Transcripts For CSPAN3 Key Capitol Hill Hearings 20150910

Izibility of security. And in every document that nato puts out, we talk about this again and again about indivisibleity of security. Saying all that, the Alliance Still goes at Great Lengths to endorse and support and embrace arms control. And the reciprocity aspect of that. Even the most die hard official within any government in the alliance that believes that we should eliminate all Nuclear Weapon weapons they do it only in the official context of reciprocity and quid pro quo that we would not eliminate our Nuclear Weapons, would not reduce our Nuclear Posture except in a process of discussion and negotiation with russia. In the last summit the alliance again stated that they looked forward to developing various transparency and confidencebuilding ideas with russia and the federation in the context of a nato council with the goal of developing detailed proposals and increasing mutual understanding. They continue to believe that this partnership between nato and russia, based on the respect of international law, is of Strategic Value and continues to aspire to a cooperative, constructive relationship, but one thats reciprocal. The flip side of that is, as theyve said, in the wales summit, is that Current Conditions do not exist to allow that to continue. And then the alliance decided in essence to suspend all discussions with respect to the Nato Russia Council. When i was there i chaired something called the Nuclear Group. That Nuclear Group developed a series of confidence Building Measures that were shortterm, midterm and longterm. Among those were discussions on nato and Russia Nuclear doctrine. Those discussions that were candid and were very open. It was a very constructive dialogue. Nato on its side was pushing to have russia provide information on their tactical or nonstrategic Nuclear Weapons, which they refused to do, but they were still willing to talk about doctrine and do it in a classified environment. We had three of those meetings. We also dealt with safety and security of Nuclear Weapons, and that process each Nuclear Weapons state, which, therefore, the united kingdom, United States, france and russia, conducted very specific safety and security exercises at each at a location in each one of those countries. They were very successful and they were really eye openers for the Nato Alliance as to how these countries would conduct a response to situations where a Nuclear Weapon might have been stolen. There might have been an accident. There might have been a detonation of some sort. The followon exercise was to be a Nuclear Weapon or Nuclear Device in a country that wasnt a Nuclear Weapons state. And russia decided they or asked that it be in one of the states that were that had the dual aircraft mission. None of the states came forward to have this exercise. Another country did and the russians refused to participate. This was all happening in 2010 and 2011, and at that point there was no longer any discussion on transparency and confidence building. So im back i guess ill just close up because i think its good to have some discussions, but again as far as nato is concerned, theyre very interested and keen on having a continued dialogue on these confidence and security Building Measures. Thats not happening. And given the continued animosity and difficulties and challenges of the various accusations and allegations, i really dont see that happening in the very near future. How are we doing . I guess i can finish up by telling the story that i think aptly captures our challenges. And that is the story about two hunters that go hunting for bear up in alaska. They get up there, and theyre dropped off by the pilot in this little airplane, and the pilot says, well, just let you know, i can only take back you two guys and one bear. Three days later, the pilot flies back and theres the two hunters with two bears. And they start arguing. And he said, look, i cant do it. One of the hunters says, look, ill give you an extra thousand dollars if you take us and the with the bears. Okay. They load the two bears in the plane, the two hunters get in the plane, the plane takes off. He gets about five miles and crashes. And miracle, miracle, both hunters survive. One staggers up, looks around and says, where are we . The other one says, i think were about two miles further than we were last year. So we continue to go down that path. And with that, ill close and take your questions. Thank you. Thank you, guy. Well, we do certainly have a lot of was it the same pilot both years . Different pilot. I dont think so. We certainly have enough time for questions, and while you are all gathering your thoughts, let me just pick up on a few things. I know the agenda says that listed me as an additional speaker. Im not going to talk. Ive said enough. What im going to do is moderate a discussion and take your questions. On the Nato Russia Council, guy, even if nato were inclined to resume some of those activities, do you think the russians would bite . I dont thing so. And part of the reason is, surprisingly for an alliance actually it was a year from last year. There are some very, very Strong Language that made it quite clear that theres no longer going to be business as usual with the alliance. For example, quote, russia has breached its commitments as well as violated international law. And thats a very big thing for europeans. Thus breaking the trust at the core of our cooperation. And they lamented the fact that for two decades nato has gone to extraordinary lengths to embrace this relationship. But as i said, talking seriously about them becoming a member of nato. And as a result of crimea, as a result of the activities in Eastern Ukraine but also the things theyve done and threatened to do in georgia and moldova and just a whole litany in fact, if you go on the nato website, theyve actually listed the 25 years of mythical crimes that nato has committed against the Russian Federation and responded to that. And its a long, long list. Everything from nato promised that we would never deploy forces in Eastern Europe to we violated the Nuclear Nonproliferation treaty by training pilots to fly the Nuclear Mission. And just goes on and on and on. So its really going to be hard, sharon, i think, to go back to a relationship. Again, as i said at the very beginning im very disappointed at that in some respects. I think we should have been a little bit more forceful, the alliance should have been a little bit more forceful in trying to reengage saying, look, where can we as steve has pointed out, where are the areas where we can Start Talking again and Start Building the trust and confidence. And thats why i said at the end of the day, this track two that were engaged in will pay huge dividends and is really, really important. I think, sharon, i think that guy is largely right. But let me try just to add a little ray of optimism. I went through the early 1990s when i worked at the stit department on arms controls issue. You have the soviet walk out from both the negotiations on the arranged Nuclear Forces and on strategic arms reduction in the end of 1993 you had a deep freeze in u. S. soviet relations throughout 1984, then in early 1985, the soviets said we want to resume the negotiations and within 2 1 2 years you had the inf treaty and major progress on s. T. A. R. T. Its very hard to be optimistic about the current state of u. S. , russia and west russian relations right now. But we shouldnt ignore the possibility there may be an opportunity to try to turn things around. So again, i think probably being pessimistic is the more realistic course now, but, you know, things can change fairly quickly. Thats been demonstrated by relations between washington and moscow in the last 30 years. One other thing, steve, that you brought up, this question in talking about doctrine. And the russians are quite interested in talking about new technologies, right, whether its precisionguided munitions or other things. And i quite clearly remember a question from one of the participants to the russians where it was asked, okay, well, how would you feel about a cyber attack . You know, does a cyber attack constitute an attack on your state . Does it create an existential threat . And the answer was, well, okay from one russian, right . That depends on how successful it is. Right . So that seems to be a very risky situation for us to be in. And i fully understand that these talks with russia and with everybody else on Cyber Security and on any kind of limits are difficult, but once you introduce the notion of, well, a Nuclear Response to a cyber attack, it seems to me we need some kind of forum for at least discussing these issues. And nato may not be the right place. I mean, i just welcome your thoughts on that. No, i think one of the things that came out of the discussion was that on the nato side, my guess is that the alliance is going to have to be prepared to talk about questions other than nonstrategic Nuclear Weapons if it wants to have a dialogue with russia on nonstrategic Nuclear Weapons. That would include questions like Missile Defense, traditional strike and might include issues like conventional forces because i do believe that at least now while the russians are in the process of modernizing the conventional forces there is a perception and i think it still reflects the reality if you look at nato forces and Russian Forces at the conventional level nato still has some significant, quantitative and in particular qualitative advantages. You have to have that broader discussion. Where cyber fits into that, i dont know. And part of it may well be is im not sure yet that either the United States and russia separately have a fixed enough doctrine on cyber to have that conversation. Now, you could argue maybe its better to start the conversation before sides get fixed. But for all of the attention thats just talked about here in the cyber world, you know, im not sure i understand what american doctrine on cyber is. And ill give you an example. Because i do think that when the u. S. Government thinks about cyber, how do you deter Cyber Attacks . And about, oh, four or five years ago i was out Strategic Command did this annual deterrence seminar in august where they talk about questions and at one time they had a very interesting panel on cyber deterrence. The question i posed and im not sure i received a good answer was when i look at deterrence in the Strategic Nuclear area, i understand what were talking about because i can read Hans Christians right and say how many Strategic Bombers does the United States have and how many intercontinental Ballistic Missiles. Its very clear to the world what backs up american Strategic Deterrence in terms of doctrine. If you look at the cyber side, its still a pretty opaque world. We dont know how much does the u. S. Military put into cyber, how many people are working this, what sorts of capabilities. So i dont know how deterrence works in that world when youre not communicating either side. If you conduct a cyber attack, heres what might happen. And we may have to be getting our own thinking a bit in order before we can have a useful conversation with the russians on that. Let me just add, at nato we have a cyber center of excellence in talent and the genesis of that was a massive cyber attack from unknown sources, and as a result nato headquarters theyve created a cyber division, very small, but one that is, again, not wholly endorsed by all the members of the alliance but is again recognizing the many challenges an difficulties, what is an attack and trying to come to grips with it by creating an infrastructure to deal with it and have a forum for discussion on that. And there was talk about having a working group like that in the context of the Nato Russia Council just like we have i chaired for example a theater Missile Defense sub group in addition to the Nuclear Group in which we had very good cooperation with the russians up until 2008. Again, theyve structured themselves to try to deal with it, but again theres a long way to go. Thanks. Sharon. Steve put his finger, i think on the sort of essential question. You kind of rephrased it, i think. Does russia want to reduce the writ . And when we look at mh17 and the response to mh17 that certainly doesnt give one great optimism and certainly is a massive trust destroyer. But let me offer a ray of optimism. And it has to do, i think, with, you know, for us to participate in a track two, it really is track two. We dont really need to think about or i certainly dont, many of the participants dont need to think about whether the u. S. Government endorses this or not. The russian system doesnt work that way. So just the very fact that we are able to hold these discussion discussions and have the level of representation we had from the Russian Federation says something that at least some areas in the russian government are supportive of continuing these types of discussions. Maybe not in the context of a nato russian discussion right now as guy suggested, but in this context. And it just only emphasize the point that guy was making that what we are doing is all that much more important. Thank you. Its time to take questions from you. So we have some roving microphones. And i just ask that you introduce yourself and your affiliation and ill try and go in order. Austin, can you come up . Thanks. Thanks. Hi, my names an dre cito, im a reporter with tass, the russian news agency. Actually, my question is a direct followup to what youve just been discussing. First, i think its an important discussion. Thank you for having it. Second, for me as a journalist, its hard to even cover this event because i do not understand its practical significance. So i have a group of eminent experts who seem to be agreed that the dialogue is needed. From all of you, you are official dialogue on confidence building, on trust building all of that. Like andrew just said on the russian side, its probably sanctioned in some way even on track two, but what about the american side . So you are all for it. So what does it mean . You also seem to be all agreed that the west and the u. S. Are not willing at this point to restart the dialogue. Thats my question. What does it mean . What does this panel mean . What does your opinion matter for washington . Let me try briefly. And then ill let the diplomats take over. Yes, this is track two, but remember also our sponsor for this dialogue was the u. S. Government. And so and there was definitely interest in the u. S. Government. We had some government speakers at our that did not participate formally in the dialogue, but did attend, gave luncheon and dinner notes. I know anecdotally, not on an official level, that there is great interest in what was said. I dont know that the u. S. Government has plans to follow up on this. Thats beyond my ken, but yeah, its not quite i dont know if i would say it was totally track two, totally track 1 1 2. Steve put it quite well. Both sides have a big interest in reducing some of the risks that are currently not entirely nuclear, right, but the risks in these inadvertent escalation, and so to the extent that this may contribute to helping mitigate some misunderstandings, i think theres great interest in it. The panelists . A great question, andrei. But just on the value of the event today, okay, this event is being streamed live on the internet, and i believe that cspan is also broadcasting the event. So i think there is a value simply in the role of Public Education that we are talking about this. Reasonably serious people, knowledgeable people, and we think that there is a problem and that maybe maybe this can possibly have some influence outside of the building in a multitude of ways. I just add two points briefly. Any time ive had a conversation with somebody in the u. S. Government about a track two after ive been involved in, the u. S. Government supports these type of things. They think that these contacts are useful. They keep a dialogue going. Sometimes they produce ideas which can then work their ways into official channels. The second point id make, at least this would be my view, is that in the aftermath of russias military seizure of crimea and Russian Military action in Eastern Ukraine, it was appropriate for nato and russia for the nato to ratchet down the nato russia relationship. There have to be political consequences to egregious bad behavior. But the feeling of most of the american participants in the workshop it might make sense for nato to relax that and open up the way for a nato russia militarytomilitary dialogue particularly on the issue of how do you avoid accident and miscalculation when you have an increased tempo of nato and Russian Military forces operating in close proximity . So we say, lets open the door to that. Now, having said that, i also think in my own mind im not sure whether the russians would say, yes, we want to have that dialogue. But i would argue that it would be worthwhile for nato to try to do that because neither side should have an interest in a conflict that begins by miscalculation or accident. Thank you. I saw a question. First this young woman here. Thank you, university of maryland. I follow the story from the allies perspective, particularly from turkey. So my question had to do with the followup on the idea that nato is not prepared to reaffirm its commitment to the. When it comes to the reluctance to host the tactical Nuclear Weapons versus the ones who are eager to receive the modernization of the war heads and the next generation of dual capable aircraft. How much longer can nato actually continue pursuing its policy of avoiding talking about the treenos . Are we actually going to see new countries particularly in Eastern Europe who will take over the mission . Great question. Guy . Well, i dont think thats right. Thats a good question. Its complicated. I think clearly right now nato is relooking at its Nuclear Policy. And theyre going through a somewhat of a bureaucratic process to see if anything needs to be changed. The fact of the matter is nato conducts nuclear exercises, but they dont announce them. Its not public. If you look at the handout and i commend that to you, there are several good papers in there, including mine, and the report. But i have a slide in there, for example, that shows that if a Nuclear Mission for nato was ever required, that up to 16 different nations would be participating in that forward deployment again to send a political message of the solidarity of the alliance. And part of the burden sharing ongoing process that we have today is all the other nations are looking for ways in which they can participate in some way other than holding the annual Nuclear Policy symposium. How they can actively participate. Now, given the current circumstances, theres been a lot of talk about the possibility of forward deployment. As far as ive seen, at least in my discussions with people at nato, not only talking about a moving Nuclear Weapons and having them be permanently stationed, but there is, you know, discussion about, well, what more can we do . And how can we, back to the messaging part of that, a huge part of messaging is solidarity with as many nations as possible actively participating. With the three noes, one thing that people forget about the three noes is at the end of that sentence, based on the current policy situation. The policy situation has changed. So you do get some people talking, well, the situations changed particularly some of our Eastern European allies. They say those three noes are no longer relevant and we need to reexamine it. But from an overarching alliance standpoint, i dont see any changes certainly movement of those. And it wouldnt from a technical standpoint have any relevance anyway, to be frank. But again, thats not to say that we arent continuing our exercise exercises our Justice Department have a good job of announcing those that we try to keep secret. The three noes, just a little bit of history. The three noes were nato said back in 1997 when it and the founding act and this was incorporated in the nato russia founding act. But nato policy that said as a result of enlargement, no intention, to plan, to requirement to deploy Nuclear Weapons on the territory of new nato members. And i agree with everything that guy just said about the importance of nato consultations on nuclear questions. The importance of burden sharing, but i would also argue, i missed this part of the discussion in october because i would have said we probably could reaffirm the nato three noes. It seems to me there have been some suggestions in the last five or six months from some course here in washington, not in the government but outside about maybe a response to russian bad behavior in ukraine should be to move american Nuclear Weapons to place like poland. I personally thing that would be unwise on three counts. First of all, deploying those weapons from their current locations to a place like poland makes them actually much more vulnerable to russian preemptive strike in a crisis. The missile deployed in leningrad could cover twothirds of polish territory. I dont mind in the current sense the circumstances being provocative towards russia but putting american Nuclear Weapons in a place like poland would be really provocative. Think 1962 and the cuban missile crisis. The third reason is if if United States were to go to nato and say we want to move some of our b61 bombs and the delivery aircraft to locations in poland, youd have a majority of allies saying are you out of your mind . So an idea that makes weapons more vulnerable, really ticks off the russians and causes dissonance disruption with the alliance doesnt seem to me as a particularly safe policy. Pipers three noes. So while it makes sense in parallel with the three noes, nato also at the time said that, again, in the current and foreseeable security circumstances there would be no requirement for permanent stations of substantial conventional combat forces on the territory of nuclear allies. I think that theres a discussion to be had about that question, but it seems to me that the three noes which still apply because i dont think it buys you anything in military terms and it buys you lots of problems if you start changing that. As i said, from a technical standpoint, we saw no need to do that. Take away all those others, but will it give us added benefit and make us more capable, and the answer is no. Four noes. We hit a question right back there. Edward ift, georgetown university. Sharon raised the question of what do the russians think about the suspension of all these working groups. I was at a conference several months ago which ambassador kisliak spoke. He was lamenting the suspension of these groups. He said that we, russia, would like to resume them but were not going to beg. I think thats your answer. Other questions here and then there. Thank you. So Pew Research Center released interesting results of its poll conducted in several nato countries. Ukraine and russia. And one of the things that the polls showed is a very sharp divide within nato on the article v commitments. And how do you what do you think . How does that affect further progress on limiting nonstrategic Nuclear Weapons . In europe. Yeah, i saw that poll. My guess is i can go back to the 1970s and 1980s and find very similar polls. Im not sure how much weight to put in them. I think nato governments very seriously understand what article vs about. And i think that they understand that supporting each other in article v is essential to maintaining alliance. I see that as a totally separate question from the issue of nonstrategic Nuclear Weapons. Hi. Gary slergeant. Im retired army officer. Nonstrategic Nuclear Weapons, theyre hard to find. Someone could comment on the Remote Sensing piece you talk about. One thing would be at the operational level, who has launch sort of capability, if thats even something you guys are can share or understand or believe from russian . In toefrerms of authorization. What level . Down to tactical division, Army Commanders in terms of executing . Because im always worried about mistakes. Because the army and everybody makes mistakes all the time. Yeah, the well, its a very long if there was a scenario where we would actually contemplate the use of Nuclear Weapons, then theres a process that we go through. Its actually interesting is that what youre talking about. No, im talking on the russian side. If you guys know that. On the issue of Remote Sensing, the challenge that you face with nonstrategic well, in arms control, right, the closer you get to the warheads, the more intrusive the monitoring will abouty. You you can talk about nonintrusive monitoring and remote monitoring. We did talk about im trying to remember the technology. Muon radio technology. I think were all political scientists, im not sure here up on this panel. But oh, you need to ask them that question. No, but these are, you know, our National Labs have been involved in this kind of Technology Development for decades. And thathe issue there is, you know, if you were to sign an agreement in 10 or 15 years, you would already need to be starting that development today. So there are long lead times for some of this stuff. I know im not giving you a very good specific answer, but there are, i guess, i think Nancy Judd Nicholas described some of them in detail in the paper thats available on our website. But the point is, you need to start that collaboration now. In the earlier year, if you do that collaboration with the russians, then you all have buyin to particular techniques and approaches. One point at the october workshop where we had someone at the u. S. Labs give a briefing on this muon radiography. They showed a slide and said with this technology, one m away from the thing you could tell is that a Nuclear Warhead or not. I raised my hand and said, please tell me thats one mile. They said, no, thats one meter. Were still talking about limited technology. To sharons point and pretty much everyone agreed on the american and russian side that there would be value in having a dialogue right now between america and russians and others, it said, how do you develop verification technologies looking to getting questions that go beyond current treaties. How would you, for example, if you wanted to monitor a limit on Nuclear Weapons in storage, what would be the sorts of technology that you need . And actually putting time and effort into developing them now so if political circumstances reach the point where you could get that treaty, the treaty wasnt held up because you didnt have the verification techniques. And to the extent that you could develop some of those technologies and techniques in a cooperative manner where it was not coming from an american lab or a russian lab, coming from a joint effort, that Technology Actually in the end might be more acceptable to both sides. I think the state department in december of last year announced an effort to try to promote development of further technologies in the area of verification and to encourage, you know, universities to make contributions. What i dont have a good fix on is how much funding went to that thing. But they are beginning to think about how do you develop technologies so you have things on the shelf and the absent of a particular Monitoring Technology does not prevent a treaty from going into force. Richard fieldhouse, former Senate Staffer doing Community Service work. I wanted to provide a context and a question and youve all explained under the current circumstances with the ukrainian crisis left unsolved and the risks from that and the official dialogues have come down, theres wide agreement that this is not a time when theres going to be any likely progress on this issue and maybe if theres some political resolution to the ukraine crisis that would change dramatically. But theres an avenue i want to explore. I know some of you have thought about this. The new s. T. A. R. T. Agreement, the new treaty will come to an end at some point. And there may be an interest both in the United States and russia in either continuing or doing something additional, so there are restraints on both sides and there are strategic Nuclear Forces. I point out that from the senate standpoint when the Senate Considered the new s. T. A. R. T. Treaty and in many communications its been a clear and official part of the Senate Perspective that any future arms control russia would have to include nonstrategic Nuclear Weapons. And thats actually written into the resolution of advice and consent ratification and required the administration to actually make an official approach to russia to begin the dialogue on these nonextra steejic Nuclear Weapons. The question is can you foresee a time when that might be the avenue, if you will, to having serious official dialogue on the issue . Again, i try to be optimistic about these things. I do believe that even though you now have a difficult situation between washington and moscow, that at some point, maybe its 2018 to 2019, that the russians will have an interest in having a dialogue about what happens with new s. T. A. R. T. The new s. T. A. R. T. Treaty entered into force in 2011. By its terms it expires in february of 2021, although the sides do have the ability to extend the treaty by mutual agreement by up to five years. While the russians have shown little readiness in the last four years to go beyond new s. T. A. R. T. , i do think that they would want to have a continuation of some kind of american Strategic Forces and a certain amount of transparency particularly if you talk about the timeframe of 2020 2021 which is when u. S. Modern Strategic Programs with the ohio class Ballistic Missile serving a as replacement with the new Strategic Bomber and possibly a new intercontinental ba list can missile, when those are coming online, i would thing the russians would like to have some kind of cap. The question then becomes would american negotiators be able to use that russian interest as levers to say, okay, now we have to go beyond strategic and talk about nonstrategic. That will be a judgment they have to reach at time. Whether that gives the russians enough leverage to try to reach something. I would like to see the next step . U. S. russia arms control moving beyond just strategic or just deployed strategic and movie to a treaty where at least one aexpect would be a limit on the total number of Nuclear Weapons deployed, nondeployed, strategic, nonstrategic. But i think we wont know for a number of years until we get na negotiation where it gives us the leverage to get them to broaden the number of systems covered to pick up Nuclear Weapons beyond strategic. Did you want to add something . Yeah. Its an excellent question. And my honest answer is maybe. Russia to prone to nonlinear events. So extrapolates where we are in 2015 and assuming that will be the situation in 2018 or 2020 is risk risky. I would say, though, that one key positive step and this is obvious, youre going to get to this point where i think you would like to be is that there has to be a resolution of the situation in ukraine. And that resolution with the ukraine situation then has to include a broader discussion about european security. And then if theres progress on that, then i think, you know, this could be more possible. But there has to be some facilitating conditions that happened before thats able to happen. We have a question up here, then over to there. Mill tan koenig, International Center for tourism studies. You mentioned in your workshops there were provocative ideas mentioned with the safety and security of nonstrategic weapons. Was the were the ideas presented by the americans substantially different from those presented by the russians in their, you know, originality . Could you contrast any of these . You mentioned some of the ideas that were presented . Sure. Actually, it was our european who but thats okay. This was the topic that i assigned to him. And actually, the what i meant by provocative was just that at a time when youre even struggling to find venues to talk to russians, the notion that you could talk to them or have joint exercises or anything else about safety and security of these tactical Nuclear Weapons was it was a little counterintuitive. Thats why i said it was provocative. The recommendations or the ideas that and it was oliver meyer from the i forget what you call it what is it . Peace research institute. Good german scholar. Good german scholar in association. These built on things that weve done with the russians already in terms of exercises but trying to push a little bit more. So there were six items, and you can read about them in the report, but just briefly, joint assessment of the risk. And you know if anybody lass be has been following the Nuclear Security summit context, you know that any discussions of risk assessments are very taboo. Were certainly not going to do that with the russians now because theyre not attending the Nuclear Summit in 2016. You could also, as i said, flip that around and talk about site security improvements. You can share best practices. You know, this is how in a generic sense. You could have exercises focused on accidents or incidents and associated consequence management. You could develop Incident Response procedures. You know, so, for example, you could consider im just going the freed the report. Tabletop and joint exercises to develop and test procedures for responding to different crisis scenarios. Some of these things are borrowed from the Nuclear Security world. You could set up a 1540, the u. N. Security Council Resolution 1540 joint working group to explore challenges specific to safeguarding nonstrategic Nuclear Weapons by access by nonstate actors. You could and then this is really a holdover to the other areas, initiated dialogue between nato and russia on measures to avoid this unintended escalation of military encounters. So i wouldnt call these necessarily provocative. The question is do you have you know, whats the hook to initiate or resume some of those things that had been done under the Nato Russia Council. Sure. Go ahead. I wanted to add something to the previous question. Let me be a little more frank. Ive been pretty pessimistic, frankly, about having a discussion with the russians about nonstrategic Nuclear Weapons. I mean, even if these the conditions that i talked about happen, the structural situation, the structural security situation that russia faces and the asymmetry and the importance for Nuclear Weapons for russia, thats not going to go away in five years. Thats likely only going to increase so from their perspective make that discussion even harder to make progress on. We werent able to make progress on that in 25 years really. In the 1990s when it was a much more felicitous political environment. So to think in five years when i think the structure or the core problem, the strategic mismatch is going to be worse, i think its going to be tougher. I would just add to that, overwhelmingly after these two dialogues what i come away with and i think steve, you said it earlier you cant its very difficult to just put these Nuclear Issues in a box. When we said, look, you need to have a new dialogue or when these participants said you need a new dialogue on european security. How do you get there . Who do you include . You need to talk about issues that or concerns from both sides. I dont say this to be a pollyanna. Ive spent years outside of the government actually doing negotiations on arms control. But there are some russian concerns or issues that are not going to go away. I mean, we cant simply, you know, keep deploying Missile Defenses and pretend like it doesnt matter or that there arent issues of concern with that. We have our own security interests to consider, obviously. But you know, so the real question is can you you know, if you cant get anywhere on nonstrategic Nuclear Weapons in a purely nuclear avenue, are there other things or is there a broader discussion where you might make progress on that . You know, and this is not simply the gee, well trade tack nukes for ballistic Missile Defenses. Obviously, nobody is recommending that. But you have to at least have those discussions not in the press but facetoface. Again, theres an antecedent to that. If you go back to 1985 when the United States and the soviet union resume nuclear arms discussions it was done in the nuclear and space talks where you had a group on strategic Nuclear Forces, a group on nuclear intermediate range forces and a group on defense in space because the soviets s at e time said, we also need to have a dialogue that covers our concerns about things like american Missile Defenses. Now, in the end, the defense in space talks did not produce an agreement, but the context of that overall discussion then created a framework where you can get the inf treaty and the s. T. A. R. T. I treaty. In 2011, one of the big hopes for the Obama Administration was to reach a mandate with the russians about Missile Defense. In fact, that failed. And i think it failed prime alir because we werent really ready to talk about Missile Defense in the broader context of strategic stability. Where you bring in the role of Strategic Offensive weapons, nonstrategic Nuclear Weapon, p guided munitions, space weapons. It was my hope in 2013 when the Obama Administration was trying again to engage in this that at least, to me, success in those events of the spring and summer of 2013, to me, i would have said if we agreed to a framework for discussions of strategic stability. I dont think we can make progress on looking at nonstrategic Nuclear Weapons off to the side. I saw one last hand up. Hi, im meg kelly. This was briefly mentioned, but i was hoping you could speak further specifically about china and russias willingness to move forward with dialogue and arms reducti reduction. The formal russian position, as i think it has been articulated, is that the next stage in Nuclear Arms Limitation talks should not be u. S. Russia. It should at least include britain, france, and china. I agree in principle at some point at some time the dialogue needs to be a unilateral one. I think if you look at the total american and Russian Nuclear arsenals each of those countries is 4500 total Nuclear Weapons. France and china would be close to the next Largest Company at about 300 weapons apiece, so i would argue that ultimately you have to get into a multilateral dialogue, but it does seem to me theres significant room for one more bilateral u. S. Russian negotiation. If washington and moscow agreed to cut their totally Nuclear Arsenals in half, that would be six to seven times larger than the nearest third country. The russians are saying, no, the next negotiation has to bring in third countries. There might be a half step that you could do because i dont believe that the chinese are going to be prepared to say, yes, were going to make a commitment to a treaty of not above 300. Could you ask the chinese, the british, and the french to undertake a unilateral political commitment. We will not increase the number of our Nuclear Weapons as long as the u. S. And russia are reducing. Meg, its a great question. Theres no question the russians are concerned about what china is doing and could possibly do in modernization and expansion of their Nuclear Weapons capability. Over the years, theyve been frustrated, i think, at least in discussions with me about what they see as a lack of transparency in chinese programs. Now, the chinarussia relationship at some level is a black box for us, so you cant answer the question with any certainty, but i think it was significant back in 2006 or 2007 the russians approached the Bush Administration with the notion of trying to multilateralize the inf treaty. I think the Bush Administrations response was, well, sure, try, good luck. That would be great, but was not really met with certainly any interest. I think it was the concerns principally about china that was motivating the russians at the time. That raises an interesting question, which is that sometimes, especially when youre at nato, you forget the rest of the world also has issues and interests. That was brought home to me when i was had a visit by the japanese ambassador in brussels who had heard about natos discussion with the russians about various ideas concerning nonstrategic Nuclear Weapons, which is why dont you just take them all that is west of the euros and move them east of the euros. That prompted the visit that said, gee, thats going to upset the whole balance that we have in this side of the world and thats not really such a good idea. One of the ideas floating around was to take them and move them so they would be less than a socalled threat to nato. So there is a concern that that you need to take into account. A broader strategic outlook needs to be addressed when youre dealing with this very small issue of nonstrategic Nuclear Weapons. Panelists, do you have any last comments . All right. Thank you all for your time and attention today to this important topic. I hope that even though the fact that everyone showed up on a friday before labor day means were ready to come back from our strategic holiday and work on these important issues. Let me thank very briefly our external relations staff, my staff, for helping put this all together, and finally please help me thank our panelists. [ applause ] he was a nazi. He was a concentration camp commandant, and he was responsible for the murder of thousands of jews. This sunday night on q a jennifer teiga on her life altering discovery that her grandfather was the nazi concentration commandant. We would see a tremendous cruel person, a person who, yes, was i mean, he was capable of he had dogs, two dogs. He called them ralph and rolph. He trained them to tear humans apart. There was a pleasure that he felt when he killed people. This is, yes, something when youre normal, if you dont have this aspect in your personality, it is very, very difficult to grasp. Sunday night at 8 00 eastern and pacific on cspans q a. All persons having business before the Honorable Supreme Court of the United States are admonished to draw near and give their attention. Number 759. Ernest, petitioner, versus arizona. Barbara madison is probably the most famous case this court ever decided. Slavery wasnt legally recognized. Putting the brown decision into effect would take president ial orders and the presence of federal troops and marshals and the courage of children. We wanted to pick cases that changed the direction and import of the court in society and that also changed society. So she told them that theyd have to have a search warrant, and mrs. Mapp demanded to see the paper and to read it, see what it was, which they refused to do, so she grabbed it out of his hand to look at it and thereafter the Police Officer handcuffed her. I cant imagine a better way to bring the constitution to life than by telling the human stories behind great Supreme Court cases. Fred boldly opposed the forced internment of japanese americans during world war ii. After being convicted for failing to report for relocation, he took his case all the way to the Supreme Court. Quite often in many of our most famous decisions are ones that the court took that were quite unpopular. If you had to pick one freedom that was the most essential to the functioning of a democracy it has to be freedom of speech. Lets go through a few cases that illustrate very dramatically and visually what it means to live in a society of 310 million different people, who help stick together because they believe in a rule of law. Landmark cases, an exploration of 12 historic Supreme Court decisions and the human stories behind them. A new series on cspan produced in cooperation with the National Constitution center debuting monday, october 5th, at 9 00 p. M. Tonight on cspan 3, a House Intelligence Committee hearing on global cyberthreats. Then the director of National Intelligence James Clapper had this weeks National Security summit. The House Science Committee holds a hearing on last months toxic spill in silverton, colorado. The heads of several Law Enforcement and intelligence agencies, including cia director john brennan and fbi director james comey, testified at a House Intelligence Committee hearing about Global Threats to Computer Networks and recent day that breaches. I want to thank director clapper. I would still like to thank director clapper. We know that all the witnesses time is very valuable, and we want to take advantage of that today, so ill keep my comments brief. This committee has traditionally hosted an open worldwide threats hearing to better educate the public on current dangers we face as well as to showcase how the Intelligence Community is working to combat these threats. The focus of this hearing is cybersecurity or given the current state of affairs, cyber insecurity. Over the last several years, Cyber Attacks have become common place in the United States. Anthem blue shield, home depot, sony, target, jpmorgan, chase, and other companies are just to name a few have been subject to major attacks, resulting in the compromise of personal information of employees and customers alike. These are just the breaches we hear about in the news. There are many, many both large and small, occurring each and every day across our nation. The u. S. Government is certainly not immune. Opm, irs, the pentagons joint chief of staff or the joint staff, and just this morning we learned the department of energy was successfully hacked 159 times. These highprofile assaults are eroding confidence in our governments ability to counter the threat. I share the publics concern. In fact, i recently learned that the very apparatus that the department of Homeland Security uses to allow the private sector to share threat indicators with the government, the protected Critical Infrastructure information program, has not had a security audit since 2006. This raises serious questions about an agency that many government representatives believe should be at the heart of our Cyber Security strategy. I want to place the Intelligence Community on notice that we will be requesting information regarding your cybersecurity practices and procedures in the coming months. The government should not even think to impose standards on the private sector before it can maintain the security of its own systems. As Congress Continues to debate information sharing legislation, we must ensure that the Government Entities involved in the sharing process are absolutely secure. Especially if we allow the private sector to share Cyber Threats with just one government entity, dhs. In closing, i call on the senate to take up the legislation seemingly every day another breach is exposed with severe implications to our economy, our privacy, an our National Security. The time has come to put politics aside and give our country the tools it needs to defend itself from these malicious attacks. With that, ill yield to the Ranking Member, mr. Schiff. Thank you, mr. Chairman. Thank you, directors, for joining us today. Thank you so much for your service to the country. Im pleased were holding this hearing in open session, and its telling that our committee open hearings this year have been focused on cyber, the challenge of securing our networks, and related issues of encryption and terrorist use of social media are among the most pressing challenges we face. The threat to our public and private networks is all too apparent. In the past year alone, we have seen highly publicized hacks of sony pictures, not far from my district, intrusions into Health Insurance providers promera and anthem. And a devastating hack into the office of personnel management. These three instances, which took place in the context of thousands of other intrusions every day, show the breadth, scale, and crippling potential of the threat to our economy, our privacy, and our National Security. There are no simple answers to these problems. In fact, some of the steps we can take to better secure our data and our privacy can have unintended consequences. A good example are the largely welcome efforts to make our networks more private and more secure by using pervasive encryption so that even if hackers steal the data, it would be gibberish without the key to decode it. The broader adoption of stronger encryption, however, particularly in communications, can simultaneously allow terrorists and criminals to plot in ways that Law Enforcement and the Intelligence Community cannot access even with a valid warrant. Even open communications on the internet pose a challenge. Social media has proven a democratizing force throughout the world but is now increasingly being used by isis to spread messages of hate, repression, and violence. So the question is what we do about cybersecurity. The unintended consequences of encryption and the use of social media to radicalize. These are immensely challenging and inextricably linked problems, and i dont profess to know all the answers, nor should anyone in washington. But i do want to lay out several principles that should guide our response. First, we need to have a broad discussion across industry, government, academia, and the public. Last week i went to Silicon Valley where i held a series of very productive sessions with a number of leading tech companies. Ill continue to have these conversations, and i encourage others to sit down with them as well. We in d. C. Just cant tell tech to figure it out. We have to work with them and others to find the best mix of incentives, standards, and technological solutions. In these discussions, we in government must also recognize legitimate economic considerations of our global tech sector and the excellent work they already do voluntarily addressing some of these issues. At the same time, we have to recognize the legitimate need of the populous for privacy, legitimate need of Law Enforcement and the intelligence personnel to keep us safe, and the industrys legitimate need to protect intellectual property from hackers. This collaboration should also take place on a technical level. Im pleased to see Government Agencies like dhs and nsa, for example, continue to partner with universities through grants and cyber challenges to develop safer and more secure technologies and to deepen this countrys cyber literacy. We need to do more of this academic and technical collaboration. Second, government and the private sector must take joint ownership of the problem of Cyber Security. Its no longer enough for senior government officials or Corporate Leaders to simply call in tech support, nor can we afford leaders who take pride in not understanding the technology that underpins their organizations. Third, we must grow the governments cadre of cyber experts. We must invest in and atrack the best, the brightest, and the most creative to work on behalf of the nations security. The digital revolution was made possible through the marriage of technical savvy, creativity, art, and science. Those who could identify the need and those who could fill it. We must keep this in mind as we develop our bench of cyber experts. Fourth, we have to develop communication in advance to responses of Cyber Attacks and intrusions to generate a deterrent. For example, in the wake of the attack on sony, north korea must face tangible, meaningful consequences, and others must know the potential consequences of future attacks or offensive cyber action. And fifth, we need to advance legislation that catalyzes solutions. Our cyber information sharing bill, the protecting Cyber Networks act, would do exactly that. This measure would essentially crowd Source Solutions to Cyber Threats by allowing private industry and the government to share malware in order to understand it and create solutions to defend against it. Already there are private public cyber public sharing arraignments, which are proving invaluable, be it the Risk Information Sharing Program or among the private sector as in facebooks threat exchange. This legislation, which is awaiting action in the senate, would allow these models to go nationwide. Ultimately, the threat of a cyber attack presents no easy solutions. Offense is cheap and relatively easy, while defense is expensive and far more complex. Needs of communications that secure our privacy can be used to try to tear us apart. But these complex challenges are not an excuse to throw up our hands. I believe that through close collaboration and discussion we can take steps to better secure both public and private networks from intrusion in order to save lives and jobs. I look forward to hearing from our witnesses about how we can do just that. I thank you, mr. Chairman, and yield back. I thank the gentleman. We created an nsa Cyber Committee this congress, and the chairman of that committee id like to recognize for an Opening Statement is mr. Wes moorland from georgia. Thank you, mr. Chairman. I appreciate the witnesses taking the time out of their busy schedules today to come and testify. As the chairman of the nsa and cyber subcommittee, ive had an opportunity to see cybersecurity from a unique position. Ive witnessed the amazing talent and tireless work undertaken by certain elements of our government represented here today and by particularly the nsa ability to identify and defend against Cyber Threats. At the same time, ive witnessed the shocking incompetence of other elements in our government which have resulted in unprecedented privacy breaches and threaten our National Security. It is essential that everyone understands the gravity of this situation. We are under attack right now in the United States. Every second, every day there are attacks occurring somewhere in this country. Some appear relatively harmless. Others are clearly a threat to our economy, our privacy, and our National Security. In recent years, we have witnessed the theft of our nations industrial secrets, attacks on our financial institutions, and much more. While its important to keep sensitive programs classified, these types of open hearings provide muchneeded education to the public. I want to commend the chairman for having this open hearing. We are only as strong as our weakest link, and the security of our networks is all of our responsibilities. Again, i would like to thank the witnesses for coming today, taking your time out, but also the part that you play in protecting our National Security. I look forward to hearing your testimony and working together with each and every one of you to make sure that our nation is safe against any Cyber Attacks. Thank you. Gentleman yields back. Id like to introduce the Ranking Member of the nsa Cyber Committee for an Opening Statement. Thank you, mr. Chairman. Thank you, all, for coming and participating in this open hearing on a really important topic. Ive had a chance to review the written testimony. I know that were going to hear quite a lot about the risks, the costs, and the players associated with Cyber Attacks on our country, these attacks we all too often see on the front pages of the newspaper. We should do all we can, and i think the chairman and the Ranking Member have laid out a whole variety of things we should be doing. What i dont hear and what i want to spend just a couple minutes on this morning, because i think its really critical, essential, that we commit ourselves as a country to force and lead the establishment of some rules of the road internationally on how warfare and crime frankly is conducted in the cyber realm. We dont know today what constitutes an act of war. We dont know what an appropriate response is. We dont know where the line is drawn between crime and warfare. This is something we should be leading on. Something that perhaps is analogous to the geneva accords, which have existed for almost 150 years now and worked on internationally for 150 years. There is currently no comparable effort to set Something Like that treaty up so that we all understand the rules of the road. Admiral rogers, we had a brief exchange on this in an open hearing a couple months ago, and you assured me that this was, in fact, something that was on all of your minds. But i just dont see much, and i dont hear much. Why is this important . Again, the questions dont have ready answers. Is stealing classified information from us an act of war . Or is it just an act of espionage that we do to each other and maybe we even grudgingly admire those who can pull off that kind of espionage . What about if that espionage leads to the death of a source or the death of a hundred sources . What if that espionage leads to the death of americans . At what point does it become an act of war thats responded to in the cyber realm . At what point is it an acted of war responded to outside of the cyber realm . I dont know that we know the answers to this question. Theres another important reason to take this up, which is that this is something that i think we can achieve. Our global geo strategic foes, whether youre thinking of the iranians, the chinese, the north koreans, or the russians, they have a common interest with us in understanding what the rules are and how we might react and how perhaps they should react in a variety of different situations. If we do this, we will also isolate nonstate actors. This is a realm a lot of today is going to focus on, asymmetry. This is a realm in which i suspect asymmetry is particularly a challenge for us. My guess is that five motivated coding ph. D. S in a basement somewhere can create a real threat for us. I also fear that if we dont do this, well be on a continual technological treadmill and i think well always be a little bit ahead on that treadmill, but well always be looking over our shoulder as others drop the t technological and engineering capability to get through our defenses. Doing this successfully i dont think results in this problem going away any more than the Geneva Convention eliminated war. I think if you look at the 150 years of the Geneva Convention, it has done some really essential things for the world collectively. So i think its up to us as members of congress to push this, but i would just ask that we discuss it some today, that you give your thoughts and perhaps an update on whether were making any progress in this area and as leaders in the Intelligence Community, you would prioritize an effort that i think could make a real difference. Thank you. I yield back the balance of my time. I thank the gentleman. Director clapper, i said some really nice things about you right before you walked in. So youll have to watch the replay on cspan over the weekend to see those nice comments. But it is really a pleasure and an honor to have you and your team here to testify in public before this committee. We have your statement for the record, but wed like to give you an opportunity to express what is in your statement that you provided to the committee. Youre recognized for five minutes. Thank you. Chairman, Ranking Member, members of the committee, i want to testify here on the intelligence committees worldwide threat assessment at the end of february. Cyber threats again led our annual threat report. This was the third year in a row weve done so. My colleagues and i are here today to update you on some of the Cyber Threats that face our nation and their intended National Security implications, much of which youve already discussed. We will, as you understand, run into some classified aspects that we wont be able to discuss as fully in this open, televised hearing. I do want to take note of and thank the members of the committee who are engaged on this issue and have spoken to it publicly, as you did here this morning. So in the interest of time and to allow for questions, this will be the only formal Opening Statement, and then well open it up for your questions. Ill briefly cover director clapper, i didnt realize, but i think we were going to give you ten minutes, so dont feel like youre on the clock here. All right. Thank you, sir. I think we should be able to get this done within ten minutes. My colleagues and i will be, as i said, open for your questions. So before i begin, i do want to note, and i guess forgive the commercial, but the events of the last few months have reinforced my belief in the need for a ctec. Cyber threats to the u. S. National and Economic Security are increasing in frequency, scale, sophistication, and the severity of impact. And although we must be prepared for a large armageddon scale strike that would debill debail debilitate the entire structure, its not our belief thats the most likely scenario. Rather, our primary concern are the low to moderatelevel Cyber Attacks from a variety of sources, which will continue and probably expand. This imposes increasing costs, as you indicate, to our businesses, to u. S. Economic competitiveness, and National Security. Because of our heavy dependence on the internet, nearly all Information Communications technology and i. T. Networks and systems will be perpetually at risk. These weaknesses provide an array of possibilities for nefarious activity by cyber threat actors, including remote hacking intrusions, supply chain operations to insert compromised hardware or software, malicious actions by insiders, and simple human mistakes by system users. These Cyber Threats come from a range of actors including nation states, which fall into, at least in my mind, two broad categories. Those with highly sophisticated cyber programs, most notably russia and china. Those with lesser technical capabilities but more nefarious intent, who are also more aggressive and more unpredictable, iran. With respect to nonnation state entities, criminals motivated by profit, hackers, or extremists motivated by ideology, all are of course included in this threat. Profit motivated cyber criminals rely on loosely networked Online Marketplaces often referred to as the cyber underground or dark web that provide a forum for the merchandising of illicit tools, services, and infrastructure and stolen personal information and financial data. The most significant financial cyber criminal threats to u. S. Entities and our International Partners come from a relatively small subset of actors, facilitators, and criminal fora. Terrorist groups will continue to experiment with hacking which could serve as the foundation for developing more advanced capabilities. With respect to the impacts, again youve alluded to this already, Cyber Espionage undermines confidentiality. Cyber threats and actors, particularly criminal and terrorist entities, undermine data confidentiality. Denial Service Operations and data deletion attacks undermine availability. In the future, i believe well see more Cyber Operations that will change or manipulate electronic information to compromise its integrity. In other words, compromise its accuracy and its reliability instead of merely deleting it or disrupting access to it. With respect to counterintelligence impacts, as illustrated so dramatically with the opm breaches, counterintelligence risks are inherent when foreign intelligence agencies obtain access to an individuals identity information. Foreign intelligence agencies could target the individual, family members, coworkers, and neighbors using a variety of physical and electronic methods for extortion or recruiting purposes. While speaking of the opm breaches, let me say a couple words about attribution, which is not a simple process. It involves at least three related but distinct determinations. The geographic point of origin, the identity of the actual perpetrator doing the key strokes, and the responsibility for directing the attack. In the case of opm, weve had differing degrees of confidence across the ic in our assessment of responsibility for each of these elements. Of late, unauthorized disclosures and foreign improvements have cost us technical accesses. From cybersecurity investigations of incidents caused by foreign actors, we are also deriving valuable new insight and new means of aggregating and processing big data. In summary, the Cyber Threats to u. S. National and Economic Security have become increasingly diverse, sophisticated, and harmful. The variety of federal entities that work this cyber problem, some of which are represented here with me. Dhs, fbi, and nsa and other Law Enforcement, intelligence, and sectorspecific agencies, like the departments of treasury and energy. Every day each of these centers and entities gets better and better at what theyre charged to do individually. Now weve reached the point where we believe its time to knit together all the intelligence these separate activities need to defend our networks because while these entities may be defending different networks, theyre often defending against the same threats. That was one reason the president directed me to form a ctec. I strongly believe that the time has come for the creation of such an organization, and were pleased to see youve shown support for the new center in both your cyber and fy16 authorization bills. We look forward to working with the committee to enable the Intelligence Community in general and ctec in particular to support our nation in this vital area. With that, ill stop, and well open up for your questions. Director, thank you very much. As you know, we are anxiously awaiting on the senate to pass the cyber legislation so we can get to a conference. We were hopeful they would get done before we broke for august. They havent. Now it looks like were looking into october. I want to give all of you a broad question and give you plenty of time to answer it. Being were out here in the public for everyone to see, i think its a great time to not only discuss, you know, what each of your agencies do but also talk about maybe the number one, two, and three, maybe not in any particular order, particular to your agency, what you see as the greatest threats, biggest concerns, and the issues that you all are working on in each of your individual agencies. Well start with you, director clapper. Well, sir, my standpoint, obviously im trying to overwatch the entire enterprise of u. S. Intelligence. As i have said every year that i testified for five years in this job that in my 50plus years in the intelligence business, i dont recall a time when weve been beset by a greater variety of challenges and crises around the world, both regionally and functionally. And so the challenge for me is attending to, addressing this wide diversity of threats. In the face of and i have to bring this up a very uncertain budgeting environment, now approaching our fourth or fifth year of uncertainty about the size and shape of our budget, which poses challenges for us programmatically, certainly with respect to systems acquisition, and the uncertainty it creates in the work force. Ill stop there with that general overview and turn first to john brennan. Thank you. Thank you, mr. Chairman and members of the committee for the opportunity to talk to you today about this very important issue. Three Top Priorities for me thinking about cyber. One is since cia has responsibility to make sure we have a good grasp of what the plans, intentions, and capabilities are of our adversaries around the world, making sure that we have the insights and intelligence that will give us better sense of what may be coming at us. So thats part of our mission, but given that this is a very dynamic environment in terms of what the various tools and capabilities that various actors have, we need to make sure that were on the top of our game in order to make sure we inform our policymakers, legislators, and others. Two, want to make sure our systems are going to be as secure as they can be so that we can fulfill our responsibilities to share information as we need to, make sure people who are going to be able to operate and act on the information that were able to get, both inside of the cia and outside, that we can do that securely and reliably. So we have initiated a number of actions within the agency to make sure that in light of some recent experiences. That we are in some respects doubling down on the security in that regard, and i rely very heavily on my colleagues here on that front. And third, since cia is supposed to be operating securely, clandestinely and covertly globally, we need to make sure that we have a full appreciation of what that digital domain, that cyber environment, has in terms of both challenges and opportunities, which is one of the reasons why we in cia have set up a new director on Digital Innovation to were able to bring together the expertise and develop the capabilities that we need in order to carry out our missions so that we know what we are dealing with when we try to fulfill our responsibilities around the world in an increasingly digitized environment and the various digital dust we all pick up every day in our lives. We need to be mindful of how that is going to impact our intelligence activities and operations. Mike. From an nsa perspective, first in terms of what our mission and responsibilities are, we use our foreign Intelligence Mission to generate insights as to what cyber actors, nation states, groups, individuals are doing in the cyber arena with a view towards ensuring we have insights as to their efforts against the United States, our allies, and their interests. Also, importantly from an nsa perspective in our Information Assurance role, were responsible for developing cryptographic standards within the department of defense. We also partner with others within the dod to generate the technical standards to help ensure the security of all of our classified systems within the department. And then we apply our Information Assurance expertise more broadly partnering with the fbi and dhs, both to support more broadly within the federal government and also within the private sector. Those are our roles. In terms of what concerns me, priority number one clearly is ensuring the defense of our own networks to ensure execution of our operations in a secure manner. Also, ensuring helping to partner with others to ensure the defense of the dod and more broadly the dotgov domains. When i look at it from a threat perspective, i would argue three things, really, as i focus in on the future. Efforts aimed against u. S. Critical infrastructure. The second item to me is are we going to see a shift in a trend from not just outright theft of information but are we going to start to see a focus on manipulation or changing of data once someone is able to gain access to a system so we start to question the validity of what we all are particularly looking at. And then finally, in the counterterrorism arena, do we start to see groups start to view the web as a Weapon System and not just a way to dispense ideology, recruit, raise money to decide they want to take it to another level and we clearly already see very open and public conversations about that now. Director comey. Thank you, mr. Chairman, for having me here today. The fbis mission is in the United States to detect and respond to all the threats that come at us through the internet, through cyberspace, which is increasingly every threat were responsible for, whether thats counterterrorism, counterintelligence, or all the many criminal threats we focus on. At the top of our threat stack when it comes to cyber is our nationstate actors. Both their intelligence activities in the United States and their theft activities in the United States to steal our innovation, our ideas, our energy. In responding to that, my primary concerns are making sure we have the folks, we have the equipment they need, and we have the deployment that makes sense to respond to that threat. General stewart. In dia, our primary responsibility is to understand the military capabilities of our adversary. So in this space, were particularly interested in how the adversary uses the digital environment to command and control forces, conduct isr so that we can counter his capabilities in this space. So were focused not just in the nonkinetic capabilities that we can bring against an adversary, isr capabilities, but also the kinetics. So were looking at this from a broad spectrum. Either how we drop bombs to destroy or defeat that capability, or how we can be disruptive in that capability. We provide that through all sorts of analysis based on products and support that we get from our partners here at this table. Two concerns for us, how well we defend our networks. Were spending a good bit of time looking at the construct of our architecture so we can defend not just the network but the data within that network. Then the second area of concern is whether or not i have enough resources and expertise to do the first part of our charge in this space, understanding our adversaries c4 isr capabilities. We have to move some resources around. Given the totality of things we have to look at, the threat landscape, this is an area where we need to do some additional investments. I thank you, all, for being here. At this time, ill yield to the Ranking Member for the purpose of questioning. Thank you, mr. Chairman. Thank you, gentlemen. I have two questions, one dealing with the encryption issue and the other dealing with our response to Cyber Attacks and intrusions. On the encryption issue, there are several issues. Theres the technological question of can we or can Silicon Valley design a technological solution. Theres a desirability question, even if they could, is it desirable . Do we gain more from having encrypted communications immune from cyber hacking than we lose in Law Enforcement and ics ability to get the content an communications . So whats the desirability of a solution if we could achieve it technologically. Then theres the economic argument. These companies have to compete overseas. There are others that are offering an encrypted platform that people migrate to. So what do we achieve apart from harming our economic interests by insisting on a key. So i wonder if you could address those arguments that we hear from industry about this. How do you evaluate it . And on the technological issue, 20 years ago the National Academy of sciences did an analysis of a related encryption issue and the clipper chip and came up with a neutral and thoughtful analysis. Would it be worthwhile to have them take a look at this question . Is there somewhere we can go for an objective answer to the technological question that is held distinct from the economic interests at stake . Is it worthwhile pursuing that kind of neutral analysis . So id be interested in your comments on the technological feasibility, desirability, and economic implications of the encryption debate. And then on the cyber front, it seems to me that there are two very different kinds of cyber issues were confronting. There are the Cyber Attacks well, actually, i guess three. Theres Cyber Attacks like sony meant to do damage, Cyber Threats to our infrastructure would be in that category. There are cyber thefts, so economic espionage for the purpose of benefitting foreign corporations. Then there are foreign intelligence gathering efforts. It seems to me that for many of our adversaries in this realm, like the chinese, theres an advantage to blurring the distinctions between these. If they can blur the distinction between economic theft and foreign intelligence gathering, then they can justify anything they do. And seems to me its in our interest to draw clear lines between foreign intelligence gathering and economic theft. And yet, when i hear the discussion, sometimes involving opm and sometimes involving other things, i hear us in the ic blurring those lines. So i wish you could address that. Shouldnt we make clear what the rules of the road are, that we dont engage in economic espionage and we want to insist that others also dont engage in that kind of theft . And think about whether there are any rules of the road in terms of foreign intelligence gathering, but keep though questions distinct. If you could comment on those two issues. I think ill turn for those two questions to two of our panel, and ill start with director comey, then admiral rogers. Ill offer reaction on the encryption question. Thank you, mr. Schiff. First of all, i very much appreciate the feedback from the companies weve been trying to engage in dialogue with companies because this is not a problem thats going to be solved by the government alone. Its going to require industry, academia, associations of all kinds, and the government. I hope we can start from a place we all agree is a problem and that we share the same values around that problem. When i hear people talk about the crypto wars, it throws me because wars are fought between people with different values. I think we all share the same values here. We all care about safety and security on the internet. Im a big fan of strong encryption. We all care about public safety. The problem we have here is those are in tension in a whole lot of our work increasingly in counterterrorism and counterintelligence work, and given that we care about the same things, i hope we can agree we ought to come together to solve that problem. Ive heard from a lot of folks its too hard, and my reaction to that is, really . Have we really tried . Have we really tried . When i look at industry today, i see companies im not going to name them here but Major Internet Service provider who are able to comply with court orders because they strongly encrypt. They can read our emails and send us ads. Ive never heard anyone say theyre fatally flawed from a security perspective. I dont think weve really tried. I also dont think theres an it to the solution. I would imagine there might be many, Many Solutions depending upon whether youre an enormous company in this business or a tiny company in that business. I think we havent given it the shot it deserves, which is why i welcome the dialogue. Were having some very healthy discussions. And with respect to the second part of your question, sir, i mean, i think youve correctly characterized there is no one size fits all to describe the spectrum of activity we see out there. I think thats one reason why you see response to different events are not always the same. We try to look at each event in its own context. Sony clearly, for example, in the first category as youve suggested an offensive act designed to create damage versus much activity we see, which is clearly designed nation states attempting to gain economic advantage, whether thats for competitive purposes or attempting to steal insights that they can in turn generate and use themselves to develop capabilities that are of interest to them. The theft of information i think its one reason why to date weve tried to be somewhat nuanced, if you will, in how we, as a government, have responded. It goes to some of your Opening Statements about the longterm end state we have to get to of this idea of acceptable norms and behaviors. And what is within reason and what is not within reason. We clearly understand nation states use the spectrum of capabilities they have to attempt to generate insights in the world around them. But that does not mean that the use of cyber for manipulative, destructive purposes is acceptable. That does not mean the use of cyber for the extraction of massive amounts of personally identifiable information is acceptable. Were going to have to work our way through how do we develop all that in a much more refined way than we have to date. I have to say, sir, that, of course, many of these issues that you raise are significant and also policy issues. Not really the realm of the group of people sitting here. We can try to speak to them, but i do feel compelled to make that point. On your concern about conflating or not distinguishing between Cyber Threats for economic purposes or for foreign intelligence, youre quite right. Its not that we dont make that distinction, but the adversaries, notably the chinese, do not. They dont see a difference at all in the ultimate purpose for which they extract data from us. So i just want to, you know, kind of make that distinction. I also and this is a personal view with respect to that which is conducted for espionage purposes, i just would caution we think in the old song about people who live in glass houses. We should think before we throw rocks. So these are very, as you correctly and appropriately allude, very complex policy issues. If i could just drill down once more on both very narrowly. On the latter issue, are there any rules in the road when it comes to foreign intelligence gathering . Or is it even futile to try to develop them . Because if a nation decides its in their National Security interest, theyre going to do what theyre going to do. Or should we try to establish some rules of the road for foreign intelligence gathering . And on the first point, if director comey, you could just give your thoughts on what you make of the economic arguments that other companies are going to do this. Theres an advantage to having healthy American Companies in this area, both from an economic and National Security point of view. Arent we at risk of losing that . Jim, go ahead. I think its a reasonable concern. I have two reactions to it. First, i think its incumbent upon us as a country to decide how do we want to govern ourselves and our affairs. Whats the right thing for america. There are lots of costs that come with being an american business. Youre not allowed to employ children. You cant pollute the environment. We impose all kinds of rules on people that other countries dont, which is a disadvantage to our companies. Weve decided we want to be a certain way. I think we ought to start there. But look, im not blind to the fact they have to compete in the International Marketplace with other countries that share our values. So i got to imagine an important part of this is going to be an international set of norms where countries that care about those same things, safety on the internet and public safety, come together and establish this is how we will act. For example, i could imagine us saying, if there is a neutral and detached magistrate thats found a basis under the law for this information, then it can be obtained and the company must find a way to provide it. Thats the way the rule of law that governs our allies around the world is, and i think that would be an important part of any agreement that resolves this. And i hear from our allies all the time, the french want the same thing, the germans, the british. I think thats something that could be done. So ill just comment that on the rules of the road issue that i think its fair to say the United States has more rules governing the conduct of foreign intelligence than any other nation on the planet. Exemplified by pbd28, which of course governs particularly the conduct of signal intelligence in this country and to some extent extends civilian privacy productions to foreign citizens. I dont believe any other country does that. So we do have an elaborate set of governance tenants that influence the conduct of intelligence in general and signal intelligence specifically. Dont see too many other partners that would similarly align with with us. Thank you, mr. Chairman. If i may, admiral rogers. I think you wanted to add. The only other comment i would make is in many other areas, we have been able over time to develop a set of norms about a sense of what is acceptable and what is not acceptable. I think over time well do the same thing in this environment, but we clearly are not there yet. I would just reinforce the dnis comment about there are very specific things that i find foreign intelligence organizations doing in the cyber domain that quite frankly are illegal for us. We cannot do. Its a very different set of rules out there in many ways, between us and the activities i see others engage in. Gentlemen yields back. Yield five minutes to the gentleman from georgia. Thank you, chairman. We passed a good cyber bill, i think, out of the house that allowed businesses to share information without the liability question. As adam mentioned, you know, we hear about a tax and we hear about intrusions. When does playing defense become offense . In other words, if some of these companies have picked out a marker, we have determined where it is coming from. Do we continually play defense with that or try to come up with a better defense, or is some action that we might take going to be considered offensive to whether its a nation state or, you know, another company or whatever . Where is that line at . So for us particularly in the dod side, im pretty comfortable that weve got a fairly well understood characterization of what is defensive in nature in terms of actions and response. The bigger challenge in some ways is there is still uncertainty about how would you characterize what is offensive and what is authorized. Again, that boils down ultimately to a policy decision. To date we have tended to do that on casebycase basis. In terms of your fundamental premise, i think, importantly, and a comment i certainly make when im part of discussions, a purely reactive defensive strategy is not ultimately going to change the dynamic where we are now and the dynamic we find ourselves in now i dont think is acceptable to anyone. When you say its a policy issue, are we talking about a policy issue that comes out of the white house . So the application of cyber in offensive way is an application of force. The application of force under the law of Armed Conflict in the broader policy construct we use as nations, once you move beyond selfdefense, is a decision that is made at a broad policy level. Its no something that i as the director of nsa or Cyber Command unilaterally decide. Its not the framework. Not unique to the cyber world. Its the same fundamental construct we use for the application of force in the kinetic world within the department of defense and more broadly in other areas. So how is that sifted out . I mean, who makes that determination . So it depends on a casebycase basis, but clearly the secretary of defense is granted some authorities. The president retains some authorities at his level, and thats all part of the process that we work through and we deal with each individual event on the merits of its own. Well, you understand that when the public hears the word attack, it gives off a little different meaning than if we say intrusion. Right. Which is one reason i think you also raise an important point. Terminology and lexicon is very important in this space. And many times ill hear people throw out attack, act of war, and i go, thats not necessarily in every case how i would characterize the activity that i see. So it is a good distinction to make in just using the opm breach as a case in point, though its been characterized by some loosely as an attack, it really wasnt since it was entirely passive, and it didnt result in destruction or any of those kinds of effects. So that the distinction you point out, and thank you for doing that, is quite important. And as admiral rogers says, the lexicon, the terminology, is crucial. If a company or they discover that theyre being attacked by a certain entity or whatever and they use a means to stop that attack, in other words, they can figure out how to stop that attack, do they do can they do that offensively, i guess . And what would differentiate between an offensive move and a defensive move . First of all, theres a clear line in the United States, it would be a crime for any private actor to engage in an offensive cyber operation, to penetrate without permission the Computer System of another. Thats a statute that this congress has passed. So thats a clear line. I think it also makes good sense to those of us in the Intelligence Community that we dont want selfhelp because of the nature of the cyberspace is that there are unforeseen consequences that are could be dramatic and unforeseen. I think getting back to the definition i think thats what were looking for is a definition of what is offensive and whats defensive. But thank you very much. And i yield back. The gentleman yields back. The gentle lady from alabama, ms. Sewell. Thank you, mr. Chairman. I want to thank all of you gentlemen for your service to this nation, for all of the important work that youre doing in your various agencies. I wanted to drill a little bit deeper into the question that congressman westmoreland raised. Director clapper, you suggested that the opm information that was stolen wasnt used for any nefarious activities to our knowledge right now. I wanted to know what your thoughts were about how the information that was stolen from opm or from anthem is being used by these cyber actors. Well, what weve done is speculate how it could be used. And again, the distinction i was just making with congressman westmoreland had to do with the terminology of saying that the opm breach was an attack. And i dont, again, getting back to the definition, we wouldnt characterize it that way. Whats of great concern with respect to the opm breach which i spoke to briefly in my Opening Statement had to do with potential uses of that data. And, of course, were looking. Thus far we havent seen any evidence of their usage of that data. Certainly, were going to be looking for it. But its of great concern to the employees who are potentially affected as well as their families and coworkers in terms of how it could be used in a very damaging way. Not only institutionally in terms of particularly for intelligence people, but in general, how this could be used to inflict financial damage, for example. How does the various agencies work in a coordinated effort with respect to Cyber Attacks . Can you talk a little bit about how the if youre talking about the intelligence agencies . Yes. Well, we are very, very mindful of that, obviously. I mean, this is a case where we probably need to set the highest standard and example. And so, i know in my own place, i have a very intensive effort on securing and ensuring that our networks, in my own headquarters, are secure. And i know my colleagues are doing the same. Let me ask admiral rogers to comment, as well. And i think jim comey may have a perspective, as well. I think first question is which is the domain that is receiving this intrusion . Is it within the dot mill, the dot gov, is it in the dot com, dot edu, in the isnt it a coordinated effort . It is. I know it may start in one particular agency which has jurisdictions, but i would assume that its coordinated across all of our system . It is, but my point is the coordination, who has lead, the primacy, it varies by the, if you will, the entity that is being penetrated where it is, in the government, outside the government. If we use the dotgov domain as an example, the department of Homeland Security has overall responsibility of the dotgov domain, dhs, overall responsibility in the dotgov domain. So if you look in the opm scenario, for example, you saw opm as they began to realize what had happened as they realized this is beyond their own capacity. They turned to dhs. Dhs, in turn, then turned to the fbi and nsa to provide technical support. We do that continually. Weve done that particularly between nsa and the fbi within the government domain, increasingly we find ourselves when requested attempting to support highend intrusions in the private sector, sony, as an example, for example. Is there anything that could be done to enhance that cooperation coordination . Theres always more. I mean, from my perspective, as i talked to my teammates, speed is critical here. Focus, leadership, buyin, the ability to set up mechanisms to more rapidly flow information back and forth with each other, the more the ability to put expertise more quickly on the problem set. We continually get better, but for me, at least, and part of it is the obviously, one area that, of course, we could improve is in the government to private sector. Right. Relationship. Thats why the legislation is so important. Let me ask director comey as well if he has a comment. I agree with what admiral rogers said. Weve made dramatic strides in the last five years. I think of us this is probably a homely metaphor, but were kind of like a fire station. When the bell rings, we send all the trucks. We dont ask, do they need a hook and ladder . Do they need a rescue truck . Do they need an ambulance truck . We send them all, and that means we send nsa, fbi, dhs. We talk to each other, then figure out whats needed at the scene to help these people who called 911. That has gotten dramatically better. Our primary way of sharing information is through the nci jtf. Which i hope you have had a chance to visit. We all sit together and in human terms and electronically, we share that information about what do we need to respond to this particular fire . In my remaining time, i wanted to commend director brennan on your tackling the persistent problem of lack of diversity in the i. C. I know that you commissioned a report, and i just want to commend you on seeing the need and look forward to working with all of the agencies represented in making sure that we address our lack of diversity in the Intelligence Community. I yield back. The gentle lady yields back. The gentleman from florida is recognized. Mr. Miller. Thank you, mr. Chairman. Somebody said that iran did not have the technical capabilities that a russia or a china would have. Is it safe to assume and i use that word assume in quotes that russia would give some of their capabilities to iran to use it in the cyber world . Sir, that might be best left to a closed discussion. Somebody talked about attribution, also. How do we distinguish between a statesponsored hack or attack and an individual . Jim . Do you want to try that . The way we do in almost any other circumstance, we try and see what facts we have to connect, the individual at the keyboard to a particular government. Sometimes its direct evidence. Sometimes its circumstantial. Sometimes its the tools used. We put together those facts and say what judgment can we make to attribute theres always a human being at the keyboard. That human being to a particular state actor. And the only other comment i would make is then well compare the activity that weve observed with that which we have observed historically over time, looking for similarities, other connections weve previously been able to determine. Are most of the attacks designed to glean information or to disrupt . Well, again, the terminology attack versus gleaning information, and to this point, its either been, you know, disruption of a website, for example, but more commonly just proloining information. As i indicated in my Opening Statement, though, i believe that the next push on the envelope here is going to be the manipulation or deletion of data which will, of course, compromise its integrity. Going back to the russia iran issue, and i know going back to russia and iran, and i know there are some issues that we cant talk about here, but russias setting up a Cyber Command. How about china . To the best of my knowledge, the chinese have not yet gone to a configuration like the russians appeared to have with establishing a cyber com somewhat analogous to admiral rogers command. But thats not to say that the chinese, as you know, have very capable structure and apparatus in their current p. O. A. Staff structure. I yield back, mr. Chairman. The gentleman yields back. Mr. Quigley is recognized for five minutes. Thank you, mr. Chairman. Gentlemen, thank you for being here, and thank you for your service. I guess we hear most often of the highprofile hacks, Cyber Attacks on the u. S. Government and major corporations. But as you know, the majority of businesses in the United States are Small Businesses. And we have thousands of very small local governments. They still contain in their computers extraordinarily sensitive client information or public information. Yet, as we can imagine, they often lack the sophistication, the capabilities, the expertise, the knowledge, the resources to meet this challenge. What, if anything, are we doing to reach out to those entities and try to help them meet this challenge . It is absolutely a concern of every business in the United States from the traditional mom and pop up to medium size to large. And so, we have with the fbi is doing about it, is we recognize that thats a threat to everybody because our whole lives are connected to the internet. So in every community in this country, we have something called infraguard which is designed to offer a vehicle for those folks to learn from us best practices and warnings and indicators and for them to be able to share information thats useful to other Small Businesses and to the fbi. So id encourage Small Business folks, contact your local fbi office. Were in every community in this country. We have over 500 offices. Join infraguard. It will make you smarter, and i hope in the process it will make your government smarter. I would just add, as well, the responsibility, and only because theyre not represented here today, is the department of Homeland Security which does have a responsibility for engaging at the state and local and tribal and private sector segment. And i appreciate that. But the lack of resources, you know, we hear so often that its becoming cheaper and easier to hack and more expensive and difficult to defend. Is there some other way besides this that we should begin to look at in terms of trying to balance the field between the resources a Community Bank has versus a Major National bank . Just as one example. One of the things that we need to continue to do better as a federal government is equip our state and local partners to investigate crimes that are digital in nature. And thats something that sheriffs and chiefs are hungry for. The fbi and the secret service are pushing out lots of training, pushing it out online so people from their desk in a polita