Transcripts For CSPAN Key Capitol Hill Hearings 20141029

, in themy question energy sector, we dont differentiate between physical threats and Cyber Threats. We drill with the assumption that they will probably do both at the same time if it is a sophisticated attack. To be frank, the militarys response in its own protection seems to be focused on isolation as a tactic for dealing with the idea of the grid going down. I wonder if you could talk to that a little bit. As tempting as isolation is as a strategy for response, it also potentially makes security a lot more difficult if you have individual grids all over the place. If you could talk about isolation versus integration. Isolation works at a tactical level for immediate shortterm periods. It is not a comprehensive, sustainable strategy. It is this idea of, i will just shut the network down. It is not that it is a bad thing at the tactical level. If you are looking at a base, an installation as opposed to an entire grid or sector. In the long run, i think the right answer for us is going to be, again, rather than isolation, how do east to how do we do something in a more integrated way . Isolation is difficult as a strategy, particularly if you have high Power Requirements. We have huge Power Requirements so this is something that i pay a lot of attention to. Power is a big concern for us because we are a Huge Consumer of electrical power. I agree with your fundamental premise. The challenge becomes, how can we have a conversation about the right Response Strategy here . Are we really comfortable with this idea of isolation . As a broader strategy, i dont think that is the best response. Thank you. About i have heard some members ask, and likewise with the response in the question about tabletop exercises, say a business is sharing information, using a framework told or a Risk Management tool and they are dealing with an adversary that outstrips their abilities to keep pace. We know that there are partnerships with dhs and other agencies. When would the nsa step in . What is the policy there . Argue that theld most likely scenario is probably u. S. Cyber command. One of our three missions is when directed by the president or secretary to provide capability to the critical u. S. Infrastructure. , our missiono that will be to attempt to interdict the activity before it gets to that u. S. Company. That is our primary strategy. That is what dod brings to this. , ifbset of our strategy is we should fail in that regard, we have also developed defensive response capabilities that we ,an deploy to partner with dhs the fbi and the private sector. It goes to toms question. How do you mediate and mitigate . If you fail, how do you remediate . That is really the u. S. Cyber command side. Is what the president requests the secretary of defense to do. There is a policy debate, a legal debate. It is why in my an initial comments i talked about this as a National Security issue. Viewed as a National Security issue, the capabilities of dod and their application are in keeping with our broad policy and legal structure as a nation. If we view this as a private sector issue, then traditionally, do you really want dod involving themselves in this . Is why i think looking at this from a National Security perspective is important. There will be a discussion about the refocus on critical sectors. Is it any private entity . We have defined approximately 16 segments as being Critical Infrastructure whose loss would have significant National Security impact. What we are developing at u. S. Cyber command is to be prepared to apply capability in those 16 segments after erected by the president or secretary. Thank you. , according toober the department of Homeland Security you may know the chamber has embarked on a outreach campaign. Over the last few months, they have been going around the country. As you can imagine, very different audiences. A lot of us in washington are wellversed in the cyber framework. In phoenix or chicago, some of them hadnt heard of it. We are spreading the word on that. The question is, that is great, that is a campaign. What else do we need to do . You look at the als ice bucket challenge and how quickly that went viral. Jumpstarte do to people paying attention to Cyber Security . Issues, what is the Tipping Point . What does it take when it gets so bad that we finally say, ok, enough . We have to get the legislation, put those partnerships in place. The status quo is not working for us. For whatever reason, it doesnt appear that we have reached that point across society. In no small part, because many of our citizens, it hasnt reached a true pain threshold. So someone steals your account information, steals your credit card data, charges on that card. Right now, if you report this to your bank, we are not paying a price. The corporate sector is assuming liability. They are covering it. The point i think about is, once this becomes something that impacts a broad swath of our citizens in a real manner that impacts their daily life and ability to do what they want when they want, then watch for a whole shift in the way we are talking about this. My frustration is, it shouldnt take a disaster to tell us that you can see this coming. Knows that this is a significant National Security issue that is not going away. It will likely only get worse. We can either deal with this now in a collaborative, professional hit ae can wait until we across the forehead. I dont like to get hit. I find that to be a painful experience. I would much rather we have a dialogue and from the dialogue to the concrete sets of how to make this real and how we can work between the private sector, government, and a broad swath of government one of the comments i made is, right now we are asking the private sector to withstand the efforts of nationstates against them. That is asking a lot of the private sector. I think you have seen this reflected in what we are trying to do as a government. This is about partnerships. We have to be able to provide government capability and capacity to support the private sector. We need the private sector to provide capacity and capability to make this work. It is not either or. For those that argue it is a , i thinkector function the reality is it is between viewpoints. We have to work this collaboratively. There is no single technology, no Single Source of intelligence or insight that will clearly tell us exactly what we are seeing. It takes partnership to make this work. You have information i need and i have information that could be of value to you. You have not just one of the toughest jobs, you have two of the toughest jobs. Cyber commander at head of the nsa. What do you think your biggest challenge is . Where do you go from here with the Cyber Command . How can the chamber be helpful to you . My biggest challenge is creating a culture and building the framework for the future. On friday, United States Cyber Command celebrates its fourth anniversary. We are four years old as an organization. In the scheme of things, for years is not a long time. There are organizations that have a much longer history than we do. My challenge is, create that workforce, build the operational concepts and command and control as to how to deploy it, and exercise it with our partners inside and outside the department, as to how to make this work. What you need from us, what we need from you, how to share it, what format. Isnt, i givethis you everything we have. I dont want that from you and i dont think you want that from us. We can bury each other with data. Putting on my intel hat, data is interesting but what i care about is insight and knowledge. I use data as a tool to get there. A is not the and all endall. We have a question here. Wait for the mic to get to you please. The Industry Leaders association. I will stand, sorry. I cant see because of the light. My question is, you talked about the importance of cyber information sharing. We are going to hear later about sharing legislation. One of the big criticisms by some is that these bills allow you to get the information and they would like that how do you get around that . Lets have a very clear definition of what you are providing us. I dont want privacy information. It creates challenges for me. It slows me down. For this mission set, not a good thing for us. Is ai like to have discussion about, what is the information we want to share with each other . What is the value that information generates . Trustdea that you cant fill in the blank, that is a recipe for disaster for us. Among the things we need to address is, the controls and the oversight mechanisms. What is the role of Civil Liberties and privacy . What is the role of inspector generals . Aboute lots of mechanisms oversight and control of information. We need to make that a part of this. Im not interested in anybody writing a blank check for u. S. Cyber command or the nsa. I bet the fbi and dhs would tell you the same thing. Remember, dhs is the leader here. They are theargon, supportive commander and we are supporting them. We work through the department of Homeland Security. We partner with others in the federal government in addition to dhs. Energy, wery, partner with others. U. S. Cyber command, we are not the leader. The National Security agency, we are not the leader. We partner with others. We have time for one last question. Can you wait for the mic to get to you . Politico pro Cyber Security. There have been reports about employees of the nsa working there have been some reports recently about employees of the nsa working parttime in the private sector, former employees going on to the private sector. How is that affecting morale within the nsa . Is there concern about that relationship with the private sector . First, we have a formal set of processes that must be applied when individuals do something in addition to their nsa duties. We review that and when circumstances change, we will say, that is not acceptable anymore. The circumstances have changed. The relationship is different. We do that on a recurring basis. For some, it is as simple as someone with a language background saying, i want to use my language on a contracting basis to increase my skills. Sometimes we will say yes. Sometimes we wont. In terms of the flow of partnerships and information back and fourth, i have been very public about saying for the nsa, i would like us to create a model where members of our workforce dont spend 30 or 35 years working directly for us. It is amazing, the employees that i will talk to. When i say, how long have you been with nsa, 35 years, 38 years. I just said goodbye to an employee after 50 years. Technology,ate of we have got to create a world where people from nsa can leave us for a while and go work in the private sector. I would also like a world where the private sector can spend a little time with us. One of the challenges that we are dealing with, and you have seen this play out, we have talked past each other a lot. We dont understand each other. The nsa culture and experience isnt optimized to understand concerns from our i. T. And corporate partners. Likewise, many of the individuals we work with in the corporate world dont have an understanding of us. I think we should change that. I think it will produce Better Outcomes for both of us. Thank you very much. Thank you for your time. Thank you for all that you do. The u. S. Chamber of commerce looks forward to working with you and your team. We hope you will come back. I thank you for taking time from very busy personal and professional lives to be part of a dialogue it wont be just today, next week, next month being part of a dialogue about what we ought to do to address a foundational challenge for us as a nation and for our friends and partners all over the world. Cyber does not recognize geographic boundaries. The idea that we are going to deal with this in america, i dont think that is a winning strategy. We can learn great insight internally, but also from our partners overseas as well. It all starts with our willingness to have a dialogue with each other and a willingness to be open. Of,starting from a position you are in the private sector, you are all about money, i dont know that i can trust you. Or the private sector saying, you work for the government, i dont know that we can trust you. That is not going to get us where we need to be as a nation. That is not going to provide the protection that our society, the private sector, government, us as private individuals, that is not going to generate the outcomes we need. This will take all of us. It starts with an open relationship and a willingness to be transparent with each other. I thank you very much. Have a great day. [applause] thank you for your warm introduction and for inviting me to your annual Cyber Security summit. We benefit greatly from your leadership, especially in promoting the chamber of commerces role in National Security. In establishing an annual gathering focused on Cyber Security challenges, the chamber of commerce demonstrates commitment to keeping our nascent secure and lowering barriers for businesses to compete fairly in our global economy. The fact that this is your third annual summit is a testament to the growing magnitude of these threats and your commitment to making Cyber Security central to your business plans. This is an important issue. One that i know the chamber has emphasized as part of its national Cyber Security awareness campaign. In the campaign roundtable events, the chamber has stressed the importance of cyber Risk Management and reporting Cyber Incidents to Law Enforcement. I couldnt agree with these recommendations more. Todays of event, it is our opportunity to discuss how to best protect ourselves and our nation. Cyber security threats affect us all. They affect our privacy, our safety, and our economic vitality. They present collective risks and disrupting them is our collective responsibility. The attackers we face range in sophistication. When it comes to nation states and terrorists, it is not fair to let the private sector face these threats alone. The government ought to help. We need to do more. At the National Security division, we focus on tackling Cyber Threats to National Security. In other words, those posed by terrorists and nationstates. Later,talk a little bit, about how we have restructured our divisions to focus on bringing all tools to bear against these threats. Likewise, Chamber Members have an Important Role to play. You are living through these consequences with alarming frequency. Of fortune 500 companies have been hacked. Price water cooper house released a report finding that the number of detected Cyber Attacks in 2014 increased 48 over 2013. As fbi director james komi has noted, there are two types of companies in america, those who have been hacked and those who dont know they have been hacked. We are on notice. I would venture to say that everyone in this room has in their professional or private life been affected by a Cyber Security breach. At best, a minor inconvenience, a reissued credit card. At worst, devastation to your companys reputation, loss of Companies Trust and injury to your bottom line. Steps, itking proper is a question of when, not if, a major breach will occur. With that, we will come to questions about whether you did enough to protect your company, your customers and your information. Ahead to theght of day when you will have to face your customers, your employees, your board and your shareholders . When you have to notify them that someone has infiltrated your company and stolen your most valuable information . If that day was today, could you tell them that you have done everything in your power to protect your companys future . How do you warn them of the risks . Would you be able to say that you have minimized the damage . Do you have a plan . It is a pretty daunting scenario. It is knows a prize that surveys of general councils around the country identified Cyber Security as the number one issue on their mind today. Surveys also show that over one order of fortune 500 companies a quarter of fortune 500 companies dont have a response to cyber intrusions. This is Risky Business and we know that we will never achieve impenetrable defenses. But you can take steps to mitigate the risk, protect yourselves and your companies, and the Cyber Security of the United States. We have identified four essential components of cyber Risk Management. First, equip and educate yourself. Make sure you have a comprehensive and comprehensible cyber Incident Response plan and review it. I have spoken with many ceos and general councils who say they have not reviewed or cannot decipher their companys plan. We must do better. Uite risk cs management decisions and you cant manage Corporate Risk if you dont understand it. Make sure your plan addresses who, what and when. Who is involved and who needs to be notified in the event of a major breach . What will be exposed . When will you notify clients, Law Enforcement and the public . Second, know that your business contacts create risk. Malicious actors can exploit outside vendors. No matter how resilient you think your defenses may be, you need to worry about those that you do business with. Consider guidelines to govern thirdparty access to your network and ensure that your contracts require vendors to adopt appropriate Cyber Security practices. Third, protect your bottom line. Companies are increasingly considering Cyber Insurance and you should consider how this may fit into your Risk Management strategy. Cyber insurance may offer financial protection and incentivize companies. Finally, do not go it alone. Some of our attackers are linked to military budgets and resources. When they are, it is not a fair fight to take on alone. We must Work Together. Working with us can be one more component of your Risk Management strategy. As more breaches are publicly acknowledged, the public will ask how quickly and effectively you responded. As leaders, you will have to answer to board members, shareholders, and the public. You will want to say you did everything you could to mitigate your financial loss, your bottom line and your financial reputation depending on it. We can help. We can provide information to protect your networks and we may be able to take action to disrupt and deter attackers. You are on the front lines of these battles. We are with you. We are committed to working with you to protect your networks, identify perpetrators, disrupt their efforts, and hold them accountable. Among our top priorities. At the National Security division, we appointed new Senior Leadership to strengthen our capacity to protect our National Assets from Cyber Attacks and economic espionage. Thereated and trained National Security cyber Specialist Networks to focus on combating Cyber Threats to National Security. These are specially trained prosecutors in every u. S. Attorneys office across the country. Evidence andw the facts where they lead. From a lone hacker working in obscurity to an organized Crime Syndicate in russia, even a uniformed member of the chinese andtary, indictments prosecutions are a public and we proveway to which our allegations. As attorney general holder said in may, enough is enough. We are aware of no nation that publicly states that theft of information for commercial gain is acceptable. That is because it is not. Nevertheless, in the shadows of their flags, some may encourage and support corporate theft for the profit of state owned enterprises. We continue to denounce those actions. We wont stop until the crimes stop. A core part of the government response must be disruption and deterrence. In order to raise the cost to the people who commit these thats and deter others from the actions. The criminal Justice System is just one tool. In addition to prosecution, we are working with key government partners to explore how to apply designations, sanctions, trade pressure and other options to confront new cyber challenges. These changes will help us fulfill our collective responsibility and help us work with you. We rely on cooperation from the ofvate sector to bring many these cases, from identifying the malware, to pinpointing the locations of servers, to assisting victims in removing the Malicious Software from their computers. One example, last springs , aedown of game over zeus big success for our colleagues in the criminal division. This takedown would not have been possible without close cooperation. Thehe fbi put it, it was largest fusion of Law Enforcement and industry partner cooperation ever undertaken in support of an fbi cyber operation. It crossed international boundaries. It affected hundreds of thousands of users. We recognize that one of the best ways to protect the nation is to support you in your efforts. That is why in 2013, federal agents informed over 3000 companies that their Computer Systems were hacked. They are working to provide Additional Information about the who and how of the attacks. Every day, the fbi works with Companies Targeted by malicious. Ctivity we are not limited to how ping used solely in the aftermath of intrusion. Nor do we see our role as only a collector of information. We also share Sensitive Information with you so you can defend against attacks in real time. In the past year alone, the fbi presented over three dozen classified sectorspecific briefings to Companies Like yours. The information that we share with you may enhance your ability to detect future intrusions. Your engagement with Law Enforcement can help us connect the dots between your breach and a broader threat. We may be able to help identify what was stolen from you, locate the perpetrator, and in certain cases, disrupt planned attacks or mitigate the effects of past intrusions. Given the importance of this cooperation, the department of justice is committed to lowering the barriers of shared information through expensive oneonone meetings with inhouse legal teams. We learned what you perceive to be as legal hurdles to cooperation and we are working to address them. Lawsarified that certain and antitrust statutes are not impediments to sharing information with the government. We understand that trust on both sides is it essential to voluntary reporting. Trade secrets, details of networks, and personally identifiable information bottom line, we can help you manage your risk and you can help keep our nation safe. The 9 11 commission concluded recently in its 10year anniversary report that we are at september 10 levels in terms of cyber preparedness. They warned that history may be repeating itself in the cyber realm. We must band together to keep that from happening. We want to arm ourselves for the threats of today but also prepare ourselves for that which we can see coming. If you just think about the tools that cyber criminals use, the Intrusion Software affecting millions of computers, when used by criminal actors, these tools are generally used for financial gain. It doesnt take much imagination to imagine that these tools can be used to disrupt or destroy. Terrorists have stated they want to exploit Cyber Security vulnerability to harm our way of life. Al qaeda has announced intent to conduct Cyber Attacks against civilians. The department of Homeland Security recently confirmed it is investigating Cyber Security flaws in medical devices and hospital equipment that could be exploited to injure or kill a patient. The threats are real. We know that terrorists have the intent to acquire these capabilities. If they succeed in acquiring them, they wont hesitate to deploy them. It is a race against time and one with highstakes consequences. Gaps thato looking at may exist in authorities. Many of our laws were not written with cyberspace in mind. They dont necessarily contemplate extraterritorial crimes. They dont facilitate multijurisdictional investigations. They dont empower us to bring authorities to bear swiftly and effectively. We are committed to working with the relevant lawmakers who support modernizing these laws. New legislation in several areas including information sharing is needed. Byant to conclude my remarks discussing the changing perceptions of being hacked. Among consumers and industry, there is a growing understanding that companies are going to get breached. That doesnt mean we turn the other way. There is a downside to taking an ostrich approach. Consumers expect companies will adopt industry standards for security. When these intrusions happen, consumers expect companies to respond promptly, acknowledge the intrusion publicly, and cooperate with Law Enforcement to communicate to mitigate the damage. The chamber of commerce is positioned to drive corporate change, to ensure that companies and partners treat Cyber Breaches as more than a technical problem, to recognize that Security Operations are not insulated from business operations, and discuss with your boards, employees and industries, the importance of Cyber Security Risk Management. As we face evermore threats in the threats arent letting up and neither should we. Thank you very much for inviting me. I look forward to taking questions. Questions for mr. Carl and . My name is mike sark. I have a radio show that concentrates on climate change. Ngos that a lot of dont trust the government. And they see the government partnering with the private sector, you nervous. With the private sector, they get nervous. I dont know that he or anyone else in the federal government investigated. I am not sure about the repercussions. Ngos really thick in the Community Working against climate change. When we consider the full weight of the government and private ,ector standing on our backs what i would like to know is, have you considered how the federal government might reassure all americans that it is working to protect everyone and not protecting members of the chamber of commerce from things like this happening . Let me say, absolutely, we are dedicated to defending all americans, private consumers, private companies or nonprofit organizations. Thatve seen too often nonprofit organizations are targeted for cyber it attacks by nationstate ever terrys adversaries or criminal groups. I encourage those who have suffered a breach to work with Law Enforcement as the victim of a crime as they would in any other circumstance. Work andbe happy to are working on cases like that all across the country. Other questions on todays topic . Politico pro Cyber Security. You have spoken in the past around the indictments of the , the approachals to the problems in those remarks, it was promised, this is not the end. What are the types of circumstances that will lead to more aggressive movements by the u. S. Government against nationstate hacking . What is the threshold for us to see more of the tools in the toolbox being deployed . , when itk for too long came to nationstate actors, there was a lot of good work being done on the intelligence side to figure out who they were and what was going on. But for too long on the criminal side, they werent working day in and day out to sea whether or not it involved an actor that we could bring appropriate criminal charges. Network we started the and had prosecutors trained all throughout the country on both how to handle the bits and bytes and complexities of electronic evidence, and how to deal with sensitive sources and methods, the expertise that prosecutors can bring to bear in National Security cases. People are looking at the cases in that manner and the fbi is sharing intelligence with those prosecutors, a case will be brought. We proved that was the case by bringing the case against the five members of the Peoples Liberation army earlier this spring. Cases, see additional because the crime continues of stealing economic information. At the same time, we need to ,ork with our partners developing sanctions from the department of treasury, entity , bringing suits to make sure that we leave no tools in the toolbox. We bring everything to bear. Those who of the day, would steal information from hardworking american businesses and customers decide it is not worth the risk of getting caught. American express, thank you for coming today. My question is, could you shed your perspective on the impact of the latest botnet takedowns that have taken place in partnership with Law Enforcement as well as the private Sector Community to affect that . I will refer once again to game over zeus. That is an example of a takedown where several things were happening at once. You needed action inside the United States to disrupt the command and control servers and keep them from sending commands to the botnet. You needed the cooperation of foreign partners because many of the servers were in foreign countries, so that they would simultaneously take action. Could, you extent we need to find attribution of the bad actors responsible and work to bring them to justice. That collaborative action that took place with the u. S. Government, foreign governments, and the help of the private sector, was able to disable and remediate the hundreds of thousands of computers that had the infected malware. That is the type of action that cannot take place without the help of the private sector. The private sector was essential in terms of the speed with which we were able to remediate the damage. That is what bob anderson referred to when he referred to the new normal. Thank you for coming. Jerry irvine. Excuse me. Can you go over some of the damages you have with obtaining digital evidence . [clears throat] im sorry. In the metropolitan area, there are very few organizations with the exception of local fbi that have the ability to even gather the information, much less to maintain it and keep it secure. What are some of the challenges you are having, having that information around the country . It is definitely a challenge. That towe have proven those that think they can hide behind the keyboard, they cant. There are cases where we can have attribution. Thenow the person involved, name, what they look like and who they are. That is a difficult case in part because of the difficulties of gathering electronic evidence. That is true domestically, let alone outside the reach of our borders, which requires close cooperation with our foreign partners. I think we have come a long way in that regard. We need to go further. We need to continue to work on developing those relationships with our foreign partners to make sure they have parallel statutes on their books to allow us to lawfully acquire electronic evidence. Thank you very much, john, for coming here today. We appreciate the good work of you and your team. Thank you. I look forward to working closely with the chamber of commerce and your members on this joint threat. Thank you. [applause] ok, can everyone hear me ok . Chamberscome to the third annual Cyber Security summit. Thank you both for joining us. We are going to introduce you both and talk about the bill itself and go from there and perhaps take some questions from the audience. Let me introduce our speakers. So glad to have you here. California senior senator Dianne Feinstein has built a reputation as an independent voice working with democrats and republicans to find some Common Sense Solutions to the problems facing california and the nation. Since her election in 1982, senator feinstein has worked to build a significant record of legislative accomplishments which includes helping strafing strengthen security here and abroad, combating violence and protecting Natural Resources in california and across the country. Assumedfeinstein chairmanship of the Senate Select committee on intelligence where she oversees 16 intelligence agencies. She was the first female senator to hold that position. It is also my pleasure to introduce the honorable Saxby Chambliss. In 2008, Saxby Chambliss was elected to serve a second term in the United States senate. Magazine calls him a highly visible, wellrespected presence in washington and says he has a reputation as an affable but straight talking lawmaker. They also named senator Chambliss Georgian of the year. His leadership on National Security and Intelligence Matters during his tenure earned him an appointment to the Senate Select committee on intelligence where he has served as vice chairman since 2011. He is a strong advocate for improved information sharing and intelligence gathering abilities. That is a topic we are going to get into here. Thank you both for joining us. I was just sharing with senator feinstein our propaganda, if you will. We are big fans of the cyber information sharing act. Why did you put this legislation forward . What does it do . I will begin. First of all, thank you. It is my understanding that the chamber is prepared to support this legislation. That is very important. If i can speak for the vice chairman and myself, for our whole committee. On a personal level, the gentleman on my left, what a great pleasure it is to work with you. We put out a number of intelligence authorization bills. Ladies and gentlemen, one of the things i have learned in public life, in a twoparty system, to get something done, compromise is not a bad word. If we sit down and i try to share something that i know with senator chambliss, either i have to give or he has to give, or we find a mutual road to go down. Found that to be a very productive way of producing for the people of this country. Had mr. Er when we mendez before our Intelligence Committee and he gave us a classified briefing on what was happening in the United States with respect to Cyber Attacks. Then, the director of the fbi said, there is one thing common about this. 90 either know they have been attacked the other 10 may not, but they have been attacked. Almost every big American Company today has been attacked. The question is, how serious and by whom and how much . It is fair to estimate that the cost to the economy and business isnt estimated is estimated in the trillions of dollars. It is very serious. We started on this with a different bill. We put that built together, it went to the floor, and it got 56 votes. We needed 60 votes. It only got one republican vote. Do aey was to go back and bipartisan bill. That is essentially what the vice chairman and i have done. We put together a bipartisan bill. It was put out by the committee by a vote of 123. It awaits action on the floor of the senate. There are a couple groups that dont like this or dont like that. We have been prepared, and look forward to receiving their comments. Grannis is here today, our staff director. And jack from the Minority Side as well. Wante open, but we do not to produce something that cannot get a vote. Entire have done is an voluntary system. It essentially moves to let company do three things. The monitor networks, to identify cyber indicators, to use countermeasures to protect against Cyber Threats, and third, to share and receive information with each other and with federal, state and local governments. Companies who use the authorities to monitor and share information are provided full Liability Protection for doing withinong as they do so the bills parameters. Those parameters are pretty clearly spelled out. The bill has a number of protections to make sure personal information is protected and make sure the government doesnt use information for any purpose other than Cyber Security. Finally, the bill requires the director of National Intelligence to put in place a process of sharing information on Cyber Threats in the governments hands with the private sector. So we believe we have a good bill. We are thankful for the support that your organization has provided. We understand the Financial Services networks support it, but let me say one thing, we will not have a bill i have tried to get this bill on the floor and so far have not had success until communities like yourself take a good look at it, agree with it, come forward and say, do it and do it now. States are too big to let this languish anymore. Thank you very much for having us here today. Thanks to the chamber on two accounts. Number one, what i have found around the country and around the world, and around my state, i talk about Cyber Security. Ago, six or eight months if i was at a rotary club and said this is the most important thing to deal with, everybodys eyes would glaze over. You cant see what is happening out there. You cant really feel it. Except now people are starting to understand that this is serious, that it has huge not just consequences to the United States but to me personally. What you are doing today is helping educate people about this. I am very thankful for that. Secondly, i ran into a former dni last thursday. We had a Cyber Security conference in georgia. Former director Mike Mcconnell was there and we were talking about the bill. He said, where does the steamer the chamber stand . I said the chamber is fully behind this. He said, your chances just improved significantly. Thanks for your willingness to let us have a chance to dialogue with you on this. I want to echo what diane said. You will think this is a mutual admiration and it is. She and i have had a great working relationship. Democrats andat republicans can kick their political hats at the door now and then and do what is best for the country. And i have done that on a number of issues. I am so glad to have her in the foxhole when we are fighting these battles, whether in the airwaves are on the ground. She has been a great leader and a great friend in the process. Summit aCyber Security couple years ago. There were competing factions that didnt allow that will to generate more than 56 votes. After that, i did we were involved in the process, but actually we were fighting each other on the bill, but we both knew the importance of the issue. When that bill went down, she and i sat down together and said, this is foolish. We know how important the issue is. We have to come up with a bill that is bipartisan, that we can get the majority of our committee to agree on. It is not easy. In these times, on capitol hill, seeing bipartisanship is somewhat of an anomaly. I did make the right kind of compromises on positions without compromising our principles to come together on this bill. It received a 123 vote coming out of the committee. You dont see many 123 votes coming out of any committee on the senate side these days. That was going into the election. , number one, were to make sure we had a bill that was going to provide john and our other Law Enforcement and Government Agencies the tools they need to make sure they are able to detect intrusions into any system, public or private, and make sure they have the ability to share that in a public to private standpoint as well as a private to a private standpoint. If we dont do that, we are not accomplishing anything. We want to do that in a voluntary system. If we mandate to the private sector, you will do this this way, there is always going to be pushed back. With the level of trust that exists today between the Public Sector and private sector, we knew that our chances of success longterm were not going to be very good. What we did was go to your companys, go to the private sector, and say, we want your ideas. We want you to help us start on the ground floor. Lets build this building called a Cyber Security bill. We did that and we have been able to incorporate good ideas from the Public Sector, the i think wetor, and have accomplished what we set out to do. Secondly, it is imperative that we incorporate strong privacy measures in this bill. We cant allow someones personal information to be shared on a wholesale basis. We agreed on that and we think we have, with good language up with good language to ensure that does not happen. It is important that we put language in this bill that allows flexibility. This is not a shortterm project. This is longterm. With the Way Technology changes in the world of cyber on virtually an hourly basis, we want to make sure that 10 years from now, that there is flexibility in the legislative language that allows the public and private sectors to make necessary changes to adjust to what Technology Comes forward in the intervening time frame. Again, another key aspect of this is to ensure that there is Liability Protection given to the private sector. We think we have done that in the right way. We think the private sector, those folks who were involved in it, as well as i hope all of you will read the bill. You will be like the folks in the private sector and you will have some comfort in knowing that in the corporate boardroom, people are going to say, wow, if we share this information with our competitor, we are going to have protection and be able to do this and do this in a way without the fear of liability from outside sources. I am pleased about this bill. Has a lot dianne more influence on senator reid then i do but i have implored one piecef there is of legislation that needs to be completed between now and the end of the year, this is it. If we dont do it this year, i fear it will be at least another year before it rises back to the level it is now. Aree wait another year, we really risking the economy of the United States. I am very hopeful that when we get back here in a couple weeks, that senator reid is going to agree with us. Anne and i are joined at the hip on this. We are going to be together. Amendmenty has an that makes the bill better, we are ok. It is a bill that tries to send a political message of some sort. I do hope that we get the bill on the floor. The senate work in the way the senate historically has worked. Thank you. Thank you, senator. Protections, i will tell you that the Cyber Commander is very big on information sharing as well. He said the same thing you did. He doesnt want personal identifiable information. Think that information sharing we talked earlier, this is something we have been talking about for a decade. What are our chances with this bill . Do you think we have a chance . I do think we have a chance. I think it depends on people in this room and rooms like it throughout america. I look back three years and both saxby and i sat down in the chamber then when you had some concerns about the bill, and it was really useful. I think i went to 3 or four big meetings and generally came to understand what those concerns were. I think those have been remedied in this bill. This bill is in the sun, the moon and the stars. It isnt a regulatory guideline how to. Its a voluntary bill. It allows the voluntary sharing of information with each other or the government, with immunity, from lawsuits essentially. And i think thats critical. Its a first step bill. Its the first thing we need to do. Now, heres my worry. Saxby, if we dont get this bill passed now with you retiring, i think youre right, we go back, well have all the arguments weve already had and disposed of but with a new cast of characters, and companies are going to continue to get hit. So you and i, because of what we see, share a big sense of a laxative that we need to get this thing done. We really need others to stand up and say yes, we are in support with this. We oppose the last bill, we are for this bill. Lets get to it. Lets pass it. One other thing that gives us the potential to get this build on, the white house came out with their executive order virtually a year ago. I was frankly very apprehensive when they said theyre going to issue an executive order because i did no one is going to say, even though i have talked with both of us about it in advance but, frankly, the lay of the land that was put forward in that executive order is very positive in concert with what we have done in our bill. And some standards are being sent by nist. There are some other things that are being done there that i think lays the groundwork for some of, to solving some of the objections that were in the liebermancollins bill. And we focus on information sharing which is the guts of it. If you dont have information sharing its not going to work, but i think the white house needs to be commended for laying out the executive order the way they have. And ive commended nist publicly and i will continue to do so about the job theyre doing. We at the chamber certainly agree with you. We have Michael Daniel, the white house cyber coordinate this morning when he first came out with executive order he was here at the chamber a couple of times which is unheard of to shop around an executive order like that. I think the extent they went to get to that, not buyin but Situational Awareness from the private sector on the executive order was very helpful. I will tie you that the nist cyber friend to something the chamber fully supports. Were doing, socializing with small communes has country so we agree with you that the cybercrime and executive order was a step in the right direction. I think, ann, if i may, i think if we can get this up on the floor i believe we can pass it. You cant pass a bill that is a bipartisan, and this one is anything we can. And both saxby and i were closely with admiral rogers, the house chair, the vice chairman. And mike has said we are ready to go. If you get a bill, we will sit down, get it conference and well get it done right away. So you really dont wait, want to wait until the legislative bodies change on this. Because then you got to go back to your dot and start all over again. That means in inordinate delay. I would hope we can get people to stand up, saxby and ann, and come forward and say youve got to do this and do it now. We are happy to make the bill language available. I think it is already. And are staffs are here. Theyre happy to sit down with you, or we can as well, but we really need the help to get it passed. And i will just say both of your us kids have been staffs have been terrific to work with. Lets take a few questions from the floor. We are having a very hard time seeing you out there with these bright lights. So please wait for a microphone to come to you. Tried to get to Chamber Members first, if you make. Cory bennett with a hill but to discuss a lot of the ways that high, over. I could get the bill passed in the lameduck session. What pressures on the things that might be a someone blog and might prevent from getting passed in this upcoming session. Let me be candid. There were essentially two categories of people who have concerns. One trial lawyers. We think weve worked that out, and that there arent problems are now, cross my fingers. The other is the privacy community, which is a big, broad nerdy. And i think we made another six changes that weve agreed to, but, you know, its always more more more. Now, we i think if the bill comes to the floor and, obviously, we have a set time and a number of amendments, we are willing to take amendments and do them on the floor. So that shouldnt stop it. But those are really the two groups that we have concerns about. And i think one of them will be settled, and with respect to the privacy community, you know, what ive heard is we want the old bill. Well, the old bill, not exactly got exactly one republican vote on the floor. Thats not a good message if you want to passed something. So you have to find a way to Work Together to get it done, and we believe we have done that. That wasnt my vote. This one will get my vote. [laughter] other questions, comments . Over here. This morning coordinator Michael Daniel start but how hes working very closely with you on legislation but where is the white house stand on the bill today . Do you think they are supported enough . Well, i can quickly state as the chairman. What we have done is kept the white house advised. The staff has done this. They sat down. They have worked with the white house, and i think, in less theres something thats new that i dont know about, theres been a relatively close working relationship. This is, its not been a onesided conversation. Ive had direct conversation with the president , even rode with him in a golf cart one day and we talked about in the golf cart as we were trying to focus on our game. We were more importantly focus on cybersecurity that day. But we face any number of conversations with the white house on it, and im not about to speak for them, but we have taken their original concerns into consideration and we know that the president has got to sign whatever bill comes out. And we are going to continue to dialogue. Is it a perfect bill . I mean, all of us know, particularly those of you have been around the senate for a long time, nothing is ever perfect. And thats the way you get those and the way you get things done is to craft something that while it can always be improved, and as dianne said, this is the first step. Who knows where were going to be a year from now, but if we do nothing, shame on us. And i know the white house feels strongly about that aspect of it. And for those of you that may not be so in the we just we are, we are talking of 2588, cybersecurity information sharing act of 2014. A little summary that we put together, this represents a workable compromise among any stakeholders. It also safeguard privacy as you discussed. Protect Civil Liberties because there is the role of civilian intelligence agencies and desensitizes sharing with a narrow Liability Protection. It would also help businesses achieve timely and actionable Situational Awareness, information sharing and realtime. So i just want to point out you have this in your folder. Weve got 16 16 organizations along with u. S. Chamber of commerce now in support of this bill so very supportive. We have a question over here, matthew spent matthew with each other. Senators, i wanted to thank you for your work on the bill and the work of your Staff Members have done a very big a job in terms of working with us on aspects of the bill. One thing that might not be wellknown is the bill does mandate that this is sharing information with government have to remove personal information they have to remove pii. The bill says you must remove pii. We didnt originally agree with. Primarily because we thought that small and midsize businesses that are not as sophisticated in terms of doing the removal might say instead of sharing the im going to sit this one out. We recognized that is a big issue and that one element of the bill that we find the messenger to compromise our ground. You might be interested to know we have been meeting with many offices in the senate to try to educate them about the bill. It is our number one cyber legislative priority. So i wanted to just think and say yes, ev do have a chance and women opportunity to pass the bill on the floor, please urge senator reid, put it on the floor. Anyway, thank you. One thing we did to address early on privacy concerns is with regard to the definition of cyber indicator threats. And we narrowed the definition of it, and the focus is on really that serious issues of Cyber Threats. Its not able to be expanded from a privacy standpoint into noncyber issues, which i understand from a privacy standpoint. So that was another big compromise that we came together on. Dianne with me again. Thats the way things get done. I empathize with the rational and the reasoning behind it. Thats why we were able to make the changes that we are able to make on both sides. Thank you for your input. When the chamber has input, you speak for a myriad of sectors of the economy as well as individual businesses, and thats critically important to us. Thank you very much. He gave you a little inside information. Didnt have to do that. Any last questions, comments . One back there. To what extent is the debate of surveillance in the lameduck going to put into the ability to pass this bill. You know, ive heard both that it is necessary to this bill would also be a death knell for this bill because they dont want them to get inextricably linked. How do you plan to navigate that in the lameduck . Well, ill kick that off. Youre talking about the fisa reform bill and how does it relate to the potential for discussion and debate on this bill. The thing about fisa reform is that we dont need between now and then the end of the year. Weve got a bill. That bill expires the middle of next year. We do know whos going to control congress, but this has been a vigorous debate as to the changes that need to be made in fisa, and i think theres a lot of accord on that. But thats not something that urgently needs to be done between now and the end of end of the year, simply because we have laws on the books today that deal with that issue. Cyber we dont. And there should not be any connection between the two, and i certainly hope thats not the debate we get into, or not the position that we get into when we get back into session. Let me say this. Youve hit on something, because ive heard this in roundabout ways, that fisa reform has to come first. And if i understand the current status, the house has passed a bill which was are difficult for the house to pass a bill. We have passed a bill on certain fisa reforms that went out of our committee i think 114. The president has a distinct view on this, and that is that he supports the house passed bill, and senator leahy, the chairman of the judiciary committee, is putting together a fisa bill that would essentially echo the house bill with a few changes in it. One having to do with the public advocate amicus, and also with a couple of other things. Here is the big problem, and the problem is how do we get something done there ask the vice chairman has said quite correctly, well, this doesnt we need to come up until next year, but thats a long time to wait. My concern is that we do need to do something there. I dont think its necessary to put the fisa bill first. Our bill is ready to go. It could pass the senate. I think at the very least they would show that we can pass something. We can get it conferenced. We can get it back before the senate for a final vote and we can get to the president. So we can do this with not a great deal of debate, probably with a joint rule between the two sides that there be a couple of hours for debate and a limited number of amendments, and then get it passed and then conferenced it. So we could get something done. And i very much hope that that will happen. We hope so, too. We have time for one more question if theres anyone else out there. Theres one here in the middle. My name is jason from senator mark kirks office. I wanted to ask senator chambliss, who will hold the banner for information sharing the next congress for republicans . Who has that Institutional Knowledge of working with the chamber but also [inaudible] the most the most senior person in line to me is senator burr. Im sure he will be the next republican to either be chairman or vice chairman. Behind him is senator risch, and we have senator coats and rubio, senator collins but we are losing senator coburn so theres a lot of republican experience that will be coming back, and im confident that whoever it is is going to work diligently with dianne to move something. But as we both alluded to earlier, weve got lots of new members on the Intel Committee in the coming back and trying, coming in, and trying to educate those folks about the issue itself, plus there are a lot of members that simply look to dianne, to me, and other senior members of the committee to basically have some security, and from the standpoint of knowing a complex issue, having worked on a complex issue, theyre willing to go with us. Weve got a lot of folks are going to be coming in that are not going to be in that position. So thats why i think, and, obviously, dianne agrees with me, that its going to be a long time if we dont get it done by the end of this year. Hope that answers your question. I think thats one of the things that we want to work with you on, that educating of new members, and what happy to continue to do that. I want to thank you both for coming here today. Thank you for all the work youve done on this bill. Its a terrific bill. Again weve enjoyed working with you and your staff, both of you. Take you very much. The chamber will continue to push for this bill. Good, thanks. [applause] [captions Copyright National cable satellite corp. 2014] [captioning performed by the national captioning institute, which is responsible for its caption content and accuracy. Visit ncicap. Org] more now from the Cyber Security conference. Cyber securitye coordinator Michael Daniel. This is 20 minutes. Good morning, everyone. A pleasure to be here for the third annual Cyber Security summit. For those who have been forced to hear me talk to four, ive tried to throw in a few new things in my speech so it will not be totally boring. Thank you for that very kind introduction. I do want to talk little bit today about why Cyber Security is such a hard problem. About why, as howard said, we are still talking about some aspects of it 20 years on. How we are trying to think about that inside the u. S. Government to design our policies shift, adapt, address some of those key problems. When you take a step back and think about it from a purely technical standpoint, it is not obvious why it is a really tough problem. In through aing vulnerability that we know about and we know how to fix. That means the enemy is penetrating her networks through a hole we are quite well aware of them even have a patch to go over yet he dont do it. It. So whats the deal . Why is this such a hard problem . And from my point of view, i think the issue is that cybersecurity is not really just a technical problem. Its far more than that because of what cyberspace has become to us. In fact, cybersecurity is, it does have technical aspects to it, very strong technical aspects to it, but its more than that. Its also an economics problem and a business problem, a human psychology and behavior problem, a political problem, and its a physics problem all rolled into one. And so when you combine all of those factors together, thats why cybersecurity is such a hard problem and so difficult for us to solve and so difficult for us to tackle. And i want to draw out a few of what those hard problems are and then talk about what were doing to address them. And the first hard problem ill talk about is really the business and economics aspect of cybersecurity. I dont think we really actually understand the economics of cybersecurity very well. And i come to that conclusion because of what i just said. We have solutions that we know are out there, the Technical Solutions that exist, but yet we cant get people to actually implement them. Weve been talking about cyber hygiene, information sharing, Identity Management literally for decades now. And, sure, the adversaries tactics evolve in cyberspace, and the impact of Malicious Behavior is growing as we hook more and more things up to the internet. But the same fundamental weaknesses continue. So, and its not like we dont even actually collectively understand these facts at this point. Yes, we need to do more on education and outreach and talk to more and more larger and larger portions of our society. But, certainly, the numerous news reports on Cyber Breaches from target to home depot and other companies have really helped to raise awareness. Have not confronted how companies actually work on the internet. How they need to behave. In terms of Human Behavior and motivation, until he actually confront them as a business problem, an economics problem, a psychology problem as well as a technical problem, we will continue to flail at the issue. This is the vast expanse and impact of cyberspace, the fact that it touches everyone and soon will touch everything. It is changing how people think about it. When the internet was first built, Critical Infrastructure was not connected to it and did not rely on it. No one really cared about privacy protocol because people did not live their lives online. Users did not worry about the underlying security of the code only that it worked. Governments did not understand the internet, did not use it much, did not see why they should care about it. No one particularly cared they set it up to be governed that a function outside of government ace structures and did not incorporate strong security. Everyone cares about these things, at least to some degree. Ree. Governments wake up to the fact they need to care what happens on the internet and how it works for all sorts of reasons both good and bad. Companies are waking up to this fact and citizens are waking up to this fact. So as a result, what rused to be able to be decided on purely technological basis by Technology Experts or by informal agreements among Service Providers and Major Companies in the space is now the focus of a highly political process and that means the decisions that once were easy in terms of internet governance and management of security are now much harder and given how important the internet and cyberspace has become to everyone and everything, that isnt likely to change anytime soon and we need to take that into account as we build our policies. Then lastly the third hard problem that i would identify for you stems from the struck turf cyberspace itself. And as we think about how we worked to build our cyber defenses and how we counter the threats inside cyberspace the physics and math of cyberspace play a very large role. Now traditionally somebody like me would stand up here and talk to you about how cyberspace is borderless. How there are no, there are no boundaries and how information flows freely across the entire globe and thats true. And it is both a strength because it allows for, thats what drives commerce and drives the much of the value that comes from the internet. And it is also a problem because it allows malicious actors great freedom of movement but i think this argument is not entirely correct. There are borders and boundaries everywhere in cyberspace. Everywhere that networks and routers and servers and peering points touch, there are borders. And we are creating more and more borders as we build the internet of things much. So i would submit to you, that what cyberspace lacks is not borders and boundaries. What it lacks is an interior. There is no inside to a network when you think about it. Everyone lives and operates right at the border and touches an edge or goarder border some way. That reality in cyberspace has profound implications how we organize ourselves as a society to protect ourselves in cyberspace. In the physical world we assigned the mission of Border Security to the federal government. But if everyone lives right at the bored in cyberspace then it is not possible to assign Border Security to just one group or element of our society. As a result, it means that protecting cyberspace by its very fundamental nature is a mission that has to be shared by all. And that reality makes organizing for cybersecurity incredibly complex because it requires us to do cooperation across boundaries that we have in the physical world made by design difficult to bridge. Both within Government Agencies and among Government Agencies. Also between the government around the private sector and within the private sector. So if these are the problems, economics, psychology politics, physics, what are we doing to actually address them . At one level we have to address the technical issues that mentioned. Cybersecurity requires Strong Technical Foundation and know how. One of the things we have been trying to do is something howard mentioned in his opening remarks which is the National Initiative for cyber education. Weve been trying to take that to the next level. We have, over the last couple of months we have linked up the nice, this is washington everything has to have acronym. The nice program with the president s jobs training initiative. That is looking to begin how to drive to fill the gaps in our technical workforce. Not just our technical workforce. The workforce across the board, all different kinds of aspects of cybersecurity professionals we need so we can actually generate the kinds of staff that we need to do the Cybersecurity Mission that not only the government has but the private sector has as well so that you generate the knowledge on the technical side but also Financial Systems, law, Business Management and the like. So, universities are beginning to react by developing the blended degree programs, by getting Computer Science department tosco elaborate with the Business School to produce graduates with applied skills to solve cyberbased problems and manage risks in the Business World but thats not enough. The Cyber Workforce is projected to grow larger. Were stuck in a posture where were stealing workers from one another. What were trying to do is begin to address the problem by supporting scholarship programs, but supporting an effort to draw up a heat map where the cybersecurity jobs are and to partner with business and others to develop more Cybersecurity Centers of excellence across the country at various universities to really increase the workforce we have available to us. We are also working to move to address the business, economics and psychology issues of cybersecurity. And that is really where the framework, one of the core documents that has been talked about, that ann talked about and others will talk about today comes in because the framework really is industrys document. The core thing about the framework is it is built from how industry has to think about and operate in the real world and address cybersecurity as part of their business. The National Institutes of standards and Technology Led the effort but it was really one they convened and really coalesced the best ideas out of industry about how to approach cybersecurity, not just as a technical program, but as a business and economics problem. The great strength of the framework in my view is the fact that it is not in fact a cookbook. If you open it up and read it to run your firewall, you will be sadly disappoint 9 because that is not what the framework is. The framework is how you think about cybersecurity as an issue. It is deeply rooted in how businesses actually have to manage risk. In taking a Risk Management approach, the framework recognizes that no organization can or will spend unlimited amounts of money on cybersecurity. Instead it enable as business to make decisions how to prioritize and optimize cybersecurity in light of the risks that they face. It also provides a common lexicon, a common vocabulary to talk about cybersecurity. It provides a Common Foundation for communication between businesses, between businesses and their suppliers and between the business and the government. So to that end it really provides a new way for us to tale talk about cybersecurity and communicate it and deal with it in a new way and i think that is where the framework will go. I have often said that the other great strength of the framework and its Great Success will when businesses and others figure out ways to use the framework that we never even dreamed of when we built it and to me thats where were driving towards today. Of course there are other ways that were trying to address some of these problems. The political problems and the physics problems. Were trying to address them through informationsharing efforts. Many of us in the room that have dealt with these issues for a long time are almost sick of talking about informationsharing. I see some familiar faces out there but it is still one we must clearly address because we really have to move more information both among companies and between companies and the government and from the Government Back to the private sector. Weve started to see some real traction in the formulation of efforts like the sticks and taxi models coming out of dhs and providing a Technical Foundation for informationsharing but we have to continue to do more and that is where the administration is very much focused on. Earlier this year the department of justice and the federal trade commission issued guidance indicating that antitrust law should not be a barrier to cybersecurity informationsharing between companies this is big step that helps narrow the scope of work we have to do to crack this problem but there is still more we need to do and were continuing to look at what the options are within the administration to support informationsharing and we continue to support the passage of cybersecurity informationsharing legislation in congress and i hope that you will have a chance to hear that from senators feinstein and chambliss later today, that were working very closely with them to try to get that kind of legislation over the finish line. Another area that were working on to address some these psychology and business and economics aspects of this is really in the Consumer Financial protection space. With over 100 million americans falling victim to data breaches over the last year, and millions suffering from credit card and fraud identity crimes, we knew we needed to take some steps to make stronger, more secure technologies available to secure transactions and safeguard sensitive data. Two weeks ago the president sign ad new executive order, directing the government to lead by example in securing transactions and sensitive data. The new buy secure initiative will provide consumers with more tools to secure their financial future and assisting victims of Identity Theft and accelerating the transition to Stronger Security technologies in the development of next generation Payment Security tools. While there is no Silver Bullet to guaranty this Data Security the executive order implements enhanced security measures including securing credit, debit, other payment cards with microchips in lieu of simple magnetic strips and pins available on standard consumer atm cards and the president is calling on all stakeholders to join the administration and number of major corporations in driving the economy towards more secure standards to safeguard consumers finances and reduce the chances of becoming victims of Identity Theft. We also announced the white house summit on cybersecurity and Consumer Protection which will happen later this year to promote partnerships and innovation. The summit will bring together major stakeholders on Consumer Financial protection issues to discuss how all members of the Financial System can Work Together to further protect American Consumers and their financial data, now and in the future. Another big area weve been working on is something howard mentioned as well which is the National Strategy for trusted identities in cyberspace. In a nutshell this is administrations effort to kill the password dead as primary security method. If were serious about improving the cybersecurity we simply have to kill off the password. Its a terrible form of security yet weve been unable to move past it for over 30 years. So, again this comes back to obviously there are plenty of Technical Solutions out there to do this but what hasnt been able to be cracked is the issues not the technical ones, the liability issues, the networking issues and other things. So the goal that we set up with this to tackle those parts of problem and really fund private efforts to get over those nontechnical humps to enable the technology to proliferate more across the ecosystem and im excited to report that very soon we will have many of those, the pilots are starting to come to fruition and i think we will start to see the over the next six months to a year some of those technologies start to roll out across much of the market and become much more widely available. I see it as a great example of the way we can make cyberspace inherently more secure working through strong Public Private partnerships, projects that the industry and government have piloted under nstic and now were in position to build on momentum and west accelerate progress on identity and Access Management within the federal government. Final i would be remiss if i didnt mention the federal governments own house. Obviously over the last six months we dealt with all shorts of issues to heartbleed, shell shock, to intrusions across vary with us departments and agencies. So one of the things were very focused on within my office is improving the cybersecurity across all the different parts of the federal enterprise. Were working very hard to promote that the concept that cybersecurity is not in a corporation, cybersecurity is not just an extra cost center but is core and fundamental being able to execute a federal agencys mission and that in fact cybersecurity is a mission enabler, not just for the department of defense and the department of Homeland Security but for the department of the interior, for the department of housing and urban development, for health and Human Services and every kind of agency you can imagine inside of the government. Cybersecurity is now core to all of the missions of all the agencies across the federal got in order for them to be able to do their mission. So as i mentioned at the top, cybersecurity is an inherently hard problem. For at least the reasons i cited and probably more. But, as a community we have indeed made progress, particularly over last few years and started efforts i think can alter the cyber landscape is fundamental ways. We started to do things like the framework and nstic. Started cybersecurity as business problem and underlying psychological and Human Behavior issues present in cybersecurity. Were starting to realize we have to build partnerships to address political issues of cybersecurity and to Work Together to address the physics and math that make cybersecurity so hard. So despite often within the National Security staff being considered one of the four horsemen of apocalypse i have am at root an optimist. I do believe we can tackle these problems and make cyberspace safer for all of us. Of course in cybersecurity there is no such thing as done, right . There is only better. So we still need to continue focusing on making progress. That is what im looking forward to doing over next year and working with all of you to make cyberspace more inherently secure. Thank you very much. [applause] i think ann indicated i do have time to take a few questions, so im happy to do. Stunned everyone into complete silence. I guess youre off the hook, michael. Thank you very much. [applause] with midterm elections just one week away, we have more and make coverage coming up on cspan. Next, new jersey incumbent senator cory booker faces republican jeff bell. Carolina, tim scott running against Joyce Dickerson and joe bossie. That is in one hour. Later, the georgia governors debate. President on of former jimmy carter up against the incumbent. Longtime Washington Post executive editor ben bradley died last week. Of thesaw the coverage watergate story during the nixon administration. His funeral will be held tomorrow at the Washington National cathedral and we have live coverage starting at 11 00 a. M. Eastern starting on cspan. Here are just a few of the comments weve recently received from our viewers. I appreciate the airing of all of the debates. Its given me insight into the diverse views of the other representatives, candidates to the u. S. House in houses and other districts. I really enjoy seeing the different viewpoints. Its a great thing to be able to watch them. I watched the debate on cspan 2. Hear awhat i want to politician said, the things hed said. I wish you would put that on regular cspan at about 6 00 p. M. Please put the program on every night until election day so we can hear the truth about things. The nick rahaled. Ebate from West Virginia i am so tired of his campaign. I am so sick of these politicians who cannot tell the truth. Continue to let us know about the programs youre watching. Call us. Email us. Or you can send us a tweet cspan comments. Join the conversation. Like us on facebook. Follow us on twitter. Cory new jersey, incumbent booker against jeff bell. Cory booker won a special replace last year to frank lautenberg. Mr. Bell is an author, former political consultant, and speechwriter. The debate was held in trenton and this is courtesy of wpvi tv. This is vote 2014. The new jersey senatorial debate. Todays debate is brought to you by 6 abc philadelphia. Wabctv new york. And the league of women voters of new jersey. And now from our 6 abc trenton studio in alphabetical order, the candidates are republican jeffrey bell of leonia, and democrat cory booker of newark. Friedman with the starledger. Mariela saigado for telenoticias 41. And Jonathan Tamari for the philadelphia inquirer. Moderating the debate are wabctvs anchor saying saying nd jim gardner of 6 abc. Hello and thank you for joining us for this debate between the two candidates running for the u. S. Senate in new jersey. They have gathered here for what we hope will be a wide ranging and informative discussion of the major issues in the campaign. And a quick note about the format. Each candidate will have one minute to answer the question posed to them by jim, myself, and our three panelists. The candidates have also agreed to one round in which they will ask each other one question. At the end of the debate, each candidate will have one minute to make a closing statement. And so lets begin by random drawing. Our first question goes to mr. Bell. Mr. Bell, only five people have been diagnosed with the ebola virus in the United States. And each one has a direct connection, an obvious connection, a first generational connection with the source of contagion. Are we making too much of this . Are we overreacting to ebola and by that i mean the government, the media, the medical community, and subsequently americans . Or is this an ominous Public Health issue and if so, what would be the First Priority of the federal government . In my opinion the government has underreacted and underestimated the ease with which this spreads and gets around to a given country. We should have cut off on a temporary basis all flights from the three west african countries involved. And i think president obama has once again failed and helped an institution, namely the c. D. C. , to fail by political appointments and complacency. We absolutely have to have a temporary travel ban, screening people in the airports isnt enough because very often the symptoms are delayed. I dont think just saying that the experts think that it wont help is enough. I think we have to earn the side of caution and aggressive containment of this disease. Mr. Booker. First of all i want to thank the sponsors of this event and the moderators and my opponent as well as the viewers at home. This is a clear difference for new jersey voters in the choices you have in this election. Between someone already whos obviously about a tea party attacking, attacking, attacking and hardening of positions as opposed to somebody in the state of a crisis that really reaches out and finds ways to Work Together. Look, im the senator right now, and the biggest call to my office is from new jerseyians worried and concerned about this issue. And so as a result of that, what ive done first and foremost is make sure that after tea party and others look to cut organizations like the c. D. C. , that they had their funding. And join with my colleagues on both sides of the aisle to get them 88 million more. On top of that i say we have to hold the people accountable. And ive been talking directly to heads of c. D. C. , health and Human Services, even going out to Newark Airport to make sure all the policies and procedures are there. Christi g with the administration to make sure our hospitals prepared and i will be held accountable for keeping us safe. The next question goes to mr. Booker. Mr. Booker, the shooting at the Canadian Parliament complex in ottawa certainly heightened fierce about a homegrown lone wolf terror attack. Its believed the gunman was sympathetic to isis and given that new york and new jersey are really considered the leading targets for terrorist attacks, how would you make sure that there are adequate resources given to the state to combat terrorism . First and foremost, the number one time, the only time in the situation room in the white house was to work on the challenge of homegrown terrorism. And we need to make sure that our agencies that are in charge of protecting us have the resources necessary to do the job and were being very aggressive about that. Thats why ive supported investing especially in new york and new jersey which have been targets in the past making sure that our local Law Enforcement officials and our state officials have the resources they need and the kind of coordination to stop these attacks. But i want to tell you, i have a worry. I worry right now that while in states like new jersey, we have good laws in place to try to keep guns out of the hands of crem analysis we still live in a nation where someone whos on a terrorist nofly list, that we worry about committing terrorist attacks can go down to virginia where my opponent has lived for the last 30 years and go to a gun show and just buy a weapon without background checks. We need to tighten up common sense gun regulations to keep weapons, guns, out of the hands of criminals and terrorists. We should change these laws as soon as possible. Mr. Bell, your response. Im astounded that anyone would turn this situation in canada into a sermon on gun control. This is a worldwide problem. It is not just a matter of an individual criminal or terrorist. President obama is very reluctant to call things like this acts of terrorism. And that is part of the problem. We have to be honest about what the nature of the problem and the extent of it. And we have to take greater measures to prevent this from happening, to screen more people as theyre coming into the country. But more important, its a worldwide war. And to say that it isnt a war as president obama insists on doing, whether its the domestic war or what is happening with islamic state, is is just unconscionable. We have to be truthful about the nature of the problem and much more active both overseas and here. Its better to do it overseas before it gets here. And a quick follow for you, mr. Booker. Do you support putting american troops on the ground to fight isis, and if so, would it be for a limited time period or would this be open ended . First of all, isis is a real threat and theyve been cutting swaths through the middle east and putting in danger ethnic minorities, beheading citizens, doing harscompsh horrendous things to women. And they must be stopped. But at the end of the day i disagree with the president that he should have come to Congress Actually to have an open debate about our commitments to this crisis. Im a big believer that they must be stopped. But before we rush off to war, lets make sure because weve learned the hard lessons in the past, lets make sure we have an open debate and clear objectives. We have contingency plans because weve seen what happens and how things can go wrong in the past. And lets make sure that we have all the resources we need to do the job and that our allies are footing some of the bill and bearing some of the burden. America cant just rush off into this. We need to have an open discussion and debate about what the strategy and tactics are. And make sure were doing this in coordination with our allies and make sure we have a real plan to stop this isis threat. Mr. Bell, your response. Again, im astounded that you would say that the priorities to get the allies to spend money on this. There are no allies who can take the leadership. America has the only 21st century military in the west. And to say that we have to wait for allies to spend money, we have to have a debate in congress concerning that a declaration of war exists. That is what we need to do. We have to have a debate about the strategic objective. Not the ways and means, not the type of bombing, not whether troops are ever deployed. Some of them already are. But thats irrelevant to the issue of what is our strategic objective. Franklin Delano Roosevelt was a great war president because he knew the situation we were in world war ii the only policy toward the nazis and the japanese empire was unconditional surrender. Our debate should be we have to destroy isis. We have to annihilate them before they annihilate us. Which they have consistently threatened to do in beheading our captives. Our next question comes from mariela saigado and it goes to mr. Bell. Mr. Bell, more than 30,000 accompanied minors have traveled into the United States illegally from central america. They claim theyre escaping from poverty and from violence. And they are in new jersey and they are in the state and more than 1,500 to be exact are living right now in new jersey. Would you support any sort of plan that integrates them in our society, in our schools, since their families have been here already or any plan that would give them temporary or special status for this these families and these children . We have to be compassionate, mariela, toward those who have been sent across the border by parents who are desperate. Either unaccompanied they came or accompanied by coyotes. But i think it also illustrates the failure of the Obama Administration on the issue of immigration in general. When the dream act failed to pass, president obama went out and gave an amnesty to young people who would come here with their parents, not of their own accord. And it seemed like an unacceptable thing to do in some ways but here two years later we have a National Embarrassment and humiliation with this system and this nonsystem we have causing this flight from the south. Toward our borders. We have to do everything to change the immigration system, to replace the mess we have now with a Legal Immigration system that includes both a path to citizenship, for those here illegally, and also a Guest Worker Program for those who want to work here temporarily. President obama pays lip service to this. But he did nothing when he had the majority of votes for immigration in his first two years in office. So the state of new jersey shouldnt wait any more and grant them some special status to these families . Is that what youre saying, mr. Bell . I believe we need to help them. Whether you need to legislate a special status or not, im agnostic about that. But certainly we cant act as if they are criminals. Mr. Booker. Thank you very much. I support the comprehensive bipartisan Immigration Reform that we have seen going on and actually passed through the senate. And it involved people from both sides working together that would have helped so many children in new jersey. I support the dreamers act that again has some bipartisan support that can give those kids who no other country but the United States who have learned from our schools the ability to stay here and contribute to our great economy and our great country. Whats really remarkable to me is that my tea partybacked friend already, in this little small debate, just a handful of questions, has shown the kind of attack, slam and slander he is. He says he believes in tea party mill tancy. Has already mentioned the president and attacked im counting now seven times already. Thats not going to bring us together in washington and move us forward. We need people that dont believe in tea party militancy but come together with people on both sides of the aisle and solve difficult problems like immigration. Theres a comprehensive movement going bipartisan, not like my opponent who wants to retrench and actually wrote a book called the case for polarized politics. We dont need more whats making washington bad. We need people who will bring folks together and move our country forward. I would like to answer that because apparently the senator is unaware that i have worked for 10 years for bipartisan comprehensive Immigration Reform. Even working for a latino civil rights organization, la raza. Raza, president , jana magia called president obama the deporter in chief and he is a complete phony in saying that he wants Immigration Reform and senator booker, not a word of criticism to had complete abdication and failure on his part. I have a track record on working for a bipartisan immigration bill. I even i was filmed in the office of senator ted kennedy in 2007 working on that. Its really silly to say that i am a phony on that. Mr. Booker. Sir, i had the privilege of meeting ted kennedy and no two further apart politicians than ted kennedy and my opponent. And i have a simple belief. Someone tells you who they are believe them. If they look like a duck and quack like a duck, then believe theyre a duck. This is a guy who is supported by the tea party. This is a man who actually wrote a book called the case for polarized politics. If we send him down to washington, hes not going to be involved in bipartisan coalitions. He himself has told us, i believe in tea party militancy. That means digging in, dont compromise, the kind of shut down government problems that weve had. Americas had enough of that. Its time for people to come together and work on solutions to our problems. I thought the whole point of working with people who are different idea logically is to bring them together on things they can agree on. But i guess senator booker has a different definition of bipartisanship. And gentlemen, were going to have to move on. The next question comes from Matt Friedman and goes to mr. Booker. Matt. Senator, this is a good segue into this because with the congressional inaction on immigration, president obama had planned to issue major executive order to overhaul the system, as much as he could by the end of the summer. But amid pleas from democrats, who are locked in tough races this year, they feared voter backlash and president obama delayed action until after the midterm elections. Do you agree with president obamas decision to delay action on that executive order . Absolutely not. The president was wrong. The president should have stood up and made the call to do whatever he could to advance whats right for america. You know, ive spent the last years travel all around my state while my opponent was working in a think tank in washington for the last 30 years. And when i talk to people both business folks as well as people in the community, they understand that we have a problem. Whether its people who come to our schools and graduate from our universities, as soon as their student visa is up we are kicking them out when they want to contribute to our economy or young kids being denied access to citizenship even though they spent pretty much their entire lives here. We have an urgent immigration issue. There should be no waiting for politics. I didnt support the president s decision. And i will continue to go to washington to work to bring people together to make sure that we in a unified way solve this problem. Senator, no one is going to come together if the president threatens unilateral executive action. Its just not going to happen. You Pay Lip Service to bipartisanship, but youve just advocated something that would completely foul the immigration debate. Having the president do everything by executive action which hes not constitutionally entitled to do which would drive republicans and everyone else in congress away from the table. You talk a good game on bipartisanship but that answer shows that you really dont mean it. May i respond to that, please . This is a Typical Tea Party cry. Attack obama, attack obama, attack obama and call him king obama for all the executive orders hes done. If you look at the numbers, president obama is doing less executive orders than other president s from jimmy carter to Ronald Reagan to even george bush. Again, this is exemplary of what he does. Hes part of a movement that is going to be slamming and slandering and not stopping that madness and finding ways to bring people together to Work Together to find solutions. Weve had enough of that in washington. His book tells you that. The title of it is the case for polarized politics. We dont need more gridlock in washington. We need to Work Together and solve our problems. Polarization is sometimes a Public Service because it enables voters to see the difference between two points of view. Thats the sense in which i think polarization is sometimes good. Lets go on to Jonathan Tamari for mr. Bell. Governor christie said hes tired of hearing about the minimum wage and later said the focus should be on creating better and higher paying jobs. Democrats have been saying they want to give a raise to 3. 3 Million People who earn the minimum wage or less. The federal minimum wage has been 7. 25 an hour since 2009. Should it be increased . Its a bad time to do that because the openings are so limited. The young people here, particularly high school graduates, will be priced out of that market. Just the other day, i read about mcdonalds which is having a significant decline in profitability because of the prospective minimum wage increase will go to technology to replace low wage workers. Thats counterproductive in a very, very difficult job market. Mr. Booker. My opponent says a bad time to do whats right. Ive talked to people in our state and ive heard from them. Heard from a guy who lost his job, had a good minimum wage job, lost lost his job and now is working you had a good job and now lost the job working for a minimum wage job trying to support his family. Its a good time for him to raise the minimum wage now. Talk to people at county college who are trying to go to school, work a fulltime job and making the minimum wage and they can barely afford to make ends meet because they work a fulltime job and are still under the poverty line. Its a good time to do it for that person. And what about that single mom whos working double shifts because in new jersey, when you work a fulltime job, at the minimum wage, it in no way is enough to meet the minimum basic needs of her family. It is a good time to raise the minimum wage. We are america. Nobody should work fulltime and find themselves under the poverty line, having to go to food banks and rely on public assistance just to make ends meet. It is a good time to do the right thing. In fact, it always is. That is typical of why we have a jobless recovery. The minimum wage, even if you like it, is redistribution. It takes money from one sector and gives it to another. It has nothing whatsoever to do with fixing the economy and creating new jobs. Lets look at some statistics as long as were talking about jobs. The jobless rate in new jersey is 6. 5 . Which is. 6 higher than the national average. But newarks jobless rate is 11. 3 , camdens is 14. 3 . And i think most