Transcripts For CSPAN3 Defense Officials Testify On Cyberthreats 20160623

Committee will come to order. I would like to welcome our Witnesses Today as the Committee Examines military Cyber Operations. I note that just about exactly two months ago, president obama confirmed for the first time that the u. S. Is conducting Cyber Operations against isis. And as the leadership of the department of defense was discussing this, they said it was the first time that Cyber Command has been given the guidance to go after isis. Just like we have an air campaign, we want to have a cyber campaign. And some of the press went on to discuss that secretary carter was pushing for u. S. Cyber command to have greater freedom to launch attacks and to address tactical Cyber Threats against isi isis. The Department Defense capabilities to fight and win the countrys wars and be prepared and ready to execute those missions remain on solid footing regardless of which domain we are talking about, including the cyber domain. The department has been developing organizations capabilities and personnel needed to operate in cyber since at least 2010. Billions of dollars have been spent. And yet the perception and yall can disagree with this if you think im wrong. The perception is that the threat is still multiplying faster and growing faster than at least our laws and regulations, policies, rules of engagement are developing. Still a fundamental question. What is the role of the military to protect civilian infrastructure in the United States against cyber attack . I do not suggest were going to get the definitive answer to all of those questions today. But i think that it is important that we discuss not only those, but the tactical use of power. I yield to the distinguish Ranking Member for any comments he would like to make. Thank you, mr. Chairman i agree with your comments about the complexity and importance of cyber. And the most interesting thing i would like to get out of this hear something how is the organization coming together . I think thats the major challenge. Its been quite a few years since we recognized cyber. So we have a lot of people working on it. How coordinated are they . Thats the great challenge, making sure were getting the most out of the resources were putting into this it is a constantly evolving threat and it threatens everything, every aspect. The least little device can be an entry point to a cyber attack. So, how do you get a comprehensive look at making sure that you control control is a bit of an optimistic statement. Have some measure of understanding of where the threats are and how best to address them. So how the various branches of the military and our broader cyber vulnerabilities, as the chairman mentioned a lot of those vulnerabilities exist in the private sector and weve had defense contractors who have been hacked before that have created problems. So, how do you we comprehensively address this incredibly complex and everevolving problem . I think thats the great challenge. I will say that i very much approved of what secretary carter did, where he had the i forget what he called it, but basically invited hackers to try to find their way in. Youll learn from that. I think that was one of the best, most costeffective ways to do it. Instead of sending some contract out to somebody, take those people out there who are really good at this and say come at us. Show us our vulnerablvulnerabli. That was a very wise way to learn a lot in a Cost Effective manner. A cost effect approach to an ever evolving and changing problem. As the chairman mentioned, the legalities of it in terms of are our laws and regulations keeping up with it, to make sure that you and the executive branch have the authorities you need to best protect us and, in some cases shall use cyber as an offensive weapon where necessary. With that ill yield back and look forward to the testimony. Gentlemen, i also want to mention that, of course, on the front lines for oversight of this issue, i very much appreciate the emerging threats and capabilities, Sub Committee wilson who work in this area daytoday. I think it is also important, though, for all members to look at these larger cyber issues, which is why were doing this hearing with the full committee today. Let me welcome our witnesses, mr. Thomas atkin actth assistant Secretary Department of defense, thank you all again for being here. Mr. Atkin, the floor is yours. I am pleased to testify today, along with my colleagues, Lieutenant General Kevin Mclaughlin and Brigadier General moore. In how we are improving. The closed hearing will go into greater detail on some of the challenges we face in cyber space and the departments efforts to address those challenges. I wanted to highlight a few thengs here this morning. First, the threat. Today, we face a diverse and persistent threat in cyber space from state and nonstate actors that cannot be defeated through the efforts of any single organization. Our increasingly wired and interconnected world has brought prosperity and economic gain to the United States. However, our dependence on these systems also leaves us vulnerable and Cyber Threats are increasing and evolving. Posing greater risk to the networking systems of the department of defense and other departments and agencies. Our National Critical infrastructure and other u. S. Companies in interest. Dod maintains and uses robust and unique Cyber Capabilities to defend our networks and the nation, that alone is not sufficient. Securing our systems and networks is everyones responsibility. From the commander down to the individual. And this requires a culture of Cyber Security. More broadly, preventing Cyber Attacks of significant consequence against the u. S. Homeland requires a whole of government and whole of nation approach. To that end, dod works in close collaboration with other federal departments, our allies and the private sector to improve our nations Cyber Security posture and ebber ensure that dod has the ability to operate in any environment at any time. Since Cyber Strategy was signed by secretary carter, the department has devoted considerable resources to implementing the goals and objectives outlined within the document. When secretary signed the document, he directed the department to focus its efforts on three primary missions in cyber space. One, defend the department of information, department of Defense Information Networks to assure our dod missions. Two, defend the United States against Cyber Attacks of significant consequence and, three, provide full spectrum cyber options to support contingency plans and military operations. Another key part of our strategy is deterrence. Dod is supporting a comprehensive Cyber Strategy to deter attacks on the u. S. And our interests. This strategy depends on the totality of u. S. Actions, to include declaratory policy, overall defensive posture, Effective Response procedures, indications and warning capabilities and the resiliency of u. S. Networks and systems. I am proud to say that the department has made important strides in implementing dod strategy since it was signed in 2015. My colleagues and i look forward to going into greater detail on our strategy as the hearing proceeds, as well as to discuss how our thinking and incorporation of Cyber Operations is evolving. The department is committed to defending our u. S. Homeland and interests from attacks of significant consequence that may occur in cyber space. I look forward to working with this committee and congress to ensure that the department has the necessary capabilities to keep our country safe and our forces strong. I thank you for your support in these efforts and i look forward to your questions. Thank you. General mclaughlin . Chairman thornberry, Ranking Member smith, distinguished members of the committee, im honored to appear before you today representing the men and women of u. S. Cyber command. Its my pleasure to do so alongside assistant secretary Brigadier General moore and thomas atkin, two men who keenly recognize the challenges the Department Faces in the cyber domain. I would like to focus my opening remarks on the ongoing efforts to build capability and capacity in the Cyber Mission force. The Cyber Mission force, with unique teams designed to defend dod information networks, support combat missions give u. S. Cyber command and the department a means to apply military capability at scale in cyber space. We recognize that success in accomplishing our missions is dependent on three factors, quality of our people, the effectiveness of their capabilities and proficiency that our people bring to bear in employing these capabilities. Encompassing a robust, active component along with both National Guard and reserve force s being fully integrated. Out of a target total of 143 teams that will be part of the Cyber Mission force we have 46 teams at fully operational capable status and 59 that are initial operating capability status. We will eventually build to 6,187 when we finish. It is important to note that teams that are not fully operational are already contributing to cyber space efforts as the command operates on a fulltime and global basis. Nation and every Combatant Commander can call on Cyber Mission force teams to bring cyber space effects and support of their operations. In support of u. S. Central commands ongoing efforts to degrade, dismantle and ultimately defeat isil. Training them to be prepared is imperative. Cyber guard exercise, which concluded last friday provides realistic training in which federal, state industry and International Partners can use their skills against a determined opposition force. The response to cyber guard from our public and private partners has been tremendous. Dozens of Critical Infrastructure countries have expressed interest in it. Allowing policy makers to observe the types of issues we see in real Cyber Attacks and helps us generate a playbook that should save the federal government precious time and stress in responding. U. S. Cyber command to teams to ensure they have training skills to make an Immediate Impact in todays fight. Our command prides itself in being a learning organization, exercises like cyber guard and other premiere exercise, cyber flag, which is ongoing at this moment, are key Lessons Learned, opportunities for us. We also look at everything were learning and the growing set of realworld operations and collaboration from the private sector, academia to provide valuable insights to the command and allow our teams to develop and implement new tactics, techniques and procedures. Although our people are undoubtedly our most important aspect i would be remiss not to highlight the tools, infrastructure and capabilities that the force needs to execute its missions. Ongoing efforts to develop tools such as the persistent training department, Cyber Situational Awareness and the joint environment must continue to be resourced. These capabilities are critical in ensuring that theyre equipped to counter. Adversaries changing tactics in cyber space require well trained, well resourced and agile force. With that, thank you again mr. Chairman and members of the committee for inviting me to appear before you today. U. S. Cyber command is committed to the mission of ensuring the department of Defense Mission assurance, deterring or defeating threats to our infrastructure and achieving objectives. Cyber Mission Force is adding to our ability to perform this mission. U. S. Cyber command team appreciates the support of this committee that it has shown and looks forward to our continuing partnership with congress to address the challenges and opportunities in cyber space. Im happy to take your questions. Thank you. General moore . Thank you, chairman thornberry, members of the committee thank you for allowing me to speak on behalf of the joint staff. The inherent Global Nature of cyber space threats causes and creates numerous challenges for the department of defense. Additionally, our warfighting capabilities are increase iing hightech weapons, Communications Systems to our ability to rapidly deploy forces around the globe. Trying to keep up at the rate in which technology is advancing in this rapidly changing environment is extremely challenging. Potential adversaries continue to increase their capabilities they also sha irthese challenges. All of that said, we have made progress, challenging our adversaries ability to operate in sieber space and more effectively our networks information, Weapons Systems from malicious cyber space actors. In regards to building our Cyber Capabilities, u. S. Cyber come continue to make Great Strides in standing up for Cyber Mission forces, arranged in teams with the objectives to support and combat command requirements, to defend the nation against cyber attack and to protect our department of Defense Information Networks. Information and Weapons Systems. While significant process in all of these areas in the last year, significant challenges do remain to include equiping the force, recruiting and retaining a professional cyber source and Cyber Mission force command and structure. From an operational perspective, cyber com continues to make great progress. Cyber com has not only challenged isil as the president and seblingt of defense has publicly stated but built on our Lessons Learned to date, upon which to expand the scale and effectiveness of our operations. From a broader, strategic view or adversaries, who are always looking for something that can provide them an asymmetric advantage, find cyber space appealing due to low barriers of entry and perceived difficulty of tricks. Because of these threats from state and nonstate actors we work vigorously to harden our systems while educating the total force to create a climate of constant vigilance. To strengthen the whole of government, particularly u. S. Critical infrastructure, the department of defense routinely engages and works with our Department Partners and International Partners, and theres interest to expand those cyber relationships. Finally as our capabilities continue to grow, we continually engage all the combatant commands to make sure cyber effects are being considered in corporation to their planning process and benefit all current and future operations. While it is well known we are actively engaged in cyber space against isil, we also recognize that there are other threats in cyber space that must be planned for and addressed. Joint staff is working closely with u. S. Cyber com to continue to bring cyberrelated options to the table to support all our global operations. As i mentioned, cyber domain is constantly changing and we see malicious cyber actors rapidly developing new capabilities at a very high rate. Working closely with cyber com, osd, International Partners to secure our networks, our information, Weapons Systems and to support combat and command objectives while we protect the nation against malicious cyber space activities. Thank you for the opportunity to appear today. I look forward to answering any questions you might have. Thank you. Let me take a second and remind members that we will have our quarterly cyber update this afternoon the 2 00. Classifieded, of course, and we will be able to get into greater detail on classified items then. In october 2010, were nearly six years down the road. Isnt it time for cyber com to stand on its own as a combat and command . I think the short answer to that is yes. We are continuing to look at that within the department. The secretary is has been evaluating whether to stand up or recommend to the president to stand up cyber com as its own unified command. Were continuing to look at it. We are getting close to a decision. And we will be getting something to the president here in the near future. Well, were trying to help you along because section 911 of the Defense Authorization bill requires that be done. I note admiral rogers has testified become a combat and command would allow cyber com to become faster which would generate better mission outcomes. I have yet to hear a reason not to do it. And so it seems to me that we shouldnt stew around about this too long because the goal is better outcomes. And if thats what the result is, we ought to be able to agree and get that done without a lot of delay. General mclaughlin, let me ask you. We talked about the tactical use of cyber thats been publicly talked about by the president , secretary, deputy secretary. We obviously cannot get into the details of that in this forum. But are there what would you say are kind of the broader challenges that have been encountered so far . General moore mentioned Lessons Learned. At an upper policy level, what have we learned so far with what weve been doing against isis . I think what weve learned is as weve described to you the Cyber Mission force that is being built right now, weve learned that the fundamental Building Blocks of the forces that are actually supporting combat and commands, as we stated in our mission, one major focus is bringing cyber effects to support our combat and commanders and war on isil is the first at scale opportunity to do that. First thing we learned, reinforced that the way were creating our teams, expertise of our teams and how they plug in to the command and control is working. Broader challenges we have, this team is still a young force. As we mentioned, we have quite a few of them at initial operating capability. In many cases, this is the first actual live opportunity for these forces to conduct that type of mission. So, the types of lessons weve learned have been a number of just practical lessons about improving the ability for us to do that routinely at scale. The reason the persistent training environment is so important is to give teams like those that are supporting the war on isil more realistic opportunities to do their work and train in realistic environments prior to actually doing it in combat. So we sort of knew that intuitively and the operations have born out how important that capability would be. Weve learned how quickly that the department in general needs to operate from in terms of if there are any policy or anything that needs to be done to support sharing, for example, with partners. And that has happened routinely. So, the osd staff, for example, sits in our twice a week update that we do in this area specifically to want to know is there anything at all needed to make these operations more effective . Weve learned how important that broader team is. Some people pay not realize how closely coupled we are from that perspective. I think, really, the last is maturity. Weve learned more in the last several months since its been announced publicly that were supporting this. Its given us the opportunity to learn, mature, plow back in. Lessons learned in a real circumstance that it may have taken us several years to learn the things were learning but its the nature of military operations. In summary, i would just say i believe were on course, fundamentals of what were doing are sound and our job is to continue to expand capability and capacity against this enemy. We will talk with you about it, give you practice examples about that in the closed session later this afternoon. General, do you have anything to add on Lessons Learned or what you see from a joint Staff Perspective . No, sir. I think most of those that i would add to were touched on by general mclaughlin. I would piggyback on and say the speed of operations and how we can especially at tactical level, something were very much focused on, overall combat operations. Weve also applied the lessons weve learned from attacks on infrastructure. And how to better protect ourselves and how better to train our people to defend against them. Okay. Mr. Smith . What do you need to do to get ready for that point to make that move . Resources, making sure that cyber com has the right resources as they build out their Cyber Mission force. As we continue to build out the pte that general mclaughlin has already mentioned, unified platform, et cetera, to make sure that they can stand alone and operate as a military force and support the combat and commanders. Thats going to be the key. Not that we cant do it but make sure were doing it in a way that we dont hamper anything we have going. And that we continue to gain advantages and do better when were conducting these operations. So i dont think theres any one specific thing that was stopping us. Its more about how we make sure sequenced to get to the right mission. What are the coordination challenges there . Now there is, obviously weve already coordinated into a central. As you look throughout dod a lot of people working on cyber. Who you do you round all that have up and get it under one unified combat and command . What are the challenges going to be into pulling in those pieces and working with them . Well, i think part of the challenge is going to be how we just work within internally within the department. I think we have a good way ahead on the principle cyber adviser, which i am. As well as my role as acting assistant secretary for policy. We work it from both those angles within the department internally. Under the joint staff and as a commander, they work very closely with the other combat and commands to make sure that all the operations are integrated and coordinated. And then we, in policy, also work across the interagency and across the Intelligence Community to make sure the operations are coordinated and the sequence of activities, whether its the application resources or training or other operations are coordinating. And what, if any, role does the nsc play in your Cyber Operations . This is a subject thats come up in our hearings, the increasing role of the nsc over the top of, in some cases, the department of defense. How are they involved in that . If theyre involved, how much do you integrate them . Its an integral part of the whole solution for any of our activities. And so we keep them advised of the operations that we have ongoing through the interagency process. We also, when necessary, coordinate and get permission to run operations when his permission is required. Thank you, mr. Chairman. We may want to pursue that further. Thank you, im very grateful to the chairman of the committee with extraordinary staff that have worked with everyone here. Kevin gates, katie sutton, lindsay cavanaugh. Its been a remarkable exercise bipartisanship. And im particularly grateful subcommittee members here who have been so important. A superstar, coming to every meeting. Im so grateful for our other members here, doug lamburn, vice chairman trent franks, duncan hunter. But its just been terrific to work with each of you. Its been so meaningful on Cyber Operations. What can be done. But the dangers to the american people. In fact, general mclaughlin, what are we doing to make better use of Coalition Forces and capabilities in the planning and execution of our cyber Space Operations . How are we aligning our capabilities with our nato allies . Mr. Wilson, thank you. Before i answer your question, we also appreciate the great support from the subcommittee and agree that your staff the staff supporting that has been outstanding. Theyre very knowledgeable and helpful as we work together. The ability to integrate our Coalition Partners into our operations at u. S. Cyber command is critical. We have broad latitude and authorities that have been granted to us for that partnership. They are actually primarily today with our partners, we are working and do communicate with nato. Right now our focus has been our partners as well as there are some other partners that are really interested in how they actually create the capacity to have their versions of Cyber Command and to do, you know, military Cyber Operations in countries that are still, i think, at the verge of trying to decide whether theyre going to take the same steps that weve taken. Types of practical areas we work today with our Coalition Partners. One some members of the committee congressman lansoven were down last week. We have Coalition Partners in those sessions, training with our people, learning lessons, creating tactics, techniques and procedures jointly and also practically identifying and overcoming any challenges that limit our ability to work together. There are key areas where we are doing development of capability together instead of each of us spending the same money to accomplish a certain task. For our close partners there might be times we share a burden or do work like that together. And then when directed and when authorized, if we have operations where we can actually we have a partner that can bring a capability or capacity, we are operating with those partners with shared objectives operationally and conducting operations in a way that each of our, you know, National Capabilities are coming are being used to accomplish objectives that we share. I think its a robust environment right now. Its growing. I think youll see more and more countries want to be part of this partnership. We will embrace them as they show interest. And as they have the capability to partner. And we have a longterm allies of nato. Its exciting new members such as slovakia, visited different i. T. Centers there. Very talented people who will be very helpful. Additionally, general, how good is the Current Training exercise and certification process in re approximate. Licating the real world challenges using Tactical Operations, Cyber Command has recently completed a cyber guard 16 exercise. Are there any lessons or highlights from that exercise that can be applied to our ability to effectively apply Cyber Capabilities to Tactical Operations . Sir, thats also a great question. So, i would answer you in two ways. We have the ability. Cyber guard is a great example to do high fidelity, highly realistic training where our teams, our Tactical Forces can be immersed in a simulated environment that looks real to them. And have to perform their duties with an actual opposing force. Another group of people that are acting as if theyre the enemy. And they have to demonstrate that they have the ability to do their job in that realistic environment. So, we can do that. Were doing it down in the suffolk area right now. The issue we have, we cannot do that at scale. We have the program. We mentioned in my opening comments the persistent training environment. That is a focused effort in the department of defense to allow us to actually do that type of training routinely. Every week, every day so that the men and women on our teams have the abilities to do the level of training were doing down in suffolk right now. We only do that a few times a year. Our job is to do that consistently in every other domain. My time is up. Mr. Langechlt vin. Appreciate the work youre doing, full committee level, mr. Smith, Ranking Member and i agree with my chairman of the Sub Committee now, mr. Wilson, that its been an exercise in bipartisanship and deeply appreciate the work of the staff. Secretary atkin, thank you for your testimony today. Along with you, general mclaughlin and general moore. Thank you for what youre doing on cyber and, again, being here today. General mclaughlin and general moore, as we have discussed this morning, the cyber guard home defense Training Exercise just concluded. I was very pleased to be able to attend that exercise. I very much enjoyed being able to witness the exercise take place in person. I was very impressed with what i saw. I wanted to thank you all for being such great hosts for that exercise. Chairman wilson had asked, not surprisingly, were on the same page. I wanted to know what your takeaways were from the exercise at the highest level. So, anything else you want to elaborate on Lessons Learned from the exercise, feel free. But i also would like to know beyond that what lessons have been learned with respect to the Cyber Mission forces executing operations in a geographic combat and commanders area of responsibility as they pertain to each mission. And our roles and responsibilities of involved entities being refined and solidified as well as command and control of cmf. Congressman, let me just take both of your questions. I think we, on the first question about highlevel Lessons Learned that we have seen coming out of this years cyber guard, while the full report will be written in the next few weeks, we do have some initial broad insights that come from it. One is an increasing understanding of how many of the other partners so, as you mentioned, that is a whole government and International Exercise that simulates some attack of significant consequence that occurred outside of the dod networks. Whats really been interesting in our lesson is how many players, both within our government, within industry and within and i mean broadly beyond dod, within our government and Coalition Partners are coming to this exercise. It continues to grow because its an opportunity to tease out not only practical technical ways for our teams to defend and respond but those complex challenges about how different parts of the federal government coordinate in response and how does that work. How do we work with industry. You know better than most the complex issues associated with Government Forces actually connecting with industry, cyber terrain and how we should do that most appropriately and most effectively. And how we do that at scale with our partners. So, that continues to be a key lesson for us, the scale of people that want to participate. And every time we think weve reached the outer limits of who ought to be there, we realize there are more players that can or ought to come. And then the last thing, really, just to reinforce the question from mr. Wilson, the need to be able to train at the level, the men and women that are down at cyber guard are asking us, you know, we would really like to have this capability routinely. This is great training. Most of them say its the best theyve ever had. Our goal is to let them do the best all the time. Thank you. I think your question regarding what have we learned in terms of how and our mission of supporting combat and commanders, broad lessons that we learned and are we adapting to being innovative . We really just started with what we thought would work. And whats been very interesting, and i think a positive step was the department, often led by general moores team down in the joint staff, has continued to lead and ask how do we refine, change and adapt our command and control processes . We have made a number of adjustments in the last 18 months. Well talk this afternoon. Weve made chang changes in how we command and control our forces in the counter isil operations. So, we really are learning and changing a lot. Theres no one saying thats the way weve always done it, because the way weve always done it has only been two or three years. We are changing as we need to. One thing i think is a key tenent that all of us need to understand, and were seeing this play out in the support. Cyber capabilities arent just there to solve cyber problems. There are adversaries that present themselves in a variety of ways that we could hold at risk. They might have a cyber capable that i will use some other tool or capability to counter. And they may have a noncyber capability that were going to use a cyber tool to counter. That is one thing that i think the whole Department Department is learning. We bring whats unique that we can offer to our mission as opposed to defining problems as cyber only. Thats been a key lesson for everybody and a powerful one for the department. Thank you, general. Thank you and your team for the work youre doing. And i was very impressed, as i said, the cyber guard exercise. Training, training, training, i agree, has to be a key part of us doing this, Going Forward and seeing that persistent training environment be maximized and supported in a very robust way. So, thank you mr. Chairman. I yield back. Thank you. Mr. Lamborn. Thank you, mr. Chairman. Thank you all to your service to our country in various capacities. Im going to build off what representative langevin was asking. General yenstoltenberg said a cyber attack could trigger a response by nato using conventional weapons. Thats nato, not the homeland. In this fastevolving field, what can you tell us . What are you in a position to state publicly are the evolving rules of engagement where something would trigger a Cyber Response from us or a kinetic response from us . As ive said before, its a whole government response. Cyber response or cyber attack would not necessarily mean we have to have a Cyber Response back to that. And each of those actions would be evaluated on a casebycase basis by the entire interagency and the government. We would look at any cyber attack by a combat and command overseas or here in the homeland on a casebycase basis and determine the significance of it was and use a whole government approach, whether diplomatic means, economic means, Law Enforcement or military action to respond to that. Anything to add to that, generals . For our mission, as the general mentioned, job one is defending the dod information network. Thats ongoing 24 hours a day, seven days a week. We have all the authorities that we need today and are growing the forces. So, any threat that manifests itself. These are short of attacks, formal attacks or wars. But they occur all the time. And so the authorities we need within that domain, which is our main defensive mission set, we have those authorities and we spend a great deal of our time, daytoday managing and responding to a breath of those activities. In our closed session later today well give you insights into the scale of just the daily size and scope of what that looks like. And then a specific example of the operation we conducted recently against a very specific threat so you can see that, you know, a little bit more. Thats reassuring to me. Im sure its reassuring to everyone who might be listening. Changing gears, before my time is up, in israel, they are doing more with collaborating with the private sector and consolidating everything that theyre doing into one location for synergy. What do you see as the future of collaborating with the private sector here in the u. S. With places like Silicon Valley, seattle, et cetera, to harness the public sector, creativity, expertise in this area . What do you see as the future of that . In that regard, the future is here. We are integrated in with the private sector well. Were going to continue to grow that, whether its through the Defense Innovation unit, experimental out in Silicon Valley, that secretary carter stood up. How we lercveraged the skills tt the National Guard and sources bring and we leverage those skills as integrating those folks into the Cyber Mission force or continue to work with the private sector in response to Cyber Attacks through exercises such as cyber guard. So, we already are working with the private sector pretty well, i think. Were going to get better at that. And were leveraging the skills of the National Guard and reserve folks as part of the Cyber Mission force. But you dont see anything in the works like what israel did, for instance, where there would be an actual consolidation into one location . That is a much smaller country, obviously. Right. I would say that i dont see that. No, sir. I think we have good coordination and collaboration through the department of Homeland Security, fbi, department of justice as well as the other sectorspecific agencies, commerce, et cetera, with their sectors. But i dont see us consolidating all those activities under one into one location. Thank you so much, mr. Chairman i yield back. Critical infrastructure that would threaten public safety. I wonder if you could talk about that and whether the dod and National Guard would assist in responding to that type of attack as well as what actions are being taken to eliminate those vulnerabilities and to make it so that these types of attacks are not possible. Thats a great question and great challenge for our country, how we protect our critical ininfrastructure. We work closely with the department of Homeland Security, and have that responsibility to not only provide them with information regarding threats, but to help define how we would respond as a nation to an attack on the Critical Infrastructure. Where dod gets involved is an attack of significant consequence. We have the responsibility to defend against an attack of this significant consequence. How do you define significant consequence . That would be determined by whether loss of life, physical damage, Economic Impact or how it might impact our Foreign Policy. Those are some of the factors that we would evaluate. Of an attack of significant consequence. Could i just ask a followup to that . Yes, maam. As you define loss of life, if there was an attack on electric grid, caused a major power outage, hospitals no longer able to care for people and loss of life in that respect, would that fall under that definition . I would have to see im not sure i could answer a hypothetical like that. I think that the factors of the impact would certainly be evaluated or determined. Regardless of whether its an attack of significant consequence or not the department of Homeland Security would respond. If they needed assistance from the department of defense, they would ask for that assistance and we would respond with assistance through the department of Homeland Security to help that critical inf infrastructu infrastructure. Part of that occurred in cyber guard where we exercise that capability, request for assistance from the department. And we respond. So, the other piece of that is the National Guard. They have Cyber Mission capability. They are being trained to the same capabilities as the rest of the title ten force. They can respond under their own state authorities. We recently completed coordinate, train, advise and assist policy within the department to allow National Guard troops to use the department of defense resources to respond to a cyber event under state authority. And were continuing to work other policies. I just recently set up a meeting to work with all the different combat and commands, Cyber Command, joint staff and office of general counsel to determine exactly how were going to set up our defense support of similar authorities. More holistically, the policy has been in process for a significant time and we want Senior Leadership attention on it very directly. Thank you. I think this is something that, obviously, were going to have to continue to discuss and understanding the differences of whether a state or nonstate actor were to come and launch a traditional type of military attack on Critical Infrastructure versus a cyber attack how the dod is involved or not in those situations. You know, given the types of attacks that we are already seeing from both state and nonstate actors in the cyber world, you i agree. Thank you, mr. Chairman and thank you for testifying and your leadership on this issue. I want to focus my full questions on the panel and the evolution of the cyber threat and how we maintain the edge on a 21st century battlefield. News as you know has been filled with stories about the evolving strategic threats in the cyber recommend like russia and destabilizing threats from both state and nonstate actors within this week. Just this quadriplegic i read that theyve been covering reports from around the world. In march at a hearing on this subject i asked admiral rogers how confident he was moving forward that our Cyber Capabilities were robust enough to face the few tu on multiple fronts. Can you speak specifically to your concerns about adversary Cyber Capabilities and your comparison in moving forward and the second part of my question is given the unique challenge of prosecuting sigh mustainous threat wrrks do you feel its seeing risk for readiness . So, maam, were not going to address that. Well get into it when were in the closed session, but broadly you stated it correctly. The threat today is diverse. It certainly is representative not only by large nation states that are very, very capable to organizations like isil or criminal or hacker organizations. Ta barrier to entry is not that high and the ability to innovate and use technology to continue to evolve is actually there. We on the Cyber Command side, i this i the key thing we think is important is focused people and technology. Ill do technology first. The ability to have the tools and the capability and sort of an integrated suite. An indepth approach across cross our whole enter prove has proven to be very effective, and the ability to bring new technology, thats one of the richardsons for the connection to Silicon Valley. Thats why we feel its so important. We dont feel the secyber cap capability will be just for now. Its critical. The most important part, though, are our people. The reason weve talked about the persistent training environment. We havent even talked about the foundational training that goes into the Cyber Mission force and some ask why does it take a if youres to take an initial session and get them to that level is that were training all of our people to a very, very high standard, a joint standard across the force. In our view its in the minds of our people that are going to allow them to keep up technologically with what the threats are doing. Were not just training our folks to operate equipment. Were train them to underthe domain, the foundational technologies, the advanced technologies, and in some cases theyre advantaging the technology theyre having at their fingertips to counter their adversary or develop tools to do that. So i think thats the most important part for us to stay ahead is making sure we invest in the people and have those types of skills. On the multiple fronts portion of the question, given the fact that there are multiple Cyber Threats whether there are those in the middle east, where do you feel it is assuming risk to readiness . I think the way im going to answer your first question if im broadly assuming, risk to military force broadly. Cyber is a thread through everything we do, our platform, networks, our own Critical Infrastructure within dod we cant defend everything all the time at the same level. The way we approach this broadly with the department, this is not Cyber Command decision of our own makes. Give it the most important combat capabilities that need to be hardened and defended. Where the Mission Assurance is most critical. We dont think about doing that against oneone threat. We defend it at the highest level and we would accept risk if it were not as important or something we felt was lower on the priority because you cant defend all of it to 100 all the time. Thank you. Do other witnesses have would you like to add anything . On the risk measurement i would say we evaluate the Critical Infrastructure thats required for the department using our Mission Assurance strategy and our Cyber Strategy combined to identified those most critical elements of the inf infrastructure that we need to protect and then we evaluate and prioritize those pieces wchlre not only protecting them from physical damage, but now were also mapping out the key siper terrain to understand where the most critical vulnerabilities are. Thank you. My time has expired. Mr. Ashford . Thank you. Id like to second the comments regarding it on the emerging threats. Its been a very interesting year and a half. I have two topics id like to cover. One is deterrence in the cyber world and then secondarily the Information Technology Exchange Program and how you see that evolving. If i could start with general mclaughlin on deterrence. When were dealing with what the public generally thinks about in the deterrence area, were talking about Nuclear Weapons. In this case, were dealing with cyber. We know to a certain extent how many Nuclear Weapons are out there. We can identify the specific threat and we have decades of experience in dealing with deterrents as it relats to Nuclear Weapons and other Matters Regarding deterrents. In cyber where we have 80,000 or so attack as year and we have its hard to identify where theyre coming from and who has the capabilities at any given time, its very dynamic, and youve talked about that, can you just kind of define for me what deterrence means in the cyber world and how thats evolving . I can jump on that a little bit. From a cyber perspective as we mentioned before a cyber attack doesnt always mean a Cyber Response. Attribution is key. And thats probably the greatest challenge in any cyber attack is attributing it to either a state actor or nonstate actor. We look at it as we want to make sure from the assurance policy its declare torrey, that everybody understanding exactly where we stand and were able to impose costs. So the first part of any deterrence policy and our deterrence policy is denial. We want to make sure we deny the adversary to achieve the effects theyre trying to achieve by developing and having good Cyber Security. The next thing we want to bible to do is have a very resilient system. We want to build a resilient system and if they are attacked as general mclaughlin has already said, we cant protect everything all the time, but if they are attacked, that theyll be able to recover and be resilient and back online, denying the adversary the goals theyre trying to achieve. And then the third step of our deterrence policy is to impose costs. Whether its diplomatic, Law Enforcement, economic sanctions or military actions to include Cyber Response. Those are part of the deterrence policy we would use to respond or to signal to a state or nonstate actor. General. Sir, just in accordance with the direction we received from osd. Mr. At kin mentioned the secretary signed there are new dod strategy. Within that there was direction for us to actually take steps to meet those three goals, and our primary effort has been all the defensive activity and the work we do to make our work more resilient and to make it where an adversary couldnt achieve their goals against our that they might try to achieve by attacking our cyber infrastruck tu. Many people dont think deterrence involves thaw, but its really been the anchor of what were doing, weve been ordered to do and were accomplishing within the Cyber Command. Its aimed at bringing options to bear that would be there for the secretary and the president if that was directed. Thank you. Let me could i just ask a question about the Information Technology Exchange Program . I believe in the ndaa we expanded that program a bit and added more slots. Is that program so take, for example, the sony case where there were issues in the Sony Technology that made it easier or less difficult to attack the Sony Technology, whether its the silos of the various businesses within sony or whatever it is. There are issues in the private sector that are different from dod sector and federal sector, and theyre diverse. It depends on the industry and what they do. So is the purpose of the information of the Technology Exchange program to help to put in place people into the private sector directly torque help them with that, and then vice versa, to deal with those threats, and then vice versa, to if theres somebody in the private if i understand this, in the private sector, we have someone whos really exemplary or efficient in the Cyber Security that we can bring those people in on a temporary basis to address those issues that we see. Is that is that essentially what were doing here . Sir, ill have to take that question. Im not familiar with that program. Aside from that program are there others in place to allow us to bring private experts in the private sector into the military on a temporary basis and vice versa . Is that par of what were doing . Maybe misunderstood the program. Im not familiar with that. I know the secretary has talked about that as part of the force of the future, some of the changes, so i know thats something hes beginning to talk about and as we move forward. What i would say is we try to leverage the skills from the private sector through our National Guard and reserve forces as we mentioned earlier and the skills that they gain in the private sector and we also do things like the bug bounty where we actually have hackers come in and take look at our dod systems and see if they can hack those systems some of there are different ways were trying to leverage the private sector to improve our own Cyber Security. Thank you. General . Sir f youre referring to the Cyber Security information sharing act, i think thats what youre referring to right. That the government has passed. That has gone a long way. The two main benefit os that act are that it first off reduces the risk of any legal liability to any of those Industry Partners we have when they share that information and also decreases any economic or business advantage that might be gained through the act of sharing that type of information. So its really knocking down a lot of those barriers. Thank you, mr. Chairman. Mister rogers. Thank you, mr. Chairman. This would be a question for all of you. Do any of you believe that the department of defense should use equipment provided by wowway or zte, each who have links to kmie sneeze military apparatus and illegal sales to iran and in violation of u. S. Sanctions . Sir, im not familiar with those technologies. Certainly we would want to take those factors that you just high lighted into consideration if we were us go to use anything like that, and thought would probably be the risk would have to be evaluated based on those threats and whether we would use those. Youre not floor with them. Ive about heard of them, but im not a technical expert to make good decision. So, sir, i would just say so i have heard of the First Company that youve mentioned, but what i would say broadly is all of the ee kwimtd that we use or field as par of our dod mission, you know, its heritage and the supply chain, its important that we assess based on the equipment, we assess what vendors are appropriate and which ones should be. Siem not prepared to tell you because i just doan know what exclusions might be there for both of those companies broadly across the dod, but i know for our core capabilities before we buy it, we buy that capability, its security and its our knowledge of the supply chain go into the factors before we make up a broader procurement. General . Just piggy backing on what the two gentlemen said, theyre real and they should be considered any time we look at a purchase marked dod or the federal government. That with relation to dod, what about a u. S. Cleared contractor . Do you apply a different standard to them . What would you advise them if they were thinking about using equipment for one of those two chinese firms . Sir, im not again, im not on the acquisition side, and i know that we work very closely on the acquisition side with the contractors through the Industrial Base to ensure that their systems are secure, so were always looking at the supply chain vulnerabilities and the risk, and so our advice to any of the contractors that support the department of defense or any of the inner agency, i think we recommend to take a hard look at their supply chain vulnerabilities and make sure their information is secure and their operations are secure. So i guess im hearing from you all that you dont have a list of chinese firms that youre concerned about right now or you have a list, youre not familiar with it. Sir, im not familiar with the list. Do you know if you have a list . I do not, no, sir. And we can state that for the record. General mclaughlin door you know if yowl all have a list of chinese firms youre concerned about having access to your supply chain . Sir, i dont, because its all handled within our acquisition chain of command, the folks that actually procure our equipment which is outside what we do at Cyber Command. If you could do it for the record i would appreciate it. Thank you, mr. Chairman. I yield back. Ms. Mcsally. Thank you. Im not sure if you answered this. I was at a Homeland Security briefing. I do want to talk about the Cyber Operations against i says starting a few months ago. The caliphate was declared two years ago. I know probably the details would be more in a classified realm, but this is a very important domain and this terrorist organization is using sign never a way weve never seen terrorist organizations use it before and what took so long. How come it was two years before we even would think about fighting in this domain . Maam, thats a great question. I this i the bottom line is that we probably started more than two months ago. I dont have the exact date and time that we began to conduct Cyber Operations against isis. We continued to respond to isis and their both the social media, the information about military and their families ochl so it wasnt always a Cyber Response to isis but certainly a response to their cyber activities. I know theres this tension. I was in the military keeping calms running so we can collect versus taking them out so they cant communicate. We know cells in raqqah directing training and operations very specifically charging against americans in real life. Why doesnt the internet shut down a rocket. Why did we not have operations two years ago going against their commanding control as part of our centers of gravity and using all elements of military power to take them down . I know theyll get more into this in the closed hearing later today. The fact is we may have been going after them but we didnt necessarily use cyber activities to do thachlt theres also balance between collecting information and shutting it down. And certainly going after specific nodes to hamper and stop the use of the internet by isis is important, but we also have to respect the privileges and rights of citizens to have access to the internet as a whole and as a country. So its a careful balance even in raqqah or mosul or anywhere on how we balance the need or the rights to have access to the internet versus the use of the internet illegally by folks like isil. Id like to follow up for sure in the classified setting with a little more details. The second question is we were dealing with my last assignment was at after ka command, trying to deal with the functional commands and gee graph contact commands. Can somebody speak to how the relationship is working and is their duplication of Cyber Capabilities at the geographic command as hound does that work if youre working with operations . Yes, maam. I think its working pretty well and i dont see any duplication right now. When we later well give you some great details with regard to u. S. Central command. But generally each of those commands have a cyber element thats at the cyber level and their job is to understand it. With very the forces that are actually both defensive and offensive forces that theyre using, so the practical way that its working today for example in real world operations is we have daily, you know, whether its targeting meetings or planning sessions where the supportive commanders are acting routinely. Our job is to support them. And, you know, we deliver the effects on the targets that i need at the time they need. We bring it with the capability. Thanks. The last question is about the laws of iran conflict and the challenges weve had in this domain and identifyinging whats an armed attack and what constitutes the ability to respond and all that kind of stuff. Can we have some comment on where we are on that and whether theres still some further definition that needs to happen versus the clear authorities that are needed to operate in this domain . Id say specifically to your question what defines an act of war i think is what your question is regarding the cyber act thachlt has not been defined. Were still working toward that definition across the interagency. As far as an attack of significance consequence which do would respond to in the home land, we dont necessarily have a clear definition that states it but we have loss of life, economical impact and Foreign Policy some of there are some clear lines in the road where we would ee vanilla yat any specific cyber act or incident and how we would respond to that. Great. Times expired. Thank you. Let me follow up on a few things. If row arguing that is state extends of rocca have some sort of inherent right to access the internet that you all have to try to weigh . What im trying to explain is when we talk about taking out the internet, there are always challenging to how you do that and where you do that in space some of the Internet Service providers who provide that enter net service to a a region are much broader oop. So how that occurs has greater impact against the adversary and we have to weigh that in when we make our decision. Whether thats a kinetic or Cyber Operations those factors are always weighed in and the impact is very populous. Sfloo i think i understand. I got concerned for a second that there was some sort of inherent right to be on the internet that was a factor in your alls decisionmaking. I want to go back to the generals support in decisionmaking and when youve got to keep them informed and when youve got to get permission. Theres been a fair amount written about the air campaign. And i quoted secretary worker ler who said just like we have an air campaign, i want to have a cyber cam bane. Some of the things that have been written about the air campaign are that for some sorts of so weve got airplanes circling above iraq or syria for some sort of attacks, a certain level of command can make a decision, say its okay to drop your bomb. Others have to go up to sit come, some have to go to the secretary, the president , meanwhile the planes there circling. And one of the challenges to being more effective against isis is this multilayered decisionmaking process which has slowed down or hindered the ability of our military to be as effective as they could be. Now, thats with bombs and air campaign. Im concerned, i guess, that we are developing the same sort of multilayered bureaucracy decisionmake progress says when it comes to cyber, which and part of the challenge with the air campaign is by the time you get permission to do it, the target is gone. And i have personally talked to pilots that have had that happen. Now, when things are moving at the speed of light, if we go through this multilayered decision process for to push the button on a Cyber Response, then were going to be hopelessly behind. So i guess if anybody can address where we are with this speed of bureaucracy matching the speed of the world that would reassure me, i would like to hear it. Yes, sir. What i would say is in the area of hostilities, cyber come has the authority in which to conduct cyber effects and make that decision at the cyber come level. So they certainly have those authorities to do that, and i think they can talk more in greater detail in a closed session tonight or this afternoon on the specific authorities that they do have. Okay. Well talk more about it, but, again, just drawing the analogy to the air campaign, im not yet reassured. Mr. At kin, i want to follow up mr. Lamborns question about the nato announcement last week. Does that nato announcement indicate nato has agreed that a cyber attack can trigger article 5 . That is my understanding. And so then the question for the nato nations is going to be at what level of cyber attack would trigger article 5 because there are at least media reports of a fair amount of constant cyber activity in some of the baltic and Eastern European countries coming from the east. Right. As far as i know, there has not been a determination made oar a decision made on what would constitute a cyber attack that would trigger article 5. So i would have to take that one for the record. Okay. And, finally, the questions that mrs. Gabbard was asking about authorities and a gap of physical consequence, is one of the factors that would be considering in determining whether its an attack of significant consequence, who the actor is, whether its a state actor or not. That could be a factor, but i wouldnt say its one of the primary factors. The primary factors are loss of life, economic imparkts how it may impact our Foreign Policy, and then physical property. So those are the four primary factors that we would evaluate from an attack of significant consequence wlrks thats a state or nonstate actor. I guess the question that would come to my mind would be as it relats to terrorism information we may get information that a terrorist attack is in the works. We dont know exactly what the target will be. We dont know exactly what the consequence will be. And if you have to wait to see what the consequence is, then its going be too late, right . Thats right. Id also say its similar to a cyber threat. If you have an unknown if you have a known i guess ill back up. If you have the potential for a cyber attack, but you dont know where its coming from, you dont know whos going to do it. You certainly would alert people to prostliemd an opportunity to maybe heighten their security just like we do in the physical world with a Terror Threat when were not exactly sure of the where or when it will happen. It is similar, but we cant necessarily if we dont know where its coming from and whos going to do it and how its going to happen, its very hard go in and then stop that from happening. No, i understand. I guess and i realize you dont want to get into hypotheticals. My concern is we know where its coming from. Country x, y, z, who has tremendous cyber capability is preparing to do something, and the question is whether we wait and let them do it or try to at least take defensive action to manage the consequence of it. And to me thats where this gets very difficult. I understand, you know, if we know its going have significant loss of life, yeah, thats pretty easy. But if we see and i guess i would say the difference is we knee isis is going to do whatever they can get away with. So theyre going to use their full capability to kill as many people as they possibly can. We dont know that about some state actors who have tre membership does cyber capability. And so waiting to see how much of their capability they will use and how that fits into the standard of attacks of significant consequence seems to me to be somewhat problematic. I think weve surpassed one another a little bit. The first is how we respond to an attack and when we respond, how we respond versus making sure we have a good Cyber Security posture to make sure were defended prior to an attack, so certainly theres we would not necessarily evaluate the potential before it happens. We would go ahead and provide defensive measures through dhs with dhs to help prevented an attack. And then we evaluate after an attack happens. I realize these terms okay. So were going to wait back and defend but not take action to defend the attack to begin with, so the definition of offense and defense in this situation gets a little tricky. And im not trying to pin you down. For some of the complexities of this these challenges. Certainly a known threat coming from a known actor that we know will is coming after the United States, i would say that we would certainly evaluate that and those decisions would be made by the secretary and the president and what kind of actions we would take to stop that from happening. That would be on a casebycase basis. Okay. Thank you. Mr. Langeman. Thank you. I would go back to the training environment again. General mclaughlin, the house and Services Committee and you know fully funded the persistent training Environmental Initiative and i understand other committees did not provide full funding. My question is can dow provide the proposed cuts and what state has it been in . Has it been fully approved by the joint staff . Sir, if its okay, aisle attempt to answer that question for you. Sure. So as was indicated earlier, it gives us things we dont currently have like on the joint operations ranges. We dont have the scale to truly represent truly and realistic event. So thats the big advantage that it gets us. As the name indicates, it ee pertinent. Right now the official capability document is under review. It should be signed in the next one to two weeks. If that happens, we should expect to have an ioc by fiscal year 19. Thank you. I know weve talked about this on some point, but general mclaughlin and general moore, what role does the Cyber Threat Intelligence Integration Center established in 2015 play in support of Cyber Operational planning . Sir, in terms of Cyber Operational planning, in our daytoday operations at Cyber Command, its not playing a role in the planning side. Its mostly playing the role of collecting integrating intelligence and integration on what the threat is doing and then at times providing you know, providing information back out to the rest of the government operation centers, but theyre not playing any operational planning role in support of u. S. Cyber command missions today. Very good. Thank you. And general mclaughlin, let me ask you, what lessons have been learned about the construct of the Cyber Mission force over the last year . Is the force mantrained and equipped and postured correctly to address threats in their respective Mission Areas . Sir, i believe weve learned that its manned and equipped properly and postured to respond. Some areas, we have learned, we think in the spausz, agility is really important and we found in many cases we have task organized sub elements of teams. We will each of those teams is comprised of specific sets of skills, and weve learned that its very effective to take sub elements of certain teams and task organized them against a problem set and leveraged smaller more average el moneyments of those teams, whether they be defensive or offensive teams to provide you more tailored mission capability. We had very innovative commanders that use thad approach. We have used it in other dough may f domains. The basic Building Blocks we think are sound but at times we might source it if a specific problem. Very good. And going back to the in the concept area of the cyber guard exercise that we just had, if we have oddscale cyber attack that leads to infrastructure damage and dod is called in to assist, what organization within d will take the lead, and in this scenario, what will north comes role beand how is dod getting ready to assist after such an attack . So, north come would obviously in the case of a defense authority, they would have command and control response. Cyber come would be in support of that. It would could be road clearing. It could be helping to transport something from one to another. That could be a north com responsibility and if its a Cyber Response, it would be cyber com. Thank you bchlt ever my times about to expire, in terms of the for the record, building out the training environmental, what is still needed, and how can we be of assistance further . So, sir, right now the main thing needed is the broad four elements of the training environmental. We have some parts of it. We have one part of it which is the event side of it where we plan all the training events that would need to occur globally, assess the performance of each of the players that are being evaluated. Where our dresser force would reside. Its really all the things that might training. That is one of the key things that the fiscal year 17 budget request is the first real year of commitment to that funding is building the Technical Capability. What we were trying to build is the foundational Technical Capability to do that routinely at scale and to have the people there that actually provide that training. Thats what we want to get started on really seriously in fiscal year 17. We look forward to continuing support you in that effort, general, as you build that out. For your me it was time well spent going to see that exercise, and id encourage others to see the same. And with that, thank you, and i yield back. Ms. Waroski. Thank you. I understand that ta youre not involved with the acquisition side of the business, from a signer perspective, how concerned are you and what can we best key dend for how can we best defend those threats . As mentioned, we second tanltly and consistently look at our siper chain vulnerabilities and ee vat yat working with our zril based partners that provide resources for the department on different vulnerabilities and how we would stop those vulnerabilities to make sure that the only equipment that comes into the supply chain is free of counterfeit or highrisk material. Thank you. General mclaughlin, i want to direct this question to you but i want to give you this quick background. I represent the stagreat state indiana. At the training center, rotational units are able to participate in a real scenario but the most compelling is where the power grid is hack order taken offline. As i consider the devastating consequences with an attack to our grid, e oom wondering if the state department has the ability to prepare. For you, sir, you described the cyber guard and practices earlier. Ryu r yo are you fully prepare and what are the gaps, significant gaps in training if there are any . Maam, i would be able to say today im not department you listed a broad range of contingenci contingencies. In fact, id love to hear more about the capability you describe in indiana. Part of it is being able to replicate each of those unique classes of terrain, Industrial Control Systems are different than platforms. Part of what we will build are the hifi dealt rep employ kalgss of each of the unique targets we would need to defend against. Were building for them to bring their own connected into that department and then the people that actually do it have the place to sit down, plug into what looks to them to be their realistic replication of what theyre trying to defend and then do their job in a realistic scenario against hackers that are trying to do it. So today i wouldnt say we have the scale to do that range. We have a concept. Thats why were prosiding with the program to do that. It has the flexibility to sep the ability for other partners. To plug into that environment and do training. re doing it manually today at cyber guard an i think youll see us do it at scale with more than u. Schs. Dod participants. Id love for you to come and see the capability and having the resources, what theyve been able to learn, the kind of activities theyre running, and what it does for training for all of our forces. So id love to extend and invitation for you to see it for yourself. Thank you. Absolutely. I yield back, mr. Chairman. Mr. Johnson. Thank you, mr. Chairman. And, gentlemen, thank you for being here today to discuss what is really a turning point in what is an approach to our defensive military policy. Being a member of the judiciary committee, particularly the i. D. Subcommittee, cryber is at the forefront of our midnight and im encouraged to see were taking necessary steps to make sure the u. S. Is taking a compareton and competitive advantage with this arena. Mr. Ed mr. Atkin, i would ask this question. Its in relation to my colleague miss jaworski asked. With Rocky Mountains to civil authorities specifically at the state and municipal level and in consideration of the fact that u. S. Army Cyber Command is moving to ft. Gordon, i even heard concerns about how this may put neighboring communities at risk. For example, if ft. Gordon is hit with a cyber attack, is it independent enough from the local energy grid that it does not down the entire region, cetera, and what do we do to help request local authorities in the event such an attack happens . Im sorry. I meant to ask that question of general mclaughlin. Sir, im not aware of any element of the move that you just you mentioned a concern potentially with u. S. Army Cyber Command moving to ft. Gordon. Its not one thats been brought to my attention, so namet aware of any direct atekz of that move. We do step back and look broadly at the risk toll of our military installations. Many of them where using them for electricity, water, and power, but we havent seen any analysis that shows the location of military installations is driving a higher likelihood that an attack against them would have some unique impact on the local community. So im not saying that it wouldnt. Im just not aware of any analysis. I heard concerns about it from state and local officials, and i think its an area that reassurance is due at the very least. So in terms of coordinating with state and local leaders, i think that that would be something important for you to consider, and thank you for that answer. Mr. Atkin, with respect to the development of cyberrelated technology, much has been said of the need for dod to attract brilliant hacker mienl eer mind private sector. How can we in Congress Help improve the dods ability to attract Tech Startups who are leading the way in cuttingedge technology. Thank you, sir, nar question. I would say the first thought would be something that you already provided, which is the accepted Service Opportunities for the civilian sector or the civilian personnel involved in the cyber activities. The broader we can make this across the entire cyber enterprise, that wouldbe very helpful. It would be able to bring in the very smart hackers and those with a cyber background. Ive even heard the suggestion of startup incubators within government agencies. Do you see that as something that can be coordinated within dodsome. Sir, ienl not familiar with the incubator model. I know we reach out through our defense incubation unit and how we work with Silicon Valley and others. I know we level the skill sets to make sure that we those are the young smart minds that are working in the private sector and bringing expertise back into the didnt through their reserve and National Guard status. So i know were going that route, but i em not at as familiar with the incubator model that you describe. Do either yof you, general mclaughlin or general moore care to comment about that. One of the programs is the incue tell model which is actually starting a cia organization, overt. They go through the incue tell model specifically out in Silicon Valley and you think of it more of a Venture Capital ieft organization where we bring problems that we want quick hopeful solutions to. That money is invested many m times in organizations that have that. We use it to solve another specific problem and i see that program continuing grow. Its shown a lot of promise. Thank you, everyone. Our Defense Digital Service ran a bug bounty, using a hacker program. That was another model by which we did reach out to the private sector and increase the skill set to improoch our own Cyber Security. Thank you. Thank you for your service to the nation and with that i yield back. Chairman wilson. Thank you. As we conclude i think its important that kevin gates is sate seated with the chairman. I appreciate it. Kevin has an almost 20year history. Wellre just fortunate to have such great people who are assisting our country, protecting american families. General moore, what legal or policy framework of the sort evolving from tl use of social media for propaganda or recruitment. As a tactical measure, how that r they used to counter alkt social attacks . I think youre familiar with what wi oar doing. It revolves under operations to specifically get after those types of problems. We have the thormt to connect those types of operation. I dont see any limitations at this time. Indeed sadly we saw with the San Bernardino mass murder w the orlando mass murderer. There was a direct social Media Contact and availability that has resulted in mass murder across our country. I was grateful. You mentioned multiple responses that are possible. That cant be more important than right now because weve had so many incidents of sipeCyber Attacks just in the last months. The Democratic National committee came under attack. There were north korean attackers of smartphones of south korean officials. There were Power Outages affecting tens of thousand of people in the western you crane. Over and over, incidents that are just incredible and one that got my attention at the very time that the dangerous iranache nuclear deal was being put together in november 2015, irans Iran Revolutionary guard hacked the im and social media accounts of a number of Obama Administration officials if an attack. Was there any response to that attack . Im not familiar exactly with that event and what our exact response was. All of those situations that you desi design. What i would say is when were able to have attribution, we would respond at a time and manner and place of our choosing. Its so obvious. It was in such bad faith, the Iranian Revolutionary guard. To show bad fact to attack the Obama Administration that was placing such faith in them. But we certainly want to be working with you. There just has to be a response that makes sense and i want to thank you all and yield the remainder of my time. Im prompted to ask one more question. Okay, primary job of cyber come is to defend dod ned works. But in thinking about defense support to civil authorities, if there is a foreign country that launches some sort of Cyber Espionage or cyber attack against a server a private server by the secretary of state or a looking for information about a leading candidate for president s that an attack of significant consequence . Its not against dod networks, but it goes to government officials or someone whos wanting to be a government official. Yes, sir. So we would evaluate each attack, if we were evaluating them base wlond it was a significant attack on loss of life, property damage. For policy. So i would say we would evaluate each of those attacks based on that factor, whether and how we would respond. Seems to me its pretty tricky when you start into political campaigns. Say someone is the nominee for president. I was justen to adjourn and mr. Franks walks in do you have a question . Mr. Chairman, i do. But ill be brief, circumstance and i appreciate your forbearance to say the least. I didnt mean to come in usually when they walk in, they end the parties. Thats usually the situation for me. General mclaughlin, ill be brief here. In an open setting the best you can, how is Cyber Command being employed to fight against the Islamic State . So, sir, you know, in this setting and again well get into more detail with you in the closed session, our organization and the teams, the Tactical Forces that are within u. S. Cyber command, a subset of those have been allocated and directed to support operations against this Islamic State. Were operating in support of u. S. Central command. It is, you know, a focused activity thats occurring and that its a major element of what the command is focused on day to day. We have Leaders Within our organization, that its their only job. And were bringing every capent that we have in this area that are available to us or make it available to that fight. Are there any restrictions or that might be called rules of engagement or anything like that on how the command might be employed against the Islamic State in any restrictions . Well, sir, mr. Atkin described the operations. We have the adequate authority to operate. Theyre subject to the same rules of every operation. So were only constrained by the law of our own conflict and other lematiimitation. So within the operation, we feel like we have the authority and flexibility we need to support that particular operation. My last question, mr. Chairman. We know a little about the cyber doctrine and military structure of adversaries like russia, china, and others. What is our limitation with respect to iran, italy, or germany. I would say in this setting, what we know about the Cyber Operations of our adversaries, most of them know realize its l they can use. Its a power. They can have a relatively small number of people or buy expertise. Our coalition partner, many of them are on their own looking at Building Military cyber capability and we partner with them closely. They visit. Theyre looking for advice from dod and the United States and to the degree they want to come see us, we routinely meet with them and talk with them and tell them how they can be pa rt of a Broader Group that defends themselves and operate in a cyber space. Thank you, mr. Chairman. I yield back my 1 54. Thank you all for being here and for answering our questions. Well look forward to seeing you later today. The hearing stands adjourned. [ indistinct conversation ] [ indistinct conversation ] [ indistinct conversation ] [ indistinct conversation ] [ indistinct conversation ] cspans washington journal live everyday with policy issues that impact you. Coming up thursday morning, Virginia Republican congressman dave brat will be on to discuss the fiscal challenges facing congress, hes also his thoughts on the Political Climate and campaign 2016. Also Michigan Democratic congresswoman Brenda Lawrence will talk about the latest on the flint michigan water crisis. Shell discuss a letter from the epa to michigan Governor Rick Snyder and flint mayor karen weaver calling on flint Administration Officials to provide stable, reliable, and Quick Support essential to a well functioning drinking system. And michael geary, Global Center fellow at the Wilson Center about the brexit. Be sure to watch washington journal beginning at 7 00 a. M. Eastern thursday morning. Join the discussion. On thursday, voters in the United Kingdom will decide if their country should stay or leave the