Transcripts For CSPAN Admiral Mike Rogers On Cyber Security 20141101

Years Cyber Security summit hosted by the u. S. Chamber of commerce. Campaign 2014 debate coverage continues with the race in new hampshires second Congressional District between democratic incumbent and the republican challenger. That is followed by the race in new yorks 24th congressional the democratic incumbent is running for a third term against republican challenger. Camhe 2015 cspan student video competition is underway, open to all middle and High School Students to create a five sevenminute documentary on the theme the three branches and you. There is 200 cash prizes for students and teachers totaling 100,000. For the list of rules and how to get started, go to studentcam. Org. The u. S. Chamber of commerce recently held its third annual Cyber Security summit in washington, d. C. The event included remarks and a , a with the nsa director Admiral Mike Rogers did he spoke about information sharing and efforts to encourage publicprivate partnerships to combat Cyber Security threats. This is an hour. Thank you very much. I want to start by thanking you and the chamber. Your proactive leadership on this topic, i think, is second to none and i think you are doing a Great Service for the global community. What i want to do is very briefly provide a private sector view on the environment the importance of information sharing and the obstacles we face and a call to action before introducing admiral rogers. Let me start with something everybody well understands. The range of attacks we have experienced in the private sector is really unprecedented and getting worse by the day. The volume and sophistication of attacks is only showing signs of acceleration. Every published success simply encourages new entrance and bolder moves. Threat actors from social activists, cyber criminals with a range of objectives from disruption, intellectual property theft, Financial Crime and destructive intent. Cyber criminal activities in particular have simply exploded. While one at a time, the impacted individuals, Companies Collectively represent potential threats to the country if they continue to build the way they are building and if they become more orchestrated. Imagine the top 10 retailers attacked at the same moment. The top 10 Financial Service companies attacked at the same moment and the impact on the confidence in our economy. Especially, if the capabilities that today are pointed towards financial criminal activities start to turn towards a destructive intent. It is a very sobering concern for us. Now, we each in the private sector have a range of capabilities in terms of Cyber Protection and continue to invest. We probably spend more than 2 billion in the u. S. Across the Financial Sector in cyber defenses from protecting the perimeter to protecting data loss, insider threats. We continue to invest in our capabilities, but i would like to use the analogy. Think of the company as a fort. We have to know when we are under attack. At the same time, it is incredibly valuable to know when a neighbors forte is under attack or when the adversaries are marshaling their forces in a forest getting ready to attack. When they are back in the home country, building weaponry to attack the fort. My view, probably the best control that any company can have is transparency around what is happening around us with our sector and with the government. Said another way, i believe the lowestcost, highest value control is information sharing. It has the best roi of any investment anybody can make in the system of cyberprotection. One companies detective moment can become an entire sectors defense or cross sector defense. Further, no one entity can stand alone. Not a single business, sector, law enforcement, intelligence community. Each brings added insight. I believe the whole is greater than the sum of its parts and that is to protect individuals, businesses. Customers, business, law enforcement, intelligence, Homeland Security working together to protect our customers interest, business interest, Critical National infrastructure and the country. Further, while i do believe information sharing is in the best interest for each of us in our businesses, i also believe that we have a moral obligation as socially responsible enterprises to share and not to consider our cyber insights as a source of competitive advantage that some Companies Look at that way. Effectively sharing cyber information actually is not easy at all. There is a fair amount of information that does get shared. There is information sharing, but it is slow, relationship and trustbased, very variable within and across industries or the government and there are a range of obstacles. The first obstacle for the private sector is that we are simply in many cases unable to share cyber information due to potential legal liabilities that may occur. You think about what if somebody acts on information that we have shared, we share in good faith but by acting, they cost some harm . On the flipside, if we share information but a good faith of companies dont act on that information because they have a basis for not acting, the liability in both instances is so substantial form and risk perspective that it completely stands in the way of information sharing. Second, there are too many vehicles for information sharing. It is variable, well intended, a bit chaotic and hardly complete. The ncfta, cifct, the physics, fusion centers. Company to company, fbi, treasury, Homeland Security, secret service. All of those occur in some moment or another. There well intended, very appreciated from the private sector, but sometimes they are conflicting, sometimes very inconsistent in him was information sharing happens real time. The third obstacle i would say from the private sector perspective is the government over classifies. What a shared at the secret level is very rarely actionable. Not enough private sector employees have clearances above the secret level where more of the actual information resides. I compare and contrast what we get in opensource intelligence. Thinking about the last two days. Yesterday, you wouldve seen some information about a new watering hole attack that has been out there called scan box. We get what are indicators of compromises which we can act on. Last night, detail was released on an opensource context about a new purported chinese apt attack called axiom. What comes with the open source is actionable intelligence, things we can do something about which is not relevant. I will close with a call to action. On the private sector for those of you from the private sector, support legislation that is out there on information sharing. I would support either of the two bills that are out there. Theyre opening up the volume and the capability of sharing. It is the highest roi opportunity in the system of cyber defense. I would call out to things. There should be Liability Protection both for acting and not acting. The second thing i would say is information can and will be anonymized. There is a reason not to anonymize. We could address privacy concerns very effectively. For the private sector, if you re not in one of the isacs, if you are not in one, you should join one. If you are in one, you should be very active. There is a very uneven level of contribution in terms of information sharing. We need your insight. I would cal on you to do the same. For the public sector, call to action for my perspective is pass the information sharing legislation. Also, we need a Better Process to get private sector clearances either above secret or to make sure intelligence is more actionable at the secret level. What we really need is a systematized construct for how information is shared. Frequency, format, actionable substance and close to realtime as we can make it. Coordinators across intelligence agencies and the private sector. That is a view from the private sector. It is now my privilege to introduce admiral rogers. In april of this year, admiral rogers assumed the post of director of Cyber Command and chief of Central Security service. You have his biography in your package but he served as commander of the u. S. Fleet Cyber Command and the navys u. S. 10th fleet. Since becoming a flag officer in 2007, he has served as the director of intelligence for both the joint chiefs of staff and u. S. Pacific command. With over 30 years of service, he has extensive experience in the intelligence gathering, Computer Network defense and information warfare. Ive shared this with the admiral as he was coming in. I actually met him in 2012 very briefly at a Cyber Security conference at west point. The theme of the conference was actually publicprivate collaboration and the role of the sector in defense of the nation. My impression of the vice admiral was we set next to each other for maybe 30 or 45 minutes the morning of that event. I thought back on the experience to try to convey the sense that i took away from that short moment. I will tell you is this having not had at that time a lot of private sector experience, he was very inquisitive about the private sector. He asked a lot of questions. He was a very active listener. He seemed to have an appetite to learn about the challenges based in the private sector and to contemplate the opportunities for collaboration. He also conveyed purpose, sense of purpose, belief in his mission and a clam sense of command. What was interesting as i reflected is what came away for me in that moment which i think would be reinforced from what you will hear today is the admiral is very committed to publictried partnerships and is a very strong advocate of information sharing and partnering with the private sector. Please join me in welcoming Admiral Mike Rogers. [applause] good afternoon. How is everybody today . I apologize that i will speak what youre eating but please keep eating. You have about 50 minutes or so. I will speak for about 15 minutes and give a few thoughts from my perspective. I really interested in an exchange with all of you because i am curious as to the perspective that you bring to this issue. Why is admiral rogers talking to the chamber of commerce . And to the private sector about the idea of Cyber Security . Because as you heard from mark, one of my takeaways in the 10 years or so i have been involved in cyber is that cyber is the ultimate team sport. If we are going to make this work, it is about creating a true integrated team and a set of partnerships that will make this a reality. That there is no one Single Technology that will enable us to give and see Percent Security of our systems. There is no single entity that has all the answers. Nor is there one single group or entity capable of executing the solutions that we need to do. It takes all of us working together. Before i get into what i think we need to do to work together, let me start out by thanking the chamber very much both for your kind invitation today but more importantly, for the dialogue that over time you have been a part of in helping to facilitate. This is all about trying to talk to each other about how we can figure a way ahead here. Mark, thank you very much for your kind words. More importantly to me, as a Senior Business leader, i want to thank you for your openness. For your sense that Cyber Security is a direct impact and concern to the leadership of corporations. I will tell you it doesnt matter if it is a military command within the department of defense, whether it is a private company i am talking to, i can tell which organizations have leadership buy in in which those that dont. If you dont have leadership, you are fighting with one hand behind your back. All of you here today with us who play a role of leadership within the Business Community or in the government, i thank you for your willingness to spend some time in your busy lives on this important topic because as leaders, it is up to us to help drive the change that i think we need. This is much less about technology to me and much more about changing our culture. Traditionally, in our nation, we have tended to view the private sector in one arena. The government and another. And the whole question of National Security as something that is apart from that. My argument would be the line between those three groups and viewpoints. I view the Cyber Security challenges we are facing as a nation as a National Security issue for us. How where we as a nation going to addressing the challenge that is not going to go away . If we think this is a shortterm phenomena either of short duration or of relatively minor impact over time, i would argue we have missed the boat. I see this both extending for a significant period of time and it will have greater and greater impact on us both within a corporate sector, within the public sector. As u. S. Cyber command, one or our jobs is to defend the departments networks dod. We are dealing with the same challenges. Every day, there are individuals, groups and nationstates attempting to penetrate our dod networks. It is the same thing we are seeing in the corporate world. You may ask yourself what is it admiral doing talking to us . I come here wearing two different hats both related and both applicable to this idea of separate security. The first as commander, we have three missions which is applicable. The First Mission is to defend the department networks. The Second Mission is to generate the Cyber Mission called the cyber team that the department will use to execute its missions over time. The third one and the one that really brings me here today is if directed by the president or secretary, u. S. Cyber command is tasked with providing protection and support to attack against critical u. S. Infrastructure. I have to be ready if i get an order of how we will partner with our teammates because if there was one thing you learned in the military, you do not wait until the day of the crisis to say to yourself i guess we better do some training with each other or i guess we better understand what our partners need and what they dont need and what is effective for them and not. We are in the midst of working collaboratively with the department of Homeland Security, fbi teammates, ourselves, other elements of the government depending on the sector. We are in the process of partnering on how we are going to work through the details of how we are going to exercise and train with each other so that when we are in the middle of the crisis, we can really make this work in real time. The second hat i wear the National Security agency, which has gotten the most attention over the last 18 months or so, has two primary missions. We talked a lot about one of those missions the foreign intelligence mission. Nsa uses its foreign intelligence capabilities to attempt to understand what nationstates, groups, individuals are doing in the cyber arena against the United States. The other mission that nsa has is Information Assurance. Nsa is tasked of the the Information Assurance mission not only defending the department of Defense Systems as well is helping to develop the standards for systems. We do it with the federal government and increasingly, we find ourselves called on by our dhs and fbi teammates to provide capabilities to support the private sector. That is not going to slow down. That will increase. You can pick up a newspaper, you can get on your favorite website, you can blog on whatever particular interest you can go to whatever media outlet that you find is the best source. Every day, you will find something about a major cyber incident. This is not a shortterm phenomena. Later today, youll hear from senators feinstein and chambliss. I think the role they are playing is attempting to generate legislation to help the private sector deal with the very real and legitimate concern about legal liability. That is critical for us. Because if we dont help address that very legitimate concern that i think for many of you, many of you in the private sector that is a real challenge for you, for timely information sharing. As the director of the fbi, in a private life, he was general counsel of the largest Brokerage Firm in the United States. I will often ask him when you were a lawyer, what was your recommendation . What advice were you giving . He doesnt hide the fact that he would oh is tell them to be very mindful about the liability. That you have to be very careful and if youre not, potentially, the corporation is going to be setting themselves up for major financial liabilities and potentially impact on market share and business and the image. We have got to help address those concerns. What we have to get to is a realtime, automated interface. We need to define in advance what information we are going to share. I do not want privacy information in this because it creates challenges for me. Under the law, anytime as are dealing with privacy information for u. S. Citizens, i have very specific restrictions on what i can or cannot do. My input to this is we do not want privacy information here. That will slow us down. That is not what the focus of Cyber Security is. What we need to share with each other is i need to be a low provide from the government standpoint, what i ought to be able to provide is actionable information that you can use, that gives you insight as to what is the malware you are going to see, how will it come out you, what are the indicators you should be looking for in advance that will suggest to you that activity of concern is coming . I ought to help you identify who is coming after you. What i need from all of you is i am not in your system nor do you want us there. I want to understand what the malware you are seeing. What have you done with your system configurations that have worked and what did not work . What did you anticipate, what did you not . Collectively between us, we need to share this across the entire sector because as you heard mark say which i agree with, the inside of one could translate to the defense of many. That is a great value for us as a nation and we need to come up with a system that enables us to do this in a realtime way. The only way to do that in my mind is the legislation you will talk about later today as well as sitting down in a partnership and walking through exactly what elements of information are you comfortable with sharing. What do you feel you need from us, the government, and likewise i would like to have the same conversation with you. Here are the elements of conversation that would help us and here is what we are comfortable with sharing. I have got to do this in a way that you can actually use it. That is not going to help anybody. We will be working our way to that process. The key to it will be dialogue. The sector construct that has been developed over time is very powerful. If you are not engaged than the sector construct whatever area of business you are in i would urge you to consider doing that. That helps us because we have a framework within a particular sector that we can deal with. We have tried at times to simultaneously work across sectors. That has proven to be complicated. Some sectors would not apply it to themselves or they are not interested in that and that is not how we are constructed. The sector piece has been very powerful. I think one of the things we need to do as a government is simplify this. I am constantly telling my peers at the senior levels that we have created a structure that is so complex that if you are outside the government, it is incredibly cumbersome and difficult to understand. If we are honest with ourselves. That is not because people are not working hard and not because they are not motivated to do the right thing. It is because we have tended to do this incrementally over time. I think we need to fundamentally look at how we structure the government side in a comprehensive way that makes it easier for you. At the same time, makes it easier for us because many times right now, this information sharing is based on personal relationships, personal knowledge, limited awareness. I know this but i dont know what else is out there. That is true for all of us. We have got to try to simplify that. That is one of the areas we will be working on. With that, i really want i tend to use questions as a way to make some broader points. I am much more interested on what is on your mind. If you are ready, ms. Ann. We have collected some questions earlier. Can i steal one of the waters . Absolutely. There you go, sir. We collected questions from the audience earlier. We will go to the audience as well. Get your questions ready. We have microphones that will come to you. If you could just identify yourself and what company you are with before you ask your question, that will be great. One of the things we have been talking a lot about is how do we punish those bad actors that are stealing companies it. Some companies are becoming more vocal of the need to actively defend themselves against Cyber Attacks in the absence of private support. Is this something they should view or exclusively the responsibility of the government . We have a Legal Framework. We have seen five individuals from in nationstate being indicted. We have a Legal Framework for how we as a nation address criminal activity. I often get asked this question about cyber mercenaries. Should we go out as a private sector and hire individuals to conduct with the military calls offensive operations to try to stop through the use of tools nationstates, groups, or individuals from conducting these attacks against us . Again, that is something that is a broader policy issue so we will work our way through it. Be very careful about going down that road. You can potentially open up a whole new range of complications. Think about the legal implications. I will be the first to admit i am not the smartest one about it. I will urge you to be very careful about going down that road. How about attribution to the socalled bad actors . That is when this partnership becomes very powerful because that information sharing between us about what is the attribution . Based on our confidence and knowledge of that, is there options that is available to us . Information sharing, increased knowledge gives us a greater option to consider. Talking about definitions. We have the different domains. One of the questions was does the Defense Department have a definition for what constitutes use of force in cyberspace and will that definition be the same for activities in cyberspace and those for other nations as well . We have a Legal Definition under the law of Armed Conflict and the law of warfare as to what is a military act if you will. We are working our way through a policy debate about what is the extension of those rules to the cyber arena. We have definitions for what is offensive versus what is defensive response actions. The broader issue is as a society where try to come to grips with we feel this activity directed against corporate networks, governmental networks, private individuals. What is the right response . I think the broader issue is what is the right response to this . What i hope we can develop over time is a set of norms and rules that get us into an area where we have a much better definition of what is acceptable and not and even the idea of deterrence. Right now, if you are a nationstate, a group, an individual, my assessment is that most come to the conclusion that it is incredibly low risk that there is little price to pay for the actions they are taking. I am not saying i agree with that but i believe that most look at it and in light of that feel they can be pretty aggressive. That is not in our best interest in the long term as a nation for others to have that perception. We need to try to change that over time. One more. If you have a question, please raise your hand and we will bring a microphone to you. We have one right here. Tom from eei. Can somebody bring him a microphone . I will ask mine first then. One of the things we were talking about this morning was the chinese issue and russia as well. It was mcafee that conducted a survey of cyber experts around the world. They asked americans who do you fear most and american said the chinese. Every other country said americans. What are your thoughts on that . What we are clearly articulated as a nation like every nation in the world, we use a broad range of tools to better understand. The Biggest Issue we have raised is in the cyber arena, we dont use the power of the nationstate did you cyber as a tool to gain insight into foreign, private competition to then share with the private sector in the u. S. To gain a competitive advantage. We do not do that. Many other nations in the world do. Some publicly acknowledge it, some do not. We have been very vocal with our chinese counterparts. We view this as a concern and behavior that is fundamentally incompatible with the relationship we want with the chinese. We continue to work from a policy perspective. You have seen the legal action we have taken. My only argument would be i certainly understand as an intelligence individual. We are subject to more oversight and rightfully so because it is the way we are structured. We have more oversight congressionally and legally than most of my counterparts around the world. That is not a complaint. That has served us incredibly well because as a nation we want to be comfortable with what we are doing and why were doing it. I view that as a strength for us. Thank you. Tom . I am tom from the electric power sector and former navy lieutenant. I knew that you were a good man. [laughter] ceoled effort going on with the in the electric sector, we have a ceoled effort going on with the department of energy and the Homeland Security, with the electric sector coordinating council. We are focusing on tools and technologies and providing some good detection technologies. I think we have a lot of good information sharing going on. Hopefully, the technologies will help us get the machine to machine stuff going. On the latter ones, since you are from the military and i think one thing we dont do that well in the private sector is the actual drilling and exercising of the response and recovery plans. Im wondering if you might give your thoughts about how we might be able to do that more often. Obviously, with the participation of our sister agencies in the government, it is a very important part of that equation. First, it reminded me. One of the things i hear in the power sector i was down in san antonio talking to merck last week. One of the challenges i think in the power sector and what i often hear from Corporate Leaders is you need to understand some of the constraints we work on. We are regulated industry. In order for us to generate income to make some of the changes we feel we need to do, we need to go to a regulatory body and make an argument. Few of our citizens are interested in increased power rates as a vehicle to generate more money to address Cyber Security and our regulatory bodies share this concern. First, my thanks to the power sector for within those constraints try to push this as hard as we can. I have some real concerns in this arena. In terms of the kind of idea about how we can train and practice with each other one of the things i have said both internally within the department of defense as well as the private sector, individuals and organizations i deal with, we have got to move from a focus where almost all the resources focus on stopping someone penetrating our networks to an acknowledgment that there is a likelihood that despite our best efforts, we are going to fail and therefore remediation and mitigation starts to become critical. I have had to defend networks against a determined opponent who got inside the network. It is one of the best fights i ever had in my 33 years as a commissioned officer. It really was each of us trying to anticipate what we are going to do, how they thought we were going to respond, and us driving them away. One of the takeaways i told our team in the department was we have got to learn how to continue to operate a network even if you are fighting to defend it. Often times around here, when the answer is just shut down. I am like you have to be kidding me . You know what function does network execute daytoday . Do you know what this does on our ability to execute our mission . I will not take Mission Failure just by shutting down. That is not the answer in most cases. I think we need to shift to a focus on remediation and mitigation how you fight through a network that has been compromised. One of the things we are trying to do is on a sector by sector basis, how can we look at doing that . One of the things i have said in these exercises, this coordination should not be done at my level. Where we generate value is the level where men and women are actually doing their work. That is what we have to get to. It is not myself, cabinet heads, agency heads meeting with ceos. Not that that is not a part of it but that is not the level we need to get to. We need to get to an actionable level. I am always looking to the private sector how can we help with that and what is the right level for you . I know what that means in the department of defense, the government but i dont know what that means in your structures. I would be curious about what you think, tom. What it means is really at all levels because on hurricane response, for example, we are pretty good with response and recovery and have a good resource system program. Companies come to help each other and hurricane sandy, we got together an army of 67,000 people from all around the country. With the help of the military to get that done. At that level, it is important to have that. The other part of it is during a cyber attack, there will be a lot of things happening in terms of coordination at the highest level of the government. In terms of media congressional interest or governors or other folks. There has to be a lot of coordination. They are couple of different tabletops that have to be done. One that would maybe practice coordinating some of those activities as well. I apologize if i came across as not embracing that. It is such a multifaceted problem. They are so many Different Levels and complexities to this. We have step back and look at this holistically. It is not just a technical piece. I see so many people just want to focus on the technical piece. We had to think much bigger than this. Following up on that, more of the human component. We were talking about back as 1994, Time Magazine wrote a story about the internet. No one heard about the internet. They put it on their cover and described what it was. When you think about it, all the terms that have come into our vernacular twitter, youtube, blogging and tweeting what will be the next generation of Cyber Threats we will face . I think the next arena will be the digital handheld device. Both because it is exploding in its application and use. Increasingly, whether it is for business, the military, whether it is us as individuals, look at the series of actions and steps you are taking in your everyday life, corporate, government or individual with a mobile, handheld digital device. That increasingly is becoming the norm. That is the area i look to in about 5, 10 years, that is what concerns me. We tend to focus on fixed networks. Large, corporatebased those arent going to go away but the handheld digital is the next area of concern. The internet of things, the wearables. I consider the internet of things part of that. Question right over here. Wait until we bring you a microphone. I apologize, i cant see you so well. I hear the lights are pretty bright in your eyes. I am susan morrow. I guess my question, in the energy sector, we dont differentiate between physical threats and Cyber Threats. We drill with the assumption that they will probably do both at the same time if it is a sophisticated attack. To be frank, the militarys response in its own protection seems to be focused on isolation as a tactic for dealing with the idea of the grid going down. I wonder if you could talk to that a little bit. As tempting as isolation is as a strategy for response, it also potentially makes security a lot more difficult if you have individual grids all over the place. So, i dont know, if you could talk about isolation versus integration. Isolation works at a tactical level for immediate shortterm periods. It is not a comprehensive, sustainable strategy. It is this idea of, i will just shut the network down. It is not that it is a bad thing at the tactical level. If you are looking at a base, an installation as opposed to an entire grid or sector. In the long run, i think the right answer for us is going to be, again, rather than isolation, how do we do something in a more integrated way . Isolation is difficult as a strategy, particularly if you have high Power Requirements. We have huge Power Requirements so this is something that i pay a lot of attention to. Power is a big concern for us because we are a Huge Consumer of electrical power. I agree with your fundamental premise. The challenge becomes, how can we have a conversation about the right Response Strategy here . Are we really comfortable with this idea of isolation . As a broader strategy, i dont think that is the best response. Thank you. A question about i have heard some members ask, and likewise with the response in the question about tabletop exercises, say a business is sharing information, using a framework told or a Risk Management tool and they are dealing with an adversary that outstrips their abilities to keep pace. We know that there are partnerships with dhs and other agencies. When would the nsa step in . What is the policy there . First, i would argue that the most likely scenario is probably u. S. Cyber command. One of our three missions is when directed by the president or secretary to provide capability to the critical u. S. Infrastructure. Our role to do that, our mission will be to attempt to interdict the activity before it gets to that u. S. Company. That is our primary strategy. That is what dod brings to this. A subset of our strategy is, if we should fail in that regard, we have also developed defensive response capabilities that we can deploy to partner with dhs, the fbi and the private sector. It goes to toms question. How do you mediate and mitigate . If you fail, how do you remediate . That is really the u. S. Cyber command side. That is what the president requests the secretary of defense to do. There is a policy debate, a legal debate. It is why in my an initial comments i talked about this as a National Security issue. Viewed as a National Security issue, the capabilities of dod and their application are in keeping with our broad policy and legal structure as a nation. If we view this as a private sector issue, then traditionally, do you really want dod involving themselves in this . That is why i think looking at this from a National Security perspective is important. There will be a discussion about the refocus on critical sectors. Is it any private entity . We have defined approximately 16 segments as being Critical Infrastructure whose loss would have significant National Security impact. What we are developing at u. S. Cyber command is to be prepared to apply capability in those 16 segments after erected by the president or secretary. Thank you. Admiral october, according to the department of Homeland Security you may know the chamber has embarked on a outreach campaign. Over the last few months, they have been going around the country. As you can imagine, very different audiences. A lot of us in washington are wellversed in the cyber framework. In phoenix or chicago, some of them hadnt heard of it. We are spreading the word on that. The question is, that is great, that is a campaign. What else do we need to do . You look at the als ice bucket challenge and how quickly that went viral. What can we do to jumpstart people paying attention to Cyber Security . One of the issues, what is the Tipping Point . What does it take when it gets so bad that we finally say, ok, enough . We have to get the legislation, put those partnerships in place. The status quo is not working for us. For whatever reason, it doesnt appear that we have reached that point across society. In no small part, because many of our citizens, it hasnt reached a true pain threshold. So someone steals your account information, steals your credit card data, charges on that card. Right now, if you report this to your bank, we are not paying a price. The corporate sector is assuming liability. They are covering it. The point i think about is, once this becomes something that impacts a broad swath of our citizens in a real manner that impacts their daily life and ability to do what they want when they want, then watch for a whole shift in the way we are talking about this. My frustration is, it shouldnt take a disaster to tell us that you can see this coming. Every one of us knows that this is a significant National Security issue that is not going away. It will likely only get worse. We can either deal with this now in a collaborative, professional way, we can wait until we hit a across the forehead. I dont like to get hit. I find that to be a painful experience. I would much rather we have a dialogue and from the dialogue to the concrete sets of how to make this real and how we can work between the private sector, government, and a broad swath of government one of the comments i made is, right now we are asking the private sector to withstand the efforts of nationstates against them. That is asking a lot of the private sector. I think you have seen this reflected in what we are trying to do as a government. This is about partnerships. We have to be able to provide government capability and capacity to support the private sector. Likewise, we need the private sector to provide capacity and capability to make this work. It is not either or. For those that argue it is a private sector function, i think the reality is it is between viewpoints. We have to work this collaboratively. There is no Single Technology, no Single Source of intelligence or insight that will clearly tell us exactly what we are seeing. It takes partnership to make this work. You have information i need and i have information that could be of value to you. You have not just one of the toughest jobs, you have two of the toughest jobs. Cyber commander and head of the nsa. What do you think your biggest challenge is . Where do you go from here with the Cyber Command . How can the chamber be helpful to you . My biggest challenge is creating a culture and building the framework for the future. On friday, United States Cyber Command celebrates its fourth anniversary. We are four years old as an organization. In the scheme of things, for years is not a long time. There are organizations that have a much longer history than we do. My challenge is, create that workforce, build the operational concepts and command and control as to how to deploy it, and exercise it with our partners inside and outside the department, as to how to make this work. What you need from us, what we need from you, how to share it, what format. The answer to this isnt, i give you everything we have. I dont want that from you and i dont think you want that from us. We can bury each other with data. Putting on my intel hat, data is interesting but what i care about is insight and knowledge. I use data as a tool to get there. Data is not the endall. We have a question here. Wait for the mic to get to you please. I am with the Industry Leaders association. I will stand, sorry. I cant see because of the light. My question is, you talked about the importance of cyber information sharing. We are going to hear later about sharing legislation. One of the big criticisms by some is that these bills allow you to get the information and they would like that how do you get around that . Lets have a very clear definition of what you are providing us. I dont want privacy information. It creates challenges for me. It slows me down. For this mission set, not a good thing for us. What i like to have is a discussion about, what is the information we want to share with each other . What is the value that information generates . This idea that you cant trust fill in the blank, that is a recipe for disaster for us. Among the things we need to address is, the controls and the oversight mechanisms. What is the role of Civil Liberties and privacy . What is the role of inspector generals . We have lots of mechanisms about oversight and control of information. We need to make that a part of this. Im not interested in anybody writing a blank check for u. S. Cyber command or the nsa. I bet the fbi and dhs would tell you the same thing. Remember, dhs is the leader here. In military jargon, they are the supportive commander and we are supporting them. We work through the department of Homeland Security. We partner with others in the federal government in addition to dhs. Fbi, treasury, energy, we partner with others. U. S. Cyber command, we are not the leader. The National Security agency, we are not the leader. We partner with others. We have time for one last question. Can you wait for the mic to get to you . Politico pro Cyber Security. There have been reports about employees of the nsa working there have been some reports recently about employees of the nsa working parttime in the private sector, former employees going on to the private sector. How is that affecting morale within the nsa . Is there concern about that relationship with the private sector . First, we have a formal set of processes that must be applied when individuals do something in addition to their nsa duties. We review that and when circumstances change, we will say, that is not acceptable anymore. The circumstances have changed. The relationship is different. We do that on a recurring basis. For some, it is as simple as someone with a language background saying, i want to use my language on a contracting basis to increase my skills. Sometimes we will say yes. Sometimes we wont. In terms of the flow of partnerships and information back and fourth, i have been very public about saying for the nsa, i would like us to create a model where members of our workforce dont spend 30 or 35 years working directly for us. It is amazing, the employees that i will talk to. When i say, how long have you been with nsa, 35 years, 38 years. I just said goodbye to an employee after 50 years. Given the state of technology, we have got to create a world where people from nsa can leave us for a while and go work in the private sector. I would also like a world where the private sector can spend a little time with us. One of the challenges that we are dealing with, and you have seen this play out, we have talked past each other a lot. We dont understand each other. The nsa culture and experience isnt optimized to understand concerns from our i. T. And corporate partners. Likewise, many of the individuals we work with in the corporate world dont have an understanding of us. I think we should change that. I think it will produce Better Outcomes for both of us. Thank you very much. Thank you for your time. Thank you for all that you do. The u. S. Chamber of commerce looks forward to working with you and your team. We hope you will come back. I thank you for taking time from very busy personal and professional lives to be part of a dialogue it wont be just today, next week, next month being part of a dialogue about what we ought to do to address a foundational challenge for us as a nation and for our friends and partners all over the world. Cyber does not recognize geographic boundaries. The idea that we are going to deal with this in america, i dont think that is a winning strategy. We can learn great insight internally, but also from our partners overseas as well. It all starts with our willingness to have a dialogue with each other and a willingness to be open. Not starting from a position of, you are in the private sector, you are all about money, i dont know that i can trust you. Or the private sector saying, you work for the government, i dont know that we can trust you. That is not going to get us where we need to be as a nation. That is not going to provide the protection that our society, the private sector, government, us as private individuals, that is not going to generate the outcomes we need. This will take all of us. It starts with an open relationship and a willingness to be transparent with each other. I thank you very much. Have a great day. [applause] from the Cyber Security summit with the assistant attorney general for National Security, john carlin. He spoke about the governments efforts at combating Cyber Security threats. This is 25 minutes. Thank you for your warm introduction and for inviting me to your annual Cyber Security summit. We benefit greatly from your leadership, especially in promoting the chamber of commerces role in National Security. In establishing an annual gathering focused on Cyber Security challenges, the chamber of commerce demonstrates commitment to keeping our nation secure and lowering barriers for businesses to compete fairly in our global economy. The fact that this is your third annual Cyber Security summit is a testament to the growing magnitude of these threats and your commitment to make cybersecurity central to the business plans. This is an important business issue and one that i know the chamber has exercised as a part of its national Cyber Security Awareness Campaign which kicked off in may. In may. In the campaign roundtable events that occurred throughout the country the chamber stressed the importance of the cyber Risk Management and reporting Cyber Incidents as to the law enforcement. I couldnt agree with these two recommendations more. Todays event is our opportunity to discuss how we can take the steps and others to best protect ourselves and to the nation. Cyber security threats affect us all and they affect our privacy for our, our safety command our economic vitality. They present collective risk and disrupting them is our collective responsibility. The attackers we