Commission on Enhancing National Cybersecurity	 July 19, 2016 

Meeting Minutes

Attendees:

Commissioners: Tom Donilon, Heather Murren,	Annie Anton, Joe Sullivan, Keith Alexander, Peter

Lee, Maggie Wilderotter, Pat Gallagher, Sam Palmisano, Herb Lin,

Others: Kiersten Todt, Heather Clete Johnson,	Alex Niejelow, representing Ajay Banga, Robin Drake

Agenda:

I. Review of Houston meeting

II. Work plan	discussion/Timeline/Weekly Calls

III. Federal Briefings/Washington, DC	Commission meeting	

IV. Wrap-up/Next Steps

Discussion:

I. Review of Houston meeting

a.	 Highlights from the Houston meeting and key issues

i.	 Ms. Wilderotter: Critical infrastructure and the National Guard: The

National Guard concept of first responders is a	very	interesting	idea.

ii.	 The General drafted a candidate recommendation for the commission. Ms.

Todt will send it to the commission. It	was put together before the meeting

in Houston,	and the commission may consider expanding it to be more

general and oriented to	first responder response in a national	emergency

situation.

iii.	 Mr. Lee: It	is important	for someone to do a thorough dive into the Stafford

Act and its implications.

iv.	 Mr. Gallagher: There has been	an	effort in	Pittsburgh in this area. I’m happy

to share information with the commission.

v.	 Critical Infrastructure responses	– Thinking through their recommendations

from Chris Boyer,	and	others.	Is critical infrastructure itself	is a useful entity

at this point,	given	the	current definition. Mr. Lin noted	dissatisfaction	with

AT&T aversion to the concept of regulation.

vi.	 Mr. Gallagher: Examining critical infrastructure in the digital economy, two

issues come up:	Many companies do not want to be considered critical

infrastructure,	and,	does the government	defend some people, or all the

people? What happens when a nation-state attacks a	company? The

company must respond, but the government also	must defend all the people.

If the government	is only protecting some people, then protecting only	some

is not acceptable. We must figure out how to do that.

vii.	 Some of the witnesses testifying	in Houston expressed a fairly strict

rejection of modern technologies. It drew a clear	line between what is	

allowable in a	critical infrastructure setting.	It	is	not	practical	to	have a

world where technologies are rejected, given abilities of actors.

viii.	 Cyber is	the only area where the government	expects companies to defend

themselves against nation-states.

Page 1
 

	 	

	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	

	 	 	 	 	

	 		

	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	

	 	 	 	 	

	 	 	

	 	 	 	

	 	 	 	 	

	 	 	 	 	

	 	

	 	 	

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 		

	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	

		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	

Commission on Enhancing National Cybersecurity	 July 19, 2016 

ix.	 Mr. Gallagher: Critical infrastructure is critical, and the government is

necessary for response. The report must contain	something in	this area.

Further research	in this area	is needed.

x.	 Ms. Wilderotter requested the staff develop a strawman on critical

infrastructure with its definition, government response, etc.

xi.	 Additional comments –

1.	 There is a lot of history on	this topic. We need	a background, what's

defined, implications of critical infrastructure,	guidelines	and

regulations	and the responsibility of the government. If it is the

government's	responsibility for protection, the government will

insist on identity access.	NIST	staff	will	have a	lot	of	this	information.

2.	 The critical infrastructure working group has conducted numerous

interviews.	A	working strawman will be delivered to the commission

in the next week or two.

3.	 Ms. Wilderotter: Chris Boyer was somewhat unresponsive. AT&T	

has been	pushed	around	by FTC in the last few years.	A	word of

caution,	as technology gets developed, regulation is	always	behind

the market. We need	to look	at what is changing and	understand	that	

regulation	will run behind new technology.

4.	 Some of these topics will be addressed in the Minneapolis meeting.

xii.	 Ms. Wilderotter: State, local, tribal government – Follow up further on what

they are doing, and examine what	support	can be provided. It	sounds like it	

is uneven in different states. A	view of state and	local in context of critical

infrastructure needs to be examined.

xiii.	 Mr. Alexander: Many companies are concerned	about regulation becoming	

so extensive. Possibly the solution is insurance. Insurance may be able to

solve certain fears about regulation. It worked in fire safety. It perhaps	

should be addressed.

xiv.	 Mr. Gallagher: The question	is, does it get into	liability and	indemnification	

questions? We should	look	at that. There are precedents in	the government.

It	also looks at	what	happens if Anthem should be released of liability in case

of an attack	by a	nation-state.	We	should	at	least	examine	and	come	up	with

recommendations.

xv.	 Ms. Anton: There is a conference call with head of	insurance for the state of	

North	Dakota next week. He is very knowledgeable on cyber insurance. If

any	of the commissioners have questions, please email, and I can bring up or

see about adding commissioners if	there is interest.

xvi.	 Mr. Lee: It	does seem like there are gaps in capabilities in large companies,

vs. small or	medium companies. Are there natural incentives that	would help

smaller	players	in their	capabilities? If we look at filling gaps, we should

examine	how responsibilities can be	shared.

xvii.	 Additional comment on	Houston panel two - there was a safety and security

call to action. There might be something from a	safety	and education

perspective that can	be used to promote cyber education.

II. Work plan discussion/Timeline/Weekly Calls

a.	 Everyone has received the work plans from the various groups. Would now like to

discuss how to	go	forward.

b.	 The work plans we have are in 10 areas. Proposing the following as the path

forward:	

Page 2
 

	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	

	 	

	 	

	 	 	

	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	

	 	 	 	 	 	 	

		 	 	 	 	 		

	 	

	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

Commission on Enhancing National Cybersecurity	 July 19, 2016 

i.	 Commissioners should	examine all areas and	see if anything is missing. Does

anything	need to	be added?

ii.	 Over the next few weeks, commissioners should	provide feedback	on	those

proposed plans. They are not in	a consistent state, but commissioners

should look and provide feedback.

iii.	 Staff will take those work plans and develop them into papers for

commission consideration. They should	contain	the following sections:

1.	 Background – What is the current state of play?	What is happening

today?

2.	 Identify the cybersecurity challenges

3.	 Consolidate early findings

4.	 Notional recommendations: The commission must decide if	this

section is wanted or not at this point.	

iv.	 There would then be a set of ten	or more refined papers.

v.	 The next stage would be to work through them individually in	a series of

calls to examine what else may be needed. These calls will go	into	

September, so that	then there is a solid basis for deliberation following the

public workshop phase of the Commission.

vi.	 The final three months can	then be used for more in depth	work.

vii.	 The next two weeks are for feedback on the work plans. If	commissioners

have additional areas they want to	add, those topics can be started in the

process.

c.	 Mr. Palmisano: The methodology for the commission is Commissioner-led, stafffacilitated. We believe	the	best way	for us to add value	is for the	commissioners to	

be fully engaged.

d.	 There are different models for running commissions.	The	classic	model	goes to

where the staff listens to	deliberations and produces draft, which the

commissioners engage on.

e.	 Ms. Anton: It	is a great	idea. Ms. Wilderotter noted	the papers that	were sent	out	did

not include information	from the workshops. That	information must	be included

before the commissioners use the papers. It would be very helpful.

f.	 Mr. Donilon: That is correct,	but	the	initial	work	papers	were	not	intended	to	be

basis of discussions.

g.	 Mr. Alexander: The commissioners can and	should	help move it forward, by

working with the staff during the next two weeks. Members	should be actively

involved, and provide thoughts to staff.

h.	 Mr. Donilon: We have current work papers. At the beginning of August,	we	will

have the more refined	papers.

i.	 Proposed	idea: It	might	be a good idea to assign work streams to commissioners.

Not sure everyone will be able to focus on all ten areas.	It	might	be best	to have each

commissioner focus on two	or three plans.	

j.	 Mr. Donilon: The current papers are the work	plans	for	each group.	The	documents

to be derived from the work plans will be the beginning of	commission discussion.

k.	 There is a list of NIST	subject matter expert staff for those groups, but no email	

information.	Ms. Todt will provide contact information for team leads for each

group. Commissioners should reach out to	the teams and copy Ms. Todt.

l.	 Mr. Gallagher: In thinking about	this process, there is a concern,	and that is the

calendar. Impressed with the emerging viewpoint	among the commissioners. Can

we provide feedback on the structure? There may need	to be an	executive session	

Page 3
 

	 	 	 	 	 	 	 	

	 			

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 		

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

Commission on Enhancing National Cybersecurity	 July 19, 2016 

with NIST staff to discuss. Let's ensure	we	deliberate	on proposed recommendations

throughout	the process.

i.	 Ms. Wilderotter: Workgroups can take information from meetings, and

revise the first draft to start from an integrated approach.

1.	 How to get this done?

2.	 We developed 11 ideas and set the staff on the work. We, as a	

commission, have been	working in	public sessions. There are takeaways from these discussions,	such	as defining critical

infrastructure, and others. This list looks different from the original

list of	eleven areas.	These	will	be	the	basis	of	the	report.	It	may	be

time to have some type of discussion on the table of contents as it

exists,	and possibly develop a new table of contents.

3.	 Mr. Donilon: Encourage commissioner engagement with staff. The	

charge to the staff is to incorporate findings from the hearings.

4.	 It	might	be good for commissioners to	exchange short papers on key	

insights and recommendations, and submit current ideas to the staff

on what is emerging	from meetings.

5.	 It	is good for the commission to	understand	where it is now. It might

make sense for commissioners to	submit five proposed

recommendations	at a high level, and possible outcomes. There

would then be initiatives that	might	come out	of those. The

summation of all this	may be a list.

6.	 Mr. Lee: Regarding the first draft, NIST staff is tremendously

competent in handling these things.	To	me, the tyranny is that	it	may

all be one-box thinking,	and	sound	conventional.	More	innovative	

thoughts need the chance to come forward and be considered. We

need	to record	things that have the "ring of truth" as we discover

them. Don't	de-emphasize	the work on the working papers. Is there a

way to exploit what commissioners are hearing,	and	recording	them

to discuss?	We may find something new.

7.	 Mr. Sullivan: The angle we are looking at it from is different. A lot of	

what we're hearing is from people who are down in the weeds. We

should be careful not to get bogged down in any one perspective,	but

look at it from the executive level.	

8.	 Mr. Gallagher: Suggest a modified proposal,	finish the work papers.

Have some brainstorming with the commission now. If we have that,

it may provide some additional structure and provide a good take off	

point for the report.

9.	 Once these papers are submitted, commissioners would	like to	have

these calls more regularly, weekly on Tuesday and discuss two

papers	at each meeting with necessary staff present.	Commissioners

should come with comments and ready to discuss. At the end of the

five weeks, all ten topics will have been discussed.

10. Ms. Wilderotter:	There could be more topics based on	topic gap	

analysis and	cross-cutting themes.

11. There could be additional papers. The commission may decide to

drop or combine based on discussions at that time, given the time

frame, and the style of	the report. Quality vs quantity should be the

rule as far as the number of recommendations.

Page 4
 

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	

	 	 	 	 	 	

	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	

	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

Commission on Enhancing National Cybersecurity	 July 19, 2016 

12. Proposed	recommendations	should be easy to understand and be

actionable.

13. There should be high	quality, research	based	proposed

recommendations.	They should be easily implementable by the next

President. The beginning of a new administration	is the time to have

the most	impact.

14. One of the impacts of this report could	be found	in	asking the right

questions,	which	is	the	sweet	spot	of	this	report.	We	have	raised

fundamental	questions on how to shape a market	to change things

on a	fundamental basis. They may not be recommendations,	but	very

important framing questions.

15. Ms. Todt will draw up	a work	plan	for the way forward and what

we've	discussed	with	a schedule of meetings and	discussions.

III. Federal Briefings/Washington, DC	Commission meeting

a.	 Will follow up on the federal briefings and the DC commission meeting in an email

to the commissioners,	or	on the next call.	

b.	 The University of Maryland has budget for cyber. Provide an	update on the work

that	group is doing for the Aug 3rd meeting. Ms. Todt will follow	up.

IV. Wrap-up/Next Steps

a.	 Minutes from	the call will be distributed.

b.	 Ms. Todt will draft the plan	for going forward on	the working group	activities.

c.	 Mr. Donilon,	Mr. Palmisano,	and Ms. Todt will draft briefing on the next 30 days.

d.	 Propose meeting for next Tuesday to start briefings,	or possibly the following

Tuesday.

Page 5