Yes, there is technology available today to detect anomalous events. And, while this technology continues to increase in capability, for the most part, it will always lag behind the capability of the adversary, particularly the sophisticated adversary, to develop new attack capabilities. Within the Department, we have deployed a vast array of sensors to provide indications and warning of an ongoing attack. The next challenge is attribution . If, and only if, it can be shown that the attack is being perpetrated by a foreign entity, from foreign soil, does the attack become a national security matter.
Attribution is a complex undertaking that requires coordination among several elements.
Under our constitutional system, information essential to attribute the attack to a specific entity typically can be gathered only pursuant to criminal investigative authorities. The host owner can, or course, cooperate with law enforcement officials without the need for a warrant, and fortunately this frequently occurs. Regardless, collection and analysis of audit data from the host is a necessary component of the attribution process. A court order must be obtained, which can take from hours to days, and then the data must be obtained and analyzed. Coordination between responsible elements, both internal and external to the DoD during these activities is essential.