```

[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]

 FACILITATING CYBER THREAT INFORMATION SHARING AND PARTNERING WITH THE 
                  PRIVATE SECTOR TO PROTECT CRITICAL 
           INFRASTRUCTURE: AN ASSESSMENT OF DHS CAPABILITIES

=======================================================================

                                HEARING

                               before the

                     SUBCOMMITTEE ON CYBERSECURITY,
                       INFRASTRUCTURE PROTECTION,
                       AND SECURITY TECHNOLOGIES

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED THIRTEENTH CONGRESS

                             FIRST SESSION

                               __________

                              MAY 16, 2013

                               __________

                           Serial No. 113-17

                               __________

       Printed for the use of the Committee on Homeland Security

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                                _____

                  U.S. GOVERNMENT PRINTING OFFICE

85-613 PDF                WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2250  Mail: Stop SSOP, Washington, DC 
20402-0001

                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Paul C. Broun, Georgia               Yvette D. Clarke, New York
Candice S. Miller, Michigan, Vice    Brian Higgins, New York
    Chair                            Cedric L. Richmond, Louisiana
Patrick Meehan, Pennsylvania         William R. Keating, Massachusetts
Jeff Duncan, South Carolina          Ron Barber, Arizona
Tom Marino, Pennsylvania             Dondald M. Payne, Jr., New Jersey
Jason Chaffetz, Utah                 Beto O'Rourke, Texas
Steven M. Palazzo, Mississippi       Tulsi Gabbard, Hawaii
Lou Barletta, Pennsylvania           Filemon Vela, Texas
Chris Stewart, Utah                  Steven A. Horsford, Nevada
Richard Hudson, North Carolina       Eric Swalwell, California
Steve Daines, Montana
Susan W. Brooks, Indiana
Scott Perry, Pennsylvania
Vacancy
                       Greg Hill, Chief of Staff
          Michael Geffroy, Deputy Chief of Staff/Chief Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY 
                              TECHNOLOGIES

                 Patrick Meehan, Pennsylvania, Chairman
Mike Rogers, Alabama                 Yvette D. Clarke, New York
Jason Chaffetz, Utah                 William R. Keating, Massachusetts
Steve Daines, Montana                Filemon Vela, Texas
Scott Perry, Pennsylvania            Steven A. Horsford, Nevada
Vacancy                              Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (ex             (ex officio)
    officio)
               Alex Manning, Subcommittee Staff Director
                    Dennis Terry, Subcommittee Clerk

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Patrick Meehan, a Representative in Congress From 
  the State of Pennsylvania, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies...................................................     1
The Honorable Yvette D. Clarke, a Representative in Congress From 
  the State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Oral Statement.................................................    19
  Prepared Statement.............................................     4
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security..............................................     2

                               Witnesses

Ms. Roberta Stempfley, Acting Assistant Secretary, Office of 
  Cybersecurity and Communications, U.S. Department of Homeland 
  Security, Accompanied by Larry Zelvin, Director, National 
  Cybersecurity and Communications Integration Center, U.S. 
  Department of Homeland Security:
  Oral Statement.................................................     5
  Joint Prepared Statement.......................................     8
Mr. Charles K. Edwards, Acting Inspector General, U.S. Department 
  of Homeland Security:
  Oral Statement.................................................    14
  Prepared Statement.............................................    16

 
 FACILITATING CYBER THREAT INFORMATION SHARING AND PARTNERING WITH THE 
PRIVATE SECTOR TO PROTECT CRITICAL INFRASTRUCTURE: AN ASSESSMENT OF DHS 
                              CAPABILITIES

                              ----------                              

                         Thursday, May 16, 2013

             U.S. House of Representatives,
                    Committee on Homeland Security,
 Subcommittee on Cybersecurity, Infrastructure Protection, 
                                 and Security Technologies,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 9:05 a.m., in 
Room 311, Cannon House Office Building, Hon. Patrick Meehan 
[Chairman of the subcommittee] presiding.
    Present: Representatives Meehan, Clarke, Vela, Horsford, 
and Thompson.
    Also present: Representative Jackson Lee.
    Mr. Meehan. The Committee on Homeland Security Subcommittee 
on Cybersecurity, Infrastructure Protection, and Security 
Technologies will come to order. The subcommittee is meeting 
today to examine the Department of Homeland Security's National 
Cyber and Communications Integration Center, better known as 
the NCCIC, and its capabilities to protect critical 
infrastructure from cyber attack.
    I would like to welcome everybody to today's hearing, which 
will give Members an opportunity to examine in-depth the work 
of the Department and Homeland Security's National 
Cybersecurity Communications and Integration Center.
    The NCCIC is one of the U.S. Government's key civilian 
interfaces with the private sector for cyber-threat information 
sharing, incident response, and protecting the U.S. critical 
infrastructure. The NCCIC is a collaborative method for Federal 
agencies, State and local governmental entities, the private 
sector, all to communicate cyber-threat information, analysis, 
and prevention methods in real time.
    The subcommittee has been crafting a body of work that will 
help establish key areas where we can improve the Department's 
critical infrastructure protection from cyber attack. We have 
examined the threat, particularly from nation states. We have 
looked at protecting U.S. citizens from civil liberty 
violations. Today we look at the threat mitigation capabilities 
at the Department of Homeland Security.
    The director of the National Intelligence, James Clapper, 
testified before Congress this year, stating that cyber is the 
No. 1 National security threat facing our country. On March 12, 
Director Clapper stated, and I quote: ``We assess that highly 
networked business practices and information technology are 
providing opportunities for foreign intelligence and security 
services, trusted insiders, hackers, and others to target and 
collect sensitive United States National security and economic 
data.''
    In addition, the director for the National Security Agency, 
General Keith Alexander, has said that cyber espionage has 
caused the ``greatest transfer of wealth in history.''
    Our Nation is in a new era and our security is no longer 
protected by oceans and borders. Indeed, American achievement 
in the 21st Century will be intricately tied to our ability to 
secure our networks, primarily our critical infrastructure 
networks.
    While our military protects our Nation from foreign 
adversaries, the security of our critical infrastructure--our 
economy, our roads and bridges, domestic energy, water and 
public utility systems--must be a collaborative effort between 
the private sector, the local, State, and Federal Government. 
We need a civilian agency to facilitate this partnership, and 
that agency is the Department of Homeland Security.
    Today's hearing will give us an opportunity to hear from 
our expert panel regarding ways the NCCIC currently brings a 
collaborative, National response to cybersecurity. Our capacity 
within the Committee on Homeland Security is to provide proper 
oversight to ensure that the NCCIC is functioning properly and 
is capable of leading in the protection of Federal agencies in 
cyberspace; it is capable of partnering with critical 
infrastructure owners and operators to share information and 
reduce risk; and providing the necessary intelligence elements 
to assure that State and local critical infrastructure 
operators are mitigating cyber threats and, I would add, 
responding appropriately in the aftermath of any kind of 
activity.
    I am looking forward to hearing from our witnesses, 
particularly in areas that will help the committee as 
legislators strengthen the Department's capabilities.
    We must examine ways to encourage increased participation 
from owners and operators of critical infrastructure, many of 
those--most of it--in the private sector. We need to ensure the 
Department is successfully disseminating threat data with other 
Federal agencies--in particularly, the Department of Justice 
and Defense. Most importantly, we must make sure that there are 
sufficient privacy protections in place to ensure that the 
Department is able to anonymize data for both personally 
identifiable information and stakeholder identifiable 
information.
    I look forward to hearing from our panel.
    The Chairman now recognizes the Ranking Member of the 
overall Committee on Homeland Security, Mr. Thompson.
    Mr. Thompson. Thank you, Mr. Chairman. Thank you for 
holding today's hearing.
    I also want to thank the witnesses for testifying here 
today.
    Over the past few years the cybersecurity mission of the 
Department of Homeland Security has undergone an unprecedented 
expansion in funding and a change in organizational structure. 
Today I look forward to hearing the testimony from some of the 
officials responsible for implementing these expanded programs 
and activities and overseeing the change in the organizational 
structure and culture.
    I also look forward to hearing about how these changes will 
assist DHS in its efforts to become, in perception and reality, 
the civilian lead for cybersecurity in the Federal sector. 
Though once in doubt, it now appears that DHS is bringing 
together the necessary elements to solidify its leadership 
role.
    In support of these efforts, last month Chairman McCaul and 
I sponsored an amendment to cyber information-sharing 
legislation, CISPA, that would establish a center within DHS as 
the Federal hub for information sharing. I hope this amendment 
sent a clear signal that any cybersecurity legislation passed 
by Congress during this session should have a strong role for 
DHS as a Federal leader in areas where Government and the 
private sector must work together to prevent cyber attacks and 
mitigate their impacts.
    Today, I want to hear more about DHS's human capital 
resources. It is my understanding that DHS, like all Federal 
agencies, is suffering from a shortage of cyber personnel.
    As DHS works to ensure its role as a Federal lead for 
domestic cybersecurity, we cannot ignore our Nation's ability 
to prepare for, respond to, and recover from advanced cyber 
threats in a forward-looking endeavor that cannot succeed 
without sufficient, qualified personnel. We cannot rely on 
other countries to develop our cyber workforce.
    While we cannot predict what cyber threats may occur, we 
can certainly be prepared and be ready. Be prepared and be 
ready is a philosophy DHS encourages the public to adopt for 
natural disasters. Yes, when the oncoming disaster may be a 
man-made cyber threat, the Department seems to have adopted a 
``let tomorrow take care of itself'' philosophy. Surely this is 
not acceptable.
    DHS must adopt a preparedness philosophy in all aspects of 
its work. In the world of cyber threats, a part of preparation 
must be capacity-building programs that include education, 
outreach, and awareness initiatives.
    This year, as hundreds of millions of dollars are poured 
into Einstein and continuous diagnostic programs, the 
administration's budget request slashed funding for National 
initiative for cybersecurity education by $4.8 million, cutting 
the program by one-third. These cuts will delay efforts to 
provide cyber outreach and education to 1.7 million high school 
students.
    We cannot continue to complain about the lack of skilled 
cybersecurity professionals in the American workforce if we are 
willing to allow DHS to cut the funding it uses to develop the 
cyber workforce. Again, let me say: We cannot rely on other 
countries to develop our cyber workforce.
    Mr. Chairman, I look forward to hearing from the witnesses 
and hope that we can work together to restore this funding and 
ensure that DHS is properly building a defense-in-depth 
strategy to protect the Nation far into the future.
    I yield back.
    Mr. Meehan. Let me thank the gentleman from Mississippi.
    Let me also let the other Members of the committee 
appreciate that opening statements may be submitted for the 
record, and we are pleased today to have a distinguished panel 
of witnesses before us on this very, very important topic.
    [The statement of Ranking Member Clarke follows:]
              Statement of Ranking Member Yvette D. Clarke
                              May 16, 2013
    After a significant expansion of the Department of Homeland 
Security's cybersecurity mission and programs, beginning in fiscal year 
2012, I am glad that we are finally holding a hearing to look at these 
programs in depth and to assess the progress of the Department in 
carrying out that mission.
    This is the subcommittee's third hearing on cybersecurity this 
Congress--first, we held a hearing on the threats in cyberspace to our 
critical infrastructure from state and non-state actors. Next, we 
learned about how DHS protects the privacy of our citizens in 
cyberspace.
    And with that background in place, today we will hear from the 
witnesses about whether the Department has the people, programs, and 
resources in place to successfully address the significant cyber 
threats to our critical infrastructure while protecting privacy. It is 
high time that our subcommittee takes a closer look at these programs, 
some of which did not even exist just a few years ago.
    The continuous diagnostics and EINSTEIN programs, in particular, 
have undergone rapid expansion, and I am pleased that the Department is 
fulfilling its role as the protector of the dot-gov domain, with the 
resources to match. But though these Federal network security programs 
get the majority of the funding and attention, I believe the 
Department's responsibilities for protecting critical infrastructure, 
most of which is found in the private sector, is equally important.
    For this reason, I am particularly pleased that we are joined by 
Deputy Inspector General Charles Edwards, who can discuss recent work 
done by the OIG to assess the progress that ICS-CERT has made to brand 
itself as the Cyber 9-1-1 for critical infrastructure before, during, 
and after cyber incidents.
    ICS-CERT, recently incorporated as an operational arm of the NCCIC, 
has done great work in mitigating cyber risks to critical 
infrastructure, and I look forward to learning more about this mission 
and the challenges that still remain to share information with the 
private sector quickly and efficiently.
    Finally, I want to register my concerns over the continuing drain 
of senior cybersecurity leadership at the Department, a trend that has 
gotten particularly bad in the last 6 months, with the departures of 
the assistant secretary and the deputy under secretary.
    We have been hearing about the difficulties DHS faces in attracting 
and retaining skilled junior and mid-level cyber employees for a long 
time, but what does it say about the Department's cyber organization 
when it cannot retain its senior leaders, either? Rumors are 
circulating about future replacements for these losses, and I am sure 
DHS would like to make a splash with these appointments, getting 
leaders who command respect in the information security and critical 
infrastructure worlds. But most of all, DHS needs to find leaders who 
believe in the mission and will stay on board as a steady hand on the 
wheel during this period of immense expansion and evolution of our 
cybersecurity efforts.
    As part of this process, I believe DHS needs to do some soul-
searching and identify why their senior officials have been leaving, 
and if changes need to be made to ensure future leaders will be more 
empowered to do their job, I expect that the Department will do so. I 
hope to work with the Department in this endeavor to guarantee that the 
vital cybersecurity mission gets the leadership it needs.

    Mr. Meehan. I have had the chance to visit the NCCIC and to 
see the great work that is done there, and to listen first-hand 
to the explanation of what they do, and as a result, it is a 
great privilege for us today to have the people who are at the 
front end of that.
    First, Ms. Roberta Stempfley is the acting assistant 
secretary of the Office of Cybersecurity and Communications, 
where she plays a leading role in developing the strategic 
direction of the cyber communications and security. A lot of 
the problem is you have got to figure out all of these letters 
in operating things, but it oversees five strategic divisions.
    She has previously served as the deputy assistant secretary 
for the CS&C and as the director of the National Cybersecurity 
Division. Prior her to work at the CS&C, Ms. Stempfley served 
as the chief information officer for the Defense Information 
Systems Agency, where she was responsible for supporting the 
director in decision making, strategy development, and 
communication, and management of information technology 
resources at that agency.
    Mr. Larry Zelvin is the director of the National 
Cybersecurity and Communications Integration Center, the NCCIC, 
which is housed at the Department of Homeland Security. The 
NCCIC is comprised of several components, including the U.S. 
Computer Emergency Readiness team, the National Coordination 
Center for Telecommunications, the Industrial Control Systems 
Cyber Emergency Response team, and a 24/7 operations center. 
Mr. Zelvin is a retired U.S. Navy captain and naval aviator 
with 26 years of active service.
    Mr. Charles Edwards is the deputy inspector general of the 
Department of Homeland Security. Mr. Edwards is the head of the 
Office of Inspector General, a role he first attained when 
named acting inspector general in February 2011. Mr. Edwards 
has over 20 years of experience in the Federal Government and 
has held leadership positions at several agencies, including 
the TSA, United States Postal Office, Inspector--the Office of 
the Inspector General, and the United States Postal Service.
    The witnesses' full written statements appear in the 
record, and I know that Ms. Stempfley and Mr. Zelvin have 
offered a joint statement.
    So the Chairman now recognizes Ms. Stempfley for 5 minutes 
to testify, but I do want you to make sure that you hit the 
important points you have in your testimony. So thank you, Ms. 
Stempfley. The Chairman now recognizes you for your testimony.

  STATEMENT OF ROBERTA STEMPFLEY, ACTING ASSISTANT SECRETARY, 
OFFICE OF CYBERSECURITY AND COMMUNICATIONS, U.S. DEPARTMENT OF 
   HOMELAND SECURITY, ACCOMPANIED BY LARRY ZELVIN, DIRECTOR, 
 NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION CENTER, 
              U.S. DEPARTMENT OF HOMELAND SECURITY

    Ms. Stempfley. Thank you very much, Chairman Meehan, 
Ranking Member Thompson, and distinguished Members of the 
committee. I appreciate the time you have taken today and it is 
certainly our pleasure to appear before you to discuss the 
Department of Homeland Security's National Cybersecurity and 
Communications Integration Center and its role in protecting 
critical infrastructure from cyber attacks, securing our 
Federal networks, and coordinating cybersecurity information 
sharing with the private sector.
    Before I begin, I want to thank you for your leadership, 
sir--Mr. Thompson commented in his opening statement, as well--
during the recent legislation debate over the Cyber 
Intelligence Sharing and Protection Act, and especially in 
supporting the passing of that amendment designating DHS as the 
lead civil Federal entity to receive cyber threat information.
    Cybersecurity puts the confidentiality, integrity, and 
availability of critical services at risk. DHS, along with its 
Government and private-sector partners, work to counter these 
threats while supporting a cyber ecosystem that is open, 
transparent, and less vulnerable to manipulation. The NCCIC 
supports this effort by providing comprehensive and robust 
information sharing, incident response, technical assistance, 
and analysis capabilities to and with our private sector, 
Government, and international partners. While coordinating with 
these partners, our goal is to ensure that privacy, 
confidentiality, civil rights, and civil liberties are not 
diminished by our security initiatives.
    The Department's transparency and public accountability 
allow us to act as a pipeline to get cyber threat information 
in the hands of critical infrastructure owners and operators. 
We are able to share experiences and trends with law 
enforcement and intelligence communities while preventing 
malicious actors from gaining access to sensitive sources and 
methods.
    Within DHS's National Protection and Programs Directorate, 
the Office of Cybersecurity and Communications focuses on 
managing the risk to communications and information technology 
infrastructures and the sectors that depend on them. Our role 
is to enable timely response and recovery of these 
infrastructures under all circumstances.
    The Department manages and facilitates cybersecurity 
information-sharing efforts, analysis, and incident response 
activities through the NCCIC. It is a round-the-clock 
organization where Government, private-sector, and 
international partners work together towards a whole-of-Nation 
approach to address cybersecurity and communications issues at 
the operational level.
    We thank those of you who have come out for a tour and 
invite those who have yet to to do so to come and see the 
center in operation, with our private-sector partners shoulder-
to-shoulder with us in the capabilities.
    The NCCIC has experienced over the last year a 68 percent 
increase from 2011 to 2012 in incidents reported. In 2012 we 
received 190,000 cyber incidents reported to the NCCIC.
    Recently we have been working with the Departments of 
State, Justice, Treasury, and other interagency partners as 
well as our industry partners, such as the Financial Services 
Information Sharing and Analysis Center, to respond to the 
series of denial-of-service attacks against our financial 
services industry that have occurred over the past few months. 
US-CERT has worked, along with the FBI and other interagency 
partners, to provide technical data, on-site assistance, 
classified and unclassified briefings in order to help 
financial institutions and their information technology service 
providers improve their defensive capabilities.
    In addition to sharing with the private-sector entities, we 
have provided this information to over 120 international 
partners, many of whom have contributed to the mitigation 
efforts. These efforts have not only helped financial 
institutions blunt the impact of these attacks, but have helped 
the industry develop new strategies that DHS is sharing with 
other sectors of critical infrastructure should they face 
similar attacks.
    The Industrial Control Systems Computer Emergency 
Response--Cyber Emergency Response Team's mission is to reduce 
the risk to the Nation's critical infrastructure and the 
control systems that operate within it by strengthening those 
control systems. We have responded to almost 200 incidents over 
the last year with 89 on-site visits and 15 teams deployed 
jointly with the US-CERT to assist in significant private-
sector engagements.
    In March 2012, the Control Systems--the ICS-CERT identified 
a campaign of cyber intrusions targeting natural gas pipeline 
sector with spear phishing e-mails that dated back to December 
2011. Responding quickly, we immediately began an action 
campaign with the Department of Energy and other partners to 
conduct classified and unclassified briefings across the 
country providing warnings and mitigation. These entities have 
been very--have benefitted from this rapid information sharing.
    The third entity in the NCCIC is the National Coordination 
Center for Telecommunications. It leads and coordinates 
initiation, restoration, and reconstitution of National 
security emergency preparedness telecommunication services 
under all conditions.
    It has recently collaborated with industry in response to 
Hurricane Sandy, which enhanced wireless coverage to emergency 
responders providing emergency services to the 33,400 citizens 
in Long Beach, New York, the 1.4 million citizens in Nassau 
County, and the 130,000 citizens in faraway Queens. Their 
effort supported the recovery of communications to the U.S. 
financial sector by coordinating fuel and power restoration to 
key facilities in New York City, ensuring no impact to 
international financial trading.
    The Department's efforts to protect critical infrastructure 
are enhanced by the recently-issued cybersecurity Executive 
Order and Presidential Policy Directive on critical 
infrastructure security and resilience. Both of these documents 
improve the NCCIC's ability to execute its mission in support 
of the private sector by strengthening and securing the 
resilience of critical infrastructure, increasing the role of 
cybersecurity and securing physical assets, and expanding the 
coordination and information sharing with critical 
infrastructure partners.
    The Executive Order also supports DHS's strong privacy and 
civil liberty goals by reinforcing those protections and their 
incorporation in every aspect of our cybersecurity efforts. The 
Department believes, however, that the comprehensive suite of 
cybersecurity legislation is still an essential to improving 
the Nation's cybersecurity and we are pleased that the 
administration will continue to work with Congress to achieve 
this.
    Thank you so much for your support and continued attention 
to this critical issue, and I look forward to your questions.
    [The joint prepared statement of Ms. Stempfley and Mr. 
Zelvin follows:]
   Joint Prepared Statement of Roberta Stempfley and Lawrence Zelvin
                              May 16, 2013
                              introduction
    Chairman Meehan, Ranking Member Clarke, and distinguished Members 
of the committee, it is a pleasure to appear before you today to 
discuss the Department of Homeland Security's (DHS) National 
Cybersecurity and Communications Integration Center (NCCIC). 
Specifically, I will discuss the NCCIC's role, responsibilities, and 
future planning to protect our Nation's critical infrastructure from 
cyber attacks, secure Federal networks, and coordinate private-sector 
cyber-threat information sharing.
    Before I begin, I would like to thank the committee for its 
leadership during the recent legislative debate over the Cyber 
Intelligence Sharing and Protection Act, especially in support of 
passing an amendment to designate DHS as the lead civilian Federal 
entity to receive cyber threat information. Cybersecurity threats put 
the confidentiality, integrity, and availability of critical services 
at risk. DHS, along with its Government and private-sector partners, 
works to counter these threats while supporting a cyber ecosystem that 
is open, transparent, and less vulnerable to manipulation. The NCCIC 
supports this effort by providing comprehensive and robust information 
sharing, incident response, technical assistance, and analysis 
capabilities to private-sector, Government, and international partners.
                        current threat landscape
    Cyberspace is woven into the fabric of our daily lives. According 
to recent estimates, this global network of networks encompasses more 
than 2 billion people with at least 12 billion computers and devices, 
including global positioning systems, mobile phones, satellites, data 
routers, ordinary desktop computers, and industrial control computers 
that run power plants, water systems, and more. While this increased 
connectivity has led to significant transformations and advances across 
our country--and around the world--it also has increased the importance 
and complexity of our shared risk. Our daily life, economic vitality, 
and National security depend on cyberspace. A vast array of 
interdependent IT networks, systems, services, and resources are 
critical to communicating, traveling, powering our homes, running our 
economy, and obtaining Government services. No country, industry, 
community, or individual is immune to cyber risks.
    The United States confronts a dangerous combination of known and 
unknown vulnerabilities in cyberspace and strong and rapidly expanding 
adversary capabilities. Cyber crime also has increased significantly 
over the last decade. Sensitive information is routinely stolen from 
private-sector and Government networks, undermining the integrity of 
the data contained within these systems. The Department currently sees 
malicious cyber activity from foreign nations and non-state actors 
engaged in intellectual property theft and information operations, 
terrorists, organized crime, and insiders. Their methods range from 
distributed denial of service (DDoS) attacks and social engineering to 
viruses and other malware introduced through remote access, thumb 
drives, supply chain exploitation, and leveraging trusted insiders' 
access.
    The Department has seen motivations for attacks vary from 
intellectual property theft to criminals seeking financial gain and 
hackers who may seek bragging rights in the hacker community. 
Industrial control systems also are targeted by a variety of malicious 
actors who may have intentions to damage equipment and facilities or 
steal data. Foreign actors also are targeting intellectual property 
with the goal of stealing trade secrets or other sensitive corporate 
data from U.S. companies in order to gain an unfair competitive 
advantage in the global market.
    Successful response to dynamic cyber threats requires leveraging 
homeland security, law enforcement, and military authorities and 
capabilities, which respectively provide for domestic preparedness, 
criminal deterrence and investigation, and National defense. DHS, the 
Department of Justice (DOJ), and the Department of Defense (DOD) each 
play a key role in responding to cybersecurity incidents that pose a 
risk to the United States. To achieve a whole-of-Government response, 
DHS, DOJ, and DOD coordinate continuously to effectively respond to 
specific incidents. While each agency operates within the parameters of 
its authorities, the U.S. Government's response to cyber incidents of 
consequence is coordinated among these three agencies such that ``a 
call to one is a call to all.''
                     nccic's cybersecurity mission
    DHS coordinates the overall Federal effort to promote the security 
and resilience of the Nation's critical infrastructure by ensuring 
maximum coordination and partnership with the private sector while 
ensuring that privacy, confidentiality, and civil rights and civil 
liberties are not diminished by its security initiatives. Accordingly, 
the Department has implemented rigorous privacy and civil rights and 
civil liberties standards, which apply to all of its cybersecurity 
programs and initiatives. In order to protect privacy while 
safeguarding and securing cyberspace, DHS institutes layered privacy 
responsibilities throughout the Department, embeds fair information 
practice principles into cybersecurity programs and privacy compliance 
efforts, and fosters collaboration with cybersecurity partners.
    Within DHS's National Protection and Programs Directorate (NPPD), 
the Office of Cybersecurity and Communications (CS&C) focuses on 
managing risk to the communications and information technology 
infrastructures and the sectors that depend upon them, as well as 
enabling timely response and recovery of these infrastructures under 
all circumstances. CS&C executes its mission by supporting 247 
information sharing, analysis, and incident response; facilitating 
interoperable emergency communications; advancing technology solutions 
for private and public-sector partners; providing tools and 
capabilities to ensure the security of Federal civilian executive 
branch networks; and engaging in strategic-level coordination for the 
Department with private-sector organizations on cybersecurity and 
communications issues.
    To better manage and facilitate cybersecurity information-sharing 
efforts, analysis, and incident response activities, the Department 
established the NCCIC, a round-the-clock information sharing, analysis, 
and incident response center where Government, private-sector, and 
international partners all work together. The NCCIC is comprised of 
four branches: The United States Computer Emergency Readiness Team (US-
CERT), the Industrial Control Systems Cyber Emergency Response Team 
(ICS-CERT), the National Coordinating Center for Telecommunications 
(NCC), and Operations Integration (O&I). As mutually-supporting and 
integrated elements of the NCCIC, these branches provide the unique 
authorities, capabilities, and partnerships needed to drive a whole-of-
Nation approach to addressing cybersecurity and communications issues 
at the operational level.
   US-CERT provides advanced information sharing, incident 
        response, and analysis expertise for malicious cyber activity 
        targeting private-sector and Government networks. US-CERT's 
        global partnerships allow it to work directly with analysts 
        from across multiple sectors and international borders to 
        develop a comprehensive picture of malicious activity and 
        mitigation options. US-CERT's mission focuses specifically on 
        computer network defense, and it is able to apply its full 
        resources to supporting prevention, protection, mitigation, 
        response, and recovery efforts.
   ICS-CERT reduces risk to the Nation's critical 
        infrastructure by strengthening the cybersecurity of systems 
        that operate our Nation's critical infrastructure. It carries 
        out this mission by performing incident response to support 
        asset owners with discovery, analysis, and recovery efforts as 
        well as providing situational awareness through training, 
        alerts, and advisories to warn of cyber-based threats and 
        vulnerabilities affecting critical infrastructure assets. In 
        addition, ICS-CERT conducts assessments and technical analysis 
        of malware, digital media, system vulnerabilities, and emerging 
        exploits and partners with the control systems community to 
        coordinate risk management activities.
   NCC leads and coordinates the initiation, restoration, and 
        reconstitution of the National Security/Emergency Preparedness 
        (NS/EP) telecommunications services or facilities during any 
        human-caused or natural event where physical communications 
        infrastructure is damaged or vulnerable. NCC leverages 
        partnerships across Government, industry, and international 
        partners to gain situational awareness and determine priorities 
        for protection and response. NCC's presence in the NCCIC allows 
        DHS to synchronize operational processes supporting both the 
        physical and the virtual components of our Nation's information 
        and communications technology infrastructure.
   O&I applies planning, coordination, and integration 
        capabilities to synchronize analysis, information sharing, and 
        incident response efforts, ensuring effective synchronization 
        across the NCCIC.
                            strategic goals
    The NCCIC works to proactively analyze cybersecurity and 
communications threats and vulnerabilities and coordinate their 
findings with partners to manage risks to critical systems; create 
shared situational awareness among public-sector, private-sector, and 
international partners by collaboratively developing and sharing timely 
and actionable cybersecurity and communications information; and 
rapidly respond to routine and significant cybersecurity and 
communications incidents and events to mitigate harmful activity, 
manage crisis situations, support recovery efforts, and assure NS/EP.
    To accomplish its strategic goals, NCCIC relies on the voluntary 
coordination, collaboration, capabilities, and resources of its 
partners. The center works closely with those Federal agencies most 
responsible for securing the Government's cyber and communications 
systems, including the Departments of Treasury and Energy. The NCCIC 
also actively engages with the appropriate private-sector entities, 
information-sharing and analysis centers, State, local, Tribal, and 
territorial governments, and international partners. As integral parts 
of the cyberspace and communications community, these groups work 
together to protect the portions of critical information technology 
that they interact with, operate, manage, or own. These groups of 
stakeholders represent natural communities of practice providing the 
foundation for effective information sharing and response.
Threat Analysis
    NCCIC collaborates with private-sector, Government, and 
international partners to identify, research, and verify suspicious, 
malicious, or potentially harmful cybersecurity and communications 
activity, events, or incidents. For example, US-CERT operates NCCIC's 
Advanced Malware Analysis Center, which receives malware samples and 
other potentially malicious files from around the world. The Advanced 
Malware Analysis Center analyzes those files, shares that analysis 
broadly to alert partners to malicious activity, and provides them with 
actionable indicators and recommendations to improve their ability to 
protect themselves.
    By understanding the nature of attacks, vulnerabilities, and risks, 
NCCIC is able to determine possible impacts, set priorities, and 
proactively develop and share effective mitigation strategies. NCCIC 
strives to anticipate potentially harmful activity and provide 
actionable alert and warning information to partners before they are 
impacted. NCCIC's analysis efforts, whether focused on a new piece of 
malware or a tropical storm with the potential to damage critical 
communications systems, contribute directly to its information sharing, 
response, and protection and prevention capabilities.
Situational Awareness
    The success of the NCCIC's mission is heavily reliant on its 
ability to establish shared situational awareness of potentially 
harmful activity, events, or incidents across multiple constituencies 
to improve the ability of diverse and distributed partners to protect 
themselves. To do this, NCCIC integrates analysis and data received 
through its own analysis, intelligence community and law enforcement 
reporting, and data shared by private-sector and international partners 
into a comprehensive series of actionable information products, which 
are shared with partners in easy-to-digest machine-readable formats.
    Multidirectional sharing of alerts, warnings, analysis products, 
and mitigation recommendations among Federal, State, local, Tribal, and 
territorial governments, private sector, including information sharing 
and analysis centers, and international partners is a key element of 
NCCIC's cyber and communications protection and prevention framework. 
The NCCIC continuously works with a broad range of partners to explore 
and innovate new ways to enhance information sharing and move closer to 
network speed communications.
Rapid Response
    The NCCIC applies the collective capabilities of its partners and 
constituents to identify, prioritize, and escalate confirmed 
cybersecurity incidents in order to minimize impacts to critical 
information infrastructure. To ensure a 247 capability, NCCIC 
maintains cross-functional incident response teams, which draw from the 
capabilities of NCCIC's branches, along with expertise from elsewhere 
in DHS such as the United States Secret Service (USSS) and Immigration 
and Customs Enforcement (ICE). Working under a voluntary request for 
technical assistance, these incident response teams analyze malware, 
review network logs, and assess security posture to identify possible 
malicious activity, its impacts, as well as mitigation and recovery 
options.
    Recognizing the possibility of a cyber incident with physical 
impacts or a physical incident with cyber implications, NCCIC works 
increasingly closely with NPPD's National Infrastructure Coordinating 
Center (NICC). This collaboration, directed by Presidential Policy 
Directive 21 (PPD-21), helps to ensure strong synchronization between 
DHS's infrastructure protection efforts in both the cyber and physical 
realms. In addition, the NCCIC assists in the initiation, coordination, 
restoration, and reconstitution of the NS/EP telecommunications 
services or facilities under all conditions, crises, or emergencies 
including executing Emergency Support Function 2--Communications 
responsibilities under the National Response Framework.
    These efforts provide a whole-of-Nation approach to incident 
response, efficiently and effectively leveraging capabilities from 
across DHS's partner base while implementing key policies.
                   protecting critical infrastructure
    Protecting critical infrastructure against growing and evolving 
cyber threats requires a layered approach. DHS actively collaborates 
with public and private-sector partners every day to improve the 
security and resilience of critical infrastructure while responding to 
and mitigating the impacts of attempted disruptions to the Nation's 
critical cyber and communications networks and to reduce adverse 
impacts on critical network systems.
    DHS coordinates the National protection, prevention, mitigation, 
and recovery from cyber incidents and works regularly with business 
owners and operators to take steps to strengthen their facilities and 
communities, and through collaboration between the NCCIC and the NICC, 
integrates efforts across the physical and cyber domains. The 
Department also conducts on-site risk assessments of critical 
infrastructure and shares risk and threat information with State, 
local, and private-sector partners. NCCIC enhances situational 
awareness among stakeholders, including those at the State and local 
level, as well as industrial control system owners and operators, by 
providing critical cyber threat, vulnerability, and mitigation data. 
These efforts provide unique value to private-sector partners by 
integrating data from companies and industries that might not normally 
communicate.
    In 2011, DHS launched the Cyber Information Sharing and 
Collaboration Program (CISCP), which is specifically designed to 
elevate the cyber awareness of all critical infrastructure sectors 
through close and timely cyber threat information sharing and direct 
analytical exchange. Through the CISCP, participating private-sector 
partners are able to share data directly with Government. When 
requested, these datasets are covered by the Protected Critical 
Infrastructure Information (PCII) program, which protects the name of 
the company that shared the information from disclosure through Freedom 
of Information Act requests, regulatory processes, civil litigation, 
and other sunshine law requirements. Submitted datasets are analyzed in 
the context of other data received from across sectors, and based on 
this analysis regular analytical products are shared back out with 
partners. CISCP has signed 40 Cooperative Research and Development 
Agreements (CRADAs), and is in the process of finalizing agreements 
with 66 additional entities to formalize a streamlined information-
sharing process. Since December 2011, CISCP has released over 900 
products containing approximately 18,000 cyber threat indicators, which 
are based on information the Department has gleaned from participant 
submissions, open-source research, and from sensitive Government 
information.
    NCCIC has also benefited from close collaboration with the USSS and 
ICE, which have complementary jurisdiction over the investigation of 
computer crime violations that they exercise to protect the Nation's 
leaders and critical infrastructure and strategically target 
transnational organized criminals who are exploiting the financial 
system through cybercrimes. By working closely together, NCCIC and its 
law enforcement partners are able to leverage each organization's 
expertise and unique authorities to more effectively and efficiently 
execute DHS's cybersecurity mission.
                      responding to cyber threats
    As the civilian Department at the intersection of public-private 
information sharing, DHS is a focal point for coordinating 
cybersecurity information sharing with the private sector, the 
Department engages with owners and operators, based on their requests 
for technical assistance, by providing on-site analysis, mitigation 
support, and assessment assistance. The Department has repeatedly 
demonstrated its ability to expeditiously support private-sector 
partners with cyber intrusion mitigation and incident response. 
Initiating technical assistance with any private company to provide 
analysis and mitigation advice is a sensitive endeavor that requires 
trust and strict confidentiality. DHS's efforts focus on civilian 
computer network defense and protection rather than law enforcement, 
military, or intelligence functions in order to mitigate threats to the 
networks and reduce future risks.
    Since 2009, the NCCIC has responded to nearly half-a-million 
incident reports and released more than 26,000 actionable cybersecurity 
alerts to the Department's public- and private-sector partners. An 
integral player within the NCCIC, the US-CERT also provides response 
support and defense against cyber attacks for Federal civilian agency 
networks as well as private-sector partners upon request. In 2012, US-
CERT processed approximately 190,000 cyber incidents involving Federal 
agencies, critical infrastructure, and the Department's industry 
partners. This represents a 68 percent increase from 2011. In addition, 
US-CERT issued over 7,455 actionable cyber-alerts in 2012 that were 
used by private sector and Government agencies to protect their 
systems, and had over 6,400 partners subscribe to the US-CERT portal to 
engage in information sharing and receive cyber-threat warning 
information.
    The Department's ICS-CERT also responded to 177 incidents last year 
while completing 89 site assistance visits and deploying 15 teams with 
US-CERT to respond to significant private-sector cyber incidents, which 
includes analyzing data and sharing results, developing mitigation 
recommendations, and providing alerts and warning to potential future 
victims. DHS also empowers owners and operators through a cyber self-
evaluation tool, the Cyber Security Evaluation Tool (CSET), which was 
used by over 1,000 companies last year. In addition, DHS provides in-
person and on-line training sessions that focus on network security.
    The NCCIC, and its Federal partners, works with the private sector 
and international partners in preventing intellectual property theft 
with a whole-of-Government approach. For example, the United States 
Secret Service--which brings together over 6,000 partners from across 
sectors through its 29 domestic Electronic Crimes Task Forces (ECTFs)--
investigates cyber crimes within its jurisdiction, and the United 
States Coast Guard contains a component of U.S. Cyber Command and U.S. 
Strategic Command for the conduct of military missions. In each case, 
DHS focuses not only on responding to the incident at hand, but also on 
identifying trends, warning potential victims, and proactively engaging 
with partners. DHS, in collaboration with FBI and other partners, 
released a series of Joint Indicator Bulletins, containing cyber-threat 
indicators to help private-sector partners take action to stop this 
activity and protect them from theft of intellectual property, trade 
secrets, and sensitive business information.
    Most recently, and in close collaboration with interagency partners 
as well as industry partners like the Financial Services Information 
Sharing and Analysis Center, DHS has been engaged with private-sector 
and international partners during the series of DDoS incidents over the 
past few months. DHS has provided technical data and assistance, 
including identifying hundreds of thousands of DDoS-related IP 
addresses and supporting contextual information in order to help 
financial institutions and their information technology security 
service providers improve their defensive capabilities. In addition to 
sharing with these private-sector entities, DHS has provided this 
information to over 120 international partners, many of whom have 
contributed to our mitigation efforts. DHS, along with the FBI and 
other interagency partners, has also deployed on-site technical 
assistance to provide in-person support, and has conducted numerous 
classified briefings on the nature of the threat and mitigation 
strategies to hundreds of financial-sector IT security specialists. 
These efforts have helped to increase the U.S. Government's sharing and 
coordination efforts internally and with private-sector partners. 
Additionally, the mitigation strategies provided have not only helped 
financial institutions significantly blunt the impact of these attacks, 
but they have also helped the industry develop new strategies of their 
own that DHS hopes to share with other sectors of critical 
infrastructure to help mitigate similar attacks.
    NCCIC's NCC played a vital role in response to Hurricane Sandy 
recovery efforts. The NCC, as the coordinator for Emergency Support 
Function No. 2 under the National Response Framework, provided a wide 
range of communications support in partnership with industry to support 
responders, citizens, and industry response and recovery. NCC worked to 
improve first-responder actions by assisting in radio network 
infrastructure restoration such as microwave connectivity supporting 
local fire department dispatch and coordination. They also coordinated 
aid to citizens through more than 170 instances of emergency 
provisioning of communications installations supporting response 
organizations such as the American Red Cross, Army Corps of Engineers, 
Social Security Administration, and the Federal Emergency Management 
Agency. Collaborating with industry, NCC enhanced wireless coverage to 
first responders who provide emergency services to approximately 33,400 
citizens in Long Beach, New York; 1,400,000 citizens in Nassau County 
and 130,000 citizens in Far Rockaway, Queens. Their efforts also 
supported the recovery of communications to the U.S. financial sector 
by coordinating fuel and power restoration to a key facility in New 
York City, ensuring no impact to international financial trading.
    Finally, in March 2012, DHS identified a campaign of cyber 
intrusions targeting natural gas pipeline sector companies with spear-
phishing e-mails that dated back to December 2011. The attacks were 
highly-targeted, tightly-focused, and well-crafted. Stolen information 
could provide an attacker with sensitive knowledge about industrial 
control systems, including information that could allow for 
unauthorized operation of the systems. While there is no evidence that 
anyone has tried to subvert the operation of these industrial control 
systems, the intent of the attacker remains unknown. DHS immediately 
began an action campaign to alert the oil and natural gas pipeline 
sector community of the threat and offered to provide assistance. 
Industry partners have been responsive to these threats, and in May and 
June 2012, DHS deployed on-site assistance to two of the organizations 
targeted in this campaign: An energy company that operates a gas 
pipeline in the United States and a manufacturing company who 
specializes in producing materials specific to pipeline construction. 
DHS also partnered with the Department of Energy and others to conduct 
briefings across the country. Over 500 private-sector individuals 
attended the classified briefings and hundreds more received 
unclassified briefings providing warnings and mitigation strategies.
                        recent executive actions
    As today's physical and cyber infrastructures become increasingly 
linked, critical infrastructure and emergency response functions grow 
ever more inseparable from the information technology systems that 
support them. The Government's role in this effort is to share 
information and encourage enhanced security and resilience, while 
identifying and addressing gaps not filled by the marketplace. These 
policies work in conjunction with Executive Order 13618 of July 6, 
2012, Assignment of National Security and Emergency Preparedness 
Communications Functions, which improves how the Executive branch 
handles NS/EP Communications and ties cyber into emergency response 
communications.
    In February 2013, President Obama issued EO 13636, as well as PPD-
21 on Critical Infrastructure Security and Resilience, which will work 
to strengthen the security and resilience of critical infrastructure 
through an updated and overarching National framework that acknowledges 
the increased role of cybersecurity in securing physical assets, and 
will improve NCCIC's ability to execute its mission in support of the 
private sector. The President's actions mark an important milestone in 
the Department's on-going efforts to coordinate the National response 
to significant cyber incidents while enhancing the efficiency and 
effectiveness of our work to strengthen the security and resilience of 
critical infrastructure, and these policies will further enable NCCIC's 
mission. EO 13636 supports more efficient sharing of cyber-threat 
information with the private sector and directs the National Institute 
of Standards and Technology to develop a Cybersecurity Framework to 
identify and implement better security practices among critical 
infrastructure sectors. EO 13636 directs DHS to establish a voluntary 
program to promote the adoption of the Cybersecurity Framework in 
conjunction with Sector-Specific Agencies and to work with industry to 
assist companies in implementing the framework.
    EO 13636 also expands the DHS Enhanced Cybersecurity Services (ECS) 
program, key aspects of which are operated by the NCCIC. ECS is a 
voluntary information-sharing program that assists critical 
infrastructure owners and operators to improve protection of their 
systems from unauthorized access, exploitation, or data exfiltration. 
DHS works with cybersecurity organizations from across the USG to gain 
access to a broad range of cyber-threat information. ECS consists of 
the operational processes and security oversight required to share 
sensitive and classified cyber-threat information with qualified 
Commercial Service Providers (CSPs) that will enable them to better 
protect their customers who are critical infrastructure entities. CSPs 
can deliver approved services to validated critical infrastructure 
entities through commercial relationships. The ECS program is not 
involved in establishing commercial relationships between CSPs and CI 
entities. ECS augments, but does not replace, entities' existing 
cybersecurity capabilities. The ECS information-sharing process 
protects Critical Infrastructure (CI) entities against cyber threats 
that could otherwise harm their systems. ECS program participation is 
voluntary and designed to protect Government intelligence, corporate 
information security, and the privacy of participants, while enhancing 
the security of critical infrastructure. Validated CI entities from all 
16 CI sectors are eligible to participate in the ECS program and 
receive ECS services from an eligible CSP.
    In addition, the Presidential Policy Directive directs the 
Executive branch to strengthen our capability to understand and 
efficiently share information about how well critical infrastructure 
systems are functioning and the consequences of potential failures. It 
calls for a comprehensive research and development plan for critical 
infrastructure to guide the Government's effort to enhance market-based 
innovation. The strategic imperatives in PPD-21 also direct the NCCIC 
and the NICC to ``function in an integrated manner and serve as focal 
points for critical infrastructure partners to obtain situational 
awareness and integrated, actionable information to protect the 
physical and cyber aspects of critical infrastructure.'' As such, NPPD 
is enhancing the existing coordination of its two critical 
infrastructure operations centers, the NCCIC and the NICC.
                    continuing need for legislation
    We continue to believe that carefully-crafted information-sharing 
provisions, as part of a comprehensive suite of cybersecurity 
legislation, are essential to improve the Nation's cybersecurity to an 
acceptable level, and we will continue to work with Congress to achieve 
this.
    The administration's legislative priorities for the 113th Congress 
build upon the President's 2011 Cybersecurity Legislative Proposal and 
take into account 2 years of public and Congressional discourse about 
how best to improve the Nation's cybersecurity. Congress should enact 
legislation to incorporate privacy, confidentiality, and civil 
liberties safeguards into all aspects of cybersecurity; strengthen our 
critical infrastructure's cybersecurity by further increasing 
information sharing and promoting the establishment and adoption of 
standards for critical infrastructure; give law enforcement additional 
tools to fight crime in the digital age; and create a National Data 
Breach Reporting requirement.
                               conclusion
    Set within an environment characterized by a dangerous combination 
of known and unknown vulnerabilities, rapidly-evolving adversary 
capabilities, and a lack of comprehensive threat and vulnerability 
awareness, the cybersecurity mission is truly a National one requiring 
broad collaboration. DHS is committed to creating a safe, secure, and 
resilient cyber environment while promoting cybersecurity knowledge and 
innovation and protecting privacy, confidentiality, civil rights, and 
civil liberties in collaboration with its public, private, and 
international partners. Thank you for your continued support and 
attention to the critical issue of cybersecurity and I look forward to 
your questions.

    Mr. Meehan. [Off mike.]
    One of us thinks we have to get technology as my button to 
work.
    Thank you, Ms. Stempfley, for your testimony. As I 
identified at the outset, Mr. Zelvin joins in that testimony on 
behalf of the Department of Homeland Security.
    So now the Chairman recognizes Mr. Edwards, Inspector 
General's Office of DHS, for your testimony.

STATEMENT OF CHARLES K. EDWARDS, ACTING INSPECTOR GENERAL, U.S. 
                DEPARTMENT OF HOMELAND SECURITY

    Mr. Edwards. Good morning, Chairman Meehan, Ranking Member 
Clarke, Ranking Member Thompson, and Members of the 
subcommittee. Thank you for the opportunity to discuss DHS 
efforts to secure the Nation's industrial control systems. The 
majority of information that I will provide is contained in our 
February 2013 report, ``DHS Can Make Improvements to Secure 
Industrial Control Systems.''
    Industrial control systems, or ICS, are systems that manage 
and monitor the Nation's critical infrastructure and key 
resources, or CIKR. ICS are increasingly under attack by a 
variety of malicious sources, ranking from hackers looking for 
attention and reputation to sophisticated nation states intent 
on damaging equipment and facilities, disgruntled employees, or 
competitors.
    Successful attacks on ICS can give malicious users direct 
control of operational systems, creating the potential for 
large-scale power outages or man-made environmental disasters 
and can cause physical damage, loss of life, and other 
cascading effects.
    DHS has strengthened the security of ICS by addressing the 
need to share critical cybersecurity information, analysis 
vulnerabilities, verify emerging threats, and disseminate 
mitigation strategies. DHS has taken a number of actions to 
improve ICS security and foster better partnership within 
Federal and private sectors.
    For example, DHS has established the ICS-CERT Incident 
Response Team, also known as the fly-away team, to support the 
public and private sectors through on-site and remote incident 
response services on a variety of cyber threats. DHS has 
improved the quality of its alerts and bulletins by including 
actionable information regarding vulnerabilities and 
recommended mitigations and best practices for securing ICS. 
Finally, the Department has strengthened its outreach efforts 
with the ICS community, including vendors, owners, operators, 
and academic community and other Federal agencies.
    Although DHS has made improvements, more needs to be done 
to reduce the cybersecurity risks for the Nation's ICS. Many of 
the private-sector partners we interviewed use portals such as 
the Homeland Security Information Network, or HSIN, to retrieve 
advisories, vulnerability information, and best practices. 
There are 55 communities of interest on the HSIC Critical 
Sectors portal intended to facilitate communication and 
collaboration among all CIKR sectors and the Federal 
Government.
    However, DHS does not have a consolidated summary overview 
page on the HSIN Critical Sectors portal that highlights new 
information and activities to ensure that ICS cybersecurity 
information is shared effectively. As a result, the content of 
each of the CIKR sectors must be searched individually for 
pertinent and updated information. These searches can be time-
consuming for the stakeholders.
    In addition, all the sector-specific agencies senior 
officials that we interviewed expressed a need to be notified 
in advance when ICS-CERT is performing on-site or remote 
technical assistant assessments with private companies within 
their sectors. For example, these officials suggested that ICS-
CERT publish a heads-up or a quick anonymous informational 
alert regarding an on-going investigative or pending event, 
sectors and devices affected, and whether a potential fix 
exists. Such notification would be helpful and would allow them 
to react more accordingly if other companies call them with 
questions.
    Overall, officials acknowledge that DHS had improved the 
quality of alerts and bulletins that address various cyber 
topics. However, they expressed concern regarding the 
timeliness of ICS-CERT's information sharing and 
communications. ICS-CERT management acknowledged that sector-
specific agencies, councils, and private sectors concerning 
regarding the sharing of active incidents and threats, such as 
identified cyber intrusions and spear phishing e-mails.
    However, proprietary information and on-going law 
enforcement investigations sometimes limit the amount of 
information ICS-CERT can disseminate. The report included two 
recommendations and NPPD concurred with both.
    Mr. Chairman, this concludes my prepared remarks, and I 
would be happy to answer any questions that you or the Members 
may have.
    Thank you.
    [The prepared statement of Mr. Edwards follows:]
                Prepared Statement of Charles K. Edwards
                              May 16, 2013
    Good morning Chairman Meehan, Ranking Member Clarke, and Members of 
the subcommittee: Thank you for the opportunity to discuss DHS' efforts 
to secure the Nation's industrial control systems. The majority of 
information that I will provide today is contained in our February 2013 
report, DHS Can Make Improvements to Secure Industrial Control Systems 
(OIG-13-39).
    Industrial control systems (ICS) are systems that include 
supervisory control and data acquisition, process control, and 
distributed control that manage and monitor the Nation's critical 
infrastructure and key resources (CIKR).\1\ ICS are an integral part of 
our Nation, and help facilitate operations in vital sectors. Beginning 
in 1990, companies began connecting their operational ICS with 
enterprise systems that are connected to the internet. This allowed 
access to new and more efficient methods of communication, as well as 
more robust data, and gain quicker time to market and interoperability. 
However, security for ICS was inherently weak because it allowed remote 
control of processes and exposed ICS to cybersecurity risks that could 
be exploited over the internet. As a result, ICS are increasingly under 
attack by a variety of malicious sources. These attacks range from 
hackers looking for attention and notoriety to sophisticated nation-
states intent on damaging equipment and facilities, disgruntled 
employees, competitors, and even personnel who inadvertently bring 
malware into the workplace by inserting an infected flash drive into a 
computer. A recent survey revealed that a majority of the companies in 
the energy sector had experienced cyber attacks, and about 55 percent 
of these attacks targeted ICS. These attacks involved large-scale 
denial-of-service and network infiltrations. Successful attacks on ICS 
can give malicious users direct control of operational systems, 
creating the potential for large-scale power outages or man-made 
environmental disasters and cause physical damage, loss of life, and 
other cascading effects that could disrupt services.
---------------------------------------------------------------------------
    \1\ There are 18 CIKR sectors: Agriculture and Food, Banking and 
Finance, Chemical, Commercial Facilities, Communications, Critical 
Manufacturing, Dams, Defense Industrial Base, Emergency Services, 
Energy, Government Facilities, Healthcare and Public Health, 
Information Technology, National Monuments and Icons, Nuclear Reactors, 
Material and Waste, Postal and Shipping, Transportation Systems, and 
Water.
---------------------------------------------------------------------------
    Some recent cyber attacks have included the following:
   In February 2011, the media reported that hackers had stolen 
        proprietary information worth millions of dollars from the 
        networks of six energy companies in the United States and 
        Europe.
   In December 2011, a sophisticated threat actor targeted the 
        oil and natural gas subsector. Affected asset owners across the 
        sector voluntarily worked with DHS during the investigation.
   Throughout 2011, there were reports of spear-phishing via 
        email in the energy sector; no negative impacts occurred to the 
        companies' control processes and operations.
   In March 2012, an alert was issued regarding phone-based 
        social engineering attempts at two or more power distribution 
        companies. The callers attempted to direct the company 
        personnel to take action to correct a problem that would have 
        allowed the attacker to gain access to their ICS.
   In April 2012, media reported that a Canadian ICS 
        manufacturing company inadvertently planted a backdoor login 
        account in its own operating systems, which contain switches 
        and servers used in mission-critical communications networks 
        that operate power grids and railway and traffic control 
        systems. This account could have allowed attackers to access 
        the devices via the internet.
    The Industrial Control Systems--Cyber Emergency Response Team's 
(ICS-CERT) operational capabilities focus on the private-sector CIKR 
ICS and networks, which is essential to the Department's mission to 
protect the Nation's critical infrastructure, particularly against 
emerging cyber threats. Additionally, ICS-CERT uses the Request Tracker 
Ticketing System to capture analytical and status information regarding 
vulnerabilities and incidents. The ticketing system maintains the 
incident response team's remote technical assistance and on-site 
assessment status and reports. Tickets are color-coded based on age. 
The ticketing system notifies the assigned personnel when the status of 
a ticket is changed or further action is needed. Additionally, ICS-CERT 
coordinates control systems-related security incidents and information 
sharing with Federal, State, and local agencies and organizations, as 
well as private-sector constituents, including vendors, owners, and 
operators of ICS.
    ICS-CERT exchanges information with stakeholders via the Homeland 
Security Information Network (HSIN)--Critical Sector. The Office of the 
Chief Information Officer (OCIO) develops and maintains HSIN and serves 
as data governance steward for HSIN policy documents, including the 
HSIN Model Charter and HSIN Terms of Service. Although OCIO is the data 
steward, the office is not responsible for maintaining the content that 
users and communities of interest post to any element of HSIN.\2\ Each 
community of interest sponsor is responsible for maintaining and 
sharing the content within the community of interest and through the 
community of interest shared space.\3\ The administration and 
governance of the communities of interest, including creation of 
individual sites within the community, is at the discretion of their 
sponsors. OCIO works in cooperation with each community of interest to 
enforce the rules in the charter and terms of services. OCIO conducts 
regular reviews of communities of interest to validate and justify its 
purpose, objectives, and operational need. National Protection and 
Programs Directorate (NPPD) sponsors and manages the critical sector 
communities of interest.
---------------------------------------------------------------------------
    \2\ HSIN communities of interest are separate environments wherein 
users involved in the same subject matter area or industry may post and 
view potentially relevant news and information and use collaborative 
tools.
    \3\ The HSIN shared space allows authorized stakeholders and 
content contributors to publish finished products and relevant 
documents that: (1) Have appropriate markings providing sharing 
permissions at the document level, and (2) are targeted to an 
authorized audience based on their credentials and related community of 
interest and system-wide rules for sharing.
---------------------------------------------------------------------------
 dhs' progress in improving the security of industrial control systems
    We reported that Department needed to improve the security of ICS 
and information sharing to enhance program effectiveness. DHS has 
strengthened the security of ICS by addressing the need to share 
critical cybersecurity information, analyze vulnerabilities, verify 
emerging threats, and disseminate mitigation strategies. For example, 
DHS has taken the following actions to improve ICS security and foster 
better partnerships between the Federal and private sectors:
   Establishing ICS-CERT Incident Response Team, also known as 
        the fly-away teams, to support the public and private sectors 
        through on-site and remote incident response services on a 
        variety of cyber threats, ranging from general malicious code 
        infections to advanced persistent threat intrusions. 
        Additionally, in March 2012, NPPD released the Cyber Security 
        Evaluation Tool Version 4.1. The updated tool assists users in 
        identifying devices connected to their networks, as well as 
        external connections, by creating a diagram of their systems.
   Operating a malware lab that provides testing capabilities 
        to analyze vulnerabilities and malware threats to control 
        system environments. The team verifies vulnerabilities for 
        researchers and vendors, performs impact analysis, and provides 
        patch validation and testing prior to deployment to the asset-
        owner community.
   Improving the quality of its alerts and bulletins by 
        including actionable information regarding vulnerabilities and 
        recommended mitigations and best practices for securing ICS.
   Providing products to the ICS community on a daily, weekly, 
        monthly, quarterly, and as-needed basis, through email, 
        website, and portal postings. These products help ICS-CERT to 
        improve the situational awareness of ICS and provide status 
        updates of its working groups, articles of interest, and 
        upcoming events and training.
   Implementing a virtual private network solution to allow 
        NPPD program officials to access program applications and 
        systems (e.g., the ICS-CERT ticketing system) located at the 
        Idaho National Laboratory (INL).\4\
---------------------------------------------------------------------------
    \4\ A virtual private network is a technology for using the 
internet or another intermediate network to connect computers to 
isolated remote computer networks that would otherwise be inaccessible. 
Users can access resources on remote networks, such as files, printers, 
databases, or internal websites.
---------------------------------------------------------------------------
   Assisting in developing various roadmaps for the cross-
        sector, dams, nuclear, water, and transportation. The road maps 
        provide vision and framework for mitigating cybersecurity risk 
        to the wide variety of systems critical to each sector's 
        operations.
    Finally, the Department has strengthened its outreach efforts with 
the ICS community, including vendors, owners/operators, academia, and 
other Federal agencies. These efforts include participating in the 
periodic meetings with the Cross-Sector Cyber Security Working Group; 
Government Coordinating Council and Sector Coordinating Council; and 
various sector-specific groups.
                            major challenges
    Despite these actions, NPPD still faces challenges in reducing the 
cybersecurity risks for the Nation's ICS. Further, NPPD can improve its 
efforts to protect and secure control systems that are essential to the 
Nation's security and economy. Specifically, ICS-CERT needs to 
consolidate its information-sharing and communication efforts with 
Sector-Specific Agencies and the private sector to ensure that these 
stakeholders are provided with potential ICS threats and 
vulnerabilities to mitigate security threats timely. In addition, DHS 
needs to improve communications with Sector-Specific Agencies and the 
private sector by providing advanced notification of ICS-CERT's remote 
technical and on-site incident assessments.
Consolidation of Multiple Information-Sharing Communities of Interest
    Many of the private-sector partners we interviewed (e.g., owners/
operators, regulators, and working groups) use the HSIN, ICS-CERT, and 
United States Computer Emergency Readiness Team (US-CERT) portals to 
retrieve advisories, vulnerability information, and best practices. 
There are 55 communities of interest on the HSIN-Critical Sectors 
intended to facilitate communication and collaboration among all CIKR 
sectors and the Federal Government. However, DHS does not have a 
consolidated summary overview page on HSIN-Critical Sectors that 
highlights new information and activities to ensure that ICS 
cybersecurity information is shared effectively. As a result, the 
content for each of the CIKR sectors and must be searched individually 
for pertinent and updated information. For example, the Dams, Emergency 
Management, and Electricity and Oil and Natural Gas subsector 
communities of interest, which are used by companies that belong to 
multiple sectors, have to be searched individually and may contain non-
cybersecurity information, such as physical security, emergency 
response, and planning. These searches can be time-consuming for the 
stakeholders.
    Additionally, each community of interest is arranged differently, 
making it more cumbersome for the users to retrieve useful information. 
For example, some HSIN users told us that the various communities of 
interest contain duplicate information. As a result, some Sector-
Specific Agencies want to build additional portals for their 
stakeholders to streamline the information DHS provides.
    ICS-CERT officials acknowledged that existing communities of 
interest could confuse owners/operators. To eliminate duplicate 
information from the communities of interest, ICS-CERT created a 
subcommittee to address stakeholder concerns regarding the communities 
of interest. ICS-CERT officials said that ICS-CERT only contributed 
content to the communities of interest and does not have the 
responsibility for site set up. However, NPPD plans to hold discussions 
with OCIO to determine whether these communities of interest could be 
consolidated to better serve stakeholder needs.
    We recommended that the Under Secretary, NPPD collaborate with OCIO 
to streamline the HSIN portal to ensure that ICS cyber information is 
shared effectively.
Advance Notification of Remote Technical and On-site Assessments
    All the Sector-Specific Agencies senior officials that we 
interviewed expressed a need to be notified in advance when ICS-CERT is 
performing on-site or remote technical assistance assessments with 
private companies within their sectors. For example, these officials 
suggested that ICS-CERT publish a ``heads-up'' or ``quick anonymous'' 
informational alert regarding an on-going investigative/pending event, 
sectors and devices affected, and whether a potential fix exists. The 
Sector-Specific Agency officials told us that such notifications would 
be helpful and would allow them to react more appropriately if other 
companies call them with questions. For example, according to Nuclear 
Sector-Specific Agency officials, the Department's Domestic Nuclear 
Detection Office sends an email alert to State authorities and its 
offices regarding upcoming site visits.
    DHS does not communicate timely the results of its remote technical 
and on-site assessments to the public. We interviewed officials from 
three Sector-Specific Agencies, six Government and private-sector 
councils, and 23 private companies from the dams, energy, and nuclear 
sectors to evaluate whether ICS-CERT shared sufficient information and 
communicated effectively. Overall, these officials acknowledged that 
DHS had improved the quality of alerts and bulletins that addressed 
various cyber topics. However, they expressed concerns regarding the 
timeliness of ICS-CERT's information sharing and communications. As a 
result, the stakeholders are concerned that a great deal of time might 
elapse until stakeholders were made aware of the same or similar 
incident that could affect their systems.
    Additionally, both Sector-Specific Agencies and private-sector 
officials said that an advance notification would be helpful to 
increase dialogue with ICS-CERT on an event or threat that has not been 
made public. The private-sector officials suggested that advance 
notification can allow them to assist ICS-CERT in developing solutions 
and mitigating strategies as well as determining whether an incident is 
isolated or systemic.
    ICS-CERT management acknowledged the Sector-Specific Agencies', 
councils', and private sector's concerns regarding the sharing of 
active incidents and threats, such as identified cyber intrusions and 
spear-phishing emails. Additionally, ICS-CERT management told us that 
the private sector perceives that ICS-CERT has more useful information 
available than it is willing to share. However, ICS-CERT management 
said that proprietary information and on-going law enforcement 
investigations limit the amount of information ICS-CERT can 
disseminate. For example, there were instances in which the Federal 
Bureau of Investigation was engaged in an on-going investigation and 
had withheld sensitive law enforcement information. Additionally, the 
protected critical infrastructure information between DHS and the 
private-sector owner prohibits ICS-CERT from sharing vulnerability and 
malware assessment information.
    We recommended that the Under Secretary, NPPD promote collaboration 
with Sector-Specific Agencies and private-sector owners/operators by 
communicating preliminary technical and on-site assessment results to 
address and mitigate potential security threats on ICS.
    Mr. Chairman, this concludes my prepared statement. I appreciate 
your time and attention and welcome any questions from you or Members 
of the subcommittee.

    Mr. Meehan. Thank you, Mr. Edwards, for your testimony.
    Before we go to the opportunity for my colleagues to 
present their questions to you, I am pleased to be joined by 
the Ranking Member of our committee, the gentlelady from New 
York, and I recognize her now for opening comments that she may 
have?
    Ms. Clarke. Thank you very much, Mr. Chairman, and thank 
you to the Ranking Member and my colleagues.
    Mr. Chairman, I want to thank you once again for holding 
this morning's hearing. After significant expansion of the 
Department of Homeland Security's cybersecurity mission and 
programs beginning in fiscal year 2012, I am glad that this 
morning we have had the opportunity to examine these programs 
and are now able to assess the progress of the Department in 
carrying out the mission.
    As you are aware, this is the subcommittee's third hearing 
on cybersecurity in this Congress. First we held a hearing on 
the threats in cyberspace through our critical infrastructure 
from state and non-state actors. Next we learned about the 
DHS--how DHS protects the privacy of our citizens in 
cyberspace. With the background in place, today we have heard 
from the witnesses about the Department and has the--about 
whether the Department has people, programs, and resources in 
place to successfully address the significant cyber threats to 
our critical infrastructure while protecting privacy.
    It is high time that our subcommittee take a closer look at 
these programs, some of which did not even exist just a few 
years ago. The continuous diagnostics and Einstein programs in 
particular have undergone rapid expansion, and I am pleased 
that the Department is fulfilling its role as the protector of 
the dot-gov domain with the resources to match.
    But though these Federal network security programs get the 
majority of the funding and attention, I believe the 
Department's responsibilities for protecting critical 
infrastructure, most of which is found in the private sector, 
is equally important. For this reason, I am particularly 
pleased that we have been joined this morning by Deputy 
Inspector Charles Edwards and that he has discussed the recent 
work done by the OIG to assess the progress that ICS-CERT has 
made to brand itself as the cyber 9-1-1 for critical 
infrastructure before, during, and after cyber incidents.
    ICS-CERT, recently incorporated as an operational arm of 
the NCCIC, has done great work in mitigating cyber risks to 
critical infrastructure and it was important that we learned 
more about this mission and the challenges that still remain to 
share information with the private sector quickly and 
efficiently.
    Finally, I want to register my concerns about the 
continuing drain of senior cybersecurity leadership at the 
Department, a trend that has gotten particularly bad in the 
last 6 months, with the departures of the assistant secretary 
and the deputy under secretary. We have been hearing about the 
difficulties DHS faces in attracting and retaining skilled 
junior and mid-level cyber employees for a long time, but 
this--but what does it say about the Department's cyber 
organization when it cannot retain its senior leaders as well?
    Rumors are circulating about the future replacements of 
these losses, and I am sure DHS would like to make a splash 
with these appointments, getting leaders who command respect in 
information security and critical infrastructure worlds. But 
most of all, DHS needs to find leaders who believe in the 
mission, that will stay on-board as a steady hand on the wheel 
during this period of immense expansion and evolution of our 
cybersecurity efforts.
    As part of this process, I believe DHS needs to do some 
soul searching and identify with why their senior officials 
have been leaving. If changes need to be made to ensure future 
leaders will be more empowered to do their job, I expect that 
the Department will do so. I hope to work with the Department 
in this endeavor to guarantee that vital cybersecurity mission 
gets the leadership it needs.
    Once again, I would like to thank all of you for testifying 
before us this morning.
    I yield back the balance of my time.
    Mr. Meehan. I thank the Ranking Member for her opening 
comments.
    We are grateful, again, for your presence here today, of 
this distinguished panel.
    So I now recognize myself for 5 minutes of questioning.
    Let me begin by sharing an observation that I believe we in 
Congress, and in fact, across the Governmental sector, aren't 
doing a good enough job of really alerting the citizens in 
general about the true nature and scope of the threat that we 
face. We often respond in the aftermath of an incident and 
spend time analyzing what we could have done better.
    I believe the work that you are doing is not only vital to 
the security of our Nation, but you have done some tremendous 
things in the form of anticipating and sharing and 
communicating.
    So please, if I can just ask Mr. Zelvin and Ms. Stempfley, 
quickly, what is your assessment of the true nature of the 
threat that we face today in the world of cybersecurity?
    Ms. Stempfley.
    Ms. Stempfley. I had to figure the button out, too.
    Thank you very much for the opportunity to answer that 
question. As we have all recognized, cyber pervades almost 
every facet of our life--we do banking on-line, we do--I renew 
my driver's license on-line, our workplace has gone entirely 
on-line--and a recognition of that important part that the 
cyber landscape plays in this is certainly not something I 
think is widely known. So I agree with your point.
    We in the Department have been very focused on sharing 
actionable information, those threat indicators that can be put 
out there, whether it from a criminal source, whether it come 
from a hacktivist source, whether it comes from an intelligence 
source--putting that in the hands of the people who can do the 
most with it. I know Mr. Zelvin will give you very specific 
indications of that as he goes through his response to this 
question.
    But we have to pair that with raising the overall 
understanding of the population of the role that cyber plays, 
and so some of the other programs that are outside the 
technology programs that the Office of Cybersecurity and 
Communication has in things like the ``Stop, Think, Connect'' 
campaign and other broad awareness campaigns will raise that--
serves to raise that awareness so that consumers can understand 
what the impact is to them and will live up to some of their 
obligations, as well.
    Mr. Meehan. Mr. Zelvin, it is consumers, and Ms. Stempfley 
focused to some extent on the impact on the everyday American, 
but it is much broader than that, is it not, with respect to 
the very infrastructure that we have in this Nation, including 
our grids and other things of that nature?
    Mr. Zelvin. It is, Mr. Chairman. When I look at the 
challenge I look at the threats, I look at the victims, and I 
look at the mitigation capabilities. So as you look at the 
threats, it is as Ms. Stempfley said, it can affect the 
individuals.
    But there is also nation states. There are also criminal 
actors. There are nefarious actors and there are just people 
who want to see if they can do it for the sake of doing it.
    When you look at the victims, you have companies that are 
worth billions of dollars internationally. You have victims 
such as my aunt, who called me on a weekend and said, ``Why is 
DHS locking my computer and want $400 to unlock it?'' She was a 
victim of something called ransomware. Some virus got on and 
she couldn't unlock it.
    So the victims are very sophisticated or they are an 
elderly woman who doesn't understand why her computer isn't 
working.
    As you look at the mitigation capabilities, they are also 
varied. Some companies have magnificent capabilities, and 
probably we need the Government to provide information and a 
warning of what is happening and some suggestions on what to 
do, and then they are off and running and can deal with the 
challenges.
    Other places, they have no capability. They are not sure 
what to do. They are very confused by the threat and they know 
it is a problem, but they are not really sure what to do.
    In many cases they buy products from the commercial 
sector--anti-virus vendors--and hope that can be the solution. 
But it many cases it won't as they are stealing personal 
identifiable information, potentially financial information.
    Mr. Meehan. Would you jump off of that point, because I 
think it gets to the heart of what is so important about the 
work you do in the NCCIC, and particularly the fact that we 
have a moldable--or we have a broad range of capabilities, as 
you identified, very sophisticated capacities that not only 
rival but probably work in concert with the capacities--the 
highest level of capacities that we have in the Government 
sector, and I am talking about the banking sector, in some ways 
the communication sector and others.
    In other places we have systems that are dramatically 
behind, and I am talking about things like water systems or 
other kinds of municipal authorities, but all of which today 
are tied to the internet, and therefore, the operating systems 
are capable of being influenced and attacked.
    At some point, Mr. Edwards, you have done work into looking 
at that.
    But, Mr. Zelvin, explain the important role that the NCCIC 
plays in being more or less a junction that is able to tie 
together the capacity to take the best of what we have and 
allow it to be available to support those industries which are 
lagging dramatically behind.
    Mr. Zelvin. Mr. Chairman, as I look at the--you know, you 
mentioned what is it going to take for people to understand 
this cyber challenge? I will tell you, there is a variety of 
experiences, and those who have been attacked the most are 
obviously the most aware and the most prepared, and that, I 
think are the financial services sector and the communications 
sector and the information technology sector. These are the 
folks that are living and breathing attacks on a daily basis 
and they are becoming more sophisticated by the day.
    There are other sectors, as you mentioned, that haven't had 
these attacks. So what we do in the NCCIC is we look across the 
16 critical infrastructures and we try and raise the water to 
keep all the boats at the same level, if you will.
    So we highlight across the sectors. That is, what is 
happening in one sector today could be happening in another 
sector tomorrow. So we want to increase the awareness.
    We are also sharing those mitigation strategies. In some 
cases--in many cases--these are things that companies can do 
themselves, so we just want to reinforce. There is a friction 
within the critical infrastructure because in many cases--I 
apologize--the information technology and the security folks, 
they are not part of the profit, so--and there is money that 
needs to be brought into this solution.
    So what we try to do is we tell those that are in the 
leadership position to really listen to these security 
professionals and really deal with these cyber practices 
because they can affect your core businesses.
    I would also like to mention that we also work with State, 
local, and Tribal, territorial governments. We work with 
international partners. There are over 200 countries that we 
deal with almost on a weekly basis.
    So it is the critical infrastructure, it is our State, 
local, Tribal, territorial, it is our Federal Department's 
agencies, international, and as I said, the individuals. But 
the cyber threat is literally global in nature and we are 
trying to make sure we have awareness and help with the 
prevention mitigation across the board.
    Mr. Meehan. Well, my time is expired but I look forward to 
following up on some of that with the second line of questions.
    Now the Chairman recognizes the ranking lady from--the 
gentlelady from New York, the Ranking Member, Ms. Clarke?
    Ms. Clarke. Thank you, Mr. Chairman.
    Ms. Stempfley, I wanted to delve into Einstein 3. DHS has 
requested large funding increases to build out Einstein 3, 
which will help prevent intrusions into civilian Federal 
networks. While I am supportive of this program, I am concerned 
about the progress of such a large initiative and want to make 
sure it is carried out properly to ensure that our Federal 
networks are secured and to keep the cost to the taxpayers 
down.
    A recent report by GCN Magazine raised concerns that 
Einstein may be over budget and behind in implementation. For 
the record, can you give the subcommittee an update on 
Einstein, particularly Einstein 3? What is the schedule for 
deploying it at all departments and agencies, and do you expect 
there to be cost and time frame overruns?
    Ms. Stempfley. Thank you, ma'am.
    Einstein 3 is a part of a comprehensive set of capabilities 
for perimeter protection known as the National Cybersecurity 
Protection System. Just about a year ago we transitioned 
Einstein 3 from being a consolidated, Government-provided 
hardware and data capability--classified capability to be 
deployed at the internet service providers--to one that takes 
advantage of the innovation that the internet service providers 
can provide into this environment, so that classified 
Government information and countermeasures can be deployed in 
an environment where the ISPs, who are most knowledgeable of 
their own infrastructure and of the ability to transmit 
traffic, can absorb that and innovate with the Government in 
this environment.
    We are pleased to have notified Congress, I believe 5 weeks 
ago, of the award of the first of those contracts with 
CenturyLink, the first internet service provider, and we are in 
process of transitioning Federal departments onto that 
capability.
    An important piece of information here is that we 
transition Federal departments who are using that service 
provider. So we are not asking departments to move from 
whichever internet service provider provides their connection; 
we are employing this protection measure in place within that 
mechanism.
    So we are targeting those departments who are--whose 
service provider is CenturyLink. We are continuing to actively 
engage with the other four internet service providers for 
contract award in those instances, and that has been 
negotiation that is on-going. So we are very happy about that.
    We are still on target to reach our final operational 
capability in the end of 2015. This transition that we made a 
year ago actually moved our final operational capability from 
2018 back to 2015, so we saw that as a very beneficial 
capability for us to employ this protection across the entire 
Federal enterprise.
    Ms. Clarke. Fabulous. With that efficiency in time is there 
an efficiency in cost, as well?
    Ms. Stempfley. As it turned out in the analysis, the cost 
was identical between the two transitions within a small 
margin. It did not actually save us money but it also did not 
cost additional money over the life-cycle cost of the program.
    Ms. Clarke. Very well. Thank you for that update.
    Mr. Edwards, you released a report just yesterday detailing 
serious information security deficiencies at CBP. Is this--a 
little point of departure but I think it is critical when we 
look at our vulnerabilities.
    Some of the--what you outlined in your report is that there 
are some poor practices, including computers that were not 
locked or not password protected, a failure to require that 
employees sign in--or sign nondisclosure agreements for 
sensitive systems they received access to. Making matters 
worse, many of these issues had been previously identified by 
the OIG. Your recommendations based on these findings were 
directed to the CBP chief information officer and the DHS chief 
information officer but there is no role for the Office of 
Cybersecurity Communications within NPPD to play to help the 
rest of the Department improve their cyber practices.
    Could you give us a little more of a sense of what your 
observations and what this level of vulnerability can mean to 
the overall cyber environment that we find ourselves in?
    Mr. Edwards. Thank you, ma'am.
    The report that I released yesterday was in reference to 
the CBP I.T. management letter. Part of the financial statement 
audit--we use KPMG to do our financial statement audits, and 
part of that, we also do the I.T. part of it, we look at the 
FISCAM functions. There are five controls that we look at. We 
look at security management, access controls, integration 
management, segregation of duties, and contingency planning.
    So as we go through not only CBP but various different 
components, we identified I.T. control weaknesses. Even though 
CBP has fixed some of those weaknesses in the previous year 
that we identified, there are still additional controls and 
weaknesses that we have found that they need to address.
    So as, you know, part of the password protection and people 
being able to get into the systems, we have found not only in 
CBP but other parts of--even when we did within one of the 
components within NPPD we found almost a similar situation, so 
it is prominent throughout the Department.
    So I think sending a guidance to the entire Department on 
best practices and, you know, one would think instead of having 
a password as ``newuser1'' one would change it as soon as they 
are able to log in, and then maintain that, as well. Not, you 
know, quite often you find people, you know, writing the 
username and password and leaving it under the keyboard and 
other places where people can find it.
    So the--part of the review, what we did was we looked to, 
as the help desk we call up the component that we are doing the 
audit on and say, ``I am from the help desk. Can you give me 
your username and password?'' and without hesitation people 
tend to just give that up.
    Ms. Clarke. Mr. Chairman, I know that my time is lapsed 
here. I just wanted to add that, you know, we can put all of 
the new technologies we want in place but if cyber hygiene has 
not become a practice, the vulnerabilities remain perilous to 
us.
    So I want to thank you for your report.
    I yield back the balance--yield back to you, Mr. Chairman.
    Mr. Meehan. I thank the gentlelady, and I share that same 
observation.
    We are hearing--I know it is something you are talking 
about across the sector and we have heard testimony that more 
than 80 percent of our vulnerabilities could be addressed with 
better cyber hygiene. I think that is something--again, we talk 
about this process of educating America and the role that they 
can play with us. There is more sophisticated things and that 
is what you are dealing with, but we need the Nation to join us 
in battling the threat by doing better cyber hygiene.
    Ms. Clarke. We start with our own agencies, right?
    Mr. Meehan. We start with our own agencies, that is right, 
by setting the example.
    I am very grateful for that testimony, and now the Chairman 
recognizes the gentleman from Texas, Mr. Vela, for any 
questions he may have.
    Mr. Vela. Yes. Yes. On the issue of workforce, can you 
begin by explaining to us how your different divisions 
interact?
    Ms. Stempfley. Thank you, sir.
    In the Office of Cybersecurity and Communication we have 
five divisions, and those divisions span responsibility from 
National security emergency preparedness communications--that 
is the Office of Emergency Communications; the Office of 
Stakeholder Engagement and Critical Infrastructure Resilience, 
which is principally responsible for our outreach efforts, for 
our engagement with critical infrastructure to raise their 
understanding at a macro level, which is obviously supportive 
of the operational role that the NCCIC plays; as well as our 
Network Security Deployment Division, which is responsible 
primarily for the building and deployment of the--and operation 
of the National Cybersecurity Protection System; and finally, 
our Federal Network Resilience Division, which is focused on 
the dot-gov protections. That is both in terms of direct 
interaction with Federal departments and agencies and the 
building of the capability that you discussed earlier, the 
continuous diagnostics and mitigation capability, which is 
focused on the cyber hygiene for the Federal enterprise.
    Those five divisions operate together under the Office of 
Cybersecurity and Communications. You can see the mutually 
supportive role that they pay.
    For example, the communications infrastructure is moving to 
being I.P.-based. With an I.P.-based communications 
infrastructure you bring with it particular risks and 
opportunities. The technology awareness mechanisms of that are 
shared, then with the Stakeholder Engagement Organization and 
the threat information provided from the NCCIC is then 
disseminated and distributed.
    That data all support the requirements that go into the 
National Security--excuse me, the Network Security Deployment 
Division, and the Federal--and we want the Federal Government 
to be the best example of the right things to do within the 
Federal Network Resilience Organization. We realigned this 
structure last November, so not quite a year ago. It has been a 
very beneficial activity for the Office of Cybersecurity and 
Communication.
    Within the Department, the deputy secretary chairs a panel 
that ensures that we are--excuse me--coordinating across the 
Department. There is both operational engagement on the NCCIC 
floor from our Department colleagues for Secret Service, from 
Coast Guard, and others. We have policy conversations across 
the Department to ensure that we are sharing. We have a strong 
partnership with the CIO so that those FISMA requirements that 
we--the operational requirements that we publish in partnership 
with OMB are coordinated with and shared with the CIO 
organization to understand what that might mean to a large 
department that is informing back to us.
    Mr. Vela. The Ranking Member mentioned--or referenced a 
problem with retention of workforce, and are you seeing that in 
each of those five divisions, or--can you explain that?
    Ms. Stempfley. Absolutely. It is a competitive landscape 
for cybersecurity professionals. We are actively recruiting.
    If you look at the growth in terms of civilians that we 
have had in the Office of Cybersecurity and Communications in 
the 3 years I have been here, we have been actively engaged in 
this recruiting process. Mr. Zelvin shared earlier today with 
me a fact that, you know, for each announcement that we put out 
there we get candidates applying in numbers close to 100.
    The issues that we have in this competitive landscape are 
that the Department of Homeland Security's authorities for 
meeting the hiring needs are not commensurate with the other 
Federal departments' authorities, and so both in terms of pay 
and retention capabilities, we are competing against our own 
colleagues in the Federal Government and continue to compete 
against our colleagues in the broad commercial landscape, as 
well.
    We have a phenomenal mission and we keep people in part 
based on the mission responsibilities that we have. We do not 
have an exorbitant attrition rate at the operational level, 
certainly. People leave; they leave on, you know, based on 
their family and life desires. We don't see this, you know, 
exceptional attrition rate.
    But we do see that strong competition.
    Mr. Vela. So are you saying that you can't pay people 
enough, essentially?
    Ms. Stempfley. That is part of the issues, yes, sir.
    Mr. Vela. I noticed that your title is you are an acting 
assistant secretary. At the levels of leadership are there many 
spots that have not been permanently filled?
    Ms. Stempfley. Within the Office of Cybersecurity and 
Communication the acting assistant secretary is the only 
leadership position that has not been filled--or the assistant 
secretary. I have full-time career leadership. I am permanently 
the deputy assistant secretary so I am the full-time careerist 
in that position. At each of the division director level I have 
full-time fill in, you know, all of those as career positions.
    Mr. Meehan. I thank the gentleman for yielding back.
    We now recognize the gentleman from Nevada, Mr. Horsford, 
for his questions.
    Mr. Horsford. Thank you, Mr. Chairman.
    Appreciate very much this panel. You know, we have been 
meeting, as one of the new Members on this committee, a lot of 
the people in the private sector, and I want to commend the 
Center on its collaboration with a number of key private-sector 
entities and sectors.
    My question pertains to this collaboration with the private 
sector.
    You mentioned in your testimony the work with the over 
6,400 private-sector firms that work with the Center, and 
inevitably some of those have to be competitors, of course. So 
can you discuss the protocols and measures that you all have in 
place to ensure that one company's sensitive data does not pass 
on to another, particularly to a competitor, and what 
procedures are in place should such an incident occur?
    Mr. Zelvin. Yes. Thank you, Congressman.
    Last year alone, as Ms. Stempfley said, we had 190,000 
incidents reported and we put out almost 8,000 reports. This 
year we are going to exceed that just in--by May about 68 
percent.
    So when we get information there is a variety of ways a 
business can report. They can tell us that it is okay to say it 
is their company, and that is not an often occasion; they can 
ask us to anonymize, and we have this thing called traffic 
light protocol, and it is literally just an agreement between 
friends that we will not share. When I first saw it I was 
somewhat skeptical but it actually works, and we have a variety 
of ways of quantifying using a stop light protocol--red, 
yellow, green, so on and so forth, and it is actually an 
effective means.
    We have statutory capabilities under PII, Protected 
Infrastructure Information--I think I have the acronym right. 
But there is a statutory basis that we can anonymize 
information, and let's say, you know, you work for a financial 
sector. I will just refer to you as ``financial sector seven,'' 
or ``FIN7,'' or ``FIN8.'' What is important is not the identity 
of the company but the ability to port across cross-sector what 
is happening and, more importantly, what do you do about it.
    So we have folks on the floor at the NCCIC, so we have NSA, 
we have FBI, we have Secret Service, we have Cybercom. We also 
have all the information sharing and analysis centers of the 
financial services, communications, information technology, and 
also folks from individual companies that have full access to 
the floor even when we are at Top Secret or above 
classification. They have full access to all our computer 
systems, both the highly classified all the way down to below.
    So as you have these folks on board we are very cognizant 
of the competitor aspect, so we have abilities to put a label 
that anonymizes it that is either done through agreement or 
through statutory. In the agreement, why do--you know, why 
wouldn't we share? Well No. 1, I don't really need the 
information; the second thing is I don't want to betray your 
trust because if I do you will never talk to me again.
    So, you know, we are very cognizant of it and we are very 
successful at it, as well.
    Mr. Horsford. So my other part of my question is, it seems 
like some sectors are better at this than others, so how 
concentrated are certain sectors in working with the centers 
and do you see gaps? If so, what can we as Congress do to help 
facilitate bringing the sectors who aren't doing their part, 
you know, into the resources that you all have available?
    Mr. Zelvin. Yes, sir. Who has really focused on meeting the 
challenges really depends on their experience, as I mentioned, 
in cybersecurity and the attacks. There are certain sectors 
that have had a large number of attacks; there are others that 
haven't yet. It is all of our challenge to go out to them and 
say, ``Hey, this is really what others are facing, these are 
the things that you could be facing, and these----''
    Mr. Horsford. If I could be more specific----
    Mr. Zelvin. Sir.
    Mr. Horsford. So these people come into my office every day 
and my job is to, you know, encourage them to participate. You 
all have great capacity among Federal agencies, but as I have 
heard it, as the Chairman and the Ranking Member have educated 
us, the vulnerability is on the private-sector side and the 
private sector isn't always doing its part, and there are key 
sectors that seem to be completely kind of disengaged. So what 
do you need from us as Congress specifically to get those 
sectors to be more involved?
    Mr. Zelvin. In my view it is the continued dialogue and the 
continued conversation that we are having. I think, as I look--
you know, as I have briefed senior leaders, as I have briefed 
staff, you know, people generally understand there is a problem 
but they don't understand what to do about it, and when you 
talk about the problem they don't really--they know there is 
something wrong but they really have trouble quantifying what 
is it.
    The other thing I will tell you--and I say this often--the 
lexicon in cyber is not English, so if I say ``phishing,'' if I 
say ``D-DOS,'' if I say ``Trojan''--when I say ``phishing'' 
most people go to a lake someplace and think about, you know, 
maybe catching a fish but that is not when I am speaking of.
    I have often said also is that if I told you there was a 
Category 4 hurricane that hit the Gulf Coast you would go, 
``Oh, that is bad.'' Category 1? It is bad, but 4 is worse.
    If I told you there was an 8.0 earthquake on the West Coast 
you would automatically go, ``That is incredibly bad.'' 1.0? 
Most Californians probably wouldn't do anything.
    What is that in cyber? How do we get that imagery? How do 
we get the awareness across to the public of, ``Boy, this is 
something that is bad but we could probably be okay,'' or, 
``This is catastrophic and we need you to do these measures 
such as leave, you know, other precautions.''
    So we are still working that and I am hopeful, but we are 
not there yet.
    Mr. Horsford. Thank you, Mr. Chairman.
    Mr. Meehan. I thank the gentleman. I certainly, you know, 
one of the aspects are the ISACs and other things that can be 
present, and I think the gentleman's questioning was right on 
target about those that are engaged and those we have to do a 
better job of attracting.
    It is important to appreciate the vital role that you play 
and the interplay among our Governmental agencies at the outset 
before we get down to dealing with the various private-sector 
industries that are part of it, so I want to ask you to go for 
a moment off of this important observations, and it comes from 
General Alexander, who is the head of the NSA, and I use it in 
his words, and he says, ``I see the Department of Homeland 
Security as the entry point for working with industry,'' and 
there is great reasons for it: Transparency, having everybody 
doing exactly the right thing together to work as a team.
    The FBI, NSA, Cyber Command--the FBI would lead law 
enforcement and the attributions; NSA will work with foreign 
intelligence; Cyber Command are defending the Nation. But they 
have a civilian agency, by his own testimony, at the core of 
the ability for us to have a communications infrastructure that 
works across the Governmental sectors first and then 
simultaneously work effectively in real time with our civilian 
sectors.
    So please give me your observations with regards to 
somebody as significant as General Alexander looking at DHS as 
the center point for the engagement of our approach to 
cybersecurity.
    Mr. Zelvin. Thank you, Mr. Chairman.
    I agree with the general's assessment so much so I joined 
the Department. DHS is purely that civilian entity, and when 
folks come to us they know--and there is important other roles 
in Government, but within DHS we are really about that 
protection, prevention, mitigation, response, and recovery. We 
really do want to help understand the problem not only 
technically but through the tactics, techniques, and 
procedures, and then work through those mitigations, and then 
share that information, as I said, with the partners I have 
mentioned--State, local, critical infrastructure, 
international, other Federal departments and agencies.
    So when folks come to us--and it has been interesting. A 
number of private-sector partners have come to us because they 
see us as that place in Government where they can have a 
discussion where it is purely technical, there is not concerns 
potentially of being asked a lot more questions that will lead 
to other things and it is important for Government to do.
    As you look at vulnerabilities in cyberspace, there are 
things that have the potential for malicious activity but 
haven't quite matured to that point yet, and I look at things 
like have happened to a number of companies in that we discover 
a vulnerability that if somebody did something it could be 
catastrophic, but they haven't done it yet. Those are really 
the areas that we want to get ahead of.
    We don't always want to be responding. We don't always want 
to be catching up to our adversaries. We want to get ahead of 
those.
    For companies it can be often uncomfortable to say, ``We 
discovered a problem,'' and they don't want to be attributed--
they don't want their competitors to say, ``See, look. They are 
having yet another problem.'' So they come to us and we have 
the ability to provide the anonymity, work through the 
technical solutions, and then get it across the Nation and 
across the world so people can understand the threat and 
mitigate it without the fear of additional questions about who 
did it and where did they do it and how.
    Mr. Meehan. Effectively, you are a civilian agency so it 
removes some of the concern that legitimately people have 
outside that we are having private sector share either back and 
forth with our more sophisticated Governmental agencies like 
the NSA or FBI.
    Mr. Zelvin. That is correct, sir. It is absolutely a 
civilian organization and I don't have the challenges that some 
of my partners do in that I am not being pushed for things like 
attribution; I am not being pushed for bringing prosecution. 
There are other important entities that do that; that is not my 
role. My role is just to understand the problem and come up 
with the solutions.
    Mr. Meehan. Let me jump into one other piece, because we 
have done a good job of identifying the important role we place 
vis-a-vis the other Governmental--critical Governmental 
agencies, and of course, that extends down through the entire 
Governmental structure. But at the same time, we have 
relationships with the private sector.
    Now, those looking from the outside can get lost in forest, 
but there has been a lot of thought into how we are organized 
and I am impressed by it. Explain quickly: We have 16 different 
sectors--17 different sectors in which industries are 
organized, and they have their own sector communication 
coordinating councils in which they themselves look at the 
unique nature of threats, such as something that may go 
uniquely to banks, the denial of services as an example.
    Within those coordinating councils some--and this goes to 
Mr. Horsford's line of questioning--some have created what we 
call the ISAACs, these information sector analysis coordinating 
teams--very sophisticated for their--and they are housed with 
you. But my recollection is we have only got about four that 
are in there. They are some of the best, but we have got a lot 
of agencies or private-sector entities that may be lagging.
    Can you give me your observations with regard to how it is 
that, you know, we are effectively organized in that way but 
what we can do to begin to attract the collaboration of all of 
the other entities?
    Mr. Zelvin. Yes, Mr. Chairman.
    We deal with all of the critical infrastructures. We are 
working across the board. But I will tell you, as I look across 
the financial services sector, and specifically the Financial 
Services Information Sharing and Analysis Center, the FS-ISAC, 
they have done an absolutely extraordinary job helping us work 
through the recent distributed denial of services hacks that 
have been going against the financial institutions.
    So the Financial Services ISAC has not only been able to 
coordinate with Government, but also among itself. They provide 
extraordinary information not only with each other but also 
with Government. Some of the best information I get from the 
distributed denial-of-services comes from the private sector, 
and it is not only the sharing with us but also sharing within 
each other.
    The Communications ISAC, the Information Technology ISAC 
have similar experiences. I will also tell you, the Multi-State 
ISAC, so the sharing between all the States and the possessions 
and the territories--that information mechanism is very 
effective.
    There are others that we need to build up to that capacity, 
but I would tell you, I don't see that as a negative; I see it 
as a positive. We have learned a lot since these distributed 
denial-of-services attacks, and also the malware attacks that 
have affected Saudis and also in Qatar.
    This has changed the dynamic in cybersecurity just in the 
last few months. So ideas that were really well-thought-out 
earlier are really being developed and we need to catch back up 
with the others as we stay focused on the financial services 
sector, the comms, and----
    Mr. Meehan. You mean you are learning things with financial 
services that could apply to other sectors.
    Mr. Zelvin. That is exactly right, sir. I often tell folks 
that we need to share this across because the financial 
services sector needs power, they need water, they need 
transportation, they need health. They say, ``Why would we 
share with you? Why would you tell DHS?'' Well, because we have 
the ability that is unique in that we can share with these 
other sectors and we can make them aware of the challenges and 
we can share the mitigations, so why would you rebuild that 
capacity when it already exists?
    Mr. Meehan. Well, thank you.
    My time is expired and I now recognize the gentlelady from 
New York for her follow-up questions.
    Ms. Clarke. Let me thank you, Mr. Chairman, and acknowledge 
that we have been joined by our colleague on the Homeland 
Security Committee, the gentlelady from Texas, Ms. Jackson Lee, 
and ask for unanimous consent that she be authorized to sit and 
question the witnesses at today's hearing.
    Mr. Meehan. Pleased to do so. Unanimous consent, the 
gentlelady will be recognized in order, and I thank her for 
coming today.
    Ms. Clarke. Thank you very much, Mr. Chairman.
    I want to question each of you, just get your perspective 
on the dichotomy between the Enhanced Cybersecurity Services 
and Einstein. I support the expansion of the Enhanced 
Cybersecurity Services program to make sure that our critical 
infrastructure companies can benefit from U.S. Government 
intelligence on cyber threats. However, in the privacy impact 
assessment the Department states that Federal agencies as well 
as critical infrastructure may use ECS while the Einstein 
intrusion prevention capabilities are still being built out.
    My question is: Doesn't it seem a bit backwards or 
redundant, and how is it that you could build a cutting-edge 
cybersecurity program and have it available to the private 
sector before the Government itself adopts it? What is it about 
ECS that will make it available much more quickly than Einstein 
3?
    Ms. Stempfley. Thank you, ma'am.
    The Enhanced Cybersecurity Services is, as you point out, a 
cutting-edge capability in that it is the first time we have 
been able to provide effectively classified and sensitive 
countermeasures and indicators to commercial entities through a 
trusted cybersecurity provider, I think is very important. So 
we are very excited about this opportunity and engagement in 
both growing the number of service providers and the market 
that it generates with critical infrastructure partners.
    It provides, as you point out, in the privacy impact 
assessment, protection against--with two countermeasures: 
Domain name service and e-mail protection. Those are not in the 
traffic flow kinds of protection, which is the requirement for 
Einstein 3, and so there is a fairly important distinction 
there.
    While we will work to enhance the Enhanced Cybersecurity 
Services, enabling it to keep up with the threat environment 
and to provide new countermeasures into that capability, we are 
certainly in progress in that environment. We will reach that 
in a much more rapid manner in the Einstein 3 capability 
because its baseline requirement is to provide that in a real-
time capability inflow.
    That is a very technical way of describing--a technical way 
of describing it, the difference being inflow means you are 
actually affecting through the pipe as it is going on; out of 
line effectively means it gets stored, processed, and then 
forwarded on.
    Mr. Zelvin. Ma'am, I will tell you, there is some--I have a 
truly exciting job, and one of the really exciting parts is as 
you look at that dot-gov domain and the security awareness that 
I have, it is unlike any of others--so you have the dot-com, 
the dot-gov, and the dot-mil.
    So right now on the dot-gov I have extraordinary awareness 
of the traffic that is going on and we are watching that in 
almost a real-time basis in my center at the NCCIC. I have met 
with the Defense Department and we are building an awareness of 
the dot-mil similar to what we have on the dot-gov. So between 
the two of us we will have really strong awareness of what is 
going on.
    The dot-com will remain a challenge, but DHS has that dot-
gov responsibility. We are able to watch it, as I said, on a 
near real-time basis, and as we get these new enhancements, 
what we are able to do now is just to be able to see there is 
malicious activity and warn. What we will able to be doing here 
shortly is just not warn but actually mitigate and investigate 
and analyze.
    Because right now it is sort of like you know there is 
something bad in the mail but you let it get to the mailbox. 
Well, now we are going to be able to stop that and do 
appropriate measures to make sure that that bad delivery isn't 
made.
    Mr. Edwards. I will just agree with both Larry and Bobbie 
on this.
    Ms. Clarke. Very well.
    So is it anticipated that at some point the ECS will be 
phased out or become obsolete, or is there a unique capability 
within that instrument that is compatible or can partner with 
Einstein 3?
    Ms. Stempfley. Certainly. The ECS is intended to be a 
program for that information sharing and protection for the 
critical infrastructure. It has very, very limited report back 
to Government, obviously. Only, ``Did that indicator work? Is 
that a valuable piece of information for protection measures?''
    We would anticipate that to continue and that we would 
employ more countermeasures as we go through the legal, 
privacy, and other considerations for employment of those 
countermeasures in the unique situation of critical 
infrastructure.
    E3, and E3 Accelerated in particular, and its wide set of 
capabilities for the Federal enterprise we anticipate existing, 
as well. The specific countermeasures and which one would come 
forward into the Government space or the critical 
infrastructure space is really based on the very different 
legal models that are appropriate for us in that space.
    Mr. Meehan. I thank the Ranking Members.
    The Chairman now recognizes the gentlelady, Ms. Jackson 
Lee, for any questions she may have.
    Ms. Jackson Lee. Let me thank, first of all, the Chairman 
and the Ranking Member for holding the hearing and your 
courtesies of allowing me to come and to ask questions for 
something that I think is crucial for the entire Homeland 
Security Committee.
    Let me start out--and I am going to just offer for you to 
answer the questions who can answer it, and I will then ask the 
particular person if no one jumps in. The CERT teams that we 
have--this is enormously important, this whole idea of 
communication, the whole idea of reacting to the cyber threat--
with respect to the CERT systems, do we have the capacity to 
have a particularly defined CERT for each of the industries? I 
think of oil and gas; I think of the health-care industry, 
which is massive.
    That is my first question: Do we--are they defined so 
specifically that they focus on the needs of a particular 
industry?
    Madam Secretary.
    Ms. Stempfley. Ma'am, if I may take a----
    Ms. Jackson Lee. Yes. Thank you.
    Ms. Stempfley [continuing]. A first crack at your question, 
the technologies that are in use across these industries are 
very similar, and because of that the organization of our cyber 
emergency response teams or computer emergency readiness teams 
are oriented to be useful to all of the sectors, versus a 
particular emergency readiness team focused on any one sector. 
So you see the information technology infrastructure largely 
covered by the US-CERT, then the operational technology control 
systems community operated by the Industrial Control Systems 
CERT.
    So the infrastructures in the oil and natural gas, or in 
transportation, or in those mechanisms are largely produced by 
the same companies and in the same environment. This has proven 
to be one of the most effective and efficient organization 
models.
    Ms. Jackson Lee. Let me follow it with two questions, and 
maybe I will have time to make a comment. Thank you for that.
    We all understand that finding a problem in computer 
security or cybersecurity is like finding a needle in a 
haystack, and so have we developed the sophistication to be 
able to target where the problem is, to target where there is 
activity?
    My other question is on the Einstein 3 I notice that there 
is certainly a need for skilled individuals, and my question 
is: Do we as the Government have the capacity to bring people 
in laterally? It speaks to my issue of the STEM and 
diversifying. STEM education is great but it starts at 
kindergarten. If we need people right now, do we have the 
ability to cross-train them in the Government, which adds to 
the diversity and the skills that we need?
    I will--those are the two questions I will pose.
    Mr. Zelvin. Congresswoman, if I can maybe finish your first 
question and get to the second and----
    Ms. Jackson Lee. Yes.
    Mr. Zelvin [continuing]. Ask Ms. Stempfley to do the third. 
So on the first question on the specific CERTs for each of the 
sectors, I will tell you that when we operate in a sector we do 
it in intimate partnership with the sector-specific agency and 
the sector-specific coordination councils. So if there is an 
energy problem we are with the Department of Energy; if it is 
oil and natural gas, Department of TSA; Finance; Treasury; so 
on and so forth. We are fully partnered.
    So we bring the technical skills, the ability to understand 
the virtual and I.T. environment. They bring the experience and 
wealth of knowledge within----
    Ms. Jackson Lee. Do we have the capacity to target if there 
is activity that is in essence piercing our cyber framework 
involving our proprietary information? If somebody is attacking 
our system, you have that capacity?
    Mr. Zelvin. We have the--some capacity. We do not have 
absolute capacity.
    Ms. Jackson Lee. What would you need to get absolute 
capacity?
    Mr. Zelvin. Extraordinary intelligence and information. So, 
you know, in many cases there is vulnerability. So there was a 
mistake made and then found, and so there are things you do to 
correct that mistake.
    There are attacks. There are people who are purposely 
trying to do something you do not wish them to do. In many 
cases and not all--in many cases you are there reacting to the 
challenge and then building that technical mitigation to 
prevent.
    However, there are times they are are going to be--you 
know, we have to be good every time; they have to be good just 
some of the time. So I would never say that we are ever going 
to get to that place where we will be able to protect 
everything, but we have a great deal of information but it 
doesn't mean that we don't have vulnerabilities.
    I would ask Ms. Stempfley to follow up.
    Ms. Stempfley. We want to certainly thank Members of this 
committee and others for supporting the resource request that 
the Department has had over a number of years. You have seen 
the build-out of the capabilities in the National Cybersecurity 
and Communications Integration Center, which has been directly 
to your capacity question. We operate every day in that center, 
sharing information as a part of it.
    There is a responsibility the private sector has for 
adoption of best practices and adoption of cybersecurity 
principles, and we continue to work with them for further 
movement in that area.
    Your final question was on hiring and, in particular, is 
there--if I understood your question correctly----
    Ms. Jackson Lee. Cross-training.
    Ms. Stempfley. Right. So is there an ability for lateral 
hiring, I believe is what you said. One of the things that I 
think is universally recognized is that, given the importance 
of cybersecurity and the need for cybersecurity professionals 
in this area, we--all of the Federal enterprise and our 
commercial partners are engaged in trying to build the 
capabilities to ensure we have that.
    The Secretary chartered, through the Homeland Security 
Advisory Council, a cyber skills study that looked at the 
Department itself. The Department also has important 
responsibilities under the National Initiative for 
Cybersecurity Education, which continue to engage raising that 
lateral mechanism, that cross-skills.
    We certainly have to focus not only on, as you point out, 
STEM starting young--I am raising several kids who I am trying 
to direct into the technical workforce, as well--but to ensure 
that we have the capacity at a lateral level.
    We do this cross-training support in the Office of 
Cybersecurity and Communications. When we have an incident the 
NCCIC can call on individuals from across the SNC, can call on 
individuals from across the Department. One of the findings out 
of the Cyber Skills Task Force was the creation of a cyber 
surge capacity within the Federal Government and the Department 
specifically, to address your question.
    Ms. Jackson Lee. I would like to follow up with you.
    I thank the Chairman and Ranking Member for their 
courtesies. Thank you very much.
    Mr. Meehan. I thank the gentlelady for her attendance here 
and for her questions.
    I just have one--a couple of closing questions based on 
your testimony here today.
    Mr. Edwards, you identified something which goes to the 
reality that while we are dealing with a lot of these issues 
and the need for collaboration across sectors in the Government 
and, simultaneously, with the private sector, one thing you 
focused on that is the reality of this threat is speed. It is 
happening in real time and there is a need for us to be 
responsive in real time.
    Now, you have looked critically at the challenges that we 
face, so the first issue is, as you stated, sometimes 
information has gotten to our partners in the private sector 
but we have got to do a better job of organizing it so it 
allows them to get to the heart of what they need to know. The 
second thing is that we have got to try to find ways to be able 
to coordinate with our partners more in the sense of: ``Hey, we 
are seeing something in your systems and we are going onto 
it.''
    So how do we both maximize our ability to get the 
information that people need to know across sectors, not just 
in sectors? Then how do you tell people--when you are not even 
sure what you are looking yourself, where do you find the right 
balance of telling somebody you might be looking at something 
in their systems versus creating an alarm that may not be 
realized because you don't know what you have yet?
    Mr. Edwards. Thank you, sir.
    The Department has done a good job in advancing 
cybersecurity. One of the recommendations that we made was when 
you are passing out this information through--whether it is 
HISN, and now they are going to move to HISN-3--is to--for the 
entities to be able to share that information, you know, and 
also not to drill down to get to a particular question they are 
trying to answer. So I think HISN-3 is going to help towards 
that.
    But also the communication part of it. You know, there is 
excellent collaboration between the private sectors and the 
public sectors.
    But among the folks that we interviewed, quite often we 
found is a lot of this is also based on relationships, and the 
Department has senior leadership positions where people from 
the private sector pick up the phone and establish a 
relationship to somebody by name and now that person has moved 
on, they don't know who to contact. So rather than establishing 
relationship based on individuals, it needs to be based on 
processes and procedures, and I think the Department is moving 
towards that.
    But also, there is--private sector does a really good job 
in handling best practices. Larry's team, you know, by the 
reorganization and putting ICS and US-CERT and ISAC and C3O-I, 
all of them at one level is moving toward that. But you also 
find information and trend analysis that the CERT team is going 
to help towards that.
    Mr. Meehan. Well, I thank you.
    Let me just ask Mr. Zelvin and Ms. Stempfley, how about the 
private-sector companies themselves sharing information with 
the Government? What kinds of challenges do we have in that 
area?
    Mr. Zelvin. Thank you, Mr. Chairman.
    The biggest challenge, I will tell you, is a lack of 
clarity, of understanding what information can be shared. So it 
is quite often that we will meet with private sector entities 
and we are--we believe we have the ability to share information 
but there is anxiety. There is absolute determination not to 
violate law, regulatory guidance.
    Mr. Meehan. Is this information coming from you to them or 
from them to you?
    Mr. Zelvin. From them to me, sir. There is also, you know, 
lack of clarity as to what I can share with them but, you know, 
as we have looked across Government I have been given the 
thumbs-up from leadership and also those who look at what we 
are sharing in--across Government and says, ``No, this is 
appropriate and this is okay.''
    But that lack of clarity of what information can be shared 
is--still exists and there is anxiety, so----
    Mr. Meehan. What is the anxiety related to? Things like 
liability protection or otherwise?
    Mr. Zelvin. It is, sir. The ability to, as I said, that 
they are not breaking law, that they are not breaking 
regulatory compliance. They are just not sure so they err on 
the side of caution.
    As you mentioned, Mr. Chairman, speed is of the essence, so 
as the folks review all this data it is taking up precious 
time. We have, in our--many of our products and what we are 
starting to receive from the private sector and just recently 
this week an international partner is machine-readable 
information. That is wonderful because it is starting to take 
the humans out of the information exchange between us. What 
would be even better someday would be that machine-to-machine 
real-time information sharing.
    But I will tell you, the technical challenge is not, in my 
opinion, as great as the policy challenge. We first have to 
define what is it that we are sharing, and then we can design 
the machines to share it.
    Mr. Meehan. Well, with the tremendous scope of information, 
ultimately it is going to have to get to machine-to-machine 
because of the computing capacity that could go through 
something in hundredths of a second that would take days for 
humans to be able to analyze.
    Mr. Zelvin. Mr. Chairman, I agree. Right now there is a 
great deal of time spent preparing the information, sending the 
information, understanding the information, and then making the 
information actionable. We need to compress that loop of 
decision-making as small as we can get. I don't know if we will 
ever get to zero but we sure as heck can do a lot better than 
we are now.
    Mr. Meehan. Okay.
    Ms. Stempfley.
    Ms. Stempfley. Sir, one of the important things that the 
I.G. recognized and Mr. Zelvin spoke to is that this 
information sharing is in part based on trust, and you have to 
have a sense that the information will be used in the best 
interest of all parties as we go forward. That trust used to be 
person-to-person. We have moved it from person-to-person to 
organization-to-organization and we will continue to do so.
    One of the important ways that we are moving forward in 
this model is to communicate with our private-sector partners 
in ways that are most beneficial to them, which means that we 
have to be able and willing to ingest that information in the 
method that is most appropriate from our private-sector 
partner, and we must be able to produce our indicators, our 
alerts in methods that are appropriate without a--with a 
recognition that it may not be identical. We talk about the 
financial sector and the financial sector ISAC being one of our 
mature ISACs, and there being other sectors who are not at that 
level yet.
    So providing a piece of information to a high, capable 
organization may prove for it to be not as useful to an 
organization that isn't ready to ingest that. So we have had a 
real focus, not only in the NCCIC but across the entire Office 
of Cybersecurity and Communications, to release this 
information in a multitude of platforms and in a multitude of 
formats. So this machine-consumable output is formatted in a 
way that can be consumed by these different entities.
    This two-way dialogue helps to build that trust, which is a 
part of what we have to overcome is that sort of initial 
distrust that comes in any relationship.
    Mr. Meehan. Well, I thank you for the good work that each 
of you is doing, and on behalf of all of your entities, for not 
only creating the framework for this sharing of communication 
but by virtue of the collaboration that you are doing, 
enhancing that trust and enhancing our ability to protect our 
home front from the serious threat. We opened this hearing with 
discussing the very real concern about cybersecurity here in 
the Nation.
    Is there any closing thought that you--any of you have 
before we close the record this morning?
    Ms. Stempfley. If I may, I want to thank you again for this 
hearing. I think it is--the topic is one of absolute import for 
us as a Nation and we are grateful for your attention and your 
time here.
    I hope that you heard the commitment the Department has to 
this important mission and to ensure that we account for those 
mechanisms that are so vital: That inextricable tie between 
privacy, civil rights and civil liberties, and cybersecurity; 
the need for adoption of security principles across our 
critical infrastructure partners for information sharing.
    We talked about some of the important needs for hiring 
authorities for some of the programs that I know you are 
supportive of in Einstein. Our law enforcement colleagues in 
the Department continue to seek tools they need to fight crimes 
in the digital age, and that National breach reporting 
requirements that I know you are discussing.
    So thank you so much for your time and attention on this 
matter, as well.
    Mr. Meehan. Thank you.
    Mr. Zelvin. Mr. Chairman and Ranking Member, I would just 
also like to thank you for having us today. Really appreciate 
the opportunity to talk to you.
    You, your colleagues, your staff, and their colleagues are 
welcome at the NCCIC any time. We would welcome the opportunity 
to show you what the great men and women within the NCCIC, 
within CC&C and DHS are doing.
    I served 26 years in uniform in the Defense Department and 
I will tell you, the people that I work with at DHS every day 
are as good as fine as anyone I served with in uniform. Their 
passion and their patriotism are just as high as those I served 
with in uniform.
    I would also like to say that our partnership with our 
closest colleagues, both in the FBI and NSA, is critical. So it 
is truly a unity-of-effort approach, and that integration 
continues to grow and we look forward to the opportunity of 
having it grow not only within Government but also private 
sector and international.
    So thank you.
    Mr. Meehan. Thank you.
    Mr. Edwards.
    Mr. Edwards. Well, we live in a virtual world so, you know, 
DHS has matured and it is improving and it is moving in the 
right direction, but much work still needs to be done. The 
threat is not only going to be coming from nation states, but 
from hackers, but also the threat within. We have to be mindful 
of that.
    I hope I can come back and issue a report and say the 
Department has done perfectly everything right and there are no 
findings and no recommendations. That is what I hope I can do, 
but still there is much work to be done.
    Thank you.
    Mr. Meehan. Well, we would all love to be able to do that, 
but that is the important responsibility we have on oversight 
and we thank you for the good work that you are all doing to 
try to aspire to that standard.
    So I thank all of you for your testimony. The Members of 
the committee may have additional questions, and if they do we 
will ask you to respond in writing in the appropriate time.
    So without objection, the subcommittee stands adjourned. 
Thank you.
    [Whereupon, at 10:32 a.m., the subcommittee was adjourned.]

                                 

```