U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office,

http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,

U.S. Government Printing Office. Phone 202–512–1800, or 866–512–1800 (toll-free). E-mail, gpo@custhelp.com.

i 

58–232 2010

[H.A.S.C. No. 111–176] 

HARNESSING SMALL BUSINESS INNOVATION FOR NATIONAL SECURITY CYBER 

NEEDS 

HEARING 

BEFORE THE

SUBCOMMITTEE ON TERRORISM, UNCONVENTIONAL 

THREATS AND CAPABILITIES 

OF THE

COMMITTEE ON ARMED SERVICES 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED ELEVENTH CONGRESS 

SECOND SESSION 

HEARING HELD 

JULY 28, 2010 
(II) 

SUBCOMMITTEE ON TERRORISM, UNCONVENTIONAL THREATS AND 

CAPABILITIES 

LORETTA SANCHEZ, California, Chairwoman 

ADAM SMITH, Washington 

MIKE MCINTYRE, North Carolina 

ROBERT ANDREWS, New Jersey 

JAMES R. LANGEVIN, Rhode Island 

JIM COOPER, Tennessee 

JIM MARSHALL, Georgia 

BRAD ELLSWORTH, Indiana 

BOBBY BRIGHT, Alabama 

SCOTT MURPHY, New York 

JEFF MILLER, Florida 

FRANK A. LOBIONDO, New Jersey 

JOHN KLINE, Minnesota 

K. MICHAEL CONAWAY, Texas 

THOMAS J. ROONEY, Florida 

MAC THORNBERRY, Texas 

CHARLES K. DJOU, Hawaii 

KEVIN GATES, Professional Staff Member 

ALEX KUGAJEVSKY, Professional Staff Member 

JEFF CULLEN, Staff Assistant 
(III) 

C O N T E N T S 

CHRONOLOGICAL LIST OF HEARINGS 

2010 

Page 

HEARING: 

Wednesday, July 28, 2010, Harnessing Small Business Innovation for 

National Security Cyber Needs ........................................................................... 1 

APPENDIX: 

Wednesday, July 28, 2010 ....................................................................................... 19 

WEDNESDAY, JULY 28, 2010 

HARNESSING SMALL BUSINESS INNOVATION FOR NATIONAL 

SECURITY CYBER NEEDS 

STATEMENTS PRESENTED BY MEMBERS OF CONGRESS 

Miller, Hon. Jeff, a Representative from Florida, Ranking Member, Subcommittee on Terrorism, Unconventional Threats and Capabilities ............... 2 

Sanchez, Hon. Loretta, a Representative from California, Chairwoman, Subcommittee on Terrorism, Unconventional Threats and Capabilities ............... 1 

WITNESSES 

Lee, Richard P., Consultant .................................................................................... 6 

Ricketson, John H., Chief Executive Officer, Dejavu Technologies, Inc. ............ 3 

Thornton, Roger, Founder and Chief Technology Officer, Fortify Software ....... 4 

APPENDIX 

PREPARED STATEMENTS: 

Lee, Richard P. ................................................................................................. 46 

Miller, Hon. Jeff ................................................................................................ 25 

Ricketson, John H. ........................................................................................... 27 

Sanchez, Hon. Loretta ...................................................................................... 23 

Thornton, Roger ................................................................................................ 34 

DOCUMENTS SUBMITTED FOR THE RECORD: 

[There were no Documents submitted.] 

WITNESS RESPONSES TO QUESTIONS ASKED DURING THE HEARING: 

[There were no Questions submitted during the hearing.] 

QUESTIONS SUBMITTED BY MEMBERS POST HEARING: 

[There were no Questions submitted post hearing.] 

(1) 

HARNESSING SMALL BUSINESS INNOVATION FOR 

NATIONAL SECURITY CYBER NEEDS 

HOUSE OF REPRESENTATIVES, COMMITTEE ON ARMED SERVICES, SUBCOMMITTEE ON TERRORISM, UNCONVENTIONAL

THREATS AND CAPABILITIES, Washington, DC, Wednesday, July 28, 2010. 

The subcommittee met, pursuant to call, at 2:03 p.m., in room 

2118, Rayburn House Office Building, Hon. Loretta Sanchez (chairwoman of the subcommittee) presiding. 

OPENING STATEMENT OF HON. LORETTA SANCHEZ, A REPRESENTATIVE FROM CALIFORNIA, CHAIRWOMAN, SUBCOMMITTEE ON TERRORISM, UNCONVENTIONAL THREATS 

AND CAPABILITIES 

Ms. SANCHEZ. The Subcommittee on Terrorism, Unconventional 

Threats and Capabilities will come to order. 

Good afternoon. I would like to thank everybody for coming 

today, welcome you all for being before us on a very important 

topic today. 

As Congress looks to develop its comprehensive approach to cybersecurity, we will need the perspective of many people, including 

our private sector and especially, I believe, our small businesses. 

Because, when you think about it, I think over 90 percent of the 

businesses in our Nation are considered small- and medium-sized 

businesses; and everybody, we hope, is using a computer for efficiency and effectiveness these days. And so it is important because 

you have a large majority of the people who work in our United 

States under you all. 

I am particularly excited about today’s hearing because we do 

have small business representatives in front of us, and that is 

sometimes unusual for the Armed Services Committee. So we are 

really thrilled about that. One of the things we do know about our 

small businesses is that you are very capable of innovating much 

quicker than large businesses or even government. And if you have 

innovation, if a lot of the innovation and technology agenda is driven by small business, then that is actually one of those areas that 

we really do want to protect from people stealing our information 

or your information, as the case may be. 

So, today, the subcommittee is looking to discuss three main objectives for this hearing: One, the small business’s view of the cyber 

challenge facing all of us today; secondly, the technologies that 

your business, along with others, are pursuing to address those 

needs; and the third thing is to identify systemic barriers to small 

businesses as they are entering the marketplace. 
2 

The purpose is for the members of this subcommittee to further 

develop greater cyberspace expertise and awareness but also for us 

to have an open discussion of how Congress can address certain 

barriers to small businesses while those small businesses are trying to help us here in the government sector. 

And as our country works hard to improve our economy, the first 

place to take off will be small business. So in order to expand our 

economy, to grow it as so many of us I think pray every night right 

now, you really are key to getting that done. 

So, today, we hope that the witnesses will provide the subcommittee with a technical look at cybersecurity and what technology and resources are currently available to further protect the 

systems that small business actually plug into at the Department 

of Defense [DOD]. That would be another area where we are looking for tools and the hindrances or the things that you might suggest. 

So, today, we have three witnesses before us. The first, we have 

Mr. John Ricketson; and he is the Chief Executive Officer of 

Dejavu Technologies, Incorporated. So, welcome, and I do believe 

you are from California, right? 

Mr. RICKETSON. Massachusetts. 

Ms. SANCHEZ. Massachusetts. What did my people do? 

And Mr. Roger Thornton, the Founder and Chief Technology Officer of Fortify Software. I know he is a Californian. 

And Mr. Richard Lee, an independent consultant who just came 

out of the government sector. 

So I hope you all will talk a little bit to us about the interface; 

and, once again, I look forward to your testimony. Without objection, we have put your written testimony into the official record. 

I will remind the witnesses that you have 5 minutes to address. 

You don’t have to read your statement. You can talk about the 

main points or anything you might have thought, oh, gosh, I should 

have put that in there and I forgot. And, after that, we will ask 

a series of questions and hopefully you can answer them. 

And I will now yield to the ranking member from Florida, Mr. 

Miller, for his opening statement. 

[The prepared statement of Ms. Sanchez can be found in the Appendix on page 23.] 

STATEMENT OF HON. JEFF MILLER, A REPRESENTATIVE 

FROM FLORIDA, RANKING MEMBER, SUBCOMMITTEE ON 

TERRORISM, UNCONVENTIONAL THREATS AND CAPABILITIES 

Mr. MILLER. I thank my good friend for yielding. 

Thank you, gentlemen, for being here. I hope you have at least 

been to Florida, if you are not from Florida. You might have traveled there once or twice. 

This hearing does come at an appropriate moment, because over 

the last several weeks General Alexander has in fact been conducting an aggressive road show explaining his vision for the U.S. 

Cyber Command, and the establishment of the Command follows 

the 2010 QDR [Quadrennial Defense Review] recommendations 

that centralized those operations. As the Department implements 

its vision and as the Command becomes fully operational this com-
3 

ing October, the Department has an opportunity to renew its relationship with the industry and small business in particular. 

Given the vital role played by small businesses and the community to develop innovative solutions to the challenges that we all 

see today, it is critical that both Congress and DOD have a thorough understanding of small businesses’ view of the cyber challenges facing our Nation and eliminate those obstacles, as my good 

friend has already talked about, that many small businesses face 

when they contract with the Department of Defense. 

I do know that our time is limited. We do have a vote coming 

up in a little while. So I would like to ask that my full statement 

be entered into the record. And I yield back. 

[The prepared statement of Mr. Miller can be found in the Appendix on page 25.] 

Ms. SANCHEZ. Wonderful. I thank the ranking member of the 

committee. 

Now let us start with Mr. Ricketson for 5 minutes or less. 

STATEMENT OF JOHN H. RICKETSON, CHIEF EXECUTIVE 

OFFICER, DEJAVU TECHNOLOGIES, INC. 

Mr. RICKETSON. Well, thank you for inviting me. 

My name is John Ricketson. For the last 2 years, I have been 

managing Dejavu Technologies, which is a software provider of network forensic analysis tools. In my 30-year career in high technology, I have been associated with small companies for my entire 

career and about 40 transactions, equity-related, of small companies. 

Our management team is made up of serial entrepreneurs. We 

have four prior ventures, all successfully executed. This one is our 

first primarily focused on government. So we have had a fairly 

steep learning curve. 

I thought what I would do with the brief statement is start with 

the conclusion, which is we would strongly encourage small business policies to do a bit more towards encouraging innovation; and 

our view is that cybersecurity in particular is an area where the 

more ideas, the better. It is an arms race. Better defenses on more 

creative attacks and the more we can bring new ideas in, the better. 

I thought I would explain what we do just from the perspective 

of the core innovative idea that we have to present which has to 

do with, in the cybersecurity application, managing what might be, 

in a military metaphor, might be damage assessments. 

There is an infrastructure of many tools that are designed to 

block and prevent, but the fact is that breaches happen. They are 

inevitable. So we are helping with the process of discerning what 

happened, what machines were affected, what can be done about 

it in the future. 

The essence of our product is to search in a Google-like fashion 

everything that has happened for what may be going on that you 

don’t know at the time it was captured. So it is a fairly simple idea, 

but it has big implications in terms of scale and features that make 

an analyst effective at that process. 

The principal challenge that we have with our big idea is how 

to find the sponsors within agencies for whom this would be helpful 
4 

with their mission. It is harder to do that than one might think as 

a small company. 

So, in general, the small business policies have many noble goals: 

furthering economic development and job creation certainly, providing opportunities for groups that would not have those opportunities otherwise. It is more—it is easier to find those in the smallbusiness-oriented programs than it is to find the programs that 

would help make more efficient the process of introducing new 

ideas and innovations. 

I guess there are a couple of anecdotes I referred to in my report 

which is I went to the local Small Business Administration [SBA] 

who have a number of programs, none of which really applied to 

our particular challenge. 

I guess another anecdote is not much of an anecdote. There was 

a lot of newspaper headlines about stimulus money, but we were 

unsuccessful at finding any. 

But, in general, there is a few hindrances to small businesses 

presenting their ideas, one of which would be software certification 

which is an important requirement generally unique to each agency 

and there is a fairly steep investment for a small company to provide. 

Another hindrance in general is security clearances. Again, very 

important, particularly in the area that we focused. But that requires a sponsor. So there is a bit of a Catch 22. When you introduce a new idea, to try to find the right people who can bring your 

idea forward and into the realm where it can be fully discussed. 

We had experiences with the outreach and small business programs at various agencies, which actually did their job fairly well, 

which is to provide a mechanism for small companies like us to 

register ourselves so that we are known. I think that some attention to those programs is well deserved in terms of funding and expansion, because the goal would be for our good ideas to find the 

right people and agencies who would care. 

Another type of organization we encountered was the technical 

intermediary, generally designed to represent the government to do 

technical assessment. And that is another area that would be very 

helpful. 

Again, the goal is new idea, find the right application that can 

really help the mission. 

So, in conclusion, I am trying to encourage the idea of a marketplace of ideas and smaller amounts of money distributed more 

broadly to bring those ideas forward and an information flow that 

is fair and can give every good new idea a chance. 

[The prepared statement of Mr. Ricketson can be found in the 

Appendix on page 27.] 

Ms. SANCHEZ. Thank you, Mr. Ricketson. 

Now we will hear from Mr. Thornton for 5 minutes or less. 

STATEMENT OF ROGER THORNTON, FOUNDER AND CHIEF 

TECHNOLOGY OFFICER, FORTIFY SOFTWARE 

Mr. THORNTON. Thank you very much, Chairwoman Sanchez, 

Ranking Member Miller. 

I have prepared a short statement to accompany my written testimony today. 
5 

I currently serve as the Chief Technology Officer at Fortify Software. I have worked in the information technology [IT] industry in 

the Silicon Valley for the past 23 years. 

My technical expertise is in finding and fixing and preventing 

software vulnerabilities that are at the very core of our cybersecurity dilemma. My current responsibilities involve the development 

and design of technologies that eliminate these vulnerabilities in 

order to make IT systems more resilient to attack, making software 

‘‘hacker-proof.’’ 

Fortify is a small company. It is a classic Silicon Valley startup. 

It was founded by myself and my three cofounders in the spring 

of 2003. Our customers include 8 of the 10 largest banks in the 

world, all the major branches of the U.S. military, and a majority 

of the telecommunication firms across the U.S. and Europe. 

Through the course of my work, I am familiar with the types of 

vulnerabilities found in our Nation’s most critical infrastructure; 

and I can tell you with emphatic certainty we are in a desperate 

situation. My firm’s technologies have helped conduct audits on 

thousands of critical IT systems and not once have we found a system without critical vulnerabilities. Typically, we find thousands of 

such vulnerabilities. 

One example set comes from a Fortify team that conducts audits 

and reviews of military systems. Over the course of 2 years, that 

team has audited 601 applications across 141 major programs and 

found over 3.8 million security vulnerabilities, over 400,000 of 

which were deemed critical. Sadly, this is not an exception but has 

become the norm, as it represents a problem that is not currently 

receiving appropriate attention. 

There are two compelling reasons for you to consider and actively 

support the role that small businesses like mine have to play in 

solving cybersecurity issues. 

The first is economic. As Chairwoman Sanchez has noted, small 

businesses have historically been an incredibly important driver for 

job growth in our country, and cybersecurity is no exception to that 

rule. 

The second is innovation. Only a small company would have the 

audacity and impetus to challenge the status quo and offer an entirely new approach when there are entrenched solutions in place. 

Like many small businesses, my company was founded on a simple 

observation that challenged conventional wisdom and led to innovation. 

Our observations were this. I will share them with you today. 

IT systems are compromised of network, computers, and software 

running on those computers. The prevailing strategy for IT up to 

now has been to secure the networks by limiting access and attempting to block attacks. That traditional security strategy has 

failed us. It is outdated. It is fundamentally flawed. Simply put, 

nearly all software delivered today, including that which the Defense Department is going to use and all the critical infrastructure, 

will be constructed with major vulnerabilities. 

Consider those vulnerabilities as open doors for hackers to gain 

access to systems. Our adversaries have shifted their approach to 

leverage those open doors in software at the same time we have re-
6 

sponded with more network security. The results speak for themselves. 

If we eradicate software vulnerability, then the attacks won’t 

work. We can build software systems to be resilient to attack. This 

is very similar to the practice of building buildings that are resilient to fire, but we need to do a better job. 

This line of thinking represented a radical departure from the 

status quo, and in the Silicon Valley that means a new small business determined to solve an old problem in a new way. In spite of 

the strides we have made at Fortify and other small innovative 

firms, there are some extraordinary challenges that the status quo 

pose that I would ask for your support in overcoming. 

The first is a disproportionate focus on protecting hardware networks while the majority of the attacks are at the software layer; 

second, lack of clear policy relating to software security that leads 

to vague software security requirements and inadequate funding 

for software security initiatives; and the third is inadequate funding for fixing the vulnerabilities that companies like mine and others are finding every day. 

We have a strong conviction and have established high confidence that the right combination of technology, human capital, 

and process can confront the advanced persistent threat and ultimately protect us from cyber warfare. We look to Congress to establish a strategic policy guidance for cyber, and we applaud Congress for being so active. This inspires mature companies, mature 

small companies like Fortify, and also gives hope to the next generation of innovators. 

In conclusion, please let me compliment this subcommittee for 

your cybersecurity leadership. In particular, we strongly support 

the certification and the accreditation language included in the 

House-passed 2011 NDAA [National Defense Authorization Act]. 

Combined with the language contained in Section 932 of the Senate 

companion bill, these provisions are sorely needed to protect the 

United States in the domain of cybersecurity. 

I would like to personally thank Chairwoman Sanchez, Ranking 

Member Miller, and the members of the subcommittee for holding 

the hearing. We look forward to working with you and the talented 

House Armed Services Committee staff to help better strengthen 

our Nation’s cybersecurity defense through effective software security. Thank you. 

[The prepared statement of Mr. Thornton can be found in the Appendix on page 34.] 

Ms. SANCHEZ. Thank you, Mr. Thornton. 

Now we will hear from Mr. Lee for 5 minutes or less. 

STATEMENT OF RICHARD P. LEE, CONSULTANT 

Mr. LEE. Well, thank you, Congresswoman Sanchez. I appreciate 

the opportunity to address the subcommittee. 

I believe that we have got—as you commented; I am an independent consultant previously working inside the Federal sector as 

an acquisition professional and am now in the small business sector attempting to assist others to understand how to bring their 

products to market. 
7 

I believe we have to deal with the intersecting demands of the 

need to share information, whether it is in the commercial sector 

or in the Defense Department or government sector, and the need 

to protect that information, the three pillars of information assurance: the confidentiality, the integrity, and the availability. 

Our economy has become very dependent on the Internet. We are 

not going to be able to abandon that battle space but must be able 

to work through attacks on our Internet connectivity. 

Almost all of the things that we do on a daily basis, from personal banking to managing the logistics trail to get things into the 

warfighting theaters, for example, depend on Internet connectivity. 

I also understand that the subcommittee’s focus is on harnessing 

the passion and innovation and originality and resourcefulness of 

American know-how. One of the things that I believe that my colleagues have mentioned is that we failed to take a holistic systems 

engineering approach to the problem and instead look at component piece part fixes that don’t seem to ever solve the big problems. 

The issue of a Maginot line as a wall of defense is not going to 

work. It never has, and it won’t work in the cyber domain, either. 

And we need to find solutions from a systems engineering perspective to harness that innovation. 

I believe there are three fundamental things that are causing difficulty for small businesses to get into the solution space: The first 

is the acquisition process itself, which I will address a little bit 

later. The second is the evaluation and the certification process 

that we go through in order to bring products and solutions into 

the cyber domain. And, finally, are the financial resources available 

to the small business sector in just being able to get their products 

to market. 

With respect to the acquisition process, I think that one of the 

issues we have and continue to have is that there are a number 

of large integrators who understand the acquisition process and 

can navigate it. Because of that, it is difficult to get innovation into 

their tool kit; and, consequently, when we are solving a problem, 

identifying and resolving a vulnerability, we seem to fall back on 

the same guys that got us here. 

If you recall Albert Einstein’s comment, no problem can be solved 

from the same level of consciousness that created it and, thus, I believe your effort to harness small business innovation in this vital 

area. 

The evaluation and certification process is king in the governmental cyberspace domain. There is a whole army of people who 

can say no, very few people who can say yes when you want to insert technology into our environment. Most small businesses do not 

have the resources to navigate the certification process to be able 

to get their products into the domain to provide either vulnerability 

fixes or completely new and innovative ways to approach a cyber 

issue. 

And, finally, the ability to get into the cyber domain to identify 

the resources necessary requires a champion on the inside of government pulling that solution into the cyberspace. 

I believe that there are some programs in the executive departments and in the Defense Department specifically that do a good 

job of identifying and incubating innovative solutions. The Defense 
8 

Advanced Research Project Agency [DARPA] has a number of programs, as does Defense Research and Engineering specifically on 

their ability to do the Defense Acquisition Challenge and their 

Joint Capability Technology Demonstrations. But, as always, transition into sustainment is the difficult part. 

As you noted, Congresswoman Sanchez, my remarks are in the 

record. So I will conclude there and await your questions. Thank 

you for the opportunity to address you. 

[The prepared statement of Mr. Lee can be found in the Appendix on page 46.] 

Ms. SANCHEZ. Thank you very much, Mr. Lee. 

I will remind members that—well, I will let you know that each 

of the members has up to 5 minutes to ask their questions. We will 

start with those who arrived to the committee prior to the gavel 

closing, and so I will begin by asking my questions of the panel. 

This morning, I met with Zachary Lemnios—he is the Director 

of Defense Research and Engineering [DDR&E]—in order to discuss this very topic of cybersecurity, and one of the main issues 

that was brought up was how we get the technical base right. I 

think that that is one of the crucial questions that we have for 

DARPA and for DDR&E working on that answer of what are the 

technical underpinnings to build a secure system. I know they are 

working with universities and with the private sector to try to answer that question. So I guess I would like to start by asking our 

witnesses here today what do you think are some of the technical 

underpinnings to build a secure system? 

And anybody can take a stab at it. None of you can take a stab 

at it. I know it is a ‘‘why are we alive’’ question, but it is one that 

we are struggling with. 

Mr. THORNTON. Chairwoman Sanchez, I would be happy to give 

some comment on that. 

The gentleman you had a conversation with was definitely right 

on focusing on that. You can think about the resiliency of a system, 

and let us use this room to say its resiliency to not catch on fire. 

If we only focused on the fabric, let us say, and we knew the fabric 

was fireproof, what about the wood tables? What about the articles 

we bring in? What about the sprinkler systems and what have you? 

Cybersecurity today is fragmented into those that worry about 

access to the networks, those that worry about access to the computers, and my area of expertise, those that worry about the software programs themselves. And our adversary is not. They will 

look at our systems, they will look at all those components, they 

will look at the human interaction, find the weakest point and attack. 

So one of the things that has escaped us is in our systems engineering, the people that are ultimately responsible for an inventory 

management system for the military or a financial accounting system, is having those people with the purview of the entire system 

be the ones responsible for security. They still may need experts to 

help them, but we need to push the responsibility of security up 

the system to the senior-most people. That means a change in the 

thinking of education, what is the educational requirement to be a 

system designer, a change in roles and responsibilities—— 
9 

Ms. SANCHEZ. Are you talking from a hardware or software or 

both standpoint? 

Mr. THORNTON. Both, both. So the key is every system has—in 

information technology world, we call them system architects—people whose responsibility purviews across all the technical components, ensuring that security responsibility is held at that level. 

Ms. SANCHEZ. Great. 

Anybody else? Mr. Lee. 

Mr. LEE. Yes, ma’am. 

To pick up on the comments about systems engineering, one of 

the things that we don’t do a good job of is recognizing that when 

we approach the certification of networks or the software that operates those networks, the computers and the software that runs on 

them, the evaluation process desires the use of standards which are 

good in and of themselves because they provide a bound for the 

evaluation process. 

Unfortunately, most of the standards that we rely on were built 

when the Internet was being evolved and were conceived in an academic environment where trust sort of existed between the colleagues. But as we have gone into a cyber world we can no longer 

trust the users, and sometimes we can’t even trust each other. 

So we need to perhaps take a step back and figure out are there 

some inherent vulnerabilities and standards that we use in 

architecting our systems that will perpetuate vulnerabilities that 

we just can’t solve. If that is the case, we need to take a look at, 

from a system’s perspective, what we might do to change that environment; and I believe that is where small business innovation fits 

right into the sweet spot of that solution space. 

Ms. SANCHEZ. Thank you, Mr. Lee. 

Mr. Ricketson, would you like to comment or—— 

Mr. RICKETSON. Yes, I would. 

I guess my comment is maybe to challenge the underlying assumption of the question. I am skeptical that we could find what 

you referred to, technical underpinnings. I think the history of the 

Internet shows that all of the hierarchically driven networks fell by 

the wayside, and the Internet, with all of its decentralization and 

messiness, was the best solution. 

So I am skeptical of vendors that would promote their underlying 

technical solution, and I am skeptical of an organized body that 

would decide to pick winners. I think that we have an Internet that 

is decentralized, and we need to work on the issues of trust and 

monitoring and statistical analysis and stay on top of it. 

Ms. SANCHEZ. I, too, had that question this morning. I am a little 

bit more—after having spoken to both the DARPA Director and to 

Zachary this morning, I think they are going both ways. I think 

they are doing a double track to ensure that maybe there are, and 

maybe they are not. So that is a keen observation that you have 

just made. But I think they are looking at it from both standpoints: 

Is there a better way or is the Internet, with all its failings, the 

way we are going to go? 

Mr. Miller, my ranking member, please, 5 minutes. 

Mr. MILLER. I would like to—and I will keep it brief—talk a little 

bit about the impediments. 
10 

Mr. Ricketson, you talked about it as far as your visit to your 

local SBA office. SBA, small business initiative research programs, 

technology transition programs have all been successful for small 

businesses. I mean, it has been proven so. 

You talked about some specific instances with the others. You 

didn’t really go into great detail. But what I would like to know is, 

have you used them in the past? Did you see the same thing Mr. 

Ricketson saw when you tried to avail yourself of some of the programs that were there? And what changes would you recommend 

to allow for greater participation of companies like yours in the 

software field? 

So if I could start with Mr. Lee and then work back to Mr. 

Ricketson, I would appreciate it. 

Mr. LEE. Yes, sir, Mr. Miller. 

So to go right to your question, I think one of the advantages 

that the Defense Department may have is to follow the lead of 

DARPA that they did with their challenge program where they put 

a problem out there and bring—or ask people to bring solutions to 

them in competition for an award. That certainly exposes innovation and innovative technologies for use. 

And from a prior government-side person, the two questions one 

always had to ask a contractor with a great solution was, A, how 

much is it going to cost and how do I get to you? What is the contract vehicle? 

The contracting process is so cumbersome that it is very difficult 

to get innovation inserted into our existing systems. We can do pilots, and we can do cultivation and incubation, but the transition 

into the environment is very difficult. 

Many of the innovators like Apple and their iPhone go to the 

commercial marketplace because they can get out there quickly. 

They have to identify their certification implementation process. 

The government is an extraordinarily difficult labyrinth to navigate for the small businessman, and he necessarily has to get married up with a big innovator who has different motivations sometimes than the insertion of technology. 

So I think there is a challenge in how you weigh, on one hand, 

open competition kinds of activities and the other is the insertion 

of new and innovative technology to solve the problems that we 

have. The programs exist. It is in the transition into the environment that it seems to be just so difficult to solve. 

Mr. THORNTON. Congressman Miller, I would answer your question in thinking about two different ways that the government 

helps make streamline working with small businesses. One, driving 

requirements that require innovation, thereby giving the small 

business an equal footing on the playing field. And I would like to 

come back to that, because the other is more directly what you 

were asking, which is the programs that are in place for small 

businesses like ours to work with the government. 

I have been to a lot of seminars and sessions where small businesses complain that it is difficult to access the government and 

what have you. And I wouldn’t sit here and say it is easy, but, in 

my experience, it is not all that harder than the banking industry 

or the manufacturing industry in that the government demands 
11 

that you understand their environment, that you understand their 

processes, that you understand how they do work. 

So I think part of it is a little bit of level setting the education 

or what does it take to work with the government. The programs 

were there for us, but we—our very first revenue as a company 

came through an SBIR [Small Business Innovation Research] program with the U.S. Air Force, and neither myself nor any of my 

founders had any connection with the Air Force. We simply worked 

our way through the system and found that. The National Security 

Agency has been very helpful, sponsored our company for the right 

clearances that we need. 

So I do think programs that are in place, from what I understand 

and from talking to other entrepreneurs, there could be more education. My counsel to those other entrepreneurs is, if you want to 

work with the government and sell to the government, you are 

going to need to hire people that work in that arena, just like we 

have hired people that have worked in the banking arena and can 

help us navigate. 

If I could finish on my first point, though. When requirements 

that the status quo are not good enough are fed from the government to the IT industry, that gives the small innovator a giant advantage. So, from my vantage point, that is, security of just my 

network, it is not good enough. I need security of my software. But 

there is opportunities for that in just about every realm of cybersecurity. Demand more or better than what is currently being offered 

by the status quo. 

Mr. RICKETSON. Nothing much more to add than what I had said. 

I think my modest proposal is to simply bring the criteria ‘‘does it 

help innovation’’ into the small business programs. Every program 

that I mentioned there was—it was a worthy program. So I am not 

knocking any of those. But we just need to do more. Thank you. 

Ms. SANCHEZ. Thank you, Mr. Miller. Thank you, gentlemen. 

I will now call on my good friend, Mr. Smith, from the State of 

Washington for his questions. 

Mr. SMITH. Thank you, and I appreciate the chairwoman holding 

this hearing. It is a critical issue for our subcommittee. 

I think that for the government to get small business more involved the best ideas are out there I believe in the small business 

community, in many instances; and, as all of you have mentioned, 

it oftentimes is impossible for them to do business with the government and we in the government lose out, particularly on this subcommittee that works on IT infrastructure. But this expands out. 

We do a lot of work with the Special Operations Command. A lot 

of their needs requires updated better technology, and small businesses are the companies that can provide it. So we appreciate 

that. 

I think most of the questions have been answered. I will just 

throw this out there, if you gentlemen have anything to say about 

it in particular. What is the one thing you would say we could 

change about our acquisition or procurement policy that would 

most help small businesses get greater access, have the opportunity 

to be able to sell what they make or their services to government, 

in this case the DOD? 

Mr. LEE. Sir, I would like to take a cut at that. 
12 

I think that because we in the acquisition process tend to wind 

up with the big integration companies that have deep pockets that 

can navigate the bidding process system and know how to write a 

proposal that a government evaluator can read, understand, and 

accept, we tend to get the sameness of the solution competing on 

price. 

One of the things that might help is if there were some tax code 

incentives or other kinds of things where some of the debt and/or 

operating loss that a small business necessarily incurs while they 

are trying to do this innovative thing and get their product to market could be used somehow by the large integrator to help offset 

some of his financial activity. He may be incentivized to try to 

bring in some of the new innovative or novel ways to solve some 

of these cyber problems. 

Some of the people that I have worked with have taken a systems engineering perspective and have a new way of looking at the 

networking architecture to be able to insert distributed defense-indepth kinds of activities, firewalls, for example, instead of building 

it at the boundary like the Maginot line. But that technology is extraordinarily difficult to stick into the system because the large integrators are unfamiliar with it and just don’t have a way. 

Mr. SMITH. Shouldn’t there be a way to do this without the large 

integrators, in some instances? I guess that is—we have small businesses come to us all the time; and, regrettably, one of the first 

things we have to tell them is here is the eight biggest defense 

companies; find one and partner with them. But shouldn’t there be 

a way that a small business can simply do it without having to go 

to a large integrator? 

Mr. LEE. Sir, one of the problems from my perspective is that the 

evaluation and certification process has so many people demanding 

‘‘certify me’’ because it is great to have that certification label on 

your product. And, in some cases, particularly for government networks and environments, you need that evaluated product certification in order to even be considered. If you don’t have the champion inside the government pulling on your solution, then you need 

that integrator to be pushing you into the environment as part of 

a systems approach that he has recommended or has been hired to 

implement. 

Mr. SMITH. What I would like to do—and it is something we have 

worked on a lot with different companies—is get the acquisition 

people out there to be looking for you guys. Instead of seeing one 

of you guys coming and going, they don’t know what they are 

doing, better call somebody bigger, they say, I am going to take a 

closer look. 

So I think, from our perspective, we need—and this has particular application on the cybersecurity side. Because, as you gentlemen have noted, you are cutting-edge innovators on that, in 

many instances, but we need acquisition people who can move past 

that. 

I accept your answer. I am running out of time. I don’t know if 

the other two gentlemen wanted to comment at all on how you 

would change the process. 

Mr. RICKETSON. My big idea may not actually be a good idea. I 

would love to have someone validate it. So my idea—I make a tech-
13 

nical claim. That technical claim may or may not be valid. Even 

if it is valid, it may or may not forward the mission. 

So I will give you an example. We have a search capability that 

is supposed to scale. That means you can search into huge amounts 

of data. The word ‘‘petabyte’’ comes up. The petabyte is bigger than 

I can count, and products break down in situations of stress like 

that. 

So if there is a technical intermediary that represents the government that can take a claim and say, yes, this is true and has 

the credibility inside the government with the technical sponsors, 

that is a major step forward and is independent and is a level playing field between a big and small company. It is just about the 

idea. 

Mr. THORNTON. And, Congressman Smith, if I can add—and I 

will caveat with I am not an expert in Federal acquisition. So this 

is an idea from a person who—— 

Mr. SMITH. That may be helpful, actually, that you are not buried in the minutia of Federal acquisition and can simply look at it 

from a practical standpoint. But go ahead. 

Mr. THORNTON [continuing]. That is what I was thinking, is 

when I—in my experience, I have seen the Federal Government 

make some really smart acquisitions and other times where I questioned it, whether it was the best technical solution. One thing I 

noticed was the technical capability to define the requirements 

were employees of the Federal Government. I can give some examples. But, in general, when the system integrator is writing the requirements for the Federal Government, I think a lot of times 

those requirements are going to be not demanding the highest, latest innovations. 

So maybe a radical shift in theory but building up the capabilities inside of each of the agencies to have some top-of-field technical people that can drive requirements, from personal experience 

I have seen that work quite well. 

Mr. SMITH. That makes a great deal of sense. 

I think two directions we need to go in to get there. We have 

talked about this in a number of contexts, but our somewhat obsessive reliance or I should say excessive reliance on contractors since 

9/11 has downgraded the number of people within the acquisition 

process who are talented and knowledgeable. There just aren’t as 

many of them there, for one thing. 

But the second thing I always want to emphasize is to empower 

those people. I think part of what drives some people out who do 

have experience in the acquisition process is, if you are the type 

of go-getter, really knowledgeable, you are a person who wants to 

be empowered, you want to know if you make a smart decision you 

can implement it and see the result of it. 

If you are in the acquisition process and you can’t make the decision and say, you know what, this company or—to your idea—this 

guy has this idea and you know what, it works, it is great, it is 

what we are going to do, but I cannot do it because there is an 18- 

month procurement process and it doesn’t fit the RFP [Request for 

Proposal] that was written sometimes 2 years ago. It doesn’t really 

fit that RFP. So I would have to go back in, I would have to change 

the RFP, I would have to go through another 12 months, and then 
14 

I come back to you and you go I don’t remember who you are because it has been so long. So I think we need to empower people 

within the acquisition process. 

Thank you, Madam Chairwoman. 

Ms. SANCHEZ. I like the observations you made, Mr. Smith. 

And, of course, the other problem is, at a time when we have 

such a calling on the government to stop making government bigger and having this push to somehow—it is difficult, because we 

are dealing with very complex issues. We are dealing with people 

who get paid a lot of money. Everybody who is worth their salt in 

your industry is making money, and then we want them to come 

and work for the Federal Government. So that—— 

Mr. SMITH. If I could just comment. It is not a matter of making 

the government bigger. It is a matter of making it better. And we 

are paying the contractors. We are paying for those RFPs. We are 

paying for this acquisition process, which in many cases just winds 

up costing more. So I think you can accomplish both. 

Ms. SANCHEZ [continuing]. Well, we always try to do that, and 

I think that is part of what we did in the slimmed-downed acquisition programs that we are putting in place led by Mr. Andrews. 

But there is always that overlap time where we are trying to get 

out of one system and really make the other system work, and it 

is a difficulty. So I would agree with you. It is just difficult how 

we get to that. 

Mr. Ricketson, you said at one point in your testimony that we 

should encourage small business policy, that we should change 

small business policy or make small business policy to encourage 

innovation. If you were a Congressperson sitting up here and you 

wanted to change small business policy of the government to encourage innovation, how would you go about that? What would you 

propose would be—— 

We have already got our small business innovation programs. We 

have pilot programs. We have got Mr. Lee saying, well, you know, 

the problem really isn’t that you are not encouraging innovation in 

small business. By having some of these programs is when you get 

to a point these programs, that falls off—when we tell you, okay, 

here, we are going to throw you out of the nest and go fly, there 

is nobody to help you figure out how to fly as you spiral downwards 

into never-never land. 

So what would you say? If you were a Congressperson, when you 

say change small business policy or mold small business policy to 

encourage innovation, what would that look like? Because we also 

have R&D [Research and Development] tax write-offs, for example. 

What would be—from your angle, what does that mean to you? 

Mr. RICKETSON. I am honored to be asked, though I come here 

from the perspective of our small company trying to move forward, 

seeing some hindrances, offering constructive suggestions about 

areas to focus on. Far be it from me to make a lot of specific proposals. 

However, a comment you made a minute ago I wanted to respond 

to that I think is relevant. All of us—there is the challenge of big 

government versus—bigger government versus what we want government to do. And in the area of fostering innovation, small 

amounts of money at earlier stages yields much better returns than 
15 

large amounts of money that are deployed in mature programs. So 

I would encourage the government to provide for small businesses 

that have ideas that seem like they might be interesting, services 

that eliminate those companies having to come up with the money 

and take that risk themselves. 

So a suggestion a moment ago, which is some technical claims 

are difficult to validate because they take an infrastructure that is 

beyond the small company to fully judge. And a technical claim 

goes beyond technology but also involves risk. Large companies, 

large integrators, complex procurement programs are, to some extent, a proxy for risk assessment. So if you can at least ask the organizations that are assigned to look after technology and small 

companies to bring innovation into their criteria and find ways to 

measure whether they are doing a good job, we are going in the 

right direction. 

Ms. SANCHEZ. The problem for somebody who is working in the 

government—I am not talking about us, because we are taking 

risks all the time. We have 2-year jobs, and then we have to go out 

and campaign again—is that it seems to me within the Federal 

Government, from what I learned, is that somebody who goes with 

the known quantity, a Rockwell or a Raytheon or something, is 

never going to get in trouble if he suggested or gave the contractor 

somebody like that. Because when those guys mess up—and somewhere along a large project there are a lot of mess-ups. You have 

to look at some of the subcommittees I have had before to know 

all the failings that I have seen. Well, it couldn’t be done. We are 

the biggest, we are the best, and it couldn’t be done. Or we just— 

you scoped it wrong or the specs were wrong. 

But if a government employee goes and gives it to a small, innovative company and you do fail, then it is like, well, didn’t you 

know that was going to happen? Here is a company that has no 

track record or doesn’t have the resources to cover the losses or 

look at all the time we have wasted. 

So it is really—it is a very difficult thing when I look at these 

government employees to be able to really take that type of risk. 

I would also say that is one of the reasons why we put DARPA 

in, because that is our risk taking, that is almost throw caution to 

the wind and go with bold ideas. It is almost a contrarian type of 

an agency. 

So I don’t know if we need more DARPAs or what we need in 

order to give government ability to feel comfortable working with 

so many of these new issues and what is really a risk to your environment by definition because it is new and a bad attack of cybersecurity can get to all of us at once. 

Mr. Miller, do you have any other questions? 

Mr. MILLER. Yeah. I would like to follow up on Mr. Smith’s line 

of questioning in regards to insourcing. 

I would say that in the First Congressional District it is of great 

concern not only to me but to some of my constituents because I 

believe that the standards used in determining which jobs are to 

be insourced don’t really use any true methodology. I think that, 

in many cases, the numbers seem to be arbitrary. 

But what I want to know and, Mr. Thornton, you had—when we 

were talking a minute ago, you were nodding your head. I couldn’t 
16 

tell if it was in agreement or dissent. My question is, have any of 

your companies been affected by DOD’s insourcing? And, if it has, 

could you explain and offer your guidance to the committee on 

what jobs could be insourced from your field? 

So, Mr. Thornton, if you would; and then if the other two want 

to chime in, you can. If not, that is fine, too. 

Mr. THORNTON. Thank you, Congressman Miller. 

I cannot say specifically that we have been affected by insourcing 

on any particular instance, but I can give an example where the 

government had in its employ some very sharp technical people 

that were ultimately driving the architecture of a major purchase. 

And this was at the Veterans Administration [VA], some of the 

people that work for Mr. Baker there, very technically astute, as 

good as you are going to find in private industry and what have 

you. And when you have an environment like that, the government 

as a customer is being very clear in terms of its expectations of 

your technical performance. 

I could cite some other examples where our company is working 

with a large integrator and the government employees are more 

program managers and financial folks and it is really the large integrator that is driving the technical requirements. And from my 

not expansive number of times I have seen that—I have only seen 

that a couple of times—it does make sense to me what Congressman Smith was saying. Were the government able to insource technical architecture, empowered individuals that can drive requirements, we will probably end up with more effective, cost-effective, 

more demanding requirements. 

Now, what does that mean to small business? I believe in my 

heart of hearts more demanding requirements is an unfair advantage for small business. When you ask for something that is not 

currently being built today, more times than not it is a small business that is going to be able to meet that requirement than a large 

company. 

And so one other way I might contrast that. My company does 

a lot of work with the Federal Government and a lot of work with 

the banking industry. As I mentioned with the VA, there were 

technical people in there that could easily work in the banking industry and drive the same requirements. Just about every bank we 

come into has technical people that manage the entire requirements process, set the bar for what is good enough, determine if 

the small business is making legitimate technical claims or not and 

really owns that. And as we talk here today—this is not an idea 

I came to bring to you, but as I listen to the discussion that does 

make a lot of sense to me—I think you would benefit from that. 

Mr. LEE. Mr. Miller, I think one of the issues you have in trying 

to insource is—I am going to bet, looking at us, that my colleagues 

and I grew up shortly after Sputnik went up and the Mercury 

space program kicked off and the United States went nuts for 

science and math and engineering expertise and the kids that I 

was growing up with were focused on that. 

The kids today are not as focused on that. We see our universities, particularly engineering schools, being more inundated by 

foreign students who take that expertise home. Those are the peo-
17 

ple that you need, the young kids coming out of school that you 

need to figure out a way to incentivize into the government. 

Unfortunately, there is a whole culture that seems to believe that 

a government job is, A, to serve the Nation but more, and as importantly, to generate a good pension coverage for when you get older. 

So the issue becomes, how do you incentivize those kids to come 

into the service, the government service to do the engineering work 

needed in order to make sure we are pulling the best out of the 

small business and getting it into our processes? 

I don’t know if you can think outside the box and say, well, let 

us have a project, maybe run by DARPA, maybe run by some other 

organization. I know the services all have good and vibrant laboratories that do innovative things. Perhaps you run a pilot effort for 

a 2-year initiative to suspend the FAR [Federal Acquisition Regulations] and the DFAR [Defense Federal Acquisition Regulations], 

write some letter contracts and see what we can do, as my colleagues have said. And if the technical expertise and the delivery 

is good and the government side can figure out that it is good and 

can understand how to specify that on a grander scale, you now are 

in a position that government has learned, industry has learned, 

and we got out from under the acquisition umbrella that just seems 

to impede the process, which seems to be where we constantly 

found ourselves stuck in the labyrinth. 

Ms. SANCHEZ. Well, do you have any more questions, Mr. Miller? 

Mr. MILLER. No. 

Ms. SANCHEZ. Okay. We are going to have votes in a few minutes 

so we will conclude this, but I just wanted to make some observations. 

I can’t tell you how many times—and I live in Orange County, 

California, which is, as you know, an innovative—we carry the innovative agenda, as so many in California, and especially the defense, the aerospace, NASA [National Aeronautics and Space Administration]-driven issues, we have a lot of small companies that 

work in Orange County that have their people in Orange County, 

and there have been plenty of times I have seen where these small 

companies come to the Federal Government—they come to me and 

they say, we really have some ideas, and someone needs to hear 

these. You need to help us. Of course, we start banging on doors 

and stuff. 

The reality is, it is very difficult. As you say, unless you have 

someone who has been in the Pentagon day in, day out, or contracting, it is a very difficult thing for a small business and they 

really can’t afford tons of lobbyists and specialists and everything 

and to put them out there for a year or two. 

As many of you know, the specs are written with, you know— 

because a technical aspect may not be within one of the government departments that is doing this, they rely a lot on industry 

coming in and talking to them about what those specs for those 

RFPs should be. That is a long process. It is usually a year, two, 

three years before you see the RFP; and it has been written by 

somebody who already, you know, knows it is coming out. And yet 

you have the small business who wants to compete. It is very difficult, and they can’t afford to compete. That is the truth. 
18 

So we do need to find a new way in which we allow this innovation to get in here. Because I certainly see it out in the commercial 

area day in and day out where I live out there in California, and 

you don’t see it here as much in Washington, DC. 

So I would hope that if you do have, given that some of you have 

hit your head against that wall or been at companies or heard stories, that you might do us a favor of sitting down and writing specifics about what we might change, what we might really try to 

change in order for these innovative ideas to get a fair shake out 

here in Washington, DC. That is what this subcommittee is about, 

at least with respect to the Department of Defense. 

I want to thank all of you for being here today. We really appreciated your testimony, and I would appreciate any follow-up that 

you might have to this issue that I just laid out. 

Thank you very much. The subcommittee is now adjourned. 

[Whereupon, at 3:05 p.m., the subcommittee was adjourned.] 
A P P E N D I X 

JULY 28, 2010 

PREPARED STATEMENTS SUBMITTED FOR THE RECORD 

JULY 28, 2010 

(23) 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 
49 
50 
51 
52 
53 

Æ