Transcripts For CSPAN3 Politics And Public Policy Today 20160914

Defenses. The first session for the evening is from pete and joyce giving Public Sector perspective on this topic. Pete was former cto for department of energy, currently a member of icit gala board and ceo of doths and bridges. Joyce Hunter Deputy cio policy and planning for u. S. Department of agriculture. So please help me welcome our first speakers. Great, thanks, parham. I appreciate the chance to be here. Two villanova grads, if youre wondering what the v stand for, pretty excited, it was a good year for us. Again, im only about nine, nine and a half, ten months removed from the federal government. Whats most exciting after 25 years and spending the last 7 1 2 or so at the department of energy was the opportunity to sort of take what i was doing in my role there. That was working inarguably the members us of the critical sectors, the 16 we know exist today but also on this panel or this conversation were going to talk a bit about how joyce at the usda and department of energy, collaboration thats needed to really talk about this complex ecosystem. My time in government was very rewarding. Being on the outside now and looking back, this is a topic, Critical Infrastructure that is pervasive. It touches the Public Sector, federal government, private sector and i should say state, local, tribal and territorial communities as well. But the private sector and investment thats needed r d thats being done, well talk a little about that part of the ecosystem and the Consumer Sector. I think most of us when we go to bed at night and flip the switch off or get up and turn the switch on, drink the water, take the shower, eat the food, take a plane somewhere, i know we may pretty it subliminally but these are the things, thats the consumer element of this infrastructure that i dont care we take for granted. But when the light doesnt turn on or the water doesnt get warm or come on period, not to be an alarmist, to parhams point but we rely and depend on this. Maybe if theres a a snowstorm, the power might be out for two days and you enjoy it. After three you get a little antsy, want to shave and get the power on but you assume things will kick back up. What wed like to do tonight and talk about it later in our second panel really how the federal government and the role it plays from oversight, if you will, and the relationships it is having with not only amongst the agencies but also what kind of the compliance versus the mandate versus what do i need to really know to really move that pendulum forward ash innovation. What well talk about is not so much the sectors themselves, the Critical Infrastructures are there to simply identify where are we at risk across the 16, again, the ecosystem itself its quite diverse but more important we want to look at what are the threats today beyond physical threats and Natural Disasters. Cyber security is now going to impact our Critical Infrastructures. The human factor, which is not just Insider Threat but you think about an aging workforce, a Skilled Workforce that knows the infrastructure as it exists today that was purpose built 100 years ago to do a job it effectively is still doing. As we address the internet and its impact or the internet protocol, the smart grid, which sounds cool but really the same concerns we have in our agency, business, and Home Networks we now have to think about those as threats as we make the grid smarter, the power grid and, of course, the impact downstream on other Critical Infrastructures. Thats a little about my passion and interests. Again, im excited to be talking here with my colleague, joyce, who is going to paint a little bit of a picture on the mission of not only what we may think the usda is but its impact. Joyce, why dont you address some of the things we chatted earlier about and not just what the usda is doing but its Critical Role and its dependencies on other sectors. Just a little bit of background. I went the opposite way of pete. I have been in federal Government Service for about 3 1 2 years, spending 25 years in industry and then five years with my own i. T. Consulting company, so i came from the opposite end of the spectrum. But i think that agriculture is very complex. Im a city girl. Urban, born and raised in philadelphia. So what did i know about agriculture . Not much. I spent a lot of my time in my previous life in health care. So i knew a lot about health care and i was a very mission focused person. And agriculture is a mission focused organization. With Critical Infrastructure have you to realize with agriculture we have 29 agencies, staff offices and mission areas. Some of those include areas like Animal Plant Health Inspection Service or Food Nutrition Service or nes, National Agriculture statistical agencies. Those are influential in the marketplaces. When you really look at it, its complex because we do not only production but processing and delivery. So production, the farmers, producers, and ranchers. The supply chain also includes areas such as processing. You have tyson foods, other processing organizations. Then on top of that you have the delivery. So you have the Grocery Stores and then you also have the food chains that access the food supply. When you look at it, any one of those areas could potentially be a target for any kind of contamination. We ploy a lot of inspectors, meat inspectors, egg inspectors, chicken inspectors, you name it, we can inspect almost anything. They have even added tilapia not tilapia, but catfish, i guess because they are grown in farms. Therefore, farms, catfish, so weve got catfish now. It is of great importance to us because our job is to protect the American People. And to be able to supply those security features and security measures so we can make sure that the food that is grown from a production perspective, you look at it, its more than just the food, its the soil, whats in the soil. Its the water. Its the water that takes care of those plants. Its the pests. We have introduced several pests. With people traveling as much as they are, we have to really admit that sometimes these are not maliciously brought into this country but they are just travelers. Bugs attach themselves and come along and come along for the ride. They get free airfare and come in and lodge themselves in our citrus organizations. There is a big now that is destroying the citrus population in florida. Imagine this, it has made its way across the country and it is now in california. We just recently had a hackathon to try to come up with various measures in which we can try and find this bug and report it as it is trying to grow and develop. So those are the kinds of things were involved in in trying to keep our agriculture products safe. That was awesome. You touched on a couple of things i just for clarification purposes when i mentioned 16 infrastructure sectors and you can find those by googling 16 infrastructure sectors in our country obviously and they are unique. One of the things tonight we will address theres an unintentional silo effect that occurs with every sector, every agency and in the case of dhs which oversee a bit of activity and policies in those sectors. Information sharing, data collection, creation, analysis around each of those sectors as we my great data to the cloud, engage in analytics, which is a hot term in washington and i imagine any revenue business that wants to understand and extract value from whether the intellectual property associated with domain space, theres a theme in order for us to create a more resilient infrastructure. Yes, its available today. The light should turn on and may turn object. You could see its reliable to an extent. It might be out a few hours. This injection of technology and the analytics associated with the amount of data we create as an agency, federal agency, i can tell from the Energy Sector standpoint, the value of turning data into information is extremely valuable and information sharing to be an effective ecosystem requires collaboration. I dont mean, hey, lets get on the phone and have a Conference Call and talk about what we think is important, thats part of it. You have to be willing across those sectors, private and Consumer Sector to engage in a dialogue not always 50,000 foot level but bring it down a bit and a bit more to talk about. Hey, maybe some of the data we have generating and how youre protecting it is how. Joyce, you hit on a couple of things, worth referencing, dependence on sectors. I never thought about food safety and Food Security terms when i was doing a Little Research into how usda was approaching it. From the energy standpoint and Energy Sector generation and transmission and storage and delivery and distribution of energy. What im eating and where it was grown and the impact of fertilizers, you were recently out in northern california, i believe, with some of that hackathon and awesome activities where youre doing a lot of crowd sourcing and communicating with the public to look at innovation. Water Transportation Systems and Chemical Services are impacted, food and agriculture are impacted by those. The food deliver y, supply chain. When we think about Critical Infrastructure and impact cyber is having and the report generated and all these bad actors and trojans and worms and all these things that are affiliated with more of an internet or computer or Technology Oriented discussion, there is a supply chain for food and agriculture. Theres a supply chain for dams sector, Defense Industrial base. Looking at that ecosystem again across and having the impact the internet protocol will have in those sectors, you see that merging if theres something i should be worried about on infrastructure and data center, its probably something i have to be thinking about and can have Lessons Learned and translate that out into if youre a commercial owner and operator in the case of Utility Electric utility, oil, natural gas, at least from my world and production facilities in the fda. So let me ask you a question here. We here a lot about regulation, compliance, an agency that is the ultimate nonprofit, if you will, federal government. We are investing money in r d. A lot of the federal government pushes money back out for research and development element. How do you feel that its balancing meeting and being compliant with regulation versus stimulating ecosystem the president talks about when he addresses it in his Cyber Security National Action plan. We have to have a lot more not just reliable but resilient secure infrastructure thats flexible. How do you balance that tension or address it . Its very difficult. As we know, sometimes the government does not necessarily move at the speed of light. But if were going to stay ahead of things like i said before, there are Natural Disasters home grown bugs, the bugs inserted and other organizations that want to get ahold of information. Having signsbased surveillance is key and critical to be able to figure out exactly whats going on. That means youre going to have to ploy and talk to other agencies. So we have to have a relationship with energy. We have to have a relationship with transportation. As we are growing more crops in climates like california, arizona, other areas, and they are shipped akrcross United States, we have to make sure they are secure. Its a multiagency relationship we have to have. Surveillance systems are steamily important. We have to determine exactly where the source of the problem is. Remember the avian flu last year . It was kind of marching its way across the country. Being able to work with transportation organizations and farmers and other places to be able to provide that information ahead of time, letting them know theres a tracking system that we have put into place that allows them to find out where the disease is going to be next time or where its going to be the next season. As you know avian flu only starts up when the weather is starting to get cold and birds start migrating. You have to have some kind of tracking system on the birds so you know where the birds are flying and where they land next time. Its a lot of sciencebased information that you have to employ. Sometimes legislation and scientific discovery and innovati innovation. Sometimes they dont commune with each theres a lot of fear, uncertainty and doubt, what i call fud in the system. A lot of people think too much Scientific Investigation leads to the frankenstein effect, whereas it basically is necessary to inform and educate. It allows everyone to make better decisions. Farmers, producers, ranchers and consumers. Thats what we use the data for so we can better inform people whats going on. How it is going to affect them and what they can do to mitigate some of the circumstances that they have. Legislation sometimes is slow to come about. And sometimes a lot of the directives that come out dont come with money. The Unfunded Mandate. The Unfunded Mandates. So a lot of times were thinking the agency isnt moving fast enough, a lot of times the mandate didnt come with funds so we have to rob peter to pay paul to actually get some of these things done. Its not necessarily that we dont want to do it, its that sometimes we have to figure out how we can do it. Thats not going to be a burden on the consumer as well as not be a burden on the agency providing that particular service. Well said. You hit on a couple of points to wax or riff off, theres definitely no shortage we know about and the report so well done referenced a lot of chronology or genealogy of what is Critical Infrastructure. I highlighted 10 in my notes i find that build on one another. For those of you listening and watching theres great material at the dhs website for starters begin thats a defactors portal for a lot of information and it can be overwhelming. When you start with what does Critical Infrastructure mean, its the animals, its the electricity, its the networks that we use. Its the distributed Energy Systems that we hear and read about but wonder what it is. I like to break it down to if i was talking to my phone which i do, the power grid is a network. Its an antiquated one and one that works but purpose built with platforms that needed to be available to the consumer to provide power. When we think about how to approach today, network in house solution building out ping, power and pipe we called it back in the day in the data centers i worked in. All that plumbing behind the scenes to allow us to do email, applications to do phone mail, convergence of telephony, voice, video, data on one wire coming out of the wall, that freaked a lot of people out. I was fortunate enough to be in education at the time and i was asked to spearhead an effort to take that bull by the horn and really a make it happen. Who today doesnt think i want to have one bill that handles my voice, video as well as mobile phone bill. Its innovation that seemed to not so much outpace the technology or situation at hand. I think with the Energy Sector and i dont want to speak for the Agriculture Sector but were seeing a case where very slow to in accelerate, if you will, or implement the innovation. Theres a country of innovation happening in the government. The government spends arguably about 150 billion, with a b, every year on r d. Theres a big chunk on r d spent on physical, cyber, electricity, oil and natural gas systems and of course in the farming industry, et cetera. Using satellites to watch crops g generate or grow. Geology and nasa together in california. Theres this linkage of technology that requires that Institutional Knowledge of what does a farmer see and deal with every day. The convergence of telephony put people out of work. It took aging infrastructure and not so innovative and said, hey, we need to build something thats going to force that workforce to become more of an expert in new technology. Some folks said, hey, its time to cash out my chips. I dont want to learn about voiceover ip stuff. Were seeing that as more of a challenge with aging infrastructure and aging workforce. I dont want to gloss over that. What you also said, joyce, that really caught my ear, you did reference the information and technology thats available today is allowing taos make data driven decisions. If im a farmer and used to do something a certain way, i might not be asking you new technology i need information extract freddie your brain to know what is the best way to irrigate. What is the best time of the year to do the i think so you referenced. On the energy side the smart grid is the hot topic. Smart grid, i was guilty back in the day thinking one day it was going to be at my house. Yeah, i have a smart meter in my home but i dont know who is watching that data, what its going to do. The idea of controlling it from the beach or driving an Autonomous Vehicle and interesting internetwork, i embrace innovation but im not sitting here saying i want to be the first person and early adopter. Thats a challenge and thats incorporating standards which the good folks at federal Regulatory Commission and it cant be adversarial, coalition of the willing like joyce and i like to refer to our selves as. I appreciate the fact that you emphasized data and analytics in driving some of that innovation. I think one of the things we have to understand that agriculture is no longer beverly hillbillies and green acres. So people out on farm now have gps. I was last summer, two summers ago, maybe two and a half centers ago i was out in iowa and taken out to the john deere r d facility. I expected some grizzled senior mature man to come out in overalls and help me drive a tractor of some sort. I was absolutely amazed and floored when a young man about 21 years old, graduated from iowa state six months ago, tshirt, jeans, had his tablet, waved me over to the planter, got into the cab of the planter, took his tablet, plugged it into the console. He his cd changer and put his ear phones on his ears, plugged it and programmed it and gave me the joystick and said drive. Thats where we are. Datadriven information. The planter drove down a prescribed path, turned around. It missed a spot. Once it completed its run, it went back to the spot it missed and planted the seed. It takes that information from the soil, uploads it to the gps system and sends it out so agriculture or one of the other agribusinesses can prescribe a prescription for the soil. Too much water, too much oxygen, too much nigtrogennitrogen. That information, thats what were concerned about. When were talking about Critical Infrastructure, were talking about people being able to get ahold of that data and being able to use it for either nefarious purposes or for purposes of their own. One example eggs weve highly we really, really do protect the information that nas has, our statistical agencies because they are the ones that inform the stock markets. So you have the markets of soybean, wheat, corn, et cetera. And if anybody were to get into that, they could adjust the markets and either become very rich or become very poor. So thats part of the Critical Infrastructure that we need to protect. So its a very complex organization, and its going to involve a lot more data sharing so that we have the information thats necessary in order for not only us to make decisions at the agency level but also information that we can inform our stakeholders. Great, great points. Now, the transition there, as you were speaking, got me thinking about the triage of Critical Infrastructure protection, Cyber Security and go down the path of what elements of Cyber Security, many elements there, user entity behavior analytics, incident detection response, there is models and simulation of an environment so you can see if something happens prescriptively i need to be prepared for. Zero vulnerability report. We know we read before this event. Highlighted. That will grochl the same report a year, six months from now will have new threats. What i took extracted from what joyce is saying. Again, Natural Disaster threat. The Climate Action plan is not a bad read in terms of how do we prepare when theres changes in climate. There are definitely Cyber Security threats, again, whether its the power grid, agricultural food, what we worry about in data centers we need to worry about. Back and forth flow of information. I think its great you vp people out there. Im looking for actionable activity. Actionable intelligence is a great word, sexy to say, internet of ideas. From a consumer perspective we expect iphones to be privatized and protected. We could have a whole other discussion with Health Care Sector about hipaa and that aspect. Information flow, incident response, Cyber Security as it relates to Critical Infrastructure i think its pretty awesome and amazing that these only these 16 sectors are so intertwined. This is one of those factoids. From an energy perspective, this is what the power grid is today. Think about this. Two points quadrennial energy review. Approximately 2. 6 million miles of interstate and intrastate pipelines. 640,000 miles of transmission lines, 414 Natural Gas Storage facilities, 330 ports with crude petroleum and Refined Petroleum products and more than 140,000 miles of railways with crude petroleum, liquefied natural gas and coal. If you think about that in the context of thats a network of stuff, physical stuff. There are folks out there that are shooting guns at physical plants and transmission facilities. There are drones that are being used now to not just spy on electricity and facilities that are in the middle of many rural areas in the country but literally picking things up and dropping pieces of metal and so forth to bring down transmission facilities. Thats a physical threat. And then the cyber threat weve talked about, whether its stuxnet, what have you, thats a good example of one thats like, thank goodness it didnt happen in my backyard but it can happen. With this wireless information of data sharing, who is protect thanksgiving data about my information as petco customer, satellite from farmer to utility. We have to think about that from foreign nation perspective. Thats where the report addresses bad actors inside and outside. That triage is something we want to take away today that affects all 16 of the sectors. If we go back, he quoted some figures. If we look at agriculture, there are 2 million farms, approximately 900,000 firms and 1. 1 million facilities. Thats a lot of information. If i could say that over five years ago i say there are three things that worried me. The things that worried me five years ago still worry me. Cyber security, infrastructure, and i. T. Workforce. It was true then. Its true now. Well said. Joyce, pete, thank you very much. Can we have our panelists come to the stage. While our panelists are getting settled that was a really great conversation. One of the things we want to show today is the connecting points between the different sectors. Energy is not independent of agriculture, which is not independent of transportation. These are all interconnected. So the more we get stakeholders in each sector to understand dynamics that play within National Ecosystem with these issues drive Holistic Solutions to some of these problems. So the final panel for this evening is going to cover the content of the paper and have some experts share their perspectives on what was discussed and share anecdotes from their own points of view. To my left product manager from force point. Jay williams, fellow and Vice President of Cyber Infrastructure protection at parsons. To jays left is, of course, pete and to the far left is ryan, fellow and cto for Critical Infrastructure at fire eye. Thank you very much for joining us today. I want to start by giving the audience a lay of the land from your perspective. Describe current Security Posture of our nations Security Sector and how well are we doing . Ill take that one. I think were sharing a mic here. As far as the Energy Sector and other Energy Sectors, i think on the Positive Side of things we have increased our awareness for the need for Cyber Security in i. T. And o. T. Were taking necessary precautions and policies and guidelines have been created such as industrial standards, isa 99, 64423, and specifically for the Energy Sector, a series of nine security measures that entice both cyber as well as physical security. However, one of the areas we need to correlate Cyber Security is similar to where safety was 20 to 30 years ago in that Cyber Security is one of the risk factors that need to go into everybodys Risk Management plans. Cyber security needs to be part of the culture in Critical Infrastructure especially in the Energy Sector. The greatest thing is the Security Industry has matured to sound state of policies and training and procedures that could follow suit and pull Cyber Security in with that the other note i want to make in the ol t. Space, when i speak ol t. And industrial control systems, specifically level one and level two are not necessarily addressed very specifically in the documentation. Theres a ton of vulnerables in pocs and iot devices. There are thousands of protocols and manufacturers of those that are unique. Not like i. T. Where you have intel processor amd, windows or mac, thats about as far as it goes. In the iot down in the ot and industrial control level, a whole other bailiwick of controls. I would jump onto that and say, yes, its complicated. All of these things youve mentioned, its a very complicated sector to look at. The good news is its recognized. Were all here talking about it. The report was written. Were all looking at it. Everyone is ready to jump in and figure how do we tackle this and fix it. Thats where that information sharing that pete and joyce talked about earlier really comes in. Lets make sure were talking across agency, between agency and private sector so we can keep all of that Knowledge Base movi moving. Excuse me. One other thing. Its highly key to have proactiveness in that sector. They definitely lead the way as far as advance cyber and critical sect or, nerc cip. I would add if theres a theme from any sectors and the discussion were having, Risk Management, risk mitigation, minimizing risk is your goal, not the silver bullet. There is no silver bullet. Great technology as a claim. I can make sure you never have a breach in your power grid or Water Filtration system. I hope nobody really believes that. But mitigating that risk through innovation, and i have to give shout out to National Laboratories for those that dont know that ecosystem, amazing people doing amazing work for not just this country but the world. When you do a Little Research into what these places have on their plate in terms of taking some of those billions of dollars to look at how do we mitigate that risk from a cyber standpoint in this case in the Energy Sector, my colleagues here on the table i would assume agree that weve got to keep pushing that envelope, move the pendulum forward, connect the dots in the sense what could the impact be if this happens or that happens. Keep asking the question, continuous cycle. If you can create a bridge where you ultimately can say that information we learned in this sector can be shared, you avoid this noncollaborative or valley of death as we call it in the r d space. Thats something that is important. Please, if nothing, take away there are amazing folks doing research and development at the earliest level to invent but also to leverage with the private sector, entrepreneurs out there who have developed capabilities. Risk mitigation is something we definitely want to have as a theme when we walk out of here today. Absolutely. The next question is going to be based on one of my favorite quotes in the paper, just let it sink in. The paper states, the nation of survival depends on complex energy grid which in turn is dependent on assortment of Power Generation plants, distribution facilities and transport mechanisms to deliver energy to home and businesses that support life, business, operations and Critical Infrastructure systems. Think about that. It supports life. Were talking about things that when we mentioned earlier kicking off the session people consider this to be the most critical sector, this is why. My first question is what are factors that contribute to growing attack surface, why is it now becoming sing such a lar issue. 15, 20 years ago, no wifi, these controllers werent accessible at someones home on the beach. To your point, whole efficiency and uptime to the extent were introducing vulnerability because we want that ease of use and efficiency, were broadening that attack surface. Thats what scares me the most. Before Insider Threat, focus on my inside folks and if i get that locked down, good. Now opening ransomware we never saw before in industrial control now we are. Largely stemmed from phishing emails, never part of the industrial control, adps well get into later on. That attack vector surface was never there. I think through efficiency and ease of use have opened that up. So we need to take a step back and say how do we take your typical i. T. Cyber security and make them industrial control relevant so they are still doing uptime and efficiency but securing nations Energy Sector as a whole. In general technology and innovation what we seek for vulnerabilities, it is unavoidable. It is our responsibility as solution providers, public and policy creation to create a safe inform to continue to deploy those technologies and innovation in order to remain competitive and to remain as capable as we are especially like the Energy Sector and grid. As stated in the report and also on energy. Gov, weve decentralized all these different aspects of what makes up the sector. So weve got different transmission, generation, delivery functions, these are all separate markets. What used to all be one is now controlled, sharing and complexity weve added in, which strengthened a lot of it. In a lot of cases we control where they are. No one knows whats happening. The more we get control of that and know whats out there, the better we can mitigate and manage. Just a thought, when youre driving down the highway, working at energy did for me, you look at cables, phone lines and transformers, im no engineer but im like, man, somebody invented that and it does something really important. You just assume thats how it works. Now i think about what if a line was cut, what happens . Whats the Disaster Recovery like we think about if a server goes down. Thats where innovation is happening with terms youre hearing and reading about, microgrids, renewable fuels, distributed energy. Whether youre on a have a green thumb or not, the fact of the matter is the grid is growing. Theres new technology that we as a country are investing in. Bad things happen in fukushima. Bad things happen deepwater horizon. Bad things happen katrina. Those bad things unfortunately spawn opportunities to innovate and be able to predict if something happens maybe not have cities and people dying to parhams point after a few days because theres no food new york city clean water, no ability to communicate. I believe the federal government, publicprivate partnership, this innovation, r d invested is awesome and the reality is we have to i believe we should embrace it. We know things wont always work. There are cyber risks. You can take a data center down three days and say, hey, its maintenance window. You dont do that on power grid. Youre building we talked about this. Building cyber, bolting it on now and one day retiring but you cant bring down the power grid, right . Just say, hey, everybody, theres no power for a few days or a few hours. Its not convenient. That again adds to the complexity but we have to have streams of pushing innovation and inertia behind it, risk focused. Wait a minute, we dont want to open up the grid for a breach. The report talked about this current snapshot, that static list of 20 or so items we have to be thinking about and there would be more tomorrow. But we need to, as a country, respect the fact that those National Laboratories and other academic institutions or allow them to do that basic and research thats applied so that we cyber folk or Cyber Community enmeshed with scientists doing r d are looking towards really delivering that resilient flexible, scalable secure network we will call this generations power grid. Not the smart grid, just more features. One thing that was mentioned, stacy mentioned, increases efficiency but caused some problems. I want to focus that comment in the context of ot convergence. A lot are i. T. And o. T. Is becoming a newer concept for them. Can somebody talk about the phenomenon and whereas yes it is driving efficiencies but what vulnerabilities is that also creating . I think what we tend to forget about, we really beef up enterprise i. T. Side to maximum security and cyber but no one is losing their lives in these attacks, right . You take it to the o. T. Side, youve got german steel mill blowing up, actual loss of life potential here. That to me, talking about energy grid going down or take water going down in manhattan for a week, bedlam and brawl, stock market goes down, this is something we really need to take serious and really focus on applying that Cyber Security to that particular point. I think the really key point is convergence between i. T. And ol t. And how the attacker can attack through i. T. , cross dmz firewall and has access to controllers. On the flip side they can come in through o. T. And come across dmz firewall and get into the enterprise i. T. Side. So where we hear that concept of air gap, thats not really the case. Jay and i were at seemans together, a lot of Companies Say were air gapped, completely off from enterprise i. T. You go in there and find out 15 different ways back and forth. They didnt know that. I can guarantee you the attackers do. We really need to button up both sides of the fence. I want to take that from a different perspective, peoples standpoint. Cyber security is not Just Technology but people and process. One thing that anybody who has been in the industry knows, theres been this battle from i. T. And ol t. , industrial control engineers and i. T. Were coming around to accepting the fact it requires collaborative effort enterprise wide with i. T. And industrial control engineers and maintenance and facilities. But even more than that, it requires people from Environment Health and safety, requires people in auditing, requires sea level suite for budget to implement these things. Convergence between i. T. And o. T. Implies convergence with all our Critical Infrastructures. I completely agree. Its a bunch of folks who now need to talk to each other that never need to talk to each other. Maybe now they dont speak the same language. We have to educate all different sides of this issue and actually get everyone talking about the same things. Have you i. T. Come in spouting Cyber Security acronyms, i. T. Wont know what they are talking about and advice verse. We need to converse at the same level. I want to switch gears and talk about attributioattributio. For a long time, maybe a common thought. Attribution leave that to certain federal agencies and only lashlg companies who have the budget to go through that process. But something the paper talks about and weve been talking about in our circles is the value the attribution process provides to defending your sector, specifically Energy Sector. Can you talk about your views on that and why attribution can protect your investment. How can you protect something when you dont know the attacker. You have to know the attacker landscape. Are they criminal organization, a state sponsored attacker. Thats a good question because you have to understand, are they severely backed by funds. Do they have the ability and region and depth to do that or some Small Time Group out that got lucky. You really need to understand your attacker and be able to take that countermeasure and in turb build your protection up against that. Thats typically how i would just look at the service. Again, to expand on that, it gets back to something as simple if the sectors themselves, which we all agree are intertwined, who would argue they are not, youve got tension of regulatory body in some light is, you know, viewed as a compliance focused, telling us what to do and youve got owners and operators from pg es of the world and duke energies and Florida Power and light and coop in texas that doesnt have the dollars to invest in the innovation but the grid in that complex ecosystem that it is, it relies on each one of those entities no matter how much money is being invested or not. So if a pg e is doing some really compelling stuff and innovation around protecting assets, information assets, instead of like i dont want to share my secrets with another sector because i have customers and its my bottom line im dealing with, thats a mind shift, paradigm. Information sharing sounds great. After everybody leaves the room, are they really willing to do that. Im talking about sharing information not on who are your customers but how are you dealing with Cyber Security and incident protection and protecting architecture to say this is how weve done it at our utility or in our utility sector space. Thats to me, again, one of these it sounds really good. The white house, of course, pushes it. Its one of the most common terms if you search object threats to the Energy Sector, its resilience and information sharing and Cyber Security. Some people are doing some really great things. It doesnt do the country any it doesnt do it good if one sector or one business says were super and uber protected and then their neighboring state that they rely on for who knows what protection doesnt have time, energy, or workforce. This is something weve seen the needle move maybe not as quickly as wed like in the room but definitely move in the defense and intelligence spaces. So they have already started this path to better sharing with each other. Not always do they want to. But they do recognize once we are a collective and we do talk to one another, thats much more powerful. So i think perhaps we can take those Lessons Learned and hopefully share that with the Critical Infrastructure sector and all sorts of other sectors. I think to the point i do want to give credit to them, i have seen sharing. Are we going as fast as we like, probably not, but thats the nature of the beast. Joyces point earlier. We move at our i think this al opportunity where we are responsible also to work with our local, state and federal agencies, even fbi which there is threats detected, because they can help be that common piece that helps collaborate that data between the different infrastructu infrastructures. In addition to that, theres private Sector Companies doing global threat po portals that collaborate and utilize that data like an antivirus. Those of you who read our papers know we spend a significant portion of each report discussing threat actors and their motives and their preferred attack vehicle toctor. They list them out. We are proud to provide that to the conversation. I want to discuss from your perspectives some of the threat actors mentioned in the paper who are the ones who stood out to you for what reasons and any ideas there. I think thats i could go on for probably about an hour. You always hear russia, china. Theres two different types of motives there. Russia is typically in it for the monetary value. China is in it for trade secrets. Chemical, energy, water, thats Serious Business when you talk about the polymers and data. Its not about stuff blowing up. Its also about keeping the data. Dont want to see another jet that looks like our jets in the air. We want to focus on that. But there are other threat actor groups. Of course, you have russia with the dragonfly groups and chiet na wi china with apt. Axium is one of the most sophisticated out of china. You have Desert Falcon out of the middle east which a lot of people dont give tout to. You have a lot of different threat vectors. Either state sponsored order criminal organizations. They are targeting the Energy Sector. We need to look at what kind are these rand cyber terrorism is an act of war. The easiest way to take down is this. Now, i can take a group of individuals, highly skilled individuals inside a room and take down your energy grid your power, water. What are you going to do . Destroy from within and crumb blow on the ocrumble. We need to understand their tactics, reverse engineering, building our intelligence from that perspective. I just wanted to give Honorable Mention to Insider Threats. We cant forget about Insider Threats. They represent 80s. Its still legitimate. One of the higher areas. Frankly the good news is with just proper training and policies and end point hardening and basic best practices, we can scircumvent a lot of the inside threats. Good point. I will jump in on that. Recently, actually Just Announced today, 2016 ponymon report have some statistics. I will read them to you. Increasingly malicious insiders target privilege users to obtain access rights through social engineering as we discussed in the paper. And this has been an increase of 48 over 30 back in 2011. So were seeing that much higher percentage of speer fishing attacks and other this other social engineering avenues. Theres also a lack of visibility continuing to hinder the ability to determine if users are complying with policies. Is your training working . Yes, Insider Threat is so 80s. But we still have the problem. People arent listening. Our staffs are turning over. So as joyce and pete talked about earlier, were having an aging workforce, especially in the federal government. Millennials are coming in. Their view of security is different. Than most of us in this room. So we have to just be very aware of that. 57 of respondents to the survey said that organizations do not have capabilities to effectively monitor Privileged User activity. Your Privileged User is the one you have given the keys to the kingdom. So how do you know when theyre not doing something theyre supposed to be doing or doing something theyre not supposed to be doing . We have to be very cognizant of that. Its a different type of insider. Something thats i mentioned a few times tonight is that its said the Energy Sector is the most important Critical Infrastructure we have in our country and any country. I was wondering, do you agree with that statement . If you do, which i presume you do, why is it possible to reinforce that concept to as we mentioned in the onset of the discussion increase the awareness of this issue to ultimately drive better defense . So, yes, obviously, the Energy Sector is truly the backbone of all 16 critical inf infrastructu infrastructures, without energy, all the Critical Infrastructures fall. As far as reinforcing, as we continue to do, the Energy Sector is one of the few infrastructures that have a policy thats regulated. All the other Critical Infrastructures do not have any regulated policies or compliances right now. Nist is a framework, isas are guidelines. We have to continue to enhance. They came out with a new revision. We have to push deeper into the sector on a control aspect of properly protecting those systems as well. Continue the whole culture change. I just want to chime in that i dont want to steal president ial policy directive 21. But it does identify the Energy Sector as uniquely critical, because it provides an essential function across virtually all Critical Infrastructure sectors. From a consumer standpoint, if you give it a 10 Second Thought about when i flip that switch whats really happening, do you care, maybe not. If a cell phone is not working, we get frustrated. Things you take for granted that i think the Energy Sector not to be an alarmist, but ryan brought up a great point, when a city goes out and people dont have food and panic and mayhem and pill ladies and gentlem all that, you see the impact not having energy or power can have on our daily lives. The information exchanges that need to happen amongst policy makers, regulators, innovators, entrepreneurs, we need to make sure we have a bridge for the entrepreneurial individual who out there today has invented something that could encrypt data. Maybe we turn it upside down on es encryption. Maybe we have to think about not just mitigating a risk for the thing that is a known vulnerability but who is thinking outside of the box . I know there are people doing it. I think we cannot allow that road to innovation to be stifled by compliance and regulation and just meeting the mail. Which we all know happens. Here is a standard. I met it. I dont have do anything beyond that. It gives an opportunity to celebrate innovation. I think we need to do more of that in our country. And maybe it easier for those individuals that have a passion for protecting this infrastructure we know that is vulnerable today to have that voice. Whether theyre in a grand investing it today or in another country, we have to trust that there could be an exchange of information and a fluid exchange so that we can really push that again pendulum forward and create that inertia thats needed. We have about six minutes left. I want to get to the final two questions we have. We talked a lot about the importance of information sharing and collaboration between public and private sector, between different sectors, between different agencies. How can this come to fruition . I cant recall if it was in a previous offline conversation where we said everyone is collaborating and talking about it, but is it doing anything once you leave the room and talk about these great idea ss . Is it legislation . Is it innovation across industry s industry . Public and private sectors Come Together Extremely key and critical to us moving forward as a society in a secure society. I would like to call our security vendors. Being able to imbed a security, not from a Network Perspective but on that particular asset, is really going to be key to absolutely squashing any type of attack at that level. To jays point, how do we get down there, secure, embed it down at the proprietary level so we can ensure thats not overrun . Another good example of this i think that applies here is the smart city initiative. Theres much cities that are taking this on and even in Foreign Countries and nations. It really does exemplify the combination of combining all the private entities, Critical Infrastructures, transportation, energy as well as local government, local fbi, police, fire. Theres a lot more at stake in the sense of theres radio blockers. Theres all sorts of other threats that can actually influence a citys inf infrastructu infrastructure. If they cant respond to an emergency. So i think the state of indiana is an example. Recently held a largescale drill where they involved all ems, all emergency services, Critical Infrastructure, state and local government and local fbi and went through a Cyber Security drill of an actual incide incident. And i think its going to take those local and state entities that drive these type of activities that cross all these different agencies that really will make the difference in the long run. If i can try to triage my thoughts. I think in threes. If im an investor, if im a entrepreneur, a large or small business, lets focus on the folks who get up every morning and want to change the world. The government who is a not for profit arguably that says i will give money i will pump it into the ecosystem. The white house or the National Economic council and ostp, office of science and Technology Policy put out a document, its a great read, in november of last year that spoke about the American Innovation ecosystem. How do you feel the Entrepreneurial Community . How do you incentivize, which is something we talked about. How do you create an incentive for somebody to want to collectively share information . You have to think whats the greater good. The grant money that gets pumps in the economy. Im a fan of the grant. A lot of people dont understand what a grant is for. Go try to discover or work and team with an institution to invent something. When you can coalesce that we know its broken today. The president talked about the accelerating the transfer of technology into this ecosystem and out of and to commercialize and to create viability opportunities for that commercialization. Thats a broken process today. Its well intentioned like communicating and information sharing and all these committees that talk about it from the hill to the executive branch to the government agencies. I think people really want to make a difference. But in government and in these institutions where privacy and protection and staying ahead of your competition does stifle the ecosystem from accelerating. Thats something we need to really put a microscope on and figure out whats the best way to streamline that process. The last question we have a couple minutes left, want to make sure we have time for this. Joyce mentioned earlier that the Unfunded Mandate every organization out there, i dont know of one who says i have more money than i know how to spend. This is something we need to address. Its going to take money and resources to do t. How can organizations who feel they dont have the resources or they cant get new resources to do things we talked about, how can they reprioritize existing resources to go down the list . What does that process look like . Its really simple for me. Training and enablement. You look at something as simple as fishing, which could be easily caught by your trained companies. Most companies, 80 , 90 of the companies are coming out with negative fishes findings. Something as simple as that that leads to ransomware. Enabling the workforce to be stronger minded and understand the environment and be on their toes is probably step one to be quite honest. My Closing Remarks would be, you have to take the first step. Thats in the form of an assessment. You have to know where your vulnerabilities are, weaknesses are. The most important, you have to fix what you find. Unfortunately, sometimes the vulnerabilities hurt. Theres a lot of personal peoples reputations at stake. If you are going to improve, you are going to have to accept that. The message is that you also have to understand that. You have to create the budgets in order to be able to move forward with these. Only other thing is you have to create budgets, create the teams and you have to create the culture within these agencies and within these businesses in order to tackle this. Its only until you have done all those things and like ryan said, training which is a very important piece, is the beginning of protecting. You gotta do all these things to get to the point where you start protecting yourself. I completely agree with the training. I think that is probably the least expensive thing that we can all do. We are all first line of defense, no matter where you sit. Just keeping that and reiterating it and the people hear it and they think its a broken record. Eventually, it will sink in. We will all be very well armed to be that first line of defense to not click on the link, do not actually get taken in by those. The other thing is just good cyber hygiene. Dont connect your systems to the internet unless you have to. Use a separate system. Multilevel work stations are out there. They have been out there for a long time. Maybe look at that technology. Things like that. Panelists, thank you very much. That was a fantastic discussion. [ applause ] that concludes the briefing. We want to thank you here and at home for joining us. We look forward to seeing you at the end of next month for the next briefing. Thank you very much. Our live coverage will continue this afternoon at 2 30 eastern when Veterans Affairs secretary Robert Mcdonald goes before the senate v. A. Committee. He will talk about what he needs to implement recent recommendations from the commission on veterans care report, including developing a process for vets to appeal healthcare decisions. The heads of several veterans groups will be there to respond. Live coverage starts at 2 30 eastern. That is grand rapids. And the grand river, which divides the city and which in many ways defines the city. Theres a good chance that most people over the course of any given day will see or interact with a piece of furniture made in grand rapids. We were the first city to ever receive a grant from the endowment to be used specifically to commission an original work of art for a specific civic site. This weekend, the cspan cities tour along with our Comcast Cable partners will explore the life and history of grand rapids, michigan, on book tv. Gordon olson talks about notable people who grew up in grand rapids. Then we will talk a tour of the home of Richard Norton smith as he shares with us how and where he works and about his newest biography and Gordon Andrews talk about the life of attorney Charles Hamilton houston in his role in the early Civil Rights Movement. People understood the role of Charles Hamilton houston. But you cannot have a conversation about the Civil Rights Movement in the United States without an inclusion of the work of charles houston. On American History tv on cspan3, grand rapids resident nancy twedale talks about the letter she wrote that brought artwork to Public Places across the country. We will visit the grand Rapids Public Museum with the curator. We will take you to the exhibits at the gerald r. Ford president ial library and museum. A new car pulled up and stopped in front of the store. This big fellow stepped out of it and stepped into the entryway of the store and paused there. For a long time. And stared at junior. Ford asked him if he could help him. The man looked at him and said, you are lesley link king junior. He said, no, im gerald ford junior. Well, you are my son. I am your father. I want to take you to lunch. The cities tour of grand rapids, michigan, saturday at noon eastern on cspan 2 and sunday afternoon at 2 00 on American History tv on cspan3. Todays White House Briefing began with questions about president obamas meeting with myanmars leader. The white house is restoring trade benefits with the asian nation. Here is a 20minute portion of todays briefing. With the easing of sanctions on burma, is the administration taking away its leverage to improve conditions for the Muslim Community and to force changes to that nations constitution. Kevin, i think were enhancing it. The more deeply the United States engages in a country like burma, the more success we can have in encouraging them to pursue reforms. Thats been documented in the president s engagement with burma over the last 7 1 2 years of his presidency. You recall that when president obama took office, the leader of the country, was in the oval office of the president of the United States today, was a prisoner in her own house. So i think the progress thats been made in the country has been remarkable. As the United States has been pursued a policy of deepening our engagement in burma, critics all along have suggested that there was a risk associated with that kind of engagement. And in some ways that it was too soon for the United States to be pursuing that kind of engagement. So this was the criticism we heard from some when the Obama Administration decided to appoint an ambassador to burma. People suggested it was rewarding bad behavior. This is also criticism that we heard in advance of the president s first trip to burma, a suggestion it was too soon for the president to be visiting burma. What we found at each stage is that by more deeply engaging with burma, we have been able to influence and encourage greater reforms that are consistent with our own National Interests and consistent with our own values. Of course theres more work that needs to be done. The preside they both acknowledged that in the oval office. We have been heartened by the increased commitment we have seen from her government to addressing the human rights concerns. We certainly welcomed her inclusion of coffee annon providing International Input on the process. It would give the International Community greater confidence that her government in burma is taking those reforms seriously. Thats a good thing. Domestic policy, the california congressional delegation is calling on the administration to approve a waver that would allow undocumented immigrants to purchase unsubsidized Health Insurance through covered california, that states medicate program. Is that a concept the administration is supportive of . Kevin, i have to acknowledge i have not seen the letter you are referring to. So im not sure i can respond to their specific request. As you know i guess this is evident from their letter that the way that the Affordable Care act is written, individuals who are undocumented immigrants are not eligible to collect benefits associated with the Affordable Care act. Thats been the subject of some fear mongering or even outright lying on the part of republicans. They are stressing the word unsubsidized. I havent seen that proposal. Im not in a position to react to it. We will take a look at the letter and see if we can get you a response. More on the visit today. Senator corker released a statement after meeting with her saying he was appalled by her reaction by Human Rights Violations in the country. I was wondering during the president s conversations with her, what was his did he have any response to the way what were the discussions about human rights . And did he come away with a similar feeling about her reactions to his concerns or to the u. S. Concerns about human rights. The president made clear in the meeting that its important for the burmese government to uphold the human rights of all religious and ethnic groups inside of burma. And we have seen, since she assumed office, a gater commitment to the pursuit of reforms that will protect human rights. Theres been a greater effort to recognize the citizenship of the the rights of the citizens of burma. And there has been the inclusion of anon in the process. There is more work that needs to be done. There needs to be a sustained commitment to these reforms. That reflects the priority that the United States places on universal human rights and ensuring they are protected by governments all around the world. I think all of you had a chance to hear directly from her in the oval office indicate that she intended to make that a priority. And we certainly would welcome those kinds of comments, because theres a lot of important work that remains to be done. On the dakota pipeline, there was a protest outside the white house yesterday, i believe senator sanders spoke at that, and there were protests around the country. Is the president following these protests at all . Does the administration have any response to i think senator sanders induced an amendment that would stop the court for issuing any permits for that for that pipeline until an Environmental Impact statement has been completed. Does the Administration Support that move . I do not know that the president was aware of the protests yesterday. Obviously, the president was on the road most of the day. I dont know if he was here when the protest was organized. I can just say that the administrations policy speaks for itself. Which is that despite winning an order from a judge who indicated that the process had been properly followed and that the department of interior and the army corps of engineers could move forward with the project, the army corps voluntarily stated that they would pause the project to ensure that the consideration of efveryones views and perspective, particularly those most directly affected by the project, are carefully and properly considered. So thats that would be the next step in the process. The president certainly believes thats an appropriate course of action. In this case, were talking about individuals who are who are native americans. Theres a rather sad chapter in our history with regard to the federal government not effectively looking out for the concerns of native populations in this country. And thats left a legacy, and its one this administration is determined to address. In this instance, it means ensuring that the process that is in place for the construction of this pipeline has adequately consider considered the impact it will have on everybody who lives in the area, including tribal populations who live in the air. Does the administration think its time to overhaul the way they are permitted in general . This isnt the first pipeline that has been run into protests. There have been a lot of these issues that are ongoing. I think that might be a little bit of an oversimplification. The keystone pipeline, that was part of demonstration for a number of years, the issues related to the construction of that pipeline are different than this one. In this case, the army corps has voluntarily indicated they will pause this project to ensure in the context of this project the concerns of everybody who could be affected were adequately taken into account. They have indicated a w willingness to go back and make sure that all Infrastructure Projects they are involved in adequately consider the views and rights of affected populations, including tribal populations. And thats an appropriate step for them to take. Mary . Thanks, josh. In the past 24 hours, we have seen the release of information hacked from the dnc, colin powell, even american olympians, hacks coming from groups with suspected ties to russia. Is this an another example of russia attempting to meddle in the u. S. Election . What is the president considering or what recourse does the u. S. Have to try and stem this flow of embarrassing leaks . Are new sanctions on the table . I think obviously i have seen the report of the variety of cyber intrusions and leaks that have emerged in the last 24 hours or so. The United States has not made a formal determination in public about who may or may not be responsible for these kinds of for these incidents. The motivation for each of them i think is likely different. I know that you asked about it in the context of the election. Im not sure that the reprehensible release of the personal Health Information of u. S. Olympians has anything to do with the election. It may have to do with some other things that have been well documented. But what i can just say in general is that all this does serve as an illustration of how its important for our policy makers to make it a top priority. The United States congress has fail doed to do that. Theres more congress should do. The president included in his fiscal year 2017 budget a significant increase in funding for Cyber Security that would not just enhance our Cyber Capabilities but also improve our ability to work more effectively to investigate cyber intrusions when they occur and to work with the private sector to deter potential incursions. As we have discussed in here many times, the congress refused to even have a hearing on that budget. Republicans have essentially said they are refusing to talk about that proposal to enhance our Cyber Security. Thats unfortunate. Thats an indication that republicans are failing to even discuss what should be a Top National Security priority. Particularly given the widespread reports and the conclusion reached by some professionals outside the government that russia is likely responsible. Ly seems like something that should get the attention of republicans in congress. Unfortunately, it hasnt. The good news, however, is that this administration has not just relied on congress to take steps to try to protect the American People from Cyber Security. Over the last couple of years we have seen the president convene a summit bringing together technology experts, leaders in private sector and National Security figures to discuss what can be done to enhance our nations National Security. The president signed an executive or the designating new authority to the secretary of treasury that would law him to impose financial sanctions on countries or individuals that are suspected of involvement with cyber intrusions. That is new authority. That gives the United States government additional options when it cops to responding to these kinds of situations. The president has prioritized in his multilateral meetings, the effort to establish internationally accepted norms when it cops comes to conduct cyberspace. We have gotten additional commitments from the chinese with regard to some of those international norms. That enhances the security of the United States. The time has come for republicans in congress to do their part. We would like to see them do more. I think last thing that i will note here is that over the weekend, the cia director was asked about this. And he noted that russia this is a quote has exceptionally capable Cyber Capabilities as well as whatever else it might want do in the cyber sphere. We have known this for quite a while. I think this is an indication that the president and his National Security team are not just keenly aware of the situation but have taken aggressive steps to try to counter it. We would welcome republicans in congress doing their part for a change. On syria, there reportedly is a significant difference of opinion, shall we say, between the secretary of defense and secretary kerry about partnering with russia. If the ceasefire holds, is the president concerned about implementing or developing this next phase, whatever that may be, because of this disagreement . Lets start by acknowledging that the if thats included in your question is a sizable one. There remains significant doubt inside the administration and around the world about the capacity and willingness of the russians to fulfill the responsibilities that they have accepted in this arrangement. And that skepticism is not just well documented, but i think entirely reasonable given the way that we have seen the russians and the assad regime behave over the course of the last year or two. So thats a big if. And i feel like thats an appropriate place to start. From there, the president and the secretary of state have both spoken publically about how deeply concerned the United States is about the humanitarian situation inside of syria. And our efforts to engage diplomatically with the russians is rooted in the knowledge that the russians have more influence over the assad regime than anybody else. The assad regime has been the chief impediment to the delivery of humanitarian aid to hundreds of thousands if not millions of innocent civilians who have been caught in the cross fire in syria, including in aleppo. So this has been the best opportunity that the United States has to try to reduce the violence and allow for the unimpeded delivery of humanitarian assistance. And thats what we have been trying to thats the result that we have been trying to bring about. When the president discusses complicated issues like syria with members of his National Security team, he is not looking for a bunch of people that have exactly the same opinion. The president is not looking for a group of people to sit around the table with him in the situation room who all nod their head every time that he speaks. What the president is looking for are informed experts who do their homework and who can make an argument and assist him in crafting a policy that advances the interests of the United States. Thats why the president is proud of the people who serve on his National Security team. At the same time, the president is entirely confident that once he has made a decision that he can count on the members of his team to execute that strategy with excellence. He is confident that every member of his National Security team is committed to that goal. All right . Michele. Many times when we have heard you talk about the president s goal on the trail and in the instances where he is talking about the election, his goal is to support Hillary Clinton as the most qualified candidate. What we heard a lot of yesterday in his speech was as if he was trying to prove that donald trump is not qualified. So would you say that that is now a big part of the president s goal when he is out there . I think president s goal is to ensure that he is succeeded in the oval office by somebody who is committed to building on the progress that we have made over last eight year. Secretary clinton is the only candidate who has indicated that shes committed to building on that progress. I would put her in the category as i was answering mar m marys question as somebody who doesnt agree with everything with the president. But its their vision in expanding Economic Opportunity for the middle class, equality for all. Advancing u. S. Interests around the world. Their visions are quite similar. The president has enormous confidence in her ability to lead this country in a direction that will continue to strengthen it and make progress in a direction that he has been fighting for for the last eight years. That was a portion of todays White House Briefing. See the rest online at cspan. Org. We are live for Robert Mcdonald. You see him on the right of your screen, he is testifying this afternoon before the senate Veterans Affairs committee on a recent report looking at recommendations for improving the v. A. Healthcare system. We will hear testimony from the heads of several veterans groups. This hearing expected to get under way in a moment. Live coverage here on cspan3. Id like to welcome the secretary and were glad to have you here today. We will change our methodology a little bit. We have two votes, one at 2 45 and one following that vote. We will run the hearing continuously. The Ranking Member andry going to wave Opening Statements so we can go directly to secretary mcdonald to make his full statement for the record. Then we will go into as much q a as we can. When i have to leave, hopefully there is somebody here so we can keep it rolling. With your cooperation, we will maybe make sure we dont have to shut down. If we do, its only for a couple of minutes. Let me welcome everybody to this meeting of the Senate Veterans afairs committee. We had a great hearing on the innovations taking place at the v. A. Last week. Todays hearing will be equally as good, because the commission on care was a great project that examined the Veterans Administration and its delivery system. It had a lot of recommendations that are very meritorious. I appreciate the embrace that secretary mcdonald has given. I know he will have great testimony. Let me welcome the secretary of thecdonald to make his testimony and we will go from there. Thank you, mr. Chairman. Ranking member blumental, members of the committee, thank you for this time to talk about vach v. A. s final report. I wish the house would have allowed me same opportunity last week. But neither i nor the organizations were invited to testify in person. I ask my written statement be submitted into the record. Without action. Thank you. Let me thank mission schlickting for chairing the committee. Nancy did an outstanding job. Overall, i see the commissions report as validation of the course we have been on for the past two years. Theres hardly anything in the record that we havent thought of or arent already doing as part of our ongoing my v. A. Transformation efforts. We differ on details, but we we agree with the intend of almost all of the commissions recommendations. 15 out of 18. We certainly agree on how wrong it would be to privatize v. A. Healthcare. Privatization would be a boon for some healthcare corporations, but as seven leading vsos told the commission it could threaten the financial and clinical viability of some v. A. Medical programs and facilities which would fall particularly hard on the millions of veterans who rely on v. A. For almost for all or almost all of their care. There are many things that v. A. Offers that nobody else offers. We have a unique lifetime relationship with our nine million patients. Nobody else offers that. Our Mental Healthcare is integrated with our primary care and specialty care. Nobody else offers that v. A. Healthcare hole veteran healthcare. Including care for many nonmedical determinations. Nobody offers that. Our research and innovation has made v. A. A leader in many areas. Nobody else offers that. If we sent all veterans in the committee fine care, they would lose the choice of integrated comprehensive care tailored for veterans. By people who know veterans and are dedicated to serving them. Thats what v. A. Is to veterans. Thats why you dont find veterans demanding Community Care as the only choice. The demand for that only choice comes from elsewhere. It doesnt come from veterans. Veterans know better. I have tested this during my time as secretary. When somebody tells me that veterans should only have the choice of the Choice Program, i ask them, are you a veteran. By and large, the answer is no. Then i ask if you talk to veterans about this. I get the same answer. Then i appropriate a little bit more and i found that beneath the banner of choice there are always two things, interest and ideology. Lets face it, privatization would put more money into the pockets of people running healthcare corporations. Its in their interest. Of course, it makes sense to them even if its not what veterans want or need. Then theres the idealogs. Government bad, private sector good. Thats as far as the thinking goes. Most members of the commission were more understanding. On one point i strongly disagree with the commission. Thats the idea of an i independent board of directors for the health administration. I dont need to say much about that since constitution probably wont allow it. I will say a governance board doesnt make sense to me. It would only make matters worse by complicating the bureaucracy at the top and spreading reresponsibility for vha so no one knows who is ultimately responsible. The fact is, we already have a governance board. Congress is our governance board. In Congress Works the way it should, nobody would be talking about adding another layer of bureaucracy to v. A. V. A. Is not the holdup on increasing access. Were doing that we have been doing that for more than two years now. Vc v. A. Is not the holdup on expanding Community Care. Where he doing that. We submitted a plan to streamline our programs last october, almost a year ago. Whats happened to it 1234 . V. A. Is not the holdup on getting rid of real estate that costs us much more each year than it is worth, or adding more points of care where they are needed. He wou we have eight Major Medical Construction Projects and 24 leases needed authorization. They are funded. But we still need a green light from congress to move forward. Were not even the holdup on Holding People accountable for wrongdoing. Ask the former v. A. Employee in geor georgia facing sentences. All told, we have terminated over 3,755 employees in the past two years. We have made sustainable accountability part of our ongoing leadership training. The Veterans First act would help us hold people accountable. We look forward to seeing it brought to the senate floor for passage. The Senate Appropriations committee has approved a budget nearly equal to the president s request. But again, we need to see some follow through. The holdup in our very real and ongoing my v. A. Transformation is our need for congressional action. We have submitted over 100 proposals for legislative changes that we put in the president s 2017 budget. No results yet. I detailed our most urgent needs. They include approving the president s 2017 budget request to keep up with rising costs and medical innovation. Extending authorities to maintain Services Like transportation to v. A. Facilities in rural areas and vocational rehabilitation. Fixing provider agreements to keep longterm care facilities from turning veterans out to avoid the hassle of requirements. And ending the arbitrary rule that wont let v. A. s dedicated medical professionals care for veterans for more than 80 hours in any federal pay period. We also need to you act on modernizing our claims appears process. Under the current law, with no significant changes in resources, the number of veterans awaiting a decision will nearly triple in the next ten years from 500,000 today to almost 1. 3 million. We submitted a plan to reform the appeals process in june. We developed a plan with the help of the vsos, state and county officials. Theyre all on board. We need congress to get on board. Im only after whats best for veterans. As you know, im not running for office. Im not angling for a promotion. I could have taken an easier job two years ago. But i didnt. I answered the call of duty thinking only of giving veterans the benefit of what i learned at west point, in the army and 33 years in the private sector running one of the moste ed adm companies in the world. My only concern is to see it continue. I know nancy will tell you, transformation is a marathon, not a sprint. It will take several years to turn any Large Organization around. To turn v. A. Around, we must maintain our momentum of change. We cant do that without cooperation of congress and passage of legislation we talked about. Thats an absolute certainty. The commission, vsos and v. A. Are in agreement on this. Congress must act or veterans will suffer. Thats unak scceptable to me an no he its unacceptable to you. What can we do . Whatever it takes, i will do t. Just let me know what it is. Thank you, mr. Chairman. Thank you, very much. We appreciate your testimony. Were you going to testify or are you here for moral support and hard questions . I have one question. Im going to get to the members of the committee. We will go through the votes. I will wait until the last minute to go over and vote and come back after voting. Hopefully, between the votes going back and forth, we will keep everything rolling throughout the hearing. We have three great panels headed off by secretary mcdonald who we appreciate for being here. If you would look at recommendation number one, which i know you read and referred to in your testimony, have you got any idea what you would estimate the cost of implementing recommendation number one for the commission on care . Recommendation one is about establishing an integrated high performing communitybased healthcare network. In our plan in october, i cant remember the exact number. Im sure david will remember it. We had Different Levels of costs depending upon what we decide to take on. Were already in process of establishing that network. David, you want to yeah. The secretary is referring to the plan that we submitted at the end of october 2015 where we currently spend right now about 13. 5 billion a year in Community Care. Thats the combination of choice and Community Care funds. In order to do the changes that we suggested, we suggested that we would need 17 billion a year. We wanted to fix the emergency medicine provision that so many veterans get stuck in the hole. We need the investment in infrastructure to do care coordination in an integrated fashion. We think that thats the best use of money for taxpayers, that its a its actually an efficient plan. The commission on cares plan was far more expensive than that. I think it contemplated putting together the v. A. Being part of a network with the private sector . Thats correct. I think it contemplated doing that without the contractors we have today for the two gatekeepers but to issue a single card . Yes, sir. We would integrate the network. It would also include department of defense partners, Indian Health service and other federal partners we have. This is not a setup. Just like to hear your answer. Is it not true that in the Veterans First bill, this committee passed out unanimously, by the provisions in there for provider agreements, were expanding the opportunity for v. A. To make that happen, to make that possible . Yes, sir. That was the right answer. I just wanted to make sure we did it. I said that we would like Veterans First to get to the floor. Were happy to help in any way we can to help you we appreciate your continuous support on that. We appreciate the committees leadership in putting it together. My last question is really a comment. They have a recommendation on i. T. And working on the i. T. System in the v. A. Im interesting in hearing how much progress you have made and the program at georgia tech which i think you are under contract with them. I understand theres a breakthrough that helped on that . Yes. Can you comment on that . I will be glad to. Just as you mentioned, mr. Chairman, in april of this year, we did certify with the department of defense. We have created a concept of whats called the Digital Health platform. This is really taking where the industry is to a new level. Its going to increase our ability to do interoperability. And so what you are referring to is georgia tech has really a fantastic technology center. We have a prototype for this that i think were looking forward to sharing with members of this committee that we think is really a path forward. To take us to a new level. Good. We appreciate the progress that you are making. Senator blumental . Thanks, mr. Chairman. Secretary mcdonald, i think in your letter the president dated august 6 or august 2, 2016, you indicated that you had concerns about the cost estimates. That the commission put together to reflect various options on the vha care system model which ranged i think as low as 65 billion to 106 billion in fiscal year 2019, depending on enrollment, Network Management and other factors. I want to say, i appreciate that the commission really devoted itself to seeking to improve the v. A. Healthcare system. And i certainly appreciate its recommendations. I wonder if you could explain the v. A. s concern with those commission estimates. This is the nub of the issue in terms of the different between the report and our point of view on the network. Im sure nancy will comment more on it later. The question is is how much unfettered access to the private sector do you allow the individual veteran . Who takes responsibility for integrating their healthcare . We believe that as the v. A. , we need to take that responsibility, that when a veteran goes out to the private sector, we still have to own the responsibility for that healthcare. The integrator tends to be the primary care doctor. If we dont do that, that it results in not very good care and also dysfunctional care because its not integrated. It also results in higher cost care, because those doctors that they may go to, first of all, may not be qualified by us as being capable, being high quality enough to be in that network. Secondly, may not follow the standards of cost that are necessary to be part of that network. I think the secretary has said that very correctly, senator, which is, we really have differences here with the commission on care report on two counts. One is the quality of care, we believe is better with v. A. Maintaining the care coordination and interest grace role. We understand the needs of veterans best. We do support and we embrace working with the private sector. Thats absolutely correct. But we believe the v. A. Needs to be the care coordinator. On the cost side, this would be, in my view, irresponsible just to turn people out with no deductibles, no cost control mechanisms. This would be returning us to the late 80s, early 90s, where there was runaway costs. We think the very best thing for veterans and the very best thing for the taxpayers is to do this carefully in an integrated network the way we proposed in october of 2015. Speaking of costs, the commission on care report found that 98 of all clinical supplies were acquired using purchase cards and that 75 of what the vha spends on clinical supplies is made through this purchase mechanism. Only 38 of supply orders were made through standing vendor contracts, which presumably would be more effective and efficie efficient. And ive been told as well that this same issue may arise with respect to medical devices and perhaps other kinds of supplies. Thats in stark contrast as you probably know to the private sector bench mark of 80 to 90 of supply purchases from existing master contracts with negotiated price discounts, which the v. A. Can do unlike medicare. Were pushing for medicare to have the same options of negotiation. What is preventing the vha from using those kind of master contracts . Nothing. In fact, if you recall the hearing we had on the 12 breakthrough priorities which you had here in the senate we didnt get the same in the house. One of the 12 is to set up a consolidated supply chain. Right now, every one of our medical centers has its own supply chain which, as you have suggested, is nonsensical. Our cost advantage is tremendous of the scale that we have and also our Customer Service is fantastic. We have been rated number one pharmacy in the country for six consecutive years by j. D. Power because of that scale advantage. What were in the process of doing is building a consolidated supply chain for all of our medical centers. So far, we have avoided about 35 million of cost. Our commitment to you was to avoid 75 million of cost by december. I think we will beat that. Thank you. Thanks, mr. Chairman. Well bea thanks, mr. Chairman. As a courtesy to everybody in the office and the members of the committee we will take a little bit of a different order in terms of question and testimony because to pay senator brownback for doing me a great courtesy for being here on time given hes got a tough schedule i will let him do the next question followed by senator bo boozman and then senator manchin. Thank you. I will ask two brief questions. Secretary mcdonald, first to you. You correctly note in your testimony that implementation of veterans choice went through some initial growing pains as we all expected. Your meetings with veterans and providers and Health Experts and others, lay out briefly the challenges and opportunities that you see for veterans choice where were going. Veterans choice, you know, weve made tremendous progress. When you recognize we set up a program in 90 days that affected roughly and sent out cards to 9 million veterans, we made tremendous progress, but weve also made changes along the way. Since the original bill we have now changed the way we define distance, the 40 mile limit, weve changed it from geo des sick distance to driving distance, that virtually doubled the number of veterans being able to avail of veterans choice. We also have made efforts originally the program was designed where we would simply give a phone number to a veteran and say go call your Third Party Administrator. My belief and i know davids is you cant outsource your Customer Service. So were pulling that responsibility back in. The integration coordination responsibility. And were now taking responsibility for Customer Service and weve taken Third Party Administrator employees and put them into our buildings as a test in order to make that easier for the veteran. Where are we headed . About 22 of our appointments every day now are in the community. There are about a million veterans that rely on the Choice Program. There are about 5,000 veterans that only use the Choice Program, which is really a strikingly low number, but it demonstrates that most veterans really want the hybrid, even if they have the Choice Program, they want the hybrid. They really want to know they have the choice and theyre generally mostly satisfied with cincinnati va or dayton va or cleveland, but they want to know they have that choice and i think thats so important. Thank you. Doctor, quickly, are there bureaucratic or legislative hurdles that prevent vha from routinely updating facilities, infrastructure, thus providing va medical staff and veterans the best care possible . Yeah, i do think that if you ask most of our Field Hospital directors they would say that there are challenges and i think weve seen a really strong direction towards being more responsive to the Hospital Leaders under laverne counsels leadership. She has established executives who work with vha and we are working together to break down some of those carrierai barrier. This does take time because were breaking down years and years of barriers, but i think were headed in the right direction. Thank you, mr. Chair. Senator boozman. Thank you, mr. Chairman and thank you all for being here. We really do appreciate your hard work. The Choice Program has over a Million People participating in it, which i think is a good thing. You dont list that as a legislative priority as far as reauthorization. Is it a priority or is it not a priority or am i have i misunderstood . We look at reauthorization as part of our program to consolidate care so we believe we did request reauthorization in that october 2015 package that we submitted on the consolidation of care. Good. Well, thats good to know. We do want reauthorization. I would just add, im sure this is why youre asking, senator, the program ends august 7th of 2017. Yes. Without reauthorization we are going to see us actually go backwards because weve now reached 5 million choice appointments. Thats fantastic and this program should be congratulated and we are just getting it to work and if we could get Veterans First passed through its going to work even a lot better. So reauthorization is absolutely a priority for us. Sorry to take more time. If you dont mind no, its important. August 7th is an important date, but if a woman is pregnant, you know, we really need to know nine months in advance of august 7th whether or not how were going to care for her. So the sooner the better. Right. And i guess that was my follow up and its good to know that, you know, that youve cleared that up and that it is important and truly have done a great job. This being a momentous task. Do you have any contingency plans, you know, in regard to august of 2017 if the reauthorization and there is also i think you can really help us at this hearing and in future hearings by helping members understand not on this committee but throughout congress how important it is to get the reauthorization done. We are in the midst right now of renewing our strategies for 2017, most of our leaders are at the National Training center right now and one of the things weve brought up is the importance of communicating that august 7th date, but also the nine months in advance of that. So i do think thats critically important. Just to give you to quantify this, we spend about 13 billion a years in the community, as the secretary said 22 of our care goes out in the community, 4 billion of that is the Choice Program. So we would have to reduce access to care by about a third in the community and that would hurt veterans. Our contingency plan, we are here to help veterans with the resources that you provide us, so were going to continue that mission and we will do the very best job possible, but there is no substitute for what youve provided in the Choice Program. Thank you, mr. Chairman. I do think that thats something that we really to work on is to make this clear how important that reauthorization is going to be. That was a terrific question and i appreciate the answer and it gives us our homework to do before that august date next year. Were going to stand in recess for a moment. Senator moran is on his way and we will continue the hearing and then senator boozman and i will be back as quick as we can cast our two votes. We will stand in recess until senator moran gets here. Thank you, mr. Secretary. Thank you for this time to talk about v as ongoing transformation. I wish the house had allowed me the same opportunity last week, but neither i nor the Veterans Service organizations were invited to testify in person. I asked that my written statement be submitted for the record. Without objection. Thank you, sir. First let me thank ms. Selecting for chairing the commission. I know it wasnt easy but nancy did an outstanding job in keeping things together. Overall i see the commissions report as validation of the course weve been on for the past two years. Theres hardly anything in the report that we havent already thought of or arent already doing as part of our ongoing my va transformation efforts. We differ on some details but we wholeheartedly agree with the intent of almost all the commissions recommendations. 15 out of 18. We certainly agree on how wrong it would be to privatize va healthcare. Privatization would be a boone for some healthcare corporations, but as seven leading vsos told the commission in april it could threaten the financial and clinical viability of some va medical programs and facilities which would fall particularly hard on the millions of veterans who rely on va for almost for all or almost all of their care. There are many things that va offers that nobody else offers. We have unique lifetime relationship with our 9 million patients, nobody else offers that. Our Mental Health care is integrated with our primary care and specialty care. Nobody else offers that. Va healthcare is whole veteran healthcare customized to meet veterans unique needs including care for many nonmedical determinants of health and well being like education services, career transition support, housing assistance, disability compensation and many others. Nobody offers that. Our research and innovation has made va is leader in many areas such as pros stet sticks, traumatic brain injury, posttraumatic stress disorder, poly trauma and telehealth. Nobody else offers that. If we sent all veterans in the Community Find care they would all lose the choice of integrated comprehensive care tailored for veterans by people o