U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

66–677 PDF 2012

S. Hrg. 112–219 

INFORMATION SHARING IN THE ERA 

OF WIKILEAKS: BALANCING SECURITY 

AND COLLABORATION 

HEARING 

BEFORE THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

OF THE

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

MARCH 10, 2011 

Available via the World Wide Web: http://www.fdsys.gov/ 

Printed for the use of the 

Committee on Homeland Security and Governmental Affairs 

( 

(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

JOSEPH I. LIEBERMAN, Connecticut, Chairman 

CARL LEVIN, Michigan 

DANIEL K. AKAKA, Hawaii 

THOMAS R. CARPER, Delaware 

MARK L. PRYOR, Arkansas 

MARY L. LANDRIEU, Louisiana 

CLAIRE MCCASKILL, Missouri 

JON TESTER, Montana 

MARK BEGICH, Alaska 

SUSAN M. COLLINS, Maine 

TOM COBURN, Oklahoma 

SCOTT P. BROWN, Massachusetts 

JOHN MCCAIN, Arizona 

RON JOHNSON, Wisconsin 

JOHN ENSIGN, Nevada 

ROB PORTMAN, Ohio 

RAND PAUL, Kentucky 

MICHAEL L. ALEXANDER, Staff Director 

CHRISTIAN J. BECKNER, Associate Staff Director for Homeland Security 

Prevention and Protection 

JEFFREY E. GREENE, Senior Counsel 

NICHOLAS A. ROSSI, Minority Staff Director 

BRENDAN P. SHIELDS, Minority Director of Homeland Security Policy 

LUKE P. BELLOCCHI, Minority Counsel 

TRINA DRIESSNACK TYRER, Chief Clerk 

PATRICIA R. HOGAN, Publications Clerk and GPO Detailee 

LAURA W. KILBRIDE, Hearing Clerk 

(III) 

C O N T E N T S 

Opening statements: Page 

Senator Lieberman ........................................................................................... 1 

Senator Collins ................................................................................................. 3 

Senator Brown .................................................................................................. 14 

Prepared statements: 

Senator Lieberman ........................................................................................... 29 

Senator Collins ................................................................................................. 31 

WITNESSES 

THURSDAY, MARCH 10, 2011 

Hon. Patrick F. Kennedy, Under Secretary for Management, U.S. Department 

of State .................................................................................................................. 4 

Teresa M. Takai, Chief Information Officer and Acting Assistant Secretary 

for Networks and Information Integration, U.S. Department of Defense, 

and Thomas A. Ferguson, Principal Deputy Under Secretary for Intelligence, U.S. Department of Defense .................................................................. 7 

Corin R. Stone, Intelligence Community Information Sharing Executive, Office of the Director of National Intelligence ....................................................... 9 

Kshemendra Paul, Program Manager, Information Sharing Environment, Office of the Director of National Intelligence ....................................................... 11 

ALPHABETICAL LIST OF WITNESSES

Ferguson, Thomas A.: 

Testimony .......................................................................................................... 7 

Joint prepared statement with Teresa Takai ................................................. 44 

Kennedy, Hon. Patrick F.: 

Testimony .......................................................................................................... 4 

Prepared statement .......................................................................................... 33 

Paul, Kshemendra: 

Testimony .......................................................................................................... 11 

Prepared statement .......................................................................................... 59 

Stone, Corin R.: 

Testimony .......................................................................................................... 9 

Prepared statement .......................................................................................... 52 

Takai, Teresa M.: 

Testimony .......................................................................................................... 7 

Joint prepared statement with Thomas Ferguson ......................................... 44 

APPENDIX 

Thomas E. McNamara, Former Program Manager of the Information Sharing 

Environment at the Office of the Director of National Intelligence, prepared 

statement .............................................................................................................. 68 

Markle Task Force on National Security in the Information Age, prepared 

statement .............................................................................................................. 72 

Responses to post-hearing questions for the Record from: 

Mr. Kennedy ..................................................................................................... 81 

Ms. Takai and Mr. Ferguson ........................................................................... 86 

Ms. Stone ........................................................................................................... 102 

Mr. Paul ............................................................................................................ 105 

(1) 

INFORMATION SHARING IN THE ERA 

OF WIKILEAKS: BALANCING SECURITY 

AND COLLABORATION 

THURSDAY, MARCH 10, 2011 

U.S. SENATE,

COMMITTEE ON HOMELAND SECURITY AND

GOVERNMENTAL AFFAIRS, 

Washington, DC. 

The Committee met, pursuant to notice, at 3:06 p.m., in room 

SD–342, Dirksen Senate Office Building, Hon. Joseph I. Lieberman, Chairman of the Committee, presiding. 

Present: Senators Lieberman, Collins, and Brown. 

OPENING STATEMENT OF CHAIRMAN LIEBERMAN 

Chairman LIEBERMAN. The hearing will come to order. Good 

afternoon and thanks for your patience. We just were able to, Senator Collins and I, vote early. And I want to apologize in advance. 

I am going to have to step out for about 15 minutes in about a halfhour, but I shall return. 

In just 6 months and a day, we will mark the 10th anniversary 

of the attacks of September 11, 2001, and we will honor the memory of the nearly 3,000 people who were murdered that day in 

America. 

Our mourning over their deaths has always been compounded by 

the knowledge that those attacks might have been prevented—certainly that was the implication of the 9/11 Commission Report— 

had our intelligence and law enforcement agencies shared the disparate facts they had gathered, enabling us to connect the dots. 

To prevent this from happening again, Congress passed several 

laws intended to strengthen information sharing among critical 

Federal agencies. Those acts included the Homeland Security Act, 

the Intelligence Reform and Terrorism Prevention Act (IRTPA), 

and the USA PATRIOT Act. 

Since then, the Executive Branch, I think, has made significant 

improvements in its information-sharing systems, and there is no 

question that far more information is now available to partners in 

other agencies who have a legitimate need for it. 

All this intelligence is further brought together at key nodes, 

such as the National Counterterrorism Center (NCTC), where it 

can be examined by intelligence specialists from a variety of agencies working together under one roof. And as a result, we have seen 

a number of successes in recent domestic and military counterterVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000005 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
2 

rorism operations that I think were thanks to that kind of information sharing, and I am going to cite some examples in a moment. 

But this Committee’s recent report on the Fort Hood attack 

shows that information sharing within and across agencies is nonetheless still not all it should be, and that allowed in that case a 

‘‘ticking time bomb,’’ namely Major Nidal Hasan, now accused of 

killing 13 and wounding 32 others at Fort Hood, to radicalize right 

under the noses of the Department of Defense (DOD) and the Federal Bureau of Investigation (FBI). So we need to continue improving our information-sharing strategies. 

Now I fear the WikiLeaks case has become a rallying cry for an 

overreaction for those who would take us back to the days before 

September 11, 2001, when information was considered the property 

of the agency that developed it and was not to be shared. 

The bulk of the information illegally taken and given to 

WikiLeaks would not have been available had that information not 

been on a shared system, so the critics of information sharing 

argue. 

But to me this is putting an axe to a problem that requires a 

scalpel and misunderstands what happened in the WikiLeaks case 

and I think misstates the solution to the problem. We can and 

must prevent another WikiLeaks without also enabling Federal 

agencies, in fact, perhaps compelling Federal agencies to reverse 

course and return to the pre-September 11, 2001, culture of hoarding information. 

We need to be smarter about how information is shared and appropriately balance security concerns with the legitimate needs of 

the users of different types of information. Methods and technologies for doing so already exist. Some of them I gather have 

been put into place since the WikiLeaks case, and we need to make 

sure that we utilize them as fully as possible across our government. 

The bottom line is we cannot walk away from the progress we 

have made that has saved lives. I will give you a couple of quick 

examples. 

U.S. Special Forces and elements of the intelligence community 

have shared information and worked exceptionally well together in 

war zones to combat and disrupt terrorist groups such as al-Qaeda 

in Iraq and the Taliban in Afghanistan. And that would not happen 

without information sharing. 

Here at home, we have used information sharing to enhance the 

role of State, local, tribal, and private sector entities in our fight 

against terrorists. And those efforts have paid off—most recently in 

the case of a chemical supply company in North Carolina that 

alerted the FBI to suspicious purchases by a Saudi Arabian student in Texas who turned out to be building improvised explosive 

devices. 

So we need to fix what is broken without going backwards. Today 

I look forward to hearing from each of our witnesses about what 

they are planning to do to improve the security of classified networks and information, while still ensuring that information is 

shared effectively in the interest of our Nation’s security. 

I would also like to hear how Congress can work with you on 

these efforts either with legislation or through more targeted fundVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000006 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
3 

ing. Efficiently sharing classified information while effectively securing that information is critical to our Nation’s security and our 

national values. We can and must have both. 

Senator Collins. 

OPENING STATEMENT OF SENATOR COLLINS 

Senator COLLINS. Thank you, Mr. Chairman. 

Effective information sharing among Federal law enforcement 

and civilian and military intelligence agencies is critical to our security. The 9/11 Commission found that the failure to share information across the government crippled efforts to detect and potentially prevent the attacks on September 11, 2001. Improving this 

communication was a critical part of the Intelligence Reform and 

Terrorism Prevention Act that Senator Lieberman and I authored 

in 2004. 

The WikiLeaks breach should not prompt a knee-jerk reaction on 

the sharing of vital information and its use by those analysts who 

need it to do their jobs. We must not let the astonishing lack of 

management and technical controls that allowed a private in the 

army to allegedly steal some 260,000 classified State Department 

cables and some 90,000 intelligence reports to send us back to the 

days before September 11, 2001. 

Unfortunately, we continue to see agency cultures that resist 

sharing information and coordination with their law enforcement 

and the intelligence counterparts. Almost 10 years after September 

11, 2001, we still witness mistakes and intelligence oversights 

reminiscent of criticisms predating our reforms of the intelligence 

community. Among those cases where the dots were not connected 

and information was not effectively shared are Abdulmutallab, the 

so-called Christmas Day bomber, and Nidal Hasan, the Fort Hood 

shooter. 

At the same time, as the Chairman has pointed out, there have 

been several cases that underscore the incredible value and benefit 

of information sharing, and an example is, as the Chairman has 

noted, the case of Mr. Zazi, whose plans to bomb the New York 

City subway system were thwarted. 

As such successes remind us, we must not allow the WikiLeaks 

damage to be magnified twofold. Already the content of the cables 

may have compromised our national security. There have been 

news reports describing the disclosure of these communications as 

having a chilling effect on our relationships with some of our closest allies. More important, however, they likely have put at risk 

some of the lives of citizens, soldiers, and partners. 

Longer lasting damage could occur if we allow a culture to reemerge in which each intelligence entity views itself as a separate 

enterprise within the U.S. counterterrorism structure, with each 

attempting to protect what it considers to be its own intellectual 

property by not sharing it with other counterterrorism agencies. If 

those stovepipes reappear or worsen, we will certainly be in more 

danger. 

Such a step backward would run counter to the policy goals embodied in the 2004 Intelligence Reform Act, articulated by law enforcement and the intelligence community leadership, and underscored in multiple hearings before this Committee; and, that is, to 

4 

1The prepared statement of Mr. Kennedy appears in the Appendix on page 33. 

effectively detect and thwart terrorists, the ‘‘need to share’’ must 

replace the ‘‘need to know.’’ 

I would also like to hear today about the possible technological 

solutions to the problems that allowed for the disclosures to 

WikiLeaks. For example, my credit card company can detect outof-the-ordinary charges on my account almost instantaneously. Yet 

the military and intelligence communities were apparently unable 

to detect more than a quarter million document downloads in less 

than 2 months. Surely, the government can make better use of the 

technology currently employed by the financial services industry. 

It is also notable that the intelligence community was already required to install some audit capabilities in its systems by the 2007 

homeland security law, which we authored, that could well have included alerts to supervisors of suspicious download activity. Had 

this kind of security measure been in place, security officers might 

have detected these massive downloads before they were passed on 

to WikiLeaks. 

Technology and innovation ultimately should help protect information from unauthorized disclosure, while facilitating the appropriate sharing of vital data. 

I would also like to explore today the implementation of rolebased access to secure classified information. Instead of making all 

information available to anyone who has access to a classified system, under this model, information is made available in a targeted 

manner based on individuals’ positions and the topics for which 

they are responsible. Access to information not directly relevant to 

an individual’s position or responsibilities would require the approval of a supervisor. 

We must craft security solutions for the 21st Century and beyond. We live in a world of Twitter and instantly viral videos on 

YouTube. We must strive to strike the appropriate balance that 

protects classified and sensitive information while ensuring the effective sharing of vital data. We can use the most cutting edge 

technology to protect the traditional tools of statecraft and intelligence—those tools of relationships and information. 

Thank you, Mr. Chairman. 

Chairman LIEBERMAN. Thank you, Senator Collins, for that 

thoughtful opening statement. 

I want to thank the witnesses who are before us for coming, also 

for the thoughtful written testimony you have submitted to the 

Committee, which will, without objection, be included as part of the 

record. 

Now we will begin with Patrick Kennedy, who is Under Secretary for Management at the Department of State. Welcome, Mr. 

Kennedy. 

TESTIMONY OF HON. PATRICK F. KENNEDY,1 UNDER 

SECRETARY FOR MANAGEMENT, U.S. DEPARTMENT OF STATE 

Mr. KENNEDY. Thank you very much. Chairman Lieberman, 

Ranking Member Collins, and Senator Brown, thank you for this 

opportunity to address information sharing after WikiLeaks and to 

discuss Executive Branch efforts to ensure that information is 

5 

shared effectively yet securely and in a manner that continues to 

advance our national security. The State Department and our 

interagency partners have long been working to obtain both appropriate information sharing and protection, and after WikiLeaks, we 

have focused renewed attention on achieving these dual objectives. 

From my perspective, serving over 30 years with the State Department, both overseas and in Washington, and also serving as 

the first Deputy Director of National Intelligence for Management, 

I especially appreciate your efforts to address with us the challenges of information sharing and security. I can assure you that 

we at the State Department remain committed to fully sharing our 

diplomatic reporting within the interagency with safeguards that 

are reasonable, pragmatic,and responsible. 

For diplomatic reporting, the State Department has historically 

communicated between Washington and overseas posts through 

messages which convey internal deliberations relating to our foreign relations and candid assessments of overseas conditions. This 

reporting provides the State Department and other U.S. Government agencies crucial information essential to advancing our national interests, and we continue to this day to share this reporting 

through automatic dissemination to over 65 U.S. Government agencies. 

In late November 2010, when the press and WikiLeaks announced the release of purported State Department cables, we immediately established a 24/7 WikiLeaks Working Group of senior 

State Department employees; we did suspend the Secret Internet 

Protocol Router Network (SIPRNet) to Net Centric Diplomacy, the 

database of State Department cables, while retaining all of our 

other distribution systems to other agencies. We also created a 

mitigation team to address policy, legal, and counterintelligence 

issues. 

For continued mitigation efforts, both within the State Department and interagency, we continue to deploy an automated tool 

that monitors State’s classified network to detect anomalies not 

otherwise apparent, backed up by a staff who analyze these anomalies. Cable distribution has been limited to the Joint Worldwide Intelligence Communications System and our traditional system that 

reaches out, as I said, to 65 agencies. We are now evaluating other 

systems for distribution, such as a searchable database that relies 

on metadata. 

The State Department has continued to work with information 

management issues interagency through the Interagency Policy 

Committee (IPC), chaired by the White House’s Special Adviser for 

Information Access and Security, as well as through existing IPCs. 

The challenges of grappling with the complexities are threefold. 

The first is ensuring information-sharing policies are consistently 

directing the use of technology to solve problems, not the other way 

around. Post-September 11, 2001, the focus was on providing technical solutions to information sharing. As a result, technical experts were asked to develop solutions to the barriers. The postWikiLeaks environment reminds us that technology is a tool to execute solutions but it is not in itself the answer. Simply put, we 

must more consistently sort out what we need to share before determining how to share it. Connecting systems and networks may 

6 

provide the means to share information, but we must still manage 

and share this content in an effective and efficient way, as both of 

you mentioned in your opening statements. 

The national security community must do a better job of articulating what information is appropriate to share with the widest appropriate distribution and what is more appropriately confined to 

a narrower audience across the community in order to ensure adequate safeguards. The State Department believes that the way in 

which we share messages through our traditional means of dissemination and the steps we have taken since November are leading us firmly in that direction. 

The second main challenge involves each agency’s rigorous adherence to existing and improved information security policies, as 

both of you have noted. This includes improved training in the use 

of labels to indicate appropriate breadth of dissemination. The Executive Order on classified information establishes the basic levels 

of classification. From that foundation, individual agencies may 

still have their own captions that denote how information should 

be disseminated because obviously not every person with a security 

clearance needs every piece of worldwide information. Agencies 

that receive information need to understand how to handle that 

captioned information so that it is not inappropriately made available to too wide an audience. 

The Office of Management and Budget (OMB) has directed agencies to address security, counterintelligence, and information issues 

through special teams. We believe that our Mitigation Team serves 

as a model for broad, cross-discipline coordination, or governance 

because it brings together the various subject matter experts. Many 

information-sharing and security issues can be resolved at the 

agency level as long as there are standards in place for agencies 

to execute. For the most part, standards have been created by existing interagency bodies, but there are some areas where further 

coordination is needed. 

The third main challenge involves the coordination, or governance, of information management. Numerous interagency groups 

are wrestling with the issues related to technological aspects of information sharing, such as those dealing with standards, data 

standards, systems, and networks. Others are wrestling with the 

policy decisions of who should have access to what information. 

New interagency governance structures to coordinate information 

sharing have been developed, including those focused, as you rightly note, on sharing with State, local, and tribal governments, as 

well as with foreign partners. In keeping with the first challenge, 

these new structures should maintain or increase focus on defining 

the content to be shared and protected as well as on the technology 

which is to be shared and used. Each agency must be confident 

that security processes and procedures are applied in a uniform 

and consistent manner in other organizations. And, in addition, it 

must be understood that material originating in one agency will be 

treated by other agencies in accordance with mutually understood 

handling instructions. 

The State Department shares information with the intent of providing the right people with the right information at the right time. 

We will continue to share our diplomatic reporting in order to adVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000010 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
7 

1The joint prepared statement of Ms. Takai and Mr. Ferguson appears in the Appendix on 

page 44. 

vance our national security information. We recognize the imperative to make diplomatic reporting and analysis available throughout the entire interagency community. The State Department will 

continue to do this in order to fulfill our mission. 

We remain committed to both appropriately sharing and protecting critical national security information, but this commitment 

requires, as you have noted, addressing multiple, complex issues. 

We must find the right policies; we must find the right technologies; and we must continue to share. 

Thank you for this opportunity to appear before you today. I look 

forward to working with you on the challenges and would be 

pleased at the right time to respond to any questions you might 

have. Thank you. 

Chairman LIEBERMAN. Thanks very much, Secretary Kennedy. 

Now we are going to hear from Teresa Takai, Acting Assistant 

Secretary for Networks and Information Integration, Chief Information Officer, U.S. Department of Defense. Welcome. 

TESTIMONY OF TERESA M. TAKAI,1 CHIEF INFORMATION OFFICER AND ACTING ASSISTANT SECRETARY FOR NETWORKS 

AND INFORMATION INTEGRATION, U.S. DEPARTMENT OF 

DEFENSE, AND THOMAS A. FERGUSON, PRINCIPAL DEPUTY 

UNDER SECRETARY FOR INTELLIGENCE, U.S. DEPARTMENT 

OF DEFENSE 

Ms. TAKAI. Thank you, sir. Thank you for that introduction. 

Chairman Lieberman, Ranking Member Collins, and Senator 

Brown, thank you for the invitation to provide testimony on what 

the Department of Defense is doing to improve the security of its 

classified networks while ensuring that information is shared effectively. 

As noted, I am Teri Takai, and I serve as the principal adviser 

to the Secretary of Defense for Information Management, Information Technology, and Information Assurance, and as such am responsible for the security of the Department’s networks and then 

coordinating the Department’s mitigation efforts in response to the 

WikiLeaks incident. 

With me is Tom Ferguson, Principal Deputy Under Secretary for 

Intelligence. He serves as the principal staff adviser to the Under 

Secretary of Defense for Intelligence and is responsible for policy 

and strategic oversight of all DOD intelligence, counterintelligence, 

and security policy, plans, and programs, as delegated by the 

Under Secretary for Intelligence. In this capacity, Mr. Ferguson 

oversees the development and implementation of the Department’s 

information-sharing policies. 

Mr. Ferguson and I have submitted a detailed statement for the 

record, but I would like to briefly highlight a few of the Department’s efforts to better protect its sensitive and classified networks 

and information while ensuring its ability to share critical information with other partners and agencies is continued. 

Immediately following the first release of documents on the 

WikiLeaks Web site, the Secretary of Defense commissioned two inVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000011 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
8 

ternal DOD studies. The first study directed a review of DOD information security policy. The second study focused on procedures for 

handling classified information in forward-deployed areas. Results 

of the two studies revealed a number of findings, notably that: Forward-deployed units maintained an overreliance on removable electronic storage media; second, roles and responsibilities for detecting 

and dealing with an insider threat needed to be better defined; 

and, finally, limited capability existed to detect and monitor anomalous behavior on classified computer networks. 

The Department immediately began working to address the findings and improve its overall security posture to mitigate the possibility of another similar type of disclosure. The most expedient 

remedy for the vulnerability that led to WikiLeaks was to prevent 

the ability to remove large amounts of data from the Department’s 

secret classified network using removable media, such as discs, 

while allowing a small number of computers to retain, under strict 

controls, the ability to write removable media for operational reasons. The Department has completed disabling the write capability 

on all of its SIPRNet machines except for approximately 12 percent 

that maintain that capability for operational reasons, largely in deployed areas of operation. The machines that maintain write capability are enabled under strict controls, such as using designated 

kiosks with two-person controls. 

We are also working actively with National Counterintelligence 

Executive on its efforts to establish an information technology insider detection capability and an Insider Threat program. Mr. Ferguson’s organization is leading that effort for the Department of 

Defense, and they have been developing comprehensive policy for 

a DOD Counterintelligence Insider Threat Program. 

In addition, DOD is developing Web-enabled information security 

training that will complement DOD’s mandatory annual information assurance training, and the Joint Staff is establishing an oversight program that will include inspection of forward-deployed 

areas. 

As DOD continues efforts to improve our information-sharing capabilities, we will strive to implement the mechanisms necessary 

to protect the intelligence information without reverting back to 

pre-September 11, 2001, stovepipes. DOD is working closely with 

its interagency partners, several of whom join me here today, to 

improve intelligence information sharing across the government 

while ensuring the appropriate protection and safeguards are in 

place. 

I would like to conclude by emphasizing that the Department 

continues to work towards a resilient information-sharing environment that is secure through both technological solutions and comprehensive policies. Mr. Ferguson and I thank the Committee for 

the opportunity to appear before you today, and we look forward 

to answering your questions. 

Senator COLLINS [presiding]. Thank you. 

Mr. Ferguson, I am told that you do not have a prepared statement. Is that correct? 

Mr. FERGUSON. That is correct. Ms. Takai has a nicer voice than 

I do and has given our joint statement. 

Senator COLLINS. Thank you. 

9 

1The prepared statement of Ms. Stone appears in the Appendix on page 52. 

Before I turn to our next witness, we have been joined by Senator Brown, and I just wanted to give him an opportunity for an 

opening statement if you would like to have one. 

Senator BROWN. Thank you. I am actually eager to hear from the 

witnesses and ask questions, but thank you for the offer. 

Senator COLLINS. Thank you. Then we will proceed. 

Our next witness is Corin Stone, who is the Intelligence Community Information Sharing Executive from the Office of the Director 

of National Intelligence (ODNI). We welcome you. Please proceed 

with your testimony. 

TESTIMONY OF CORIN R. STONE,1 INTELLIGENCE COMMUNITY 

INFORMATION SHARING EXECUTIVE, OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE 

Ms. STONE. Thank you, ma’am. Chairman Lieberman, Ranking 

Member Collins, and Senator Brown, thank you for inviting me to 

appear before you today to discuss the intelligence community’s 

progress and challenges in information sharing. I want to first recognize the Committee’s leadership on these important issues and 

thank you for your continued support as we address the many 

questions associated with the need to share information and the 

need to protect it. Your leadership and oversight of information 

sharing, especially as we come up to the 10-year anniversary of 

September 11, 2001, has been invaluable. I look forward to our continued participation and partnership on this complex and vitally 

important issue. 

As the Intelligence Community Information Sharing Executive, I 

am the Director’s focal point for all intelligence community information-sharing matters, providing guidance, oversight, and direction on information-sharing priorities and initiatives across the 

community. In that capacity, I work in coordination with my colleagues at the table and across the community on comprehensive 

and strategic management information sharing, both internally and 

with all of our mission partners. 

My main focus today concerns information that is derived from 

intelligence sources and methods or information that is reflected in 

the analytic judgments and assessments that the intelligence community produces. I want to be clear, though, that our concern for 

the protection of information is not only narrowly focused on 

sources and methods. 

As we have seen recently through WikiLeaks, the unauthorized 

disclosure of classified information has serious implications for the 

policy and operational aspects of national security. We all have networks that must be secured, and as technology continues to advance, my colleagues and I remain deeply committed to keeping up 

with the ongoing challenges we face. 

I am acutely aware that our major task is to find what the Director of National Intelligence (DNI) has termed ‘‘the sweet spot’’ between the two critical imperatives of sharing and protecting information. Every day our officers work tirelessly to tackle challenges 

of increasing complexity in a world that is interconnected, fastpaced, and ever changing, sharing vital information with each 

10 

other, customers and partners, leading to better prepared senior 

policymakers across the Executive Branch and Congress. 

It is important to note that the community’s work on these complicated questions predates the recent unauthorized disclosures by 

WikiLeaks. As you know, the challenges associated with both sharing and protecting intelligence are not new and have been the subject of major effort in the intelligence community for years. However, these latest unauthorized disclosures underscore the importance of our ongoing and comprehensive efforts to address these 

evolving challenges. 

Working with the whole of government to address these issues, 

the intelligence community’s strategy involves three interlocking 

elements. 

The first is access, ensuring that the right people can discover 

and have access to the networks and information they need to perform their duties, but not to information that they do not need. 

The second element is technical protection, technically limiting 

the ability to misappropriate, manipulate, or transfer data, especially in large quantities. 

And the third area is auditing and monitoring, taking actions to 

give the intelligence community day-to-day confidence that the information access granted to our personnel is being properly used. 

As we work to both share and protect networks and information, 

we must never lose sight of the sweet spot. As we continue to increase how much information is shared, we must also increase the 

protections in place to ensure information is being properly used 

and safeguarded. This is the only way to create the necessary trust 

and confidence in our systems that will foster appropriate information sharing. It is a matter of managing risk, and people, policies, 

processes, and technology all play important interconnected roles in 

managing that risk. 

However, it is also important to note that while all of our capabilities can reduce the likelihood and impact of unauthorized disclosures, in the final analysis our system is based on trust—trust in 

the individuals who have access to classified information and trust 

that they will be responsible stewards of this Nation’s most sensitive information. 

Whether classified information is acquired by a computer system, 

a classified document, or simply heard in a briefing or a meeting, 

we have had bad apples who have misused this information before, 

and we will, unfortunately, have them again. This reality does not 

mean we should err on the side of not sharing; rather, we must put 

all proper safeguards in place, continue to be forward leaning to 

find a threat before disclosures occur, be mindful of the risks, and 

manage those risks with the utmost diligence. 

Thank you for the Committee’s time, and I welcome your questions. 

Senator COLLINS. Thank you. 

Our final witness on the panel this afternoon is Kshemendra 

Paul, who is the Program Manager for Information Sharing Environment of the Office of the Director of National Intelligence. Welcome, Mr. Paul. 

11 

1The prepared statement of Mr. Paul appears in the Appendix on page 59. 

TESTIMONY OF KSHEMENDRA PAUL,1 PROGRAM MANAGER, 

INFORMATION SHARING ENVIRONMENT, OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE 

Mr. PAUL. Thank you, Chairman Lieberman, Ranking Member 

Collins, and Senator Brown. Thank you for the opportunity to 

speak about our efforts to effectively share and protect information 

at every level of government. Thank you for your attention to information-sharing reform efforts and your support of my office’s mission. I also want to recognize my fellow panelists, key partners in 

government-wide efforts to further strengthen information sharing 

and protection. 

As the WikiLeaks story emerged, concerns were voiced that the 

information-sharing efforts would suffer a setback. This Administration is committed to strengthening both information sharing and 

information protection. While complex and challenging, we do not 

see these goals as conflicting. Guidance throughout the Executive 

Branch has been consistent. We need to accelerate information 

sharing in a responsible and secure way. 

The WikiLeaks breach is not principally about information-sharing challenges. A bad actor allegedly violated the trust placed in 

him. While we cannot always stop bad actors, we can and must 

take this opportunity to reassess our posture, our progress, and our 

focus related to improving and strengthening information sharing 

and protection. 

The challenges highlighted by the WikiLeaks breach are complex 

and go to deeply rooted issues: First, the perpetuation of agencybased, bilateral, and fragmented solutions versus common and comprehensive approaches to information sharing and protection; second, the need to improve our counterintelligence posture and some 

of the other technical considerations that my fellow panelists have 

talked to; and, finally, while the breach involves classified information, we need to be mindful that the root cause issues and the sensitivities extend to sensitive but unclassified information also. It is 

a whole-of-government problem, not just a classified national security problem. 

I would like to clarify the information-sharing environment and 

my role. The purpose of the information-sharing environment is to 

improve the sharing of terrorism-, homeland security-, and weapons of mass destruction-related information across Federal, State, 

local, and tribal agencies and with our partners in the private sector and internationally. 

The information-sharing environment spans five communities: 

Defense, intelligence, homeland security, law enforcement, and foreign affairs. It is defined as a cross-cutting, horizontal, data-centric, trusted information-sharing and protection capability. My role 

is to plan for and oversee the agency-based buildout, and manage 

the information-sharing environment. But my office is not operational. Agencies own the mission, agencies set policies and procedures, and agencies make the investments that interconnect our 

networks, databases, applications, and business processes. These 

agency-based contributions together form the information-sharing 

environment. 

12 

The law grants the program manager’s role governmentwide authority. This authority is exercised primarily two ways: First, I am 

the co-chair of the White House’s Information Sharing and Access 

Interagency Policy Committee; through that role, we work through 

policy and oversight issues; and, second, through my partnership 

with the Office of Management and Budget. 

We are being deliberate and collaborative in our approach to further strengthening information sharing and protection. We have 

put an emphasis on governance and outreach. My office, together 

with my mission partners, is leading the refresh of the 2007 National Strategy for Information Sharing. We are using this opportunity to leverage common mission equities to drive common policies and capabilities. And we are orchestrating specific agency-led 

sharing and protection initiatives with our partners. 

We believe this work provides a framework for strengthening 

efforts to address the root cause issues associated with the WikiLeaks breach. These capabilities will result in further assuring the 

proper sharing and protection of information. 

Our work across mission partners is profiled in our annual report 

to the Congress delivered every summer. I also encourage those interested in following or influencing our efforts to visit our Web site 

and to participate in upcoming online dialogues aimed at shaping 

our future direction. 

In closing, our efforts have been and continue to be focused on 

accelerating information sharing in a secure and responsible way. 

Effective information sharing and collaboration are absolutely essential to keeping the American people safe. 

Thank you for the opportunity to participate in this hearing. I 

also would appreciate any comments, directions, support, or feedback that you can provide to me in my office. My fellow panelists 

and I look forward to your questions. 

Senator COLLINS. Thank you very much for your testimony, and 

I thank all of the witnesses. 

I want to express my personal frustration with this issue. Our 

Committee has held hearings on the lack of information sharing in 

the case of Abdulmutallab, where credible information was given to 

our embassy in Africa but did not make its way in a timely fashion 

to the National Counterterrorism Center and, thus, Abdulmutallab 

was not listed on the No Fly List. So there is an example of credible information that should have been shared across government 

but was not. 

Similarly, in our investigation into the Fort Hood attacks, we 

found that credible information about Major Hasan’s communications with a known terrorist suspect was not shared by the Joint 

Terrorism Task Force with the Army—another terrible failure in 

information sharing. 

Now, there have been successes as well. But I mention those two 

failures to contrast and raise such questions with how an Army 

private allegedly was able to download hundreds of thousands of 

classified documents, cables, and intelligence reports without being 

detected, and that baffles me. It also frustrates me because in 

2007, Senator Lieberman and I authored homeland security legislation that included a requirement that military and intelligence 

agencies install audit capabilities with robust access controls on 

13 

classified systems. And those technologies that would enable us to 

audit information transmission and authenticate identities for access control are not new. They are widely used. And the serious 

cyber risks associated with the use of removable media devices, 

such as thumb drives, have been known for many years. 

How did this happen? How could it be that a low-level member 

of the military could download such a volume of documents without 

it being detected for so long? That truly baffles me. I do not know 

who to start with. Mr. Ferguson, do you want to take a crack at 

that? 

Mr. FERGUSON. I will be the first in the pond. Let me take it in 

a couple steps. Your question has a lot of parts to it. 

The rank of Private Bradley Manning is really not so much the 

issue. It was what his responsibilities were. He was there to provide intelligence support for military operations. So we do not base 

it necessarily on a rank structure. We base it on what is his mission responsibilities to support the military. 

To get to your question about how was he able to access so much 

data, and then I will get to the part about what have we done and 

why didn’t we do what we could have done. The situation in the 

theater is such that—or was. It has changed now. But we took a 

risk, essentially is what it is. We took a risk that by putting the 

information out there, share information, provide agility, flexibility 

of the military forces, they would be able to reach into any of the 

databases on SIPRNet. They would be able to download that information, and they would be able to move the information using removable media across various domains, whether it is across security domains or from U.S. systems to coalition systems. And we did 

that so they could do this very rapidly. 

Here in the Continental United States (CONUS) many of the 

things you have talked about, about closing off open media ports 

and so forth, actually have been in place for a decade or more. If 

you go to many of the agencies, they actually are not able to access 

those open ports. But the focus in the theater was speed and agility, so we took that risk to allow not just Private Manning but 

many people who are serving there to move at that pace. 

You asked about why we did not put in place capabilities that 

were in your bill. In fact, as early as 2008, we started to deploy 

what is called the Host Based Security System (HBSS), as early as 

2008. And at the time of Private Manning’s alleged activities, about 

40 percent of the systems in CONUS actually had that system in 

place. The systems were not—that was not available in the theater. 

Senator COLLINS. And why wasn’t it? 

Mr. FERGUSON. Mainly because of a lot of the systems there are, 

for lack of a technical term, cobbled together, and placing those 

kinds of systems—they are not all equal. It is sort of a family of 

systems there, and it is not just like working for Bank of America 

where they have one homogeneous system and they can insert 

things and take things out as it works. You have multiple systems 

and putting in new intrusion software or monitoring tools and so 

forth, you have to approach each system differently. And that is 

part of the problem. 

So basically to get away from that and not hold up the ability 

to move information, they took on the risk by saying, look, these 

14 

people are cleared. They go through background investigations, 

and, frankly, most of our focus was right about outside intruder 

threat, not inside threat. 

So in the end, to answer your questions—we had ourselves a situation where we had information sharing at this level, and we took 

the risk of having monitoring tools and guards and passwords and 

so forth, as well as people did not fully implement policies, they did 

not follow security rules down at this level. So the problem is that 

is where we made our mistake. We allowed this to occur when we 

were sharing information at this level. So what we are trying to fix 

today is not take this level of information sharing and moving it 

down here, which you have referred to in your opening statement, 

but take this and move it up here. And that is what we are trying 

to do as rapidly as we can. 

Senator COLLINS. Thank you. 

Mr. Kennedy, Mr. Ferguson basically explained that DOD, in the 

interest of making sure that the information was out there in theater, took a risk, but that does not explain to me how the private 

would have access to State Department classified cables that had 

nothing to do with the country for which the private was involved 

in intelligence activities. So how did it happen that he had access 

to classified State Department cables, involving countries that had 

nothing to do with his intelligence responsibilities? 

Mr. KENNEDY. That is a very good question, Senator. Several 

years ago, the Department of Defense and the intelligence community came to the State Department and said, we need the State Department—and actually they paid for it—to push out reporting to 

SIPRNet, which is the Department of Defense worldwide system, 

and to load a number of our cables onto a Defense Department 

database that would be accessible to Defense Department people. 

So in response to their request, we took a selected element of our 

cables and pushed those out to the Department of Defense’s database. 

To be blunt, we believe in the interest of information sharing 

that it would be a grave mistake and a danger to the national security for the State Department to try to define in each and every one 

of the 65 agencies that we share our diplomatic reporting analysis 

with to say that Private Smith should get this cable, Lieutenant 

Jones should get that cable, Commander X should get that cable. 

The policies that have been in place between the State Department 

and other agencies is we provide this information to the other 

agency. The other agency then takes on the responsibility of controlling access by their people to the material that we provide to 

them. 

Senator COLLINS. I will come back to that issue, but I want to 

first give an opportunity for my colleague, Senator Brown, to ask 

his questions. 

OPENING STATEMENT OF SENATOR BROWN 

Senator BROWN. Thank you. You are on a roll, though. 

I have served in the National Guard for 31 years. I am a Lieutenant Colonel. I am on the computers regularly, all that good 

stuff, and I have to tell you, sometimes it is like brain surgery getting on the computer, even for somebody like me who is part of the 

15 

senior staff, and had been a trial defense attorney, just to log on, 

get access, go where I need to go, and I still have not really gotten 

a satisfactory answer as to how this private had complete and total 

access to the documents he had. In my wildest dreams, I could not 

do what he did. 

And then I see, he works 14 hours a day, no one cares. Well, the 

average workload in that region is that and more for many people. 

My understanding, in doing my own due diligence, is that there 

was a complete breakdown of command authority when it came to 

instructing that soldier and people within that command as to the 

do’s and do not’s with regard to information and information sharing. There was no check or balance, and that the amount of people 

that have access to that information has grown by tens of thousands. Hundreds of thousands of people have access to that information on any given day. 

Is that accurate, that that many people have access to that information? Whoever feels qualified to answer it, probably the DOD 

folks. 

Mr. FERGUSON. Let me put it this way: The SIPRNet is a command and control network, just like the Internet. 

Senator BROWN. I know what that is, I am in the military. Can 

you explain to the listeners what that is? 

Mr. FERGUSON. What is the SIPRNet? 

Senator BROWN. Yes. 

Mr. FERGUSON. The SIPRNet is a command and control network 

that maintains Department of Defense classified secret level information that covers a whole portfolio of issues. It is not just intelligence information, for one. It is operations data. It is financial 

programmatic data, personnel data. It covers a very large—— 

Senator BROWN. It is everything. 

Mr. FERGUSON. It is everything. All that information is not available to everyone who is on SIPRNet. A lot of that information, in 

fact, is password protected. But there are sites, just like going on 

the Internet, that if you click on there, if you put in the search for 

that information and it is not password protected, it is available to 

whoever is on the SIPRNet. 

Senator BROWN. All right. So let me just take what you are saying here—and that was not the case with this young soldier. We 

are not just talking about that stuff where you just get online and 

take that stuff. We are talking about that the young person who 

had the ability to not only get that but all the classified documentation as well. Correct? 

Mr. FERGUSON. He was able to get the classified information that 

was not password protected. That is correct. 

Senator BROWN. Right. And is it true that there are hundreds of 

thousands of people that have access to that information still? 

Mr. FERGUSON. That is true. 

Senator BROWN. Once again, I am not a brain surgeon, but I am 

an officer in the U.S. military, and I have difficulty getting that 

stuff. Why haven’t we locked down and basically weeded through 

the people that have access, to make sure they are all our friends? 

Where is the command and control in these types of things? 

16 

Mr. FERGUSON. The command and control, since the SIPRNet is 

really a family of networks, the site owners decide, just like on the 

Internet, who gets access to their particular site. 

Senator BROWN. Right. That is for the open stuff, but I am not 

talking about that. 

Mr. FERGUSON. No. That is for secured information as well. 

Senator BROWN. All right. 

Mr. FERGUSON. So in the case, of course, of the State Department 

information, that has now been removed from SIPRNet, so that is 

not available for everybody to take a look at. 

Senator BROWN. I was kind of surprised they were even on there. 

Mr. FERGUSON. Well, that was a request of the Department of 

Defense and the DNI to put that information on or to make it more 

accessible to people in the intelligence community. 

Senator BROWN. Is the reason why because—listen, I understand 

the moving nature of the battlefield. I believe that a lot of the command and control went away because of the changing nature of the 

battlefield. They needed the information very quickly. Is that a fair 

assessment? 

Mr. FERGUSON. That is a fair assessment. 

Senator BROWN. So knowing that, what checks and balances 

have been put in place, notwithstanding that fact, what are we 

doing? 

Mr. FERGUSON. What they have done—and Ms. Takai can talk 

about the technology behind this. They have closed down all the 

ports. They cannot remove the data. But they also are starting to 

chart and narrow the data access based on mission responsibility, 

for one. It is not going to be as simple as just going in, turning off 

stuff, and just doing a big survey of the SIPRNet, although that 

will probably occur. And then, of course, the moving of the data, 

which was the big concern, is now a two-man rule. As Ms. Takai 

pointed out, 12 percent of the systems now have the ability to remove data and shift it to another domain. The other 88 percent are 

shut down. 

Senator BROWN. Well, he used a thumb drive, right? 

Mr. FERGUSON. He used a compact disc (CD), actually. Oddly 

enough, the thumb drives have been shut off for some time. 

Senator BROWN. That is what I thought. So it was a CD, right? 

Mr. FERGUSON. It was CDs, that is right. He was downloading 

the CDs. So we have a two-man rule. 

Another key piece of this is—I do not know the word to use—a 

failure on the part to monitor and follow security regulations. It is 

as simple as that. 

Senator BROWN. Listen, I agree with you. I know there is a protocol in place. I am still flabbergasted. I mean, here we are, we 

have one of the biggest leaks in my lifetime or my memory, at 

least, in the military, and we have a private who is in trouble. I 

am a little curious. There seems to have been a breakdown completely on that chain of command. 

Mr. FERGUSON. It did not work as well as we had hoped. 

Senator BROWN. And that being said, it has not worked as well 

as you had hoped, is there anything like a red team or an unannounced inspection? Or have you changed the protocol? 

17 

Mr. FERGUSON. Actually there have been investigations looking 

at the entire process for the entire theater. And a lot of the changes 

have occurred in terms of the two-man rule, shutting down of the 

ports, and other security training and so forth has all occurred in 

the last 3 or 4 months. So, yes, they have taken some pretty significant actions already. 

If I may, I would like to pass it to Ms. Takai because she can 

speak to some of the technology that is in place. 

Senator BROWN. And with that, I will take that testimony in a 

second. But that being said, I know all the agencies are actually 

awash with new guidelines and directives. Is there a coordinated 

effort of some kind being made so that policy and oversight are 

staying consistent, that agencies are not left to guess who to listen 

to? Is there someone in charge that basically is dictating what we 

are doing, why we are doing it, how we are doing it, and then following up to say, yes, we are, in fact, doing it? Is there anything 

like that going on? 

Mr. FERGUSON. Yes, I will give you a good example. Their policies for security and use of material was spread across a number 

of policy documents, so if you were sitting in a field or you are in 

the United States and you wanted to find where that policy was, 

you had to go search for it. In hindsight, that was not a good way 

of approaching it. It worked that way for years, decades. 

One of the things we have done is we have updated those policies, and we combined and consolidated them into a single product. 

So there is only one place—it is a one-stop shop to go get that. That 

came out of the Under Secretary of Defense for Intelligence’s office. 

So he sets the guidelines for that information protection assurance 

and security parts. 

In terms of setting rules for information sharing itself, that is 

being done as a community-wide activity, not just with the Department of Defense but with the DNI—this is an approach with all the 

other agencies. So there is one initiative right now underway, and, 

of course, each department is also looking at it individually. 

Mr. PAUL. Can I amplify that? 

Senator BROWN. Yes, please, and then I just have one final question, but sure, yes, absolutely. 

Mr. PAUL. So there is an ongoing White House-led process right 

now looking at the WikiLeaks incident and potential structural reforms. That has three main tracks that are going on, and my panelists and I and others are involved in that process. 

The first part of it is looking at how to better balance things like 

identity management and tagging of information more consistently 

so you can do better kinds of access controls like what were talked 

about in the opening statements. 

The second is looking at the insider threat passbacks and some 

of the technical considerations that we have talked about. 

And the third is looking at how we strengthen governance across 

the spectrum—so the hope is that in the coming weeks and months 

we can come back and talk about the results of that process. 

Ms. TAKAI. Before I speak to the technology, just to follow on to 

the governance issue, there is participation by all of the organizations in a White House working group that reports to the deputy’s 

18 

committee around the various activities to make sure that we are 

well coordinated and that we are working together. 

Inside the Department of Defense, this is an item that is high 

on the Secretary’s list, and we provide ongoing reports to him from 

the standpoint of the technology mitigation efforts both to him and 

the Chairman of the Joint Chiefs of Staff regarding our progress. 

So there is significant oversight. There is significant guidance in 

terms of making sure that we are taking care of this and we are 

following on to the commitments that we have made both from a 

technology perspective and working with Mr. Ferguson’s area in 

terms of making sure that the policies are updated. So I wanted 

to make sure that I added that in response to the question. 

Moving on to the technology, I think we have talked about the 

Host Based Security System and the progress that we have made 

thus far in terms of having that installed and making sure that we 

can detect anomalous behavior in terms of individuals who might 

get on to the network and download information, and we are doing 

that in three ways. One is from a device perspective. The Host 

Based Security System detects if, in fact, a computer does have a 

device where information can be downloaded so that we can validate that and ensure that it is a part of the 12 percent of those 

computers that we believe need that information in the field. 

The second thing that we are doing is to look at what we call an 

audit extraction module to follow on to Senator Collins’ question 

around how do we have the information and the analytics to see 

anomalous behavior and we can catch it at the time that it occurs. 

We are currently in testing. That software is integrated with 

HBSS, and we will then be moving ahead to roll that out across 

DOD. 

The third thing that we are moving forward on, as you mentioned, Senator Collins, is around really a role-based process. We 

are going to be implementing a public key infrastructure (PKI) 

identification similar to our current Common Access Cards (CACs) 

that we have on our non-classified network to all of the DOD users, 

and what that will do is give us an opportunity over time to refine 

what information individuals have access to. So sheer access to 

SIPRNet, for instance, in this case, we will be able to, by looking 

at each individual database, take it down to what information that 

individual needed as opposed to having the network completely 

open. 

Senator BROWN. I appreciate that, and just in closing, it was not 

only dangerous, it is embarrassing what happened. You know, it is 

embarrassing for our country some of the things that were actually 

out there. And so there are a lot of lessons there, but I appreciate 

the opportunity. 

Thank you for having this hearing and participating and allowing me to participate in it. 

Senator COLLINS. Thank you. 

Chairman LIEBERMAN [presiding]. Senator Collins, thanks very 

much for assuming the Chair. I apologize to the witnesses. 

I appreciate the testimony. Let me ask a few questions, if I 

might. In a speech that DNI General Clapper gave last fall, he predicted that WikiLeaks was going to have a ‘‘very chilling effect on 

the need to share.’’ After WikiLeaks began to release State DepartVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000022 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
19 

ment cables in late November, news headlines forecasted a 

clampdown on information sharing, and this is what we have been 

dealing with and you deal with in your testimony as submitted. 

I wanted to ask you if there are specific areas—and I guess I 

would start with Ms. Stone and then any others. Are there specific 

areas where you think the WikiLeaks case has had a direct impact 

on information sharing other than the examples cited in the prepared testimony by Mr. Kennedy of the State Department removing its diplomatic cables from SIPRNet? 

Ms. STONE. Thank you for that question, sir. My reaction is that 

the most direct impact has been in the area of culture and those 

people who are concerned about sharing information, rightly so, 

and our ability to protect it. And, therefore, our reaction to 

WikiLeaks must be to increase protection as well as sharing. As we 

increase the protection, we also increase the trust and confidence 

that people have that when they share their information appropriately, it will be protected; we will know where the information 

is; we will be able to pull that information if it is inappropriately 

accessed; and we will be able to follow up with appropriate repercussions if and when it is misused. 

So I think the most direct impact I have seen is not in a specific 

tangible action, but more so that it has resulted in a very clear 

need for us to increase the protections, to increase trust and confidence to share more broadly; because—while Director Clapper 

was very concerned—as we all were, that this would have a chilling 

effect, we have all worked very hard, both within the ODNI, within 

the intelligence community, and across the government, to ensure 

that it does not have a chilling effect; but that, in fact, as Mr. Ferguson said, as we increase sharing, we also increase protection to 

develop that trust and confidence. 

Chairman LIEBERMAN. That is good. Mr. Kennedy. 

Mr. KENNEDY. If I could, Mr. Chairman. I think there have been 

two kinds of chilling effects. One, I think there has been a chilling 

effect on the part of some foreign governments being willing to 

share information with us, and that is obviously of great concern 

to the State Department. We build our diplomatic reporting analysis on the basis of trust; that when individuals tell us things in 

confidence, we will share them in confidence within the U.S. Government, that it will not go broader than that. So that has been 

one chilling effect. 

I think the State Department, though, has avoided the chilling 

effect that you were directly addressing. For example, if I might, 

during the period of time, we have posted, as you all mentioned, 

some 250,000 cables to this database posted to the DOD SIPRNet. 

During that same period of time, we disseminated 2.4 million cables, 10 times as many, through other systems to the 65 other U.S. 

Government agencies. And so, therefore, while we stopped disseminating on SIPRNet for the reasons that my DOD colleagues have 

outlined, we have continued to disseminate to the intelligence community system, the Joint Worldwide Intelligence Communications 

System (JWICS), and we have continued to disseminate the same 

volume of material to the same other agencies based upon their 

need for that information. We do not hold anything back. This unfortunate event has not caused us to hold anything back. We conVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000023 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
20 

tinue to share at the same rate as we were sharing before because 

we know that our information is essentially the gold standard. 

There are more reporting and analysis officers and sources and 

information from 265 State Department diplomatic and consular 

posts around the world than any other agency, so it is our intent 

to uphold our piece of national security and obviously to be responsive to the very forceful and correct legislation that you saw past, 

which is to share. We are continuing to share using two other 

means. 

Chairman LIEBERMAN. Do any of the other three witnesses want 

to comment, either in terms of specific areas of the effect of 

WikiLeaks on information sharing or perhaps some more indirect 

impact with people becoming more hesitant to work across agency 

boundaries or even marking intelligence products more restrictively? Mr. Paul. 

Mr. PAUL. Yes, in my role I have the opportunity to work closely 

with our State, local, and tribal partners, and I just want to report 

that the concerns about a chilling effect, they share that. They 

share the concern, and we remain vigilant and work with them to 

try to identify any challenges of that sort. But so far with our partners, primarily FBI and DHS, there is a lot of good sharing. Our 

different sharing initiatives continue to move forward, things like 

the Nationwide Suspicious Activity Reporting Initiative, the Nationwide Network of Fusion Centers, and different initiatives of 

those ilk. 

Chairman LIEBERMAN. Good. Thanks for your answers to that. 

Incidentally, one of the things I have found that I am sure other 

Members of Congress have found in foreign travel that we have 

done since the WikiLeaks leaks is that, somewhat in jest but not 

really, often leaders of foreign countries that we are meeting with 

will say, ‘‘I hope this is not going to appear on WikiLeaks.’’ So they 

are hoping that there is a certain confidence and trust in the exchange of information. And, of course, we say, ‘‘Oh, no.’’ And then 

the person from the embassy usually says, ‘‘No, we have taken care 

of that problem.’’ But it did affect the trust of allies around the 

world. 

One of the things that Congress called for in the Intelligence Reform and Terrorism Prevention Act was the use of technologies 

that would allow ‘‘role-based access’’ to information in government 

systems—in other words, that people would have access to information necessary for their work, but would not have overly broad access to information that they did not need. 

One of the key lessons, obviously, from WikiLeaks is that we 

have not yet made enough progress toward that goal as we need 

to, and if such capabilities had been in place on SIPRNet, I presume Private Manning would never have had access to that much 

information, if any at all. 

Ms. Takai, maybe we will start with you. What are the key challenges associated with implementing role-based access as I have 

defined it across our classified and sensitive information systems? 

Ms. TAKAI. Thank you, Mr. Chairman. I would like to start first 

by just giving you an update on where we stand at DOD in terms 

of rolling out a PKI-based CAC card for SIPRNet. 

Chairman LIEBERMAN. Good. 

21 

Ms. TAKAI. We are in the process and, in fact, they are in production, if you will, through our trusted foundry on those cards. We 

are anticipating the completion of the rollout by the end of 2012 

so that all the individuals who today need SIPRNet and use 

SIPRNet will have PKI identification. 

Chairman LIEBERMAN. Have you defined those terms while I was 

away? Or would you want to do so now, PKI and the CAC card, 

for the record? 

Ms. TAKAI. Effectively the common access card is a card that you 

actually utilize with your computer that actually identifies you 

when you log on to the computer. So it is a much more sophisticated password, if you will. It gives you a user name and password, 

but it more clearly identifies you, and then from that more clearly 

can identify the role that you play in the organization and then 

through that the information to which you should have access. 

Chairman LIEBERMAN. So that would all limit access based on 

what the position of the card holder was and the presumed needs 

to know of the card holder. 

Ms. TAKAI. That is correct, sir. But to the second part of your 

question in terms of our rollout plan and the steps that we need 

to go through, the cards are actually rolled out to each individual 

who has a computer, so our deployment plan is to actually get the 

physical cards and the physical readers installed on all of the computers for those individuals that require access to SIPRNet. 

The second thing is that through the trusted foundry we have a 

manufacturing process for those cards, and they have a capacity for 

a certain number of cards, so that also is a factor. 

So, again, in order for us to really complete 100 percent, we have 

to take into account those two factors, and also the fact that many 

of the computers where this is needed are, as you could well imagine, in many locations around the globe. And that is not only, of 

course, certainly on the ground, but on ships and so on. So it will 

take us a while, by the end of 2012, to have that deployment complete. 

But I think it is important to note, in addition to just the physical deployment of the cards and on the various computers, that it 

will then take us additional time to make sure that we get the 

roles associated with the information connected. So the cards give 

us the capability to do that, and then we will continue the deployment to link the information to that. 

Chairman LIEBERMAN. That is encouraging. Thanks. Senator 

Collins. 

Senator COLLINS. Thank you, Mr. Chairman. Just a couple more 

questions. 

Mr. Ferguson, when I think about the WikiLeaks incident, I 

think not only of the failures of technology but also a failure to 

focus on certain red flag behavior that was exhibited by the suspect. And it reminds me very much of what our investigation found 

when we looked into Major Hasan’s behavior prior to the massacre 

at Fort Hood. 

If the media reports are correct, Private Manning exhibited problems such as mental health issues, an assault on colleagues, and 

the fact that supervisors had recommended that he not be sent to 

the front lines. 

22 

These are all pretty big red flags, and I am wondering why they 

did not lead to a restriction in his access to classified information. 

I do not know whether you are the right person for me to ask that 

question to, but my point is there is more than just technology at 

stake here. If we have a high-ranking official and we use the user 

role approach but that individual becomes unstable or embraces 

Islamist radicalism or there is some other reason that would cause 

the individual to pose an insider threat, do we have the systems 

in place to catch that individual? 

Mr. FERGUSON. Senator, I probably cannot really speak to the 

specifics of Private Manning. It is an ongoing investigation. However, your point, though, about a process to identify behaviors that 

we should be concerned about, we have taken a look at that, and 

the training that we had in place—whether it was Hasan or this 

case—was not sufficient to give his supervisors the pieces of data 

they would need to put together and say this person is a problem, 

or in some cases to take action when they did suspect something 

was wrong. 

So what we have done in the Department is begin to shape with 

new policy and direction how to better train supervisors in how to 

best identify behaviors that would be of concern. That is one piece, 

but they also have to be willing to take action, and that is part of 

the other problem. It is not that somebody might say that this behavior is irregular. It is also in some cases a fear to take action, 

or it may reflect on them as a failure or it may reflect on them in 

some other way. And so there are two hurdles here. It is teaching 

people how to identify the characteristics, but it is also teaching 

people that the right thing to do is to take action. 

Senator COLLINS. I am concerned because we have seen two recent cases where tremendous damage was done, despite the fact 

that there was ample evidence, it appears—I am less familiar with 

the case we are discussing today—that something was dramatically 

wrong. That is an issue that I am eager to pursue, and I think your 

point about training is a very good one. 

Mr. Paul, just for my last question, you mentioned in your testimony that there is a fragmented approach to computer security 

across the Federal Government, and I think I can speak for the 

Chairman when I say that we could not agree with you more, and 

that is one reason we have introduced our cybersecurity bill which 

will apply to the civilian agencies and also try to work with the private sector to develop best practices. But our bill does not deal with 

the intelligence community or the military computer systems. 

You also in your testimony pointed out that you are not an operational office at DNI and that you are heading a task force on this 

issue. What are you telling us? Are you telling us that the DNI 

needs more authority to prevent this fragmented approach where 

one intelligence agency may have a totally different approach to security, classification, and access than the Department of Defense? 

Mr. PAUL. So when I was using the description of ‘‘fragmentation,’’ what I was referring to was that agencies put in place specific agency-based solutions. Those solutions serve for specific 

needs. But then when you look at more broad information sharing 

and protection with other agencies, the solutions tend to not work 

as well. An example of this is, as we look at things like identity 

23 

management frameworks—some of my panelists have talked about 

identity management. That is foundational to being able to do information sharing and information protection. We have several different identity management frameworks across the scope of the 

Federal Government, our State and local partners, and so forth. 

Those frameworks are mostly aligned, but we need to make sure 

that as they get implemented, they are implemented in a way that 

is consistent across all the different partners. If that does not happen, then you run into challenges when information moves across 

organizational boundaries. 

The second part of your question was about my role in cochairing the Information Sharing and Access Interagency Policy 

Committee. A key thing that we are trying to do in that group is 

to harmonize policy frameworks across the different agencies to 

make sure that on one hand, we have the consistent framework, 

but on the other hand, we are not slowing down operational considerations in those agencies so that the variations that occur are 

truly because of mission requirements and not because we are not 

effectively working together. 

Senator COLLINS. Ms. Stone. 

Ms. STONE. Thank you. If I could just add to that, across the intelligence community we are working very hard to have comprehensive guidelines and processes that are consistent and interoperable. We are working on leveraging public key infrastructure 

and attribute-based access control to have a more comprehensive 

identity and access management. We are standardizing data protection models to have several levels of security, and we are working on an enterprise audit framework. 

So within the intelligence community, while we may have different systems, we are working very hard from the Office of the Director of National Intelligence to more standardize and ensure consistency across those networks. The way we then plug in with the 

rest of the government—and, indeed, we must be interoperable 

with the rest of the government, of course—is through this interagency group that we are working on together with everyone at the 

table and others to ensure that we can, in fact, be coordinating and 

consistent with the other offices. And we are still working through 

exactly what that looks like, but that is certainly a concern that 

we are all very well aware of. 

Senator COLLINS. Thank you. Just two final concluding comments. I would note that the Government Accountability Office 

(GAO) continues to list information sharing, particularly with regard to terrorism-related information, as a high-risk activity, and 

it is on the high-risk list again this year. 

And, finally, as we look at the user role approach, which I 

brought up in my opening statement and which we have commented on today, we do have to be careful that does not translate 

back to the bad old days where no one shared anything and where 

we had stovepipes because we are defining who has access so narrowly that we deny access to analysts who really need that information. 

So it is a very difficult task that you are all embarking on, but 

in this day and age, that an individual could be able, undetected 

for so long, to download and illegally distribute hundreds of thouVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000027 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
24 

sands of important cables, reports, and documents is just inconceivable to me. So, clearly, we have a long way to go to strike the right 

balance. 

Thank you, Mr. Chairman. 

Chairman LIEBERMAN. Thank you, Senator Collins, very much. 

Thanks again for taking the chair while I had to leave. 

Just a few more questions, and I want to follow up first with one 

to you, Mr. Paul, following up on the question I asked Ms. Takai 

before about role-based access. In your testimony, you note the fact 

that there are at least five distinct identity credential and access 

management frameworks in use by Federal agencies, and, of 

course, that makes me wonder whether that limits the ability to 

implementation the kind of role-based access capabilities that the 

IRTPA required in systems in a cost-effective way. I wonder if you 

could talk about what you are doing, hopefully in cooperation, perhaps, with the other witnesses here today, to harmonize those different access frameworks. 

Mr. PAUL. Sure. Thank you for the question. There are these five 

different frameworks, but they are really not that different. They 

are different enough, though, that it requires the attention of my 

office and other bodies—the Federal Chief Information Officer 

Council, for example, and my colleagues here—to make sure that 

as the frameworks get implemented in the different agencies and 

with our State, local, and tribal partners, that we do not allow for 

variations or that variations are controlled and reflect mission requirements and the like. So a focus of my office is to work with the 

interagency, bringing together groups to make sure that as these 

frameworks get implemented, they are implemented in a consistent 

way. 

Building on top of that, it is critical, as we look at role- and 

attribute-based access controls that you both have highlighted, that 

the framework for doing those, how we define roles, how we, to use 

a colloquialism, tag data, how we tag people, and that tagging occurs in different places. A person may be tagged in one agency, 

data may be tagged in another, and we want to be able to have 

that data move in an appropriate way with policy enforcement. 

That means there needs to be a consistent framework for how that 

happens, and coordination, and this goes to some of what you have 

heard from me and others about the importance of governance of 

the standards and architecture approach. So those are contributions that are catalyzed through the efforts of my office in close cooperation with my mission partners. 

Chairman LIEBERMAN. Good. I urge you on in that. 

Mr. Ferguson, I mentioned in my opening statement the great 

successes that we have had in the past few years in Iraq and Afghanistan in disrupting terrorist networks in those countries with 

our military and intelligence agencies working very closely together 

and doing so in a remarkably rapid way, sometimes exploiting information from one raid or one source and using it within an hour 

elsewhere, or quicker. 

As you make changes to improve the security of classified networks at DOD and in the intelligence community, are you taking 

steps to ensure that those efforts will not diminish or slow down 

25 

our ability to carry out the kinds of operations I have just described? 

Mr. FERGUSON. Yes, sir, absolutely. Even though the process was 

to allow personnel working in a secured facility to access the 

SIPRNet and pull down data and copy it through open media. 

Chairman LIEBERMAN. Right. 

Mr. FERGUSON. For example, so we could have more agility and 

flexibility. We have gone back and taken a look at how that process 

worked, and we have found that by creating just a kiosk process 

and a two-man rule, we can still move at the same speed and have 

the same agility without giving everybody the same availability to 

the information and being able to pull the data down and copy it. 

So it is very much in mind to make sure that we do not hinder our 

ability to carry out the operations. 

Chairman LIEBERMAN. Good. Do you want to add anything, Ms. 

Takai? 

Ms. TAKAI. Yes, I would. I think one of the things that is very 

important is that we continue to see the dramatic need for information and information sharing by the warfighter and so, if anything, 

the demand for that information continues to grow. And so as we 

are looking at the technology, just to relate back to what Mr. Paul 

said, part of our efforts are to ensure within DOD we are eliminating our fragmented environment, which has grown up over 

time, through our legacy base of the way that our networks and 

our databases have grown up. And so I wanted to make sure that 

I added that there was a relationship between the work that Mr. 

Paul is doing and the work that we are doing internal to DOD, and 

I am sure my partners here are all undergoing the same thing. I 

think that is really what Ms. Stone was talking about. And those 

things in combination with being able to apply cybersecurity enhancements are really going to give us an opportunity to get that 

information out there as quickly as today and in some cases even 

faster than today, but to do it in a secure way. 

Chairman LIEBERMAN. That is excellent. Let me ask a final question. Based on the testimony you have provided, really in what you 

are doing to respond to the challenges that were illuminated by the 

WikiLeaks case, but also to protect the information-sharing environment, one, have you seen any areas where you think you would 

benefit from statutory changes? And, two—and this is a question 

that I ask in a limited way in this fiscal environment—are there 

any funds we should be targeting to particular uses that we are not 

now doing to assist you in responding to this crisis? Maybe we will 

start with Mr. Kennedy and go down the table, if anybody has anything to say. 

Mr. KENNEDY. Thank you very much, Mr. Chairman. I cannot 

think of any additional legislative authority. I think you have done 

two things. You have given us the intent, and then you have given 

us the command. And I think we know from what you have said 

and what we know internally which way we should go. 

On the funding, I can always say that an institution as small as 

the State Department can always use additional funding given the 

range of demands upon us. But I believe that we have a role-based 

access system in place that we use to distribute material within the 

State Department. If you are on the French desk, you get one set 

26 

of materials. If you are on the Japan desk, you get another. As I 

mentioned earlier, we will continue to push State Department reporting to the other agencies, but it does, I will admit, put a burden on them to then take our material which we have provided to 

Secretary of Defense, so to speak, to DOD, and then to distribute 

that to their people according to the roles that only they are capable of defining, because I think it would be wrong for me to say 

which individuals within an entity as large as the Defense Department or as large as the DNI or the intelligence community which 

analyst needs what. So we send it to them, and I think they may 

be the ones who have to answer that second question about how 

they are going to distribute it efficiently and effectively as both you 

and Senator Collins have talked about. 

Chairman LIEBERMAN. Thanks. Ms. Takai, any legislative recommendations or budget targeting? 

Ms. TAKAI. In terms of the legislative question, I agree with Mr. 

Kennedy. At this time we do not see any additional legislation that 

we need. We are going through a review to answer exactly that 

same question for the Secretary in terms of is there any need for 

any change, not only additional funding but a change in the cadence of the funding. And so once we have that pulled together, we 

would be happy to share it with you. 

Chairman LIEBERMAN. I appreciate it. Mr. Ferguson. 

Mr. FERGUSON. I would have to agree on the legislative side, and 

certainly as Ms. Takai has pointed out, as we go through this process of putting in these capabilities, what kind of funding needs I 

guess we have to identify what those real costs are and come back. 

Chairman LIEBERMAN. Ms. Stone. 

Ms. STONE. Similarly, on the legislative question, I think we 

have what we need for now, although I would reserve the right to 

come back if we discover we need something else. 

And on the funding piece, again, we do have an interagency process ongoing looking at exactly what we might do with different options, so we would have to see where that comes out. But I do believe there is at least something in the fiscal year 2012 proposal 

submitted by the President to work on some of these issues. 

Chairman LIEBERMAN. Good. Mr. Paul. 

Mr. PAUL. Just to echo Ambassador Kennedy, the laws and the 

statutes that this Committee has championed provide an adequate 

basis, a fine basis. I know in the context of the information-sharing 

environment that it is my responsibility, there is enough authority. 

It is an issue for me now of execution and leadership. 

Chairman LIEBERMAN. Good. Thank you all. Senator Collins. 

Senator COLLINS. Thank you. 

Chairman LIEBERMAN. Well, thanks very much, again, for your 

prepared testimony and the oral testimony, and I emerge encouraged that you are certainly dealing with the specific series of 

vulnerabilities that the WikiLeaks/Manning case revealed, and I 

presume in the nature of the modern world with technology, innovation, and exploitation what it is, you will also be thinking about 

the next way in which somebody might try to take advantage of 

our information-sharing environment. But I think that we have 

raised our guard in a sensible way and also continue to share inforVerDate Nov 24 2008 13:31 Jan 24, 2012 Jkt 66677 PO 00000 Frm 000030 Fmt 06633 Sfmt 06633 P:\DOCS\66677.TXT SAFFAIRS PsN: PAT
27 

mation, which we need to do, is what I take away from this hearing, and I appreciate that very much. 

The record will remain open for 15 days for any additional questions or statements. With that, the hearing is adjourned. 

[Whereupon, at 4:36 p.m., the Committee was adjourned.] 

(29) 

A P P E N D I X 


66677.001
30 


66677.002
31 


66677.003
32 


66677.004
33 


66677.005
34 


66677.006
35 


66677.007
36 


66677.008
37 


66677.009
38 


66677.010
39 


66677.011
40 


66677.012
41 


66677.013
42 


66677.014
43 


66677.015
44 


66677.016
45 


66677.017
46 


66677.018
47 


66677.019
48 


66677.020
49 


66677.021
50 


66677.022
51 


66677.023
52 


66677.024
53 


66677.025
54 


66677.026
55 


66677.027
56 


66677.028
57 


66677.029
58 


66677.030
59 


66677.031
60 


66677.032
61 


66677.033
62 


66677.034
63 


66677.035
64 


66677.036
65 


66677.037
66 


66677.038
67 


66677.039
68 


66677.040
69 


66677.041
70 


66677.042
71 


66677.043
72 


66677.044
73 


66677.045
74 


66677.046
75 


66677.047
76 


66677.048
77 


66677.049
78 


66677.050
79 


66677.051
80 


66677.052
81 


66677.053
82 


66677.054
83 


66677.055
84 


66677.056
85 


66677.057
86 


66677.058
87 


66677.059
88 


66677.060
89 


66677.061
90 


66677.062
91 


66677.063
92 


66677.064
93 


66677.065
94 


66677.066
95 


66677.067
96 


66677.068
97 


66677.069
98 


66677.070
99 


66677.071
100 


66677.072
101 


66677.073
102 


66677.074
103 


66677.075
104 


66677.076
105 


66677.077
106 


66677.078
107 

Æ 


66677.079