Transcripts For CSPAN3 Election Security 20180213 : vimarsan

Good afternoon. This cybersecurity subcommittee meets this afternoon to receive testimony on the department of defenses role in protecting the u. S. Election process. The witnesses are mr. Bob butler, cofounder and managing director of cyber strategies, llc. Adjunct senior fellow at the center of new america operations for acom. Heather conley the Senior Vice President for europe, youre asia and the arctic and director of the Europe Program at the center for strategic and international studies, dr. Richard hartnet ahead of Political Science at the university of cincinnati an a former scholar and residence at u. S. Cyber command and the National Security agency and dr. Michael sum wrryer, at the harv kennedy school. At the conclusion of Ranking Member nelsons comments, we will have a round of questions and answers. There is no dispute about what russia did during the 2016 election cycle. There is clear evidence that russia attempted to undermine our democratic process through the hacking of independent political entities, manipulation of social media and use of propaganda venues such as russia today. Evidence to date indicates that no polls or state election systems were manipulated to change theout come of the vote, however there was evidence of russian probing of certain election systems in 21 states. The department of defense has a Critical Role to play in challenging and influencing the mind set of our cyber adversaries and defending the homeland from attacks. Attacks that could include cyberattacks by other nations against our election infrastructure. We look forward to the department approaching these issues with a heightened sense of urgency. The threat is not going away. Just a couple weeks ago the director of the Central Intelligence agency warned that russia will seek to influence the upcoming midterm elections. The white house National Security adviser stated mexican or that the mexican president ial campaign as well. This is all in addition to russia attempts to influence the elections in france and germany last year. Each of us on this panel has been quite vocal about the need for a strategy that seizes the strategic high ground. Whether you call it deterrence or something else, we need a strategy that moves out of the trenches. The lack of consequences for the countless attacks over the past decade has emboldened our adversaries and left us vulnerable to emboldened behavior. The attacks we experienced during the 2016 election are just the latest rung on that escalation ladder. As long as our adversaries feel they can act with impunity they will press further. Our witnesses offer unique perspectives on the challenges we face. We look to them to help us understand why our posture of restraint has not worked. If we can reverse the damage already done, and what will take to develop and implement a strategy that limits our exposeure and causes cost on Malicious Behavior. We invited dr. Richard harknet to explain his limits our ability to confront challenges we face. Our adversaries actively exploit us because they see great benefit and little consequence in doing so. I agree with dr. Harknet that the cold war models of deterrence werent work and look forward to hearing what he think will work. Dr. Sumyer, we understand that hes working on a paper addressing some of the challenges we examined during our full Committee Hearings in october on the whole of government approach to cybersecurity. We look forward to hearing more from dr. Sul meyer on the gaps and seams he sees in organizational model and what lessons we can learn from allies like the british. Ms. Heather conley provides expertise in russian politics and foreign policies. Russia has yet to face serious consequences in the cyber or other domains for its 2016 elections interference. We look forward to ms. Conleys testimony on how the United States can tailer and implement these penalties and how the department can best deter or dissuade further Russian Election metling. We look for to the testimony of bob butler who brings extensive cybersecurity in the department of defense and private sector. Mr. Butler has been involved in numerous studies including the recent Defense Science Board Task force on cyber deterrence. Let me close by thanking our witnesses for their willingness to appear today before our subcommittee. Senator nelson . Thank you, mr. Chairman. First of all, i want to make sure that since this is a hearing on elections that everybody understands that this senator feels that this is about the foundation of our democracy and that we as a government ought to be doing more to defend ourselves. And the second thing i want to make sure everybody understands is, this is not a partisan issue. This can happen to either party or the nonparty candidates as well. And it ought to be all hands on deck. The chairman and i in public and in closed meetings, because of the clearance, we have been quite disturbed about wondering if we are doing as much as we should as a government to protect ourselves. So in a recent closed hearing of this subcommittee, the department of defense demonstrated that its not taking appropriate steps to defend against and deter this threat to our democracy. So mr. Chairman, i join you in welcoming these witnesses and hope that some practical suggestions are going to come out. I want to mention just a few things. First, the department had cyber forces designed and trained to thwart attacks on our country through cyber space and thats why we created the Cyber Commands National Mission teams. A member of this subcommittee, senator blumenthal, senator shaheen, we all wrote to the secretary of defense last week that they, the department, ought to be assigned to identify russian operators responsible for the hacking, stealing information, planning misinformation and spreading it through all the bot nets and fake accounts on social media. They ought to do that. Thats the Cyber Command knows who that is. And then, we ought to use our cyber forces to disrupt this activity. We arent. We should also be informing the social Media Companies of russias fake accounts and other activities that violate those companies terms of service so that they can be shut down. Second, i would ask us to look at that as the departments own defense size Board Task Force on cyber deterrence concluded last year, we ought to show mr. Putin that two can play in this game. We ought to consider Information Operations of our own to deter mr. Putin like exposing his wealth and that of his oligarchs. Third, i would suggest the department should ensure that its active and reserved components cyber units are prepared to assist the department of Homeland Security and the governors to defend our election infrastructure. Not just after the attack but proactively before and during the russian attacks. Fourth, i would suggest that the dep must integrate capabilities and planning to cyber warfare and Information Warfare to conduct Information Warfare through cyber space as last years defense bill mandated. Our adversaries recognize the importance of this kind of integration but today cyber warfare and Information Warfare are separated in the department of defense it involve multiple organizations. And fifth, i would recommend as one of our witnesses i think will testify today, the Department Must help develop an effective whole of government response to russias strategic Information Operation through things like a joint Interagency Task force and effusion center. Our colleagues on the Foreign Relations committee have proposed something similar. The threats not going away. Its likely to intensify and as our Intelligence Community has been warning and as dni coats has just testified to the Senate Intelligence committee, that threat is not going away. So the 2018 elections are upon us. We cannot sit idly buy and watch this happen again. Thank you, mr. Chairman. Thank you and welcome to all of our panelists here today, our witnesses. Wed ask that, first of all, you limit your opening remarks to five minutes but your entire statements will be made a part of the record. We like to begin with mr. Butler. Thank you, mr. Chairman. Ranking member nelson and distinguished members of the cyber subcommittee. Its a privilege to be here. Thank you for the invitation. My views really represent my views and not that of any particular organization. Ill just quickly hit the highlights of my written statement, they track very closely with a lot of the opening comments. My comments are really focused around my assessment of the threat in the electoral processes after interviewing a few different states. Secondly, recommendations to the federal government partner with the whole of America Campaign and thirdly what this subcommittee can do going forward. Ive been watching the russian influence operations threat for some time in uniform and out of uniform and our ability to counter russian influence operations is not only a function of what we know about the threat but our willingness and ability to address that threat. As ive looked at the election infrastructure in a few states weve learned from 2016 and what is our known vulnerabilities have been remediated. Whether you look at the voting registration systems or the election infrastructure proper. However, the states do not know how to address the disinformation campaign. That is a struggle and the threat still remains very, very high. My perspective looking at this particular threat, what were talking about today is one line of operation within what i think has to be addressed through a National Security counsel led task force. A whole of America Campaign, not too much dissimilar from the nctc but with a strong empowered private sector element. Again, i go back to the idea of a whole of america process. Two key components inside of this, one is the idea of having an element thats focused on strengthening states infrastructure and hardening american citizens, deterrence by denial some would say. A second component focused on cost and position, from bot net disruptions to other kinds of sanctioning activities, importantly reinforce multilateral limit im a big component of a cyber stability board, coalition of the of the willing working to ensure the most effective way of doing cost in position. Those two components then supported by an integrated fusion center. It provides situational awareness, combined the best of intelligence both in the commercial and from the National Security community with Law Enforcement and active defense actions. Focused on a campaign that is centralized in its planning but decentralized in its execution. From my perspective it really requires both cultural and legislative enablingers. Cultural the president must lead and rally the nation. Theres opportunities already this week that can be used to help with that. The infrastructure proposals a great example. I dont see anything about resilience in the infrastructure proposal. We should have a way of norpg, especially as were building new infrastructure, methods and strategies and incentives for strengthening the infrastructure here in this country. Additional, we need to leverage the best of u. S. Competencies across america. Defense is excellent. U. S. Intelligence agency combined with web Scale Companies do a great job. Web Scale Companies are very good and growing in their ability to rapidly identify disinformation campaigns and response. And we need will need some help from the legislative side. Specifically for dod, five recommendations that track very closely with what senator nelson was talking about. I think thetojump start this sponsored task nelson was talking about. I think to jumpstart this nscsponsored task force, we should coordinate with the secretary of defense to immediately stand up and a joint Interagency Task force. Inside of that again, empowered private sector players. We typically dont think about that, but this really is something where we need to Work Together in a Public Private partnership. We need to make arrangements with state and local officials through dhs and the National Guard bureau. Second recommendation is to the ngb and working with the National Guard bureau to really not only inventory what we have on cyber units and Information Operations units, but to begin to scale them to help the states and to help us as we think about Incident Response in general. I think they could be aligned with fema regions. I think they could be aligned in a lot of different way, but we need to first get organized. The third is to actually have a session where we discuss courses of action. That would have to be a closed session, but i think thats where the request for authority, new authorities request for new resources come out and it gets to the point of not only looking at offensive actions, but defensively what were in store for as we begin to move offensively and what were going to do from a continuity of government and continuity of business perspective. The last two relate to senator nelsons comments with regards to the dsp tank forcsk force. I think we should continue to push with the Task Force Recommendations and i would advocate that this committee should have its own campaign of exercises to help it understand where the adversary is going and to be able to advance ideas with regards to looking at threat and countermeasures. I stand ready to answer any questions that you have. Thank you, mr. Butler. Miss conley . Thank you so much, chairman. Ranking member senator nelson and esteemed colleagues. Thank you for this very timely opportunity to speak to you this afternoon and what a timely moment as u. S. Intelligence agencies have now assessed that russia will continue to make bold and more disruptive Cyber Operations focused on the midterm elections. Cia director mike pompeo also stated publicly that he fully expects russia will attempt to disrupt the u. S. Midterm election. So we know they are doing it and will do it, but we as a nation are not prepared to effectively combat what i believe is an intensifying disInformation Operation, an influence operation. Im a bit of a contrarian on this panel. Im not a cybersecurity expert, but what i am most concerned about is that we have nine months and the American People are not educated as to what is going to happen to them and thats where i think our focus must lie. Im less concerned about the mindset of president putin. I know his mindset. Im more concerned about the mindset of the American People as we head towards this election. You asked us what role dod could play to protect the u. S. Elections, and i think simply dod, working with congress, has got to demand a whole of Government Strategy to fight against this the enduring disinformation and influence operation. We dont have a national strategy. Unfortunately, modernizing our Nuclear Forces will not stop a russian influence operation. Thats where we are missing a grave threat that exists in the American Peoples palm of their hand and on their computer screens. It is vital that we Start Talking publicly about this threat and educating the American People on a bipartisan basis. Tragically, the Russian Campaign has already deeply polarized our country which only serves the kremlins interest as one of the most trusted institutions in the United States, the department of defense must leverage that trust with the American People to mitigate russian influence. Simply put, the department of defense has to model the bipartisan and factbased action and behavior and awareness that will help reduce societal division. This is about leadership and its about protecting the United States and as far as i can see, that is in the department of the defense job description. So a good place to begin is using dods extensive employee and military networks to provide timely policy guidance and statements about the threat that russian influence operation poses to election security. Secretary mattis and general dunnford should provide Public Outreach to the threat and how to counter it. Perhaps they should think about forming Public Service announcements and european governments have been very effective in warning their publics about the danger of russian disinformation. France and germany were very strong on that, but you have to put the message out and we have not. I offered one suggestion, my written testimony to look at how we can leverage the Senior Vice President<\/a> for europe, youre asia and the arctic and director of the Europe Program<\/a> at the center for strategic and international studies, dr. Richard hartnet ahead of Political Science<\/a> at the university of cincinnati an a former scholar and residence at u. S. Cyber command and the National Security<\/a> agency and dr. Michael sum wrryer, at the harv kennedy school. At the conclusion of Ranking Member<\/a> nelsons comments, we will have a round of questions and answers. There is no dispute about what russia did during the 2016 election cycle. There is clear evidence that russia attempted to undermine our democratic process through the hacking of independent political entities, manipulation of social media and use of propaganda venues such as russia today. Evidence to date indicates that no polls or state election systems were manipulated to change theout come of the vote, however there was evidence of russian probing of certain election systems in 21 states. The department of defense has a Critical Role<\/a> to play in challenging and influencing the mind set of our cyber adversaries and defending the homeland from attacks. Attacks that could include cyberattacks by other nations against our election infrastructure. We look forward to the department approaching these issues with a heightened sense of urgency. The threat is not going away. Just a couple weeks ago the director of the Central Intelligence<\/a> agency warned that russia will seek to influence the upcoming midterm elections. The white house National Security<\/a> adviser stated mexican or that the mexican president ial campaign as well. This is all in addition to russia attempts to influence the elections in france and germany last year. Each of us on this panel has been quite vocal about the need for a strategy that seizes the strategic high ground. Whether you call it deterrence or something else, we need a strategy that moves out of the trenches. The lack of consequences for the countless attacks over the past decade has emboldened our adversaries and left us vulnerable to emboldened behavior. The attacks we experienced during the 2016 election are just the latest rung on that escalation ladder. As long as our adversaries feel they can act with impunity they will press further. Our witnesses offer unique perspectives on the challenges we face. We look to them to help us understand why our posture of restraint has not worked. If we can reverse the damage already done, and what will take to develop and implement a strategy that limits our exposeure and causes cost on Malicious Behavior<\/a>. We invited dr. Richard harknet to explain his limits our ability to confront challenges we face. Our adversaries actively exploit us because they see great benefit and little consequence in doing so. I agree with dr. Harknet that the cold war models of deterrence werent work and look forward to hearing what he think will work. Dr. Sumyer, we understand that hes working on a paper addressing some of the challenges we examined during our full Committee Hearings<\/a> in october on the whole of government approach to cybersecurity. We look forward to hearing more from dr. Sul meyer on the gaps and seams he sees in organizational model and what lessons we can learn from allies like the british. Ms. Heather conley provides expertise in russian politics and foreign policies. Russia has yet to face serious consequences in the cyber or other domains for its 2016 elections interference. We look forward to ms. Conleys testimony on how the United States<\/a> can tailer and implement these penalties and how the department can best deter or dissuade further Russian Election<\/a> metling. We look for to the testimony of bob butler who brings extensive cybersecurity in the department of defense and private sector. Mr. Butler has been involved in numerous studies including the recent Defense Science Board Task<\/a> force on cyber deterrence. Let me close by thanking our witnesses for their willingness to appear today before our subcommittee. Senator nelson . Thank you, mr. Chairman. First of all, i want to make sure that since this is a hearing on elections that everybody understands that this senator feels that this is about the foundation of our democracy and that we as a government ought to be doing more to defend ourselves. And the second thing i want to make sure everybody understands is, this is not a partisan issue. This can happen to either party or the nonparty candidates as well. And it ought to be all hands on deck. The chairman and i in public and in closed meetings, because of the clearance, we have been quite disturbed about wondering if we are doing as much as we should as a government to protect ourselves. So in a recent closed hearing of this subcommittee, the department of defense demonstrated that its not taking appropriate steps to defend against and deter this threat to our democracy. So mr. Chairman, i join you in welcoming these witnesses and hope that some practical suggestions are going to come out. I want to mention just a few things. First, the department had cyber forces designed and trained to thwart attacks on our country through cyber space and thats why we created the Cyber Command<\/a>s National Mission<\/a> teams. A member of this subcommittee, senator blumenthal, senator shaheen, we all wrote to the secretary of defense last week that they, the department, ought to be assigned to identify russian operators responsible for the hacking, stealing information, planning misinformation and spreading it through all the bot nets and fake accounts on social media. They ought to do that. Thats the Cyber Command<\/a> knows who that is. And then, we ought to use our cyber forces to disrupt this activity. We arent. We should also be informing the social Media Companies<\/a> of russias fake accounts and other activities that violate those companies terms of service so that they can be shut down. Second, i would ask us to look at that as the departments own defense size Board Task Force<\/a> on cyber deterrence concluded last year, we ought to show mr. Putin that two can play in this game. We ought to consider Information Operations<\/a> of our own to deter mr. Putin like exposing his wealth and that of his oligarchs. Third, i would suggest the department should ensure that its active and reserved components cyber units are prepared to assist the department of Homeland Security<\/a> and the governors to defend our election infrastructure. Not just after the attack but proactively before and during the russian attacks. Fourth, i would suggest that the dep must integrate capabilities and planning to cyber warfare and Information Warfare<\/a> to conduct Information Warfare<\/a> through cyber space as last years defense bill mandated. Our adversaries recognize the importance of this kind of integration but today cyber warfare and Information Warfare<\/a> are separated in the department of defense it involve multiple organizations. And fifth, i would recommend as one of our witnesses i think will testify today, the Department Must<\/a> help develop an effective whole of government response to russias strategic Information Operation<\/a> through things like a joint Interagency Task<\/a> force and effusion center. Our colleagues on the Foreign Relations<\/a> committee have proposed something similar. The threats not going away. Its likely to intensify and as our Intelligence Community<\/a> has been warning and as dni coats has just testified to the Senate Intelligence<\/a> committee, that threat is not going away. So the 2018 elections are upon us. We cannot sit idly buy and watch this happen again. Thank you, mr. Chairman. Thank you and welcome to all of our panelists here today, our witnesses. Wed ask that, first of all, you limit your opening remarks to five minutes but your entire statements will be made a part of the record. We like to begin with mr. Butler. Thank you, mr. Chairman. Ranking member nelson and distinguished members of the cyber subcommittee. Its a privilege to be here. Thank you for the invitation. My views really represent my views and not that of any particular organization. Ill just quickly hit the highlights of my written statement, they track very closely with a lot of the opening comments. My comments are really focused around my assessment of the threat in the electoral processes after interviewing a few different states. Secondly, recommendations to the federal government partner with the whole of America Campaign<\/a> and thirdly what this subcommittee can do going forward. Ive been watching the russian influence operations threat for some time in uniform and out of uniform and our ability to counter russian influence operations is not only a function of what we know about the threat but our willingness and ability to address that threat. As ive looked at the election infrastructure in a few states weve learned from 2016 and what is our known vulnerabilities have been remediated. Whether you look at the voting registration systems or the election infrastructure proper. However, the states do not know how to address the disinformation campaign. That is a struggle and the threat still remains very, very high. My perspective looking at this particular threat, what were talking about today is one line of operation within what i think has to be addressed through a National Security<\/a> counsel led task force. A whole of America Campaign<\/a>, not too much dissimilar from the nctc but with a strong empowered private sector element. Again, i go back to the idea of a whole of america process. Two key components inside of this, one is the idea of having an element thats focused on strengthening states infrastructure and hardening american citizens, deterrence by denial some would say. A second component focused on cost and position, from bot net disruptions to other kinds of sanctioning activities, importantly reinforce multilateral limit im a big component of a cyber stability board, coalition of the of the willing working to ensure the most effective way of doing cost in position. Those two components then supported by an integrated fusion center. It provides situational awareness, combined the best of intelligence both in the commercial and from the National Security<\/a> community with Law Enforcement<\/a> and active defense actions. Focused on a campaign that is centralized in its planning but decentralized in its execution. From my perspective it really requires both cultural and legislative enablingers. Cultural the president must lead and rally the nation. Theres opportunities already this week that can be used to help with that. The infrastructure proposals a great example. I dont see anything about resilience in the infrastructure proposal. We should have a way of norpg, especially as were building new infrastructure, methods and strategies and incentives for strengthening the infrastructure here in this country. Additional, we need to leverage the best of u. S. Competencies across america. Defense is excellent. U. S. Intelligence agency combined with web Scale Companies<\/a> do a great job. Web Scale Companies<\/a> are very good and growing in their ability to rapidly identify disinformation campaigns and response. And we need will need some help from the legislative side. Specifically for dod, five recommendations that track very closely with what senator nelson was talking about. I think thetojump start this sponsored task nelson was talking about. I think to jumpstart this nscsponsored task force, we should coordinate with the secretary of defense to immediately stand up and a joint Interagency Task<\/a> force. Inside of that again, empowered private sector players. We typically dont think about that, but this really is something where we need to Work Together<\/a> in a Public Private<\/a> partnership. We need to make arrangements with state and local officials through dhs and the National Guard<\/a> bureau. Second recommendation is to the ngb and working with the National Guard<\/a> bureau to really not only inventory what we have on cyber units and Information Operations<\/a> units, but to begin to scale them to help the states and to help us as we think about Incident Response<\/a> in general. I think they could be aligned with fema regions. I think they could be aligned in a lot of different way, but we need to first get organized. The third is to actually have a session where we discuss courses of action. That would have to be a closed session, but i think thats where the request for authority, new authorities request for new resources come out and it gets to the point of not only looking at offensive actions, but defensively what were in store for as we begin to move offensively and what were going to do from a continuity of government and continuity of business perspective. The last two relate to senator nelsons comments with regards to the dsp tank forcsk force. I think we should continue to push with the Task Force Recommendations<\/a> and i would advocate that this committee should have its own campaign of exercises to help it understand where the adversary is going and to be able to advance ideas with regards to looking at threat and countermeasures. I stand ready to answer any questions that you have. Thank you, mr. Butler. Miss conley . Thank you so much, chairman. Ranking member senator nelson and esteemed colleagues. Thank you for this very timely opportunity to speak to you this afternoon and what a timely moment as u. S. Intelligence agencies have now assessed that russia will continue to make bold and more disruptive Cyber Operations<\/a> focused on the midterm elections. Cia director mike pompeo also stated publicly that he fully expects russia will attempt to disrupt the u. S. Midterm election. So we know they are doing it and will do it, but we as a nation are not prepared to effectively combat what i believe is an intensifying disInformation Operation<\/a>, an influence operation. Im a bit of a contrarian on this panel. Im not a cybersecurity expert, but what i am most concerned about is that we have nine months and the American People<\/a> are not educated as to what is going to happen to them and thats where i think our focus must lie. Im less concerned about the mindset of president putin. I know his mindset. Im more concerned about the mindset of the American People<\/a> as we head towards this election. You asked us what role dod could play to protect the u. S. Elections, and i think simply dod, working with congress, has got to demand a whole of Government Strategy<\/a> to fight against this the enduring disinformation and influence operation. We dont have a national strategy. Unfortunately, modernizing our Nuclear Forces<\/a> will not stop a russian influence operation. Thats where we are missing a grave threat that exists in the American People<\/a>s palm of their hand and on their computer screens. It is vital that we Start Talking<\/a> publicly about this threat and educating the American People<\/a> on a bipartisan basis. Tragically, the Russian Campaign<\/a> has already deeply polarized our country which only serves the kremlins interest as one of the most trusted institutions in the United States<\/a>, the department of defense must leverage that trust with the American People<\/a> to mitigate russian influence. Simply put, the department of defense has to model the bipartisan and factbased action and behavior and awareness that will help reduce societal division. This is about leadership and its about protecting the United States<\/a> and as far as i can see, that is in the department of the defense job description. So a good place to begin is using dods extensive employee and military networks to provide timely policy guidance and statements about the threat that russian influence operation poses to election security. Secretary mattis and general dunnford should provide Public Outreach<\/a> to the threat and how to counter it. Perhaps they should think about forming Public Service<\/a> announcements and european governments have been very effective in warning their publics about the danger of russian disinformation. France and germany were very strong on that, but you have to put the message out and we have not. I offered one suggestion, my written testimony to look at how we can leverage the National Guard<\/a> bureau looking closely with state and local leaders in cooperation with the department of Homeland Security<\/a> to enhance Cybersecurity Awareness<\/a> and be able to detect patterns of inthere youence. For example, if hacked email surfaced online in conjunction with the false rumors about potential electoral candidates. We need to Start Talking<\/a> about this. Another instrument is the state partnership program. The National Guard<\/a> has partnered with the lithuanian military and the estonian military and they can bring back to their states information about how russian influence works. We are speaking today about protecting the homeland from continuous disinformation attacks which alter how the average american thinks about their system of governance and their government, and what the American People<\/a> may end up thinking is that everyone is lying, everything is fake and there is nothing that can be trusted and then even the most trusted of american institutions, the defense department, the justice department, the fbi, the department of Homeland Security<\/a>, the office of the president will mean very little to the American People<\/a>, and this is exactly how you break the internal coherence of the enemy system according to Russian Military<\/a> doctrine, and unfortunately today, we are doing this most of this to ourselves without assistance from the kremlin. This is a matter of urgency. We have nine months and we need to educate the American People<\/a> in addition to enhancing, of course, our cybersecurity protections, but as the french disinformation attacks showed what many of the organizations it looked like this information was coming from, it was coming from american organizations. This is designed to be hidden. It adapts. We have to educate the American People<\/a> about what they are going to confront on the november elections. Thank you. Thank you, miss conley. Dr. Hartpit . Chairman rounds, ranking number nelson, distinguished members. Thank you for the opportunity to speak to you about this critical issue today. We have a big picture problem. Throughout International Political<\/a> history states have, at times, miss aligned their security approaches to the strategic realities in which they tried to secure themselves. In 1914, every general staff in europe thought that security rested on the offense, and they found how devastatingly in world war i that they were tragically wrong. France in the 1930s said okay, we learned from the last war. Its a defensedominant environment and well rest our security on the most technologically defensive works in history and again, the fundamentals have changed and the germans simply went around the line. Senators, with all due respect, i do not want to be france in the 1930s, but i think we are coming dangerously close it to that my oppia and the misalignment of strategy. Our adversaries are working through a new seam in international politics. Cyberspace is that seam. Its unique characteristic have created a strategic environment without having to violate traditional territorial integrity through war. What weve been witnessing are not hacks. Theyre not thefts. Its not simple espionage. What we must accept is the fact that we are facing comprehensive, Strategic Campaign<\/a>s to undermine our National Sources<\/a> of power be they economic, social, political or military and so, therefore, i agree, we must develop a counter Strategic Campaign<\/a> to protect those sources that have a more security, stable, interoperable and global cyberspace. With the regard to the integrity of our elections, weve effectively left civilians whose main focus is not security on the front lines. That is not a recipe for success. Specific to the department of defense role of creating better security in, through and from cyberspace, we must adopt a cyber persistence in which our objective is to seize and maintain the initiative. We must defend forward as close to adversary capacity and planning as possible so that we can watch and inform ourselves, disrupt and disable if necessary. Our immediate objective must be to first erode the confidence adversaries now have in their ability to achieve and enable objectives. They are very confident. Second, we have to erode their confidence in their own capabilities and third, we must erode those capabilities themselves. We are well past the post on this. We need a comprehensive, seamless, integrated strategy that pulls together greater resiliency, forward defense and when necessary countering and testing cyber activity to reverse current behavior. We are not at step one. We are well past that. We actually have to reverse behavior. Our security will rest on our ability to simultaneously anticipate how adversaries will exploit our vulnerabilities how we can exploit theirs. Cyberspace is an interconnect the form of Constant Contact<\/a> that creates an imperative for us to persist. This is a wrestling match in which we have to grapple with who actually has the initiative. Being one step ahead in both knowledge and in action. If we do not adjust to this reality our National Source<\/a> of power will remain exposed and more of those who wish to contest our power will pour into this seam. I therefore, argue that we must make three critical adjustments and the first is we have to adjust our overall strategic perspective. War and territorial aggression which can effectively be deterred are not the only pathways for undermining our National Sources<\/a> of power. In fact, because we have this effective strategic deterrent, we should expect our adversaries to be in the strategic behavior below the threshold of war. . Second, we must move the cyber capability out of their garrisons and adopt a strategy that matches the operation allen viernment of cyberspace. We must meet the challenge of an interconnected domain with a strategy that continuously seeks tactical, operational and strategic initiative. Third, we must make the fundamental alterations to capability development, operational tempo and Decision Making<\/a> processes and most importantly, as bob referred to, overall authorities that will enable our forces to be successful. We cannot succeed using authorities that assume territoriality and segmentation in an environment of interconnectedness Constant Contact<\/a> and initiative systems. We cannot secure an environment of constant action through inaction. Strategic effect in cyberspace comes from the use of capabilities than having the initiative over ones adversaries. It is time for us to seize that initiative. I look forward in explaining in more detail how we can pursue security during our q and a. Thank you, dr. Hartnet. Dr. Sillmeier. Ranking member nelson and distinguished subcommittee, it is an honor to be here today. I would like to note that i am part of a team at the kennedy schools bellfor center that released a report a couple of hours ago. Its a playbook for state and local Election Administrators<\/a> and its got steps they can take to improve the cybersecurity of systems that they administer. Its based on Field Research<\/a> by a wonderful research team, many, many students contributed. Im very lucky to have one of the wonderful students here. Karina has joined us. Regardless of the role of the department of defense, these defensive improvements are essential and i want to make sure i hit that right up front. Those recommendations that we put out today compliment the playbook for the political campaigns to improve their cybersecurity. Its essential that we make our elections harder to hack and that we improve resiliency in case Critical Systems<\/a> are compromised. But we should also consider how best to counter threats abroad before they hit us at home. So let me transition to how i see some potential roles for the military outside of the United States<\/a> to protect our elections. There are two necessary conditions of posture that i see as critical, reconnaissance posture and force posture. First, reconnaissance posture. Our Cyber Mission<\/a> forces should constantly conduct Reconnaissance Mission<\/a> abroad to discover electionrelated threats to the United States<\/a> and provide indicators and warnings to our forces and decisionmakers. There will never be suspect resources to address all threats equally and prioritizing threats to our democratic processes is critical. Otherwise we cannot hope to disrupt these threats on forced posture, our forces must be sufficiently ready to strike and strike against targets abroad that threaten our elections. Readiness is a critical issue for our armed forces today and i would encourage senators on the Sub Committee<\/a> to ensure theyre asking tough questions about the readiness of our cyber forces just as they would about any other part of our military. If the militarys reconnaissance and forces are postured to focus on threats to our elections from abroad, there are four objectives that i think our forces should be prepared to pursue. It should go without saying that undertaking these actions should be consistent with International Law<\/a> and other relevant u. S. Comm commitments. Those objectives are preventing attacks from aprilizing. Second, preempting imminent attacks. Third, halting attacks in progress and fourth, retaliating if necessary after an attack. On the fourth, let me just note i would emphasize that had retaliation needs to be timely. Its got to be timely. The more time that elapses after an adversarys attack the harder it will be that our action is in direct response. Across those objective, proper training, thorough rehearsals and coordination with other parts of our government are essential. Bringing military capabilities to bear inside and outside of cyberspace is always a serious matter so its critical to ensure that rules of engagement and questions about authorities are settled well in advance of any order to strike. Here, i would note that some of our closest allies like the United Kingdom<\/a> and israel have undertaken some National Level<\/a> organizational reforms to streamline responsibilities for cyber issues and we may at some point want to consider something similar here. One of the best cyberrelated investments the nation has made is in the National Mission<\/a> force an elite group of Network Operators<\/a> at Cyber Command<\/a>. They defend the nation from an attack of significant consequence in cyberspace. I think it is very much worth conditioning what role the nfk to describe the objectives just now. I have not dus discussed deterrence much. I tonight get me wrong, however i would not like to bet if i didnt have to. Sometimes the pros pekt of defending againstis in ils deterrence is the least bad option. Thats not the case in cybersecurity. We have other options like the ones i described just now and we should employ them alongside strong policies of deterrence. Finally, i would just note that information derived abroad from reconnaissance should be shared with relevant parties at the state and local level. I want to commend the department of Homeland Security<\/a> for working hard to promote information sharing over the last few years and i would also like to encourage more thinking especially among my colleagues in academia to help Congress Protect<\/a> itself since congress is so critical as a part of our democratic process not just work accounts, but also campaign accounts, personal accounts and these cant be left vulnerable. That concludes my prepared testimony and i look forward to taking your question. Thank you. Let me thank all of you for some great insight and i look forward to your thoughts in terms of the questions that we ask. What id like to do is to do what we call fiveminute rounds here. Well alternate back and forth and after weve done that once through if we have time i would go back through and do a second round depending on the amount of time that we have and whether or not other members come. Let me begin with mine. Ill start with dr. Hartnett. Youve written that restraint and reactive postures are not sustainable, that the United States<\/a> needs a strategy that capitalizes on the unique attributes of the cyber domain. You called for a strategy of cyber persistence where we are constantly engaged with adversaries seeking to frustrate, confuse and challenge. How would your strategy calling for persistent engagement apply in the russian meddling with our election as an example and should this involve us contesting the Malicious Behavior<\/a> at its source and what do you believe are the consequences of our failure to response to the Russian Election<\/a> interference . Number one, weve got to be able to provide attribution to where its coming from and hopefully weve got that completed, but give me your thoughts on it. What would you say is an example of persistent engagement with regard to what wooe doeve done already and what they expect them to do . [ inaudible ] there we go. Is it on . Thank you. So lets think about the Internet Research<\/a> agency, right . I mean, we know about this center in st. Petersburg. We know that it controls a series of automated bots that are driving particularly wellconceived Information Operations<\/a> that are meant to be divisive. Right . I dont know why we are according First Amendment<\/a> rights to bot, right . Its not a free speech issue. If we have evidence of foreign manipulation, technical manipulation of the social media space thats not what the American People<\/a>, you know, from an educated standpoint actually understand is coming at them, right . They think that this is a maj majoritarian. But if that trend is being driven by foreign automated intrusion that is not an issue over free speech. Thats an issue of a direct foreign manipulation and so we need, i agree with dr. Sillmeyer, right . We need to have the reconnaissance to your point about attribution, right . Thats what persistence enables you to do to start to get better at attribution, but we need to be able to move at the speed of relevance. So if, in fact, the bots are hitting us in a particular trend that is meant to be divisive, we should be able to have the capacity to at least disrupt if not disable that capacity. We do know where some of these capacities lie by being persistent in our reconnaissance, we will get a better understanding of what our vulnerability surface is. We have to think about it that way. We tend to think about an attack surface. Thats from their perspective. We have to get a better handle on what our vulnerability surface is and by being able to understand what our vulnerabilities are and again, a product of being persistent in this case, we can start to take those capabilities away. Dr. Sillmeyer, do you agree with that . I do. I agree with a vast majority of what my colleague dr. Hartnett just said. For me, even just to get a little more specific, the kinds of options that i would want to be seeing presented, right, need to allow Decision Makers<\/a> some flexibility from lower level actions like denying troll farm access to compromised infrastructure, deleting some accounts to erasing some systems if it comes to it. Its too important to take options off the table ahead of time. So as long as the options space is kept open we can do it persistently or less persistently, but a wide range of options. Mr. Butler, your thoughts . I agree with both michael and richard on this. I would say that we need to be asymmetrical in our response. Im a big believer in bot net instructions as we saw with levishov and thats a symmetrical response. If you look at the Research Agency<\/a> in st. Petersburg, theyre a couple to the kremlin and the counter influence cam camp where you begin to cut the funding and cut the support enablers behind that infrastructure. So we fleneed to think about ths differently. It shouldnt be cyber on cyber and social media on social media. Its got to be a broader campaign. Miss conley . I agree with the asymmetrical response and while trying to bring down the infrastructure of those of those bots, what they are doing though, russia exploits the weaknesses that it finds. So it is amplifying the weaknesses and division that are already appearing on social media. So how do we try to reduce the weaknesses . And this, again, gets back to the critical importance of exactly what this committee represent, the bipartisanship, fact based and getting to communities through a variety of methods to help inform the American People<\/a>. So when they see a trending site lets look at that. Whats underneath that. The only way we can stop this from changing hearts and minds from the American People<\/a> is helping them discern what is coming. We can do everything we can technologically to eliminate it, but the other part is just missing. We are not educating. On the asymmetrical sanctions, my frustration, and i am sure many on thisi committee, as wel. Ill ask you to shorten it up because my time has expired. Sorry about that, is to think about ways that we can focus on the kremlin, on financial sanctions, on sanctioning the inner circle as once attributable back to that. So not just in the cyber domain. Focusing on financial sanctions and individual sanctions, that could be very powerful, as well. Thank you. Senator nelson . So all of you sound like that you just dont think enough has been done and that were not ready and dr. Hartnett, you have said that 2016 was the stone age compared to whats going to happen so you want to trace what you think will happen . I think one of the things back to the chairmans question about one of the lingering effects is, again, we have adversaries who are confident. So even if there are other actors aside from russia who will look at this space and say this is a space that i can play in and i can work in. Until we start to reverse that confidence, were going to see greater experimentation. Technologically, ill give you one example, senator. My concern with regard to leveraging Artificial Intelligence<\/a> and machine learning. This will be a step function, thus my stone age aleutian, a step function from where we are. We are going to within the next 16 months, im going to be able to take you and put you in a video in which you are saying something that you never said in a place that youve never been, and you are not going to be able to authent kate thicate that yo not done that or been there. Just think about that as a tool for someone, an adversary who wants to engage in disruptive social cohesion types of information campaigns. Right. Thats around the corner. So miss conley, given that, youve already said that you dont think weve taken any positive, proactive steps. Why do you think thats the case . I think the executive branch refuses to recognize the threat and it refuses to put forward a national whole of government and whole of Society Strategy<\/a> and bring all of the agencies and tools of influence to bear on this. We have to think of this as a direct threat to the National Security<\/a> of this country. It has to receive the priority. I would also, just to focus what dr. Hartnett said, this is adaptation. If were preparing for what russia did in 2016 it would be very different in november. It would be very different in 2020. It would look more american. It would look less russian and this is adaptation. Were already fighting the next war and ahead of the new one which is why i think education is so critical, but absent a u. S. Government approach we will all have to do our part in our communities to inform the people of the american threat and its unfortunate that we cant do this in a unified way. So if we cant get the government to move, are there any private initiatives that would help . What im seeing is some very effective News Literacy<\/a> campaigns. I think again, new sources and social media are doing fact checking. The pressure that congress has brought to bear on the social Media Companies<\/a> is changing their perspective, but again, we are so late to need. This has been oning about and this campaign is only intensifying and were just getting our arms wrapped around this. This is where every member of congress has to return to their home district and talk about this in very clear ways. . Amen to that. Dr. Hartnett, on the example that you gave of the next level of technology of which something can be created that looks real, acts real, feels real, et cetera, if Cyber Command<\/a> were to adopt your thinking knowing what the threat is in what way would you suggest they change the way theyre doing their operations . I think its very important to expand this notion of defending forward. This notion that we need to be as close to the source of the adver adversarial capability and Decision Making<\/a> as possible. This is not a space in which time and geography is leverageable for defense. So when we think about the notion of front lines and the front lines are everybody, right . Rate now our general approach has been to defend at our border and our network which actually means that we start defending after the first breach and we are already playing catchup. So i confer with the notion of adaptability here and its all about anticipation. So when bob butler talks about asymmetric, right . Thats what i would talk about in terms of being able to be one step ahead, right . We have to be able to anticipate the exploitation of our vulnerabilities you need to be able to be defending as far forward as possible and in space, we defend forward. We are not defending forward right now. Okay. Thank you. Senator gillibrand . Thanks to all of you for your testimony. I agree with a lot of it, professor hartnett, i appreciate your effort to redefine the space and operating in it. Rather than attack the election infrastructure and treat it like an attack, as you said, but because of the way we set up the Cyber Capabilities<\/a> and we have done with good reasons including privacy and states rights and it seems the dod is hamstrung on trying to have an attack on our democracy. Ive asked this many times and theyve said its not our job. So you argue that we need to consider authorities that we allow dod and dhs for the Intelligence Community<\/a> to employ the cyber persistence and recommend the rallies . Can you expand on what kind offa authorities we might be considering from our allies. Ive put this to the department of defense in any setting weve had in every conversation about cyber and its a states rights issue and its not our job and i cannot for the life of me cannot see why we dont see that as our job. If they would have bombed we would have responded with the military and it seems offputting to me. The response is often thats Homeland Security<\/a>s job. They can call us if they need us, but they havent. I understand why thats probably not the case because a lot of secretaries of state in a lot of states think its their job and not anyone elses job and they dont want to relinquish that control and i would like your suggestions on how to right the authorities that we think are necessary and also, ive really tried to the push the National Guard<\/a> as a possible place where this can be done because the National Guard<\/a> already serves the states and theyre already under the control of the governors, so why not amplify what were already doing with the National Guard<\/a> and reserve to give them the expertise and cyber and actually delegate this mission specifically to them in conjunction with all of the other assets in the military. So to all of you, you can ask dr. Hartnett since you addressed it in the opening remarks about what authorities can we give . How can the National Guard<\/a> be useful and how do we get this done because its frustrating to me that were not doing it and a third thing to add to your answer and i coa 9 11 deep dive analysis to the electoral infrastructure and its a bipartisan bill, whether we ever get a vote on it i will never know, but that would be a great first step in my mind to get the report and these are the ten things you need to know for infrastructure so maybe comment on those three ideas. Thank you, senator. You mentioned our allies and he has work in analyzing them and if you look at the uk, for example, and you look at the israelis and look at the australians and their first default in cyberspace is to look at how do we find synergy and not segmentation . Our entire approach to this space has been starting with who has divided roles and responsibilities. So i think we have to look we can learn something from our allies, and we find synergy rather than segmentation and that should be the policy framework question, right . In terms of authorityis and think theres a false debate between 10 and 50 and if i argue for a seamless notion and i am suggesting that we understand title 10 and title 50 as actually mutually reinforcing and not defined as again segmentating and they segment in congress, and they dont segment in operational space and so we should understand and reinterpret, i would argue those authorities to emphasize where a synergy and where there is seamless reinforcement rather than looking at something that divides and put us into different lanes. In terms of the National Guard<\/a>, i think the Cyber Protection<\/a> teams and force type of an approach would be appropriate. We need to get at this, senator, so if that is the best mechanism. Theres expertise at that level. Mr. Butler has talked about leveraging the private sector through National Guard<\/a> as well as reserve and we have a capacity if you look at the brits they are looking at a cyber civilian reserve force and thats another interesting way of thinking about this. So ultimately, if we need to do a deep dive, i think we do, right . I think we have authorities that are structured for a terrestrial space that does not map to the realities of this humanmade interconnected space. Authorities are what we should do last. We should figure out what our mission is. We should develop the organizations to pursue those missions and then we should authorize them to do it. I would submit to you that one of the major problems weve face side weve been continuously trying to shoehorn our cyber forces into existing authorities and working backward from the way we should be working. Ill turn to bob, as well. Senator, i think the National Guard<\/a> is an area that we absolutely should explore and i mention it in my written testimony, as well as far as education and bringing together dhs and dod ask working with Community Leaders<\/a> on the state and local level. On the 9 11 commission, cyber is a critical pillar of this and it transcends it, as well, we need to look at russian economic influence and look at a whole range of not just of russia as the adversary and other adversaries that use cyber disinformation and economic. So please broaden that out. They will find any seam, state, federal, First Amendment<\/a> privacy, thats where they will be and thats why we cant get locked into those seams, bob . Senator, i take it from two different angles. One is clean sheet everything. What do you want to do and lets refocus the authorities. I, katherines work here in looking at countermeasures is a great example of that. Her legal interpretation of the manual is very different from what most people are saying these days. The other thing is im involved in exercises where im blending physical ask cyber together and looking at what we look at physical and cyberspace and im working on an activity where we have a natural hazard and a nation state actor manipulating inside of that. How do you get a rolling start in you can use our authority and the military can create a rolling start. We need to leverage. We need to reinterpret and leverage these kinds of things as we go forward. A part of that is the National Guard<\/a> bureau. We cant, we have un9 11ness within the stand up of the National Guard<\/a> activities both in the air and now with the army. We have both cyber and Information Operations<\/a>. I think we can create pockets of talent. Washington state has a phenomenal Security Unit<\/a> and maryland has a fantastic unit where they leverage a lot of nsa expertise and we have units spread around the country and we need to create a construct of cyber move all assistance across boundaries and state borders and again, i think we can do that. Weve just got to sit down and plan together a campaign in that regard. While the senators time has expired, well let you expedite the answer. Well go real quick. I support the goodness just said. Abroad, i do not believe the kind of activities that i described earlier need new authorities. On the deep dive, id say great. The bellfors center has tried to get a tart on that and we hope we can be a support and theres a part of me that wonders that if by saying cyber the responses help desk and by not describing it in a way by warfare and propaganda and foreign influence we do a disservice to the real problem. Thank you. Senator blumenthal. Thank you, mr. Chairman. I want to thank all of you for being here and im familiar with the work done by the Belfour Center<\/a> and thank you for the work done by each of your organizations. I want to first tell you. You probably already know that the immediacy and urgency of this task was reinforced this morning before the Senate Intelligence<\/a> committee before dan coats with the director of National Intelligence<\/a> said, quote, there should be no doubt that russia perceives its past efforts and views the 2013 midterm elections as a potential russian influence operations and that statement would be beyond conventional wisdom and it would be unnecessary to stay because it is the consensus of our Intelligence Community<\/a> and it has been broadly accepted by everyone, except the president of the United States<\/a> and in my view, thats the elephant in the room and the president needs to acknowledge this threat on our National Security<\/a>. So, i put that on the record simply because we can propose all of the great ideas in the world and some very good ideas, as a matter of fact, came from a report done by the senate Foreign Relations<\/a> committee and a minority report by my colleague and then Ranking Member<\/a> senator cardon called putins asymmetric assault on russia for u. S. National security made very good proposals and i would be interested to see the Belfour Center<\/a>s release today and, in fact, without having seen it, mr. Chairman, i ask it be made part of the record. Without objection. I think we need to make progress on gaining acceptance at the highest levels of the United States<\/a> government, and let me put it as diplomatically as possible for the proposition that russia attacked our democracy, in my view it committed an act of war. Theyre going to do it again unless they are made to pay a price for it, and that includes enforcing sanctions passed overwhelmingly by this body. 982, still unenforced. So the talk about retaliatory measures in real time, doctor, is very well taken, but why should the russians take us seriously when the president denies the plain reality of their attacking our country and the sanctions that would make them pay a price are still unenforced. All of that said, i want to raise another topic which i think so far has been untouched. The social media site, facebook, google. Let me ask each of you if you can comment on what their responsibleities are and how they are meeting them in this disinformation Propaganda Campaign<\/a> using bots and fake accounts which have been appearing on those sites . Mr. Butler . I think, senator, the response, and i have talked with a couple of the web Scale Companies<\/a> about this and its aligning with what weve already seen in the Counter Terrorism<\/a> fight and so in that space, what you see is them actively, proactively looking for disinformation and in the case of terrorism, of course, looking for recruitment and i think the challenge is guidance with regards to counter narratives or alternative narratives in that space. That needs to be done with others, but i think thats where we need to head. They have the ability based on their reach and their fusion engines to really help us move much more quickly into active defense in this space and not just to do it from a cyber perspective, but from an influence, a counter influence perspective which i think is critical. Miss connelly . Building on the awareness of what theyve done to force the social Media Companies<\/a> to take a deep look at this has been helpful. I would suggest to you they think russia will adapt their tools and this will look more and more american which will get more and more into First Amendment<\/a> issues because that is a weakness to exploit here. So what i would commend in the interest of being ahead of the curve and not behind it is we start looking at how social media engines can start detecting what looks like its an american origin and that would be the next step i recommend. Thank you. I think we have to move away from a Partnership Model<\/a> to be perfectly honest with you. Weve been talking about a public, private partnership for 25 years. Published about this, 25 years ago, and the problem is that partnerships require shared interest in the beginning of the morning. The private sector has a very specific interest profit making and the state has a very specific interest, security providing. We should recognize and grant that they have a different interest. So we need to move this to an alignment model, right . How do we structure incentives within the marketplace for them to achieve their primary objective which is profit making while producing an effect that the state requires which is enhanced security. Until we start to actually think about how can we shape and incentivize that behavior and recognize that we actually have very different interests in this space, right . I mean, that strava fitness band company a few weeks ago, right . Produced a heat map that exposes all of our forwarddeployed troops. I would submit to you that nobody at their Board Meeting<\/a> when they came up with this really great idea of releasing that heat map and they said, look, even our stuffs in the real dark places and they thought that was really cool. Ten years ago the Intelligence Capacity<\/a> that a state would have had to have found the Forward Deployed<\/a> troops. Think about that and this was produced by a fitness company. And they are nonsecurity seeking actors in this space. Thats the way we have to think about them. Lets meet them on their grounds, right . And start to get them to align toward the security needs we have. Thank you. Briefly, i would just note the interests are not aligned and that is the most essential part and to not treat them all the same. Not all of the companies have gone through the same amount of selfreflection. Some have not and some have and we should be honest about that and finally, i dont think we should limit this to social Media Companies<\/a> and there are a lot of companies up and down the stack and a lot of people on the intern internet who have an interest on this type of work. I apologize, mr. Chairman, ive gone over my time. What i would like to do is another round. Lets do one more round so that everyone has an opportunity. Well make it five minutes, and i would simply say that for those of us on this end that like to go, and i went over, as well. Lets phrase it so whatever hits the five minutes whoever is speaking on it that will be the last one on it and well move from there. Let me begin with this very quickly and well look at changing the hats. Dual hats and within the Cyber Community<\/a> and we have a dualhatted individual for both title 10 and title 50 operations and so forth. We are looking at separating those into separate items and one side, title ten and title 50, and weve had a lot of discussions over it and we were concerned at first that we would go very, very rapidly and now theres a discussion about whether or not moving in this particular way is quick enough. I just want to know your thoughts about whether or not were actually approaching the challenges that are facing us in the right way with regard to the organization of government as a whole. I can just very quickly go across and ask each of your thoughts about whether or not were moving in the right direction as to how we are arranging so that we can respond to these types of threats . Ill begin with mr. Butler. My sense is that were at a point when we have enough of the infrastructure developed to really work within Cyber Command<\/a> and were not as dependent as we once were on the National Security<\/a> agency. I think the other part of this is as we move forward with the influence strategies that were talking about, we need to have a way of checking and understanding whether its working and so we need an activity that understands this space that can help Cyber Command<\/a> make adjustments along the way. So i support the split and the support where were trying to go as we move forward. As we take a look at those two elements and we put it into a larger dod and whole of government and whole of america construct, i go back to, you know, what i put in my written statement. I think from my perspective, having been through this both in uniform and doing information and Operations Campaign<\/a> planning and where we are today, we need to get the best of america into this space, right . There is a role for dhs. The fbi is very engaged. There is a role for the department of defense that goes beyond the National Guard<\/a> bureau that ties in with the Intelligence Community<\/a>. There is a role for trusted private sector partners in this space. As a matter of fact, you cant do it without them. We have to align. Miss connelly . The organizational structure gets to why we nieed a comprehensivetype 9 11 commission. It falls within the streams of Law Enforcement<\/a>, intelligence, defense, education, awareness and thats why we need to a deeper dive just as after 9 11 we restructured ourselves and we need to do that again. Thank you. Dr. Hartnett. I fully concur that we do the deep dive and i would urge us to reconsider the split of the dual hat, and i know that that is not the current view. This notion of my litmus test. Are you producing more segmentation . There is not one of the allies moving in that direction. Let me ask a question on that very quickly because one of the items was on the title 50 side and the ns aside they love to be deeply embedded and there is a real concern out there that if they active leave and were persistent that theyre constantly being seen and that interrupts their capabilities to be the intelligence gatherers that they are and how do we then allow for that constant and persistent activity if they have the same concern about theyd really rather not be seen and they simply want to be the deep ears for us. So i think having the dual hat enables that kind of determination to be made, right . The sensitivity of both when and where we will make certain tradeoffs and where that seamlessness can be intelligence. And its not working today, is it . No. I think it can, but if you look at our adversaries, why are they not worried about capability ands why are they not worried about weve had a high and right kind of focus to all of this, both in the recon phase and in the force phase that is in the space. Ill move over very quickly because he has been shorted. Always pick on the harvard guy. I think were back to different interests and the two different institutions have matured and now they have Different Missions<\/a> and different jobs to do and the current structure what you can say for it is efficient Decision Making<\/a> because its one person who makes the decision. I think its time, though, for too different and for an odd judecation to be made for which priorities are going to take precedence each time. Thank you. Senator nelson . Until we evolve into that new structure we are struck with what we have and we set up the commission teams to disrupt the troll farms and the bot nets and the hackers all engaged in attacks in our democracy read elections and we can identify them and the infrastructure they use and we can identify their plans and operations. We can do everything that we can to stop these activities, but if you dont do anything its not going to happen and until the existing structure that we have, the secretary of the defense walks into the room and says, boss, and his boss is the commander in chief, until he says, boss, weve got to act nothings going to get done. So are we describing a situation that we are defenseless in this 18 election . My sense, sir, is no. My recommendation is in the Homeland Defense<\/a> mission of the department of defense. We should stand up and move forward as we begin to move to another level which would be a National Security<\/a> task force, but in the interim, this come they has jurisdiction and the secretary has prerogatives to set up a jiativ to set up Homeland Defense<\/a> and this is a Homeland Defense<\/a> issue. Well, everybodys i think its a defend the nation issue. I think youre right. And. I think this is as clear an attack on the country as if you lobbed a missile or if you lobbed an artillery shell. Senator blumenthal wanted to ask the question, one of you had stated that its going to morph into where the attacks are going to look more american. Would you expand on that, please . Senator, that was me and its in part from some of the lessons we learned from the french president ial election. The last cyber attack which happened within the last 24 hours of the campaign. It was a combination of both hacked emails from macrons campaign as well as made up messages and it was all mixed in between. What we understand and i dont have access to classified briefings from our french colleagues that many of where it looked the source came from from u. S. Organizations and some of this is tied into adaptation where they dont want it to look like a russian bot and they dont want it to look like a russian and they wanted to originate from other sources to confuse and make attribution questionable in those last few moments. So my indue igz tells me that the more and more of these attacks will look like theyre coming from america. It will obscure attribution and then people will say this is their First Amendment<\/a> right to say these things and put forward and thats the problem. How did the french counter that . Well, very gratefully the french have a blackout period 24 hours before an election and it is a reflection period and because the french government and intelligence agencies had made very clear, repeatedly and publicly, that this was likely to happen, french media were very responsible. They could not fact check the information in time and it would not move forward and the last major attack was thwarted because both of a law and also a lot of french proactive steps to inform their public that this could happen. And that was in the last 24 hours before the French Election<\/a> . So when it happened it was the president ial Election Debate<\/a> between le pen and macron, in that debate she began to hint that there was information about potentially mr. Macrons overseas Bank Accounts<\/a> and sort of hinted at this, then about 24 hours later the document release happened, and in that suggested so one could speculate that there was some coordination, but because it hit so late it really did not have the impact, but again, responsible media, government warnings and the reflection period all prevented something that if it had happened 72 hours before it may have had a different impact on that election. Senator jill brand . You said that they had ways to prevent it from happening, is that true . The reports were about campaigns and state and local officials can take based on Field Research<\/a> about what they found was vulnerable and techniques that happened in the past and ways to shore up those defenses and its not going to be that kind of a deep dive. Have you distributed that to the 50 states . Believe so, yes. Have you gottent commen comm response back . It went back. I would like you to brief this committee on what the responses are after the outreach to different states and a copy of the report for all Committee Members<\/a> so that we have our own first draft of what our own 9 11 deep dive might ultimately look like because this has to be done and its striking to me that theres no sense of urgency by this administration. Its absolutely crazy as far as im concerned and so i want to work towards elevating this issue and your work will help us do that. Dr. Hartnett, you mentioned in your comments that bots dont have free speech rights. I couldnt agree with you more. So what kind of legislation do you think we could write or could be written to say we expect these platforms whether its facebook or twitter or instagram or any other Online Community<\/a> to not sell its technology to fake entities who are posing as real people and the reason i say that is its simple fraud as far as im concerned because youre doing it for the purpose of changing someones mind and distracting them and giving them false information and i believe it should be illegal under the same analysis that we have fraud statutes. How would you go about trying to take away those free speech rights that are given to nonentities today . Thank you, senator. So im not a lawyer, but i would build on what you just said. I think the notion of our default to fraud, right . So if, in fact, what you are trying to sell is trend, right . If that is the operative thing, that should be Human Behavior<\/a>. And so we have to think through this is very tricky, right . But legislatively we have to separate out Human Behavior<\/a> from automated behavior, right . And automated behavior can be classified as falsification of trending. You know, if you want to caps e capsulate it in that fashion. The space is not just it is not smart marketing, its manipulation and therefore should be out of bounds. Can i make one quick comment on your deep dive . Yeah. I look at one other example. The eisenhower exercises in the 1950s. President eisenhower says, what is our macro grand strategy. Set up three competing teams to come up with what the stret ji should look like. It is an interesting alternative approach, but we get at the same sort of things we look at. Like a National Competition<\/a> . They actually specify, he brought together three very specific groups of experts. They were given access to classify information but they worked as independent teams. Then they were brought together knock heads over what the best route to a grand strategy looks like. We do not have a cyber grand strategy. And we do not have a grand strategy for cyber space. I can tell you the chinese do. Theyve announced it. They are going to be the number one ai country by 2030. We need to start to think in those grand strategic terms. Senator . I will build on this. You have elements in this particular legislation which gets to, you know, what we want online plat forms to do. They can identify structure and are beginning to identify infrastructure that has origin in elements that are nefarious. So i think i would add to that as one way of kind of tackling this issue. The second point i want to disagree too strongly with my colleagues here, but i have worked in the private sector and ive worked in the Public Sector<\/a> side. I know that there are models that can work to align incentives. Enduring Security Framework<\/a> is a good example of that. We had it work before when you show a private sector and National Security<\/a> government elements working together, a threat of this magnitude, and you provide some type of limited liability protection, you can get there. It took us a long time with facebook, twitter and microsoft to get to pulling terrorists data offline. But they are doing it now. My sense is, the sooner we get into this process, with creating an alignment of not only incentives but understanding of the problem, and again it is not with everyone. It is with folks who can do things on scale and really help us as a nation. Thank you. Thank you, mr. Chairman. Thank you, senator gillibrand. First of all, thank you very much for all of the witnesses for your time. You spent an hour and a half with us today. It has been greatly appreciated. I suspect we will speak again in the future as we learn more about the challenges and threats that face our country. It is not going to get better, it is going to get worse. We all recognize that. Our challenge is to make sure we have the right longterm strategies and that they are properly implemented. As such, i think weve got a lot of work to do. With that, once again, thank you. Thank you for the participation of our members here today. And at this time, this subcommittee meeting is adjourned","publisher":{"@type":"Organization","name":"archive.org","logo":{"@type":"ImageObject","width":"800","height":"600","url":"\/\/ia903105.us.archive.org\/32\/items\/CSPAN3_20180213_193400_Election_Security\/CSPAN3_20180213_193400_Election_Security.thumbs\/CSPAN3_20180213_193400_Election_Security_000001.jpg"}},"autauthor":{"@type":"Organization"},"author":{"sameAs":"archive.org","name":"archive.org"}}],"coverageEndTime":"20240630T12:35:10+00:00"}