Sen. Rounds good afternoon. The Cyber Security subcommittee meets to assess the role mike rounds good afternoon. The cybersecurity subcommittee meets this afternoon to receive testimony on the department of defenses role in protecting the u. S. Election process. The centw american security, Senior Vice President of Critical Infrastructure protection, operations for a calm. Ms. Heather conley, the Senior Vice President for europe, eurasia, and the arctic and for the of the Program Center of strategic and international studies. Dr. Richard hartnett, had a full andpe Political ScienceCyber Command and the director of the Cyber Security project at the Harvard Kennedy school. At the conclusion of Ranking Member nelsons comments, we will ask our witnesses to make their opening remarks. After that we will have a round of questions and answers. There is no dispute about what russia did during the 2016 election cycle. There is clear evidence that russia attempted to undermine our democratic process through the hacking of independent political entities from manipulation of social media and use of propaganda such as russia today. Evidence indicates that no polls or state election systems were manipulated to change the outcome of the vote. Russians evidence of probing of certain election systems in 21 states. The department of defense has a Critical Role to play in challenging and influencing the mindset of our cyber adversaries and defending the homeland from attacks. Cybers that could include attacks by other nations against our election infrastructure. We look forward to the department approaching these issues with a heightened sense of urgency. The thread is not going away. Just a couple of weeks ago, the director of the Central Intelligence agency warned to that russia will seek to influence the upcoming midterm elections. The White House National security adviser stated, mexican that mexican president ial campaign as well. This is in addition to russian attempts to influence the elections in france and germany last year. Each of us on this panel has been quite vocal about the need for a strategy that seizes the strategic high ground in cyberspace. Whether you call it deterrence or something else, we need a strategy that moves out of the trenches and imposes costs on our adversaries. The lack of consequences for the countless attacks over the past decade has emboldened our adversaries and left us vulnerable to emboldened behavior. Attacks we experienced during the election are the latest run on that escalation ladder. Adversaries will they can act with impunity, they will press further. Our witnesses offer unique spurt unique perspectives on the challenge we face. We look to them. If we can reverse the damage and what it will take to implement a strategy that limits our exposure and imposes costs on Malicious Behavior. We invited dr. Richard hartnett to explain his theory of cyber persistence. Our adversaries actively exploit us because they see great benefit and little consequence in doing so. I agree that the cold war models of deterrence will not work and look forward to hearing what he believes will take to influence it mindset of our adversaries. Writings, his his focus to great deal of his research on the organizational challenges we face as a government. We understand he is working on a paper addressing the challenges we examined during our hearings in october. We look forward to hearing more on the gaps and the scenes he sees in our organizational model and what lessons we can learn from allies like the british british. Brescia has yet to face serious consequences in the cyber or. Ther domains for its 2016 elections and interference. We look forward to the testimony on how the u. S. Can tailor and intimate these penalties and how the department can deter or dissuade meddling. We look forward to the testimony of mr. Bob butler who brings cyber experience in the department of defense and the private sector. Mr. Butler has been involved in numerous studies of cyber deterrence including the recent Defense Science Board Task force on cyberdeterrence. Let me close by thinking our witnesses for the willingness to appear today before our subcommittee. Senator nelson. Nelson thank you, mr. Chairman. I want to make sure that since elections,earing on that everybody understands that is about thefeels foundation of our democracy. And that we as a government ought to be doing more to defend ourselves. This is not a partisan issue. Partyan happen to either or the nonparty candidates as well. And it out to be all hands on deck. In public andnd i in closed meetings, because of clearance, we have been quite disturbed about wondering if we are doing as much as we should as a government to protect ourselves. So, in a recent closed hearing of this subcommittee, the department of defense demonstrated that it is not taking appropriate steps to defend against an deter this threat to our democracy. Youmr. Chairman, i join me and welcoming join you in welcome any these witnesses and hope some practical suggestions are going to come out. I want to mention a few things. Hast, the department cyberforces designed and trained to thwart attacks on our country through cyberspace and that is why we created the seven commands National Mission teams. Subcommittee,is senator blumenthal, senator , we over to the secretary of defense last week department ought to be assigned to identify russian operators responsible for the hacking, stealing information, planning planting misinformation, and spreading it through all the. Nets and fake accounts on social media. They ought to do that. That is the Cyber Command knows who that is. To usen we ought separate forces to disrupt this activity. We are not. We should also be in forming informing the social Media Companies of russias fake accounts and other activities companiese those terms of services so they can be shut down. Second, i would ask us to look at that as the departments own concludedsk force , to show mr. Prudent that two can play in this game. That we need operations of our to exposeermine his wealth than those of the oligarchs. Third, i would suggest the department should ensure that it component active and cyber units are prepared to assist the department of Homeland Security and the governors to defend our election infrastructure. Attack, buter the proactively before and during the russian attacks. Fourth, i would suggest that the the the Department Must integrate capabilities and planning to cyber warfare and Information Warfare to conduct Information Warfare through cyberspace as last years defense bill mandated. Our adversaries recognized the importance of this kind of integration but today, cyber warfare and Information Warfare are separated and the department of defense and involved multiple organizations. And fifth, i would recommend as one of our witnesses, i think will testify today the Department Must help develop an effective whole of government response to russias strategic operation through things like a joint Interagency Task force and a fusion center. Our colleagues on the Foreign Relations committee have proposed something similar. The threat is not going away. It is likely to intensify. And as our Intelligence Community has been warning, and coats has just testified to the Senate Intelligence committee, that thread is not going away. So, the 2018 elections are upon us. Watchnot sit idly by and this happen again. Thank you, mr. Chairman. Chair thank you to our panelists here. Our witnesses. We ask that you limit your opening remarks to five minutes. Madeentire stigmas will be part of the record. We would like to begin with mr. Butler. Mr. Butler thank you, mr. Chairman. Thedistinguished members of subcommittee. Thank you for the invitation. My views represent my views and not that of any particular organization. I will hit the highlights of my written statement. They track closely with the opening comments. My comments are focused around my assessment of the threat and the electoral rossa sees after viewing a few different states. Secondly, recommendations partnered with the whole of America Campaign and thirdly, what this committee can do going forward. I have been watching the russian influence operations threat for some time in uniform and out of uniform. Our ability to counter russian influence operations is not only a function of a we know about the threat but our willingness and ability to it address that threat by hardening resilience and other countermeasures. As i looked at the infrastructure in different states we learned from twice 16 knownat our vulnerabilities are. When you look at the voting registration systems and the registration proper, we are making progress. However, states do not have that is a struggle and the threat still remains very, very high. My perspective looking at this particular threat, what were talking about today is one line of operation within what i think has to be addressed through a National Security council led task force. A whole of America Campaign, not too much dissimilar from the nctc but with a strong empowered private sector element. Again, i go back to the idea of a whole of america process. Two key components inside of this, one is the idea of having an element thats focused on strengthening states infrastructure and hardening american citizens, deterrence by denial some would say. A second component focused on cost and position, from bot net disruptions to other kinds of sanctioning activities, importantly reinforce multilateral limit im a big component of a cyber stability board, coalition of the of the willing working to ensure the most effective way of doing cost in position. Those two components then supported by an integrated fusion center. It provides situational awareness, combined the best of intelligence both in the commercial and from the National Security community with Law Enforcement and active defense actions. Focused on a campaign that is centralized in its planning but decentralized in its execution. From my perspective it really requires both cultural and legislative enablingers. Cultural the president must lead and rally the nation. Theres opportunities already this week that can be used to help with that. The infrastructure proposals a great example. I dont see anything about resilience in the infrastructure proposal. We should have a way of norpg, especially as were building new infrastructure, methods and strategies and incentives for strengthening the infrastructure here in this country. Additionally, we need to leverage the best of u. S. Competencies across america. Defense is excellent. Here in this country. U. S. Intelligence agency combined with web Scale Companies do a great job. Web Scale Companies are very good and growing in their ability to rapidly identify disinformation campaigns and response. Will need some help from the legislative side. Specifically for dod, five recommendations that track very closely with what senator nelson was talking about. I think thetojump start this sponsored task nelson was talking about. I think to jumpstart this nscsponsored task force, we should coordinate with the secretary of defense to immediately stand up and a joint Interagency Task force. Inside of that again, empowered private sector players. We typically dont think about that, but this really is something where we need to Work Together in a Public Private partnership. We need to make arrangements with state and local officials through dhs and the National Guard euro. Second recommendation is to the ngb and working with the National Guard bureau to really not only inventory what we have on cyber units and Information Operations units, but to begin to scale them to help the states and to help us as we think about Incident Response in general. I think they could be aligned with fema regions. I think they could be aligned in a lot of different way, but we need to first get organized. The third is to actually have a session where we discuss courses of action. That would have to be a closed session, but i think thats where the request for authority, new authorities request for new resources come out. It gets to the point of not only looking at offensive actions, but defensively what were in store for as we begin to move offensively and what were going to do from a continuity of government and continuity of business perspective. The last two relate to senator nelsons comments with regards to the dsp task force. I think we should continue to push with the Task Force Recommendations and i would advocate that this committee should have its own campaign of exercises to help it understand where the adversary is going and to be able to advance ideas with regards to looking at threat and countermeasures. I stand ready to answer any questions that you have. Rounds thank you, mr. Butler. Miss conley . Conley thank you so much, chairman. Ranking member senator nelson and esteemed colleagues. Thank you for this very timely opportunity to speak to you this afternoon and what a timely moment as u. S. Intelligence agencies have now assessed that russia will continue to make bold and more disruptive Cyber Operations focused on the midterm elections. Cia director mike pompeo also stated publicly that he fully expects russia will attempt to disrupt the u. S. Midterm election. So we know they are doing it and will do it, but we as a nation are not prepared to effectively combat what i believe is an intensifying disinformation operation, an influence operation. Im a bit of a contrarian on this panel. Im not a cybersecurity expert, but what i am most concerned about is that we have nine months and the American People are not educated as to what is going to happen to them and thats where i think our focus must lie. Im less concerned about the mindset of president putin. I know his mindset. Im more concerned about the mindset of the American People as we head towards this election. You asked us what role dod could play to protect the u. S. Elections, and i think simply dod, working with congress, has got to demand a whole of Government Strategy to fight against this the enduring disinformation and influence operation. We dont have a national strategy. Unfortunately, modernizing our Nuclear Forces will not stop a russian influence operation. Thats where we are missing a grave threat that exists in the American Peoples palm of their hand and on their computer screens. It is vital that we Start Talking publicly about this threat and educating the American People on a bipartisan basis. Tragically, the Russian Campaign has already deeply polarized our country which only serves the kremlins interest as one of the most trusted institutions in the United States, the department of defense must leverage that trust with the American People to mitigate russian influence. Simply put, the department of defense has to model the bipartisan and factbased action and behavior and awareness that will help reduce societal division. This is about leadership and its about protecting the United States and as far as i can see, that is in the department of the defense job description. So a good place to begin is using dods extensive employee and military networks to provide timely policy guidance and statements about the threat that russian influence operation poses to election security. Secretary mattis and general dunnford should provide Public Outreach to the threat and how to counter it. Perhaps they should think about forming Public Service announcements and european governments have been very effective in warning their publics about the danger of russian disinformation. France and germany were very strong on that, but you have to put the message out and we have not. I offered one suggestion, my written testimony to look at how we can leverage the National Guard bureau looking closely with state and local leaders in cooperation with the department of Homeland Security to enhance Cybersecurity Awareness and be able to detect patterns of influence. For example, if hacked email surfaced online in conjunction with the false rumors about potential electoral candidates. We need to Start Talking about this. Another instrument is the state partnership program. The National Guard has partnered with the lithuani