[House Hearing, 111 Congress]
[From the U.S. Government Publishing Office]



                                     

                         [H.A.S.C. No. 111-176]

 
 HARNESSING SMALL BUSINESS INNOVATION FOR NATIONAL SECURITY CYBER NEEDS

                               __________

                                HEARING

                               BEFORE THE

   SUBCOMMITTEE ON TERRORISM, UNCONVENTIONAL THREATS AND CAPABILITIES

                                 OF THE

                      COMMITTEE ON ARMED SERVICES

                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED ELEVENTH CONGRESS

                             SECOND SESSION

                               __________

                              HEARING HELD

                             JULY 28, 2010

                                     
[GRAPHIC] [TIFF OMITTED] TONGRESS.#13

                                     

                  U.S. GOVERNMENT PRINTING OFFICE
58-232                    WASHINGTON : 2010
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202ï¿½09512ï¿½091800, or 866ï¿½09512ï¿½091800 (toll-free). E-mail, [email protected].  
  


   SUBCOMMITTEE ON TERRORISM, UNCONVENTIONAL THREATS AND CAPABILITIES

                LORETTA SANCHEZ, California, Chairwoman
ADAM SMITH, Washington               JEFF MILLER, Florida
MIKE McINTYRE, North Carolina        FRANK A. LoBIONDO, New Jersey
ROBERT ANDREWS, New Jersey           JOHN KLINE, Minnesota
JAMES R. LANGEVIN, Rhode Island      K. MICHAEL CONAWAY, Texas
JIM COOPER, Tennessee                THOMAS J. ROONEY, Florida
JIM MARSHALL, Georgia                MAC THORNBERRY, Texas
BRAD ELLSWORTH, Indiana              CHARLES K. DJOU, Hawaii
BOBBY BRIGHT, Alabama
SCOTT MURPHY, New York
                 Kevin Gates, Professional Staff Member
               Alex Kugajevsky, Professional Staff Member
                      Jeff Cullen, Staff Assistant


                            C O N T E N T S

                              ----------                              

                     CHRONOLOGICAL LIST OF HEARINGS
                                  2010

                                                                   Page

Hearing:

Wednesday, July 28, 2010, Harnessing Small Business Innovation 
  for 
  National Security Cyber Needs..................................     1

Appendix:

Wednesday, July 28, 2010.........................................    19
                              ----------                              

                        WEDNESDAY, JULY 28, 2010
 HARNESSING SMALL BUSINESS INNOVATION FOR NATIONAL SECURITY CYBER NEEDS
              STATEMENTS PRESENTED BY MEMBERS OF CONGRESS

Miller, Hon. Jeff, a Representative from Florida, Ranking Member, 
  Subcommittee on Terrorism, Unconventional Threats and 
  Capabilities...................................................     2
Sanchez, Hon. Loretta, a Representative from California, 
  Chairwoman, Subcommittee on Terrorism, Unconventional Threats 
  and Capabilities...............................................     1

                               WITNESSES

Lee, Richard P., Consultant......................................     6
Ricketson, John H., Chief Executive Officer, Dejavu Technologies, 
  Inc............................................................     3
Thornton, Roger, Founder and Chief Technology Officer, Fortify 
  Software.......................................................     4

                                APPENDIX

Prepared Statements:

    Lee, Richard P...............................................    46
    Miller, Hon. Jeff............................................    25
    Ricketson, John H............................................    27
    Sanchez, Hon. Loretta........................................    23
    Thornton, Roger..............................................    34

Documents Submitted for the Record:

    [There were no Documents submitted.]

Witness Responses to Questions Asked During the Hearing:

    [There were no Questions submitted during the hearing.]

Questions Submitted by Members Post Hearing:

    [There were no Questions submitted post hearing.]
 HARNESSING SMALL BUSINESS INNOVATION FOR NATIONAL SECURITY CYBER NEEDS

                              ----------                              

                  House of Representatives,
                       Committee on Armed Services,
     Subcommittee on Terrorism, Unconventional Threats and 
                                              Capabilities,
                          Washington, DC, Wednesday, July 28, 2010.
    The subcommittee met, pursuant to call, at 2:03 p.m., in 
room 2118, Rayburn House Office Building, Hon. Loretta Sanchez 
(chairwoman of the subcommittee) presiding.

  OPENING STATEMENT OF HON. LORETTA SANCHEZ, A REPRESENTATIVE 
    FROM CALIFORNIA, CHAIRWOMAN, SUBCOMMITTEE ON TERRORISM, 
            UNCONVENTIONAL THREATS AND CAPABILITIES

    Ms. Sanchez. The Subcommittee on Terrorism, Unconventional 
Threats and Capabilities will come to order.
    Good afternoon. I would like to thank everybody for coming 
today, welcome you all for being before us on a very important 
topic today.
    As Congress looks to develop its comprehensive approach to 
cybersecurity, we will need the perspective of many people, 
including our private sector and especially, I believe, our 
small businesses. Because, when you think about it, I think 
over 90 percent of the businesses in our Nation are considered 
small- and medium-sized businesses; and everybody, we hope, is 
using a computer for efficiency and effectiveness these days. 
And so it is important because you have a large majority of the 
people who work in our United States under you all.
    I am particularly excited about today's hearing because we 
do have small business representatives in front of us, and that 
is sometimes unusual for the Armed Services Committee. So we 
are really thrilled about that. One of the things we do know 
about our small businesses is that you are very capable of 
innovating much quicker than large businesses or even 
government. And if you have innovation, if a lot of the 
innovation and technology agenda is driven by small business, 
then that is actually one of those areas that we really do want 
to protect from people stealing our information or your 
information, as the case may be.
    So, today, the subcommittee is looking to discuss three 
main objectives for this hearing: One, the small business's 
view of the cyber challenge facing all of us today; secondly, 
the technologies that your business, along with others, are 
pursuing to address those needs; and the third thing is to 
identify systemic barriers to small businesses as they are 
entering the marketplace.
    The purpose is for the members of this subcommittee to 
further develop greater cyberspace expertise and awareness but 
also for us to have an open discussion of how Congress can 
address certain barriers to small businesses while those small 
businesses are trying to help us here in the government sector.
    And as our country works hard to improve our economy, the 
first place to take off will be small business. So in order to 
expand our economy, to grow it as so many of us I think pray 
every night right now, you really are key to getting that done.
    So, today, we hope that the witnesses will provide the 
subcommittee with a technical look at cybersecurity and what 
technology and resources are currently available to further 
protect the systems that small business actually plug into at 
the Department of Defense [DOD]. That would be another area 
where we are looking for tools and the hindrances or the things 
that you might suggest.
    So, today, we have three witnesses before us. The first, we 
have Mr. John Ricketson; and he is the Chief Executive Officer 
of Dejavu Technologies, Incorporated. So, welcome, and I do 
believe you are from California, right?
    Mr. Ricketson. Massachusetts.
    Ms. Sanchez. Massachusetts. What did my people do?
    And Mr. Roger Thornton, the Founder and Chief Technology 
Officer of Fortify Software. I know he is a Californian.
    And Mr. Richard Lee, an independent consultant who just 
came out of the government sector.
    So I hope you all will talk a little bit to us about the 
interface; and, once again, I look forward to your testimony. 
Without objection, we have put your written testimony into the 
official record.
    I will remind the witnesses that you have 5 minutes to 
address. You don't have to read your statement. You can talk 
about the main points or anything you might have thought, oh, 
gosh, I should have put that in there and I forgot. And, after 
that, we will ask a series of questions and hopefully you can 
answer them.
    And I will now yield to the ranking member from Florida, 
Mr. Miller, for his opening statement.
    [The prepared statement of Ms. Sanchez can be found in the 
Appendix on page 23.]

 STATEMENT OF HON. JEFF MILLER, A REPRESENTATIVE FROM FLORIDA, 
   RANKING MEMBER, SUBCOMMITTEE ON TERRORISM, UNCONVENTIONAL 
                    THREATS AND CAPABILITIES

    Mr. Miller. I thank my good friend for yielding.
    Thank you, gentlemen, for being here. I hope you have at 
least been to Florida, if you are not from Florida. You might 
have traveled there once or twice.
    This hearing does come at an appropriate moment, because 
over the last several weeks General Alexander has in fact been 
conducting an aggressive road show explaining his vision for 
the U.S. Cyber Command, and the establishment of the Command 
follows the 2010 QDR [Quadrennial Defense Review] 
recommendations that centralized those operations. As the 
Department implements its vision and as the Command becomes 
fully operational this coming October, the Department has an 
opportunity to renew its relationship with the industry and 
small business in particular.
    Given the vital role played by small businesses and the 
community to develop innovative solutions to the challenges 
that we all see today, it is critical that both Congress and 
DOD have a thorough understanding of small businesses' view of 
the cyber challenges facing our Nation and eliminate those 
obstacles, as my good friend has already talked about, that 
many small businesses face when they contract with the 
Department of Defense.
    I do know that our time is limited. We do have a vote 
coming up in a little while. So I would like to ask that my 
full statement be entered into the record. And I yield back.
    [The prepared statement of Mr. Miller can be found in the 
Appendix on page 25.]
    Ms. Sanchez. Wonderful. I thank the ranking member of the 
committee.
    Now let us start with Mr. Ricketson for 5 minutes or less.

STATEMENT OF JOHN H. RICKETSON, CHIEF EXECUTIVE OFFICER, DEJAVU 
                       TECHNOLOGIES, INC.

    Mr. Ricketson. Well, thank you for inviting me.
    My name is John Ricketson. For the last 2 years, I have 
been managing Dejavu Technologies, which is a software provider 
of network forensic analysis tools. In my 30-year career in 
high technology, I have been associated with small companies 
for my entire career and about 40 transactions, equity-related, 
of small companies.
    Our management team is made up of serial entrepreneurs. We 
have four prior ventures, all successfully executed. This one 
is our first primarily focused on government. So we have had a 
fairly steep learning curve.
    I thought what I would do with the brief statement is start 
with the conclusion, which is we would strongly encourage small 
business policies to do a bit more towards encouraging 
innovation; and our view is that cybersecurity in particular is 
an area where the more ideas, the better. It is an arms race. 
Better defenses on more creative attacks and the more we can 
bring new ideas in, the better.
    I thought I would explain what we do just from the 
perspective of the core innovative idea that we have to present 
which has to do with, in the cybersecurity application, 
managing what might be, in a military metaphor, might be damage 
assessments.
    There is an infrastructure of many tools that are designed 
to block and prevent, but the fact is that breaches happen. 
They are inevitable. So we are helping with the process of 
discerning what happened, what machines were affected, what can 
be done about it in the future.
    The essence of our product is to search in a Google-like 
fashion everything that has happened for what may be going on 
that you don't know at the time it was captured. So it is a 
fairly simple idea, but it has big implications in terms of 
scale and features that make an analyst effective at that 
process.
    The principal challenge that we have with our big idea is 
how to find the sponsors within agencies for whom this would be 
helpful with their mission. It is harder to do that than one 
might think as a small company.
    So, in general, the small business policies have many noble 
goals: furthering economic development and job creation 
certainly, providing opportunities for groups that would not 
have those opportunities otherwise. It is more--it is easier to 
find those in the small-business-oriented programs than it is 
to find the programs that would help make more efficient the 
process of introducing new ideas and innovations.
    I guess there are a couple of anecdotes I referred to in my 
report which is I went to the local Small Business 
Administration [SBA] who have a number of programs, none of 
which really applied to our particular challenge.
    I guess another anecdote is not much of an anecdote. There 
was a lot of newspaper headlines about stimulus money, but we 
were unsuccessful at finding any.
    But, in general, there is a few hindrances to small 
businesses presenting their ideas, one of which would be 
software certification which is an important requirement 
generally unique to each agency and there is a fairly steep 
investment for a small company to provide.
    Another hindrance in general is security clearances. Again, 
very important, particularly in the area that we focused. But 
that requires a sponsor. So there is a bit of a Catch 22. When 
you introduce a new idea, to try to find the right people who 
can bring your idea forward and into the realm where it can be 
fully discussed.
    We had experiences with the outreach and small business 
programs at various agencies, which actually did their job 
fairly well, which is to provide a mechanism for small 
companies like us to register ourselves so that we are known. I 
think that some attention to those programs is well deserved in 
terms of funding and expansion, because the goal would be for 
our good ideas to find the right people and agencies who would 
care.
    Another type of organization we encountered was the 
technical intermediary, generally designed to represent the 
government to do technical assessment. And that is another area 
that would be very helpful.
    Again, the goal is new idea, find the right application 
that can really help the mission.
    So, in conclusion, I am trying to encourage the idea of a 
marketplace of ideas and smaller amounts of money distributed 
more broadly to bring those ideas forward and an information 
flow that is fair and can give every good new idea a chance.
    [The prepared statement of Mr. Ricketson can be found in 
the Appendix on page 27.]
    Ms. Sanchez. Thank you, Mr. Ricketson.
    Now we will hear from Mr. Thornton for 5 minutes or less.

   STATEMENT OF ROGER THORNTON, FOUNDER AND CHIEF TECHNOLOGY 
                   OFFICER, FORTIFY SOFTWARE

    Mr. Thornton. Thank you very much, Chairwoman Sanchez, 
Ranking Member Miller.
    I have prepared a short statement to accompany my written 
testimony today.
    I currently serve as the Chief Technology Officer at 
Fortify Software. I have worked in the information technology 
[IT] industry in the Silicon Valley for the past 23 years.
    My technical expertise is in finding and fixing and 
preventing software vulnerabilities that are at the very core 
of our cybersecurity dilemma. My current responsibilities 
involve the development and design of technologies that 
eliminate these vulnerabilities in order to make IT systems 
more resilient to attack, making software ``hacker-proof.''
    Fortify is a small company. It is a classic Silicon Valley 
startup. It was founded by myself and my three cofounders in 
the spring of 2003. Our customers include 8 of the 10 largest 
banks in the world, all the major branches of the U.S. 
military, and a majority of the telecommunication firms across 
the U.S. and Europe.
    Through the course of my work, I am familiar with the types 
of vulnerabilities found in our Nation's most critical 
infrastructure; and I can tell you with emphatic certainty we 
are in a desperate situation. My firm's technologies have 
helped conduct audits on thousands of critical IT systems and 
not once have we found a system without critical 
vulnerabilities. Typically, we find thousands of such 
vulnerabilities.
    One example set comes from a Fortify team that conducts 
audits and reviews of military systems. Over the course of 2 
years, that team has audited 601 applications across 141 major 
programs and found over 3.8 million security vulnerabilities, 
over 400,000 of which were deemed critical. Sadly, this is not 
an exception but has become the norm, as it represents a 
problem that is not currently receiving appropriate attention.
    There are two compelling reasons for you to consider and 
actively support the role that small businesses like mine have 
to play in solving cybersecurity issues.
    The first is economic. As Chairwoman Sanchez has noted, 
small businesses have historically been an incredibly important 
driver for job growth in our country, and cybersecurity is no 
exception to that rule.
    The second is innovation. Only a small company would have 
the audacity and impetus to challenge the status quo and offer 
an entirely new approach when there are entrenched solutions in 
place. Like many small businesses, my company was founded on a 
simple observation that challenged conventional wisdom and led 
to innovation.
    Our observations were this. I will share them with you 
today.
    IT systems are compromised of network, computers, and 
software running on those computers. The prevailing strategy 
for IT up to now has been to secure the networks by limiting 
access and attempting to block attacks. That traditional 
security strategy has failed us. It is outdated. It is 
fundamentally flawed. Simply put, nearly all software delivered 
today, including that which the Defense Department is going to 
use and all the critical infrastructure, will be constructed 
with major vulnerabilities.
    Consider those vulnerabilities as open doors for hackers to 
gain access to systems. Our adversaries have shifted their 
approach to leverage those open doors in software at the same 
time we have responded with more network security. The results 
speak for themselves.
    If we eradicate software vulnerability, then the attacks 
won't work. We can build software systems to be resilient to 
attack. This is very similar to the practice of building 
buildings that are resilient to fire, but we need to do a 
better job.
    This line of thinking represented a radical departure from 
the status quo, and in the Silicon Valley that means a new 
small business determined to solve an old problem in a new way. 
In spite of the strides we have made at Fortify and other small 
innovative firms, there are some extraordinary challenges that 
the status quo pose that I would ask for your support in 
overcoming.
    The first is a disproportionate focus on protecting 
hardware networks while the majority of the attacks are at the 
software layer; second, lack of clear policy relating to 
software security that leads to vague software security 
requirements and inadequate funding for software security 
initiatives; and the third is inadequate funding for fixing the 
vulnerabilities that companies like mine and others are finding 
every day.
    We have a strong conviction and have established high 
confidence that the right combination of technology, human 
capital, and process can confront the advanced persistent 
threat and ultimately protect us from cyber warfare. We look to 
Congress to establish a strategic policy guidance for cyber, 
and we applaud Congress for being so active. This inspires 
mature companies, mature small companies like Fortify, and also 
gives hope to the next generation of innovators.
    In conclusion, please let me compliment this subcommittee 
for your cybersecurity leadership. In particular, we strongly 
support the certification and the accreditation language 
included in the House-passed 2011 NDAA [National Defense 
Authorization Act]. Combined with the language contained in 
Section 932 of the Senate companion bill, these provisions are 
sorely needed to protect the United States in the domain of 
cybersecurity.
    I would like to personally thank Chairwoman Sanchez, 
Ranking Member Miller, and the members of the subcommittee for 
holding the hearing. We look forward to working with you and 
the talented House Armed Services Committee staff to help 
better strengthen our Nation's cybersecurity defense through 
effective software security. Thank you.
    [The prepared statement of Mr. Thornton can be found in the 
Appendix on page 34.]
    Ms. Sanchez. Thank you, Mr. Thornton.
    Now we will hear from Mr. Lee for 5 minutes or less.

            STATEMENT OF RICHARD P. LEE, CONSULTANT

    Mr. Lee. Well, thank you, Congresswoman Sanchez. I 
appreciate the opportunity to address the subcommittee.
    I believe that we have got--as you commented; I am an 
independent consultant previously working inside the Federal 
sector as an acquisition professional and am now in the small 
business sector attempting to assist others to understand how 
to bring their products to market.
    I believe we have to deal with the intersecting demands of 
the need to share information, whether it is in the commercial 
sector or in the Defense Department or government sector, and 
the need to protect that information, the three pillars of 
information assurance: the confidentiality, the integrity, and 
the availability.
    Our economy has become very dependent on the Internet. We 
are not going to be able to abandon that battle space but must 
be able to work through attacks on our Internet connectivity.
    Almost all of the things that we do on a daily basis, from 
personal banking to managing the logistics trail to get things 
into the warfighting theaters, for example, depend on Internet 
connectivity.
    I also understand that the subcommittee's focus is on 
harnessing the passion and innovation and originality and 
resourcefulness of American know-how. One of the things that I 
believe that my colleagues have mentioned is that we failed to 
take a holistic systems engineering approach to the problem and 
instead look at component piece part fixes that don't seem to 
ever solve the big problems. The issue of a Maginot line as a 
wall of defense is not going to work. It never has, and it 
won't work in the cyber domain, either. And we need to find 
solutions from a systems engineering perspective to harness 
that innovation.
    I believe there are three fundamental things that are 
causing difficulty for small businesses to get into the 
solution space: The first is the acquisition process itself, 
which I will address a little bit later. The second is the 
evaluation and the certification process that we go through in 
order to bring products and solutions into the cyber domain. 
And, finally, are the financial resources available to the 
small business sector in just being able to get their products 
to market.
    With respect to the acquisition process, I think that one 
of the issues we have and continue to have is that there are a 
number of large integrators who understand the acquisition 
process and can navigate it. Because of that, it is difficult 
to get innovation into their tool kit; and, consequently, when 
we are solving a problem, identifying and resolving a 
vulnerability, we seem to fall back on the same guys that got 
us here.
    If you recall Albert Einstein's comment, no problem can be 
solved from the same level of consciousness that created it 
and, thus, I believe your effort to harness small business 
innovation in this vital area.
    The evaluation and certification process is king in the 
governmental cyberspace domain. There is a whole army of people 
who can say no, very few people who can say yes when you want 
to insert technology into our environment. Most small 
businesses do not have the resources to navigate the 
certification process to be able to get their products into the 
domain to provide either vulnerability fixes or completely new 
and innovative ways to approach a cyber issue.
    And, finally, the ability to get into the cyber domain to 
identify the resources necessary requires a champion on the 
inside of government pulling that solution into the cyberspace.
    I believe that there are some programs in the executive 
departments and in the Defense Department specifically that do 
a good job of identifying and incubating innovative solutions. 
The Defense Advanced Research Project Agency [DARPA] has a 
number of programs, as does Defense Research and Engineering 
specifically on their ability to do the Defense Acquisition 
Challenge and their Joint Capability Technology Demonstrations. 
But, as always, transition into sustainment is the difficult 
part.
    As you noted, Congresswoman Sanchez, my remarks are in the 
record. So I will conclude there and await your questions. 
Thank you for the opportunity to address you.
    [The prepared statement of Mr. Lee can be found in the 
Appendix on page 46.]
    Ms. Sanchez. Thank you very much, Mr. Lee.
    I will remind members that--well, I will let you know that 
each of the members has up to 5 minutes to ask their questions. 
We will start with those who arrived to the committee prior to 
the gavel closing, and so I will begin by asking my questions 
of the panel.
    This morning, I met with Zachary Lemnios--he is the 
Director of Defense Research and Engineering [DDR&E]--in order 
to discuss this very topic of cybersecurity, and one of the 
main issues that was brought up was how we get the technical 
base right. I think that that is one of the crucial questions 
that we have for DARPA and for DDR&E working on that answer of 
what are the technical underpinnings to build a secure system. 
I know they are working with universities and with the private 
sector to try to answer that question. So I guess I would like 
to start by asking our witnesses here today what do you think 
are some of the technical underpinnings to build a secure 
system?
    And anybody can take a stab at it. None of you can take a 
stab at it. I know it is a ``why are we alive'' question, but 
it is one that we are struggling with.
    Mr. Thornton. Chairwoman Sanchez, I would be happy to give 
some comment on that.
    The gentleman you had a conversation with was definitely 
right on focusing on that. You can think about the resiliency 
of a system, and let us use this room to say its resiliency to 
not catch on fire. If we only focused on the fabric, let us 
say, and we knew the fabric was fireproof, what about the wood 
tables? What about the articles we bring in? What about the 
sprinkler systems and what have you?
    Cybersecurity today is fragmented into those that worry 
about access to the networks, those that worry about access to 
the computers, and my area of expertise, those that worry about 
the software programs themselves. And our adversary is not. 
They will look at our systems, they will look at all those 
components, they will look at the human interaction, find the 
weakest point and attack.
    So one of the things that has escaped us is in our systems 
engineering, the people that are ultimately responsible for an 
inventory management system for the military or a financial 
accounting system, is having those people with the purview of 
the entire system be the ones responsible for security. They 
still may need experts to help them, but we need to push the 
responsibility of security up the system to the senior-most 
people. That means a change in the thinking of education, what 
is the educational requirement to be a system designer, a 
change in roles and responsibilities----
    Ms. Sanchez. Are you talking from a hardware or software or 
both standpoint?
    Mr. Thornton. Both, both. So the key is every system has--
in information technology world, we call them system 
architects--people whose responsibility purviews across all the 
technical components, ensuring that security responsibility is 
held at that level.
    Ms. Sanchez. Great.
    Anybody else? Mr. Lee.
    Mr. Lee. Yes, ma'am.
    To pick up on the comments about systems engineering, one 
of the things that we don't do a good job of is recognizing 
that when we approach the certification of networks or the 
software that operates those networks, the computers and the 
software that runs on them, the evaluation process desires the 
use of standards which are good in and of themselves because 
they provide a bound for the evaluation process.
    Unfortunately, most of the standards that we rely on were 
built when the Internet was being evolved and were conceived in 
an academic environment where trust sort of existed between the 
colleagues. But as we have gone into a cyber world we can no 
longer trust the users, and sometimes we can't even trust each 
other.
    So we need to perhaps take a step back and figure out are 
there some inherent vulnerabilities and standards that we use 
in architecting our systems that will perpetuate 
vulnerabilities that we just can't solve. If that is the case, 
we need to take a look at, from a system's perspective, what we 
might do to change that environment; and I believe that is 
where small business innovation fits right into the sweet spot 
of that solution space.
    Ms. Sanchez. Thank you, Mr. Lee.
    Mr. Ricketson, would you like to comment or----
    Mr. Ricketson. Yes, I would.
    I guess my comment is maybe to challenge the underlying 
assumption of the question. I am skeptical that we could find 
what you referred to, technical underpinnings. I think the 
history of the Internet shows that all of the hierarchically 
driven networks fell by the wayside, and the Internet, with all 
of its decentralization and messiness, was the best solution.
    So I am skeptical of vendors that would promote their 
underlying technical solution, and I am skeptical of an 
organized body that would decide to pick winners. I think that 
we have an Internet that is decentralized, and we need to work 
on the issues of trust and monitoring and statistical analysis 
and stay on top of it.
    Ms. Sanchez. I, too, had that question this morning. I am a 
little bit more--after having spoken to both the DARPA Director 
and to Zachary this morning, I think they are going both ways. 
I think they are doing a double track to ensure that maybe 
there are, and maybe they are not. So that is a keen 
observation that you have just made. But I think they are 
looking at it from both standpoints: Is there a better way or 
is the Internet, with all its failings, the way we are going to 
go?
    Mr. Miller, my ranking member, please, 5 minutes.
    Mr. Miller. I would like to--and I will keep it brief--talk 
a little bit about the impediments.
    Mr. Ricketson, you talked about it as far as your visit to 
your local SBA office. SBA, small business initiative research 
programs, technology transition programs have all been 
successful for small businesses. I mean, it has been proven so.
    You talked about some specific instances with the others. 
You didn't really go into great detail. But what I would like 
to know is, have you used them in the past? Did you see the 
same thing Mr. Ricketson saw when you tried to avail yourself 
of some of the programs that were there? And what changes would 
you recommend to allow for greater participation of companies 
like yours in the software field?
    So if I could start with Mr. Lee and then work back to Mr. 
Ricketson, I would appreciate it.
    Mr. Lee. Yes, sir, Mr. Miller.
    So to go right to your question, I think one of the 
advantages that the Defense Department may have is to follow 
the lead of DARPA that they did with their challenge program 
where they put a problem out there and bring--or ask people to 
bring solutions to them in competition for an award. That 
certainly exposes innovation and innovative technologies for 
use.
    And from a prior government-side person, the two questions 
one always had to ask a contractor with a great solution was, 
A, how much is it going to cost and how do I get to you? What 
is the contract vehicle?
    The contracting process is so cumbersome that it is very 
difficult to get innovation inserted into our existing systems. 
We can do pilots, and we can do cultivation and incubation, but 
the transition into the environment is very difficult.
    Many of the innovators like Apple and their iPhone go to 
the commercial marketplace because they can get out there 
quickly. They have to identify their certification 
implementation process.
    The government is an extraordinarily difficult labyrinth to 
navigate for the small businessman, and he necessarily has to 
get married up with a big innovator who has different 
motivations sometimes than the insertion of technology.
    So I think there is a challenge in how you weigh, on one 
hand, open competition kinds of activities and the other is the 
insertion of new and innovative technology to solve the 
problems that we have. The programs exist. It is in the 
transition into the environment that it seems to be just so 
difficult to solve.
    Mr. Thornton. Congressman Miller, I would answer your 
question in thinking about two different ways that the 
government helps make streamline working with small businesses. 
One, driving requirements that require innovation, thereby 
giving the small business an equal footing on the playing 
field. And I would like to come back to that, because the other 
is more directly what you were asking, which is the programs 
that are in place for small businesses like ours to work with 
the government.
    I have been to a lot of seminars and sessions where small 
businesses complain that it is difficult to access the 
government and what have you. And I wouldn't sit here and say 
it is easy, but, in my experience, it is not all that harder 
than the banking industry or the manufacturing industry in that 
the government demands that you understand their environment, 
that you understand their processes, that you understand how 
they do work.
    So I think part of it is a little bit of level setting the 
education or what does it take to work with the government. The 
programs were there for us, but we--our very first revenue as a 
company came through an SBIR [Small Business Innovation 
Research] program with the U.S. Air Force, and neither myself 
nor any of my founders had any connection with the Air Force. 
We simply worked our way through the system and found that. The 
National Security Agency has been very helpful, sponsored our 
company for the right clearances that we need.
    So I do think programs that are in place, from what I 
understand and from talking to other entrepreneurs, there could 
be more education. My counsel to those other entrepreneurs is, 
if you want to work with the government and sell to the 
government, you are going to need to hire people that work in 
that arena, just like we have hired people that have worked in 
the banking arena and can help us navigate.
    If I could finish on my first point, though. When 
requirements that the status quo are not good enough are fed 
from the government to the IT industry, that gives the small 
innovator a giant advantage. So, from my vantage point, that 
is, security of just my network, it is not good enough. I need 
security of my software. But there is opportunities for that in 
just about every realm of cybersecurity. Demand more or better 
than what is currently being offered by the status quo.
    Mr. Ricketson. Nothing much more to add than what I had 
said. I think my modest proposal is to simply bring the 
criteria ``does it help innovation'' into the small business 
programs. Every program that I mentioned there was--it was a 
worthy program. So I am not knocking any of those. But we just 
need to do more. Thank you.
    Ms. Sanchez. Thank you, Mr. Miller. Thank you, gentlemen.
    I will now call on my good friend, Mr. Smith, from the 
State of Washington for his questions.
    Mr. Smith. Thank you, and I appreciate the chairwoman 
holding this hearing. It is a critical issue for our 
subcommittee.
    I think that for the government to get small business more 
involved the best ideas are out there I believe in the small 
business community, in many instances; and, as all of you have 
mentioned, it oftentimes is impossible for them to do business 
with the government and we in the government lose out, 
particularly on this subcommittee that works on IT 
infrastructure. But this expands out. We do a lot of work with 
the Special Operations Command. A lot of their needs requires 
updated better technology, and small businesses are the 
companies that can provide it. So we appreciate that.
    I think most of the questions have been answered. I will 
just throw this out there, if you gentlemen have anything to 
say about it in particular. What is the one thing you would say 
we could change about our acquisition or procurement policy 
that would most help small businesses get greater access, have 
the opportunity to be able to sell what they make or their 
services to government, in this case the DOD?
    Mr. Lee. Sir, I would like to take a cut at that.
    I think that because we in the acquisition process tend to 
wind up with the big integration companies that have deep 
pockets that can navigate the bidding process system and know 
how to write a proposal that a government evaluator can read, 
understand, and accept, we tend to get the sameness of the 
solution competing on price.
    One of the things that might help is if there were some tax 
code incentives or other kinds of things where some of the debt 
and/or operating loss that a small business necessarily incurs 
while they are trying to do this innovative thing and get their 
product to market could be used somehow by the large integrator 
to help offset some of his financial activity. He may be 
incentivized to try to bring in some of the new innovative or 
novel ways to solve some of these cyber problems.
    Some of the people that I have worked with have taken a 
systems engineering perspective and have a new way of looking 
at the networking architecture to be able to insert distributed 
defense-in-depth kinds of activities, firewalls, for example, 
instead of building it at the boundary like the Maginot line. 
But that technology is extraordinarily difficult to stick into 
the system because the large integrators are unfamiliar with it 
and just don't have a way.
    Mr. Smith. Shouldn't there be a way to do this without the 
large integrators, in some instances? I guess that is--we have 
small businesses come to us all the time; and, regrettably, one 
of the first things we have to tell them is here is the eight 
biggest defense companies; find one and partner with them. But 
shouldn't there be a way that a small business can simply do it 
without having to go to a large integrator?
    Mr. Lee. Sir, one of the problems from my perspective is 
that the evaluation and certification process has so many 
people demanding ``certify me'' because it is great to have 
that certification label on your product. And, in some cases, 
particularly for government networks and environments, you need 
that evaluated product certification in order to even be 
considered. If you don't have the champion inside the 
government pulling on your solution, then you need that 
integrator to be pushing you into the environment as part of a 
systems approach that he has recommended or has been hired to 
implement.
    Mr. Smith. What I would like to do--and it is something we 
have worked on a lot with different companies--is get the 
acquisition people out there to be looking for you guys. 
Instead of seeing one of you guys coming and going, they don't 
know what they are doing, better call somebody bigger, they 
say, I am going to take a closer look.
    So I think, from our perspective, we need--and this has 
particular application on the cybersecurity side. Because, as 
you gentlemen have noted, you are cutting-edge innovators on 
that, in many instances, but we need acquisition people who can 
move past that.
    I accept your answer. I am running out of time. I don't 
know if the other two gentlemen wanted to comment at all on how 
you would change the process.
    Mr. Ricketson. My big idea may not actually be a good idea. 
I would love to have someone validate it. So my idea--I make a 
technical claim. That technical claim may or may not be valid. 
Even if it is valid, it may or may not forward the mission.
    So I will give you an example. We have a search capability 
that is supposed to scale. That means you can search into huge 
amounts of data. The word ``petabyte'' comes up. The petabyte 
is bigger than I can count, and products break down in 
situations of stress like that.
    So if there is a technical intermediary that represents the 
government that can take a claim and say, yes, this is true and 
has the credibility inside the government with the technical 
sponsors, that is a major step forward and is independent and 
is a level playing field between a big and small company. It is 
just about the idea.
    Mr. Thornton. And, Congressman Smith, if I can add--and I 
will caveat with I am not an expert in Federal acquisition. So 
this is an idea from a person who----
    Mr. Smith. That may be helpful, actually, that you are not 
buried in the minutia of Federal acquisition and can simply 
look at it from a practical standpoint. But go ahead.
    Mr. Thornton [continuing]. That is what I was thinking, is 
when I--in my experience, I have seen the Federal Government 
make some really smart acquisitions and other times where I 
questioned it, whether it was the best technical solution. One 
thing I noticed was the technical capability to define the 
requirements were employees of the Federal Government. I can 
give some examples. But, in general, when the system integrator 
is writing the requirements for the Federal Government, I think 
a lot of times those requirements are going to be not demanding 
the highest, latest innovations.
    So maybe a radical shift in theory but building up the 
capabilities inside of each of the agencies to have some top-
of-field technical people that can drive requirements, from 
personal experience I have seen that work quite well.
    Mr. Smith. That makes a great deal of sense.
    I think two directions we need to go in to get there. We 
have talked about this in a number of contexts, but our 
somewhat obsessive reliance or I should say excessive reliance 
on contractors since 9/11 has downgraded the number of people 
within the acquisition process who are talented and 
knowledgeable. There just aren't as many of them there, for one 
thing.
    But the second thing I always want to emphasize is to 
empower those people. I think part of what drives some people 
out who do have experience in the acquisition process is, if 
you are the type of go-getter, really knowledgeable, you are a 
person who wants to be empowered, you want to know if you make 
a smart decision you can implement it and see the result of it.
    If you are in the acquisition process and you can't make 
the decision and say, you know what, this company or--to your 
idea--this guy has this idea and you know what, it works, it is 
great, it is what we are going to do, but I cannot do it 
because there is an 18-month procurement process and it doesn't 
fit the RFP [Request for Proposal] that was written sometimes 2 
years ago. It doesn't really fit that RFP. So I would have to 
go back in, I would have to change the RFP, I would have to go 
through another 12 months, and then I come back to you and you 
go I don't remember who you are because it has been so long. So 
I think we need to empower people within the acquisition 
process.
    Thank you, Madam Chairwoman.
    Ms. Sanchez. I like the observations you made, Mr. Smith.
    And, of course, the other problem is, at a time when we 
have such a calling on the government to stop making government 
bigger and having this push to somehow--it is difficult, 
because we are dealing with very complex issues. We are dealing 
with people who get paid a lot of money. Everybody who is worth 
their salt in your industry is making money, and then we want 
them to come and work for the Federal Government. So that----
    Mr. Smith. If I could just comment. It is not a matter of 
making the government bigger. It is a matter of making it 
better. And we are paying the contractors. We are paying for 
those RFPs. We are paying for this acquisition process, which 
in many cases just winds up costing more. So I think you can 
accomplish both.
    Ms. Sanchez [continuing]. Well, we always try to do that, 
and I think that is part of what we did in the slimmed-downed 
acquisition programs that we are putting in place led by Mr. 
Andrews. But there is always that overlap time where we are 
trying to get out of one system and really make the other 
system work, and it is a difficulty. So I would agree with you. 
It is just difficult how we get to that.
    Mr. Ricketson, you said at one point in your testimony that 
we should encourage small business policy, that we should 
change small business policy or make small business policy to 
encourage innovation. If you were a Congressperson sitting up 
here and you wanted to change small business policy of the 
government to encourage innovation, how would you go about 
that? What would you propose would be----
    We have already got our small business innovation programs. 
We have pilot programs. We have got Mr. Lee saying, well, you 
know, the problem really isn't that you are not encouraging 
innovation in small business. By having some of these programs 
is when you get to a point these programs, that falls off--when 
we tell you, okay, here, we are going to throw you out of the 
nest and go fly, there is nobody to help you figure out how to 
fly as you spiral downwards into never-never land.
    So what would you say? If you were a Congressperson, when 
you say change small business policy or mold small business 
policy to encourage innovation, what would that look like? 
Because we also have R&D [Research and Development] tax write-
offs, for example. What would be--from your angle, what does 
that mean to you?
    Mr. Ricketson. I am honored to be asked, though I come here 
from the perspective of our small company trying to move 
forward, seeing some hindrances, offering constructive 
suggestions about areas to focus on. Far be it from me to make 
a lot of specific proposals.
    However, a comment you made a minute ago I wanted to 
respond to that I think is relevant. All of us--there is the 
challenge of big government versus--bigger government versus 
what we want government to do. And in the area of fostering 
innovation, small amounts of money at earlier stages yields 
much better returns than large amounts of money that are 
deployed in mature programs. So I would encourage the 
government to provide for small businesses that have ideas that 
seem like they might be interesting, services that eliminate 
those companies having to come up with the money and take that 
risk themselves.
    So a suggestion a moment ago, which is some technical 
claims are difficult to validate because they take an 
infrastructure that is beyond the small company to fully judge. 
And a technical claim goes beyond technology but also involves 
risk. Large companies, large integrators, complex procurement 
programs are, to some extent, a proxy for risk assessment. So 
if you can at least ask the organizations that are assigned to 
look after technology and small companies to bring innovation 
into their criteria and find ways to measure whether they are 
doing a good job, we are going in the right direction.
    Ms. Sanchez. The problem for somebody who is working in the 
government--I am not talking about us, because we are taking 
risks all the time. We have 2-year jobs, and then we have to go 
out and campaign again--is that it seems to me within the 
Federal Government, from what I learned, is that somebody who 
goes with the known quantity, a Rockwell or a Raytheon or 
something, is never going to get in trouble if he suggested or 
gave the contractor somebody like that. Because when those guys 
mess up--and somewhere along a large project there are a lot of 
mess-ups. You have to look at some of the subcommittees I have 
had before to know all the failings that I have seen. Well, it 
couldn't be done. We are the biggest, we are the best, and it 
couldn't be done. Or we just--you scoped it wrong or the specs 
were wrong.
    But if a government employee goes and gives it to a small, 
innovative company and you do fail, then it is like, well, 
didn't you know that was going to happen? Here is a company 
that has no track record or doesn't have the resources to cover 
the losses or look at all the time we have wasted.
    So it is really--it is a very difficult thing when I look 
at these government employees to be able to really take that 
type of risk.
    I would also say that is one of the reasons why we put 
DARPA in, because that is our risk taking, that is almost throw 
caution to the wind and go with bold ideas. It is almost a 
contrarian type of an agency.
    So I don't know if we need more DARPAs or what we need in 
order to give government ability to feel comfortable working 
with so many of these new issues and what is really a risk to 
your environment by definition because it is new and a bad 
attack of cybersecurity can get to all of us at once.
    Mr. Miller, do you have any other questions?
    Mr. Miller. Yeah. I would like to follow up on Mr. Smith's 
line of questioning in regards to insourcing.
    I would say that in the First Congressional District it is 
of great concern not only to me but to some of my constituents 
because I believe that the standards used in determining which 
jobs are to be insourced don't really use any true methodology. 
I think that, in many cases, the numbers seem to be arbitrary.
    But what I want to know and, Mr. Thornton, you had--when we 
were talking a minute ago, you were nodding your head. I 
couldn't tell if it was in agreement or dissent. My question 
is, have any of your companies been affected by DOD's 
insourcing? And, if it has, could you explain and offer your 
guidance to the committee on what jobs could be insourced from 
your field?
    So, Mr. Thornton, if you would; and then if the other two 
want to chime in, you can. If not, that is fine, too.
    Mr. Thornton. Thank you, Congressman Miller.
    I cannot say specifically that we have been affected by 
insourcing on any particular instance, but I can give an 
example where the government had in its employ some very sharp 
technical people that were ultimately driving the architecture 
of a major purchase. And this was at the Veterans 
Administration [VA], some of the people that work for Mr. Baker 
there, very technically astute, as good as you are going to 
find in private industry and what have you. And when you have 
an environment like that, the government as a customer is being 
very clear in terms of its expectations of your technical 
performance.
    I could cite some other examples where our company is 
working with a large integrator and the government employees 
are more program managers and financial folks and it is really 
the large integrator that is driving the technical 
requirements. And from my not expansive number of times I have 
seen that--I have only seen that a couple of times--it does 
make sense to me what Congressman Smith was saying. Were the 
government able to insource technical architecture, empowered 
individuals that can drive requirements, we will probably end 
up with more effective, cost-effective, more demanding 
requirements.
    Now, what does that mean to small business? I believe in my 
heart of hearts more demanding requirements is an unfair 
advantage for small business. When you ask for something that 
is not currently being built today, more times than not it is a 
small business that is going to be able to meet that 
requirement than a large company.
    And so one other way I might contrast that. My company does 
a lot of work with the Federal Government and a lot of work 
with the banking industry. As I mentioned with the VA, there 
were technical people in there that could easily work in the 
banking industry and drive the same requirements. Just about 
every bank we come into has technical people that manage the 
entire requirements process, set the bar for what is good 
enough, determine if the small business is making legitimate 
technical claims or not and really owns that. And as we talk 
here today--this is not an idea I came to bring to you, but as 
I listen to the discussion that does make a lot of sense to 
me--I think you would benefit from that.
    Mr. Lee. Mr. Miller, I think one of the issues you have in 
trying to insource is--I am going to bet, looking at us, that 
my colleagues and I grew up shortly after Sputnik went up and 
the Mercury space program kicked off and the United States went 
nuts for science and math and engineering expertise and the 
kids that I was growing up with were focused on that.
    The kids today are not as focused on that. We see our 
universities, particularly engineering schools, being more 
inundated by foreign students who take that expertise home. 
Those are the people that you need, the young kids coming out 
of school that you need to figure out a way to incentivize into 
the government.
    Unfortunately, there is a whole culture that seems to 
believe that a government job is, A, to serve the Nation but 
more, and as importantly, to generate a good pension coverage 
for when you get older. So the issue becomes, how do you 
incentivize those kids to come into the service, the government 
service to do the engineering work needed in order to make sure 
we are pulling the best out of the small business and getting 
it into our processes?
    I don't know if you can think outside the box and say, 
well, let us have a project, maybe run by DARPA, maybe run by 
some other organization. I know the services all have good and 
vibrant laboratories that do innovative things. Perhaps you run 
a pilot effort for a 2-year initiative to suspend the FAR 
[Federal Acquisition Regulations] and the DFAR [Defense Federal 
Acquisition Regulations], write some letter contracts and see 
what we can do, as my colleagues have said. And if the 
technical expertise and the delivery is good and the government 
side can figure out that it is good and can understand how to 
specify that on a grander scale, you now are in a position that 
government has learned, industry has learned, and we got out 
from under the acquisition umbrella that just seems to impede 
the process, which seems to be where we constantly found 
ourselves stuck in the labyrinth.
    Ms. Sanchez. Well, do you have any more questions, Mr. 
Miller?
    Mr. Miller. No.
    Ms. Sanchez. Okay. We are going to have votes in a few 
minutes so we will conclude this, but I just wanted to make 
some observations.
    I can't tell you how many times--and I live in Orange 
County, California, which is, as you know, an innovative--we 
carry the innovative agenda, as so many in California, and 
especially the defense, the aerospace, NASA [National 
Aeronautics and Space Administration]-driven issues, we have a 
lot of small companies that work in Orange County that have 
their people in Orange County, and there have been plenty of 
times I have seen where these small companies come to the 
Federal Government--they come to me and they say, we really 
have some ideas, and someone needs to hear these. You need to 
help us. Of course, we start banging on doors and stuff.
    The reality is, it is very difficult. As you say, unless 
you have someone who has been in the Pentagon day in, day out, 
or contracting, it is a very difficult thing for a small 
business and they really can't afford tons of lobbyists and 
specialists and everything and to put them out there for a year 
or two.
    As many of you know, the specs are written with, you know--
because a technical aspect may not be within one of the 
government departments that is doing this, they rely a lot on 
industry coming in and talking to them about what those specs 
for those RFPs should be. That is a long process. It is usually 
a year, two, three years before you see the RFP; and it has 
been written by somebody who already, you know, knows it is 
coming out. And yet you have the small business who wants to 
compete. It is very difficult, and they can't afford to 
compete. That is the truth.
    So we do need to find a new way in which we allow this 
innovation to get in here. Because I certainly see it out in 
the commercial area day in and day out where I live out there 
in California, and you don't see it here as much in Washington, 
DC.
    So I would hope that if you do have, given that some of you 
have hit your head against that wall or been at companies or 
heard stories, that you might do us a favor of sitting down and 
writing specifics about what we might change, what we might 
really try to change in order for these innovative ideas to get 
a fair shake out here in Washington, DC. That is what this 
subcommittee is about, at least with respect to the Department 
of Defense.
    I want to thank all of you for being here today. We really 
appreciated your testimony, and I would appreciate any follow-
up that you might have to this issue that I just laid out.
    Thank you very much. The subcommittee is now adjourned.
    [Whereupon, at 3:05 p.m., the subcommittee was adjourned.]
?

      
=======================================================================




                            A P P E N D I X

                             July 28, 2010

=======================================================================

      
?

      
=======================================================================


              PREPARED STATEMENTS SUBMITTED FOR THE RECORD

                             July 28, 2010

=======================================================================

      
      
    [GRAPHIC] [TIFF OMITTED] T8232.001
    
    [GRAPHIC] [TIFF OMITTED] T8232.002
    
    [GRAPHIC] [TIFF OMITTED] T8232.003
    
    [GRAPHIC] [TIFF OMITTED] T8232.004
    
    [GRAPHIC] [TIFF OMITTED] T8232.005
    
    [GRAPHIC] [TIFF OMITTED] T8232.006
    
    [GRAPHIC] [TIFF OMITTED] T8232.007
    
    [GRAPHIC] [TIFF OMITTED] T8232.008
    
    [GRAPHIC] [TIFF OMITTED] T8232.009
    
    [GRAPHIC] [TIFF OMITTED] T8232.010
    
    [GRAPHIC] [TIFF OMITTED] T8232.011
    
    [GRAPHIC] [TIFF OMITTED] T8232.012
    
    [GRAPHIC] [TIFF OMITTED] T8232.013
    
    [GRAPHIC] [TIFF OMITTED] T8232.014
    
    [GRAPHIC] [TIFF OMITTED] T8232.015
    
    [GRAPHIC] [TIFF OMITTED] T8232.016
    
    [GRAPHIC] [TIFF OMITTED] T8232.017
    
    [GRAPHIC] [TIFF OMITTED] T8232.018
    
    [GRAPHIC] [TIFF OMITTED] T8232.019
    
    [GRAPHIC] [TIFF OMITTED] T8232.020
    
    [GRAPHIC] [TIFF OMITTED] T8232.021
    
    [GRAPHIC] [TIFF OMITTED] T8232.022
    
    [GRAPHIC] [TIFF OMITTED] T8232.023
    
    [GRAPHIC] [TIFF OMITTED] T8232.024
    
    [GRAPHIC] [TIFF OMITTED] T8232.025
    
    [GRAPHIC] [TIFF OMITTED] T8232.026
    
    [GRAPHIC] [TIFF OMITTED] T8232.027
    
    [GRAPHIC] [TIFF OMITTED] T8232.028
    
    [GRAPHIC] [TIFF OMITTED] T8232.029
    
    [GRAPHIC] [TIFF OMITTED] T8232.030
    
    [GRAPHIC] [TIFF OMITTED] T8232.031
    
                                  
