```

[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]

 
                     HOMELAND CYBERSECURITY AND DHS
                     ENTERPRISE ARCHITECTURE BUDGET
                      HEARING FOR FISCAL YEAR 2005

=======================================================================

                                HEARING

                               before the

                     SUBCOMMITTEE ON CYBERSECURITY,
                       SCIENCE, AND RESEARCH AND
                              DEVELOPMENT

                                 of the

                 SELECT COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED EIGHTH CONGRESS

                             SECOND SESSION

                               __________

                             MARCH 30, 2004

                               __________

                           Serial No. 108-44

                               __________

    Printed for the use of the Select Committee on Homeland Security

 Available via the World Wide Web: http://www.access.gpo.gov/congress/
                                 house

                               __________

                    U.S. GOVERNMENT PRINTING OFFICE
23-174                      WASHINGTON : 2005
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800  
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�0900012005

                 SELECT COMMITTEE ON HOMELAND SECURITY

                 Christopher Cox, California, Chairman

Jennifer Dunn, Washington            Jim Turner, Texas, Ranking Member
C.W. Bill Young, Florida             Bennie G. Thompson, MississPpi
Don Young, Alaska                    Loretta Sanchez, California
F. James Sensenbrenner, Jr.,         Edward J. Markey, Massachusetts
Wisconsin                            Norman D. Dicks, Washington
W.J. (Billy) Tauzin, Louisiana       Barney Frank, Massachusetts
David Dreier, California             Jane Harman, California
Duncan Hunter, California            Benjamin L. Cardin, Maryland
Harold Rogers, Kentucky              Louise McIntosh Slaughter, New 
Sherwood Boehlert, New York          York
Lamar S. Smith, Texas                Peter A. DeFazio, Oregon
Curt Weldon, Pennsylvania            Nita M. Lowey, New York
Christopher Shays, Connecticut       Robert E. Andrews, New Jersey
Porter J. Goss, Florida              Eleanor Holmes Norton, District of 
Dave Camp, Michigan                  Columbia
Lincoln Diaz-Balart, Florida         Zoe Lofgren, California
Bob Goodlatte, Virginia              Karen McCarthy, Missouri
Ernest J. Istook, Jr., Oklahoma      Sheila Jackson-Lee, Texas
Peter T. King, New York              Bill Pascrell, Jr., North Carolina
John Linder, Georgia                 Donna M. Christensen, U.S. Virgin 
John B. Shadegg, Arizona             Islands
Mark E. Souder, Indiana              Bob Etheridge, North Carolina
Mac Thornberry, Texas                Ken Lucas, Kentucky
Jim Gibbons, Nevada                  James R. Langevin, Rhode Island
Kay Granger, Texas                   Kendrick B. Meek, Florida
Pete Sessions, Texas                 Ben Chandler, Kentucky
John E. Sweeney, New York

                      John Gannon, Chief of Staff

        tephen DeVine, Deputy Staff Director and General Counsel

           Thomas Dilenge, Chief Counsel and Policy Director

               David H. Schanzer, Democrat Staff Director

             Mark T. Magee, Democrat Deputy Staff Director

                    Michael S. Twinchek, Chief Clerk

                                 ______

   Subcommittee on Cybersecurity, Science, and Research & Development

                    Mac Thornberry, Texas, Chairman

Pete Sessions, Texas, Vice Chairman  Zoe Lofgren, California
Sherwood Boehlert, New York          Loretta Sanchez, California
Lamar Smith, Texas                   Robert E. Andrews, New Jersey
Curt Weldon, Pennsylvania            Sheila Jackson-Lee, Texas
Dave Camp, Michigan                  Donna M. Christensen, U.S. Virgin 
Robert W. Goodlatte, Virginia        Islands
Peter King, New York                 Bob Etheridge, North Carolina
John Linder, Georgia                 Ken Lucas, Kentucky
Mark Souder, Indiana                 James R. Langevin, Rhode Island
Jim Gibbons, Nevada                  Kendrick B. Meek, Florida
Kay Granger, Texas                   Ben Chandler, Kentucky
Christopher Cox, California, ex      Jim Turner, Texas, ex officio
officio

                                  (ii)

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               STATEMENTS

The Honorable Mac Thornberry, a Representative in Congress From 
  the State of Texas, and Chairman, Subcommittee on 
  Cybersecurity, Science, and Research and Development
  Oral Statement.................................................     1
  Prepared Statement.............................................     2
The Honorable Zoe Lofgren, a Representative in Congress From the 
  State of California, and Ranking Member, Subcommittee on 
  Cybersecurity, Science, and Research and Development...........     2
The Honorable Christopher Cox, a Representative in Congress From 
  the State of California, and Chairman, Select Committee on 
  Homeland Security..............................................    22
The Honorable Jim Turner, a Representative in Congress From the 
  State of Texas, Ranking Member, Select Committee on Homeland 
  Security
  Prepared Statement.............................................     4
The Honorable Robert E. Andrews, a Representative in Congress 
  From the State of New Jersey...................................    33
The Honorable Donna M. Christensen, a Delegate in Congress From 
  the U.S. Virgin Islands........................................    27
The Honorable Jennifer Dunn, a Representative in Congress From 
  the State of Washington........................................    29
The Honorable Bob Etheridge, a Representative in Congress From 
  the State of North Carolina....................................    31
The Honorable Jim Gibbons, a Representative in Congress From the 
  State of Nevada................................................    25
The Honorable James R. Langevin, a Representative in Congress 
  From the State of Rhode Island.................................    36
The Honorable Kendrick B. Meek, a Representative in Congress From 
  the State of Florida...........................................    41

                               WITNESSES

Mr. Robert Liscouski, Assistant Secretary for Infrastructure 
  Protection, Department of Homeland Security
  Oral Statement.................................................     5
  Prepared Statement.............................................     8
Mr. Steven Cooper, Chief Information Officer, Department of 
  Homeland Security
  Oral Statement.................................................    14
  Prepared Statement.............................................    18

                                APPENDIX

Questions for Assistant Secretary Robert Liscouski:
  Questions from Congressman Dave Camp...........................    45
  Questions from Congressman Sherwood Boehlert...................    46
  Questions from Congressman Mac Thornberry and Congresswoman Zoe 
    Lofregn......................................................    47
  Questions from Congressman Jim Turner..........................    54

Questions for Chief Information Officer Steven Cooper:
  Questions from Congressman Mac Thornberry and Congresswoman Zoe 
    Lofgren......................................................    56

                     HOMELAND CYBERSECURITY AND DHS

      ENTERPRISE ARCHITECTURE BUDGET HEARING FOR FISCAL YEAR 2005

                              ----------                              

                        Tuesday, March 30, 2004

                          House of Representatives,
             Select Committee on Homeland Security,
                    Subcommittee on Cybersecurity, Science,
                              and Research and Development,
                                                   Washington, D.C.
    The subcommittee met, pursuant to call, at 10:06 a.m., in 
Room 2325, Rayburn House Office
    Building, Hon. Mac Thornberry [chairman of the 
subcommittee] presiding.
    Present: Representatives Thornberry, Smith, Camp, Linder, 
Gibbons, Cox (ex officio),
    Lofgren, Andrews, (Del.) Christensen, Etheridge, Lucas, 
Langevin, Meek, and Turner (ex officio).
    Also Present: Representative Dunn.
    Mr. Thornberry. The hearing will come to order. I would 
like to welcome our witnesses and guests to this hearing of the 
Subcommittee on Cybersecurity, Science, and Research and 
Development.
    Last year, we received a number of perspectives on 
cybersecurity from academia, think tanks, the technology 
industry, government agencies, users, and others. All want the 
Department to succeed in its mission to protect our Nation. All 
emphasized the importance of cyberspace and the need for 
stronger cybersecurity in government, industry, academia, and 
at home.
    Now, as we move into the second year of the Department of 
Homeland Security there remain many areas in cybersecurity in 
need of improvement. Cyber is an area that can touch across 
virtually every aspect of our lives, from electrical grids, 
airport control towers, manufacturing, banking, chemical 
plants, and many other areas.
    With the creation of the National Cybersecurity Division 
last June, I was pleased the Department acknowledged the need 
to consolidate the cyber mission into an organization that 
could have one voice in dealing with international, Federal, 
State, local, and private sectors. However, over the course of 
recent months I have been concerned that many of the 
cybersecurity resources within the Department remain fragmented 
and have not been integrated under the Cybersecurity Division.
    Our Nation needs a seamless, well-functioning organization 
within the Department to work with industry, other government 
elements, academia, and the home user. That is part of the 
external cybersecurity mission of the Department.
    But there is also an internal cybersecurity mission for the 
Department. The Chief Information Officer has responsibility 
for protecting the Nation's most sensitive data that has been 
entrusted to the DHS to counter terrorism against the homeland. 
As the Department develops its enterprise architecture, privacy 
and classified information are two areas that must be 
considered as the networks from the 22 agencies are brought 
together.
    I also believe that the Department must be a role model for 
the rest of government as well as the private sector in how 
they secure their own information infrastructure. DHS needs to 
``walk-the-talk'' and achieve the highest standards within the 
Federal Government and cybersecurity. The creation of the 
Department should also result in efficiencies through 
integration and also find the most effective use of resources.
    I look forward to hearing about your progress in both areas 
over the course of the past year.

 Prepared Statement of The Honorable Mac Thornberry, Chairman, Select 
                     Committee on Homeland Security

    I would like to welcome our witnesses and guests to today's 
hearing.
    Last year, this subcommittee received a number of perspectives on 
cybersecurity, from academia, think tanks, the technology industry, 
government agencies, users, and others. All want the Department of 
Homeland Security to succeed in their mission to protect our nation. 
All emphasized the importance of cyberspace and the need for stronger 
cybersecurity in government, industry, academia, and at home.
    As we move into the 2nd year for the Department of Homeland 
Security, there remain many areas in cybersecurity in need of 
improvement. Cyber is an area that cross-cuts virtually very aspect of 
our lives. Electrical grids, airport control towers, manufacturing, 
banking, chemical plants, and many other areas are dependent upon their 
computers, information, and networks to be reliable and secure from 
attacks.
    With the creation of the National Cybersecurity Division (NCSD) 
last June, I was pleased that the Department acknowledged the need to 
consolidate the cyber mission into an organization that could have 
``one voice'' in dealing with international, federal, state, local and 
private sectors. However, over the course of recent months, I am 
concerned that many of the cybersecurity resources within the 
Department remain fragmented and have not been integrated under NCSD.
    Our nation needs a seamless and well-functioning organization 
within the Department to work across industry, other government 
elements, academia, and the home user. That is part of the external 
cybersecurity mission for the Department of Homeland Security.
    There is also an internal cybersecurity mission for the Department. 
The Chief Information Officer has the responsibility for protecting our 
nation's most sensitive data that has been entrusted to DHS to counter 
terrorism against the homeland. As the Department develops its 
enterprise architecture, privacy and classified information are two 
areas that must be considered as the networks from the 22 agencies are 
brought together.
    I also believe the Department must be a role model for the rest of 
the government--as well as the private sector--in how they secure their 
own information infrastructure. DHS needs to ``walk the talk'' and 
achieve the highest standards within the federal government in 
cybersecurity. The creation of the Department should result in 
efficiencies through integration and also find the most effective use 
of resources. I look forward to hearing about your progress and plans 
for the coming year.

    Before we turn to our witnesses, let me yield to the 
distinguished ranking member, the gentlelady from California.
    Ms. Lofgren. Thank you, Chairman Thornberry.
    The Select Committee on Homeland Security is in the process 
of tracking the first ever authorization bill through the 
Department of Homeland Security, and I believe that today's 
hearing before this subcommittee will serve as an important 
part of the authorization process. We will focus on 
cybersecurity activities of the Infrastructure Protection 
Directorate and will explore the information technology and 
enterprise architecture issues facing the agency, and it will 
give us an opportunity to understand resource and policy issues 
pertaining to the budget request for the next fiscal year.
    In addition, members may explore additional legislative 
issues relevant to the Director's activities for possible 
inclusion into the authorization bill.
    Certainly, we have no shortage of issues to discuss with 
our witnesses today. Earlier this month President Bush and 
Secretary Ridge celebrated the first anniversary of the 
creation of the Department of Homeland Security. At the event, 
the President said, quote, one of the most important steps we 
have taken to fight terrorism is creating the Department of 
Homeland Security combined under one room with a clear chain of 
command many agencies responsible for protecting our Nation. 
Creating the newest department of our Federal Government was a 
tough task that required a lot of hard work, changing some old 
habits in order to merge into a new department. Unquote.
    I think this assessment of the Department is pretty 
optimistic, and I know that while rank and file employees have 
worked very hard over this past year to get it up and running, 
I am not convinced that the leadership of the Department of 
Homeland Security should be celebrating at this time, 
particularly in the area of cybersecurity.
    I am concerned about cyber policy in the Department. I am 
not convinced that cybersecurity is a priority within the 
overall Department of Homeland Security, and I am troubled by 
the lack of concrete cybersecurity accomplishments over the 
past year.
    The release of the National Strategy to Secure Cyberspace 
was at the beginning of 2003. This policy paper established 
cybersecurity goals. At the end of 2003, the Department of 
Homeland Security convened a cybersecurity summit with major 
players in the technology industry in the Silicon Valley. Other 
than these two events, I am just not familiar with the work 
that is going on in DHS, and I think I am safe in saying that 
members of this subcommittee are somewhat frustrated.
    The threat of a cyber attack is very real. In 2003, we saw 
increasing worm and virus spreads, and Business Week estimated 
that the damage from worms last year alone was over $13 
billion.
    Today's witnesses are Mr. Robert Liscouski, Assistant 
Secretary for Infrastructure Protection, Information Analysis, 
and Infrastructure Protection Directorate, and Mr. Steven 
Cooper, Chief Information Officer of the Department of Homeland 
Security. I hope that the witnesses today will be able to 
reassure this subcommittee that work is being done within the 
Department and that cybersecurity in fact is a priority for the 
administration.
    I would also like to note my frustration at the tardiness 
with which the statements were delivered to the committee. The 
rules of the Homeland Security Committee prescribe that 
witnesses who wish to submit a written statement shall file 
them--not may, but shall file them 72 hours prior to the 
hearing. Mr. Liscouski's statement was filed 14 hours prior to 
this committee and Mr. Cooper's statement was filed 45 minutes 
before the committee hearing, and I think that that is a real 
disservice to every member of the committee as we obviously 
have not had the time to really study Mr. Cooper's statement or 
Mr. Liscouski's statement.
    Before concluding, I would like to thank the chairman of 
this committee, Mr. Thornberry, who has led our committee with 
great skill and intelligence, and I appreciate his leadership. 
Thank you.
    Mr. Thornberry. I thank the gentlelady, and let me echo her 
frustration with the delays in having the statements before us. 
Obviously, it makes it more difficult for all of us to do our 
job well.
    Let me just, as a brief aside on timing. My understanding 
is that we will have votes roughly around 11:30. Mr. Liscouski 
also has another hearing in the Intelligence Committee around 
that time, and so I don't want to limit anything but the 
briefer we can all be in our questions and responses we can 
cover more territory. I appreciate both of our witnesses. 
Without objection, other members of course may submit opening 
statements for the record.

  Prepared Statement of the Honorable Jim Turner, a Representative in 
 Congress From the State of Texas, and Ranking Member, Subcommittee on 
           Cybersecurity, Science, and Research & Development

    Thank you Mr. Chairman.
    Good Morning Gentlemen. Mr. Liscouski, it is a pleasure to have you 
testify before our Committee again. Mr. Cooper, I believe this is the 
first time you have appeared before us--welcome.
    The Department of Homeland Security's cybersecurity mission is two-
fold. First, it is the key agency responsible for coordinating our 
nation's efforts to protect our computer networks and critical 
infrastructures. Second, it must ensure that its own information 
technology systems are well-integrated and armed with appropriate 
safeguards.
    We recognize that these tasks are not easy but they must be done to 
help ensure the security of our homeland. The ever-changing nature of 
technology means that the Department must have the best expertise, 
personnel, tools, and full authority to effectively accomplish its 
mission.
    Unfortunately, the Department is not making the progress needed to 
secure our nation from a cyber attack. It is also not moving quickly 
enough to integrate and protect its own information technology systems.
    Mr. Liscouski, six months ago you appeared before this Subcommittee 
and told us that the Department, having finally found a Director to 
lead its cybersecurity efforts, was undertaking significant initiatives 
to further our country's efforts to secure cyberspace and prepare and 
respond to network attacks. To date, however, the cybersecurity 
initiatives that the have been unveiled have not gotten us much further 
than we were before the creation of the Department. Indeed, some of the 
initiatives appear to duplicate existing efforts.
    Let me just mention a few specific areas in which I see the 
Department's efforts lagging.
         First, it is not apparent to me that the Department 
        has in place the ability and authority to direct other agencies 
        with specific expertise in the event of a cyber crisis.
         Second, the Department does not appear to have an 
        effective and meaningful public--private cybersecurity 
        partnership. Many in the private sector have little or no idea 
        what you are doing, what is expected of them, or how they are 
        supposed to integrate and coordinate with the Department.
         Third, the Department has not sufficiently moved 
        forward with the National Strategy to Secure Cyberspace 
        released by the Administration a year ago. Why haven't we yet 
        seen clear assignments of responsibilities and deadlines for 
        the Strategy's implementation? If it is because the strategy 
        won't work or is ineffective--we need to know that.
         Lastly, Mr. Liscouski, the Department's 2005 budget 
        does not clearly lay out what your directorate is planning to 
        do to further our cybersecurity efforts. We've only seen broad 
        assertions and categories of activities. There seems to be 
        lacking a clear vision on what the Department is doing to 
        secure cyberspace.
    Mr. Cooper, I must say I am equally concerned about the state of 
the Department's efforts to build robust information technology systems 
within the Department and secure its own internal networks. There are 
specific areas, in particular, for which I am concerned.
         First, the Department's efforts to date have been too 
        slow. Just last week, I saw one official stating that simple e-
        mail can't get passed to people in the same office and that it 
        takes hours for e-mail to bounce around the Department to reach 
        its destination. We won't win the war on terror if Homeland 
        Security officials can't even talk to each other.
         Second, good and consistent information technology 
        policies can help speed the integration of terrorist watch 
        lists, strengthen the security of our borders, and allow us to 
        ``connect the dots'' to find terrorists. It worries me, Mr. 
        Cooper, that you have publicly suggested that a consolidated 
        watchlist may not be necessary. In my view, achieving this goal 
        is critical for making our homeland security programs work.
         Third, it is not clear to me, Mr. Cooper, that you 
        have the sufficient authority to coordinate and direct the 
        divisional Chief Information Officers within the Department. If 
        this is a problem, I hope that you will be candid with us 
        regarding any additional authorities your position requires.
         Lastly, this past December, the Department received a 
        34--the lowest grade of any agency--in the Government Reform 
        Committee's annual grading of agencies on the security of their 
        computer systems. The Department should be setting an example 
        for the rest of government to follow--not trailing at the back 
        of the class.
    Gentleman, I thank you for appearing before our Committee today to 
address these important issues.

    I appreciate both of our witnesses being here today. Let me 
first call on Robert Liscouski, Assistant Secretary for 
Infrastructure Protection at the Department of Homeland 
Security.

    STATEMENT OF ROBERT LISCOUSKI, ASSISTANT SECRETARY FOR 
   INFRASTRUCTURE PROTECTION, DEPARTMENT OF HOMELAND SECURITY

    Mr. Liscouski. Thank you, Mr. Chairman, and distinguished 
members of the subcommittee. I appreciate the opportunity to be 
here this morning.
    As you pointed out, I am responsible for infrastructure 
protection at the Department of Homeland Security, and I am 
pleased to be here before you today to discuss our progress 
that we have made in the National Cybersecurity Division and to 
discuss the President's fiscal year 2005 budget request.
    In today's highly technical and digital world, we recognize 
that attacks against us may manifest themselves in many forms, 
including both physical and cyber attacks. And in addition, we 
recognize the potential impact of collateral damage from any 
one attack to a variety of assets. This interconnected and 
interdependent nature of our infrastructure makes our physical 
and cyber assets difficult to separate, and it would be 
irresponsible to address them in isolation.
    The integrated approach that DHS takes toward protection of 
physical and cyber assets and responsive threats and protection 
of its vulnerabilities enables us to consider the full range of 
risks to the Nation, including loss of life, destruction of 
infrastructure services, economic impact, and national security 
implications. Recognizing that future terrorist attacks may not 
be limited to either physical or cyber acts but rather a 
combination of the two to amplify the impact, my office is 
organized to examine and address threats and vulnerabilities 
across the nation's infrastructure by using a five-step risk 
management methodology that measures the Nation's risk profile 
in the context of and in the absence of threat information. 
Those major steps of the risk management methodology include 
the identification of the critical infrastructure assets, the 
assessment of vulnerabilities, the normalization analysis and 
prioritization of protective measures, implementing protective 
programs, and then finally the measurement of effectiveness and 
performance outputs so we can determine whether what we are 
doing is the right thing.
    The National Cybersecurity Division was created in June of 
2003 to serve as a national focal point for the public and the 
private sectors to address the cybersecurity issues and to 
coordinate the implementation of a national cyber strategy to 
secure cyberspace.
    Under that mandate, the National Cybersecurity Division has 
been working closely with our partners in the Federal 
Government, the private sector, and academia on a variety of 
programs and initiatives to protect our information 
infrastructure. We recognize that the challenge is vast and 
complex, that the threats are multi-faceted and global in 
nature, and that our strengths and our vulnerabilities lie in 
our interdependencies; that the environment changes rapidly, 
and that information sharing and coordination are crucial to 
improving our overall national and economic security.
    The activities of the National Cybersecurity Division then 
are based on this understanding and designed to address each of 
the priorities set forth in the National Strategy to Secure 
Cyberspace.
    Priority one, a national cyberspace secure response system;
    Priority two, a national cyberspace security threat and 
vulnerability reduction program;
    Priority three, a national cyberspace security awareness 
and training program;
    Priority four, securing the government's cyberspace; and,
    Priority five, national security and international 
cyberspace security cooperation.
    When I appeared before the committee--before the 
subcommittee in September of 2003, I announced that Mr. Amit 
Yoran was to become the Director of the National Cybersecurity 
Division. Under his leadership, the division has aggressively 
pursued partnerships and programs and is building a strong team 
to meet its objectives. I also announced the creation of the 
U.S. Computer Emergency Readiness Team, or the US-CERT. The US-
CERT is a key component of our cyber strategy and readiness and 
response system and the National Cybersecurity Division's 
operational arm. The US-CERT provides a national coordination 
center that links public and private response capabilities to 
facilitate information sharing across infrastructure sectors 
and to help protect and maintain the continuity of our Nation's 
cyber infrastructure.
    On 28 January of this year, the Department of Homeland 
Security through the US-CERT unveiled the National Cyber Alert 
System. It is an operational system developed to deliver 
targeted and timely and actionable information to Americans to 
secure their computers. At the U.S. government, we have the 
responsibility to alert the public of imminent threats and to 
provide protective measures where we can, and minimally to 
provide information necessary for the public to protect their 
systems.
    The day we inaugurated the system, the US-CERT site 
received more than 1 million hits. And today, from the first 
few weeks of that site, we have more than 250,000 direct 
subscribers who receive the National Cybersecurity Alert 
information to enhance their cybersecurity. And I urge you all 
to visit that site at www.US-CERT.gov, to subscribe to our 
information services.
    To facilitate the preparation interagency and public-
private cooperation coordination during and to recover from 
cyber incidents, we have created the Cyber Interagency Incident 
Management group, or Cyber IIMG. The Cyber IIMG coordinates 
intergovernmental preparedness and operations to respond to and 
recover from cyber incidents and attacks. The group brings 
together senior officials from national security, law 
enforcement, defense, intelligence, and other government 
agencies that maintain significant cybersecurity capabilities 
and that can bring to bear in response to an incident and, 
importantly, possess the necessary statutory authority to act.
    We have also broadened our interagency partnerships to 
create two new groups addressing the various challenges before 
us. The first is a Chief Information Security Officers Forum, 
CISO Forum, established to provide a trusted venue for our 
government information security offices to collaborate and 
share effective practices, initiatives, capabilities, 
successes, and challenges.
    The second group is the Government Forum of Incidents 
Response and Security Teams, FIRST, a group of technical and 
tactical practitioners of security response teams responsible 
for securing government information technology systems. GFIRST 
members work together to understand and handle computer 
security incidents and to encourage proactive and preventive 
security practices.
    One of our most important constituencies of course is the 
private sector, because as you well know it is estimated that 
85 percent of America's critical infrastructure is owned and 
operated by the private sector, and technology developed by the 
industry continues to fuel the growth and the evolution of the 
Internet.
    In December 2003, the Cybersecurity Division co-hosted the 
first National Cybersecurity Summit, which allowed the 
Department to work side by side with leaders in industry to 
address key cybersecurity issues facing the Nation. The Cyber 
Division is also working closely with research and academic 
communities to better educate and train future cyber analysts, 
and we are participating in the National Science Foundation 
Scholarship For Service, or the Cyber Corps program as well as 
the National Security Agency's Information Assurance Centers 
for Excellence, academic excellence in 26 States, for which 
there are 50 centers.
    The National Cybersecurity Division is only 9 months old, 
but these initiatives represent considerable progress toward 
making cybersecurity a reality and reflect our collective 
commitment to do much more. Each accomplishment fosters further 
activity which we have outlined in our fiscal year 2005 budget. 
The national cybersecurity budget for fiscal year 2005 request 
is $79 million, and it is based upon ongoing and future 
activities necessary to meet our mission.
    The division is positively exploiting the work of its 
predecessors and building crucial partnerships as part of DHS's 
overall efforts to enhance the protection of our Nation's 
critical infrastructure. We have much to do and it will take 
time, resources, dedication, energy, and hard work to succeed. 
We are committed to that challenge, and we look forward to the 
opportunities to update the subcommittee on our progress.
    We are also approaching the next National Cybersecurity 
Day, I would like to point out, which is this Sunday. And as 
Americans turn their clocks forward, we also urge them to take 
this opportunity to review and improve their cyber readiness.
    Again, I thank you for the opportunity to testify before 
you today, and I would be pleased to answer the questions at 
your convenience.
    [The statement of Mr. Liscouski follows:]

          Prepared Statement of the Honorable Robert Liscouski

    Good morning, Chairman Thornberry and distinguished Members of the 
Subcommittee. My name is Robert Liscouski, and I am the Assistant 
Secretary for Infrastructure Protection in the Department of Homeland 
Security (DHS). I am pleased to appear before you today to provide an 
update on the Department's National Cyber Security Division's efforts 
in coordinating cyber security initiatives since my appearance in 
September 2003 and to discuss the President's FY 2005 budget request 
for the Division. In my testimony today, I will share information on a 
number of initiatives that use diverse channels of communication to 
reach our government partners as well as our mutual constituents--home 
users, small and medium-sized businesses, and corporations.

Introduction
    March 1st marked the one-year anniversary of the Department of 
Homeland Security. In his remarks commemorating that day, Secretary 
Ridge stressed the Department's goal to strengthen information sharing 
and infrastructure protection over the next year. We in the Information 
Analysis and Infrastructure Protection Directorate (IAIP) take that 
mandate to heart in our collective efforts and activities to protect 
the Nation. Established by the Homeland Security Act, the IAIP 
Directorate leads the Nation's efforts to protect our critical 
infrastructures from attack or disruption, and under the leadership of 
Under Secretary Frank Libutti has made significant strides toward that 
objective.
    The IAIP Directorate includes the Office of Information Analysis, 
the primary gathering and analytic center for threat information and 
intelligence within DHS, and the Office of Infrastructure Protection 
(IP), for which I am responsible. In today's highly technical and 
digital world, we recognize that attacks against us may manifest in 
many forms, including both physical and cyber attacks. In addition, we 
recognize the potential impact of collateral damage from any one attack 
to a variety of assets. This interconnected and interdependent nature 
of our infrastructure makes our physical and cyber assets difficult to 
separate, and it would be irresponsible to address them in isolation. 
The placement of our two offices within the Directorate underscores 
this linkage and enables us to work together to share intelligence and 
other information and coordinate our efforts to mitigate our 
vulnerabilities. Further, IP's component divisions work closely 
together to coordinate efforts regarding both physical and cyber 
threats and vulnerabilities and to develop plans that address the 
interdependencies between them.
    Homeland Security Presidential Directive 7 (HSPD 7), released by 
President Bush on December 17, 2003, requires the development of a 
National Infrastructure Protection Plan that sets out a roadmap for 
assessing both physical and cyber vulnerabilities and, once the 
vulnerabilities are determined, articulating the protective actions 
that need to be taken. As such, IAIP takes a holistic view of critical 
infrastructure vulnerabilities and works to protect America from all 
threats by ensuring the integration of physical and cyber security 
approaches in the Directorate's Office of Infrastructure Protection.
    This integrated approach to physical and cyber threats and 
vulnerabilities enables us to consider the full range of risks to the 
Nation, including loss of life, disruptions of infrastructure services, 
economic impact, and national security implications. Recognizing that 
future terrorist attacks may not be limited to either a physical or 
cyber act, but rather a combination of the two to amplify impact, IP 
includes the National Cyber Security Division, the Protective Security 
Division, the Infrastructure Coordination Division, and the National 
Communications System and is organized to examine and address threats 
and vulnerabilities across the Nation's infrastructure by using a five-
step risk management methodology that measures the national risk 
profile in the context, and absence, of threat information. The major 
steps of our risk management methodology include:

         Identification of critical infrastructure
         Assessing vulnerabilities
         Normalizing, analyzing, and prioritizing protective 
        measures
         Implementing protective programs
         Measuring effectives through performance metrics
    By performing each of these steps continuously across and within 
each critical infrastructure sector, and by integrating threat 
information, we are continually improving our national critical 
infrastructure protection program--physical and cyber--and driving 
better correlation of protective programs to the dynamic threat 
environment.
    National Cyber Security Division Mission: Coordinating our National 
Cyber Security
    In support of the broader IAIP mission, the National Cyber Security 
Division was created in June 2003 to serve as a national focal point 
for the public and private sectors to address cyber security issues and 
to coordinate the implementation of the National Strategy to Secure 
Cyberspace released by the President in February 2003.
    Under that mandate, the National Cyber Security Division has been 
working closely with our partners in the federal government, the 
private sector, and academia on a variety of programs and initiatives 
to protect our information infrastructure. We recognize that the 
challenge is vast and complex, that the threats are multi-faceted and 
global in nature, that our strengths--and our vulnerabilities--lie in 
our interdependencies, that the environment changes rapidly, and that 
information sharing and coordination are crucial to improving our 
overall national and economic security. The activities of the National 
Cyber Security Division, then, are based on this understanding and are 
designed to address each of the priorities set forth in the National 
Strategy to Secure Cyberspace (``the Strategy''):
        Priority I:A National Cyberspace Security Response System
        Priority II: A National Cyberspace Security Threat and 
        Vulnerability Reduction Program
        Priority III: A National Cyberspace Security Awareness and 
        Training Program
        Priority IV: Securing Government's Cyberspace
        Priority V:National Security and International Cyberspace 
        Security Cooperation

    Meeting the Mandate: Readiness and Response
    The National Cyber Security Division's primary overarching goal 
since its creation has been to enhance the Nation's Cyberspace Security 
(Readiness and) Response System (Priority I) that will, where possible, 
deter and prevent a cyber attack from occurring, limit its scope and 
impact on the critical infrastructures, and expedite recovery. In 
October 2003, we participated in Livewire, the first ever national-
level cyber exercise to baseline our capabilities and communication 
paths for responding to national attack. The exercise involved over 300 
participants representing more than 50 organizations across federal, 
state, and local governments and the private sector. Cyber attack 
simulation scenarios were developed to stress cyber interdependencies 
across our critical infrastructures and baseline our ability to 
collaborate across the public and private sectors. The information 
gleaned from Livewire validated the National Cyber Security Division's 
approach and activities. In that context, I will outline the National 
Cyber Security Division's accomplishments to date and discuss on-going 
and future programs that all serve to enhance our national cyber 
security.
    When I appeared before the Subcommittee in September 2003, I 
announced the appointment of Mr. Amit Yoran as the Director of the 
National Cyber Security Division. Under his leadership, the Division is 
aggressively pursuing partnerships and programs and building a strong 
team to meet its objectives. I also announced the creation of the U.S. 
Computer Emergency Readiness Team, or US-CERT. US-CERT is a key 
component of our Cyber Security Readiness and Response System and the 
National Cyber Security Division's operational arm. Through its initial 
partnership with the CERT Coordination Center (CERT/CC) at Carnegie 
Mellon University, US-CERT provides a national coordination center that 
links public and private response capabilities to facilitate 
information sharing across all infrastructure sectors and to help 
protect and maintain the continuity of our Nation's cyber 
infrastructure. The overarching approach to this task is to facilitate 
and implement systemic global and domestic coordination of deterrence 
from, preparation for, defense against, response to, and recovery from, 
cyber incidents and attacks across the United States, as well as the 
cyber consequences of physical attacks. To this end, US-CERT is 
building a cyber watch and warning capability, launching a partnership 
program to build situational awareness and cooperation, and 
coordinating with U.S. Government agencies and the private sector to 
deter, prevent, respond to and recover from cyber--and physical--
attacks.
    One direct impetus of the Livewire exercise was to validate the 
importance of building a cyber information dissemination mechanism to 
reach our stakeholders. On January 28, 2004, the Department of Homeland 
Security through USCERT unveiled the National Cyber Alert System, an 
operational system developed to deliver targeted, timely and actionable 
information to Americans to secure their computer systems. As the U.S. 
Government, we have a responsibility to alert the public of imminent 
threats and to provide protective measures when we can, or least 
provide the information necessary for the public to protect their 
systems. The offerings of the National Cyber Alert System provide that 
kind of information, and we have already issued several alerts and the 
initial products of a periodic series of providing ``best practices'' 
and ``how-to'' guidance. We strive to make sure the information 
provided is understandable to all computer users, technical and non-
technical, and reflects the broad usage of the Internet in today's 
society. I am pleased to report that Americans are exhibiting a keen 
interest in the alert system. On January 28th, the day we inaugurated 
the system, the US-CERT site received more than one million hits. 
Within the first few weeks, more than 250,000 direct subscribers 
received National Cyber Alerts to enhance their cyber security. For 
your reference and for your constituents, I urge you to visit www.us-
cert.gov to subscribe to a number of our information services to 
facilitate protecting your computer systems. As we increase its 
outreach, the National Cyber Alert System is looking at other vehicles 
to distribute information to reach as many Americans as possible.
    The Livewire exercise reiterated the critical need for government 
to share information and coordinate efforts at cyber incident 
preparation that enhance our effectiveness in responding to cyber 
activity. To facilitate preparation and interagency and public-private 
coordination during, and to recover from cyber incidents, we created a 
Cyber Interagency Incident Management Group, or Cyber IIMG. The Cyber 
IIMG coordinates intra-governmental preparedness and operations to 
respond to, and recover from, cyber incidents and attacks. The group 
brings together senior officials from national security, law 
enforcement, defense, intelligence, and other government agencies that 
maintain significant cyber security capabilities that they can bring to 
bear in response to an incident and, importantly, possess the necessary 
statutory authority to act. By meeting monthly, the Cyber IIMG is 
developing cyber preparedness and response plans that will help it to 
support the IIMG during national events with cyber implications, and 
ensure that during a cyber crisis the full range and weight of federal 
capabilities are deployed in a coordinated and effective fashion.
    To enhance the level of communication among federal agencies in a 
crisis, DHS' IP is continuing to widen the reach of the Critical 
Infrastructure Warning Information Network, or CWIN. For those who are 
not familiar, CWIN is a technologically advanced, secure network for 
infrastructure protection, communication and cooperation, alert, and 
notification. As a private communications network, CWIN serves as a 
reliable and survivable network with no logical dependency on the 
Internet or the public switched network. In the event a significant 
cyber attack disrupts our telecommunications networks and/or the 
Internet, CWIN provides a secure and survivable capability for members 
to communicate. It is important for us to understand and prepare for 
any contingency. In this vein, DHS is extending the reach of CWIN's 
survivable architecture beyond federal agencies by working with 
critical private sector companies to establish CWIN nodes at their 
Network Operations Centers. The goal is to increase the number of CWIN 
nodes to 100 by the end of 2004, making it a robust and resilient 
capability that supports national cyber operations and response during 
times of crisis.
    Key components of the National Cyber Security Division's efforts 
are laid out in Priority IV of the Strategy: Securing Government's 
Cyberspace. Consistent with law and policy, the National Cyber Security 
Division works with the Office of Management and Budget and the 
National Institute of Standards and Technology regarding the security 
of federal systems and coordinates with federal law enforcement 
authorities as appropriate. We have taken great steps to integrate 
existing frameworks into the system, such as the continued 
functionality of the Federal Computer Incident Response Center 
(FedCIRC) is being transitioned within US-CERT, as well as to create a 
new forum for coordination toward greater cyber security in the federal 
government.
    We have also broadened our interagency partnerships to create two 
new groups addressing the various challenges before us. The first is 
the Chief Information Security Officers Forum (CISO Forum), established 
to provide a trusted venue for our government information security 
officers to collaborate and share effective practices, initiatives, 
capabilities, successes and challenges. The second is the Government 
Forum of Incident Response and Security Teams (GFIRST), a group of 
technical and tactical practitioners of security response teams 
responsible for securing Government information technology systems. 
GFIRST members work together to understand and handle computer security 
incidents and to encourage proactive and preventative security 
practices. The purpose of the GFIRST peer group is to:

         Provide members with technical information, tools, 
        methods, assistance and guidance;
         Coordinate proactive liaison activities and analytical 
        support;
         Further the development of quality products and 
        services for the federal government;
         Share specific technical details regarding incidents 
        within a trusted U.S. Government environment on a peer-to-peer 
        level; and
         Improve incident response operations.
    The National Cyber Security Division has taken on aggressive plans 
for accelerated information sharing and collaboration efforts in both 
the CISO Forum and GFIRST. Already, both groups have increased 
information sharing horizontally across previously somewhat stove-piped 
organizations and improved the overall cyber preparedness of the U.S. 
Government.

Meeting the Mandate: Assessment and Analysis
    A major component of the National Cyber Security Division's mission 
is our focus within the Office of Infrastructure Protection to 
coordinate efforts on physical and cyber threat and vulnerability 
identification and assessment, and the implementation of protective 
measures to reduce vulnerabilities that will enable IAIP to 
systemically address the security status of U.S. networks and the cyber 
components and dependencies of our critical infrastructures. This 
effort directly responds to the calls in the Strategy and HSPD 7 to:

         Develop a National Infrastructure Protection Plan;
         Complete and maintain a critical cyber asset 
        inventory;
         Implement and expand standard methodologies to perform 
        threat, risk, and vulnerability assessments;
         Develop and maintain an interdependency analysis 
        capability to systematically understand the relationships 
        between cyber and physical assets; and
         Identify and implement priority protective measures to 
        mitigate vulnerabilities.
    The National Cyber Security Division currently houses a number of 
operational, data analysis, and other diagnostic tools to assist in 
assessing our vulnerabilities. The US-CERT is developing a 
comprehensive Watch Operation that will provide a 24x7 single point of 
contact for national cyber incident detection, evaluation, response, 
coordination, and restoration. Some key tools that US-CERT funded and/
or executed include:

         Common Vulnerability and Exposures (CVE), a dictionary 
        of standard names for vulnerabilities that makes it possible to 
        correlate information across vendor products
         Malware Analysis, a laboratory operation performing 
        detailed analysis and characterization of malicious code to 
        adequately notify the Government of specific dangers and 
        threats to the critical infrastructure
         Security Analysis Program (SAP), a set of analysis 
        tools and capabilities offered through US-CERT to (1) help 
        agencies better monitor network security activity; (2) assist 
        agencies in identifying configuration problems, unauthorized/
        unnecessary network traffic, network backdoors, and routing 
        anomalies; and (3) gain better global situational awareness of 
        network health and malicious activity. The use of these tools 
        by the federal civilian agencies represents one way that we are 
        transferring technology used by the military to increase our 
        overall capabilities.
    As part of our efforts to improve our situational awareness and 
analysis capabilities, the National Cyber Security Division is 
coordinating with the National Communications System (NCS) on the 
Global Early Warning Information System (GEWIS). GEWIS is an effort 
underway within IAIP to find a wide variety of sources, including open 
source and approved private information, which can be analyzed to 
provide better situational awareness of the Internet and its underlying 
infrastructures. GEWIS will allow DHS to assess the health of the 
Internet in a timelier manner and, as a result, coordinate with the 
appropriate stakeholders in responding to Internet events. GEWIS is 
currently being used by IP in conjunction with other resources to 
provide the current situational awareness capability. GEWIS is 
continuing to evolve, and over time will provide enhanced 
functionality.

Meeting the Mandate: Awareness, Outreach, and Cooperation
    So far I have discussed the accomplishments we have made in 
readiness and response, assessment, analysis, and warning efforts at 
the National Cyber Security Division. Another major component of our 
work lies in the outreach and awareness programs that support every 
aspect of our efforts to improve and sustain cyber security. The 
Strategy clearly identifies the users and stakeholders in cyber 
security in Priority III as home users and small business, large 
enterprises, institutes of higher education, the private sectors that 
own and operate the vast majority of the Nation's cyberspace, and state 
and local governments. In Priority V, the Strategy also emphasizes that 
international cooperation is crucial to protecting ourselves in a world 
where attacks cross borders at light speed. The following components 
make up the National Cyber Security Division's outreach and awareness 
programs and serve as the basis for our recently initiated Partnership 
Program.
    One of our most important constituencies is the private sector. It 
is estimated that eighty-five percent of Americas critical 
infrastructure is owned and operated by private companies, and 
technology developed by industry continues to fuel the growth and 
evolution of the Internet. In December 2003, the National Cyber 
Security Division co-hosted the first National Cyber Security Summit in 
Santa Clara, California with the Information Technology Association of 
America, TechNet, the Business Software Alliance, and the U.S. Chamber 
of Commerce. This event was designed to energize the public and private 
sectors to implement the National Strategy to Secure Cyberspace. The 
Summit allowed the Department of Homeland Security to work side-by-side 
with leaders from industry to address the key cyber security issues 
facing the Nation. Five interest areas were established to focus 
specifically in the areas of:

         Increasing awareness
         Cyber security early warning
         Best practices for information security corporate 
        governance
         Technical standards and common criteria
         Security across the software development lifecycle
    Perhaps most importantly, the Summit served as a call to action. It 
represented a logical transition point from developing a national 
strategy to energizing the public-private partnership to implement 
concrete, measurable actions to improve the security of America's cyber 
systems. The efforts of these working groups as well as those of other 
industry leaders will be vital as we move forward in implementing the 
National Strategy.
    In addition to the National Cyber Security Summit, the National 
Cyber Security Division is working with a host of groups to better 
understand and address their cyber security issues and concerns. These 
groups include, among others, the President's National Infrastructure 
Advisory Council, the President's National Security Telecommunications 
Advisory Committee, and the private sector Information Sharing and 
Analysis Centers (ISAC). As a result of the working relationships that 
have been developed among state and local cyber security 
representatives, we are also facilitating a multi-state ISAC that will 
even further enhance information sharing at the state and local levels.
    The National Cyber Security Division is also working closely with 
the research and academic communities to better educate and train 
future cyber analysts. We are participating in the National Science 
Foundation's Scholarship for Service, or ``Cyber Corps'' program as 
well as the National Security Agency's fifty Information Assurance 
Centers for Academic Excellence in twenty-six states. We are looking at 
a number of additional ways to raise cyber security awareness in our 
educational and professional programs, including exploring the K-12 
curriculum with the Department of Education and exploring the 
possibility for the private sector to create independent information 
technology certification programs for IT security professionals.
    A crucial role for the National Cyber Security Division is to 
cooperate and leverage expertise within the Department of Homeland 
Security. Within IP, the National Cyber Security Division coordinates 
with the Protective Security Division (PSD) on our physical and cyber 
interdependencies and activities. In addition, it works closely with 
the National Communications System (NCS), which runs the CWIN program 
and the Global Early Warning Information System (GEWIS) described 
above, and brings NCS's telecommunications system expertise to its 
efforts. Through its integrated approach to addressing the critical 
infrastructure, the Office of Infrastructure Protection also 
coordinates efforts with the 13 critical infrastructure sectors laid 
out in HSPD 7 and their respective Information Sharing and Analysis 
Centers (ISACs). The National Cyber Security Division coordinates 
closely with IP's Infrastructure Coordination Division on the cyber 
elements of their efforts.
    In addition to our coordinated work within IP, the National Cyber 
Security Division works with a number of other DHS organizations. Close 
linkage between the Office of Infrastructure Protection and the Office 
of Information Analysis, led by Assistant Secretary Patrick Hughes, 
promotes the ability to map threat information with cyber 
vulnerabilities. This mapping allows for the effective prioritization 
of potential risks so agencies may implement remediation efforts as 
quickly as possible to limit the impact of computer incidents.
    The technology that drives cyber security needs and product demands 
develops very rapidly in today's environment. Therefore, IAIP and the 
Science and Technology Directorate (S&T) are working together to 
coordinate research and development activities in the important areas 
of critical infrastructure protection and cyber security. A program of 
regular, interactive meetings between the two directorates ensures a 
two-way flow of information and coordination of technical activities. 
S&T's cyber security portfolio scope and activities are driven by the 
threats and issues that warrant national-level concerns, including 
cyber attacks by hostile adversaries against the Nation's critical 
infrastructures, or attacks whose consequences are of sufficient 
magnitude to cause widespread economic or social disruptions. The 
National Cyber Security Division provides important input regarding the 
research and development requirements for S&T's cyber security 
portfolio based on its activities and insight into the needs for 
greater protection of our cyber systems. Initial technical emphases for 
the Cyber Security Portfolio include:

         Improving the security of Internet infrastructure 
        protocols and developing migration paths for these protocols 
        into commercial use;
         Research, development, testing, and evaluation 
        investments aimed at next-generation cyber security 
        technologies aimed at prevention of and protection against 
        attacks; threat identification and tracking; monitoring, 
        detection, and attribution of attacks; and immediate as well as 
        longer-term response to attacks;
         Economic assessment and modeling to support the 
        development of business cases for cyber security in addition to 
        providing a foundation for risk-based cyber security decision 
        making.
    I have addressed many of our national efforts, but I want to 
emphasize our international partnership efforts as well. As the 
Strategy says, ``America's cyberspace is linked to that of the rest of 
the world.'' Cyberspace is truly borderless, and our communications 
networks are inarguably interconnected. We need to defend our systems 
from the outside, but we can only do so with global cooperation and 
coordination. Therefore, the National Cyber Security Division's 
Partnership Program includes outreach and advocacy efforts with our 
global partners, through US-CERT outreach activities and in bilateral 
and multilateral discussions in conjunction with the Department of 
State, the Department of Justice, and the Department of Defense.
    The National Cyber Security Division is only nine months old, but 
these initiatives represent considerable progress toward making cyber 
security a reality and reflect our collective commitment to do more. 
Each accomplishment fosters further activity, which we have outlined in 
our FY 2005 budget request.

National Cyber Security Division Budget Request FY 2005
    The National Cyber Security Division Budget Request of $ 79 million 
for the fiscal year 2005 is based on the on-going and future activities 
necessary to meet our mission. The budget plan is organized around 
National Cyber Security Division's program initiatives in (1) Readiness 
and Response; (2) Strategic Initiatives; (3) Information Sharing and 
Coordination; and (4) Management and Administration. Please let me 
highlight some key initiatives in the plan.

Readiness and Response
    The core building block for an effective National Cyberspace 
Security Readiness and Response System is the U.S. Computer Emergency 
Readiness Team (US-CERT).
    US-CERT will require full funding of $59.3 million for its various 
existing and projected programs, including sustaining and improving the 
GEWIS, CWIN, Watch, and other programs described above. In its 
inaugural year, US-CERT is making significant progress in establishing 
critical operational capabilities and building key relationships within 
government, private industry, and academia. To further these 
advancements, FY05 will be a significant year for the US-CERT to 
continue building and enhancing present capabilities into even more 
responsive and robust ones.

    Strategic Initiatives
    The National Cyber Security Division's Vulnerability Assessment and 
Reduction Program in response to HSPD 7 is a central aspect of its 
Strategic Initiative endeavors, and the requested funding of $7.0 
million will build upon the initial efforts undertaken in FY03 and 
FY04. Additional aspects of the Strategic Initiatives program include 
software assurance efforts, continued awareness and training efforts, 
and a series of tabletop and other exercises including a second 
Livewire exercise, our participation in the National-Level Exercise 
Program, and a planned set of cyber-specific tabletop exercises at the 
State and local level.

Information Sharing and Coordination
    A critical aspect of the National Cyber Security Division's 
activities is outreach to the public and private stakeholders in the 
U.S. and interaction with global partners. $8.7 million will be used to 
support a variety of public awareness campaigns and outreach efforts--
such as continued support of the Stay Safe Online campaign--as called 
for in the Strategy. IAIP will also build and expand international 
partnerships to raise cyber security awareness and cooperation to 
promote a global culture of security. Most importantly, it accomplishes 
the operational partnership executive of information sharing and 
collaboration.

Management and Administration
    The National Cyber Security Division is building a significant team 
of technical and security experts and determining the infrastructure it 
needs in support of its numerous initiatives toward greater national 
cyber security.

Conclusion
    The creation of the National Cyber Security Division reflects the 
recognition that we as a Nation are utilizing sophisticated information 
networks to increase productivity, encourage innovation in products and 
services, enhance daily lives, and communicate globally in an instant. 
Importantly, we are also using these innovations to enhance our 
national and economic security, facilitate our law enforcement and 
public safety efforts, and protect our individual privacy. As 
technology has developed, we have found more exciting ways to use it, 
and we have become increasingly dependent on it. But, we have also 
acknowledged that its proliferation across our critical 
infrastructures--the very same proliferation that makes us more 
advanced as a society and an economy--also makes us vulnerable to those 
who would use it to harm us. IAIP, through the coordinated efforts of 
its component divisions including the National Cyber Security Division, 
is working diligently to address those vulnerabilities and provide 
greater security without stunting the growth and benefits of the 
digital economy for all Americans. We are approaching the next National 
Cyber Security Day this Sunday, and as Americans turn their clocks 
forward, we will also be urging them take the opportunity to review--
and improve--their cyber readiness.
    In its short life, the National Cyber Security Division is 
positively exploiting the work of its predecessors, leveraging the 
existing expertise around it, and building crucial partnerships as part 
of DHS' overall efforts to enhance the protection of our Nation's 
critical infrastructures. We have addressed crucial operational 
components of our program and are improving them, and we are developing 
strategic plans for the future. We know we still have much to do and 
that it will take time, resources, dedication, energy, and hard work to 
succeed. We are committed to that challenge, and we look forward to 
future opportunities to update the Subcommittee on our progress.
    Again, thank you for the opportunity to testify before you today. I 
would be pleased to answer any questions you have at this time.

    Mr. Thornberry. Thank you.
    Now we turn to Mr. Steven Cooper, who is the Chief 
Information Officer for the Department of Homeland Security.

    STATEMENT OF STEVEN COOPER, CHIEF INFORMATION OFFICER, 
                DEPARTMENT OF HOMELAND SECURITY

    Mr. Cooper. Mr. Chairman and members of the subcommittee, 
good morning. I am Steve Cooper, Chief Information Officer for 
the Department of Homeland Security. It is my pleasure to 
appear before the subcommittee, and I wish to thank the 
chairman and members for providing me the opportunity to update 
you on our efforts and progress in integrating and securing 
information systems within the Department and to discuss the 
President's fiscal year 2005 budget for information technology. 
I would request that my written testimony be entered into the 
record.
    Mr. Thornberry. Without objection, your testimony shall be 
in the record.
    Mr. Cooper. Thank you.
    The challenges facing those of us who comprise the 
information technology function of the Department of Homeland 
Security is complex. There are three major areas of focus.
    The first is to ensure that the women and men on the front 
lines of the Department have all of the information technology 
enabled solutions and tools they need to safeguard the United 
States and to deliver our safety and service-related 
operational functions and capabilities. The war on terrorism is 
real, and we must deliver new mission solutions with quality 
and speed in a cost effective manner while maintaining already 
existing mission solutions that we inherited when the 
Department was formed.
    The second area addresses the integration of IT enabled 
solutions. Guided by our enterprise architecture, we are 
identifying opportunities to consolidate and streamline mission 
solutions. In mission areas like threat identification and 
management, identity credentialing, in collaboration we have 
identified multiple solutions in use within the various 
organizational elements of the Department. Our goal is to help 
facilitate and support the operators and subject matter experts 
in our business units, and determine the optimal number and 
nature of mission solutions needed.
    And the third area is to realize efficiency and economies 
of scale that the President and Congress have set forward when 
creating the Department of Homeland Security. Here, we must 
rapidly identify and eliminate existing overlap or redundancy 
within our IT infrastructure within the Department. However, we 
must ensure that we do no harm to mission solutions while we 
restructure and consolidate our infrastructure. In this case, 
we really are changing the tires on the car while it is moving.
    In order to guide the information technology function in 
achieving success in these three overarching focus areas, I 
have, in concert with our Department of Homeland Security CIO 
Council, set eight priority force the IT function. I would like 
to share these with the committee.
    Very quickly, they are: Information sharing, mission 
rationalization, IT portfolio management, information security, 
infrastructure transformation, enterprise architecture, IT 
governance, and IT human capital.
    These priorities are aligned with the strategic priorities 
of the Department set forth by Secretary Ridge and Deputy 
Secretary Loy. For each priority, we are in the process of 
developing a case for change, the business case, a road map 
that outlines the activities, tasks, and deliverables needed to 
achieve the desired objectives and metrics by which we will 
measure success. I would like to highlight two of these eight.
    First is enterprise architecture. In my previous 
testimonies, I have discussed the vision of strategy of DHS and 
how that strategy must be supported by a disciplined capital 
planning investment control process that is guided by business-
driven enterprise architecture. With the release of the first 
version of enterprise architecture in September 2003, we made 
progress toward the goal of achieving, one, Department of 
Homeland Security IT infrastructure. Version 1 of the 
enterprise architecture describes a target information 
management infrastructure that will be dramatically different 
from the one we have today, one that will provide timely, 
accurate, useful, and actionable information to all individuals 
and stakeholders who require it all of the time. We believe 
this effort was truly unique in the Federal Government, and 
that we delivered a comprehensive and immediately useful target 
enterprise architecture in less than 4 months.
    Version 1 of our enterprise architecture contributed to 
some of our investment decisions for fiscal year 2005. Work is 
currently under way on Version 2 of the enterprise 
architecture. This work will develop additional detail around 
the target architecture and enhance the transition strategy 
from Version 1 into a more detailed transition plan that will 
specifically enable the implementation of the target enterprise 
architecture.
    Version 2 is currently on track for completion by the end 
of this fiscal year. Along with continuing the hard work of 
developing greater detail, we will continue reaching deeper to 
find more opportunities to consolidation and begin to develop 
new and improved mission support capabilities enabled by 
information technology.
    Version 2 of the enterprise architecture, together with the 
associated transition plan, will serve as the basis for further 
improving DHS mission performance and facilitating information 
technology, alignment, integration, and consolidation.
    DHS is a new organization formed a little over a year ago 
from 22 legacy agencies, each with their own culture, 
processes, and legacy information technology systems. Many of 
these legacy agencies had developed their own enterprise 
architectures prior to the establishment of the Department. The 
challenge for us is to implement an integrated DHS enterprise 
architecture, bringing together the good work that has been 
done within each of the organizational elements and, during 
that process, ensuring that the entire Department has the IT 
capabilities needed to accomplish our mission capabilities 
every day.
    One challenge to achieving integrated homeland security 
enterprise architecture is having enterprise architecture that 
is sufficiently mature to support detailed alignment and 
analysis for IT investment management decision making. We used 
Version 1 to identify what we called quick hits, and these are 
outlined in release one of our enterprise architecture; we are 
currently developing Version 2 to support more detailed 
investment decision making.
    Another potential challenge is overcoming resistance to 
change and obtaining management and organizational buy-in into 
our enterprise architecture initiative. The Department has 
placed a very high priority on our efforts. Deputy Secretary 
Loy has directed the major organizational components of DHS to 
participate in the development of Version 2. As we speak, there 
are more than five different business focus area teams 
comprised of subject matter experts from across the Department 
working in facilitated team sessions to make sure that the 
business model for enterprise architecture Version 2 accurately 
and comprehensively captures the capabilities and requirements 
needed to accomplish the Department's mission. The extent of 
each organizational element's participation in these business 
area focus teams is reported to the DHS Management Council and 
monitored on a bi-weekly basis.
    The development of an enterprise architecture is an 
enormously complex process requiring considerable resources and 
a systematic methodology. However, DHS has already made good 
progress in meeting the goals of our desired target enterprise 
architecture. We are well on our way to consolidating many of 
the management functions from each of the 22 agencies, 
including financial and human resources. We have reduced to 10, 
19 financial management service providers. We have moved from 
13 separate contracting offices to eight. We have moved from 22 
human resource offices to seven. We have moved from eight 
different payroll systems to three, and department experts 
expect to reduce this to one by the end of the year. And we 
have moved from 22 property management systems to three.
    These are a few up-to-date examples of the progress we are 
making. It is, however, clear that we still have a long way to 
go.
    I would like to highlight our fiscal year 2005 budget 
request very quickly.
    Information contributes to every aspect of homeland 
security and is a vital foundation of the homeland security 
effort. My office has responsibility for providing IT 
leadership that will foster best management practices in 
managing IT, enhance efficiencies through shared services and 
coordination of acquisition strategies, ensuring systems are 
properly accredited and certified as secure, and being an 
advocate for business transformation, all necessary toward 
ensuring that our homeland is more secure. The leadership and 
funding provided through the Department's IT investments are 
crucial for maintaining an enterprise architecture that is 
fully integrated with other management processes, and for 
allowing the Department to participate in many of our e-Gov 
initiatives across the Federal enterprise.
    The President's budget request for fiscal year 2005 
includes a request for 226 million for departmentwide 
information technology investments. Included in the request is 
$95 million for information technology services, a portion of 
which will provide funding for the departmentwide geographic 
information system capability to improve the Department's 
enterprise portal. This funding provides for continuation of 
our enterprise architecture and planning efforts to address our 
evolving financial management system, eMERGE2, and funding to 
enable the development, the beginning of the development of our 
human resources information technology solutions.
    Additionally, the request includes $31 million for 
information security-related activities.
    Finally, the fiscal year 2005 budget request includes $100 
million for wireless communications.
    I would like to highlight some key things related to one of 
our eight priorities in closing, and that is information 
security.
    Since its creation, the Department of Homeland Security has 
moved out aggressively to design and implement an information 
security program that will not only ensure compliance with all 
appropriate standards and regulations, but to also ensure that 
the entire Homeland Security community has a secure and trusted 
computing environment from which to operate. The heart of our 
reporting structure is built around the congressional 
requirements expressed in FISMA, the Federal Information 
Security Management Act. In order to effect a comprehensive 
information security program, and in accordance with the 
provisions of FISMA, I have designated a Chief Information 
Security Officer who manages and oversees all the internal 
Homeland Security Department's information systems security 
activities. The FISMA report details compliance with Federal 
laws and policies and DHS information security policies and 
standards. DHS is in the process of implementing enterprise 
management tools to ensure the accuracy and completeness of 
FISMA reporting across the Department.
    FISMA requires each agency to perform for each program and 
system periodic testing and evaluation of the effectiveness of 
information security policies, procedures, and practices. We do 
follow and will apply the Self-Assessment Guide for Information 
Technology Systems from the National Institute of Standards and 
Technology and as mandated by law. This self-assessment guide 
utilizes an extensive questionnaire which we have already begun 
using in delivering our first Department of Homeland Security 
report.
    I have selected a commercial off-the-shelf product called 
``Trusted Agent FISMA''. This is an automated enterprise based 
management tool that maintains FISMA reporting data from all of 
our components and their plans and activities that captures and 
tracks security weaknesses and associated corrective 
milestones. In addition, it collects, processes, and stores all 
of the self-assessment information in accordance with the NIST 
guidance. We have deployed this system throughout DHS and have 
generated our first quarterly report. We expect this to improve 
the timeliness and accuracy of our reporting as this 
information is available real-time to the Secretary and other 
cognizant officials.
    I thank you again for the opportunity to testify before you 
today, and am pleased to answer questions that the committee 
may have.

 Prepared Statement of Steven Cooper, Chief Information Officer, U.S. 
                    Department of Homeland Security

    Mr. Chairman and Members of the Subcommittee:
    Good morning, I am Steve Cooper, Chief Information Officer for the 
Department of Homeland Security (DHS). It is my pleasure to appear 
before the Subcommittee, and I wish to thank the Chairman and Members 
for the providing me the opportunity to update you on our efforts and 
progress in integrating and securing information systems within the 
Department and to discuss the President's FY 2005 budget request for 
Information Technology. I will also update the Subcommittee on our 
Enterprise Architecture program efforts.

    Enterprise Architecture
    In his proposal for creating the Department over a year ago the 
President highlighted the use of enterprise architecture techniques to 
improve both the sharing and use of information. The President stated 
that the ``development of a single enterprise architecture for the 
department would result in elimination of the sub-optimized, 
duplicative, and poorly coordinated systems  that are 
prevalent in government today. There would be rational prioritization 
of projects necessary to fund homeland security missions based on an 
overall assessment of requirements rather than a tendency to fund all 
good ideas beneficial to a separate unit's individual needs even if 
similar systems are already in place elsewhere.''
    In my previous testimonies, I've discussed the vision and strategy 
of DHS and how that strategy must fulfill the President's vision. 
Additionally, it must be supported by a disciplined capital planning 
and investment control process that is guided by business-driven 
enterprise architecture. With release of the first version of the 
enterprise architecture in September 2003, we made progress toward the 
goal of one DHS infrastructure. Version 1 of the enterprise 
architecture describes a target information management infrastructure 
that will be dramatically different from the one we have today, one 
that will provide timely, accurate, useful and actionable information 
to all individuals who require it all the time. We believe this effort 
was truly unique in the federal government in that we delivered a 
comprehensive and immediately useful target enterprise architecture in 
less than four months.
    However, Version 1 of the Homeland Security Enterprise Architecture 
(HLS EA) defines the enterprise architecture at a conceptual level and 
outlines a general transition strategy that must be broken down further 
for the architecture to be implemented. Version 1, which was published 
at the end of September 2003:
         Identified common activities
         Proposed conceptual projects
         Proposed reusable business components
         Proposed Technology Patterns
         Began communications effort
                 Increased understanding of EA planning and 
                integration
                 Increased the knowledge of the target 
                architecture
    Work is currently under way on Version 2 of the enterprise 
architecture. This work will develop additional detail around the 
target architecture and enhance the transition strategy from Version 1 
into a more detailed transition plan that will more specifically enable 
the implementation of the target enterprise architecture. This effort 
currently consists of 5 business teams composed of about 45 business 
people charged with the responsibility of decomposing the common 
business activities. During this effort for Version 2, we will:
         Verify and augment transitional projects
         Verify and augment reusable business components
         Verify and augment technology patterns
         Prepare an HLS-EA Framework that identifies the 
        products that will be produced by the department and that are 
        expected to be produced by the Transitional Project Managers
         Prepare governance procedures and bodies to ensure 
        alignment with the HLS-EA
         Ensure the integration of the transitional projects
    Concurrently with the Version 2 effort, the enterprise architecture 
team is working with several large project offices, e.g., ACE and US-
VISIT, to determine alignment to the transition strategy so that these 
project offices can immediately begin building to the target 
architecture.
    Version 2 is currently on track for completion early in the 4th 
quarter, FY04. Along with continuing the hard work of developing 
greater detail, we will continue reaching deeper to find more 
opportunities for consolidation and opportunities to develop new and 
improved mission support capabilities enabled by information 
technology. Version 2 of the enterprise architecture, together with the 
associated transition plan, will serve as the basis for further 
improving DHS mission performance and facilitating IT alignment, 
integration, and consolidation.

Technical Reference Model Status
    In Version 1 of the EA, we developed the DHS Technical Reference 
Model (TRM) by extending the TRM from the Office of Management and 
Budget Federal (OMB) Enterprise Architecture (FEA). The value of the 
TRM is to provide a common set of terminology for describing and 
organizing technology. We are currently working on further developing 
the DHS TRM by improving the structure of technology categories so that 
they promote consistency and are more meaningful across the Department.
    In addition, we have made progress on filling in the Standards 
Profile (SP). The Standards Profile provides guidance to the components 
and major programs on what technologies to use to implement solutions 
to ensure consistency and interoperability with other solutions within 
the Department and the homeland security community. Our approach is to 
collect all of the technology standards from the component CIO offices 
and to organize them into the revised TRM for analysis. In many cases, 
the standards in place are consistent across the components and these 
consensus standards will be adopted as the Departmental standard. 
Standards that are adopted fall, generally, into four categories: Move-
to, Divest, Hold, or Contain. As part of the process, we have assigned 
``stewardship'' of specific standards to individuals within my CIO shop 
or to other appropriate individuals in the Department. As the standards 
are developed, they reviewed by the Applied Technology Working Group, 
in accordance with the EA Governance Process as a part of the IT 
strategic management framework, and are adopted by the Enterprise 
Architecture Board (EAB).
    One particular area where the TRM from the EA Version 1 has been 
useful is in guiding investment in IT is in the area of ``technology 
patterns.'' Patterns are repeatable solutions to recurring technical 
challenges that are based on best practices, typically from industry. 
In Version 1 of the EA, we identified over a dozen patterns that have 
significant applicability within the Department. As a result, one of 
the major business/IT initiatives within the Department, the 
eMERGE2 program of the Resource Management Transformation 
Office (RMTO) has adopted the pattern approach and is in the process of 
acquiring technologies that implement several of the patterns 
identified. These patterns and technologies will form a technology 
foundation for other programs to leverage.

Implementation of ``Quick Hits''
    Definitions for the Quick Hits, foundational elements and 
activities that had to be in place to support achievement of an 
integrated enterprise architecture, have been completed and stewards 
have been recommended. The Quick Hits have begun to be integrated into 
existing projects. For example, RMTO will soon begin implementing some 
of the technology patterns included in the Technology Patterns Quick 
Hit. The Consolidated Enforcement Environment (CEE) project has formed 
a case management working group and is incorporating the Standardized 
Investigation Case Management Quick Hit into their plans and will be 
coordinating with the Department of Justice on a long term solution. 
The One Face at the Border initiative met the requirements for the 
Integration POE Workforce Quick Hit. The Office of Infrastructure 
Management, within the DHS CIOs office, is working toward Network 
Integration as part of their One DHS Infrastructure project.

Challenges Achieving an Integrated Enterprise Architecture, Timelines 
and Implementation
    DHS is a new organization, formed a little over a year ago from 22 
legacy agencies, each with their own culture, processes, and legacy IT 
systems. Many of these legacy agencies had begun development of their 
own Enterprise Architectures prior to the establishment of DHS. The 
challenge for DHS is to implement an integrated DHS Enterprise 
Architecture while ensuring that, during the process, the entire 
Department has the IT capabilities needed to accomplish the mission.
    One challenge to achieving an integrated HLS EA is having an EA 
that is sufficiently mature to support detailed alignment and analysis 
for IT investment management decision-making. As I've noted previously, 
DHS developed Version 1 of the DHS EA in 4 months ending in September 
2003. We also used Version 1 to identify Quick Hits and we are 
currently developing the HLS EA version 2, to support IT investment 
management.
    Another potential challenge is overcoming resistance to change and 
obtaining management and organizational buy-in into the EA. The 
Department has placed a very high priority on the HLS EA. Deputy 
Secretary Loy has directed the major organizational components of DHS 
to participate in development of Version 2 of the DHS EA. As we speak, 
there are more than 5 different Business Focus Area Teams, composed of 
subject matter experts from across the Department, working in 
facilitated team sessions to make sure that the business model for EA 
Version 2 accurately and comprehensively captures the capabilities 
needed to accomplish the Department's mission. The extent of each 
organizational element's participation in these Business Area Focus 
Teams is reported to the DHS Management Council and monitored on a bi-
weekly basis.
    The development of an EA is an enormously complex process. The goal 
was to produce a foundation for enabling DHS to make decisions about 
DHS investments immediately and to begin to direct its resources away 
from stove-piped, duplicative systems and move to interoperable, 
enterprise wide systems providing improved mission capability. Although 
Version 1 of the EA is relatively conceptual in nature, it does provide 
a foundation for implementation. As noted, DHS has been using the 
principles and transition strategy as a basis for beginning to redirect 
resources from current investments.
    As we speak, DHS is working on Version 2 of the EA. This version 
will include a transition plan that will be completed in June 2004. 
Version 2 will continue to build on the hard work of the first version 
by developing greater detail, reaching deeper to find more 
opportunities for consolidation, and establishing a consolidated 
framework for meeting mission need.
    One of the difficulties in expediting implementation of such a 
major change, such as EA, is the degree to which that change can be 
managed and accepted by an organization. However, DHS has already made 
significant progress in meeting the goals of the EA. We are well on our 
way to consolidating many of the management functions from each of the 
22 agencies, including financial and human resources systems.
         19 financial management service providers were reduced 
        to 10
         separate contracting offices were reduced to 8
         22 human resource offices were reduced to 7
         8 different payroll systems were reduced to 3 and DHS 
        expects to reduce this to one by the end of the year.
         22 property management systems have been consolidated 
        to 3.
    These are just a few of the examples of progress. And it is clear 
we still have a long way to go.
    One of the first things we need to do is implement a full 
governance structure with enforcement authority to ensure that 
investments are aligned with the strategic goals. We have already made 
progress in this area. This week the DHS Enterprise Architecture Board 
(EAB)is open for business. The EAB is charged with the responsibility 
of reviewing all investments for their alignment to our EA. What this 
means is that all investments going through the FY06 budget process 
will have to demonstrate that it is achieving the goals of our 
transition strategy and that it is aligned to the technology standards 
identified in the EA. This will mean that the EAB will be responsible 
for reviewing nearly 300 investments this year. That is a daunting task 
for an organization.
    Another area we could focus on to expedite the implementation is to 
increase the number of working groups focusing on specific areas within 
DHS that support the DHS mission. Currently, DHS has the Resource 
Management Transformation Office (RMTO), which is consolidating an 
enterprise solution for DHS administrative functions, such as 
accounting, acquisition, budgeting, grants, and procurement.

Department-wide Information Technology Investments Budget Request FY 
2005
    Information contributes to every aspect of homeland security and is 
a vital foundation for the homeland security effort. My office has 
responsibility for providing IT leadership that will foster best 
management practices in managing IT, enhance efficiencies through 
shared-services and coordination of acquisition strategies, ensuring 
systems are properly certified and accredited as secure, and being an 
advocate for business transformation, all necessary toward ensuring the 
homeland is made more secure. The leadership and funding provided 
through the Department's IT investments are crucial for maintaining an 
enterprise architecture that is fully integrated with other management 
processes, and for allowing DHS to participate in many E-Gov 
Initiatives.
    The President's budget request for FY 2005 includes a request for 
$226 million for Department-wide Information Technology Investments. 
Key strategic issues in FY 2005 will be to build and expand upon the 
foundational work completed in FY 2003 and FY 2004; to facilitate 
consolidation of management function capabilities; to lead the 
implementation of the Department's Enterprise Architecture; and, to 
continue to coordinate information integration efforts within DHS.
    Included in the request is $95 million for Information Technology 
Services, a portion of which will provide funding for the Department-
wide Geographic Information System (E-GIS) capability; to improve the 
Department's Enterprise Portal; this funding provides for continuation 
of the DHS Enterprise Architecture and planning; evolving the Financial 
Management System, eMERGE2; and, development of the Human 
Resources information technology solution.
    Additionally the request includes $31 million for Security 
activities, which will provide funding for continuation of the Homeland 
Security Information Technology and Evaluation program; and for 
continued support of terrorist information integration and sharing.
    Finally, the FY 2005 request includes $100 million for Wireless 
Communications, which includes funding for enhancement of the 
Integrated Wireless Network (IWN) and Tech Ops Support. The Expanded 
IWN initiative expands to other DHS agencies the pre-existing Justice-
Treasury IWN partnership established prior to the inception of the 
Department of Homeland Security (DHS), and which includes mobile radio 
(MR) and the application of emerging technologies as it pertains to 
domestic law enforcement and counter/anti-terrorist operations 
(including missions in the U.S. Territories), tactical communications, 
legacy systems support, and airborne and non-Coast Guard marine 
communications. It also continues the funding for the SAFECOM project.

Information Security
    Since it's creation, the Department of Homeland Security has moved 
out aggressively to design and implement an Information Security 
Program that will not only ensure compliance with all appropriate 
statutes and regulations, but to also ensure that the entire Homeland 
Security community has a secure and trusted computing environment from 
which to operate. The heart of our reporting structure is built around 
the congressional requirements expressed in the Federal Information 
Security Management Act known as FISMA. In order to effect a 
comprehensive Information Security Program and in accordance with the 
provisions of FISMA, I have designated a Chief Information Security 
Officer (CISO) who manages and oversees all of the internal Homeland 
Security Department's Information Systems Security activities.
    Due to the comprehensive nature of the FISMA reporting 
requirements, and to avoid duplication of effort, DHS uses the FISMA 
reports to satisfy the annual requirement to verify to the Secretary 
the status of the Information Security Program. Additional mechanisms, 
such as program briefings, status information and incident reports 
ensure continuous visibility to the Secretary throughout the year.
    The FISMA report details compliance with Federal laws and policies 
and DHS information security policies and standards. DHS is in the 
process of implementing enterprise management tools to ensure the 
accuracy and completeness of FISMA reporting across the Department.
    FISMA requires each agency to perform for each program and system 
``periodic testing and evaluation of the effectiveness of information 
security policies, procedures, and practices'' annually. NIST SP 800-
26, Self-Assessment Guide for Information Technology Systems, is the 
required self-assessment guide required by OMB policy. This, self-
assessment guide utilizes an extensive questionnaire (containing 
specific control objectives and suggested techniques which the security 
of programs and systems can be measured. OMB's FISMA implementing 
guidance also requires agencies to maintain a Plan of Action and 
Milestones process that captures and tracks security weaknesses, and 
associated corrective milestones.
    I have selected a Commercial off the Shelf Product called ``Trusted 
Agent FISMA''. This is an automated enterprise based management tool 
that maintains FISMA reporting data from all our components and their 
POA&M's that will capture and track security weaknesses and associated 
corrective milestones; in addition it will collect, process and store 
self-assessment information in accordance with NIST SP 800-26. We have 
deployed this system throughout DHS and have generated our first 
quarterly report. We expect this to improve the timeliness and accuracy 
of our reporting as this information is available real-time to the 
Secretary and other cognizant officials.
    With this tool we will be able to focus our compliance and as well 
as leverage the effort of the DHS Inspector General to corroborate the 
accuracy of the FISMA information and improve the compliance stature of 
the department.
    I thank you again for the opportunity to testify before you today 
and I am pleased to answer any questions you may have.

    Mr. Thornberry. Thank you.
    I will yield my time to the chairman of the full committee, 
Chairman Cox.
    Mr. Cox. Thank you, Mr. Chairman. I take it that you mean 
you are simply postponing your own opportunity?
    Mr. Thornberry. There may be another chance.
    Mr. Cox. I hope you do not yield your time entirely.
    I want to join in welcoming our witnesses, and thank you 
very much for your leadership in the Department, for being up 
here today, and for keeping us apprised of what you are doing. 
As you know, we are keenly interested, in fact most members of 
the subcommittee have been keenly interested in cyber as a 
priority since we were developing the Homeland Security Act in 
Congress. And we want to make sure that it gets all the 
attention that it deserves, and I know that you are doing that.
    Let me begin by asking just what I hope is a trivial 
question. I am just trying to do the math in the testimony: 
That the $79 million dollar request for cyber; of that, 75 
percent is going to the program, 59.3. Then there was another 
8.7 that goes to outreach and public awareness, and 7 million 
that goes to vulnerability assessments and reduction. That 
leaves, by my math, 4 million unaccounted for, and I just 
wondered where it went.
    Mr. Liscouski. Sir, if you would permit me to get back in 
writing on that so I can do the math myself, I am sure we can 
provide to you the balance of where that $4 million is.
    Mr. Cox. It may be undistributed overhead. I don't know.
    Mr. Liscouski. I could look through this, but I would 
prefer to get back to you in writing, if I may, sir.
    Mr. Cox. Okay. Given the important role, as you outlined, 
Mr. Liscouski, in your testimony for the Computer Emergency 
Readiness Team, the CERT, the component of your efforts, how 
should we assess the other watch centers within DHS? There are 
several of them. If we are interested in consistency and 
overall cyber spec reporting, shouldn't we be concerned? Or 
should we welcome the fact that we have, for example, the IP 
National Communications System operating a 24/7 
telecommunications watch center; we have also within IP 
Cybersecurity Division operating a 24 by 7 cyber watch center; 
we also have within IP the Infrastructure Coordination Division 
operating a 24/7 watch for physical and cyber reporting. We 
have within IA a 24/7 Homeland Security Op Center with a 
dedicated cyber watch desk. We have Mr. Cooper, in your shop, a 
Cybersecurity Incident Response Center. And, we have at Secret 
Service a 24/7 watch operation for electronic crimes.
    Mr. Liscouski. Sir, and thank you for the question. Let me 
get some clarity to the operations overall in terms of how the 
integration of the watch centers is being performed.
    The legacy organizations that came in to us from Secret 
Service, from NCS that--and the Fed CIRC, that represent some 
of the watch centers you just articulated. With respect to the 
Fed CIRC, the NCC, the ones we have created with the HSOC, I 
will just quickly try to outline what those capabilities and 
mission requirements are and tell you how they are integrating.
    The HSOC, the Homeland Security Operations Center is a 24 
by 7 watch center that on behalf of DHS or at large it provides 
situational awareness across all of our enterprise, across the 
entire United States, integrates information to ensure that we 
understand from all hazards what is going on at any given point 
in time. Information piped into that HSOC is analyzed, 
understood in the context of is it threat information, is it 
incident data? And then we share with the respective elements 
of DHS to ensure that the appropriate actions are followed 
upon.
    In the context of other situational awareness types of 
watch centers, the ICD, the Infrastructure Coordination 
Division, is ultimately responsible for the coordination of 
activities as it relates to infrastructure protection and 
monitoring what is going on across all of our infrastructure 
components irrespective of incidents.
    The distinction there is ICD is going to be creating--I 
will add one more acronym to you-- the NICC, the National 
Infrastructure Coordination Center, which is going to be the 
amalgamation of all these watch centers. This is just an 
evolutionary process to the comment of not breaking it as we 
are building it. We do not want to denigrate the capability we 
have with existing watch centers as we are building the one 
amalgam capability that is going to respond to our situational 
requirements, very large infrastructure protection, which will 
mean the incorporation of the NCSD's watch center, the NCC, the 
National Communication Coordination Center, and other elements 
for infrastructure coordination, all under the ICD.
    The interconnectedness between the Homeland Security 
Operation Center and the NICC is paramount for us. We are 
looking to augment the capabilities of the HSOC. We have NCSD 
and as well as other infrastructure protection components on 
the HSOC which are responsible for doing incident management 
real-time.
    The reach-back capability to determine what the impact of 
an incident may be is going to be through the Infrastructure 
Coordination Division and, through that center, the NICC. And 
it is really reflective of the complex nature of all of our 
infrastructure components. Instead of creating one gigantic 
coordination center, we are really looking to leverage the 
capabilities that we have established through DHS to ensure 
that we have got the right expertise coming to the table at the 
right times to provide the answers as necessary.
    So it is not a redundant capability, sir, it is clearly an 
augmentation of the capability, depending on what function they 
are serving at a given point in time.
    Mr. Cox. But I heard in what you said that you also are 
anticipating further consolidation.
    Mr. Liscouski. That is correct, sir. We are consolidating 
the watch centers, the national, the NCS, the National 
Communications System. The NCD's watch center will be 
incorporated into the NICC. That is correct.
    Mr. Cox. How is my time, Mr. Chairman?
    Mr. Thornberry. The gentleman's time has expired.
    Mr. Cox. All right. I thank the CHAIRMAN.
    Mr. Thornberry. Although the Chair is trying to be lenient.
    The gentlelady from California.
    Ms. Lofgren. Thank you, Mr. Chairman.
    I have had a chance to--although I didn't have a chance to 
read your testimony, Mr. Cooper, I did have a chance to review 
your comments to the House Government Reform Committee in 
October of last year. And in that testimony, you had given your 
first draft of the Department Enterprise Architecture Plan, and 
you provided what I think you called a Quick Hit Project that 
you thought could be accomplished within 6 months. And some of 
those quick hits were integrating watch lists, network 
integration, developing external information sharing strategy, 
completing a feasibility study on integrating Immigration and 
Customs case management systems, and a number of others.
    Now, we don't have teams of people auditing your 
department, but I don't believe we yet have a unified watch 
list data base. And the Inspector General has told us that the 
lack of an agreed-upon IT infrastructure prevents the Office of 
Information Analysis Risk Assessment Division from 
communicating with State, local, and private sector partners, 
and that inhibits the exchange of information. And the IG also 
says that there is concern that the IAIP lacks connectivity to 
access sensitive data bases maintained in other Federal 
agencies, which hampered their efforts to conduct business. 
And, you know, you can't always believe what you read in the 
press, but Information Week has reported that your office has 
had problems handing over and receiving secured e-mail.
    Can you provide us with an update and where we are on all 
the quick hits that you were going to get done by now?
    Mr. Cooper. I can give you an initial update, and I would 
like to also provide information in writing on all of the quick 
hits represented in the first release of enterprise 
architecture. But let me address a couple that I think are 
very, very relevant to the points that you made.
    With regard to an integrated watch list and with regard to 
information sharing, the Secretary and the Deputy Secretary 
have already initiated an information sharing program that is 
now under way within the Department. The business owner is 
General Frank Liboutti, who is our Under Secretary for 
Information Analysis and Infrastructure Protection. Under his 
guidance, he has named a program director, and a team has been 
established that has already begun work in addressing how we 
will move forward to better improve our connectivity and our 
ability to put in place a two-way exchange of information with 
all of our stakeholders, both internal and external.
    Ms. Lofgren. Can I interrupt to try to understand?
    Mr. Cooper. Yes, ma'am.
    Ms. Lofgren. So this information sharing effort is only 
within the Department? Does it include the FBI and those 
agencies that are outside the Department?
    Mr. Cooper. Yes, ma'am. It will address the full national 
scope.
    Ms. Lofgren. It will but it does not currently?
    Mr. Cooper. It does not currently. We are in the early 
stages of formation, and the team exists and is now working 
through the various requirements for the different communities 
with which we must interact.
    Ms. Lofgren. When do you think that will be done?
    Mr. Cooper. Our expectation is to hit the deadline set for 
us by Under Secretary Liboutti, and that means that we will 
have a significant amount of this in place operational and done 
by the end of this calendar year.
    I also want to highlight that in the quick hits we have in 
place and operational what we are now calling our Homeland 
Security Information Network. We built off a program called 
JRIES, Joint Regional Information Exchange System, that is 
operational. It is in place. And we are rapidly expanding 
membership in that system and as part of our Homeland Security 
Information Network. In the next several months, we will expand 
from the current about 50 participating State, local, and 
Federal partners who are already connected to probably about 
five times that number in the next several months. And, again, 
I will be more than happy to provide detailed program plans 
related to information sharing and building upon what is 
already operational.
    Ms. Lofgren. I see that I am just about to run out of time. 
But I would like to get, I am sure every member of the 
committee would want, a report on each one of the quick hits 
and the current status. Before--I guess my time has completely 
expired, so I will yield back to the chairman. I expect we will 
have a second round.
    Mr. Thornberry. I thank the gentlelady.
    The gentleman from Nevada.
    Mr. Gibbons. Thank you very much, Mr. Chairman.
    Gentlemen, welcome to the committee. We are happy to have 
you. Your information has been extremely helpful to us.
    Cybersecurity is not new. It is something that not only 
your agency but other Federal agencies have been working on for 
decades in some cases. If you could help us better understand 
how agencies like the NSA, National Security Agency, NGA, 
National Geospatial Intelligence Agency, the CIA, the DOD, all 
of those other agencies' efforts have been or have not been, I 
don't know what the answer will be, integrated into your effort 
in cybersecurity. How do you leverage their experience, their 
efforts, their work product over these many years to help you?
    Mr. Liscouski. Thank you, sir. And there is a couple of 
different perspectives on the roles and responsibilities within 
those agencies and how they would integrate and how we partner 
up.
    DHS has got a protective mission and the protective mission 
we have in terms of looking at how we should best protect our 
critical infrastructure, the partnerships that we have got 
there clearly within the Intelligence Community and the NSA and 
the DOD specifically are we actively leveraging those. We have 
got a very strong partnership with NSA across a number of 
fronts. Up until just recently, until a recent transfer, the 
Deputy Director of the NCSD was in fact an NSA detailee, and it 
provided tremendous opportunity for us to leverage the 
experience that they have over the years of being able to gain 
an understanding of how to best protect those systems, and we 
are actively looking or looking forward to his replacement to 
come on board very shortly. Similarly, within DOD, who also has 
a protective mission for their dot-mil domain, we partner up 
with the Joint Task Force For Computer Network Operations. We 
have a very robust exchange of information between our US-CERT 
and their operations center. We have got very good personal 
relations as well as operational relationships with that 
agency.
    On the offensive side, clearly within the domain of that 
realm, I speak at a very high level here, we are able to 
partner up with CIA and other Intel Community efforts to 
understand how they best look at their offensive mission to 
understand how we best need to look at our defensive mission 
based upon what the capabilities are out there.
    On the intel side, in terms of the threat assessments, as 
you may know, through our Information Analysis Office we use 
them as the portal back into the Intelligence Community. We 
regularly drive requirements into the Intel Community to better 
understand how we can best protect our networks and our 
Nation's infrastructure from cyber threats.
    So it is really a multifaceted approach. I would say it is 
highly integrative from the standpoint of either through 
people, exchange of people, or through active exchange of 
information.
    Mr. Gibbons. Very quickly, who establishes the standards by 
which you integrate and take advantage of all of these multiple 
operations? Is there a common standard which is being 
established, and are you part of that? Do you control it, or is 
some other agency in control of the standard and definitions 
about how this cybersecurity program that you just described 
takes place?
    Mr. Liscouski. Well, we have got the benefit of the 
Homeland Security Presidential Directive 7, which was signed by 
President Bush on December 17th of 2003, which provides us the 
framework for integration of all of the--real large for 
infrastructure protection, not just for cyber, to ensure that 
we have appropriate roles and responsibilities laid out for 
that protection. We are actively engaged in framing out not 
just the strategy but the implementation of that strategy. It 
is a work in progress as we develop the plan we are 
implementing. But we are able to negotiate with respective 
sister agencies in the Federal Government as well as State and 
local and the private sector to understand how we have to, 
again from the total infrastructure protection picture, flesh 
out the responsibilities. Who is going to do what? What 
programs are necessary to be done? Where the gaps are? And, 
most importantly, from the perspective of outcomes, how do we 
measure the outcomes to ensure that we have effectiveness? That 
falls under the auspices of HSPD-7. I have direct 
responsibility for that. I have got a program office in my 
office to do this, and we are actively engaged in fleshing it 
out.
    Mr. Gibbons. One final quick question. What degree does the 
DHS enterprise architecture plan to marry up with the Federal 
enterprise architectural efforts as well?
    Mr. Liscouski. I will defer to Mr. Cooper for that. But I 
will just, as a segue into that, is we are wholly dependent on 
Mr. Cooper's efforts to provide us the backbone enterprise 
architecture for our operations.
    Mr. Cooper. It is aligned. Even before the Department was 
formed, we actually began working with the Federal enterprise 
architecture framework to both work with Dr. Haycock, who was 
guiding the charge under Norman Ranscript of the Office of 
Management Budget, and we have continued that relationship 
since. So it is very much alive.
    And in those business areas that are critical to Homeland 
Security, we become, if you will, the lead agency. So as the 
work we do to populate the business processes, the 
informational requirements and then supporting technology, that 
flows into the Federal enterprise architecture.
    Mr. Gibbons. Thank you, Mr. Chairman. My time has expired.
    Mr. Thornberry. I thank the gentleman.
    The gentlelady from the Virgin Islands.
    Mrs. Christensen. Thank you, Mr. Chairman, and I would like 
to welcome our two witnesses, also.
    Mr. Cooper, do you feel that your office has the sufficient 
authority to drive IT integration within the Department of 
Homeland Security, even though you don't have direct line 
authority over divisional chief information officers? And, if 
not, is there anything that we can do to strengthen that 
position, the position you hold within the Department of 
Homeland Security?
    Mr. Cooper. What I have done is to have created a 
Department of Homeland Security CIO Council, which is comprised 
of all of the named or titled CIOs who came into the Department 
with their respective agencies that now comprise the full 
Department. Additionally, I have asked the Chief Financial 
Officer and the Chief Procurement Officer to participate with 
us as full members of that council. Together, we have been 
participating in the investment review process of the 
Department. That is under the guidance of the Under Secretary 
for Management and Under Deputy Secretary Loy. I believe that 
in concert we have been appropriately bringing forward the 
proper recommendations, the proper decision-making framework so 
that we can make adjustments, if necessary, in some of the 
alignment that we inherited with regard to legacy applications 
and/or infrastructure investment. We will continue to learn, we 
will continue to grow, we will continue to refine these 
processes as rapidly as we can.
    Mrs. Christensen. And to what extent also does your office 
interact with other Federal agencies outside of DHS?
    Mr. Cooper. I personally participate in the Federal CIO 
Council. So there are regular meetings. I am also a member of 
the Executive Committee of the Federal CIO Council. We draw 
upon the Federal CIO Council for a lot of that interaction. 
Additionally, our Chief Technology Officer and our Deputy Chief 
Information Officer are also members of that committee. So the 
three of us participate very actively.
    Mrs. Christensen. Do you provide standards for the other 
agencies that are outside?
    Mr. Cooper. My office actually does not provide standards 
for other Federal agencies. But let me give you a real example 
of how it works. We, like other Federal Cabinet agencies, 
receive the direction and guidance that are set by Mr. 
Liscouski's area of responsibility, and we then apply, as all 
Federal CIOs would do, we apply that guidance and those 
standards, those accompanying standards within the Department 
of Homeland Security.
    Mrs. Christensen. Assistant Secretary Liscouski, last week 
we had a briefing from two of the private infrastructure 
organizations, the financial and telecommunications sectors. 
Could you tell us how your office interacts with the private 
sector? And early on, in the early days of the Department there 
seemed to be not an easy relationship, or there were problems 
that needed to be resolved. Could you talk about the 
relationship within your office and those private sector 
agencies?
    Mr. Liscouski. Yes, ma'am. We have a very aggressive 
outreach program with the private sector, and you are 
accurately portraying the relationships in the beginning. The 
legacy relationships that we inherited from the PDD-63 effort 
that ultimately authorized the establishment of the ISACs, the 
Information Sharing Analysis Centers, didn't allow for 
sufficient leadership and engagement at the private sector 
level to allow them to mature to a level of capability that 
would ensure that we had robust information sharing going both 
horizontally across information or industries as well as 
vertically back up to the government.
    The first couple of months we were engaged with the private 
sector, we actively looked at that model to see how we could 
best leverage it, and the first part of that was to determine 
the validity or the value of those information sharing analysis 
centers. And I can tell you from my private sector experience, 
I looked hard at the efficacy of that effort.
    To be candid with you, when I looked real hard at it. I saw 
there was a lot of opportunity there that we could leverage 
very well into a success story by enabling and empowering the 
private sector through the ISACs to develop their horizontal 
relationships, how they integrate and how they collaborate 
information. And that was the road that we embarked upon to 
ensure that we could establish that.
    We have got a very good story to tell. I hope you heard 
that last week between the FS ISAC specifically.
    Mrs. Christensen. What exactly is your current relationship 
with the ISAC Council?
    Mr. Liscouski. Well, we have got an excellent relationship 
with the ISAC Council. They have stepped up to the leadership 
plate and they have provided what has been necessary and has 
been previously missing with the private sector, and that is 
the private sector leadership going back down into the private 
sector. They are actively engaged with my office both through 
the Infrastructure Coordination Division, which is responsible 
for managing ISACs and funding ISACs, as well as directly 
through my office I actively engage with them minimally once a 
month on a council level and much more frequently on an 
individual level. So I think we have got a very robust and a 
very successful story to tell as it relates to our private 
sector partnership there.
    Mrs. Christensen. Thank you. I think my time is up.
    Mr. Thornberry. I thank the gentlelady.
    The gentlelady from Washington, the Vice Chair of the 
committee.
    Ms. Dunn. Thank you very much, Mr. Chairman, and welcome, 
gentlemen. It is very interesting as we begin to tie some of 
these responsibilities together to get a clear view from your 
point of view on how things are working.
    Secretary Liscouski, in your written testimony and in your 
testimony before our panel today, you identified a couple of 
major steps in your management methodology that were 
interesting to me. One was the identification of critical 
infrastructure. Another was the assessment of vulnerabilities. 
I am especially interested in knowing how you work together 
with local government bodies and State government bodies and 
the private sector, what kind of input they have into these 
assessments, and whether they have a direct pipeline to you to 
know what you decided on.
    Mr. Liscouski. Yes, ma'am. Thank you, and I appreciate the 
question.
    As I pointed out, our partnership with the private. 
sector--and coming from the private sector, my bias is that we 
have to work closely with the industry to determine what they 
believe their priorities are, and we have to normalize those 
priorities with what we believe are our national level 
priorities.
    We accept ready input from both the private sector, the 
associations and, importantly, the State and local and tribal 
governments to ensure that we have got their perspective on 
what has to be protected and how it can best be protected. We 
develop common vulnerabilities assessments, common best 
practice methodologies, which are vetted through our State and 
local and tribal contacts as well as the private sector to 
ensure that we have got, in terms of our achieving 
infrastructure protection at large, consistent, effective, 
sustainable, and measurable capabilities and results across all 
of our critical infrastructures.
    Now, as a general statement, I will tell you that we are 
succeeding in that very well. The methodology that we have 
outlined is that, at a national level, is scalable right down 
to an individual company level. It is the type of methodology 
which is being adapted to ensure that we help the industry at 
the single entity level as well as those that are highly 
interconnected to ensure that we can identify those 
vulnerabilities, the assets that need to be protected, the 
vulnerabilities, and the appropriate levels of programs.
    The reason integration is so important to us, not just 
within the Infrastructure Protection Office as it relates cyber 
and physical, but clearly as it relates to State and local 
involvement, is because these efforts cannot be done 
unilaterally. The private sector cannot afford to protect 
itself nor does it have the wherewithal to protect itself that 
the State and local governments do in their law enforcement and 
protective authorities. So all the programs that we have 
developed and designed have been in collaboration and 
coordination with all those stakeholders to ensure that we have 
both a rational approach and an effective approach, and one 
which is dynamic enough to be molded against the current threat 
at any given point in time.
    As you know, it is a very dynamic threat environment, so it 
is a work in progress. Clearly, the engagement we have with the 
private sector, we are constantly being fed with new 
technologies and new ideas on how to best implement programs 
that can be effective. At the end of the day, it is the private 
sector who is responsible for ensuring that they are doing what 
they need to be doing to protect that critical infrastructure. 
So we have a significant effort there.
    Ms. Dunn. The State and local governments are satisfied 
with the relationship they have with you?
    Mr. Liscouski. At a general level, I would say they are, 
but as everything, I think there are different opinions.
    We have clearly a lot of room for improvement across the 
board. We are not satisfied with where we are today. We are in 
the very early stages of building this program. It is a long-
term approach, but I think we are satisfied with the approach 
we are taking.
    Over the recent holiday threat period, we were actively 
engaged, and I am sorry to see Mr. Gibbons go because I had the 
opportunity to be out with Mr. Gibbons in Las Vegas during that 
period of time in which we had very robust meetings with the 
private sector, State and local governments. To be candid with 
you, I wasn't quite sure what kind of reception we were going 
to get, but we worked through many very difficult issues and 
came up with some very successful solutions to a response of 
that holiday threat period; and I think it is representative of 
the types of efforts we have out there that do tell a good 
story.
    Ms. Dunn. That is good.
    I think it is very useful that both of you have been in and 
out of the private sector, so you understand the value of what 
they can contribute and the kinds of communications that they 
need in order to be part of this whole thing. I think it makes 
us all stronger.
    Let me ask you, Mr. Cooper, one question. The enterprise 
architecture team that you have started is going to come up 
with a plan to connect networks within the Department of 
Homeland Security. At the same time, you have new programs 
being started up, like U.S. VISIT. Do you believe that you are 
in contact with them to the extent that you know what sort of 
information-sharing requirements they have and is it working 
well together?
    Mr. Cooper. Yes, ma'am. I am actually a member of the 
executive advisory committee of U.S. VISIT in that specific 
example and also participate in the advisory committees of all 
of our major programs. We are deliberately looking for major 
programs to leverage whatever capability is being established. 
For example, within U.S. VISIT, as we roll out new biometric 
capability at the borders and ports of entry, that requires 
some new underlying infrastructure. We are actually leveraging 
that new investment as part of the U.S. VISIT program to ensure 
that infrastructure enhancements that we are making become the 
foundation of the direction that our infrastructure requires 
and--as represented in our enterprise infrastructure 
architecture.
    We are doing the same thing with Customs and Border 
Protection's ACE program. We are leveraging the legacy 
Immigration and Naturalization Service's Atlas program for 
which there is appropriated funding to better establish 
infrastructure, and we are working to coordinate all of those 
investments within our enterprise architecture activities.
    Ms. Dunn. Are you going to be able to get the FBI and CIA 
to come together so the U.S. VISIT can use their information in 
a way that is consistent?
    Mr. Cooper. I am confident we will do that. I am afraid 
where we might have a difference of opinion is the timing that 
it might take.
    Mr. Thornberry. So the question is, are any of us going to 
be alive when it happens?
    Gentleman from North Carolina.
    Mr. Etheridge. Thank you, Mr. Chairman, and let me thank 
you gentlemen for being here this morning.
    Mr. Cooper, I know--I think a question has been asked in 
one way on the testimony previously before the Government 
Reform Committee, and let me go back to that and ask my 
question a little different way, to some extent on the same 
subject as it relates to the 18 projects. Let me talk about two 
of them and one very specifically, I think, because right now, 
as you are trying to pull these together, and I guess I am very 
interested in particular--first, as you talk about the State 
and local industry needs survey, what do you hope to gain and 
what is its status is what I would like to know.
    And let me go to another one that is very specific that I 
know my office and, I assume, many offices have problems with. 
This is an ongoing problem of getting information out of the 
Citizens Immigration Services, or CIS, because for my 
constituents they are constantly blaming the computer system. 
We call them, and they keep saying it is the computer system's 
problem. Well, garbage in, garbage out. You know what I am 
talking about in computer language.
    And I am very interested in hearing about the feasibility 
study on integrating immigrations and Customs case management 
systems. Specifically, don't we need to fix the immigration 
computer problems first before we integrate those with Customs? 
Because if we don't get them fixed and integrate them, we are 
compounding the problem. I hope you will help me understand 
that so I can share that back with my staff who are quite upset 
about it.
    Mr. Cooper. I understand. Let me take them in reverse order 
of your question. Let me go ahead and address citizenship and 
immigration services.
    First, I do agree and the approach we are taking is exactly 
as you described. We have done a couple of things very 
actively. First we have--.
    Mr. Etheridge. Can you give me a time line as to when we 
will have it fixed?
    Mr. Cooper. I will give you our current working targets of 
timing. The first thing that I had done is I have worked 
directly with Director Aguirre and his staff. We have named a 
CIO in Citizenship and Immigration Services. That individual is 
already on board and working directly with his staff and 
directly with the program folks to first, as you properly point 
out, to fix the problems with both the process as well as the 
underlying information technology that supports those 
processes.
    They will address, first, developing and reengineering any 
of the processes that they find to be inefficient or lend 
themselves to optimization. Only until that work is done will 
we then move forward to integrate with other component parts of 
the organization.
    So we are following your advice. We are fixing the problems 
first, streamlining process, understanding requirements, 
understanding the information necessary to support those 
processes; then automating within CIS, then integrating. And 
there is opportunity to integrate in that case management 
arena.
    We have also ongoing an integrated consolidated case 
management effort that is at the very beginning so that the CIS 
folks, who are developing the work that I am just describing to 
you, are also part of a larger interdepartmental working group. 
And then, in turn, we also have reached out to other Federal 
agencies, like the Department of Justice or the Department of 
Energy, who have automated solutions in place to then evaluate, 
might there be an already existing solution that we could reuse 
that we could bring to bear? And the goal is to optimize, 
streamline and modernize, but don't necessarily build all this 
stuff from scratch because we are suddenly a new department.
    Does that give some guidance.
    Mr. Etheridge. The time line?
    Mr. Cooper. Here, again, we are moving forward. The time 
line to address the backlog is 6 months, the target that 
Director Aguirre has given us to direct the backlog and a lot 
of the cases kind of pending, from roughly this time period.
    Another way of thinking about that is that our goal is to 
address this and have real solutions on the ground and to have 
cleared that backlog as fast as we can. But Director Aguirre's 
direction to me and to my team is help us do this by the end of 
the fiscal year.
    Mr. Etheridge. October 1?
    Mr. Cooper. Six months, that is the target, this fiscal 
year.
    Very quickly, in the State and local information sharing, 
that type of thing, as part of the program that I mentioned to 
you that Under Secretary Libutti is guiding, as part of that, I 
actually have been working along with several of our other 
colleagues and leaders within the Department, particularly the 
office of State and local government.
    We actually have been reaching out through the National 
Association of State CIOs and through a number of larger city 
CIOs, my office and me personally. We have been exchanging 
information. We have been working to better understand the 
requirements for information sharing from State and local and 
tribal government and from members of the first responder 
community. We are doing that not only through my office, but 
when we have something like Project Safecom which is also 
reaching out on the interoperability issue. That is how we are 
gathering requirements. We are then taking those and applying 
them and sharing them within the Department and working 
together within the Department and State and local partners to 
put solutions on the ground.
    Mr. Etheridge. I know my time is up. Is that sharing a two-
way sharing?
    Mr. Cooper. It is a two-way sharing. In fact, we require 
them to guide us. We can't see the requirements from the 
Federal environment. We are dependent upon them to provide 
local requirements.
    Mr. Etheridge. In a lot of cases, they are really our eyes 
and ears for those people who don't have the data.
    Mr. Thornberry. I thank the gentleman for his good 
questions.
    The gentleman from New Jersey.
    Mr. Andrews. Thank you, Mr. Chairman. I would like to thank 
our witnesses for their testimony this morning and for their 
service to our country. I know they do it at some considerable 
sacrifice.
    The first thing I thought about last August when I heard 
about the blackout that was rolling across the northeast United 
States was whether it was an accident or whether it had been 
deliberately caused.
    Let's assume--and happily all the evidence from that is 
that it was an accident. Let's assume that, this morning, a 
utility company in Wisconsin found evidence that someone was 
hacking into their system with an apparent attempt to bring 
down the system and bring down the grid. How would you find out 
about that?
    Mr. Liscouski. We learned a lot from the blackout, sir, and 
the processes we established with NCSD and through IP in 
general, particularly as it relates to situational awareness 
during that blackout period served us very well. For 
instance--.
    Mr. Andrews. Not to interrupt, but if that happened this 
morning, who would tell you?
    Mr. Liscouski. What we learned in the blackout period was 
the processes we put in place at that time were exactly the 
same processes we would learn from an event similar to the 
hypothetical you just provided. We work with FERC, NERC in 
particular, which is the North American Electrical Reliability 
Council, which establishes the ISAC management point for our 
relationships with all the private sectors that relate to the 
electric utility companies. They have a very robust capability 
and the communications across the grid to pick up on incidents. 
Most likely, that would be the first indication for us 
reporting back from the private sector back into the ISAC, 
directly back into DHS about any activity like that.
    Mr. Andrews. Would the utility company be required to tell 
you this, or just do it as a matter of good practice?
    Mr. Liscouski. There is a requirement--and I am getting a 
little bit out of my lane here as it relates to the regulatory 
requirements set forth by both the FERC and the NERC, FERC in 
particular; but I believe that there is a requirement to report 
those outages, but I can't specifically cite the authorization 
for that regulation.
    Mr. Andrews. I know this is probably an unknowable answer, 
but give me your best guess.
    How long would it take between the discovery of the 
intrusion by the utility company and report of the intrusion to 
responsible authorities within your division?
    Mr. Liscouski. There are a lot of dependencies on that 
chain--in the chain of that reporting. The first indication 
would be the robustness of that particular enterprise that 
might be under attack to detect an attack. In some cases, it 
might be a failure that might be the first indication of an 
attack. Where there is more robust capability, they are doing 
network monitoring and there are standards that have been 
supplied by NERC for implementation for cybersecurity, 
particularly resulting from the blackout example that would 
allow a utility company to be able to detect what is going on 
and therefore report it.
    It depends upon the magnitude of the type of attack, their 
capability to detect that.
    Mr. Andrews. I think I just heard you say that your ability 
to know would be very dependent upon the robustness of the 
detection system the utility company has in place. So if they 
had a weak system in terms of detection, you all might miss it 
all together?
    Mr. Liscouski. It really depends upon the type of attack. 
If it is a very specific attack against a specific company, a 
utility company or any other company that might be on the 
Internet, specifically targeting them, there are a couple of 
points we might be able to get information from, a, from the 
ISP which might be monitoring network activity that might see 
an increase of traffic to a specific IP address that might 
result in a denial of service for instance. The IP could report 
it to us, the target company could report it to us; it really 
depends upon the scenario. It is not easy to come up with a cut 
and dried answer to say, yes, it can happen, or no, it can't 
happen.
    Mr. Andrews. Let us assume that the information was 
accurately reported and let us further assume that there were 
tools at your disposal that would stop the spread of the 
problem, that you could wall off other parts of networks and 
other parts of systems to protect other parts of the power 
grid. And let us assume that your best experts in your 
department said that is what you ought to do.
    Do you have the authority to tell people to do that or not? 
Do you have the authority to tell the other people in the 
utility system that they have to follow those prescriptions or 
not?
    Mr. Liscouski. Taking the example, in partnership with the 
Department of Energy with whom we have--and the FERC with whom 
we have a strong relationship in the protection of critical 
infrastructure, by extension, I would say we have the authority 
to initiate that activity.
    The actual execution of that authority would be with those 
respective regulatory agencies that have that specific 
legislative authority. But in terms of taking an action and 
prescribing a specific action, going back to the earlier 
conversation I had about the HSPD7, we are exactly in the 
middle of framing out those roles and responsibilities and how 
we would broker those relationships.
    Mr. Andrews. What I think I just heard you say was that if 
you detected the attack and if you had a clear recommendation 
as to what to do about it from your experts that you would have 
to have some cooperation from the Department of Energy to 
execute the solution, right?
    Mr. Liscouski. I think it is more appropriate at the FERC 
level.
    Mr. Andrews. You would have to have some cooperation from 
FERC and there are other regulatory bodies that might have some 
flow in this, too. The Nuclear Regulatory Commission might have 
a hand in it?
    Mr. Liscouski. They might.
    Mr. Andrews. I raise these questions not just to paint an 
interesting hypothetical, but I think we have a lot of 
technological issues, and we have a lot of very smart 
technological people to address them; but I think fundamentally 
we have a management problem, an analytical problem. And the 
analytical problem is, who is in charge when we have a crisis?
    I don't pretend to have an answer, and I don't advocate the 
answer that government be in charge of private enterprises in 
these circumstances. I don't want to see that. But we need to 
think through, ``we,'' the committee, the administration, 
everyone, these protocols, because we don't have a lot of time 
to make these decisions. And even if we have honed the 
technology to the point where we know what is going on, and we 
have some good ideas what to do about it, we have created 
confusion or dysfunction--you haven't--as to who is in charge 
of what.
    Mr. Liscouski. I don't think that is the appropriate 
characterization. I think we have good leadership. I think DHS, 
the brilliant part about the creation of this department is it 
does pin leadership responsibilities on the Secretary in 
working through the relationships we have with sector-specific 
agencies. It may not appear to be a direct line of authority, 
but there is a clear line of communication that--we got 
activity going, and we have plenty of examples over the recent 
threat periods of how we have exercised that authority in 
cooperation.
    Mr. Andrews. Can the Secretary order utility companies to 
do what your folks would say they should do?
    Mr. Liscouski. I feel pretty confident we can exercise the 
necessary actions we would need to get to get the appropriate 
action at that level. We have a cyber IIMG, Interagency 
Incident Management Group, that was stood up subsequent to the 
live wire exercise that took place this past fall in which the 
lesson there was that we need a cyber response. We quickly 
created that capability.
    I am confident, sir, that we have the leadership that we 
need. Do we need to refine that and figure out how we do it 
better? Absolutely.
    Mr. Andrews. I realize my time is up. I am not in any way 
impugning the leadership capabilities of people in these jobs 
nor am I doubting our competence to do them. What I am 
wondering about is because of the relative infancy of this 
department whether a--knowing bureaucratic turf battles to be 
what they are, if we were find ourselves mired in a 
bureaucratic turf battle at a time that we had to make some 
very quick decisions, I think it behooves us to answer those 
questions in advance so people know clear lines of authority.
    Mr. Liscouski. We are actively engaged in looking at those 
lines of communication. I would be happy to come back and talk 
to you about that. I wouldn't want you to leave this committee 
room thinking that we haven't thought about that or we haven't 
taken activity on that.
    Mr. Andrews. I certainly don't think. I think we 
collectively need to think more about it and establish clear 
lines of authority.
    Mr. Thornberry. Gentleman from Rhode Island.
    Mr. Langevin. Thank you, Mr. Chairman.
    And, gentlemen, thank you for being here. I would like to 
touch on a couple of areas that have already been touched on 
this morning, first, dealing with JRIES and the second dealing 
with outreach to private industry.
    First of all, can you tell us about the relationship 
between JRIES and RISSNet? Those people who may not be familiar 
with it, that is the Regional Information Sharing Network used 
by law enforcement. It is a highly effective tool for 
intelligence sharing and obviously it is a proven entity.
    It was my understanding that JRIES was supposed to partner 
with RISSNet, but evidently that has not happened. And, in 
fact, from what I understand, RISSNet has been sidelined by 
DHS. So I would like to ask why it seems that you are pushing 
aside a proven system for a brand new one.
    Second question for Secretary Liscouski: Last week I had a 
meeting with the IAIP directorate's enterprise architect 
Jonathan Houk and a company from my district, Ibis Consulting, 
to discuss how DHS is tapping the vast amount of expertise 
residing in the private sector. And I was pleased to hear that 
he is trying to leverage industry resources as much as possible 
in setting up IAIP's enterprise architecture, which is still 
obviously in the planning stages.
    But aside from Mr. Houk's efforts, I would like to hear 
more on how effective DHS has been in forging industry 
partnerships. And I would like to hear more from you and Mr. 
Cooper about DHS's policies and guidance concerning industry 
outreach, if you would take the RISSNet question first.
    Mr. Cooper. Let me address that for you, sir.
    You are correct in that there was a period of time where 
the communication between the two programs was not occurring 
and was not anywhere near as effective as I think both groups 
and DHS want it to be. Much more recently, myself included, we 
have gotten that back on track and the RISS.Net team has met 
with the JRIES team and the program director to reengage and to 
actively build upon the work that RISS.Net has already done and 
to rapidly map into our homeland security information network, 
which is now what JRIES is evolving into as far as a label. It 
is a broader scoping. And that change in title properly 
reflects the broader scoping on behalf of DHS. So I do 
acknowledge that there was a temporary delay. We didn't have 
the effective communication. We believe very strongly that now 
has been corrected and I know that as of last week, there had 
been more recent meetings between the RISS.Net team and the 
JRIES team to move this forward.
    Mr. Langevin. I am encouraged to hear that.
    Mr. Liscouski. Sir, with respect to the private sector 
outreach program, we have it in many dimensions. Let me address 
the cyber one since that is the focus of this panel or meeting 
this morning.
    Mr. Yannis has taken a very aggressive approach in 
establishing private sector partnerships. The first event that 
he participated in was the cyber summit back in December in 
which we were actually able to announce and get him engaged in 
the private sector outreach program. But subsequent to that, 
there have been a number of initiatives that he is engaged in. 
There is a US-CERT, private sector partnership program. They 
are on daily watch calls with the private sector either 
directly with private sector entities or through the ISACs. The 
task forces that have result from the cyber summit are also 
reporting back and are actively engaged with the NCSD in 
providing information and recommendations about how they can 
influence best practices throughout the industry.
    Across infrastructure protection, we have traditionally 
have had--traditionally, in a year, if you can establish a 
tradition in the year, we have had active engagement with the 
NSTAC, the National Security Telecommunications Advisory 
Council, which is a presidential council established through 
the NCS; the NIAC, National Infrastructure Advisory Council, 
which was established through the legacy organization of the 
CAIO. Those are things we are actively engaged with.
    The Homeland Security Advisory Council, which was 
established by the Secretary, has its own subcouncil, the 
Private Sector Advisory Council, with whom we are actively 
engaged. They represent, really, leadership of industries at 
the top level, at the CEO level, with whom we both exchange 
ideas and get influence from, again, the ISACs themselves 
across all the infrastructure components.
    The private sector component is one in which I personally 
take an active leadership role, ensuring that we have got the 
right things going on there. We look for every form possible to 
ensure we get both feedback as well as getting our message out 
there. And importantly, when we get the feedback, it is, what 
do they believe they need to be doing to better protect our 
critical infrastructure; and we take that feedback into our 
thinking about how do we develop programs, realistic, going 
back to the consistent, effective, sustainable and measurable 
types of approaches we try to take.
    I could, frankly, better take the remaining time here to 
talk about the different types of relationships and I would 
like to address something specific if you have it.
    Mr. Langevin. Can you talk about your interaction with 
small business? Very often they are the innovators and 
entrepreneurs that are out there at your basic level that have 
a product they believe can fill a niche. This is what happened 
with Ibis Consulting, and I put them in touch with the right 
people.
    But how easy is it for small business to reach someone at 
DHS and get some type of an answer or an action?
    Mr. Liscouski. There are two parts to that question.
    From a protection standpoint, we actively reach out to 
small businesses through our partnerships with our private 
sector outreach office, Mr. Al Martinez-Fonts, who you may know 
is a Special Assistant to the Secretary. His office is 
responsible for ensuring that we don't let any business fall 
through the cracks if they are not represented by a specific 
infrastructure sector themselves, so leveraging partnerships 
with U.S. Chamber of Commerce, for instance, or other industry 
groups to reach out to those small businesses to get the word 
about how to best protect themselves.
    I was a small business owner and I am a staunch believer in 
what they add to the economy. That is the growth engine for the 
economy. We are very interested in protecting them. In terms of 
outreach and ways they can actually do business with us, I will 
defer to Steve, but the reality is we have a number of 
mechanisms by which companies can reach DHS.
    Mr. Cooper. We have specific focus on small--and medium-
sized businesses. My office works very closely with Kevin 
Boshears, who is the Director of our Office of Disadvantaged 
and Small Business Utilization; and we have actually, with his 
guidance, established some programs to flow and to make 
introduction connections with small businesses, in particular 
with my office.
    I have named a Special Assistant For Industry Liaison, Tom 
Bold, and Tom has developed a program that then, in addition to 
Kevin's guidance to us, we have established a Web site that 
allows small businesses, medium-sized businesses--any business, 
but we are trying to focus on small and medium-sized 
businesses--to make their products and, services with specific 
areas they believe that they can help us address some of the 
business problems and challenges that we face, known to us.
    We have--I personally, along with my team, have met with 
more than 3,000 businesses in the past year. We are trying to 
meet as many and talk with as many people as we can. We feel 
very, very strongly, and I have publicly spoken about the fact 
that we inside the Department don't have all of the technology-
enabled answers. We are dependent upon a very cooperative, 
collaborative partnership with industry, particularly small--
and medium-sized businesses where a lot of the innovation does 
occur.
    Mr. Langevin. I am encouraged by your answer.
    Mr. Thornberry. I thank the gentleman.
    Mr. Liscouski, let me try to see if I can ask a series of 
questions related to the national strategy to secure 
cyberspace, which the administration issued just before the 
Department really was up and running. But it still seems to me 
that to offer a good blueprint on the issues we need to be 
concerned about with regard to cybersecurity; and what I would 
like to do is go through some of the things they said we need 
to work on and have you just at least give us the name of a 
program or an effort. We can't get into the details of this 
stuff, or we will never get anywhere, but I am trying to get a 
feel, over the last year, how much progress have we made.
    The first priority, as you know, is the National Cyberspace 
Security Response System. That is the first priority in the 
national strategy. And then they talk about public-private 
architecture for responding to national level cyber incidents. 
The first specific under that is analysis, tactical, strategic, 
and vulnerabilities.
    Are we doing those things? Are we analyzing those cyber 
attacks?
    Mr. Liscouski. We are, sir.
    Mr. Thornberry. Do you do that or does IA do that; or does 
the Cyber Division, which is under you, do that? It says 
``analysis,'' so how does that work?
    Mr. Liscouski. Let me take the first part of what we are 
doing, and I will tell you how we are doing it. There are a 
number of efforts that we have got under the priority one; the 
first--and no order of ranking here, just to give you the 
amalgamation.
    There is the critical infrastructure--I am sorry, Computer 
Incident Interagency Management Group that I referred to 
earlier, first part of our response system. There are the 
alerts that we put out through the cyber alert system, as well 
as the efforts we are taking to build our national watch 
capability. We have got a--one effort dedicated to network flow 
analysis and situational awareness, and we have got our C1 
project, which is our secure and survivable communications.
    But who does the analysis that is aggregated among these 
types of efforts is a combination of--we work closely with our 
information analysis colleagues. The unique thing is, you know, 
about IAIP as we are joined at the hip. We both are resources 
for each other. In the context of threats, IA has the 
responsibility of providing us with threat information and that 
can then be mapped over to vulnerabilities. The technical 
expertise to understand how those threats can manifest 
themselves and those vulnerabilities, particularly in the cyber 
world, is found in the NCSD.
    So analysis occurs across the soft center of IAIP if we 
look at where really the heart of what the IAIP organization is 
providing in terms of value to DHS.
    I don't mean to be overly complicated about this, but there 
is analysis on both sides of that equation. So as it relates to 
priority 1, we have a very distinct role from the NCSD's 
perspective providing that response capability as well as an 
analytic capability.
    Mr. Thornberry. Number two under that same priority is 
warning, and you just referred to some organization, but that 
is kind of an operational role; it seems to me that is a little 
different from infrastructure protection. I presume that is the 
same thing. Cyber Division is doing all of that analysis and 
the operational things and yet they are under infrastructure 
protection. I think that is kind of a unique situation for 
cyber, but also raises some questions.
    Mr. Liscouski. It is not unique for cyber. We are doing a 
similar way for telecommunications under the NCS. Similarly, 
within our protective security division, we are doing an 
analysis on threat information as it relates to mapping that 
threat information into vulnerabilities. As I point out, this 
is a very--you can't cut that Gordian knot. It is robustness of 
analysis going on both sides of the equation.
    The one way that he might look at it is, threat information 
is sort of incident specific. Vulnerability analysis in terms 
of how vulnerabilities may be exploited might be end results 
specific. For instance, oftentimes we look at if we want to 
create--if a terrorist group is interested in creating a mass 
casualty type of event, they have a number of different ways 
they can use that: biological event, chemical event, bombing, 
using aircraft as missiles. We all know the results and we look 
at different ways we can affect that type of outcome.
    The analysis that has to go on to exploit vulnerabilities 
in those particular modalities of attack are things that our 
organization is responsible for doing. The intent and who has 
got the capability of doing those things clearly resides on the 
side of the information and analysis.
    Mr. Thornberry. Under, still, priority one, one of the 
things we need, the strategy says, is recovery mechanisms and 
continuity plans in Federal cyber systems. Are those under way?
    Mr. Liscouski. Yes, sir, they are. The partnerships we have 
in cross-infrastructure components, but cyber in particular, is 
intended to be able to recover from an attack as quickly as we 
possibly can, reconstitute ourselves. That is an integral part 
of our protection program.
    One of the things a good recovery capability does is it 
devalues the target. One of the protection priorities we have 
is not just hardened targets, but to quickly recover from an 
attack should an attack occur. That effectively devalues the 
target if we can recover quickly.
    Mr. Thornberry. I am not going to go through all of these 
items. I will skip ahead for a second to priority two, which is 
threat and vulnerability reduction.
    Among some of the specific items listed there are securing 
the mechanisms of the Internet including key Internet 
protocols, Internet routing, and management of the Internet. 
How are we working with the private sector to do those things 
that were specifically set out in the strategy?
    Mr. Liscouski. We have a number of initiatives currently 
under way in which we are looking at both the vulnerability of 
the Internet as well as ways that we need to enhance the 
security of the Internet. One of those efforts, the GEWIS 
program, which was the Global Early Warning Information System, 
started out as an effort that the NCSD has enhanced 
significantly and gained ownership of, is looking broadly 
across the Internet at the network analysis activity that needs 
to be examined to ensure that we can see attacks coming over 
the horizon and take protective actions as necessary.
    Mr. Thornberry. I think what we might like to do is submit 
some of these other types of questions for the record, going 
through the various elements of the strategy, again not looking 
for detail, because that is way too much, but I do think it is 
important for us and for all of those interested in this topic 
to have some idea that at least there are initiatives under way 
for the various areas, and some of them are not even in your 
bailiwick. But the initiatives that are under way, we need to 
know that they are under way.
    I yield to the gentlelady.
    Ms. Lofgren. I realize we are out of time and we have a 
series of votes. I have a lot of questions which I will submit 
and look forward to the written response.
    But I did want to make sure that I understood Mr. Cooper's 
answer to Mr. Etheridge, because I wrote it down and want to 
make sure I was not mistaken.
    Did you say that by the end of this fiscal year we will 
meet the President's 6-month goal on processing immigration?
    Mr. Cooper. I am indeed saying that we are going to do 
everything that we possibly can to meet that goal. That is our 
direction, that is where I am placing additional information 
technology resources to help do that.
    Ms. Lofgren. Thank you very much.
    Mr. Thornberry. The chairman may have additional questions, 
particularly for Mr. Liscouski, who has another hearing. Maybe 
Mr. Cooper might be more flexible if we need to come back.
    Mr. Cox. We don't need to come back. I intend to go to the 
floor for the vote, but I would take a few minutes before we 
leave.
    Mr. Thornberry. We have the gentleman from Florida here.
    Mr. Meek. I will yield to the chairman and I will submit my 
questions for the record.
    Mr. Cox. I appreciate your courtesy.
    On the subject of our overall strategic objectives, I am 
impressed and pleased that the number one strategic objective 
is preventing cyber attacks against America's critical 
infrastructures. When I look at the priorities as they are laid 
out, I find that the first priority is the response system. The 
second priority is threat and vulnerability reduction, which 
has as its analog the second of the two, the second of the 
three overall objectives for DHS itself.
    Likewise, priority 3 is awareness and training. That gets 
to protection. Priority 4 is securing government cyberspace. 
That, of course, is defensive. And within priority 5, as it is 
outlined, even though it is described as international 
cooperation, there is a bit about intelligence sharing and so 
on.
    But, you know, the main purpose of the Department of 
Homeland Security is to deal with the problem of T and T, 
terrorists and technology, the weapons of mass destruction plus 
terrorists, the possibility that mayone day be upon us. That is 
the worst thing that could happen to the country and, 
therefore, the first thing that the Department of Homeland 
Security needs to concern itself with.
    Such things as pulse weapons directed at our country, 
therefore, mark what ought to be the top priority in prevention 
there is clearly superior to dealing with it after it happens, 
just as with any other weapon of mass destruction. So I wonder 
if I could inquire first whether you have it in mind to place 
increasing emphasis on the prevention piece, because while it 
is occasionally mentioned, I see that we are focused, for 
understandable reasons, elsewhere because it is more tractable; 
and specifically whether it is possible to initiate more 
meaningful collaboration between the National Cyber Division 
and the Department of Defense.
    Mr. Liscouski. Yes, sir. From our perspective, these 
programs all roll up into a good preventive and protection 
approach. You can take apart elements and see that they 
contribute to protection. But every single one of these, from a 
response and recovery capability awareness, threat and 
vulnerability reduction, all really do constitute good 
protection programs. So I would, if I understand your question 
correctly, validate this approach in terms of what it 
accumulates--.
    Mr. Cox. What I am trying to do is distinguish protection 
from prevention. We have prevention, protection response. I see 
a lot of protection, a lot of response, and I need to 
understand more about what we are thinking about doing in the 
prevention area.
    Mr. Liscouski. In the context of prevention and again, I 
don't want to be definitionally based here, but as it relates 
prevention, typically the law enforcement component of 
interdicting, detecting and interdicting what is going on. 
Detection as it relates to prevention is clearly within the 
domain of what we do. The actual activity related to 
interdicting or reducing an adversary's ability to attack us is 
not something that my organization is charged with.
    Mr. Cox. On the other side of IAIP, in the other half of 
Frank Libutti's brain, we have the essence of the prevention 
piece of DHS, and it would seem to me that that would apply 
just as thoroughly to cyberspace as anything else.
    Mr. Liscouski. The full circle here--and again, this is 
trying to cut the Gordian knot, but we look at prevention in 
the context that you just provided it to occur at the target 
level. And the things that we can control in the world, that we 
do to protect--if I could take some time here for a moment--
there are protective activities we engage in which increase 
awareness of group capabilities and tactics that could be 
affected against a specific target.
    We go out and train the private sector on what to look for, 
the observables of preincident indication of activity of a 
terrorist attack. Those observables, while they may be 
disparate pieces of information not directly related to an 
imminent attack, but potentially future planning of an attack, 
are things we can pipe back into our IA folks to assist in the 
prevention role.
    That is the value add that we have in the ability of 
providing information from the private sector that we directly 
gain on preincident information that we collect, that we share 
with our information analysis component that gets put back into 
the intelligence community to affect good prevention 
methodologies and good prevention activities. It is finding 
out--and the unique thing about this and the unique thing about 
what DHS does, particularly as it relates to IP, is that we 
deal in the target community; and as a result and as opposed to 
looking at just the criminal activity or the terrorist activity 
that goes into targeting the private sector, we are dealing 
with the targets that are the focus of those terrorist groups.
    So if we know what to look for and we can train people in 
what the observables are, that observable information can 
significantly enhance prevention activities as it relates to 
law enforcement and the intelligence function.
    As I pointed out earlier, it is a pretty complex process, 
but I think it is an extremely articulable one as it relates to 
what our role is and how we play together in this space. It 
happens in the cyber world routinely; as we found out, probing 
or potential exploit probes, things that can be detected in the 
cyber world contribute to that sort of knowledge as well. 
Terrorist groups, we know, use cyber activity to probe physical 
targets to see what the penetration capabilities are. That 
information gets collected similarly as observable--physical 
things that are observable get reported back to us.
    I don't know if that responds to your question or not.
    Mr. Cox. It amply responds given the time that we have. I 
appreciate very much your willingness to speak to the point.
    I thank the chairman. Please keep in mind my suggestion 
about deeper cooperation with DOD. I think that that could be 
helpful.
    Mr. Liscouski. I could respond to that, too.
    We actively engage with DOD and we are looking at all 
levels between NORTHCOM as well as the Assistant Secretary of 
Defense Paul McHale. We have a good partnership there.
    Mr. Thornberry. I thank the chairman.
    I would like to ask both witnesses if we can have an 
agreement that because our time has been cut short, that you 
all will make an effort to respond to our written questions, 
try to within 2 weeks and less than 30 days, and I will commit 
to you to make sure that the questions are reasonable in length 
and scope. If we could have that agreement with both of you, I 
would appreciate it.
    I am going to ask one other question at the risk of missing 
this first vote. You are free to go Mr. Liscouski, but I don't 
know if anybody is going to be over there anyway because we are 
all voting.
    But, Mr. Cooper, I want to direct this to you because one 
of the primary reasons that the Department of Homeland Security 
was created was to integrate 22 different agencies into one 
seamless unit. Now, the total measurement of seamlessness is 
not having one IT architecture and system with which the 
Department can operate, but it is a pretty good one. And yet, 
when I look at some of the specifics that you have provided on 
the progress you have made, you have still got ten different 
financial management systems, you have still got eight 
different contracting offices, seven different human resources.
    I guess it is an area where I am frustrated, frankly, and I 
want to ask, is the primary difficulty you face figuring out 
what you want to do? Is it resolving the technical difficulties 
of merging these 22 different agencies? Or is it something 
else? Is it money? Is it getting the decisions made to force 
people to go use somebody else's computer system even though 
that is not what they have been using?
    If you had to summarize the difficulty you face in making 
this one seamless IT department, what is it?
    Mr. Cooper. I would summarize it in this way: It is a 
combination of people, process and technology. The technology 
is in fact, honestly, from my professional and kind of sitting 
in the role that I currently sit in, is the least controversial 
and the easiest to effect.
    However, having said that, it is--in and of itself, the 
technology challenges are complex. We know how to do them, so 
that is the easiest.
    The second is process. What we don't want to do, if you 
pardon the expression, is pave the cowpath. We want to 
reengineer some of the processes that we now use or will use to 
effect threat identification and management or some of the 
cybersecurity activity that Bob has talked about or some of the 
back office processes that I spoke to briefly. That is hard 
work.
    We do have--we are making progress. I mentioned the five 
business area focus groups. This is under way. We were a little 
bit slow to get going because we had to do some education. We 
had to help people understand why this is an important and 
valuable exercise.
    We have had the support of the Secretary. We have had the 
support of the Deputy Secretary and now we are engaging. All 
areas of the Department are engaging. So that, I feel 
comfortable that we are under way.
    Again, we will move as fast as we can move with quality and 
with speed. It may take us longer than all of us would hope 
that we could complete.
    The last and the toughest is people. This is about change. 
And that means that in some cases, the right decision or what 
might come out of these business area focus groups might be 
suggestions or reengineering that says a process used to be 
done in many organizational elements and now it might be more 
appropriate to place it in one organizational element, name 
that organizational element, the managing partner or the 
business process owner to have reach and span of control across 
that process across the entire Department. That is change, it 
is difficult, and it is about thinking differently and about 
doing work differently.
    I don't have exact answers. It is not quite a science yet. 
There is a little bit of art involved.
    Mr. Thornberry. I appreciate your analogy of changing the 
tires as the car is moving, because while you are doing this 
stuff, you still have got to guard the borders and still have 
to process the people coming in. And I don't want to minimize 
that effort.
    I will say this. I think a number of us will be looking for 
ways to help you, maybe even push you a little bit to make sure 
that this does move as fast as possible. And understanding 
culture and people and reluctance to change, we cannot let that 
obstruct the ability to have a department that is functioning 
as well as it possibly can, because so much is riding on the 
success of this department.
    So I don't want to make your job more difficult, but on the 
other hand, separation of powers is here for a reason and maybe 
we can help give you some extra incentive or whatever to get 
the job done.
    But I appreciate it. I appreciate both of you being here 
and your answers today, and I appreciate your willingness to 
answer our written questions promptly. And, with that, the 
hearing is adjourned.
    [Whereupon, at 11:50 a.m., the subcommittee was adjourned.]

                            A P P E N D I X

                              ----------                              

                   Questions Submitted for the Record

 Questions for Assistant Secretary Robert Liscouski, From Congressman 
                               Dave Camp

    1. Your office has the responsibility to communicate cyber threat 
information to the private sector. I am interested in understanding the 
different means you use to accomplish this task. What challenges do you 
face in communicating with large companies (the Financial Services 
Sector, for example) versus small business owners and private users? 
What are the different means you utilize to reach these different 
groups, especially given their varying levels of understanding of cyber 
threats?
    The primary ways that DHS communicates cyber threat information to 
the private sector are: (1) through the U.S. Computer Emergency 
Readiness Team (US-CERT) public website at www.us-cert.gov, (2) through 
the US-CERT's National Cyber Alert System (NCAS), (3) through the US-
CERT Portal, and (4) through the Information Sharing and Analysis 
Centers (ISACs) in each of the critical infrastructure sectors.
    The US-CERT public website is our primary means to provide 
information to the public at large. It includes relevant and current 
information on cyber security issues, current cyber activity, and 
vulnerability resources. To date, the website has received over 3.8 
million hits at an average of 128,000 per day. It also provides a link 
to the National Cyber Alert System (NCAS).
    NCAS is an operational system developed to deliver targeted, 
timely, and actionable information to Americans to allow them to secure 
their computer systems. Information provided by the NCAS is designed to 
be understandable to all computer users, technical and non-technical, 
and reflects the broad usage of the Internet in today's society. The 
NCAS provides a communication mechanism through website access and e-
mail alerts for providing general guidance for users and the ability to 
reach millions of Americans at once with a variety of cyber security 
information materials on both a technical and non-technical level. 
There are currently over 270,000 unique subscribers to the various 
alerts provided by the NCAS, and our challenge is to increase its 
outreach to as many Americans as possible. We are working closely with 
the National Cyber Security Alliance on expanding the Stay Safe Online 
campaign, coordinating closely with the Federal Trade Commission on 
their information security campaign, and working with other trade 
groups and industry associations with key cyber security awareness and 
outreach programs.
    In addition to the public website, US-CERT maintains an active 
secure online portal that enables the cyber security stakeholder 
communities including government and the private sector to communicate 
and collaborate on cyber security efforts. Groups that utilize the US-
CERT portal include the Chief Information Security Forum (CISO Forum), 
the National Cyber Response Coordination Group (NCRCG), DHS's Office of 
Infrastructure Protection, the Government Forum for Incident Response 
Security Teams (GFIRST), the Multi-State Information Sharing and 
Analysis Center (MS-ISAC), and the US-CERT staff. One challenge to 
reaching the private sector communities has been creating a trusted 
protocol for sharing information. That challenge is being addressed in 
through the NCSD/US-CERT Outreach and Awareness efforts.
    In the case of vendor-specific vulnerability or threat information, 
we communicate directly with appropriate and expert representatives in 
the individual company when that is possible. The recent Cisco 
vulnerability is a key example of how we communicated--and 
collaborated--with the private sector on a very specific vulnerability. 
The ability to communicate with specific companies in such cases is 
crucial. The appropriate contacts are being developed through the NCSD/
US-CERT Outreach efforts and through participants in the US-CERT 
Portal. Outreach targets include the spectrum of the critical 
infrastructure sectors (through the ISACs, industry associations, 
etc.), software developers and researchers, academia, government, the 
information technology (IT) vendor and operator community, and others. 
DHS works with various vendors to understand, assess, and inventory 
vulnerabilities so that when threat information is transmitted, it 
includes specific instructions on how to mitigate or eliminate the 
vulnerability, and what resources exist to obtain help.
    The ISACs were established as a primary mechanism for two way 
information sharing with the critical infrastructure sectors. Many 
critical infrastructure sectors have developed procedures to widely 
disseminate their alerts, warnings and advisories, to both large and 
small companies, throughout their sector. These sectors involve trade 
associations, representing smaller companies, who receive information 
from the ISAC and who then re-transmit that information to their 
members.

    2. How do you utilize Information Sharing and Analysis Centers 
(ISACs) to share and receive threat information? How do you recommend 
strengthening or improving the relationship between ISACs and DHS for 
this purpose?
    DHS/IAIP's Infrastructure Coordination Division within the Office 
of Infrastructure Protection maintains an on-going relationship with 
the ISACs and is the focal point for all ISAC relationships for 
critical infrastructure issues. Threat information gained from the 
Intelligence Community through DHS's Office of Information Analysis 
alerts, warnings, and advisories applicable to the critical 
infrastructures and key resource industries are delivered directly to 
them through standard agreed upon procedures. DHS/IAIP also provides to 
them regularly scheduled daily situational briefings, and periodic 
classified briefings as needed as well as special briefings when there 
is a major change in the threat level. IAIP also meets periodically 
with the ISAC Council a cross-sector body representing a large number 
of the ISACs, to improve information sharing practices and strategies. 
Such meetings help to sustain the relationship with the ISACs by 
proactively identifying gaps that need to be mutually addressed.
    DHS is constantly strengthening its relationship with the ISACs. 
One of its most critical programs is the implementation of a National 
Infrastructure Coordination Center (NICC) to serve as an operational 
nexus for all of the ISACs. The NICC allows representatives from the 
ISACs, industry groups, and key companies within each sector to share 
and receive situational awareness information. These sector experts 
work both within their areas of expertise and across sectors to 
maintain constant situational awareness of the status of the critical 
infrastructure. The NICC provides a centralized mechanism for sharing 
information with the ISACs and the private sector in response to an 
event or crisis. The ISACs will also be expanded to ensure that one 
exists for each critical infrastructure sector and key segments within 
each sector. DHS continues to work with industry to evaluate ways to 
reach the full breadth of each critical infrastructure sector, either 
through improvements in the ISAC mechanism or additionally through 
sector coordinating groups.
    In addition to these regular, ongoing efforts, the Homeland 
Security Information Network, once functional, will facilitate real-
time communication between DHS and the private sector through the ISACs 
or other sector groups as they form. DHS is also working with the ISACs 
on a number of exercises, on a national, regional, and sector basis 
that will help determine where communication and collaboration 
improvements can be made.

              Questions From Congressman Sherwood Boehlert

    1. Mr. Liscouski, in a September 2003 letter to Governor George 
Pataki, you requested New York's initiative and leadership in the 
Multi-State Information Sharing and Analysis Center (MS-ISAC) and 
promised that DHS would assume a more 'formal' role in the MS-ISAC, 
once established. New York State and Mr. William Pelgrin, Director of 
Cyber Security and Critical Infrastructure Coordination for the state, 
have been proactive and effective in coordinating and leading the 
Multi-State Information Sharing and Analysis Center. Mr. Pelgrin's 
efforts have resulted in the MS-ISAC involving 49 states and the 
District of Columbia and a business plan, submitted to DHS, which 
highlights roles, responsibilities, budgets, and additional steps 
needed for the MS-ISAC. Now that it has been established, what funding 
and support do you plan to provide the MS-ISAC as you work to formalize 
the relationship between DHS and this critical initiative that you 
requested?
    DHS recognizes and appreciates Mr. Pelgrin's efforts to develop and 
expand the Multi-State ISAC. As part of this effort, we had requested 
that he engage other like entities within the states, which had 
information sharing initiatives on-going, such as NASCIO, and integrate 
their efforts. That work is in progress. We are currently reviewing Mr. 
Pelgrin's business plan that was developed prior to the implementation 
of new capabilities within DHS, such as the National Cyber Security 
Division, the US-CERT, and the announcement of the Homeland Security 
Information Network (HSIN) by Secretary Ridge in March 2004. All of 
these new capabilities are intended to assist and enhance the core 
capabilities of the ISACs and bring them up to a common level of 
effectiveness. The Multi-State ISAC will receive the benefits of all 
these new capabilities including the ability to share information and 
collaborate on cyber security issues on a 24x7 basis and to further 
integrate information sharing within and across State and local 
governments through the HSIN/US-CERT portal.
    The Multi-State ISAC and Will Pelgrin have been extremely 
supportive of the US-CERT and our initiatives to increase national 
cyber security situational awareness. The NCSD has participated on a 
number of Multi-State ISAC monthly conference calls throughout 2004 and 
plans to continue to support the mission of the Multi-State ISAC to 
provide valuable cyber security vulnerability and incident information 
to the State level. Moving forward, NCSD plans to work along with the 
Multi-State ISAC to mutually improve cyber security on both the state 
and federal level. As such, DHS has entered into a contract with the 
MS-ISAC to provide $400,000 in FY04 funds, which the MS-ISAC is 
currently using for various outreach efforts such as conference, the 
webcast series, and other activities. DHS is exploring an increase in 
the funding for the MS-ISAC in FY05.

     From Congressman Mac Thornberry and Congresswoman Zoe Lofgren

    1. Coordination for Threat Assessments
        a. How is the National Cyber Security Division (NCSD) working 
        with the Information Analysis Directorate (IA), which has 
        responsibility for information analysis of the threat?
    The Office of Information Analysis (IA) is DHS' portal to the 
Intelligence Community and is responsible within DHS for all aspects of 
the intelligence cycle for cybersecurity, such as issuing additional 
collection or analysis requirements to the rest of the Intelligence 
Community. NCSD works with IA on the substance of the collection and 
analysis requirements.
    Operationally, the NCSD works with IA through daily threat 
assessment meetings and on an as-needed basis in the case of a specific 
threat. One example of this coordination was the participation of NCSD 
in partnership with IA to develop the National Intelligence Estimate 
(NIE) ``Cyber Threat Against the Information Infrastructure.'' This 
classified document is an update of the 2000 NIE of the same title. In 
addition to the regular meetings NCSD participates in daily conference 
calls with the National Security Agency/NSIRC, the Central Intelligence 
Agency, and the Department of Defense's Joint Task Force Global Network 
Operations (JTF-GNO) to discuss classified cyber activity of note.
        b. How does the NCSD interact with the Terrorism Threat 
        Integration Center (TTIC) for classified assessments? How are 
        these assessments used and what NCSD products have resulted 
        from TTIC derived information?
    NCSD interacts with the Terrorism Threat Integration Center (TTIC) 
indirectly through the DHS Homeland Security Operations Center (HSOC). 
NCSD shares the staffing of a 24x7 Infrastructure Protection desk at 
the HSOC that has direct reach back to the US-CERT, and the HSOC and 
TTIC work closely together on information for both physical and cyber 
threats. Additionally, NCSD interaction with the TTIC is accomplished 
through DHS/IA, law enforcement and intelligence community detailees on 
staff in IAIP and is developing a comprehensive threat, risk, 
attribution assessment, and response capability.
    With regard to classified assessments, NCSD participated in 
National Intelligence Estimate's cyber threat assessment in conjunction 
with IA and other members of the law enforcement community.
    To date there are no specific NCSD products that have been produced 
from TTIC-derived information.
        c. Who within DHS has the authority and mission to correlate 
        cyber threat and vulnerability for an overall assessment? When, 
        how, and with whom will this information be shared?
    As a focal point for cyber security issues related to reducing the 
vulnerability of critical infrastructure or key resources in order to 
deter, mitigate, or neutralize terrorist attacks, DHS' National Cyber 
Security Division (NCSD) has the authority and mission to correlate 
cyber threat and vulnerability information. The NCSD performs this 
correlation within the Division in a collaborative effort between the 
US-CERT Operations branch and the Law Enforcement/Intel branch as the 
lead entities but also in collaboration with other Divisions in the 
Office of Infrastructure Protection. In addition, as part of the 
National Infrastructure Protection Plan (NIPP), NCSD is responsible 
for: (1) conducting risk assessments and determining the necessary 
protective measures for the information technology industry, and (2) 
providing guidance to the sector specific agencies with responsibility 
for other critical infrastructure sectors on how to incorporate cyber-
related vulnerabilities into their vulnerability assessments.
    NCSD regularly shares information with key stakeholders within DHS, 
including the Homeland Security Operations Center (HSOC) through 
existing daily conference calls or targeted communications, IAIP, and 
other components as appropriate as well as with interagency partners 
through the NCRCG, GFIRST, and the Chief Information Security Officer 
(CISO) Forum. As information is cleared through classification 
procedures, NCSD also shares information with the private sector 
through appropriate channels, including the ISACs, the HSIN/US-CERT 
Portal , and the US-CERT NCAS. The public at large can also access 
information provided through the NCAS as well as the US-CERT public 
website. In the event that a cyber threat rises to the level of 
national security, the public will be informed through the Homeland 
Security Advisory System (HSAS).

2. Coordination for Cyber Advisories and Warnings
        a. What organization within DHS is responsible for managing and 
        issuing cyber advisories and warnings?
    Through its mission to serve as a national focal point for cyber 
security issues and to implement the National Strategy to Secure 
Cyberspace, NCSD is responsible for managing and issuing cyber 
advisories and warnings. Those advisories and warnings are issued to 
the public and our partners through the NCAS and to specific entities 
on an as-needed basis in the case of a targeted vulnerability or 
threat. Information that is less sensitive and for wider distribution 
is disseminated through the US-CERT public website and the US-CERT 
secure online portal, as appropriate.
        b. How will DHS integrate cyber advisories and warnings into 
        the existing Homeland Security Advisory System (HSAS), given 
        that cyber has a unique audience, particularly when those 
        people who must respond to an attack are not the traditional 
        First Responders used for physical national disasters?
    NCSD provides information for use in the HSAS to be activated as 
appropriate. However, the nature of cyber attacks is that there are 
varying degrees of cyber activity at any given time that warrant 
advisory to the cyberspace stakeholder community that does not meet the 
criteria for raising the national alert status through the HSAS. 
Therefore, US-CERT utilizes the NCAS to notify the entire national, and 
international stakeholder community about activities that may warrant 
specific protective measures but that do not rise to the national 
security level of the HSAS. US-CERT is reaching out to key partners for 
incident response at various levels of sensitivity or urgency through 
the NCAS, the US-CERT secure online portal, the NCRCG, and the US-CERT 
public website to communicate with cyber ``first responders'' and other 
stakeholders.
    In the event of a cyber incident of national significance (or an 
incident with both physical and cyber implications), the NCSD/US-CERT 
and/or NCRCG will provide analysis and recommendations to the IIMG or 
to the Secretary to help inform a decision about whether to raise the 
national alert level,
        c. How is the cyber threat and warning mission being integrated 
        into the Homeland Security Operations Center (HSOC)?
    US-CERT communicates regularly with the HSOC on cyber security 
issues, including participation in daily conference calls and regular 
e-mail and other correspondence. In addition, the NCSD shares the 
staffing of a 24x7 Infrastructure Protection desk at the HSOC that has 
direct reach back to the US-CERT for coordinated action as appropriate.
        d. How will DHS work with other countries when responding to a 
        cyber attack, given that most attacks have effects on 
        information systems around the world?
    Cyberspace transcends traditional borders and we recognize our 
international outreach is crucial to protecting ourselves. As such, DHS 
is active in a number of multilateral and bilateral activities 
addressing cyber security issues such as early warning, response, and 
information sharing. NCSD and US-CERT are reaching out to other 
countries to form strategic partnerships that we will be able to 
leverage in the case of a cyber attack. US-CERT is a member of the 
Forum for Incident Response Security Teams (FIRST), an international 
coalition of government, commercial, and academic organizations that 
aims to foster cooperation and coordination in incident prevention, 
prompt rapid reaction to incidents, and promote information sharing 
among members and the community at large. FIRST is one way that US-CERT 
works with computer security incident response teams (CSIRTs) in other 
countries when needed to share information, best practices, and 
experiences. US-CERT also communicates and collaborates with other 
CSIRTs directly.
    For example, NCSD and US-CERT participate in the cyber security 
efforts of the Asia Pacific Economic Cooperation (APEC), the 
Organization for American States (OAS), and the Organization for 
Economic Cooperation and Development (OECD). Their respective programs 
seek to raise awareness about cyber security, provide technical 
assistance and capacity building for emergency response teams, help 
develop trusted relationships between response teams, and to build a 
global ``culture of security.''
    On an operational basis, the NCSD and US-CERT are developing closer 
ties with the so-called ``Five-Eyes'' countries (United States, United 
Kingdom, Canada, Australia, and New Zealand), as well as other 
countries with key operational capability and interest through 
information sharing and cooperative mechanisms. The objective is to 
forge trusted relationships with our counterpart organizations abroad 
and develop the basis for a coordinated response in a cyber incident or 
attack. We seek and have created opportunities to build those 
relationships in a number of international forums and activities. The 
most recent example was the multilateral conference on cyber security 
that DHS/NCSD co-hosted with the German Ministry of the Interior in 
Berlin in October 2004. Government policy makers, managers of CSIRTs 
with national responsibility, and law enforcement representatives from 
fifteen countries in Europe, Asia Pacific, and the Americas 
participated in the conference. The conference focused on developing a 
framework for cyber information sharing and incident response, and 
included a tabletop exercise to examine international communication and 
collaboration channels as well as interactive sessions on international 
information sharing and incident response. The participants agreed to 
an initial framework for cyber information sharing and incident 
response by identifying points of contact cyber information sharing 
actions in the short term and, and are forming a cooperative mechanism 
to build a more mature framework in the longer term.

3. Framework
        a. Is DHS developing a cybersecurity framework for public and 
        private use and what is the status?
    The cyber security framework for the nation is the National 
Strategy to Secure Cyberspace issued by President Bush in February 
2003. The Strategy put forth a framework of five priorities for all 
stakeholders in protecting our nation's information infrastructure and 
provided a roadmap for both the private and public sectors to undertake 
toward a more secure cyberspace. DHS is well on our way to implementing 
the Strategy with our counterpart agencies throughout the government 
and are actively partnering with the private sector to work 
collaboratively and create a set of public milestones to measure 
progress. We have consolidated and are leveraging existing programs and 
have identified new ones toward meeting the mandate of the Strategy.
        b. What elements are being included in this framework? At a 
        minimum, please include an update for benchmarks, standards, 
        best practices, common criteria and other elements as 
        appropriate.
    The elements of the framework are set out in the Strategy's five 
priorities:
        Priority I:A National Cyberspace Security Response System
        Priority II: A National Cyberspace Security Threat and 
        Vulnerability Reduction Program
        Priority III: A National Cyberspace Security Awareness and 
        Training Program
        Priority IV: Securing Government's Cyberspace
        Priority V:National Security and International Cyberspace 
        Security Cooperation
    Key elements of our program to meet the mandate of the Strategy are 
as follow:
        US-CERT--established a 24x7 cyber watch and warning operation 
        with a secure online portal for collaboration, information 
        dissemination, and information exchange;
        US-CERT Outreach--establishing regular communication and 
        collaboration mechanisms such as US-CERT Portal, US-CERT public 
        website, NCAS and other activities to reach critical 
        infrastructure sectors, software developers, academia, 
        government entities, and other stakeholders.
        Strategic Initiatives--identification of cyber security 
        programs for the long term, including software assurance, 
        research and development, exercises, training, and education.
        Law Enforcement and Intelligence Coordination--NCSD works with 
        key parties in the law enforcement and intelligence communities 
        to leverage information and coordinate response to cyber 
        security threats and events.
    NCSD has identified a set of goals, corresponding objectives, and 
programs and initiatives to further these goals that map to the five 
priorities of the National Strategy. NCSD is working to develop a set 
of specific milestones to measure progress toward the goals articulated 
in the following strategic framework:

----------------------------------------------------------------------------------------------------------------
                     PRIORITY                                                NCSD GOALS
----------------------------------------------------------------------------------------------------------------
I. National Cyberspace Security Response System     #1 Prevent, predict, detect, and respond to cyber incidents,
                                                     and reconstitute rapidly after cyber incidents
----------------------------------------------------------------------------------------------------------------
II. National Cyberspace Threat and Vulnerability    #2 Work with public and private sectors to reduce
                                                     vulnerabilities and minimize the severity of cyber attacks
Reduction Program                                   #4 Coordinate with the Intelligence and law enforcement
                                                     communities to identify and reduce threats to Cyberspace
----------------------------------------------------------------------------------------------------------------
III. National Cyberspace Security Awareness and     #3 Educate and encourage Americans to secure their
 Training Program                                    cyberspace thought a National awareness and training
                                                     campaign
----------------------------------------------------------------------------------------------------------------
IV. Securing Governments' Cyberspace                #1 Prevent, predict, detect, and respond to cyber incidents,
                                                     and reconstitute rapidly after cyber incidents
                                                    #2 Work with public and private sectors to reduce
                                                     vulnerabilities and minimize the severity of cyber attacks
----------------------------------------------------------------------------------------------------------------
V. International Cyberspace Security Cooperation    #1 Prevent, predict, detect, and respond to cyber incidents,
                                                     and reconstitute rapidly after cyber incidents
----------------------------------------------------------------------------------------------------------------
Common to All Priorities                            #5 Build an effective organization
----------------------------------------------------------------------------------------------------------------

    NCSD has various opportunities and obligations to report to 
Congress on its programs and activities and will continue to do so as 
requested and on a timely basis.
        c. How will progress and compliance with voluntary standards 
        and the framework be measured and certified, particularly in 
        the private sector, which owns and operates most of the 
        critical information infrastructure?
    The private sector has a large role in increasing our nation's 
cyber security, and they are acting upon that responsibility. Private 
sector associations formed the National Cyber Security Partnership 
(NCSP) and are expanding it to include over 20 associations. NCSD is 
participating in meetings of the NCSP and others to encourage the 
articulation of a set of priority milestones for implementation of the 
priorities of the National Strategy that can track progress by the 
private sector and government.
        d. What incentives will be provided, or are needed, in order to 
        have government and industry adopt this cybersecurity 
        framework?
    Much of the Strategy calls for information sharing between the 
private and public sectors. Historically, companies and other entities 
have had concerns about the confidentiality of information shared with 
the federal government, either independently or through a mechanism 
such as the ISACs. Congress enacted the Critical Infrastructure 
Information Protection Act as part of the Homeland Security Act of 2002 
to facilitate sharing of the most valuable information about 
capabilities, threats, vulnerabilities, and deterrence programs 
possible. The law granted an exemption for voluntarily submitted 
critical infrastructure information from the Freedom of Information Act 
(FOIA) and state sunshine laws. To implement the law, DHS has created 
and led a working group to develop regulations and procedures for 
receipt, disposition, and use of Protected Critical Infrastructure 
Information (PCII). In February 2004, DHS created the PCII Program 
Office, which has developed rigorous safeguarding and handling 
procedures to manage the information flow and prevent unauthorized 
access to information submitted under the PCII program.
    Separately, the market demand for cyber security presents a 
significant incentive for both government and industry to adopt the 
approach laid out in the Strategy.
        e. The National Institute of Standards and Technology (NIST) 
        has been active in developing cybersecurity requirements for 
        industrial control systems. Are these activities being included 
        in DHS efforts to develop cybersecurity standards? How will DHS 
        capitalize on these activities to decrease the vulnerability of 
        privately owned critical infrastructure?
    Yes, the National Institute of Standards and Technology (NIST) 
efforts to develop cyber security requirements for industrial control 
systems have been included in DHS' efforts to develop cyber security 
standards, particularly in NCSD's effort to develop a control systems 
framework.
    The control systems framework will build upon the work already 
completed by the NIST-sponsored Process Control Security Requirements 
Forum (PCSRF) and developed in compliance with the ISO 15408 
requirements definition language (Common Criteria) to allow for 
international acceptance.
    PCSRF has already developed a system protection profile for 
industrial control systems? components that serves as an appropriate 
starting point for this effort. Work continues on the profile, and once 
the reference components are defined, a vulnerability analysis will be 
conducted to enumerate the relevant operational security requirements 
for each class of component. These requirements will then be mapped to 
a set of security controls based on specific assurance levels and the 
criticality of the site in terms of impact on critical infrastructure, 
economic impact and/or potential loss of life due to an environmental 
manifestation of a successful cyber attack on a control system. Once 
this definition is complete, specific recommendations will be made to 
implement the appropriate security controls in each environment.
    Currently there is a lack of specific guidance in the standards 
that are being developed for operational control systems 
implementations. NCSD will continue to work with the standards bodies 
and industry to define any specific sector operational requirements, 
and then to offer rigorously defined security requirements and specific 
recommendations for security and/or mitigation back to the standards 
bodies and to industry.
    In addition to the framework, DHS has invested funds to augment the 
existing testing capability of the National Supervisory Control and 
Data Acquisition (SCADA) Testbed officially launched in May 2004 and 
run jointly by the Idaho National Environmental and Engineering 
Laboratory (INEEL) and Sandia. The National SCADA Testbed is aimed at 
SCADA systems only and aimed strictly at developing the capabilities to 
test energy sector systems. DHS' test center operates hand-in-hand with 
the SCADA Testbed, but the DHS effort is focused on the non-energy 
sectors and is trying to work with other existing private and public 
testbeds as to leverage their efforts and avoid duplication. The DHS 
Control Systems Security and Test Center (CSSTC) and the National SCADA 
Testbed was officially opened in August 2004.
    Finally, with regard to control systems, NCSD is developing a 
control systems risk/impact decision tool that the US-CERT will be able 
to use for analysis and vulnerability evaluation for control systems.

4. Management
        a. How is DHS distinguishing cybersecurity roles and 
        responsibilities internally, e.g., NCSD, CIO, TSA, Secret 
        Service, NCS, and others?
    By virtue of the mandate provided in HSPD #7, NCSD has been given 
the mandate to ``facilitate interactions and collaborations between and 
among Federal departments and agencies, State and local governments, 
the private sector, academia and international organizations.'' As 
such, NCSD is a national focal point for the public and private sectors 
on cyber security issues and it is responsible for coordinating the 
implementation of the National Strategy to Secure Cyberspace. NCSD 
recognizes that each of these entities may bring unique capabilities, 
responsibilities and/or authorities to bear on cyber security issues, 
and as such, NCSD must act as a coordinating body to ensure that these 
entities are acting in concert.
    When dealing with the internal DHS information systems, the DHS CIO 
has the responsibility and authority to implement and assure the 
security of such systems. NCSD ensures that the office of the CIO is 
kept informed of the latest cyber threats and is provided with timely, 
actionable information to take steps to protect DHS systems from 
emerging malicious code occurrences.
    The National Cyber Response Coordinating Group (NCRCG; previously 
known as the Cyber Interagency Incident Management Group) will 
coordinate interagency preparedness and operations to respond to, and 
recover from, cyber incidents and attacks. The role of the NCRCG is 
discussed in the Cyber Annex to the National Response Plan. The group 
brings together senior officials from DHS, law enforcement, defense, 
intelligence, and other government agencies that maintain significant 
cyber security capabilities. The combination of these officials/
agencies provides the capability to analyze and coordinate a national 
level response to any incident that affects cyber assets. In addition 
to the ability to focus portions of their agencies? resources, they 
possess the necessary statutory authority to act.
    The National Communications System (NCS) is responsible for 
coordination of the planning for and provision of national security and 
emergency preparedness communications for the Federal government under 
all circumstances. National security and emergency preparedness (NS/EP) 
telecommunications services are those that are used to maintain a state 
of readiness or to respond to and manage any event or crisis that 
causes or could cause injury or harm to the population, damage to or 
loss of property, or degrade or threaten the NS/EP of the United 
States. Both the NCS and NCSD report to the Assistant Secretary for 
Infrastructure Protection, which allows for close coordination on those 
cybersecurity issues that impact each organization.
    The draft National Response Plan (NRP) is a set of defined 
processes that will bring together several DHS functions for cyber 
security. The Cyber Incident Annex of the NRP, as developed by NCSD in 
coordination with the NCRCG, establishes procedures for a coordinated, 
multidisciplinary, broad-based approach to prepare for, respond to, and 
recovery from cyber Incidents of National Significance impacting 
critical national processes and the national economy. For physical 
incidents, Emergency Support Function 2 (ESF #2)--with NCS as 
coordinating agency--would coordinate Federal actions to restore 
backbone connectivity for the Internet and provide priority service to 
NS/EP users. The draft National Response Plan includes tie-ins between 
ESF #2 and the Cyber Incident Annex to ensure these functions stay 
coordinated, which has been operationalized by cross-membership across 
the NCS, NCRCG and the Interagency Incident Management Group (IIMG).
    Various DHS components, including Immigration and Customs 
Enforcement (ICE) and the Secret Service have statutory responsibility 
for investigating cyber crimes. DHS through NCSD has assumed a 
supporting role in this area. Among the efforts that have been 
undertaken are, the support and administration of the Cyber Cop Portal, 
the co-sponsorship (with the Department of Justice) of the first 
statistically valid survey of cyber crime in the US, and the initiation 
of a number of joint meetings to address the issue of cyber attack 
attribution.
    The Cyber Cop Portal is one of the oldest and most widely used 
mechanisms for sharing information in the electronic crimes community. 
It consists of over 5,300 members from all 50 states and over 40 
countries. Its growth and use brought it to the point where it could no 
longer be maintained as a voluntary part time project, and it was in 
danger of being shut off. NCSD has decided to sponsor and administer 
the portal.
    NCSD has agreed to provide funding and support to the DOJ Bureau of 
Justice Statistics to assist in the first ever statistically valid 
survey of cyber crime in the United States. The effort will involve 
questionnaires to over 36,000 US businesses covering all critical 
infrastructure sectors. The results of the survey will provide law 
enforcement and policy makers with a better understanding of the 
problem and how to allocate resources.
    One key component in the ability to effectively respond to cyber 
attacks is attribution, determining the source of the attack. This is 
also one of the most difficult aspects of cyber attack investigations. 
The solution to the problem is not found in any one community of 
interest, but across a broad spectrum of disciplines (Intelligence, 
Counter Intelligence, Law Enforcement, private industry, etc.). Under 
the auspices of the NCRCG, and in conjunction with DOJ, a number of 
attribution meetings have been held or are being planned. These 
meetings are designed to develop an overall picture of the state of 
attribution throughout the various communities, and then to develop a 
plan to improve it. The plan is due during the second quarter of FY05.
        b. What measures have been taken to elevate the importance of 
        cybersecurity within the overall mission of DHS and to improve 
        public awareness of cybersecurity issues? Specifically, should 
        cybersecurity be a part of ``READY.GOV'' public web site to 
        make Americans more aware of cybersecurity needs?
    Cyber security is a priority issue for DHS and the mission for 
NCSD. We are improving public awareness of cyber security issues 
through the US-CERT public website and the NCAS launched in January 
2004 as well as through our engagement in the National Cyber Security 
Alliance's Stay Safe Online campaign, our Outreach and Awareness 
branch, and our partnership with the MS-ISAC to reach state and local 
government. The US-CERT public website provides information on cyber 
security issues, cyber activity, and cyber vulnerabilities. NCAS is our 
primary mechanism for communicating with the public on cyber alerts, 
security tips, and other useful notifications. We are pursuing ways to 
reach as many Americans as possible through the website, awareness 
campaigns, and the NCAS as well as other public awareness efforts.
    DHS is currently expanding the Ready campaign and is developing 
Ready for Business and Ready for Kids. Ready for Business is designed 
to help small to medium business owners safeguard their business 
operations in the event of a terrorist attack or other emergency.
    Preliminary messages for the campaign center around three key 
themes: Ensuring Business Continuity, Safeguarding and Preparing Your 
Employees, and Safeguarding your Computer Systems (cyber security). The 
third theme will help businesses owners understand better the need for 
cyber security and also how to achieve it. It will encompass topics 
such as how to prevent computer viruses, how to detect computer 
viruses, how to preserve and back-up computer data, and how to prevent 
hacker intrusion.
    DHS is working with the Advertising Council to develop content and 
messages that will inform and motivate business owners to take action. 
The messages will be distributed through a variety of vehicles that 
will target business owners and operators.
        c. Some have suggested that the NCSD should be elevated within 
        the DHS organization--either as a direct report to the 
        Secretary Ridge or to the Under Secretary for Information 
        Analysis and Infrastructure Protection. What is the 
        Department's view of such a change?
    The Department is working closely with the Homeland Security 
Council to evaluate this and other policy and organizational options 
related to elevating and expanding the current role of the NCSD.

5. Wireless Funding
        a. The National Communications System program budget for 
        Wireless Priority Service is $78M. The office of the Chief 
        Information Officer (CIO) includes funding for wireless 
        activities at $100M. How are your office, the CIO, and Science 
        and Technology Directorate working together on developing these 
        programs?
    In summary, each program has a very distinct mission employing 
different technologies. DHS/IAIP recognizes the need to continually 
assess opportunities to insure integration of communications as well as 
efficiencies of programs. DHS has established forums for the review and 
ultimate execution of such a strategy and is coordinating all of its 
programs efforts. The IAIP NCS is an inter-agency body responsible 
(through E.O. 12472) to support the President in providing priority 
telecommunications services across federal, state and local entities 
that assures the greatest opportunity to communicate during all crises. 
The NCS Wireless Priority Service (WPS) program was directed by the 
National Security Council and subsequently authorized by the FCC. WPS 
is a National Security/Emergency Preparedness (NS/EP) priority service 
program utilizing based in the commercial/public cellular networks for 
designated Federal, State, Local and critical infrastructure owner 
leadership. The DHS CIO office focuses on managing the wireless assets 
for the department with a significant focus on the private Land Mobile 
Radio (LMR) network users of the federal entities transferred to DHS. 
They are also engaged with DOJ in leveraging its capabilities and 
development of LMR interoperable communications for the Federal law 
enforcement community. In terms of coordination, the NCS programs, 
through exhibits 300, are reviewed and approved by the DHS CIO office. 
The CIO office also has established a wireless management working group 
which IAIP NCS participates in regularly to review technology issues 
and evolution as well as identify areas that will create efficiencies 
of all programs. A primary long term objective, in addition to assuring 
interoperability of DHS assets, is to integrate WPS capabilities with 
all wireless solutions as technology enables.
    IAIP, DHS' CIO Office and the S&T Directorate, along with other 
Directorates, also work together on common interoperability challenges 
through the Department's new Office of Interoperability and 
Compatibility. This Office, housed within the S&T Directorate, was 
created to coordinate the multiple interoperability efforts and needs 
of the Department as well as look to leveraging the vast range of 
interoperability programs and efforts within the Federal government. 
Additionally, the DHS S&T Directorate manages the SAFECOM Project 
charged with partnering with state and local governments to improve the 
interoperability of federal, state and local LMR communications for 
first responders. In this area as well, IAIP support to DHS S&T through 
participation and review of Project SAFECOM activities, includes 
assuring that the WPS can effectively interoperate with Project SAFECOM 
solutions as technology dependency eases to a more open environment.
        b. Describe how First Responders will be able to benefit from 
        the results of these efforts.
    First Responders are increasing their dependence on wireless 
communications for command and control during emergency operations. The 
WPS program provides government and private sector leadership, such as 
incident commanders, with priority access to the public cellular 
infrastructure. The WPS link improves the commander's ability to 
receive reports from and give instructions to First Responder teams and 
other supporting organizations. Without the WPS link, command and 
control could be degraded because of cellular call-congestion in the 
vicinity of the incident/ emergency for all government and private 
sector leadership.
    Deployment of WPS across the wireless industry is essential to a 
full public network based emergency capability for response as well as 
COOP and COG needs. WPS is the cellular augmentation of the Government 
Emergency Telecommunications Service (GETS). It is anticipated that in 
the future technology will enable the integration of these capabilities 
with the interoperable Land Mobile Radio (LMR) private systems employed 
by the broad based first responder community.

                 Questions From Congressman Jim Turner

    1. When the National Cyber Security Division (NCSD) was created in 
June of last summer, the Department announced it would build upon the 
existing capabilities of several agencies with cyber responsibilities 
transferred to DHS, including the National Communications System (NCS). 
The NCS, however, has remained separate from the NCSD. Yet, the NCS 
remains responsible for several cybersecurity initiatives, including 
the ``Network Security Information Exchanges (NSIE)'' and the ``Cyber 
Warning Information Network.'' The proposed budget continues to keep 
the NCS activities separate from the NCSD. Isn't it counterproductive 
to have so many core cyber functions outside the National Cyber 
Security Division? Wasn't the creation of the National Cyber Security 
Division intended to provide a focal point for cyber security threat 
and vulnerability assessment, as well as information sharing, within 
the Department?
    The June 2003 DHS announcement forming the NCSD was not intended to 
suggest that NCS would be fully absorbed into NCSD. The NCS is an 
interagency organization formed under Executive order 12472 to support 
the President in the provision of National Security/Emergency 
Preparedness (NS/EP) Telecommunications meeting the need of the federal 
government under all wartime and non-wartime crisis conditions. This is 
a critical mission that now addresses infrastructure protection issues 
in addition to its traditional COOP/COG focus.
    The NSIE referenced in the question is a government and industry 
effort initiated under the auspices of the President's National 
Security Telecommunications Advisory Committee (NSTAC) and is managed 
through the NCS National Coordinating Center for Telecommunications 
(NCC). It addresses a very broad range of security issues potentially 
affecting the telecommunications infrastructure. Cyber security is only 
one component of these issues and the NCSD sits on the NSIE to address 
these matters. Also referenced in the question is the Cyber Warning 
Information Network (CWIN). When first envisioned, this private network 
was focused on the cyber arena, as the development of the US-CERT 
became firm and with further analysis, IP recognized that this 
capability had far more utility than originally intended. CWIN is 
intended to provide information and warnings across all infrastructures 
to our State, local, and industry partners. CWIN has been transferred 
to the IP Infrastructure Coordination Division (ICD) where it will 
support the cross-sector needs for all IP divisions.
    In order to facilitate coordination between these elements, 
Infrastructure Protection is currently building out a watch center 
facility, the National Information Coordination Center (NICC) that will 
include NCSD, US-CERT, NCS, and ICD. Co-locating these groups on in a 
single watch center facility will facilitate the fast and efficient 
sharing of information. Initial move in to this facility is scheduled 
for the first quarter of 2005.
    2. The IAIP budget includes a $1.9 million increase for conducting 
cyber exercises such as ``Live Wire,'' which was a simulation of a 
terrorist attack on computer, banking, and utility systems. There are, 
however, existing cyber exercises that are up-and-running. Over two 
years--since before the Department was created--the city of San Antonio 
planned and conducted ``Operation Dark Screen,'' a cyber terrorism 
exercise that involved both the public and private sector and was 
designed to help the city defend and respond to a cyber attack. Even 
within the Department, the Secret Service is reaching out to the 
private sector and supporting table-top exercises to address the 
security of private infrastructures. What is the IAIP Directorate doing 
to integrate and coordinate with existing cyberexercises such as these? 
How much of the requested $1.9 million will go towards these existing 
exercises that have been tested and proven? In addition, what is DHS 
doing to ensure that our local communities and towns, who will provide 
the cyber-first responders in the time of crisis, are prepared? Isn't 
it true that there is no individual entity or individual within IAIP 
responsible for coordinating all of the cyberexercises being put on by 
the government and, as a result, there may be duplicative efforts?
    Whereas the first responder and emergency management communities 
have been exercising at national, regional, and local levels for many 
years, the cyber response community is quickly catching up. The U.S. 
Government has an active program of exercises to assess preparedness 
and processes in the event of an attack on the Nation. DHS has 
established a National Exercise Program Office (NEP) to coordinate 
scheduling and participation in the exercises sponsored by various 
agencies. The IAIP Directorate is coordinating its exercise planning 
with the NEP, which is the responsibility of the DHS Office of Domestic 
Preparedness. The IAIP Under Secretary's Office has an Exercise 
Management Program (EMP) that maintains regular contact with members of 
the exercise community and coordinates with the NEP to facilitate the 
Directorate's participation in exercises. NCSD's coordination efforts 
entail scheduling cyber security exercises with NEP as well as 
integrating cyber scenario components into other planned exercises as 
appropriate. These coordination efforts with NEP assist in minimizing 
the duplication of exercise efforts.
    NCSD's involvement in the NEP is guided by two principles: (1) 
while cyber is only one element of a multifaceted NEP, cyber elements 
must be closely coordinated with other elements of that program to 
ensure efficient use of limited resources and the most effective return 
on exercise investments; (2) cyber exercise elements must not be 
sidelined or relegated to an ``afterthought'' category within the NEP.
    In October 2003, numerous federal agencies participated in 
Livewire, the first ever national-level cyber exercise to baseline our 
capabilities for responding to national cyber attack. The exercise 
involved more than 300 participants representing more than 50 
organizations across the federal, state, and local governments, as well 
as the private sector. Cyber attack simulation scenarios were developed 
to stress cyber interdependencies across America's critical 
infrastructures and baseline government agencies' abilities to 
collaborate across the public and private sectors. Information gleaned 
from Livewire and similar exercises aimed at ensuring security of 
critical infrastructures are being used to improve our national 
incident response processes.
    While Livewire brought together a number of players for a large-
scale event simulation, other exercises target specific areas or agency 
concerns. For example, the United States Secret Service's (USSS) 
Electronic Crimes Task Forces (ECTFs) have been running smaller 
regional and sector-specific tabletop exercises over the past eighteen 
months. These exercises are designed to help coordinate efforts in a 
targeted geographic area and are tailored to a specific regional 
infrastructure, such as the energy industry in Houston, TX, the high-
technology industry in San Francisco, CA, and the banking and finance 
industry in Charlotte, NC. In February 2004, the National Defense 
University ran its Dark Portal exercise and in August 2004, a cyber 
security workshop co-hosted by NCSD and the National Security Council 
was held at the National Defense University. This tabletop workshop 
exercise included members of the National Cyber Response Coordination 
Group (NCRCG), as well as multi-agency key decision makers in the U.S. 
Government cyber security realm.
    NCSD has sponsored several exercises that test cyber readiness in 
various geographic locations and critical infrastructure sectors across 
the Nation. In September and October 2004, a series of regional 
exercises were held in Seattle, WA (Blue Cascades II) and New Orleans, 
LA (Purple Crescent II). Both exercises were successful in highlighting 
dependencies between cyber and physical infrastructures and 
interdependencies among critical infrastructures. These exercises also 
identified and tested the coordination and cooperation among federal, 
state, and local governments with the private sector in the case of 
attacks (both cyber and physical) on the critical infrastructures in 
those regions of the U.S. In addition, each of the exercises 
illustrated the need to continue to provide outreach and cyber 
education to local emergency management and physical security 
professionals as well as identify and improve shortfalls in emergency 
preparedness.
    DHS EMP serves as the lead organization in the development, 
facilitation and participation of a week-long, cabinet-level national 
exercise (``TOPOFF3'') to be held in the summer of 2005. These national 
exercise programs occur every two years and involve the same basic set 
of participants. The exercise for TOPOFF3 represents a joint physical 
and cyber scenario, with NCSD leading the development of the cyber 
component for the exercise. It will test not only response to attacks, 
but also continuity of government and operations, emergency response at 
the state, regional and local levels, and containment and mitigation of 
chemical, nuclear, and other attacks, etc. NCSD is also working with 
DHS to ensure a more prominent cyber component in the follow-on TOPOFF 
series of exercises for 2007 and beyond.
    The lessons learned from these and other exercises will form the 
backdrop for an NCSD-sponsored National Cyber Exercise planned for 
November 2005. Planning activities are currently underway with initial 
groundwork already laid for this effort. In September 2004, a key 
stakeholder meeting was held to discuss the scope and objectives with 
critical infrastructure sector lead agencies. NCSD is in the process of 
planning the Initial Planning Conference (IPC) for the National Cyber 
Exercise that will include representatives from various government 
agencies and the private sector. The IPC will allow the opportunity for 
the stakeholders to establish clear and concise goals and objectives 
for the National Cyber Exercise as well as to discuss and develop 
possible scenarios.

    The objectives of the National Cyber Exercise are to:
        1. Sensitize a diverse constituency of private and public-
        sector decision-makers to a variety of potential cyber threats 
        including strategic attack;
        2. Familiarize this constituency with DHS' concept of a 
        national cyber response system and the importance of their role 
        in it; and
        3. Practice effective collaborative response to a variety of 
        cyber attack scenarios, including crisis decision-making.
        4. Provide an environment for evaluation of interagency and 
        cross-sector business processes reliant on information 
        infrastructure.
        5. Measure the progress of ongoing U.S. efforts to defend 
        against an attack.
        6. Foster improved information sharing among government 
        agencies and between government and industry.
        7. Identify new technologies that could provide earlier warning 
        of attacks.
        8. Define the roles and responsibilities of government agencies 
        and industry.

    Questions for Chief Officer Steven Cooper, From Congressman Mac 
                Thornberry and Congresswoman Zoe Lofgren

1. Cybersecurity Standards
    Question: a. How are technical cybersecurity standards being 
established and enforced across the Department for information 
technology purchases, processes, and practices?
    Technical Cybersecurity Standards are promulgated through the 
Technical Reference Model portion of the Department's Enterprise 
Architecture Program. There are also mature standards established 
through the Federal Information Processing Standards. The Information 
System Security Managers at the organizational elements are responsible 
for ensuring compliance with standards. In addition, regular Program 
and Acquisition reviews check for compliance with published standards.
    The Department's long-term strategic approach for the enforcement 
of information technology security standards is to verify policy and 
standards compliance during the Security Test and Evaluation phase of 
the system Certification and Accreditation (C&A) process. DHS is 
currently in the process of establishing an enterprise C&A application 
that will maintain an online repository of all C&A documentation and 
enforce the use of Department mandated C&A methodologies. This 
application will generate comprehensive system test procedures and 
processes to fully map system compliance with DHS policy and standards. 
The current status of implementing this C&A tool is that DHS has 
completed the Requirements Definition phase and product evaluation 
phase, and have an operational pilot system which has given phenomenal 
results. We expect to have a Department implementation in the near 
future.
    The Department also verifies proper implementation of policy and 
standards by
    conducting NIST 800-26 reviews of security controls in accordance 
with Office of Management and Budget Memorandum M-03-19. These reviews 
are ongoing.

    Question: b. Who sets cybersecurity requirements for the Department 
and how are they communicated to the technology developer or purveyor?
    DHS follows cybersecurity standards requirements established by the 
Committee for National Security Systems for its classified systems, and 
the Office of Management and Budget, and National Institute of 
Standards and Technology guidance for it unclassified systems. 
Additionally, mission specific requirements are promulgated through the 
internal Management Directives, as well as through the Technical 
Reference Model of the Department's Enterprise Architecture. These have 
been provided to industry in general, and are also specifically called 
out when appropriate in contracting vehicles.

    Question: c. How are cybersecurity standards requirements being 
incorporated in calls for proposals, grants or other contracting 
mechanisms?
    The DHS Science and Technology (S&T) Directorate is in the process 
of establishing a DHS-internal Cyber Security Standards Working Group. 
Within the S&T Directorate, the working group will include 
representatives from the Standards and Cyber Security R&D portfolios, 
as well as representatives from S&T's Chief Information Officer (CIO) 
group. Outside of S&T, invitations to serve on the working group have 
been extended to the DHS Office of the CIO, the National Cyber Security 
Division and the National Communications System in the Information 
Analysis and Infrastructure Protection Directorate, and the United 
States Secret Service. This group will collectively identify what cyber 
security standards requirements should be incorporated into S&T's R&D 
portfolio investment plans.

    Question: d. In what areas of cybersecurity do you see a need for 
new or better standards, benchmarks, and other elements of a 
cybersecurity framework, and what can DHS do to help implement such a 
framework?
    With new areas of technology emerging every day as well as new 
applications of existing technology, there is always a need to refine 
existing standards and promote new ones. The emergence of MPLS has 
opened many new questions and the means to securely implement reliable, 
secure wireless networks continues to be a challenge, as does the 
management of geospatial data and Law Enforcement Information. DHS 
works closely with the Federal cooperative process through bodies such 
as the National Institute of Standards and Technology and the Committee 
for National Security Systems to ensure the success of these efforts.

    Question: e. Does the office of the Chief Information Officer (CIO) 
use any cybersecurity standards and processes recommended by the 
National Cybersecurity Division (NCSD), National Institute of Standards 
and Technology (NIST), and National Security Agency (NSA) to secure the 
DHS enterprise architecture?
    To the best of our ability, all relevant standards from national 
bodies such as NIST, NSA and NCSD are applied throughout DHS. This 
includes relevant FIPS and similar standards for procurement and 
internal processes such as self assessments and Certification and 
Accreditation are explicitly standards based.

    Question: f. How does NCSD provide actionable cybersecurity 
information to the CIO to consider in its enterprise architecture 
implementation?
    DHS participates in the interagency US CERT process. As a member of 
USCIRC, DHS like all participating agencies, gets alerts, warning and 
mitigation tools in a timely manner. In addition, there is a constant 
and constructive exchange of information between the National Cyber 
Security Division and the Office of the CIO for timely notifications of 
relevant issues. Actionable items--such as those that may significantly 
compromise confidentiality or availability are given the highest 
priority for incorporation into the Department's security architecture 
which is integral to the Department's Enterprise Architecture.

2. Purchasing Power
    Question: a. What specific actions has DHS taken to improve its 
FISMA report card in order to become government model for secure 
information systems?
    DHS has implemented a COTS enterprise product to provide automated 
support for 800-26 assessments, manage FISMA metric reporting, as well 
as Department-wide Plans of Actions and Milestones (POA&M). This 
product is being used to generate a Digital Dashboard showing 
Organization Element performance metrics and overall DHS performance 
metrics, and access to this system has been made available to the OIG 
to ensure veracity of FISMA data reported by Organizational Elements. 
Access to the Digital Dashboard will be made available to senior 
management in the near future to ensure that senior managers are 
directly involved with the Department's Information Security Program. 
In the past few moths we have implemented several enhancements made to 
FISMA reporting product for improving reporting of 800-26 and C&A 
metrics. This enhancements include a) 800-26 integrity checking; 2) 
computed metrics for 800-26 assessments and C&A; capability to upload 
assessment and C&A artifacts; 4) better tracking of C&A deliverables. 
We have purchased an Enterprise license for a C&A tool (SecureInfo 
RMS). This tool has been installed on an Enterprise server and all OEs 
are currently using the tools with DHS ramping up to full mandatory 
use. The DHS baseline policy has been mapped to this tool and use of 
the tool will ensure that the C&A SRTM is mapped to DHS policy. We have 
prepared and submitted a POA&M to OMB to achieve full ATO on all 
currently reported systems by the end of July, 2005. To ensure 
continued progress we have formed a DHS security working group to focus 
on FISMA reporting and FISMA issues.

    Question: b. Many witnesses before the Subcommittee have suggested 
that a powerful tool the federal government possesses in cybersecurity 
is its buying power. Has DHS used this power to induce hardware or 
software manufacturers to provide more secure systems?
    Every new information technology contracting vehicle put into place 
by the Department includes robust security standards. Additionally, the 
Department regularly engages information technology vendors to ensure 
that strong security is integral to product development and 
implementation. Sec. 

3. Wireless Funding
    Question: a. The office of the CIO includes funding for wireless 
activities at $100M. The National Communications System (NCS) program 
budget for Wireless Priority Service is $78M. How are your office, the 
NCS, and the Science and Technology Directorate working together on 
developing these programs?
    The Wireless Management Office (WMO), within the DHS Office of the 
Chief Information Officer, is mandated to lead and coordinate the 
Department's programs, projects, and initiatives that involve the 
wireless transport of information, including voice, data, and 
multimedia. The WMO's mission, ``To be the model program office, 
providing state-of-the art wireless capabilities to preserve our 
freedoms and protect America,'' serves to focus and provide direction 
for the program's activities and services to ensure the effective use 
of wireless technologies across the Department's organizational 
elements. As part of its mission, the WMO integrates its activities 
with the National Communications System (NCS) and the wireless 
initiatives of S&T to meet evolving homeland security requirements. The 
WMO is primarily focused on wireless communications to support internal 
DHS missions. The NCS is responsible for directing the Wireless 
Priority Service program which supports commercial, private sector 
wireless capabilities.
    The WMO is working with NCS and the DHS S&T Directorate in 
implementing program activities through groups such as the Wireless 
Working Group (WWG). The WWG is a coordination body established to 
ensure DHS-wide approaches to wireless communications are developed and 
implemented in an integrated manner. The WMO chairs the WWG, which is 
composed of 80 representatives from all of the DHS organizational 
elements with wireless communications as part of their mission. The 
majority of the WMO's coordination with the NCS and DHS S&T occurs 
through its participation on the WWG to collect DHS organizational 
elements wireless requirements, coordinate resource utilization, and 
ensure organizational elements play an integrated roll in centralized 
DHS wireless concepts (e.g., system designs, user requirements, 
operational concepts, procurement contracts). This collaborative 
approach is consistent with the Department's customer service strategy 
and allows for on-going feedback and confirmation that the WMO is 
adequately addressing the needs of its customers and stakeholders.
    Question: b. Describe how First Responders will be able to benefit 
from the results of these efforts.
    The activities of the WMO, in partnership with DHS S&T and the NCS, 
directly benefits first responders at all levels of the government by 
equipping them with the wireless capabilities to fulfill their missions 
of protecting the homeland. By building strong relationships that 
foster increased coordination among first responders, enabling and 
enhancing their wireless capabilities, the DHS WMO--in coordination 
with DHS S&T and NCS--are achieving several objectives to the benefit 
of first responders, including--
        - Implementing integrated, nationwide tactical communications 
        capabilities for DHS organizational elements and other public 
        safety first responders
        - Providing technical assistance and implementation of wireless 
        enhancements
        - Advancing the use of emerging wireless technologies among 
        first responders
    These objectives are being met through several major initiatives 
supported by the WMO and coordinated with DHS S&T and the NCS.
    Integrated Wireless Network (IWN): The mission of the Integrated 
Wireless Network (IWN) project is to provide a consolidated, nationwide 
approach to reliable, seamless, interoperable wireless communications 
to support federal agencies and officers engaged in the conduct of law 
enforcement, protective services, homeland defense, and disaster 
response within the Departments of Homeland Security, Justice, and 
Treasury. The IWN will serve as the day-to-day tactical communications 
network for the DHS, Justice, and Treasury user community, as well as 
for those within DHS and Treasury, replacing outdated and antiquated 
legacy communications systems. As a result, the IWN, in every sense, 
will serve as the lifeline that directly supports the wireless 
communications capabilities of first responders.
    The IWN represents an investment in voice and data communications 
technologies, the completed system will establish a 24 x 7 
communications network, complete with support services that will 
include major disaster recovery and contingency capabilities (e.g. 
system back-up). A centrally managed and coordinated approach to this 
initiative ensures that common, standards-compliant technologies are 
procured, thereby fostering interoperability between and among federal 
agencies for more effective and efficient enforcement activities, as 
well as provisioning communications interoperability with our state and 
local partners for event management and crisis response.
    G4High Risk Metropolitan Areas Interoperability Project: With the 
demand for improved intergovernmental communications necessitated by 
homeland security concerns, federal agents must increasingly 
interoperate with other federal, state, and local public safety 
entities. The project was initiated to improve federal interoperability 
with local first responders in the highest threat areas across the 
country. The project is being implemented in coordination with the 
interoperability efforts of the WMO, SAFECOM, and the Office of 
Domestic Preparedness (ODP).
    WMO Sponsored Projects: The WMO is supporting several projects that 
are improving the wireless communications capabilities of agencies at 
all levels of the government.
    DC Broadband Project: The District of Columbia is currently 
implementing a cost-effective, high-speed, wide area, wireless data 
network that will permit the use of interoperable, broadband, wireless 
data applications for public safety communications. This network will 
allow first responders in the NCS to use full-motion, high-resolution 
video monitoring and other bandwidth-intensive monitoring tools to 
immediately share time-critical incident and emergency event 
information.
    This will enhance regional and federal first responder 
capabilities. It will also provide accurate interoperability usage 
profiles and results, collect data on network performance (data 
throughput, coverage, latency, and effective of spread spectrum 
technologies), and implement public safety application requirements and 
operations improvements.
    Phoenix Mesa Interoperability Project: This project provides an 
opportunity for the WMO to partner with state and local agencies and 
build upon existing communications system infrastructure. The WMO plans 
to leverage this existing system by installing federal very high 
frequency (VHF) trunked repeaters at select locally-owned radio 
frequency (RF) sites. The project should result in several key 
benefits, including the demonstration of an innovative application that 
can be replicated across the country, providing potential long-term 
cost savings for IWN implementation, and serving as a model for 
coordination and partnerships among federal, state, and local agencies 
and first responders.
    The primary goal of the project is to demonstrate the feasibility 
of local and federal agencies utilizing common infrastructure while 
operating within different frequency bands. To accomplish this goal, 
the WMO partnered with the cities of Phoenix and Mesa, Arizona, who 
were two of the first cities in the country to implement a regional 
TIA/EIA-102 Project 25 800-megahertz trunked system. The installation 
of these repeaters will enable the WMO to use existing system assets 
such as shelters, towers, connectivity, and network management 
infrastructure.
    SAFECOM: Linking federal tactical communications to local, state, 
and tribal public safety first responders is critical to ensuring 
seamless, wireless communications at the scene of the incident and 
improving officer safety. In 2002, as part of the President's 
Management Agenda, the White House established SAFECOM as the umbrella 
program within the Federal Government to oversee all communication 
interoperability initiatives and projects. Through SAFECOM, the Federal 
Government is addressing public safety communications issues in a more 
coordinated, comprehensive, and effective way.
    The WMO is working with SAFECOM to improve wireless communications 
interoperability among federal, state, and local public safety first 
responders. The WMO does so by recognizing and supporting the crucial 
role of SAFECOM to the benefit of first responders to include--
         Creating and adopting standards
         Recognizing interoperability and communications issues
         Identifying current initiatives that address 
        interoperable communications issues, and
         Developing coordinated strategies to leverage work, 
        while decreasing the unnecessary duplication of efforts.
    Collectively, the programs are providing the vital link to improve 
vertical interoperability among over 100 federal agencies with public 
safety response to over 44,000 local and state first responders.
    Federal Partnership for Interoperable Communications (FPIC): The 
FPIC works to advance federal wireless communications interoperability 
across federal first responders by fostering intergovernmental 
cooperation. The FPIC pursues this mission by advancing the following 
goals to the benefit of the federal wireless community: providing 
technical and operational advice to SAFECOM and federal departments and 
agencies; educating federal users about wireless communications 
equipment, security, and operations standards and best practices; and 
coordinating wireless communications interoperability efforts within 
the Federal Government.
    As members of FPIC, the WMO and SAFECOM work to improve federal 
wireless communications first responders through standing committees 
and working groups. Standing committees--such as the Standards, 
Security, and Spectrum Standing Committees--coordinate ongoing FPIC 
activities. Working groups are established to consider, investigate, 
and/or act on a specific activity or subject area of interest to 
members. The FPIC may establish partnerships with state/local 
organizations, associations, departments, bureaus, agencies, or 
individuals as appropriate. In this way, projects of mutual concern to 
all of the wireless public safety community can be addressed in a 
cooperative manner.
    Question: 4. To what degree do the DHS enterprise architecture 
plans integrate with the federal enterprise architecture effort? How is 
DHS working with other departments to establish cybersecurity 
standards?

Support for Federal Initiatives
    EA is one of the means by which visibility into IT assets can 
enable the federal government to find business and financial 
efficiencies. Our alignment to the Office of Management and Budget 
(OMB) Federal Enterprise Architecture (FEA) continues throughout all of 
our Enterprise Architecture (EA) efforts. Our FEA and e-government 
initiatives are discussed below.

Support for the Federal Enterprise Architecture
    Our EA planning project was driven by the concepts and products of 
the OMB FEA Reference Models. We have aligned the various EA artifacts 
with the five FEA Reference Models: the Business Reference Model, the 
Data and Information Reference Model, the Service/Component Reference 
Model, the Technical Reference Model, and the Performance Reference 
Model. And, more importantly, we have embraced the two FEA foundation 
concepts: Line of Sight for program effectiveness and Component and 
Service Based Architectures for effective reuse and repeatability.
    Business Reference Model. The FEA Business Reference Model drove 
the development of our business model. Several of the Business 
Reference Model Lines of Business are directly applicable to DHS (in 
particular, Homeland Security and Disaster Management). For all other 
business activities within the DHS business value chain level, there is 
a one-to-one link to the Business Reference Model Lines of Business. 
The EA Business Model includes a matrix that shows the relationship 
between our business activities and the Business Reference Model 
Subfunctions. It is important to note that every business activity in 
the EA Business Model is mapped to a Business Reference Model Sub-
function. As a result of this alignment, OMB should be able to readily 
identify functional commonality of DHS with other federal agencies.
    Data and Information Reference Model. The Data Reference Model 
consists of a layered model for decomposing collections of information, 
from Subject Areas down to Data Objects and their properties. We 
adopted this approach and classified the information required to 
support the homeland security business activities at the Subject Area 
and Data Object levels. Further decomposition and description of the 
data objects will be performed in the next phase of the EA process. Our 
Data Architecture aligns with the Data Reference Model concepts by 
providing a common, consistent way of categorizing and describing data 
to facilitate data sharing and integration.
    Service Component Reference Model. The DHS EA project has fully 
embraced the FEA Service/Component Reference Model's component-based 
approach to the reuse of applications, application capabilities, 
components, and business services across the federal government. OMB 
created the Service/Component Reference Model specifically to identify 
service components and their relationship to the technology 
architectures of federal agencies. We leveraged the Service/Component 
Reference Model in two important manners: (1) the structure of our 
Application Architecture is a set of interworking components that has 
direct ties to the Service/Component Reference Model, and (2) our 
Technology Architecture applies a set of technology patterns that is 
derived directly from the technology aspects of the reference model.
    The Application Architecture has been constructed to leverage 
reusable components that can be acquired once and used to provide 
services to many applications. It shows the structure of this component 
reuse. From the set of component architecture diagrams, it can be seen 
that there is a significant opportunity to apply this reuse concept 
throughout DHS (and across other government agencies). The result 
should be considerable cost savings, as well as greatly improved 
interoperability and flexibility of applications.
    The Technology Patterns of our EA are repeatable solutions to 
recurring technical challenges. These patterns employ technologies 
described in the DHS Technical Reference Model (discussed below) and 
provide capabilities as described in the FEA Service/Component 
Reference Model. For example, the Business Intelligence/Data Warehouse 
technology pattern of our EA aligns with the Business Intelligence 
Service Type of the FEA reference model.
    Technical Reference Model. The initial formulation of the DHS 
Technical Reference Model began with the taxonomy as well as the 
technical services, protocols, and interfaces specified in the FEA 
Technical Reference Model. The DHS model extends and refines the FEA 
model where necessary to reflect the additional functional and 
technology requirements of DHS. In deriving the DHS model from the FEA 
model, we have also made adjustments to better align the technology 
categories with the physical layering of services that exist in vendor 
and open source products. The Domain level (Tier 3) categories of the 
DHS model have all been mapped to the FEA model, so that comparisons 
can be directly made with the technical reference models from other 
agencies.
    Performance Reference Model. Although this FEA reference model was 
still under development during our EA planning project, an initial 
attempt was made to align our Business Model with the intent of the 
Performance Reference Model, based on draft materials provided by OMB. 
Specifically, the Business Model includes a table that defines the 
outcomes or measurement categories and corresponding indicators 
(metrics) for each cross-cutting, corporate activity defined in the 
Homeland Security Value Chain. Measurement categories are defined for 
each activity in six areas: Mission and Business Results, Customer 
Results, and Process and Activities, People, Technology, and Other 
Fixed Assets. This guidance within the DHS EA will provide specific DHS 
IT programs with a starting point for applying the Performance 
Reference Model within their Exhibit 300 submissions to OMB.

Support of E-Government Initiatives
    The Target EA and Transition Strategy identified several 
opportunities to leverage on-going e-Government initiatives. As you may 
be aware, the Department is currently the managing partner for the 
Disaster Management and Safecom e-Gov initiatives. The Department is 
also actively participating in six additional e-gov initiatives. For 
example, there are three major organizations within the department that 
provide grants to state, local, private industry, academia, and 
individuals for a variety of reasons that participate in the e-Grants 
effort. We will be looking more closely at this mode of delivery and 
how it may leveraged into the EA program.
    Finally, the target EA identifies a concept for homeland security 
information sharing and knowledge flow--the Homeland Security 
Information Sharing Architecture--based on a concept of Communities of 
Interest adopted from the intelligence community. Information sharing 
with state, local, tribal, and other federal government entities is a 
critical function of DHS, both as a source of information and as the 
``first responders'' to an incident. Implementation of this information 
sharing architecture will provide value to homeland security community 
by driving results and productivity through effective information 
sharing.
    In addition to the initiatives for which DHS has the lead 
responsibility, we expect to be a major contributing player or user of 
several others. We are committed to transitioning to projects such as 
e-Authentication, e-Clearance, e-Payroll, e-Travel, and HR Integration. 
We are actively gaining more knowledge about these initiatives so that 
our role in supporting them and their particular timelines and 
capabilities can be integrated seamlessly into our target and 
transition strategy.

                                 

```