thing in this respect, is in the nuclear area. So are there any specific groups that are focused just on protecting our nuclear efforts against cyber?
WORK:
There's the national, the NESA, and also we have a nuclear weapons council which is co-chaired by again, Frank Kendall, our undersecretary of defense for ATML and the vice chairman of the Joint Chiefs. They are the ones that work with DOE to make sure that our weapons system components are reliable and trusted. And to make sure that we have a safe, reliable and effective nuclear deterrent.
(UNKNOWN)
Admiral, when we look at building the force of cyber warriors, the cyber team, how can we use the National Guard, Reserves to do that. Because it strikes me that can help us in retaining highly qualified individuals who want to devote part of their life to helping their country. And it would seem to almost be a perfect fit for us.
ROGERS:
So we have taken a total force approach to the force that we're building out, that includes both guard and reserve, every service slightly different not the least of which because different services have different Reserve and Guard structures. So that is a part of it. I'd say one challenge we're still trying to work our way through is under the title 32 piece, how we coordinate, what guard and reserve are doing, how we generate capacity and bring to bear with maximum efficiency.
The one thing -- the two things in partnering with my guard teammates and my reserve teammates, because we are taking a total force approach for this, we need one standard for this. We don't want a place where the guard and reserve are trained to one standard and the active side is trained to a different. That gives us maximum flexibility in how we apply the capability across the force, and the Guard and Reserve has done great in that regard.
And then secondly, we need one common unit structure. We don't want to build unique one of a kind structures in the guard and reserves that don't match the title ten side again. We want to treat this is as one integrated force and again I would give the guard and the reserve great kudos in that regard. We've got a common vision about the way we need to go. We've got a great exercise series cyber guard that we're using every year where we bring together the guard, the private sector, the active component, government and work our way through the specifics of how we will make it work.
(UNKNOWN)
Director Clapper, and I apologize if you have already answered this. What is the one cyber challenge you are most concerned about?
CLAPPER:
Well, obviously, the one that I have to think about is -- would be a massive armaggedon-like scale attack against our infrastructure. That is not -- we don't consider that the most likely probability right now that the greater threat or the low to moderate sort of threats that we're seeing. And what I have seen in the five years that I've been in this job is a sort of progression where these get more aggressive and more damaging.
And as I indicated in my oral statement at the outset what I will see, I think what we can expect next are data manipulation which then cause -- calls into question the integrity of the data which in many ways is more insidious than the kinds of attacks that we've suffered thus far. So, you know, the greater -- the specter is this massive attack though it's not likely.
(UNKNOWN)
Thank you.
Thank you, Mr. Chairman.
MCCAIN:
(OFF-MIKE)
(UNKNOWN)
Thank you, Mr. Chairman.
Annex 3 of the recently signed nuclear agreement calls for the participating countries to work with Iran to quote "Strengthen Iran's ability to protect against and respond to nuclear security threats, including sabotage, as well as to enable effective and sustainable nuclear security and physical protection systems." Close quote.
Secretary Clapper, do you read this portion of the nuclear agreement -- the annex to include cyber threats, meaning that the P5- plus-one countries who are part of this agreement will be expected, will be deemed to have an obligation under the agreement to assist Iran in developing systems to prevent other countries from using cyber capabilities to acquire information about or to disrupt the operations of Iran's nuclear capabilities or Iran's nuclear programs?
CLAPPER:
Well, in this environment I would say that I trust that this is not going to prevent us from gleaning intelligence from our traditional sources in the interest in verifying the agreement which will be principally monitored by an international organization, IDEA. So I'm not aware of any strictures on our ability to collect on their behavior and their components.
(UNKNOWN)
But why would we want to give Iran the ability to defend against cyber weapons that we or perhaps some of our allies might one day want to use against Iran?
CLAPPER:
Well, sir in this open environment there are some aspects here that I can't stress. I'd be happy to talk with you privately or in a classified environment about that.
(UNKNOWN)
OK, OK. But you're not disputing the fact that the agreement says that, that we would have to...
CLAPPER:
No.
(UNKNOWN)
OK. Now, can you tell me in this environment what specific technical assistance we'll be offering Iran in this portion of the agreement.
CLAPPER:
I honestly don't know the answer to that question. I would have to have that researched. I don't know exactly what's in mind there.
(UNKNOWN)
Now, would any of these capabilities, once acquired by Iran, prevent or inhibit the United States or any of our allies and another enemy of Iran from using any cyber measure against Iranian nuclear facilities?
CLAPPER:
Again, I'm reluctant to discuss that in this setting.
(UNKNOWN)
Were you consulted by U.S. negotiators during the nuclear negotiations in connection with this portion of the agreement?
CLAPPER:
Well, the intelligence community was deeply involved throughout the negotiations.
(UNKNOWN)
Can you describe the nature of any consultation you had with them as to this portion of annex 3?
CLAPPER:
With the Iranians?
(UNKNOWN)
Yes.
CLAPPER:
No, I did not engage with the Iranians with...
(UNKNOWN)
No, that's not what I'm asking. I'm asking if you can describe your discussions with U.S. negotiators as they came to you and consulted with you on the implication of this portion annex 3.
CLAPPER:
I didn't actually -- my lead for this was Norm Rule (ph), known to many of you on this committee as National Intelligence manager (ph) for Iran and he was the direct participant and I don't want to speak for him as to the extent to which he was involved or consulted on that provision. I would have to ask him.
(UNKNOWN)
OK, but you would of been aware of consultations going on? I'm sure he came to you and said look this is going to impact our ability, the ability of the United States to do what we need to do with respect to Iran. Might that have been something...
CLAPPER:
Again, sir, I would rather discuss what the potential response of ours could be in a closed setting.
(UNKNOWN)
OK, Secretary Work, how is the department working to ensure that the hardware and software on some of these major programs we're developing can fit to future contingencies in technological advances, so they can continue to address emerging cyber threats well into the future without major overhauls of the entire system?
WORK:
Senator, as I said, "we are now putting into our KPPS, our Key Performance Parameters in any new systems, specific cyber- hardening requirements." Much like during the Cold War when we had EMP requirements for many of our systems. The problem that we face is that many of the old systems that are still in service, were not built to the -- to respond to the cyber-threats that we see today.
So we're having to go back through all of those older systems, determine which ones were most vulnerable, to prioritize them, and to make fixes. So it also goes back to Senator Donnelly's question on the trusted foundry (ph), we are trying to determine, what is the best way to assure that we have reliable and trusted micro-electronics.
(UNKNOWN)
Thank you, I see my time's expired. Thank you Mr. Chairman.
MCCAIN:
(OFF-MIKE)
KING:
Thank you Mr. Chairman.
Secretary Work, if there's a catastrophic attack tonight on the fiscal instructor, the financial infrastructure of this country, I do not want to go on cable news in morning -- if there is cable news in the morning, and say, "the administration told us that the policy is still in development." We've got to get on this. We've been talking about it for years and as the Chairman pointed, this was an essential part of our National Defense Authorization Act a year ago.
And the idea, that we can continue to simply defend and never have an offensive capability, I just think is ignoring this enormous threat which we all agree. So, let me ask a one word answer question to each of you.
Do we need an offensive capability in cyber-realm in order to act as a deterrent, Secretary Work?
WORK:
We need a broad range of response options, to include...
KING:
Do we need a offensive cyber capability to act as a deterrent?
WORK:
I would say, "yes, sir."
KING:
Director Clapper?
CLAPPER:
Absolutely.
KING:
Admiral Rogers?
ROGERS:
Yes.
KING:
Thank you.
The second part of that is, that it can't be secret. Our instinct is to make everything secret and the whole point of a deterrent capability, is that it not be secret. So, I think we need to establish what we have. I suspect we do have some significant offensive capability but part of making it a deterrent is, that is has to be made public.
I think another question that needs to be addressed and I don't necessarily think -- in this hearing this morning, but in terms of the policy; we need to define what an of war is in the cyber area. Whether hitting Sony Pictures is an act of war, or the OPM, and how do draw those lines. And, I would suggest that, that's got to be part of this policy definition.
And, I don't mean to imply Secretary Work, that this is easy, but it's urgent. And, that's the -- and, just simply can't defend ourselves by saying, "well, it was complicated, we didn't get to it."
Changing the subject slightly, Admiral Rogers, do you believe that the dispersion of responsibility in the federal government for cyber, is a potential problem? It strikes me, we've got agencies, and departments, and bureaus; I suspect you could name 15 of them if you tried, that all have some responsibility here. Do we need to strengthen Cyber Command and make that the central repository of this policy.
ROGERS:
I would not make Cyber Command and the Department of Defense, the central repository. This is much broader than just the DOD perspective, but I will say this, I have been very public in saying, "we have got to simplify this structure for the outside world."
Because, if you're on the outside looking in, and I hear this from private sector fairly regularly, "who do you want me to go? Should I talk to the FBI? Should I talk to DHS? Why can't I deal with you? Do I need to talk the financial company? Should I be talking to the sector of constructs that we've created?" We have to try to simplify this for the private sector.
CLAPPER:
What I might add to that Senator King, it's one of the reasons why I had a very brief commercial for, just within the intelligence community of integrating the cyber pictures, the common operating pictures, simply from within intelligence, let alone, you know, what we do to react or protect. And that, to me is one important thing that I have come to believe, we need along the lines of a mini-NCTC (ph) or NCPC.
KING:
And, I would hope that, that would also -- and that, the leadership and decision making on that, has to start with the White House. It has to start with the administration for an all of government approach to dealing with this dispersion of responsibility problem.
I would point out parenthetically, that there has been a lot of talk about China and our ability to interact with China and to respond and hold China responsible, and it's not the subject of this hearing but the fact that we owe China trillions of dollars, compromises our ability to interact with China in a firm way. It's a complicated relationship and that's one of the things that makes it difficult.
Director Clapper, do you have any idea, what brought the Chinese to the table for this recent agreement with the president?
CLAPPER:
Well, it appears that the -- the threat of potential economic sanctions, particularly, in opposing them right before the visit of President Xi, I think that got their attention and that's why they dispatched Minister Mong (ph) to try to come to some sort of, agreement. Which is what ensured subsequently.
KING:
And I agree, that it's not a definitive agreement or a treaty, but I do Secretary Work, that it's a step in the right direction. At least, these issues are being discussed. But countries ultimately, only act in their own self-interest and we have to convince the Chinese that it's in their interest to cut out this activity that's so detrimental to our country.
Thank you gentleman, for you...
WORK:
Sir, could I make one real quick comment?
KING:
Yes, sir.
WORK:
Just because we have not published our policy, it is so broad and encompassing going over things like encryption; what are the types of authority we need? It does not mean, that if we did have an attack tonight; we do not have the structure in place right now, with the national security team to get together, to try to understand who caused the attack, to understand what the implications of the attack were, and what response we should take.
Those are in place right.
KING:
But the whole point of being able to respond is deterrent so that the attack won't occur. If Dr. Strangelove taught us, that if you have a doomsday machine and no one knows about, it's useless. So having a secret plan as to how we will respond, isn't the point I'm trying to get at.
The deal is, they have to know how we will respond and therefore not attack in the first place.
Thank you. Thank you all, gentlemen, for your testimony.
REED:
On behalf of the Chairman, let me recognize Senator Fischer.
FISCHER:
Thank you, Senator Reed.
Following up a little bit, where Senator King was going on this. Many of you talked about establishing norms in cyberspace? Do you think it's possible to establish or maintain that norm without enforcement behaviors? When we look at publicly identifying those who are responsible for an activity or imposing costs on them, can we do that?
I'll begin with Mr. Secretary.
WORK:
Well, I believe that trying to establish these norms are very -- very helpful. In the Cold War, for example, there was a task agreement that we would not attack each of our early warning missiles launch -- I mean, warning satellites. So establishing these norms are very important. But they will be extremely difficult because the enforcement mechanisms in cyber are far more difficult, because it's more much easy to attribute missile attacks, et cetera.
So, I believe that this agreement with China is a good first step. That we should strive to establish norms, especially between nation-states. And establish norms, which we believe are beyond the bounds and to try to establish mechanisms by which we can work these through. But this will be very, very difficult, Senator, because it's much more difficult.
CLAPPER:
And we have the added problem, of course, of the norms, that Secretary Work said, that are really applicable to nation-states. And, of course, they have a whole range of non-nation-states actors out there who wouldn't necessarily subscribe to these norms and would be a challenge to deal with, even if there were nation-states, mutual agreements.
FISCHER:
Admiral?
ROGERS:
I would echo the comment that my two teammates made. I'm struck by raw captives (ph) of our own experience.
In my early days as a sailor, well, before I got into this business, at the height of the Cold War out there, we knew exactly how far we can get between the Soviets and us. We knew exactly how far we could push each other, and we pushed each other at times right up to the edge, very aggressive behaviors.
But we developed that set of norms, we a series of a deconfliction mechanisms in the maritime environment, we actually developed a set a signals over time so we can communicated with each other; but it's so uncomfortable that we're are going to achieve over time in the nation-state arena. But as my teammates have said, "it's the non-state actors that really complicates this," to me. It's going to make this difficult.
FISCHER:
So, when we're attacked in cyberspace, how do we impose cost on those who are attack us? Do we respond in cyberspace or can we look at other ways to, I think, respond in an appropriate manner, say with sanctions? What would you look at, Admiral?
ROGERS:
So what we have talked about previously is, we want to make sure we don't look at this just from one narrow perspective. That we think more broadly, we look across the breadth of capabilities and advantages that we enjoy as a nation, and we bring all of that to bear as we're looking at options as to what we do; and that it's a case by case basis. There's no one single -- one size fits all answer to this.
ROGERS:
Fundamentally, think more broadly than just cyber. Not that cyber isn't potentially a part of this, I don't mean to imply that.
FISCHER:
Correct, Mr. Secretary, would you agree with the Admiral on that? Do you see a variety of options other than? And wouldn't -- wouldn't this be more beneficial to us as a country to be able to have a policy that -- that is a public policy on what those options should be and the consequences that would be felt when we are attacked?
WORK:
Absolutely. And that is what I say about a broad policy, where we will respond in a time -- manner -- time, place and manner of our own choosing. In this case, there's an asymmetry with our nation- state potential adversaries. They are all authoritarian states. The attack surfaces that they have are far smaller than what we have as a free nation. And we value that. We do not want to close down the Internet, but we are more vulnerable to a wide variety of attack surfaces than our adversaries.
So we may sometimes have to respond proportionately, but in a different way than a simple cyber response. It might be sanctions. It might be a criminal indictment. It might be other reactions. So we believe very strongly that this is something that's an interagency process, a process established where they are taking care of and handled on a case-by-case basis.
FISCHER:
And does the administration have a definition on what constitutes a cyber attack?
WORK (?):
Well, any type of malicious activity which causes either damage or theft of -- theft of information or I.T. -- all of those are under either cyber -- malicious cyber activities. It might be espionage. In each case, there's no defined red line for what would constitute...
FISCHER:
What -- what would be the difference between a cyber attack and cyber vandalism?
CLAPPER:
Well, we'd have to make, again, a case-by-case determination. And of course, an important consideration here would be, in terms of our reaction, would be attribution. And that, again, would be case-by-case.
WORK:
And cyber vandalism, ma'am, do you believe -- is that stealing information or I.T. or...
FISCHER:
The attack by North Korea on Sony was described by the president as cyber vandalism. I was just wondering on how you distinguish that -- that definition from a cuber attack.
CLAPPER:
Well, it didn't affect a national security entity, but it certainly did cause damage to a company. And in that case, and this is an important illustration of when we could attribute very clearly, and there was uniform agreement across the intelligence community, to attribute that attack to the North Koreans. And we did sanction them.
FISCHER:
Thank you.
Thank you, Mr. Chairman.
MCCAIN:
(OFF-MIKE)
HEINRICH (?):
Thank you, Mr. Chair.
Gentlemen, thank you for your service and for joining us here today.
And Director Clapper, before I start on -- begin to focus on cyber policy, I think we're all very concerned about the allegations that leadership at Central Command deliberately distorted the assessments of intelligence officers related to the fight against ISIL. And I understand that there's an ongoing investigation and I'm going to wait for the results of that investigation.
But I want to say that as a member of both this committee and the Intelligence Committee, I want in the strongest terms possible impress upon you the importance for all of us to receive absolutely objective and unbiased assessments. And I look forward to the results of the I.G. investigation and I expect that you will hold accountable anyone who has failed in their duty in the intelligence community no matter how high up the chain that may go.
CLAPPER:
Well, Senator, I -- you brought up a very important consideration here, which is a great concern to me. I'm a son of an Army intelligence officer that served in World War II, Korea, and Vietnam. And I served in various intelligence capacities for over 52 years, ranging from my first tour in southeast Asia in the early '60s, to my service now as the longest-tenured DNI.
And it is an almost sacred writ in intelligence -- in the intelligence profession never to politicize intelligence. I don't engage in it. I never have and I don't condone it when it's identified.
Having said that, I -- I completely agree with you. In spite of all the media hyperbole, I think it's best that we all await the outcome of the DOD I.G. investigation to determine whether and to what extent there was any politicization of intelligence at CENTCOM.
I will also say that the intelligence assessments from CENTCOM or any other combatant command come to the national level only through the Defense Intelligence Agency. That is the main conduit and I will say (inaudible) evaluator and filter for what flows into the national intelligence arena.
HEINRICH (?):
Thank you, Director.
Turning to you, Admiral Rogers, as the director of U.S. Cyber Command, your responsibilities include strengthening our cyber defense and our cyber deterrence posture. And I want to return to the line of questioning several of my colleagues have -- have begun this morning.
As you know, the breach of OPM computers resulted in an enormous loss of sensitive personal information. Thus far, to my knowledge, the U.S. has not responded. And to put it in the words of Deputy Secretary Work's language this morning, we haven't imposed a cost, which raises questions about whether we truly have developed the mechanisms for proportionate response to cyber attacks against the U.S. government, even after the April 2015 publication of the DOD cyber strategy.
We know that if a foreign agent had been caught trying to steal U.S. personnel files in a less digital age we would either kick them out of the country if they were a diplomat, or we'd throw them in jail if they weren't a diplomat. That would be considered a proportionate response. But in the case of the OPM breach, the U.S. government seems uncertain about what a proportioned response would look like.
So I want to ask you three questions and I'll let you take them as you may. What constitutes an act of war in cyberspace? Has the United States decided on a proportionate response in the case of the OPM cyber espionage case? And what types of information gathering by nation-states, by governments, are legitimate? And what types are not?
ROGERS:
Well, first let me start off by saying, look, so I'm the operations (ph) commander. And all three of the questions you've just asked me as much broader than that. I'm glad to give you a (inaudible), but I'm mindful of what my role is.
In terms of the three things that we define what an act of war is, the bottom line is clearly we're still working our way through that. What are the parameters that we want to use to define what is an act of war? My going in position is we ought to build on the framework that we have developed over time in the more conventional domain. That's a good point of departure for it. It's got a broadly built framework. It's something that people recognize. And it's where we ought to start as a point of departure.
The second question was about -- (inaudible).
HEINRICH (?):
A proportional response to the OPM case.
ROGERS:
Again, I think that what OPM represents is a good question about so what are the parameters we want (inaudible). Is it, as the DNI just said, is it the intent (inaudible). Is it scaled? Is it -- you can do espionage at some level, for example, but if you trip some magic threshold, hey, is 20 million records (inaudible) those records? Is there some scale component to this?
I think we're clearly still trying to work our way through that issue, and there is no one-size-fits-all (inaudible). I think there's recognition -- I think that's clearly what has driven this broad discussion between the United States and China, for example. That's been a positive, I would argue.
And the third -- could you repeat again -- the types of information?
HEINRICH (?):
You know, I'll -- my time is expired, so I'll (inaudible). I think what you're hearing from all of us...
MCCAIN:
Go ahead, Senator. This is an important (inaudible) line of questioning.
HEINRICH (?):
We would like to see more transparency in being able to telegraph our deterrence. Because we all know that looking back into the cold war, that our deterrent was very important, but the other side knowing what that deterrent was was absolutely critical for it to be effective. And so we need to be clear about what types of information gathering by government are considered legitimate and acceptable, and where those red lines are going to be.
ROGERS:
I agree. I think that's an important of part of the whole deterrence (inaudible). It has to be something that's communicated and that generates understanding and expectation, and (inaudible) a sense of consequence.
CLAPPER:
I think the contrast with the cold war is a good one to think about in that I think what you're -- the concern that people are raising is should there be red lines on spying. That's really what this gets down to. We didn't have red lines in the cold war. It was free-wheeling as far as us collecting intelligence against the Soviet Union and vice versa. There were no limits on that. It's very difficult for both sides -- well, more so for us.
And, of course, underlying -- the backdrop to all that was the deterrent, the nuclear deterrent, which of course restrained behavior, even though it got rough at times, as the example that Admiral Rogers cited in (inaudible) maritime context. But there were ground rules that governed that.
We're sort of in the wild west here with cyber, where there are no limits; that we've agreed on no red lines certainly on collecting information, which is what the OPM breach represented.
MCCAIN:
Director and Admiral, I would like to thank you for your forthright and candid assessment, and also I think the lesson that all of us are getting is that we really have to have some policy decisions. And you've been very helpful in fleshing them out for us.
Senator Cotton?
COTTON:
Secretary Work, I'd like to return to an exchange you had with Senator Ayotte about the intermediate range nuclear forces treaty, also known as the INF Treaty. Is Russia in violation of their obligations under the INF Treaty?
WORK:
We believe that a system that they have in development would violate the treaty.
COTTON:
And you said just now "in development," I thought I heard you say with Senator Ayotte that it's not deployed or it's not yet operationally capable. Is that correct?
WORK:
That's my understanding. I can have -- I can get back to you with a question for the record. It is in development and we have indicated our concern to the Russians that if they did deploy it, we believe it would violate the INF.
COTTON:
Thank you. Could you please do that in writing? And if it's appropriate, in a classified writing that's fine as well.
I'd now like to move to the cyber mission force at the Air Force Association conference a couple weeks ago, Major General Ed Wilson, the commander of the 24th Air Force stated that DOD cyber mission force was halfway through its buildup. How difficult is it to establish the needed infrastructure and manning across the services to create the capability that we need to defend and deter cyber threats?
WORK (?):
I'd like to start, and then I'll turn it over Admiral Rogers.
We're building to 133 total teams, 68 are cyber protection teams that are focused on our number one mission, defense of our networks. We have 13 national mission teams that we are building to help defend our nation's critical infrastructure, and we have 27 combat mission teams that are aligned with the combatant commanders and assist them in their planning.
To support those, we have 25 support teams which they could call upon, for a total of 133. We're building to 6,200 military personnel civilians and some specialized contractors and another 2,000 in the reserves. So about 8,400.
We expect to reach that in 2018 provided there's not another government shutdown. The last time we had a government shutdown and the sequestration, it put us behind by six months in building this. So as of right now, we are -- I think we're on track. And I turn it over to Admiral Rogers to explain the -- how well we're doing in attracting talent.
ROGERS:
And if I could first, let me accent (ph) a few (ph) on one particular portion of DepSec Work's comments in terms of impact of a government shutdown or sequestration for us. The last time we went through this and we shut it down, we assessed that we probably lost six months' worth of progress because we had to shut down the school system, we went to all stop in terms of generation of capability and the -- like a domino, the layover effect of all of that we think cost us about six months of time.
If we go to a VCA or sequestration level, it puts us even further behind and in -- in an environment in which we have all uniformly come to the conclusion we're not where we need to be, and we've got to be more aggressive in getting there. And you can't do that if -- when you're shutting down your efforts, when you're cutting money to go specifically.
Senator, to the question you asked, I would tell you the generation of the teams in terms of the manpower and their capability, we knock on wood, is exceeding my expectations. The bigger challenge to me has been less -- but it's not an insignificant challenge. But the bigger challenge has been less the teams and more some of the enabling capabilities that really power them. The tools, if you will. The platform that we operate from. The training environment that we take for granted in every other mission set. The idea that we would take a brigade combat team that before it went to Iraq, before it went to Afghanistan, we put it out in the National Training Center and we put it through the spectrum of scenarios we thinks they're likely to encounter in their deployment.
We don't have that capability right now in cyber. We have got to create that capability. It's those enablers to me and the intelligence piece just like any other mission set. Everything we do is predicated on knowledge and insights. It's no different for the CENTCOM commander than it is for me.
Those are the areas to me where the challenges are -- are greater, if you will, than -- than just the manpower. I'm not trying to minimize (inaudible).
COTTON:
Yes, and -- and how -- how important is it that we take advantage of the existing infrastructure and capabilities that we have as you're building out the entire mission force?
ROGERS:
I mean, that's what we're doing right now, but I will say one of our experiences -- Cyber Command has now been in place for approximately five years -- one of our insights that we've gained with practical experience and as we're looking at both defensive response as well as potential offensive options, we need to create infrastructure that is slightly separate from the infrastructure we use at NSA.
It's -- so a unified platform you've heard us talk about, it's supported in the funding. That's an important part of this. Experience has taught us this in a way that five, six years ago we didn't fully understand.
COTTON:
Well, I'd -- my time is up for questions but I'd just like to bring to your attention that Arkansas General Mark Berry has requested cyber protection team at Little Rock Air Force Base. There's an 11,000 square foot facility there, it has a skip (ph) of 8,500 square feet. It's already had $3.5 million invested in it. One of these facilities I understand would cost about $4 million. It's a request that I support. I think it's harnessed resources that we've already invested, and also it's a -- they're ready to support in addition to the professional educational center that does a lot of the cyber training for the National Guard which is less than 30 minutes away.
Thank you.
CLAPPER:
Mr. Chairman, I -- I have to comment and I'm rather struck by the irony here of -- before I left my office to come to this hearing I was reviewing the directions that we're putting out to our people for shutting down and furloughing people. What better time for a cyber-attack by an adversary when much of our expertise might be furloughed?
MCCAIN:
I think that's a very important comment, Director, and thank you for saying it. There's some of us who -- who feel it's urgent that we inform the American people of the threats to our national security of another government shutdown. I believe that it was an Arkansas philosopher that said there is no education in the second kick of a mule, so I thank you for your comment.
Senator McCaskill?
MCCASKILL:
That's probably a Missouri mule.
Director Clapper, earlier this year I introduced a bill that would give intelligence community contractors whistleblower protections as long as those complaints were made within the chain or to the inspector general or the GAO. So disclosures made to the press would not be protected. I -- as you probably know, Defense Department -- I know that Secretary Work knows this -- that we've already put into the law in recent years whistleblower protections for the contractors at the Department of Defense, and to my knowledge, and certainly correct me if I'm wrong, any of you, I'm not aware of any classified or sensitive information that has made its way to a damaging place as a result of these protections.
The -- the 2014 intel authorization gave these protections to the government employees within intelligence. And one of the challenges we have in government is this divide between the contractors and government employees. And, frankly, whistleblower protections -- I can't think of a good policy reason that we would give whistleblower protections to employees and not give them to contractors. And so I'm hopeful today that you would indicate that you believe this is an important principle and that we should move forward with this legislation.
CLAPPER:
Absolutely, Senator, and we have published internal to the intelligence community an intelligence community directive that includes whistleblowing protections for contractors. After all, that was the source of our -- our big problem here with Mr. Snowden who was a contractor. And so our -- our challenge -- the -- the additional burden we have, of course, is trying to prevent the exposure of classified information outside channels so that's why whistleblowers absolutely must be protected so that they are induced or motivated to go within the channels knowing that they'll be protected.
This program is managed by the intelligence community inspector general who is, of course, independent as a Senate-confirmed official.
MCCASKILL:
Thank you, and I'm pleased to -- to see that -- that you would be supportive of that.
And -- and, Secretary Work, and Admiral Rogers, I assume that you would be supportive of giving whistleblower protections to intelligence community contractors?
WORK:
Absolutely. I agree total with what Director Clapper said.
ROGERS:
Yes, ma'am, and I say this as the head of an intelligence agency.
MCCASKILL:
Thank you.
I want to follow up a little bit, Director Clapper, with your comment about a shutdown. Could you tell us what impact another government shutdown would have on your progress of getting the cyber mission force fully operational? Excuse me, Admiral Rogers.
I -- I -- I think that in political isolation, shutdown appeals to a certain swath of Americans, and I understand why because sometimes it just feels good to say, well, let's just shut it down because obviously government is never going to win popularity contests, certainly not in my state. On the other hand, there's a difference between being responsible in terms of public policy and being irresponsible in terms of recognizing -- I love it when some of my friends wave the Constitution in my face and then fail to read the part that we have a divided checks and balances in this country, unlike other countries.
The American people sent a party -- a President of one party to the White House and elected a Congress of a different party and that means we have to figure out how to get along. So could you talk a moment about what the impact would be to this important mission if, once again, we went down the rabbit hole of deciding the best thing to do is just to shut down government?
ROGERS:
So if we use our experience the last time, first thing I had to do is shut down the school system and training and education is a core component of our ability to create this workforce. Just shut it all down because it was only mission essential.
The second thing I was struck (ph) for, all travel that was associated with training, all -- we had to shut all that down so I couldn't send people to generate more insights, to gain more knowledge. We had to shut down some of our technical development efforts because of the closure. Again, put that all on hold at a time where we had talked about the need to develop more capability, the need to develop more tools. I had to shut that all down during the period of the last shutdown.
We were forced to focus our efforts on the continued day-to-day defense which is critical -- don't get me wrong -- as Secretary Work has indicated, it is priority number one for us.
The other concern I have is -- and I have watched this play out now just in the last 10 days. I've been in command 18 months and I will tell you, the biggest thing I get from my workforce prior to the last 10 days, sir, this happened to us once in 2013, is this going to happen again? If it is, why should I stay here working for the government? I could make a whole lot more money in the cyber arena on the outside.
So in addition to the threat increase (ph) that the DNI has highlighted, my other concern is if we do this again, is the amount of our workforce that says, you know, twice in the course of two years, I've got a family, I've got mortgages, I've got to -- to take care of myself. As much as I love the mission, as much as I believe in defending the nation, I can't put myself or my family through this. I've got to go work in the commercial sector. That would be terrible for us. Because people -- despite all our technology, never forget, it is men and women who power this enterprise. That's our advantage.
MCCASKILL:
At the risk of sounding like a smart aleck, which I do from time to time, I would say maybe we need to open some of those schools so some of my colleagues could do some math and realize the votes are not there to overcome a presidential veto and this is a recipe for dysfunction that does not help anyone in this country, in particular our national security.
Thank you, Mr. Chairman.
MCCAIN:
(OFF-MIKE)
(UNKNOWN)
Thank you, Mr. Chairman.
I just want to echo the comments from my colleague Senator McCaskill. I think it's irresponsible. We have the Secretary come before this committee and say the number and severity of threats have not been greater since 9/11. That should be enough said in terms of what we need to do to keep continuity in funding the government.
All the other things I may have a problem with have to be second to that priority. I thank you all for your work and Director Clapper I thank you for your comment.
Admiral Rogers, we've had briefing from you since you've taken the command. And one of the briefings I'm reminded of is the trend that you see in terms of the gap between what tends to be still at American advantage overall, narrowing. Particularly with nations like China and Russia and I think you maybe even mentioned Iran being an emerging threat.
Can you tell me, really in the context of maybe another six months reset (ph) on your training, but more importantly, based on your current funding streams and your current plan, are we going to be able to widen that gap again or this just a matter of staying slightly ahead of our adversaries?
ROGERS:
For right now, I think the most likely scenarios is we're staying slightly ahead of our adversaries because we're trying to do so much foundational work if you will. As I said previously, trying to overcome a very different approach over the previous decade (ph).
It's not a criticism of that approach. It was a totally different world. It lead to a different prioritization. It led to a different level of effort and a different investment strategy. Clearly we're going to have to change that and we're changing that at a time when budgets are going down and threats, not just in cyber, but more broadly, are proliferating.
I don't envy the choices Secretary Carter and the leadership has to make. There's nothing easy here. So I think in the near term, the most likely scenario for us is, how can we focus on the best investments that maximize our defense capability while continuing to help us retain the advantage we do right now against most.
(UNKNOWN)
Thank you and this question may be for Secretary Work. The announcement about the agreement with China, that we're basically not going to attack each other in the face of the compelling evidence that we have that China's done it in the past and they've denied it, why is this agreement a positive thing if the -- with the smoking gun information we have right now on prior attacks, theft of intellectual property, theft of commercial data, that we have a pretty strong base evidence to say that they're guilty of it, if they deny it, why does this agreement mean anything?
WORK:
On the build up to this visit we made it very clear through a wide variety of efforts that this was going to be something that was foremost in the discussions when President Xi came, we made it as clear as we possibly can in every single level from the President on down that the Chinese cyber activities are unacceptable and we believe that this is a good first step as a confidence building measure where China can either demonstrate that they are serious about establishing some new norms (ph) and going after cyber crimes, et cetera.
But the proof will be in the pudding. I agree with Director Clapper and Admiral Rogers, it's going to be up to the Chinese that they're serious about this.
(UNKNOWN)
Will the manipulation of commercial data fall within the definition of theft under this agreement?
WORK:
Well, specifically, one part of it is, the theft of I.P., intellectual property for commercial advantage and say for example, the Chinese state enterprise. And we have agreed, at least we have made a tentative agreement that we will not do those types of activities. China has done those activities in the past and it will be up to them to prove that we won't do in the future.
(UNKNOWN)
And the -- for anyone, and then I'll yield. I know that the committee's gone on awhile.
But at what point -- I think Senator Heinrich made some very important points about drawing redlines. But, at what point are we going to have clear definitions about malignant (ph) activities in cyberspace being acts of war or acts of terrorism, and then have appropriate responses whether they be through cyber or through sanctions or other? When are we going to get that clarity because we don't have it today?
WORK:
Senator, I don't believe that we will ever have a definitive, one size fits all definition for these types of things. Every single attack will be have to handled on a case by case basis and you will have to judge the damaged that was caused, who made attack, was it just a non-state actor, or just a malicious hacker.
We'd have to go after that person in terms of criminal activity. So I don't believe we're going to ever a have a specific definite that says, "if this happens, we will trigger this response." Each one, will be handled in a case by case basis and be proportioned.
(UNKNOWN)
Well, thank you. And, Mr. Chair (ph), I think of lack of clarity though, the only concern that I have is that you're not establishing some level of known deterrent. I understand that complexities of it, I've worked in the field but I think that without that clarity, you're more likely to have more things that you're going to have to look and figure out to do in situations or response.
Thank you, Mr. Chair.
MCCAIN:
(OFF-MIKE)
(UNKNOWN)
Thank you, Mr. Chairman.
And thank you, gentlemen, today, on a really important topic.
I believe, and I was looking for transcript but at the joint press conference between President Xi and President Obama; the president of China, I think publicly stated that, "They don't engage in these kind of cyber activities."
Was that an accurate statement, if that was indeed what he said, in terms of cyber-warfare?
It's pretty remarkable if you're in a press conference with another head of state and you just say something that seems to be pretty blatantly false.
CLAPPER:
Well, it is and I think apart from the statements, at least for our part, it'll be, what happens now? Will there be a change in their behavior?
And I said earlier, well, hope spring eternal. But I personally am somewhat of a skeptic. But it will be our responsibility to look for the presence or absence of their proving (ph) of intellectual property and other information.
(UNKNOWN)
And were any of you gentleman, or all of you gentlemen, consulted on the terms of the agreement?
CLAPPER:
We were aware of the negotiations but at least from -- normally, intelligence wouldn't be a voice or shaper of policy for electives between two heads of state. I think our responsibility is to report what they do.
WORK:
We participated in the build-up of the visit in terms of policy development, et cetera. But in terms of what went on between the two leaders of the nations, we were not directly consulted.
(UNKNOWN)
Admiral?
ROGERS:
And I was aware of the ongoing process and like Secretary Work, same thing, part of the broad effort in preparation for the visit.
(UNKNOWN)
But you weren't, you didn't see the terms of this agreement before the -- did you Mr. Secretary?
Let's assume, you know, kind of, past is prologue here, and you know, we're talking intellectual property. As you know, our country's been trying to get the Chinese from -- to stop stealing U.S. intellectual property for decades really, and it hasn't really worked out very well.
If -- let's assume that the -- that this agreement, that there is some additional cyber theft that we can attribute to China, what would you recommend the actions of the United States should be, particularly in light of this agreement?
WORK (?):
I wouldn't be able to answer that as -- I would have to know what the degree of the activity would be.
(UNKNOWN)
Let's say another OPM kind of activity?
WORK (?):
I think that we -- the Department of Defense would recommend a very vigorous response.
(UNKNOWN)
And, Mr. Secretary, what would -- what would you -- I mean, just give me a sense of what that would be. Sanctions, retaliation?
WORK:
Could be any of those, Senator, maybe all of the above. It will depend upon the severity of the -- of the activity. But, again, I know this is -- I know this is a big point of contention with the committee. It is -- we are serious about cost imposition and our statement is if you participate in that -- this activity, we will seek some type of measure which imposes costs upon you. And we just do not think it's a proportional cyber-attack for a cyber-attack. It might be something entirely different like a criminal indictment or sanctions or some other thing.
(UNKNOWN)
Let me ask kind of a related question for all three of you. How -- and I know you've been discussing this so I'm sorry if I'm kind of going over areas that we've already discussed, but help us think through the issue of rules of engagement here. I mean, we have rules of engagement in so many other spheres of the military that are well established. How do we think through these issues which I think in some ways are the fundamental aspects of what we do in response to cyber-attacks?
Admiral, do you want to take a stab at that?
ROGERS:
So if you look at the defensive side, I'm pretty comfortable that we've got a good, broad recognition of what is permissible within a rules of engagement framework.
(UNKNOWN)
Do we? I mean, between us and other nations?
ROGERS:
I -- I -- I wouldn't -- if you define it between us and other nations, I wouldn't know. I apologize. I don't know if (inaudible)_ question was in a -- was in a DOD kind of responsive framework.
If you want to expand it to a broader set of nations, then it's probably fair to say no.
CLAPPER:
I would agree. I think when it comes to offensive -- if -- if you're thinking about offensive cyber warfare, we probably do not have rules -- defined rules of engagement.
WORK:
Agree with what Director Clapper said earlier, Senator, that this really is the Wild West right now. There's a lot of activity going on, both from nation state actors all the way down to criminals. And so sorting through each of the different attacks and trying to attribute what happened and who it came from and who was responsible for it, all -- all demand specific responses on these attacks.
But I agree totally with the committee that we need to strengthen our deterrence posture, and the best way to do that is continue to work through these things and make sure that everyone knows that there will be some type of cost.
(UNKNOWN)
Thank you.
Thank you, Mr. Chairman.
MCCAIN:
The committee would also like to know when there's going to be a policy that would fit in to these attacks and would then be much more easily responded to if we had a policy as mandated by the 2014 defense authorization bill.
I thank the witnesses for a very helpful hearing. I know that they're very busy and we -- the committee appreciates your appearance here today.
Thank you.
CQ Transcriptions, Sept. 29, 2015List of Panel Members and Witnesses
PANEL MEMBERS:
SEN. JOHN MCCAIN, R-ARIZ. CHAIRMAN
SEN. JAMES M. INHOFE, R-OKLA.
SEN. JEFF SESSIONS, R-ALA.
SEN. ROGER WICKER, R-MISS.
SEN. KELLY AYOTTE, R-N.H.
SEN. LINDSEY GRAHAM, R-S.C.
SEN. DEB FISCHER, R-NEB.
SEN. TED CRUZ, R-TEXAS
SEN. MIKE LEE, R-UTAH
SEN. TOM COTTON, R-ARK.
SEN. MIKE ROUNDS, R-S.D.
SEN. JONI ERNST, R-IOWA
SEN. THOM TILLIS, R-N.C.
SEN. DAN SULLIVAN, R-ALASKA
SEN. JACK REED, D-R.I. RANKING MEMBER
SEN. BILL NELSON, D-FLA.
SEN. CLAIRE MCCASKILL, D-MO.
SEN. JOE MANCHIN III, D-W.VA.
SEN. JEANNE SHAHEEN, D-N.H.
SEN. KIRSTEN GILLIBRAND, D-N.Y.
SEN. RICHARD BLUMENTHAL, D-CONN.
SEN. JOE DONNELLY, D-IND.
SEN. MAZIE K. HIRONO, D-HAWAII
SEN. TIM KAINE, D-VA.
SEN. MARTIN HEINRICH, D-N.M.
SEN. ANGUS KING, I-MAINE
WITNESSES:
JAMES R. CLAPPER JR., DIRECTOR OF NATIONAL INTELLIGENCE
DEPUTY SECRETARY OF DEFENSE BOB WORK
ADMIRAL MICHAEL S. ROGERS (USN), DIRECTOR, NATIONAL SECURITY AGENCY, AND COMMANDER, U.S. CYBER COMMAND