Transcripts For CSPAN3 Key Capitol Hill Hearings 20240622

Policy. It was emerrill rogers not that long ago said just as much as that, that we dont have a good cyber offensive policy. We talked about it ad infinitum in classified settings for the entire ten years i was on the Intelligence Community and we could never get consensus to move to the next place on what that cyber offensive is. And by the way just as a personal note i just saw that the Administration Says theyre going to make china pay for the consequence of the opm hack. I cant wait. I cannot wait to see what the heck that thing is. And candidly im not too excited about what its going to be. We havent crossed that threshold to bring everybody in a room and try to work through this problem. I would long answer to your question, but i dont believe they have the right to go extraterritorial to protect what they perceive to be a threat at that point. Thats fantastic. Thank you, thank you so much. We can get a hand for the speakers. Thats just great. You can see how we can make many hours speaking about that. But well roll into the next panel. Capabilities needs to protect and defend in a cyber enabled economics world. So this played perfectly into that. Thank you, thank you. We want to get you out in a relatively timely fashion. If we can ask you all to reclaim your seat or somebody elses. So while were getting our seats, before i turn it over to the panelists for this discussion, i want to read a very short paragraph. Theres an intellectual no mans land where military and political problems meet. We have no tradition of systematic study in this area and thus few intensity prepared experts. The military profession has traditionally depreciated the importance of strategy where politics are important as compared with tactics. Now were faced with novel and baffling problems to which we try to adapt certain readymade strategic ideas inherited from the past. If we examine the origin and development of these ideas, we may be better able to judge whether they actually fit the present and future. So this was written in 1959 by Bernard Brody in his treaty strategy in the missile age. And it is a prescient piece. I recommend it to all. His calls for new ideas and scholarship to deal with the atomic age help the u. S. Create the doctrine and capabilities that guided us for the last half century at least. But i would add to brodys assessment that theres an intellectual no mans land where political, military and economic problems meet, and that we have no tradition of systematic study in this area. So within our monograph and in earlier seminars ive turned to earlier work that i and others did on the nuke la kill chain and thought about its applicability to this cyber Economic Warfare. And there arent any vast dirnss, namely the hurdle for development, acquisition in use and also what i call in one of the Previous Panels somewhat referenced it, the could we be in a war and not notice metric. I think it would be hard to ignore the use of a Nuclear Weapon but as we heard in our last panel were fully engaged in a cyber enabled economic world. So the kill chain of needed capability so to speak may have to be thought about differently but nonetheless its basic elements, intelligence in warning, deterrence, detection, forensics, interdiction, battle management, consequent management and recovery serve as a useful way to gauge our current capabilities and create the doctrine and technologies that we need Going Forward. So at this point i want to welcome our three amazingly talented individuals that will talk about the nexus of policy and technological developments. The first is mark dubwits who is from the defense of democracies where he leads projects on iran sanctions and nonprolive igs ap about hes an expert on sanctions and has testified before congress and advised the u. S. Administration, congress and numerous foreign governments on iran and the sanctions issues. He heads the foundation ftd center on sanctions and illicit finance and is the coauthor of a dozen studies on economic sanctions against iran. Mark, off to you. Great. Sam, thank you very much. First of all, sam, i hope you will keep me to my five minutes so maybe give me a nudge if im over five minutes. Ill try to make my remarks short. I want to thank sam very much for involving me in this project. A fascinating project, amazing people to be involved in. Ken, thank you very much for hosting this and allowing fdd to cohost this. And i want to pay special note to the young woman who coauthored this report with me, annie fixherler who is based in new york about who is the next generation of economic warriors. I know juan knows her very well, samantha knows her very well and satisfying to the three of us that when were all playing golf in our retirement someone like annie will be continuing the fight. Let me talk a little bit about the paper that we wrote together. And i want to put us in context. The paper is called cyber enabled swift warfare. We call it swift warfare because the case study that we dealt with as part of the analysis is the Swift Financial messaging system. Which is global standard if i want to wire money to juan my citibank has swift codes and juans account at chase manhattan has swift koesd and its the way our two Financial Institutions talk to each other so i can wire money to juan, which i do often. Thank you. No, no absolutely. So the key looking at swift was swift really was the high point of the u. S. Governments Economic Warfare campaign against iran. And it reminds me that there was a point in time where we actually engaged in Economic Warfare against irpaniran. This is coming at a very troubling moment for me having spent time working on iran to see the u. S. Government dismantle the entire sanctions infrastructure that we put in place in pursuit of this nuclear deal, but thats the topic for another panel. But certainly for a period of time as david sanger explained in the new york times, the u. S. Treasury department where juan worked and under juans leadership and stewart levy and david cohen and adam zubin, the u. S. Treasury department was described as president obamas favorite noncombatant command. And for good reason. It had become the locus for Economic Warfare against the iranian regime. Really it was a decade of escalatory measures that began under president bush, the designation of key iranian banks and revolutionary guard entities and it actually culminated in the passage of sanctions legislation by congress, congressman rogers certainly played a key role in that. And it really was it was fascinating because as these sanctions escalated, you saw over time a dramatic impact on iranian decisionmaking. Some of the key events along the way included the u. S. Treasury departments a usa patriot act 311. It was a finding that the entire jurisdiction of iran was a jurisdictional primary Money Laundering concern. It was legislation passed by senators menendez and kirk which designated the central bank of iran as the key pillar of that jurisdiction of Money Laundering concern. Then in 2012, again congress over the objections of the administration and the europeans actually passed legislation threatening sanctions against the board of directors of swift. And that legislation encouraged the europeans and eventually swift to expel dozens of iranian banks through the swift system. Was first time that there was a wholesale deswifting of a countrys Financial Institutions and it cut off iran from the Global Financial system made it impossible for the iranians through the formal system to move money to finance trade to repatriate their Foreign Exchange earnings. Now, it was certainly a tool of very effective coercion. But it was something that our adversaries have learned from. And i would note that when it comes to swift, we see calls from u. S. Congress from the British Government, in fact from propalestinian organizations to use swift again as this ultimate instrument of economic coercion. And in fact, last year the organizations asked swift to deswift israeli banks particularly those banks that had branchs in the disputed territories. The British Government asked for swift to deswift russian banks and that led to a response from the head of one of largest russias bank who said that deswifting of the bank would be an act of war, an act of economic war. Weve seen our adversaries try to take our playbook on iran and use it in other ways. In russia, the russians are using Economic Warfare against our allies in Central Europe and eastern europe. There theyre using energy warfare. The dependence that our european allies have on russian natural gas, example. Theres been a whole series of measures, both offensive against russia because of its annexation of crimea and invasion of Eastern Ukraine but also retaliatory measures by the russians against our allies and against the United States leading to the need for defensive measures. If you move to the asia pacific region, the chinese have used Economic Warfare and Political Warfare against taiwan, for example, for years to persuade the International Community that taiwan should not be recognized as an independent state. The chinese cut off the export of Rare Earth Minerals for a couple of months when there was a dispute with the japanese. And those Rare Earth Minerals were very important actually critical to Key Industries of the japanese economy. In the South China Sea there have been significant territorial disputes between china and the philippines and vietnam and japan and other countries and the chinese have matched their naval maneuvers with economic coercion. What youre seeing essentially is our adversaries learning from us that the power of Economic Warfare, the power of economic coercion as a dominant instrument of statecraft. The United States and certainly our allies in the middle east in asia and europe are lucky because the United States still remains the dominant Global Financial superpower. 81 i think it is of Global Transactions are done in the u. S. Dollar. 60 of Foreign Exchange reserves are held in the u. S. Dollar. 45 of Global Financial transactions are done in the u. S. Dollar. Because of the u. S. Dollars dominant position in the Global Financial system we still wield tremendous power. But make no mistake, that is changing. And its changing in some fundamental ways. The russians and the chinese for example, are creating an alternative to the Swift Financial messaging system. Its in a nascent form right now. Hard to track that support that swift has today with 10,financial snooss using the system. But over time it may erode the global dominant position of swift. The chinese have a combination credit card interact card which is a available in a hundred plus countries around the world. It has a market position that represents 45 of the total number of cards in global circulation. And Something Like 25 to 30 of the total transactional value. Its quite extraordinary. For the chinese its useful and for the russians because its moved from new york. The chinese moved in and offered this card to russian banks who could then offer an interact card and a global credit card delinked from new york and therefore not susceptible to our sanctions. The chinese have set up the bank which an alternative bank for infrastructure financing which has attracted Global Support including from most u. S. Allies. As a final example and there are many others the chinese have gone to the imf and asked that the something called the sdrs which were special drawing rights which would represent a global asset, a Foreign Exchange asset, that asset is linked to a basket of currencies including the u. S. Dollar and the chinese yuan. The chinese have been pressuring the imf to actually change the allocation the percentage allocation in that basket so that the yuan is more lilye ly highly represented. This these are examples of how the chinese want to erode our financial dominance. We may create a system that diminishes the power of the u. S. Dollar. Let me end on this. With this specific recommendations. Annie and i conducted a lot of interviews with folks in the u. S. Government, a lot of former treasury officials, state officials, people in europe and asia because what we really wanted to find out was what kind of defensive measures were we actually taking . Wed been very good on the offense, but how good on the defense . And what we discovered particularly in the u. S. There hasnt been as much thinking about defensive Economic Warfare, how do we create a defensive shield to protect the u. S. And the allies from the use of offensive weapons from the iranian iranians, the russians, chinese and others against our closest allies . And youll see in the monograph came out with some specific recommendations. But specific recommendations within the u. S. Government changes, institutional changes within the interagency, the idea of creating an office of policy planning at the u. S. Treasury department. The state has an office of policy planning. Our recommendation is the Treasury Department should have an office of policy planning where theyre really thinking about these kinds of defensive measures and they have the time unlike our friends at treasury who are drinking from a firehose every day to think through what kind of specific measures we can put in place to defend the United States and our allies. Number two was actually standing up Economic Warfare director at the nsc. Our sense from the nsc was folks had strong planning on the economic side, they understand market, they understand Financial Markets, but the idea of having people at the nsc who understand sanctions and elicit finance and the use of Economic Warfare would be useful. Three was actually establishing a doctrine on the use of Economic Warfare. We have doctrines from the nuclear age, about Missile Defense and a new cyber doctrine that folks have spoken about. An Economic Warfare doctrine would be useful. How should we be using this offensively and defensively and then maybe a controversial recommendation. But the idea of setting up ab Economic Warfare command. We have commands in the u. S. Government. Most of them are in the pentagon. But this would be an Economic Warfare command that would draw the best and the brightest and the necessary resources against the interagency. Our recommendation was to locate it at treasury. Im sure there will be a lot of debates about that. But those four specific recommendations on both doctrine and on institutional changes so we can actually protect our allies against the use of economic coercion. Ill finally end with this. Israels been an interesting example because the boycott difbestment of sanctions movement against israel suggests that were seeing the canary in the coal mine. Were seeing that here is a small democracy liberal democracy, an ally of the United States where all of a sudden Economic Warfare is being used against israel in order to achieve political objectives of those who oppose israels position in the territories. Whatever position you take on the territories whatever position you take on these regional disputes, my assessment my conclusion is we should be protecting our allies with cyber defenses ballistic Missile Defenses military defenses and Economic Warfare defenses regardless of our assessment of who is right with respect to a regional dispute. This is the canary in the coal mine. As terrorism once came to our shores, Economic Warfare will one day come to our shores. We have to start thinking through the kinds of methodologies, doctrines and institutional changes to create that economic defensive shield. Thats great. The only thing i would take issue with is Economic Warfare has reached our shores and i think mark and andy would agree. And in their chapter, they really do kind of delve down into, look, all right, if were going to be serious about this then lets be serious. What does that mean in terms of organizational changes that may be necessary in the u. S. Government. But our next two speakers focus on where really the rubber meets the road in terms of the technologies that are going to be needed. How we think about that. Because ultimately, you know, were going to have to be able to back up our words of deterrence with our technologies. And the first speaker is dr. Michael she can who is a Program Manager in the Innovation Office at darpa, which for those who may not know is the Defense Advanced Research project agency. His focus is on quantitative and cryptographic techniques for establishing big data and software. Previously a Research Scientist and a scientific consultant at booze allen hamilton. And he holds a ph. D. In chemistry from princeton. First of all, thanks sam. I think i speak for mark as well, too, when i say that those of us who work on the Technology Side of the house found this to be a very useful and fun exercise to think about the broader context in which a lot of our work lives. As a prepare tory remark, i should say that all the opinions i express today since im still in government, are my own and not those of darpa or of the u. S. Government. Ill start on a slightly downbeat note. Today you can barely turn on your news browser without seeing a fresh story about another u. S. Firm being a victim of intellectual property theft. Whats vexing is that there does not seem to be a clear path out of this very bad equilibrium. The purpose of my article in the monograph is to hopefully provide some new thinking that may help us out of this state. One is taking a Historical Perspective as a timeless instrument of competition between nation states. And number two, a scientific perspective on technologies that can potentially help us flip the script on the economic spies and i. P. Pirates that are targeting our industries and undermining our economic national strength. Again we have history that can help us here. The notion of intellectual property actually evolved over centuries as an enshrinement of economic reward to the inventors of valuable ideas. The u. S. Economy is particularly sensitive to the climate in which such rewards are protected because in a 2012 report by the u. S. Patent and trademark office, 75 out of 313 u. S. Industries are categorized as i. P. Intensive. And they account for more than 27 million jobs and more than 18 of all employment in the u. S. In 2010. According to the 2013 report by the commission on the theft of American Intellectual property, the u. S. Loses over 300 billion a year in i. P. Theft. The report stated that if i. P. Were to receive the same protection overseas as it does here, the American Economy would add millions of jobs an encourage significantly more r d investment and economic growth. Not all counties in the world are serious about a rule of law reveem. The United States has been here before in this problem, although on the other side of the problem. In the immediate aftermath of americas warfare independence from the uk our young republic itself engaged in a no holds barred campaign of privately conducted but officially tolerated i. P. Theft against british industry in order to supercharge the Young American manufacturing economy. Now, the british response to this was quite rigorous. They were fully aware of the stakes of this kind of conflict. They imposed export controls on machines and designs restrictions on skilled immigration and sometimes even acts of arson against u. S. Factories employing stolen british i. P. I know theres been talk about hack backs in the Previous Panel and this isnt really what we have in mind but the idea of hack backs is not ter tibly new, its been tried. Arson aside, the british strategy would not look unfamiliar to american officialdom today. Yet but any reasonable accounting the british policy completely failed to stanch the defusion of their most sensitive manufacturing i. P. Into the factories of its unfriendly transoceanic rival which went on to eclipse the uk as the worlds manufacturing leader. All of this must sound distressing to all ourself today. In 2015 its obvious that its america thats playing defense in this game. So exemplify the struggles of all our ip sensitive industries, ill focus on the Software Industry not only because theyre the largest by export value but because there are also new ideas pertinent to that industry that might inspire new thinking for other industries protections as well. To give a partial illustration of what our Software Industry struggles with, in a report by the Business Software alliance, 19 of the software sold in the u. S. Is pirated. But in china as one other example, 77 of the software transacted is pirated. But beyond the simple crime of making and running unauthorsed pirate copies theres the deeper theft made possible by prying into the source code of software to source the proprietary algorithms that are acquired by vast sums of research and development dollars. How do we stop Something Like this . Through the lens of how we might protect our Software Industry, we develop a model for a new model for thinking about how to protect our i. P. Based not only on law and diplomacy but on technology and economics as well. That may change the dynamic between the attacker and defender in this i. P. Conflict. The status quo in defending our nations i. P. Interests in general tilts towards the kind of diplomatic and legal remedies favored by the british. As weve seen through historical experience, there are fundamental limitations to this kind of approach. So it is useful to pull back a step and think about the problem at a more basic level. I. P. Theft is fundamentally as much an economic as criminal phenomenon. Weve seen through historical experience that laws and diplomacy are lipted edlimited in their ability to deter criminals from this kind of crime. So the question is can we use technology and economics to deter economic Decision Makers from deciding to steal as opposed to not steal . Can we raise the technical cost of stealing to such high levels that it no longer becomeswhile to do so . So the good news is that the answer is yes. But there are some major caveats. Today commercial software is effectively defenseless against being wrong by reverse engineers because the state of the art in defending software against such theft largely consists of putting in code by essentially giving him more code to read and understand. However, this security through obscurity approach can almost always be defeated. In under a day with Standard Software tools and is almost universally regarded as ineffectual among Software Security experts. But the good news is that a recent mathematical breakthrough has opened up the door to making new kinds of software that can baffle even the best resource to reverse engineers. It entails writing the source code in such a way that enwrapping its secrets is equal to a mathematical problem and algorithms known today. This is exciting because this is the kind of technological breakthrough that could be the impetus for imagining a future where our i. P. Rights are protected not by the laws of governments or nations but by the laws of mathematics. But here there are some huge caveats. Realizing such technologies not only for software but maybe for other products as well, too, will very likely require radically new sintic ideas that will take years if not decades of sustained research and effort, but if these efforts are successful, such efforts could ensure Economic Leadership far into the future. And to pivot to another problem, one of the issues that we have in the cyber threat today is that victims are caught up in a very pathological dynamic in which they actually have sometimes an interest in concealing their own victimhood. We talked about this in the context of cyber threat sharing. So one of the other interesting things that has emerged in the Academic Research over the past 30 years is the field called secure multiparty computation. This really began as something of an academic problem about little more than 30 years ago. This is called the millionaires problem by which two millionaires wanted to see which one has more money but they dont want to reveal exactly how much money each has. I dont know how millionaires think, but its a neat problem. So the bottom line is that this might seem like kind of a contrived problem but its from a cryptographic and mathematical perspective it is not trivial at all actually. And the whole field of cart cartography built up around this that morphed into what we call snpc today. Given that was a contrived problem 30 years ago, what this has evolved into 30 years later is a very valuable and Practical Technology in a very real problem. So in space today theres some dozens or if not scores space faring nations, thissy all have their slights s satellites going at very high speeds and every country has an interest in not having the satellites collide. When you reveal your trajectories youre giving away sensitive commercial information or National Security information. How do you share information about your satellites without giving away those kinds of secrets . Where the research has gone is from that contrived millionaires problem to actual software today that could actually help the likes of National Space agencies and Companies Share their information without revealing private information. Now, this is obviously exciting because these are not trivial problems. For the math geeks out there, these are 200 degree integrals actually over space and time, you know, for objects going at near relative listically relevant speed. Its a hard problem and computationally very difficult. But software after 30 decades of investment that gets us closer to that problem. Its not hard to see how this maps on to a lot of the kinds of sharing problems that we have within the cyber threat realm which has a pryivacy component to as well. To conclude, i think its actually very fitting that the ingenuity of the american system that has created so many world changing ideas could be at the end of the day the source of defenses to protect those very ideas. Thank you. Thank you, michael. Doesnt it make you feel good that hes in the government . Yes. Hes tremendous. But the modernday i think problem of the millionaires problem now is to actually figure out how much money does donald trump actually have. So thats where its evolved to. And finally mark tucker is the founder and ceo of temperal Defense Systems and Founding Member of the Cyber Insurance company of america. He leads a team of experienced white hat hackers that are redefining the Technology Paradigm to safeguard network fwhs the cyber war era. That was a mouthful. Thank you, samantha. Thank you for inviting me. I think this is a great way to look at the problem because this problem is a complex problem and its really not quite understood. But when you marry those two terms of cyber war with economic cyber war, it brings multiple notions that help crosspollinate and define the problem. So before i kind of go into a few things and ideas that i think might help encrack the problem, i think we need to quantify and understand the problems dynamics. When i heard a few things in the Previous Panel ways diametrically opposed, right . But i was down there and couldnt talk. So ive held some of those things. I understand why the comments were made, and the comments were made because of these trends and these economic things happening and trying to understand the essence of whats going on here is what forums like this are about. So when you look at cyber Economic Warfare youre like well, what is it . Well its war its not crime. Theres a difference between having a war environment and a criminal environment. Crimes happen in war, but i think its very safe to say that if we kind of get some actionable assumptions and say, okay, maybe its not provable a hundred percent, but a preponderance of the evidence this assumption is pretty good and we can start making some action plans around it. Because ultimately America Needs a cyber action plan. Weve got the department of Cyber Command now. Weve got multiple departments of everything. But the core of the problem i think is still a little bit elusive. So i think a few things in the first panel were perfect and spoton. So lets say actionable assumption cyber wars here and upon us. And i would go so far as saying when did cyber crime become cyber war . What Inflection Point in time did that happen . That happened in the stuxnet attack. That was the shot heard around the world. Thats when cyber war became kind of like the turning point of criminal gangs and all these activities happening to something that became a physical damage was caused and it caused, you know, geopolitical outcomes because of it. That one thing is like the shot heard around the world. We can assume that cyber war sheer. Then we start looking at what is the dynamic of cyber war look like . It looks like a low intensity conflict in war terms to me. It doesnt look like the power balance between, you know, the nuclear war era where everybody built up these huge offenses and nobody struck. Why . Because theres proliferation has already occurred. That dynamic doesnt exist in cyber because theres too many actors, theres too many people. It takes one individual. So that would be equivalent to saying, well if we think about it like trying to do a Nuclear Power arms race buildup of offensive of cyber weapons, it just wont work because we cant control it. Theres too many points of attack basically heading through. But if you look at it like a low intensity conflict you can pretty much say okay cyber is here to stay for a long time. Theres going to be interesting things that happen. So the Playing Field is basically, if i could compare a few examples of where a low intensity conflict is occurring we look at iraq in 2004 when all of a sudden america comes in, we take the country over. I was there, by the way. So the ground truth i had then is equal to the ground truth i had now on the problem. So ive seen it from all different levels. So when i was first there there was a bomb here and there and it went off and, yeah it was scary. But in essence there was a power void. Because saddam was gone and nobody knew what to do. So the criminal gangs started to move first. And there was, you know, a little bit of activity happening. Well, what happens when those types of low intensity conflicts evolve . The next stage the coordination where all of a sudden theres six bombs going off and theyre going off at the same time and the frequency is going up. So when we look at the threat horizon over a 20year period in cyber war, basically what were seeing is a negative threat for 20 years a negative trends that occurring. So now when most of that occurred in the think of it as cyber crime era now in the cyber war era weve seen the curve steepen. In essence whats happening is when you look at the battlefield and the battlefields interesting in cyber war because its all around all of us and its global so whats going on the frequency of attacks is occurring and the battlefield is being softened. So when we see all these attacks happening on the banking systems, on the Transportation Systems and all these negative economic pieces, we havent seen anything yet. This is just the normal course of a low intensity conflict. So the next stage is basically coordination. When coordination occurs people will get scared an a plan is completely required. What we should be doing is learning from these types of discussion points so that we can make this plan and get ahead of the curve. So if we take the assumption that were in the cyber war era it looks like low intensity conflict. Weve got a power void because nobodys controlling whats going on then were saying okay, well maybe we need to come up with some assumptions of how we got here. Well why is security so bad . And you can borrow economic principles to understand that. Its pretty easy. The question that was asked is why dont the manufacturers share in the liability . Well, you want to know why . Its because bill gates dad was an attorney and a very smart attorney. And every time you Load Software you hit an okay button and you basically take the liability and shift it over to you or if youre a company you shift the liability over to your company. So no it makes total sense that weve got so many security holes because the economic incentive is not with the manufacturer of these products. So a part of what steve was talking about, while i disagree with him, i understand how he got to those notions because you cant fix the problem so all we have is offense. I would suggest this that we can fix the problem. The defensive problem is fixable but like any problem we have to be able to quantify it. If we dont quantify the problem and we cant measure the problem, we dont know if its improving or getting worse. We can see the attacks move up and down but we dont know how to compare one technology against another technology. What is the security of this industry, what is the baseline . We dont have any of those metrics right now. So one of the technologies that will shift that maybe it wont shift the liability back to the manufacturers but it will change purchasing habits when people know one operating system scores a three and another operating system scores a four in security. So what that will do is it will allow economic principles to basically take the security responsibility and allow the consumers or the companies or the purchasing managers to basically buy more secure stuff. So once we know how to measure it and that technology is in existence now, then all of a sudden we can start to say, all right, were going to basically change the evolutionary path of technology because now that we can measure it its no longer good enough to say i have good security, i have a firewall, i have antivirus and i have an intrusion detection system. What will actually happen is youll say well your securitys a three. You may have all those things but those things arent basically raising your level of security. And so by basically creating the Standard Measure used for technology which is called qsm, which is one of our companys products that we worked at with George Mason University over the last four years to solve is a huge Building Block to basically changing this shifting liability landscape and allowing the security level to go back into technology. So when we look at these problems, okay so theres an okay button. That sure did a lot. Yes, it did. But theres also other things that did a lot to technology. And every two years a chip gets twice as fast. There hasnt been any interesting profound observational loss even. But if weve got this 20year negative trend where the threats go higher and higher, if we can get ahead of that curve by lets say just two years where now all of a sudden weve got the ability to measure technology, security and we can start to use americas creativity and americas production force and harness the countrys resources on a technological basis thats now focused toward better security, we can come up with maybe the law and say well if america stays two years ahead of security, then were basically going to hit an Inflection Point where that trend starts to go down. As long as we stay two years ahead, then all of a sudden were heading in the right trajectory for defensive security. I would also advocate that in this american cyber action plan weve got to say, okay, 85 of the resources or some number and 85 defense and 15 is offense for example. And so we have to come up with those measures and those metrics and then we basically have to coordinate as a country to utilize our resources to win. Were america, we own the Technology Market still. We may not own the manufacturing base, but its still our ideas. Why do you think theyre stealing our i. P. . Because were ahead. Lets use the things that america can basically take to market and the fact that our vulnerability is the fact that were connected, right but thats also our greatest strength. If we harness what put us here and look at it in a little bit different way, then i think we can make an improvement on the defensive side and i think on the offensive side if we start thinking of the problem like low intensity conflict and, you know, we create things to beat cyber insurgencies which is basically whats happening and we kind of look at the surge, you dont have a Banking Industry surge to basically take the fight back to them and create those deterrents portions. But it wont be a type of effort because theres no laws being enforced and the ability to bring someone to justice is very difficult. So its going to look like a low intensity conflict cyber war environment. So anyway, my times up. Thank you. Thank you mark. Before we go to the question, i just wanted to mention when we started this project, we really wanted to create a larger group of people that are interested in this topic that take different pieces of the research on to move it forward. Right . We never wanted it to be that this is the be all and end all, right . So theres a lot to go forward on this. One of the things that i think this panel and the last one really showcase are the needed kind of places where policy and new technologies you know come to bear. And you know on that i was hudson hudsons institute cofounder herman khan wrote the six desirable characteristics of a deterrent. He wrote that a deterrent to be successful, must be frightening, inexorable persuasive cheap nonaccident prone and controllable. So if we just even start with those six things and you can imagine having both the policymakers, the war fighter, the technologists around a table saying, all right, look heres the problem. How do we create a deterrent that both rests with sound policy doctrine and the technologies to be able to do what khan recommended i think we would really move this conversation ahead. Okay. My interjection, yeah. No, wait one second. Fdd and elicit finance. Great thought provoking panels. Both panels. There was something said in the first panel that provoked a question that i think is appropriate for you all. Which was the reference to us losing the space race. And it made me think about president kennedy decades ago. He set the goal and the goal post. And the undercurrents of getting to the moon in the space race. The undercurrent was our competition with the soviet union and the tremendous threat that was there. But over that decade he really sort of galvanized or the country galvanized with this goal. It was inspiring and very positive. If we were to look at the cyber war, the cyber race, what would be the goal or the goal post . Is there a way to sort of galvanize this next generation of young people and others within our society to target a specific goal so we could win the cyber race which were losing . Michael, you want the take this first . I think thats an analogy thats often drawn. And its problematic because with a space race theres clearly defined goal posts as to progress. Set sending a man into space sending a man to the moon and sending a device to mars and so on. The problem with cyber is the agenda is much more diffuse. The kinds of cyber problems that exist on machines and networks and there is as chairman rogers mentioned in the Previous Panel anthropological problems around cyber, too. One of the things that tends to be a distracter in the cyber debate is an over emphasis on the technological dimensions. Theres a human dimension because its a security problem and all Security Problems are human problems. Looking at the statistics of the kind of compromises that occur because somebody opens an email or attachment and goes to a link and then all hell breaks loose after that. At the end of the day, you wont get away from that. Because we dont Design Software networks for machines we design them for ourselves. Where we could possibly direct one area of research actually is to say that well we should stop blaming the human because we are human. We should be able to open up a link or an attachment or go to a site without trembling in mortal fear that its going to compromise the entire enterprise. Whereas i think theres going to be a much more diffuse kind of agenda for the cyber problem i think there are some problems that could still be very ambitiously stated very much like the problems of a space race as well, too. Thats one of them. But im sure theres others as well, too. I would just add to that. Maybe this is too simplistic but i think when it comes to cyber, the whole notion of winning is something that were cautious about and were careful about. We dont actually want to win in cyber. We just want to survive in historical terms we invent the cannonball. We dont want to win using the cannonball. We just want to survive if the other side gets one. We invent missiles. Again, we dont want to just win. We want to create Missile Defense shields just in case the other side builds bigger miseyes than we have. There seems to be hesitation when it comes to cyber. I dont work in the cyber field but i sense it in the language. The goal should be were going to win this cyber war. Then any country that launches a cyber attack against us will be meet with fearsome retaliation. I dont know what well do against the chinese because of opm, but i dont hear in the rhetoric of the president a commitment to actually win. We need to send a message that were the United States of america. And whether you hit us with cannonballs or missiles or cyber attacks, were going to retaliate in a fearsome way and our goal is going to be to win in the cyber world as we won i think in missiles, and we won in cannonballs. Its a commitment at that level before we get into exactly how we do it on a technical level and how do we reorient the u. S. Government on an institutional and a doctrinal level in order to do so. I also think theres measurable goalposts along the way. For example, when we hit this turning point and the 20year trend ticks down what is going to actually happen . Well, if we say whats going to happen on the pla side tore china side unit 16398, all of a sudden all the million of agents that theyre watching oh their screens and monitoring go dark. Thats actionable. And when that happens, you know what were going to see . Were going to see that unit freak out. Were going to see them go back in to the drawing board were going to see them working day and night. Theyll send minions out to try to get new points so they can basically reinsert new types of agents. This is what i mean by weve got to be able to stay two years ahead. Because if we can stay two years ahead, the effects are dramatic. Right now what weve done is just stayed complacent and let all these agents and things and supply chain infections just permeate everything. So i think just like that where were saying, all right, when the turning point hits, how will you know . Because that unit that is the biggest unit in the world right now thats basically one unit against us theyre basically their agents go dark and then were going to see actions because of it. I also think that we can measure the number of cyber events that occur and i think we can measure the amount of money thats stolen from a bank or credit card. So i think we can come up with measurable, you know, are we winning metrics. Heres just a quick addition to that. Heres an indication of how youre losing. So i was reading through the iran deal the other day and every day its a new surprise. But my yikes moment of last week was i surprise. I discovered the United States and our allyiesallies, we commit to protect the Nuclear Iranian program against nuclear sabotage. Were going to protect it against the ability of the United States, israel other allies to use cyber offensive weapons against Irans Nuclear program regardless of what happens with that nuclear program. It will be a scale with near zero break out. Even then, we will commit to defend Irans Nuclear program against cyber sabotage. Thats not the shot to the moon. Thats not a commitment to winning. Thats actually were going to harden our adversaries cyber defenses. Sir . My name is rich wilhelm. I ran all of our business with the intelligence agency, but 20 years ago, i had a job similar to yours where we did round one of all this. Were so much farther ahead now, but im struck by one thing. Yes, we are much farther ahead. We understand the threat a lot better, and theres a lot more technology out there, but im struck by how little progress weve made in solving the central policy issues that are going to be required to actually move ahead. And, you know, my thinking over the years has matured somewhat, and it seems to me were essentially trying to solve a problem where boundaries dont count on legal policy framework where boundaries really do count. And im not just talking about geographic boundaries. Im talking about the difference between private and Public Sector responsibilities, between domestic and foreign you know, if you look at the Intelligence Community. And we need some new framework. What and this is a question, really, for you, mark. You talked about i mean, the government response has been to create new organizations but not fundamentally alter the existing boundaries that exist in law of our existing agencies. What do you think the likelihood is that we can solve that problem over the long run and that there is a new paradigm that will emerge so that the interfaces between the various agencies operate a hell of a lot more smoothly than they do right now . Thank you for that question and for your service on these issues. I would say that im somewhat optimistic. Ive sort of seen it from the outside on the offensive side. I think weve done a pretty good job. A lot of credit to juan and the folks at the office of terrorism. Who ever heard of tfi or ofac a decade ago . What juan and his colleagues did at tfi is they took institutions, agencies in the u. S. Treasury department and they turned them on offense. I think they did a really remarkable job not just leveraging government but leveraging markets. Because the real secret sauce of our financial coercion on offense is not what we did to governments. Its actually what we did to companies and Financial Institutions in changing their riskreward assessment. You can do business with our 17 trillion economy, or you can do business with irans 350 billion economy. If you do business with their 350 billion economy, youre going to be doing business with bad actors who are engaged in illicit financial activities. Its been a very successful program. Im obviously very skeptical about whether we have actually used those incredible resources and achievements towards the right diplomatic ends, but at the end of the day we certainly hone the instruments. And our paper tries to look it from the other point of view. With those instruments honed on offense and other countries and adversaries using some of those same powers how can we reorient the government to start think about creating a defensive economic shield . We have Cyber Command. Im learning a lot about some of the deficiencies we have in that area. But from an Economic Warfare perspective, the folks at tfi dont actually have the time to think through defensive shields which is why an offense of policy planning would be useful at treasury. It would be useful to have an Economic Warfare command with all the powers to work on an interagency level, to actually think through both on the cyber side and the traditional warfare side how do we defend the United States. Heres a good news story for me. The state of success South Carolina just passed legislation. The legislation says that any country that uses Economic Warfare against one of our allies will be denied federal state grants from South Carolina and the state pension fund of South Carolina will have to divest from any Companies Engaged in Economic Warfare against one of our allies. Its interesting. Its at the state level. Its the state of South Carolina. If you use Economic Warfare against the United States or our allies, dont do business in the state of South Carolina. Illinois just did something similar and other states are contemplating. Thats creating a defensive shield at the state level, which i think could be created at the federal level through executive orders, legislation, and creating a defensive economic architecture led by so many of the people who have been successful on offense. Just so that you political scientists or ir theorists out there dont think that theres a place for you in this robust debate and moving forward and that its just a place for ekon economists and technologists, we need a better strategy. Theres no reason to think that what the russians are doing or how theyre organizing is in any way similar to what the chinese are doing or the iranians are doing or the nkorth koreans are doing. One telling point on this is that in the weeks before the sony hack, the North Koreans were speaking out at every opportunity they had, screaming that the movie that sony was going to release the interview, was an threat to north korea. They were some of the first ones to say, look over. Yes, sir . The doctor used the phrase krip krip to grapically sound. Any comments . Again, i should preface all this by saying today im speaking as an individual and not as a representative of either my agency, the department, or the u. S. Government at large. Im essentially talking about things that still live very much in the Research Space you know. So obviously crypting toography means a very different thing versus the kinds of things that still happen in academic circles. So when i say when i use terms like security in this context, maybe the better word to use is provable security rather than cryptographic security. I think that probably is a more accurate way to characterize that. Well, thats wonderful. I think with that im going to wrap up unless you have one last comment . Good. All right. I thank you so much. Again, stay tuned for the sin synopsis of this seminar. Thank you again. Have a good day. Tonight on cspan 3 a Senate Hearing on relief programs for Small Businesses effected by natural disasters. The Brookings Institution looks out new military defense technologies and the new commandant of the u. S. Coast guard, and a discussion at the Hudson Institute about cybersecurity. Today the Senate Small Business Committee Held a hearing on Disaster Relief for Small Businesses. It focused on changes made since Hurricane Katrina hit the gulf coast ten years ago. The senate began its district work period yesterday. This is an hour. Well, good morning everyone. Welcome. Thanks very much for joining me here today for this discussion roundtable about a very important ongoing challenge in relation to Disaster Recovery. Natural disasters are obviously indiscriminate and sweeping. With this roundtable, i hope to highlight the improvements made in Disaster Recovery efforts in the last decade discuss continuing challenges that local, federal, and state officials still face, and have a conversation about Disaster Mitigation and response. This is, as you know, the tenth anniversary of Hurricane Katrina. Were going to acknowledge that in just a couple of weeks, and i want to take this opportunity to remember the tens of thousands of families horribly impacted by that disaster. Ten years ago this month, we experienced a deadly and costly disaster. The most costly and defrvastating in history. Hurricane katrina caused 108 billion of damages. The damages from that years hurricanes rita and carina caused some 50,000 people to be unemployeed ed unemployed by the second half of 2009 and here we are in 2015 still dealing with katrinas impacts on top of the other significant disasters we have suffered through in the last decade. Between 2008 and 2012 with hurricanes gus tav, ike, and isaac, there was over 44 billion in damages and then on october 29th 2012 Superstorm Sandy devastated the vast majority of the east coast of the u. S. 131 people lost their lives and 12 states, which includes the district of colombia were declared major disaster areas. The lives lost, exorbitant amount of money spent, and the Lasting Impact still felt today from all of these events are highlighted here as the foundation for discussing ways to mitigate these losses in the future and tore recoverre recovery by getting our lives back in order as soon as possible after the disaster. While businesses and communities came together willing and able to deliver vital relief, too many times they were turned down actually by bureaucracy within Government Agencies. Immediately following the event i heard reports of hellish conditions at the super dome witnessed unacceptable response times from fema long delays in the delivery of federal emergency assistance, failing evacuation systems and ineffective federal contracting practices. Disaster relief funds either never made it to the hands of those they were intended for or arrived way too late. All these failures obstructed vital recovery out of katrina. Longterm Disaster Recovery assistance comes from others whose responsibility is to provide our homeowners, renters businesses, and nonprofit longterm recovery loans that can get these Economic Resources back on track. After Hurricane Katrina struck louisiana ten years ago we learned the hard way what worked and didnt work in this longer term category as well. And after each major disaster since then we have learned that Small Businesses need, really extra help to get back on their feet, and so thats a very important focus of this discussion. As chair of the Senate Small Business and entrepreneurship committee, im committed as are all of our members, to serving Small Businesses across the country and ensuring they are afforded the resources and assistance they need to help them recover as well. A completely separate category, which was certainly very very important in the Hurricane Katrina and rita context is the corps of engineers and Disaster Recovery and storm protection in that category. Ive done quite bit of work on that reforming the corps process, improving how they respond before and after disasters. That has more been in the context of my work on the environment and public works committee, but certainly thats another very important piece of the equation that we may touch on here today. Earlier this year with all of these thoughts in mind and as chair of the Small Business committee, i passed through the committee with unanimous bipartisan support s 1470, the rise after disaster act of 2015 along with other legislation to address the needs, protections, and recovery of americas Small Business in particular. The act reflects a number of things that we have learned, and i think itll definitely help future disaster victims recover more quickly and with less red tape from the federal government. Specifically, the bill provides longterm recovery loans to Small Businesses when Disaster Assistance is no longer available, and it directs federal agencies to utilize local contractors for response and Recovery Efforts rather than Government Contractors from washington, d. C. And other far flung areas. I also introduced last month a bipartisan national Disaster Relief tax act that will provide tax relief for victims across the country that have experienced disaster in recent years, including businesses effected by the red river flooding and hurricane isaac in 2012. The bill will also allow businesses to create National Disaster funds in order to prepare for disaster costs and insurance. To have this discussion were really honored by having six great leading participants and i want to briefly introduce them and i look forward to hearing from all of them. James rivera. During his 25 years at the sba, mr. Rivera has led several efforts to improve the agencys disaster operations including development of more efficient loan and underwriting processes computer upgrades, which was resulted in quicker loan disbursements, and other accomplishments. Gerilee bennett. Shes been leading Disaster Recovery programs since 2003. Shes supported disaster recover recovery operations through businesses since the 1990s. Russ paulsen is the executive director for nationwide Community Preparedness and building resilience programs at the red cross. Hes led some of the largest Disaster Response and Recovery Efforts in that organizations history. William shear is director of Financial Markets and Community Investment at the u. S. Government Accountability Office and will be offering significant insight into todays issues having directed substantial bodies of work having addressed sba, community, and Economic Development programs and housing finance. Andrea deadwyler is the director of the credit Programs Group in the Audit Division in the sbas office of inspector general. And finally last but certainly not least tee rowe is the ceo of the Small Business network which leads nationwide educational system programs to strengthen business management. So i look forward to hearing from all of you and then well have a discussion coming out of those observations so why dont we start with mr. Rivera. Thank you, chair for inviting us up here and our partners as we work through the Disaster Assistance. Weve made almost 200 million in loans since we started in 1953. While were not a first responder, im glad gerilee is here. From our perspective weve worked very diligently since katrina. We continue to learn from every disaster. Most recently with sandy, we also continued to learn from the sandy experience. We took a step back after both katrina and after sandy and gus tav. Weve now implemented a threestep process to simplify the process to make it easier for the disaster survivor to understand what were doing. We also take advantage of credit scoring opportunities on how we can approve individuals, homeowners and businesses with higher Credit Scores and put them through the system faster. We recently updated our standard operating procedure, took a back to basics approach. We always take a look at what works works, what doesnt work, and how we can approve Going Forward. Thank you. Great. Thanks very much mr. Rivera. Gerilee bennett. Thank you very much for the invitation to be here today. As mr. Rivera said fema is please to be able to participate in this roundtable with our partners the sba, and the red cross, who weve been working very closely with since katrina and throughout the years in support of many disasters such as Hurricane Sandy hurricane isaac in louisiana, hit before that and somewhat got overshadowed but we had already implemented a lot of changes even by then. I want to focus today on some of the improvements that we have done in partnership with the interagency members of the national Disaster Recovery framework. The framework was developed really in response to Hurricane Katrina, the postkatrina reform act called for a national Disaster Recovery strategy. Some of the key elements of the framework are that it promotes partnership, planning for Disaster Recovery in advance, and the development and establishment of an organizational structure and leadership in advance that focuses on Disaster Recovery not just response. One example of this is at the federal level we have developed the economic Recovery Support function. Its led by the department of commerce, Economic Development administration. And the key partners include sba, the department of treasury, the department of agriculture, fema is also one of the primary partners, and all of these agencies Work Together to support communities and states and more importantly businesses after disasters to find the support they need to get their businesses back up and running. Some of the strategies that the economic Recovery Support function undertakes, they do Economic Assessment postdisaster, what the real needs are. Is this a rural disaster . Is this a smalltown, smallbusiness kind of disaster . Is there a major employer in the area whom if that business gets back up and running quicker, will make all the difference in the world in getting people back to the area . They also Work Together to make sure there are Business Recovery centers usually sponsored by the sba. They have all the partners available for all the businesses to find what resources are available. It is to make sure education, Technical Assistance and networking for resources and support are available. After a disaster, its a Good Opportunity to provide support and information to community to businesses about resilience. That never before a disaster are people as much in tune to be resilient, to have good insurance, to have good supply networks that are also resilient, so it is a good time to take advantage of that. Again, i look forward to the conversation. Thank you for the invitation. Great. Thank you. I will move to russ paulsen. Mr. Chairman, thank you for inviting the red cross to participate. My name is russ paulsen. Im executive director at the red cross. In 26 years with the red cross, ive seen the importance of Small Business recovery throughout the country. We do it about 70,000 times a year on average. We just did it after red river floods where we opened three shelters in north louisiana. And we keep that promise after home fires across the country that happen about every eight minutes every day every year. We can only do this because of the financial generosity of the American People and sometimes heroic actions of volunteers, americorps members and our employees. Kay wilkins organized her team to open up shelters throughout south louisiana after katrina came through or while it came through. Not seeing her family for days. A young woman who never lived away from home before she came to the new orleans area to be a red Cross Americorps member, who after being there for two weeks was sent to run a shelter at north shore and who had to deal with the needs of all sorts of people, including helping a gentleman who didnt have his Home Health Aide with him. Never had any training but its people who step up and do what they need to do. A young man who ran a shelter and had to figure out what to do with a shelter full of scared people when the roof started peeling back. Its heroic actions by people in the response phase and for people who they will never meet again. We serve 68 million meals and snacks. We serve clients who have evacuated in all 48 of the contiguous United States. We were also able to contribute to the recovery for years after the storm. Rebuilding their homes. We helped people Access Mental Health service, which is often not thought about. But after a trauma like katrina it is really more than what most people are built to handle. We designed it almost like an Insurance Program where people could make sure they could pay the bills of independent providers, and those providers knowing they had a market that could pay the bills could move back to town. Recovery is such a gourdian knot after a big disaster. Businesses are reluctant to come back without employees and a customer base. Residents are reluctant to come back without businesses where they can shop and work. People dont want to come back without government providing services. Its a really tricky proposition and oftentimes its the Small Business that comes back first. Sort of homesteading in a neighborhood and then people can come back around it. Katrina taught all of us in Emergency Management there are some disasters that are bigger than any of us. But we learned that we have to not only work with our traditional partners but people who wouldnt normally get involved with disasters, so now we have faithbased services and organizations who havent thought about disasters before. Church groups Like National baptists, Islamic Relief Lutheran Church Methodist Church church of latter day saints groups like the naacp and others at the national level. At the local level, too many to count. We have put in Place Technology apps to help people find shelters, first aid apps so they need what to do. We outnumber firefighters and rescue workers 400 to 1. Apps to help people find their relatives when they are separated by disaster. Now were working inging to get ahead of the disaster. Fires kill more than anything in this country. Talking to them about hurricane preparedness or tornado preparedness. We have mad a lot of progress. Still more to go, but it was quite an experience. Great. Thank you very much for that perspective, mr. Paulsen. Now william shear. Thank you. Thank you, chairman for the invitation. Its very good to be back here with Senate Small Business. Weve done a very large body of work looking at sbas Disaster Loan Program going back to Hurricane Katrina, and ill just state as always in Going Forward view me and us as a resource of terms of navigating reports and everything we have done. Theyre all on our home page. Think of me and us as a resource to help navigate that. What i brought today for the purposes of an introduction, im glad to answer any questions about our body of work but i highlights pages to two testimonies and theyre on the table over there. One was a testimony in may of 2010 before this committee, and it was based on a report that came out in july of 2009. And we were asked to look out how much progress had sba made in implementing the Small Business Disaster Response and improvement act of 2008. Its a mouthful. Ill now call it the 2008 act. Very important piece of legislation. It was a good way to look at progress sba had made from basically the problems that incurred during katrina and rita and it was also what remained to be done. The other thing we did was extensive fieldwork looking at the response of the 2008 disasters, which were of a smaller magnitude of katrina or sandy. It was the midwest floods and hurricane ike in particular where we did extensive fieldwork and we could see well how sba had done and the response had improved, so thats one, you know, data point that i want to provide through that testimony. Then the other document is last month we testified before house Small Business on a response to Hurricane Sandy, and it was based on a report and updates the report. The report was issued in september of 2014. Here we looked at obviously a much larger disaster, and looked at the response. We saw certain deficiencies in terms of timeliness and deficiencies in terms of following through with plans instated plans to initiate other provisions of the 2008 act. And in particular three loan programs that would operate through private sector lenders, and so ill just to close up this statement and look forward to questions is that our report in 2014 on sandy had two recommendations. One was to better account for the early influx of applications due to greater use of electronic reporting, electronic applications. The other one had to do with really get do a documented evaluation of lender feedback on in particular the immediate disaster Disaster Assistance program. To really evaluate lender input and to move forward with a pilot. And this is something that goes back a number of years. Its one that it is important in terms of developing a capacity, at least testing how well a program of that nature could work in a future disaster. So for now, i say, again, thank you for the invitation. I look forward to the discussion. Great. Thank you very much for that body of work. Next well hear from andrea deadwyler. On behalf of our inspector general, i represent the dedicated men and women of the sba. The sbas Disaster Assistance program is a high risk program. I believe our investigations and audit recommendations are having a positive impact on the integrity of the program. The Disaster Loan Program plays a vital role in the aftermath of disasters to assist with rebuilding disasterdamaged properties. Following Hurricane Katrina the sba released several reports. Sense the gulf coast hurricanes sba hazardss addressed many of our recommendations. Sba controls to prevent duplication with huds. Regarding dupelication of benefits, our 2010 audit provided controls. As a result of our audit, hud and sba improved internal controls. When we conducted our audit in 2015, we found that controls were adequately designed and generally working as intended. Sba implemented an electronic application for Hurricane Sandy survivors. However, the office of Disaster Assistance did not anticipate the surge in workload, which resulted in a backlog of over 29,000 loan applications. Excuse me. Consequently the agency implemented expedited process for home and disaster loans based on Credit Scores and loan amount. But the expedited process for Business Loans did not result in any time savings. We have identified challenges with sbas ability to meet disaster performance goals. Contributing factors includes sbas need to significantly increase Staffing Levels especially in response to a largescale disaster as well as a need to mobilize and train staff quickly. Sba reported an improper payment rate of 12 in its disaster program, which is a significant reduction from the 18. 4 reported in the prior year. The reduced volume of approved disaster loans for one went from 2014 from 332 million compared to the 2. 8 billion in approved loans in 2013 primarily due to Hurricane Sandy. They also implemented multilayer reviews at a Distribution Center to identify proper payments. However, we also note that the improper payment rate continues to exceed the 10 level. Hence, we consider this an ongoing challenge. In closing, the oag acknowledges the challenges that the office of Disaster Assistance faces in balancing its mission to provide loans with the responsibility of ensuring prudent loan practices. Due to the impact and risk associated with the Disaster Loan Program, we will continue to emphasize these programs as a priority in our office. Thank you for the opportunity to participate today. I look forward to your questions. Okay. Thank you very much. Next is tee rowe. Thank you mr. Chairman. Appreciate the opportunity to be here to discuss sbas Disaster Assistance program. Im tee rowe the president of americas sbdc which suspects the Small Business development centers. When a disaster hits, were there. Were there because its our neighborhood, its our clients, its our community. And in every case and particularly with katrina, sbdcs have learned a lot. Our past state director in louisiana did an amazing job with our committee on Disaster Recovery helping people share best practices and really tear down our effort to coordinate with sba and improve the response. And i have to say from my personal experience during katrina, i was head of Congressional Affairs at sba, so i was there in the trenches with james. Maybe not as deep in the trenches, but i saw what sba went through and how theyve come forward. And my members of the sbdcs have seen that same change. In every disaster people are overwhelmed. And at the sbdcs, we pool together as a family to try to share resources to try and bring volunteers from other sbdcs to help set up the Disaster Recovery center. Because when you set up a Disaster Recovery center, we work with sba now. Theyre temporary because theyve got to move from place to place, so theyre there for about a week, and were still there at the sbdc helping the Small Businesses. And that process has gotten so much better. Our new york state director cant say enough great things about the work that james has done. I just was on a call with our southeast directors so theyre kind of the disaster specialists just because of the way Mother Nature works. And they truly appreciate both the changes that sba has implemented but also the changes in your bill because youre removing some roadblocks to the cooperation we try to achieve. For instance the ability of an sbdc to operate across state lines. When things were started i think when the legislation was written, it just kind of forgot about disasters. Your bill does a great thing in letting us in disaster situations send folks from across the country to help out. Its a great improvement in the way sbdcs will be able to assist Small Businesses. And i would like to talk really quickly because ms. Bennett mentioned something very important. While were there at a Disaster Recovery center and were helping people work through their disaster loan applications, were helping them retrieve information put their lives back together. Because as mr. Paulsen said the Small Business is the hub of the community, and what weve been focusing on more and more and we actually have two specialists in florida who work all throughout the gulf region. Theyre recovery specialists, but theyre really resiliency specialists. And we work so hard to make sure that the clients all across the country are prepared to recover. Because without that preparation preparation, youre just that many more steps behind. Now, ill just quickly sum up that the last thing we really appreciate section 102 of your bill, the additional awards to sbdc. Weve found in sandy how helpful that additionally fund was because even still three years after, were still doing recovery work. Its vital to us to be able to provide that longterm assistance in a recovery situation. With that, ill finish up and thank you so much. Great. Thanks to all of you for the comments. Now, we just want to have a open conversation following up on all these topics, so theres no particular format. Please, jump in whenever you have a relevant thought. My questions and concerns are probably naturally going to focus more in light of the katrina experience my experience, and also the Small Business side of things since were in the Small Business committee. I guess this thought or question is mostly for sba, fema, red cross, and sbdcs. How is your response different for catastrophic disasters whatever that means, sandies versus other events . Do you have a different rule book, a different playbook and where roughly is that line that you would distinguish between catastrophic disasters and other events . Anybody want to take a stab at that . I can go first and then i look forward to hearing what fema and the American Red Cross says. We are much more coordinated today than weve ever been before, so the major disaster declarations are handled by fema. Red cross is always around in every major disaster. Weve been on the ground. Well stay there for 60 days. Generally, we were there for two months or as long as theres a need from that perspective, but were well coordinated in our Recovery Centers where theres a Disaster Recovery center for the major disaster re erer declarations. Coordination between our agencies, we hiccupped a lot back during katrina rita wilma. Today, we have the framework in place. It may look like a larger bureaucracy, but its a much more efficient process. When gerilee and i first met we were discussing the difference between response and recovery. We figured that out now. Ten years later, were Mature Organization when it comes to these are the roles and responsibilities of the responders and the recovery players. Now we have Disaster Preparedness 3r5igsprepared ness operation teams so we can continue asut of the disaster the longer term effect from that perspective. Okay. Fema . Gerilee, you want to take a stab . Yes. Thank you, mr. Chairman. I would say we dont have a different playbook for a catastrophic disaster because its really important we have the basic plans and systems and teams in place for all disasters in that they practice on the smaller disasters and it exercises what they would do if there were a catastrophic disaster. If we designed things that we would do things much differently in a catastrophic disaster, we wouldnt be as ready because we havent practiced it that way. We have some plans for very specific highrisk scenarios that we Work Together clab collaboratively with our partners, so we do do that but those plans are really very much based on the systems and teams and all hazard plans that we have in place for all scenarios. Okay. Russ . The commitment we make for people to have a warm safe, dry place to go with their family, food to eat, someone to talk to about whats next doesnt change. We provide services beyond that in regular, big disasters. After sandy for example, we did case work with individual families trying to help bridge gaps things that the fema programs cant cover due to statutory limitations. We would try to bridge gaps. That one on one casework assistance is very labor intensive and long and something we probably wouldnt get to quickly after a catastrophic disaster. We dont have a number in mind for whats the difference between a catastrophic and a regular, big disaster, but i would say when something is like katrina, ten times bigger than anything weve dealt with before, that counts as catastrophic. Sandy was a big disaster. Certainly, if you go through any disaster, its catastrophic for you, but regular systems worked for that scale of a disaster. Okay. Anybody else . Well, i just echo what russ said that any disaster is big for you. At an sbdc level the playbook doesnt necessarily change center by center in a localized disaster. Where it becomes a problem is when you do get the larger disasters and you need the extended resources for the extended recovery. You know, at sbdc, you can absorb it on a localized level understanding that youre going to have to do that much extra work with the businesses that have been affected in your area as they recover. But when you run into Something Like sandy where, i think, sba had, what, 600,000 applications or 400,000plus is what we had in katrina sbdcs are literally working with hundreds of thousands of businesses in helping them with longterm recovery . And at the same time, while a year or two later, everybody thinks, oh, the disaster is over that was then, its still affecting the community. Its still affecting the businesses. Let me jump in one. One of the reasons i asked this question is i know the gao concluded about sandy that the sba didnt surge operations quickly enough, didnt sort of realize the scope quickly enough, so thats part of the reason im asking. Is there a metric where you get it immediately that this is another category and theres a surge that starts that would not be required in lesser disasters . So in response to the gao question, one of the things we did postdisaster, we always do an after action report. Weve shared that with your staff as far as what weve done. In regards to how we staffed up, we had 800 people on the roles. We went up about 200, 300 people as a result of the louisiana hurricane that predated sandy. We ended up with 2500 employees. Staff wasnt the issue. Its just because we didnt put them on board fast enough. At katrina, we didnt have a staffing strategy. We had 800 employees. We hired 6,000 employees in six months. Postkatrina, we have 2,000, 3,000 reservists that are on call, that are available. The timing of how quickly we on boarded the staff, that was really the issue internally. We were prepared to on board much quicker. The difference between the electronic loan application coming in sooner versus the traditional paper intake curve we tripped up there, but weve addressed that. Weve changed our sop. Weve changed an updated our Disaster Preparedness plans internally, so that shouldnt be an issue, if we have any type of disaster activity. The staff is available. Weve even taken another step where we have a contract in place that will supplement if we go beyond that 3,000 level employee where we can have them fill any gaps that we may have across the disaster program. Okay. Go ahead. Sure. It was sandy was obviously the biggest disaster since katrina, so it was a much bigger task then lets say the 2008 disasters. James said it wasnt a matter of having the planning in place to take into account the electronic applications and the speed of them coming, so that was definitely part of it and part of the delays. Where were at now is there have been changes at what we call at sba the playbook which is one of three major elements of the disaster process. Theres the Disaster Recovery plan. Theres disaster forecasting models. Weve seen a change to the playbook. James and i have talked about this and a liaison at sba. We need a little bit more assurance from them. It might just be talking us through the steps as far as how do these different pieces fit together to make sure that if there was another major disaster like sandy or that magnitude that the process would work out differently and that sba would be more ready to respond. Okay. Let me move to a slightly different topic, which was a huge frustration of mine after katrina and continues to be in general, which was that i saw in so many cases federal response, roof contracts debris removal, et cetera, focus on National Mega firms. And local Small Businesses were virtually completely left out. If they had any participation, it was literally five subcontracting layers down getting pennies on the dollar. As all of you acknowledged in various ways in your comments a big part of recovery is local Small Business recovery, right . So heres a huge opportunity to drive that through this work, debris removal, blue roofs whatever, and i saw so many cases after katrina where the locals again either were forgotten or what are you doing differently since katrina to involve far more local Small Business . I guess thats primarily fema, but certainly involves others as well. Gerilee, you want to start . I can get back to you later with specific statistics, but i can describe to you the approach changes we are taking. In order to be able to get in fast and provide that surge, we do still rely heavily at fema on standby contracts and on interagency agreements where we provide funding to the army corps of engineers. But i think what were doing differently in approach is we have those and we dont provide the full scope for the full scope of the disaster upfront. We asked that they get in and do early work and then transition to local Business Contracts as soon as possible, so we can get you more details about how that works and statistics afterwards. Okay. Anybody else . So postkatrina, we saw that as a challenge. We under. We met interagency. As a procurement goal, we met with fema and with the other federal agencies and we said, look, we need to focus in. As gerilee explained, the first step is they come in but we definitely make sure theres a focus of Small Business contacts. We can make the referral directly to the organization that has the assignment on how to get the work. That didnt exist prekatrina but thats something we have developed for all disasters since then. Okay. Let me just also make the comment. To me this is a problem outside of disasters too. To me theres been a trend for federal Government Agencies to deal more and more with mega contracts or bundling contracts that by their size have to go to mega entities. And i think its mostly easier on the bureaucrats. If you have one mega contract youre dealing with versus 100, its a lot easier within the government bureaucracy. I think thats a very worrisome trend. It is completely cutting out Small Business. Small out Small Business. Small businesses either cant participate or if they do, they are layers down in terms of subcontracting, getting pennies on the dollar. I think a lot of postdisaster contracts and work is a particular worrisome example of that. But i think its a bigger trend. Thats just my two cents. Id love for you all particularly small sba to look at the relevant provisions regarding this in my bill, s147. We rare that they use local subcontractors for debris removal or demolition and provide incentives to federal agencies to work with local contractors. Id love your very specific feedback on those provisions. And im guessing most of those provisions really could be implemented in some form or fashion by you if you wanted to do it now. So id love your feedback on that. Any other comments on that in that general area . Okay. Let me ask the ig based on your audits and investigations of sbas Disaster Recovery programs, what are the outstanding biggest concerns that you have and what areas have the disaster programs been vulnerable to fraud or waste or abuse, and what are your top line recommendations . [ inaudible ]. Im sorry. [ inaudible ] waste and abuse in those programs. I think our investigators get referrals from many different sources. And they diligently look into any allegations of fraud. They participate on task force with regard to especially the big disasters. And that was a multilayer question. As we speak what would be your top line recommendations in that whole category . Top line recommendation well one of the big things we talked about and its been talked about with regard to the work as well and thats the gearing up in emergency. As james mentioned, theyve implemented a lot of different results to make sure theyre prepared for future disasters when it comes to receiving those recommendations. I think in sandy they had just started the electronic application and got so many more than they anticipated initially. So it took a while to address that back log. But i think with the implementation of the rapid, expedited process, i think they should be, and with the new plan to ramp up more quickly. I would like to think theyd be able to address those issues. We just have to wait and see. James mentioned every disaster is different and the approach is different. I think we just have to wait and see. Okay. Let me highlight another concern, and its probably outside any of yalls specific focus because its about the flood Insurance Program which isnt feem amafema but its not direct Disaster Response. One big issue weve seen and focused on in flood Insurance Programs is Participation Rate. Theres been very low Participation Rate. That, obviously is a major problem and issue in terms of solvency of the program and affordability of the program. By some estimates like a study in 2006 said only 49 of homes in special flood hazard area had Flood Insurance. So were having half the Participation Rate we should. I think this is a continuing problem. Weve talked about it. Weve talked about it in committee, in the Banking Committee with administrator fugate. But i have not seen those rates rise dramatically. I havent seen studies that document that. Ms. Bennett, do you have any observations on that or maybe fema can follow up and give us a status on work in that area . Ill just mention that fema has taken the concerns of the Flood Insurance issues postsandy very seriously and weve established a task force thats focusing on revamping the way the program is operated and making sure its customer focus and customer friendly. We have an ombudsman function to help People Better understand how their par tasipation, how they can participate in the program and make sure they have a place to provide feedback about the program. As to specific efforts to address Participation Rates well get back to you on that, sir. Okay. Let me start wrapping up. Thank you all again for your participation and ongoing work for this discussion. I want to highlight something i mentioned in my opening comments, which is some recent legislation weve developed and worked on in this committee. I just mention s1470, the rise after disaster act. Id love you all to continue to work at those provisions and respond and react pro con, anything in between suggestions. Its anything in between but its still moving through the process, and also the national Disaster Relief tax act we introduced that last month. Take a look at that as well and please after any suggestions you might have. This is obviously ongoing work for all of us. And ongoing discussion. Im sure well have plenty of followup, including the specific things i mentioned as followup for the record. With that well be adjourned. Thank you very much. On the next washington journal, your phone calls and reaction to the fox news republican debate. After that, thom file and philip bump discuss voter turnout and demgraph ics from president ial and Congressional Elections since the late 1970s. Plus your Facebook Comments and tweets on washington journal live at 7 00 a. M. Eastern on cspan. Sunday night on q a former emergency manager of detroit kevin orr talks about detroits Financial Issues and his job overseeing the largest municipal bankruptcy in u. S. History. If detroit had taken that 1. 5 billion in 2005 and 2006 when the stock market went down to 6700 and if it had just invested it in an index fund the stock market is now trading at 18,000. Almost three times what it was. They not only would have tripled their money but could have paid the pensions in full. Used to be a practice of giving pensioners a 13th check at the end of the year, including to the 12 theyre do. They could have fixed themselves if there had been some sober management going on. If you have some strong leadership and some focused leadership you can resolve these problems but it takes a lot of effort. Sunday night on cspans q a. At the Brookings Institution, military analysts and defense contractors discussed new technologies that have the potential to transform how wars are fought. Much of their discussion focused on 3d Printing Technology and reforms to how the government procures defense contracts. This is an hour and a half. Good morning, everyone. Welcome to brookings. Im Michael Ohanlon with the Foreign Policy program here. Weve got a wonderful event here today talking about Defense Technology. And im pleased to have a number of members of our National Security industrial based working group, from a number of americas greatest companies, thinking about Technology Innovation across defense and nondefense sectors, and ill introduce the panelists in just a moment. They represent companies that have been part of our group in an important way for a number of years. In some cases more recently than others, but a lot of expertise on several topics. Im going to say a brief word of introduction about the panelists and the topic. Let me do that first. What were trying to do is look at a few specific areas of Defense Technology and innovation. A lot of you have heard of socalled 3d printing or additive manufacturing. Were also going to talk about propulsion technologies which in some ways are, you know, a longstanding interest of the u