[Senate Hearing 115-457]
[From the U.S. Government Publishing Office]


                                                        S. Hrg. 115-457

                 REAUTHORIZING DHS: POSITIONING DHS TO
            ADDRESS NEW AND EMERGING THREATS TO THE HOMELAND

=======================================================================

                               ROUNDTABLE

                               BEFORE THE

                              COMMITTEE ON
               HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
                          UNITED STATES SENATE

                     ONE HUNDRED FIFTEENTH CONGRESS


                             SECOND SESSION

                               __________

                            FEBRUARY 7, 2018

                               __________

        Available via the World Wide Web: http://www.govinfo.gov

                       Printed for the use of the
        Committee on Homeland Security and Governmental Affairs

        
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]                            
                                
                                __________


                   U.S. GOVERNMENT PUBLISHING OFFICE                    
31-265 PDF                  WASHINGTON : 2019                     
          
-----------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, 
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected].        
        
    
        
        COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                    RON JOHNSON, Wisconsin, Chairman
JOHN McCAIN, Arizona                 CLAIRE McCASKILL, Missouri
ROB PORTMAN, Ohio                    THOMAS R. CARPER, Delaware
RAND PAUL, Kentucky                  HEIDI HEITKAMP, North Dakota
JAMES LANKFORD, Oklahoma             GARY C. PETERS, Michigan
MICHAEL B. ENZI, Wyoming             MAGGIE HASSAN, New Hampshire
JOHN HOEVEN, North Dakota            KAMALA D. HARRIS, California
STEVE DAINES, Montana                DOUG JONES, Alabama

                  Christopher R. Hixon, Staff Director
                Gabrielle D'Adamo Singer, Chief Counsel
                    Daniel P. Lips, Policy Director
          Michelle D. Woods, Senior Professional Staff Member
               Margaret E. Daum, Minority Staff Director
       Charles A. Moskowitz, Minority Senior Legislative Counsel
                 J. Jackson Eaton IV., Minority Counsel
                 Subhasri Ramanathan, Minority Counsel
                     Laura W. Kilbride, Chief Clerk
                    Bonni Dinerstein, Hearing Clerk

                            C O N T E N T S

                                 ------                                
Opening statement:
                                                                   Page
    Senator Johnson..............................................     1
    Senator McCaskill............................................     3
    Senator Heitkamp.............................................    10
    Senator Peters...............................................    13
    Senator Portman..............................................    15
    Senator Hassan...............................................    19
    Senator Lankford.............................................    21
    Senator Harris...............................................    24
    Senator Jones................................................    27
Prepared statement:
    Senator Johnson..............................................    39
    Senator McCaskill............................................    40

                               WITNESSES
                      Wednesday, February 7, 2018

Hon. Elaine C. Duke, Deputy Secretary, U.S. Department of 
  Homeland Security; accompanied by Hon. Claire M. Grady, Under 
  Secretary for Management; U.S. Department of Homeland Security; 
  and Christopher Krebs, Senior Official Performing the Duties of 
  the Under Secretary, National Protection and Programs 
  Directorate, U.S. Department of Homeland Security..............     4
George A. Scott, Managing Director, Homeland Security and 
  Justice, U.S. Government Accountability Office; accompanied by 
  Chris Currie, Director, Emergency Management and National 
  Preparedness Issues, U.S. Government Accountability Office.....     5
John V. Kelly, Acting Inspector General, U.S. Department of 
  Homeland Security..............................................     6

                     Alphabetical List of Witnesses

Duke, Hon. Elaine C.:
    Testimony....................................................     4
    Prepared statement...........................................    43
Kelly, John V.:
    Testimony....................................................     6
    Prepared statement...........................................    58
Scott George A.:
    Testimony....................................................     5
    Prepared statement...........................................    46

                                APPENDIX

Chart submitted by Senator Johnson...............................    70
GAO cybersecurity report submitted by Senator Portman............    71
CSIS cybersecurity report submitted by Senator Hassan............   118
Information submitted for the Record by Ms. Grady................   148
Responses to post-hearing questions for the Record from:
    Ms. Duke.....................................................   149
    Mr. Kelly....................................................   177

 
                     ROUNDTABLE REAUTHORIZING DHS:
  POSITIONING DHS TO ADDRESS NEW AND EMERGING THREATS TO THE HOMELAND

                              ----------                              


                      WEDNESDAY, FEBRUARY 7, 2018

                                     U.S. Senate,  
                           Committee on Homeland Security  
                                  and Governmental Affairs,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 10:01 a.m., in 
room SD-342, Dirksen Senate Office Building, Hon. Ron Johnson, 
Chairman of the Committee, presiding.
    Present: Senators Johnson, Portman, Lankford, Daines, 
McCaskill, Heitkamp, Peters, Hassan, Harris, and Jones.

             OPENING STATEMENT OF CHAIRMAN JOHNSON

    Chairman Johnson. Good morning. This roundtable of the 
Senate Committee on Homeland Security and Governmental Affairs 
will come to order.
    I want to welcome our participants, we will call them. I 
guess they are witnesses, but we have the Honorable Elaine 
Duke, the Honorable Claire Grady, Mr. George Scott, and Mr. 
John V. Kelly from the Department of Homeland Security (DHS), 
the Government Accountability Office (GAO), as well as the 
Office of Inspector General (OIG).
    This roundtable will discuss the attempt to reauthorize 
DHS. The House has passed their bill. They had a memorandum of 
understanding (MOU) to consolidate that entire process under 
the Committee of Homeland Security in the House.
    It is a little more messier here in the Senate, which is 
not unusual. The Commerce Committee has taken up and passed 
authorization for the Transportation Security Administration 
(TSA) and the U.S. Coast Guard (USCG). The Judiciary has a 
number of components. We have, my staff keeps telling me, 
somewhere around 40 to 50 percent of DHS under our Committee's 
authorization. That is really what we are here to talk about 
today.
    I think it is accurate to say that what the House 
authorization does is--and this is what you need to do in these 
authorizations--take what DHS currently does and codify it, 
take the recommendations from the GAO and the Inspector General 
(IG). And by the way, reading your testimony, it is actually 
pretty pleasing to see how many of the recommendations the 
Department has addressed over a number of Administrations to 
improve their operation.
    And let us also admit that this has not been an easy 
Department to establish and operate--22 agencies cobbled 
together, different missions trying to develop that unity of 
mission. We helped, I think, a little bit in the last Congress 
in working on some of the authorization of that Unity of 
Effort.
    But again, we are trying to codify these things. There are, 
I think, a couple of key changes or new departments that want 
to codify the Countering Weapons of Mass Destruction (CWMD) 
office. I think we want to figure out some way to take National 
Protection and Programs Directorate (NPPD), focus its mission, 
do the renaming, and we have talked a little bit about doing 
that on a must-pass piece of legislation, or we do this on this 
authorization. I think there is a great deal of desire to do 
it. It is just a matter of how do we get those efforts signed 
into law.
    A couple of items need to be worked out. Authorization for 
Federal Emergency Management Agency (FEMA) grants. What are we 
going to do with Federal Protective Service? We will continue 
to have those discussions. Maybe that is something we can 
determine and come to conclusion with voting in a markup.
    My last point is I do want to talk about the one glaring 
omission out of the House authorization and something that 
maybe it is too controversial, but it is something I think that 
the Department really needs, is a very serious look at all of 
the committees of jurisdiction to have that you are responsible 
to.
    In my briefing, we got this little chart of all the 
committees,\1\ and I do not think, how many committees and 
subcommittees do have that responsibility to report to and that 
have jurisdiction over DHS. But some of the information is 
pretty interesting.
---------------------------------------------------------------------------
    \1\ The chart referenced by Senator Johnson appears in the Appendix 
on page 70.
---------------------------------------------------------------------------
    The number of hearings that DHS personnel have participated 
in prior Congresses, 304 in the 111th, 289 in the 112th, 219 in 
113th, 211 in the 114th Congress. Witnesses are in the 400 
levels; the briefings, thousands. I mean 4,000, the 111th 
Congress; over 4,000 in the 114th.
    Now, as the oversight committee, we strongly believe in 
agency responsibility in terms of reporting to us and 
transparency, all those types of things, but it needs to be 
more streamlined. So one of the things I think we are 
suggesting is--I am really not real nuts about commissions, but 
I am not quite sure of any other way of doing this. I am open 
to other ideas, but some kind of commission to work with House 
committees and Senate committees to reduce that burden because 
from my standpoint I want to make sure the Department is 
focusing on its primary mission, which is keeping America safe 
and secure.
    So, with that, I do ask unanimous consent that my written 
opening statement be entered into the record.\2\
---------------------------------------------------------------------------
    \2\ The prepared statement of Senator Johnson appears in the 
Appendix on page 39.
---------------------------------------------------------------------------
    With that, I will turn it over to our Ranking Member, 
Senator McCaskill.

             OPENING STATEMENT OF SENATOR MCCASKILL

    Senator McCaskill. Thank you, Mr. Chairman.
    I am a little confused as to why this is a roundtable 
instead of a hearing. I hope someone can speak to that. This is 
an Administration that prides itself on getting rid of 
senseless regulations, and I am being told that the reason we 
did a roundtable is because you did not have time to get 
testimony approved by the Office of Management and Budget 
(OMB).
    Is that right? Is that why it is not a hearing?
    Chairman Johnson. I think it was just a conversation 
between staff and DHS in terms of what would be the best format 
to have these discussions to prepare for a markup to actually 
pass this piece of authorization. To me, it is not a big 
difference one way or the other.
    Senator McCaskill. Well, I think it is really important, 
the reauthorization of DHS. I think it rises to the level of a 
hearing, but you and I may just have a disagreement about that. 
I did not know that it was under the impression it was 
something that the Department did not have ample opportunity to 
prepare for a hearing because of the approval of OMB, but if it 
was just a choice of the Chairman, then you and I just have a 
difference of opinion about whether or not this rises to the 
level of a hearing.
    I have a number of things I would like to take time to talk 
about today. I probably will not have time to talk about all of 
them. Obviously, I continue to be very concerned about 
acquisition and how well the Department handles acquisition.
    We see press about the most egregious examples. Obviously, 
the recent one, we have a contractor who clearly has a very 
troubled history with the Federal Government, but yet we 
entered into a contract for them to deliver meals, and clearly 
they did not deliver on that contract. They did not perform 
under that contract. I think we have to really drill down on 
debarment and suspension and why this is such a hard thing to 
do in the Federal Government.
    I can assure you my colleague, the Chairman, if it was his 
company, if it was a private business and you had somebody that 
was a supplier and they screwed up time after time after time, 
do you know what that private business would do? They would 
quit doing business with the supplier, but the Federal 
Government seems to never quit doing business with anybody who 
screws up. And I do not get it. I would like us to get to the 
bottom of that.
    I also obviously have questions that I will spend some time 
on. I am very concerned about the privilege dispute in the IG 
report. This is groundbreaking, it is unprecedented, and it is 
very bad. And I want to get to the bottom of it.
    And I also will put my written statement in the record\1\ 
since we have great attendance this morning, and I think 
everybody has questions. Let us move to questions
---------------------------------------------------------------------------
    \1\ The prepared statement of Senator McCaskill appears in the 
Appendix on page 40.
---------------------------------------------------------------------------
    Chairman Johnson. Again, it is my understanding you will 
each have an opening statement, so why do we not just start 
with the Honorable Elaine Duke. She is the Deputy Secretary of 
the Department of Homeland Security.

TESTIMONY OF THE HONORABLE ELAINE C. DUKE,\1\ DEPUTY SECRETARY, 
U.S. DEPARTMENT OF HOMELAND SECURITY; ACCOMPANIED BY HONORABLE 
     CLAIRE M. GRADY, UNDER SECRETARY FOR MANAGEMENT, U.S. 
DEPARTMENT OF HOMELAND SECURITY; AND CHRISTOPHER KREBS, SENIOR 
  OFFICIAL PERFORMING THE DUTIES OF UNDER SECRETARY, NATIONAL 
 PROTECTION PROGRAMS DIRECTORATE, U.S. DEPARTMENT OF HOMELAND 
                            SECURITY

    Ms. Duke. OK. Thank you. I will just give one opening 
statement for the Department.
---------------------------------------------------------------------------
    \1\ The prepared statement of Ms. Duke appears in the Appendix on 
page 43.
---------------------------------------------------------------------------
    Thank you for having both of us here. Claire Grady, as the 
Under Secretary for Management, is our Chief Management 
Officer, and I as the Deputy Secretary and acting as our Chief 
Operating Officer. And there is a strong linkage to that, and 
hopefully with the two of us, we can cover all the areas today.
    You have been great partners, and we are really looking 
forward to having some open and honest dialogue.
    The purpose for DHS is clear. It is even clearer now with 
the threats against our country, and we welcome an 
Authorization Act that would give us updated authorities, 
updated support, and updated accountability for the country 
which we support.
    We recognize that we have to ensure that we carry out the 
mission on behalf of the country and that we are serving even 
our employees, our 240,000 employees right, and we think 
passage of the Authorization Act would be helpful in us 
executing our authorities and responsibilities.
    Over the past year at DHS, I have been working on a Unity 
of Effort at DHS, and this is critical. And hopefully, we will 
have time to talk about it today, but it is really looking at 
how we as the headquarters operate to enable and support the 
headquarters.
    And I see three roles for the headquarters elements: 
leading a community of practice, being subject-matter experts, 
and servicing the headquarters. And I think that your proposal, 
Mr. Chairman, of consolidating some of the committees would 
really be a great parallel to what we are trying to do in 
headquarters and align and streamline even better. We have made 
great progress. We have to do more in this area.
    What we are looking for in an authorization bill overall is 
something that does what you say and codifies some of the 
efforts we are making already, the leadership commitment, but 
it does not go so far as to dictate and legislate areas that 
really would be difficult to change or take away key and 
essential flexibilities of the Secretary and the leadership of 
the Department, so finding that right balance.
    We do feel like areas in an authorization bill that would 
help us with personnel, things such as hiring retention and 
separation flexibilities and management of our employees would 
be helpful, and we can discuss those in a level of detail 
either now or in subsequent discussions with you and the 
Ranking Member later.
    Also, the Department's Cyber and Infrastructure Security, 
we do have the senior official performing the duties of the 
Under Secretary, Chris Krebs, with us here today to talk about 
the NPPD area and the Countering Weapons of Mass Destruction. 
So we are looking forward to coming up with some agreements 
that can provide you information that will help inform your 
authorization bill.
    Thank you.
    Chairman Johnson. Mr. George Scott is the Managing Director 
for the U.S. Government Accountability Office, Homeland 
Security and Justice team. Mr. Scott.

 TESTIMONY OF GEORGE A. SCOTT,\1\ MANAGING DIRECTOR, HOMELAND 
 SECURITY AND JUSTICE, U.S. GOVERNMENT ACCOUNTABILITY OFFICE; 
ACCOMPANIED BY CHRIS CURRIE, DIRECTOR, EMERGENCY MANAGEMENT AND 
 NATIONAL PREPAREDNESS ISSUES, U.S. GOVERNMENT ACCOUNTABILITY 
                             OFFICE

    Mr. Scott. Thank you, Chairman Johnson, Ranking Member 
McCaskill, and Members of the Committee. I am pleased to be 
here today to discuss opportunities to further strengthen the 
Department of Homeland Security.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Scott appears in the Appendix on 
page 46.
---------------------------------------------------------------------------
    Over the past 15 years, DHS has implemented a range of 
homeland security operations while making significant progress 
in addressing the high-risk area of transforming the Department 
and strengthening its management functions. In fact, we now 
consider DHS to be a model for how other agencies should work 
to address their high-risk issues.
    That said, there are a number of key areas where the 
Department needs to continue to improve. Reauthorization 
provides the opportunity to reflect on the progress the 
Department has made and also how best to align the DHS 
missions, roles, and responsibilities to better counter new and 
emerging threats to the homeland.
    I would like to briefly discuss some specific examples 
where we think legislation to reauthorize the Department would 
help.
    In terms of departmental organization, codifying the roles 
and responsibilities of the National Protection and Programs 
Directorate would help strengthen DHS's focus and 
responsibilities on cybersecurity. Also, renaming the office to 
better reflect those responsibilities would be a positive step.
    In the area of protecting critical infrastructure, Congress 
could require DHS to evaluate the assistance and information it 
provides to stakeholders regarding cybersecurity protections, 
particularly those sectors that work with the Department on a 
voluntary basis.
    It is important for DHS and the Congress to better 
understand to what extent those efforts are yielding positive 
results. While the Department has made progress addressing 
financial management issues, including receiving a clean audit 
opinion on its financial statements for 5 consecutive years, 
significant challenges remain. In particular, the Department 
continues to struggle with its financial system modernization 
efforts, and additional oversight is warranted.
    DHS also needs to continue to develop a financial 
management workforce with the skills necessary to uphold a 
strong internal control environment, and the Congress could 
require the Department to develop a comprehensive strategy for 
doing so.
    Finally, no discussion of Department would be complete 
without touching on the area of acquisition management. The 
Department has taken a number of important steps in response to 
GAO recommendations to improve oversight of its acquisitions.
    For example, it reestablished the Joint Requirements 
Council (JRC). Codifying the role of the JRC, as recently 
proposed by Senator McCaskill, and ensuring that the Department 
continues to follow sound acquisition practices will help 
increase accountability for the billions of dollars that the 
Department spends each year.
    This concludes my statement, and I look forward to 
answering any questions that you have. Thank you.
    Chairman Johnson. Thank you.
    Our final participant witness is Mr. John V. Kelly. He is 
the Acting Inspector General for the Department of Homeland 
Security's Office of Inspector General. Mr. Kelly.

 TESTIMONY OF JOHN V. KELLY,\1\ ACTING INSPECTOR GENERAL, U.S. 
                DEPARTMENT OF HOMELAND SECURITY

    Mr. Kelly. Good morning, Chairman Johnson, Ranking Member 
McCaskill, and Members of the Committee. Thank you for inviting 
me to discuss DHS's Reauthorization Act and positioning DHS to 
address new and emerging threats.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. Kelly appears in the Appendix on 
page 58.
---------------------------------------------------------------------------
    Since its establishment, DHS has progressed in addressing 
challenges to accomplish its mission. However, to fulfill its 
vital mission of successfully protecting and securing our 
Nation, DHS must continue to overcome challenges that hinders 
its efforts.
    Over the last few years, my office has issued numerous 
reports that address the challenges that face DHS. Many of 
those challenges, Congress addressed in H.R. 2825, the DHS 
Reauthorization Act. With implementation of our recommendations 
and your legislation, DHS can continue to improve its 
operations and reduce fraud, waste, and abuse. However, if the 
Department ignores these challenges, it will be difficult for 
DHS to effectively and efficiently address new and emerging 
threats to the homeland.
    In our last two annual reports on DHS's major management 
and performance challenges, we highlighted two of the most 
significant longstanding challenges. First, DHS's leadership 
must commit itself to ensuring DHS operates more as a single 
entity rather than a confederation of components.
    The Department leadership must also establish and enforce a 
strong internal control environment. The current internal 
control environment is relatively weak, and it affects all 
aspects of the Department's missions, including border 
protection, immigration enforcement, protection against 
terrorist attacks, natural disasters, and cybersecurity. 
Fortunately, the DHS Authorization Act reinforces the need for 
the Department unity by streamlining oversight, accountability, 
and eliminating redundancy.
    Another important area is acquisition management. In fiscal 
year (FY) 2017, DHS spent more than $33 billion on contractual 
services, supplies, and assets; thus, DHS's acquisition 
management system is critical in fulfilling its mission. 
However, implementing an effective acquisition management 
system is inherently complex.
    DHS annually spends tens of billions of dollars on a broad 
range of assets and services, including ships, aircraft, 
surveillance towers, nuclear detection equipment, financial and 
human resources (HR) systems, and information technology 
systems. To its credit, DHS has improved some of the 
acquisition processes; however, challenges remain. Provisions 
of the DHS Authorization Act would strengthen the role of the 
Under Secretary of Management, implement efficiencies across 
components, and better ensure oversight and accountability, 
thus, safeguarding billions of taxpayer dollars.
    DHS must also strengthen aviation security. Nowhere is the 
asymmetric threat of terrorism more evident than the area of 
aviation security. The Transportation Security Administration 
cannot afford to miss a single genuine threat without 
potentially catastrophic consequences, yet terrorists need only 
to get it through once.
    The detection of dangerous items on people and baggage 
requires reliable equipment, effective technology, and well-
trained transportation security officers. Our work has 
identified vulnerabilities in TSA's screenings operations. We 
have conducted nine covert penetration testing audits on 
passenger baggage and screening operations.
    I cannot provide the results in an unclassified setting but 
can characterize them as troubling and disappointing.
    TSA's failures were caused by a combination of technology 
and human error.
    I am pleased that TSA's leadership understands the gravity 
of our findings and is moving to address those.
    We recently audited the Federal Air Marshals Service (FAMS) 
contributions to TSA's security. Although the detailed results 
are classified, I can state that some of the funding for FAMS 
could be discontinued and reallocated to higher priority areas.
    Finally, a primary focus of DHS is the integrity of the 
roughly 240,000 departmental employees. While the vast majority 
of DHS's employees and contractors are honest and hardworking 
public servants, much of our investigative caseload concerns 
allegations of corruption on part of DHS law enforcement 
personnel and government contractors.
    While the DHS Authorization Act implicitly grants the OIG 
the right to first refusal, we suggest that Act explicitly 
grant that right to us.
    Inspectors General play a critical role in assuring 
transparent, honest, effective, and accountable government. The 
American public must have a fundamental trust if the government 
employees are held accountable for crimes and serious 
misconduct by an independent fact-finder.
    Mr. Chairman, this concludes my comments. You are welcome 
to answer questions.
    Chairman Johnson. Thank you, Mr. Kelly.
    One of the reasons I like this roundtable approach is, in 
general, in the past, it allows pretty free flow of 
questioning, and we can stay on one topic.
    So the way I want to approach this is we do have a timer 
here. It is set for 5 minutes. I think the yellow light goes 
off when there is 1 minute left, and the red light goes when 
your time is up.
    But I do want to accept or encourage, but if you have a 
follow-on question that is pertinent to what another Member is 
asking, so we can cover the topic right then and there as 
opposed to 15 minutes, half hour later, bring up the topic 
again and rehash it, just raise your hand. But, again, I really 
want to discipline kind of one shot per member on a particular 
topic, and it has to be pertinent, OK? So, again, I think that 
will just add to the discussion.
    So I will defer my questioning. I will turn it over to 
Senator McCaskill, and we will see if this thing works.
    Senator McCaskill. I am a little confused about the process 
here, but we will forge ahead.
    Chairman Johnson. It will be good.
    Senator McCaskill. If this is going to be a roundtable, I 
sure hope we are not cutting people off from being able to ask 
as many questions as they want.
    Chairman Johnson. No.
    Senator McCaskill. OK. Let us start with something that 
concerns me because of my work with the IG community as a 
former auditor.
    The Inspector General conducted an extensive review of the 
Department's implementation of the President's travel ban. The 
cooperation hit a roadblock when Inspector General Roth took 
steps to release his findings. Not only did it take months for 
the Department to respond to the Inspector General regarding 
the Department's privileged claim so the report could be 
released, in the end, the Department decided to assert a 
privilege that had never been used before, invoking a 
deliberate process privilege.
    Now, the irony is that you are invoking a deliberate 
process privilege in the implementation of the travel ban. If 
there was ever anything that was not deliberate, it was the 
travel ban because it occurred without adequate notice to the 
Department, without adequate preparation to the Department. 
Anybody with common sense could look at it and see that.
    So the irony is that you are using a deliberative process 
privilege to block information from the public. Are we allowed 
to see this information, Ms. Duke?
    Ms. Duke. The concern over the deliberative process was it 
has to be protective. We have to be able to have discussions 
with the President, the Administration. That is process.
    Additionally, it is under litigation, and that is the issue 
here. It is important that we protect this.
    Yes, we will provide the report as it is to the Congress. I 
think that the important thing to note is that even with the 
redactions, it does state what the process was, and we believe 
that even with the deliberative process, it gives adequate 
information about what happened with the travel ban.
    Senator McCaskill. I mean, I just think it is outrageous. I 
do not understand it. Government is sued all the time. We 
cannot use litigation as an excuse to stop information from the 
Inspectors General. We cannot do that because every Department 
will then say, ``Oh, we are under litigation. We cannot''--and 
is this an executive privilege, or is this a deliberative 
process privilege? Is this the White House that is exerting 
this privilege, or is it your Department?
    Ms. Duke. There were different pieces of the report that 
came under different privileges. Some were executive. Some were 
deliberative process.
    The IG got all that information. It was an issue of whether 
it could be made public through a public report. So the IG does 
have the information.
    Senator McCaskill. But the IG cannot share that with me?
    Ms. Duke. Correct.
    Senator McCaskill. Or the Chairman of this Committee?
    Ms. Duke. We would be happy to have a discussion about that 
with you if you would like to go over the findings of the 
report. I will commit to you that we will come in and talk to 
you about the report.
    Senator McCaskill. Well, I am going to need more 
explanation about this because this could be a trend. All of a 
sudden, we could have IGs all over government encountering 
Departments saying, ``Well, this was a deliberative process. We 
cannot talk about this,'' and then, all of a sudden, our 
oversight is gone.
    Ms. Duke. Right. We find it highly unusual for an IG report 
to be solely focused on discussions within the Executive Branch 
between--a lot of the report was focused on email 
notifications, those type of things, where normally an IG 
report would be focused on how did DHS implement the travel 
restriction.
    Senator McCaskill. Well, as somebody who has read probably 
as many IG reports as anybody in this room and as many GAO 
reports as anybody in this room, emails are always a part of 
those reports.
    Ms. Duke. And emails regarded to how we implemented it, I 
think would be appropriate. I think the deliberative process 
refers more in the early stages of how we converse pre-
decisional, if you will, within the Executive Branch over how 
decisions were made.
    Senator McCaskill. Well, I am going to ask for a one-on-one 
briefing on this. If we have to do it in a classified setting, 
whatever. I want to know what is being hidden from the public, 
and then we can go from there.
    On acquisitions, the recruiting contract, we have asked for 
information on this recruiting contract for Customs and Border 
Protection (CBP). We asked on January 3. We still have not 
gotten anything. Was it competitively bid?
    Ms. Grady. Yes, ma'am, it was.
    Senator McCaskill. OK. So the best deal we could get was 
paying $40,000 for every job that pays $40,000?
    Ms. Grady. So we looked at it from the perspective of 
competitive selection and that representing what best met our 
needs at a fair price.\1\ So when we looked at it, we looked at 
it in its entirety.
---------------------------------------------------------------------------
    \1\ The information for the Record from Ms. Grady appears in the 
Appendix on page 148.
---------------------------------------------------------------------------
    As you know, we have struggled to hire the necessary staff 
for border patrol agents, border patrol officers, Air and 
Marine, and even despite the efforts of using a range of 
options, including retention incentives and different things we 
had done from a recruiting perspective, we have an average, a 
net loss of about 400 positions for border patrol agents every 
year.
    This year, first quarter, we are down another 100. We 
needed to do something above and beyond what we were able to 
do, particularly with the intent to hire an additional 5,000 
border patrol agents. We looked at it carefully and said this 
is a surge need. We still need to continue to push on all of 
the flexibilities from an HR perspective we have to meet our 
staffing needs, but to meet the surge, we needed assistance 
over and above what we had. And we had awarded a contract to a 
company who has a proven track record for ability to accomplish 
just that.
    Senator McCaskill. Well, $40,000 per employee is 
outrageously high. We are paying $40,000 to hire somebody we 
are going to pay $40,000. For folks from where I live, for 
people who think the government has lost its mind, this would 
be Exhibit A.
    Ms. Grady. I understand the concern, and one of the things 
that was important to us about that contract is structuring it 
so that we pay for actual onboarding when we get formal job 
offers. We are not paying for effort; we are paying for 
delivering results.
    Senator McCaskill. $40,000 per?
    Ms. Grady. Approximately. That includes initial startup 
costs that are granted toward the recruiting efforts, 
safeguarding information associated with personally 
identifiable information (PII), and all of the branding and 
efforts up front. So if you do on that net division, you could 
come up with a figure close to that, but what we were really 
focused on is getting the results. And it is a scalable 
contract. It is an indefinite delivery indefinite quantity 
(IDIQ) contract.
    Senator McCaskill. Well, I will be anxious to get the 
contract file. Will it come soon?
    Ms. Grady. We are going to share that information with you, 
and we would be happy to discuss the specifics of the contract.
    Senator McCaskill. Well, we sent the letter on January 3. 
Will it come soon?
    Ms. Grady. I will look into the exact date we are going to 
get it back to you.
    Senator McCaskill. Can we get it in 2 weeks?
    Ms. Grady. We will have issues associated with protected 
information within that competitive source selection 
information, but we are committed to providing that information 
to you and being transparent about the processes.
    Chairman Johnson. Senator Heitkamp?
    Senator McCaskill. I hope you have an answer.
    Ms. Grady. Yes, ma'am.
    Senator McCaskill. Two weeks?
    Ms. Grady. Two weeks.
    Senator McCaskill. All right.

             OPENING STATEMENT OF SENATOR HEITKAMP

    Senator Heitkamp. there is a boatload of money that is 
coming your way, and if we cannot trust that you are spending 
it right, if we cannot trust that the decisions are being made 
based on evidence-related factors and by professionals, this is 
not going to go well. And so these issues that we are 
confronting today are critical, and I think Senator McCaskill 
has done a great job outlining just two areas where we have 
concern because if we cannot see an IG report and all the 
attachments, we are not doing oversight, right?
    And if we have a problem hiring people, you have a problem 
retaining people, what are you doing? Who are you talking to? 
What are the other strategies that are being deployed to 
maintain staff?
    We spend a lot of time. I spend a lot of time, as you know, 
on the Northern Border. I hate to sound like a--and I talk to 
border patrol, and I talk to the challenges. And with a few 
tweaks, you could get them to stay. Instead of paying $40,000, 
you could walk into a high school and recruit high school 
students. You guys are not being creative enough.
    And this is hard work, and it is going to require different 
thinking, but $40,000 to hire a job that pays $40,000? There is 
no one who thinks that is a good idea.
    Ms. Duke. Senator, you raise a good point about retention 
and other activities.
    So you may have heard about our leadership year. That is 
focused on exactly having a concerted effort on why are we 
losing people and looking at that from both a leadership and 
management and a supervisor perspective.
    The fact that we went up in the Federal Employee Viewpoint 
(FEV) survey, the largest increase in government, I think, 
shows that is working. We are hearing from our employees what 
they want from a cultural perspective, and we are addressing 
that. And we can talk more about that if you want the time.
    Additionally, in border patrol especially where we have 
high attrition and difficult to recruit, a lot of that has to 
do with certain duty stations, and we are looking at 
legislative proposals that might help and some things including 
if someone goes to a location where it is not desirable, can 
they have first choice. So we are looking at what we can do 
internally and what we might have similar to Department of 
Defense (DOD).
    Senator Heitkamp. You need to get this house in order----
    Ms. Duke. Yes.
    Senator Heitkamp [continuing]. Because, like I said, we are 
being asked to authorize and appropriate a lot of money.
    Ms. Duke. Yes.
    Senator Heitkamp. And if that money is just going to be 
poofed and we look back on this time and say in our rush to get 
this done, we did not do the right oversight, then shame on us.
    I want to talk a little bit about Chairman Johnson's 
chart,\1\ and I want to talk about the 9/11 Commission. I did 
not know that you mentioned it, but this was one of the 
recommendations, improving this, government oversight, somehow 
by bringing in more of a defense authorization structure to the 
Department of Homeland Security. I think that is the direction 
that we need to head, and that was the recommendation that the 
9/11 Commission made that was never followed through, partly 
because we got jurisdictional turf battles that go with this, 
right?
---------------------------------------------------------------------------
    \1\ The chart referenced by Senator Heitkamp appears in the 
Appendix on page 70.
---------------------------------------------------------------------------
    Chairman Johnson. Nobody wants to give it up.
    Senator Heitkamp. Yes, right.
    If we are going to do the right kind of oversight, we 
cannot have this kind of disparate jurisdictional challenges, 
and this is probably more to the Chairman and the Ranking 
Member. We have to start asserting our jurisdiction here, and 
we have to start talking about how we are going to do a broader 
oversight.
    If it makes sense for you guys to be consolidated into the 
agency that you are consolidated into, it makes sense for the 
Committee on Homeland Security to have broad and consistent 
oversight with the mission of the agency, and when we do not 
have that, we do not have a plan. We do not have oversight when 
we have not figured this out, and maybe there is ways to tear 
down these barriers between the committee chairs.
    I know that the House is trying a different kind of select 
committee or whatever method. Can any of you comment on the 
kind of authorization process that the House is going through 
and whether you think that is working to give you a more narrow 
focused point of contact on oversight?
    Ms. Duke. We agree. I cannot specifically comment on the 
House process, but we agree on the consolidation of authority, 
and we are hoping an authorization bill would be a step in that 
direction.
    What we see from this Committee is a holistic look. So when 
you talk about acquisition, for example, Senator, you talk 
about a program, but you also talk about the system. And the 
reason you are talking about the system is because of your 
Committee, and in others, they have just such a narrow slice, 
that we are not looking at the full system. And so I agree with 
everything you are saying.
    I know the House is trying to do a similar effort to 
consolidate some of the authority, and we think we would get 
more comprehensive oversight with a consolidation of 
jurisdiction.
    Senator Heitkamp. Right. I mean, you cannot force that. We 
have to assert jurisdiction here.
    But let us not pretend that we are going to get a broad 
reauthorization oversight capacity here with this kind of mixed 
jurisdiction, and so I really encourage this Committee to start 
asserting its jurisdiction and start talking about this as a 
problem.
    Chairman Johnson. We also cannot pretend that we are going 
to solve that problem overnight. It is going to require, I 
think----
    Senator Heitkamp. But, Ron, how old is the agency?
    Ms. Duke. It is 15 years.
    Senator Heitkamp. How old?
    Mr. Kelly. Fifteen years.
    Senator Heitkamp. Fifteen years. It is not overnight.
    Chairman Johnson. Oh, no. I realize----
    Senator Heitkamp. Let us quit pretending.
    Chairman Johnson. Pussy-footing around.
    Senator Heitkamp. Right. Let us quit pretending that 15 
years of dispersed jurisdiction here is acceptable and we have 
to wait longer. We have to get this problem fixed.
    Especially when you are going to get 25 billion extra 
dollars.
    Chairman Johnson. It is why we are, I think, recommending 
some kind of commission with highly respected individuals 
serving to point out we are literally putting our Nation's 
security at risk by having DHS so scattered in terms of--and 
answer the same question with different committees.
    Senator Heitkamp. Guess what? We had a commission. It was 
called the 9/11 Commission, and they told us what we should do.
    Chairman Johnson. I understand. Right. And Congress did not 
follow it.
    Again, we are on the same page here. We agree it is how you 
fix it. Senator Peters.

              OPENING STATEMENT OF SENATOR PETERS

    Senator Peters. Thank you, Mr. Chairman.
    I think I will follow on the theme of accountability, which 
has been a big part of the last two questioners, and that deals 
with some of the grant making that occurs within your agency. 
Certainly, tens of billions of dollars of money have been put 
out in various grants since 9/11, and certainly the taxpayers 
have a right to know whether that money has actually made us 
safer or not. And if it has not, then we need to make some 
changes accordingly.
    Mr. Kelly, I understand FEMA is currently reviewing the 
Threat Hazard Identification and Risk Assessment (THIRA), which 
is the process that agency and States use to undertake each 
year. Is it true that these THIRAs are not being currently used 
to drive grant allocations?
    Mr. Kelly. I will have to get back to you on that specific. 
I do not have that answer to you right now.
    Senator Peters. OK. So that would be important because I 
think we need to look at that, and my understanding is they are 
not, and yet they are making these assessments. At some point, 
they should get to the point where you actually have data, as 
was mentioned, the actual metrics to be looking at before 
grants are provided.
    Mr. Kelly. Conceptually, I would agree with you on that, 
but I cannot give you the actual answer right now to that 
question.
    Senator Peters. Great.
    Mr. Scott, related to that, does the language in the draft 
legislation require assessments and information? The State 
prepared its reports in the THIRA. Do they have the potential? 
I know you have looked at that issue. Do you believe that they 
have----
    Mr. Scott. I am not exactly familiar with that.
    I will call on my colleague, Chris Currie.
    Chris, do you have any responses?
    Mr. Currie. Yes, Senator Peters.
    So, in general, the House bill does essentially what we 
have been recommending for over a decade, which is encourage 
FEMA to better assess from year to year the effect of the 
preparedness grants.
    You mentioned the THIRA process. FEMA does use that, but 
that is mostly developed by the State, and then FEMA relies on 
the State's assessment.
    So what we do not know year in and year out is how these 
grants are making us safer and building our capabilities. So, 
in short, we do not know what our investment of $50 billion 
over the last 15 years is really buying us year in and year 
out.
    Senator Peters. Well, that is pretty troubling. If we do 
not know what $50 billion has actually bought us, what would be 
your recommendation?
    Mr. Currie. Well, what we have been saying for over a 
decade now is that FEMA needs to come up with its own 
quantitative measure year to year of how these preparedness 
grants are building our capabilities, and that is what is not 
being done now. And that is what we would like to see.
    And I think another important point is with all this 
investment on preparedness and pre-disaster grants, it is not 
clear what the impact is on the post-disaster side because that 
is exploding. We are spending more and more very year on that 
too.
    So right now, it may not be buying down the cost on the 
back end either post disaster.
    Senator Peters. Great. Thank you. I appreciate that.
    The question also back to Mr. Kelly and Mr. Scott, there 
has been proposals to consolidate some of this grant process, 
which his right now really fragmented. Has the OIG or the GAO 
done assessment as to whether the action of consolidation would 
increase the efficiencies in these programs and perhaps also 
better align them to national priorities? Is that something you 
have looked at?
    Mr. Kelly. We have not initiated a review in that area. We 
have been looking at some of the preparedness grants, and we do 
a lot of work on the disaster assistance grants. We have 
identified a number of challenges that exist.
    We sent actually Chairman Johnson and Senator McCaskill a 
letter in June making suggestions on how FEMA can improve their 
structure and oversight of the disaster assistance grants. 
There were a number of legislative proposals, administrative 
changes in that proposal.
    Senator Peters. OK. Mr. Scott.
    Mr. Scott. Well, to the extent that across various grant 
programs, there are opportunities to harmonize requirements, 
opportunities to streamline reporting requirements. There is 
always opportunities, I think, to wring out additional 
efficiencies, both in the grant-making process, but also in the 
grant administration process. So, as a matter of practice, I 
think to the extent that actions can be taken to streamline 
grant making, I think that is generally a positive thing, as 
long as that goes with the necessary oversight of the grants. 
It is important not just to get the money out the door but to 
make sure we have the necessary oversight mechanisms in place 
to ensure the grant money is properly spent.
    Senator Peters. Great. Thank you.
    Honorable Elaine Duke, a question for you related to 
cybersecurity. When we are dealing with cyber-threats, really 
the challenge is making sure that we are hardening the weakest 
link because the bad guys are always looking for the weakest 
link. And my concern is that although the Federal Government 
certainly has a lot to do to strengthen our cybersecurity 
efforts, I am very concerned about State and local governments 
that simply do not have the same kinds of resources that we 
have here at the Federal level and are certainly that weak link 
in the overall system.
    I am working with a colleague of mine in a bipartisan way, 
Senator Perdue, to look at ways in which we can get the 
Department of Homeland Security to work with State and local 
governments that are voluntarily asking for assistance and 
expertise within your Department. If you could talk a little 
bit about what you believe we can do from the Department to 
help State and local governments and if there are any specific 
actions we should be taking here in the Committee to assist you 
in your efforts.
    Ms. Duke. Yes. Thank you, Senator.
    We agree that State and locals can be assisted by the 
Federal Government on a voluntary basis. We also think the same 
for critical infrastructure segments. That the Federal 
Government can play a role in the integration, not in an 
involuntary way.
    I think the NPPD, the Cybersecurity Agency Act will help 
with that, and what we are looking at is we already have 
deployed tools. That is the number one thing that we can do, is 
let State and locals, let critical infrastructure use some of 
the tools that we have deployed. That could be done more. We 
are looking at that.
    We are doing evaluations. The election subsector is an 
example of when asked, we are going out and doing risk 
assessments of structures for the State governments or the 
local governments.
    We think the collaboration--what we are looking at 
overall--and then training is another area. We are giving 
training, and then we have pre-position protective security 
agents (PSA), put PSAs throughout the jurisdictions to do 
onsite assist and help and remediation, and those are NPPD 
Federal employees that are out there.
    We think more needs to be done in this area. We agree. And 
one of the things with the NPPD Act, we think it would do that 
by having critical infrastructure and cyber and realizing that 
cyber is a cross-cut across everything. It is not a stand-alone 
function.
    Senator Peters. Great. Thank you.
    Chairman Johnson. Senator Peters, one thing we do know 
about FEMA grants, the State and local governments love them. 
So combine that with the fact that we do not know whether they 
are really actually working, it definitely is a concern. 
Senator Portman.

              OPENING STATEMENT OF SENATOR PORTMAN

    Senator Portman. I would like to piggyback on that cyber 
issue because one of the questions I wanted to ask was about 
workforce. As you know, back in 2014, we wrote bipartisan 
legislation--this Committee strongly supported it--to upgrade 
your abilities in the cyberspace, very concerned about the lack 
of retention and also being able to attract top-flight talent.
    That was 3 years ago. We asked that the GAO do a report 3 
years out.\1\ I am pleased to say, Mr. Scott, that we got the 
report just a few days ago, which is great. I saw it for the 
first time last night, and your report basically says that DHS 
has missed all kinds of deadlines.
---------------------------------------------------------------------------
    \1\ The GAO report referenced by Senator Portman appears in the 
Appendix on page 71.
---------------------------------------------------------------------------
    So I understand the need to help State and local. I 
understand the need to harden our own, but if we do not have 
the personnel to do it, it makes it incredibly challenging.
    So just quickly, Mr. Scott, tell us what are your specific 
recommendations right now as to how we get DHS back on track 
and begin to attract this workforce we need.
    Mr. Scott. Thank you, Senator Portman.
    As you mentioned, just yesterday, we issued a report really 
highlighting the urgent need for the Department to take 
additional steps to identify its cybersecurity positions and 
critical skill requirements.
    In summary, then Department has made some progress 
categorizing and signing certain codes to some of its 
cybersecurity positions.
    There are some concerns with the accuracy of some of the 
information they provided. For example, I think they estimate 
about 95 percent of the positions were identified. We came in 
and did an analysis and found it is really around 79 percent 
because the Department basically excluded some of the vacant 
positions. They did not count those in the math.
    We made six recommendations, including for DHS to enhance 
the procedures around identifying these vacant positions, 
improving the workforce data, and developing specific plans to 
identify and report on the critical cyber needs.
    The Department concurred with all six of the 
recommendations, so our expectations within the next 2 years or 
so that they should be further along in addressing some of its 
critical cyber workforce needs.
    Senator Portman. That is great.
    Ms. Grady and former Secretary, Acting Secretary, and now 
Deputy Secretary Duke here, one of your recommendations was to 
have accountability; in other words, have someone responsible 
for every component. And I think that is something that you two 
should focus on, given your management responsibilities.
    Second, I was involved in 2002 in the legislation that 
created the Department, as some of you know, and I have 
wondered sometime since then whether we have created a 
behemoth, something that is just too difficult to manage.
    But having said that, the risk that we face in an 
increasingly dangerous and volatile world, I think require us 
to have one agency to just focus on keeping it safe, and at the 
time, we did try to align the Committee structure with the 
Department, unsuccessfully.
    Again, in a 9/11 report, this was talked about, but I agree 
with what the Chairman and other colleagues have said about 
that, is that it is difficult for you. And the Chairman talked 
about the number of testimonies you have had to give over the 
last year and the inability for you all to focus on your core 
function because you are dealing with so many different 
committees and subcommittees.
    So I do think it is a good idea, Mr. Chairman, and the 
first step in it is to have an authorization from this 
Committee because we have the bulk of the jurisdiction, and if 
we are not taking that jurisdiction seriously and ensuring that 
we do have authorizations, we are going to continue to have 
even more erosion of that responsibility.
    So this is good. We tried this back in 2011. Susan Collins 
and Joe Lieberman tried it. We were able to get it out of 
Committee. We were never able to get it across the floor, and 
so I am glad you are doing this. And this authorization, as I 
understand, is going to be a little more narrow, to try to 
avoid issues, and I hope we can do this in a bipartisan basis 
as kind of the first step toward a much broader issue here, 
which is how do you manage this Department that has so many 
different siloes, as Mr. Kelly said earlier, and make it work 
better as a single entity. And this will help.
    On oversight, I have to raise, as Chairman of the Permanent 
Subcommittee on Investigations, you all have not been 
responsive in a few of our requests, and we push. We write 
letters, but let me just give you three quickly.
    One is way back in April 2017, we asked some questions 
about the management of the Chief Information Officer (CIO), 
and I am not going to get into the details because we do not 
make these investigations public typically until we report, but 
we need that information. We have been given a minimal amount 
of documents, most of which are not at all responsive to the 
request, so need help there.
    Second is back in December, we asked about your privately 
run immigration detention facilities. Again, not to get into 
the details, but we need that information, and you guys have 
not been responsive. You have not produced any documents. We 
have made phone calls. We have sent emails, status updates. We 
need that information. That is back in December 6.
    Then finally, in January of this year, just a couple of 
weeks ago, we asked you guys for information on the procedures 
to protect unaccompanied alien children. You remember we had 
this hearing and a report on this topic and deep concern about 
the lack of accountability. This was with Senator McCaskill and 
myself. We were simply looking for what we were told at the 
time you all were doing, which was a memorandum of agreement 
that you were going to have between the Department of Health 
and Human Services (HHS) and DHS. We were told that would be 
done a year ago almost, February 22, 2017. You still have not 
done it. So we need to figure out a way to get that information 
to us, figure out why you have not accomplished that, and what 
we can do to push DHS and HHS to get that memorandum of 
understanding to protect these kids.
    So on all those issues, can I get a commitment from you all 
today? I will not ask for 2 weeks. I am going to be much more 
generous. I will ask for 4 weeks, but we need to have a 
response.
    Ms. Duke. I apologize, Senator. I was not personally aware 
of that, and I do commit that to you. I will give you, this 
Committee, an update next week on all three and a timeline for 
getting you that information.
    Senator Portman. OK.
    Finally, Mr. Chairman, this is going to be my last point. 
With regard to the hearing and report from last week on the 
fact that dangerous chemicals, synthetic opioids are coming 
into our country through our own U.S. mail system and your 
Customs and Border Protection people are not able to stop it 
because they do not have the information, but we need to pass 
the Synthetics Trafficking and Overdose Prevention (STOP) Act.
    My colleagues, for the most part here, are cosponsors of 
that and I think would agree with me, but we also asked for 
some other things in that report, which is that DHS work better 
with the Chinese government to shut down these labs, to stop 
the shippers, to deal with it in China.
    And I know you were along with Attorney General Sessions at 
a session on this broader issue of security issues with China 
last year. Can you tell us what has happened with regard to 
China and their willingness to help us to stop this poison 
coming into our communities by stopping it at the source?
    Ms. Duke. We have made progress with China. The biggest 
thing is that the percentage of packages that we can track, 
which is key to shutting it down, has over doubled, and we are 
making more progress. We need to be able to track all of them, 
but the Chinese government has been very cooperative in that.
    Senator Portman. It has not been very cooperative?
    Ms. Duke. They have been very cooperative in being able to 
track packages.
    Senator Portman. How have they been cooperative?
    Ms. Duke. They are helping us institute a tracking system 
with the mail service. We do not have a mail service tracking 
system in the United States, and there is not an international 
one. So we have very good tracking of like Dalsey, Hillblom and 
Lynn (DHL), United Parcel Service (UPS), and Federal Express 
(FedEx).
    Senator Portman. You have 100 percent tracking there 
because we require them to do it, and we should require the 
post office to do the same thing, but only half the packages 
coming in of that increased volume admittedly from China has 
that kind of advanced electronic data on it. So they are not 
there yet, just so you know.
    And my goal is not just to have that tracking information, 
which is very important and that is what the STOP Act focuses 
on, but how do you actually get China to do what they say they 
want to do, because after our hearing in this committee room, 
the Chinese government official spokespeople said, ``Yes, we 
want to cooperate more with the United States.'' To me, that 
was an extension of some kind of an olive branch to you all to 
get with them and to begin to crack down, not just to have the 
codes and to have the information, but to actually stop these 
labs.
    There are thousands of them in China. We know that. They 
are creating this poison that is coming into our community and 
to begin to prosecute some of these people who are involved.
    We have two indictments. They have yet to arrest these 
individuals that we have indicted over here who are Chinese 
nationals. So my question is what more can we do on that front, 
and what have you done?
    Ms. Duke. I mean, we have been working with them regularly 
in terms of--principally through the Department of State in 
terms of working with China, but it is not just a China 
problem. We have an opioid conference going on now in Miami 
that I leave for tonight to look at how we can do enforcement.
    As you know, it is hard to discuss everything in this 
environment, but the transit to some countries, we are looking 
at that, and stopping it not only in China but the transit, and 
then also the President's council on trying to do the 
deterrence for opioids.
    So we support the STOP Act. We are hitting it from many 
angles. It is a challenging problem.
    Senator Portman. Yes. Well, we could go on and on, but I 
would just say your own people tell us that primarily in our 
own mail system and primarily from China right now and 
understandably there is a lot of transshipment going on and 
maybe even some new routes that are being developed, but we 
know we have a huge issue here. It is the number one killer in 
my home State of Ohio. Now 60 percent of overdose deaths this 
last year were from fentanyl and carfentanil.
    So thank you for pushing the Chinese more on helping to 
stop this at the source.
    Chairman Johnson. Thank you, Senator Portman. Again, you 
are doing great work on that. Senator Hassan.

              OPENING STATEMENT OF SENATOR HASSAN

    Senator Hassan. Thank you very much, Mr. Chairman, and 
thank you all for being here today.
    I will just add to what Senator Portman said. Enforcement 
deterrence on fentanyl coming into the country is obviously 
important. So is treatment so that we can reduce the demand in 
this country for opioids, so if you would take that back to 
your colleagues throughout the Administration. We cannot arrest 
our way out of this. We have to do everything to get out of 
this, and we would love the Administration's help.
    Secretary Duke, I wanted to just start. I have three areas 
to explore this morning. You talked about election securities, 
critical infrastructure, and I wanted to ask you to please 
share with us in more detail the scope of activities that DHS 
has undertaken to help secure our Nation's election 
infrastructure. What specific actions has the Department taken 
in 2017 and 2018 to advance the mission?
    Ms. Duke. And I will have Chris come up to the table to get 
into more specifics, but principally, we are doing assessments 
of the systems, as requested by the State and local 
governments.
    We have also made available our Systematic Alien 
Verification Entitlements (SAVE) system for checking rosters, 
but on the critical cybersecurity side, it is principally 
focused around assessments.
    And I think you all know Chris Krebs.
    Mr. Krebs. Good morning, ma'am.
    Senator Hassan. Good morning.
    Mr. Krebs. Senior Official performing the duties of the 
Under Secretary for NPPD.
    Senator Hassan. Can you say that again? [Laughter.]
    Mr. Krebs. Hoping to change that.
    Chairman Johnson. Faster.
    Mr. Krebs. Three principal lines of effort: information 
sharing, technical support, and incident response planning.
    On the first line with information sharing, we are working 
closely with the Multi-State Information Sharing and Analysis 
Center, which has direct relationships with State and locals, 
to provide best practices, information on strategic and 
targeted risks to election infrastructure, but also providing 
security clearances to State and local officials.
    Senator Hassan. That was going to be my next question.
    Mr. Krebs. Yes, ma'am.
    Senator Hassan. So you are working to ensure that State 
election officials have the appropriate security?
    Mr. Krebs. And we have kicked off that line of effort. We 
have a number of the 50 senior election officials, where about 
37 into at least getting into the interim----
    Ms. Duke. And just adding to that, on clearances, while we 
are making progress on the longer clearances, we are giving 1-
day clearances as an interim gap.
    Senator Hassan. And are you working to provide election 
officials with access to Sensitive Compartmented Information 
Facility (SCIF)?
    Mr. Krebs. Yes, ma'am. That is part of the relationship 
with the Federal Bureau of Investigation (FBI). We are not 
going to give them SCIFs, but we are going to coordinate ways 
that they can come into SCIFs, whether here in DC. or in their 
local offices.
    Senator Hassan. OK. And are you working to ensure that 
State election officials are coordinating with both the State's 
homeland security advisor and the State's chief information 
officer?
    Mr. Krebs. Yes, ma'am. So, as a part of every State, in the 
learning experience over the last year, rather, we have come to 
understand that there is essentially a triumvirate per State, 
and you have just highlighted--the senior election official, 
the State CIO, and the homeland security advisor. And so each 
State has a bit of a different arrangement, particularly on the 
senior official side; we are developing separate and individual 
information sharing protocols per State.
    Senator Hassan. OK. I may follow up on this a little bit 
with Mr. Scott and Mr. Kelly about your own assessment about 
whether DHS is doing enough, but I want to, just because of 
time, move on to a couple of other issues. And then we may be 
able to talk some more about that.
    To Secretaries Duke and Grady, I would like to touch upon 
an initiative being spearheaded jointly by the DHS Office of 
Intelligence and Analysis and DHS's Chief Information Officer.
    As I understand it, the DHS Data Framework Initiative is 
the Department's effort to unify your disparate datasets under 
one technological architecture in order to enhance DHS's 
ability to identify terrorist threats in our travel system.
    As I understand it, our existing framework is still in its 
initial phase of development, but it promises to bring 
important capabilities to DHS analysts in their effort to try 
to keep out foreign fighters and those who wish to do us harm.
    Can you describe for us the value of the DHS Data Framework 
project and the priority the Department places on this 
initiative?
    Ms. Duke. I cannot tell you how strong, and it is a top 
priority.
    The Data Framework is essential for moving forward against 
terrorism, TCOs, drugs. So what it does, it does several 
things. One is a systems issue at kind of the pipes area. The 
second is we are looking at better communicating between law 
enforcement-sensitive and intelligence information and also 
coordinating intelligence.
    Under Secretary Glawe has a major initiative as part of 
this data network to really be the Chief Intelligence Officer 
of the Department. It is part of the overall Unity of Effort, 
and that is going to be helpful, but then also not just having 
intelligence, but having intelligence communicate with law 
enforcement at the law enforcement-sensitive level.
    And the timeliness and the accuracy, things are moving at 
lightning speed and especially with something like a 
radicalization. We do not have the years of tracking a criminal 
anymore. We are all focused on this. It requires management 
from the pipe standpoint, me from a leadership and Under 
Secretary Glawe.
    Senator Hassan. Well, certainly, there are those of us who 
want to support you in the effort, and I would look forward to 
working with you on that.
    I had one other issue, and maybe--I assume we are going to 
get some other questions. I see it, Mr. Chair.
    But you have been talking about the NPPD change and wanting 
to put cybersecurity kind of into the title. I am a little 
concerned that cybersecurity is more important than that, and I 
am wondering what authorities would an independent operational 
cybersecurity component need to retain from NPPD in order to be 
successful and would any of NPPD's non-cyber functions suffer 
if the cybersecurity mission was pulled out and turned into an 
independent DHS component.
    I am over time. If you want to give a very brief answer and 
then work it into the rest of the discussion on this, that 
would be great.
    Ms. Duke. I think that the NPPD reorganization and name 
change is not just a name change. It does come with the 
authorities and the Under Secretary.
    I do think that cyber and critical infrastructure together 
work well. We can talk more about that.
    Senator Hassan. All right. Thank you.
    Chairman Johnson. Senator Lankford.

             OPENING STATEMENT OF SENATOR LANKFORD

    Senator Lankford. Thank you, and thanks to all of you. I 
know we have lots of questions we are peppering you with, but 
it was interesting that we bring all these issues. And some of 
this is 15 years of pent-up energy and of questions, but for 
GAO to begin a report, which GAO typically brings us all the 
bad news first, and GAO led with there is a lot of good news 
here. And there is a lot of things that are changing and making 
those adaptations.
    We had hearings just 2 years ago talking about the HR 
system and about how difficult this has been for DHS, and now I 
am hearing that the numbers are changing as far as the time 
period for hiring.
    It used to be for Customs and Border Patrol, it was about 
350 days-plus. It got up close to 400 days for a while to be 
able to hire one agent. Where are we now in that process?
    Ms. Grady. So those numbers are definitely coming down, and 
the other thing that we look at is the number of applicants. We 
need to hire a single person, and that number was well into 
triple digits. We have that now into double digits, which is 
still way too high, but using a combination of streamlined 
processes, meaning combining multiple steps in a single site at 
a recruiting event and other actions that we have taken, we 
have been able to drive that down. It is still too long.
    One of the things that we are looking at is we have been 
keeping the numbers as a complete average on a metric. In some 
cases, an individual can be an extreme outlier with 800 days. 
That is literally the worst I have seen. So we are looking at 
what is the average for, say, the 80 percent so that we do not 
have outliers driving the metric.
    It is headed in the right direction, not as fast as we 
would like. It continues to be a focus, and I meet with the 
head of Human Capital and the Chief Financial Officer (CFO) for 
each of the components that have hiring challenges and mission-
critical operations to track that number.
    Senator Lankford. That is something that Senator Heitkamp 
and I have worked on a lot, and it is something we are still 
committed to be able to work on. If there are specific 
legislative requests that you have for that, we need to know, 
and so we can help work through that process.
    There are 120 different hiring authorities that are sitting 
out there. It is a complicated mess to be able to go through 
the process.
    If there are things that you see--we are doing our own 
work, but if you see things, we are glad to be able to hear 
those as well.
    Ms. Grady. We appreciate that, sir.
    Ms. Duke. Senator Lankford, we do have a couple. One would 
be expanded authority to waive polygraphs; for instances, for 
local law enforcement that have been cleared and we can give 
you more detail and also some expanded hiring authorities.
    We would like to be a delegated special hiring authorities 
similar to Department of Defense, and I can articulate those 
for you or your staff to be able to do some flexibilities 
without having to ask permission.
    Senator Lankford. OK.
    Chairman Johnson. I will stop your time. Talk about the 
polygraphs because in talking to CBP, there have been 
improvements there, and it is more streamlined. We are not 
rejecting so many, but still, I think getting the good 
information.
    Ms. Duke. Right. First of all, we went to the FBI to get 
some best practices and time and the types of polygraph they 
do. We changed the type of polygraph, and it has been still 
effective, but it has pushed up the numbers.
    Additionally, we were looking for the ability to waive on 
certain classes of low-risk people, and that would include 
local law enforcement. We have the DOD with current top secret 
(TS) clearances. Those type of things would be helpful. That 
does tend to be longer.
    I think the all-in-one hiring that Mr. Grady talked about 
is really helpful, but expanded ability to waive would be good.
    Senator Lankford. Mr. Scott, you were going to mention as 
well?
    Mr. Scott. Yes. I just wanted to make the Committee aware, 
we do have some ongoing work currently looking at the 
challenges the Department is facing in terms of border patrol 
agent hiring, and we anticipate reporting out on that later 
this year.
    One of the things I would also caution, though, is that it 
is important to really understand the root causes, both in 
terms of what is preventing you from hiring the right people 
and targeting them initially, but also the need to sort of 
balance the goal of hiring additional agents and making sure we 
are not in some way potentially compromising the quality----
    Senator Lankford. Right.
    Mr. Scott [continuing]. Of the agents we are getting.
    And I know that is something--I am sitting here right next 
to Claire. I know it is something they are well aware of, but I 
think it is really important to emphasize. Having a goal to 
hire more is one thing.
    Senator Lankford. Right.
    Mr. Scott. Having a process to make sure you hire the right 
people is a totally different thing, and I want to make sure 
that balance is not lost in the rush to hire additional agents.
    Senator Lankford. And I would completely agree with that, 
and I do not think there is anyone at this table that would 
disagree.
    Mr. Kelly. If I could add an additional area that they have 
a challenge in, and that is once they hire them, promptly train 
them, and having the facilities available to provide the 
training to those individuals.
    Senator Lankford. Is there a specific need that you see 
already at this point on the location and facilities for 
training?
    Mr. Kelly. We are doing some work that is identifying 
limitations and their ability to train the individuals that 
they are hiring.
    Senator Lankford. Will there be recommendations attached to 
that as well?
    Mr. Kelly. Yes.
    Senator Lankford. OK. When will we get that?
    Mr. Kelly. I cannot give you a hard date.
    Senator Lankford. Try.
    Mr. Kelly. July.
    Senator Lankford. July?
    Mr. Kelly. Yes.
    Senator Lankford. OK. That is great.
    Ms. Duke. And, Senator, also in Secret Service, there are 
training constraints. That is a critical path, and we are 
working on expanding the facilities for Secret Service also.
    Senator Lankford. OK. How much facilities sharing can we 
use? Obviously, there is a lot of law enforcement training 
facilities nationwide that we have that are Federal facilities. 
Are there any of those that we can share facilities?
    Ms. Duke. Yes. The Under Secretary can talk more, but we 
are looking at not only facilities, but--for initial training, 
but shooting ranges and those type of facilities for 
consolidation.
    Ms. Grady. We have explored things like mobile firing 
ranges to allow people to attain certain proficiencies and 
maintain that, and we are looking at available facilities 
across Federal and local to make sure that we are taking full 
advantage of what is available rather than duplicating.
    Senator Lankford. Yes. Again, there is no reason to rebuild 
something that already exists.
    Let me just make a couple of quick comments with this as 
well. One is for Senator Hassan's comments on cybersecurity, 
specifically related under our elections, Senator Harris and I 
have done a lot of work on this. I was very pleased to be able 
to hear your answers of the cooperation.
    It is one of the frustrations that we had in going through 
this, was how long it took after the last election for 
individual States to even be notified, and the common answer 
was ``We do not have any one with clearance,'' ``We do not have 
any method to do that.'' So to hear you are proactively 
pursuing that is very helpful to know. That is something we are 
trying to put into legislative language to make consistent from 
here on out that there is that ongoing cooperation.
    So to Chris and what you had mentioned before and for you 
all, thank you for doing that. We are going to continue to be 
able to work cooperatively with you because we think that is 
exceptionally important.
    And I can just make this one comment here for Senator 
McCaskill as well. As this whole table so far has talked about 
metrics, I am very pleased to hear that. This Committee passed 
out unanimously a bill that Senator McCaskill and I have called 
the Taxpayer's Right to Know that works on identifying the 
metrics and programs and what is out there. It has come under 
this Committee unanimously. It is not across the floor, and if 
any way we can get that done, that will help us all. It is a 
nonpartisan bill on basic transparency on it, and we are 
looking forward to being able to get that done.
    Thank you, Mr. Chairman.
    Chairman Johnson. Senator Harris.

              OPENING STATEMENT OF SENATOR HARRIS

    Senator Harris. Thank you, and I could not agree more, 
Senator Lankford, and I thank you for your leadership on those 
points.
    Secretary Duke, I have to tell you I was a bit troubled by 
the exchange you had with Senator Portman when he asked if you 
were familiar with the requests that he as a member of the U.S. 
Senate has made to your Department, and you were not personally 
aware. I would imagine that before you come to testify before 
the U.S. Senate, you would have done an inventory to find out 
if there are any requests that have come in, what is the status 
of those, and have they been answered.
    On the issue of election, cybersecurity, as you know, the 
midterm elections are coming. They are around the corner. In 
fact, in Texas, I believe that voters will go to the polls on 
March 6, and while DHS has provided a risk and vulnerability 
assessment to some States, other States remain on a long 
waiting list, I am told, the waiting list being as long as 9 
months.
    And I would like to know what is your timeline for getting 
these done.
    Ms. Duke. OK. Chris will talk about the specific timeline, 
but we have made measures in terms of both prioritizing and 
making the list short.
    Senator Harris. Can you give me a date by which it will be 
done?
    Mr. Krebs. So, first off, starting with the 9-month wait 
list, that is actually probably about 6 months old, and in 
fact, what we have done is we have reprioritized. That is the 
benefit of the critical infrastructure designation, I can take 
election infrastructure and put it at the top of the list.
    Senator Harris. Great.
    Mr. Krebs. So we have done that.
    Senator Harris. When will they get done?
    Mr. Krebs. So we have conducted five. We have another 10 or 
11 in the hopper, ready to schedule through probably about the 
beginning of April.
    The dependency here is whether we get requested for risk 
and vulnerability assessments. There are States--South 
Carolina, for example--that has the capacity to conduct their 
own technical assessment of the security of their networks.
    So while some States have their own abilities, we are 
focusing and doing a lot of awareness on those States that need 
additional help, so that is what we are focused on right now.
    Senator Harris. How many? How many States have requested 
that it be done?
    Mr. Krebs. At this point, as I mentioned, five have been 
done. Another 11 are in the queue.
    Senator Harris. So my question is, how many States have 
requested?
    Mr. Krebs. Sixteen.
    Senator Harris. Sixteen.
    Mr. Krebs. Yes, ma'am.
    Senator Harris. And when will all 16 be completed?
    Mr. Krebs. My understanding of the scheduling, probably 
about mid-April.
    Senator Harris. Do you have a date certain?
    Mr. Krebs. I do not have an April 15 or anything like that, 
but April is the timeline for completing the requested.
    And my hope is that we have more come in and over the 
course of the next several weeks, in fact, but we will 
prioritize----
    Senator Harris. But where is Texas on that list since their 
primaries are March 6?
    Mr. Krebs. I would have to get back to you on that. I do 
not have that information.
    Senator Harris. OK. I would want to know that you are aware 
of the 16 States at least and what their dates are for their 
primary----
    Mr. Krebs. Yes, ma'am.
    Senator Harris [continuing]. And that it would be your goal 
to have their assessment complete before their primaries 
actually occur and before those voters go to the polls.
    Mr. Krebs. Yes, ma'am.
    Senator Harris. And I am concerned that you do not know the 
timeline. Given that we have unanimous consensus among our 
intelligence community that Russia interfered in the election 
of the President of the United States, it would seem to me that 
this would be a high priority for the Department of Homeland 
Security, and you would be clear about the timelines.
    I have other questions. Part of my understanding is that 
the delay in processing these requests are that you do not have 
skilled workers to complete the scans. Is that correct, or is 
that not the problem? I am trying to understand what the 
problem is with the delay.
    Mr. Krebs. Ma'am, the delay is that the risk and 
vulnerability assessment capability is also servicing other 
critical infrastructure sectors and in fact also Federal high-
value asset assessment.
    So what we have done is put at the top of the pile the 
State and local election officials right now. So we have 
deprioritized others and put those at the top.
    With more, I can do more. So we are looking at ways to 
increase training, to bring additional personnel on, and also 
there is an equipment requirement that we are procuring new--
additional equipment.
    Senator Harris. So if we can be a little bit more precise, 
do you have the necessary personnel and funding and other forms 
of resources to provide the States with their request and get 
this completed in a timely manner?
    Mr. Krebs. For those that have requested right now, we have 
the capabilities to conduct, as I mentioned, on the existing 
timeline.
    Senator Harris. Great. How many State election officials 
have applied for security clearances?
    Mr. Krebs. At this point, I believe it is 37 have submitted 
their paperwork. We have one final secret issued. We have about 
17, I believe, interim secret. This changes on a daily basis. 
Again, the opportunity to do daily 1-day read-ins on any issue 
that might come up, and in fact, we are going to do a number of 
briefings over the course of the next couple weeks for State 
election officials.
    Senator Harris. So those daily 1-day readings----
    Mr. Krebs. One-day read-ins, yes.
    Senator Harris [continuing]. Mean that if you wanted to 
have some consistent information about what is happening, you 
would have to call in every day to get a 1-day reading? Is that 
what you are saying?
    Mr. Krebs. It depends on the bulk of the information and 
the intelligence that we want to share, but it would require me 
to either be in person with those folks or have local 
intelligence officials read them in that day.
    Senator Harris. That seems extremely bureaucratic.
    Mr. Krebs. Of course. That is the reason----
    Senator Harris. And they are not in agreement.
    Mr. Krebs. Yes, ma'am. And that is the reason we are----
    Senator Harris. So the goal, then, is to get them 
permanently receiving their security clearance?
    Mr. Krebs. Yes, ma'am. In fact, not just the senior 
election official in the State, but also additional staff. So 
we are at the point right now of one senior election official 
per State and two additional staff with security clearances.
    Senator Harris. So what percentage of those that should 
receive security clearances to completion, completing that 
process, have actually received those clearances?
    Mr. Krebs. The percentage, I do not have percentages in 
front of me.
    Senator Harris. About what number?
    Mr. Krebs. I think we are probably at about a 30 percent 
rate for the 50 senior election officials, and that is 
including an interim secret level. And an interim secret gets 
you effectively the same access as a permanent secret, but we 
have prioritized, again, this process of vetting and issuing 
the clearances. And we will continue to do so in advance of the 
2018 election.
    Senator Harris. So let us just keep going with Texas as the 
example. March 6 is their primary. Have they received their 
security clearance?
    Mr. Krebs. Ma'am, again, I would have to come back to you 
on the specifics of Texas. Every State has----
    Senator Harris. OK. Please respond to this Committee and 
give us a precise timeline on when they will be completed, and 
we would like to see on that timeline when each of these States 
are actually conducting their primaries to see if you are going 
to actually get this done by the time people start voting.
    Mr. Krebs. Yes, ma'am.
    Senator Harris. Thank you.
    I have nothing else.
    Chairman Johnson. Chris, do not go away. Let me just follow 
up.
    I remember in 2016, I think one of the problems was just 
identifying who to contact in the States, and so the question I 
have for you, have we identified in every State the individual 
or individuals that do need to be identified that can 
effectively handle whatever information you provide them?
    Mr. Krebs. And that is what I mentioned earlier. We have an 
individual State-by-State protocol for notifying, whether it is 
a State commissioner of elections or a Secretary of State. So 
we are working through those individual processes right now. 
Each State will have, as I mentioned that kind of triumvirate 
of----
    Chairman Johnson. Again, my question is, do we have those 
individuals identified for every State?
    Mr. Krebs. Yes, sir.
    Chairman Johnson. So now just going through the protocol of 
getting them security clearances?
    Ms. Duke. Yes. We have them identified.
    Chairman Johnson. OK. I want to make sure we at least 
cleared that hurdle. Senator Jones.

               OPENING STATEMENT OF SENATOR JONES

    Senator Jones. Thank you, Mr. Chairman.
    I want to go talk a little bit about the budgeting. I have 
been really kind of focused on budgeting lately with all these 
continuing resolutions (CRs). Obviously, it is kind of an 
unusual situation with somebody sworn in as a U.S. Senator and 
we immediately start shutting down the government with things, 
and that has bene a concern, budgeting, I heard during the 
campaign.
    We have heard Secretary Mattis being pretty focal about the 
Defense Department and the negative effects that these CRs have 
on defense. Do you see that with Homeland Security? Is that a 
problem? And if you could outline the effects that some people 
call it crisis budgeting. Some people call it hostage 
budgeting. Whatever it is, from just kicking the can down the 
road, can you address that a little bit?
    Ms. Duke. Shutdowns are disruptive. I will start with our 
employees. We have 240,000 employees that go through a period 
where they are not sure if they are going to get paid or those 
that must come to work have to come to work and others do not 
and probably still will get paid after the fact. So there is a 
true employee issue.
    We have to focus on the mission, and because under a CR or 
a shutdown, you are at last year's level, it constricts us in 
adapting to priorities, and we cannot do new starts. So if any 
emerging need comes up, we cannot address it because we cannot 
start something new. In a mission area so dynamic as homeland 
security, that is very constricting.
    It also, like the jurisdictional issue the Chairman talked 
about, is disruptive. Our new Under Secretary has spent quite a 
bit of time with planning and reacting to shutdowns. It is 
administratively a huge burden that distracts from the mission.
    Ms. Grady. It is also a huge burden operationally because 
you are operating under a continuing resolution. You do not 
know with certainty what your budgets are going to be for the 
next year. You have the problem with any new starts that you 
cannot begin. We are in the middle of the second quarter of the 
fiscal year without a full budget telling us what we have for 
the year.
    So in terms of operational planning, in terms of moving out 
on important hiring efforts, in terms of important 
acquisitions, we are hamstrung until that gets resolved, and 
that has a ripple effect throughout, especially when you try 
and compress spending of very important resources for very 
important capabilities, and then it is now in a compressed 
period of time potentially.
    It has a huge operational impact. It adds administrative 
burden, and it is just difficult to operate, especially a 
number of short-term CRs.
    Senator Jones. Does it add cost, administrative cost and 
other cost?
    Ms. Grady. It absolutely does because you enter into short-
term decisions or short-term bridges, or you make short-term 
decisions to accommodate what you have from a financial 
perspective that you would not make if you had the full budget 
available at the beginning of the fiscal year.
    Senator Jones. Right.
    Ms. Duke. The Ranking Member mentioned acquisition, which 
is always a high interest for all of us.
    The Federal Government traditionally spends too much in the 
fourth quarter anyway, and these short-term CRs push it even 
further into awarding quickly in the fourth quarter and 
spending maybe not in the most judicious ways.
    Senator Jones. OK. Not to bring up probably a sore subject, 
but this past week, a CNN reporter found some pretty sensitive 
documents in the back of an airplane, which could have 
jeopardized a lot of things. What happened, and what all was 
found? And what can be done to stop that? That was a pretty 
serious breach, in my opinion.
    Ms. Duke. Yes. The actual leaving of the documents, we will 
be handling under a personnel matter, similar to anything else 
that is a breach of our responsibilities of our employees. We 
will handle it that way.
    In terms of the material and the documents, that is 
something we are working on. It is old information. It is what 
we tend to call a hot wash of what we see and what we are 
looking forward to, but that will be handled in our personnel 
system.
    Senator Jones. Is there anything that can be done in this 
to try to stop that? Are you looking at ways to try to figure 
out how to keep that?
    I know that may be an isolated incident, but still it could 
be a pretty serious isolated incident.
    Ms. Duke. Yes. I mean, protecting both for official use 
only and classified information is very important, and just 
reiterating it, I think that this is a reminder to all 
employees when they hear about it of how careful we have to be. 
An important responsibility of being a civil servant is 
protecting that.
    Ms. Grady. So a slightly bigger response to that question 
from an insider threat perspective, which is safeguarding the 
information that has been entrusted to us. We have expanded our 
Insider Threat program to go beyond classified information, to 
look at the sensitive and unclassified information that are 
essential to our missions, to ensure that we are monitoring for 
usage and taking appropriate action if we identify a potential 
vulnerability.
    So we have gone beyond the traditional definition of 
insider threat, which would limit it to classified, to look 
across the information that we can control and make sure that 
we are safeguarding against exfiltration and inappropriate use 
of that information.
    Senator Jones. OK. Great.
    Thank you, Mr. Chairman.
    Chairman Johnson. Thank you, Senator Jones.
    I think we are waiting for Senator Daines to come back, but 
in the meantime, I would just like to pick up on what Senator 
Jones was talking about, shutdowns. What percent of the 
personnel in DHS were considered essential and required to come 
to work? Approximate. I am not looking for----
    Ms. Grady. It was about 70 percent. Most of the individuals 
that were determined to be nonessential are individuals who 
work on longer-term actions. We did nothing that would in any 
way, of course, jeopardize national security, but individuals 
who were moving things forward in terms of critical policy 
initiatives, in terms of planning for future budgets, in terms 
of just the longer-term strategic efforts tend to be the 
individuals and the sorts of functions that----
    Chairman Johnson. So you really did send about 30 percent 
of your workforce home. They did not report.
    Now, unfortunately, I have been around here, and we have 
had a shutdown. The fact of the mater is everybody gets paid 
eventually. In our Senate office, we made them all essential 
because we knew they were going to get paid.
    Seems we are talking about authorization, have you thought 
of during that shutdown anything we could do in the 
authorization to make this more clear-cut and really protect 
your Department and we can potentially talk about doing it 
governmentwide? I support the End Government Shutdown Act, 
which would just--if we do not get our act together, if we just 
keep funding government at the current level, and then you 
start putting a little discipline in there after 90 days or 120 
days, something like that, but, I mean, set aside a 
governmentwide End Government Shutdown Act. Is there something 
in this authorization we can take advantage of in the recent 
rearview mirror?
    Ms. Duke. We actually had not considered that, but it is 
not just the day of the shutdown. It is the weeks leading up to 
it where there is angst.
    Some of the biggest portions of our workforce, say 
transportation security officers, are in the low end of the 
scale. So even having to wait for the money could be critical 
for them.
    Chairman Johnson. Well, give that some thought. I am hoping 
to mark this bill up. If we cannot do it by next week, we are 
going to be holding a markup, and maybe it will be the 
following week, if we delay it, if there are more complex 
issues. But give that some thought.
    Ms. Duke. Will do.
    Chairman Johnson. Again, the reality of the situation is 
every time there has been a government shutdown, everybody gets 
the backpay, and it is incredibly unfortunate that there is 
this level of dysfunction. But let us take a look at maybe 
addressing that here, and it could be potentially an example 
for other parts of government.
    Ms. Duke. If we may, too, while we are talking about 
personnel and waiting for Senator Daines, disaster workforce 
flexibility is something that could help us in responding to 
future disasters.
    We have a major core workforce in FEMA that are not career 
employees. We have no ability to transition the best of those 
into the Federal workforce. That is one of the personnel 
provisions we would look at under an authorization bill.
    In addition, having some ability to do noncompetitive 
temporary appointments, we are looking at some of the things 
with recruiting from high schools and the Pathways program, but 
some of those workforce structure flexibilities that we could 
have similar to DODs.
    Within CBP, I mentioned within border patrol specifically, 
we are looking at incentives for families in some of the 
isolated areas. Similar to DOD, give preference for spouses for 
Federal employee, those type of things that would help make 
those not as non-desirable locations?
    Chairman Johnson. So I know we have held something like 25 
informational meetings with staff to engage us and majority and 
minority staff. If those things are outside of comments made 
during those meetings----
    Ms. Duke. OK.
    Chairman Johnson [continuing]. Get a list of those 
compiled. Get some proposals. I am assuming these things are 
not in the House authorization bill.
    Ms. Duke. No, they are not.
    Chairman Johnson. So, again, let us list all these things.
    Ms. Duke. OK.
    Chairman Johnson. And if we can come to agreement here on a 
bipartisan basis, I think those are some good initiatives. We 
should include it here so that we can get this passed.
    Ms. Duke. OK. And we have a two-page list of what we would 
call our ask, things that would be helpful for us that we think 
are in concert with not only you as the Committee but the IG 
and GAO, and we will have those to you today.
    Chairman Johnson. OK. You have those today?
    Ms. Duke. Yes.
    Chairman Johnson. Good.
    Ms. Grady. And those have been largely a subject of the 
ongoing conversations with staff, so that we can make sure that 
they are being----
    Chairman Johnson. OK. We can formalize it for the record 
here, and again, we will get back with you on that. Senator 
McCaskill.
    Senator McCaskill. Yes. Let us talk about this contract and 
suspension and debarment. Was it bid for the Tribute meals in 
FEMA?
    Ms. Grady. Yes, ma'am.
    Senator McCaskill. It was bid?
    Ms. Grady. Yes.
    Senator McCaskill. This was not a small business situation?
    Ms. Grady. This was not a small business set-aside, no.
    Senator McCaskill. OK.
    Ms. Grady. That is my understanding.
    Senator McCaskill. And you all had no heads-up. You had no 
ability to find the previous problems with their failure in the 
defaults?
    Ms. Grady. We are dragging into this one right now and 
looking at what happens. It was terminated quickly. I do not 
have information that I have seen relative to the due diligence 
we did on the front end for the responsibility determination. 
Obviously, that is something that we are looking at and 
understanding what happened associated with that.
    We do have a robust suspension and debarment program, but 
we suspended and debarred about 190 people last year--or firms, 
the largest in the Federal Government, and we are in the 
process of updating our suspension and debarment instruction to 
make sure that we are fully reflecting best practices, and at 
the IG's recommendation, we are going to be moving to a case 
management system to ensure that we have more complete 
documentation and tracking.
    Senator McCaskill. So Tribute is going to show up again, 
maybe not at DOD, but at another agency. How are we going to 
ding them so we quit hiring them?
    Ms. Grady. Anytime you terminate, there is a notification 
that is provided. In addition, you provide the past performance 
information to inform that and proceed with suspension and 
debarment activities.
    Senator McCaskill. Why did not that happen? Maybe you guys 
can speak to--they clearly had defaulted on a number of 
government contracts. Now, they were much smaller, but there 
have been a number of Federal Government contracts they 
defaulted on. But from what I read about it, you all did not 
have any flag in the system so it would have shown up.
    Ms. Grady. So my suspicion--and again, this is just based 
on my professional judgment, not based on facts, so I want to 
make that very clear--is because the dollar value, they were 
below the simplified acquisition threshold, and that may be 
have been a loophole in terms of reporting, but again, that is 
my speculation, not information that I have verified.
    Senator McCaskill. Well, we are going to dig into it.
    Ms. Grady. As are we.
    Senator McCaskill. And I know you all will. Let us work 
together and try to get to the bottom of it.
    I would really like to know what we need to do to 
strengthen the ability of the Federal Government for suspension 
and debarment because I know that it has been byzantine at 
times in terms of the process, and what has happened is rather 
than go through the process of suspension and debarment, you 
just default the contract and move on. And then that bad actor 
remains a viable contractor in the Federal system.
    Ms. Grady. I agree. And the suspension and debarment, 
because of due process, has probably been taken to an extreme, 
and the length of time it takes to get somebody on the debarred 
list is inordinate in terms of protecting the Federal----
    Senator McCaskill. How long do you think it takes?
    Ms. Grady. My estimate would be it is probably over 2 years 
because you typically allow things to go through the process. 
As is the case of the contract we are discussing, the company 
has disputed the termination, and so we are going through that 
process under the Contract Disputes Act and working through 
that.
    While that is being resolved, you cannot put them in the 
debarred list. It would certainly reflect that their 
performance as we saw it--and the company has the opportunity 
to present the information as they saw it relative to their 
performance, so that is available to inform a source-selection 
decision, and we require our contracting officers to look at 
the past performance of companies in addition to suspension and 
debarment because our goal is to deal with companies who 
perform will.
    Senator McCaskill. But are you only looking within your 
Department?
    Ms. Grady. Across Federal Government. My suspicion is 
because of the very limited dollar value that they did not get 
reported, but that is something that we are looking into.
    Ms. Duke. I was going to say on the responsibility 
determination, which is separate, there is a governmentwide 
repository of past performance information.
    Senator McCaskill. Right.
    Ms. Duke. Under your government affairs role, information 
is not regularly entered in that. If you matched the number of 
government contracts against the number of contracts that are 
reported in the performance system, it is woefully 
underreported.
    Senator McCaskill. Woefully underreported.
    Well, I would like to get to the bottom of this and see if 
we cannot put something in this authorization of the Department 
that would be helpful with this.
    And the other thing I would say about FEMA, it is not like 
you guys do not know you are going to have to buy meals, right? 
Cannot you have some kind of standing, qualification for 
emergency meal providing in FEMA that then you can draw on when 
these occurrences happen?
    I mean, the idea that we would go with an unknown company 
to deliver 30 million meals seems bizarre to me.
    Ms. Grady. So we do have--and planned and have strategic 
big vehicles available and also avail ourselves of the Defense 
Logistics Agency, who has also a number of vehicles available. 
I think the combination of the number of storms, the response, 
and the isolated location in Puerto Rico put a particular 
challenge on the system.
    For example, another contract that did not go well was blue 
tarps.
    Senator McCaskill. Right.
    Ms. Grady. We had a number of instances where we went 
beyond what we would normally use. We had just the amount of 
response and the amount of effort in multiple sites just tapped 
into all the sources, so we were expanding sources beyond which 
we would normally ever have to----
    Senator McCaskill. Because of the fact that you had three 
simultaneous----
    Ms. Grady. Right.
    Senator McCaskill [continuing]. Situations you were trying 
to deal with.
    Ms. Grady. And the urgency and----
    Senator McCaskill. That makes me feel a little better.
    Ms. Grady. Well, the meal mission in Puerto Rico was bigger 
and longer than anybody had anticipated and quite frankly 
historic in its nature.
    Senator McCaskill. Yes. Thank goodness for all the 
charitable work that went on to provide meals because clearly 
the government fell down on the job.
    Ms. Grady. We always work closely with the non-governmental 
organization (NGOs), and that is a key element associated with 
the response and recovery of any disaster.
    Senator McCaskill. I want to briefly ask about this vetting 
center. I am a little worried about the vetting center. I mean, 
we have six or seven different things in government that do 
this. Why are we creating a new one?
    Ms. Duke. The intent of the National Vetting Center is a 
consolidation.
    Senator McCaskill. What are you consolidating?
    Ms. Duke. It has not been determined yet. The terms of the 
vetting center are that we will do some consolidation, but the 
details are to be worked out, now that the President has 
announced it.
    What we are looking for is having intelligence, better 
available for vetting and law enforcement people. That is one 
of the biggest vulnerabilities right now is the difficulty in 
law enforcement and vetting personnel to get intelligence 
information. That is one of the problems we are trying to 
solve.
    Senator McCaskill. OK. So some of these are going to go 
away. We are not going to have the FBI Terrorist Screening 
Center, the National Crime Information Center? We are not going 
to have the National Counterterrorism Center, the Terrorist 
Screening Database, the Terrorist Identified Data Environment, 
the State Department Consular Lookout and Support System, 
Consular Consolidated Database, and the National Targeting 
Center?
    Ms. Duke. We are looking at reducing the need for all those 
standalones by having a presence, a multiagency presence. I 
cannot commit now. We can keep you apprised of what is going to 
be ongoing----
    Senator McCaskill. I am going to be cranky if it is just an 
add-on. If you do not get rid of some of these, it is going to 
drive me nuts.
    Ms. Duke. It will drive me nuts too.
    Chairman Johnson. I cannot imagine that. [Laughter.]
    Senator McCaskill. I mean, that is a lot.
    Ms. Duke. It is essential not only for efficiency, but it 
is essential for the info sharing and the speed. We have to do 
a better----
    Senator McCaskill. Well, I want to be there, a fly on the 
wall, when the FBI and State Department and all these people 
give up their centers because if you can do that, then we can 
definitely get jurisdiction away from Finance, Judiciary, and 
Commerce.
    Chairman Johnson. Yes. Not a problem. [Laughter.]
    Senator McCaskill. So we will watch you work, Secretary 
Duke, and once you get this done, you can teach us how to do 
this because I have a bad feeling this is going to be an add-on 
and just another layer of complexity and overlap in a system 
that frankly still has gaps.
    Thank you, Mr. Chairman.
    Chairman Johnson. Just quick to clarify, what you are 
saying is we went over the capacity of the predetermined 
suppliers already in place?
    Ms. Grady. Yes, sir.
    Chairman Johnson. So we had to find additional suppliers 
and----
    Ms. Grady. And we are always seeking to bring in new 
vendors and also to compete requirements whenever possible to 
best meet our needs.
    Chairman Johnson. But again, you had the suppliers already 
pre-vetted, preapproved. You just exceeded their capacity, 
which is understandable. Senator Hassan.
    Senator Hassan. Thank you very much, and again, thank you 
for this roundtable, to all of you and to the Chair and Ranking 
Member.
    I want to return to the issue of NPPD and cybersecurity. 
The advocates of the bill that passed the House said that NPPD 
needed to be renamed in order to improve the morale of NPPD 
workers, raise the profile of DHS's cyber mission, and attract 
the best and brightest cyber professionals.
    I do have a hard time thinking that a name change really 
does all that, and I understand that you are saying it is more 
than a name change.
    But just a year ago, the Cyber Policy Task Force at the 
Center for Strategic and International Studies (CSIS) co-
chaired by Senate Whitehouse and Representative Michael McCaul 
called for an independent operational cybersecurity component 
at DHS that was on part with the Coast Guard or CBP. Beyond 
just changing the name of NPPD, this Committee, I think, needs 
to hold hearings and specifically consider the possibility of 
creating a separate cybersecurity component at DHS.
    So I will return to the question. I understand your first 
answer to me was, look, it is all of a piece, and I do 
understand that, but I think cybersecurity is as important as 
border security. It is important as marine security, and so I 
am having a hard time understanding why we would not follow the 
independent report and really elevate this to the command that 
it needs to be elevated to.
    Ms. Duke. So it is being elevated to an operating 
component, and that is essential in the distinction that it 
will have everything it needs to operate. So it will have its 
own CFO, its own procurement. It will be now our eight 
operating agency. That is important because it carries 
authorities and mission support with it along with mission.
    And it is a judgment call, what goes together, and CBP, 
border security is important, but we also have trade. We have 
customs within it, because there was a decision that even 
though those are independent, they go together. So it is a 
judgment call on cyber and critical infrastructure. What are 
the benefits of those being together as opposed to being 
absolutely separate?
    I think that in the current draft, having the Under 
Secretary of Cyber and then having the cyber and the critical 
infrastructure under two political appointees will allow for 
the integration but also allow for one big piece of the 
organization to truly focus on cyber. But it is a judgment 
call.
    Senator Hassan. And maybe just to follow up on that, Mr. 
Scott and Mr. Kelly, have you all assessed the feasibility of 
creating an independent operational cybersecurity component at 
DHS? Have you assessed the likelihood that the name change at 
NPPD would impact morale and recruitment efforts in the manner 
that the bill suggested?
    Mr. Kelly. To answer whether or not we are looking into 
that?
    Senator Hassan. Yes.
    Mr. Kelly. The answer is yes. We are starting up an 
engagement that is focusing on infrastructure protection, which 
would include the cybersecurity function.
    Senator Hassan. Thank you.
    Mr. Kelly. Have we looked at the name change as being a 
morale issue? We have not.
    Senator Hassan. OK.
    Ms. Duke. I have actually.
    Senator Hassan. Have you?
    Ms. Duke. For instance, the Office of Field Operations 
(OFO), they have lost their branding, and that is an issue to 
them. I think that is why you see people with their--they love 
being part of an organization. It is not a statistically--
thing, but I think it is an issue.
    Senator Hassan. Look, I understand that, but again, 
cybersecurity is a whole different kind of border. And it 
really does concern me because it takes a different mindset and 
a different kind of expertise than maybe protecting buildings 
does. So I think it would be good for us to explore this more 
as a Committee.
    And, Mr. Scott, you look ready to say something.
    Mr. Scott. I am. Thank you, Senator Hassan.
    Just a couple of things. In 1997, GAO designated Federal 
information security as a governmentwide high-risk area. So we 
have been on this for a long time, and in 2003, we added on to 
include the critical cyber aspect of this.
    In terms of NPPD reorganization, we do believe that to 
focus on cyber is needed, and to support Deputy Secretary Duke 
there, that a name change will help in terms of clarifying its 
mission and also in title recruitment.
    I think it is also important that as we go through this 
transformation of NPPD into the new organization--and also 
making an operational component is very important, but in terms 
of once we go through this transformation, it is also important 
to build in career expectations as to what exactly the missions 
and roles are and clear up measures of effectiveness. It is 
really important that whenever we create something new that it 
is clear what it is we want it to do and how will we know 
whether it is working or not.
    Ms. Duke. Ma'am, could I real quickly address your last 
comment?
    Senator Hassan. Yes.
    Ms. Duke. Protecting buildings, Federal Protective Service, 
we like the provision in the current draft that says that the 
Secretary can consider moving that. We would support a similar 
provision for the Office of Biometric Identity Management 
(OBIM), the Biographic Information System, to really look at 
whether that would detract from the mission.
    Senator Hassan. Thank you very much.
    Thank you, Mr. Chairman.
    Chairman Johnson. Let me ask Chris Krebs to step up to the 
plate here. My guess is you were itching to say something. 
[Laughter.]
    Could you talk a little bit about your private-sector 
background and then your perspective of how important the name 
change is. You take a look at that and go not that big a deal, 
but just talk about that and then the operational.
    Mr. Krebs. So, ma'am, three quick things. I did come out of 
the private sector to join the Administration in March from 
Microsoft, where I directed cybersecurity policy for the U.S. 
Government Affairs team.
    What you are asking--and you are citing back to the CSIS 
report--is exactly what the NPPD reorganization built. It 
creates an independent cybersecurity and critical 
infrastructure component.
    Now, the importance of the linkages of the two--physical 
security and cybersecurity--that is how it is going in 
industry. They are inextricably linked. Yes, there is the 
logical, the digital side of security, but when you look at how 
organizations manage risk, they have to look across an entire 
enterprise and say, ``What is our physical risk? What is our 
cybersecurity risk?'' And they are emerging, particularly when 
you think about things like Internet of Things, industrial 
control systems and SCADA systems. So it is important that we 
keep them together because what I need to be doing from a field 
force perspective is when I go and engage any company out 
there, when we are knocking on the door, we need to be a single 
point of entry.
    So if they have physical requirements, we can work with 
those. If they have infrastructure or cybersecurity 
requirements, we can work with those. So it is not DHS knocking 
five times in the same day or day after day after day. So if we 
can consolidate those in a single storefront somewhat, I think 
that is the way to do this.
    Senator Hassan. I appreciate that, and this has been 
helpful. What I am just concerned about is the possibility of 
the cyber function kind of getting supplemented.
    Mr. Krebs. There is no greater risk right now to our 
country, at least that is my perspective.
    Senator Hassan. Well, it is mine too.
    Mr. Krebs. Others in the Department may disagree, but that 
is the thing I think about if we are going to them, the first 
thing I wake up in the morning. It is not going to be 
subordinated to any other element.
    Senator Hassan. I mean, that is while I was Governor, I got 
reports of the number of attempted attacks every day, and it is 
just we need to keep on it, so thank you.
    Mr. Krebs. Absolutely. Yes, ma'am.
    Chairman Johnson. Senator Jones, do you have any further 
questions?
    Senator Jones. Just briefly.
    The Committee was furnished with a June 30, 2017, GAO 
letter suggesting a number of recommendations. Just briefly, 
how are you coming with those, and specifically, are there any 
of those recommendations that you got, particular problems 
with, obstacles that we can help with? Just briefly on that.
    Mr. Scott. So, yes, we are trying to figure out was that 
addressed to GAO or----
    Senator Jones. Whoever can answer it best.
    Mr. Scott. Well, I will take a first shot at it, Senator 
Jones.
    We do have a number. Every 6 months or so, we are sending 
over priority recommendations letter to the Department, and 
thus far, we have continued to receive strong, robust responses 
to the issues we have raised in the priority recommendation 
letter. I give the Department credit. Among the agencies, they 
really seem to take this seriously, and I mean, they are 
continuing to make progress.
    Our expectation is we will be providing the Secretary a new 
priority recommendation letter within the next month or so.
    Senator Jones. OK.
    Ms. Grady. So regarding the priority recommendations, we 
track all the outstanding recommendations. The high-priority 
ones, obviously we focus on and make sure we are completing.
    One of the things that is important to remember with the 
GAO recommendations is some of them are short term, and some of 
them take much longer. So if it is a recommendation that is 
going to take 3 to 4 years to track, we track when it should be 
completed and track milestones associated with completion of 
those. But not all the GAO recommendations made are a quick 
fix. A lot of them are systemic that take involved effort, and 
we work very closely with GAO and making sure the instruction 
recommendation, that we understand it will address the 
challenge, and that we follow through and get that implemented 
and make meaningful progress against it on a continual basis.
    Senator Jones. And if there is anything in that letter that 
you think this bill could help with, please get that to us as 
soon as you can.
    Thank you, Mr. Chairman. That is all I have.
    Chairman Johnson. Thank you, Senator Jones.
    I do not think we have any further questions. Obviously, we 
want that list. We want to work with you very closely, Members 
and staff to do whatever we can to improve this authorization, 
add the things that we can add that can be passed, so let us 
work, roll up our shirt sleeves over the next couple of weeks, 
and we will get this thing done, OK?
    I want to thank all the witnesses for, first of all, your 
service and coming here and spending some time and doing a good 
job answering our questions.
    This roundtable is adjourned.
    [Whereupon, at 11:43 a.m., the Committee was adjourned.]

                            A P P E N D I X

                              ----------                              

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                                 [all]