[House Hearing, 117 Congress]
[From the U.S. Government Publishing Office]
[H.A.S.C. No. 117-78]
OPERATIONS IN CYBERSPACE AND
BUILDING CYBER CAPABILITIES ACROSS THE DEPARTMENT OF DEFENSE
__________
HEARING
BEFORE THE
SUBCOMMITTEE ON CYBER, INNOVATIVE TECHNOLOGIES, AND INFORMATION SYSTEMS
OF THE
COMMITTEE ON ARMED SERVICES
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTEENTH CONGRESS
SECOND SESSION
__________
HEARING HELD
APRIL 5, 2022
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
__________
U.S. GOVERNMENT PUBLISHING OFFICE
48-633 WASHINGTON : 2023
SUBCOMMITTEE ON CYBER, INNOVATIVE TECHNOLOGIES, AND INFORMATION SYSTEMS
JAMES R. LANGEVIN, Rhode Island, Chairman
RICK LARSEN, Washington JIM BANKS, Indiana
SETH MOULTON, Massachusetts ELISE M. STEFANIK, New York
RO KHANNA, California MO BROOKS, Alabama
WILLIAM R. KEATING, Massachusetts MATT GAETZ, Florida
ANDY KIM, New Jersey MIKE JOHNSON, Louisiana
CHRISSY HOULAHAN, Pennsylvania, STEPHANIE I. BICE, Oklahoma
Vice Chair C. SCOTT FRANKLIN, Florida
JASON CROW, Colorado BLAKE D. MOORE, Utah
ELISSA SLOTKIN, Michigan PAT FALLON, Texas
VERONICA ESCOBAR, Texas
JOSEPH D. MORELLE, New York
Josh Stiefel, Professional Staff Member
Sarah Moxley, Professional Staff Member
Payson Ruhl, Clerk
C O N T E N T S
----------
Page
STATEMENTS PRESENTED BY MEMBERS OF CONGRESS
Langevin, Hon. James R., a Representative from Rhode Island,
Chairman, Subcommittee on Cyber, Innovative Technologies, and
Information Systems............................................ 1
WITNESSES
Nakasone, GEN Paul M., USA, Commander, U.S. Cyber Command and
Director, National Security Agency............................. 5
Plumb, Hon. John F., Incoming Principal Cyber Advisor to the
Secretary of Defense, U.S. Department of Defense............... 4
APPENDIX
Prepared Statements:
Banks, Hon. Jim, a Representative from Indiana, Ranking
Member, Subcommittee on Cyber, Innovative Technologies, and
Information Systems........................................ 32
Langevin, Hon. James R....................................... 29
Nakasone, GEN Paul M......................................... 43
Plumb, Hon. John F........................................... 34
Documents Submitted for the Record:
[There were no Documents submitted.]
Witness Responses to Questions Asked During the Hearing:
Mr. Moore.................................................... 53
Mr. Moulton.................................................. 53
Questions Submitted by Members Post Hearing:
[There were no Questions submitted post hearing.]
OPERATIONS IN CYBERSPACE AND BUILDING CYBER CAPABILITIES ACROSS THE
DEPARTMENT OF DEFENSE
----------
House of Representatives,
Committee on Armed Services,
Subcommittee on Cyber, Innovative Technologies, and
Information Systems,
Washington, DC, Tuesday, April 5, 2022.
The subcommittee met, pursuant to call, at 4:21 p.m., in
room 2118, Rayburn House Office Building, Hon. James Langevin
(chairman of the subcommittee) presiding.
OPENING STATEMENT OF HON. JAMES R. LANGEVIN, A REPRESENTATIVE
FROM RHODE ISLAND, CHAIRMAN, SUBCOMMITTEE ON CYBER, INNOVATIVE
TECHNOLOGIES, AND INFORMATION SYSTEMS
Mr. Langevin. The subcommittee will come to order. Well,
I--we got started later than I had anticipated, than we all had
anticipated, due to votes.
But I want to begin by welcoming everyone to today's
hearing, ``Operations in Cyberspace and Building Cyber
Capabilities Across the Department of Defense,'' and I'd like
to begin, of course, by welcoming our witnesses.
Let me start welcoming, first, General Paul Nakasone, the
Commander of U.S. Cyber Command and the Director of the
National Security Agency, and Dr. John Plumb, who was recently
confirmed as the Assistant Secretary of Defense for Space
Policy and who serves concurrently as the Principal Cyber
Advisor to the Secretary of Defense.
Welcome to you both.
Dr. Plumb appeared in front of the Intelligence and Special
Operations Subcommittee on Friday. So this is only his second
appearance as a witness for the House Armed Services Committee
and the first on matters related to cyber issues.
John, I understand that you're a proud Notre Dame alum. I
know that our Ranking Member Banks is extremely happy to hear
this and I promise not to hold it against you, and look forward
to your testimony in just a few minutes.
By the way, it would be appropriate for me now--right now,
Ranking Member Banks is in the middle of markup on the--in the
Labor Committee and so, therefore, I ask unanimous consent for
Ranking Member Banks to deliver his opening statement later in
the hearing when he arrives.
Without objection.
So, General Nakasone, it's always great to see you as well.
I have valued our relationship over many years now. And I
certainly admire your dedication to both your mission and your
people.
We warmly welcome both of you to today's proceedings and
look forward to working together and I look forward to your
testimony, of course.
As I'm sure you've heard by now, and for the record, I do
plan on not seeking reelection at the end of the 117th
Congress. And after nearly 22 years in Congress, I'm ready to
chart a new course, and I've cherished my time serving the
people of Rhode Island's Second Congressional District and the
men and women in uniform.
And over the course of my tenure, I've seen cybersecurity
and cyber issues move from the periphery to the center of
national security, and I'd like to think and I hope that I've
played some small role in focusing the Congress on these vital
matters.
So, out of curiosity, I looked back at prior years'
National Defense Authorization Act. In 2001, my first year in
Congress, the NDAA didn't even mention the word cyber or
internet, not even once, as a matter of fact, and there
certainly wasn't a combatant command dedicated to cyberspace
operations at that time.
Today, cyber is part of nearly every issue that we deal
with in national security. For Congress, not only does the word
cyber appear much more than once but last year was the second
consecutive year where the NDAA contains an entire chapter or
title devoted to cyberspace-related matters.
For the Department, Cyber Command has not only been in
existence as a unifying combatant command for nearly 4 years
but is conducting operations day to day in and out--day in and
day out in defense of our national security.
In the 3 years that I've had--I've served as chairman of
the subcommittee, we have had more than 220 separate pieces of
legislation across 3 NDAAs enacted into law.
This subcommittee, along with our colleagues from the
Senate, have tackled, among many other things, cybersecurity of
weapons systems; cyber warfare personnel pay parity; cyber
targeting; support to the private sector and critical
infrastructure; capabilities to defeat ransomware; budgetary
authorities; cyber requirements for defense contractors; and of
the most significance to me, the creation of the National Cyber
Director role in the Executive Office of the President.
We no longer have to debate whether we will fight wars in
cyberspace, and to some it may seem crazy that we ever had to
have that discussion in the first place.
Cyberspace is recognized--is a recognized domain of warfare
and for better or for worse our service members and civilians
are engaged with our adversaries on a daily basis. The
Department of Defense and military services have also undergone
a similar transformation.
We have a dedicated combatant command for cyberspace
operations. We have soldiers, sailors, airmen, and Marines,
guardians and coastguardsmen defending our Nation in
cyberspace, and we have witnessed the incredible outcomes for
our national defense that we can create through cyber means.
And yet, for all the progress that we have made on this
front, there can be a sense of deja vu in the issues that we
have--we still have to address.
On workforce matters, for instance, the points that we can
and should make today are unnervingly similar to what was said
at hearings 10, 15, and even 20 years ago, statements such as
we struggle in competing with the private sector for talent, or
there remains a critical shortfall in our cyber talent.
Since 2010, this body has legislated on cyber and STEM
[science, technology, engineering, and mathematics] workforce
issues through 55 provisions and sometimes we seem no closer
than we were before. We continue to struggle in elevating
considerations for cyber domain to a level commensurate with
how we treat our land, air, sea, and now space domains.
And I've been in Congress long enough to know that progress
with any important issue is always incremental. However,
incremental does not have to be synonymous with glacial.
So the responsibility of legislators is tremendous, and we
wield the tools at our disposal as carefully as possible. When
an issue requires attention, we are judicious in how we direct
the Department to respond.
Directive actions are powerful but resorting to these too
frequently lessens their effect. That's why we often direct
other actions such as reports, briefings, quarterly updates,
implementation plans, designation of senior officials, and
many, many others.
We use these to make clear the view of Congress. Though we
use these tools because they're often successful in
accomplishing the desired end state, it is not an exaggeration
to say that we have tried to use these alternatives hundreds of
times in the cyber context.
However, at a certain point, when we are discussing the
same issues as our predecessors' predecessors, we have to ask
ourselves can we continue trying--can we continue trying the
same types of approaches that don't result in change.
So if we are repeating the same frustration on an annual
basis about cybersecurity and the defense industrial base or
the readiness of our cyber forces or the way in which the
Department manages cyber issues, then at some point we must
acknowledge a lack of preparedness to address these critical
challenges.
Congress has great obligation to our national security.
During my final year in these halls, I'm not interested in
allowing my successor to inherit the same challenges that
plague us today.
I look forward to being bold, to pushing for overdue
changes, and to working collaboratively with our members and
our witnesses.
So with that, I again want to thank our witnesses for
appearing before us today. As a reminder, after this open
session we will move to Rayburn 2212 for a closed member-only
session.
As mentioned, we'll have unanimous consent request for
Ranking Member Banks at this time we'll wait to--for him to
arrive or we'll have his records--remarks inserted into the
record.
So with that, I want to, again, thank our witnesses for
appearing before us today and with that, as always, it's great
to work with my colleagues on both sides of the aisle on these
important issues and I will stop there.
And with that, I'd like to turn now to Dr. Plumb and
General Nakasone for 5 minutes each to--for your remarks.
Dr. Plumb, please proceed.
[The prepared statement of Mr. Langevin can be found in the
Appendix on page 29.]
STATEMENT OF HON. JOHN F. PLUMB, INCOMING PRINCIPAL CYBER
ADVISOR TO THE SECRETARY OF DEFENSE, U.S. DEPARTMENT OF DEFENSE
Dr. Plumb. Thank you very much, Chairman.
Thanks, Chairman Langevin, thanks, Ranking Member Banks and
members of the subcommittee. I'm pleased to join General
Nakasone, Commander of U.S. Cyber Command, to report on the
progress the Department of Defense is making in achieving our
objectives in cyberspace.
As Secretary Austin has made clear, China is the pacing
challenge for the Department and that includes cyberspace.
China believes that achieving information dominance in
cyberspace will enable it to seize and maintain the strategic
initiative in a crisis or conflict.
China's malicious ongoing cyber campaigns include
exfiltrating sensitive info from U.S. public and private sector
institutions and stealing U.S. intellectual property and
research from the defense industrial base.
And while China may be the Department's pacing challenge,
Russia is the near-term threat today. On March 21st, President
Biden warned that Russia could conduct malicious cyber activity
against the United States, including as a response to the
unprecedented economic costs we have imposed on Russia
alongside our allies and partners.
The President stated this warning is based on evolving
intelligence that the Russian government is exploring options
for potential cyberattacks.
And, of course, it's not just Russia and China. Iran and
North Korea are threat actors of concern and ransomware
criminals remain a persistent threat.
The Department recognizes the need to prioritize missions
to disrupt threats overseas at their source in and through
cyberspace. In a domain subject to constant change, our success
in this mission demands the ability to conduct timely offensive
cyber operations when the threats meet the threshold for action
as established in policy.
The existing national policy framework, NSPM-13 [National
Security Presidential Memorandum], enables the Department's
offensive cyber operations and it has made important and
positive contributions to the Department's ability to engage
the threat.
The Department will continue to advance and modernize how
we operate in cyberspace to engage cyber threats effectively
and in a well-coordinated manner. The Department's superiority
in cyber domain also depends on maintaining an ability to move
quickly in a cohesive manner with key partners.
The close collaboration between the National Security
Agency and U.S. Cyber Command, which is strengthened by the so-
called dual-hat arrangement, has been a significant enabler of
that success. The DOD [Department of Defense] is currently
conducting its 2022 Cyber Posture Review, which is an
assessment of the Department's organizations, plans, programs,
and policies germane to cyber operations.
Once complete, the Cyber Posture Review will inform the
Department's 2022 cyber strategy. That strategy will provide
guidance to the Department as to how its cyber combat power
should be used to implement the National Defense Strategy and
how in particular cyber operations will advance integrated
deterrence.
The strategy will also identify potential solutions and
paths forward for addressing any gaps identified in the posture
review.
In the past year, we have seen cyber actors conduct
malicious cyber activities at an unprecedented scale. Prominent
examples include the Russian-led exploitation of the SolarWinds
software, the Microsoft Exchange Server vulnerability exploited
by the Chinese group Hafnium, and the Colonial Pipeline
ransomware operation.
But the past year has also demonstrated that the
Department, the U.S. Government, and our private sector
partners can find creative ways to mitigate and combat these
cyber threats. And today, today, the U.S. Government and the
private sector are collaborating in unprecedented ways to
prepare for potential Russian cyberattacks against the
homeland.
DOD will continue to work closely with this committee as we
seek to strengthen both our defensive and offensive cyber
capabilities and mature our cyber forces. Our ability to
successfully operate in cyberspace is essential to U.S.
national security.
Thank you again for holding this timely hearing. I look
forward to your questions.
[The prepared statement of Dr. Plumb can be found in the
Appendix on page 34.]
Mr. Langevin. Thank you, Dr. Plumb.
General Nakasone, you're recognized for 5 minutes.
STATEMENT OF GEN PAUL M. NAKASONE, USA, COMMANDER, U.S. CYBER
COMMAND AND DIRECTOR, NATIONAL SECURITY AGENCY
General Nakasone. Chairman Langevin, Ranking Member Banks,
and distinguished members of the committee, I'm honored to
testify beside Assistant Secretary Plumb.
I'm joined today by Command Sergeant Major Sheryl Lyon, the
U.S. Cyber Command and NSA [National Security Agency] senior
enlisted leader. We are honored to represent the military and
civilian members of U.S. Cyber Command.
Command Sergeant Major Lyon and I want to recognize you,
Chairman, for your 22 years of service to our Nation. Thank you
for your advocacy, your passion, your commitment to not only
U.S. Cyber Command and the National Security Agency, but most
of all, our Nation.
Defending the Nation is at the heart of U.S. Cyber
Command's mission. The command has been integral to the
Nation's response to the current Russia-Ukraine crisis.
We have provided intelligence on the growing threat; helped
to warn government and industry to tighten security within
critical infrastructure sectors; enhanced resilience on the DOD
Information Network; accelerated efforts against criminal cyber
enterprises; and together with interagency and allied partners,
planned for a range of contingencies.
Coordinating with the Ukrainians in an effort to help them
harden their networks, U.S. Cyber Command deployed a hunt
forward team who sat side by side with our partners to gain
critical insights that have increased homeland defense for both
the United States and Ukraine.
U.S. Cyber Command views 2022 as a year of significant
opportunity for building our capabilities as we pursue five
priorities: readiness; operations in defense of the Nation;
integrated deterrence; recruitment, retention, and training of
the force; and the joint cyber warfighting architecture and
enhanced budget control.
My goal is a command that remains world class, ready, and
capable of providing options and conducting operations in
defense of the Nation with wider partnerships and exceptional
talent.
These elements will be essential to national security, as
our Nation faces an array of adversaries who are expanding in
scope, scale, and sophistication. Cybersecurity is national
security.
Speed, agility, and unity of effort brought about by the
connected relationship between U.S. Cyber Command and the
National Security Agency is the ingredient that protects the
United States against our enemies.
The men and women of United States Cyber Command are
grateful for the support this committee and Congress has given
to our command. I look forward to your questions.
[The prepared statement of General Nakasone can be found in
the Appendix on page 43.]
Mr. Langevin. Thank you, General Nakasone. I thank the
witnesses for the testimony. We'll now move to questions.
Let me start. This is for both of our witnesses, and just
for the record and to clarify. So, a media report recently
claimed that the interagency is considering changes to the
National Security Presidential Memorandum 13, or NSPM-13.
So this is an executive branch policy that governs a subset
of cyberspace operations conducted by departments and agencies
to include the Department of Defense. So NSPM-13 as a policy
instrument, I believe, has improved the Nation's ability to
conduct operations in cyberspace.
However, it's always important that we do our due diligence
regarding oversight.
Dr. Plumb and General Nakasone, could you each speak to
NSPM-13--how it's been employed to date, and if you're
anticipating any changes? I'll start with that.
Dr. Plumb. Thank you, Mr. Chairman. I'll take that first
and then pass it to General Nakasone.
But I guess--let me just answer the top piece of this
question was, one, NSPM-13 has been valuable. It clearly has
improved the ability to conduct cyber operations, and, you
know, thank you to this committee and the general's good work
and all those that have got us this far.
I also would just say I don't think it's unreasonable or
new for a new administration to review existing Presidential
directives and so that is kind of a standard piece, and I think
that that is a reasonable expectation and it is correct that
these conversations are ongoing.
And I think our goal, at least my goal and I know I share
it with the general, is to make sure that we preserve our
ability to move at speed.
Mr. Langevin. Yeah. I agree with you that a review is
appropriate always for a new administration. But to date, are
you expecting any significant changes in NSPM-13 right now?
Dr. Plumb. So I am--I don't want to box anybody in on that.
I'm not expecting any changes that would make things anything
except better. But maybe we could pass it to the general and he
can give you his military insight on that if that's all right.
Mr. Langevin. Okay. Thank you.
General.
General Nakasone. Chairman, in light of NSPM-13 in 2018, I
think it was one of two major advances in terms of authorities
and policies that provided us the impetus to take effective
action in cyberspace.
The other one, as you recall, was declaring cyber as a
traditional military activity, which came in the fiscal year
2019 NDAA. Both of those have been very helpful to us.
In terms of changes, obviously that's a policy discussion
that's ongoing now. I'm sure those discussions will continue. I
know that my discussions with the Under Secretaries and also
the Secretaries--I've made my military knowledge known in terms
of what NSPM-13 has meant to us.
Mr. Langevin. Okay. Thank you. Thank you, General.
This is obviously something we'll want to continue to
follow up and I get--you know, having read through the NSPM-13
document when eventually it was forwarded to the Congress for
review that, you know, I support its premise and the document
as it's written and, hopefully, any changes made would make
it--would make it better, but, hopefully, not a sharp deviation
from it.
General, let me just turn to you. In past appearances in
front of the subcommittee, we have discussed the cyber mission
force [CMF] and its size.
With the benefit of time, can you speak to USCYBERCOM's
[U.S. Cyber Command's] plan to--for planned growth in the CMF?
Additionally, can you speak to the differences you've
witnessed, say, from last year to this year and, you know, the
work that still continues to evolve as the force grows and
matures?
General Nakasone. Chairman, as we originally built the
force in the Department, 133 teams that were dedicated to our
cyber mission force. The previous Secretary of Defense has
approved a 14-team growth in the FYDP [Future Years Defense
Program]. So we're going to grow five more teams this year.
The question I often get asked is, is this enough? What's
the number of teams that you need? And this is a study that's
ongoing right now within the Department to really determine
what is the final number of teams that we need for the future.
My sense is we are learning a tremendous amount of our
operations right now in support of crisis in the Ukraine that
will likely inform this.
We're a different force today than we were even 4 years ago
when I took over, and so my sense is that while 14 teams is
likely the start, I would not be surprised if the Department
comes to a determination that more are necessary.
Mr. Langevin. Thank you, General, and, you know, based on
your time in command at Fort Meade, can you speak to the
comparison of authorities between CYBERCOM and SOCOM [U.S.
Special Operations Command]?
And, more specifically, are there specific authorities that
SOCOM has today which are applicable and would be useful for
you in your operation?
General Nakasone. Chairman, as you're aware, one of the
things we did when we designed U.S. Cyber Command well over a
decade ago was to look at Special Operations Command as perhaps
an exemplar of where we needed to go.
What you speak of is what we term service-like
authorities--what are the service-like authorities that we
should emulate that U.S. Special Operations Command has today?
So right now, the authorities they have with regards to
training; the authorities they have with regards to joint force
provider and overseeing the provision of teams; and then the
last piece is acquisition.
All of those, Chairman, are areas that we think we need to
be able to emulate more closely to have that service-like
appearance for what we do.
This is important for us because, as you are well aware,
this comes down, at the end of the day, to the personnel, the
personnel that train, the personnel that are trained on teams,
and the effectiveness of these teams. All of those areas are
areas that we're focusing on as we move forward.
Mr. Langevin. Thank you. Okay. I'm going to stop there. If
we go to second round or we have the opportunity to go to the
classified session for more detailed answers, but with that,
I'm going to yield right now to Mr. Franklin.
Mr. Franklin. Thank you, Mr. Chairman. You asked some of my
questions about the growth in the teams. That's encouraging,
General, to hear that there are 14 more slated. CYBERCOM has
shown a great deal of commitment to building both capability
and capacity with the cyber mission force, reaching full
operational capability ahead of schedule.
We see further maturing. I do know in the State of Florida
we have got training units at Corry Station and at Hurlburt
Field, both successful operations.
How are we learning from these institutions to help develop
cyber-related curricula and building sustainable readiness
across the force?
General Nakasone. So one of the most important ways that
we're learning is really twofold, Congressman. One is that our
force is learning every single day in the operations that we're
conducting in cyberspace. This is a force that's engaged
against a variety of adversaries every single day of the year.
And so the important piece is how do we take those lessons
learned every day and bring them back to a place like Corry
Station or Pensacola, and that's one of the things that we
certainly have done.
But the second piece is, I think, also important. That is,
the people that have led our teams, the people that have
operated on our teams, the people that have been in hunt
forward missions in different countries, how do we get them
back into the schoolhouse, that they are the principal trainers
of our young people that come forward?
Mr. Franklin. General, the fiscal year 2023 budget contains
$11.2 billion for cyberspace activities and that's a 7.6
percent increase year over year, which sounds very strong, and
a few months ago, I would have thought that would be the case.
But considering we're now at 7.8 percent inflation, it's
actually a net decrease. I realize there's a lag time between
when you all are putting budgets together and when they finally
get out there. But is your determination that the cyber threat
to the country is stagnant or decreasing?
General Nakasone. That is not my determination in terms of
my view of the future. I think it's increasing in terms of what
our adversaries present to us as a nation.
Mr. Franklin. So I know we had a long hearing earlier today
about the fiscal year 2023 budget, but this is a budget that
fails to keep pace with inflation.
Are you are you confident that you will be able to make do
and, like good soldiers, salute and carry out the plan of the
day? But is this budget adequate or do you--are you--would you
be asking us to plus that up?
General Nakasone. So, Congressman, the amount that's been
funded to us today is what we need to start with. But we have
also identified unfunded priorities and we'll provide that to
the committee as directed by the NDAA.
Mr. Franklin. Okay. Thank you.
Dr. Plumb, what is your assessment of our ability to deter
cyberspace attacks on the U.S. Government and critical
infrastructure, in general?
Dr. Plumb. Thanks, Congressman.
Defending the homeland, deterring cyberattacks of at least,
I guess I would say, a strategic nature, absolutely essential.
I think--I guess what I would offer is I don't think cyber
deterrence is a piece unto itself. So I think deterrence
comes--you know, we have been using this term integrated
deterrence. I'm sure you've--you're well aware of it. I know
everyone here is.
But you don't deter cyber just with cyber alone. You deter
with all instruments of national power. And I think, at the
moment, the President has used the megaphone of the United
States of America to warn the Russians not to attack critical
infrastructure.
At the same time, through Cyber Command and through our
Department of Homeland Security partners, we have been working
with private sector and the defense industrial [inaudible] to
make sure that people's shields are up, that they're ready,
that they're being alerted to threats.
So I think part of that is the defense piece. Part of that
is warning of retaliation. And I think--I actually think that
is, at the moment, holding.
Mr. Franklin. Okay. Are there additional tools or resources
or authorities that would be helpful to help bolster our
ability to deter these cyber--or cyberspace attacks against the
country?
Dr. Plumb. I think on the specific question of tools, I
would ask the general to answer that. I don't know if that's
answerable in this session. I don't have any--I believe the
authorities are in place. I believe the authorities are in
place at this time.
Mr. Franklin. General, unclass [unclassified], would that--
anything you would want to offer in this setting?
General Nakasone. So I have the authorities that I need
right now, Congressman, to accomplish my mission. Obviously, we
look at a series of partnerships, and no one department or
agency can do it all in cyberspace.
So what we are very focused on is how do we develop
partnerships with CISA [Cybersecurity and Infrastructure
Security Agency] and with FBI [Federal Bureau of Investigation]
and with foreign partners and, most importantly, the private
sector to ensure that we all have a common vision and a common
vigilance.
Mr. Franklin. Thank you, gentlemen.
I yield back, Mr. Chairman.
Mr. Langevin. Thank you, Mr. Franklin.
Mr. Moulton is now recognized.
Mr. Moulton. Great. Thank you, Mr. Chairman.
And, gentlemen, thank you very much for being here, for
your ongoing work.
This morning, Chairman Milley listed four primary elements
of national power, one of which is informational, and it sounds
quite important in that context. And yet, information
operations is buried in the organizational structure of DOD and
many experts feel that our capabilities have been significantly
degraded over the past decade, this as we watch the value of
information warfare play out on the ground in Ukraine.
Do you believe that information operations is a warfighting
function that fundamentally should be in Cyber Command or
should it be elsewhere in DOD?
General Nakasone, if you could take a crack at that first,
please.
General Nakasone. All right.
So, Congressman, it already is in Cyber Command. I think
what I would say is that what have we learned about
information. Information always has to be paired with our cyber
operations to make them even more effective.
Information is only as effective as it is accurate, timely,
and relevant, and that ability for us to do that needs to pair
with the type of work we're doing either defensively or
offensively.
We have come a long way since 2018 in working the
information operations, but we still have a long ways to go.
Mr. Moulton. Thank you, General. I mean, my frustration is
that, to me, cyber is one of many, many delivery methods for
information and it doesn't make sense to me that it's buried in
a command that's just one of the delivery methods rather than
on a more strategic level.
But I understand the fact that you own it and you're going
to defend it.
Mr. Plumb, what's your view on this? Do we have the right
organizational structure for information operations, or should
we be looking at reorganizing within DOD?
Dr. Plumb. So, Congressman, thanks for the question and,
obviously, information warfare, if you wish, has been really
essential, really, over the last month or two here with the
Russia-Ukraine conflict.
I guess I would say, on one level, we are conducting
information operations to a strategic level with the President
and the White House making announcements.
Mr. Moulton. I understand that, Mr. Plumb. But I'm asking
about the organizational structure within DOD.
Dr. Plumb. So on the organizational structure, I'm going to
ask you if I can take that for a lookup.
[The information referred to can be found in the Appendix
on page 53.]
Mr. Moulton. Okay.
Dr. Plumb. I'll say I don't have anything immediate, but I
don't want to leave something----
Mr. Moulton. That's fine. If you can take that for the
record, that would be great.
General, you mentioned to me earlier that the USMC--the
Marine Corps--has done a great job of retaining its cyber
workforce and the Marines are planning further changes and
reforms to their personnel policies, including directly
commissioning cyber operators and other specialties into higher
ranks, as was commonly done with various specialties during
World War II.
Do you believe these additional changes are warranted and
will help further retain the workforce?
General Nakasone. I do, and I see it already. I've seen it
in my own service in terms of, first of all, building a branch,
then taking a look at different initiatives in terms of what
they do.
What the Marines have really done very efficiently that I
applaud is the fact that they've lengthened their tours in
terms of how long they stay with us.
Most young men and women that come into the Marine Corps
that want to be cyber warriors want to do cyber, and so being
able to do that for 6-plus years at one location has been very,
very attractive to them and we see that in the payoff with
regard to the retention numbers.
Mr. Moulton. General, you described the mission of CYBERCOM
in your opening statement as defense--defense of the Nation.
What role do you see for offense and deterrence?
I know we talk about integrated deterrence but when we
really talk about having an effective deterrent it means having
an effective offense. So what--how do you characterize the role
of offense to the American people?
General Nakasone. So, Congressman, when I speak of defense
of the Nation, that is a full spectrum defense to include
offensive operations. You know, the best defense a lot of times
is a good offense.
The way that we have done this at U.S. Cyber Command is the
idea of persistent engagement--how do we maintain both the
ability to share information and act against our adversaries.
We don't want those adversaries to continue to have free
rein in terms of what they do in cyberspace. So how do we
ensure that when they steal our intellectual property or when
they steal our identities or when they try to interfere within
our elections, we take them on, and that's what we have done
since 2018.
Mr. Moulton. But if I can press you a bit on this, I mean,
it's common knowledge, without going into anything classified,
that the Chinese are stealing our intellectual property every
single day.
They're sometimes effective at getting it from DOD but
they're effective all the time at getting it from the private
sector. Do you think we should have a more aggressive
deterrence with China?
General Nakasone. So I think in terms of the way that we
look at our adversaries, such as China, is this needs to be not
only persistent engagement but how do we look at the
authorities in terms of what's being done in the United States
and what is, you know, available for the Chinese to operate so
freely within our Nation?
So I think that that has to be a more--a greater
perspective on how we're going to do this in the future.
Mr. Moulton. Thank you, Mr. Chairman. I yield back.
Mr. Moore. Thank you, Chair. Thank you both for being here.
General Nakasone, it's good to see you again. Appreciate the
opportunity to talk about these growing and ever important
issues now.
Thinking about our adversaries, one thing that's very
concerning is the cybersecurity of the commercial and
government entities of many of our adversaries, they're in
lockstep, right.
They're operating, you know, I would almost say not even
necessarily in a commercial way. That may be even just a front,
right. Like, they're really operating in lockstep where, you
know, you contrast that with American cyber mentality kind of
an every man for himself. It's a way to categorize it. I know
there's nuance to that.
But I am concerned that we're setting ourselves up to lose
that competitive edge. Without stronger U.S. cyber public-
private partnerships with regulatory and acquisition authority,
America's technological--may become an exploitable
vulnerability.
A question--I'm interested in this--I'm interested in
improving our cutting-edge innovation efficiently and
transitioning those programs of record.
Few things disincentivize information--innovation more than
technologies and products languishing in the proverbial sort
of, let's say, valley of death in the acquisition process.
I believe we can accelerate the adoption of emerging
technology and strengthen our defense innovation base by
empowering unit commanders who are responsible for mission
outcomes impacted by rapidly changing technologies such as AI
[artificial intelligence], SAS [statistical analysis software],
quantum computing.
Would you support an innovation fund available at the
installation or the installation command level to provide the
experts on the ground the flexibility to pursue, develop, and
integrate new emerging technologies?
General Nakasone. So, Congressman, I would offer that we
have some of that today and I think, you know, working with,
you know, DIU--you know, Defense Innovation Unit--being able to
work at a facility like we have at USCYBERCOM called DreamPort
where, you know, private companies are able to understand what
our needs are and then rapidly adopt it.
It isn't necessarily a means of not having enough money.
It's the fact that what we are doing is trying to cut down the
barriers to make sure that the private sector understands our
needs and rapidly they're being able to meet those needs. We
have had some success there.
We need more. And I think that's, you know, more empowered
by this idea of being able to have a number of different
touchpoints such as Defense Innovation Unit and DreamPort
available to our folks readily.
Mr. Moore. So DIU's--we have interacted with them from our
team, have had very positive interactions and I really
appreciate the shift that we're really trying to make here,
taking commercial products--taking what's commercially
available and making it very relevant and useful in our DOD. So
it's a good--please.
General Nakasone. So, if I might follow up on it. So meet
very frequently with Mike Brown, you know, who's the leader of
DIU. What has been most effective for us is for them to
understand these are the challenges that we would like to have
you go and see what the private sector may have. And so they've
done that readily and I think we're starting to see some of the
benefits of that.
Mr. Moore. With it not being as much, as you say, the
funding issue, more of a regulatory and, you know, that kind of
conversation, we're welcome to that. I think that you would get
a lot of support from this committee on helping navigate that.
Also, General, my bipartisan bill, the Better Cyber Crimes
Metric Act, passed the House last week. It will improve the way
Federal Government tracks, measures, and analyzes cyber crime.
However, I'm concerned we still do not have enough to
incentivize private businesses and industry to share with the
government when cyberattacks occur.
While you and I know--we know this not to be true, many
business owners have been told that they have low confidence
the government will do anything if hacks are reported. Do you
have any recommendations on how to increase the willingness of
private companies to share information when these attacks do
take place?
General Nakasone. Congressman, if I might take that for the
record, just because I'd like to think about that a bit more. I
know it's a very difficult question and I want to make sure I
give a fulsome answer.
[The information referred to can be found in the Appendix
on page 53.]
Mr. Moore. Okay. Excellent. That's--I've interacted with
our Utah network quite a bit. We have a really awesome group of
cyber professionals, startups, that's going on, that's being
taught at our universities.
It's a burgeoning area and we're really excited about it,
and they're really engaged and they want to help. They want to
be involved in the work they're doing for the mission and for
the pride of their country. So I appreciate any response that
you have with that.
We have historically led the world in developing
cybersecurity initiatives and standards, and as I've talked to
those experts, they're waiting to implement new forms of
security approved or recommended by key government entities to
ensure that businesses are not using technologies that may not
receive future approval for government use.
This has undoubtedly slowed the adoption of new
cybersecurity technologies. What is CYBERCOM doing to help
inform and assist private partners with legacy security systems
strained by the rapid proliferation of new computing form
factors?
General Nakasone. So, Congressman, our focus has been on
the defense industrial base [DIB]. That's where the Secretary
of Defense is a sector risk management authority. And so we
have worked closely with both the National Security Agency and
our private DIB partners to make sure that they have both an
understanding of the threat and understanding of ways that they
can rapidly get after that threat.
Mr. Moore. Thank you. My time's up.
Mr. Langevin. Thank you, Mr. Moore.
Ms. Escobar is recognized for 5 minutes.
Ms. Escobar. Thank you so much, Chairman, for holding this
hearing. It's a great opportunity for the committee to examine
the functions of CYBERCOM and inform the American public of the
critical role it plays in our Nation's cyber strategy.
As more and more of our daily lives move onto the web, it's
essential that our country have top-of-the line cybersecurity
defenses. This is especially critical for me because I
represent El Paso, Texas, a border region with over 800,000
people that is also home to one of the largest installations in
the Department of Defense, Fort Bliss.
General Nakasone and Secretary Plumb, I'm going to ask both
of you the same question. One of the recurring topics on border
security over the last years--the last few years has been
technology.
I'm a firm believer that appropriate technology can and
should be used to perform certain security functions and that
deploying more strategic technology at our land ports, in
particular--our land ports of entry--can decrease wait times
for both cars and pedestrians, moving trade and commuters more
quickly and more securely.
However, the use of this technology does raise certain
questions, including how well fortified it is against potential
adversarial cyberattacks.
General and Secretary Plumb, you mentioned working in an
interagency manner with the Department of Homeland Security. Is
there any interagency collaboration between CYBERCOM, the
Department of Defense, and the Department of Homeland Security
on the cybersecurity being provided for the ever-expanding
technology being used at our borders?
General Nakasone. Congressman, thank you very much for your
question and your emphasis on cybersecurity.
While U.S. Cyber Command does not have that relationship,
the National Security Agency, of which I head--does have that
relationship with the Department of Homeland Security to
provide that type of support with regards to cybersecurity.
Now, that's something we do regularly with the Border Patrol
based upon the request of the Department of Homeland Security.
And so this is something that is an ongoing mission for us
at NSA and it's something that the DHS [Department of Homeland
Security] and NSA regularly talk about.
Ms. Escobar. Great. And, actually, Secretary Plumb--thank
you so much, General--does the Department view the expansion of
technology at our borders as another avenue that a foreign
adversary may seek to exploit if the proper cybersecurity
precautions are not taken?
Dr. Plumb. Thank you, Congresswoman. I would say every
technology has an avenue for exploitation that an adversary
could use.
Ms. Escobar. Thank you.
General, we had a discussion last year about CYBERCOM's
efforts to recruit a diverse workforce. As I mentioned then, I
represent the University of Texas at El Paso, which is a
Hispanic-serving institution with a strong track record with
the NSA as a National Center of Academic Excellence in cyber
operations.
In your written testimony, you mentioned CYBERCOM's
academic engagement network. I'd like to give you an
opportunity to expand on the work you've been doing with that
initiative and others to not just engage with academia but to
recruit talent that comes from every corner of the country,
including traditionally underrepresented populations.
General Nakasone. Congresswoman, I welcome your invitation
to do that. As you well know, we stood up the Academic
Engagement Network at U.S. Cyber Command just this year and
part of that is to be able to recruit a much broader
demographic of our Nation. We need a force that's reflective of
our Nation and this is one of the ways that we're doing it.
I must, in all transparency, tell you that our focus has
been in San Antonio of late and so maybe we need to go a little
bit further to the west in Texas to take a look at what El Paso
has to offer there. But if you don't mind, let me take that up
in the coming year.
Ms. Escobar. I would invite you to do that and, in fact,
would be happy to host you for a visit at the University of
Texas at El Paso in El Paso, and then would love to follow up
with you at some point in the near future about any lessons
that you've learned since the start of the Academic Engagement
Network, anything that you'd like to share with us so that we
can continue to build on the work that you've begun.
Mr. Chairman, my time has just about expired. I yield back.
Mr. Langevin. Thank you, Ms. Escobar.
Mr. Fallon is now recognized for 5 minutes.
[No response.]
Mr. Langevin. Do we have Mr. Fallon?
Mr. Fallon. Yes. Yes, sir. Thank you. Thank you.
Mr. Langevin. Very good. You're recognized for 5 minutes,
Mr. Fallon.
Mr. Fallon. I was promoting you.
[Laughter.]
Mr. Fallon. Thank you. Listen, I think one of the mistakes
that the public makes when it comes to cyber defense policy is
the idea that this is somehow a new realm. However, you know,
the threats in cyberspace aren't new and they've long since--we
have long since possessed both offensive and defensive
capabilities, and competition in cyberspace, of course, is
almost constant.
Even though this problem has been an issue for a long time,
I have a substantial concern that the Department of Defense is
still not properly positioned to address it in today's rapidly
evolving landscape.
My concern is that there are too many--maybe too many chefs
in the kitchen, if you will. I understand CYBERCOM is a joint
force comprised of service cyber components from each of the
branches.
And on top of that, you have Cyber National Mission Force
and Joint Force Headquarters and DOD Information Network. I
mean, already that becomes seven separate commands. Mix in
CYBERCOM's commander's dual role as Director of the NSA and
Chief of Central Security Service and you get another one.
Finally, throw in the rest of the intelligence community,
the Department of Homeland Security, Department of Justice, et
cetera, and I think you see where I'm going with this. So what
do you get? A whole lot of bureaucracy and finger-pointing and
not a highly adaptable organization ready and willing to fight
and win.
Everybody wants to be in charge and everybody wants to, you
know, maybe get the credit or pass on the blame if that's the
case.
Dr. Plumb, can you honestly say that our cyber mission
force is not hampered by this bureaucracy, and if you think
there is a bureaucracy issue, what can we do to streamline it?
Dr. Plumb. Thank you, Congressman. I agree with you that we
need to make sure that bureaucracy doesn't get in the way of
delivering military effects where needed.
I actually think that we are in pretty good shape at the
moment. There's always room for improvement and always have to
be--anyone that works in the Pentagon or, really, the
government knows that you always have to be careful to guard
your ability to not have more bureaucratic growth slow you.
I think the trend line, though, for cyber effects in
particular has--is on--is going in the right direction. As we
said at the beginning, sir, NSPM-13 has provided improvements
in the ability to use cyber to advance the national interest
and my goal in this role is to make sure that that trend line
continues in a positive direction.
Mr. Fallon. And do you think there's--what things
specifically--and you don't need to say it right now if--or if
you want to get back to us--but how can we maximize efficiency?
I just want to--I just want us to be thinking along those
lines.
General, just for time's sake--General Nakasone, we have
heard some complaints from within CYBERCOM that, you know, one
day they work for one person and their priorities. Then the
next day it changes. How do we create a unified vision and
mission to set--to avoid subordinate commanders working on, you
know, pet projects in silos, if you will?
General Nakasone. So, Congressman, I'm not aware of that. I
would tell you that there's one person in charge of U.S. Cyber
Command and that person is me and we haven't--I have not seen
that in terms of being able to develop options or being able to
respond to crises for the Nation.
One of the opportunities that we have here is the fact that
we have a very flat organization. While we may have a number of
different headquarters, the teams all fall under the
operational control of the commander.
And so while we have different missions that we support
different commanders, there is no problem in terms of being
able to develop the options and the requirements and, I would
tell you, the effects for what our Nation needs.
Mr. Fallon. General, we recently created a new service in
the Space Force. You know, cyberspace is a realm, of course,
that touches everyone everywhere.
Do you believe there's any merit to creating another
service designed to support all others, you know, like absent
of territorial commands from subordinate commanders that can
focus solely on cyberspace across DOD?
General Nakasone. Congressman, I don't see this right now.
One of the areas that I think has been very effective, as the
chairman had indicated, we have service-like authorities to
train the force, to be able to provision the force, to be able
to do acquisition.
I would be very concerned on a new service in terms of
what--you know, what you would call the bureaucracy that we'd
be set up there. We're looking for, you know, our services that
do a very, very good job of recruiting and training and then
for us to be able to employ them rapidly.
Mr. Fallon. Okay. Thank you, Mr. Chairman. I yield back.
Mr. Langevin. Thank you, Mr. Fallon.
And now Mr. Larsen is now recognized for 5 minutes.
Mr. Larsen. Thank you, Mr. Chair. I appreciate that, and
thanks for coming this afternoon.
General Nakasone, this is somewhat related to the question
you just asked but I'm asking it in a different way to maybe
sort of dig into a little bit about the construct of the
CYBERCOM integrated planning elements and the joint cyber
centers, if that's the most optimized mechanism for
coordination between CYBERCOM and other COCOMs [combatant
commands].
General Nakasone. So I've seen it both ways, Congressman.
I've lived long enough now to see both the joint cyber centers
and now what we developed over the previous years, the
integrated planning elements.
Let me tell you why I think the integrated planning
elements are really what has been very effective for us. We
have taken and designed an integrated element that goes to each
of the combatant commands, the other 10 combatant commands, and
it varies in size from 39 to 50 folks.
What that provides the commander are people that really
understand cyberspace, that understand how we do our
operations, how we do our planning, how we do our execution.
They're resident today with General Wolters at U.S.
European Command. In fact, they are resident today to really
understand and be able to provide General Wolters' staff the
options that are necessary, both defensively and offensively,
that are effective.
Why do I think this has been effective is because the
feedback that I'm getting from the commanders is that they
really value this type of integration.
Mr. Larsen. So when they are with the COCOM, does COCOM
then have an operational command of those folks, so they're
setting the missions, whereas you've--perhaps you've done the
training and equip part of the mission? Is that how to think
about this?
General Nakasone. They go embed themselves within different
parts of the staff within the COCOM. That's designed by the
combatant commander.
Mr. Larsen. Uh-huh. Yeah. Well, maybe take a look at that.
But a little bit more on that point, though--thanks for
bringing up EUCOM [U.S. European Command]--and again, I
apologize. I was out. But there was an article last month,
``Cyber troops stretched thin in Ukraine,'' and I don't know
how you can--if you can answer this or not, but how you see
U.S. capabilities currently coordinating or integrating with
allies and partners in any--in any current operations that are
based in EUCOM.
General Nakasone. So we can talk about this in more detail
in the closed session. But what I would offer here is that one
of the very big lessons that we have learned is the ability to
deploy a number of different teams early on in a crisis to U.S.
European Command, and then working with General Wolters and his
staff, making sure that those experts, those teams, go to the
places that are necessary.
And I can provide a little bit of thought in terms of where
those teams have gone when we meet a little later on today.
Mr. Larsen. Are there broader lessons to learn about what
would--what would trigger the decision to send those teams? It
seemed kind of--it seemed somewhat obvious in the current case,
let's say, but there may be other cases in the future where it
may not be as obvious that, oh, it's time to send teams. So
what are you learning about looking into the future?
General Nakasone. So what we have learned over nine
different hunt forward operations in 2021 is the fact that
consistent engagement with a series of partner nations is
really valuable. We understand the networks. We understand the
leadership. We understand what they care about most.
And so working with that, you know, in competition or
crisis is much better than, you know, waiting until there's a
conflict.
Mr. Larsen. Right.
General Nakasone. And so that's what we have learned.
Mr. Larsen. Mm-hmm. And I'm sorry, Mr. Chair. Did folks ask
questions about education requirements or anything else?
So yeah. So how are we doing with the pipeline of people
that CYBERCOM can utilize in the future?
General Nakasone. Broadly, I would say, Congressman, is our
supply is not large enough in our Nation. And so as you well
know, within the State of Washington with a number of different
centers of academic excellence, we follow this up now at U.S.
Cyber Command with the Academic Engagement Network to be able
to build a resource for our Nation and that doesn't necessarily
mean that they will come in as military civilian members of the
Department of Defense, but the ability for them to have
exposure and interest in what I think is, obviously, you know,
a key competitive advantage for our Nation in the future.
Mr. Larsen. All right. That's fine. Thank you. And I yield
back.
Mr. Langevin. Thank you, Mr. Larsen.
Mr. Johnson is recognized.
Mr. Johnson. Thank you, Mr. Chairman, and thank you,
General, for your time today. In your role, you are responsible
for the cyber operations that protect the sprawling .mil
digital enterprise that our warfighter really depends upon, and
over the last several years, progress has been made to
implement an internet operations management program that looks
at DOD's cyber infrastructure through the eyes of the
adversary.
But despite some progress, this program has yet to be
deployed across the entire DOD Information Network [DODIN], and
recently enacted fiscal year 2022 DOD appropriations provide
funds to do that.
So are you committed to pushing this critical endeavor
across the finish line this year? Should we expect that?
General Nakasone. I am committed, Congressman, and I would
say, first of all, thank you for discussion on the DOD
Information Network, a sprawling network in terms of, you know,
what provides us support for our warfighting functions, our
communications, and our capabilities.
What we have done with our joint force headquarters that's
in charge of the DOD Information Network is look at all 45
stakeholders within this information network and then make sure
that we're checking in terms of how they're conducting their
operations.
This is part of the--you know, the foundational work that
we need to have a much more secure and resilient DODIN.
Mr. Johnson. Very good.
And could you describe how CYBERCOM is integrating
artificial intelligence and machine learning to automate
defense of the DODIN and monitor it and identify cyber threats?
General Nakasone. Congressman, we have worked a number of
different experiments. I know of specifically an experiment
that we worked at Army Cyber to look at artificial intelligence
and machine learning to identify vulnerabilities within our
network and then patch them automatically.
This is a really good example of taking, you know, what we
would consider, you know, a vulnerability and not having to
have a human in the loop but rapidly being able to address the
vulnerability with a patch before anyone knows it.
This is the initial work that we have done. There's more
work that needs to be done in AI. I'm a very, very strong
supporter of the AI National Commission and where we can bring
that to U.S. Cyber Command.
Mr. Johnson. And I know that some of this is sensitive and
may be better in a classified setting, but I'm just wondering
about what the most promising applications of AI and ML
[machine learning] may be for the CYBERCOM enterprise.
General Nakasone. There are many, Congressman, and I think
that I will defer that to a different venue to, perhaps, have
that discussion with you.
Mr. Johnson. Very good. Let me ask you about something
else. I've got a couple minutes here. The late scholar Thomas
Schelling described bargaining power is the power to hurt.
Could you describe the utility of the defense forward concept
compared to a more traditional deterrence by the punishment
model?
General Nakasone. So, as, you know, Secretary Plumb
indicated, cyber deterrence is not nuclear deterrence and this
is a much different, you know, means upon which we look at this
domain.
And so what we have learned, I think, over the past several
years is that we have to have an ability to really drive the
cost up for our adversaries and there are a number of different
ways that we can drive the cost up for our adversaries.
One is we can have much more resilient networks. Two, we
can share information more broadly. Three, we can take on cyber
adversaries that are attempting to attack our Nation. Those are
all ways of doing it.
But it's a comprehensive approach. And the other piece that
I would add is what we have learned from elections is that
partners matter and partners like the FBI, partners like CISA,
partners like academic institutions that have, you know,
knowledge that they're tracking on adversaries that we may not
even see.
And so I think, again, to the point of there's no one
agency, no one department, that can do it all in cyberspace,
but the most effective ones are the ones that partner and get
it done together.
Mr. Johnson. Very good. Thank you again, General.
I yield back.
Mr. Langevin. Thank you, Mr. Johnson.
Mrs. Bice is now recognized for 5 minutes.
Mrs. Bice. Thank you, Mr. Chairman, and General Nakasone,
it's good to see you again.
The emergence of new technologies like artificial
intelligence and quantum computing and the proliferation of
cyber intrusion capabilities pose significant threats to our
national security and to our service members.
One of my key concerns impacting the Nation's cyber posture
is the workforce challenges that we face. As you are both well
aware, it is critical that we get more trained cyber
professionals into the door at U.S. Cyber Command.
With the tremendous competition in the private sector for
cyber talent this is a huge challenge.
General Nakasone, can you briefly describe the U.S. Cyber
Command's efforts to recruit and retain top talent in the face
of stiff competition from the private sector?
General Nakasone. Congresswoman, thank you very much, and
it's good to see you again as well.
Let me begin, first of all, with the recruit piece. This is
an area that I think our services who have a responsibility--
Army, Navy, Air Force, Marines--to recruit talent have done
exceptionally well.
We continue to recruit a population of young men and women
that want to serve our Nation and they want to work in
cyberspace, which is incredibly attractive to them.
The challenge is not necessarily the recruiting. The
challenge isn't the training. The challenge, as you've
indicated, is the retention and that's both for military and
civilian.
Let me give you two ideas in terms--or several ideas that
we have approached it. One is, certainly, targeted supplements
to very, very high-end capabilities. So this is targeted local
supplements based upon people that are coders or people that
have significant technical abilities, that pay them at 28
percent more than the going rate.
That's never going to, perhaps, compete with the private
sector. But what it does do it does give us a leg up in being
able to say what you do is valued and what you do is,
obviously, renumerated.
The other piece that I would say is a certain amount of
dynamic of how we approach cyberspace and one of the things is,
as the Congressman mentioned, you know, being able to do
recruiting is, you know--from, you know, a population of
civilians is, hey, come in and be a mid-grade officer. Or, as
we take a look at our enlisted workforce and say, hey, why
don't you go and spend 6 months in training with industry or
going to get a graduate degree?
These are all areas that, perhaps, we haven't traditionally
done within our services. But this is the dynamic nature that I
think we have got to approach the problem here in cyberspace.
So as I've talked to the service chiefs, one of the areas
that I've mentioned is this is a shared responsibility, shared
in terms of what you have to do as leading your service but
also shared in the idea we have a lot of different areas that
we need to be able to make sure that we keep our best people.
Mrs. Bice. I love your thinking outside of the box approach
to this--the problem because I think we have to figure out how
do we keep and retain this crucial talent.
One other, maybe, thought here is how are you competing
with DHS when it comes to pay for these individuals? It's my
understanding that CISA folks are paying significantly or can
pay significantly more than you're able to do. Is that
something that Congress needs to look into?
General Nakasone. So we're working with the Department
right now in terms of, you know, how we have to look at that.
That's not only as my role as Commander of U.S. Cyber Command.
It's also my role as Director of NSA because we do see, you
know, increased competition.
But again, you know, I think this is something that work
closely with the Department, working, obviously, through
Secretary Plumb as well as the Principal Cyber Advisor to bring
these ideas. This is something that we're very well aware of.
Mrs. Bice. Good. And when it--when we're talking about
cyber leverage, how does CYBERCOM leverage commercial threat
information provider--threat at information providers and how
does CYBERCOM share information currently?
I've heard some concerns about not sharing information. You
mentioned the FBI previously in a comment that you made.
I think we have siloed a lot of information and there's not
as much sharing as there could be. Can you talk a little bit
about that?
General Nakasone. There's a program called Under
Advisement. That is a commercial program that we execute at
U.S. Cyber Command. It's run by 12 people of my command that
reaches out to a number of commercial providers and talks about
what we're seeing in cyberspace, and what are you seeing? It's
a two-way street, right. I mean, so we're very interested in,
obviously, what they're seeing. But they're also interested to
know what are you seeing about our threats.
This is an incredibly and powerful program that has been
able to allow us insights into ransomware and insights into
adversaries that are seeking vulnerabilities within our
networks. But it's all based upon this idea of give and take
with the private sector. And so this is a program that I would
commend in terms of really great success that we're seeing.
Mrs. Bice. I would love to see more of that because I think
that information share is going to be crucial for us to be able
to prevent significant national security cyber threat that we
face every day. But that sharing of information for the private
sector is crucial.
General Nakasone. If I might follow up. One other piece
that I do want to highlight is that I did mention the Federal
Bureau of Investigation and our Cyber National Mission Force--
it's commanded by Major General Hartman--our elite force that
has done tremendous work in defense against malicious cyber
actors in both elections and ransomware, is closely partnered
with a number of different field offices throughout the United
States to share this information.
As you're well aware, the FBI, obviously, has a track on
these cyber criminals within the United States. So this pairing
of information is one of the areas that Director Wray and I
talk about a lot as being a significant success story in 2021.
Mrs. Bice. Thank you, Mr. Chairman. I yield back.
Mr. Langevin. Thank you, Mrs. Bice.
We're going to be wrapping up in just a minute to go into
the closed session upstairs. But before we do that, General
Nakasone, if I could, earlier today in your appearance in front
of the Senate Armed Services Committee you spoke to the--to
readiness matters and in those remarks you noted there are
defined roles for Cyber Command and the military services, and
that the services, generally, are able to present forces that
have passed through a basic level of training.
From there, it's the command's responsibility to manage the
advanced training. I know that in discussions that you and I
have had, that obviously training is important, having the--you
know, the right skill level, especially as you're operating--
our operators operating in cyberspace.
If we have got concerns around the readiness of our force
and the commitment of the services to the cyber domain writ
large, should we be pressing the services to reexamine and
consider raising the bar on what that basic level of training
consists of and is defined as? Or, you know, do you recommend a
better way of doing this, should we be taking a fresh look at
that?
General Nakasone. Chairman, I mean, you've hit the nail on
the head here. This is what we're doing right now, which is,
the Secretary of Defense has signed out a memorandum directing
that one service, the Army, has the responsibility for advanced
cyber training.
And so now we're going to build that with the Army being in
charge to be able to ensure that we have standards at different
locations for this training.
My hope is that by the time an operator comes to me,
there's very little training that they have to do. That's not
the case today for a number of different reasons, and so,
again, this is part of our maturity, our readiness. But I do
see progress, as we move forward.
Mr. Langevin. I hope you'll have advice for us and thoughts
on how we kind of make that--the training kind of uniform level
of readiness among all the services so when they get to you,
you know, they're at peak level and then you can take them,
obviously, even further. So----
General Nakasone. And part of this, Chairman, is, you know,
cyberspace is one of the few domains that is just now getting a
simulation capability. For us it's called a Persistent Cyber
Training Environment.
It's where we're able to do missions in a simulated way,
and you can imagine the power of this being able to do with
training, repetition and repetition and more reps, being able
to do that.
So we're deploying that now throughout our service elements
to be able to do that. That's a key enabler that we need to be
able to do in 2022.
Mr. Langevin. Excellent. Excellent. And I know that, you
know, we have talked about the amount of time they're assigned
to U.S. Cyber Command in a cyber role and, you know, before we
wrap up is there anything that you want to talk about, you
know, publicly in terms of how long you'd like to keep them,
you know, doing cyber work as opposed to the current construct?
Anything you want to add?
General Nakasone. Forever.
[Laughter.]
Mr. Langevin. So I----
General Nakasone. So, I mean, Chairman, I would say that
I'm working this very closely with the service chiefs now. In
fact, I'm in communication with them to look at this. This is
something that Command Sergeant Major Lyon is also working with
the senior enlisted leaders.
We have to standardize tour lengths. We need to standardize
Active Duty service obligations. We need to take a look at a
means upon which we have, I think, more uniformity with regards
to how long, you know, young men and women are going to be with
our force.
Mr. Langevin. Agreed. That's something that I and the
committee is going to continue to follow. I look forward to
working with you on that, going forward, as well.
Okay. So with that, I'm going to ask unanimous consent that
Ranking Member Banks' opening statement be entered into the
record. He's still in his markup. And so without objection, so
ordered.
[The prepared statement of Mr. Banks can be found in the
Appendix on page 32.]
Mr. Langevin. With that, I want to thank members for their
questions. I want to thank our witnesses for their testimony
today and their answers to the questions.
Members may have additional questions that they need to get
answered that will be submitted for the record. We ask that you
respond to those members in writing as expeditiously as
possible.
We will now adjourn and move to the closed session
upstairs.
With that, the subcommittee stands adjourned.
[Whereupon, at 5:27 p.m., the committee proceeded in closed
session.]
=======================================================================
A P P E N D I X
April 5, 2022
=======================================================================
=======================================================================
PREPARED STATEMENTS SUBMITTED FOR THE RECORD
April 5, 2022
=======================================================================
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
=======================================================================
WITNESS RESPONSES TO QUESTIONS ASKED DURING
THE HEARING
April 5, 2022
=======================================================================
RESPONSE TO QUESTION SUBMITTED BY MR. MOULTON
Dr. Plumb. The DOD Principal Information Operations Advisor is
currently overseeing the review of the DOD Strategy for Operations in
the Information Environment and is conducting the first-ever
information operations posture review. These and other ongoing efforts
will enable DOD to evaluate the effectiveness of our current and
planned actions and identify any additional steps that should be
considered, including any further organizational adjustments to improve
the Department's efficiency and effectiveness. [See page 11.]
______
RESPONSE TO QUESTION SUBMITTED BY MR. MOORE
General Nakasone. U.S. Cyber Command missions and authorities
dictate that operations will take place outside the United States. As
you are aware, legal barriers are but one of the reasons the private
sector is reticent to share information with government organizations.
Within the United States, the Federal Bureau of Investigation (FBI) and
Cybersecurity and Infrastructure Security Agency (CISA) have the
responsibility to work with the private sector in regards to protecting
their networks and information sharing. Information sharing and public-
private partnerships are where the power is--together they both play a
vital role in everyone defending and protecting their networks. [See
page 13.]
[all]