Challenges facing u. S. Cyber command. I would like to thank you for convening this forum. Its an honer to represent the individuals of this fine organization. Im grateful and humbled by the opportunity to lead this impressive team. Im confident you would be proud of the men and women of u. S. Cyber command if you saw their commitment to mission and hard earned successes on a daily basis as i am fortunate to do. While my written statement goes into detail, i would like to highlight the challenges we face in todays environment. And some of the initiatives the command is pursuing to meet those challenges. Over the last year, we have seen an increase of Cyberspace Operations by state and nonstate actors. We have seen a wide range of malicious cyber activities aimed against government and private sector. At u. S. Cyber command, we focus on actors that pose a threat to our National Interest through cyberspace. Nations still represent the gravest threat to security. But we continue to watch closely for signs of nonstate actors making significant improvements in their cyber cape bills. Malicious actors use cyberspace to steal intellectual property and personal information and criminals use of ran so many wear to export companies is a worry sp trend. Malicious actors have intruded in the networks ranging from the joint staffs Unclassified Networks to networks controlling inf infrastructu infrastructure. They are using cyberspace to shape potential operation ways view to limiting our options. Despite this challenging environment, u. S. Cyber command continues to make progress as emphasizes shifts to operationalizing the command and sustaining its capabilities. Over the past year, we have continued building capability and capacity of Cyber Command while operating at an increased tempo. We continue to make progress in building a Cyber Mission force of the 133 teams that will be built and fully operational by 30 september 2018. Today we have 27 teams that are operational and 6 that attained initial operational capability. Its important to note that even teams that are not fully operational are contributing to our cyberspace efforts with nearly 100 teams conducting Cyberspace Operations today. For example, the command continues to support u. S. Central commands efforts to degrade and defeat isil. Last year, we noted we had just established the joint force headquarters dod information networks. Today i can proudly report it has made Great Strides towards its goal of leading the day to day security and defense of the departments data and networks. Also as the dod expands the joint information environment, we will have significantly more confidence in the overall security and resilient of our systems. Our operations to defend d to dw networks and the nations Critical Infrastructure proceed with pay host of federal industry and international partners. Recognizing that d do is just one component of the nation cyber team, u. S. Cyber commands annual exercises, cyber flag and guard offer unmatched realism as we train with federal, state industry and international partners. Additional, Cyber Mission teams are regular participants in the exercises of all the combatant commands. We need to persist in a training environment when the department is continuing to develop to gain skills and to sustain readiness across our force. Im excited by the innovation, shift and focus on Long Term Strategy thats emerging in the command and dod. We established a Partnership Program in Silicon Valley to link command personnel to some of the most innovative minds. A program is aligned and colocated with the departments Defense Innovation unit oec experimental. We are building on the synergy among all elements. Last september, the department identified the need to transform dods Cyber Security culture by improving individual per to form answer and acount built. The second and chairman approved the dod Cyber Security culture and Compliance Initiative to address those concerns. Cyber command was identified as the mission lead for this initiative and is working closely with the joint staff and osd to build a requisite capacity and structure. Cyber command is also actively contributing to the implementation of the new d do Cyber Strategy. The strategy released in april of 2015 provides a detailed plan to guide the development of dod cyber forces and strength dod Cyber Defense and cyber det deterrence posture. The purvervasive nature of cyberspace through all is he fa sets of alive and across boundaries coupled with a growing cyber threat makes deterrence in cyberspace a challenge. But ever more important. A proactive strategy is requires that offers options to the president and secretary of defense to include integrated Cyberspace Operations to deterred aver varies from action and to control escalation. To help with all of this, we requested and received enhanced acquisition and manpower authority. I thank congress and the president for the awizations granted and the physical year 16. This represents a significant augmentation of our ability to provide capabilities to our Cyber Mission teams as well as our ability to attract and retain a Skilled Cyber work force. We are currently studying how to best implement the provisions and laying the groundwork needed to put them into affect while in parallel involving a formalized singization framework. We that, thank you for convening this forum and inviting me to speak. Thank you. General dempsey was asked about our ability to address challenges to this country. He basically he stated that we have significant advantages in every major challenge except one, and that was cyber. Do you agree with general dempsey comment about a year ago . I do. The phrase i use internally with him is cyber is one area we have to acknowledge that we appear competitors who have every bit as much capacity and capability as we do. That i would say to my fellow members of the committee emphasizes our need to address this issue in a comprehensive fashion. So after we finish the defense bill, i would i will spend a great this committee will spend a great deal of its time on this issue since the threat is as admiral rogers stated. You stated last year in the house hearing, there is uncertainty about how we would characterize what is offensive and what is authorized. Again, that boils down ultimately to a policy decision and to date we have tended to do that on a case by case basis. In other words, do we if we respond, how do we respond . All of those it seems to me, our policy decisions have not been made. Is that correct . I guess, chairman, the way i would describe it is we clearly still are focused more on an event by event particular circumstance. And i think in the long run, were clearly we all want to try to get to is something much more broadly defined and well understood. So that you understand, when you detect an attack or as the or detect a probable attack, so right now you are acting on a case by case basis . Sure. Does russia have the capability to inflict serious harm to our Critical Infrastructure . Yes. Does china have the same capability . Some measure of the same capability, yes. How is chinas behavior evolves since the opm breach . We continue to see them engage in activity directed against u. S. Companies. The question we need to ask is, is that activity then in turn shared with the Chinese Private industry . We acknowledge states engage in the use of cyber as a tool to gain access and knowledge. The question or issue we have always had with the chinese is while we understand we do that formations to generate insight, using that to generate economic advantage is not something thats acceptable to the u. S. Do you agree that the lack of deterrence or repercussions for malicious cyber behavior emboldens those seeking to exploit the u. S. Through cyber . Yes. Eadmiral, we are looking at consolidation of command here as far as your responsibilities are concerned. I believe that the secretary of defense will also support such a move. So i will be recommending that the committee that we include that consolidation in the Defense Authorization bill as we mark up. I think my friend senator reed also agrees with that. Would you agree that probably the issue of cyber warfare is the least understood by all of our leadership, including in government executive and legislative branch . Its certainly among the least understood. I think thats a fair is part of this problem is that this challenge is rapidly evolving . I think thats clearly an aspect of it. The speed and the rate of change as well as the complexity. It can be intimidating. I would be the first to acknowledge that many people find this a very intimidating mission area. If you had a recommendation for this committee and congress as to your significant two or three priorities, what would you recommend . In terms of cyber overall . Action that you would like to see the congress and the executive branch take. I think we clearly need to focus on ensuring that we have got our defensive house in order and that were able to defend our systems as well as our networks. We need to think beyond networks into individual which means policy. Please, go ahead. Secondly, we need to continue to generate the complete spectrum of capabilities to provide options for our policy makers as well as our operational commanders. So when we have these issues, we have a series of capabilities that we can say, here is capabilities that we can choose from. And then lastly, i think we have just got to the other point i try to make is, weve got to figure out how to bridge across not just the dod but the entire u. S. Government with the private sector about how were going to look at this problem in an integrated national way. Would you also agree that sequestration could threaten you with a hollow force after you have recruited and some of the brightest minds in america to help you . Very much so. I would highlight in fy13, i can remember going i was in a different job at the time. But still i was doing leading the navy cyber effort. As much of my work force explained to me why we should stay with you if this is what were going to have to deal with on a periodic basis, being told were furloughed, were not going to get paid. I can remember telling them in 13, please stay with us. I hope this is a onetime thing. Sequestration means further hamper further because everything is our ability to meet time lines we have been given have been predicated on sustaining of this. I will not be capable of generating that capability in the timely way that right now were on the hook to do. Senator reed. Thank you, mr. Chairman. One of the issues that has been discussed and mentioned in my Opening Statement is raising Cyber Command to a full unifies command. And yet i also noted and you acknowledge that only half the Cyber Command newly formed Cyber Mission is initially capable to ioc. And then some critical elements such as training environment, uniform platform doesnt exist. Are you in your mind mature enough to be a full uniformed command now . Yes. And what would that advantage give you . Or what would that decision give you . Whethn we think what tend to drive should something be elevated . Across the department, we tnd to focus on the impairties of of command and unity of effort and in it would be fungal not geographic. In this case, does the function rise to a global level and is it of sufficient priority to merit coordination across the entire department. The other issue i would argue is one of speed. All of those argue again, i just am one input. I realize this is a broader decision than just admiral rogers. Theres many opinions that will be factored in. My input to the process has been a commander designation would allow us to be fast he which would generate better mission outcome. The departments processes of budget prioritization, strategy, policy are all generally structured to enable direct Combatant Commander into the process. Thats what they are optimized for. I believe cyber needs to be a part of that direct process. The other aspect, obviously, is the relationship with nsa. There are several options. One is to have separate command. Or one option or additional option is to at least at a future time have the option to divide the dual hat arrangement. Can you comment on that . So, my recommendation has been for right now you need to leave them dual hatted. Part of that is the premise that we built Cyber Command on, we created it six years ago, where we said to ourselves, were going to maximize the investments that the nation had made in nsa in terms of infrastructure and capability. So because of that, we didnt have a huge military construction program, for example, for Cyber Command and put the forces, the 6,200 in different structures. We said we were going to take nsas existing spaces to do that. So my input has been for right now, based on the very model we created Cyber Command, where we really in many ways very tightly aligned these two organizations, that at the occcurrent time impossible. It would be difficult or less than optimal in my opinion to try to separate them now. But what i have also argued is we need to continue to assess that decision over time. You need to make it a conditions based assessment as to at some point in the future does it make more sense to do that. Part of that is the fact that if you are a unified command, you will be developing alternatives to nsa capabilities. Yes. Exclusive to Cyber Command so that at some point you could have an infrastructure that looks like nsa and the synergies you are talking about now operational. Yes, sir. One of the issues is that you depend upon the services to provide you a great deal of resources. In fact, its really i think interesting to note that only half of these identified units are released initially capable. And that there doesnt seem to be an intense training effort thats standardize and in place right now. What can you do what can we do to accelerate these units in terms of their maturity and their training environment . So if i could, senator, im going to respectfully disagree. Thats quite all right. You have to be respectful. Remember, we started this build process in fiscal year 13. We said we would finish it by the end of fiscal year 18. Ready to fight in a high demand environment. Were pretty much on track, as i have said publically. If you look right now in fact in the last two months, i have managed to increase timeliness since the last assessment i did in february where i publically had said based on the data as of the first of february, i believe that we will meet ioc for 91 of the teams on time and that we will meet foc for 93 of the teams on time in the two months since then were up i managed to work with the services and for ioc were up to 95 of the force. For foc were at about 93 of the force. So my only point is, im not critical of the services in terms of their generating the force. I think they are making a very good effort and its on track. Its not perfect but its on track. They have also been very willing when i have said what we need do is ensure that we have one integrated joint capability how we work cyber. There has to be one structure, one training standard. Every service agreed to adhere to that. In that recogard, im comfortab. What i think the challenge for us as i look over the next few years is we initially focus on those Mission Teams and the men and women and their training. What experience is teaching is not unlike other domains is as you both chair and Ranking Member said in your Opening Statements, thats not enough. So what finding now is its the other things that really help enable that we have to focus more on. Thank you. Thank you, mr. Chairman. Thank you, mr. Chairman. Admiral rogers, in december of last year you published an article saying a challenge for the military cyber work force. And you discussed as did you in your written Statement Today that the importance of growing and developing and maintaining this force. When you talked about it i guess it was the chairman in his statement, the 123 teams, where you are right now and aiming to 133, what comprises a cyber team . They come in several different types. Theres what we call combat and command Mission Teams. Those are aliligned with commanders. They are designed to create offensive capability, if you will. There are Cyber Protection those are about that team ccmt teams, they are about 65 individuals on a team. If you look at Cyber Protection teams, slightly different mission. So different structure, different focus. They are at about 39 individuals per team. Each of those two teams has a small subset of 23 individuals on what we call support teams. That just gives you a sense. Sure. When you add all that together, thats when you come up with the 6,187. Yes, sir. As was brought out in the chairmans statement, you would really have to know first of all, you are drawing from institutions that are training these people. This is new. This is brandnew to a lot of people, including a lot of people at this table. I know that in my state of oklahoma, the university of tulsa has really made great progress in fact your predecessor was out there and working with them. I understand from senator rounds, similar things happening in south dakota. You have these kids out there. They are learning this. They are choosing they are determining what they will do for a career. I think its a good question whether you say when we ask the question, can we depend on sustaining in this environment that were in this these teams, this number, this work force so that individuals out there would be aiming their talents toward helping us . Because theres going to be a lot of competition for these kids. How confident are you that were going to be able to maintain the level necessary to attract good people . So experience to date says were doing a good job in that regard. Both of our ability to recruit and retain. What drives that our experience suggests is the desire of men and women, whether civilian or in uniform, to be part of something bigger than themselves. To do something that matters and do something on the cutting edge. That is really what powers the men and women of the teams. Im always talking to the my f fellow indicators, what should we look at that will tell us that trend is changing . There are skill sets within the force that i mention separately that i may in fact come back to the committee with to say, look, there may be some that would be a good thing to do, come back. Im running out of time. I agree with you whether you say that the states that we watch most closely remain russia, china, iran and north korea. At the same time, i notice that there is an effort this came when our fbi director james comey was in contact with these people that they were china is trying to develop a closer relationship with us when, in fact, theyre the ones that were going to be watching. You are not entertaining any kind of a close relationship with them that might impair that . No, sir. Okay. Good. Yesterday in the an article came out that says the pentagon doesnt know who is in charge for responding to a massive seib area tack. They go on to talk about the northern command. They talk about what we are doing. They are talking about Homeland Security. You are familiar with this report that came out yesterday . No, im not. Im familiar with the broad premise. Okay. The conclusion of the report i will read this. It says, we believe that by issuing or updating guidance that clarifies roles and responsibilities of relevant dod officials, dod will be in a better position to plan for and support civil authorities in a cyber incident. This is a goa report. I suggest that you look at that and see if we have reached their conclusion so far. Thank you, mr. Chairman. Thank you, mr. Chairman. Thank you, admiral for being here and the work you do. Irpree i appreciate it very much. We face terrorist threats and all the underlying. Nearly every briefing about our National Security i have asked about the issues of Cyber Security. And protecting our power grids. Its a very important issue to me and the power that our state produces for this country. In the shortterm, which cyber threat is most dangerous to the United States . I guess in our grid, our food supply, our water supply . What is most vulnerable that we should be working on . Power and basic infrastructure is something that always concerns me because the potential impact on the nation is very significant should we have significant issues there. I would also argue one sector that i worry about a little bit is, you look at the amount of personally identifiable information that is out there in a lot of areas. Healthcare is a good example where the amount of data that we have all provided to the medical world that is available out there on all of us and our families, that worries me about thats reflected you look at opm, look at the Anthem Health insurance, large data concentrations are now increasingly become an attractive target. Because of big data analytics, massive amount of data that we said no one could comb through that to generate insights or find anything, its too long, you sure dont have those conversations anymore. We talk about cyber, we keep talking about basically our corporate hacking, if you will. For proprietary reasons. Look at the military hacking that goes on for our defense reasons. Then you look at just everyday life that we have come to expect that could be probably disrupted with quite an alarming yes, sir. Alarming concerns. The other thing in your testimony you mentioned the reserve forces are being assigned to all levels of u. S. Cyber command. And Cyber Mission forces. Can you elaborate on the National Guard, what they bring to the table for the Cyber Mission . Well, you are able through our guard and reserve teammates, you are able to access a set of manpower that potentially is using these same skill sets in their day to day work in the private sector. You are able to also access at times a very different perspective which works out very well, which is one reason why as we were creating this, we were adamant from the beginning it needed to be viewed as a total force. That if we were just going to make this an active only component, that was not going to optimize the full range of capabilities that are out there. So you have seen in the last six months in particular the guard and reserve capability starting to come online and flesh out as well. The thing that im saying is i have the National Guard in west virginia, we dont have a base. Our guard is everything to us. Being a former governor, i understand the importance of our guard. We have been so active is basically an aggressive recruiting and some of our best and brightest and young empeoes coming into the guard for opportunities, especially educational. They can pinpoint for to you bring in some of the really sharp young talents that could help us in defending ourself cyber. This is the guard is doing now. Okay. I spend a lot of time talking about lou do we do this in an integrated way. Again the other thing in your fem ytestimony you say sas is focused on propaganda. You can elaborate on this and how they have been successful. They have harnessed the power of the information arena to promulgate their ideology on a global basis. To recruit on a global basis. To generate revenue and to move money as well as coordinate some level of activity on a large basis. The challenge i look for or that concerns me when i look at the future is what happens if the nonstate actor, isil being one example, views cyber as a Weapon System . That would really be a troubling development. In a very simplistic way, people ask why cant we shut down that part of the internet . Why cant we interrupt isis ability to go on social media and attract . Why are we not able to infiltrate that more . I mean, i would the idea that you just are going to shut down the internet given its construction and complexity is just not ive had people ask me, cant you stop that area of world where the problems are coming from, whether it be in syria or in parts of iraq or iran. Things that we might have some input and control over. Its not possible . Its just not that simple. I wish i could say theres a pafrt i object part of the internet used by a specific set of users. Im trying to find an answer. That question is asked quite a bit. Shut her down, turn off your telephone, but it doesnt work that way. Thank you for your service. Thank you for your service. You are i believe the right person at a very challenging time. You are in the middle of some decisions that have to be made by the United States as sooner rather than later. Our Congress Passed carl levin was chairman then. They evaluate vulnerability of our systems and to issue a report to how to defend those. That time passed. But we have issued another legislation last year that said the secretary of defense shall in accordance with the plan complete an evaluation of the cyber vulnerabilities of each major weapons system of the department of defense not later than december 31, 2019. So we have given an additional date there. But not later than 180 days after the date of of this enactment which i would believe would be play this year. The department the secretary of defense shall submit to the congressional defense committees the plan of the secretary for the evaluation of major Weapon Systems, including an identification of im system to be evaluated an estimate of the funding requires and priority among the evaluations. Are you familiar with that . Are we on track to is the Defense Department on track to complete that initial report . I am familiar with it. Im sorry i am not in the weapon acquisition business. So im not the best informed as to the current status. I know the effort is ongoing because u. S. Cyber command is part of that. If i could take that one for the record. I apologize. If you would. This has been going on some time. On a bipartisan basis, congress recognized several years ago that our Weapon Systems it started out for space, missiles and antimissile systems being evaluated. Then we realized, large segments of our defense capability are vulnerable. We have had a broader report. I believe it is important for the secretary to complete this on time if not sooner. I would hope that would you look at that. In light of chairman mccains questions and senator inhofes questions, i would refer to this goa report that just came out. The first line of this article is, quote, the pentagon does not have a clear chain of command for responding to massive cyberattack on domestic targets in the United States according to the federal governments principal watchdog goa. Does that concern you . First of all, i havent read the report. So im not informed as to its specifics. I mean, i would argue, im always concerned about a clear chain of command and clear articulation of responsibilities. It lists a number of things that appear to be unclear in how we respond. The chairman asked you when do we arent we going to need to develop a policy for how to respond to attacks and what we might do in response and how to ratchet up responses relevant to the threats we face. I hope that you would look at that. With regard to worldwide situation as commercial and economic as private companies that are a big part of the entire network of cyber worldwide, many of those impact our allies, other friends and many of those could Many Companies could be based in countries that are not friendly to us. And would like to penetrate our systems. Are you concerned that all of our allies, asia, europe need to be aware of this danger . And are we working to make sure that segments of those systems arent purchased or impacted by entities that could be hostile to our joint interests . I share your concern about supply chain vulnerability. Thats a good word, supply chain vulnerability. And it is growing in probability, if you will. Given the nature of the economic world were living in now. We have a process within the u. S. Government to address these issues for major purchases, companies, National Security priorities. We have a specific process in place for some components of dod infrastructure like the nuclear world, for example. If you look at its proliferation of the issue generally across both our allies and ourselves, this is an issue thats going to get tougher. Could go on for decades. Do we need to meet with our allies to develop a unified policy to protect our joint systems . It is a discussion we have with our allies. Its much as you said, this goes across the commercial sector, dod, government at large. Its out there for all of us. Well, i thank you for your leadership. It will be a lot of challenges like that in the months to come. You are at the focal point of a critical issue. I lhope you will not hesitate t lead and tell us what we need to do to help you. Roger that. Thank you, mr. Chairman. Admiral rogers, i need some clarification of what your responsibilities are in Cyber Command. Are you responsible for protecting this country from cyberattacks on private networks and corporations or is it simply government . Dod lahas a responsibilitieso defend against events of significant cyber consequence. For example, if may we had three Urgent Care Centers that were hacked. We had main general health, one of our healthcare. They were hacked is that part whats the defendant anythiinit Critical Infrastructure . There are 16 seg toctors. The second component of the definition i gave you is not just the sector that was attacked, so to speak. But also the magnitude of the event. Dod, we use the phrase significant cyber consequence. The concern being that the department of defense is not resources nor is it tasked with defending every single computer structure within the United States. So we try to identify where can our finite resources be best applied . So they are focused on the 16 segments designated to the nations infrastructure. Then tripped in those circumstances in which the actions against one of those 16 segments reaches significant cyber consequence. In i mean were being hacked every day in insurance companies, businesses, some of it is Cyber Espionage but some a criminal. We need to think who is responsible. I understand you dont call out the army, if there is a criminal in one town. You have local police, but there is a gap here. Do you see what im saying . Yes, sir. There is a gap in our defense because we really dont have the infrastructure of the state police or local police that would protect local interests when they are being attacked and you have the expertise. We have to work out something as between Cyber Command and local Law Enforcement, if you will, to protect us from these repeated and continuous and escalating attacks. Although, if i could, just to think more broadly, i think the challenge is how do we harness the capacity and capability thats resident in the government structure, contained with the capabilities that are resident in the private sector . Its much bigger than just, dont get me wrong, were definitely part of this but i urge people we got to think much more broadly i think thats a good way to articulate it. Dont we keep talking in these hearing, when will we have a well developed and articulated strategy and i emphasize the word articulate. Its not detour rans but we need definition what is an act of war, what is a mutually assured destruction situation. This seems to me is this in the works and if so, when . Sir, i dont have a date for you. Thats well beyond the missions of u. S. Cyber command. Im part of the discussions. Im the first to acknowledge that. I try to provide an input and be one voice what i think is the direction broadly we need to go. I apologize senator, i dont have the specific date or timeline for you. Seems as a matter of policy, we really need this needs to p haen. Weve been talking about this long, we arent there yet and yet, something terrible is going to happen and a lot of people are going to say why didnt we have a policy, deterrent policy. I would urge counsels of the administration to push for a sense of urgency on this question because if we if all we do is defense and there is no deterren deterrence, well lose the battle. Yes, sir, a losing strategy. Final point and i know you talked about this earlier. Im finding it harder and harder to justify your holding two jobs given the complexity i mean, this arrangement was created in 2009 which in Technology Terms is a century ago and i just cant i mean, i understand the relationship between nsa and Cyber Command but particularly if we move in the direction, which i think we are of setting up Cyber Command as its own independent command to have the same person trying to run those two agencies, i just think is impractical and impossible. Ive been doing it ten years to date. Youve been doing it well. As ive said in my initial comment, i agree that its something we need to continue to assess. I agree in the long run the probably best course of action is to ultimately put both organizations in a position of capable of executing commission in a complementary and aligned way than in a more separate way but the reality is were just not ready to do that today, i believe. Dont get me wrong. I get paid to make things happen and i will execute it to the best of my ability. I take it you agree we should move Cyber Command should be its own command. I do, sir. Yes, sir, thank you. Thank you, mr. Chair. Subject to the will of the entire committee that would be my intention and i want to read and i would propose that on the Defense Authorization bill. I think so, sir. I think thats something well consider but i think its value with the comments today and to consider them as we go forward. Thank you, senator fisher. Thank you, mr. Chairman, i look forward to the discussion on raising cyber to combat and command and look forward to the discussions as a committee on the importance of cybersecurity for the country. Rogers, in your prepared statement you mention the cyber attack on ukraines power grid and note youve seen cyber actors from more than one nation exploring the networks of our nations critical inf infrastructure. Do you believe our teams possess the necessary skills relating to controls and systems to be able to stop or to recover from an attack on our power grid . We have the skills. The challenge at the moment is one of capacity. What i mean by that is in the two years ive been in command, ive yet to run into a situation where we didnt have the skill set to apply against a problem but the challenge at the moment because were still in the midst of the bill is sometimes that skill set is embodied in an incredibly small number of people and if we had multiple events sign tame tan usely, sna chalk today so to speak capacity is the greater concern than capability, if you will, if that makes sense. Well, i understand your demands on the force to exceed that capacity but as you add those capabilities, how are you going to prioritize and responsibilities youre going to have . How do you plan to prioritize placing that building competency with our Industrial Control System . Is that something you focus on in the near term or is it going to take a backseat to maybe some of the other areas for the Cyber Mission forces. Something were doing now. I would also highlight the very construct of the force by creating a separate section of the force that is focused purely on defending Critical Infrastructure was designed for that. How do you ensure an element of the force were building is focused like a laser on the mission set . Its a carved out separate entity. The National Mission force. The general is my Component Commander doing that. Do you have a plan to work with services then on building that yes, maam. Is it near completion . You hear said ton king ask about policy. Weve been asking about policy for a long time. We dont have a policy. If we dont have a policy, how will we develop plans . I remind people is look, even as were trying to get to broader issues youve raised outside the Immediate Mission, look, our mission is generate capacity and capability and ensure were ready to go as the broader issues are being addressed. So were trying to deal with the piece by generating capabilities we think would be part of the discussion by generating the defensive capabilities we think would be part of the deterrent discussion. I dont want to wait for everything to fall in place. We cant wait as perfect as it would be. I agree with you, we dont have time. Yes, maam. When we look at the department, what level of communication do we have with the different communities within the departments, say the with regard to acquisition of instillation to make sure the items we purchased or facilities that were building are able to take those threats were looking at from cyber into account . I would tell you the acquisition piece is an area we need a lot of work not because people arent working hard but ive been struck by the analogy, we would never buy a ship, tank, aircraft without the operational vision driving how we designed it, built it, structured it skpl yet for much of our networks, that has not historically been the model. We built those and bought those and focus on efficiency and price and really focus on Operational Impact and really didnt think at the time that we would be dealing with a world in which intruders, foreign actors would be using those systems as Access Points to degrade our missions as a department. We didnt anticipate that decades ago and thats the world were in now. Its happened in private industry. Right, decades of investment were trying to overcome. Last question, do you have any knowledge if our adversaries targeted any infrastructure on the military bases . Yes. Thank you very much. Yes, maam. Thanks, mr. Chairman and thank you admiral rogers for your extraordinary and distinguished service in so many rolls over so many years. I want to focus on the challenges of recruiting young people in an age where the best and the brightest have knowledge have so many opportunities, many highly paid and challenging in the professional issues. Young americans are entering the work force with Computer Technology thats been part of the entire lives not so much for us as a certain age but for them yes but i wonder if you can tell us how successful you and obviously the incomperbly important forces have been in obtaining talent and what we can do to help. Im very comfortable where where we are on the uniform s e side. The same things that make a person decide to pick up a rifle leads men and women to decide they want to put on a uniform and pick up a keyboard. Thats not the biggest challenge. The area we need to take a greater look at is on the civilian side of this because we got our vision is we got to create a work force that is both active and reserve military. So we get the breathe of expertise that youve referenced. Where i need to come back to the committee, can i come up with some different processes or options that would make things more attractive to particularly some very highend, very small number of skill sets that i dont have huge numbers of but incredibly valuable for us, thats one area i think ill have to come back. We need to step back and take a look at the piece of it. Is there sufficient, are there sufficient resources devoted to research, the personnel available to super vice the research and in effect planning for the future. Right. Im not going to pretend for one minute you have people and money that you would like. Its i would argue characterize it as reasonable right now. Its not a major issue in the sense i said wow, we have a significant sensibility to execute. I havent seen that. I know you indicated you havent read it. Right, right. But i wonder focussing on the infrastructure segment you mentioned, transportation, financial, electric, how well are they doing in protecting themselve themselves . If you look across the 16 segments designated as Critical Infrastructure, i would argue some are ahead of others i probably put financial has access to more than some and come to the conclusion that the ability to move funds through these transactions, if you will that we believe and trust and in their defense, they are quick to remind me our Business Model is different. Were regulated for example in order to generate and increase our Cyber Defense and capabilities. The only way for us to do that is raise rates for example. Most consumers not enthusiastic about that. Most regulatory bodies not necessarily overly enthusiastic about that at the moment. Those would be electricity. Power is an example. There is improvement that you would put at the bottom of that list of readiness . There are some i think ive publicly previously talked about health care is one of the examples of the 16 segments i look at and i go, thats an area probably that needs a broader top to bottom look on the first to acknowledge, really outside our Immediate Mission and i dont bore into it every day. As i look where potentially well be tasked to provide our capabilities to partner with, an area i would Pay Attention to. Thank you very much. Thank you, mr. Chairman. Thank you, mr. Chairman. Admiral rogers, thank you for your service. I find it interesting that as you work your way through this, youre in a brandnew area trying to determine how to respond and protect. It seems when you lay this out and say you have 16 different segments within the realm that youre responding to, fair to say that they break out into either information or data systems and operating systems . In terms of the way that we look at what the data is or the different systems that were looking at as being vulnerable, a data system being the collection of information and individuals and operating systems being those systems perhaps necessary for the infrastructure within our country . A fairway to break out, i guess, thats fair to be honest, senator. I never thought of it that way. Not that thats a bad way. The reason i would ask, it seems while Information Systems would contain material or information a private nature, perhaps, a trade secret that may very well be information on an individual such as the information we lost to the federal level and have on operating system for the utilities and operating systems out there for dams and operating systems for Nuclear Power plants. Clearly they can do significant damage and bodily injury, as well. Fair enough to look at it. Based upon that, when you look at your role and the role of Cyber Command do you see your role operation different than data and collection systems . Our protection scheme is based on two different pieces of strategy. The first component of the strategy is our intent is to go into foreign space to stop the attack before it ever reaches those systems. The second component of the strategy is to apply defensive capability working directly with each of the individual elements if you will to say if that fails, we also would like to work to show up the systems. The other point i want to make sure i articulate and probably should have done a better job this morning is as a reminder, u. S. Cyber command and dod at large provide our Cyber Capabilities and defensive Critical Infrastructure in the private sector in partnership and in support of dhs. Dhs has overall responsibility in the federal government for the provision of Government Support to the private sector when it comes to cyber. I dont want people thinking well, its just Cyber Command and the private sector. There is a broader set of players we integrate with and support as we execute the mission. An attack in either case would be, we dont know whether or not well be able to do it in time and respond afterwards. Would you say we have operation systems, Information Systems we have, do you feel the protocols are there . Im going back to what senator king was eluding to earlier. Im not sure we have the definitions prepared yet to allow you to respond immediately within mill la seconds unless we talk about it and lay it out. Is it there today . In every single component in the private sector, no its not. Cyber is no different than other domains in the sense that the importance of intelligence to provide us insight gives us the knowledge and insight, the warning, if you will to anticipate and act the event. True for the sitcom commander as me. Warning continues to be critical for both of us. Today if our forces were aware of an attack, they have the ability to respond but if it was property or entities within the United States, do you have the ability to respond today if it is not a military but a civilian or a civil target . Is there a process . Yes. Is it something i can do automatically instantaneously, no. Thats the case it has to happen first then because for all practical purposes, the attack will be instantaneous. We have to get the warning in advance. The importance of intelligence. If you get the warning in advance, it would have to be enough time for you to get out and have a political discussion for all practical purses whether or not you can again, it would depend by the scenario. There are some elements with mechanisms in place and its just a process as opposed to a broad not one that can be done in mila seconds . No. Thank you, mr. Chairman. Thank you for being here. Senator. Let me start with your acquisition personnel. Some of the saddest stories of waste within government and a lot of that had to do with knowing when you need to buy and when legacy systems need to be scrapped and how nimble can you be off the shelf . Im not sure the military with that flexibility to move with the technology. I think these acquisition personnel are important so do you have the ten in place that are suppose that we authorized in order for you to make the wisest acquisition decisions possible in light of a history littered with serious mistakes and lots and billions and billions of dollars wasted . I operate and defend. I dont buy. You have been kind enough, the committee and congress has been kind enough to provide an initial capability to do us. Were in the process of hiring. Im very mindful of as i remind the team it is about generating outcomes, guys. Thats why were granted this authority and need to be mindful of and not interested in spending money for the sake of spending money. Its about generating capabilities that impact the mission in a material way. I would be interested in how you are requiring with more detail, if you would provide, how you are finding the acquisition personnel and how competitive are we in finding the right acquisition personnel. If we have the capabilities in the space a lot of it is people being trained but a lot of it is under lined yes, maam. You have to buy the right capabilities. So i just im really worried about getting the right people making those decision sos so i would like to stay updated in the progress. What kind of coordination does your command have at this point with our nato allies, israel, arab allies and particularly interested in any coordination and cooperation you have with nga. Im not going to publicly obviously. Classified forum go into specifics. I would only tell you we partner with and have a hand full of nations and have a very direct, real relationship with respect to capabilities, real world operations. I wont go into the specifics of who. One of the challenges i find is cyber like any other mission, we have to prioritize. When i look at foreign partnerships, i ask where is the greatest return for us as a department, as a dod and where is the greatest return for us in terms of ability to execute the mission. I spent almost as much time with the discussion with the team about what were not going to do as i discuss what we are going to do and remind them since were in the midst of build thing capability out, prioritpr. We identified a set of partners if you will. These partnerships are generating capability were using today. Great. And maybe in a classified setting i could get more information. Yes, maam. What is the ratio of civilian versus military within the command at this point . Its about were trying to build 80 military, 20 civilian. At a snapshot, off the top of my head 70 30, 70 military, 30 civilian. What about contractors . Is the ratio on contractors and what is your goal on contractors . This could be an area and underlying that is a concern about the actual screening of contractors. What is your goal and to go forward . I apologize, im trying to do the mat in my head. Its probably 25 . We have over and above the government civilian and military, we have an additional 25 off the top of my head, an additional 25 of the contractor base. Is that where you would like to be Going Forward or see more relying on contractors im a little leery of over becoming reliant on contractors, why . Because i try to remind people, cyber is a domain to conduct a wide range of military operations and in accordance with the law, those operations need to be conducted by military personnel so im not trying to minimize the role of contractors, i just try to remind the team its not one size fits all. We have to ask ourselves whats the right allocation . Im pretty comfortable right now. I wouldnt argue its among my highest priorities. Id argue now probably priority number one manpowerwise i said the civilian piece. Im very comfortable with tracking and going the right way in the uniform piece. The civilian area is where i know ill be paying more attention to in the coming year. Thank you, admiral. Yes, maam. Threats nation state wise in terms of who were most threatened by . I would argue russia and probably in terms if you look at capability, the other four that we have pub welcolicly acknowle china, iran, north korea and nonstate actors, the other category where i look that could be a game changer were dynamics to change. On the terrorism side, could you give us the top couple of terrorist organizations youre worried about . Not that i dont know in an unclassified forum. We dont end. On the criminal side, what areas of criminality do you worry most about . Countries . Russia probably has the most active criminal element with the most with the greatest capability. Do you think the russian government is doing anything constructive in terms of regulating criminal activity in cyber . I would only say it doesnt appear to be getting much better. What about iran . Is iran better in the last year in terms of their cyber activity . Yes. Are they less threatening . I apologize are they less threatening or more capable . Id argue they are increasing their investment and increasing their level of capability. We have not seen the same level of activity from them that we have seen historically in the past. I have seen some of that same activity directed at other nations around the world. Are they improving capability . Yes, sir. Do you know if the money they are getting is going into the cyber upgrades . I dont know for a fact. Okay. Is it fair for the country to establish as a policy cyber dominance over enemies that we want to be the dominance of the warfa warfa warfare . We want to have the same capability. I think thats the goal. So lets march down that path. The navy is pretty wide . Yes, sir. And the cyber arena, how close is it. So the gap of tdominance in seas and cyber is not nearly. Not nearly the same. When it comes to iran when you compare the air force to our air force, whats the gap . Are the iranians trying to close it . They are. For a nato point of view, were familiar with article five in attack against one is attack against all. Is there any such concept in the cyber arena. You believe article five applies to all domains. Do they. Were trying to work our way through that. I dont know whats the biggest impediment to us getting there . Is it the congress . Is it the no. Its as much in someways as my perspective this is just an exercise. This is something we can afford the defendant of Homeland Security is responsible for protecting us and the Financial Service power arena or civilian targets. Youre responsible for protecting the military infrastructure. And provide support to the commercial infratastructure. But offense. They are not going to attack a foreign nation, you would. Yes, sir. So how can we as a nation given the threats that we face in the cyber arena not really have a good answer as to whats the im ped mmpediment to rule engagement. Sorry, sir, you really need to speak to the policy side. Yeah, but youre an operator. Yes, sir. Who do you talk to about hey, guys, lets see if we can get there. The secretary of defense or office of secretary of defense. How do they respond . Intellectually, we realize we need to do. Is there Anything Congress is not doing that you would like us to do to help resolve this issue. No, i cant argue its Something Congress failed to do. Thank you mr. Chairman, admiral, i know that you talked a little about cyber teams in response to earlier questions and i think the idea to leverage our outstanding National Guard and capabilities and capacity and establishing many of the cyber teams is a good idea. As you and your colleagues and as you look at the region, i ask that you look closely at the knees of the asia pacific. In hawaii we have nsa hawaii, various Component Commands and other Agency Regional officers that are, offices that are likely targets for cyber criminals as we focus on the reboundsf the pacific. I wanted to get to a question. Last september the u. S. And china did agree that neither government would support or conduct cyber theft of intell t intellectual property. Six months down the road, would you say china is living up to this agreement . I dont know how specific the agreement was, frankly. Seems like a good idea for the two countries to enter into that kind of dialogue and discussion but really, what is happening with regard to that agreement . If i could, what the agreement said is neither nation would gauge in that activity for the purpose of gaining economic advantage for their private sector. We continue to see chinese activity in the regard. The Million Dollar question is is that activity for governmental purposes or passed from the government to the private sector from my mind, the jury is still out in that regard. Its activity level is somewhat lower than prior to september of 2015. Is there any way that we can determine whether china is engaging in such activity. Are there any parameters . Is there anything we measure to determine whether this agreement is being adhered to . Yes, maam. In an unclassified forum, i wont get into specifics how we go about doing that but yes, ma maam. Maybe in another context we can get to some of the questions. With regard to our ability to support a our cyber capability, Stem Education is critical, can you talk more about what you are do doing to train a work force for us. Lets take hawaii for example. Today for example the general for the guard in hawaii is meeting in the complex with the Cyber Command and elements across the island to look at and include academic sector, how do we generate and more capable work force to meet guard requirements and command and nsa and other elements. How can we partner more effectively in aligning the capability to deal with issues of common interest on the state of hawaii and more broadly. You see that same hawaii is an area where we probably have gone further than others but we can see that same type of activity with a hand full of universities across the United States from the west coast, something on the order of 60 to 100 between nsa and Cyber Command tend to partner together a lot. Obviously that needs to continue because our cyber capability is something that will be an on going effort. You mentioned the importance of the private sector and outside of government approach to cyber needs. How do you envision the private sectors role . The private sector brings technical invasion, Broad Knowledge of capabilities and alternative ways to look at problems. Those are three things when i look at the private sector, i say you can really add value for us in that regard. What we have done to date is created what we call the point of partnership in Silicon Valley where i placed a small element on the ground. The part thats interesting to me is i did not want reserves working in their day to day jobs. We started that since last summer thats working out well for us and gives us a chance to get a sense for what technical invasion is going on out there. We approach them with different problem sets and say hey, here is an issue were still trying to work our way through. How are you handling this or would you give us some suggestions on how we might deal with it . Im trying to see if we can replicate the model. Im looking at the east coast next as an example, somewhere probably in the Greater Boston metro area next. Sounds like more of an informal arrangement now and maybe Going Forward ins institutionalize it. Yes, maam. Thank you. Admiral rogers, i dont envy you with the job you have, the complexity and then the additional challenges, things on the horizon you have to worry about and list ping to the discussion, one thing thats very important well never have the perfect weapon. Absent the United States coming up with a Game Changing offensive or defensive capability of the scale of the manhattan project, you cant possibly get inside the decision cycles of the state actors that organize crime, terrorists and other people and when you think about decision cycles in this realm, you think about every single day you get new malware, viruses, other Technology Added to your pc to deal with new threats that didnt exist a day or two or week before. How do you really segregate your scope of responsibility, the vulnerabilities of the dod or however you would like to define your scopebility and differentiate that from the broader private sector threat. You have 28 million Small Business businesses. You have distributed Public Sector whether electric water or gas and the concern that i have is what we have right now, we havent seen and i think that we will see some day a nation, state or organized crime or terrorist organization literally be in position to execute a multi pillar attack if they are smart and are we will do something to disrupt you and disrupt your ability to react by attacking the private sector. So how do we look at this on a global basis as they increase abilities, they will figure out a way to go after communications infrastructure, supply chain, health care, electric, whatever public in, how do we coalesce, do a good job in d. O. D. And create the line and go around it and disrupt you from a different directio direction . You have articulated the challenges of how to operate because the boundaries that we consider this is a dod function, this is a private function, this is a government cyber blurs these lines. So the dod arena is a reason if you look at the exercise in training regime that we put in place, we try to do it within the dod but across a breath of the private sector, cyber guarders are annual exercise it will be in june. We pick a different segment if you will every year. Well do the power segment in this years exercise. I think its Something Like 20 different corporations, the guard, state, local. Thats what im getting to. Its almost as if your military exercises have to involve all of these players so they have a better understanding of their vulnerabilities and the nature of the attack that would occur and to what extend are we looking at state and local governments as a way to at least in North Carolina serve in the legislature and we were talking about what we could do to work on Cyber Threats and i saw it also as an economic advantage. As states became particularly good at grid hardening or at securing the physical presence in Cyber Threats within the state borders, they create an economic advantage to set up business in the state. To what extend are we trying to lead and help make this problem a little less difficult at the federal level by making sure the state and local government are stepping up their game as part of the effort. Its a reason there is a big guard component to this effort to ensure we can also try to address this state and local aspects of this. Ill see if i can schedule time in our office, we may have to do some in a secured setting. Thank you very much. Thank you, mr. Chairman. One of the issues is in fact sort of the services being able near resources to fully develop the units that they will detach to you essentially or provide for your operation control since you wont have organic units. Can you give an assessment where they are in terms of doing that across the services . That really goes to the heart of readiness, if you will. One of the so in september when i was with you, one of the things i said then during that session was that i thought one of the reasons why 16 was going to be a big game changer, i thought wed get more involved in the total breath of capability sets, which we are and the other reason was because we needed to shift from a focus on ioc and foc, the generation of capability to actual ready n ness. Are we ready to employ this . We spent the last six months working our way through how do you define readiness in the cyber arena down to the individual team level so that i as a come bander have an awareness where the force is and using the same mechanisms we use to assess readiness across the dod i can provide policymakers, here is what this force is really capable of doing. Weve just started doing that. Ive gone through two strong men with the team. Well do a third and final one this summer and by the end of the summer in september, i will start providing to the dod on a quarterly basis by team. Here is where we are in terms of true readiness. Is the nightmare scenario thats one of these nations acquires the capability to shut down satellites . I mean, that is a there is two scenarios that really concern me. One is the physical shut down and enter diction of capability. The other scenario explain the first one. If you were to shut down look at it from first dod perspective because much of what we rely on for our enablers as a department are commercial infrastructure, power, ability to move force for example. If you are able to try to take that away or Material Impact the ability to manage an air Traffic Control system, to manage the overhead structure and the flow of communications or data for example, that would materially impact dods ability to impact the mission and Economic Impact for us as a nation. The other concern i have is to date, most penetrations of systems that weve seen by actors have either been to steal data or to do recognizance. What happens if the purpose of the intrusion is to manipulate data so you can no longer believe what youre seeing. Think about the implications if you couldnt trust the military picture that you were looking, that youre using to base decisions on and let alone the broader Economic Impacts for us as a nation. Senator . Thank you, mr. Chairman and thank you admiral for being here and for the job that youre doing every day. I wanted to start with does russia have the ability to inflict serious harm. Do we have the capability . In a classified discussion, i would rather not get into that. Let me put it in the context of i assume there is some mutual detouerrence that goes on when were talking about some state actors. Again, its a lot more complicated than just the yes or no. I hope we can ask that question in a classified setting. I had the opportunity over the last two weeks to visit astoniya and probably the first victim of a cyber attack by a nation state by russia. Its been acredited by nato and to hear them talk about how they thi think. Can you talk how cyber come works with nato allies . Ive been there myself and to the center and in brussels for example in december and as u. S. Cyber command, i addressed the north atlantic counsel one of the member nations asked to talk to the leaders up at the alliance about implications of cyber and how lengthy and large one voice. Im the first to acknowledge that. How might the Alliance Work its way forward as we try to go with the cyber arena. Cyber command i tried to partner both with the alliance as a whole as well as specific member nations on specific issues with within. You got to get the house together number one. Explain a little more what you mean whether you say that. Much like weve seen on the u. S. Side, ive said look, i see nato as spending a lot of time and thats a good thing focused on the defense of natos fixed infrastructure but remind them there is value in as nato is creating capability, additional force constructs to be able to apply traditional capability in a much faster way. Ive also been part of discussions where i remind them even as youre generating that additional force, that additional capability, you need to think what are the signer vulnerabilities and defense implications of that. We can spend a lot of money on generating capability but inherent vulnerabilities, thats not a good situation for the alliance or us. Were dealing with the same challenges. I had those discussions with the allegiance at large. So how do we increase their participati participation . We have some nato nations, the large st and not all 28. Over time youll see more and mo more. We talked about how we might take a look at cyber exercise or training regime. When i was there in december, i said this is something we need to think about. One of the things that i was really interested in in estonia is hearing about the Defense League. Defense league. And you were talking about earlier in your testimony about the effort to take advantage of the expertise in the private sector to help us as were looking at cyber issues and i was very interested in one of the things i heard was that the reality is we cant prevent a cyber attack. We got to be prepared to respond to that attack in the way that is most effective and most fastest and they were talking about their Defense League as one way that they are able to do that. Is that something that recognizing that were probably not talking about, but is that what youre looking at what youre talking about the teams that are being set up to help respond . Its a little different in the sense that the idea behind the cyber league for estonia is you have private citizens. Right. Who on a volunteering basis will apply themselves at specific problem sets as they emerge. Kind of after hours, after work on their own time. Thats kind of model for the cyber league in estonia and use that to argument. Aside from us, that cyber league is a cross for us and our streak tours between the Digital Service arena, the dod is creating, as well as the kind of guard construct, though, the difference is when the uniformed member of the guard or reserve so it is not exactly the same but the thought process, the idea of trying to tap that is similar. Thank you, thank you, mr. Chairman. Thank you, chairman and thank you admiral longers for your service. I wanted to ask you a basic question. You have substantial responsibility in your position. What keeps you up at night . Is your worry . I have no problem sleeping but secondly, there is three things generally i highlight. Number one is actions taken against Critical Infrastructure in the United States, damage or manipulation. Number two, what happens when actors start to no longer just enter systems to do recognizance or steal but actually to manipulate or change data so that we no longer can believe what were seeing and the third and final what happens when nonstate actors view cyber as a Weapon System . And they want to use it as a vehicle to inflict pain and against the United States and others. And to the third point you just made about nonstate actors using cyber as a Weapon System, how grave a threat is that to us k currently . I would argue it is not ill say but tomorrow will change. Today i will tell you i have not seen groups yet make huge investments in this but i worry that its a matter of time because it wouldnt take long. One of the challenge of cyber in addition we proeviously it doesnt recognize boundaries, it doesnt take billions of dollars of investment. It doesnt take decades of time and doesnt take a dedicated work force of tens of thousands of people like you see most nation states deal with. Cyber is the great equalizer in someways. What are the greatest risks to the extent you can describe them here to our Critical Infrastructure, the first issue . Just based on the activity ive seen in some nation state actors, what happens if they decide they want to for some period of time disrupt, pumps. Power system, financial system. To move money. If you look at the scenario, have one unfold in the United States. Im not going to argue someone is capable of making the United States go dark but there is capability to cause Significant Impact and damage. Thats why you discuss in your opening testimony the need for the coordination across the government. Right. I wanted to ask you the law changed by congress in terms of the nsa the freedom act. Yes, maam. Can you give us an update on what is happening with that and whether thats working and any concerns you have . Its an important question for us to check back in with you on. Yes, maam, unclass hearing i wont go into great detail. Id say and what ive said to the intelligence oversight committees we have been able to compile and on time. There has been some level of slowness from the old system or new system. In terms of how quickly to get information. The time duration is minutes or hours. Its not days or weeks. So it hasnt yet gotten to the point where i felt i needed to come back to the congress or administration and say look, im seeing a sigma tnificant materi impact because i made the commitment. If i saw that and i believe i owe it to the nation to make that point. I have not seen that yet. There is no doubt its taking longer in someways . In someways. It takes longer. Well, i think it is important for you to come to us with that because given minutes and hours can make a difference in terrorist attacks and preventing them and taking action, this is important for all of us to understand given the world were living in. I wanted to ask you a final question about the jcpoa or iran deal and in there theres a provision that said that the u. S. Must cooperate with teheran through training to strengthen to protect against sabotage in the nuclear program. Admiral rogers as the u. S. Helped t i cant speak for the u. S. Government as a whole. U. S. Cyber command has not participated in any such effort. Okay. Thank you. I missed some of the discussion, i dont want to be needlessly repetitive but want to go to an interchange you had with the chair in opening questions. I met recently with a senior military leader that tried to basically summer rise his sense of things and said we have o plans but no strategy. Ive been thinking about that. I think in your back and forth with the chair you talked about and i think others may have asked you about this, this notion were kind of reacting case by case to Cyber Attacks and kind of deciding in each instance what we want to do but the development of a broader doctrine, whether its, you know, what will a detoerrence policy be in terms of triggering and collective defense obligation, that were assessing those things but kind of not at the end point. Could you talk to us about the kind of Development Process and working on these questions, they are so important. What might we expect from the pentagon, from Cyber Command in our interaction, in our oversight in terms of developme development of doctrines. Youll see in the dod Cyber Strategy for example, a broad over arching frame work from the department how well both develop capability. Were part Cyber Command is part of the broader dialogue within the department about how do we align the capabilities of force with the world that were seeing today and one of the arguments that weve made over the course of the last six months is we need to take an element of the cyber capability were generating and focus it very much in the deterrence piece. How do we shape potentially drive opponent choices and behavior before we get to the crisis scenario. Were in the early stages of that but im very heartened by the fact we have a broad agreement thats an important part of the strategy and we need to be doing that. Were just starting the early stages of that journey. The department participates in the broader dialogue within the u. S. Government how from a National Policy perspective, how will we move forward in addressing some issues you have all raised today. For me as u. S. Of the issues that you have all raised today. Meanwhile, for me as u. S. Cyber command. What i remind our team is we know that capability is going to be part of that deterrent strategy, guys tharks what we get paid to do. Weve got to focus own generating that ability today. Thats kind of been if you will the focus for u. S. Cybercommand at the operational level that i and the team really focus at. Let me ask you another question, i think senator shaheen may have asked you this with representative nato. Another item thats common in this committee, as we look at the postures of other commands, joint training exercises, india does more joint training with the United States than any other nation, we have marines deployed throughout africa and special purpose of training of african militaries. Whats our posture visavis partners in the cyber area, in the training we do together, in the development of joint resiliency strategies . So we do some level of training with key allies. One of the challenges for us, quite frankly is how do you maximize capacity. You cannot do everything with every nation that you would like to do. Part of our strategy is how do you focus the greatest return . What are the nations you want to start with . We have done that, the other challenge i find is, this is part of an ongoing internal discussion for us, based on where we are in the journey right now, i cant do so much with the external world that it negatively impacts our internal ability within the department to generate. Unlike some mission sets where we have decades of infrastructure capability, capacity and experience, we dont have that in the cyberarena. The same force and capability im using to help train and partner with foreign counterparts, im still building every day. Thats the challenge for us right now. I dont think it will be as much an issue in the future as that capacity fully comes online. But were not there yet. Uhhuh. We trained aviators out of other Service Branches and then we created an air force academy in 1954 and decide weird going to train aviators, not that we dont train aviators in the other Service Branches. I think senator mccain may have had some training somewhere in his past we created an air force after world war ii. Ive wondered whether the cyber domain would have eventually become so significant that there may be the need to consider creating a dedicated cyber academy. Much like the air force was created in the 50s. The question is you can train cyber folks everywhere and have them percolate throughout the Service Branches or you can focus on a particular cyber expertise and those folks could go into the different Service Branches. Has there been any discussion or thought about that . Its been a discussion. My input to that discussion has been im not right now based on my experience and what i see a proponent of that approach. My concern is to maximize effectiveness in cyber you need to understand how it fits in a broader context. And i watch at times when i deal that elements in our own workforce, who are incredibly technically savvy, incredibly smart about the aegis of the mission, when i try to remind them, remember were applying this as part of a broader strategy and a broader context. When you dont understand the broader context, youre not in my experience, not as effective. Thats my concern about that approach it will start to make us very, very siloed. Narrow and siloed. Im concerned about the potential implications of that. Admiral rodgers, thank you for appearing again before the committee. If i heard you correctly, you testified to center ayotte that your three main theyres were krets to our Critical Infrastructure, the ability to manipulate systems such that we might not have faith in their operations and third, nonstate actors using cyber as a weapon against the United States. Is that accurate . Yes, sir. Are either of the Islamic State or al qaeda able to do any of those three things at this point . I havent seen them yet. But my concern is thats now. The Islamic State has a reputation of being effective online. We we infer online recruiting and propaganda is a skill set from the use of cyber against electrical power grids and so forth . Yes, sir. How hard would it be for a nonstate actor like the Islamic State or al qaeda to develop that skill set . Is it nothing more than recruiting the right person . It would not be difficult. Recruiting the right people with the right focus. Its certainly not be on beyond their ability. I believe. Its not beyond their ability. If they made that decision. When we think about other potential nonstate actors, are those, do those groups that have that capability or approaching the capability tend to be associated with state actors . In some cases, yes, but not in all. Not in all. I want to turn now to the ongoing debate about encryption. Think Data Security and cybersecurity is obviously critical in the modern world. Most people in this room probably have a smartphone in their pocket. Even my 70yearold father got a smartphone recently. We keep emails, text messages, phone calls, Financial Information, health information. Many other sensitive data. Hes ahead of senator graham. On our phones, i think data and cybersecurity is essential. I think physical security is essential, i would hate to see americans get blown to pieces because we had an imbalanced priority of cybersecurity over physical security. How do we strike that balance as a society . My first comment would be i dont think its either or. My argument would be we dont serve either viewpoint particularly well when we cast this as well. Its all or nothing, its either or. My view is over time we have been able to integrate groundchanging technology in the course of our nation, and to do it in a way that enables the nation under the right circumstances with the right level of control, to be able to access that. For me, my starting position is, what is it that is different about this, that would preclude that from applying here . I dont personally see that. Even as i acknowledge theres no one simple answer, theres probably no one silver bullet. Its not going to be a one size fits all. But i look at the innovation and the cando approach we have as a nation and im thinking we can solve this. Like for instance a decadesold law known as the Communications Assistance for Law Enforcement act. Which tells Telecom Companies of any size if they want to construct a telephone system in this country, it has to be susceptible to a wiretap pursuant to a court order if the court finds probable cause to order a wiretap against a terror suspect or a human trafficker or a drug dealer or so forth. Similarly we all expect privacy in our bank accounts, but banks must maintain systems that they it turn over Financial Information subject to a court order on a potential money launderer. Is there any data that says we should treat Tech Companies different than Telephone Companies or banks. I like you, i just say look, weve got frameworks in other areas, why cant we apply that here . These questions have been about the larger debate about encryption Going Forward, the way smartphones are designed, messaging systems are designed there was a case recently involving apple and the fbi and the San Bernardino shooter in which the fbi requested apples assistance to override a feature of an iphone, apple refused, fbi found a third party capable of doing so and has withdrawn that case. Should americans be alarmed at this kind of vulnerability in such a widelyused device . The way i would phrase it is vulnerability is an inherent nature of the technical world that we live in today. And if you desire is to live in a World Without vulnerability i would say that is probably highly unlikely. Do you know if weve shared that vulnerability with apple . As u. S. Cybercommand, sir, i apologize, i dont know. Admiral, one other point. We know for a fact that baghdadi is sending young men into the refugee flow to commit acts of terror. Wherever they can locate. Is it true or very likely that they also know of a website to come up on. Secure so that they can communicate back with baghdadi and his tech . Yes. So right now theres a media report that 400 young men had been sent into the refugee flow i would assume then that at least some of them have are armed with a website to come up on once they get to a preferred destination so that they can coordinate acts of terrorism. A website or encrypted app. Yes, thats probably likely. Thats a bit concerning, isnt it . Yes, sir. So what should we be doing to counter that . Besides take out isis . I think we need a broader National Dialogue about what are we comfortable with its not either or. Weve got to have security and weve got to have safety and privacy, and at the moment were in a dialogue that seems to paint it as well its one or the other. And as the dialogue we just had with senator cotton, i dont see it that way. Yet we know of a direct threat of an attack in europe or the United States Technical Capability to enhance their ability to commit this act of terrorism. Isnt that a pretty tough so we need a National Conversation . Do we need more hearings . Do we need to urge the administration to come up with a policy . What are our options here . The worstcase scenario to me is we dont have the dialogue and we have major event and in the aftermath of a major event we decide to do something that perhaps that in the breadth of time we step back and ask ourselves, how did we ever get here . I dont think theres any doubt that thats a likely scenario. Thats what i hope it doesnt come to. To date for a variety of reasons weve been unable to achieve that kind of consensus. Weve got to figure out how were going to do this. And you dont want a Law Enforcement i believe, you dont want a Law Enforcement individual or an intelligence individual dictating this. Just as i dont believe you dont want the private sector, a company dictating this. This is too important from my perspeive. Is awareness of this threat important for the American People to know how serious this threat is . Yes. Senator kipg . Mr. Chairman, hearing this dialogue and the discussion youve just been having, it strikes me it underlying the foolishness of continuing to be governed by budget decisions made six years ago. When this threat was nothing like the magnitude that it is today. And here we are dealing with a major new threat and trying to fit it within, to shoehorn it within a budget structure that was, that clearly did not take account of the fact that weve got a major new threat and a serious one, and its going to take resources to confront. I just cant help but make that point. It underlying the fact that were trying to be governed by decisions made at a time when circumstances were very different than they are today. I think senator king, but admiral rogers has made it clear in this testimony that sequestration will prevent him from carrying out completely the missions that hes been tasked with. Is that correct, admiral . Yes, sir. My greatest concern if you went to sequestration would be the impact on the workforce, particularly the civilians. Who would argue is this what i want to be aligned with . I can replace equipment. It takes us years to replace people. There is a real likelihood that if we continue the sequestration, that you will have to you will not be able to continue to employ these outstanding and highly selective individuals . Yes. Sometimes, admiral, i do not want the American People to see what goes on at these hearings. The old line about laws and sausages. I certainly wish the American People could hear and see your statements that youre making today. Rather than as you just stated, an attack and then we always overreact. That thats just democracies are all about. And so i thank you for your good work. But i also want to thank you for your straightforward answers to questions that were, that were posed by the members of this committee. We thank you. The hearing is adjourned. Thank you. Olivia golden talks about workmandates that are taking effect in over 20 states and may cause as many as 1 million americans to lose their food stamps. Then patrick mclaughlin, Senior Research fellow at the George Mason University center on their report that ranks 50 states and the District Of Columbia by the effect of federal regulations on a states economy. Anticipate brian simon, State Government reporter on the articles of imimpeachment filed in the Alabama State legislature against governor robert bentley, following reports of an inappropriate relationship with a former staffer. Be sure to watch cspans washington journal beginning live at 7 00 a. M. Eastern thursday morning. Consumer financial proprotection bureau Richard Cordray on his semiannual report before congress. It will star live 10 00 a. M. Eastern on cspan. What we see is new factors making emancipation desirable. All kinds of obstacles falling by the wayside with the result that by August Lincoln will announce a new war effort. Wheaton College History professor Tracy Mckenzie on the evolving war goals of the civil war. And on real america how was it possible for america to achieve such production and at the same time build an army . 20 of American Industrial manpower was woman power. Legions of american women were amassing to stop advance across the world. This 194 4 War Department Film Documents how women in world war ii helped the war effort, alluding that the hidden army of american women working in war manufacturing are a main reason germany lost the war. Sunday evening at 6 00 on kp american artifacts we visit the daughters of the american museum. One thing that stands out in this time period is this creation of this imagery of the apotheosis. Thats an old concept that goes back to ancient times from a warrior is made godlike by lifting him up and celebrating him. It is worth highlights key facets James Madison who followed jefferson as the fourth president of the United States owns over 100 slaves while he occupied the white house. He exposes expanding the 3 5 compromise, which guaranteed the south held a disproportionate influence on congress to preserve and uphold slaveowning interest. Tyler perry, africanamerican studies professor at California State University fullerton on the 12 american president s who were slavee in office. Defense secretary ashton
vimarsana.com © 2020. All Rights Reserved.