will now come to order welcome everyone to this afternoon's hearing on the administration's cyberspace policy review this is the second of three hearings the science and technology committee is holding on cybersecurity last week the research and science education subcommittee held a hearing on the research needs for improved cybersecurity and next week my technology and innovation it will hold a hearing on the cybersecurity activities of the national institute of standards and technology and the department of homeland security i've been long concerned about the lack of attention given to cybersecurity by the federal government and by the private sector previously federal efforts were output oriented focused on things like the number of programs funds spent or numbers of interagency working groups rather than outcome driven i'm pleased that the new administration has made cyber security a top priority and is focusing efforts on achieving outcomes such as fewer breaches of federal systems fewer cases of identity theft and the security of smart grid systems and health i t systems in order to achieve these very very important results it is essential to first conduct a review of our federal cyber security structure an efforts the administration cyberspace review does not make any brand new recommendations however it is valuable as a frank assessment of current federal activities and a road map for what needs to be fixed in general the recommendation suggests improving interagency coordination and coordination with the private sector modernizing the research agenda and enhancing public education on cybersecurity by addressing each of these recommendations we are laying the building blocks for our new outcomes based approach to federal cybersecurity the four agencies appearing before the committee today have a significant role to play in creating that foundation today's hearing i hope to learn how each agency intends to improve its current cyber security efforts in response to the administration's review of this information will help guide this committee's ongoing efforts to protect our nation's data computer systems and its citizens i want to thank our witnesses for appearing before saturday and now i would like to recognize representative smith for his opening statement thank and thanks for holding this hearing today to review the administration's efforts to strengthen cyber security as outlined specifically in the white house's recently released cyberspace policy review the federal efforts to increase network security date back several years they were brought  to the forefront in early two thousand and eight when president bush formally established a comprehensive national cybersecurity initiative to deal with widespread and successful cyber attacks on federal networks president obama has committed to fully continue this effort under his administration and emphasize its importance in a recent speech continuity across the bush and obama administrations as well as increased attention being given to this issue in congress provide indication of a small but important bandage over where we were just a couple of years ago awareness of this problem and the need for action is now nearly universal there is broad agreement on the seriousness and magnitude of our cyber security vulnerabilities and the complexity of the technical and policy changes that must be addressed to overcome them however while there is a consensus on the problem we are still at the earliest stages of identifying and implementing solutions and we're working through relatively policy territory as we do so accordingly i hope both congress and the administration will work to balance the pressure to act quickly and aggressively on cybersecurity with the need for thorough and deliberate consideration of all possible courses of action as we hold these hearings and consider legislative options later this summer i hope to focus on three broad areas of cybersecurity approach to improving the security of these networks do new regulations or liability protections make sense could they be counterproductive to our security goals i hope today's hearing will serve to begin the process of answering these questions i thank the witnesses for being here and i hearing on the state of cybersecurity r and d and several of our witnesses emphasized the need for better partnership information sharing between the federal government and the private sector we also discuss the challenges faced incentivizing agencies companies and individuals especially those that don't face an immediate or obvious threat to adopt established best practices and to disclose breaches in security and the expert panel echoed recent reports regarding concerns over lack of prioritization in the federal r and d portfolio one additional issue we discussed in last week's hearing was importance of education the panel emphasized that our i t workforce needs to be taught the skills necessary to incorporate security into software in systems from the beginning but i t professionals are not the only ones who need to be better educated agree that increasing the public's awareness of the risks and consequences of course security practices is also essential people are beneficiaries of i t but also the weakest link in i t security a computer scientists need to team with social scientists to gain a better understanding of how humans interact with and utilize technology we  cultural change in the ways that americans practice their computer hygiene how to i look forward to hearing from our witnesses about their agency's responses diary space policy as i said this is a critical issue and i'm very happy that the administration has focused in on it and we are doing so here on the committee a secure resilient cyrus bass viol not only for the federal government but for businesses large and small statement the ranking member of the research subcommittee thank you mr chairman i was last and probably least try to keep my comments very short curity of our information is vitally important to all federal government entities and that includes representatives many of my colleagues are aware that our own networks are targeted daily by people in government who would like to do harm to us or to our government or to find out personal information that is proven provided to us by our constituents or other friends in other countries it takes to digic planning an organization to avoid and address these attacks when considering the impacts of information security on policy development related to electronic health records national defense and technology development for example it quickly becomes obvious how important trust networks are to the public and to legislators all of the federal agencies testifying the witness table today play a critical role in protecting the security of our systems well maintaining the necessary freedom to exchange unfettered communication i look forward to your comments on how the agency vatsim the national cybersecurity efforts and expect to learn a great deal from each one here today thank you very much thank you dr taylor if there are other members who wish to submit opening statements your statements will be added to the record at this point and now it is my pleasure to introduce our witnesses for loni is the director of the information technology laboratory at the national institute of standards and technology dr jeannette wing is the assistant director at the direct for computer and information science and engineering at the national science foundation dr robert lee haney is the acting director at the defense advanced research projects agency and  ash is the acting deputy assistant secretary at the office of cyber security communications at the u s department of homeland security the witnesses will have five minutes for spoken testimony and your written testimony will be included in the record in their entirety and when you complete your testimony we will begin with questions each member will have five minutes to question the panel and ms for lani  se proceed thank you chairman and servant lipinski ranking members and members of the subcommittee i appreciate the opportunity to appear before you today to discuss our role in cybersecurity and our perspective on the administration's cyberspace policy review through our work in information technology mystic celebrates the development and deployment of information and communication systems that are reliable usable interoperable and secure vance's measurement science through innovations and mathematics that this six computer science and conducts research to develop the measurements and standards infrastructure for emerging information technolog applications many of our vital programs impact national security such as improving the accuracy and interoperability of biometrics recognition systems and facilitating communications among first responders research activities range from innovations in identity management and verification to metrics for complex systems to development of practical and secure cryptography in a quantum computing environment to automation of discovery and maintenance of system security configurations and status and to techniques for specification and automation access authorization in line with many different kinds of access policies as you are aware beginning in the early one nine hundred sevent nist has developed standards to support federal agencies information assurance requirements through the federal information security management act or fiza congress again reaffirms nist leadership role in developing standards for cyber provide for the development and promulgated of federal information processing standard or phipps that are compulsory and binding for federal computer systems and this mission in cyber security is to work with federal agency industry and i think the media to research develop and deploy information security standards and technology to protect information systems against threats to the confidentiality integrity and availability of information and services consistent with this mission and with the recommendations of the president's cyberspace policy review this is actively engaged with private industry academia non national security all departments and agencies the intelligence community and other elements of the law enforcement and national security communities in coordination and participation of cyber security research standards development standards conformant demonstration and cyber security education and outreach the national security community and number of state governments and major private sector organizations are also adopting the risk management framework and cybersecurity controls designed by nist for the federal government this is engaging industry to harmonize product assurance requirements to align with industry business models and system development practices we play a leading security role in supply chain risk management healthcare information technology the smart grid biometrics and site space authentication the next generation voting systems and cloud computing we work with the intelligence and counterterrorism communities to facilitate prosector information sharing among federal state and local government organizations we team with the department of justice and the small business administration and extending cybersecurity education and training beyond the federal government into the private sector for the first time  part of the own going initiative to develop a unified secure information security framework for the federal government and its contractors nist has included security controls and its catalog for both national security and non national security system the updated security control catalog incorporates best practices and information security from the united states department of defense the intelligence community and civil agencies to produce the most broad based and comprehensive set of safeguards and counter measures ever developed for information systems under the provision of the national technology transfer and advancement act this is also passed with a key role and encourage and coordinating federal agency development and use  voluntary consensus standards and coordinating the public private sector development of standards and conformity assessment a activities through consensus standards organization will continue to conduct the research necessary to enable and provide cybersecurity specifications standards assurance process of training and technical experts the expertise needed for securing the u s government and critical infrastructure information systems to mitigate the growing threat will continue to closely coordinate with the mystic and international private sector cybersecurity programs and national security organizations thank you for the opportunity to testify that they own this work in the cyber security arena and our views on the president's cyberspace policy review i'll be happy to answer any questions you may have thank you ms for lani dr please proceed thank you very much good afternoon chairman lou and chairman lipinski ranking members miss and members of the subcommittee i am jeanette wing and i am the assistant director of the computer information science and engineering directorate at the national science foundation i'm delighted to have this opportunity to speak with you today about n s f support for cybersecurity research at the front two years of knowledge investments that capitalize on the intellectual capacity of the best and the brightest in our nation's colleges and universities as well as the r many partners in the private sector the research outcomes generated with n s f support well funded out to contribute to the security stability and integrity of our global cyber infrastructure for many years to come to begin i would like to emphasize that many cyber security measures deployed today build upon the fundamental research outcomes generated decades ago thus as a recent sixty day cyberspace policy review conclude national strategy to secure cyberspace in both the near and the long term must include investments in fundamental unclassified long term research allow me to share with you just a few important fundamental contributions made to date by the open research community many a originally developed with applications other than security in mind cryptographic schemes and cryptographic based authentication and they believe today's internet commerce such as online banking program analyses and verification techniques and able to early detection of software vulnerabilities thereby often preventing cyber attacks such as dishing worms and bot nets machine learning and data mining approaches are now used in filtering spam and detecting credit card fraud captures the distorted text that only humans not machines can decipher ensuring that it is indeed a human not a bot who is buying a ticket online these and many other research results developed with and at the funding are being used routinely in numerous corporations today moreover and as a fund it projects have spawn startup companies that bring critical technology to the marketplace creating new jobs expanding the economy and helping to secure cyberspace this year n s f will invest almost one hundred thirty seven million dollars in cutting edge research on the science and engineering of trustworthy systems are interdisciplinary trustworthy computing program is a significant component of this investment and supports more than eight hundred principal investigators co principal investigators and graduate student we contribute to the comprehensive national cybersecurity initiative the n c i through this program with a focus on three vital areas the scientific foundations of trustworthiness privacy and usability and i sa s f and the academic community greatly appreciated the opportunity to contribute to the sixty day cyberspace policy review we are pleased that the review recognizes the importance of investments in both fundamental and classified cyber security research the kind of research and ice up support and cybersecurity education the review also recognizes the importance of a strong academia industry government partnership in which n s f pla central unable ng role for example the n s f science and technology center called trust and three cyber trust centers all work directly with industry partners to speed the transition of research outcomes into products and services looking ahead there are several areas right for industry university collaboration first industry has data that are otherwise unavailable to academics providing access to real data appropriately sanitized anonymizer scrubs based on real adversaries and real users of operational systems the networks will allow researchers to test their theories and to gain new insights second industry has problems looming on the horizon that they just don't have time to solve or they can't even imagine because they are so focused on the present these are exactly the kinds of problems academic researchers can work on anticipating the threats of tomorrow so that when they arrive solutions will be ready in my testimony today i provided examples of ways in which n s f works with us partners in the federal government the private sector and academia to catalyze research advances in cybersecurity with robust sustained support for research in both the executive and legislative branches we have a unique opportunity to increase our nation's investment in fundamental open information assurance and cybersecurity as i believe you're already aware darpa's mission is to invest in high risk high reward technologies that create new capabilities for our military and information assurance inside cyber security are important elements in our current portfolio programs let me begin to today by commenting on the significance of robust secure cells forming networks to the defense department like many commercial enterprises the department is transforming to network centric operations so droppers programs are focused on ensuring that these networks can operate independently in a robust and secure manner we're interested in two types of that works strategic high speed optical and satellite based global networks networks relying on commercial hardware technologies for the most part where our for these types of networks are focuses largely on operations survivability under attack and security at the other extreme our tactical largely wireless networks networks directly supporting the warfighter on the front lines wireless networks present both hardware and software challenges they must be adaptive capable of operating in any environment as well as being able to manage defend and heal themselves at speeds beyond human capabilities and they must be self forming without recourse to the infrastructure or cell towers of a commercial provider as network capabilities become ever more essential to operations these networks above all else must be secure will spend about one hundred twenty seven billion dollars on information so that surance and cybersecurity in the c fiscal year and we're requesting an increase of more than fourteen percent two hundred sixty four million dollars for two thousand and ten well most of these investments are targeted towards software architecture and particle issues to ensure networks that are secure from the ground up their underlying hardware must also be secure so in what is truly a dark a hard problem we are investing in a program we call trust enough the same name that the n s f has for one of its programs but we're doing something completely different what we're doing is we're investigating and methods for detecting malicious features inserted into semiconductor chips during their design manufacture and programming all of these efforts focus on the department challenges but we believe our success is as has been the case in the past will eventually impact commercial network technologies as well at this time perhaps our most visible program one of particular interest to this committee which we took on as part of the comprehensive national cyber initiative is our program to develop a national cyber range recognizing that scientific progress has always been paced by advances in our ability to observe test and perform rigorous experiments we're designing this range to be a vehicle for significantly advancing progress in cyber understanding and capabilities to be a tool for rapid realistic and quantitative simulation assessment of cyber technologies researchers will be able to operate at either the classified or unclassified levels and with many more nodes  ranges was highly automated tools and measurement techniques they will have access to revolutionary research capabilities capabilities that will allow rapid network simulation under real world conditions enabling efficient development and testing of information assurance and cyberspace security strategies the program has three phases in the current first phase we began by seeking ideas from multiple sources which after a government panel review resulted in our placing seven teams under contract to develop complete repeating designs for delivery later this summer at that time the government team will evaluate and select the best among these designs to continue into a phase two program to produce a limited number of prototype ranges in a third phase the most capable prototype range will be further developed into the operational range to be completed in twenty twelve managing the national side range development but will transition the completed range to another organization for operation the details are a work in progress presently to government working groups of studying the issues one is developing a technical vision and business model for the range operations the other is focused on security issues for accrediting the range for use by all agencies across the government in the end i believe the range will operate like other national research assets but a panel to review and prioritize use of proposals and then ministre to to administer to maintain facilities and facilitate research or access regarding how we coordinate our research with other agencies i can assure you that we actively who are in it our efforts to specific examples include the multi agency participation in the development of the national cyber range and are teaming with the n s f to organize to cyber security workshops this summer but in general in the process of developing new programs our program managers routinely engage with their counterparts in other agencies to scope out the best way forward to achieve a specific research goal regarding the sixty day cyberspace policy review this high level document ranges over a wide variety of policy issues but i note that a specifically recognizes the importance of innovation in achieving cybersecurity explicitly calling out the supply chain threat which  trust program is addressing and the importance of modeling and simulation capabilities that the n c r will enable in conclusion as apartment expands it's not centric operations information assurance remains a critical concern in dealing with this concern we're committed to working with organizations across the government to contribute to the national goals for secure cyberspace and when the new darpa directors in place refining our plans programs and budgets for cyber security will be high to discuss white house's recent release cyber policy review as it relates to the part of homeland security's ongoing efforts to secure the federal civil executive branch networks and information systems and to coordinate activities focused on securing the nation's critical infrastructure one of the greatest threats facing our nation is a cyber attack to the critical infrastructure on which we depend our society relies on technology and telecommunications to support our common me in critical government functions and cyber threats to these systems are real growing and evolving their large diverse and range from independent unsophisticated opportunistic hackers to technically competent adversaries and nation states the nation must be vigilant sector and federal state local tribal and international governments to assess and mitigate cyber risk and prepare for prevent and respond to cyber incidents the cyber safe space policy review assesses the current state of u cybersecurity policies and structures based on this is susman future decisions will be made regarding u s cyber security policy and appropriate structures to execute it isn't to say that those decisions will focus on the following five key areas the review which build upon existing programs and activities one develop a new comprehensive strategy to secure america's information communications infrastructure to ensuring an organized and unified response to future security incidents three strong things public private and international partnerships for investing in cutting edge research and development and five beginning a national campaign to promote cyrus purity awareness and digital literacy and to build a digital workforce for the twenty first century within those areas a series of near and mid term actions are set forth the h s n n c s d working with inner agency partners are actively engaged in advancing these actions as emphasize that privacy and civil liberties considerations at the center are efforts protecting the privacy of americans and their personal information not just a party is required by law and we take it very seriously d h just leads a mother and see approach to coordinate the security of federal civil executive branch networks united states computer emergency reading this team or u s cert serves as a central federal information security incident center and is a focal point for the security of federal civil executive branch networks agencies report  agencies on hansing detection capabilities and works with them to mitigate information security instances u s search compiles and analyzes incident information shares that information with the operators of federal information systems you assert provides products ranging from current and potential over the last year and d h s s lead the cia and cia effort to establish a front line defense for federal jacket branch as part of this effort the h s works with the office of management budget to reduce federal executive branch external connections through the trusted internet connection or tech the executive branch networks we also work with federal agencies develop additional capabilities to detect and eventually prevent intrusions such collaboration will help inform the products necessary to provide actual information to our critical infrastructure community in addition to coordinate security federal civil branch networks we work with industry and government partners to secure the nation's critical infrastructure networks the vast majority of the nation's cyber infrastructure is owned by the private sector at such  always sponsibility and the key to our shared success is protecting civil cyber infrastructures collaboration with the private sector is for this reason d h s will continue to strengthen and build upon the public private partnership framework created under the national infrastructure protection plan or net develop a plan for retaining a skilled trained workforce we need to build the next generation so i was going to work force that will help us maintain a competitive advantage over the coming years we will focus resources on the education training of our current workforce and developing and recruiting is a difficult task requiring coordinated focused approach to better secure the nation's technology communications infrastructure president obama cyberspace policy review of reaffirms that cybersecurity is among the most significant issues facing the nation's economic and national move on to two questions of a c m chairman who is down there i'm not sure if you want to take back to the chair here or we up with questions or or yesterday at an s f and meet with director bill mentioned in the eighty's and some of these things are that i'm going to ask about not going to be a surprise to you or anyone actually who knows background as a social scientist i brought up in my opening statement that one of the most important things that i think is often overlooked in probably the weakest link that we have right now for cybersecurity is  collaboration between social scientists and computer scientists thank you for your question it gives me an opportunity to speak about the trustworthy computing program which one of the things i wanted to do when i got to the national science foundation was actually broaden the scope of what we were doing in cybersecurity to make sure to include topics like privacy and usability which absolutely includes understanding social science and how humans b organizations behave and so one of the things we i specifically did was to broad the scope of our cyber truss program to include privacy and usability and to work with our social science colleagues to make sure that for instance we have  reviewers from their communities looking at proposals that speak directly to these kinds of issues in fact cybersecurity not just security reliability privacy and usability it's not just the technical issues that all of us scientists and engineers like to address but there are much broader issues like legal and ethical which if you look at the whole problem we really need expertise from both the scientific and engineering communities as well the less  technical communities so we are very very much keen at the national science foundation looking at the broader picture they want to throw to a general a question for each one of you actually  going along these lines to tell me what rules do you have as your agency what type of education you do of your employees so that they do not wind up practicing bad  tell me if there's anything that you do along those lines or your employer will of course because we write the standards for the federal government we expect during protests to live up to a higher standard so it's a we do work very diligently  chief information officer to ensure that the understanding of what needs to be accomplished to protect the systems and the citizens that are interacting with us are deployed appropriately into the staff so it's something printed out he was trying to get to see where he could find a certain i don't know if it's a virus or what exactly it was trying to find places where he could he could pick that up because he knew that this was going around to  just get a better handle on all this so thank you dr wing n s f we have a security secure information technology awareness program and every single n s f employee is required to go through a training every year and it covers all the topics from how to choose a good password to protect shutting down your issue and to make sure that screens are with confidential information  not displayed and so on and there's policy documents about the spec that everyone is expected to read so we have a very serious we take security very seriously and everyone goes through this training program agency within the defense department our computers are part of a larger enclave that is monitored very closely so we have a very robust information resource directorate that is available to help people work their way through the problems they might be having with their computers and so far we've been successful in blocking large numbers that you might imagine our computer system is regularly under attack and we've had good success that preventing those attacks from having any adverse effect on the operations of our computers thank you dr phoniness sir thank you first of all we follow all the  practices and we closely follow his mouth our c e o is the person responsible for making sure those things are implemented across our department we also are very much into security awareness training and we annually require people to take security innocent and fact i have to do take that tonight when i get home we also have sort of eat our own dog food and a sense of what we do is as i get i mentioned a trusted internet connections and we actually have to trust internet connections and we're moving to have all our network traffic go through those trusted internet connections and we have a close relationship between us our security operations center and our u s sir thank you thank you my time is expired i will now  einstein i know that our progeny five agencies right now have already been deployed with einstein is that correct there's we have the ploy we have deployed the systems are not operational yet we're actually right now we're in  locations but we're we're we're working the legal issues at this point in time and then following will be eventually all agencies that the idea is we're doing in the phases what we're doing is first of all we're doing it at the h s that's one of the five agencies included and then we're going to go is we're going to we're working now with justice department of agriculture and state department and nasa on terms of deploying that trust and connections actual physical einstein devices to those locations we've also worked with the g s a and we actually put on contract we actually made contract modifications work with g s a on the networks contract and now agencies can go to the networks contract and get those services actually trust internet connection services from the networks contract vehicle and so that so we're actually working with the carriers right now the eighteenth sprint verizon to get them so that they can provide the capabilities for example they have to have a secure facility to do this trust and connection so right now the carriers are working those particular instances of what they need to put in place so they can offer those services so that'll be available to any agency i want to do that and then our next phase w  i think that clearly the larger the agency and you know the more nationally it's beauties of the holders are so so let me say that so each agency has to make its own determination of how important it feels it's its  those trusted and connections and then we have a we've made available to anyone who feels that they have a need to immediately move to those contracts people's will be of those contracts will be available and actually services will be offered to use those  thank you beyond that relating to privacy i appreciate the fact that the president said that with emphasis that he would seek not to include monitoring private sector networks or internet traffic then new york times last saturday stated that a senior administration that senior administration officials have admitted those assurances may be challenging to guarantee in practice and that some administration officials have begun to discuss whether laws or regulations must be changed to allow law enforcement military and intelligence agencies greater access to networks or internet providers once a significant evidence of a national security threat was found so i mean maybe  actually able to what we do not track the individual personal and part of the message is what we do is we drop that what we do is we track the information was called header information basically the information where it came from where it's going to and we also will look at if we also going fast you can actually recognize what's called the signature of that pick that up but for example we wouldn't get into the privacy of a person's e mail unless there was some issue about a national security issue or something like that you clearly what you can do is protect the privacy suggestion the legislative and regulatory changes i think that's something that needs to be addressed as we go forward at this point time i recommended you do not recommend i would not be the one to say yes or no this point in time  i think that's an issue that needs further study ok thank you thank you the gentleman from new mexico recognized the five minutes mr chairman thank you very much i know that i read a lot in the testimonies about the need for coordination if you could briefly touch upon how you work together how the coronating is working if it's not working what suggestions you may have and also if any  so let me let me take that question on coordination the coordination happens at all levels and the best a coronation happens in fact at the lowest level or with the technical people and the different agencies working together informing each other of what each agency does in terms of what we fund but what we actually do so we have program directors who talk to each other in different agencies and we coordinate things like running joint workshops to reach the academic community the private sector jointly and that coronation works beautifully from my perspective we also have more formal techniques for coronation for instance night or networking and information technology research and development  the testbeds that we jointly support with the other agencies like the are actually a starting point for drivers cyber national cyber range so i think we coordinate quite well together d or what is night or the networking information technology research and development program it's a coordination it's an organization like ornate over thirteen federal agencies networking is an agency that does almost all of its research activities outside the agency by contract over ninety percent of our budget goes out as contracts to industry academia  and federal laboratories specifically for example is an active participant in many of our programs including the national cyber range development that i spoke about in my oral testimony i'd like to point out that innovation and creativity in research has an individual property or characteristic of individuals and  it's not a of activity that works well when it's driven from above the darker i like to characterize our present bottoms up organization it's not a case that i wake up in the morning and come into work and ask my starter's send me a program manager to manage a great idea that i had overnight rather it's a case that will work to open my email and find that one of my program managers is trying to get on my calendar to come and tell me about his or her great idea and it's in that way that new ideas new programs are created of course in order to support the argument for creating a program a program manager has to reach out to other workers in their particular field in order to be able to put together a case for why a particular program should be started and executed  the technology and the challenges that the program is going to address as you possibly can in order to make the strongest case that you can thank you mr chairman as my time expires i want to see if i'm right maybe if available if i can at th correctly to include our national laboratories because there was a concern that maybe we weren't using the coordination as much as we should have been in the past and so i'd like to explore that a little bit more specifically pinned down to the expertise that does exist within n s a with the attacks that they experience on a regular basis then if you're the question asker thanks very much for sure very good will come back to the gentleman now the gentleman from michigan dr ellis recognized for five minutes thank you mr chairman and i have a question for in colleges and universities deciding to major in computer science has gone down dramatically and that there's also not that much interested and undress in the high scores and getting involved and everyone likes to play  computer but not very many are saying i'd like to do this and build a better computer some time my life since you're at n s f you have access to all the state what is happening is the enrollment continuing to be down raises in the context of this hearing because if we're not producing the right people we're not going to get anywhere with our discussions of cybersecurity and particularly implementation of the new ideas new approaches we had seen a decline for the past few years primarily because of the dot com bust and another worries but fortunately this past year we actually saw an o and the community at large is much more optimistic now about seeing and romans go back up so we're crossing our fingers and hoping that will be a trend a positive trend  i do share your concern that we're not using another trained and educated students in computing not just because they are likely the ones to be designing and building next generation information technology systems that we're all going to enjoy using on a daily basis but we we are working as a community to try to increase the pipeline to increase the improve how it is we project what computer science is so that we have we can attract the best and brightest to the field so i hope you're  low education however we have two programs that i'd like to inform you about that i think are coming attempting to overcome some of the issues that you raised the first program is one we call  computer science study group and it's a program targeted to one tenured young faculty members in computer science and it's a three year program over the period of three years of support level for the individual and in the program could reach as much as a million dollars and as part of the program we bring these individuals on to military installations and expose them to specific areas of interest to defense department in the hope that we can encourage them to think about their research agenda in terms of solving the kinds of problems that the defense department deal with currently with the three year program as i mentioned we're bringing about ten on tenured faculty and program each year we currently have about thirty in the program as you may be aware a few years ago we ran a series of what we called grand challenges  which were targeted to do that demonstrate the ability of unmanned automobiles to navigate through difficult terrain we found that there was an enormous amount of interest among students in that program and in participating in our program and so we asked in our budget last year for us modest amount of funds on the order of a couple of million dollars to create a special program to reach that would reach out to high school students particularly students interested in things like robotics in an attempt to stimulate interest among students and the kinds of problems that we have to deal with thank you also the robotics first program  cyberspace policy review as a way to again address a problem that you're concerned about attracting the best and the brightest to computer science and the whole notion of the program is to really revitalize the undergraduate curriculum in computer science and one of the things i'm very keen on doing is to actually go out and do outreach to the k to twelve level because i do believe that it's increasing the pipe even before they get to  college to explain what computing is all about and to get them into the field so i wanted to mention the c path program thank you well that's good thank you and i try to do my part as members of congress we get invited to speak in schools regularly and whenever i speak a nice cruise i always tell the students they have to choose their subjects very carefully and they should not overlook math and science because when they get out and start looking for jobs they will discover that they were either be a nerd or work for a nerd which they would prefer doing and of course they don't believe that and i simply ask who is the richest man in the world and f is doesn't always cross her mind probably because they don't have a contact with people who do that on a regular basis thank you very much thank you dr taylor the national science foundation has data that indicates you are having by our federal governments and certainly by the private sector can bear a great benefits how do you see as n s f facilitating and encouraging the transfer of research from academia into that equation well this is a very good question because it's specifically relevant for cybersecurity obviously academics can do their their research write their paper produce students and so on but what really matters in the end is protecting securing our cyberspace and if the private sector owns most of that there has to be more engagement between the academic community and the private sector and s f through this all the all of the centers and also so there are formal mechanisms that we have even the larger words that we grant through our through the p r through our normal programs often those guys will have connections to industry it's probably goes without saying that a lot of the researchers especially in cybersecurity want to see that their research ideas are relevant and can help and so they they have a motive they have a personal motivation to actually work with industry some of the techniques just get out there immediately so for instance one of the results recently has been developing secure web browsers and so now one of the open source web browsing companies has picked up that those techniques immediately a part of it is because a many of the researchers have personal contacts in industry and these kinds of things transfer informally but quickly another mechanism that's not formal but very useful is many of the students graduate students that are funded through and i say often take summer internships at companies like google and microsoft and yahoo and so on and one of the reasons that they do that is in fact that is how they can get access to real data so there's great incentive to to actually do that and plus it's a very good opportunity for students to see what it's like to do research in industrial setting how do you envision the private sector i think the greatest simple ways are impact on creating the research agenda for and how do they do they have a way to influence that agenda well our agenda is officially it's actually very much like what dr lohan say we are a very bottom up organization as well as the academic community that speaks to us as far as where they see the frontiers of a search going with the wrenches of science going what the challenging science questions are and they come to us with brilliant ideas and say well this is where the field is going on and and in those conversations we are always engaging industry so whenever we run these planning workshops industry is as invited as the academic community so even from the very beginning we try to engage the private sector in these kinds of strategic agenda setting  set priorities and then as i mentioned before some of the larger centers that we see we fund like the trust center and the we actually have four cyber trust centers have the participation is there room for a lot more participation from the private sector do you think that the flow is if the awareness is out there and it's been pretty much heightened in the last couple of years or do you think there's a room with them very closely on all sorts of reasons but specifically have been hearing from some of these companies that they would like to participate more in telling telling the academics what the real problems are and what they should be working on in the academic listen the other another mechanism i forgot to mention is of course in our review process through the panel reviews of the committee of visitors that we have we always have industry representative there to help with their views so that they can give some sanity check on well that's an interesting problem but it's not not relevant for industry they can also help in the committee thank the gentleman mr smith recognized for five minutes i'm inclined to ask about the application of sanity checks but maybe there's not enough time here i'm just teasing  wouldn't mind for the discussion here when it comes to public private partnerships i was pleased that the president did say that the administration will not dictate security standards for private companies but one said collaborate industry to find technology solutions is that your take on his comments briefly i believe that's correct what we need to do is you know our mission predominately right now is focused on protecting the federal government and protecting the dot mil domain and then working with our private partners in particular critical structures and making sure that they have aware of the situation so we do a lot of information sharing so we're working information sharing programs so there where  the threat and so that they take the appropriate measures to protect their network and i think it's the issue of the progress level of security for the infrastructure it depends upon if you're dealing with a critical defense contractor who has critical maybe define how we go about that i mean i know that we want to take care of government and the private sector but i think we need to acknowledge that already there is a great degree of overlap there and already public private partnerships do and there's transfer of information across the internet between government and the private sector so how do we sort through that and especially with the broadened use of the key objective being public private partnerships so clearly the federal government clearly doesn't operate in a vacuum we do our business what we do you know the critical structures that we have been actually use on our own networks is actually owned by the protection plan have set up a process where we work with the critical structures in terms of protecting those critical sure sure and we've actually said we national cybersecurity vision is actually the sector lead for the ip infrastructure work closely with industry to develop risk mitigation we're actually developing right now and i t risk mitigation process and we'll publish that in your future so there's actually a process where they can actually look at the ip sector and determine you know how to do ris committee and there's actually a public industry sector committee and within that is receptor committees actually a group that works with us on the r and d portions and they actually provide us what they believe are the i t r and d requirements and the communications the information sharing information security center that the that we run for the federal government but we make that information available to our private partners in terms of the warnings and we also building upon something defense department started was defense industrial base so if you're from a defense industrial base what that is is is through the contracting process and we can maybe get into that i just have a limited time here and i was just wondering if you talked a little bit about critical infrastructure protection can you perhaps indicate whether or not there's any intent to take the critical infrastructure off of the so called internet grid as a means of protection i don't think at this point in time there is no plans to make it off the grid because for for the most part there's two reasons first of all the cost in terms of trying to make the government and private sector different private network the cost is very large  the same internet network when you talk about the internet you're really talking about one thousand nine hundred verizon and sprint and so everyone uses those networks so it's a common carrier perspective here so it's very difficult to take it off the grid so so what we have to do is work together with me with industry on making sure it's secure and you can have portions of it that are more secure so for example looking at d n a as something that we're looking at and going towards and growing interested in that connection so that certain enclaves are more secure than others the role that nist plays with the payment card industry if you could help me understand that in the coordination with that and what requirements maybe nist has established for p what we have is the national vulnerability database which captures all the work which works with industry and with government to provide data on where the valar vulnerabilities are sorry and the payment card industry decided to use that database as their mechanism to determine whether their companies meet certain criteria so we don't tell them what to do but we provide the resources that they can measure against and understand whether their criteria are being met before they issue a payment card so let me see if i understand that correctly you don't does not mandate or prescribe any  any standards if you will that p c i has to follow they utilize your database as a tool but there's no requirements and missed provides for them as a career not a regulatory agency except for these the standards for the federal government to use in their cybersecurity are you aware of any organization that has standards that the credit card industry has to follow and for protecting consumer information against cybersecurity crimes i'm not and i'm not aware either and i looked into this i just thought maybe there's there's something out there the reason i bring it up mr chairman and there's no objection i'd like to submit an article from the national journal two seven zero nine decider crime wave into the record that maybe we could review which outlines some of the alarming rates of crime a security breaches that are increasing year to year money lost mr chairman and i make this available for the committee and make sure that we get a copy for the record there is no objection mr chairman no objection so ordered and the reason i say that mr chairman is as we look at this i couldn't agree more with some of our colleagues in the coordination that must take place from a public and private perspective to be able to protect consumers information when they're getting hit in enormous rates i think the average that an individual gets hit back to two thousand and seven anyway that was measured of according to the article was depending on the type of crime between three thousand and thirty five hundred dollars but just depending on what it may hit and we all know that we're trying to help people out more and more today mr chairman that are sometimes getting taken advantage of and this is an area where i think we could truly coordinate to provide some of those  protections one of the things mr chairman that vendors as an example are required to do is to actually keep this data and then back it up and then those are some of the areas where the largest breaches occur the article highlights of reach that most of us are familiar with the teaching that i think is ninety million records were actually taken advantage of and to see truly what the requirement of the merchants our vendors are as we're looking at the cyber security loophole that  sometimes to take place and see what we can learn from there to be able to help individuals out this is something that we touched on a little bit in our homeland security meeting committee hearing not too long ago mr chairman and i thought was important to bring up  and so i know that we read a lot about this and what i would ask mr chairman to my witnesses today are able to provide us with any thoughts or ideas whether they support that point that was brought up or if they have suggestions on what can be brought up in between before i go to you i would just like to highlight the point i was trying to make earlier mr chairman around the expertise that we have within some of our n s c laboratories who have to deal with cyber attacks on a daily basis and not only do they have the sophistication from a technological perspective on some of the data sets that they've compiled with how we can combat some of these attacks but they have an interface with the government and private sector as well especially because of the nature of them being classified and also being civilian organizations because of how the they've been created and then we look to them to see how we could utilize that expertise with the time remaining mr chairman i go to i'd like to just civically mention the inner agency coordination that is that led to our new draft publication eight hundred fifty three which is the recommended security controls that can be used for low medium or high risk systems and the agreement across the director of national intelligence c i a o the d o d this committee for national security systems and of course in this so that there is one baseline for all of federal government which enables the vendors to sell into the government much more easily and then the other agencies that have much higher security requirements than what it is normally promulgated can set their their their standards higher than that so this is just recently released and it's a true outcome of the coordination particularly in the response to the cybersecurity review  thank you very much and i want to want to thank you all for appearing before the committee this afternoon the record will remain open for two weeks for additional statements from members and for answers to any follow up questions for the committee may ask of witnesses the witnesses are excused and the hearing is now adjourn