Commission on Enhancing	National Cybersecurity	 July 7, 2016

Meeting Minutes

Attendees:

Commissioners: Tom Donilon,	Sam Palmisano,	Keith Alexander,	Herb Lin,	Heather Murren,	Maggie

Wilderotter,	Alex	Niejelow

Executive Director: Kiersten Todt

NIST and Others: Adam Sedgewick,	Donna Dodson, Kevin Stine, Jon Boyens, Clete Johnson (DOC),

Robin Drake (Exeter)

Agenda:	

I. After Actions from California Meeting

II. Key Themes from California Meeting

III. Houston Meeting

IV. Work Plans

V. Wrap-up/Next Steps

I.	 After Actions from California	Meeting

a) Mr. Lin: Do we address military matters?

i) Mr. Donilon:	The scope does not include military domains.

b)	 Mr. Alexander: How is commercial sector protected by the government? What are roles

and responsibilities	for	both?

i) Mr. Donilon: We will need to look at the roles and responsibilities	of the various	

government agencies.
 

c) Centralization – Should there be more?
 

i)	 Each agency is responsible to protect itself. It will be uneven. How to get that fixed is an	

important part. We should get an understanding of	what's happening today, and	how to	

get best practice in place across the govt. We should discuss whether to centralize some

systems.

d) Ms. Wilderotter: It	was one of the major themes of Berkeley.

e) Ms. Todt: We are getting	a	Defense detailee to work on governance and perform analysis of

federal	cybersecurity efforts to be covered. Agency briefings will be scheduled also.

f) Mr. Donilon: This an area	I've asked for help on and talked to	Secretary	Pritzker about. It	is

a key area.	There is a lot to focus on, procurement, etc.

g) Ms. Wilderotter: We need to know where we're starting from to be able to determine

where to go.

h)	 Mr. Donilon: There is a lot of impact that can	be had through procurement policies. It

doesn't mean	we should	rule out having the discussion	that the civilian side could not

benefit from expertise on	the military side. The problem is, the capability is on military side.
	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	

	 	 		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 		

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 		

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

Commission on Enhancing	National Cybersecurity	 July 7, 2016

The acquisition is on the civilian side. We should talk to Defense Advanced Research

Projects Agency (DARPA)	on this.

i)	 Mr. Alexander: What is the role of	the government and the company when a company is

attacked by a nation-state? There must be	a real-time way to get	information in time to save

the company. We do need to highlight	some of that. Insurance and other things belong in

that	discussion.

j)	 Mr. Donilon: We want to look at how	to enhance sharing between public and private

entities.	Ultimately, there should be real machine-to-machine sharing. On roles	and

responsibilities,	a	conversation	with	scenarios	would	be	useful	to	determine	who	is	

responsible for	what. Keith's question	is valid	about when	it becomes the responsibility of

the government.

k)	 Ms. Todt: We have identified the DC meeting in September to look at	governance. We can

think about	how to ensure	we're getting	the right input from the government, both	before

and after the meeting.

II. Key Themes from California	Meeting:

a) Amex witness: We should not be the victim of the same attack twice.	

b) Impact of the procurement process, and government role.

c) Slack witness: Creating incentives to make secure products. How to educate consumers

came up in a variety of ways. It calls in the question of regulation and enforcement of

consumer rights.

d) Role of philanthropic organizations from Eli Sugarman.	

e) Mr. Donilon: We have the ability to have procurement standards	affect general standards.	

There has been	discussion	of standards entities, and about products that come into	the US.

There has been	discussion	of an Underwriters Laboratories Inc. (UL)-type lab for

technology products.

f) Ms. Wilderotter: The size of a	business matters from the technology perspective. Having

the right	requirements geared to the size of business is important.

g) Two subject matter	experts	had	a meeting about a month	ago	with	Peiter Zatko,	who is

working on the concept	of establishing a UL-type lab for cyber.	He has been invited to come

to Minneapolis, following the release of his work to the public.	

h) Small and medium business has been a	consistent theme that has come up in the meetings.	

It	should be included in the report.

i) Mr. Lin: We need to investigate why things have not	worked well in the past.

(1) Good solutions have failed in the past, and understanding why will be part of our

recommendations
 

ii) Other points from CA:
 

(1) Mr. Lin: The philanthropic area belongs in	the R&D	agenda. There are other areas it

could fit also	- policy, the environment that we want to live in. Whatever we say in

the report must capture that point.

III. Houston Meeting

a) The agenda has been	sent to the commissioners. Themes are critical infrastructure and state

and local. Ms. Todt reviewed panelists for each of the three panels. She is working	to bring
	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	

	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

Commission on Enhancing	National Cybersecurity	 July 7, 2016

in someone auto related. We have someone from the National Guard, as well as the CISO for

the State of Texas, and the CISO of the City of Houston.

b) Looking	at critical infrastructure from the state and local perspective will showcase how	

critical infrastructure works on more local levels.

c)	 Ms. Wilderotter: The agenda looks good. The gentleman from Nevada,	who	talked	about

how the state has partnered with local businesses- It	would be interesting to see what	the

panelists think	of what has been	done there.		Also,	Mark McLaughlin talked about	the power

grid and what needs to	be done to	protect it.

d) Briefing books for Houston will go out shortly.

e) The no-host dinner is confirmed	for the evening before the Houston meeting.	Information

will be sent out.

f)	 Mr. Palmisano: Are speakers confirmed?

i)	 Ms. Todt: Yes, we are still working on getting an auto representative to come. There is	

someone from Toyota who has been invited.	Any	other	names	from	the	auto	industry

will be welcome. The names on the agenda have confirmed.

g) The Minneapolis meeting is confirmed for 8/23, and 9/19	is confirmed for Washington, DC.

IV. Work Plans

a) Ms. Todt: They have been	drafted, and are being reviewed. They lay out areas of challenge,

and candidate recommendations for each area. We looked at how to categorize work groups

into themes or areas the report will address. We identified	a	notional approach for scoping	

areas in the outline. These will be a	series of recommendations for the commission to	

review.

b) Mr. Donilon: On work groups, we should work towards getting commissioners initial drafts

of sections as soon as possible, and	not wait for the whole thing to be complete. Instead

have a rolling production	of sections as they are ready for the commissioners to react	to. We

will roll those out for reactions from the group.

i) Ms. Todt: The commission has the document sent out before Berkeley, which lays out

who the working groups are.

c) Mr. Palmisano: What’s the process for getting consent on	prioritization?

d) Ms. Todt: The outline will be next item. We will set up a conversation to talk through the

structure, then arrive at consensus. We will start with the consensus approach early, and

get agreement for the way forward.

e) Mr. Donilon: Working groups will have possible recommendations for each area. Reactions

to those should	come first. We can	review the proposed recommendations by working

group. After	that, the result would be a list of all, which then would be culled to provide the

most important. The ones that don’t make the short list would not be considered further.

f) Ms. Todt: There is a sequence of	getting the ideas, shortening the list,	and deriving the

outcomes we want in the report. Conversations in Berkeley	show how everyone is oriented	

toward those actionable recommendations. Some proposed recommendations	may require

implementation plans. The report should contain all the steps to make things happen.	

g)	 Ms. Wilderotter: We should try to keep in mind what	the major proposed

recommendations are in the context of an overwhelming	amount of data. There perhaps
	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

Commission on Enhancing	National Cybersecurity	 July 7, 2016

should be an executive summary by topic, backed up by the implementation plans, etc. It

will be extremely important to keep the report simple and completely actionable.

h)	 Ms. Todt: The body of the report should not regurgitate existing information.	It	should	be

new and	accessible to all entities.

i)	 The commissioners received the notional outline Monday night. The timeline for	reviewing

form, substance, etc. of the report will be done in a	separate meeting	with	the commission.

j)	 The outline is an	annotated outline. Findings will be identified	in addition to

recommendations. The findings are important data points relating to where we are. Some

will also	be recommendations, some will stand alone.

k)	 Ms. Todt: It	is not	a one for one, but	to categorize the information we are hearing. It	may	

include implementation steps. The notional approach for categorizing recommendations	is	

for discussion only. It is an inventory of what we've been hearing. We wanted	to	make sure

all information is listed and identified. Working	sessions will initially	be	held	over the

phone.

l)	 Papers and	other items will be integrated	over the course of the discussion.

V.	 Wrap-up/Next Steps

a) No additional questions or items to discuss prior to Houston next week.