```

[House Hearing, 111 Congress]
[From the U.S. Government Publishing Office]

 
                         REVIEWING THE FEDERAL 
                         CYBERSECURITY MISSION

=======================================================================

                                HEARING

                               before the

                        SUBCOMMITTEE ON EMERGING
                        THREATS, CYBERSECURITY,
                       AND SCIENCE AND TECHNOLOGY

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED ELEVENTH CONGRESS

                             FIRST SESSION

                               __________

                             MARCH 10, 2009

                               __________

                            Serial No. 111-5

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC] [TIFF OMITTED] TONGRESS.#13

                                     

  Available via the World Wide Web: http://www.gpoaccess.gov/congress/
                               index.html

                               __________

                  U.S. GOVERNMENT PRINTING OFFICE
51-633                    WASHINGTON : 2009
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001

                     COMMITTEE ON HOMELAND SECURITY

               Bennie G. Thompson, Mississippi, Chairman
Loretta Sanchez, California          Peter T. King, New York
Jane Harman, California              Lamar Smith, Texas
Peter A. DeFazio, Oregon             Mark E. Souder, Indiana
Eleanor Holmes Norton, District of   Daniel E. Lungren, California
    Columbia                         Mike Rogers, Alabama
Zoe Lofgren, California              Michael T. McCaul, Texas
Sheila Jackson Lee, Texas            Charles W. Dent, Pennsylvania
Henry Cuellar, Texas                 Gus M. Bilirakis, Florida
Christopher P. Carney, Pennsylvania  Paul C. Broun, Georgia
Yvette D. Clarke, New York           Candice S. Miller, Michigan
Laura Richardson, California         Pete Olson, Texas
Ann Kirkpatrick, Arizona             Anh ``Joseph'' Cao, Louisiana
Ben Ray Lujan, New Mexico            Steve Austria, Ohio
Bill Pascrell, Jr., New Jersey
Emanuel Cleaver, Missouri
Al Green, Texas
James A. Himes, Connecticut
Mary Jo Kilroy, Ohio
Eric J.J. Massa, New York
Dina Titus, Nevada
Vacancy
                    I. Lanier Avant, Staff Director
                     Rosaline Cohen, Chief Counsel
                     Michael Twinchek, Chief Clerk
                Robert O'Connor, Minority Staff Director
                                 ------                                

   SUBCOMMITTEE ON EMERGING THREATS, CYBERSECURITY, AND SCIENCE AND 
                               TECHNOLOGY

                 Yvette D. Clarke, New York, Chairwoman
Loretta Sanchez, California          Daniel E. Lungren, California
Laura Richardson, California         Paul C. Broun, Georgia
Ben Ray Lujan, New Mexico            Steve Austria, Ohio
Mary Jo Kilroy, Ohio                 Peter T. King, New York (Ex 
Bennie G. Thompson, Mississippi (Ex      Officio)
    Officio)
                      Jacob Olcott, Staff Director
       Dr. Chris Beck, Senior Advisor for Science and Technology
                        Daniel M. Wilkins, Clerk
               Coley O'Brien, Minority Subcommittee Lead

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Yvette D. Clark, a Representative in Congress From 
  the State of New York, and Chairwoman, Subcommittee on Emerging 
  Threats, Cybersecurity, and Science and Technology.............     1
The Honorable Daniel E. Lungren, a Representative in Congress 
  From the State of California, and Ranking Member, Subcommittee 
  on Emerging Threats, Cybersecurity, and Science and Technology.     3
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Chairman, Committee on 
  Homeland Security..............................................     5

                               Witnesses

Mr. David Powner, Director, Information Technology Management 
  Issues, Government Accountability Office:
  Oral Statement.................................................     7
  Prepared Statement.............................................     8
Mr. Scott Charney, Vice President, Trustworthy Computing, 
  Microsoft:
  Oral Statement.................................................    15
  Prepared Statement.............................................    17
Mr. Amit Yoran, Chairman and Chief Executive Officer, NetWitness 
  Corporation:
  Oral Statement.................................................    24
  Prepared Statement.............................................    26
Ms. Mary Ann Davidson, Chief Security Officer, Oracle 
  Corporation:
  Oral Statement.................................................    31
  Prepared Statement.............................................    33
Mr. James A. Lewis, Project Director, Center for Strategic and 
  International Studies:
  Oral Statement.................................................    35
  Prepared Statement.............................................    37

                         REVIEWING THE FEDERAL 
                         CYBERSECURITY MISSION

                              ----------                              

                        Tuesday, March 10, 2009

             U.S. House of Representatives,
                    Committee on Homeland Security,
      Subcommittee on Emerging Threats, Cybersecurity, and 
                                    Science and Technology,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 2:53 p.m., in 
Room 311, Cannon House Office Building, Hon. Yvette D. Clarke 
[Chairwoman of the subcommittee], presiding.
    Present: Representatives Clarke, Richardson, Lujan, Kilroy, 
Thompson [ex officio], Lungren, Broun, and Austria.
    Ms. Clarke. The subcommittee will come to order. The 
subcommittee is meeting today to receive testimony on reviewing 
the Federal Cybersecurity Mission. I will begin by recognizing 
myself for an opening statement.
    Good afternoon, and thank you to all the witnesses for 
appearing before us today. I am pleased to chair today's 
hearing, my first as Chair of the Emerging Threats, 
Cybersecurity and Science Technology Subcommittee. While there 
may be a number of new faces here on the dais, I can assure 
everyone that this subcommittee will continue to address many 
of the same issues from the 110th Congress. Over the next 2 
years, we will continue our oversight over nuclear detection 
programs, radiological threats, public health threats, 
cybersecurity and the Science and Technology Directorate. I 
also look forward to working in the same bipartisan spirit that 
the previous Chairman and Ranking Member carried on their work.
    Mr. Lungren, I know that you take this responsibility as 
seriously as I do, and I look forward to partnering with you 
over the next 2 years to ensure the safety and security of the 
American people, American businesses, American infrastructure 
and the American way of life.
    Today's hearing will be the first of three cybersecurity 
hearings that the subcommittee will hold this month. It is easy 
to understand why this issue dominates our agenda. We rely on 
information technology in every aspect of our lives, from our 
electric grid, banking systems, military and Government 
functions, to our e-mail, Web browsers, and iTunes.
    Interconnected computers and networks have led to amazing 
developments in our society. Increased productivity, knowledge, 
services, and revenues are all benefits generated by our modern 
networked world. But in our rush to network everything, few 
stopped to consider the security ramifications of this new 
world we were creating. So we find ourselves in an extremely 
dangerous situation today. Too many vulnerabilities exist on 
too many critical networks which are exposed to too many 
skilled attackers who can inflict too many damages to our 
systems. Unfortunately, to this day, too few people are even 
aware of these dangers and and fewer still are doing anything 
about it. This committee will continue to sound the alarm 
bells, raise awareness of the problems we face, and hold those 
in charge accountable for their inaction.
    This hearing comes at a critical moment in our Nation's 
approach to their cyber threat. There is no more significant 
threat to our national and economic security than that which we 
face in cyberspace. We, the United States, must do everything 
equally significant to meet this challenge.
    We are approximately halfway through the National Security 
Council's 60-day interagency review of the Federal 
Cybersecurity Mission which began on February 16. The review is 
being conducted by Melissa Hathaway, senior director of the 
NSC, on orders from President Obama and the National Security 
Adviser. The goal for the review is to develop a strategic 
framework to ensure the U.S. Government's cybersecurity 
initiatives are appropriately integrated, resourced, and 
coordinated with Congress and the private sector. I commend the 
President for his vision in making cybersecurity a priority for 
his administration and for requesting this review.
    Given this committee's leadership role in cybersecurity 
policy development, we look forward to working with Ms. 
Hathaway and her team. Thankfully, their review does not have 
to start from scratch. I encourage the review team to rely upon 
the extensive hearing record of this committee in the 110th 
Congress, and from the work that our witnesses have already 
undertaken in that area.
    The CSIS Commission report and the many GAO reports which 
Mr. Powner's team have produced over the years contain dozens 
of outstanding recommendations that, if actually implemented, 
will improve our national security posture. That message bears 
repeating. The previous 2 decades have seen countless reports 
from America's thought leaders in cybersecurity, containing 
hundreds of recommendations about how to improve America's 
posture in cyberspace. What has been lacking is the courage and 
leadership to actually implement these recommendations.
    Now is the time to act. To ensure our national and economic 
security, now is the time we must act. The U.S. Government must 
chart a new course to secure cyberspace. Maintaining the status 
quo will not be enough to keep America secure. Now is the time 
for the Government to stop planning and start acting.
    There are three key issues that I believe this review must 
address.
    The 60-day review. First, this review must call for a 
national strategy for cyberspace. The previous administration 
drafted a high-level national security strategy in 2002 that 
presented problems and possible solutions to some of the same 
cybersecurity issues that we face today. Unfortunately, that 
strategy stopped short of mandating security changes. Without 
teeth, the strategy was never implemented. We need a strategy 
that uses all of the tools of the U.S. power in a coordinated 
fashion, but more importantly, we need to hold our agencies 
accountable for implementing that strategy.
    That leads me to my second requirement, leadership. A lack 
of high-level leadership on cybersecurity has cost our country 
dearly over the last several years. The review must clearly 
delineate roles and responsibilities of each agency involved in 
the governance of cybersecurity at the Federal level, including 
DSA, NSA, and DOD; but most importantly, it must describe how 
the White House will coordinate policy and budgets for each of 
these different responsibilities. The CSIS Commission 
recommended, and I fully support, an assistant to the President 
of Cyberspace Security in the Executive Office of the 
President, along with support staff to coordinate this effort.
    Third, the review must address the many policy and legal 
shortfalls that exist in protecting our critical infrastructure 
from cyber attack. Unfortunately, critical infrastructure 
systems remain the area of greatest vulnerability. While the 
previous administration relied on a voluntary protection system 
throughout many of the 18 credible infrastructure sectors, I 
believe this administration should seek to use a combination of 
regulations and incentives to ensure that our electricity grid, 
including the Smart Grid, water facilities, financial systems, 
and other key infrastructures are properly secured. The 
framework of this approach should be addressed in the review.
    To the witnesses appearing before us today, I thank you for 
being here. I welcome your thoughts on the issues I have just 
discussed, as well as your opinions on what an effective 
national cybersecurity review should look like.
    I intend for this subcommittee, as well as the full 
committee, to continue to play a role in shaping our national 
security posture.
    I would like to just take a moment to acknowledge that we 
have been joined by the Chairman of this committee, the full 
committee, Chairman Bennie Thompson. I think this amplifies the 
importance of today's hearing.
    The Chair now recognizes the Ranking Member of the 
subcommittee, the gentleman from California, Mr. Lungren, for 
an opening statement.
    Mr. Lungren. Thank you very much, Chairwoman Clark. Thank 
you for the bipartisan manner in which you have approached the 
organization of this subcommittee and the informal meetings 
that we have had. I am looking forward to working with you and 
with our colleagues who are here present and the others who are 
Members of this subcommittee, particularly our Chairman, Mr. 
Thompson, and our Ranking Member of the full committee, Mr. 
King.
    We need in this Congress to address the many threats and 
challenges that face us and that are under the jurisdiction of 
this subcommittee. Cybersecurity is certainly one of, if not 
the most paramount challenge that we have, and I support your 
decision to highlight the cyber threat with this, our first 
official hearing.
    When I chaired the subcommittee in the 109th Congress that 
had cyber, the issue of cybersecurity within its jurisdiction, 
I realized that our first challenge was educating our 
colleagues and the public on the seriousness of the growing 
cyber threat. After our classified cyber threat briefing last 
week, it is clear that much, much more needs to be done.
    In the words of today's witness, David Powner of GAO, our 
Nation is under cyber attack and our present strategy and its 
implementation have not been fully effective in mitigating the 
threat. Now, I don't believe that this is because people wanted 
this to be the case or that there was any conscious effort on 
the part of Members of Congress or previous administrations or 
people in the private sector. I just think it is a point of 
fact that what you can't see, can't feel, can't hear, can't 
touch, sometimes is not what you pay attention to. 
Cybersecurity, the cyber world which is so important to us, is 
embedded in so much of what we do but we don't see it.
    I use the old analogy of the refrigerator. I open the 
refrigerator, and all I want is cold milk. I really don't care 
how it works. We have that attitude toward the cyber world that 
is embedded in everything that we do. But we can't have that 
attitude. I believe it is particularly true regarding our 
information infrastructure, which includes our 
telecommunications and computer networks and systems and the 
data they contain. Information technology and computer networks 
increase information sharing and collaboration, which does a 
tremendous thing: It raises our productivity, lowers ours costs 
and improves performance. Would that the rest of our economy 
could do as well.
    However, the rapid growth of the internet and our 
interconnected computer systems and its networks have, as you 
so rightly said, made us increasingly vulnerable to things such 
as cyber crime, cyber espionage, and cyber terrorism. I fully 
agree with the central finding of the CSIS Commission's report 
that cybersecurity is one of the most important security 
challenges this Nation faces. U.S. cyberspace should be 
declared a vital national asset, perhaps even a critical 
national asset. This would help the Federal Government marshal 
its resources and implement a Comprehensive National 
Cybersecurity Strategy.
    I have felt for some time that we are playing catch-up in 
detecting and defending against the increasing number and 
sophistication of today's cyber threats, whether they are of 
the mischievous nature, of the organized crime nature, of the 
nation-state nature. I agree we need a national cybersecurity 
strategy, understanding that cyberspace can't be secured by 
Government alone, and that is a very important point that we 
have to stress. However, the Government does need to reorganize 
and focus its national cyber efforts if we hope to defeat the 
new cyber threats.
    I would also suggest we need a true public/private 
cybersecurity partnership based on trust and cooperation to 
protect against this new cyber threat. The private sector, 
let's make it clear, designs, deploys and maintains much of the 
Nation's critical infrastructure. Therefore, we must honor 
their experience, their expertise and their ingenuity--that is, 
that which is found in the private sector--into a trusted 
partnership with Government, a partnership where both sides 
benefit and therefore are eager to cooperate and share 
information. It just seems to me that in many cases we should 
be setting certain standards or goals but not setting the means 
to get there because the cyber world moves so fast, we really 
can't catch up with this. Government, by its very nature, moves 
more slowly. I don't want anything that we do to depress the 
creativity of the private sector. Therein lies our greatest 
opportunity to protect ourselves.
    I believe the CSIS report's recommendation to create three 
new public/private groups designed to foster better trust and 
cooperation on cyber issues is the right approach. They would 
be a new Presidential advisory committee that connects the 
White House to the important private-sector cyberspace 
entities; a national town hall organization that provides 
dialog for education and discussion; and a new cyber 
operational organization.
    The Bush administration recognized the growing threat on 
our national security from cyberspace, proposed a Comprehensive 
National Cybersecurity Initiative in 2008. The CSIS Commission 
came to a similar conclusion in their December report, 
``Securing Cyberspace for the 44th President,'' stating only a 
Comprehensive National Security Strategy that embraces both 
domestic and international aspects of cybersecurity will make 
us more secure. Well said.
    Everyone seems to agree that we need to do more, so I am 
anxious to hear the testimony of our expert witnesses today to 
help us on that journey so that we may do that which needs to 
be done to meet this 21st century threat.
    Once again I thank you, Madam Chairwoman, for the time.
    Ms. Clarke. The Chairwoman now recognizes the Chairman of 
the full Committee on Homeland Security, the gentleman from 
Mississippi, Mr. Thompson, for an opening statement.
    Mr. Thompson. Thank you very much, Madam Chairwoman.
    Good afternoon. I believe this is the ninth oversight 
hearing the Homeland Security Committee has held on Federal 
cybersecurity issues since the beginning of the 110th Congress, 
and I thank you, Madam Chairwoman, for continuing our oversight 
efforts. This is a particularly timely hearing, given the 
recent resignation of Mr. Beckstrom as director of the National 
Cybersecurity Center.
    Some of our biggest challenges in the Federal 
cybersecurity, reported by dozens of independent observers, 
including GAO and CSIS, have come as a result of ineffective 
leadership, unclear organizational structure and poorly defined 
roles and responsibilities from agencies and private sector. 
This is why I, along with many of my colleagues, were very 
optimistic when Mr. Beckstrom was brought on to lead the 
National Cybersecurity Center. He has expertise in 
organizational structure. He has worked extensively in the 
private sector. But Mr. Beckstrom did not have experience in 
working miracles, and that is the unfortunate position that the 
previous administration put him in. Without clear authority or 
budget, he was placed in a no-win situation.
    In his resignation letter, Mr. Beckstrom candidly described 
the control that is wielded by NSA over the cybersecurity 
mission today. This parallels the thoughts of some of our 
witnesses here today.
    I don't disagree with the public statements made recently 
by the DNI, who said that the NSA houses most of the cyber 
talent in the Federal Government. But I don't think the answer 
to our problems in cyberspace comes from giving control of the 
entire Federal Cybersecurity Mission to NSA. I want to clearly 
state that this committee believes that there should be a 
creditable civilian government cybersecurity capability that 
interfaces with, but is not controlled by the NSA. According to 
GAO, DHS has not proven itself up to the challenge yet. From 
our work with DHS through the years, I don't disagree, but 
there are pockets within DHS showing signs of improvement. US-
CERT and the controlled security system program are two of 
these programs that I believe are demonstrating progress.
    I hope the administration can strike the balance between 
civilian and military cybersecurity capabilities. We here in 
Congress are looking toward this administration for leadership 
on this critical issue. I share the Chair's optimism about the 
President's commitment to cybersecurity, and I hope that, at 
the end of the 60-day review, we here in Congress will have a 
clear understanding of the President's vision for 
cybersecurity.
    I yield back the balance of my time, Madam Chairwoman.
    Ms. Clarke. Other Members of the subcommittee are reminded 
that under the committee rules, opening statements may be 
submitted for the record.
    I welcome our distinguished panel of witnesses. Our first 
witness is Dave Powner, director for information technology 
management issues at the Government Accountability Office. Mr. 
Powner and his team have produced a number of outstanding 
reports for this subcommittee throughout the last several 
years, and we are pleased to welcome him back.
    Our second witness is Scott Charney, corporate vice 
president of Microsoft's trustworthy computing group. Prior to 
Microsoft, Mr. Charney was a principal for 
PriceWaterhouseCoopers, where he led the firm's cyber crime 
prevention and response practice. Mr. Charney also served as 
chief of the computer crime and intellectual property section 
in the criminal division of the U.S. Department of Justice. Mr. 
Charney was also co-chair of the CSIS Commission on 
Cybersecurity. Welcome.
    Our third witness is Mr. Amit Yoran, chairman and chief 
executive officer of NetWitness Corporation, a leading provider 
of network security products. Prior to NetWitness, he was 
director of the national cybersecurity division at the 
Department of Homeland Security. He was also chief executive 
officer and advisor to Incutel, the venture capital arm of the 
CIA. Mr. Yoran is a member of the CSIS Cybersecurity 
Commission.
    Our fourth witness is Mary Ann Davidson, the chief 
secretary--excuse me--the Chief Security Officer at Oracle 
Corporation, where she is responsible for Oracle product 
security, as well as security evaluations and assessments. Ms. 
Davidson represents Oracle on the Information Technology ISAC. 
She has served on the Defense Science Board and is a member of 
the CSIS Cybersecurity Commission. Welcome, Ms. Davidson. 
Nothing against the secretary, but you are chief security 
officer.
    Our fifth witness is Jim Lewis, the director of the Center 
for Strategic and International Studies and Technology and 
Public Policy Program. He is also program manager for the CSIS 
Commission on Cybersecurity for the 44th Presidency. Mr. Lewis 
has also been a regular witness before this subcommittee, so 
welcome to you also.
    Without objection, the witnesses' full statements will be 
inserted into the record.
    I now ask each witness to summarize his or her statement 
for 5 minutes, beginning with Mr. Powner.

  STATEMENT OF DAVID POWNER, DIRECTOR, INFORMATION TECHNOLOGY 
      MANAGEMENT ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Powner. Madam Chairwoman, Chairman Thompson, Ranking 
Member Lungren, Members of the subcommittee, thank you for 
inviting us to testify on cybersecurity recommendations for the 
new administration. Over the past several years, our work for 
the subcommittee has highlighted many areas requiring better 
leadership and management of our Nation's cyber-critical 
infrastructure, including improving cybersecurity of control 
systems, strengthening our ability to respond to internet 
disruptions, bolstering cyber analysis, and warning 
capabilities and addressing cyber crime.
    This afternoon I will provide a progress report of our on-
going work for you, Madam Chairwoman, looking at improvements 
to our Nation's cybersecurity strategy. Specifically, we held 
panel discussions with nationally recognized experts and these 
discussions, coupled with GAO's extensive work in this area, 
have resulted in 12 specific recommendations for the new 
administration to improve the approach to protecting both 
Government systems and our Nation's cyber-critical 
infrastructures. I will now briefly discuss each of the 12.
    No. 1, develop a national strategy that clearly articulates 
strategic objectives and priorities and provides a means for 
enforcing action and accountability. The current strategy does 
not do this, nor does it contain requirements to hold 
responsible organizations accountable.
    No. 2, establish a White House office responsible and 
accountable for leading and overseeing the National 
Cybersecurity Policy. Currently, DHS is our national security 
focal point, and they have not delivered on this 
responsibility.
    No. 3, establish a governance structure for strategy 
implementation. Create a governing body, similar to a board of 
directors, responsible for reporting and measuring on the 
strategic priorities. This body should be led by senior 
executives from key Federal agencies, as well as key sectors. 
It should be noted that our experts stress that not all Federal 
agencies and sectors are key cyber players.
    No. 4, acknowledge we are in a cyber war with criminal and 
adversarial nations. Publicize the severity of prior attacks 
and raise awareness that we are constantly under attack.
    No. 5, create or designate an accountable operational 
cybersecurity organization. White House-led is not the silver 
bullet, and DHS has a troubled reputation to overcome. Despite 
tremendous capability, there are concerns about this being an 
intelligence organization, because a secretive culture runs 
counter to the need to partner with the private sector. Our 
experts suggested a cyber defense organization. Clearly, there 
was no consensus on where this organization should reside, and 
this will be a tough policy question whether the best approach 
is to create another organization and how.
    No. 6, focus less on creating plans and more on 
prioritizing, assessing and securing cyber assets. We have 
created many plans that largely go unused. We need to create a 
prioritized list of our Nation's cyber assets and work toward 
securing them.
    No. 7, bolster public/private partnerships by providing 
more incentives for private sector participation.
    No. 8, focus greater attention on the global aspects of 
cyberspace. We should work toward an international global cyber 
strategy and use international agreements to focus 
cybersecurity issues and thwart cyber crime, like the Council 
of Europe's cyber crime convention.
    No. 9, modernize our legal framework to better address 
cyber criminals. Domestic and international law is outdated and 
it needs to be revised to make it easier to catch and prosecute 
criminals.
    No. 10, better coordinate Government and private sector 
cyber R&D. Cyber R&D is underfunded and not coordinated.
    No. 11, increase the number of skilled cyber professionals, 
including criminal investigators. Experts suggested that the 
cybersecurity discipline should be a profession that is 
licensed.
    No. 12, make the Federal Government a model for 
cybersecurity. The CNCI initiative is a good first step, but 
the Federal Government has much room for improvement.
    In summary, Madam Chairwoman, many large cybersecurity 
policy questions loom for the Obama administration and the 
Congress. GAO, CSIS and our expert panel recommendations need 
to be strongly considered as the game plan is defined over the 
next several months to provide a more secure cyber America.
    This concludes my statement, and I look forward to your 
questions.
    [The statement of Mr. Powner follows:]
                   Prepared Statement of David Powner
                             March 10, 2009
                             gao highlights
    Highlights of GAO-09-432T, a testimony to the Subcommittee on 
Emerging Threats, Cybersecurity, and Science and Technology, Committee 
on Homeland Security, House of Representatives.
Why GAO Did This Study
    Pervasive and sustained computer-based (cyber) attacks against 
Federal and private-sector infrastructures pose a potentially 
devastating impact to systems and operations and the critical 
infrastructures that they support. To address these threats, President 
Bush issued a 2003 national strategy and related policy directives 
aimed at improving cybersecurity Nation-wide. Congress and the 
Executive branch, including the new administration, have subsequently 
taken actions to examine the adequacy of the strategy and identify 
areas for improvement. Nevertheless, GAO has identified this area as 
high-risk and has reported on needed improvements in implementing the 
national cybersecurity strategy.
    In this testimony, you asked GAO to summarize: (1) Key reports and 
recommendations on the national cybersecurity strategy, and (2) the 
views of experts on how to strengthen the strategy. In doing so, GAO 
relied on its previous reports related to the strategy and conducted 
panel discussions with key cybersecurity experts to solicit their views 
on areas for improvement.
What GAO Recommends
    GAO has previously made about 30 recommendations, mostly directed 
at DHS, to improve our Nation's cybersecurity strategy efforts. DHS in 
large part has concurred with GAO's recommendations and, in many cases, 
has actions planned and under way to implement them.
   national cybersecurity strategy.--key improvements are needed to 
                    strengthen the nation's posture
What GAO Found
    Over the last several years, GAO has consistently reported that the 
Department of Homeland Security (DHS) has yet to fully satisfy its 
responsibilities designated by the national cybersecurity strategy. To 
address these shortfalls, GAO has made about 30 recommendations in key 
cybersecurity areas including the 5 listed in the table below. While 
DHS has since developed and implemented certain capabilities to satisfy 
aspects of its cybersecurity responsibilities, it still has not fully 
satisfied the recommendations, and thus further action needs to be 
taken to fully address these areas.

 TABLE 1.--KEY CYBERSECURITY AREAS IDENTIFIED BY GAO AS NEEDING FURTHER
                                 ACTION
------------------------------------------------------------------------
                 Item No.
------------------------------------------------------------------------
1........................................  Bolstering cyber analysis and
                                            warning capabilities.
2........................................  Completing actions identified
                                            during cyber exercises.
3........................................  Improving cybersecurity of
                                            infrastructure control
                                            systems.
4........................................  Strengthening DHS's ability
                                            to help recover from
                                            internet disruptions.
5........................................  Addressing cybercrime.
------------------------------------------------------------------------
Source: GAO analysis of prior GAO reports.

    In discussing the areas addressed by GAO's recommendations as well 
as other critical aspects of the strategy, GAO's panel of cybersecurity 
experts identified 12 key areas requiring improvement (see table 
below). GAO found these to be largely consistent with its reports and 
its extensive research and experience in the area.

 TABLE 2.--KEY STRATEGY IMPROVEMENTS IDENTIFIED BY CYBERSECURITY EXPERTS
------------------------------------------------------------------------
                 Item No.
------------------------------------------------------------------------
1........................................  Develop a national strategy
                                            that clearly articulates
                                            strategic objectives, goals,
                                            and priorities.
2........................................  Establish White House
                                            responsibility and
                                            accountability for leading
                                            and overseeing national
                                            cybersecurity policy.
3........................................  Establish a governance
                                            structure for strategy
                                            implementation.
4........................................  Publicize and raise awareness
                                            about the seriousness of the
                                            cybersecurity problem.
5........................................  Create an accountable,
                                            operational cybersecurity
                                            organization.
6........................................  Focus more actions on
                                            prioritizing assets,
                                            assessing vulnerabilities,
                                            and reducing vulnerabilities
                                            than on developing
                                            additional plans.
7........................................  Bolster public/private
                                            partnerships through an
                                            improved value proposition
                                            and use of incentives.
8........................................  Focus greater attention on
                                            addressing the global
                                            aspects of cyberspace.
9........................................  Improve law enforcement
                                            efforts to address malicious
                                            activities in cyberspace.
10.......................................  Place greater emphasis on
                                            cybersecurity research and
                                            development, including
                                            consideration of how to
                                            better coordinate Government
                                            and private sector efforts.
11.......................................  Increase the cadre of
                                            cybersecurity professionals.
12.......................................  Make the Federal Government a
                                            model for cybersecurity,
                                            including using its
                                            acquisition function to
                                            enhance cybersecurity
                                            aspects of products and
                                            services.
------------------------------------------------------------------------
Source: GAO analysis of opinions solicited during expert panels.

    Until GAO's recommendations are fully addressed and the above 
improvements are considered, our Nation's Federal and private-sector 
infrastructure systems remain at risk of not being adequately 
protected. Consequently, in addition to fully implementing GAO's 
recommendations, it is essential that the improvements be considered by 
the new administration as it begins to make decisions on our Nation's 
cybersecurity strategy.
    Madam Chair and Members of the subcommittee: Thank you for the 
opportunity to join in today's hearing to discuss efforts to protect 
our Nation from cybersecurity threats. Pervasive and sustained 
computer-based (cyber) attacks against the United States and others 
continue to pose a potentially devastating impact to systems and 
operations and the critical infrastructures that they support. To 
address these threats, President Bush issued a 2003 national strategy 
and related policy directives aimed at improving cybersecurity Nation-
wide, including both Government systems and those cyber critical 
infrastructures owned and operated by the private sector.\1\
---------------------------------------------------------------------------
    \1\ Critical infrastructures are systems and assets, whether 
physical or virtual, so vital to nations that their incapacity or 
destruction would have a debilitating impact on national security, 
national economic security, national public health or safety, or any 
combination of those matters. Federal policy established 18 critical 
infrastructure sectors: Agriculture and food, banking and finance, 
chemical, commercial facilities, communications, critical 
manufacturing, dams, defense industrial base, emergency services, 
energy, Government facilities, information technology, national 
monuments and icons, nuclear reactors, materials and waste, postal and 
shipping, public health and health care, transportation systems, and 
water.
---------------------------------------------------------------------------
    Because the threats have persisted and grown, a commission--
commonly referred to as the Commission on Cybersecurity for the 44th 
Presidency and chaired by two congressmen and industry officials--was 
established in August 2007 to examine the adequacy of the strategy and 
identify areas for improvement.\2\ At about the same time, the Bush 
administration began to implement a series of initiatives aimed 
primarily at improving cybersecurity within the Federal Government. 
More recently, in February 2009, President Obama initiated a review of 
the Government's overall cybersecurity strategy and supporting 
activities.
---------------------------------------------------------------------------
    \2\ The commission was created by the Center for Strategic and 
International Studies (CSIS), a bipartisan, nonprofit organization 
that, among other things, provides strategic insights and policy 
solutions to decision-makers. Entitled the CSIS Commission on 
Cybersecurity for the 44th Presidency, the body was co-chaired by 
Representative James Langevin, Representative Michael McCaul, Scott 
Charney (Microsoft), and Lt. General Harry Raduege, USAF (Ret).
---------------------------------------------------------------------------
    Today, as requested, I will discuss: (1) Our reports, containing 
about 30 recommendations, on the national cybersecurity strategy and 
related efforts, and (2) the results of expert panels we convened to 
discuss how to strengthen the strategy and our Nation's cybersecurity 
posture. In preparing for this testimony, we relied on our previous 
reports on Federal efforts to fulfill national cybersecurity 
responsibilities. These reports contain detailed overviews of the scope 
and methodology we used. We also obtained the views of nationally 
recognized cybersecurity experts by means of two panel discussions on 
the effectiveness of the current national cybersecurity strategy and 
recommendations for improvement. In summarizing the panel discussions, 
we provided all panel members an opportunity to comment on our written 
summaries, and their comments were incorporated as appropriate. The 
panelists' names and titles are in appendix I. We conducted our work in 
support of this testimony during February and March 2009, in the 
Washington, DC, area. The work on which this testimony is based was 
performed in accordance with generally accepted Government auditing 
standards.
                               background
    Government officials are concerned about attacks from individuals 
and groups with malicious intent, such as criminals, terrorists, and 
adversarial foreign nations. For example, in February 2009, the 
director of national intelligence testified that foreign nations and 
criminals have targeted Government and private sector networks to gain 
a competitive advantage and potentially disrupt or destroy them, and 
that terrorist groups have expressed a desire to use cyber attacks as a 
means to target the United States.\3\ The director also discussed that 
in August 2008, the national government of Georgia's Web sites were 
disabled during hostilities with Russia, which hindered the 
Government's ability to communicate its perspective about the conflict.
---------------------------------------------------------------------------
    \3\ Statement of the Director of National Intelligence before the 
Senate Select Committee on Intelligence, Annual Threat Assessment of 
the Intelligence Community for the Senate Select Committee on 
Intelligence (Feb. 12, 2009).
---------------------------------------------------------------------------
    The Federal Government has developed a strategy to address such 
cyber threats. Specifically, President Bush issued the 2003 National 
Strategy to Secure Cyberspace \4\ and related policy directives, such 
as Homeland Security Presidential Directive 7,\5\ that specify key 
elements of how the Nation is to secure key computer-based systems, 
including both Government systems and those that support critical 
infrastructures owned and operated by the private sector. The strategy 
and related policies also establish the Department of Homeland Security 
(DHS) as the focal point for cyber CIP and assign the Department 
multiple leadership roles and responsibilities in this area. They 
include: (1) Developing a comprehensive national plan for CIP, 
including cybersecurity; (2) developing and enhancing national cyber 
analysis and warning capabilities; (3) providing and coordinating 
incident response and recovery planning, including conducting incident 
response exercises; (4) identifying, assessing, and supporting efforts 
to reduce cyber threats and vulnerabilities, including those associated 
with infrastructure control systems;\6\ and (5) strengthening 
international cyberspace security. In addition, the strategy and 
related policy direct DHS and other relevant stakeholders to use risk 
management principles to prioritize protection activities within and 
across the 18 critical infrastructure sectors in an integrated, 
coordinated fashion.
---------------------------------------------------------------------------
    \4\ The White House, The National Strategy to Secure Cyberspace 
(Washington, DC: February 2003).
    \5\ The White House, Homeland Security Presidential Directive 7 
(Washington, DC: Dec. 17, 2003).
    \6\ Control systems are computer-based systems that perform vital 
functions in many of our Nation's critical infrastructures, including 
electric power generation, transmission, and distribution; oil and gas 
refining and pipelines; water treatment and distribution; chemical 
production and processing; railroads and mass transit; and 
manufacturing.
---------------------------------------------------------------------------
    Because the threats have persisted and grown, President Bush in 
January 2008 began to implement a series of initiatives--commonly 
referred to as the Comprehensive National Cybersecurity Initiative 
(CNCI)--aimed primarily at improving DHS and other Federal agencies' 
efforts to protect against intrusion attempts and anticipate future 
threats.\7\ While these initiatives have not been made public, the 
Director of National Intelligence stated that they include defensive, 
offensive, research and development, and counterintelligence efforts, 
as well as a project to improve public/private partnerships.\8\ 
Subsequently, in December 2008, the Commission on Cybersecurity for the 
44th Presidency reported, among other things, that the failure to 
protect cyberspace was an urgent national security problem and made 25 
recommendations aimed at addressing shortfalls with the strategy and 
its implementation.\9\ Since then, President Obama (in February 2009) 
initiated a review of the cybersecurity strategy and supporting 
activities. The review is scheduled to be completed in April 2009.
---------------------------------------------------------------------------
    \7\ The White House, National Security Presidential Directive 54/
Homeland Security Presidential Directive 23 (Washington, DC: Jan. 8, 
2008).
    \8\ Statement of the director of national intelligence before the 
Senate Select Committee on Intelligence, Annual Threat Assessment of 
the Intelligence Community for the Senate Select Committee on 
Intelligence (Feb. 12, 2009).
    \9\ Center for Strategic and International Studies, Securing 
Cyberspace for the 44th Presidency, A Report of the CSIS Commission on 
Cybersecurity for the 44th Presidency (Washington, DC: December 2008).
---------------------------------------------------------------------------
gao has made recommendations to address shortfalls with key aspects of 
         national cybersecurity strategy and its implementation
    Over the last several years we have reported on our Nation's 
efforts to fulfill essential aspects of its cybersecurity strategy. In 
particular, we have reported consistently since 2005 that DHS has yet 
to fully satisfy its cybersecurity responsibilities designated by the 
strategy. To address these shortfalls, we have made about 30 
recommendations in key cybersecurity areas including the 5 listed in 
Table 1. DHS has since developed and implemented certain capabilities 
to satisfy aspects of its cybersecurity responsibilities, but the 
Department still has not fully satisfied our recommendations, and thus 
further action needs to be taken to address these areas.

 TABLE 1.--KEY CYBERSECURITY AREAS IDENTIFIED BY GAO AS NEEDING FURTHER
                                 ACTION
------------------------------------------------------------------------
                 Item No.
------------------------------------------------------------------------
1........................................  Bolstering cyber analysis and
                                            warning capabilities.
2........................................  Completing actions identified
                                            during cyber exercises.
3........................................  Improving cybersecurity of
                                            infrastructure control
                                            systems.
4........................................  Strengthening DHS's ability
                                            to help recover from
                                            internet disruptions.
5........................................  Addressing cybercrime.
------------------------------------------------------------------------
Source: GAO analysis of prior GAO reports.

    In July 2008, we reported \10\ that DHS's United States Computer 
Emergency Readiness Team (US-CERT) did not fully address 15 key cyber 
analysis and warning attributes related to: (1) Monitoring network 
activity to detect anomalies, (2) analyzing information and 
investigating anomalies to determine whether they are threats, (3) 
warning appropriate officials with timely and actionable threat and 
mitigation information, and (4) responding to the threat. For example, 
US-CERT provided warnings by developing and distributing a wide array 
of notifications; however, these notifications were not consistently 
actionable or timely. As a result, we recommended that the Department 
address shortfalls associated with the 15 attributes in order to fully 
establish a national cyber analysis and warning capability as 
envisioned in the national strategy. DHS agreed in large part with our 
recommendations.
---------------------------------------------------------------------------
    \10\ GAO, Cyber Analysis and Warning: DHS Faces Challenges in 
Establishing a Comprehensive National Capability, GAO-08-588 
(Washington, DC: July 31, 2008).
---------------------------------------------------------------------------
    In September 2008, we reported \11\ that since conducting a major 
cyber attack exercise, called Cyber Storm, DHS had demonstrated 
progress in addressing eight lessons it had learned from these efforts. 
However, its actions to address the lessons had not been fully 
implemented. Specifically, while it had completed 42 of the 66 
activities identified, the Department had identified 16 activities as 
on-going and 7 as planned for the future.\12\ Consequently, we 
recommended that DHS schedule and complete all of the corrective 
activities identified in order to strengthen coordination between 
public and private sector participants in response to significant cyber 
incidents. DHS concurred with our recommendation. To date, DHS has 
continued to make progress in completing some identified activities but 
has yet to do so for others.
---------------------------------------------------------------------------
    \11\ GAO, Critical Infrastructure Protection: DHS Needs To Fully 
Address Lessons Learned From Its First Cyber Storm Exercise, GAO-08-825 
(Washington, DC: Sept. 9, 2008).
    \12\ At that time, DHS reported that one other activity had been 
completed, but the Department was unable to provide evidence 
demonstrating its completion.
---------------------------------------------------------------------------
    In a September 2007 report and an October 2007 testimony, we 
reported \13\ that consistent with the national strategy requirement to 
identify and reduce threats and vulnerabilities, DHS was sponsoring 
multiple control systems security initiatives, including an effort to 
improve control systems cybersecurity using vulnerability evaluation 
and response tools. However, DHS had not established a strategy to 
coordinate the various control systems activities across Federal 
agencies and the private sector, and it did not effectively share 
information on control system vulnerabilities with the public and 
private sectors. Accordingly, we recommended that DHS develop a 
strategy to guide efforts for securing control systems and establish a 
rapid and secure process for sharing sensitive control system 
vulnerability information. DHS recently began developing a strategy and 
a process to share sensitive information.
---------------------------------------------------------------------------
    \13\ GAO, Critical Infrastructure Protection: Multiple Efforts to 
Secure Control Systems Are Under Way, but Challenges Remain, GAO-07-
1036 (Washington, DC: Sept. 10, 2007) and Critical Infrastructure 
Protection: Multiple Efforts to Secure Control Systems Are Under Way, 
but Challenges Remain, GAO-08-119T (Washington, DC: Oct. 17, 2007).
---------------------------------------------------------------------------
    We reported and later testified \14\ in 2006 that the Department 
had begun a variety of initiatives to fulfill its responsibility, as 
called for by the national strategy, for developing an integrated 
public/private plan for Internet recovery. However, we determined that 
these efforts were not comprehensive or complete. As such, we 
recommended that DHS implement nine actions to improve the Department's 
ability to facilitate public/private efforts to recover the internet in 
case of a major disruption. In October 2007, we testified \15\ that the 
Department had made progress in implementing our recommendations; 
however, seven of the nine have not been completed. To date, an 
integrated public/private plan for internet recovery does not exist.
---------------------------------------------------------------------------
    \14\ GAO, Internet Infrastructure: DHS Faces Challenges in 
Developing a Joint Public/Private Recovery Plan, GAO-06-672 
(Washington, DC: June 16, 2006) and Internet Infrastructure: Challenges 
in Developing a Public/Private Recovery Plan, GAO-06-863T (Washington, 
DC: July 28, 2006).
    \15\ GAO, Internet Infrastructure: Challenges in Developing a 
Public/Private Recovery Plan, GAO-08-212T (Washington, DC: Oct. 23, 
2007).
---------------------------------------------------------------------------
    In 2007, we reported \16\ that public and private entities \17\ 
faced a number of challenges in addressing cybercrime, including 
ensuring adequate analytical and technical capabilities for law 
enforcement and conducting investigations and prosecuting cybercrimes 
that cross national and State borders.
---------------------------------------------------------------------------
    \16\ GAO, Cybercrime: Public and Private Entities Face Challenges 
in Addressing Cyber Threats, GAO-07-705 (Washington, DC: June 2007).
    \17\ These public and private entities include the Departments of 
Justice, Homeland Security, and Defense, and the Federal Trade 
Commission, internet security providers and software developers.
---------------------------------------------------------------------------
cybersecurity experts highlighted key improvements needed to strengthen 
                   the nation's cybersecurity posture
    In addition to our recommendations on improving key aspects of the 
national cybersecurity strategy and its implementation, we also 
obtained the views of experts (by means of panel discussions) on these 
and other critical aspects of the strategy, including areas for 
improvement. The experts, who included former Federal officials, 
academics, and private sector executives, highlighted 12 key 
improvements that are, in their view, essential to improving the 
strategy and our national cybersecurity posture. These improvements are 
in large part consistent with our above-mentioned reports and extensive 
research and experience in this area. They include:
    1. Develop a national strategy that clearly articulates strategic 
objectives, goals, and priorities.--The strategy should, among other 
things: (1) Include well-defined strategic objectives, (2) provide 
understandable goals for the Government and the private sector (end 
game), (3) articulate cyber priorities among the objectives, (4) 
provide a vision of what secure cyberspace should be in the future, (5) 
seek to integrate Federal Government capabilities, (6) establish 
metrics to gauge whether progress is being made against the strategy, 
and (7) provide an effective means for enforcing action and 
accountability when there are progress shortfalls. According to expert 
panel members, the CNCI provides a good set of tactical initiatives 
focused on improving primarily Federal cybersecurity; however, it does 
not provide strategic objectives, goals, and priorities for the Nation 
as a whole.
    2. Establish White House responsibility and accountability for 
leading and overseeing national cybersecurity policy.--The strategy 
makes DHS the focal point for cybersecurity; however, according to 
expert panel members, DHS has not met expectations and has not provided 
the high-level leadership needed to raise cybersecurity to a national 
focus. Accordingly, panelists stated that to be successful and to send 
the message to the Nation and cyber critical infrastructure owners that 
cybersecurity is a priority, this leadership role needs to be elevated 
to the White House. In addition, to be effective, the office must have, 
among other things, commensurate authority--for example, over budgets 
and resources--to implement and employ appropriate incentives to 
encourage action.
    3. Establish a governance structure for strategy implementation.--
The strategy establishes a public/private partnership governance 
structure that includes 18 critical infrastructure sectors, 
corresponding Government and sector coordinating councils, and cross-
sector councils. However, according to panelists, this structure is 
Government-centric and largely relies on personal relationships to 
instill trust to share information and take action. In addition, 
although all sectors are not of equal importance in regard to their 
cyber assets and functions, the structure treats all sectors and all 
critical cyber assets and functions equally. To ensure effective 
strategy implementation, experts stated that the partnership structure 
should include a committee of senior government representatives (for 
example, the Departments of Defense, Homeland Security, Justice, State, 
and the Treasury and the White House) and private sector leaders 
representing the most critical cyber assets and functions. Expert panel 
members also suggested that this committee's responsibilities should 
include measuring and periodically reporting on progress in achieving 
the goals, objectives, and strategic priorities established in the 
national strategy and building consensus to hold involved parties 
accountable when there are progress shortfalls.
    4. Publicize and raise awareness about the seriousness of the 
cybersecurity problem.--Although the strategy establishes cyberspace 
security awareness as a priority, experts stated that many national 
leaders in business and Government, including in Congress, who can 
invest resources to address cybersecurity problems are generally not 
aware of the severity of the risks to national and economic security 
posed by the inadequacy of our Nation's cybersecurity posture and the 
associated intrusions made more likely by that posture. Expert panel 
members suggested that an aggressive awareness campaign is needed to 
raise the level of knowledge of leaders and the general populace that 
our Nation is constantly under cyber attack.
    5. Create an accountable, operational cybersecurity organization.--
DHS established the National Cyber Security Division (within the Office 
of Cybersecurity and Communications) to be responsible for leading 
national day-to-day cybersecurity efforts; however, according to 
panelists, this has not enabled DHS to become the national focal point 
as envisioned. Panel members stated that currently, DOD and other 
organizations within the intelligence community that have significant 
resources and capabilities have come to dominate Federal efforts. They 
told us that there also needs to be an independent cybersecurity 
organization that leverages and integrates the capabilities of the 
private sector, civilian government, law enforcement, military, 
intelligence community, and the Nation's international allies to 
address incidents against the Nation's critical cyber systems and 
functions. However, there was not consensus among our expert panel 
members regarding where this organization should reside.
    6. Focus more actions on prioritizing assets and functions, 
assessing vulnerabilities, and reducing vulnerabilities than on 
developing additional plans.--The strategy recommends actions to 
identify critical cyber assets and functions, but panelists stated that 
efforts to identify which cyber assets and functions are most critical 
to the Nation have been insufficient. According to panel members, 
inclusion in cyber critical infrastructure protection efforts and lists 
of critical assets are currently based on the willingness of the person 
or entity responsible for the asset or function to participate and not 
on substantiated technical evidence. In addition, the current strategy 
establishes vulnerability reduction as a key priority; however, 
according to panelists, efforts to identify and mitigate known 
vulnerabilities have been insufficient. They stated that greater 
efforts should be taken to identify and eliminate common 
vulnerabilities and that there are techniques available that should be 
used to assess vulnerabilities in the most critical, prioritized cyber 
assets and functions.
    7. Bolster public/private partnerships through an improved value 
proposition and use of incentives.--While the strategy encourages 
action by owners and operators of critical cyber assets and functions, 
panel members stated that there are not adequate economic and other 
incentives (i.e., a value proposition) for greater investment and 
partnering in cybersecurity. Accordingly, panelists stated that the 
Federal Government should provide valued services (such as offering 
useful threat or analysis and warning information) or incentives (such 
as grants or tax reductions) to encourage action by and effective 
partnerships with the private sector. They also suggested that public 
and private sector entities use means such as cost-benefit analyses to 
ensure the efficient use of limited cybersecurity-related resources.
    8. Focus greater attention on addressing the global aspects of 
cyberspace.--The strategy includes recommendations to address the 
international aspects of cyberspace but, according to panelists, the 
United States is not addressing global issues impacting how cyberspace 
is governed and controlled. They added that, while other nations are 
actively involved in developing treaties, establishing standards, and 
pursuing international agreements (such as on privacy), the United 
States is not aggressively working in a coordinated manner to ensure 
that international agreements are consistent with U.S. practice and 
that they address cybersecurity and cybercrime considerations. Panel 
members stated that the United States should pursue a more coordinated, 
aggressive approach so that there is a level playing field globally for 
U.S. corporations and enhanced cooperation among government agencies, 
including law enforcement. In addition, a panelist stated that the 
United States should work towards building consensus on a global cyber 
strategy.
    9. Improve law enforcement efforts to address malicious activities 
in cyberspace.--The strategy calls for improving investigative 
coordination domestically and internationally and promoting a common 
agreement among nations on addressing cybercrime. According to a 
panelist, some improvements in domestic law have been made (e.g., 
enactment of the PROTECT Our Children Act of 2008), but implementation 
of this act is a work in process due to its recent passage. Panel 
members also stated that current domestic and international law 
enforcement efforts, including activities, procedures, methods, and 
laws are too outdated and outmoded to adequately address the speed, 
sophistication, and techniques of individuals and groups, such as 
criminals, terrorists, and adversarial foreign nations with malicious 
intent. An improved law enforcement is essential to more effectively 
catch and prosecute malicious individuals and groups and, with stricter 
penalties, deter malicious behavior.
    10. Place greater emphasis on cybersecurity research and 
development, including consideration of how to better coordinate 
Government and private sector efforts.--While the strategy recommends 
actions to develop a research and development agenda and coordinate 
efforts between the Government and private sectors, experts stated that 
the United States is not adequately focusing and funding research and 
development efforts to address cybersecurity or to develop the next 
generation of cyberspace to include effective security capabilities. In 
addition, the research and development efforts currently underway are 
not being well coordinated between Government and the private sector.
    11. Increase the cadre of cybersecurity professionals.--The 
strategy includes efforts to increase the number and skills of 
cybersecurity professionals but, according to panelists, the results 
have not created sufficient numbers of professionals, including 
information security specialists and cybercrime investigators. Expert 
panel members stated that actions to increase the number professionals 
with adequate cybersecurity skills should include: (1) Enhancing 
existing scholarship programs (e.g., Scholarship for Service) and (2) 
making the cybersecurity discipline a profession through testing and 
licensing.
    12. Make the Federal Government a model for cybersecurity, 
including using its acquisition function to enhance cybersecurity 
aspects of products and services.--The strategy establishes securing 
the Government's cyberspace as a key priority and advocates using 
Federal acquisition to accomplish this goal. Although the Federal 
Government has taken steps to improve the cybersecurity of agencies 
(e.g., beginning to implement the CNCI initiatives), panelists stated 
that it still is not a model for cybersecurity. Further, they said the 
Federal Government has not made changes in its acquisition function and 
the training of Government officials in a manner that effectively 
improves the cybersecurity capabilities of products and services 
purchased and used by Federal agencies.
    In summary, our Nation is under cyber attack, and the present 
strategy and its implementation have not been fully effective in 
mitigating the threat. This is due in part to the fact that there are 
further actions needed by DHS to address key cybersecurity areas, 
including fully addressing our recommendations. In addition, nationally 
recognized experts have identified improvements aimed at strengthening 
the strategy and in turn, our cybersecurity posture. Key improvements 
include developing a national strategy that clearly articulates 
strategic objectives, goals, and priorities; establishing White House 
leadership; improving governance; and creating a capable and respected 
operational lead organization. Until the recommendations are fully 
addressed and these improvements are considered, our Nation's most 
critical Federal and private sector infrastructure systems remain at 
unnecessary risk to attack from our adversaries. Consequently, in 
addition to fully implementing our recommendations, it is essential 
that the Obama administration consider these improvements as it reviews 
our Nation's cybersecurity strategy and begins to make decisions on 
moving forward.
    Madam Chair, this concludes my statement. I would be happy to 
answer any questions that you or Members of the subcommittee may have 
at this time.
    If you have any questions on matters discussed in this testimony, 
please contact me. Other key contributors to this testimony include 
Bradley Becker, Camille Chaires, Michael Gilmore, Nancy Glover, Kush 
Malhotra, Gary Mountjoy, Lee McCracken, and Andrew Stavisky.

    Ms. Clarke. Thank you very much.
    Our next witness, I now recognize Mr. Charney to summarize 
his statement for 5 minutes.

    STATEMENT OF SCOTT CHARNEY, VICE PRESIDENT, TRUSTWORTHY 
                      COMPUTING, MICROSOFT

    Mr. Charney. Chairwoman Clark, Ranking Member Lungren, Mr. 
Thompson and Members of the subcommittee, thank you for the 
opportunity to appear today to provide a perspective on 
reviewing the Federal Cybersecurity Mission. As you know, I 
served as one of four co-chairs of the CSIS Commission on 
Cybersecurity for the 44th Presidency with Representatives Jim 
Langevin of Rhode Island and Michael McCaul of Texas and 
General Harry Raduege.
    I will address four themes that cross many of the 
recommendations made in the Commission's report.
    First, we have an immediate need for a comprehensive White 
House Coordinated National Strategy for Cyber Space Security.
    Second, we need to to evolve and focus the public/private 
partnership model.
    Third, we should consider a new regulatory model designed 
to ensure that greater regulation, if enacted, protects 
innovation while providing appropriate Government oversight of 
cybersecurity issues.
    Fourth, the internet needs an appropriately deployed 
identity metasystem, if we are to make the internet 
dramatically more secure but protect important social values 
such as privacy and free speech. I will address each of these 
in turn.
    First, the need for a Comprehensive and Coordinated 
National Strategy could not be more clear. In the information 
age, a country's success is dependent upon information, 
knowledge, and communications. While the growth of the internet 
in the early 1990's created new beneficial opportunities for 
all, including individuals, businesses, and governments, it 
also created unprecedented opportunities for those who would 
misuse technology. It permits individual criminals, organized 
crime groups, and nation-states to target all types of 
sensitive information, from personal information to business 
information to military information.
    It is therefore clear that our country's future success 
requires a Comprehensive Cybersecurity Strategy that engages 
the relevant agencies of the Government and brings to bear all 
elements of national power including economic, diplomatic, law 
enforcement, military, and intelligence authorities.
    When one recognizes the breadth of the challenge, and the 
need for a massively decentralized but coordinated response 
among the Federal agencies, it becomes clear that our National 
Cybersecurity Strategy and its implementation should be led by 
the White House. Of course, any successful strategy must 
include protecting one's own networks from attack. Here it is 
critical that the Government and private sector work together 
to improve the state of computer security. Why is partnership 
required? It is because the private sector drives the design, 
development, and implementation of the products and services 
that power cyberspace.
    We must also have the right objectives. For years the goal 
of the partnership has been information sharing which will not, 
without more, secure America's infrastructures. We must 
establish a more meaningful public/private partnership where 
the partners work in complementary fashion toward the clearly 
identified objective of securing America's networks. Consistent 
with this philosophy the partnership should focus on sharing 
information that is actionable and building mechanisms that 
enable meaningful action to be taken.
    With regard to regulation, the Government and private 
sector should jointly determine the level of security provided 
by markets, the level of security needed to protect national 
security, and how the gap between what the markets will provide 
and what national security demands can be filled most 
effectively.
    While this is not a call for broad regulation, it is a 
recognition that appropriately tailored legislation, 
legislation that is technology-neutral and recognizes the best 
practices created by the innovative private sector may be an 
important component of any national cybersecurity effort. The 
fact is, markets respond to customer demand, and most customers 
know more security issues today than in the past will not pay 
for the level of security necessary to protect national 
security. In short, establishing a cohesive national strategy, 
a robust public/private partnership and a security model that 
takes advantage of industry best practices, Government 
influence, and tailored regulations can dramatically advance 
security.
    Finally, creating the ability to identify what person and 
which device is sending a particular data stream in cyberspace 
must be part of an effective cybersecurity strategy. Even 
sophisticated attackers face difficult challenges and find 
their access restricted because of better authentication. 
Stronger authentication can also help us create safe places for 
our children to learn on-line, for businesses to interact with 
customers, and for Government to serve its citizens.
    In addition, because the use of digital IDs also reduces 
the need to authenticate people by having them provide private 
details about themselves, stronger authentication can enhance 
both security and privacy. Thus, as part of an overall 
cybersecurity strategy, the Government should accelerate the 
adoption of authentication technologies by actions such as 
issuing and accepting digital credentials in appropriate 
circumstances and working to integrate privacy issues into the 
design, development, and operation of the resulting identity 
metasystem.
    In conclusion, let me say there are complex challenges that 
obviously will not be solved overnight. Securing America's 
future in the information age depends upon creating a 
comprehensive national strategy for cyberspace security, one 
that simplifies, organizes, and enables effective operational 
partnerships among the Government, private sector, and internet 
citizens. There is both an opportunity and a need for 
leadership as we focus the Nation's attentions on the 
importance of cybersecurity.
    I thank this committee for raising this important issue, 
for considering my written testimony as part of the record, and 
I look forward to your questions.
    [The statement of Mr. Charney follows:]
                  Prepared Statement of Scott Charney
                             March 10, 2009
    Chairwoman Clark, Ranking Member Lungren, and Members of the 
subcommittee, thank you for the opportunity to appear today at this 
important hearing on cybersecurity. My name is Scott Charney, and I am 
the corporate vice president for trustworthy computing at Microsoft. I 
served as one of four co-chairs of the Center for Strategic and 
International Studies' (CSIS) Commission on Cybersecurity for the 44th 
Presidency. I served on the Commission as an industry expert with more 
than 18 years of security technology experience in both the public and 
private sectors, and have a long history of leading domestic and 
international cybersecurity efforts.
    Prior to joining Microsoft, I was chief of the computer crime and 
intellectual property section in the criminal division of the U.S. 
Department of Justice. I was involved in nearly every major hacker 
prosecution in the United States from 1991 to 1999, worked on 
legislative initiatives, such as the National Information 
Infrastructure Protection Act that was enacted in 1996, and chaired the 
G8 Subgroup on High Tech Crime from its inception in 1996 until I left 
Government service in 1999.
    Representative Jim Langevin (D-RI), Representative Michael McCaul 
(R-TX), Lt. Gen. Harry Raduege, USAF (Ret.), and I led the CSIS 
Commission effort, along with project director Jim Lewis of the Center 
for Strategic and International Studies, to identify key cybersecurity 
challenges facing the new administration and provide a set of 
recommendations to address those challenges. Guided by our 
Congressional co-chairs, we assembled a group of individuals with 
cybersecurity experience in both Government and industry. The aim of 
the group was to identify both short-term recommendations that the next 
administration could implement quickly to make a noticeable improvement 
in the Nation's cybersecurity, and longer-term recommendations that are 
critical to the Nation's future cyber-objectives.
    Thank you for the opportunity to appear today to provide a 
perspective on ``Reviewing the Federal Cybersecurity Mission.'' I would 
like to address four specific themes that cross the Commission 
recommendations including: (1) The need for a comprehensive and 
coordinated national strategy for cyberspace security; (2) the 
imperative to radically evolve and elevate the public-private 
partnership model; (3) the need for an identity metasystem that makes 
the internet dramatically more secure while protecting important social 
values such as privacy and free speech; and (4) the necessity for a new 
regulatory model that protects innovation while providing appropriate 
Government oversight.
            comprehensive and coordinated national strategy
    As the CSIS Commission report makes clear, we are locked in an 
escalating and sometimes hidden conflict in cyberspace. The battle of 
bits and bytes has very real consequences for America, other nations, 
the private sector, and even what we have come to call ``the internet 
citizen.'' Cyberattack joins terrorism and weapons of mass destruction 
as one of the new, asymmetric threats that puts the United States and 
its allies at risk. To be clear, there are risks to cyberspace other 
than those related to security; for example, the increasing number of 
machines and applications creates a very complex environment with 
challenging reliability issues, and our increased dependence on 
information technology makes the availability of systems a national and 
international imperative. But for the purposes of this testimony, I 
will confine my remarks to security.
    The information age has arrived, but the United States has not yet 
built a comprehensive national cyberspace security strategy. The need 
for such a strategy has never been more urgent. America's leadership in 
a connected world cannot be assumed from its leadership in the 
industrial world. In cyberspace, the country does not remain 
unchallenged, as recent events have clearly proved. Some of the 
challenges we face include:
   America's reliance on interdependent global networks;
   The misuse of information technologies to support violent 
        extremism;
   The ability of any individual to engage in activities 
        formerly limited to nation-states (e.g., cyber-military 
        espionage and cyber-warfare); and
   The ability of any nation, regardless of traditional 
        measures of sophistication, to gain economic and military 
        advantage through cyber programs.
    In addition to these challenges, the Internet citizen--those 
individuals who use cyberspace for social and commercial interactions--
is critically relevant to any solution. Unsecured computers can turn 
everyday users into a launch platform for attacks. Fear about on-line 
security and availability can have sweeping economic consequences. 
Trust in cyberspace, on the other hand, can create new opportunities, 
markets, and possibilities.
    The United States must plan, organize, and act accordingly to 
develop a national cyberspace security strategy that can address these 
challenges. Historically, national security strategies have been 
characterized by their employment of all elements of U.S. power--
economic, diplomatic, law enforcement, military and intelligence. A 
comprehensive cyberspace security strategy must include these elements 
and articulate how they will be employed to ensure national security 
and public safety, ensure economic prosperity, and assure delivery of 
critical services to the American public. Such a strategy must also 
recognize the ever-mounting importance of economic security. In the 
industrial age, power was generally based on physical might; in the 
information age, power is derived from information, knowledge, and 
communications.
    In my opinion, there are three fundamental attributes that span all 
of the elements of national power. Articulating and advancing a clear 
understanding of norms, attribution, and deterrence in the context of 
cybersecurity can dramatically improve the national and international 
cyberspace ecosystem.
    Norms.--U.S. foreign policy and diplomatic engagements on issues 
        related to cyberspace security are not as focused as our 
        efforts to combat terrorism or stem proliferation of nuclear 
        weapons. I believe that the United States should marshal its 
        significant diplomatic skills and expertise to advocate for 
        cyberspace security and increase multilateral cooperation. I 
        would caution that advocacy and cooperation are not goals in 
        themselves. We need to focus advocacy and cooperation efforts 
        toward specific outcomes. For example, working with like-minded 
        nations to define clearly articulated norms of nation-state 
        behavior in cyberspace could help to deter state support for 
        cyberattacks or hold nation-states that support such efforts 
        accountable for their actions.
    Attribution.--Attribution of cyberattacks is one of the most 
        fundamental challenges facing the international community and 
        the United States. The inability to attribute attacks can 
        greatly impede the effectiveness of the Nation's response. Too 
        often, valuable time is lost trying to determine if an attack 
        or penetration of a system was an isolated criminal incident or 
        one perpetrated by a foreign intelligence organization. 
        Attributing the source is essential to ensuring the 
        appropriateness of response--criminal prosecution or military/
        diplomatic measures. Absent strong attribution abilities, 
        international and national strategies to deter acts will not be 
        taken seriously by the community of attackers who thrive on 
        this diagnostic weakness, nor by criminals that prey on 
        citizens' inboxes and on-line accounts. Thus, we must focus on 
        identity and authentication in cyberspace and enhancing swift 
        international cooperation on cyberattacks.
    Deterrence.--Deterrence did not happen overnight in the Cold War; 
        the concept and strategy took several years to develop. 
        Deterrence in the information age is perhaps even more 
        complicated due to the lack of attribution and the inability to 
        identify strong mechanisms to prevent hostile actions. But the 
        United States can learn important lessons from the nuclear 
        experience. In the Cold War, the United States kept sensitive 
        information secret, but disclosed enough about our strategy and 
        capabilities that allies and adversaries alike understood our 
        commitment to national security and our ability to protect it. 
        We must do the same for cyberspace.
      Deterrence is very difficult when adversaries and bad actors are 
        motivated and persistent. In order to improve cyberspace 
        security in a meaningful way, deterrence requires a clear and 
        unambiguous commitment by our Nation and understanding by the 
        spectrum of bad actors--from cybercriminals, to organized 
        crime, to nation-states--that violations of our cybersecurity 
        have consequences. What makes deterrence successful is 
        commitment, broadly known and broadly felt.
    The sheer number of extremely important issues that transcend 
agency boundaries suggests that the coordination of any national 
cybersecurity strategy must reside within the one organization 
responsible for ensuring that the Government acts as one Government. If 
the Government wants to use all the instruments of its power--economic, 
diplomatic, law enforcement, military, and intelligence--then the 
center of gravity must be in the White House. I support the 
Commission's recommendations that, if implemented, would elevate the 
priority of cybersecurity and improve its strategic coordination. 
Creating a National Office for Cyberspace in the Executive Office of 
the President will provide the interagency coordination required to 
identify, assess, and manage cyberspace risks.
    This office does not need to assume or manage all cybersecurity 
functions; rather, it should have a tightly defined mandate to develop 
strategy and coordinate the implementation of that strategy by the 
agencies that have jurisdiction over the elements of national power. It 
must also be recognized that the White House office will be best able 
to provide strategic leadership only when the agencies of Government 
responsible for executing their respective cybersecurity 
responsibilities are staffed with experienced and competent 
professionals who are resourced appropriately.
    As you know, President Obama has directed the National Security 
Council and Homeland Security Council to initiate a 60-day review of 
the plans, programs, and activities under way throughout the Government 
that address cyberspace security. According to the White House, the 
review will build upon existing policies and structures to formulate a 
new vision for a national public-private partnership and an action plan 
to: Enhance economic prosperity and facilitate market leadership for 
the U.S. information and communications industry; deter, prevent, 
detect, defend against, respond to, and remediate disruptions and 
damage to U.S. communications and information infrastructure; ensure 
U.S. capabilities to operate in cyberspace in support of national 
goals; and safeguard the privacy rights and civil liberties of our 
citizens.\1\
---------------------------------------------------------------------------
    \1\ http://www.whitehouse.gov/blog/09/03/02/Cyber-review-underway/.
---------------------------------------------------------------------------
    A successful cyberspace security strategy requires more than a plan 
and an organization; it requires partnership. The private sector drives 
the design, development, and implementation of the products and 
services that power cyberspace. Our technical expertise and experience 
in the global marketplace make us key partners in developing national 
and international cyberspace security strategies. For more than a 
decade, the Government and the private sector have partnered to address 
various aspects of cybersecurity, but this partnership has not achieved 
the robust results that are needed to protect cyberspace effectively. 
Therefore, my next key recommendation is to redesign that partnership.
  radically evolve public-private partnerships to advance cyberspace 
                                security
    Cyberspace security is a shared challenge and requires Government 
and the private sector to work together. The private sector designs, 
deploys, and maintains much of the Nation's critical infrastructure. 
However, the private sector faces unique challenges because its 
customer base and supply chains are global. It also builds commercial 
products that can be targeted by sophisticated advisories, including 
nation-states. Private sector firms are increasingly being forced to 
think about security challenges that cannot reasonably be mitigated by 
commercially realistic development practices, especially as users 
remain price-sensitive.
    The Government also faces challenges. Unlike certain other 
traditional aspects of national security, cyberspace cannot be secured 
by the Government alone; it requires a coordinated effort involving the 
owners, operators, and vendors that make cyberspace possible. The 
bifurcation of responsibility (the Government must protect national 
security) and control (it does not manage the assets or provide the 
functions that must be protected) dictates the need for a close 
partnership with clearly defined roles and responsibilities that 
optimizes the capabilities of participating stakeholders.
    Since the 1990s, well-intended public-private partnerships have 
been created to address this need, yielding a perplexing array of 
advisory groups with overlapping missions, different stakeholders with 
varying capabilities, insufficiently articulated roles and 
responsibilities, and plans with literally hundreds upon hundreds of 
recommendations. In the few instances where groups overcame 
institutional adversities and developed meaningful recommendations, the 
repeated unwillingness or inability to implement those recommendations 
at the Federal level has damaged the partnership significantly. Absent 
a comprehensive national strategy and clear purpose, both Government 
and private sector stakeholders will continue to struggle to be 
effective.
    Advancing cyberspace security requires a radical evolution of 
public-private partnerships as we currently know them. What does 
radical evolution mean? The Federal Government and private sector 
stakeholders must articulate a new philosophy for collaboration, one 
that starts with a very simple premise: Government and private sector 
efforts should be synergistic and efficient. This requires that the 
Government and private sector: (1) Identify those security requirements 
that will be fulfilled by the market; (2) identify national security 
requirements; and (3) identify how the gap between market security and 
national security can be filled. This effort must be focused on 
protecting functions (e.g., communications) as opposed to simply 
physical assets. Moreover, we must build operational partnerships that 
let us effectively mitigate and respond to threats. Finally, to the 
extent important work is on-going, the parties must identify what works 
and have the courage to retire what does not, even though retiring 
organizations may be viewed as draconian by those who have invested in 
these efforts in the past.
    As part of the evolution, it is important that the public-private 
partnership concentrate on what is truly critical to cyberspace 
security and build trusted and effective collaboration between 
Government and private sector stakeholders.
What functions are critical?
    The Commission identified four critical cyber-infrastructures:

   Energy;
   Finance;
   Converging information technology and communications;\2\ and
---------------------------------------------------------------------------
    \2\ Outside the United States, this is referred to as the ICT 
sector. See ``Telecommunications Task Group Final Report,'' CSIS 
Cybersecurity Commission http://www.csis.org/media/csis/pubs/
081028_telecomm_task_group.pdf, for more information on why ``the 
boundary between information, information technology, and 
telecommunications services has become almost indistinguishable.''
---------------------------------------------------------------------------
   Government services (including State and municipal 
        governments).

    This is not to suggest that all these infrastructures are 
identical. If power fails, the cascading effect is immediate and 
significant; by contrast, the result of an attack on Government will 
depend upon what Government service is affected. In essence, energy and 
information technology and communications form the backbone of 
cyberspace, and the availability of Government services and finance are 
particularly important for national security. While other 
infrastructures depend on cyberspace, an interruption of their 
operations would not broadly affect cyberspace itself. If energy, 
finance, the converging information technology and communications 
networks, along with Government services, can continue to function as 
intended while under attack, cyberspace will continue to support the 
Nation. Thus, these infrastructures should be the focus of a more 
attentive cyberspace security effort.
Trusted and Effective Collaboration
    The majority of public-private partnership efforts to date have 
focused on information sharing. While information sharing is important, 
it cannot be--as it had been to date--the end goal; rather, we must 
focus instead on sharing information that is actionable and then taking 
action. The CSIS Commission recommended three new partnership groups to 
advance beyond information sharing to enable trust and action. I will 
focus my comments on the two that would most significantly and 
immediately enhance our cybersecurity and resiliency by permitting 
better strategy development and operational collaboration.
            Evolve Strategic Presidential Advisory Bodies
    Trust is the foundation of a successful partnership between 
Government and the private sector. In the past few years, despite good 
intentions on both sides, trust between Government and the private 
sector has declined. Trust is built on personal relationships and in 
small groups, with parity of stakeholders and demonstrated commitment. 
Large, diffuse groups with floating engagements among a range of 
participants are not conducive to building the level of dialogue that 
promotes trust. When the President brings C-Level officers to the table 
and addresses challenges in a trusted forum, he can drive a powerful 
set of changes in the cyber-ecosystem. Advisory committees that engage 
senior-level Government and private sector personnel, such as the 
National Security and Telecommunications Advisory Committee (NSTAC) and 
the National Infrastructure Advisory Council (NIAC), have served past 
presidents well. However, the split between national security and 
emergency preparedness communications and cybersecurity is artificial 
and dangerous. In the information age, with its converged information 
technology and communications infrastructure, the distinction between 
these two groups creates overlap and limits progress on developing and 
improving cyberspace security capabilities. Accordingly, the Commission 
recommended establishing the President's Committee for Secure 
Cyberspace to replace the NSTAC and NIAC.
    In addition to establishing the proposed Committee for Secure 
Cyberspace as a C-level membership organization operated under Federal 
Advisory Committee Act, the administration should act to reform current 
decision-making bodies in Government that do not have private sector 
involvement. For example, the Joint Telecommunications Resources Board 
(JTRB), which is chaired by the Office of Science and Technology 
Policy, consists of agencies, such as the Department of Defense (DOD), 
the Department of Homeland Security, the General Services 
Administration, and the Department of Commerce.\3\ The JTRB is 
chartered to make decisions on how to prioritize telecommunications 
resources in non-wartime crisis, yet absent an effective channel into 
the private sector, the JTRB would be challenged to fulfill its 
charter. Another parallel entity is the National Cyber Response 
Coordination Group, an organization intended to help identify and 
coordinate response to a cyber-based crisis. Unfortunately, this 
interagency Government group does not have a meaningful way to engage 
the private sector, thus limiting its strategic and tactical 
effectiveness.
---------------------------------------------------------------------------
    \3\ Executive Order 12472, ``Assignment of National Security and 
Emergency Preparedness Telecommunications Functions,'' section 2(b)(3), 
April 3, 1984, available at http://www.ncs.gov/library/policy_docs/
eo_12472.html.
---------------------------------------------------------------------------
            Create Operational Collaboration
    Over the past 10 years, there have been several attempts to improve 
operational coordination between and among key Government and private 
sector stakeholders, but these have met with limited success. For 
example, the private sector has invested and maintained information 
sharing and analysis centers, but they are all too often ignored by 
Government agencies. The Commission recommended creating a new 
organization, the Center for Cybersecurity Operations (CCSO), to 
address operational issues that affect cyber infrastructure.
    I strongly support creating a more effective model for operational 
collaboration to move us from the less effective partnerships of the 
past to a more dynamic and collaborative self-governing approach 
involving cybersecurity leaders from Government, industry, and 
academia.
    Collaboration is not about plans; it is about outcomes. To create 
actual operational collaboration, we must learn from the experiences of 
the past. Collaboration is more than information sharing and is more 
than coordination; collaboration involves stakeholders working 
together, jointly assessing operational risks, and developing and 
implementing mitigation strategies. I would like to add to the 
Commission recommendation and suggest that an effective collaboration 
framework for public-private partnerships should include focused 
efforts to:

   Exchange technical data (at the unclassified level as much 
        as possible), with rules and mechanisms that permit both sides 
        to protect sensitive data;
   Create global situational awareness to understand the state 
        of the computing ecosystem and events that may affect it;
   Analyze the risks (threat, vulnerabilities, and 
        consequences) and develop mitigation strategies;
   When necessary and consistent with their respective roles, 
        respond to threats; and
   Develop cyber threat and risk analytics as a shared 
        discipline. For example, one could combine Government and 
        private sector information and then use the private sector's 
        expertise in analyzing large data sets in pseudonymous ways to 
        get new insights into computer security without raising privacy 
        concerns.

    What needs to be accomplished over the long term, and the 
operational mission, must be clear and articulated; the roles of 
Government and industry must be well-defined; and all participants must 
demonstrate commitment and continuity to achieve success. The goal is a 
trusted and focused collaborative alliance for both strategy and 
operations among the Government, academia, and the private sector.
           take action today to create a more secure tomorrow
    On-line collaboration, commerce, and, in some instances, public 
safety depend on trust. Today the mechanisms to provide authentication 
and attribution in cyberspace do not meet the needs of the internet 
citizen, enterprises, or governments. The lack of trust stems in part 
from our inability to manage on-line identities effectively and the 
excessive reliance on voluntary efforts to close key gaps in security.
Identity Imperatives
    In the context of national security, weak identification and 
authentication limits an organization's ability to enforce security 
policies to protect sensitive information and systems, and hinders 
effective Government and industry response to cyber attacks. From an 
economic security perspective, these weaknesses prevent internet users 
from taking reasonable steps to protect themselves from dangerous 
parties. Creating the ability to know reliably the person and/or device 
that is sending a particular data stream in cyberspace must be part of 
an effective cybersecurity strategy. Even sophisticated attackers face 
difficult challenges--and find their access restricted--because of 
better authentication.
    This need for improved identity and authentication in cyberspace 
has been documented in numerous forums, and Government and industry are 
progressing on multiple initiatives to address it. For example, in the 
United States, the Federal Financial Institutions Examination Council's 
(FFIEC) Guidance for Authentication in an Internet Banking Environment 
has spurred the use of stronger authentication in online banking. The 
experience of the DOD was that intrusion into its networks fell by more 
than 50 percent when it implemented Common Access Cards (CAC). Homeland 
Security Presidential Directive 12 (HSPD-12) (``Policy for a Common 
Identification Standard for Federal Employees and Contractors'') is 
another U.S. authentication initiative which requires Federal agencies 
to improve their identity and credentialing processes, using smart 
cards to secure both physical and logical access to Federal facilities 
and networks. These and other Federal initiatives have had success, but 
it is often limited to the sector or domain for which they are 
attempting to affect change.
    Past efforts to radically improve identity management for 
cybersecurity have not failed due to lack of awareness regarding the 
problem, nor a lack of efforts to address it. Much more simply, there 
are too many disparate efforts resulting in stove-piped policies and 
technologies that conflict and compete with each other, instead of 
driving toward a coordinated, interoperable, scalable security- and 
privacy-sensitive solution. There is also, particularly in the consumer 
sector, a serious ``chicken-and-egg'' problem: Consumers are not 
interested in robust on-line identity tokens because Government and 
commercial sites do not consume them, and Government and commercial 
sites do not build technology to consume such tokens because, after 
all, no consumer has them. I want to re-emphasize a point made earlier: 
Any successful public-private partnership should start with the premise 
that the Government should fill market gaps in security. Thus, as part 
of an overall cybersecurity strategy, the Government should accelerate 
the adoption of authentication technologies by supporting the creation 
and use of digital credentials. This would include issuing and 
accepting such credentials in appropriate circumstances, catalyzing the 
private sector market for digital identities, and establishing the 
appropriate governance structure for the issuance, use, revocation, and 
destruction of digital credentials.
    The use of digital IDs also reduces the need to authenticate people 
by having them provide private details about themselves, known as 
Personally Identifiable Information or PII. This usage would reduce the 
need to transmit, store, and use private information to identify 
individuals, thus increasing privacy and helping prevent crimes such as 
identity theft. Stronger authentication, combined with appropriate 
rules regarding the use of such authentication mechanisms, could 
enhance both security and privacy.
    I recognize that efforts to improve authentication raise sensitive 
privacy and civil liberties issues, but it is possible to improve 
authentication for critical functions without unduly compromising our 
values.\4\ This can be done if we integrate privacy issues into the 
design, development, and operation of the identity metasystem.
---------------------------------------------------------------------------
    \4\ For more on this topic, including how the Government can ensure 
privacy is protected in a better authenticated environment, see the 
White Paper on Establishing End-to-End Trust, www.microsoft.com/
endtoendtrust (pp. 6-7).
---------------------------------------------------------------------------
The Role of Regulation
    Opinions vary widely on how industry and Government can best work 
together to more effectively increase cybersecurity across critical 
infrastructures and Government. But even if public and private 
cooperation is optimized and operationalized, that will not provide the 
level of security necessary to meet national security demands. This is 
true because markets respond to customer demand and most customers, 
even though more aware of security issues today than in the past, will 
not pay for the level of security likely necessary to protect national 
security.
    This recognition, however, does not mean the first step to address 
the gaps between the current and desired states of security should be 
broad-based regulation. Rather, the Government should encourage a 
balanced approach, one that combines industry self-regulation with 
Government influence (through, for example, procurement regulations) 
and then includes carefully tailored regulation when necessary. I 
believe such a combined approach can be highly effective without unduly 
raising the costs for users and stifling the very innovation that is 
needed to make infrastructures more secure.
    When security gaps are identified--and neither market forces nor 
non-regulatory Government intervention suffices to address that gap--
Government should focus on adopting the regulatory model suggested by 
the CSIS Commission. In this model, industry identifies the best 
practices, and the Government ensures their adoption and works to 
harmonize requirements across sectors. I would also add that any 
Government regulation should follow certain key principles: It should 
solve a clearly identified problem; it should neither be under-
inclusive (fail to solve the problem fully) nor over-inclusive (address 
more than the problem); it should not be crafted in a way that creates 
unintended consequences; and it should be technology-neutral and not 
create hard-to-modify statutorily imposed technology requirements that 
stifle innovation and prevent further enhancements in security.
    Progress in cyberspace security is not without cost. Voluntary 
efforts have closed many security gaps but have not done enough. 
Establishing a cohesive national strategy with a robust public-private 
partnership will create a framework for tailored regulations that can 
advance identity and trust in a manner that markets alone cannot.
                             moving forward
    The first major Presidential document on emerging threats in 
cyberspace was published more than a decade ago when the President's 
Commission on Critical Infrastructure Protection released its seminal 
report.\5\ At that time, only 1.7% of the world's population (70 
million people) had internet access. In the years that have followed, 
the world has changed dramatically. Attacks have evolved from exploits 
designed to garner attention to targeted stealth attacks that are 
designed for more nefarious purposes, such as conducting identity 
theft, economic espionage, and military espionage. In 2008, almost a 
quarter of the world's population (more than 1.5 billion people) had 
internet access, and it continues to grow.\6\ The rise of the internet 
has permitted new forms of social connection, and created new 
educational and economic opportunities. But the richness of cyberspace 
also permits criminals, foreign intelligence organizations, and nation-
states to exploit cyberspace for profit, espionage, or conflict. 
Securing America's future in the information age depends upon creating 
a comprehensive national strategy for cyberspace security, one that 
simplifies, organizes and enables operational partnerships between and 
among Government and private-sector stakeholders, including internet 
citizens.
---------------------------------------------------------------------------
    \5\ http://cip.gmu.edu/archive/
5_PCCIPCriticalFoundations_1097_full_report.pdf.
    \6\ http://www.internetworldstats.com/emarketing.htm.

    Ms. Clarke. I thank you for your testimony.
    I now recognize Mr. Yoran to summarize his statement for 5 
minutes.

STATEMENT OF AMIT YORAN, CHAIRMAN AND CHIEF EXECUTIVE OFFICER, 
                    NET WITNESS CORPORATION

    Mr. Yoran. Ms. Chairwoman and Members of the committee, 
thank you for the opportunity to testify on Reviewing the 
Federal Cybersecurity Mission and for your attention to this 
important topic. My name is Amit Yoran and I have a lot to say, 
so I will skip reading my bio and jump right into it.
    An effective national cyber effort must leverage the 
intelligence community's superior technical acumen and 
scalability. However, it is in grave peril if this effort is 
dominated by the intelligence community. Simply put, the 
intelligence community has always and will always prioritize 
its own collection efforts over the defensive and protection 
mission of our Government's and Nation's digital systems. When 
intelligence operations discover a compromise, the decision to 
inform system defenders or not lacks transparency. Mission 
conflict exists between those defending systems and those 
attempting to collect intelligence or counter-intelligence 
insights.
    The current series of cyber programs called for billions of 
dollars in funding for intelligence and centralized security 
efforts, but are designed with very little emphasis on helping 
defenders better protect the systems housing our valuable data 
and business processes.
    For instance, the Center for Disease Control, which houses 
sensitive research and information about biological threats 
such as anthrax, has ongoing cyber incidents which it lacks the 
personnel and technologies to adequately investigate. In the 
face of spending billions more on centralized cyber 
intelligence activities, the CDC's cyber budget is being cut by 
37 percent. Intelligence focused on national efforts are 
overclassified, to the point where catastrophic consequences 
are highly probable. High levels of classification prevent the 
sharing of information necessary to adequately defend our 
systems.
    For instance, IP addresses, when classified, cannot be 
loaded into defensive monitor systems. It also creates 
insurmountable hurdles when working with a broad range of 
Government IT staffs that do not have appropriate clearances, 
let alone when trying to work with, communicate, and partner 
with the private sector. Classification cannot be used 
effectively as a cyber defensive technique, only one for 
avoiding responsibility and accountability. Overclassification 
leads to a narrowly limited review of any program.
    One of the hard lessons learned from the terrorist 
surveillance program is that such a limited review can lead to 
ineffective legal vetting of a program. The cyber mission 
cannot be plagued by the same flaws as the TSP.
    An immediate, thorough, and transparent legal analysis of 
the governance authority's privacy requirements should be 
performed on the efforts used to both protect our CT systems as 
well as all cyber collection activities. Given the broad 
concerns of overclassification and its cascading consequences, 
conducting these reviews must be a high-priority task.
    Cyber research investments are practically nonexistent at a 
time when bold new visions need to be explored. The Department 
of Homeland Security has demonstrated inefficiency and 
leadership failure in its cyber efforts. While pockets of 
progress have been made, administrative incompetence and 
political infighting have squandered meaningful advancement for 
years now, while our adversaries continue to aggressively press 
their advantage.
    DHS has repeatedly failed to attract or retain the 
leadership and technical acumen required to successfully lead 
in the cyber mission. While the tendency would be to move the 
cyber mission to the NSA, it would be ill-advised for all the 
reasons I provide in my much longer written testimony.
    We must enable civil government to succeed in its mission 
of defense or also concede that the private sector, too, cannot 
succeed in its defensive mission and subjugate them to 
intelligence support. DHS is the natural and appropriate place 
for public/private partnership and cooperative activities, 
including those in cyber.
    The current set of public/private partnerships is at best 
ill-defined. They categorically suffer from meaningful value 
creation or private sector incentives for participation. Such 
incentives might include tax credits, fines, liability levers, 
public recognition, or even occur at an operational level 
through mechanisms such as the sharing of threat intelligence, 
technical knowledge, incident response report, to name just a 
few.
    Trust relationships when dealing in cybersecurity matters 
are absolutely critical. In discussions among privacy and civil 
liberties group, the role of the NSA in monitoring or defending 
U.S. networks is debated. Should such intelligence programs 
exist, DHS should be very cautious before participating in, 
supporting or engagement in these activities.
    The Department's ability to fulfill its primary mission and 
responsibilities may be permanently damaged by a loss of public 
confidence and trust. At a bare minimum, in order to preserve 
this trust, any interacting with domestic intelligence efforts 
should be explicitly and clearly articulated.
    Sufficient transparency may serve to increase public trust 
and confidence and offset concerns raised by uncertainty and 
the uninformed. DHS must be formally charged with and enabled 
to build an effective cyber capability in support of securing 
our Federal civilian systems. Special provisions should be made 
in the hiring, contracting, human resources, and political 
issues within the cyber mission of DHS to prevent it from 
remaining a victim of the Department's broader administrative 
failures.
    DHS should be given specific emergency authorities to 
address security concerns in civil systems, to include the 
ability to measure compliance with security standards, 
protocols, and practices, and take decisive action where 
organizations are not applying reasonable standards of care. At 
present, the operation's cybersecurity arm of DHS, US-CERT, 
remains politically torn apart into three components, 
completely subjugated to a cadre of detailees from the 
intelligence community.
    In order to regain efficiency, the Department's operational 
security activities must be reconsolidated in the US-CERT. This 
operational mission is not resourced to succeed with less than 
20 Government FTEs and a budget of only $67 million.
    Ms. Clarke. Mr. Yoran, I am just going to ask if you can 
summarize and we will probably pick up on more of your 
testimony through questions. Of course, we have your full 
testimony in the record.
    Mr. Yoran. Yes, Madam Chairwoman.
    The newly focused DHS US-CERT should report directly to the 
Secretary of DHS, just as NTOC reports to the Director of NSA. 
The cyber responsibilities of the Department must not remain 
buried in the Department or, alternatively, they must be 
removed and placed in an independent agency where they can 
succeed. Thank you.
    [The statement of Mr. Yoran follows:]
                    Prepared Statement of Amit Yoran
                             March 10, 2009
    Ms. Chairwoman and Ranking Member, thank you for the opportunity to 
testify before the Homeland Security Committee on Reviewing the Federal 
Cybersecurity Mission.
    My name is Amit Yoran and I am the CEO of the NetWitness 
Corporation, a company providing next generation cybersecurity 
monitoring technologies to the U.S. Government and private sector, 
including Fortune 500 companies delivering critical infrastructure 
cyber protection to the Nation. I serve as a member of the CSIS Cyber 
Commission advising the 44th Presidency and on numerous security 
industry advisory bodies.
    Previously I have served as the first Director of the National 
Cyber Security Division (NCSD) in standing up the United States 
Computer Emergency Readiness Team (US-CERT) and Einstein program at the 
Department of Homeland Security (DHS), as founder and CEO of Riptech, a 
leading managed security services provider, and as manager of the 
Vulnerability Analysis Program (VAP) of the U.S. Department of 
Defense's Computer Emergency Response Team (DoD CERT). I received 
Bachelor of Science degree in Computer Science from the United States 
Military Academy at West Point and Master of Science in Computer 
Science from The George Washington University.
    Over the past 15 years, automation and use of computer systems has 
permeated every aspect of modern life. Our Nation is entirely reliant 
upon computer systems and networked technologies in everything from 
national security and intelligence activities to commerce and business 
operations to power production and transmission to personal 
communications and correspondences.
    Today's internet has become one of the unifying fabrics driving 
globalization at an increasingly accelerated pace. It represents the 
core means by which personal and organizational interactions occur 
whether those communications take the form of internet email or simply 
phone calls, which invariably traverse the cyber realm. Beyond its role 
as a communications medium, computer-based automation and technology 
are the driving forces behind every major industrial and economic base 
in the world. Simply put, computer technologies and communications 
represent the greatest threat to and opportunity for expansion of the 
U.S. values system.
                evolving into a national cyber strategy
    The past 2 years have brought about an unprecedented level of 
Federal focus and attention on cyber security matters culminating in a 
portfolio of activities commonly referred to as the Comprehensive 
National Cyber Initiative (CNCI). Advocacy for CNCI under the Bush 
administration resided in the Office of the Director of National 
Intelligence (ODNI), under whose charge the billions of dollars in 
programs were conceived and orchestrated. While many of the CNCI 
programs are well intended and designed, there are several significant 
flaws in adopting the Bush administration's CNCI as an on-going 
national cyber strategy.
   White House leadership. The Obama White House is currently 
        conducting a comprehensive 60-day review of cyber. The purpose 
        of the review is to develop a strategic framework to ensure 
        that ``initiatives in this area are appropriately integrated, 
        resourced and coordinated both within the Executive Branch and 
        with Congress and the private sector.'' This review effort will 
        culminate in recommending an optimal White House organizational 
        structure for dealing with the cyber challenges facing our 
        national and economic security as well as ``an action plan on 
        identifying and prioritizing further work in this area.'' For 
        the reasons outlined below, an effective national effort to 
        address cybersecurity can only succeed through continuous, 
        active, and decisive White House leadership.
   Intelligence.
     An effective national cyber strategy must leverage the 
            strength of the intelligence community. As information and 
            computer-based technologies increasingly permeate how the 
            world works, opportunities abound to improve the types, 
            quantity, and quality of intelligence the community can 
            provide at various levels of classification to its 
            consumers. In the primary intelligence functions of 
            collection, analysis, and dissemination, cyberspace can 
            provide an effective aspect to operations. The volumes of 
            information and the diversity of sources can quickly become 
            overwhelming. The intelligence community must continue to 
            refine its ability to evaluate the quality and value of 
            such information and accurately assess it in order to 
            assure its appropriate dissemination to decisionmakers. 
            This should include improved functionality around 
            attribution in cyberspace.
     There is a clear and distinct conflict of interest between 
            intelligence objectives and those of system operators. 
            Simply put, intelligence organizations prioritize the 
            intelligence and counter-intelligence missions; which in 
            cyber focuses on monitoring adversaries, determining their 
            methods and techniques, tracking their activities to a 
            point of origin, and determination of compromise scope, and 
            attack intent and adversary's objectives. While these are 
            very important, they frequently conflict directly with the 
            information assurance objectives of system owners and 
            operators, who are primarily concerned with system defense 
            and protection, and in the event of compromise, a speedy 
            restoration to a functional and assured state. This 
            distinction in core objectives is critical because it 
            represents the difference between programmatic emphasis on 
            information gathering, or system resilience and 
            availability. For instance, intelligence and law 
            enforcement entities often prioritize attack attribution, 
            while almost no emphasis is placed on attribution by those 
            defending systems. Rather than sharing information with 
            operators and better informing them as to how they can 
            defend and monitor themselves, an intelligence community-
            centric mindset around cyber would limit information 
            exchange and instead focus on enabling the intelligence 
            community to perform an expanded and aggregated monitoring 
            program. Such a monitoring program would face significant 
            cost and scalability impediments. We must remember the 
            purpose for a monitoring program. Are we in fact monitoring 
            to enable better defenses? Who makes the decisions to 
            inform the defense? It is a clear conflict of interest for 
            those who collect to make this decision. The decision 
            should be a balanced one. Prioritizing the intelligence 
            mission also has significant resource allocation 
            implications. Amid news stories of billions of dollars in 
            cyber spending under CNCI a majority of resources are going 
            to intelligence and centralized monitoring activities. For 
            instance, the Center for Disease Control, where sensitive 
            information resides about biological threats, such as 
            anthrax, has on-going incidents which they do not have the 
            manpower or technology to adequately investigate. In the 
            face of these challenges, this year the CDC's cybersecurity 
            budget will be reduced by 37%.
     For ill-defined reasons, the CNCI led by ODNI has been 
            shrouded by a high degree of secrecy and lack of 
            transparency. The plan itself is so classified that even 
            Members of Congress have not been provided copies and 
            industry has had no access to the document. While the need 
            for high levels of classification may exist in certain 
            components of a national cyber effort, such as offensive 
            capabilities or for the protection of sources and methods, 
            such a broad over-classification is counterproductive to 
            supporting an effective cyber defense. Such information is 
            prevented from being shared with operators, most of which 
            do not hold adequate clearances and creates significant 
            hurdles when trying to defend unclassified systems. In 
            recent examples adversary internet addresses used in 
            attacks and their various attack methods have been 
            classified to the point they were not broadly available for 
            defensive purposes or provided through channels. In 
            numerous cases this roadblock prevented information from 
            being used effectively in cyber defense and provided 
            further advantage to our adversaries. If you cannot or will 
            not share useful information with cyber defenders, their 
            job is made far more difficult. As the private sector is 
            increasingly the target of foreign intelligence efforts, a 
            national cyber effort will need to further evolve its 
            abilities in working with the private sector. Most 
            importantly, over-classifying a national cyber strategy 
            prevents adequate public review and debate to assure that 
            the programs are designed optimally, contain the highest 
            level of innovation, and are well-aligned with and informed 
            by the total body of knowledge of the cyber security 
            profession. Often classification is used to hide weaknesses 
            found. Classification cannot be used effectively as a cyber 
            defensive technique, only one for avoiding responsibility 
            and accountability. Over-classification leads to a narrowly 
            limited review of any program. One of the hard-learned 
            lessons from the Terrorist Surveillance Program (TSP) is 
            that such limited review can lead to ineffective legal 
            vetting of a program. The cyber mission cannot be plagued 
            by the same flaws as the TSP has been.
     Intel loss/gain analysis has historically been performed 
            by the intelligence community's judgment without 
            substantive subject matter input from those whose systems 
            are being damaged. If the intelligence community takes on a 
            leadership role for the cyber mission it is likely that 
            additional monitoring programs will be put in place to find 
            the adversary. While the technical acumen within NSA is 
            strong, better controls over operations would be needed to 
            reduce the natural emphasis on collection and instead 
            prioritize the protection and availability of Government 
            and industry systems. The cyber mission suffers in favor of 
            the intelligence mission all too often. While protecting 
            sources and methods, the intelligence community needs to 
            better inform public and private sectors on the threat 
            environment and how they can better defend themselves. 
            Moreover, some organizations may be less likely to act 
            responsibly and invest properly in monitoring and defending 
            their own systems if they feel as though they can rely on 
            some federated intelligence monitoring operation.
   Research and Development. The current paradigm in cyber 
        security is not likely to change significantly through improved 
        security products, monitoring, and incident response 
        capabilities. While the private sector makes significant 
        investment in incremental product, application, and protocol 
        improvements; fundamental research is required to meaningfully 
        improve the security of the cyber and critical infrastructures.
     According to the CSIS Commission work, ``The federal 
            government plans to spend about $143 billion in 2009 on 
            R&D. We estimate that two-tenths of 1 percent of that will 
            go to cybersecurity.'' An inherently Government investment 
            must drive long-term research agendas in cybersecurity, 
            where private sector focus on shorter-term 
            commercialization limits results to more tactical or 
            incremental advancements. The Department of Homeland 
            Security's Science and Technology Directorate invests less 
            than $20 million per year on cybersecurity research 
            efforts, a far cry from any responsible level of resource 
            allocation.
     The Government should not use this money to be in the 
            security product development business, especially via 
            classified venues. In an overwhelming majority of 
            instances, Government cyber requirements are substantially 
            similar to if not exactly the same as the private sector 
            and only in the rare cases where they are not or in 
            classified instances, do specific tactical Government 
            development efforts make sense to consider. In addition, it 
            is a fact that there is a severe lack of qualified 
            engineers needed to develop these systems. Today, the 
            majority of these engineers are employed by the security 
            industry. The Government and intelligence community should 
            guide and assist in functional requirements for the 
            development of technologies which can help us best address 
            the sophisticated cyber threat environment, not enter the 
            product development business. The resulting improvement in 
            security technologies will not only benefit the Government 
            in protecting its systems, but will also benefit the 
            Nation's critical infrastructure operators and rest of the 
            shared internet fabric that joins our digital world. 
            Additionally, Government development efforts have stranded 
            enterprise cyber defenders without the benefits of product 
            management, maintenance, and professional support.
   Standards and Acquisition reform. The CSIS Commission report 
        provides a lot of insight into how the Government can 
        positively improve its situation as well as security of private 
        networks by leveraging its expertise in standards, setting and 
        using its procurement size to effect product vendor behaviors. 
        We also need to consider more dynamic methods for systems 
        procurement and lifecycle management as the current processes 
        seem marginally nimble enough to enable the purchase of a 
        battle tank or fighter jet. Antiquated and poorly maintained 
        systems compound our challenges. The systems on Federal 
        networks average 5 years old. Unlike responsible parties in the 
        private sector, Federal networks frequently do not have 
        centralized patching, vulnerability understanding, or adequate 
        monitoring technologies and processes. Simply put, they are not 
        achieving or maintaining an appropriate standard of care by any 
        responsible measure. It should be understood the reasons for 
        this are a lack of IT and IT security governance. The 
        technology here is not overly complex; the real challenge is 
        the people and the process. The average Government executive, 
        whether DoD or civil, stays in his/her position for an average 
        of 18 months. There is little or no reason to look ahead at the 
        next executive's tenure and budget or plan for the life cycle 
        management or security of a system 18 months later. In 
        addition, because planning was not done in the previous 
        executive's tenure, the system the executive has to care for is 
        more likely than not to be in an unkempt, dated, and insecure 
        state. There is no governance mechanism or motivation for 
        Government systems to plan, budget, or perform best practice 
        life-cycle management which can significantly reduce risk of 
        loss. Please see the recently published Consensus Audit 
        Guidelines for a reasonable approach to minimal security 
        practices.
   Legal Review and Privacy Oversight.
     Congress and the Obama Administration must work together 
            to modernize authorities. FISMA and Clinger-Cohen are dated 
            and fraught with politics and games. Without hard-hitting, 
            detailed legislation that structures governance and 
            authorities no program will succeed. Today the CNCI is not 
            codified. HSPDs 54 and 23 are not supported by legislation, 
            therefore are not mandated. An immediate, thorough, and 
            transparent legal analysis of the governance, authorities, 
            and privacy requirements should be performed on both the 
            efforts used to protect IT systems as well as an analysis 
            with the requisite understanding of intelligence and 
            national security law for all cyber collection activities. 
            Given the broad concerns of over-classification, conducting 
            these reviews must be a high priority task.
     An effective national cyber function requires an informed 
            privacy function. Privacy issues need proper review and 
            advocacy when designing various Government cyber security 
            programs, especially those of the intelligence and law 
            enforcement communities. An effective program should be 
            implemented in a non-partisan fashion by qualified privacy 
            professionals who are not members of the executive or 
            legislative branches and have fixed terms of service 
            without eligibility for reappointment or extension terms. 
            Security can be implemented with and even contribute to 
            enhanced privacy, but it is not easy and often not without 
            strong and deliberate privacy advocacy and oversight.
   Homeland Security.
     The Department of Homeland Security (DHS) has demonstrated 
            inefficiency and leadership failure in its cyber efforts. 
            While pockets of progress have been made, administrative 
            incompetence and political infighting have squandered 
            meaningful progress and for years now our adversaries 
            continue to aggressively press their advantage. Recently, 
            the Director of National Intelligence, Admiral Dennis 
            Blair, told the House intelligence committee that, ``the 
            NSA, rather than the Department of Homeland Security which 
            currently oversees cybersecurity, has the smarts and the 
            skills to secure cyberspace.'' In his assessment of both 
            organizations he is absolutely correct. DHS has repeated 
            failed to either attract or retain the leadership and 
            technical acumen required to successfully lead in the cyber 
            mission space. On a number of occasions proven, talented, 
            and knowledgeable leaders from within the Government or 
            successful experts from private sector have joined the 
            Department in hopes of meaningful contribution. In its 
            cyber responsibilities DHS has a consistent track record 
            for tolerating political infighting, individual egos, and 
            shenanigans over prioritizing and executing its cyber 
            responsibilities in a mature fashion. While the tendency 
            would be to migrate the cyber mission to the NSA, that 
            would be ill-advised for all of the reasons provided 
            earlier. In Rod Beckstrom's resignation letter last week, 
            he states, ``NSA effectively controls DHS cyber efforts 
            thru detailees, technology insertion and the proposed move 
            of NPPD and the NCSC to a Ft. Meade NSA facility. NSA 
            currently dominates most national cyber efforts . . . The 
            intelligence culture is very different than a network 
            operations or security culture. In addition, the threats to 
            our democratic processes are significant if all top level 
            government network security and monitoring are handled by 
            any one organization.'' This could not have been more 
            accurately stated. We must enable civil government to 
            succeed at this mission. This being said, it is far past 
            time we fix the DHS problems and move forward.
     Public-Private Partnership. In addition to defining 
            increased security functionality and assurances for 
            Commercial Off the Shelf Software (COTS), the Government 
            must work more closely with the private sector and 
            understand their businesses if it is to be effective in 
            constructing useful partnership programs. Programs managed 
            in a vacuum by the intelligence community at a highly 
            classified level are unlikely to work well and in concert 
            with system operators within the Federal Government, let 
            alone in the private sector, where not only are mission 
            objectives completely foreign, but where there are very few 
            people with Government clearances. Government programs need 
            to focus on open dialog and information exchange, and 
            enabling the private sector to better understand the 
            security challenges they face and how they might be 
            overcome with the help of the Government. DHS is the 
            natural and appropriate placement for public-private 
            partnership and cooperative activities, including those in 
            cyber security. The current set of public-private 
            partnerships are at best ill-defined. While well-
            intentioned and occasionally valuable information is 
            brought to the Department, they categorically suffer from 
            meaningful value creation to the private sector. A deeper 
            understanding of how cyber defense and security operations 
            are implemented in the private sector is required by those 
            crafting the evolution of these programs so that adequate 
            incentives can be appropriately incorporated going forward. 
            Such incentives might include tax consequences, fines, 
            liability levers, public recognition, or even occur at an 
            operational level, such as the sharing of threat 
            intelligence, technical knowledge or incident response 
            support to name just a few. Due to its fluid nature, trust 
            relationships when dealing in cyber security matters are at 
            least as strongly emphasized as in physical security. In 
            news reports and discussions among privacy and civil 
            liberties groups the role of the NSA in monitoring or 
            defending domestic private networks is debated. Should such 
            intelligence programs exist, DHS should be very careful to 
            distance itself from participation, support, or engagement 
            in these activities. The Department's ability to fulfill 
            its primary mission and responsibilities may be permanently 
            damaged by a loss of public confidence and trust. At a bare 
            minimum, in order to preserve public trust, its interaction 
            with domestic intelligence collection efforts should be 
            explicitly and clearly articulated.
     NCSC and US-CERT. Congress and the administration should 
            focus DHS where it can have the greatest positive impact. 
            The Department's culture migrates toward increasing its own 
            mission scope and infrequently emphasizes a crawl, walk, 
            run mentality. Sometimes, it's just time to close 
            PowerPoint and Word, stop the rhetoric and simply roll the 
            sleeves up and begin the actual work at hand. For instance, 
            spending the Department's limited resources on advocacy 
            programs for better software development, where the 
            Department has very limited experience, expertise, and 
            credibility is of exceptionally limited value.
     The US-CERT works to support the security of Government 
            networks through design, deployment and monitoring the 
            Einstein series of programs to enhance situational 
            awareness, be the centralized incident reporting authority 
            for the Federal civilian networks, facilitate efficient 
            incident response and cleanup efforts, support the private 
            sector through information exchange with critical 
            infrastructure operators, and working with IT and IT 
            security product vendors to assure that they can address 
            the needs of the broader Federal Government and critical 
            infrastructures.
        At present the US-CERT remains torn apart into three arms; a 
            technology deployment arm (lead by an intelligence 
            community detailee), a security arm (managing the Trusted 
            Internet Connection program), and the operations arm 
            (performing the core US-CERT mission). This stove-piping 
            has added political strife, inability to spend 2009 money 
            this year, and defocusing all from accomplishing the single 
            US-CERT mission. In order to regain any efficiency, the 
            Department's operational security role, which has been 
            ripped apart by years of political infighting, must be 
            reconsolidated in the US-CERT. The critical work of the US-
            CERT with its operational mission is not resourced to 
            succeed (fewer than 20 Government FTEs, a budget of only 
            $67 million out of the Department's $355 million spend on 
            cybersecurity). Additionally, the US-CERT must be lead by a 
            single Federal civil executive.
        The coordination function of the National Cyber Security Center 
            is underutilized. Rod Beckstrom's recent resignation claims 
            that only 8 weeks of the annual funding have been provided 
            to it. His concerns for NSA management control of DHS' 
            cyber efforts apply to the US-CERT as well, which reports 
            to detailee from the USSS, who reports to detailee from 
            NSA/Navy. All special assistants around the Acting 
            Assistant Secretary are also NSA detailees. The US-CERT 
            must be provided appropriate staffing levels to move 
            forward and given adequate funding. Not doing so cannot 
            help but send the strongest message to the cyber community, 
            the rest of Government, the intelligence community, and the 
            private sector that cybersecurity does not matter to DHS 
            leadership and the Department's role is unnecessary. A 
            newly focused cyber mission must report directly to the 
            Secretary of DHS. This critical mission has been sought 
            aggressively by so many parties, but resisted so strongly 
            by the Department responsible for its successful execution. 
            Cyber must not remain buried in the bureaucracy of DHS or, 
            alternatively, it must be removed and placed where it can 
            succeed.
    The House Homeland Security Committee and Congress should work with 
the Executive branch to assure these fundamental changes are made:
    1. DHS must be charged with and enabled to build an effective cyber 
        capability in support of securing Federal civilian systems.
      a. Make special provisions in the hiring, contracting, human 
            resources, political issues within the cyber mission of DHS 
            to prevent it from remaining a victim of the Department's 
            broader administrative failures.
      b. Enable the US-CERT to stand up the capabilities necessary to 
            assist in the defense of Federal civil government as a 
            component of the Federal civil agency charged with 
            defending the homeland.
      c. DHS should also be given specific emergency authorities to 
            specifically address security concerns in civil systems, to 
            include the ability to measure compliance with security 
            standard, protocols, and practices and take decisive action 
            where organizations are not applying reasonable standards 
            of care.
    2. Flesh out, define roles, responsibilities and authorities of 
        DHS, DoJ, DoD, NSA, and other Federal departments and agencies 
        engaged in securing digital infrastructure. Such a framework 
        should be publicly stated so that trust and confidence in cyber 
        programs can be restored. It will also be a critical step in 
        guiding more informed and consistent interactions with the 
        private sector. Steps must also be put in place to allow the 
        White House, Congress, departments and agencies to have 
        visibility, input, and clear oversight into the process and 
        solutions.
    3. Adequately resourcing for success.
      a. A large-scale reallocation of the DHS cyber monies toward the 
            programs which are operational and provide meaningful value 
            add to its responsibilities to the Federal civil networks 
            is needed.
      b. There exists stronger network controls and millions of dollars 
            spent by DoD and NSA to protect the DoD networks, and that 
            they still are under-resourced to adequately defend 
            themselves. Only a fraction of that is being spent to 
            defend Federal civilian systems and in reality those 
            networks are by comparison 10 times larger than the Defense 
            Department's.
    Thank you for the opportunity to testify. I would be happy to 
answer any questions you may have at this time.

    Ms. Clarke. I thank you as well for your testimony.
    I now recognize Ms. Davidson to summarize her statement for 
5 minutes.

STATEMENT OF MARY ANN DAVIDSON, CHIEF SECURITY OFFICER, ORACLE 
                          CORPORATION

    Ms. Davidson. Chairwoman Clarke, Members of the 
subcommittee, my name is Mary Ann Davidson. I am Chief Security 
Officer for Oracle. Thank you for the opportunity to testify 
regarding the important issue of cybersecurity.
    The Declaration of Independence states all men are created 
equal. All information systems, however, are not. The truth of 
the statement should be self-evident but it isn't, and therein 
lies a risk to our freedoms. The ubiquity, flexibility, and 
configurability of information systems has led to circumstances 
in which software designed for a particular purpose and 
environment is too often deployed in an environment it was 
never designed for, without any thought or explicit acceptance 
of the risks in so doing. There is no substitute for knowing up 
front what you need software for, how it is going to be 
deployed, and what risks you can accept and what risks you 
won't. The time to make these determinations is during 
procurement, not afterwards.
    The Navy does not purchase container ships and try to 
deploy them as aircraft carriers, nor does the Air Force 
purchase Gulfstream V's and try to configure them as F-22 
Raptors. While there is nothing wrong with container ships or 
Gulfstream V's, they were not designed for the operational 
needs or the threat environment that aircraft carriers and F-
22s were designed for.
    Why then is information technology somehow different? It 
isn't. Good security, like good hardware, starts in 
procurement: Knowing what you need, how it will be used, and 
explicitly describing the threat environment for deployment. 
Use procurement wisely and aggressively.
    This brings me to my second point. Information technology 
is mission-critical not merely mission-enabling. Our entire 
economy rests on an IT backbone; in particular, our homeland 
security and our military's ability to prosecute war rests on 
an IT backbone. DOD continues to invest in network-centric 
operations, which is all about getting the right information to 
the right warrior at the right time and the right battlespace. 
This makes the network itself the battlefield and therefore, 
DOD needs to enhance the treatment of information systems as a 
core mission specialty as well as using information systems 
offensively. Absent this capability, the DOD will not be able 
to use IT as the force multiplier it is.
    Just as General Patton knew his tanks and their technical 
capabilities very well, not just merely how to deploy them, our 
military and homeland security leaders need to know and how to 
deploy and embrace the full capability of IT. Putting it 
differently, do we envision having a contractor at the helm of 
an aircraft carrier? If not, then why would our cyber offense 
be any different? General Patton also knew that the 3rd Army 
would stop without supplies of gas. Netcentric armies stop 
without supplies of information. Only by holding capability for 
both function and esteem can offense inform defense.
    This brings me to my third point. We are in a conflict. 
Some would say a war. Let's call it what it is. Given the 
diversity of potentially hostile entities building cadres of 
cyber warriors probing our systems, including our defense 
systems for weaknesses, infiltrating U.S. Government networks 
and making similar attempts against American businesses and 
critical industries, is there any other conclusion to be 
reached?
    There are three obvious outgrowths from the above 
statement. One is that you can't win a war if you don't admit 
you are in one. The second is that nobody wins on defense. The 
third is that we need a doctrine for how we intercede in 
cyberspace that covers both offense and defense and maps to 
existing legal and societal principles in the off-line world.
    In short, Congress should consider developing a 21st 
century application of the Monroe Doctrine. The need for a 
framework to guide the Government's role in response to foreign 
aggression is a point that Melissa Hathaway has specifically 
noted during her review and an area where this subcommittee can 
work with the National Security Council.
    You may recall that the Monroe Doctrine, introduced in 
1823, said that further efforts by European governments to 
interfere with the States in the Americas, the Western 
Hemisphere, would be viewed by the United States as acts of 
aggression, and the United States would intervene. The Monroe 
Doctrine is one of our longest-standing foreign policy tenets, 
invoked on multiple occasions by multiple Presidents. We have, 
as the expression goes, sent in the Marines and the rest of our 
Armed Forces to uphold it.
    Some may argue that cyberspace is virtual and unsuited to 
declared spheres of influence. But even internet protocol 
addresses mapped to physical devices in physical locations we 
care about: Critical infrastructures such as a server for a 
utility company in New York or a bank in California. Note that 
the Monroe Doctrine did not detail the same intervention or 
even specific intervention for each perceived act of 
aggression. Merely laid out ``Here is our turf, stay out or 
face the consequences,'' language that allowed great 
flexibility in terms of potential responses.
    We need not militarize all elements of U.S. cyberspace any 
more than invoking the Monroe Doctrine meant creating permanent 
military encampments throughout the Western Hemisphere. The 
advantages of invoking a Monroe Doctrine in cyberspace would be 
to put the world on notice that the United States has cyber 
turf, and the second is that we will defend our turf. We need 
to do both now.
    Thank you and I look forward to your questions.
    [The statement of Ms. Davidson follows:]
                Prepared Statement of Mary Ann Davidson
    Chairwoman Clark, Members of the subcommittee, my name is Mary Ann 
Davidson, and I am Chief Security Officer for Oracle. For more than 30 
years, information security has been a central part of Oracle's 
software DNA, and is a big reason why the Federal Government is 
Oracle's largest customer. Thank you for the opportunity to testify 
regarding the important issue of cybersecurity.
1. The Declaration of Independence states ``All men are created 
        equal.'' All information systems, however, are not.
    This truth of this statement should be self-evident but it isn't, 
and therein lies a risk to our freedoms. The ubiquity, flexibility, and 
configurability of information systems has led to circumstances in 
which software designed for a particular purpose and environment is too 
often deployed in an environment it was never designed for, without any 
thought or explicit acceptance of the risks in so doing. Without 
properly scoping our requirements we are faced with an all-or-nothing 
approach to cyberspace, simultaneously putting at risk our civil 
liberties, our homeland security and the women and men of our armed 
forces.
    Let me give you a present-day example: I had a most frightening 
conversation with a highly placed official in the Defense Department 
who said that DoD wanted to use popular social networking software and 
that (direct quote) ``you in industry need to secure it.'' My response 
to that statement: ``What is DoD going to use the software FOR? `Hi, 
I'm an al Qaeda operative. I like long walks on the beach and IEDs. 
Will you friend me?' '' Without an appropriate context, I noted to the 
gentleman, there is no magic security dust we in industry can sprinkle 
on technology that is already ``out there and being used,'' especially 
if we do not know what it is being used for. Certainly there are 
legitimate scenarios where we may want to permit our troops to use 
social networking software as a morale booster, including contact with 
their family and friends, but the technical and policy-based security 
requirements around that use case are different from a use case where 
the DoD might use similar technology for operational purposes.
    There is no substitute for knowing upfront what you need software 
for, how it is going to be deployed, and what risks you can accept and 
what risks you won't. The time to make those determinations is during 
procurement, not after. The Navy does not purchase container ships and 
try to deploy them as aircrafts carriers. Nor does the Air Force 
purchase Gulfstream Vs and try to configure them as F-22 Raptors. There 
is nothing wrong with container ships or Gulfstream Vs, by the way, but 
they were not designed for the operational needs or--and I emphasize 
this last point--threat environment that aircraft carriers and F-22s 
were designed for. Why, then, is information technology somehow 
``different?'' It isn't. Private industry and Government agencies have 
varying use cases and threat environments in cyberspace, just as they 
share different requirements in the real world. And where privately run 
information systems can benefit from defensive technologies informed by 
our offensive capabilities--to use a metaphor--this rising tide will 
lift all ships in cyberspace.
    Unfortunately, many think software is so flexible and configurable, 
that one size fits all applications. It doesn't. The military already 
knows this, but sometimes they need an occasional reminder. When I was 
a naval officer, I had many different uniforms: dress blues, dress 
whites, tropical whites, khakis, and utility greens. Each had its 
purpose. Should one be foolish enough to wear dress blues to a 
firefight, it isn't merely that you will be breaking uniform 
regulations; you aren't going to be adequately protected, either. You 
wear body armor to a firefight. While cost is one consideration in 
deployment, it need not be the only one, unless we plan on digging up 
old Lee-Enfield rifles and giving them to the Marine Corps instead of 
the M-16s they now use. ``You get what you pay for'' is as true in 
software as in anything else.
    Good security, like good hardware starts in procurement: Knowing 
what you need, how it will be used, and explicitly describing the 
threat environment for deployment. Use procurement wisely and 
aggressively.
    This brings me to my second point.
2. Information technology is mission critical, not merely mission 
        enabling.
    Our entire economy rests on an IT backbone: The acronym ``IT'' 
therefore represents ``infrastructure technology'' as much as 
``information technology.'' In particular, our homeland security and 
our military's ability to prosecute war rests on an IT backbone. DoD 
continues to invest in network-centric operations, which is all about 
getting the right information to the right warrior at the right time in 
the right battlespace. Therefore, the network itself is the battlefield 
because the network is what our enemies will attack if they want to 
deny us the ability to use our own technology (or in an attempt to use 
our technology against us).
    Given that DoD has bet the farm on information systems, they need 
to enhance its treatment of information systems as a core mission 
specialty in supporting roles as well as using information systems 
offensively as a warfare specialty. Absent this capability, the DoD 
will not able to fully use IT as the force multiplier it can be. Just 
as Patton knew his tanks and their technical capabilities very well, 
not just merely how to deploy them, our military and homeland security 
leaders need to know and embrace the full capability of IT. Putting it 
differently, do we envision having a contractor at the helm of an in-
theatre aircraft carrier? If not, then why would our cyber offense be 
any different? Note that the ability to deploy and support systems 
itself is also a critical mission specialty, just as, say, supply/
logistics is a staff function in the military but a critical one. 
Patton knew very well that armies stop without supplies of gas; net-
centric armies stop without supporting information systems. 
Furthermore, only by holding capability for both functions in esteem 
can ``offense inform defense'' and vice versa.
    We must also remember the strength of the American economy rests on 
the flexibility afforded the private sector to innovate and market 
those innovations globally. In the same way our Nation's electrical 
grid, pipelines, roads, and railways support our military but are not 
run by our military, our critical cyber infrastructures and the 
companies who create them cannot simply fall under military control. Of 
course our Government should defend our cyber interests, but in the 
same way we would abhor a military presence at every intersection, we 
must also ensure civilian control over the normal operation of our 
digital highways.
    This brings me to my third point.
3. We are in a conflict--some would say a war. Let's call it what it 
        is.
    Given the diversity of potentially hostile entities building cadres 
of cyberwarriors, probing our systems--including our defense systems--
for weaknesses, infiltrating U.S. Government networks and making 
similar attempts against American businesses and critical industries, 
is there any other conclusion to be reached? Whatever term we use, 
there are three obvious outgrowths from the above statement. One is 
that you can't win a ``conflict''--or war--if you don't admit you are 
in one. The second is that nobody wins on defense. The third is that we 
need a doctrine for how we intercede in cyberspace that covers both 
offense and defense and maps to existing legal and societal principles 
in the off-line world. In short, Congress should consider developing a 
21st century application of a Monroe-like Doctrine. The need for a 
framework to guide the Government's role in response to foreign 
aggression is a point that Melissa Hathaway has already noted during 
her 60-day interagency review of the Federal cybersecurity mission, and 
an area where this subcommittee can productively collaborate with the 
National Security Council.
    For those a tad rusty on their U.S. history, the Monroe Doctrine 
(introduced December 2, 1823) said that further efforts by European 
governments to interfere with states in the Americas--the Western 
hemisphere--would be viewed by the United States as acts of aggression 
and the United States would intervene. The Monroe Doctrine is one of 
our longest-standing foreign policy tenets: Invoked on multiple 
occasions by multiple presidents, including Teddy Roosevelt, Calvin 
Coolidge, Herbert Hoover, and John Kennedy. We have, as the expression 
goes, sent in the Marines--and the rest of our armed forces--to support 
the Monroe Doctrine.
    Note that the Monroe Doctrine did not detail the same intervention 
or even specific intervention for each perceived act of aggression, 
merely laid out ``here is our turf; stay out or face the consequences'' 
language that allowed great flexibility in terms of potential 
responses. Some may argue that cyberspace is ``virtual'' and unsuited 
to declared spheres of influence. But even internet protocol (IP) 
addresses map to physical devices in physical locations we care about--
critical infrastructures such as a server for a utility company in New 
York, for example, or a bank in California.
    The advantages of invoking a Monroe-like Doctrine in cyberspace 
would be to put the world on notice that the United States has cyber 
``turf,'' (properly and narrowly scoped--we should not claim all 
cyberspace as our turf). The second is that we will defend our turf. We 
need to do both. Now.
    As I mentioned earlier, having a military response capability does 
not mean militarizing all elements of U.S. cyberspace any more than 
invoking the Monroe Doctrine meant necessarily creating permanent 
encampments throughout the Western hemisphere. Nor should a cyber-
Monroe Doctrine lead to permanent Government encampments in private 
networks, or become a mandate for unilateral intervention in all of 
cyberspace. With proper guidance, various Government agencies and the 
private sector can find their natural role in guarding our cyber 
infrastructures in a framework similar to how we currently protect our 
real-world interests.
    To summarize:
   Technology is only a force multiplier if you pick the right 
        technology for the intended use and intended threat 
        environment. The Government must make security an explicit part 
        of procurement, funding appropriately skilled staff to execute 
        these procurement requirements while recognizing that some non-
        commercial requirements will incur additional costs.
   We need a skilled cadre of Government information technology 
        professionals--both offense (in the military) and defense 
        (throughout the entire Government).
   We need the cyber-equivalent of the Monroe Doctrine for our 
        21st-century information age that respects the boundaries of 
        our shared ownership of the Nation's cyber infrastructure.

    Ms. Clarke. We thank you for your testimony.
    I now recognize Mr. Lewis to summarize his statement for 5 
minutes.

   STATEMENT OF JAMES A. LEWIS, PROJECT DIRECTOR, CENTER FOR 
              STRATEGIC AND INTERNATIONAL STUDIES

    Mr. Lewis. Thank you and thank you to the committee for the 
opportunity to testify. The new administration has a real 
opportunity to improve our Nation's security in cyberspace, but 
there are many difficult issues it has to address, and the work 
of this committee will be essential in helping to guide that 
effort.
    You know, the President has directed the National Security 
Council to undertake a 60-day review. This review is an 
important step. Cyberspace, as you have heard, has become one 
of the central pillars of our economy and our national 
security. Securing cyberspace will help enable recovery and 
future growth. Officials involved in the review have told me it 
is forward-looking, with a broad scope. It will lay out a 
strategic framework for the United States.
    In my testimony, I would like to discuss how to assess the 
review. The Center for Strategic and International Studies 
issued a report in December on steps the next President could 
take. We made many recommendations and whether you like our 
recommendations or not, I believe strongly that we identified 
the right issues. Any review that does not address the issues 
we identified will be inadequate.
    Among our recommendations there are two that I think are 
crucial. The first is the need for clear leadership from the 
White House, and the second is a comprehensive plan for moving 
ahead. We undertook a long discussion of who should lead the 
Federal cybersecurity effort. It looked at many agencies: 
Defense, FBI, GSA, DHS, the intelligence community. We were 
concerned with agency authorities and competencies, but also 
with the signal that a lead agency would send to the public and 
to the world. The United States should avoid being perceived as 
militarizing the internet, and it should avoid solutions that 
give rise to concerns over privacy and civil liberties. In the 
end, we decided only the White House had the necessary 
authority.
    Clear White House leadership is essential, but it has to be 
accompanied by a truly strategic plan, a truly strategic plan--
a truly comprehensive plan, I am sorry.
    What does comprehensive mean? It means going beyond an 
effort to secure Government networks. It means integrating 
offensive and defensive strategies and looking at how to 
improve attribution and identity in cyberspace. It means 
engaging with foreign nations, something we have not done 
particularly well. It means accepting that the Federal 
Government must use its regulatory powers if we are to make any 
progress.
    I want to emphasize the need to develop regulatory 
strategies, because this has been largely overlooked in 
previous national efforts. Regulation is necessary when market 
forces alone will not provide security. We were careful to note 
in our report that a new approach is needed, one that avoids 
both prescriptive regulations, but also rules, that are so 
diluted as to be meaningless. New regulation must be developed 
in partnership with the private sector, but with the Government 
setting the goals and ensuring compliance.
    My own view is that regulation is essential if we are to 
give substance to public/private partnerships. Regulation gives 
us an opportunity to improve cybersecurity in critical 
infrastructure, something this committee has worked on in the 
past and you will be working on, I understand, in the future. 
The work of this committee has made a tremendous contribution. 
It helped guide us in writing the report. Regulation of 
critical infrastructure will become increasingly important. The 
stimulus package envisions spending on infrastructure and it 
will build security in. This is a good idea, but when we come 
to the question of what precisely needs to be done to make new 
projects secure, we don't know the answer, and we don't have 
the time or the people to develop that answer.
    A failure to invest in infrastructure modernization for 
almost 2 decades has made it impossible to build both quickly 
and securely. Smart Grid projects are an example of this. Smart 
Grid uses, for example, advanced meters to measure and manage 
the flow of electricity. These new meters are based on network 
technologies. Unfortunately, if the new smart meters are not 
secure, they can be hacked. Regulation can play a role in 
remedying this by giving Government the ability to mandate 
actions that mitigate our new vulnerabilities. But if we do not 
build the regulatory foundation now, the United States will be 
put at risk.
    Let me summarize quickly. It is always difficult batting 
clean-up because everyone has already said everything. But we 
need somebody in charge at the White House who will implement a 
comprehensive plan. That plan has to include strategies for 
international engagement and for domestic regulation. Then we 
need to move out.
    Okay. I thank the committee and look forward to your 
questions.
    [The statement of Mr. Lewis follows:]
                  Prepared Statement of James A. Lewis
                             March 10, 2009
    I thank the committee for the opportunity to testify on the Federal 
Cybersecurity Mission. I believe that the new administration has a real 
opportunity to make a significant difference in improving our Nation's 
security in cyberspace, but there are many difficult issues that it 
must address. The work of this committee will be essential for helping 
to guide that effort.
    As you know, the President directed that the National Security 
Council undertake a 60-day review of the U.S. approach to 
cybersecurity. Federal officials involved in the review have told me 
that this is a forward-looking effort with a broad scope. It looks 
beyond securing Federal networks, which was the focus of the last 
administration's efforts, and will endeavor to lay out a strategic 
framework for the United States.
    The decision to undertake this broad review is an important step 
forward for our Nation. Cyberspace has become one of the central 
pillars of our economy and our national security. The adoption of 
network technologies since the 1990's by the United States has been a 
source of both competitive advantage and the rapid growth. The digital 
infrastructure is now essential. More importantly, expanding our 
digital advantage offers the possibility for continued increases in 
productivity and innovation. Securing cyberspace will help enable 
recovery and future growth.
    Reaping the full advantage of digital technologies will require 
real improvement in cybersecurity. Estimates of the damage to our 
economy are imprecise, but millions of dollars are lost each year to 
fraud and theft, millions of dollars worth of intellectual property 
lost to foreign competitors, with the total easily reaching into the 
billion. One of my fears is that as we increase spending on research 
and science as part of the stimulus package, we are actually 
subsidizing the research of our economic and military competitors since 
they can easily access work that cost us millions to develop for only a 
few dollars.
    There is of course additional risk that insecure digital networks 
could allow foreign militaries and intelligence services, criminals, or 
other groups, to disrupt the provision of crucial services that are 
either provided by or depend upon digital technologies. It is easy to 
overstate the consequences of this sort of attack, and much of the 
discussion of cybersecurity over the last decade has involved some very 
silly and exaggerated scenarios for national disaster, but the risk is 
real and growing, and any national security strategy that does not 
address it is inadequate.
    Where are we today in cyber security? From one perspective, we are 
in remarkably bad shape. In the last year, we have seen the networks of 
the two Presidential campaigns, secure networks at the U.S. Central 
Command and computer networks in Congress and other Federal agencies 
penetrated by outsiders. 2007 saw a number of significant penetrations 
of major Federal agencies by an unknown foreign power. The Secretary of 
Defense's unclassified email was hacked. The Department of Commerce's 
Bureau responsible for high tech exports off-line for more than a 
month. The networks of the Departments of State and Energy, NASA, and 
other Federal agencies were penetrated and according to public reports, 
immense quantities of information downloaded. The networks of Federal 
contractors, the defense industry and other leading companies were also 
penetrated. Again, our statistics on this are imprecise, as companies 
prefer to conceal their losses or in many instances may not even be 
aware they have been hacked. Poor cybersecurity damages national 
security and drains our economy.
    In response to this crisis, the Bush administration created its 
Comprehensive National Cybersecurity Initiative (known as CNCI). This 
initiative made real progress in securing Federal networks. CNCI 
included Einstein, a technology that monitors Federal networks for 
intrusion. It included the Trusted Internet Connection initiative, TIC. 
It looked at the question of how to use Federal procurements to improve 
cybersecurity in an effort know as the Federal Desktop core 
Configuration--FDCC. The CNCI included several other initiatives and 
projects, some of which were underway by the time the Bush 
administration ended. Overall, it was a major step forward.
    However, the CNCI had several major drawbacks. It began in the last 
year of the Bush administration. This late start was a serious 
impediment and one advantage for the Obama administration is that it 
came into office understanding that securing cyberspace is a major 
strategic issue. The CNCI was highly and unnecessarily classified. A 
few of its elements deserved being labeled top secret, but most did 
not, and the difficulties that over-classification created for 
coordinating with the private sector and with our allies seriously 
impeded the Bush administration effort. Finally, and most importantly, 
the Comprehensive National Cybersecurity Initiative, despite its name, 
was not comprehensive.
    This was its greatest failing. The CNCI focused on the ``dot.gov'' 
space, on Government networks, and while this is important, it is 
inadequate for cybersecurity. The task involves a global network 
largely operated by the private sector. The CNCI did not have a serious 
international component and it did not adequately address how to secure 
critical infrastructure or the ``dot.com'' space where most commercial 
activity takes place. These were serious shortcomings, and they point 
to crucial areas for work by the new administration.
    At the same time that the previous administration began work on the 
CNCI, the Center for Strategic and International Studies created a 
commission to develop recommendations for the 44th Presidency on how to 
improve cybersecurity. CSIS is a nonpartisan, nonprofit research center 
organization headquartered in Washington, DC with more than 200 staff 
and a large network of affiliated experts. Its research focus is on 
security in a changing global environment. CSIS has been working on 
cybersecurity issues for many years and this work led us, in the face 
of the damaging events of 2007, to establish this Commission. When we 
began our work and for many months afterwards, we did not know of the 
CNCI. Officials involved in the CSNI initially declined our invitations 
to participate in order to preserve the initiative's secrecy.
    The report produced by this commission--I note that the other 
private sector witnesses on this panel were members of the group--laid 
out a truly comprehensive approach to securing cyberspace. Thirty-eight 
thousand copies have been downloaded from the CSIS Web site. We were 
guided by the conclusions that Federal disorganization and an over-
reliance on voluntary efforts had damaged our national security. To 
summarize our recommendations:
   Create a comprehensive national security strategy for 
        cyberspace that uses all the tools of U.S. power in a 
        coordinated fashion--international engagement and diplomacy; 
        military planning and doctrine; economic policy tools; and the 
        involvement of the intelligence and law enforcement 
        communities.
   Publish a public doctrine for cyberspace. The President 
        should state publicly that the cyber infrastructure of the 
        United States is a vital asset for national security and the 
        economy and that the United States will protect it, using all 
        instruments of national power.
   Clarify governance and responsibility for cyber security and 
        establish White House leadership for cybersecurity based on 
        Presidential Strategy and Directives.
   Use regulation to set minimum standards for securing 
        cyberspace, to ensure that the delivery of critical services 
        can continue when we are attacked.
   Mandate strong authentication for access to critical 
        infrastructure. Strong authentication can significantly improve 
        defense, if it is done in a way that protects privacy and civil 
        liberties.
   Use acquisitions policies and rule to drive security, to 
        encourage the development and use of products and services that 
        are secure, based on standards and guidelines developed in 
        partnership with industry.
   Build human capital and improved technologies for securing 
        cyberspace by expanding research, training, and education.
   Refocus and strengthen public-private partnerships and focus 
        them on action, not information sharing. Build on the CNCI 
        effort, as part of a larger and more transparent comprehensive 
        effort to secure cyberspace.
    It is a lengthy list, but this reflects the overarching importance 
of cyberspace to our Nation and the complexity of the problems involved 
in securing it. I believe that the issues we identified are central for 
improving national security and the 60-day review must address them.
    Two recommendations deserve additional scrutiny in the context of 
the 60-day review. These are governance and regulation. We had a 
lengthy set of discussions in the CSIS commission on how best to 
organize for cyberspace. We considered many agencies for the lead role, 
including the Departments of Defense and Homeland Security, the FBI, 
the General Services Administration, and the intelligence community.
    Three problems drove us to reject an agency-led approach. First, 
the mandate of any one agency would have to be greatly expanded to 
fully cover cybersecurity. Agency legal authorities differ widely and 
none--law enforcement, military or intelligence--are by themselves 
adequate for the range of cyber problems. We did not think that a super 
agency with broad domestic and international powers made sense. Public 
perception is important. Giving the intelligence community the lead in 
cybersecurity, although initially attractive to some of us because of 
the strong capabilities these agencies possess, would trigger powerful 
antibodies in the privacy community and the public, particularly after 
the experience of the previous administration's warrantless 
surveillance program and the struggles over FISA renewal.
    The previous administration gave the Department of Homeland 
Security a central role in cybersecurity. We concluded that this was a 
mistake. While DHS has an important role to play, it lacks the 
competencies to deal with the range of issues involved in cybersecurity 
or to successfully engage in conflict with foreign militaries and 
intelligence services. DHS also lacks the interagency stature to direct 
other, more powerful agencies.
    Giving DOD the lead could be interpreted as ``militarizing'' the 
internet and would likely also provoke a reaction from both the privacy 
and the international communities. Foreign nations track U.S. policies 
closely and a decision to give DOD the lead in securing cyber space 
would be interpreted as a decision by the United States to make 
military action the focus of its cyber efforts. This would not be in 
our interest, as we will need to build a collaborative international 
approach to improve security.
    At the end of the discussion, we concluded that only the White 
House had the authority to bring many large and powerful agencies to 
follow a common agenda and to coordinate with each other. A successful 
approach to cybersecurity blends intelligence, law enforcement, 
military, diplomatic, and domestic regulatory functions. Coordinating 
these various functions can be best done from the White House. In 
recommending a White House lead, we emphasized that a ``cyber czar'' is 
not the right solution. The new administration went through a brief 
fascination with czars of various shapes and flavors for different 
issues; our view is that for cyber security, the overly centralized 
approach implied by a czar will fail. The White House and only the 
White House can set strategy and policy, ensure that agencies are 
following them and resolve agency disputes.
    Regulation is the second issue that deserves extra attention. Our 
report concluded that the market would never deliver adequate security 
and the Government must establish regulatory thresholds for critical 
infrastructure. We proposed a new, more flexible approach to developing 
regulation that was based on close cooperation with industry in 
developing standards and an avoidance of prescriptive regulations that 
spell out in precise detail what companies must do.
    Regulation poses a number of challenges. The United States does not 
need regulations that are costly to implement yet deliver little in the 
way of improved security. Nor does the United States need regulations 
that are so diluted as to be meaningless. Finding the required balance 
will be difficult, but if we fail to use regulation to improve our 
national cyber security, if we do not identify mandatory actions to 
secure the digital infrastructure, the Obama administration will have 
no more success than any of its predecessors.
    The stimulus package has inadvertently complicated the issue of 
regulation. The package includes significant funding for infrastructure 
projects, such as the Smart Grid. The package envisions that spending 
on infrastructure will build security into new projects. All this is 
good, but we then come to the question of what precisely needs to be 
done to make these new projects secure? Unfortunately, we do not know 
the answer to this and we do not have the time or people needed to 
develop that answer. A failure to invest in infrastructure 
modernization for more than a decade has makes it impossible to build 
both quickly and securely.
    ``Smart Grid'' projects are an example of this problem. It uses 
advanced meters to measure the flow of electricity and allow it to be 
better managed. These new meters are based on internet technology. 
Unfortunately, if the new ``smart'' meters are not secure, they can be 
``hacked,'' taken over by attackers, and used to disrupt the delivery 
of electricity. The United States does not have the guidelines it needs 
to guide make infrastructure secure.
    I am not recommending that we delay stimulus investments while we 
sort out the requirements for cybersecurity. The most pressing task 
facing the new administration is to mitigate the suffering that the 
recession has brought and to take the steps needed to reduce 
unemployment and restore growth. Infrastructure investment is an 
important part of this. Years of underinvestment in infrastructure have 
put us in this unfortunate situation. However, regulation can play a 
role in remedying this problem, by giving Government the ability to 
identify and mandate actions that mitigate new vulnerabilities. For 
example, a requirement that electrical companies strengthen 
authentication of identity on their control networks would improve 
security. But if we do not build the regulatory foundation now, the 
United States will be put at risk, and the task of laying the 
foundation falls squarely on the 60-day review.
    Regulation can also help reshape and strengthen public-private 
partnerships. For more than a decade, the public dialogue has revolved 
around threadbare ideas on the need to defer to the private sector as 
it owns and operates the bulk of the critical infrastructure and on 
information sharing as an alternative to Government mandates. In fact, 
the result has been to make public-private partnership less attractive 
or less important. The partnership groups often serve a largely 
``representational'' function rather than one that is oriented towards 
action. Companies do not have ``skin in the game.'' Regulate them, and 
they will come. Regulation is the key to improving public private 
partnerships, particularly if these partnerships are tasked with 
developing and maintain the standards upon which regulation must be 
based.
    This administration has a unique opportunity. The United States has 
pursued a market-led approach to cybersecurity for more than a decade. 
This approach is inadequate. Now is the time to identify where 
regulation is needed to improve cybersecurity. Our recommendation was 
to begin with critical infrastructure--if a service is truly critical, 
we should not be afraid to require action to secure it.
    I began by asking where we are today in cybersecurity and answered 
that, from one perspective, we are in remarkably bad shape. From 
another perspective, however, we are at a moment of tremendous 
opportunity. This administration can define an integrated and 
comprehensive Federal approach to securing cyberspace, something no 
previous administration has been able to do. The complexity of the 
problem means that it will take much longer than 60 days to put in 
place the policies, structures, and regulations we will need. However, 
if the 60-day review can establish a clear governance structure led 
from the White House, if it lays out a broad plan of action for moving 
ahead, including the development of a comprehensive national security 
strategy and the use of regulatory authorities to secure critical 
infrastructure, and if this administration acts upon it, the review 
will be a success.

    Ms. Clarke. We thank you for your testimony.
    I thank all of the witnesses for their testimony, and I 
will remind each Member that he or she will have 5 minutes to 
question the panel.
    I will now recognize myself for questions. This first 
question goes to the entire panel. You all have spent a great 
deal of time putting together cyber recommendations for this 
administration. I want to express my gratitude for your work. 
The statements during the campaign and the decision to do a 
comprehensive review suggest that this administration is 
committed to a real change in our approach. My question is: How 
do we judge whether the review has been a success, and what 
specific things should we be looking at to determine if we are 
moving in the right direction?
    Mr. Powner. A couple of thoughts here. Looking at whether 
the review is a success, and echoing what Dr. Lewis mentioned, 
there have been already a fair number of very good 
recommendations through the CSIS report. Clearly, the experts 
we talked to had some additional recommendations. One, that 
that review needs to take into consideration those many 
recommendations. The other thing is looking back on this 
historically, even back to the mid-1980's, we really need to 
look at a new organization. DHS-led hasn't really cut it. 
Recently, an 18-sector approach where all sectors are created 
equal, I am not certain that that is the right approach either. 
Moving forward we need to look at certain things: A new 
organizational structure; greater prioritization; and clearly 
more accountability for those organizations that are in charge.
    Ms. Clarke. Anyone have anything else to add to that?
    Mr. Lewis. Well, we know what a bad plan looks like because 
we have lived through at least a couple of them. I think that 
if we were looking at this plan, we would want clear 
leadership, some comprehensive strategies that include both 
international and regulatory, that look at combining 
intelligence, military, law enforcement, diplomatic engagement. 
We would want a commitment to action. At the end of the day, if 
we see those three things--leadership, planning, action--we 
should be better off.
    Ms. Clarke. Let me then move on and direct this question to 
Mr. Powner. I know that the CSIS Commission met with the review 
team last week. Have you met with the review team yet?
    Mr. Powner. No, we have not. We are in the process of 
trying to get that scheduled.
    Ms. Clarke. Would you please let us know how we can help 
facilitate that meeting?
    Mr. Powner. We will.
    Ms. Clarke. My next question, and it is ironic because I 
understand that Mr. Beckstrom has joined us in the audience, 
and I would like to thank him for his service and express my 
regret for our inability to retain his talent and expertise. 
But late on Friday, Mr. Rod Beckstrom announced that he was 
resigning as Director of the National Cybersecurity Center. I 
think this is a loss for the community and it is unfortunate 
that Mr. Beckstrom's skills weren't put to good use. In his 
resignation letter he acknowledges the critical importance of 
the NSA, but said that their dominance in cybersecurity today 
is a bad strategy.
    Can you all comment on what you agree or disagree with in 
these comments and what role the NSA should play alongside DHS? 
Mr. Charney.
    Mr. Charney. Yes. So there is no question that the center 
of technical expertise in the Government, particularly on the 
operational side, is within NSA. However, I agree with the 
comments made earlier, that at the end of the day, if you want 
the public to trust that the networks are being secured well 
and in a transparent fashion, the mission cannot reside in NSA. 
So I think it is really important to empower DHS to take the 
necessary operational role and have a relationship with NSA 
that captures and utilizes their technical expertise.
    Ms. Clarke. Anyone else want to comment? Okay. I am going 
to move on to my next question.
    On March 24, this subcommittee will hold a hearing entitled 
``Securing the Smart Grid from Cyber Attack''. We will be 
discussing a number of technological issues related to the new 
advanced metering technologies that are being developed and 
deployed.
    But this question has to do with policy. What Federal 
agency is in charge of defending against the cyber attack 
launched by a nation-state against our electric grid and what 
agencies do you think should be in charge of defending against 
such an attack? Any thoughts on that issue?
    Mr. Yoran. Ms. Chairwoman, this is an issue that we have 
been trying to tackle for some time, initially with a National 
Cyber Incident Response Working Group, co-chaired by the 
Department of Homeland Security, Department of Justice and the 
Department of Defense. It is an issue that I think is one that 
ought to be a key focus for Melissa Hathaway as she conducts 
her 60-day review, understanding exactly what the authorities 
are, the priorities, the technical capabilities that exist in 
various pockets of the Federal Government, and how they can be 
brought to bear most effectively so that that planning can 
occur before any time of crisis.
    Mr. Lewis. I was just going to add, for me the answer would 
be FERC or the NRC or maybe the Department of Energy. I say 
that because they have the relationships with the companies. 
They know how the stuff works. They are the people who have the 
regulatory authorities. The last thing you want is somebody new 
charging in in a crisis and saying, ``I am in charge, do what I 
say.'' So I would say look at the folks who are doing this now.
    One of the things that this committee has done that has 
been very useful is hold those regulatory agencies accountable 
and get them to move out a bit more smartly. I think that would 
be a good direction to continue.
    Mr. Powner. Chairwoman Clarke, if I can just add to your 
question on who is responsible for defending--and I want to 
make sure we are real clear on this. If it is a response--if we 
are answering that in terms of response I agree it is muddy. It 
could be various Federal agencies and entities in charge of 
that response, depending on the severity of the attack. But in 
charge of defending the grid, it is those public utility 
companies that own the grid.
    Ms. Clarke. Well, thank you very much. My time is up. I now 
recognize the Ranking Member of the subcommittee, the gentleman 
from California, Mr. Lungren, for questions.
    Mr. Lungren. Thank you very much, Madam Chairwoman, and 
thank you all for being here. I appreciate the contributions 
you all have made and there are so many questions to ask. Let 
me just try one very, very quickly.
    Dr. Lewis, you were very specific about saying that the 
person who should be in charge of the leader of the new 
comprehensive cybersecurity ought to be in the White House.
    Mr. Charney, if I understand what you said, I thought you 
felt the DHS could be stood up to have that responsibility.
    Mr. Charney. Sir, to be clear, there is a difference 
between developing a strategy and coordinating it through the 
Federal agencies and the individual responsibility of the 
various agencies.
    Mr. Lungren. Right.
    Mr. Charney. So if you are going to look at a national 
strategy that has to determine some very difficult questions 
like when is a cyber attack an act of war and what is a 
proportional response, those kinds of key decisions are to be 
done at the White House level. But you also need an operational 
capability, things like US-CERT, an agency to help the other 
agencies deploy best practices. So I view DHS as more 
operational of implementing the strategy, but I think strategic 
elements and the cross-government cooperation has to be at the 
White House.
    Mr. Lewis. I agree completely with that. I think if you 
look at the agencies, I agree completely FBI has a role, DOD 
has a role, DHS has a role, the intelligence----
    Mr. Lungren. I understand they all have roles. My question 
has been--I think Mr. Charney responded to it and I have 
articulated it before, but I am concerned about a lack of 
urgency not only in the Congress, in the White House, in the 
public domain with respect to the threat, No. 1; and, No. 2, 
how we do it?
    As we have seen DHS develop and pull itself together, I 
think it is actually starting to get its sea legs and frankly I 
think doing a far much better job today than it was 2, 3, 4, 5 
years ago. That is part of what happens when you stand up an 
agency like that.
    But there is the question of a sense of urgency. The 
President and his particular delegate in the White House can 
set the policy, but how do you make sure people follow it? We 
all know CIOs in the various departments and agencies have a 
natural protective mechanism about how it ought to be done. We 
understand that you have got DOD, you have got NSA, you have 
got the FBI and all of them, and all of them believe they have 
a certain respected expertise.
    How do you engage that sense of urgency throughout the 
Federal establishment that has not been there? I am not trying 
to blame anybody. I am just trying to state a fact because it 
hasn't been there in the public either. How do we leapfrog to 
that position where we have that policy established at the 
White House on the one hand, but then we have the 
implementation or operational motivation and authority? Because 
if the various individuals responsible for the various agencies 
and departments think they can just kind of shrug when they get 
the call from the person at DHS, it doesn't drive what I want 
to be driven here. Mr. Yoran.
    Mr. Yoran. Sir, I think that is a very important issue, 
when they get the call from DHS, that they have to feel a sense 
of urgency in getting it fixed or, more importantly, not feel 
like they can rely on DHS doing the monitoring, where the 
intelligence community is protecting them. Everybody has to 
feel a sense of responsibility and ultimately be held 
accountable for the protection of the information and the 
systems that they manage and need in order to accomplish their 
core mission. Until the Executive branch or any branch of 
Government holds senior leadership accountable for flaws in the 
security culture, lapses in security which are a result of lack 
of due care or negligence if you want, until there is some 
accountability there, I don't think we are going to see 
meaningful change.
    Mr. Lungren. Let me follow up and ask a slightly different 
way. That is, how do we maintain those people that have the 
quality that can do that job, and how do we attract others to 
those kinds of jobs? In other words, you can't pay them as much 
as the private sector can pay them. It is like when people go 
in the military service or do some other type of service. They 
do it in part because they are making a contribution, but they 
know their contribution is going to be utilized. It is going to 
be valuable. It is going to be effective.
    How do we raise that level of appreciation so it is not 
just accountability, but it is also responsibility in the sense 
that it is recognized throughout the establishment, both 
private sector and public sector?
    Ms. Davidson. I believe that one of these--this is one of 
the issues I tried to touch upon, which is if you don't 
actually have a career path, you see there are people whose job 
it is to do information technology. Information technology will 
continue to be the janitorial service of many organizations 
where we are cleaning up other people's messes. It absolutely 
is critical. One of the things that we do to try to make people 
understand how critical it is is to, quite honestly in our own 
company, to go into various meetings and say, let me show that 
a particular tack isn't theoretical; I am going to hack your 
software. This is exactly how I can do this. This is exactly 
how I can corrupt a system.
    That creates some of the awareness. It is scary but it is 
necessary. Either that or we wait until we get a real attack.
    In terms of, you are talking about compensation trying--we 
do actually elevate those security professionals to give them 
some recognition within their jobs so they get training, they 
get recognition. It is recognized as a specialty that is held 
in esteem. As you point out, you can't always give people more 
money, but you can give people respect. I think you need both 
of those to show what is possible and to show that the, if you 
will, the warriors who defend it do a good job at it, and that 
creates the environment by which people who are able to 
actually do that kind of work are respected.
    Mr. Lungren. Could I ask one real quick question, maybe for 
a quick response? That is, how will we enforce the new Davidson 
doctrine that you articulated to protect our cyberspace?
    Mr. Lewis. Let me try. All of us have worked in the Federal 
Government for a long time, and if you want power, there are a 
couple of things that give you power: Access to the President, 
control of the budget, control of policy. For me, the only 
place you are going to do that is in the White House. If I have 
the access to the President, control of your budget, and I can 
say what the policy is and know that the President or the Vice 
President or the National Security Adviser will back me up, I 
will get agencies to do whatever I want. That is what we need.
    So you want to know who is going to enforce the Davidson 
doctrine? It is a good name for it, by the way. You know, we 
have to put that at the White House.
    Ms. Clarke. I now recognize Mr. Lujan from New Mexico for 5 
minutes.
    Mr. Lujan. Thank you, Madam Chairwoman. I am going to just 
jump right into this, because there are many questions I think 
that need to be asked, and I am not sure if we will run out of 
time with doing this.
    But specifically with what we are discussing today with 
understanding that DHS is the lead agency for the Nation's 
cybersecurity and the key components that exist within DHS, 
what are your thoughts--and I don't know if we want to start 
with Mr. Powner, and then I will move down the line a bit--but 
from the perspective of having DHS move away from their near 
exclusive internal focus on cybersecurity issues and more 
toward development and deployment of software and hardware 
solutions to protect critical infrastructure projects?
    Mr. Powner. We have done a lot of work with the DHS. DHS 
clearly is the lead cybersecurity focal point for the Nation. 
Even working with our critical infrastructure owners, if you 
look at policy and law and how that is laid out, it is pretty 
clear that they have not lived up to those responsibilities. So 
the question going forward is, do we want to keep working with 
them as the operational entity that is the lead or do we just 
designate them an operational role and put someone else in 
charge of primarily coordinating with the private sector, with 
the intelligence community, and with the military 
organizations? We would think the latter.
    Mr. Charney. I think it is really important to get the 
organizational structure right. Every Federal agency needs to 
deploy IT systems for their business operations, and therefore, 
every Federal agency needs a CIO and a CSO, a chief security 
officer, who manages security at that agency. Now, when you 
have a distributed organization--and certainly Microsoft is 
one--you end up with a lot of different, essentially business 
groups, that are running IT that will service their business 
mission, and that is fine.
    The role that DHS should play in coordination with NST that 
sets standards for civilian agencies, and NSA because of their 
technical expertise, is to decide what the minimum bar is for 
security that should be required to be implemented by the 
various agencies. You know, in any environment there are things 
that you have to do, things that would be good to do, and best 
practices that you might like to deploy. Understanding what is 
required versus what is recommended versus what is a best 
practice is really important.
    But I don't think you can have, for example, DHS making 
hardware and software decisions for the various agencies 
because the hardware and software that is deployed has to map 
to the agency mission. But DHS could say, as a requirement of 
deploying whatever you are going to deploy, there are certain 
security things that must be done: You must have a documented 
information security program; you must have technical controls 
and people controls in place to manage risk; you need an 
incident response plan in place because bad things will happen.
    I think that is the appropriate function of DHS.
    Mr. Lujan. Mr. Yoran, before you answer that, I think that 
is a perfect segue into an issue that I want to raise.
    Within our New Mexico DOE and New Mexico laboratories, 
there is a real opportunity with the work that they are working 
on to improve the Nation's cybersecurity posture by bringing 
the resources to bear on this critical problem. So in speaking 
specifically to some of the IT teams that are being discussed 
and making sure that we have a centralized point to be able to 
have access, whether it is to the President or to others as we 
are talking about this issue, what are your thoughts in taking 
advantage of the expertise that lies in some of our Nation's 
DOE laboratories that are working with specific issues, some 
which are partnered with DOD responsibilities as well?
    Mr. Charney. It is obviously critically important to grab 
expertise wherever it resides, and one of the things DHS should 
be doing is discovering and then propagating best practices 
across the Government and the private sector. So I think that 
would be a key thing to do.
    Mr. Lujan. Thank you. Madam Chairwoman, if I may shift a 
little bit and get your perspective.
    As we are moving forward with the deployment of Smart Grid, 
including the importance of communications and the potential 
threats that could exist from attacks, what is the importance 
of making sure that we are taking into consideration the 
elements and inventories across the country and making sure we 
have adequate protections for our critical infrastructure like 
electricity, renewable generation areas, and the backbone of 
really what will essentially be our Smart Grid?
    Ms. Davidson. I do think that there are entities who are 
looking at that in their role with the utilities. But if I 
could actually back up a little earlier than that, if you think 
of this as a supply chain, one of the things that actually 
needs to change that none of us touched upon, part of the 
reason we have these difficulties--I don't think anybody sits 
down and says I think I am going to deploy a system that is 
hopelessly insecure and will leak like a sieve. It isn't merely 
awareness. It is that a lot of the people who are building 
these at the grassroots level do not understand that they have 
any responsibility and they don't learn to think like an 
attacker. That starts with the university system.
    It is not just computer science and electrical engineering, 
it is people who are building these control systems. If you can 
change one thing, if you can get the people designing and 
building those things to assume, think like a hacker, assume 
your system will be attacked, then they will design 
differently. They will build differently. They will deploy 
differently. By the time someone like a utility gets something, 
they will still have to ask intelligent questions in 
procurement, but they won't have to sit around and wonder, I 
wonder if anybody had a clue whether somebody is going to try 
to attack the power grid?
    We have to move the supply chain for security-aware people 
all the way back into the university systems. Unfortunately, 
having gone to the universities--I believe Scott has as well--
you get a resounding nonresponse from universities when you 
ask, do you teach secure coding practice in all of your 
engineering and control system disciplines?
    Mr. Lewis. On the question, the national labs are actually 
places that you could look for. Both Sandia, which has done 
some excellent work, also Idaho National labs, NERC, FERC, NST, 
Department of Energy, these are all the people who could help 
us make sure that Smart Grid is secure.
    Ms. Clarke. Mr. Lujan, we will be covering that territory 
in about 2 weeks when we do our Smart Grid hearings. So this is 
a precursor to it.
    I would like to now recognize Mr. Broun of Georgia for 5 
minutes.
    Mr. Broun. Thank you, Madam Chairwoman.
    First, I want to respectfully disagree with those of you 
all that think that the White House is the place to put central 
control of this problem, for the simple reason that I am 
disappointed that we haven't been more aggressive in our last 
administration, and I don't know what kind of aggressiveness we 
are going to have in this administration to try to solve this 
problem.
    As I have learned more and more about it I am extremely, 
extremely concerned about our national security, not only from 
a military perspective but an economic perspective.
    At home, I have utilized Koperski, I have used Norton, I 
have used McAfee to try to make sure that my own home computer 
networks are secure and have a firewall that are in place. I 
have just recently learned how inadequate those programs are. 
So I think we have to have a national effort to develop some 
kind of very, very strong national security and economic 
security type of plan.
    But I think this committee and the Department of Homeland 
Security is the best place to do that, for the simple reason 
that in the administration you have personalities and different 
focuses and those sorts of things. I do agree we need to have a 
central focus, but I don't think the White House is that place. 
I think this committee ought to be setting policy, and not the 
White House frankly; and the Department of Homeland Security I 
think is the best way to try to coordinate things within the 
interagency efforts to make sure that we stay secure, whether 
it is DOD, Department of Energy or all the other sources as 
well as within the private sector.
    Having said all that, I believe in the private sector, I 
believe in the marketplace, and I think innovation and 
development comes probably best in the private sector and not 
from governmental sources. Can the Government secure our 
cyberspace without private sector involvement, and how much 
private sector involvement do we need in that? I just throw 
that open to the panel.
    Mr. Powner. Well, clearly 85 percent of the cyber-critical 
infrastructure associated with this Nation is owned by someone 
other than the Federal Government. So the Federal Government 
can't do it. The key is partnering with them, where those 
private sector owners view the Federal Government as a credible 
partner that provides a valuable service. I think that is what 
has been determined with DHS with their US-CERT operations 
where we share threat information. The message really going 
forward is we in the Federal Government, whether it is DHS or 
whether it is the White House, they need to do a much better 
job where they are viewed as a credible partner in helping the 
private sector secure it.
    Mr. Yoran. I would just add to that a little bit. I agree 
that centralized coordination is required. I think the 
Department of Homeland Security's key role can be in protecting 
the dot.gov, the Federal civilian agencies. I don't think the 
DHS can effectively lead sort of offensive capabilities we 
would need in cyber or counterintelligence capabilities we 
would need in cyber, nor do I think the Department of Defense 
would subjugate their cybersecurity efforts, which are 
necessary for conducting warfare today, to the Department of 
Homeland Security.
    However, I agree with you entirely that the best thing 
Government can do is fund some fundamental long-term research, 
but ultimately rely on the private sector and commercial 
products for the development of IT technologies that have more 
security and IT security technologies that have more capability 
by refining their requirements and using their procurement and 
acquisition capabilities to drive those products and features 
into the commercial software versus trying to develop 
technologies in Government development efforts.
    Mr. Broun. My time is about up but I appreciate y'all's 
comments. I have got a hundred questions to ask you all and 
don't have the time to do that. I appreciate y'all's efforts.
    I see this as a critical national security interest. In 
fact, just in the commercial sector, if we have an attack, 
which we are having every day on commercial entities, if we 
have an attack on our commercial entities, it can totally wreck 
this Nation. So I think we have got to find a solution, and I 
look forward to your answers that--I am going to give you all 
some questions in written form and and I appreciate y'all's 
candid answers to that.
    I think we need to act and act now. Government doesn't do 
that very well. It is very slow in acting, and that is the 
reason why I want to try to get the private sector involved as 
much as we possibly can, because I think the private sector can 
be more innovative and can act quicker and can find real 
solutions to this. We need to have some coordinated efforts, 
and I think the Department of Homeland Security is the best way 
to do that.
    Thank you, Madam Chairwoman.
    Ms. Clarke. The Chairwoman recognizes for 5 minutes the 
gentleman from Ohio, Mr. Austria.
    Mr. Austria. Thank you, Madam Chairwoman. To our committee, 
thank you for your testimony today. I appreciate it very much.
    I want to follow up on some of the questions that were 
asked earlier and more on the role of homeland security in your 
opinion. When you look at the jurisdiction, the electricity, 
the grid was brought up earlier, and you testified that you 
know it has fallen on the Department of Energy. Sometimes we 
see things intertwined between the different departments, 
whether it be DOD, Department of Justice. What do you see as 
Homeland Security's role or jurisdiction as a department? I 
would open that up to the entire panel.
    Mr. Yoran. I think that Homeland Security's greatest impact 
can be summed up in three key areas. The first is in US-CERT 
series of programs and operations to help protect the dot.gov, 
the Federal civilian systems and agencies.
    The second is in cross-critical infrastructure issues. 
Clearly, the Department of Energy and other regulatory bodies 
define security standards, measure their effectiveness, and 
have many levers for forcing change in the private sector.
    I think the third is sort of working on issues where the 
failure of one critical infrastructure or the security levels 
in one critical infrastructure don't address the requirements 
of another industry, of another sector of our economy.
    The third area is in interaction with the private sector 
through a series of well-defined public/private partnerships 
with specific objectives and also with value-add and incentives 
in the private sector for their voluntary participation.
    Mr. Charney. I suggest the way to think about this is 
separating out the horizontal from the vertical. There are a 
lot of things in IT that are horizontal on which all the 
verticals depend. So robust authentication, knowing who is 
connecting to your network, you need to know whether you are 
telecom, energy, or something else.
    There are other things that are unique to vertical sectors. 
The energy SCADA systems may be different than phone SCADA 
systems. As a result of that, I think when you think of DHS' 
role, I view it as kind of the horizontal base security, and 
then the sectors and their regulatory agencies have to focus on 
the vertical uniqueness.
    Mr. Austria. Thank you for that. That is why I do agree 
with you. I think we need to have clear leadership and a 
comprehensive strategy and a commitment to take action in those 
areas so that is much better defined.
    Let me jump over to the public/private partnership because 
I do agree with you on that. I have always believed that the 
private sector, which designs and deploys and maintains much of 
our Nation's critical infrastructure is far ahead of Government 
in their ability to detect, to attribute, and to defend against 
a cyber attack.
    Correct me if you think I am wrong, but isn't that, again, 
a reason just to follow up on some of the other questions with 
the public/private sector, that we really should be pursuing 
this to really achieve national security when it comes to 
cyberspace?
    Mr. Charney. Sir, the answer is yes. We all here I think 
are big fans of private sector innovation, but I will say I 
wrote years ago that you couldn't make a market case for the 
Cold War. I mean, there are certain things in national security 
where the markets are not designed to address the problem, 
because when we build products for market we know that we have 
a large customer base that is global and very price-sensitive. 
Some of things that the national security community requires is 
very specific and expensive.
    So it has long been my view that you need a symbiotic 
relationship where--and I described this in my testimony--where 
you figure out what the market will provide, what national 
security needs are, and how Government can help bridge that 
gap. I don't think you can rely on markets alone to bridge the 
gap because markets aren't designed to do that any more than 
they are designed to protect national security and provide law 
enforcement mechanisms. These are things that we tax people for 
and make them pay for from the Government.
    Ms. Davidson. I do agree with Scott largely, but I also 
think that the Government can be a smarter buyer. Even 
something as simple as some transparency in procurement around 
what vendors do and do not do in terms of security, I don't 
think in many cases the questions have ever been asked. It is 
certainly asked at the Defense Department level or the 
intelligence. They want to know how you engineered your 
software. But the average garden-variety agency does not ask 
that. Why would that change things?
    This is something I think, unfortunately, women can 
understand better than men, but I call it the bathing suit 
test. If you have to go out in public in June in a bathing 
suit, along about March you are going to put it on and you are 
going to say I can't believe I look like this; I better get in 
shape before I have to go out in public.
    If people had to disclose, so to speak, their development 
processes related to security, you would want to look a lot 
better by the time you are actually filling in the form. That 
per se is not going to cure all our ills, but it will improve 
what people are buying or at least they will know what they are 
getting and not getting, and they can make smarter decisions as 
purchasers.
    That will not, as Scott I think would agree with, mean that 
we are going to--commercial software, unless it has been 
necessarily engineered to the highest level of software 
assurance that, for example, the intelligence community could 
want. But even raising the baseline would be a very good start. 
It would save people a lot of money they are spending now, 
trying to patch their security and make it harder for bad guys 
to do what they do. Make them work harder.
    Mr. Austria. I understand that my time is up. Thank you. I 
do agree with my colleagues that, you know, cyberspace security 
is critical to our national security. I have other questions 
that I will be glad to submit to our panel. But thank you, 
thank you for your time.
    Ms. Clarke. Thank you. The Chairwoman now recognizes the 
Chairman of the full committee, the gentleman from Mississippi, 
Mr. Thompson.
    Mr. Thompson. Thank you very much, Madam Chairwoman. I was 
listening to the testimony in the rear but I was multitasking, 
too.
    This is basically to each panel member. With the 
information that you have available to you, do you think the 
United States is prepared for a major cyber incident?
    Mr. Powner. No, we are clearly not as prepared as we should 
be. I will go back, several years' work that we did for this 
subcommittee, I think several Congresses ago, looking at 
internet recovery. You can look at what happened with 9/11, 
Katrina, on how we recovered major portions of the internet. 
There were major lessons learned in that.
    The question going forward, do we have--one of the 
requirements in our current national strategy is a joint 
public/private internet recovery plan if we have a major, major 
attack. We still don't have that plan. You need a plan. You 
need to exercise that plan. So I think today we are not 
prepared.
    Mr. Lewis. You can look at the experience of 9/11, and I 
hate to bring it up because it is painful, but one of our co-
chairs who couldn't be here today, Harry Raduege was the 
Director of the Defense Communications Network. On that day, he 
got phone calls from all the major service providers, all the 
big telecom companies, all the big IT companies saying, how can 
we help, what can we do to restore service? I know that Dick 
Clarke, who was also at the White House then, got similar 
calls.
    So you had two people, people who knew who to call, they 
had the existing relationships, and they knew how to do things. 
They knew how to move trucks from Ohio or from Virginia to New 
York or to Washington to rebuild services. We don't have that 
today in cyberspace, and that is one of the things we 
desperately need.
    Ms. Davidson. I would like to tell a story in response, a 
short one. That is, in the 1920's, there was a Marine Corps 
colonel who realized the next war would be with Japan, and it 
is because of him that the Marine Corps developed amphibious 
warfare capability. He saw this in the 1920's, which was long 
before December 7, 1941. So we don't have that much time.
    There are people who are sounding the warning. There are 
people who are trying to do things differently. We are not 
going to have 21 years to get it right. So we do need to act 
now. No, we are not prepared.
    Mr. Thompson. Mr. Yoran.
    Mr. Yoran. Sir, I would say that the nefariousness of cyber 
is the fact that we are experiencing the 9/11 in cyber. It just 
doesn't have the tremendous visibility.
    For over 10 years now, for over a decade now, we have had 
significant incidents going on with foreign adversaries, and 
our national response has basically been to look the other way 
or occasionally have an article in the news media about it. So 
because there is no catastrophic visible outcome, we sort of 
lie in bed at night and are able to sleep, not realizing 
exactly how much damage is occurring. So we are not prepared.
    Mr. Charney. I would never go against my esteemed 
colleagues on this point. I would point out, however, that it 
is important to focus on the nature of the attack so you can 
figure out your strategy for defending. There are attacks 
against confidentiality, we have heard a lot about that, where 
data is taken. There are attacks against integrity where people 
alter critical systems or data that you rely upon. There are 
attacks against availability, and then the systems go down. In 
the availability attacks, I mean one goal is always to keep 
five-ninths of availability, keep the networks up. But the 
other part of any strategy has to be about how fast you can 
reconstitute the capabilities if the capabilities fail.
    So this is one of the reasons it is so important to have a 
comprehensive strategy, because when you think about how you 
are going to reconstitute across multiple networks and maybe 
across multiple time zones, it is actually quite challenging. 
You have to figure out what your strategy is for 
reconstitution, who is in charge, roles and responsibilities, 
what is the interface to the private sector that owns 85 
percent of this infrastructure. The availability problem is in 
some ways different than the confidentiality and the integrity 
problem. It is important to focus on all of them.
    Mr. Thompson. Well, I would like to say, Madam Chairwoman, 
that what we have just heard is very troubling, I think to me 
and the rest of the committee, that we have some work to do. I 
think perhaps at our next hearing we need to bring some of the 
people who have the primary responsibility for the plan, or 
whatever we are operating under, and see if we can get some 
idea as to what they are doing to keep us safe. But I am real 
concerned about it. I would say that both the subcommittee and 
I as Chairman on the full committee will give this our 
undivided attention, and I would look to people like yourselves 
to help provide the leadership, getting us where we need to be. 
I yield back.
    Ms. Clarke. Thank you. Member Lungren.
    Mr. Lungren. Madam Chairwoman, I just wanted to tell you 
this is an outstanding panel that I thank you for putting 
together. I thank all of you for being here. We could go on 
with this for hours. Some of us will probably submit some 
written questions. I know we have already begged your 
indulgence for the time you have given us, but hopefully if you 
could respond to those in a timely fashion, we could maybe talk 
to you later, too, as well. Thank you.
    Ms. Clarke. I thank the witnesses for their valuable 
testimony and the Members for their questions. The Members of 
the subcommittee may have additional questions for the 
witnesses, and we will ask you to respond expeditiously in 
writing to those questions.
    Hearing no further business, the subcommittee stands 
adjourned.
    [Whereupon, at 4:04 p.m., the subcommittee was adjourned.]

                                 

```