U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

96–817PDF 2015

CYBER WAR: DEFINITIONS, DETERRENCE, AND

FOREIGN POLICY

HEARING

BEFORE THE

COMMITTEE ON FOREIGN AFFAIRS 

HOUSE OF REPRESENTATIVES

ONE HUNDRED FOURTEENTH CONGRESS

FIRST SESSION

SEPTEMBER 30, 2015

Serial No. 114–106

Printed for the use of the Committee on Foreign Affairs

(

Available via the World Wide Web: http://www.foreignaffairs.house.gov/ or

http://www.gpo.gov/fdsys/

(II)

COMMITTEE ON FOREIGN AFFAIRS 

EDWARD R. ROYCE, California, Chairman 

CHRISTOPHER H. SMITH, New Jersey 

ILEANA ROS-LEHTINEN, Florida 

DANA ROHRABACHER, California 

STEVE CHABOT, Ohio 

JOE WILSON, South Carolina 

MICHAEL T. MCCAUL, Texas 

TED POE, Texas 

MATT SALMON, Arizona 

DARRELL E. ISSA, California 

TOM MARINO, Pennsylvania 

JEFF DUNCAN, South Carolina 

MO BROOKS, Alabama 

PAUL COOK, California 

RANDY K. WEBER SR., Texas 

SCOTT PERRY, Pennsylvania 

RON DESANTIS, Florida 

MARK MEADOWS, North Carolina 

TED S. YOHO, Florida 

CURT CLAWSON, Florida 

SCOTT DESJARLAIS, Tennessee 

REID J. RIBBLE, Wisconsin 

DAVID A. TROTT, Michigan 

LEE M. ZELDIN, New York 

DANIEL DONOVAN, New York 

ELIOT L. ENGEL, New York 

BRAD SHERMAN, California 

GREGORY W. MEEKS, New York 

ALBIO SIRES, New Jersey 

GERALD E. CONNOLLY, Virginia 

THEODORE E. DEUTCH, Florida 

BRIAN HIGGINS, New York 

KAREN BASS, California 

WILLIAM KEATING, Massachusetts 

DAVID CICILLINE, Rhode Island 

ALAN GRAYSON, Florida 

AMI BERA, California 

ALAN S. LOWENTHAL, California 

GRACE MENG, New York 

LOIS FRANKEL, Florida 

TULSI GABBARD, Hawaii 

JOAQUIN CASTRO, Texas 

ROBIN L. KELLY, Illinois 

BRENDAN F. BOYLE, Pennsylvania

AMY PORTER, Chief of Staff THOMAS SHEEHY, Staff Director

JASON STEINBAUM, Democratic Staff Director 

(III)

C O N T E N T S 

Page

WITNESSES 

James Andrew Lewis, Ph.D., senior fellow and director, Strategic Technologies Program, Center for Strategic and International Studies ................. 4

Catherine Lotrionte, Ph.D., director, Institute for Law, Science and Global 

Security, Georgetown University ........................................................................ 14

Mr. Bob Butler, adjunct senior fellow, Technology and National Security 

Program, Center for a New American Security ................................................. 26

LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING 

James Andrew Lewis, Ph.D.: Prepared statement ................................................ 6

Catherine Lotrionte, Ph.D.: Prepared statement .................................................. 16

Mr. Bob Butler: Prepared statement ..................................................................... 28

APPENDIX 

Hearing notice .......................................................................................................... 56

Hearing minutes ...................................................................................................... 57

The Honorable Gerald E. Connolly, a Representative in Congress from the 

Commonwealth of Virginia: Prepared statement .............................................. 59

Written responses from Mr. Bob Butler to questions submitted for the record 

by members of the committee ............................................................................. 60

Written responses from Catherine Lotrionte, Ph.D., to questions submitted 

for the record by members of the committee ..................................................... 62

Questions submitted for the record to James Andrew Lewis, Ph.D., by the 

Honorable Mark Meadows, a Representative in Congress from the State 

of North Carolina ................................................................................................. 66

(1)

CYBER WAR: DEFINITIONS, DETERRENCE, 

AND FOREIGN POLICY 

WEDNESDAY, SEPTEMBER 30, 2015

HOUSE OF REPRESENTATIVES,

COMMITTEE ON FOREIGN AFFAIRS,

Washington, DC. 

The committee met, pursuant to notice, at 10:14 a.m. in room 

2172, Rayburn House Office Building, Hon. Ed Royce (chairman of 

the committee) presiding. 

Mr. SALMON [presiding]. This hearing will come to order. This 

morning we will consider the growing threats to U.S. national security in cyberspace. It is no exaggeration to say that we are at the 

dawn of a new age of warfare. Computers and the Internet have 

connected people around the world. However, reliance on these 

technologies has also made us vulnerable to cyber attacks from 

other countries, terrorists, and criminals. 

So much so that the Pentagon now counts cyberspace as the fifth 

domain of warfare alongside land, air, sea, and space. Whether or 

not an all-out cyber war occurs, it is clear that we are in a state 

of ongoing cyber conflict. The White House, the State Department, 

and the Department of Defense have all been hacked, and, of 

course, the Office of Personnel Management had the sensitive information of more than 21 million Americans compromised. 

In the private sector, hackers have crashed the computers of 

Sony executives, seized the personal information of more than 78 

million people from the Nation’s second largest health insurer, and 

stolen the credit and debit card information of more than 40 million customers of a major retailer. The magnitude of this theft is 

staggering, yet it is said that it takes companies an average of 205 

days to even realize their system has been breached. 

Across the globe, Estonia found itself at the opposite end of a 

crippling Russia-backed denial of service attack. A computer worm 

shut down the air force and navies of France and Great Britain for 

a time. And an attack by North Korea, coined Dark Seoul, crippled 

South Korea’s banking system. 

In the coming years, it is likely that Iran will pour more resources into cyber weapons. These have already been used against 

the U.S. Navy, American banks, a Las Vegas casino, and Saudi 

Arabia’s largest oil producer, all without setting off significant retaliation. Indeed, it has been said that it is exactly the lack of 

international norms in responding that make cyber weapons so attractive to Russia, China, Iran, and North Korea. So we have a lot 

of work to do. 

2

Our top intelligence officer told Congress earlier this month that 

the U.S. lacks both the substance and the mind-set to deterrence. 

Indeed, last spring the President issued an Executive order that 

would allow him to target individuals or organizations deemed responsible for computer attacks, but this new order, similar to the 

way in which terrorists of nuclear proliferators are targeted, has 

yet to be used. So the President’s recent comment that offense is 

moving faster than defense is putting it mildly. 

From the private sector to government, our country is taking 

body blow after body blow in cyberspace. Why aren’t we hitting 

back? As one observer notes, we have a deterrence deficit. 

The new agreement between the United States and China on economic espionage would be a step forward if China actually abides 

by it. And others, like Iran and Russia, will be watching closely 

how the United States responds to what is perhaps the greatest 

theft in history. 

We look forward to hearing from our witnesses, what is cyber 

war and how does it differ from cyber conflict and cyber espionage? 

Could better attribution techniques be developed to help the United 

States deter cyberattacks? What is the role of diplomacy in containing cyber conflict? Do the international norms surrounding traditional warfare apply? And what are the foreign policy implications of continued cyber infiltrations and espionage? 

We look forward to our witnesses’ testimony as we consider U.S. 

responses to one of the most urgent problems facing the United 

States. 

And I now turn to the ranking member for any opening comments he might have. 

Mr. ENGEL. Well, thank you very much, Mr. Salmon. And to our 

witnesses, welcome to the Foreign Affairs Committee. We badly 

need your expertise, because our focus today is a new frontier when 

it comes to enhancing American security, and I agree with everything that my colleague just said. 

For years, cyber attacks from overseas have posed a growing 

threat to the United States. Cybercrimes, such as a breach of the 

credit card systems at Target stores by Russian hackers in 2013, 

have put millions of American consumers at risk. Cyber espionage 

by foreign governments, the recent attack on the Office of Personnel Management, for example, threatens to expose national security information and violates the privacy of many, many American citizens. 

Today this committee is focusing on cyber war. That is a relatively new term and we still don’t have a consensus about what 

it generally means, exactly means. Generally speaking, cyber war 

is understood as something different from the attacks that the 

United States has already experienced. 

So today I hope we can provide a little clarity on what we mean 

by cyber war. When does an act of espionage or vandalism cross 

the line and become an act of war? What would it take for a cyber 

attack to violate prohibitions against the use of force under the 

Laws of Armed Conflict? And regardless of the terminology we use, 

what should we be doing to protect the security of the United 

States and our citizens? 

3

I think it is urgent that we move quickly to address this challenge, because it is unlike any threat we have seen in the past. In 

recent history, the power of our military and safety of our shores 

have kept the violence of conventional warfare at a distance for 

most Americans, but technology has made the world smaller and 

more interconnected, for better and for worse. 

A conventional war today could easily be accomplished by cyber 

attacks on critical infrastructure here at home. Our power grid, air 

traffic control systems, water treatment facilities, or freight infrastructure could all be targeted. 

Our private sector is also a likely target. The Governments of 

China, Russia, Iran and other nations understand the value of 

American business secrets and intellectual property. That is why 

the Justice Department indicted five members of the Chinese military conspiring to steal American trade secrets in the metal and 

energy sectors and pass them along to Chinese businesses. I hope 

our witnesses can provide some insight about the best ways to 

shore up our defenses against these threats. 

And as we guard against this danger at home, I think America 

has a role to play around the world helping to establish standards 

for this cyber activity, bringing governments together to prevent 

and put a stop to cyber conflict. We led the way when it came to 

conventional conflict, we can lead the way again. In fact, we have 

already taken positive steps. 

In 2011, the Obama administration released an international 

strategy for cyberspace, calling for stronger diplomacy in privatepublic partnership to deal with this issue. A year later, we pushed 

to classify cyber activities causing death, injury, or significant destruction as a use of force under international law. We worked with 

Russia and China through the U.N. to limit the threat of 

cyberattacks against critical infrastructure. And we took another 

big step last week. 

Before Chinese President Xi visited the United States, several 

members of this committee wrote to President Obama, singling out 

the Chinese Government’s cyber theft of intellectual property as a 

major concern. So I was very pleased that on Friday, the administration announced a huge win for U.S. companies. President 

Obama secured a commitment from the Chinese Government to 

stop engaging in state-sponsored cyber theft of intellectual property, including trade secrets and confidential business information. 

What is more, the Chinese agreed to work with us to prosecute 

cyber criminals targeting American assets. This is a significant 

achievement, but, of course, we need to make sure that China holds 

up its end of the deal. Talk is cheap. We have to make sure they 

produce, and we have to produce by being tough. 

Mr. Chairman, let me just add, even though it is off topic, last 

week in, my opinion, we achieved another landmark in U.S.-China 

cooperation on another critical threat, climate change. After years 

of pressure from the U.S. at very high levels, the Chinese will start 

a cap and trade system to curb carbon emissions in their country. 

I believe it is a very important step. 

Let me close by saying that while we have taken steps at home 

and shown leadership around the world, we still have a long way 

to go just to understand the nature and threat of cyber war, let 

4

alone what is necessary to contain this threat and protect our interests. 

So, again, let me thank our witnesses. I look forward to a good 

discussion and look forward to hearing their expertise. Thank you, 

Mr. Chairman. 

Mr. SALMON. Thank you. 

This morning we are pleased to be joined by a distinguished 

panel. First, Dr. James Lewis is a Senior Fellow and Director in 

the Strategic Technologies Program at the Center for Strategic and 

International Studies. Before joining CSIS, Dr. Lewis served in 

both the Department of State and the Department of Commerce. 

Welcome. 

Dr. Catherine Lotrionte. Is that correct? 

Ms. LOTRIONTE. Yes. 

Mr. SALMON. Is the Director of the Institute for Law, Science and 

Global Security at Georgetown University, where she teaches 

courses on national security law, U.S. intelligence law, and international law. Welcome. 

Mr. Bob Butler is an Adjunct Senior Fellow in the Technology 

and National Security Program at the Center for New American 

Security. Mr. Butler has led a long career in information technology, intelligence, and national security in both the private and 

public sector. And he is going to the best State in the country this 

afternoon, Arizona. So happy to have that. 

Without objection, the witnesses’ full prepared statements will be 

made part of the record, and members will have 5 calendar days 

to submit statements, questions, and extraneous materials for the 

record. 

Dr. Lewis, would you please summarize your remarks. 

STATEMENT OF JAMES ANDREW LEWIS, PH.D., SENIOR FELLOW AND DIRECTOR, STRATEGIC TECHNOLOGIES PROGRAM, CENTER FOR STRATEGIC AND INTERNATIONAL 

STUDIES 

Mr. LEWIS. Thank you, Mr. Chairman, and thanks to the committee for inviting me to testify. 

Cybersecurity is a foreign policy problem, so it falls squarely in 

the jurisdiction of this committee. While much of our discussion focuses on domestic solutions, these by themselves are inadequate to 

secure our networks against foreign opponents. Five countries have 

advanced cyber attack capabilities: The U.S., the U.K., Russia, 

China, and Israel. And several other countries are developing these 

capabilities. They include Iran and North Korea, both of which who 

have used cyber attacks against American companies. 

So far when we look at these countries, they use their cyber attack capabilities in a manner that is consistent with their national 

military strategies and their policies. This means that cyber war is 

unlikely outside of some larger conflict. If that conflict were to 

occur, however, whether it was over the South China Sea or over 

the Russian interventions around the world, our opponents would 

use cyber attack to disrupt command and control systems and the 

software that controls advanced weapons. Both Russia and China 

have probed the most advanced U.S. weapons systems to prepare 

for this. 

5

Critical infrastructure is a second order target. Countries will attack it when they think they control the risk of escalation or when 

they are desperate, but it is vulnerable and it is a target that both 

Russia and China have probed. 

While there is agreement that international law, including the 

Laws of Armed Conflict, apply to cyber war, there remains areas 

of significant dispute, particularly over what qualifies as an armed 

attack or use of force in cyberspace. There is a gray area since a 

cyber attack can cause disruption without causing destruction or 

casualties. We have seen this with Iran’s attack on Saudi Aramco 

and North Korea’s action against Sony. How the Laws of Armed 

Conflict apply to this gray area is unclear. 

The concepts of use and force in armed attack underpin our treaty obligations for mutual defense. The U.S. has worked with its allies in NATO and in Asia to modify our existing treaties to ensure 

that the use of force in cyberspace is covered by them, is part of 

mutual defense. 

The definition of armed attack and use of force also determine 

deterrence thresholds. And I noted that, I think, the chairman 

talked about a deterrence deficit. We clearly have that. It is a 

major problem. 

In response to Sony and to Iran’s actions against the Sands casino, the administration took steps to strengthen deterrence, including public discussion of our improved attribution capabilities 

and the creation of new cybersecurity sanctions. The goal was to 

create a credible threat. 

It is too early to tell if this has worked, but traditional military 

espionage does not work and will not work against cyber crime or 

cyber espionage. The U.S. needs to find something other than military threats to stop these activities. Indictments and sanctions can 

threaten deterrence, but more work is needed, and this is where 

the committee can play an important role. 

It could consider, among other things, expanded oversight of diplomatic activities, including the implementation and compliance 

with alliance commitments and bilateral agreements, such as the 

recent agreement with China, and the work in the U.N. to build 

norms on responsible state behavior. It could look at legislative actions to strengthen countermeasures. 

We won’t always go to war over cyber espionage, in fact, we are 

unlikely to ever go to war over cyber espionage, but there are countermeasures such as sanctions or other penalties that we know 

have an effect on our opponents. It would be useful to provide 

greater clarity into the legal basis for the authorization of the use 

of force in cyberspace. 

Finally, you mentioned the existing 2011 International Strategy. 

This needs to be revised. It was written for a much different security environment, and it needs a second look, something that either 

this administration or the next will have to do. Cybersecurity poses 

a difficult challenge for foreign policy. Congress can help by providing oversight and guidance on its international and diplomatic 

aspects. 

I thank the committee for the opportunity to testify, and will be 

happy to answer any questions. 

Mr. SALMON. Thank you. 

6

[The prepared statement of Mr. Lewis follows:]


96817a-1.eps
7


96817a-2.eps
8


96817a-3.eps
9


96817a-4.eps
10


96817a-5.eps
11


96817a-6.eps
12


96817a-7.eps
13


96817a-8.eps
14

Mr. SALMON. Dr. Lotrionte. 

STATEMENT OF CATHERINE LOTRIONTE, PH.D., DIRECTOR, INSTITUTE FOR LAW, SCIENCE AND GLOBAL SECURITY, 

GEORGETOWN UNIVERSITY 

Ms. LOTRIONTE. Thank you for the invitation to speak to you 

today about international law and cyber operations. 

Even though there have not yet been discrete cyber operations 

that rise to the level of damage to property and lives equivalent to 

kinetic attacks, cyber operations are a part of the traditional military operations today, fast becoming a part of modern kinetic warfare. Such cyber operations first appeared overtly in the 2008 

armed conflict between Georgia and Russia, also during the armed 

conflicts in Afghanistan and Iraq, and throughout the armed conflict in Libya and Syria, and recently have played a significant role 

during the 2014 armed conflict between Russia and Ukraine. 

This emerging reality requires that states examine the question 

of how to treat cyber operations under international law. There appears no alternative at present but to consider a host of legal propositions in examining the law related to cyber operations and assessing whether the laws that we currently have are adequate as 

cyber operations become ubiquitous. 

Under current international law, cyber operations would amount 

to internationally wrongful acts if they were inconsistent with established international law. To date, there is only one treaty that 

explicitly addresses cyber activities: That is the 2001 Budapest 

Convention on cyber crime. 

There is a growing international consensus that aspects of international law do apply in the cyber domain, but most of the details 

about how it applies remains in flux. Many states have affirmed 

the application of existing laws, including the U.N. Charter and the 

Laws of Armed Conflict. And while it is well settled in the U.S. 

that the U.N. Charter and the Laws of Armed Conflict apply to 

cyber warfare, the challenge is determining exactly how it applies 

and getting international agreement on those issues. 

In July of this year, the fourth U.N. Group of Government Experts, under the auspices of the Secretary General and composed 

of 20 states, finalized its recent report to the General Assembly. 

The report highlighted norms for peacetimes that states should 

abide by, including that states should not conduct or knowingly 

support actions that intentionally damage critical infrastructure of 

other states. 

Under the international law related to the use of force, it remains unclear whether a cyber operation that does not result in 

physical damage or injury can nevertheless amount to an armed attack for purposes of Article 51 of the U.N. Charter, when it generates severe but nondestructive or injurious effects. 

While the U.S. has asserted in a report to the U.N. that ‘‘under 

certain circumstances a disruptive activity in cyberspace could constitute an armed attack,’’ it has not indicated which sorts of disruptive activities would qualify. 

And under International Humanitarian Law, or IHL, cyber operations executed in the context of an armed conflict are subject to 

the Law of Armed Conflict. For example, because the conflict beVerDate 0ct 09 2002 15:32 Nov 14, 2015 Jkt 000000 PO 00000 Frm 00018 Fmt 6633 Sfmt 6633 Z:\WORK\_FULL\093015\96817 SHIRL
15

tween Russia and the Ukraine is international in nature, the ensuing cyber operations are subject to IHL. However, for the customary legal rules of proportionality and the requirement to take 

certain precautions during an attack under IHL, the meaning of 

the word ‘‘attack’’ for purposes of cyber operations is contested, and 

yet it is critically important in determining if the rules apply. 

In conclusion, while there may never be a comprehensive treaty 

on cyber operations under international law, verbal acts, such as 

diplomatic statements, policy statements, press releases, military 

manuals, decisions of national courts, opinions of official legal advisors, pleadings before international tribunals, and executive decisions and regulations, and importantly for this committee, domestic 

legislation can also serve to develop customary international law. 

The U.S. can actively work to develop these specific customary 

principles that it wishes to prevail internationally by being outspoken and transparent about what it views as the law in cyberspace. This, of course, will also require constant and consistent action along with those words. 

Given the existing difficulties involved with adopting a new treaty in this area, a reinterpretation of existing laws to accord with 

the emergence of cyber operations, along with the development of 

new customs that serve to adapt existing norms to cyber operations, will likely be the path states take. 

The U.S. can build deterrence by telegraphing or clearly articulating and promulgating an interpretation of the law it believes is 

applicable to cyber operations. Doing this means being specific and 

being clear, specifically about the thresholds for a use of force and 

an armed attack under the law. For example, on the issue of what 

constitutes a use of force, the U.S. could take the position that 

cyber operations executed against certain categories of targets, 

whether they are SCADA systems or specific critical infrastructures, creates a rebuttable presumption that such actions constitute a use of force for purposes of Article 2 of the U.N. Charter. 

The U.S. could explicitly state such a position is a White House 

national security strategy, for instance. In making such legal assertions regarding thresholds and acting in accordance with those outlined thresholds, the U.S. could also seek agreement on these explicit thresholds from other States to develop clearly what the law 

is. Under such a legal framework, we can develop methods of countermeasures to hold those accountable for not complying with the 

law. This is just one way to develop deterrence when speaking 

about cyber conflict. 

I thank you, and I look forward to your questions. 

Mr. SALMON. Thank you. 

[The prepared statement of Ms. Lotrionte follows:]

16


96817b-1.eps
17


96817b-2.eps
18


96817b-3.eps
19


96817b-4.eps
20


96817b-5.eps
21


96817b-6.eps
22


96817b-7.eps
23


96817b-8.eps
24


96817b-9.eps
25


96817b-10.eps
26

Mr. SALMON. Mr. Butler. 

STATEMENT OF MR. BOB BUTLER, ADJUNCT SENIOR FELLOW, 

TECHNOLOGY AND NATIONAL SECURITY PROGRAM, CENTER FOR A NEW AMERICAN SECURITY 

Mr. BUTLER. Congressman Salmon, Ranking Member Engel, and 

distinguished members of the committee, thank you again for the 

invitation to come and talk about cyber war and related topics. 

These are my opinions and not necessarily those of the U.S. Government or the Center for a New American Security. 

The bottom line upfront for me is that, you know, we have done 

a good job, I think, as a country in building strategy and developing strategy. We are lagging in implementation. And I would 

agree with my colleagues and Congressman Salmon’s remarks 

about deterrence deficit. We are definitely in a situation of a deterrence deficit, and we are increasing our risk exposure over time by 

not remedying those actions. 

I say this from my perspective as a software developer, that is 

how I was trained; and from a DOD perspective, where I served in 

the United States Air Force for 26 years both as a computer systems officer and an intelligence officer; from a policy perspective, 

having served as a deputy assistant secretary over at the Pentagon 

on cyber policy; and from 6 years in the private sector working in 

both building business and building security programs globally. 

So rather than going through my remarks, I would just like to 

summarize some of the salient points and then stand ready for 

your questions. 

First of all, on the topic of cyber war, I think that is a misnomer. 

We are talking more about actions and tools and capabilities in 

cyberspace that are used as we move through cyber conflict, and 

so the idea within the Department of Defense of a combined arms 

campaign where cyber capabilities are integrated as we go through 

different phases on the run-up to conflict and de-escalation. 

With regards to the treaties, I think Catherine went through it 

in quite good detail. My sense, and from practical experience, is 

that the Law of Armed Conflict does apply in cyberspace, as do 

other international rule sets. There are principles, such as proportionality, that do apply. 

Treaties are important. What we have with the North Atlantic 

Treaty Organization in terms of collective defense is an important 

aspect of it. And those kinds of treaties that fall below the level of 

war that we are using in law enforcement, like the Budapest Convention that Dr. Lotrionte mentioned, are key aspects of how we 

need to think through this problem set. 

With regards to deterrence, we have mentioned the International 

Strategy on Cyberspace a few times. That really is our declaratory 

statement. We reserve the right to use all means to defend ourselves in accordance with international law. But saying something 

is not just the only element of deterrence. We need to be able to 

display and project force, whether that be in economic sanctions or 

in other ways. We need to have deterrence by denial, where we 

build up defenses and avoid things like an OPM breach. We need 

to look at resiliency that takes us beyond U.S. Government activity 

27

and into the critical infrastructure. And we need to do more in 

those areas. 

From the standpoint of diplomacy, I think there is definitely a 

role in this emerging area of cyber diplomacy—whether it be bilateral, multilateral relationships as we see with the North Atlantic 

Treaty Organization, or multi-stakeholder kinds of partnerships as 

we talked about with the United Nations and the Government 

Group of Experts, or in private sector collaboration. More on that 

in just a few moments. 

In terms of foreign policy implications, certainly I think there are 

foreign policy thrusts here. We need to develop norms. We need to 

also develop standards and comport to international standards and 

ensure others comport to those international standards as well. We 

need to have a leveling set of rules. We need to build partnerships, 

public-private partnerships that extend internationally, and we 

need to find enforcement mechanisms as we go forward in time. 

In terms of the administration and the assessment that I would 

have is, again, strategy blueprints have been good, but our implementation has been lagging. We need from the President on down 

a unified vision and a much greater focus on implementation. 

Here we need to look at resources, yes, but also authorities and, 

more importantly, accountability within each of the departments 

that have responsibilities here. And I do believe this takes us into 

new ways of looking at how cyber activities should be comported 

over time. 

In terms of the laws, we need to update the laws, whether it be 

the existing communications laws, such as the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, or the 

Critical Infrastructure Partnership Advisory Council authorities. 

Those all need to be used as updated tools to help us in this area 

of building deterrence. 

Finally, in terms of the role for the committee, I really endorse 

Jim Lewis’s comment about the committee taking on a greater role 

in reviewing the International Strategy on Cyberspace. It does 

need to be updated. The threat has changed significantly. We need 

measures of effectiveness, and I think it would be helpful for the 

committee to be involved there. 

Secondly, I think as an aspect of that, a key aspect, is to begin 

to drive international private-public partnerships, to build trust as 

well as to build a coalition of interested stakeholders to help us 

with norm development, enforcement of those norms, and understanding of cyber conflict. I think to get to that particular point, 

it is important to bring in U.S.-based multinational representatives 

and experts to help inform that discussion and look at things that 

have been discussed already from the government side, like the 

Wassenaar agreements on export control. 

And then, finally, I think from an education standpoint, there 

are ways that we can actually increase our understanding through 

tabletop exercises, and I would commend that the committee think 

about using such types of tabletop exercises to continue their education and promotion of where they want to go in helping us with 

cyberspace. 

I stand ready to address your questions. 

Mr. SALMON. Thank you. 

28

[The prepared statement of Mr. Butler follows:]


96817c-1.eps
29


96817c-2.eps
30


96817c-3.eps
31


96817c-4.eps
32


96817c-5.eps
33


96817c-6.eps
34

Mr. SALMON. Well, we will now begin member questions. 

Last week President Xi Jinping visited the United States. Among 

other things, they came to an agreement on economic espionage, 

cyber espionage that neither country’s government will conduct or 

knowingly support cyber-enabled theft of intellectual property with 

the intent of providing competitive advantages to companies or 

commercial sectors. 

To me, the wording is vague and it gives both the U.S. and the 

Chinese side substantial room for interpretation. 

Tell me, Dr. Lewis, does this agreement actually mean anything? 

Why do you believe President Obama chose to forego any public 

discussion of the grievous economic and security losses from China’s previous attacks? And given that China believes that economic 

security is a national security imperative, do you predict whether 

China will actually substantially decrease or cease cyber theft in 

this realm? 

Mr. LEWIS. Well, I would agree with you. Thank you for the 

question. 

By the way, the very first time I ever testified 15 years ago was 

in front of this committee. I couldn’t sleep the night before, I sweat 

through my shirt, and I stuttered. So it is a lot more fun being here 

as a private citizen. 

Mr. CONNOLLY. Dr. Lewis, I have the same problem. 

Mr. LEWIS. Yeah. 

Mr. SALMON. Just stay awake for the answers, and we will be all 

right. 

Mr. LEWIS. That is my advice. 

It is a significant step forward, because for the first time a Chinese leader has addressed the issue of commercial espionage, and 

in the past, the Chinese have stoutly denied in public that they 

have any concern with this activity. In private, they have made the 

argument that for them commercial espionage is a national security issue, and so therefore they are legitimate in that kind of espionage. 

In talking to administration officials, they know there is wiggle 

room in the language. They have told me they will be watching it 

closely to see how well the Chinese live up to their commitments. 

It is not an on/off switch. This is very difficult for Xi, in particular 

because the PLA, which is our primary actor, makes money. This 

is a source of extracurricular income for them, and they are not 

going to be happy giving it up. 

But we can now count to a degree the number of economic espionage incidents that occur in the U.S., FBI and NSA can count 

them, and so that means if the Chinese live up to their agreement, 

the numbers should start to go down; if it stays the same or it goes 

up, we know they are not. And what I was told by, again, administration officials is sanctions are still on the table. They realize they 

may have to take action. 

Mr. SALMON. Mr. Butler, despite affirmations and reassurances, 

we should still be prepared for malicious cyber incidents, correct? 

Mr. BUTLER. [Nonverbal response.] 

Mr. SALMON. With your prior military and government service 

and current private sector experience, what do you think our priorities should be in contingency planning for these attacks or for conVerDate 0ct 09 2002 15:32 Nov 14, 2015 Jkt 000000 PO 00000 Frm 00038 Fmt 6633 Sfmt 6633 Z:\WORK\_FULL\093015\96817 SHIRL
35

tinued cyber espionage that targets our military and economic assets? 

And lastly, for anyone on the panel after you address that question, if this government—or excuse me—if this agreement doesn’t 

live up to its word, what should the U.S. Government do besides 

maybe sanctions? Are there other opportunities to escalate the severity of the issue? So what are some of the other options? Mr. Butler. 

Mr. BUTLER. Thank you, Congressman Salmon. I think our priority is to get our own house in order here. We need to improve 

our defenses first and foremost. We can’t go through another type 

of breach like we have seen of the magnitude and severity of the 

OPM breach. So finding ways to, what I would say, create cyber 

hygiene and doing that quickly will help us in a significant way. 

I think beyond that, it is now thinking through resiliency within 

the critical infrastructure. As a foundational piece, I think we need 

to continue to improve in our deterrence by denial activities. 

At the same time, we need to think through how to establish 

norms much faster and find ways to enforce those norms. Again, 

I think one aspect of that is what I was discussing earlier, by 

bringing the private sector into the discussion to help us with understanding their perspective and looking at ways that we can tie 

together continuity of government and continuity of business-type 

activity. 

Beyond that, and in terms of other options, we need to make sure 

that we not only speak about the potential for creating cost on the 

part of an adversary, but be able to show that. And that needs to 

be certainly in the demonstration of force, things like economic 

sanctions, but it is also showing the ability to be able to operate 

in spite of attacks. And so finding ways to work across the spectrum of those options, I think, is absolutely critical. 

When we talk about deterrence today, it is cross-domain, it is the 

idea of using economic sanctions, potentially some other tools in 

the economic inventory that take us from beyond OFAC work into 

looking at ways that we could restrict travel of individuals into our 

country based on, you know, wrongful acts that are being prosecuted. It is certainly building the capability through our law enforcement activities and finding ways to not only name and shame, 

but to continue to work with entities like Interpol to help us with 

taking down illegal activity around the world. It is working to continue to grow the cyber mission forces that we have laid out in the 

defense cyber strategy. So I think it is a multi-facetted strategy, it 

is cross-domain deterrence. 

Ms. LOTRIONTE. If I can add something to that. I think that with 

this agreement, it would be very good if the United States had a 

plan in place already for, one, how they are going to verify this. So, 

optimally right now, we would have measures in place and sensors 

in place that we would be able to basically approach the Chinese, 

and we would have to determine now which forum we would want 

to approach them in when and if they cheat in this agreement. 

Once that happens, though, I think we have to have, as Bob said, 

a cross-domain strategy. 

And I would activate all those elements at once, meaning I would 

use law enforcement tools; I would start prosecuting those that are 

36

violating our domestic law; I would pull out all the options on sanctions, whether it is financial or others; I would also look at the 

WTO; and I would start bringing immediately—I would have the 

USTR ready to bring charges or claims against China for violations 

in the TRIPS agreement; and, of course, less spoken of publicly, I 

would have our intelligence organizations actively prepared to do 

counterintelligence and, in the more covert world, things to counter 

their actions. 

So, I think we need to have that plan now and assume the worst, 

assume that they will cheat, so the minute they do, we have every 

avenue of the U.S. Government prepared to take action. 

Mr. LEWIS. Just to build on that quickly, there was an intense 

debate within the administration on how to respond to the OPM 

hack, and sanctions were the middle course. Some people wanted 

to do more aggressive things, some people didn’t want to do anything. So I think that the Chinese got the message that we were 

mad about this and would take action. 

And in the future, to both strengthen deterrence and make sure 

there is compliance with the agreement, we probably will need to 

think about possible punitive actions, whether that is publishing financial data, leaking financial data on Chinese leaders, or erasing 

data on their servers, sanctions, indictments. There are a range of 

tools, but we will probably have to use them. 

Chairman ROYCE [presiding]. We are going to go now to our 

ranking member, Mr. Eliot Engel. 

Mr. ENGEL. Thank you, Mr. Chairman. 

As your testimony shows, the international community has not 

yet formed a consensus on how to reduce cyber conflict. For example, some of our adversaries in cyberspace have advocated for an 

arms control approach, while America is focused on establishing 

global norms and confidence-building measures. 

So let me ask Dr. Lewis and Mr. Butler, what do you see as the 

greatest factors motivating countries to support one approach over 

the other, and what are the most significant barriers to fostering 

a greater international consensus? Why don’t we start with you, 

Dr. Lewis. 

Mr. LEWIS. Thank you for the question. 

One of the things that is interesting is that while there is a wide 

disparity of views on what we should do, all countries are afraid 

of cyber war, and this is from the biggest to the smallest, and 

many of them fear Cyber Command quite a bit. And I always wonder, should I tell them the truth or should I let them continue to 

believe that we are omnipotent, but that is the impression, and so 

it is that shared fear that drives the negotiation. 

The dilemmas with a traditional arms control approach, which is 

the preferred Russian approach, is, it is difficult to define what is 

a cyber arm. They clearly would like to include information in that 

category. The Russians talked about information weapons, which 

doesn’t make any sense, right, but they would like to control information, and they have supporters in the world. 

So the treaty approach has verification problems, it has definition problems, and that is why the U.S. decided to go after norms 

of state behavior. You have to think about how you would verify 

compliance with norms and you have to think about penalties if 

37

norms aren’t followed, but the arms control approach has just not 

been that useful because of its sort of structural problems that we 

face. 

Mr. ENGEL. Thank you. 

Mr. Butler. 

Mr. BUTLER. Yes, Congressman Engel. I think the incentives and 

the factors for driving people into this discussion exist. Really everyone is affected by some type of malware or maliciousness that 

is going on in cyberspace, whether it is China, Russia, Iran, North 

Korea, our allies are affected, and so there is an incentive to come 

to the table and discuss. The challenge, as Jim indicated, is there 

is fear. There are also problems with taxonomy. We have different 

doctrines in terms of what is in cyberspace, and what is not in 

cyberspace, including these physical and logical structures. 

We also are challenged with regards to understanding our overall 

objectives as we come to the table. As we look at, for instance, you 

know, the United States, we are trying to create an open and secure environment that allows for a global transaction platform and 

national security. Many countries see the benefits in that, but they 

see it as a U.S.-defined environment, and so going to multi-stakeholder types of venues actually helps us, the government group of 

experts, for instance. 

And, finally, I would say that one of the other barriers is getting 

folks involved in the global economic system. And here is where the 

private sector again comes into play. I think it is important for nations, whether they are, you know, very, very developed or underdeveloped, to see where we are heading and helping folks to begin 

to see the value of being on the Internet. 

There is this aspect of fear that not only comes from cyber war 

for high-end states, but as we think about some of the underdeveloped countries of the world not understanding exactly where 

we are going in terms of an interconnected society. 

Mr. ENGEL. Thank you. 

Dr. Lotrionte, let me throw a double-edged question at you. As 

international conflict increasingly moves into cyberspace, we need 

to be prepared for situations in which our military engages in hostilities overseas without deploying troops outside the United States. 

So in your opinion, would such activities trigger the congressional 

oversight and authorization requirements of the War Powers Resolution, and what steps should Congress take to ensure that cyber 

activities of the U.S. military fall within these oversight and authorization requirements? 

And let me also add, as the United States works to develop global norms and customary international law governing cyber conflict, 

what legal clarifications are needed to ensure that we are able to 

prevent and respond to cyber threats by terrorist groups and other 

nonstate actors? 

Ms. LOTRIONTE. Okay. Thank you for the two-part question. 

First on your question with respect to the applicability of the 

War Powers Resolution, so as it is today, the language of that statute today, for most of the cyber activities that one could anticipate 

or think of where the U.S. would be conducting these activities 

abroad without soldiers engaged abroad, my position on that in the 

current state of the language is it is not applicable, meaning that 

38

if you look at the words within that statute, there could be a whole 

scope of cyber activities that would not trigger. So, if the President 

is honestly looking at that statute and trying to fulfill his reporting 

and consulting requirements, there are a lot of activities that 

would not be triggered. 

There are two elements of that resolution that bring me to that 

reason. The two triggering elements for reporting are the words 

‘‘armed forces’’ and ‘‘hostilities.’’ And when you are talking about, 

not just cyber, but other emerging technologies, even drones, 

nanotechnology, there is a slew of new technologies in which this 

resolution is wholly inadequate in terms of covering. 

But particularly with cyber, when you are talking about armed 

forces, that language needs to be expanded if you would like to 

cover and trigger that consulting and reporting requirement from 

the executive branch. As well as the phraseology with respect to 

hostilities, that has to also be expanded. 

So, you know, for instance on the armed forces, it is not so much 

armed forces will be involved overseas necessarily when you are 

talking about the use of cyber tools by the President, but you need 

to use the language that would be suitable for that statute would 

be something to the effect of adding capabilities, language about capabilities, oriented provisions or supplies. 

And as far as the phrase in the statute on hostilities, I would expand that language and not just leave it as it is today, but expand 

it to include it is not only engaging in hostilities, but it is also potentially the violation of the sovereignty of another nation that may 

trigger it. 

Now, this, of course, would take some consultation, but if you ask 

me the original intent of that statute, if we wanted that original 

intent to consist today and you want the reporting and consulting 

that was envisioned for the legislative branch in the war-making 

process with the President, that is what I would say would need 

to be changed. 

That was the first one. Would you like me to go on to the second 

question you had or——

Chairman ROYCE. Should we do that in writing? 

Mr. ENGEL. I guess we can do that in writing. 

Ms. LOTRIONTE. Okay. 

Mr. ENGEL. Thank you. 

Chairman ROYCE. Yeah. Thank you. 

Let me ask a quick question to Dr. Lewis. We had the cyber attack on Turkey’s electric grid. That was on March 31 of 2015. That 

was a 12-hour power outage, affected 40 million people in Turkey. 

You had the Iran cyber attack against American companies and the 

2012 cyber attack on Saudi Arabia’s oil conglomerate that destroyed the data on tens of thousands of computers. 

So the question I have is what impact could the administration’s 

lifting of sanctions on Iran have on Iran’s cyber capabilities going 

forward? 

Mr. LEWIS. It is a very good question and one that I think people, 

particularly in the financial sector, have been paying close attention to. The theory that most folks had was that Iran would be on 

its best behavior while the nuclear deal was being negotiated. 

39

Chairman ROYCE. But they were hacking during the—they were 

doing the attacks during the deal. 

Mr. LEWIS. Well, they weren’t doing it as much as they were 

doing it against U.S. banks. They toned back a little bit. And the 

question is once this is completed, will they resume their activity, 

and so I think that is something that we are all watching. 

My assumption is that Iran will be aggressive in the Persian 

Gulf. And the whole point of much of the discussion around the 

Sony episode——

Chairman ROYCE. Okay. I have got to stop you right there——

Mr. LEWIS. Okay. 

Chairman ROYCE [continuing]. Because James Clapper says that 

Iran used cyber to attack U.S. military networks in December 

2014. That would be in the middle of the Iranian nuclear negotiations. I don’t know how you can present this thesis if they are in 

bad behavior in the middle of a negotiation where they are trying 

to get us to do what they want us to do, and now you say, well, 

now afterwards, after we have lost the leverage, they are going to 

change their behavior. And let me go to another question. 

Mr. LEWIS. Oh, change their behavior for the worst. 

Chairman ROYCE. Yeah. 

Mr. LEWIS. This is not—one of the changes in the last few years 

has been significant improvement on Iran’s attack capabilities. 

Chairman ROYCE. Yeah. 

Mr. LEWIS. So the concern is will they use them against the 

U.S.? And they used them against Sands. 

Chairman ROYCE. Yeah. 

Mr. LEWIS. You know, so——

Chairman ROYCE. Yeah. Well, very good. I appreciate that, Dr. 

Lewis. 

I have got a question for Bob Butler. The DNI, our Director of 

National Intelligence, says he doesn’t think that the agreement announced last week during the visit of President Xi is going to impact the bottom line in how China attempts to access U.S. computer systems, including our intellectual property. I was going to 

see if you agree with that. How do you gauge that agreement? Is 

it going to affect the cyber conflict? Are they going to honor the 

agreement? 

Mr. BUTLER. I think the proof is in the pudding. We are going 

to have to wait and see. We had an agreement on Friday. We have 

also had an informal announcement about the Chinese not being 

very happy with some of our positions on U.S. Internet policy since 

then. I think we need to see from a validation and verification 

standpoint with regards to the follow-through on this. 

My sense is the wording is important. You know, there was no 

agreement, of course, on espionage writ large, specifically on commercial secrets and how that is interpreted. So I think we need to 

put in place immediately some type of validation and verification 

scheme that takes advantage of our national intelligence apparatus, but also capabilities that we have in the private sector to understand what exactly is changing and how it is changing as we go 

forward in time. 

Chairman ROYCE. Let me ask a question of Dr. Lotrionte. Which 

U.S. Government agencies are responsible for addressing cyberVerDate 0ct 09 2002 15:32 Nov 14, 2015 Jkt 000000 PO 00000 Frm 00043 Fmt 6633 Sfmt 6633 Z:\WORK\_FULL\093015\96817 SHIRL
40

war-related threats and response and recovery efforts? Because the 

point I want to make is should the Department of Defense protect 

the cybersecurity of the U.S. homeland from significant cyber attacks? And is it really time for us to look at this just as, you know, 

during the second world war, we stood up the Air Force as a separate branch in order to give that responsibility, give that authority? 

Is it time to do something like that? 

Ms. LOTRIONTE. So I think there are multiple agencies and departments that have underneath their legal mission or authority a 

role to play both in preventing, but also countering and responding. 

First I would start with State Department, the significant role in 

the diplomacy. In order to have a form of deterrence, we need to 

have the establishment of some agreements, these norms, right, to 

make a link——

Chairman ROYCE. You know what, what I am going to ask you 

to do, as an attorney, you have a great background in this: Could 

you delineate that in writing for me, because I am about to be out 

of time and I wanted to ask Bob Butler one more question? 

If a cyber attack took down our financial system or took down 

the electrical grid, would the United States consider it a use of 

force, and if so, how would we determine who to strike back and 

who to strike against? 

And, Dr. Lotrionte, I am going to ask you that too, but, Bob? 

Mr. BUTLER. Sure. Mr. Chairman, certainly from the vantage 

point of taking down life safety systems, the grid, water treatment 

systems, and looking at our financial services, I think that would 

be of serious consequence. We are planning, from a DOD standpoint, national teams to support that. 

In terms of figuring it out, you know, I think we have to understand what the ‘‘roll-up’’ is to cyber conflict, and maybe I will just 

take 30 seconds here to explain how that takes place. 

I mean, initially we see reconnaissance activity, right? We see 

people scanning networks. We then see people crawling on networks. Then we see focused targeting of activity based on our 

knowledge—based on the adversary’s knowledge from what they 

have done on reconnaissance and surveillance activities. Then potentially we see exploitation through malware that could lead to 

stealing things. It could also be an implant that basically positions 

someone for a further attack, whether it is disruptive or destructive. 

We would need to find and ‘‘lay in’’ intelligence both on the national security side and with commercial sensors to help us understand what is ‘‘going on,’’ on the network. 

Chairman ROYCE. Well, okay. So here is what I am going to do. 

I am out of time, but——

Mr. BUTLER. Yes. 

Chairman ROYCE [continuing]. If any of the three witnesses for 

the last two questions have some ideas here in terms of attribution 

techniques and how we could follow up on that, because that is 

what you are getting to, that would be helpful to the committee. 

We now go to Karen Bass of California. 

Ms. BASS. Thank you, Mr. Chair. 

In listening to your testimony, I wanted to know if either one of 

you, you know, out of the three could give me examples of where 

41

you think other countries are doing a good job in terms of 

cybersecurity, and maybe there are some lessons that we can learn 

from there. 

And then I believe it was you, Mr. Butler, that were talking 

about the consequences and maybe imposing sanctions on individuals. But then, how do we address it when a lot of this is state 

run? 

And then finally, sorry to load up all my questions, but when I 

think of some of the major terrorist groups that we are dealing 

with, whether it is Al Qaeda or ISIS, or the Taliban, what level of 

involvement do they have in cyber attacks? 

Mr. LEWIS. I will start. Let me come back briefly to the earlier 

question, though, which is to if you want to get the Iranians to 

change how they think about this, you don’t want to take a passive 

approach, and that has been one of our problems——

Ms. BASS. Are you——

Mr. LEWIS [continuing]. One of our problems in cybersecurity. We 

need to make credible threats and we need to have countries believe that we will respond with some punitive action. 

Not a lot of people are doing a good job on this. The Israelis have 

done a good job, but not perfect. The Russians have done a good 

job, the French, and to some extent the British. That might be it 

in the world. We do okay, but one of the things we need to do is 

make people believe that if they hack us, there will be punishment, 

and that is maybe the most important thing we can do. 

Ms. BASS. And are any of our intelligence agencies cooperating 

or taking lessons and implementing practices from the countries 

you just mentioned? 

Mr. LEWIS. We have really close relations with the British. We 

have okay relations with the Israelis and the French, good relations, but not as close as the British. So there is an effort in the 

context of our alliances to build a collective defense. 

Ms. BASS. Thank you. 

Mr. BUTLER. Let me go to your first question with regards to 

states that are doing good work in the area of cybersecurity. I 

think the U.S. model and allied models continue to grow. And when 

I look at really good work going on around the globe. I think of the 

partnerships that we have in place. 

So, if I look at the Japanese Computer Emergency Response 

Team, which is really the APAC Computer Emergency Response 

Team, they have taken lessons learned from what we have done 

and others, and are really doing a pretty good job in tracking advanced persistent threats. 

When I think about, for instance, what are we doing on the global transaction platform, the Financial Services-ISAC, or Information Sharing and Analysis Center, has broadened their approach to 

where they are now looking globally as opposed to just within the 

country. 

There is a new activity that has stood up in Singapore that is 

an extension of Interpol—Global Center for Innovation. Here, a 

model that we, I think, pioneered, maybe some others were involved in terms of botnet takedowns, proactive botnet ‘‘takedowns,’’ 

is being worked on on a global basis. 

42

So I think both on the proactive/prevention side as well as on the 

prevent, or on the response side, there are models that we can look 

at. And, again, we have been involved with helping others in that 

area, but we can also learn from that as well. 

In terms of sanction enforcements, I think, again, it is a combination of trust and verify. So there are different economic and 

trade remedies that could be employed. We need to look at the impact as best we know it would have on the nation-state, and then 

we need to think through the enforcement, the verification mechanism, and certainly intelligence is involved in there, but we could 

also ensure validation through a partner working in conjunction 

with us against that potential adversary. 

In terms of looking at the terrorist issue, deterrence is different. 

I like to talk about tailored deterrence against nation-states, a nation-state, and what is required to deter that particular actor. A lot 

of the things we have been talking about lately really are focused 

on determined resource nation-states as opposed to terrorist 

groups. 

And in this space, we need to think hard about, you know, for 

instance, in ISIS, that is growing in social media campaigns and 

recruiting and creating challenges for us. How do we deter those 

kinds of actors and how do we deter actors that are really where 

we don’t know a lot about their doctrine? 

Ms. BASS. Thank you. I appreciate it. 

Dr. Lotrionte? 

Ms. LOTRIONTE. In terms of other countries working well on the 

cybersecurity front, I would put in a word for the Brits in terms 

of what I have seen they do. Now, a lot in the awareness area and 

also working with their universities. They have less than we do in 

this country, but they have done a lot of good work, the government has, in reaching out and coordinating to understand what resources on that, the higher education level, and putting in R&D as 

well. 

I think they are not better than us, but they have followed our 

lead in most of the ways that we have communicated with the private sector. I think they also are working on getting better at that, 

sending out warnings to their companies about the nature of the 

threat. 

But I would say in general, and this is not always the case, I 

think the U.S. is the lead in this, and the Europeans, I have heard 

the Europeans say that. And I have often had, whether it is the 

Japanese or the Germans or other East Asian countries, when they 

come into town, the officials are coming into town and going to the 

State Department, they often come to me and they have asked me, 

talk to me about how the U.S. is handling and doing their 

cybersecurity work. And they are looking to us for good examples, 

for models. So I think that might be my general sense. 

On the sanctions, over the years watching how under international law targeted sanctions, while slow in terms of their effectiveness, can ultimately be effective. I think you can do very targeted, smart sanctions against individuals. You know, I personally 

like the thought of freezing assets. When people lose their money 

and they no longer can get their money, you usually see some effect. 

43

Ms. BASS. Thank you. 

Ms. LOTRIONTE. And terrorist groups are also definitely, as Bob 

has already said, a consideration we have to deal with. 

Ms. BASS. Thank you very much. 

Chairman ROYCE. We go now to Mr. Dana Rohrabacher of California. 

Mr. ROHRABACHER. Thank you very much, Mr. Chairman. 

I guess we are talking about a number of approaches to this sort 

of new subject. I don’t think anybody talked about this 10, 20 years 

ago. And what you just said when we were talking about a retaliation, I was thinking in terms of retaliation versus sanctions. 

Would it not be better to try to set up a system where we are 

not offering some sort of economic sanction, but instead if we catch 

you and your people, how do you say, disturbing our system, our 

economic system in some way or our weapons systems, that we will 

just retaliate against your systems? That the Chinese banks will 

have to experience some problems if people keep hacking into our 

banks? Isn’t that what—wouldn’t that be more effective than telling the Chinese Government, you are going to not be able to deliver 

anymore widgets over here that you have manufactured? 

Ms. LOTRIONTE. I can——

Mr. ROHRABACHER. And we will ask our whole panel that. Go 

right ahead. 

Ms. LOTRIONTE. I can say something about the law, at least 

international law. Well, first, absolutely correct: 10 years ago we 

weren’t dealing with the level of threats, and therefore, it wasn’t 

really a conversation about talking about responses, right, and how 

to react to this. But since then, luckily, a lot of people have given 

a lot of their time internationally to think about the rules that we 

had and have today, can we actually use them effectively to actually respond in a pretty effective and meaningful way? 

And, yes, it is sometimes economic, you try to use the, if you will, 

less escalatory means to resolve this dispute, right, whatever it is, 

and the law actually requires that. But at times you will need to 

actually go to the higher level of the spectrum and maybe use force. 

So most of what my written statement for the record, that I have 

given you, but also I tried to summarize it really quickly was that 

is why I put most emphasis on really looking at some key terminology that we have all accepted under international law, use of 

force in armed attack, and come to agreement on what those terms 

mean. Why is that important? Well, it is because then we will all 

know where the line is. 

Mr. ROHRABACHER. Right. I understand that part of your testimony. 

Ms. LOTRIONTE. And I think you can use force. 

Mr. ROHRABACHER. I think the gentleman would like to comment 

as well. 

Mr. LEWIS. Sure. Thank you, Congressman. 

So we talked earlier about a deterrence deficit. People don’t believe that the U.S. will take action in response——

Mr. ROHRABACHER. Right. 

Mr. LEWIS [continuing]. To these cyber things, and so we——

Mr. ROHRABACHER. There is no deterrent unless there is a capability of retaliating. 

44

Mr. LEWIS. Well, we have the capability, it is people don’t think 

we will do it. And so one of the most important things we could 

do is think, how do we persuade the people like the Irans, the Chinas, the Russias that we would retaliate for some kind of cyber action. And many of us are coming to the belief that——

Mr. ROHRABACHER. Give me——

Mr. LEWIS [continuing]. We might have to do it once. 

Mr. ROHRABACHER. Give me an example of when you say, we will 

retaliate, what that would mean. 

Mr. LEWIS. You have a range of options. You could, for example, 

with OPM, you could have erased data on some of the Chinese 

computer networks that held the OPM data. That wouldn’t have 

taken it away. It is gone forever. But it would have sent a signal. 

You could leak financial data on Chinese leadership. You could 

interfere with the power grid. There is a whole range of things we 

could do. But I think the fear is until we do something, and it 

might be sanctions, until we show some reaction, people won’t take 

our threats seriously. 

Mr. ROHRABACHER. Mr. Butler, do you want to——

Mr. BUTLER. I think it is important to look at who we are trying 

to deter. So in China, for instance, if you go back and just look at 

August and the Shanghai Exchange, I mean, something that would 

hurt would be to impact, you know, them economically. They are 

trying to be part of a global economic system——

Mr. ROHRABACHER. Give me an example of what you think we 

would—if China has these assets that they are now building that 

will hurt us, what would we do with our capabilities to retaliate 

against a Chinese, well, they already are, apparently, breaking into 

our banking system, et cetera. 

Mr. BUTLER. If we could impact them adversely in an economic 

way, I think that will have a significant impact on it. I mean more 

and more, I see people like Jack Ma of Alibaba, Huawei, and ZTE 

driving into the global economic system, and needing business outside of China. And they have influence in China. 

On the flip side of it, we have organizations, U.S.-based multinationals that have relationships in China and actually have Chinese clients. We should be taking advantage of that to shape the 

environment to our advantage, as opposed to waiting for something 

and then reacting. 

Mr. ROHRABACHER. I think this is a very fruitful discussion, but 

only probably the first one that we should have on this issue. And 

let me note that—let me ask this. When the chairman mentioned 

the cyber attack that may have taken place with the Iranians 

against some of our naval vessels, could that have been in retaliation for, perhaps, an Israeli attack on their reactors? 

Mr. LEWIS. I don’t know in that particular case. In other cases, 

there probably has been some retaliation because of attacks attributed to Israel. So the Kharg Island incident where the Iranian 

oil——

Mr. ROHRABACHER. We are going to have to make sure that we 

establish, and this hearing is the first step toward getting an honest discussion of this, so I thank the chairman for scheduling this 

hearing because we are going to need to know how to verify that 

there has been an attack, verify who the attack is from. We are 

45

going to determine what type of protection that we can have that 

will nullify or at least protect us against these attacks, what type 

of systems we need. 

And then we need to discuss if there are attacks like this, what 

type of retaliation, what are our options of retaliation. And as we 

heard earlier, even the wording as to what will, what will justify 

a type of retaliation, just the wording of it, we haven’t even determined that yet. 

Mr. LEWIS. That is a really important——

Chairman ROYCE. And maybe, Doctor, we can respond to that in 

writing. 

We are going to go to Alan Lowenthal from California. 

Mr. LOWENTHAL. Thank you, Mr. Chair. And I want to thank the 

panelists. I mean, this is something that I am just learning myself 

and I find it fascinating but I certainly don’t consider myself an expert in any way. 

I would like to return now when we are dealing with 

cybersecurity, rather than the focus on where the attacks come 

from on our own infrastructure and how much we are doing to protect ourselves and our infrastructure. I believe that the President 

has issued an Executive order pledging, I think it was 13636, to 

improve our infrastructure, critical infrastructure in terms of 

cybersecurity. 

I would like to know what significant security developments have 

resulted from that Executive order. Has it been effective? How 

much of our own critical infrastructure is vulnerable? And what 

are we doing about our own infrastructure to understand the 

vulnerabilities that we face today? Anybody want to jump in? 

Again, to my edification. It may be common knowledge to everyone 

else but it certainly isn’t to me. 

Mr. BUTLER. I think it is a great question. With the Executive 

order and actually prior to the Executive order, certainty our life/

safety systems sectors have been taking action. They have been 

incentivized through the government to take more action. 

Again, I will just start with financial services and our banks and 

related financial service activities, they have been practicing, you 

know, in terms of incident response for some time. They have been 

doing a lot of information sharing. They have gone beyond information sharing into joint solutioning. They have helped to develop 

automated ways of information sharing to find new standards, and 

they have taken that globally. 

When I look at what is going on in the energy world, we have 

work to do. Our energy grid is a challenge. And based on the regulatory nature of how FERC and NERC work to support different 

utilities, co-ops, and consortiums. We need to find ways to actually 

not only create incentives but work through standards and get the 

grid to a point where it is a lot more resilient than it is today. As 

we build that new infrastructure. 

Mr. LOWENTHAL. Have we not looked at these issues over time? 

Is that really, we did we not understand the vulnerabilities to our 

private sector and allowed them to develop without even questioning some of these issues? And is that true in terms of our own, 

say, Department of Defense which may have been more responsive 

to some of these issues earlier? I don’t understand the difference 

46

between the private sector development and the public sector development, the defense development. 

Mr. BUTLER. In the Department of Defense, we have been working on the whole issue of cyberspace and operating effectively in 

cyberspace for years. We have continued to try to ramp up and improve our defenses as we work through concepts for growing cyberspace as an operational domain in conflict and warfare. 

From the private sector perspective, there has been different levels of understanding and knowledge, primarily driven by business 

motives. And so the financial services, even before the 2012/2013 

attacks, the distributed denial-of-service attacks, were moving in a 

very accelerated direction to make themselves more resilient on a 

global transaction platform. 

I would say oil and natural gas is getting there, but they are late 

to the game. And they are working hard to catch up. They have to 

work through different kinds of upstream and downstream activities to kind of ensure that people understand at all levels within 

an organization, to include their supply chain, what is at stake. 

Certainly Saudi Aramco woke them up to that. 

On the grid side, in California, we have seen the physical attacks 

up in Menlo Park and the Metcalf substation. Since those physical 

attacks, there has been lots of educational outreach in terms of ensuring utilities in California and elsewhere are moving in that direction. The challenge is rate structures. It costs to build security. 

And one of the issues that I am constantly faced with on the private sector side is how do I generate a return on investment as I 

build into security? What the President has done and the administration has done is opening up a new dialogue that allows us to 

drive more into incentivizing the private sector through threat 

sharing, ability of using CIPAC, Critical Infrastructure Partnership 

Advisory Council, authorities to get limited liability protections, 

collaborate with government and others that are ahead in this 

game, and to drive us to a new level so all boats rise together from 

the country’s standpoint. But it is taking time. 

Mr. LEWIS. We started talking about this in 1998. In fact, we 

started talking about this in 1996. So it has been a slow progress. 

But banks, telecommunications companies, and defense industrial 

companies are generally at the top of the league, they are the best. 

Electrical grid it is a very mixed performance. Some companies do 

good, some don’t. 

One thing to watch is the new industry. So everyone knows your 

car is slowly becoming a rolling computer. So the auto industries, 

the airplane industries, they are beginning to focus on 

cybersecurity. But it varies from sector to sector. And we haven’t 

found a good way to change that. 

Mr. LOWENTHAL. Thank you, Mr. Chairman. 

Chairman ROYCE. Thank you. We go to Mr. Randy Weber. 

Mr. WEBER. Thank you. Mr. Butler, what is the price, how high 

of a price is water if you can’t get it? What price would you pay? 

Mr. BUTLER. I think it is needed for life. 

Mr. WEBER. Yes. Whatever it is——

Mr. BUTLER [continuing]. Price on it. 

47

Mr. WEBER. I am fascinated by the exchange with you and Mr. 

Lowenthal about the infrastructure, for example. And the thought 

occurs to me on energy, electricity, we have got to have it. 

Mr. BUTLER. Right. 

Mr. WEBER. We absolutely have to have it. So maybe a redundant system, one that is connected, both of them connected to the 

grid, and I know the price, you mentioned rates would be important, I get that. But there is people who have to have dialysis or 

police departments have to run, or military, it is a security and it 

is a life issue in a lot of ways. So maybe the answer to that is a 

redundant setup where you have two power plants side by side, I 

know, cost is a factor, one that is controlled, you know, through the 

Internet, if you will. 

And I have pipelines all over the State of Texas. And they actually can control the entire pipeline across the country from their 

control room. So maybe that is the answer. Maybe you have a 

standalone unit that is not connected to the Internet so none of our 

enemies can shut it down. But yet it can snap on line in just a matter of seconds or minutes more appropriately. So interesting discussion. Dr. Lewis, you said that advanced cyber capability, in your 

comments there was five countries, U.S., U.K., Russia, China, and 

Israel. Define advanced cyber capability. 

Mr. LEWIS. The usual way to look at it is they could cause physical destruction. They could cause the kind of disruption in services 

that you were talking about. They could turn off electrical plants. 

Mr. WEBER. Is it safe to say that they have, for lack of a better 

term, a military officer or probably a 12-year-old kid in a computer 

room, that can hack—that is what they do, that is their job? 

Mr. LEWIS. The bad news is the countries that don’t like us, including Iran, Russia, and China, have probed our critical infrastructure and have looked for vulnerabilities and are prepared to 

turn it off if necessary. 

Mr. WEBER. Okay. What is the percentage of their success? Mr. 

Butler, you mentioned earlier they are watching people monitor the 

grid. Would you say that of those people who are trying to attack 

us, are they 1 percent successful, 10 percent successful? 

Mr. LEWIS. My guess would be, I don’t know what Bob thinks, 

it would be closer to 100 percent. 

Mr. WEBER. Well, that is encouraging. And you said Russia and 

China, you ought to be putting sanctions on it. Is a reverse hacking, are we able to reverse hack them? Now, somebody mentioned, 

you know, maybe it was Dr. Lotrionte? Is that how you say that? 

Said releasing the personal financial information of Chinese leaders? Are you advocating that we have a department in our military, 

if you will, that actually does that, hacks to get back at them and 

then, is that what you are saying? 

Mr. LEWIS. One of the problems in this whole thing is we have 

taken kind of a passive approach. We have taken a technical approach. We have focused on making our defenses strong which you 

could call it a Maginot Line approach. We have to find ways——

Mr. WEBER. How did that work with the French by the way? 

Mr. LEWIS. We don’t want to be on the same path. 

Mr. WEBER. You think? 

48

Mr. LEWIS. I think we need to find ways to demonstrate to countries that we will not put up with this. 

Mr. WEBER. So, Dr. Lotrionte, am I saying that right? 

Ms. LOTRIONTE. You are. 

Mr. WEBER. Okay. And you said in 2005 was really the first appearance of was it a cyber crime, was that international legislation? I missed that. That got by me. Do you remember? 

Ms. LOTRIONTE. Was that the 2008, the armed conflict that I was 

mentioning? 

Mr. WEBER. That is what it was. Thank you. 

Ms. LOTRIONTE. I wanted to set it up to say we are starting to 

see the cyber tools and operations be used within armed conflicts. 

And they are continuing. But first for state level it was 2008 in 

Georgia and Russia. 

Mr. WEBER. I am surprised that it took that long, quite frankly. 

And then, Dr. Lewis, you said the Israelis did a good job on responding. What does that look like? 

Mr. LEWIS. They have an advantage because they are a small 

country. And one of the things that they have is they use their 

military to identify talent. So they recruit kids out of high school. 

Mr. WEBER. That is that set, like I was talking about in China, 

they have got a group of people that that is their attack, that is 

their platoon or whatever you want to call it. That is their job. 

Mr. LEWIS. The Israelis are under attack probably every week by 

Hezbollah, very low level attacks, and probably by Iran, by the Syrian Electronic Army. 

Mr. WEBER. Well, we are too I mean not necessarily by those entities but others. 

Mr. LEWIS. They are a lot smaller. And so they don’t have what 

you would call strategic depth. So they get a lot of practice. People 

are a little more afraid of attacking us. But we need to make them 

more afraid. 

Mr. WEBER. Okay. All right. Thank you, Mr. Chairman. I yield 

back. 

Chairman ROYCE. We go now to Mr. Ted Poe of Texas. 

Mr. POE. Thank you, Mr. Chairman. The cyber attack on Sony 

Pictures Entertainment by North Korea, in your opinion, Dr. 

Lewis, is that an act of terrorism? 

Mr. LEWIS. Yeah, so it is one of these things that falls in this 

gray area because they did disrupt Sony Pictures, they leaked damaging materials, they put out emails. It was a coercive act, right? 

Now, whether you call that terrorism or not, I would call it coercion. The North Koreans probably intended it to terrify Sony. So 

they were doing this intentionally to punish Sony for that movie. 

Mr. POE. North Korea used to be on the State Sponsors of Terrorism List. They are off. Do you think we should reconsider that, 

Dr. Lewis? Just your opinion. 

Mr. LEWIS. Sure. No, I don’t. Because it is, what influences how 

countries think about this doesn’t have to do with sanctions that 

are external to that or terrorism lists that are external to that. We 

need to think about things that directly apply to cybersecurity. And 

that is where the committee might want to do some work. Putting 

them back on the list or taking them off, it is not going to affect 

their behavior. We need to do things that are more direct. 

49

Mr. POE. Because their behavior is bad. 

Mr. LEWIS. Yes. Oh, yeah. 

Mr. POE. Let me ask the other two witnesses, same question, do 

you think it is an act of terrorism? And if you think it is, should 

they be put back on the list? Just your opinion. Both of you. All 

three witnesses. 

Mr. BUTLER. I rarely disagree with Jim. I think we need to spend 

more time thinking about what the North Koreans are really trying 

to do here. They are building a cyber capability. And they did 

achieve their desired effect in really terrorizing a large entertainment firm. Where is that going to go? And so I think, I wouldn’t 

rule it out in terms of putting them back on an established terrorist list. But I think we need to spend more time understanding 

where they are growing with their capabilities, as well as intent. 

Ms. LOTRIONTE. If I took a very legalistic approach to it, under 

international law, I would call that not an act of terrorism but a 

violation of the norm of non-intervention under international law 

which is——

Mr. POE. Wait a minute. Wait a minute. Wait a minute. What 

did you just say? 

Ms. LOTRIONTE. Not to get in the weeds, but the norm of noninvention under international law which is——

Mr. POE. The norm of non-intervention under international law. 

Ms. LOTRIONTE. It is what Lewis described as coercive. It is by 

definition coercive interference when you are basically bleeding or 

forcing a state to give up one of its fundamental rights under international law. And that typically is seen as political elections. But 

also it can be the freedom of speech. So this was illegal, in my 

view, under international law. It was a violation of the norm of 

non-intervention but not terrorism. 

Mr. POE. Okay. And just following up on that, the Sony situation, 

any consequences for that attack? Were there any consequences on 

the North Koreans for doing what they did? 

Ms. LOTRIONTE. As a policy matter——

Mr. POE. Did somebody call them to the principal’s office? Were 

they retaliated against? Did we hack into their system? I mean, 

was there any type of response to that act by Sony? I mean by——

Mr. LEWIS. I think they were scared. So one of the things that 

has come up repeatedly in the questioning is our ability to attribute the source of an attack. And about 8 years ago, DOD started to work really hard with a lot of money in—to be able to figure 

out who is doing the hacking. And I think the North Koreans were 

shocked that we were able to tell so quickly that it was them. And 

that scared them. 

Five years ago, they did another attack on U.S. facilities, not as 

bad. We never were quite sure. This time we knew it was them. 

We could take pictures of the guys doing it. Right. So it is that improved attribution capability that scared them. 

Ms. LOTRIONTE. So to answer that question, was there a response 

or retaliation, what was publicly, at least, available to know, it 

does not appear that the U.S. took a public move in response, retaliation. 

Now, I would hope or assume that our intelligence organizations 

have responded to that. And under international law, a counterVerDate 0ct 09 2002 15:32 Nov 14, 2015 Jkt 000000 PO 00000 Frm 00053 Fmt 6633 Sfmt 6633 Z:\WORK\_FULL\093015\96817 SHIRL
50

measure to a violation of a norm of non-intervention is appropriate 

and legal. So if we have legal authority to take a countermeasure, 

it has to be non-forcible, I would think that would be in the bailiwick of the intelligence community to do that. And we might not 

see or talk about that publicly. 

Mr. POE. Okay. I will yield back, Mr. Chairman. 

Chairman ROYCE. Mr. Ted Yoho of Florida. 

Mr. YOHO. Thank you, Mr. Chairman. And thank you for having 

this very important meeting. And I would propose or recommend, 

not recommend, I would ask that we build on this hearing to define 

what constitutes a cyber attack and when it is an act of war or an 

act of terror, and define systems that fall under that, whether it 

is our electrical system, military system, power systems, hospitals, 

and whether that is a certain amount of life lost, any life lost, or 

economic, a major economic catastrophe. 

And, Dr. Lewis, you were saying we have known about this since 

1996. That is 20 years. Twenty years and we still don’t have a definition or a policy. I think that is way too long. We have just 

dropped the ball on this. And who is watching the hen house? I 

mean, this is not acceptable. 

Number one charge of America’s Government, as we all know, is 

national security. This is a national security threat. And technology 

will continue to advance, become more complex in the future. And 

we are going to be more intertwined with that. And to not have 

those kind of policies in place is a shortfall of administrations, not 

just this one but of past ones. And this is something we need to 

get on right now. We should have been on it. 

I am glad, I am sure there is a lot more going on behind the 

scenes than we hear about. I am sure it is like Jack Nicholson in 

that movie you can’t stand, you can’t tolerate the truth or you don’t 

want to know it. And I think to ask you what constitutes an act 

of war or an act of terrorism, do we have a definition of that? 

Ms. LOTRIONTE. So I will, one, I agree with you in terms of the 

amount of time it has taken to get to the point we are where we 

are actually talking about the specific definitions and norms I 

think has been too long. And it does remind me when I was in the 

intelligence community, the years leading up to 9/11. And it was 

like a good 15, 20 years it took people to understand what would 

be an armed attack under the law by non-state actors like terrorists that would allow us to use force in response against them on 

somebody else’s sovereign territory. And I think it took us too long. 

So here we are in a different context, different types of threats, 

of course, but the same principles that need to be discussed and defined. So, really the focus of my whole point and my written statement was that we do need to get agreement on some very important terms with respect to international law and the use of force 

and armed conflict. Specifically, what is a use of force for purposes 

of Article 2(4) of the U.N. Charter. What is an armed attack for 

purposes of Article 5(1) of the U.N. Charter which allows a country 

to use forcible measures in response. 

And so I think that we have had some laws that have developed 

at the U.N., for instance, with respect to non-state actors. After 

9/11, the U.N. Security Council passed two very important resoluVerDate 0ct 09 2002 15:32 Nov 14, 2015 Jkt 000000 PO 00000 Frm 00054 Fmt 6633 Sfmt 6633 Z:\WORK\_FULL\093015\96817 SHIRL
51

tions which cleared up the law and said you can go and you can 

use force and retaliate against even non-state actors. 

Mr. YOHO. That was U.S. law? 

Ms. LOTRIONTE. Well, it is U.S. law. 

Mr. YOHO. It is fine that the U.N. has that, but the U.S. needs 

to have our own definition so we don’t need to go to the U.N. We 

are saying we need to put this out to the world that if you do this, 

this is our response. 

And, Dr. Lewis, you were saying we need to have a credible response. Unfortunately, our Government right now has lost a lot of 

credibility. We draw red lines in disappearing ink. We call for regime change and deny it. I mean, we go on and on. Again, it is not 

just this administration. It is what America stands for. 

We have got to be able to project credibility with a policy and be 

willing to back it up. And what, you know, what I would like to 

see is what is the appropriate response the U.S. should state it will 

do? Is it to retaliate and to put other countries on notice in the beginning and say this is what we are going to do? And is it an eye 

for an eye response as my colleague Dana Rohrabacher said? Or is 

it, you know, we are going to respond two or three or four times 

worse than whatever you did? What is your thoughts on that? 

Mr. LEWIS. You touched on some key points. And Bob is being 

a little modest here, but DOD has actually done a good job of coming up with doctrine on offensive use, defensive use of cyber——

Mr. YOHO. I would like to see that. And I would like to build 

that. Because if somebody comes into my house uninvited, it is not 

going to be a nice response. You know, and that is what I feel they 

are doing here. They are invading our privacy. They are invading 

our sovereignty. And for us to not have a response stated and put 

people on notice I think is just such a shortfall. Mr. Butler? 

Mr. BUTLER. Yes. Just building on the conversation, I mean we 

have levels of activity, exploitation, disruption, destruction. When 

we hit disruption and destruction, we have a problem. And that 

should signal to the national command authorities we need to take 

action. 

The challenge inside this space is making sure we have the indications and warning before it happens. For instance, we need to 

have some signaling with regards to what is happening to our industrial control systems. If malware drops into our industrial control systems, that should be a signal that we should be thinking 

about taking action to counter, before something rises to another 

level and we actually get into aggression. 

Mr. YOHO. All right. Let me ask you this. With North Korea attacking Sony, we have had people here saying it wasn’t North 

Korea, it was China working through North Korea as a proxy. 

What do we do when another country, a nation-state, works 

through a proxy, maybe Hezbollah in the future, some terrorist organization, but we know it was directed by a nation-state? And if 

we don’t have time, if I could get a response to that, I would love 

to hear that. 

Ms. LOTRIONTE. Do you want me to just——

Mr. YOHO. Go ahead. 

Ms. LOTRIONTE. So non-state actors as proxies for state’s actions, 

right? Well, yes, we have authority. And it is under international 

52

law. And the U.S. could accept it to take action against the state 

who is, if you can attribute, if you can attribute the actions of the 

non-state actors to the state, you can use force and take it to the 

state, hold them responsible. 

Ms. LEWIS. One place we get hung up on, and this is where the 

committee could help, is we get hung up on what is a proportional 

response. So there is a lot of debate, what is a proportional response to Sony? And that is where having some guidelines or some 

principles. 

There is a second issue, though, which is the one you brought up 

which is maybe sometimes we don’t want to be proportional in our 

response. And that would be useful to have guidelines on as well. 

Mr. YOHO. Thank you. Thank you, Mr. Chairman, for the extra 

time. 

Chairman ROYCE. Thank you. We will pursue that question. We 

will go to Mr. Brad Sherman of California. 

Mr. SHERMAN. We don’t play offense. China hacks. We don’t talk 

about what tariff to put on all Chinese products in order to compensate ourselves for that. Not even allowed to talk about that in 

polite society. It is much easier for bureaucracies to say we want 

money for defense. Offense, oh my God, it is not politically correct. 

The unique vulnerability of China, and to some extent Russia, is 

the incredible corruption. We have the capacity through cyber and 

other means to identify which princeling owns which chateaus. Dr. 

Lewis, do we have the capacity to find, document, and leak to the 

press the ill-gotten foreign assets of Chinese leaders and their children? 

Mr. LEWIS. I believe we do, particularly because many of those 

assets are located in the United States. 

Mr. SHERMAN. And if you are trying to embarrass a regime, there 

is, you know, entries on a Merrill Lynch form are interesting but—

pictures of chateaus, mcmansions, et cetera, are more so. 

Dr. L, to what extent do we play offense in the sense of not just 

gathering, traditional statecraft, spying on governments and feeding it into our intel operation? To what extent do we play offense 

beyond that? 

Ms. LOTRIONTE. I certainly think we have the capability. I also 

think we have the authority, legal authority, particularly Cyber 

Command in its authority legislated by Congress gives it both defensive and offensive capability. Unfortunately, I think because of 

the nature of those——

Mr. SHERMAN. Could we, for example, steal Chinese proprietary 

company, corporate information and just either hand it to an American company, which would raise huge questions which company, 

or just publish it? 

Ms. LOTRIONTE. If the U.S. Government——

Mr. SHERMAN. Yes. 

Ms. LOTRIONTE [continuing]. Determined that they wanted as a 

matter of policy to conduct economic espionage, they could do it. 

Mr. SHERMAN. And do we have the legal authority to then publish the results? 

Ms. LOTRIONTE. Yes. 

Mr. SHERMAN. Do we have the authority to give it to those companies that correctly choose which political party to donate to? 

53

Ms. LOTRIONTE. Yes. 

Mr. SHERMAN. You mean, we could leak it to one company and 

not another? 

Ms. LOTRIONTE. Well, when we discuss the economic espionage 

part, I think that is a concern of agencies in the U.S. Government, 

would there be any liability in terms of choosing between companies that benefit. Well, you can solve that by actually having a 

framework for, similar to when you put out a bid for a contract. 

There are processes——

Mr. SHERMAN. You mean, we would announce that we had stolen 

secret technology to build printing presses and then have companies bid? That would be interesting. 

Ms. LOTRIONTE. I think so too, sir. 

Mr. SHERMAN. And you say we would have all the legal authority 

to do that? If we had a President that wanted to go in, steal some 

corporate—now, the problem we have here, what is asymmetrical 

is, we got a lot more intellectual property than they do. So that is, 

I don’t want to get in a tit for tat steal intellectual property world. 

What I would rather do is get them to stop. 

Mr. Butler, can you think of any other offensive cyber techniques 

that we could use that the Chinese and the Russians would find 

painful? 

Mr. BUTLER. I think for the Chinese, and as I mentioned earlier, 

as they are trying to integrate into the global economic system. 

Anything that we could do that would impact their growth potential, Huawei, ZTE, Baidu, Alibaba, I think would have an impact. 

I think like you said, sir——

Mr. SHERMAN. But it is asymmetric. Alibaba might want access 

to the U.S. market. Google does want access to the Chinese market. 

Mr. BUTLER. Right. Right. 

Mr. SHERMAN. The easiest thing, of course, is just tariffs on their 

imported goods. And the asymmetrical way is to go after the corruption because, and I gather from this panel there are no legal obstacles to espionage designed to identify and prove ill-gotten gains 

held by Chinese leaders and their children, and leak that to the 

press, in both China and the United States. Mr. Lewis, do you see 

any legal bar to that? 

Mr. LEWIS. No. I was just going to say that it would apply equally to Russia. 

Mr. SHERMAN. Yes. I think, I think it would have less political 

impact in Russia, although that regime has to be a little shaky. I 

mean, China is trying to explain to its people why under their 

great leadership they may have to suffer with less than 7 percent 

growth. Putin has to explain a world of $44 a barrel oil which is 

a much more painful world. Doctor, do you have——

Ms. LOTRIONTE. I would just say, I think you wanted to reconfirm about the legality of it. Not only would that be legal, but in 

the past, as far as the first half of that scenario, doing it to them 

and leaking it, we have history outside of this cyber context that 

the intelligence community has done things like that before. So 

both legal under international law and under domestic law. 

Mr. SHERMAN. Okay. And so we have in pre-cyber methodology 

obtained embarrassing information about the leaders and families 

54

of countries we are not entirely friendly with and leaked it to the 

press. Unless Mr. Butler has a comment, I yield back. 

Chairman ROYCE. I want to thank our witnesses. There is one 

more favor that the panel could do for this committee if you would. 

Mr. Ted Yoho of Florida had two other questions that we would 

like to get your response in writing to if we could. Mr. Yoho, do you 

want to lay out those two questions? 

Mr. YOHO. Yes, sir, Mr. Chairman. I appreciate it. The first one 

is what is your recommendation to help facilitate our Government 

working with private industry or, vice versa, industry working with 

our Government to prevent or alert each other about attacks. That 

is question number one. 

The second one which is really two questions, are there any laws 

prohibiting us to follow through on these, you know, something prohibiting us. And I know we have got to go through the U.N. to be 

nice and all that. But, again, my concern is the sovereignty and the 

protection of the United States Government, and that law ought to 

trump everything else. 

And then are there any laws that are needed for us to do what 

we want to do as far as protecting this country and our citizens and 

the economy of this country? Those, if you could do that, because 

what we would like to do, according to Chairman Royce, is formulate a cybersecurity policy for the United States of America. And 

we don’t want to wait another 20 years. And if you would do that, 

it would be greatly appreciated. How long do you think it would 

take? Can we get that in a week, within a week? 

Ms. LOTRIONTE. I can give you the legal answers in a day. 

Mr. YOHO. Perfect. Thank you. 

Mr. BUTLER. A week. 

Mr. YOHO. Mr. Chairman, thank you. 

Chairman ROYCE. Thank you very much, Mr. Yoho. I appreciate 

those ideas. And we stand adjourned. And, again, thank you very 

much, panel. 

[Whereupon, at 11:45 a.m., the committee was adjourned.] 

(55)

A P P E N D I X 

MATERIAL SUBMITTED FOR THE RECORD

56

f


96817n.eps
57


96817m-1.eps
58

f


96817m-2.eps
59

f


96817d.eps
60


96817e-1.eps
61

f


96817e-2.eps
62


96817f-1.eps
63


96817f-2.eps
64


96817f-3.eps
65

f


96817f-4.eps
66

[NOTE: No responses were received by the committee to the above questions prior 

to printing.] 

Æ


96817g.eps