Transcripts For CSPAN2 NSA Director Rogers Says Russia Poses Threat To Congressional Elections 20170509

Take your phone calls it 00 p. M. Eastern cspan. Admiral rogers and head of u. S. Cybercommand testified at a Senate Hearing about threats to u. S. Computer systems highlighted uh government packing by russia and china as well as non state actors bombproof this is two hours 15 minutes. [inaudible conversations] the Committee Meets today for cybercommand please welcome back admiral rogers commander of cybercommand director National Security agency and several other titles. We are grateful for your many years of distinguished service with your parents today threats continue to grow in scope and severity but the nation remains unprepared to address these threats is a defining feature of the 21st century. As a result the committee is focused on cybersecurity concern of a lack of security we were hopeful without any serious effort from Alaska Administration the new litmus ration would have on within 90 days of the inauguration. Ninety days have come and gone but all policy provided while the executive branchs disheartening this committee has not stood selfhood but has adopted more than 50 provisions to enable the department to defend against threats in cyberspace. Cyberis an issue to require an integrated approach we simply do not have that now. The very fact that each agency of government believes it is responsible for defending the homeland we have with those themes that the adversaries would use against us most notably divided kingdom has recognized that approach but of the National Cybersecurity center that would help to address the deficiencies here in United States those that should be evaluated to address those deficiencies the coast guard has an interesting mix of authorities to be just as applicable in cyberspace as territorial waters. With the United States to seamlessly transition to the military authorities. It could be a powerful tool to impede the existing organizational structure with the handoffs to the entity for for their response of the mediation or lawenforcement action progress for the efforts of department of defense by vendor stands cybercommand is on track to reach full capability for the training in the fall of 2018. But unless we see dramatic changes of the future budgets i am concerned they will respond to Malicious Behavior and in short. Services began to prioritize or deliver the cyberWeapons Systems to be headed down the path. And those to replace those individuals at the conclusion of there first assignments on the Cyber Mission force. We have already heard about puzzling issues specifically out of the 127 cyberofficers completing the first two were none with back to the cyberrelated job that is unacceptable to suggest a lack of focus. With a steady pipeline talent those of we have trained already is essential for the cyberMission Force admiral rogers to a to to help us better understand to take a closer look at the existing models of those services are sufficient or if we should consider a different model we plan to have another hearing with outside experts of the cyberservice. And this is before the committee. Thank you very much let me join you to have welcome admiral rogers. But a with the testimony until the importance of cyberthat we face. Something to for your service and dedication. With his espionage and theft of intellectual property to support the military and economy so now to experience firsthand of that manipulation and distortion to threat in the bedrock of our democracy and with those cyberattacks now the scope of what we are defending against and it even takes on greater urgency. In just one years time Intelligence Community has warned that the Russian Election interference will be a normal. Well designated as Critical Infrastructure with that of louis operation to continuously conduct. , those to deter such actions as secretary Carter Commission and to serve on the task force to testify twice this year. They advocate the operations through cyberspace what key leaders on the other side value the most that could include their own Financial Wellbeing to be turned the cyberattacks. With that across the department of defense across the local government involving dod the Intelligence Community we have not seen evidence yet delaware appreciate those problems and intend to address them. Cybercommand specifically with the Cyberspace Operations with expelling intruders out to penetrate the networks of adversaries. That this mess is that element conducted through cyberspace. Sa and then we urge you on these managed of these matters. Welcome back. So the opportunity to talk about the hardworking men and women of cybercommand to describe how that conducts efforts of the domain to support the Nations Defense against sophisticated adversaries. That the nation needed a military command to focus on cyberspace with the support elements given the responsibility of the Department Systems and networks and also relies on cybercommand to build forces and be prepared to employ them with critical ever structure to require support the pace of conflict has intensified the last few years not one day has gone by the boc one yvette occurring somewhere in the world. Consequences for military and a nation at large those sectors that are operating with sophistication and speed and precision as they continue to expand their capabilities to a dancer interest through cyberspace to undermine the United States National Interest to those of the allies. It is the unfolding according to a cell logic continuing to better understand we use this to enhance the department of Situational Awareness of management of risk. To update on those initiatives the frame lines of operation to support the joint force commander objectives to return those two critical of a structure. Full spectrum Cyberspace Operations to ensure the allies denied the same to any adversary. The Information Networks includes Weapons Systems and platforms to complete a bill out of the cyberMission Forces to be fully operational by the end of fiscal year 18 and to hold targets that risk. That is critical to the National Security interest with the unified combat and command status with the u. S. Of cybercommand director of the National Security agency to oppose partnership with the nsa in benefit Cyberspace Operations with that may evolve as it has efficiency in the future. The National Defense authorization act is a separate provision for splitting bad arrangement this is another provision that i support to Cyber Command will in gauge over other matters with the responsibilities and authorities over the coming years including cybermanpower to build capacity to streamline the acquisition process that our critical enablers to have the dynamically changing Global Environment along with the office of secretary of defense to work with you and your staff to iron out those details the are motivated to accomplish the assigned emissions missions. To secure the system now works counter adversaries objectives through cyberspace. The command operation to create a cybereffects on the battlefield their cost of the emerging to meet the requirement as they look a those operational approach is overtime. This combined with agile policies faster Decision Making process broader concept of operation and smarter command and control structures the men and women thank you for your support as they overcome those challenges to allowing to accomplish the mission to endorse those efforts on their behalf. If investment of resources is paying off to help keep americans safer but in other domains as well i will afford to continuing a dialogue and in the months to come. I look forward to answering your questions. So oh to affect the outcome of the election in france idiocies any slack of the chinese efforts to commit cyberattacks or affect elections . No i do not. To have any reduction of russian behavior . No i do not. The committee was told me it cybercapabilities of those cable adversaries will far exceed to defend key infrastructure do you agree with that assessment . Diane agreed in general has why those deterrents are so important. But we would have to have a policy followed by a strategy. Qsr. We dont have that the new team is working on that. The check is in the mail. [laughter] we have the fbi and Law Enforcement to permit does plan security to defend those Computer Networks and the department of defense to develop and employee is the status quo sustainable . It is my question is is it the most effective . My recommendation is the challenges with very specialized and distinct responsibilities is the ability to respond in a focused way it is the key to success and that is the challenge. Do we need a cybercore . In my experience to be successful at cyberyou not only need to understand those technical aspects but the broader urd aspect of which they occur. Some where there is a manner woman sitting at a keyboard directing operations if we went with a unique approach we would generate a force that was positioned but not understanding of that deeper context that is a stronger way to go about doing this. Not a single one stayed with cyber . A you getting the cooperation that you need for your command . I talked to the Service Chiefs personally. One that i am particularly highlighting and i have suggested is that Cyber Mission force that i am responsible for i knowledge there is only one part. Was that received by the airforce . They are clearly working their way through this. I personally have at chief of staff i sat him down the line have the right picture rexene said you have an accurate sense were not where we need to be. So my job is to help them to keep the pressure on him to sustain this. Is in your job you have to look at scenarios. Give us the best and the worst abuse for the cyberattacks on the United States. The worst worstcase scenario has a couple of dimensions about right destructive activity focusing on aspects of Critical Infrastructure including space. But in addition the other thing that concerns me is do we see data manipulation . So what happens if we change the data . That is of very different challenge and third what happens when non state actors that that enables the into go with the status quo . The best is we develop a policy followed by a strategy. One. As you have pointed out in terms of the technical aspects of cybercybercommand has been in the forefront with those of cognitive information that changes Public Opinion have you been tasked to conduct those operations . No we have not that is not part of the defined responsibilities per se. There are some things were doing right now for example, in the fight against isis with combat commanders but i cannot go into that right now but if information is delaware what bin file will be optimize ourselves . When i first guarded by journey given us a uniform with expertise and the soviet union collapsed we decided that would be required to do away with those institutions in need to step back and reassess the. So your expertise is rather limited. The skill set and the personnel. I am the first to unmet. It is not comparable. Not on the day to day basis around the world. So, has been given the lead on operations . Any problem is cybercommand . So redo work closely sold this this day mission that goes to grow what with other organizations so going back to the cold war doing the of radio towers nobody seems to be doing this aggressively. Certainly we aeronaut where we need to be so were you aware of the penetration of the election and 2016 in terms of active involvement . Qsr yes, sir. What actions did you take greg. Here i have to give this to the director of of nsa. And that they were engaged in the effort to inform the fbi to inform those organizations but in turn i make sure the dod and other elements have that awareness of cybercommand so ive become aware of efforts of u. S. Infrastructure. With the department of Homeland Security if for example, so if the secretary of defense to determine they could assert themselves and in this seven not have to do that with cybercommand. Sea would be prepared to disrupt these operations . And then to look back so we have to be much better prepared from 2018. I apologize. After looking at the experience of 2016 the attribution to a foreign state going after the keys systems to be seen. Thank you very much. Admiral rogers and enough be fair to evaluate the article they showed you this morning but are they finding of the new . How did they come up with the billions to come up with nuclear test does that make sense to you . I will not get into specifics but we have publicly its knowledge to see those koreans in a criminal mechanism of if you will. And then to come to that conclusion that maybe right. But one element to generate revenue when we see the growth from 1300 and raleigh have all visited with the policy or lack of policy to make a position there is too much authority at the top of it was quoted december of last year before the committee to say we want to be more agile than the reality is we have to push this authority down to a lower level in certain areas. Does that make sense . Qsr. And to assume the new responsibilities this is an important area in the cyberarena. We have then to begin israel to talk about uh director for this cybersubcommittee meeting the senator that was with me at that time of course chairs the subcommittee we had the meeting editing was pretty productive that they might be doing Something Better it is much more complex. But they also said the three things that was significant. If they had studied the system or other countries as well. Theres a reason to every time i am in televisa vice see him. In fact, we were just talking about some potential test cases to see how that plays out but i look to him and one of the things i have learned is there is no one Single Organization that has all the answers there is the power of the partnership to create a system to gain insider knowledge for a whole host of partners in sight outside the government the academic world is one big civil one example. So being in a position spending at the university of tulsa are we having access to the people that will become necessary with the very serious problem that we have is there an effort to promote of programs . There is. We have relationships right now with over 200 academic institutions although one thing i try to highlight is to be larry e. Of creating a cyberforce for everybody who has cookie cutters. Some people will be really good but they have spent much of their personal life and this we have to get the full spectrum of capability. Pcs countries that came in after the of parliamentary election the first time in 96 years there redoing things in addition with a level of warfare. He also started working the they have views those cybercapabilities more than 62005 vendor times over the last two months so this is something that is happening so if you see Something Like example in the ukraine it didnt take any need time im sure youre on top of everything that is happening thank you mr. Chairman and admiral for your service in response to senator reid you said you were aware of the russian attempts to interfere in our election. Are you aware or were you aware of Russian Communications with members of the Trump Campaign team . Now you are into my rule as an essay i am here with cybercommand i will not get into that. And the standard reluctance but i also see you not just as cybercommand as nsa director also. Also. Okay. The chairman asked this is what we see of this behavior a new normal to which he responded i think somewhat yes. How do we counter these type of cyberenable operations and who has that responsibility greg. In terms of russian executions . If you refer to the Intelligence Community assessment we identified many elements involved in the campaign with respect to what should redo the first is to publicly oust the behavior to have a Public Discourse for those that was engaged in the behavior second we have to make this much more difficult for them to succeed to pardon the systems or take a look at the election process and probably look at this end to end to ask what changes to me to make . Third 22 climatize ourselves to the idea and we were back into the time frame of the manipulation of media to be a more discerning reader and lastly we also need to make it very clear those nations states or groups it is unacceptable to me gauge of this behavior and there is a price to pay. At this point is sounds like listening to the previous answers that were in a position we cannot prevent a cyberattack on things like critical of for structure. But when we say prevent that is why deterrence becomes important we won the gold to convince the actors you dont want to do this this is not in your best interest. Ended different setting that is a care, will you share with us under the threat of the attack or the attack with that word deterrence greg. Khanate classify aids setting. That would be very helpful. Would you consider Critical Infrastructure of Voter Registration rules greg. I think one of the challenges the process we used to identify the current Critical Infrastructure areas of the private sector we tend to look at that industrial output associated with it one of the things need to think about now is not just output but data and information existing in those areas of a critical consequence. But in simplistic terms we need to if they show up to vote and that they are not registered voter in the data has been manipulated that is pretty serious that is Critical Infrastructure. Take a look at that definition. O will fall upon the chairmans statement with regard to the cyberofficers cyberofficers, is one of the reasons to be viewed as a career path . That theyre taking officers and to employ them in other areas. You have low wide spectrum of cyberrequirements it is why im trying to make that argument. What we need to do something along the order of one third how do we put them elsewhere within the broader Cyber Enterprise to build that level of expertise across the department . Settlement to sound like the air force is ripping people after they finish the time with us to make them airplane mechanic that is not what we hear seeing at all. News that the way to be a fourstar . You mean could you build a career . Clearly in the military we are in the military i am not above all last person that will do this side of think. With regard to the cyberservice. The cyberis less cybersurfing this but more a combination of active as well as significant reserve. Is any allies trying this correct. Nobody right now who has really gone to the Single Service most try to use the existing Service Structure that is what you do for your career that is what is being done by most nations around the world. Keep us posted. On page two of the written testimony you say they continue to maintain the Initiative Just short of for to challenge the ability to react and respond. So what constitutes an act of for in your opinion in terms of policy of the agency greg. Then model lawyer or a policy individual that involves legality. It is clear not just United States but broadly internationally we have not reached a broad consensus i you would define and clearer actionable terms with the cyberarena looks like. Have a redo that . To get the prophecy people together and to be involved in a broad discussions internally with the u. S. Government and foreign partners to form a consensus help us out for your not aware but a lawyer but one of the first people live and ask what sort of acting in your judgment would go beyond this threshold of four . Is that criteria intent with those tactics or techniques used could be set criteria . It implies People Better focused that is a general conversation we found ourselves in. I am trying to mentally work myself through with a more specific set with the attributes that would be defined as an act of war. Use delaware technical developments are outpacing policies we find that in the commerce area also. But do you have anything new that you dont have now . In broad terms you need to reassess that authority to have the right investment of manpower i am very honored the department is focused on this mission and the first to a knowledge cybercompetes with of broader range but the argument i am trying to make it is within those priorities i think cyberis pretty high we need to focus the investment and prioritize it but we cannot be willing to accept five per 10 years for Development Cycles trading people for whatever will not get us there. Tell us what you need. Yes, sir,. Mr. Chairman following that line of questioning when of uh issues raised is how the government responds to cyberattacks and escalates is there a coherent plan in place to allow the federal government to respond to major cyberattacks and escalate the response greg. I dont know enough to accurately respond some of that is outside of my purview. I am not trying to be a smart ass but not in a position to say that categorically yes or no. I was concerned prior earlier responses your strategy of deterrence because i dont see how deterrence will work with regard to russia to see a continuation to have his systems. What i am looking for you is leadership and coordination to be prepared. Title date you heard me say the strategy is deterrence i thought i communicated is deterrence should be part of a broader strategy and the first to mcnall is that. That transition with a private company and government response are they in place and if not what authorities do you need . Clear is that aspect but i am wondering if it is cultural. That they have penetrated your system here is where they are and a din some cases the responses i will work with you. But in some cases thanks very much we will never hear anything in some cases you saw this play out with some states response to the election. That is the testimony we have heard that if you hearings but to be highly concerned if you dont have the authority or some aspect of the federal government to say to the secretary of state be recognized the states rights for all lections huge use of the Technology Want to pursue as a states rights issue but if you dont have level of sophistication to be certified so i hope you can come to the committee with the list of authorities in place before the next election is not adequate that they think they are covered reassurances that they are by the most highly sophisticated experts in our government to be developed by the department of defense i dont dispute at at all. Befalls with the Homeland Department of security idol speak for them at all but secretary kelly should speak for himself. But i do it knowledge that clearly dod has a role. No doubt. With regard to the most recent election resaw the mills of the successful french candidates also rumor of campaigns launched on the internet and accusing of preparation of the president ial election. How could the United States leverage the cyber40 allies them partners negative should be have of role and how do we deal with those respites. This is more of nsa than cybercommand i will not get into specifics but talking to the of french counterparts to be publicly attributed to penetrate the infrastructure this is where we seek were doing similar things with the german counterparts with the upcoming election sequence more than cybercommand. Thank you mr. Chairman as you know there has been some debate the geographically based counterterrorism strategy were legal authorities depends considerably on where they take place it is similar lead dependent on zeros areas that active. Bid is an issue for us the point that i chide to make i tried to make take diocese for example, it isnt necessarily syria or iraq but to have an impact on that but we have that challenge. Yes maam. Are you bound by the limitations set forward with the president ial policy guidance . Yes maam i have to meet ppv 20. Looking at bat to with the interconnectedness of the nature of cyberspace what impact does that have on your operations . Can you meet the requirements of the Combatant Commanders . Not as fast as i would like for grovel not get into specifics but if this issue came to ahead we can work it out to an reword granted the authorities to execute earlier doing to extend beyond the physical and firemen to of syria and iraq and the first to rick knowledge it is a the fastest processing and the world. You have suggestions that congress should make . Before i go to congress i will have a dialogue with my immediate boss about what a framework with lookalike and then we will come to our own conclusions first. Bad is the policy from 2013 to be reviewed by the department . Department document it is a president ial document. Is the department reviewing it . We are broadly looking at cyberauthorities right now are provided employment to the secretary with the things they may want to look at. So based on your experience where do you think improvements should be made . Everything ive hearing from the current team they acknowledge the structure emplace are not fast enough which is a good step for me. So what do redo . If you except the promise what should we do . It is an ongoing topic of discussion now rather not get into this publicly although they are reaching out to have no complaints. This secretary will breen them at any conclusions for word complex. And dont want to speak for the secretary. In testimony before the house you mentioned an unresolved question about deity generated capacity in the cyberbeen outside the government. Knu elaborate . Specifically what type of capacity wouldbe beneficial in what gaps are you trying to fill . It goes to if we will defend Critical Infrastructure the point i try to make is i dont want to show up in the middle of a crisis and some of these sectors that is my experience from the military discovery learning while in contact is a painful way to learn that increases voss and takes more time and your not effective enough. The argument i try to make to build on the sector with Critical Infrastructure is sound can recreate these mechanisms with the private sector and operate 24 7 . Water be seeing . Du support those capabilities on the private sector . Been a Perfect World would her a greater structure they are putting telemetry on the networks couldnt you share that with us . Prefers recommendation with the private sector is already making those actions. We do that some what but i want to be more institutionalized in realtime. Mr. Chairman for the record we have been having these hearings now for four years and talk about the problem everybody is convinced it is a serious problem for quite appreciate the fact of how you could supply for the record the five things you think we should do talking about it is important but action. Have your smart people think about it. Legislation, regulation, rel ationships, communication, we would all find that helpful is an echo of the question from earlier. Second we have approached this with the government the approach i think it should be whole society because it is an odd situation where you have government for sherbrooke those vulnerable elements are in the private sector like financial systems, guest, pipeline, el ector, we had a situation 2011 cyberbill regulatory to the private sector but failed there was great resistance to regulatory approach. We dont have some to defend themselves against russian mobs or missile attacks from north korea. We do that what about a system where we work with the private sector to assist them financially to install those measures and in exchange they could get some compensation of liability and free stuff . But how redo that without them taking their foot off the gas greg. Generally that gets a better outcome than polarization penalizing but the question that you raised that the traditional enemy have a strong wall and cybershows much of what we are seeing is a National Security issue to have a whole approach of we handle the. This is the training government and the private sector but of all street goes down. I agree. And to support that amendment getting into the National Defence act last year said 180 days a report is due for nonmilitary options available to deter correspond to imminent threats but that date is coming just to remind you. This is a way to force that development of cyberpolicy the the president has 180 days to describe those actions that could warrant a military response. I know they have a lead they will respond formally we have been a part of that process. I am delighted that is worked on because one of those gaps is a coliseum and a strategy is critical because right now deterrence does not work and finally as retired about this think about what the russians did in 2016. There were three components of packing and leaking the the Voting System which did think is a very serious issue but the other was information and manipulation and that is hard to adapt with those that have the first amendment. What we need to think about it is a heightened level of Digital Literacy to understand when they are being misled and manipulated. My wife has a sign that says the most difficult thing on the internet is to determine the authenticity of of quotation from abraham lincoln. [laughter] behalf to understand this is a whole new lovell to manipulate reports from those French Elections that isnt illegal to say he had them but had defender self against that . Think about that how do we educate our people to be more discerning crux of america this the brave new world for all of us. It is particularly challenging in the country that values freespeech. Admiral rogers thank you for service to our country. Wearing two hats what is the earliest date you think cyber, should be elevated to commack and come back and comeback and command. It is a policy issue that is not fair to think we can do in a reasonably short period time. Instead of the criteria before such a move was made. We have identified those tapes those steps im confident we could do this in a short period of time. Can you say what the activities have to be . We have identified to shift current responsibilities down to us make changes from the document signed from the of president to outline what combat and commanders insist with the geographic aspects we have to make the changes. Then we have identified investments. There is an advantage to have to separate organizations while the information would be shared would be any different manner. But those activities would be different. Can you share the Positive Side of a move like that could. I am on record to say recommendation is after six or nine months seeking to the conclusion the answer is to separate the two to remain closely aligned because they work in the same battle space so it is still a unique relationship in the long run it is the right thing to do with a series of steps that each organization is optimized to achieve a successful outcome particularly with the cybercommand but it could be done within a reasonable period of time. Have you classify that infrastructure and what efforts it is cyber, taking vital to the deity mission wrecks. Diana stand. With the Defense Security Security Service to make sure that those businesses of infrastructure have access to information and i spend a lot of time focused on this not that it is unique but that is dependent on capabilities so how can we speed up the process . It is hard right now to deal directly with the framework created overtime potentially we could amend that with companies that have a direct relationship to provide capabilities or infrastructure. Also be pick a couple places those that are a little more isolated with some test cases with Critical Infrastructure on the island to highlight how we Work Together very closely because there is no alternative generator. We forget it how critical blow cyberaspects are can you think of any other areas that require dominant sea dominant in cyber . Our success looks at the ability of the rest of the department of the of broader ability. Welcome back admiral rogers it has become evident to meet me Crystal Clear that russia has mastered the domain and effectively sets up a situation to coordinate those fake automated social media accounts for those to amplifies the stories effectively that is true of thick noose for real news said those are proving with daytoday business as well as the lead have seen in europe so does cybercommand have a role to play as a threat not just a reality . If you look at the low weighed the spectrum and information dynamic plays out, but i am so focused on executing missions let me get the structure set im trying to conceptualize and my own mind how we bring that cyberwarfare how do we do this in the integrated way . Were not there yet. What is the right way for word . You have people assigned the issue of thousands that are out there as a mechanism that look like social media accounts theyre really just automated that takes a story that interested 10 people and makes it look like it is interested of 10,000 now negative news feed shows up so have elected that capability to make it clear that they are not genuine . Because it seems if you take that piece out on a constant rolling basis you have dramatically diminished impact. With that scenario that you went through. They were focused largely externally. But this is not attached to actual people in the United States. Though wade that this will go next you will see domestic manipulation and for us right now i am not directly involved but with government efforts to generate insight we share with major social media providers will be believed to be criminal but is of threat to the nation. See you can go in relative the realtime . American some cases reported cent immediate realtime but i get enough to show the ambac comprehensive effort. Im trying to engender a broader dialogue we have to stop looking at this with one individual. That speaks to the relationship with their Financial Services or utility or media. From your perspective, what more can we be doing to help them connect with our National Guard and their capabilities, what else can we do . I can walk you through what pennsylvania is doing, delaware, washington, its interesting to me. I think to myself you are in a different world. The biggest challenge, and it is one that ive outlined about six different priorities for Cyber Command if there are things we are going to focus on, one of sixs motivations try to partner with Northern Command as well as the National Guard bureau so we are seeing the investments which i am very supportive of and appreciative of. How do we create a mechanism so that we can actually apply that in real time. We are doing something now where the air force is activating sequence in the guard. If we had a major cyber event i feel very comfortable about understanding is going to do what. Im curious about if it is not something catastrophic or where the dod active force is viewed as the responsibility. How do we apply them and what is the control structure in place. We do that now and its a very mature in terms of how we respond to natural disasters and we have a great process. Maybe it runs parallel to teams where they provide backup in case of any sort of incident in the super bowl and things like that. We always have them on standby in as we look at major events and progression whether it is elections or others throughout the year we have those guard capabilities. One o one of the other challenges in the guard construct is based on state. I have the council of governors and the tags in many instances the state is going to be counting from the cyber perspective into the cyber arena doesnt reside in the state so how do we take advantage of more broadly and im trying to figure the construct on something that isnt always defined to make sense. A number of my colleagues moving on to a different topic keep the personnel they are so theres been a lot of suggestions about bringing civilians and fill in the gaps. But they also stated that each dose is not a luxury. It is essential when you have a military. When we put look at things this how do we make sure it isnt being deluded fox its the reason ive argued creating the cyber force. The nationstate can do this and civilian cannot. To bring the total spectrum active reserve contractor civilian, private sector not to bring together one single slice so i would be wary about swinging the pendulum too far in one direction away from a piece of that. Thank you mr. Chair. The office of the director of National Intelligence released an assessment on the activities and intentions in recent years and general clapper testified regarding this report yesterday in the judiciary so we all know that do you feel the actions in the cyber attack it should be viewed as unacceptable. It is not a behavior that he wants tyouwant to encourage or r that you want to see repeated. How to get there is the challenge. What is your opinion of the role of the military in preventing these type of events. Our job is to generate insight and knowledge that help inform a potential response and ability to get ahead of the problem to identify in advance intent to do something that all arms policymakers and military commanders with the ability to engage in the operations or choices that communicate to the other party we know what youre thinking about doing. And the Cyber Command side, again, if we define the infrastructure to the nation and we are directed by the president or the secretary we can apply the capabilities in partnership with others because we wont be the only one in the department of security we can apply those capabilities proactively with some of the owners. It was very clear by general clapper yesterday they would continue these efforts and we know theyve been doing this since the 1960s or 70s that thebutthey have many more toolse toolbox. So you are still awaiting direction for everyone to coordinate the efforts to stop. I dont have a defined mission here. We need to do that for everyone to come together. They continue to increase the Cyber Security capabilities and advance to Cyber Attacks and theyve placed the focus on the advanced capabilities. How does that work with the other commands to counter the threats they face . I partnered with honolulu two weeks ago and i try to get out there every six months. I try to do this with all of the Combatant Commanders around the world. Are we meeting the requirements. Cyber command in many ways. Much of the success is going to be defined by others and that is the way that it should be. So we spent a good deal of time outlining capabilities. It should be the priority for how the capabilities are appli applied. And the meetings with the other Combatant Commanders part of the function to encourage a. We have to do the same thing in cyber. As other Government Agencies try to fill their requirement as well, i would like to know specifically how important it is to continue the nonmilitary investments in education particularly in the programs for the growing need of the Cyber Command. The workforce is going to be a spectrum from the guard and reserve and contractors. For much of the active piece, much of it will be done by the private sector and not by the government. So as i said we have relationships with over 200 institutions and its one of the reasons why we spend a fair amount of time. Tell me how you generate a workforce and i acknowledge that there are some differences but there are some things i could learn from you about what works for you because it cant be all about money. Thank you mr. Chair. Admiral, its good to see you again. Youve been on the job about two years now. Three. If you were to go back three years ago and were in the same Committee Hearing with the answers have changed substantially . Where in other words have we made significant progress . We have capability. We are actually using it. We have a good way ahead. We have a commitment to that way ahead. As you go through this, when you think about the competitors is the gaps narrow or wide between the capabilities to defend ourselves and to potentially respond to narrowing the gap i would also tell myself you are not moving fast enough. We acknowledge we are not where we want to be. Over the last three years the sense of ownership and i for one think we are making a huge mistake if we leave this hearing or if the private sector thinks we are coming up with a solution but they all benefit from. Its what the consequences should be that we need some security ourselves and our businesses and homes and states. How have they improved . Some have made significant improvement. Others, to go to your point its hard to expect the police force to stop burglaries not just unlocked that open. He will turn all the lights on and leave the house for an extended period of time and say feel free. Thats not going to get us where we need. We havent been in here for a hearing a week before and how do we get to the point that we put pressure on the private sector not to mandate that to use it as a distinguishing factor choosing between one potential contractor or supplier and another. If you want to do business in the authorities is that within the Current Authority . We made some in the contractor will language. Did they try to define in the discussion i think that we were talking about needing some sort of thirdparty suppliers, maybe a state agency adhering to a baseline standard. We could do an assessment or an inspection. It is the kind of thing looking at the reality they have a supplier base. We need to hold them to the same standard and repeat what we always say in the committees. All you need to do this understanis understandthe supplr that one critical component that shuts down the ability. After elevation how do you envision a standard operator and what are the priorities . Now w now we are into a kind of what if scenario. I just dont like getting into the what if kind of things. Now we need to let the process play out and see what bottomline they come to. On behalf of chairman mccain, senator warren. I want to ask about the importance of the nonmilitary agencies which includes defending the United States against Cyber Attacks by the nonstate actors. Our Department Promotes International Norm in cyberspace and helps make our partners and allies more secure. I think youve already talked about that and it counters the online radicalization by the nonstate actors everyday. I want to ask with reductions in funding to the state department and counter radicalization programs make the job easier or harder. I am concerned about the significant reductions to them on dod departments proposed by the administration. Hes agencies provide critical support for the work and i just want to make sure that doesnt get overlooked. But i also want to do is follow up on a question senator hirono asked. They helped the preferred american president ial candidate and last week they did exactly the same thing in order to help the preferred french president ial candidate. They need to step up the game and their gameand i know you arf that. You stated in the testimony that improving the Network Defenses and building a Cybersecurity Culture depend on skilled people so i would like to press you on the question how we recruit and retain cyber warriors. One of the witnesses said that the military recruiting system is so focused on filling quotas they end up recruiting only today to execute the missions we would need a decade from now. Can you tell us about your recommendations to ensure we are recruiting the right talent and the threats that we would face tomorrow . Its the digital warriors in the 21st century and the images we are the cutting edge of something brandnew and everyday we are shaping the future in a way that nobody else gets to do and we are doing things that nobody else on the outside can do. We have a focus and a vision and we are driving so we are looking for how to get ahead of this and then one of the skill sets that i need this is one area that i would highlight. Im saying to myself right now we are probably not optimized for the data requirements, so what kind of skills do i need is that a uniform scale, with a contractor makes more sense, is that something that the reserve can do and they are going to stay there and do that, that is probably an example saying to myself is still in my mind we havent developed a plan. In the 2017 Defense Department authorization we gave a lot of flexibility on how to recruit talent. So let me just ask do you have all of the authority that you need or do we need more exemptions from federal hiring malls and other changes come to help you in your recruiting efforts not just today that from todabut fromtoday and a year frd a few years. I find the ability we are lagging. Is this something we are failing to understand and not optimizing the outputs that we need im not at the stage yet but i told the team if we come to the conclusion we have to ask for more authority that is what we are doing. We have to take advantage of the willingness and the committee to work with us when it comes to flexibility in the capital peace. I know how much you have invested in the cyber military force and the Mission Force overall that you have made enormous progress that i hope youll let us know more in advance. Let us know because if you need more flexibility you should have more flexibility. Thank you mr. Chair. Thank you for everything. In the testimony we heard this year, the seder capabilities are the adversaries likely to far exceed the United States ability to defend the key Critical Infrastructures. Do you agree with that . It challenges much of our infrastructure and represents the decisions made decades ago. The cost of replacing the fixed infrastructure is huge. So its not likely that we are going to replace all of that infrastructure in the immediate and longterm its just beyond the nation right now. So on defense in terms of detection from the earlier testimony even today is there anything you can tell us what youre doing on the offensive side or are we developing a capability as well as we are acknowledging those capabilities and i apologize i would rather not get into that but i would like to move over to the question of the day and that is how do you stand up this force training is a very major part of this as you said between 2013 and 2016, under the supervision of the office of the secretary of defense and the joint staff were supposed to come to an agreement on a joined program funded by the services and the mission. Can you update us on the status of that agreement . We will transition to that initial outfit if you will using the nsa infrastructure we signed up to use much of the structure and schoolhouses. The buildout capability is due to be on track in 2018. The agreement was the responsibility for training and development. We are on track to do that right now but the service would be responsible for developing our own cyber warriors. We have a mandated training standards by position. Each service then often times partnering for example the training in pensacola is used because we then get together and say give him the same common standard that is the best way to cross the person to make this work and what services the best capability, held we managed to put . Having some experience in the organizations im concerned about the trade off. We are in our crisis days right now with the ability to detect and deter at this point. I understand the ideal might be to have the context mentioned. In the interim phase when we are in this mode, do we have a send that there might be counterproductive to the ability to stand up to the immediate threats . It would be difficult. Its another reason why i would argue optimizing destructors and mechanisms that are in place and we have to hold them accountable. We cant turn to them and do what we always do. We got a huge mismatch between the current capacity. The history has been the extraction of data from the system but its the primary motive and the state actors. In north korea we saw a little bit of a different attack. What i would call the sleeper embed code do we see the continuing growth in that type of activity and any areas they both look no would looko extract but to understand it. One of the things if the system has been penetrated it is a manipulated change amended to the configurations fo separately now for the mitigation when someone has penetrated a system so it is the full spectrum of the simple answer is yes it is a full spectrum. Any others for that in the u. S. . They are clearly interested in a longterm presence extracting. Thank you, general. It is always a pleasure and we enjoy your testimony as always. My question involves the Semi Conductor industry that right now faces some major challenges in addition to some fundamental technological limits are being reached in that area and has also been a push by china to reshape the favor using industrial policies backed by over 100 million in government directed funds. Is it critical to the obligation of the critical u. S. Defense systems and i am very concerned abouthat chinas industrial pols pose a threat to u. S. National security and although we have a range of tools that are familiar to deal with this, the principal mechanism is the Interagency Committee on the Foreign Investment in the u. S. And within the dod as you know as well as a key contributor to the National Assessment of the military services, the combat commands all have a role in this process. Considering cyber calms leading role, how has the poster to support the mergers and acquisitions for significant implications for the dod Cyber Mission packs one of the applications, one input i tried to make is to step back and reassess the process so that it is optimized. They understand the structure and criteria that we used to make decisions about the investment acceptable from the National Security perspective and my concern is i cant say we are not smart enough but we are just one in the process. We need to step back and ask that question to ourselves. That is just one of the things we need to be doing. To turn back to some of the discussions that we have had related to the involvement of the private sector that has to be involved in the security operations. The exercises in the most recent ones involved in the attack in the northeast all of these entities are not part of the department of defense. It cited concerns in a large part of the exercise that takes place in a classified foru forut places inherent limitations on public and private sector participation and the arrangements certainly are designed to protect the plans and capabilities and we all realize the importance of doing that. It potentially could be catastrophic so my question is how are you balancing the need for security that must assess a broad support from. Its one of the reasons we changed the cyber overtime. So if you look at the scenario that you talked about that we did last year in terms of the activity directed against the power grid. We went to several companies and said we would like you to participate so what do we need to make that happen. We also are going to the private sector. We added the back so i am trying to sneak can we create an exercise and we do tabletop exercises which is huge, its like a thousand individuals. We talk at a higher level to skirt some of the security aspects of this and bring in a private sector that would do that before being complex. I want to touch on that and specifically a few moments ago you refer to the president as russias preferred candidate. I think she is referring to the Intelligence Committee assessment of january 6 primarily with the fbi which brings to mind the curiosity from the report i wanted to raise on the key judgments where it says we also assess putin and the government aspired to help the president chances when possible by discrediting secretary clinton. All agencies agree with this and they have high confidence in the judgment and have moderate confidence. In the end i made that call. When i looked at all of the da data. We have multiple sources, multiple disciplines and i was able to remove almost every other rationale i could come up with over time. It didnt have the same level of sourcing or multiple sources. I still believe that fit within the context. One particular point was to her to secretary clintons chances and helped donald trumps. Obviously we cant discuss those classified matters we want to build up the defenses and expanded the missile defenses and accelerate the Nuclear Modernization for oil and gas and none of those things seemed to be in account. In 20096 months after it invaded georgia. In 2012 and a moment with medvedev president obama said there would be more flexibility on the Ballistic Missile defense and mocked the opponent in the president ial debate saying that russia is the number one geopolitical flow. With the closest middle east ally. 2014 we start virtually idly by the invasion. 2015 russia had a surge and continued the effort to block the Security Council resolutions. 2016 they pummeled aleppo i approached to the act that would hold them into account and increase the amount of times they were in the arctic. President trump promised to reverse those policies and secretary clinton largely campaigned on the continuity. That doesnt sound to me like something the kremlin would be happy about. Do you think given that eight year history of the intelligence and leadership felt emboldened to undertake those email systems . Now you are in the political judgment and that is not my ar area. On the issue of moderate confidence did you have a high degree of confidence or was there the effort to discredit one candidate had only a moderate degree of confidence if you read the key judgments it says i concur in the report and we have high confidence in the judgment that the russians clearly were trying to undermine democracy and discredit us broadly they wanted to specifically make sure that candidate clinton did not win and then it was just the last part about the judgment they wanted a candidate trump. They were asked what would be the most significant adversary and he testifie justified basede capacity of the wouldbe russia. Just on the cyber domain do you view it in the adversary at the taken actions that have put them into the position on the United States. Im watching them on the behaviors that are destabilizing and the interest of cyber. Would you also agree francis and i live in a Coalition Partner . You are aware of the reports in the last few days there was a second evidence tying russia to the effort to destabilize the French Election . That is something we should take seriously when the adversary tries to destabilize. There was an article the day before saturdays visit was fascinating headlines. You asked the far right activists to promote an attack and that the article was about the effort by the groups in the United States to immediately spread the documents in many instances before they were able to defend them. If we should take seriously an adversary cyber attack on the democracy of an ally, should we be indifferent or concerned about efforts of americans to Work Together with or in parallel with an adversary attacking the democracy of an ally . Stanek i apologize. Im not sure that i am understanding. Do we take seriousl seriousla inouye tries to destabilize the democracy of an ally if an american organizations are trying to Work Together with or are in parallel with trying to attack an ally like france, should we be indifferent to that or take that seriously . We need to be concerned. And should be cubas government to be concerned in this case, and i will introduce this for the record if we should be concerned about the effort of the folks in the United States to Work Together with or in parallel with an adversary, where should that concern lie in the federal government, is that a small enforcement matter or dhs or Cyber Command after . Syndicate depends upon the specifics. If individuals in the United States are taking the documents from an illegal hack and trying to disseminate it to affect the French Election, this is something we should be concerned about where it would apply. If it is a locality first it would be the fbi that that is not a fully informed opinion, but it is the first thing that comes to my mind. Theres been some debate about whether there is such a thing as a good shutdown of the United States government. Do you see any circumstance under which the commission would be none of it shot down by the United States. I know youve are asking for a yes or no but its what we been through in 2013 and its now four years later and every time there is the nearest hand in the media of a potentiality, i get are we going to go through this again, you said this wasnt going to happen i thought they were committed to us in our mission. I dont want to work in an environment where i will just be jerked around like am i going to get paid, do they value what we do, we just want to support the key Movement Moving forward. Russia is still interfering in the politics you concur with that . Do you agree that with democrats in 2016 x. Of the republicans in the next . Its not about politics or parties, it is an effort against every citizen of the nation. Im not going to get into them at large, but certainly we acknowledge an incidental collection and we also have a very strict process. The only way you can collect on a citizen is to have it werent for if an american citizen is incidentally in a conversation with somebody that you are already following. Im asking is the request to your Organization Want to be american citizen . How many of those requests did to get in 2016 . I think it is 1,900. How many people can request the unmasking of the citizen . If you are the recipient of the intelligence we used to criteria number one is to be in the official duties into the repealing of the u. S. Person has to provide context and greater value it cant just be im just curious. If you are in the authorized distribution. Does the National Security director advisor they are normally on the distribution for most. There was the record of who made the request involving the american citizen. There is the record of the basis so why do we say yes was reminded the individuals once we authorize it is only to that individual so if we unmask the reports that went to a particular individual we dont unmask the report for everybody only the individual general flynn was caught up with the Administration Im familiar with the story. Assuming he didnt have the warrant allowing us to collect on him it would be following the Russian Ambassador does that make sense . We would know how the conversation was revealed. Im not talking about warrens. Hispanic it is probably a greater potential generally in terms of collection. Somebody took that information that we gained. Are you concerned about people no matter how noble they think the event might be . Thats why ive gone through it in writing saying lets we do not engage in this behavior. Its that information is given to and its possible us to know. On the nsa site is part of the investigation and a committee we are going through right now. I would have to pull the data, sir. I apologize. Thanks, mr. Chairman and admiral rogers. Thank you for your service. We have heard repeatedly in this room as well as yesterday with doctor clapper. Yes sir. Nothing is changing their behavior and clearly nothing will change their behavior in the future because to quote you they have more to gain than to lose in continuing this kind of attack. Can you recommend to us what measures would be taken, and i know youve been asked this question and you said that the tools like sanctions can be an effective option but so far distinctions in mind you are way less than they should be, do you agree that they can and should be increased to provide a price. Theyve proven to be an effective tool and they work all the time. There will be a point where the Cyber Response with the appropriate. I would highlight when we think about the terms we need to think more broadly because it doesnt mean we should automatically when it has to be a direct response i think we need to think more broadly in the strength as a nation. There is no question that the russians attacked the country through the cyber and would you agree that americans who cooperated with that attack also should be killed by chemical . Splenic broadly yes but now you are starting to get into the legal and policy piece. It includes defending the nation. Lets talk about a group of americans that they have cooperated like the russians and enabling or encouraging this kind of an attack. And by the way they violated the criminal laws and wouldnt you agree they should be held accountable and the investigation is appropriate and necessary. We still dont have one. Can you tell the American People whose responsibility it is to develop a strategy and policy . Theres multiple components but it all boils down to the executive. They are working through this in fairness to them this is not this is a complicated topic with a whole lot of nuance and i know the discussions are ongoing. Ive been a part of some of them and im grateful to team is willing to reach out and say from your perspective what do you think and e. And whether using a devout. I just want to conclude again for the attack on the country requires compelling americans and also a strategy and a policy for knowing when there is a cyber attack on the nation and then it is an act of war that should prompt the cyber domain or other domains and economic sanctions to force them to pay a price. And right now, our policy of deterrence is in my view an abject failure. Thank you. Thank you mr. Chairman. We have heard over and over again and multiple hearings we have our cyber hearing tomorrow so this is timely about the information sharing and the standing the challenges of the classified information by staff has tried to charge the structure for me and the one thing that sticks out is the coordinated group it appears to me to be the only place the structure is set up where the private sector entities seem to plug into the national structu structure. The interesting thing is a the coordinated group is supposed to be in response to the significant cyber event. They have realtime collaboration within and desist on an ongoing basis. My first question is asked to coordinated group ever been called into a session and has there ever been ongoing meaning of or any meetings of the group that has been laid out . It does interact. We participated in the work we do virtually in the videoconference if i could. I know we spend a lot of time today struggling with what our policy is. It looks to me we dont really have anywhere that there is an ongoing meeting over a structure that integrates the private sector into what is a pretty convoluted setup that we have right now. I think it is fair to say that the sector level we have those that occur but one of the things pointed out is we dont have a sector labeled u. S. Election infrastructure like we do in cover transportation. Although it is named part of their Critical Infrastructure possibility and that happened last year may be in response to this but we will find out more tomorrow. I guess it seems to me when someone is impacting the election, if you look at the list, the National Policies certainly impact chemical, commercial, manufacturing, everything gets impacted. So i guess forget about russia for a minute. Are you familiar with the model and what is wrong with it and why arent we emulating it more . I want to paint a simplistic picture. They turned to their gc hq and said you have the preponderance of the capability expertise we would like you to take a portion of the capability and the art going to create this center. The individual that runs it i worked with for a long time is the employee. They decided in their construct we have always been less comfortable in the idea do you want our military or the intelligence to be the primary interface if you will. Their view is i it is about aligning the greatest expertise and a private sector and it isnt quite the same baggage or history or tradition. Because of that, weve taken a fundamentally different approach and i hope that with this new team coming in are we happy with the way that this is working i havent seen the diagram but you have heard me say for a long time we have to simplify the complexity because if you are in the private sector trying to figure out who am i supposed to be dealing with and was it you and last time it was that organization, we have got to simplify this. Pulling the group together after the cyber event, theres going to be a lot of monday morning corner backing about the information that should have been shared. I agree with everything you said that i would remind you perfect information sharing in and of itself will not necessarily fix every problem if you look at the reactions there were plenty of organizations that provided the insight. I just want us to think about the simple cureall. I know its not the simple cure but i know that underlining does is about information sharing is calcified and i want to make sure that we are aware of that. Thank you mr. Chairman and for being here for the job and i wanted to go on the issue of classified and unclassified. The challenge in this case is that the American Public doesnt know what is going on and when they dont know whats going on on an event of this magnitude is a challenge for our democracy. And i wasnt able to hear your testimony into the questions. Have you talked about in the big picture what that means and what are they trying to do with our electoral system and with the interference in germany and what theyve done in the countries in Eastern Europe what is their goal . As we indicated and said in the intelligence assessment primary goals we have done, first was to undercut the United States and its principles to send the message they are every bit as consistent not as high on the hill. They work against each other so they undercut the democracy. Then it talks about the third objective is to try for the judgment that the third objective was to help the candidate when. If you look at the activity that they have done in france and germany, they are trying to help ensure that they might be more inclined. It might engage in the policies of the russian perspective. Whats the difference between the candidates and what the choices be in terms of National Security policies and how that might impact the russians. Doesnt the overarching strategy mean not who the winners and losers are the two undermined the Public Confidence in the democracy of how it works. At the center part of that. Im sorry if i didnt make that jump. Its the we have not the unwilling to pass stronger sanctions are bewildering to do other efforts pfft to take action against them because of their interference. What does that say to our allies greg sematech insert the and stand by they would be perplex of misconduct occurred why are we seeing xyz . I can understand that but we try to assure our allies that this is one aspect of broader set but in broad terms we should not question that longterm commitment like poland beat no doubt about that to mimicry are more committed to poland than rush the . Spread that is not wise said but that is open to interpretation with that assumption,. At rogers thank you for your testimony today we appreciate your service and communicate to your colleagues there service also. The hearing is adjourned. [inaudible conversations]