    [House Hearing, 113 Congress]
    [From the U.S. Government Publishing Office]

                             [H.A.S.C. No. 113-17]

         INFORMATION TECHNOLOGY AND CYBER OPERATIONS: MODERNIZATION AND

                   POLICY ISSUES TO SUPPORT THE FUTURE FORCE

                                   __________

                                    HEARING

                                   BEFORE THE

        SUBCOMMITTEE ON INTELLIGENCE, EMERGING THREATS AND CAPABILITIES

                                     OF THE

                          COMMITTEE ON ARMED SERVICES

                            HOUSE OF REPRESENTATIVES

                        ONE HUNDRED THIRTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                  HEARING HELD

                                 MARCH 13, 2013

                  [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                   ----------
                             U.S. GOVERNMENT PRINTING OFFICE

    80-187 PDF                       WASHINGTON : 2013

        SUBCOMMITTEE ON INTELLIGENCE, EMERGING THREATS AND CAPABILITIES

                        MAC THORNBERRY, Texas, Chairman

    JEFF MILLER, Florida                 JAMES R. LANGEVIN, Rhode Island
    JOHN KLINE, Minnesota                SUSAN A. DAVIS, California
    BILL SHUSTER, Pennsylvania           HENRY C. ``HANK'' JOHNSON, Jr.,
    RICHARD B. NUGENT, Florida               Georgia
    TRENT FRANKS, Arizona                ANDRE CARSON, Indiana
    DUNCAN HUNTER, California            DANIEL B. MAFFEI, New York
    CHRISTOPHER P. GIBSON, New York      DEREK KILMER, Washington
    VICKY HARTZLER, Missouri             JOAQUIN CASTRO, Texas
    JOSEPH J. HECK, Nevada               SCOTT H. PETERS, California
                     Kevin Gates, Professional Staff Member
                     Tim McClees, Professional Staff Member
                              Julie Herbert, Clerk

                                C O N T E N T S

                                  ----------

                         CHRONOLOGICAL LIST OF HEARINGS
                                      2013

                                                                       Page

    Hearing:

    Wednesday, March 13, 2013, Information Technology and Cyber
      Operations: Modernization and Policy Issues to Support the
      Future Force...................................................     1

    Appendix:

    Wednesday, March 13, 2013........................................    27
                                  ----------

                           WEDNESDAY, MARCH 13, 2013
     INFORMATION TECHNOLOGY AND CYBER OPERATIONS: MODERNIZATION AND POLICY
                       ISSUES TO SUPPORT THE FUTURE FORCE
                  STATEMENTS PRESENTED BY MEMBERS OF CONGRESS

    Langevin, Hon. James R., a Representative from Rhode Island,
      Ranking Member, Subcommittee on Intelligence, Emerging Threats
      and Capabilities...............................................     1
    Thornberry, Hon. Mac, a Representative from Texas, Chairman,
      Subcommittee on Intelligence, Emerging Threats and Capabilities     1

                                   WITNESSES

    Alexander, GEN Keith B., USA, Commander, United States Cyber
      Command........................................................     6
    McGrath, Hon. Elizabeth A., Deputy Chief Management Officer, U.S.
      Department of Defense..........................................     5
    Takai, Hon. Teresa M., Chief Information Officer, U.S. Department
      of Defense.....................................................     3

                                    APPENDIX

    Prepared Statements:

        Alexander, GEN Keith B.......................................    62
        Langevin, Hon. James R.......................................    31
        McGrath, Hon. Elizabeth A....................................    54
        Takai, Hon. Teresa M.........................................    33

    Documents Submitted for the Record:

        [There were no Documents submitted.]

    Witness Responses to Questions Asked During the Hearing:

        Mr. Thornberry...............................................    77

    Questions Submitted by Members Post Hearing:

        Mr. Franks...................................................    87
        Mr. Langevin.................................................    84
        Mr. Rogers...................................................    85
        Mr. Thornberry...............................................    81
     INFORMATION TECHNOLOGY AND CYBER OPERATIONS: MODERNIZATION AND POLICY
                       ISSUES TO SUPPORT THE FUTURE FORCE

                                  ----------

                      House of Representatives,
                           Committee on Armed Services,
                Subcommittee on Intelligence, Emerging Threats
                                              and Capabilities,
                             Washington, DC, Wednesday, March 13, 2013.
        The subcommittee met, pursuant to call, at 3:46 p.m., in
    room 2212, Rayburn House Office Building, Hon. Mac Thornberry
    (chairman of the subcommittee) presiding.

    OPENING STATEMENT OF HON. MAC THORNBERRY, A REPRESENTATIVE FROM
    TEXAS, CHAIRMAN, SUBCOMMITTEE ON INTELLIGENCE, EMERGING THREATS
                            AND CAPABILITIES

        Mr. Thornberry. The subcommittee hearing will come to
    order. I appreciate our witnesses and guests and their
    patience. There are some days that just don't work very well,
    and this is certainly one of them.
        I will ask unanimous consent to put my opening statement in
    the record and yield to the gentleman from Rhode Island for any
    comments he would like to make.

      STATEMENT OF HON. JAMES R. LANGEVIN, A REPRESENTATIVE FROM
      RHODE ISLAND, RANKING MEMBER, SUBCOMMITTEE ON INTELLIGENCE,
                   EMERGING THREATS AND CAPABILITIES

        Mr. Langevin. Thank you, Mr. Chairman.
        I want to thank our witnesses for appearing before the
    subcommittee today. This is obviously an important hearing as
    our national security is dependent on our information systems,
    and those networks are critical to all aspects of our defense.
    Yet, one only needs to look at recent headlines, even of the
    day, to understand the unrelenting and sophisticated threats
    that we face in the cyber domain.
        Now we continue to see just how vulnerable such networks
    are in other sectors of our society, at a potential cost of
    billions lost to cybercrime, and we know our defense networks
    are at even greater risk. So obviously, though, they must be
    fail-proof and secure.
        Now we are still waiting for this year's budget, but I
    believe it is safe to say that IT [information technology]
    represents a large piece, $33 billion last year for that
    matter, and that is a significant figure. And we must be ever
    mindful of our responsibility to make the most effective use of
    taxpayer's investments in these capabilities.
        Now we are aware that the Department has experienced some
    challenges in acquiring certain IT systems and services in the
    past. So today, I would like to hear what steps we are taking
    to tackle those challenges in order to get the connectivity we
    need at a reasonable price.
        DOD [Department of Defense] cyber operations are quite
    literally a growth business, and it is one of the rare portions
    of the DOD that will be growing indefinitely into the future;
    and there have been significant developments in just one year
    since our last posture hearing.
        Now we are starting to get answers to some of the questions
    about how and when the United States might conduct the full
    range of military cyber activities, and I would like to discuss
    that today to the extent that this forum allows.
        And I understand that Cyber Command [CYBERCOM] is beginning
    to organize itself into mission teams, which is an exciting
    step. But the manpower cost is enormous and the education and
    training requirement significant. This is going to take,
    obviously, a lot of work to get right.
        I would be greatly interested to hear how, to hear our
    panelists' thoughts on how we refine the education,
    recruitment, retention and training of the highly specialized
    personnel that we need. And I would also like to hear how
    CYBERCOM is interfacing with combatant commanders to provide
    its unique capabilities wherever and whenever they are needed.
        Lastly, there are two other areas of vulnerability that I
    want to address today. The first is supply chain security for
    our IT systems. Now we could get IT functionality perfect and a
    robust defense of networks in place and still be at risk of
    compromise from counterfeit components as well as unknown
    design specifications within an approved component,
    particularly, also looking at things like zero-day exploits
    which we know our adversaries make extensive use of.
        So the second is the vulnerability of our critical
    infrastructure to cyber attacks. DOD relies on these services
    but they are defended by other Federal agencies or departments,
    or not at all. So I mention this frequently because I want to
    make progress in the effort to close these gaps. And today is
    another opportunity to see where we are on this matter.
        So with that, again, I want to welcome our witnesses here
    today. Before turning it over to you--back to you, Mr.
    Chairman, I just want to take this opportunity to congratulate
    General Alexander in particular. This is grandchild number 15
    was born today. A grandson. And General, I just want to
    congratulate you and your family on the addition to your
    family.
        [The prepared statement of Mr. Langevin can be found in the
    Appendix on page 31.]
        General Alexander. It is probably more than----
        Mr. Langevin. Thank you. And congratulations again,
    General. And I yield back, Mr. Chairman.
        Mr. Thornberry. And then what State was he born?
        General Alexander. Texas.
        [Laughter.]
        Mr. Thornberry. Thank you. I just want to get that on the
    record.
        Mr. Langevin. Point well taken.
        Mr. Thornberry. And I appreciate the gentleman's comments.
    And just as an administrative note, I want to remind members
    that next week, we have our first quarterly cyber operations
    briefing which is similar to the counterterrorism quarterly
    updates that we have been receiving. This is a new provision in
    the Defense Authorization Act, and we will have that classified
    briefing next week.
        Without objection, all of your statements will be made a
    part of the record. And we would appreciate your summarizing
    them. We again appreciate our witnesses, the Honorable Teresa
    ``Teri'' Takai, Chief Information Officer of the Department of
    Defense; the Honorable Elizabeth McGrath, Deputy Chief
    Management Officer at the Department of Defense; and General
    Keith Alexander, Commander of USCYBERCOM.
        Thank you all for being here. Ms. Takai, you may summarize
    your statement.

     STATEMENT OF HON. TERESA M. TAKAI, CHIEF INFORMATION OFFICER,
                       U.S. DEPARTMENT OF DEFENSE

        Ms. Takai. Good afternoon, Mr. Chairman and distinguished
    members of the subcommittee. Thank you so much for giving us
    the opportunity to testify today on the importance of
    information technology to the transformation of the Department
    of Defense.
        I am responsible for ensuring the Department has access to
    the information, the communication networks, and the decision
    support tools needed to successfully execute our warfighting
    and business support missions. The Department's IT investments
    support mission critical operations that must be delivered in
    both an office environment and the tactical edge.
        Just to give you some perspective on the size and scope of
    what we cover, we operate in over 6,000 locations worldwide.
    And we support the unique needs and missions of three military
    departments and over 40 defense agencies and field activities,
    and our services are used by 3.7 million people.
        Included in the overall IT budget are the Department's
    cybersecurity activities and efforts that are designed to
    ensure our information systems and networks are protected
    against the ever-increasing cyber threats the Department and
    the Nation face.
        We are undertaking an ambitious effort to realign and
    restructure our ability to provide better access to
    information, improve our ability to defend and keep pace. This
    effort is the Joint Information Environment [JIE].
        The Department is aligning its existing IT networks into a
    Joint Information Environment that will define how we are
    restructuring not only our networks but our computer centers,
    our computing networks and cyber defenses to provide a singular
    joint cybersecurity approach that is common across the
    classified, secret, and coalition networks. This is in contrast
    to today's networks in which each military department differs
    in its approach and design in cyber defense.
        The ultimate beneficiary is the commander in the field. The
    consistent network in IT and security architecture will enable
    innovative information technologies that keep pace with today's
    fast-paced operational requirements.
        Our standard security architecture will enable cyber
    operators at every level to see who is operating on our
    networks and what they are doing. This will enable a
    synchronized cyber response. And I am sure General Alexander
    will be speaking more to you about this in his words.
        The consolidation of data centers, operations centers and
    help desks will enable timely and secure access to the
    information and services needed to accomplish their assigned
    missions, regardless of the location.
        As we have refined the JIE concept, we have concluded that
    we can achieve all of the Department's cybersecurity goals but
    just as importantly, still have better joint warfighting
    decision support, better operational and acquisition agility,
    and also importantly, better efficiency. On cybersecurity we
    are focused on ensuring that the essential DOD missions are
    dependable and resilient in the face of cyber warfare. The
    first of the efforts that we will embark on as I have mentioned
    is JIE. The second effort is our deployment and use of
    cybersecurity identity credentials for all users of our secret
    network. We are currently deployed on our unclassified network
    and we will complete the classified network this year.
        The next is continuous monitoring. This will allow us much
    faster detection and remediation of mission vulnerability
    across the millions of computers that are in our networks, give
    us a chain of command and accountability tool, and will give
    the Cyber Command better ability to set remediation priorities.
        The fourth effort as was mentioned is our supply chain risk
    management. Globally sourced technology provides real benefits
    to the Department but it also provides the opportunity for
    potential adversaries to compromise our missions through
    subversion of the supply chain. The Department recently issued
    policy that makes permanent the Department's efforts to
    minimize the risk to DOD missions from this vulnerability.
        And lastly is our successful voluntary cyber information-
    sharing efforts with the Defense Industrial Base. We have 78
    participating companies which represent a majority of our
    acquisition spending in the Department.
        We share classified and unclassified cyber threat
    information and companies that have been participating said
    that the program has significantly improved their cybersecurity
    efforts. We are also partnering with security service
    providers, for those companies that choose to use that service,
    they will have additional classified threat information.
        I would like to conclude by mentioning a few other efforts
    that we are working on. We have a new focus on the development
    of secure communications for Presidential and senior leader
    comms [communications], nuclear command and control, and
    continuity of government. We are working with other Federal
    agencies to ensure that we have the ability to communicate at
    all times. We are also working to ensure that the Department's
    position, navigation and timing infrastructure is robust.
        Next, my office recently issued the DOD commercial mobile
    device strategy and implementation plan which allows us to use
    commercial mobile devices in both a classified and unclassified
    environment.
        And finally, spectrum has become increasingly important not
    only to the Department's mission but to consumers and the
    economy of the Nation. While fully committed to the President's
    500 megahertz initiative, it is important that we balance the
    use of our finite radio spectrum to meet national security
    requirements as well.
        Thank you so much for your interest in our efforts and I
    look forward to taking your questions.
        [The prepared statement of Ms. Takai can be found in the
    Appendix on page 33.]
        Mr. Thornberry. Thank you, Ma'am.
        Ms. McGrath.

    STATEMENT OF HON. ELIZABETH A. MCGRATH, DEPUTY CHIEF MANAGEMENT
                  OFFICER, U.S. DEPARTMENT OF DEFENSE

        Ms. McGrath. Thank you, Mr. Chairman. Good afternoon. We
    really appreciate the opportunity to discuss with you the
    progress that we have made in the defense business operations.
    We feel they are critical enablers of our national security
    mission and our goal is to ensure we have effective, agile and
    innovative business operations that support and enable our
    warfighters.
        This work spans every organization in all functional areas.
    Our goals are to optimize business processes and identify key
    outcome-based measures. Here, information technology is a key
    enabler. Over the past number of years, attention to this issue
    has steadily increased and Congress has been instrumental in
    shaping the governance framework and supporting processes the
    Department uses to oversee these efforts. And we thank you for
    that.
        My written statement provides updates on our integrated
    business environment framework; therein you will see evidence
    of the maturation of our Business Enterprise Architecture and
    some of the recent successes and challenges in the
    implementations of our largest IT systems.
        I will take a few moments to highlight a few of the points.
    First, Section 901 of the 2012 National Defense Authorization
    Act included significant changes to the Department's investment
    management process for defense business systems. We established
    a single Investment Review Board which we execute through a
    Defense Business Council which replaced five separate
    functionally based boards.
        It also significantly expanded the scope of the systems to
    be reviewed by the board to include those in sustainment.
    Previously, it was simply modernization and development. This
    new investment process allows the Department for the first time
    to holistically manage the entire portfolio of business systems
    in a deliberate and organized manner.
        This legislation is truly serving as a catalyst for
    dramatic improvements across the defense enterprise. We now
    have functional strategies that articulate goals, outcomes,
    expectations, standards, mandatory solution across business
    lines.
        Military departments and defense agencies all must align
    with execution plans to these imperatives across their IT
    portfolio. As an example of the Investment Review Board's
    value, we identified approximately 10 percent of the systems
    reviewed as legacy systems that will be retired over the next 3
    years. And we are using this process to both ensure
    architectural compliance and business process reengineering.
        Second, I would like to highlight the ongoing work to
    improve the implementation of some of the Department's most
    visible defense business systems, our Enterprise Resource
    Planning systems or ERPs. The Department is committed to
    learning from its successes and failures as well as learning
    from the findings from the Government Accountability Office and
    the Inspector General.
        In addition to a number of ongoing initiatives to improve
    specific aspects of our implementations, I have over the last 6
    months undertaken a substantial effort to work with industry
    leaders to fully understand and define the leading root causes
    of program successes and failures across the dimension of cost,
    schedule and performance.
        Our findings reinforce the need to focus the Department on
    quality upfront work extremely early in a program's life cycle
    to include ensuring clarity of requirements, quantifiable
    business cases. As a result of this work, I have directed a
    number of actions across the Department.
        While we have certainly faced challenges, the Department is
    making steady progress in this area including having now
    successfully fielded a number of Enterprise Resource Planning
    systems.
        In closing, the Department remains committed to improving
    the management and acquisition of IT systems as well as our
    overarching business environment. These issues receive
    significant management attention and are a key part of our
    enterprise strategy to build better business processes that
    will create lasting results for our men and women in uniform
    and the American taxpayer.
        I look forward to your questions.
        [The prepared statement of Ms. McGrath can be found in the
    Appendix on page 54.]
        Mr. Thornberry. Thank you.
        General Alexander.

      STATEMENT OF GEN KEITH B. ALEXANDER, USA, COMMANDER, UNITED
                          STATES CYBER COMMAND

        General Alexander. Chairman, Ranking Member, I would read
    my statement but you know I can't read so I am just going to
    give you the highlights from that. And I know both Ms. Takai
    and Ms. McGrath can read really well. Perhaps you should read
    my part.
        What I want to hit is a few things that I think it is
    important for the committee to know. First, you all know we
    have great people. We are getting great people both in our
    staff and the service components that have--that are building
    the teams that we need. And issues come up with sequester
    especially for the civilian folks; having to furlough those
    people that we are bringing in sends a wrong message.
        Further, the continuing resolution compounds our ability to
    actually conduct the training missions that we need to bring
    these teams on board. We talked a great deal about the threat.
    You know what is going on in Wall Street, what has happened
    over the last 6 months. What happened in Saudi Arabia with
    Saudi Aramco, the threat is real and growing.
        From our perspective, we need to be prepared for attacks
    against our Nation in cyberspace. In order to do this, we do it
    as a team. And that team includes DHS, Department of Homeland
    Security, FBI [Federal Bureau of Investigation] and, of course,
    DOD.
        DHS has the resilience and recovery just like it would in a
    kinetic operation. And it is the public interface for our
    industry. FBI would lead investigations, look at who is doing
    this inside the United States; they are the domestic handler.
    And DOD has responsibility to defend our Nation from an attack,
    to support the combatant commands and their operations in
    planning, defend the DOD networks and other networks as
    authorized.
        We have created roles and responsibilities between
    Secretary Napolitano, myself and Director Bob Mueller, we all
    agree on that, it has gone to the White House. I think that
    helps lay out the plan for how we can work with you in
    establishing legislation for the future. And I can talk to
    legislation and questions if that comes up.
        When is civil liberties and privacy upfront here? We know
    how important that is. We can protect civil liberties and
    privacy in our networks. This isn't one or the other, it is
    both. And I think we can do both. And to understand that, I
    think we need to get into technical details. I won't do that
    here, but you know we have the capacity to do that.
        And I just encourage you to look at the facts in this as we
    go forward. Five things that we are looking at from my
    perspective in setting up Cyber Command and the teams that we
    have. First and most important are people, building and
    training a ready workforce. The second thing, command and
    control and doctrine, we are establishing that and how we work
    with the combatant commands that I can answer more, Congressman
    Langevin, to your question later on about how we work with the
    combatant commands. Situational awareness--how do you see what
    is going on in cyberspace and how do you react to it. A
    defensible architecture, I think this is absolutely vital,
    especially for the Defense Department. Today, we have 15,000
    enclaves. It is very difficult to defend and get situational
    awareness around that. We need to go the Joint Information
    Environment, something that we work very closely with Ms. Takai
    and her folks. And finally the authorities, policies and
    standing rules of engagement. Those are vital for the future
    and we need to work with you to get those right.
        That is a quick summary of my 26-page written--and so, Mr.
    Chairman, I turn it back to you.
        [The prepared statement of General Alexander can be found
    in the Appendix on page 62.]
        Mr. Thornberry. Thank you. I think that may be a record on
    shortness of your testimony.
        Let me just start by asking about a couple of things.
    General Alexander, I think the statements you just made that
    there is a role for the military, especially Cyber Command, to
    defend the country in cyberspace. I think that is a step beyond
    where we have been in previous years' hearings.
        Can you tell us a little bit more about how that--where we
    are in that discussion? Exactly what should we expect the
    military to defend us against and what sort of circumstances?
    And then what are the sort of circumstances that industries or
    us as individuals are required to defend ourselves?
        General Alexander. So there is two parts to this, to your
    question. And I will give it to you as accurately as I can from
    my perspective and then show you where the range of options
    that the administration and the Defense Department have to look
    at.
        First, I think it is reasonable that we the American people
    know that when our Nation is under attack, whether it is
    physical attack or cyber attack, that the Defense Department
    will do its part to defend the country.
        It is not going to just defend itself. Our job is to defend
    the country. And the focus would be, obviously, on critical
    infrastructure just as it would in kinetic and other things.
    The issue becomes when does an exploit become an attack and
    when does an attack become something that we respond to?
        Those are policy decisions and the red lines that goes to
    those would be policy decisions. Our job would be to set up the
    options that the President and the Secretary could do to stop
    that. And as you may recall, both the former President and the
    current President have both said that they would keep the
    options open in this area.
        I mean, I think that is reasonable, from using State
    Department to demarche all the way over to kinetic options or
    cyber. So they have that whole range. What we are building is
    the cyber options that would fit that tool kit for the
    administration and policymakers to determine exactly what to
    do.
        As an example, it is reasonable to expect that we would
    have the ability to stop a distributed denial of service
    attack, and so creating the tools and capabilities of that,
    which would get into the classified area, you would expect that
    we would actually go and work with our teams to do that. And
    those are the kinds of things that we do. So how do we defend
    the country in that? What kinds of capabilities that we need?
    We have laid that out in great detail. And I think the training
    on that is superb.
        Mr. Thornberry. Just to make an editorial comment. I
    appreciate your point that the authorities, policies, rules of
    engagement are key to deciding how to use the tools that your
    folks have evolved. My opinion is that the more the
    administration consults with Congress, the more we can make
    these decisions out in the open, the better result we will have
    and in addition, the more you will have the support of the
    American people.
        The more that is kept secret with some White House meeting
    or White House paper that is hard to access to, the more
    suspicions there will be about what the government is really
    doing. So I know that is kind of a different realm from yours
    but I think the circumstances under which the government will
    act and how it will act and who will act are important to be as
    public and transparent as we possibly can.
        Finally, let me ask, Ms. Takai, I have got this Defense
    Science Board study that came out in January that basically
    concludes, we cannot be confident that our critical information
    technology systems will work under attack from a sophisticated
    actor.
        I mean, I am sure you have seen it. Can you just make a
    comment about whether you think this Defense Science Board
    study got it right about our vulnerabilities?
        Ms. Takai. Well, I think, first of all, any independent
    report like that is useful because it does give us an
    independent view of a way of looking at our vulnerabilities.
    The report is a year old at this point in time and it really
    is--it does precede several of the actions that General
    Alexander has taken in terms of looking to remediate.
        It also does not consider some of the actions that we have
    been taking to change our cyber defense approach from looking
    at how we protect the perimeter and how we just protect
    networks to actually how we look at it from a mission
    perspective.
        So what we have done is ahead of actually the Defense
    Science Board report coming out, those are the same areas that
    we have been looking at. Those are the same areas that we are
    looking for remediation actions and some of the things that I
    described in my testimony are really a step toward actually
    moving forward to address some of those issues.
        Now, the challenge is you are never 100 percent. And so, I
    think the point around, really, looking at it from a mission
    perspective is important because we need to be sure that we are
    prioritizing from the standpoint of where we put our resources,
    looking at it from the most critical areas and making sure they
    are secure.
        Mr. Thornberry. If your folks look at this and think it
    appropriate, I would appreciate in a written answer some more
    updates as to how far you think we have come in addressing the
    shortfalls that they identified here.
        Ms. Takai. Yes, sir. Absolutely. General Alexander and I
    are actually working on that document, so we would be happy as
    we get that developed to provide that to the committee.
        [The information referred to can be found in the Appendix
    beginning on page 77.]
        Mr. Thornberry. Thank you.
        Mr. Langevin.
        Mr. Langevin. Thank you, Mr. Chairman. Again, thank you to
    our witnesses. General Alexander, I would just start with you,
    if I could. More of a follow-on on to the chairman's question.
    Can you speak to the role of CYBERCOM as defender of last
    resort in the event upon civilian--in the event of an attack on
    civilian critical infrastructure?
        As we know, these attacks move at network speed. And what I
    want to know is what the, you know, the processes that are put
    in place in terms of establishing rules of the road so that you
    know how and when you can respond--if there is an attack on
    critical infrastructure and CYBERCOM has to step in as the
    defender of last resort?
        General Alexander. So we are working with the Defense
    Department, the White House, and the interagency to set up
    those standing rules of engagement, put forward what I will
    call the way in which we would actually execute some of these.
        Right now, those decisions would rest with the President,
    the Secretary. And they would tell us to execute. I think as we
    go down the road, we are going to have to look at what are the
    things that you would automatically do, think of this as the
    missile defense, but missiles in real time.
        And I think that is an education and learning process that
    changes fundamentally the way that we have defended the Nation
    from a kinetic perspective to how we are going to have to
    defend the Nation in a cyber perspective.
        So there is a lot to learn there. Most important on that,
    one is the team that I talked about. But two is the partnership
    with industry. And that is where the legislation is going to be
    important.
        We cannot see attacks going against Wall Street today.
    Somebody has to tell us, and if we are going to be able to
    react to it in time to have favorable results, we need to know
    that at network speed so that we can react at network speed. So
    those types of information-sharing and the liability of
    protection that goes with them is key to this. The other part,
    you know, you could put under building up standards and helping
    people get to this, the executive order takes a great step in
    that direction.
        I think getting incentives would really help. So I think
    there is a partnership here, one within the administration for
    how we set this up and the rules of engagement, I take the
    chairman's comments that you put about working together in a
    transparent way. And the second part is we have got to have
    that same discussion with industry.
        Mr. Langevin. And let me use this as an opportunity to talk
    about the information-sharing, and give you an opportunity to
    talk about the, you know, the concerns that people have in
    terms of information that would be shared with the government.
        I understand--you and I understand that we are not actually
    looking at information that would be shared, it is more the
    bits and bytes, the ones and zeros, the attack signatures that
    we would be looking for.
        But I would like to again give you the opportunity for the
    public to reassure them of what this is, what information would
    be shared.
        General Alexander. Thank you, Congressman, because I do
    think this a key point.
        The issue would be if somebody were throwing an attack at
    Wall Street, as an example, what we would want to know is the
    fact of the attack and the type of attack. We don't need to
    read people's email or see their communications to get that
    information.
        The Internet service providers would actually see that. So
    we could tell them the types of attacks, the types of exploits
    and those things that the government needs to know. That
    includes DHS, FBI, NSA [National Security Agency] and the
    Defense Department, all together need to know that.
        What we are talking about is, for example, I use the car
    going up the New Jersey Turnpike on its way to Rhode Island and
    it would go through an E-ZPass lane--well, in E-ZPass what
    happens is the car is scanned. You don't read what is inside
    the car. You just get the metadata.
        In a similar way, if a packet were going forward, what the
    Internet service providers need to tell us is there was a
    packet, we saw bad software, malicious software in that packet,
    of the type you were looking for. We stopped that packet. It
    was coming from this IP [Internet protocol] address, going to
    this IP address.
        And it would be up to FBI if it was domestic to work with
    the courts to do that or to Cyber Command if it were coming
    from outside the United States. And so, the bottom line, there
    is a way to do this that ensures civil liberties and privacy
    and does ensure the protection of the country.
        And I think we ought to work towards that and help educate
    the American people on what we are trying to do here.
        Mr. Langevin. I agree and I appreciate you getting that out
    there.
        General, if I could, I would also turn our discussion to
    the new mission teams that are forming within your command. In
    testimony before the Senate Armed Services Committee on
    Tuesday, you noted the creation of 13 teams within--with an
    offensive focus. Can you lay out for us what authority these
    teams would be operating under and how will they interface with
    their Intelligence Community colleagues?
        General Alexander. Sure, Congressman. The key is we
    organize the teams into groups. So the teams that you are
    referencing, those 13 are what I will call the National Mission
    teams, that would have the mission to counter an adversary who
    is attacking our country.
        They are the counter-cyber force. I call that offensive
    because their job is to stop--like a missile coming into the
    country, their job would be to stop that and provide options
    for the White House and the President on what more to do.
        So they are the folks that would counter any cyber
    adversary. We also are creating teams to support combatant
    commanders and their missions and operations, and then we are
    building teams to operate and defend our networks within DOD
    and work with DHS and FBI as required.
        So those are the three sets of teams and the three general
    missions that they have. And then, we have supporting them,
    what we call direct support teams that provide the analytic
    support that we would need for that.
        All of this is integrated and works seamlessly with the
    Intelligence Community and with FBI to ensure we don't have
    duplication of effort and we are not all operating on the same
    place in cyberspace so that that is deconflicted.
        Mr. Langevin. My time is expired. I will have more
    questions for the witnesses in round two. I yield back.
        Mr. Thornberry. I thank the gentleman. And I think it is
    helpful that explanation of what offensive means in this
    context because there is a variety of definitions that people
    use for that.
        Dr. Heck.
        Dr. Heck. Thank you, Mr. Chairman. I thank all of you for
    being here.
        General Alexander, there have been some discussions about
    the roles of Cyber Command and protecting domestic critical
    infrastructure. How would that role differ if the attack was
    coming from OCONUS [outside the contiguous United States]
    versus CONUS [contiguous United States] and do you have the
    Title 10 authorities necessary to respond to a domestic attack
    in real time since you are really the only entity that can
    defend in real time.
        General Alexander. Congressman, thanks, because I think for
    clarity, from my perspective, the domestic actor would be the
    FBI. And the FBI, we share our tools with the FBI.
        They would work through the courts to have the authority to
    do what they need to do in domestic space to withstand an
    attack. We have worked very closely together.
        Director Mueller and his teams are absolutely superb to
    work with. And we have come up with a way that he would do
    inside, we would do outside. Now, there may be points in time
    where you have different--you know, significant attacks where
    we need to change parts of that.
        But the key thing is to have him do inside the country. We
    can support back and forth and do this at network speed. So we
    are practicing that. I think that is something that we can do.
        He would work with the courts as appropriate to do his
    portion of the mission. Outside the country, that is where we
    would operate.
        Dr. Heck. So you would be comfortable if there was a Saudi
    Aramco kind of attack that originated from within the United
    States at U.S. infrastructure, that the FBI would be able to
    respond and thwart that attack in real time?
        General Alexander. Assuming that we could see it because
    that kind of an attack is a whole different issue. And on that,
    where we would really depend is on working with the Internet
    service providers. They would stop that packet initially by
    some signature that we gave them.
        And so, that is something that would go to a domain
    controller that we could stop. I think that is a different set
    of tactics that you would use versus the distributed denial of
    service attack where you are trying to take out the bots and
    the command and control infrastructure.
        Dr. Heck. Okay. And then, how is the IC [Intelligence
    Community] supporting the cyber intelligence needs of DOD? I
    mean, beyond NSA, what IC organizations are the primary
    intelligence providers for CYBERCOM?
        General Alexander. Well, there are several, of course, the
    Central Intelligence Agency [CIA], the Defense Intelligence
    Agency [DIA] and NGA, the National Geospatial Agency. Tish Long
    and her folks have done a superb job, too.
        It is kind of interesting. You say, ``Well, what can you
    see from imagery?'' But there are some great things that you
    can do by bringing the actual physical infrastructure and
    overlaying the cyber infrastructure--so all those work.
        And within the military, DIA has, within our J2, people, at
    Cyber Command that work at--and of course, NSA has a great
    foundation of folks that really provide the best support that
    we have across that technical layer.
        Dr. Heck. Thank you, Mr. Chairman.
        Mr. Thornberry. Thank you.
        Mr. Kilmer.
        Mr. Kilmer. Thank you, Mr. Chairman.
        I am particularly interested in workforce issues and how we
    prepare the workforce to meet the needs within the cyberspace.
    And I have a number of questions in that regard.
        And I guess, Ms. Takai, I will start with you. As CIO
    [Chief Information Officer] you oversee the Information
    Technology Exchange Program that is set to expire on September
    the 30th, which seems like a good opportunity to leverage
    talent that is already in the workforce to bring industry and
    the Federal Government together, to knowledge share and learn
    best practices in cybersecurity.
        I was hoping you would give a little update on that
    program's success and then I have a few specific questions
    therein. Do you feel like enough private companies know about
    the program and have been able to take part? Can you speak to
    the advantages of extending and/or expanding the program?
        Have there been any problems with any aspects of the
    program that you think, if we looked at continuing it, should
    be addressed? And then, finally, I know to be eligible, an
    employee must be a GS-11 or the equivalent or above. Do you
    think that is an appropriate level or would you think there
    would a value in adding additional--involving additional
    workers in the mix?
        Ms. Takai. Well, let me see if I can take all those
    questions in turn.
        First of all, I think, we probably do need to expand our
    communications on that program. The program has been, I think,
    a great opportunity for us to bring industry technology experts
    into DOD and likewise, be able to look at where DOD employees
    can go out into industry to get experience.
        But to date, we really do need to think about how we expand
    the program and from a communication perspective. However, I
    think it is important to note that right now, we have a key
    individual who has just recently joined my department from
    Cisco.
        He is a very skilled, highly capable architect and one that
    is always difficult to grow. That kind of technical knowledge
    is something that just takes time. And so, the ability to bring
    that individual in and have them take a look at the work we are
    doing on the Joint Information Environment has really been
    valuable.
        So we are really seeing the benefit of the program and
    therefore it is very important to us to continue the program. I
    think in terms of some of the challenges that we have had in
    terms of moving the program forward, it has really been
    understanding how to get the companies to understand the
    security requirements and for us to be able to get them in
    through our fairly long security process.
        And I think some of that is just a part of it. But I think
    also we need to be in a position where we can better educate
    the companies on the kinds of security requirements that we are
    going to be asking about. And so, we are looking very much to
    take the lessons learned from the program, to be able to expand
    it. I think from a level perspective, I think starting at the
    GS-15s is sort of the--you know, the first level is actually a
    good place because it does give us the opportunity to go from
    the GS-11 level up through various levels, you know, into
    actually an SES [Senior Executive Service] level, which is the
    more highly skilled folks.
        So I think starting there is a good place and the program
    does give us the flexibility then to bring people in at
    different levels. So we are very excited about the program. As
    I say, we appreciate the industry participation we have had so
    far and would very much like to continue the program past the
    sunset date in September.
        Mr. Kilmer. Thank you. Maybe just in follow-up, I would
    just like to ask more generally what you feel collectively we
    can do as Members of Congress to help you recruit an adequate
    number of workers in the cybersecurity realm?
        Ms. McGrath. So I can say from a--again, I am more in the
    business space within the Department and it is always
    challenging to find skill sets even with the Enterprise
    Resource Planning and the more modern technological capability.
        So we are buying commercial-off-the-shelf. It is really
    educating the workforce to get there. The Congress has passed
    legislation to enable us to hire highly qualified experts. I
    feel the Department has not leveraged the opportunity that we
    have so far, or to date, as much as we could have, really
    bringing folks in for a term.
        It can be 1 to 5 years to work on some of these really sort
    of hard problems that we have, to ensure that our outcomes are
    what we need. But we do have actually a very good model in the
    SECDEF [Secretary of Defense] Corporate Fellows Program where
    we take our military and send them out to industry for a year
    at some of the, I would say, best and brightest companies like
    Cisco and Caterpillar and Google and--so we are not leaving
    anybody out, but I couldn't possibly mention them all.
        Because they are already cleared, they have, I will say
    those kinds of requirements already met and it seems to be an
    easier transition from within the Department for our military
    externally, but I would wholeheartedly welcome, you know,
    anything we could do to advance the communication because I
    think it helps certainly in the business space with the
    activities we have under way.
        Mr. Thornberry. Mr. Peters.
        Mr. Peters. Thank you, Mr. Chairman.
        Just maybe a follow-up on that. I think, General, it was
    you who may have told us a few weeks ago about some of the
    difficulties you were having recruiting talented individuals in
    light of the budget uncertainty that we had.
        That perhaps, people are coming to you and saying--I heard
    this at one testimony I think it was you--saying, ``Gee, you
    know we can't really depend on this for a career if we don't
    think that Congress is behind it.''
        Last week, we took an action to relieve some of the
    pressure, perhaps, on the military side at the House level and
    that is working its way through Congress. But, do you want to
    update us, just to follow on Mr. Kilmer's question, how is the
    uncertainty around the budget or how is the budgeting
    continuing to affect your ability to recruit the kind of people
    we need to be our warriors?
        General Alexander. So, you have hit it right on the head,
    Congressman, that what we are getting from some of our people
    especially those who come from industry, they already take a
    pay cut coming to the government. And they do this because they
    are patriots.
        The issue is they have taken a pay cut and now we are
    saying, ``Well, you might get a pay cut again and this pay cut
    will be furlough and we are not sure how that is going to go,
    or where that is going to be.''
        That uncertainty is something that truly complicates their
    willingness to stay with us. And we don't--we should not do
    this to them. You know, we are trying to get the great people
    into cyber. These are technically qualified people.
        You go out to Google, they are looking for people today.
    You know, I sat down with the Google HR [human relations]
    folks. They said, ``Look, we are paying, you know, probably
    twice as much as you are paying folks'' and they are having
    trouble getting them.
        We get them because they want to do something good for the
    Nation. So as a consequence, I do think we have to, one, give
    them the certainty. I would just say, two, they are our most
    valuable assets. You know, it is the people. That is the talent
    that we need and we need to let them know we care about them,
    all of us, and we need your support in that.
        Mr. Peters. Thank you.
        Thank you, Mr. Chairman. I yield back.
        Mr. Thornberry. Thank you.
        Mrs. Davis.
        Mrs. Davis. Thank you, Mr. Chairman.
        And I would certainly appreciate that comment because
    sometimes we have a perception out there that somehow Federal
    workers are not necessary to make everything work in this
    country. And I think that we know that that isn't true on just
    about every level. And so, I appreciate your comments.
        I wanted to ask about the electronic health records. I know
    that is not exactly on the agenda right now. But I wonder if I
    could do that because we know that recently it was announced
    that the Department of Defense was going to--no longer are we
    going to have parallel efforts, I think, in trying to create an
    interoperable system. And that the Department of Defense was
    going to try and work with the Veterans Administration [VA].
    Can you talk a little bit about that and what is going on? We
    had had that strategy articulated that they were going to do
    that, and it is just not clear now, exactly, what we are going
    to do.
        I know that the discussion was around trying to cut costs,
    that we were going to create this common system, but in light
    of the fact that we are not going to do that, how are we going
    to create this interoperable system that is going to work?
        Ms. McGrath. So I would be happy to take that question.
        The Department of Defense and Veterans Affairs have been
    working together over probably 10 years to enable greater
    sharing of information between the two organizations. So when
    our military members transition from defense to the VA, that
    all their information comes with them and we could get out of a
    more paper-based approach to medical treatment and history.
        And I think we have made significant progress in terms of
    sharing the information over big, I'll just say, pipes of
    interfaces between the two organizations. Both DOD and VA were
    looking to modernize their legacy environment.
        And so, back in March of 2011, then Secretary of Defense
    Gates and Secretary Shinseki of the VA decided to abandon, if
    you will, either legacy system--so in VA it is VistA [Veterans
    Health Information Systems and Technology Architecture] and DOD
    it is AHLTA [Armed Forces Health Longitudinal Technology
    Application]--and move together jointly for sort of a common
    system, if you will, although it would probably be a family of
    systems that enable this capability to happen.
        And we moved out smartly and made sure that we were
    approaching the solution, if you will, with a common
    architecture, a common data standard which is really key toward
    interoperability.
        VA has moved their systems into our DISA [Defense
    Information Systems Agency], so that we are collocating as much
    as possible common business practices.
        Because if you don't have all these things, you are still,
    I will just say, the IT will only get you so far.
        And so, the foundational aspects of all these things we
    agreed to in 2011.
        What you have heard recently, is the, in December of 2012
    the Interagency Program Office had completed an engineering-
    based or bottoms-up, if you will, lifecycle cost estimate which
    really put the approach, the affordability of the approach, in
    question.
        So the question Secretary Panetta and Shinseki said to the
    teams was, is there a more economical way to still deliver an
    innovative electronic health record to our military members and
    veterans, but it is done in a less risky way.
        So you reduce the risk, decrease the cost and maintain the
    schedule that we are on. And that is when the Departments
    decided to instead of build, if you will, the system piece by
    piece, to start from a core set of capabilities and build out
    from a core.
        So the VA decided to go back to their legacy system, again,
    VistA. The DOD does not have, right now anyway, a desire to use
    its legacy system and want to ensure that we have explored all
    opportunities.
        So when we are looking at what would our core capability--
    would it be the VA's VistA core, VistA as our core? Would we
    look at--would we have something commercial? The health space
    has gone, has made tremendous leaps in terms of modernization
    over years. We want to ensure that we are assessing the
    capabilities that commercial market brings.
        And we are right now--we issued a request for information
    in February. We got all the answer, all the responses in. We
    are evaluating them through our Cost Assessment and Program
    Evaluation team has the lead for that and they will make a
    determination whether or not we will go with a COTS
    [commercial-off-the-shelf]-based solution or a government-based
    solution by the end of March.
        Mrs. Davis. Is it fair to say that we have kind of
    abandoned, though, the joint strategy?
        Ms. McGrath. I think the joint strategy still exists from a
    data interoperability and integration. If I talk about a
    military member's health record, I am populating that record
    from data from different sources.
        The change in the strategy is really the underlying IT
    system. We still want to do as much joint as we can from the
    various applications like immunization, lab, and all the other
    health-related stuff.
        And I think that the architecture, again all the handshakes
    that we made in the beginning in terms of architecture data,
    those are all still absolutely at the forefront.
        So there has been certainly a change with the approach to
    the underlying IT. But there has been no change to our----
        Mrs. Davis. I guess what would be helpful to know about
    that is how is that going to affect the service member. And if
    they are--it sounds like you are looking at a new acquisition
    strategy perhaps. And I think we would certainly be concerned
    about costs involved and kind of, what have we lost I guess, in
    that time that we were working on all that.
        So I just wonder maybe we can follow up with those
    discussions. But I appreciate it because I wanted to just take
    this opportunity to try and understand better what has happened
    and how we can move forward.
        Ms. McGrath. Yes, ma'am, I would be happy to----
        Mrs. Davis. We have spent a lot of time on that.
        Ms. McGrath. We have and I would just say that all the
    infrastructure, the very foundational things that we have been
    working on since the agreement in 2011, all will be carried
    forward. And so, we are not, I will just say, scrapping
    anything from that perspective; we continue to use those
    foundational pieces because they are key irrespective of the
    applications that will ride on top of that infrastructure.
        But I would be happy to give you more detail.
        Mrs. Davis. Thank you. Thank you, Mr. Chairman.
        Mr. Thornberry. I appreciate the gentlelady asking about
    that because I remember very well the hearing we had in the
    full committee with Secretary Panetta and Secretary Shinseki.
    And this was the key thing they trumpeted. Never before would
    we have this kind of cooperation between the VA and the
    Pentagon with one health record that would follow a service
    member from the day he enlisted all the way through.
        And it is discouraging that under the best case scenario it
    is going to be significantly delayed to have that available as
    you all work through these various options. I don't understand
    or underestimate the technical difficulty in doing so.
        I don't know. It is just frustrating I guess when this was
    trumpeted as such an achievement; that at least, there is a
    change in strategy.
        Ms. McGrath, I am really not trying to pick on you but let
    me ask you about one other situation that maybe hadn't turned
    out so well.
        The Air Force's Expeditionary Combat Support System [ECSS],
    what happened with that? And what have we learned from it?
        Ms. McGrath. I would like to say--and I will very quickly
    move to the ECSS question.
        But the two things on the electronic health record. One is
    the underlying system piece, and sort of the modernization.
        What we are also focused on is accelerating data
    interoperability. We have standard data in the Defense
    Department across the entire organization. Because of the
    mobility of our military members, the information must be
    wherever the military member is--that is theater, East Coast,
    West Coast, does not matter.
        The VA--we are mapping the DOD health data dictionary to
    the VA data so that by the end of this year we will be using
    standard data between the two organizations and we will be able
    to populate a military record, an integrated electronic health
    record, with DOD and VA information.
        And so I don't want to--I understand the concerns. I have
    been----
        Mr. Thornberry. That is helpful, I appreciate you
    clarifying that.
        Ms. McGrath. And so, we do. We are moving very smartly
    forward.
        With regard to the Air Force logistics transformation
    program, true, not as positive a story. It was a story that
    began in the 2005 timeframe, and it was laden with I will just
    call them issues. We had a couple of protests along the way I
    think that added at least a year-plus to the program. We
    restructured it in 2009. They didn't meet a 5-year initial
    operational capability in the 2010 timeframe. So then we put I
    will just say stronger fiscal controls on the program to make
    sure that we identified success criteria both from a government
    perspective and a vendor performance perspective.
        We also restructured the contract to be more outcome-
    oriented. And frankly, the program overall was not delivering.
    And, therefore, we cancelled it in the December timeframe of
    last year.
        We have this in terms of this program that has provided
    many lessons learned as well as some of the other programs,
    both--some successful--we still learn from these programs and
    some not, in the area of size and scale this clearly was one of
    those programs that was way too big.
        We need to chunk these IT systems, if you will, into
    smaller capability sets. And so, we are delivering and then
    adding as opposed to trying to deliver the whole thing at once.
        Buy in leadership skill sets. And we talked a little bit
    about cyber skills and I mentioned the skill sets. Data, data
    quality is huge. For any of these IT programs, you are really
    trying to take really old data from old legacy systems, bring
    them into the new modern, much more tightly controlled
    environment. We have learned a ton with regard to data.
        The infrastructure also can't be understated. The work that
    Ms. Takai is doing with the Joint Information Environment so
    that we have a much more holistic perspective on the network.
    How it runs, it is optimized. We find in every program I will
    just call it too much infrastructure, so it adds to latency and
    all of these kinds of issues. We have captured all of these, if
    you will, lessons learned along with some standardization of
    leading indicators across programs; we weren't managing and
    monitoring them in a similar way. And we have made those
    changes so that the program office, us, and us together, can
    look at really the health of each one of these programs as they
    move throughout the life cycle.
        Mr. Thornberry. Well, to state the obvious I realize, but
    under the best case scenario we are going to have tight defense
    budgets as far as the eye can see. And a large amount of money
    goes to these various IT programs.
        And obviously we have the same interest that you do, I
    know, into making sure that the money we spend is spent well
    and you get something for it.
        It is particularly--I mean I appreciate the lessons
    learned, which are important absolutely. But it is frustrating
    also to spend money and then not have a system that works at
    the end of the day.
        Hopefully, the lessons will improve others but it is
    something we are going to have to continue to get better about,
    no doubt.
        Ms. McGrath. Excuse me, sir, may I add just very quickly?
        Mr. Thornberry. Of course.
        Ms. McGrath. Because I mean we do share both the desire to
    get it better and the frustration when it doesn't. And I am
    constantly looking for ways in how you apply the lessons
    learned from program A to program B or whatever the next one
    is.
        But I would also say that I don't want to lose sight of
    some of the capability that has been delivered.
        And the only data point that I will give you is that in
    2009--and when we looked at the amount of money being spent on
    really we have about 14 of these major business programs. We
    were highly in a developmental stage.
        The number of users in these main ERP [Enterprise Resource
    Planning] programs was about 27,000. Today, those same
    programs, we have 195,000 users. So we have delivered
    capability without going through the--I will just say the [word
    unclear] we tend to talk about, those that are sort of really
    big, expensive and not go so well. But there has been progress
    made in terms of delivering supply chain capability, financial
    capability, and also contracting. And I just don't want to lose
    that--and I appreciate you allowing me to share that.
        Mr. Thornberry. Yes, ma'am. I appreciate it.
        Kind of continuing on a theme of trying to spend smarter or
    at least exploring ways, Ms. Takai, the Defense Business Board
    made recommendations about satellite communications [SATCOM]
    and recommended that we could make some capital leases in
    multiple increments of up to 10 years. It has also been
    suggested that we could lease these satellite services for more
    than 1 year at a time which is what we have been doing and
    probably the most expensive way to do it.
        Can you comment on that suggestion? And is that not
    something the Department should look at as a way of saving
    money for the commercial satellite services that we, that the
    Department depends so much on?
        Ms. Takai. Yes, sir. We have seen the Defense Business
    Board recommendations and we do believe that there is benefit
    in looking at the cost recovery model that we are using for
    commercial SATCOM. And it is a requirement that we actually
    look at that over a multi-year period because of the nature of
    the industry.
        So one of the things that we are doing is to actually put
    together a cost recovery model that takes into account a multi-
    year acquisition, to look at what is the best approach so that
    we can guide programs going forward.
        We are implementing a converged SATCOM gateway architecture
    that will help to standardize more on the way that we are
    buying commercial SATCOM and actually our own SATCOM. We are
    looking at a plan of action for our own nuclear voice
    conferencing integration and then looking at--we are actually
    conducting an analysis of alternative study as it relates to
    that.
        One of the challenges for us is that when we look at
    commercial SATCOM, it is also important for us to look at the
    security of that commercial SATCOM. And in many cases, we are
    asking those commercial SATCOM providers to actually provide us
    capabilities that aren't necessarily the demand from the rest
    of their customers to the extent that we are looking at it.
        So that requires some upfront investment for them, and if
    we are not able to actually commit to a multi-year capability,
    then we get into a couple of situations, neither of which is
    good. One of which is we would ask them to take that on and yet
    at the point in time we want to use it, we no longer have the
    funding in order to be able to do it.
        On the other side, we fund it upfront and we aren't
    necessarily using the capability. That is why we need to look
    at a different way of the cost recovery model from a multi-year
    perspective in order to be able to manage the issue that was
    raised by the Defense Business Bureau.
        Mr. Thornberry. Well, if there are additional authorities
    that you need to look at multi-year procurement of these
    services, please come and talk to us because I don't see if you
    are a satellite company how you can meet the Defense Department
    needs a year at a time particularly given what you just said
    about enhanced security requirements as part of that. I don't
    see how that can ever be done cost-efficiently without looking
    ahead several years.
        General Alexander, I am going to take the other side of the
    argument now. This is a brochure from one of your two hats
    about commercial solutions for classified. And I guess it is
    inviting commercial companies to submit their products to see
    whether it could be used in a classified environment.
        I mean--and I guess in a general way, is this a new
    emphasis on making more use of commercial hardware and software
    in a classified environment? And can we do that in a secure
    way? Again, thinking back to the Defense Science Board saying
    we got problems here.
        General Alexander. Chairman, I think we can. A couple of
    areas. If you think about encryption capabilities, going out
    and getting commercial encryption and making sure that it meets
    the standards, and we can set the standards based on different
    encryption levels. We can if we know the company and the way
    they actually create the capabilities, the tokens. And you can
    look at some of the DOD cards and stuff that we actually use.
    We can ensure that it is done right, then there is a great
    opportunity for us to work with industry.
        I think this is going to become hugely important as we grow
    mobile devices that, you know, our spouses will use for
    banking, need to be secured at a comparable level to the way
    that we would need to do classified and sensitive operations.
        So ensuring that the devices have that capability not only
    helps industry, it helps the government, and I think there are
    great ways to do it. We look at that in some of the encryption
    stuff we work with NATO [North Atlantic Treaty Organization]
    and elsewhere, so I do think it is a great step forward, and
    industry does provide us some great capabilities.
        Mr. Thornberry. Mr. Langevin.
        Mr. Langevin. So maybe on that line of commercial, let's
    talk a little bit about the cloud as where--we seem to be
    moving more and more toward the cloud. You know, articles that
    I have been reading recently have diminished my confidence in
    the security of the cloud, at least it has called it into
    question anyway.
        There have been some high-profile thefts of information
    from that, in that realm. And yet I know that certainly is
    something that your operation, General, are looking at moving
    more into, more in that direction.
        Let's talk about the security of the cloud. And if we do
    make a robust change in that direction, you know, what are we
    doing about guaranteeing security? What is your level of
    confidence in securing the cloud?
        General Alexander. So this has several dimensions to answer
    that question. I am going to try to hit each of those, and then
    if you want more information, we can come back.
        First, when we talk about cloud security versus what we
    call legacy architectures, the problem that we have with legacy
    architectures is if you look at the Defense Department's 15,000
    enclaves with administrators for each of those enclaves, the
    ability to patch those networks and set vulnerabilities is at
    the manual speed.
        And the problem that that creates if you say that the time
    a vulnerability is publicly identified until it is done in the
    Department, it takes way too long because it is done to those
    15,000 network parts.
        We are using the host-based sensor systems to help speed
    that up but it is not where it needs to be. And your ability to
    actually see into those enclaves is very difficult. So the
    first thing that a cloud can give you is the ability to patch
    those systems almost in real time. You can reach out and patch
    that network there.
        Now there are some issues that we have had with the cloud.
    One of the things that we saw is the cloud systems as we saw
    them did not have data element-level security tagging
    capabilities. So in the one that we created, Accumulo, we
    allowed it to have each element of data tagged and secured at
    that level, and only accessible at that level.
        And there are some exceptional things that we can do in
    this area that I can go into more detail in another setting
    that gives you how I think this is more securable than legacy
    architectures. From our perspective, from our technical
    perspective, it is much better. It is not perfect. The issue is
    somebody who hacks into your networks over here, you don't know
    where they are but they have free--they are free to roam around
    once they are inside. You just don't know they are there.
        As you may know, most companies that get hacked in the
    legacy system don't know about it for 6 to 9 months. I think we
    can go much further in the cloud and I think you will see that
    that will far outstrip legacy architectures in security. Unless
    you come up with an architecture that is completely
    independent, nobody else can get into.
        But for what we need it for the Defense Department, we need
    mobile secure comms [communications]. And when you think about
    it, think about our ships, our aircraft and our mobile teams
    out there, they have to talk to something in the mobile
    environment. They are going to end up talking to the cloud. So
    we have to fix that cloud environment.
        I will tell you that what Ms. Takai and her folks are doing
    with the Joint Staff J6 and our folks on the JIE is a huge step
    in that direction. It will address all of those types of issues
    and there is more. You know, I feel like the Ginsu knife guy--
    ``wait, wait, wait, there is more''--because, you know, think
    about what you can do in a cloud that you can't do in a normal
    system, just to give you a couple of ideas.
        You can jump your networks, you can jump your databases,
    like frequency-hopping, that makes your ability to hack into
    them very, very difficult; and each day down that can be
    encrypted with a different algorithm depending on the security
    levels of the people who need access to that data. That is a
    huge step forward. We are having tremendous success in that
    area. And I think you have seen some of the folks who are
    working on that.
        I think you may talked to some of them, Dave Hurry and some
    of the others that are really good at that.
        Mr. Langevin. Well, thank you for the answer. That helps
    quite a bit. If I could, let me turn now to Ms. Takai. So
    obviously this is, you know, all of these great technologies
    that we have ultimately come down to the people.
        How well they are trained, do they know the capabilities of
    the systems and so--I know you touched on this a little bit but
    can you speak further to us about how you are developing the
    pipeline of cyber and IT professionals in the Department and
    are there things that we can do better to support you? And I
    know you have talked on this a little bit, I would like to give
    you an opportunity to expand on this even further if you would.
        Ms. Takai. Thank you very much. Well, first of all, let me
    just give you a synopsis of the actions that we are taking
    around growing the cyber workforce. The first steps are really
    around being able to support General Alexander and making sure
    that as we are growing the cyber capabilities, we are doing it
    to the requirements of what he feels he needs from the cyber
    workforce perspective.
        So it is important that we recognize that the capabilities
    that we are growing are going to be operational capabilities
    and we are really focused on that partnership and making it
    happen. We are putting together that strategy today. The first
    grouping will be individuals that we have inside DOD and we
    will need to update our certifications, we are going to need to
    upgrade our capabilities.
        And the other thing I think and General Alexander can speak
    to this even more. It isn't just necessarily technical people
    that are going to be on these teams. It is going to be a
    breadth of experience and it is going to really need several
    capabilities. Now, just to speak to the technical side of it,
    we are going to be bringing in and growing the resources from
    some of the technical people that we have today.
        The plan is through the Joint Information Environment
    really as we begin to implement it, we will be able to free up
    individuals who can then be trained with some of the technical
    background to be able to move into the cyber defense area much
    more heavily than they are today. So that is one--number one.
        And then secondly is we are going to step up our recruiting
    and with that we are going to have to be more definitive around
    the career path for the civilians that we hire. Clearly, the
    military and General Alexander is addressing how the military
    will be moving folks through. But one of our challenges is we
    aren't going to be able to rotate people in and out of jobs in
    the same way, because the skill sets that are required here
    means we need to have a single career path for these
    individuals to continue to grow.
        And that will be an area that we will want to come back and
    talk with you about because today the way that we do that
    career development doesn't necessarily allow us to keep people
    in a single path and move them up progressively, it tends to
    move them around from position to position. So, that is an area
    that we will be back to you.
        The third area is that we are going to have to find a way
    to be able to recruit individuals at the more senior levels to
    be able to supplement. We are not going to be able to grow
    everybody from within. And that is an area where we are going
    to have to look at our existing programs to see what we can do
    from a competitive salary perspective.
        We can get a lot of good people because the national
    mission is important, but at the same time we are going to have
    to look at what those sources of individuals would be and that
    would be as I say not only looking at our university systems
    and being able to grow them, but also what will it take to
    recruit some of them from the outside.
        Mr. Langevin. Thank you. Further, you know, to talk about
    this issue of integration, how are you planning to integrate
    our total force capability such as those resident in the
    National Guard cyber units into a comprehensive CYBERCOM
    approach, particularly with regard to command and control and
    authorities?
        Ms. Takai. Let me start and then ask General Alexander to
    comment on this as well. We believe that the National Guard
    does provide a great opportunity to actually look at being able
    to look at other forces. So for instance, particularly in areas
    like Washington, particularly around Redmond, and in the areas
    of Silicon Valley, we know already that we have individuals
    that are in the National Guard that are highly capable.
        The key thing I think is to make sure that as we utilize
    the National Guard, we are doing it in not only a uniform way
    but we are doing it in a way so that we have the advantage in
    two senses. One is that it is integrated with the entire cyber
    approach that General Alexander is going to speak to. But
    second of all, that as we are moving people through there and
    as we are actually utilizing them in different settings, that
    again they are going to be operating in the same way, they are
    going to be able to be integrated rather than them having sort
    of a separate approach to the way they are doing the training
    and not be able to call them in when they are needed.
        But General Alexander, let me have you also talk to how
    they are going to fit within your teams.
        General Alexander. Congressman, I would add also the great
    teams in Rhode Island, Texas and Nevada, just to get all three
    of them out.
        Mr. Langevin. The 102nd in Rhode Island.
        General Alexander. And of course, I know Ms. Takai wanted
    me to mention those. We sat down with the National Guard a
    couple weeks ago. We have had our first Guard exercise last
    summer. We will have another one this summer. As Ms. Takai
    said, we are training everybody to the same standard. My
    comments to them is, look, your folks have to be trained and
    certified to the same standards as the Active Force.
        Our focus would initially be on the cyber protection teams
    that they would create. And I think they will focus on regional
    teams. The 10 regions of the Guard, create those teams first,
    train them and operate them. See what their role and
    relationship would be working with us, DHS, FBI and NORTHCOM
    [Northern Command] defense support to civil authorities. There
    are some great things that we can do.
        We will also create some offensive teams and some of the
    Guard units are already doing that. I talked to General Grass
    today on this topic. He, General Jacobi and I will meet next
    Tuesday and perhaps we are going to meet right now. That must
    be him calling in.
        We will meet next Tuesday to actually lay out a transparent
    program so the service chiefs see what we are buying. We want
    to make sure that this is a program the service chiefs sign up
    to because parts of this are going to be in their budget and we
    want to make sure that everybody is transparent in what we are
    getting here.
        So that is the process. There is a Cyber Guard exercise
    coming up. I think those are some of the things that you and
    some of the other members may be very interested in; you are
    welcome to attend parts of that.
        Mr. Langevin. Thank you. I am very impressed with the work
    of the National Guard and as you have mentioned we have the
    102nd in Rhode Island that is actively working with various
    aspects of cyber, particularly with the 24th Air Force. I have
    had the ability to get down to the 24th Air Force in Texas and
    visit with General Vautrinot there. And I know that they are
    working very closely with our Rhode Island National Guard in
    that respect.
        General, as always, we thank you for--and your team. Please
    pass on our appreciation to the extraordinary men and women
    under your command and also, Ms. Takai, at the Pentagon, for
    the work that they are doing, how dedicated they are, it is
    obviously very important. We want to do everything we can to
    support you and before I yield back I just want to thank the
    chairman for his partnership in this effort as well.
        There are very few people in the Congress--not enough--that
    focus on this issue of cybersecurity and I know, Chairman
    Thornberry, how much you put a lot of time and effort into this
    issue and there is not another Member of the Congress that has
    worked as hard on this issue as you have, so thank you.
        Mr. Thornberry. I appreciate it, Jim--obviously, the
    gentleman has been a leader in this for some time. Dr. Heck, do
    you have other questions?
        I just had two more things I wanted to ask about. General
    Alexander, to the extent you can talk about it in open session,
    this subcommittee has been interested before on tactical use of
    cyber in military operations. And I noted that part of your
    teams, the teams you are creating in Cyber Command, are those
    teams--some teams to support combatant commanders.
        And can you in this forum describe how that will work, to
    whom they will answer, how it will be decided what operations
    to carry out and whatnot, that sort of thing?
        General Alexander. Chairman, broadly speaking they are
    going to work at the strategic level, those combatant command
    [COCOM] mission teams will be directly focused on the COCOM
    requirements and answer to those requirements.
        We will have a deconfliction process that that combatant
    commander and myself will work together to make sure that if
    somebody else is working in that space we deconflict it, and
    that is logical so that you don't have two people working in
    the same space.
        That is different than the tactical service teams that we
    would create. So if you go into Iraq like in the past 10 years
    and look at what we did for our intelligence teams that support
    brigade combat teams, that was a huge success.
        In the future, you can imagine that we will eventually
    grow, at the tactical level, cyber teams that are part of those
    intelligence teams or working together with them to provide
    local cyber effects. They would have to be trained to the same
    standard, deconflict through a theater and others, just as we
    do other areas. But I think it would provide that.
        And then you can see that the Air Force and Navy would have
    tactical and operational level that would nest into what we are
    building at the combatant command level. So I think they will
    work as a team, think of that as a cryptologic architecture now
    for cyber going all the way down. And I think this provides us
    tremendous capability at the tactical edge.
        Mr. Thornberry. I fully agree, it does. I guess, what I
    haven't quite got my mind around is how you deconflict what you
    think is a tactical operation when there really is not
    geography in cyberspace. And so the equities that--part of
    our--my concern has been that if you want to have a tactical
    cyber operation, you basically have to have a full complement
    of all the agencies in Washington to hash it all out. And that
    is not very time efficient for cyberspace and just how that
    would work on a practical basis. I think we got to work our way
    through it. It is just something that I have been interested in
    and we have worked on from time to time. Do you have one----
        Ms. Takai, we could not have a hearing without me asking a
    question about spectrum, because it is such an important part
    of what goes on. I know there was a recommendation for sharing
    spectrum as a possible, I don't know solution, but as a
    possible step that could increase spectrum for anybody. Do you
    have any comments on that recommendation?
        Ms. Takai. Yes, sir, and I was wondering whether we would
    get to the spectrum question or not, so here we are. We
    actually feel very strongly that it is important that we look
    at spectrum-sharing as a possibility.
        I think the report that you are referring to is probably
    the President's PCAST [President's Council of Advisers on
    Science and Technology] report that suggested that we have to
    look at spectrum-sharing going forward. We are participating
    now in five different working groups that are being led by the
    NTIA [National Telecommunications and Information
    Administration] to look at different areas of spectrum-sharing.
        And we actually have had success in spectrum-sharing. We
    have had an instance where we have been able to actually use
    and be able to share with a medical device, a medical alert
    device for some of the areas. So we do believe that there are
    opportunities.
        But with that, spectrum-sharing has its challenges. It
    isn't a new concept; it is certainly just coming to light now
    because of the severe pressure on spectrum. There are several
    different ways to do it. One of them is geographic, where you
    look at exclusion zones.
        The difficulty for us in certain bands, like the 1755 to
    1850 band, is that the exclusion zones would actually be in the
    same areas that the commercial providers are interested in. So
    we have to look at that. The second thing is whether we could
    do it from a time standpoint.
        But again in 1755 to 1850 which we use very heavily for
    training in CONUS, that becomes difficult because we can't
    predict where in fact we are going to be in the timeframe we
    are going to be using it.
        So I think it is--there are great opportunities. I think we
    do need to explore and we are working and have signed some of
    the first ever MOUs [memorandums of understanding] with the
    some of the commercial companies to actually do some
    experimentation in certain geographic locations.
        But I think it is a step beyond where we can, you know,
    necessarily say we can go to say that spectrum-sharing is going
    to solve the problem. It is really a combination of where do we
    have to vacate, where will we need comparable spectrum, and
    then where are the areas that we can share now and then going
    into the future.
        Mr. Thornberry. Thank you. And thank you all again for your
    patience and for your brevity. We hit on a wide variety of
    topics today and that was very helpful. And as the gentleman
    from Rhode Island said, we appreciate each of you and the folks
    who work with you and what they do for the country.
        With that the hearing stands adjourned.
        [Whereupon, at 5:05 p.m., the subcommittee was adjourned.]

    =======================================================================

                                A P P E N D I X

                                 March 13, 2013

    =======================================================================

                  PREPARED STATEMENTS SUBMITTED FOR THE RECORD

                                 March 13, 2013

    =======================================================================

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

    =======================================================================

                  WITNESS RESPONSES TO QUESTIONS ASKED DURING

                                  THE HEARING

                                 March 13, 2013

    =======================================================================

                RESPONSE TO QUESTION SUBMITTED BY MR. THORNBERRY

        Ms. Takai. Response to DSB Report on Resiliency:
        The Defense Science Board (DSB) report entitled, ``Resilient
    Military Systems and the Advanced Cyber Threat'' makes a series of
    recommendations. There is significant effort in the CIO, USCYBERCOM,
    and NSA mission spaces already happening or planned in each
    recommendation area. Below are short summaries of the major DSB
    recommendations, and examples of ongoing and planned work to meet them.
    This list does not include efforts outside of the CIO/USCYBERCOM/NSA
    area of responsibility.

        DSB Recommendation #1: Determine the Mix of Cyber, Protected-
    Conventional, and Nuclear Capabilities Necessary for Assured Operation
    in the Face of a Full-Spectrum Adversary (DSB report page 7).
        Secretary of Defense assign United States Strategic Command the
    task to ensure the availability of Nuclear Command, Control and
    Communications ([N]C3) and the Triad delivery platforms in the face of
    a full-spectrum Tier V-VI attack--including cyber (supply chain,
    insiders, communications, etc.)
        Examples of ongoing efforts
          Multi-level human intervention and off-line launch code
    authentications
          NSA-produced NC3 Information Assurance (IA) materials
          Stood up the Strategic and National C3 and Intelligence
    (SNC3I) Joint Systems Engineering & Integration Office (JSEIO) to do
    end-to-end engineering of NC3
          CIO & USD(AT&L) signed DODI 5200.44 which
    institutionalizes supply chain risk management in acquisition and
    sustainment
          CIO & USD(AT&L) assisting STRATCOM in application of
    supply chain risk management (SCRM) to its key programs

        DSB Recommendation #2: Determine the Mix of Cyber, Protected-
    Conventional, and Nuclear Capabilities Necessary for Assured Operation
    in the Face of a Full-Spectrum Adversary (DSB report page 7).
        SECDEF and Chairman, Joint Chiefs of Staff (CJCS) designate a mix
    of forces necessary for assured operation . . . . Segment Sufficient
    Forces to Assure Mission Execution in a Cyber Environment
        Examples of ongoing efforts
          Established Cyber National Mission Force-trained and
    certified teams
          Implementing the Joint Information Environment (JIE) to
    improve cyber defense and resilience of unclassified and secret
    networks for better protected conventional capabilities
          Increased funding for cyber capability development (on-
    hold for sequestration and Continuing Resolution)
          NSA collection and analysis critical to understanding
    adversary

        DSB Recommendation #3: Refocus Intelligence Collection and Analysis
    to Understand Adversarial Cyber Capabilities, Plans and Intentions, and
    to Enable Counterstrategies (DSB report page 8). SECDEF in coordination
    with the Directors of CIA, FBI, and DHS, should require the Director of
    National Intelligence (DNI) to support enhanced intelligence collection
    and analysis on high-end cyber threats
        Examples of ongoing efforts
          Improving threat information sharing in real-time across
    USG
          Increased Intelligence Community (IC)/NSA focus on
    cyberspace operations support
          Increased ``hunting'' on blue networks
          Cyber integrees from NSA/USCYBERCOM at FBI, CIA, and DHS;
    and vice versa

        DSB Recommendation #4: Build and Maintain World-Class Cyber
    Offensive Capabilities (with appropriate authorities) (DSB report page
    9).
        United States Cyber Command (USCYBERCOM) develop capability to
    model, game and train for full-scale cyber warfare.
        Under Secretary of Defense for Personnel and Readiness (USD(P&R))
    establish a formal career path for civilian and military personnel
    engaged in offensive cyber actions.
        Examples of ongoing efforts
          Established Cyber National Mission Force (Cyber National
    Mission Teams and Combatant Command Mission Teams)
          Cyberspace operations-focused training exercises (Cyber
    Flag, Cyber Guard, and Cyber Knight)
          CJCS cyber emergency action conferences

        DSB Recommendation #5: Enhance Defenses to Protect Against Low and
    Mid-Tier Threats (DSB report page 9).
        The DOD should establish an enterprise security architecture,
    including appropriate ``Building Codes and Standards'', that ensure the
    availability of enabling enterprise missions . . . . The DOD should
    leverage commercial technologies to automate portions of network
    maintenance and ``real-time'' mitigation of detected malware . . . .
    USD(P&R), in Collaboration with the DOD CIO and the Service Chiefs
    Establish a Formal Career Path for DOD Civilian and Military Personnel
    Engaged in Cyber Defense
        Examples of ongoing efforts
          Developed JIE enterprise security architecture for
    unclassified, secret, and coalition networks
          Migrating all internet-facing servers into a separate
    zone to isolate and contain attacks
          Improving SIPRNET/Coalition/Federal gateways and NIPRNET/
    Internet boundary defenses
          Developing a Department-wide Cyber Workforce Strategy
    that includes military and civilian qualifications and career paths
          Automating continuous monitoring of cyber vulnerability
    via use of the already deployed Host-Based Security System (HBSS)

        DSB Recommendation #6: Change DOD's Culture Regarding Cyber and
    Cyber Security (DSB report page 10). Commander, USCYBERCOM and the DOD
    CIO establish a plan with measurable milestones and flow down to all
    organization elements.
        Examples of ongoing efforts
          Creating a capstone Cyber Defense strategy document,
    describing strategic imperatives that will change behavior, culture,
    operations, and intelligence support (e.g., Defending DOD Networks,
    Systems, and Data: Strategic Choices for 2020)
          Conducting annual IA training across the DOD
          Simulating ``Phish-me'' exercises and other real life
    exercises
          Providing each organization and its chain of command an
    automated cyber risk score via continuous monitoring

        DSB Recommendation #7: Build a Cyber Resilient Force (DSB report
    page 11). DEPSECDEF should direct specific actions to introduce cyber
    resiliency requirements throughout DOD force structure.
        For programs not part of the segmented force, provide a cyber
    standard set of requirements (expected to be a subset of the critical
    program requirements list) to be applied to all DOD programs
    (USD(AT&L), DOD CIO, SAEs))
        Develop DOD-wide cyber technical workforce to support the build out
    of the cyber critical survivable mission capability and rolled out to
    DOD force structure (USD(AT&L), CIO, SAEs, DOT&E, USD(I), USD(P&R)).
        Examples of ongoing efforts
          DOD CIO and USCYBERCOM identifying key cyber terrain and
    infrastructure that supports critical C4 systems and assets in order to
    assure mission execution while under degraded cyber conditions
          Developing Resiliency Framework criteria that helps
    delineate requirements for contracts and that can be used in the
    acquisition process
          Creating Cyber security Implementation Guidebook to
    assist acquisition program managers in successfully implementing cyber
    security requirements (with AT&L)
          Use of Cyber Ranges for simulated live fire cyber
    security exercises with active Red Team participation
    [See page 9.]
    ?

    =======================================================================

                  QUESTIONS SUBMITTED BY MEMBERS POST HEARING

                                 March 13, 2013

    =======================================================================

                     QUESTIONS SUBMITTED BY MR. THORNBERRY

        Mr. Thornberry. Will you comment on requirements and guidelines
    being generated by CYBERCOM with respect to an insider threat program?
    How do you prevent implementation of this policy devolving into a mere
    ``check the box'' requirement that does little to enhance our security?
    The FY13 NDAA included language on next generation host-based security
    solutions and mentioned insider threat mitigation as one of those
    capabilities that needed to be addressed in this context. Are
    CYBERCOM's guidelines going to specify that established host-based
    solutions are required to satisfy the enterprise monitoring and audit
    requirements? As a part of your overall risk mitigation strategy, which
    networks will your requirements cover in terms of Insider Threat
    Monitoring?
        General Alexander. USCYBERCOM has developed requirements for
    implementation of insider threat capabilities on DOD networks in
    coordination with the National Insider Threat Task Force (NITTF) and
    the Comprehensive National Cybersecurity Initiative to develop and
    implement a government-wide Cyber Counterintelligence Plan (CNCI 6) to
    achieve the objectives described in the FY13 NDAA. These insider threat
    requirements include auditing and monitoring, insider threat awareness
    and training, foreign travel and contact reporting, polygraphs,
    personnel security, evaluation, analysis, and reporting and security
    incident reporting and evaluation. This provides a comprehensive
    defense-in-depth strategy for the detection of and protection from the
    insider threat. In addition, these capabilities will deter malicious
    insider activity. The comprehensiveness of this approach prevents the
    policy from becoming a ``check the box'' requirement. USCYBERCOM
    directives as spelled out in OPORD 12-106 specify that host-based
    solutions are required to satisfy the enterprise monitoring and audit
    requirements. All U.S. owned and operated DOD Non-secure Internet
    Protocol Router Network (NIPRNET) and Secret Internet Protocol Router
    Network (SIPRNET) networks are covered by these requirements for host-
    based security and insider threat monitoring.
        Mr. Thornberry. What progress has DOD made in improving the agility
    and flexibility of the IT acquisition process?
        Ms. McGrath. DOD has taken a number of important steps to improve
    the agility and flexibility of our IT acquisition processes both
    through policy and through proactive involvement with active IT
    acquisition programs. A common theme of these efforts has been to
    tailor the processes to the unique attributes of IT in a way that
    speeds delivery of capability into the hands of our users.
        One important development has been the adoption of an acquisition
    model tailored for defense business systems. This alternative
    acquisition model provides a comprehensive process that aligns
    requirements, investment, and acquisition processes for defense
    business systems under an integrated governance framework and focuses
    on incremental delivery of capability, within eighteen months of
    program initiation. This incremental approach improves control over
    cost, schedule and performance requirements.
        The Under Secretary of Defense (Acquisition, Technology &
    Logistics) issued implementing policy for this model in the summer of
    2011 and the guidance was incorporated into the Defense Acquisition
    Guidebook in the fall of 2012. This policy is being incorporated into
    the next update of the DOD 5000.02 acquisition instruction. The Defense
    Enterprise Accounting and Management System (DEAMS), an Air Force
    financial management program, was the first program to achieve an
    acquisition decision under this new policy and we are in the process of
    transitioning several other major IT programs to this new approach as
    well.
        Through the use of this approach, DEAMS has integrated
    traditionally stove-piped processes and enabled tight integration
    between the functional sponsor and the program office. We continue to
    conduct targeted outreach with Program Managers, Functional Sponsors,
    and Program Executive Officers on this new policy, and are working with
    the Defense Acquisition University to embed the new process into
    appropriate curriculum.
        Mr. Thornberry. In the FY12 NDAA, this committee directed the
    establishment of an insider threat detection program. Can you please
    describe the current status of this effort, which is supposed to
    achieve full operational capability later this year?
        Ms. Takai. DOD has been actively participating in National Insider
    Threat Task Force (NITTF) addressing government-wide insider threat
    issue--consistent with EO 13587, ``Structural Reforms to Improve the
    Security of Classified Networks and the Responsible Sharing and
    Safeguarding of Classified Information.'' The NITTF issued
    implementation guidance of EO 13587 via Presidential memo on Nov 21,
    2012.
        Internally, DOD has:
          instituted read/write controls for external secret
    computer access ports and restrictions and audits of removable media
    (USBs, etc.,);
          driven out anonymity and instituted access control
    through public key infrastructure (PKI) implementation; and
          improved our ability to detect anomalous or malicious
    behavior on the DOD's secret network.
            o  Provides limited ability to discern data access that signal
            exceptions to normal data access.
            o  Provides full packet capture in order to discern patterns of
            malicious activity and allow for the investigation of
            incidents.
        Mr. Thornberry. How will the Joint Information Enterprise (JIE)
    interact with other major IT related initiatives, like the Defense
    Intelligence Information Enterprise or electronic health records
    interoperability? Will it be interoperable with the networks of the
    Intelligence Community?
        Ms. Takai. The DOD CIO is leading the DOD's IT effectiveness effort
    to achieve the Joint Information Environment (JIE) and the Director of
    National Intelligence CIO is leading a similar effort of the
    Intelligence Community Information Technology Enterprise. Both CIO's
    share common objectives and end-states, and actively participate on
    each other's governance boards, standards and architect forums, and
    Identity Management and data framework forums. Both CIO's recently
    established a Joint Information Standards Committee (JESC), and a
    directed policy governing the reuse of standards and specifications
    between the two communities to ensure interoperability and information
    sharing.
        The Defense Intelligence Information Enterprise (DI2E) is a
    unifying construct between the Department of Defense, the Intelligence
    Community (IC), and coalition Intelligence Information Enterprises, and
    aligns with the Intelligence Community IT Enterprise (ICITE) and DOD
    Joint Information Enterprise (JIE) policy and strategy.
        The DI2E Governance Council oversees development and implementation
    of a DI2E that is standardized, secure, optimized and interoperable,
    that aligns with DOD, IC and Coalition IT Enterprises. The Council
    coordinates on similar efforts by the IC Chief Information Officer
    (CIO), the DOD CIO, and the Defense Information Systems Agency (DISA)
    to ensure intelligence information integration across all security
    domains, including top secret, secret, unclassified, and various
    coalition fabrics. It enables seamless theater intelligence
    architectures and achieves efficiencies across the Defense Intelligence
    enterprise by recommending cost saving measures.
        With respect to electronic health records interoperability, DOD is
    establishing a Medical Community of Interest (Med-COI) virtual network,
    under the auspices of JIE and its single security architecture. The
    Med-COI, using the JIE architectural construct, will provide enterprise
    services and operate within the secure and protected DOD Global
    Information Grid (GIG). This capability will support unhindered and
    timely data access of patient records for DOD and VA clinicians and
    adjudication of VA Benefit claims.
        Mr. Thornberry. What role does the Cyber Investment Management
    Board (CIMB) play in decisions related to the JIE, especially with
    decisions related to service-specific system and network acquisitions?
        Ms. Takai. The CIMB is an advisory and management body, established
    to facilitate cohesion across S&T, requirements, acquisition, R&D, T&E,
    and sustainment efforts to ensure that cyber warfare investments are
    effectively coordinated across the Department. In this capacity, the
    CIMB is intended to provide a framework to make resourcing
    prioritization recommendations consistent with established JIE
    milestones.
        Mr. Thornberry. In discussing the Joint Information Environment
    (JIE), there seems to be a lot that is aspirational with this
    construct, but you will be limited by the current network environment
    that you have. How does DOD plan to get from the current ``as-is''
    state to the ideal ``to-be'' state?
        Ms. Takai. DOD is continually modernizing its IT infrastructure and
    systems, and has several ``network'' initiatives on-going (i.e.,
    LANDWARNET, AFNET, NGEN, etc.) that are focused on achieving the same
    objectives as JIE for the individual Military Services. JIE effort will
    leverage their already planned activities and technology refresh cycles
    to optimize the current network environment to our desired ``to-be''
    state from an enterprise perspective. At the enterprise level, DISA has
    planned upgrades of the Defense Information Systems Network (DISN)
    consistent with the target architecture for the JIE, to include the
    replacement of circuit-based switches with IP-enabled technologies, and
    replacement of legacy transport routing to Multiprotocol Label
    Switching (MPLS). The detailed solution architectures for the JIE are
    scheduled for completion in June 2013, and are being incorporated into
    Component programming activities for FY15 and beyond. The Department's
    JIE Technical Synchronization Office (JTSO) is developing a
    consolidated synchronization plan in conjunction with other DOD
    Components.
        Mr. Thornberry. Last year, the House Oversight and Government
    Reform committee introduced the Federal Information Technology
    Acquisition Reform Act (FITARA). Are you familiar with this proposed
    legislation? If so, what thoughts do you have on how this might affect
    DOD equities?
        Ms. Takai. I am aware of the some of the provisions of last year's
    draft bill, as well as the current version that was introduced earlier
    this year. I believe because of the complexity of the Department's
    missions, we will need to examine the legislation carefully to ensure
    that it does not undo important relationships we have developed between
    the Office of the Secretary of Defense and the Services and Agencies as
    well as introduce new or overlapping requirements for the Department
    for its IT investments.
        Mr. Thornberry. Following the termination of the Net-Enabled
    Command Capability (NECC), what is the Department doing to modernize
    its command and control capabilities?
        Ms. Takai. The Department is executing a sustainment and
    modernization plan to evolve the current Global Command and Control
    System (GCCS) family of systems and related command and control
    programs to improve mission effectiveness, achieve efficiencies, and
    provide required command and control capabilities to the joint
    warfighter. Our sustainment and modernization efforts will ensure
    support to current operational priorities while migrating to objective
    capabilities described in the recently updated Joint C2 Capability
    Development Document (CDD).
        Mr. Thornberry. How do you plan to address ``Bring-Your-Own-
    Device'' (BYOD) policy and the use of cloud technologies? Also, how can
    DOD keep up with the rate of technological change while using the DFAR?
    Are current acquisition reform efforts sufficient?
        Ms. Takai. Bring Your Own Device (BYOD) and portable cloud services
    are emerging trends in commercial industry. Many issues must be
    addressed before the DOD can embrace these technologies, such as
    overcoming existing DOD policy constraints, understanding the various
    operational use scenarios, examining potential security
    vulnerabilities, and avoiding potential legal issues that surround BYOD
    solutions. My office published the DOD Mobile Device Strategy on June
    8, 2012, and the DOD Commercial Mobile Device Implementation Plan on
    February 15, 2013, with the focus on improving three areas that are
    critical to mobility: 1) the networking infrastructure to support
    wireless mobile devices, 2) mobile applications, and 3) a framework
    that will allow the Department to sustain a commercial mobile solution
    that is reliable, secure, and flexible enough to keep pace with fast-
    changing technology. The DOD CIO will continue to monitor BYOD efforts
    across our Federal Government and, in conjunction with the Digital
    Government Strategy, will continue to evaluate BYOD options.
        Cloud Computing is becoming a critical component of the Joint
    Information Environment (JIE) and the Department's Information
    Technology (IT) modernization efforts and will enable users the access
    to data anywhere, anytime on any approved device. One key objective is
    to drive the delivery and adoption of a secure, dependable, resilient
    multi-provider enterprise cloud computing environment that will enhance
    mission effectiveness and improve IT efficiencies. Cloud services will
    enhance warfighter mobility by providing secure access to mission data
    and enterprise services regardless of where the user is located and
    what device he or she uses.
        My office recently issued the DOD Cloud Computing Strategy to
    provide an approach to move the Department to an end state that is an
    agile, secure, and cost effective service environment that can rapidly
    respond to changing mission needs. There are two key components of the
    Department's cloud strategy. The first component is the establishment
    of a private enterprise cloud infrastructure that supports the full
    range of DOD activities in unclassified and classified environments and
    optimizes data center consolidation efforts. The second is the
    Department's adoption of commercial cloud services that can meet the
    Department's cybersecurity and other IT needs while providing
    capabilities that are at least as effective and efficient as those
    provided internally.
        The Defense Information Systems Agency (DISA) is designated the DOD
    Enterprise Cloud Service Broker to facilitate and optimize access and
    use of commercial cloud services that can meet DOD's security and
    interoperability requirements, and ensure that new services are not
    duplicative of others within the Department while consolidating cloud
    service demand at an enterprise level. In addition, DISA, as the DOD
    broker, will leverage the Federal Risk Authorization and Management
    Program (FedRAMP) standardized security authorization process,
    including the accepted minimum security baseline for low and moderate
    information security categorizations, and ongoing continuous monitoring
    to ensure that appropriate security controls remain in place and are
    functioning properly.
        Current acquisition reform efforts offer opportunities to
    accelerate the adoption of commercial technologies. In many respects,
    despite their rapid evolution, mobility solutions are much like other
    traditional IT systems that empower users and managers with the tools
    and information they need to execute their missions. Our strategy of
    integrating well-orchestrated limited deployment pilot implementations
    allows users and managers to rapidly innovate, mature critical
    technologies, and resolve integration challenges to swiftly address
    mission challenges. The Implementation Plan incorporates many of the
    Services technology development efforts in a spiral approach with an
    18-month acquisition cycle. The Implementation Plan streamlines the
    certification and accreditation (C&A) process for mobile devices,
    operating systems, and applications. Sharing the workload with industry
    will bring the timeline for C&A down from over 18 months to about 30
    days with no reduction in security posture. Though the platforms will
    continue to evolve, we have the same commitment to systematic
    acquisition practices that serve the defense community most
    effectively. We continue to review the mobility acquisition lifecycle
    for efficiency opportunities.
        Mr. Thornberry. Would you tell us how much funding has been set
    aside to assist DOD organizations in establishing Insider Threat
    Programs in accordance with the recent Presidential Mandate, Memo, and
    National Insider Threat Standards? Further, who will be the
    organization responsible for identifying and distributing the necessary
    funding to each DOD entity? Who will be on point from your office to
    ensure the funding is being appropriately spent on the Insider Threat
    Mission within each DOD entity? Are there additional monies coming from
    the ODNI or the Office of the National Counterintelligence Executive
    (NCIX) for Enterprise Audit and Insider Threat missions?
        Ms. Takai. The Department initially programmed $162M, FY12-16, in
    order to satisfy the Executive Order 13587 requirements. The Department
    is assessing the need for additional resources to address the insider
    threat as part of our FY 15 budget deliberations. The Defense
    Information Systems Agency (DISA) and the Defense Manpower Data Center
    (DMDC) are the responsible implementing agencies for the initial $162M.
    My office is overseeing implementation of the budgeted and programmed
    funds provided to date. The Department is developing the necessary
    policy and responsibilities required under the Presidential mandate
    issued November 21, 2012. Regarding additional monies, there has been
    limited funding provided to a number of our Title 50 elements by ODNI
    and NCIX in FY 11 and 12. We don't anticipate any additional funding
    from ODNI or NCIX.
        Mr. Thornberry. Does the Department have a strategy to leverage
    commercial cyber security solutions to enable it to benefit from such
    capabilities as real time, global threat intelligence that has been
    optimized to work in highly sensitive environments? Who in the
    Department is responsible for the operational requirements, technical
    requirements, funding and acquisition? When does the Department plan to
    start executing against each of these requirements?
        Ms. Takai. Yes, for instance, initial funding was secured beginning
    in FY 14, under the program name ``Zero day Network Defense'' (ZND)
    which consists of commercial tools to be acquired and deployed in
    partnership between the Defense Information Systems Agency (DISA) and
    NSA to provide this defensive capability at the DOD perimeter, and on
    classified end point systems.
        While unclassified systems are just beginning to use this
    technology from commercial vendors, we are currently seeking funding to
    expand the ZND capability to unclassified networks and develop a Global
    Reputation Service that will be capable of ingesting information from
    commercial vendors, as well as government sources.
        The requirements for this capability were derived from multiple
    sources, including the Cyber Situational Awareness Initial Capabilities
    Document with input from all DOD components and agencies.
                                     ______

                      QUESTIONS SUBMITTED BY MR. LANGEVIN
        Mr. Langevin. General Alexander, in testimony before the Senate
    Armed Services Committee on Tuesday, you noted the creation of 13 teams
    with an offensive focus. Given that cyber in many cases requires
    preparatory work in order to access the full range of capabilities, how
    forward-leaning will these teams be?
        What training will you be providing to the identified mission teams
    and to other personnel who are being assigned to cyber work? Do you
    require additional authorities or resources in order to fully train the
    men and women under your command, particularly with regard to language
    skills, emulation and red-teaming?
        General Alexander. USCYBERCOM identified 42 specific work roles and
    the standards and skills required for planning and executing cyberspace
    operations. We worked with the National Security Agency, Service
    Departments, academia, and the private sector to leverage existing
    training solutions and created new ones, as appropriate, to train the
    personnel assigned to those work roles (see Exhibit A for additional
    detail.) Over the next three years we will train the Cyber Mission
    Forces that will perform world-class offensive and defensive cyber
    operations as part of our Cyber National Mission Teams, Cyber Combat
    Mission Teams and Cyber Protection Forces. We do not require additional
    authorities or resources to train the currently identified cyber
    professionals.
        [Exhibit A is For Official Use Only and is retained in the
    committee files.]
        Mr. Langevin. Ms. Takai, what progress has DOD made in improving
    the agility and flexibility of the IT acquisition process, and is there
    additional Congressional action needed?
        Ms. Takai. There are unique characteristics associated with the
    acquisition of information systems that require the use of acquisition
    approaches different from those normally used by the Department for
    acquiring weapons systems. All acquisition approaches should be
    tailored to the nature of the product being acquired. For example,
    information systems (e.g. business systems) do not require significant
    technology development like many weapons systems and they do not have
    the long term operations and support challenges facing most weapons
    systems. The Department has made steady progress in implementing
    several of the key approaches for improving the agility and flexibility
    of the IT acquisition process in the areas of requirements,
    acquisition, testing and certification and human capital. Many of these
    efforts will be captured in the next release of DODI 5000.02,
    ``Operation of the Defense Acquisition System'' including:
          Requirements: The Joint Staff has updated the
    requirements management process (Joint Capability Integration and
    Development System (JCIDS) to include a more streamlined requirements
    management and approval process for acquisition of information systems.
          Acquisition: On June 23, 2011, a Directive-Type
    Memorandum (DTM) on Business Capability Lifecycle (BCL) was signed and
    issued by USD (AT&L). The BCL provides a framework for implementing
    more flexible and streamlined processes for the acquisition of these
    business information systems and has been incorporated into the next
    release of DOD 5000.2.
          Test and Certification: The Department's testing
    community has been working in collaboration with USD (AT&L) to
    incorporate an integrated testing, evaluation, and certification
    approach into the DODI 5000.02, to reduce redundancies in system
    testing activities and improve the efficiency and effectiveness of
    testing the Department's information systems.
          Human Capital: A comprehensive review of IT acquisition
    competencies is also currently being conducted by the Department's
    Chief Information Officer. This review will update the IT acquisition
    competencies to better define DOD critical skill sets and assist in the
    update of curricula at the Defense Acquisition University and the
    Information Resources Management College.
                                     ______

                       QUESTIONS SUBMITTED BY MR. ROGERS
        Mr. Rogers. Ms. Takai, could you please explain the Department's
    decisionmaking process for when to use ``sole source'' and ``brand name
    only'' solicitations, such as those run under the Air Force's NETCENTS-
    1 and NETCENTS-2 contracts?
        Ms. Takai. The vast majority of procurements through the NETCENTS
    vehicles are accomplished via a competitive process. In the rare event
    that a sole source or specific brand name is required, appropriate
    Justification and Approval documentation is prepared and approved at a
    level commensurate with the dollar value of the proposed procurement.
        Mr. Rogers. What steps does DOD take to meet the statutory
    requirements of FAR sec. 6.303 and/or FAR sec. 16.505, as applicable,
    that are the prerequisites for a sole source and/or brand name product
    procurement, single name product procurement, including the necessity
    to conduct open procurements, determine minimum needs, and solicit the
    interest of manufacturers or prospective offerors?
        Ms. Takai. All DOD requiring officials must follow and adhere to
    applicable procurement policies in accordance with the Defense Federal
    Acquisition Regulation Supplement (DFARS), which is regularly revised
    to ensure alignment with the Federal Acquisition Regulations (FAR) as
    well as other regulations and statutes. DFARS subpart 216.5 requires
    that all orders for supplies or services exceeding $150,000 that are
    placed under multiple award contracts be awarded on a competitive basis
    with fair notice given to vendors of the intent to purchase, and an
    opportunity for all vendors to submit offers and receive fair
    consideration. There are allowable exceptions that must be based on
    justifications and/or determinations written and approved in accordance
    with FAR 8.405-6; if a statute requires the purchase be made from a
    particular source, or if one of the circumstances described in FAR
    16.505 (b) (2) (i) through (iv) applies. DOD contracting officers must
    always consider price or cost as factors when selecting a vendor for
    award, and should also consider past performance of potential vendors.
    As an overview, the steps followed to award in DOD include: 1) system
    engineering analysis to determine requirements, 2) market research to
    determine what products are available to satisfy those requirements,
    and 3) written documentation via a determination or Justification and
    Approval of anything less than full and open competition (including
    specification of a particular brand name product). Even when a
    particular brand name product is required and justified, there is an
    expectation of competition if there are multiple competing resellers of
    that same brand name product.
        Mr. Rogers. When the requirements of FAR sec. 6.303 and/or FAR sec.
    16.505, as applicable, are determined not to have been met, what
    remedial steps are in place to make sure these requirements are
    considered?
        Ms. Takai. There are many stages at which such a determination
    might be made, such as: by the program manager after market research
    activities, by the contracting officer or the contracting activity's
    Competition Advocate prior to solicitation and/or award or by the
    Government Accountability Office after an unsuccessful vendor files an
    appeal. There are different remedial steps for each scenario. Standard
    DOD acquisition and procurement procedures contain safeguards and
    checkpoints at multiple levels to ensure that any proposed exceptions
    to the competition rules are fully vetted and adequately justified. DOD
    contracting officers must make public the justification(s) required by
    FAR 6.303-1 in accordance with FAR 5.3 and as required by law. If a
    prospective (or unsuccessful) offeror believes that the procedures
    described in the FAR and/or DFARS have not been followed, they will
    generally contact the contracting officer who has responsibility for
    the acquisition, or the contracting activity's parent organization. If
    warranted, the contracting officer can then cancel the procurement
    activity--or issue a ``stop work'' order to study the situation (if the
    contract has already been awarded). In order to meet the requirements
    of the requesting office, the contracting officer may reshape the
    procurement into a competition among multiple vendors under a pre-
    existing contract vehicle, or pursue full and open competition among
    all vendors of a particular type/class of capability.
        Mr. Rogers. What process does DOD use in deciding to standardize on
    particular technology, and how does such standardization further the
    goal of maintaining a competitive procurement process which is
    essential to reducing costs in government procurements? Does that
    process flow down to how the Services make similar decisions?
        Ms. Takai. When there are clearly definable minimum functional/
    technical standards that are available and necessary to attain a
    required capability, the DOD CIO will assemble a cross-Component
    ``tiger team'' (including Acquisition personnel) to translate those
    standards into requirements suitable for release of an Request for
    Quotes (RFQ) or a Request for Proposals (RFP) to industry. For example,
    when data-at-rest (DAR) software was initially identified as an urgent
    requirement for all DOD laptops and portable computers, the Defense-
    Wide Information Assurance Program (DIAP) assembled such a tiger team
    to flesh out the applicable required specifications. Then they
    partnered with the DOD ESI Software Product Manager team from USAF to
    translate these specifications into an industry solicitation that
    resulted in the creation of DOD ESI Blanket Purchase Agreements from 10
    different publishers of DAR software. By DOD CIO policy, all DOD buyers
    of DAR software were required to buy DAR software only through one of
    these agreements. Competition among the resellers generally resulted in
    lower prices, and the DIAP certified that all purchased products met
    both the functional & technical standards.
                                     ______

                       QUESTIONS SUBMITTED BY MR. FRANKS
        Mr. Franks. General Alexander, I want to thank you for your service
    and leading such important missions with USCYBERCOM and the NSA. I am a
    strong believer that our military is, and should always be, better than
    the rest of the world's armed forces, and that we should never be
    entering fair fights. With that in mind, and the introduction of these
    new offensive cyber teams, and the fact that cyber threats are a
    relatively new phenomenon, how much better are we on offense, and
    defense in the cyber realm as compared to our enemies.
        General Alexander. We believe our offense is the best in the world.
    Cyber offense requires a deep, persistent and pervasive presence on
    adversary networks in order to precisely deliver effects. We maintain
    that access, gain deep understanding of the adversary, and develop
    offensive capabilities through the advanced skills and tradecraft of
    our analysts, operators and developers. When authorized to deliver
    offensive cyber effects, our technological and operational superiority
    delivers unparalleled effects against our adversaries systems.
        Team Cyber is constantly increasing its operational and analytic
    defensive capabilities through the adoption and use of standards to
    facilitate domain knowledge representation and information sharing
    across the community. In addition, the use of standards ensures
    compatibility with technologies commonly available in the public domain
    and allows for the rapid integration of new functional capabilities to
    avoid long-term engineering and development cycles.
        Potential adversaries are demonstrating a rapidly increasing level
    of sophistication in their offensive cyber capabilities and tactics. In
    order for the Department of Defense to deny these adversaries an
    asymmetric advantage, it is essential that we continue the rapid
    development and resourcing of our Cyber Mission Forces.
        Mr. Franks. General Alexander, last year I asked you a question:
    How prepared are we to carry out your mission if the power grid or
    substantial part of it were to go down for an extended period of time?
    For example, two weeks or longer due to severe space weather or a
    manmade electromagnetic pulse.
        Your answer included that fact that much of DOD's cyberspace is
    served through commercial providers. Do you feel that the power and
    electricity needed to carry out your mission is important enough to
    require those commercial providers of the power grid to successfully
    harden their grid from severe space weather or manmade electromagnetic
    pulse? Can the DOD require that of commercial providers of the grid? Do
    you feel that this issue is important enough that legislation is needed
    to force the hand of industry to act?
        General Alexander. While I absolutely agree with the criticality of
    cyber hardening the power grid, I also believe any legislative solution
    has to take into account the prohibitive costs associated with doing so
    given its antiquated state. I believe the activities underway through
    the President's EO 13636 ``Improving Critical Infrastructure
    Cybersecurity'' and PPD-21 ``Critical Infrastructure Security and
    Resilience'' are a good first step. Legislation which builds upon these
    activities by providing the right set of incentives would be
    invaluable.
        From an NSA and CYBERCOM perspective, it is also critical that
    Congress pass information sharing legislation that enables effective
    two-way sharing of cyber threat information and countermeasures between
    the private sector and the USG. By effective two-way sharing, I mean
    that the government needs to know, in real time, when there are
    indications of cyber intrusions or attacks against the nation's
    critical infrastructure, and the government needs to be able to share
    in real time, indications and warnings of attacks and associated
    countermeasures that the private sector needs to protect their
    networks. Given the authority to share information, the ISPs could act
    as a domestic radar that can see cyber threats and tip and queue the
    government to respond in real time.