[Senate Hearing 117-410]
[From the U.S. Government Publishing Office]
S. Hrg. 117-410
NOMINATIONS OF ROBIN CARNAHAN,
JEN EASTERLY, AND JOHN C. INGLIS
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON
HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
__________
NOMINATION OF ROBIN CARNAHAN TO BE ADMINISTRATOR,
GENERAL SERVICES ADMINISTRATION, JEN EASTERLY TO BE
DIRECTOR, CYBERSECURITY AND INFRASTRUCTURE SECURITY
AGENCY, U.S. DEPARTMENT OF HOMELAND SECURITY AND
JOHN C. (CHRIS) INGLIS TO BE NATIONAL CYBER DIRECTOR, EXECUTIVE OFFICE
OF THE PRESIDENT
__________
JUNE 10, 2021
Available via the World Wide Web: http://www.govinfo.gov
Printed for the use of the
Committee on Homeland Security and Governmental Affairs
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
U.S. GOVERNMENT PUBLISHING OFFICE
46-566 PDF WASHINGTON : 2022
COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
GARY C. PETERS, Michigan, Chairman
THOMAS R. CARPER, Delaware ROB PORTMAN, Ohio
MAGGIE HASSAN, New Hampshire RON JOHNSON, Wisconsin
KYRSTEN SINEMA, Arizona RAND PAUL, Kentucky
JACKY ROSEN, Nevada JAMES LANKFORD, Oklahoma
ALEX PADILLA, California MITT ROMNEY, Utah
JON OSSOFF, Georgia RICK SCOTT, Florida
JOSH HAWLEY, Missouri
David M. Weinberg, Staff Director
Zachary I. Schram, Chief Counsel
Christopher J. Mulkins, Director of Homeland Security
Claudine J. Brenner, Counsel
Pamela Thiessen, Minority Staff Director
Andrew Dockham, Minority Chief Counsel and Deputy Staff Director
Kirsten D. Madison, Minority Director of Homeland Security
Amanda Neely, Minority Deputy Chief Counsel
William H.W. McKenna, Minority Chief Investigator
Jeffrey A. Post, Minority Senior Professional Staff Member
Cara G. Mumford, Minority Professional Staff Member
Andrew J. Timm, Minority Professional Staff Member
Laura W. Kilbride, Chief Clerk
Thomas J. Spino, Hearing Clerk
C O N T E N T S
------
Opening statements:
Page
Senator Peters............................................... 1
Senator Portman.............................................. 2
Senator Carper............................................... 18
Senator Lankford............................................. 21
Senator Padilla.............................................. 24
Senator Hassan............................................... 27
Senator Hawley............................................... 29
Senator Ossoff............................................... 32
Senator Scott................................................ 35
Senator Sinema............................................... 40
Prepared statements:
Senator Peters............................................... 45
Senator Portman.............................................. 47
WITNESSES
Thursday, June 10, 2021
Hon. Roy Blunt, a U.S. Senator from the State of Missouri........ 3
Hon. Mike Gallagher, a Representative in Congress from the State
of Wisconsin................................................... 3
Hon. Angus S. King, Jr., a U.S. Senator from the State of Maine.. 5
Robin Carnahan to be Administrator, General Services
Administration
Testimony.................................................... 7
Prepared statement........................................... 49
Biographical and professional information.................... 52
Letter from U.S. Office of Government Ethics................. 72
Responses to pre-hearing questions........................... 76
Responses to post-hearing questions.......................... 101
Jen Easterly to be Director, Cybersecurity and Infrastructure
Security Agency, U.S. Department of Homeland Security
Testimony.................................................... 8
Prepared statement........................................... 108
Biographical and professional information.................... 110
Letter from U.S. Office of Government Ethics................. 130
Responses to pre-hearing questions........................... 136
Responses to post-hearing questions.......................... 169
Letters of support........................................... 172
John C. (Chris) Inglis to be National Cyber Director, Executive
Office of the President
Testimony.................................................... 10
Prepared statement........................................... 189
Biographical and professional information.................... 191
Letter from U.S. Office of Government Ethics................. 212
Responses to pre-hearing questions........................... 219
Responses to post-hearing questions.......................... 250
Letters of support........................................... 261
APPENDIX
Mission Needs Chart.............................................. 265
HSGAC Letters.................................................... 266
NOMINATIONS OF ROBIN CARNAHAN,
JEN EASTERLY, AND CHRIS INGLIS
----------
THURSDAY, JUNE 10, 2021
U.S. Senate,
Committee on Homeland Security
and Governmental Affairs,
Washington, DC.
The Committee met, pursuant to notice, at 10:16 a.m., via
Webex and in room SD-342, Dirksen Senate Office Building, Hon.
Gary C. Peters, Chairman of the Committee, presiding.
Present: Senators Peters, Carper, Hassan, Sinema, Rosen,
Padilla, Ossoff, Portman, Lankford, Scott, and Hawley.
OPENING STATEMENT OF CHAIRMAN PETERS\1\
Chairman Peters. The Committee will come to order.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Peters appear in the Appendix
on page 45.
---------------------------------------------------------------------------
Today we are considering three nominations: Robin Carnahan,
who is joining us remotely, to be Administrator of the General
Services Administration (GSA); Jen Easterly, to be Director of
the Cybersecurity and Infrastructure Security Agency (CISA),
within the Department of Homeland Security (DHS); and Chris
Inglis, to be the first-ever National Cyber Director (NCD).
Welcome to each of you, and welcome to your family members who
are joining us here today.
Congratulations on your nominations, and thank you for your
previous service and for your willingness to take on these
important new roles.
The agencies or offices you have been nominated to lead,
each play a critical role in strengthening our national
security and ensuring the Federal Government is operating both
effectively and efficiently.
The General Services Administration provides a wide range
of support to Federal agencies, including managing Federal
property and the Federal fleet and offering cost savings,
acquisition programs, and technology services. In short, GSA
helps ensure agencies can deliver for the taxpayer and for the
American people.
Ms. Carnahan, if confirmed, you will lead GSA at a pivotal
moment. The Coronavirus Disease 2019 (COVID-19) pandemic
changed how workplaces operate across the government and across
the Nation. The Biden administration is charting a course to
make Federal buildings, vehicles, and operations more energy
efficient, and agencies must do more to modernize and secure
their information technology (IT) systems and their networks. I
look forward to hearing more about how you plan to lead GSA to
tackle these and other challenges.
The next two nominations are both firsts for this
Committee. Ms. Easterly, you are the first person nominated to
lead CISA since it was created by this Committee in 2018 and
charged with protecting and defending Federal networks and
securing critical infrastructure. This Committee worked closely
with Chris Krebs, who led the transformation from its
predecessor agency, and CISA has made a lot of progress in a
very short period of time. But we all know there is a whole lot
more to do.
The recent SolarWinds hack and the Colonial Pipeline
ransomware attack are only the latest reminders of what the
Federal Government must do to secure its own networks and to
work with and support our private sector, nonprofit, State,
local, tribal, and territorial (SLTT) governments.
Mr. Inglis, you have been nominated to be the first-ever
National Cyber Director, a position this Committee created last
year to lead a new office within the Executive Office of the
President (EOP) and coordinate national cybersecurity policy
and strategy. The National Cyber Director will be central to
ensuring a cohesive, whole-of-government approach to
cybersecurity.
These are all vital roles, and I am pleased we have three
highly qualified nominees here today who each bring a wealth of
government and private sector experience. I look forward to
hearing from each of you today.
With that, I will turn it over to Ranking Member Senator
Portman.
OPENING STATEMENT OF SENATOR PORTMAN
Senator Portman. Thank you, Chairman Peters, and I thank my
colleagues for being here. Senator King, I just left you a few
moments ago on a Zoom call. Senator Blunt, you and I have spent
a lot of quality time together recently.
Senator Blunt. That is our lives these days.
Senator Portman. Yes. I have a very long, articulate and
important statement to make that I am going to submit for the
record\1\ and instead just say welcome to Ms. Carnahan, Ms.
Easterly, and Mr. Inglis. I have spoken to all of you. I have
had the opportunity to get to know you a little bit. These are
really important positions, and the leadership deserves careful
consideration, which it will get at this hearing.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Portman appears in the
Appendix on page 47.
---------------------------------------------------------------------------
With that, Mr. Chairman, I will again submit my full
statement for the record and look forward to hearing from my
colleagues in the Senate.
Senator Peters. Next we have some guests joining us today
to introduce the nominees.
First, we are joined by our colleague Senator Blunt, who
will be introducing Ms. Carnahan. Senator Blunt, thank you for
being with us. Good to see you, and you are recognized for your
introduction.
STATEMENT OF HONORABLE ROY BLUNT, A UNITED STATES SENATOR FROM
THE STATE OF MISSOURI
Senator Blunt. Thank you, Chairman Peters. As Senator
Portman pointed out, the three of us, along with Senator
Klobuchar, have spent a lot of time together over the last
month. I am glad to be here on this topic as well as I was
pleased to work on the other issues we have been working on.
Thanks for holding this hearing. I am glad to be able to
speak to the Committee regarding the nomination of Robin
Carnahan to be the Administrator of the General Services
Administration. I am honored to welcome her to the Senate today
even if it is only over video.
Robin Carnahan was born and raised in the great State of
Missouri. Throughout her life, she and her family have served
our State and our country in many roles and with distinction.
After graduating from William Jewell College in Liberty,
Missouri, and the University of Virginia Law School, she
practiced law in St. Louis and held positions with the National
Democratic Institute and the Export-Import (EXIM) Bank of the
United States. From 2005 to 2013, she served as the Secretary
of State of Missouri. In this role, she utilized innovative
technology to save money and improve government service for
residents of Missouri, I probably should add here following the
example of her great predecessor, my son, Matt Blunt, who held
that job right before Robin did. It is a job I held as well,
and the three of us have common appreciation for that
particular place to serve Missourians. In 2016, she joined the
Office of 18F at the General Services Administration. This
office provides technology consultation to State and local
governments.
I think the bottom line here, Mr. Chairman and Senator
Portman, is that Robin Carnahan understands the GSA and she
understands the importance of the GSA to the country. I have no
doubt that, if confirmed, she would be a successful and an
effective Administrator of the General Services Administration.
I understand this to be a job of major significance in the
daily operations and decisions of the government that fall
within the purview of the General Services Administration. I
look forward to supporting her confirmation. Of course, before
I can do that, your Committee needs to recommend that that
confirmation move forward, and I hope you do.
Chairman Peters. Thank you, Senator Blunt.
Next we have a video from Representative Gallagher
introducing Ms. Easterly.
STATEMENT OF HONORABLE MIKE GALLAGHER, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF WISCONSIN
Mr. Gallagher. Thank you, Senator Peters, Senator Portman,
and distinguished Members of the Committee, for allowing me to
introduce Jen Easterly for her nomination to be the Director of
the Cybersecurity and Infrastructure Security Agency.
It is an honor to be here to introduce Jen. As the Co-Chair
of the Cyberspace Solarium Commission (CSC) with my good friend
Senator Angus King, I cannot overstate what a crucial role the
President has nominated Jen to fill. Our bipartisan public-
private commission assessed that CISA is the most important
agency in the execution of Federal network security and the
development of an effective public-private collaboration to
protect our national critical infrastructure.
CISA is quite simply on the front lines of ensuring the
Federal departments and agencies, the private sector, and the
American people have the resources to detect, withstand, and
respond to cyberattacks. Thanks in large part to the work of
your Committee, we have made significant progress on
strengthening the agency so that it can perform this crucial
mission.
For example, we authorized CISA to perform threat hunting
on Federal networks to more proactively identify cyber threats
to Federal assets and systems and begin any necessary
mitigation processes sooner. We also elevated the role of CISA
Director so that the position is equivalent to that of the
Transportation Security Administration (TSA) Administrator in
order to emphasize the importance and stature of the agency and
its leader. When we did that, when we amended the law to
elevate the position of CISA Director, we stipulated that a
qualified CISA Director would be someone who has extensive
knowledge of cybersecurity, infrastructure security, and
security risk management and has at least 5 years of experience
fostering multistakeholder coordination and collaboration on
these issues.
Jen Easterly's qualifications are well above and beyond
those stipulated by the law. Her background is incredible. She
is currently the head of Firm Resilience and the Fusion
Resilience Center at Morgan Stanley. In this capacity, she is
responsible for ensuring preparedness and response to business-
disrupting operational incidents and risks. Jen joined Morgan
Stanley in February 2017 to build and lead the firm's
Cybersecurity Fusion Center, which is the operational
cornerstone of its entire cyber defense strategy. Prior to
joining the private sector, Jen served for three decades in the
Federal Government. She was the Special Assistant to the
President and Senior Director for Counterterrorism, where she
led the development and coordination of U.S. counterterrorism
and hostage policy. Prior to that, she was the Deputy for
Counterterrorism at the National Security Agency (NSA), where
she was responsible for leading operations to detect and
disrupt terrorist attacks against the United States and our
allies.
Jen is a two-time recipient of the Bronze Star. She retired
from the U.S. Army after more than 20 years of service in
intelligence and cyber operations. She was responsible for
setting up the Army's first cyber battalion. She was also
instrumental in the design and creation of U.S. Cyber Command
(USCYBERCOM).
She is a distinguished graduate of the United States
Military Academy (USMA) at West Point. She holds a Master's
degree in philosophy, politics, and economics from the
University of Oxford, where she studied as a Rhodes scholar.
She is a real overachiever. I could go on. But Jen's accolades
and accomplishments are so numerous that we might never
actually get to the hearing itself. She was a critical member
of our Red Team on the Solarium Commission, and I want to say
what an honor it is to be at the same hearing where Senator
King, my Co-Chair, will introduce our fellow Commissioner Chris
Inglis for his nomination as our country's first National Cyber
Director.
Jen and Chris are great cybersecurity experts, to be sure,
but more than that, they are also great Americans. They embody
what it means to put politics aside and serve the Nation. They
will be a great team that introduces the speed and agility into
cybersecurity and critical infrastructure protection that I
believe is needed to protect our country against the malicious
cyber activity that we are seeing.
I look forward to this hearing and to the Committee's
progress on putting Jen to work as quickly as possible as our
next CISA Director. Thank you again, Senator Peters, Senator
Portman, and the distinguished Members of this Committee, for
your time and for your consideration of Jen's nomination.
Chairman Peters. Now we are joined by the Co-Chair of the
Solarium Commission. Senator King, great to have you before our
Committee. Senator King will recognize Mr. Inglis. Senator
King, you are recognized for your opening statement.
OPENING STATEMENT OF HONORABLE ANGUS S. KING, JR., A UNITED
STATES SENATOR FROM THE STATE OF MAINE
Senator King. Mr. Chairman and Senator Portman and Members
of the Committee, America is under attack. We are under attack
today. This is one of the most serious conflicts, one of the
most serious challenges that this country has faced in the
post-World War II period.
The two positions that we are really talking about today
are the equivalent of the Secretary of Defense and the head of
the Joint Chiefs of Staff (JCS). These are people who will be
charged with defending this country in what is an ongoing and
serious conflict.
I am taking time out now from an Armed Services Committee
hearing with the Secretary of Defense and the head of the Joint
Chiefs, and cyber is one of the things that we will be talking
about. It is a ubiquitous challenge not only to the government
but especially to the private sector, and that is one of the
really significant challenges in how we respond.
We have to reimagine conflict. We think of conflict in
terms of armies and battleships and air forces, but we are
really now talking about the front line of this conflict can
take place in a server farm on Wall Street, in a pipeline
company, or in an electric company, or in a water service
utility anywhere in America.
Chris Inglis served with Mike Gallagher and me on the
Solarium Commission, which was created by this Congress in 2019
to devise a national cyber policy. This was a unique Commission
that had four Members of Congress, four members from the
executive, and six members from the private sector, a totally
nonpartisan process and a very intense process. In fact, next
Monday will be our 43rd meeting of the Solarium.
Sitting next to me through most of those meetings was Chris
Inglis, who I had never known before, but have gotten to know
very well during this process. His credentials are impressive.
In fact, when I first looked at it, I thought this guy has had
two full careers; he must be 100 years old. He has 30 years of
service in the Federal Government, particularly as Deputy
Director of the National Security Agency, but also 28 years in
the United States Air Force (USAF), active duty and also in the
Air Force Reserve, retiring as a general. He has degrees in
computer science. He has immense knowledge and experience in
this field.
Beyond that, however, and the reason I am so enthusiastic
about his nomination, is his leadership qualities which I
observed during the course of our deliberations as the
Cyberspace Solarium Commission. He has a quiet but persuasive
leadership style. All of us have been in meetings where there
is one person when they begin to speak, you lean over and say,
``Now, what are they going to say? Because this is going to be
important.'' That is Chris Inglis.
This is an immensely important job because of the
intersection between the private sector and the Federal
Government and the complexity of the challenge throughout the
Federal Government. The fundamental purpose of the National
Cyber Director is to coordinate Federal cyber policy among all
these different agencies that have a piece of it, but also to
coordinate cooperation between the Federal Government and the
private sector. He will be working with Jen Easterly and Anne
Neuberger in the National Security Council (NSC), which I think
represents three of the absolute perfect combination to lead
this effort to defend our Nation.
I am very proud to be able to introduce Chris Inglis to the
Committee. I honestly believe, based upon 3 years of extensive
engagement in this issue with people across the country, he is
the single best person to fill this role, and a particularly
important role as the first leader of the Office of National
Cyber Director in the Executive Office of the President.
Mr. Chairman, I cannot recommend Chris Inglis more highly,
and I am delighted that he is willing to reenlist, if you will,
in Federal service and service to the country.
Thank you, Mr. Chairman. I look forward to Chris'
testimony.
Chairman Peters. Thank you, Senator King, for the
introduction. Thank you for your amazing leadership in terms of
dealing with this incredible threat. You have been a real
leader on cybersecurity issues. We appreciate all the work of
the Commission and appreciate you being here today and your
continued involvement on this issue. Thank you.
It is the practice of this Committee to swear in witnesses,
so if each of our witnesses could stand and raise their right
hands? Even on video, stand there and raise your right hands.
Do you swear that the testimony you will give before this
Committee will be the truth, the whole truth, and nothing but
the truth, so help you, God?
Ms. Carnahan. I do.
Ms. Easterly. I do.
Mr. Inglis. I do.
Chairman Peters. Please be seated.
We will now hear from each of our nominees. Ms. Carnahan,
you may proceed with your opening remarks.
TESTIMONY OF ROBIN CARNAHAN,\1\ NOMINEE TO BE ADMINISTRATOR,
GENERAL SERVICES ADMINISTRATION
Ms. Carnahan. Good morning, Chairman Peters, Ranking Member
Portman, and Members of the Committee. I appreciate the
opportunity to be here today, and I am honored to be President
Biden's nominee for Administrator of the General Services
Administration. I am also grateful to Senator Blunt, my home-
State Senator, for that kind introduction. We have known each
other for more than 30 years and our families even longer. I
value Senator Blunt's leadership, his passion for public
service, and his commitment to the people of Missouri. Senator,
thank you so much for your service.
---------------------------------------------------------------------------
\1\ The prepared statement of Ms. Carnahan appears in the Appendix
on page 49.
---------------------------------------------------------------------------
Even though we are joining virtually today, I would like to
acknowledge my family: my husband, Juan Carlos, for his
unwavering love and encouragement; my mother, Jean, who has
been a role model and hero all my life; and my brothers, Russ
and Tom, and their wonderful families. They have been a
tremendous source of love and strength.
Public service, as Senator Blunt said, runs in my family,
much of that serving the people of Missouri. My grandfather and
brother served in Congress. My father was Governor, and my
mother was the first woman from Missouri in the U.S. Senate.
But my mother's parents were also public servants, though they
never ran for office. You see, mom was born in Washington, D.C.
She grew up across the river in Anacostia. Her father was a
farmer and plumber at St. Elizabeths Hospital, and her mother
worked at the Navy Department during the war.
So growing up, the government did not seem like a faraway
or abstract concept. For me, it was about the people who worked
on behalf of their community and country, folks who went to
work every day to improve the lives of children and families,
to help businesses thrive and keep the country safe. I grew up
believing that public service was a noble calling, worthy of
our lives. I still do.
I have had the privilege of serving in elected office
myself, as well as in appointed and staff positions in State
and Federal Government. No matter what the role, I always
understood my job was to deliver effective service for people
and be a wise steward of taxpayer money.
I will never forget the first day on the job as Missouri
Secretary of State. I was being introduced around the office,
and I met more people who were manually opening mail and
preparing checks to be deposited than we had in the entire IT
department. That was the moment in 2005 that crystallized how I
came to view the challenge ahead for government--to adapt
modern technology tools to streamline operations and to serve
people better.
So during my tenure, we invested time and money in
modernizing our IT infrastructure in order to do better service
for 400,000 businesses, 4 million voters, and millions of
others who needed something from their government.
One lesson I learned was that digital infrastructure
investments pay off, both in better service and lower costs to
taxpayers. But I also learned that without serious attention,
these tech modernization projects can go wrong. The truth is
there was nothing I did when I was in office that caused me to
lose more sleep than the rollout of one of those new tech
platforms.
So diving in to learn more about technology and procurement
policy is what led me to GSA, where I served 4 years during the
Obama and Trump administrations. I joined the digital
consulting team 18F whose job was to help government partners
more effectively buy and build modern software systems and
train non-technical leaders on how to set their teams up for
success.
Now, this past year has shown the importance and the
fragility of our Nation's digital infrastructure. As the
pandemic swept through the country, Congress responded fast
with programs to meet the challenges. But yet too often the
help was slow getting to the families and businesses that
needed it most.
The bottom line is no program passed by this Congress can
be effective without smart investments in an effective, secure
digital infrastructure to deliver it. And GSA is uniquely
positioned to support that mission across government.
Of course, I know GSA is about a lot more than technology,
but I see similar opportunities to improve the way it delivers
value to partners in real estate management and acquisition. If
confirmed, I look forward to exploring creative, practical ways
to right-size the Federal real estate portfolio to serve the
changing needs of agencies and local communities.
In acquisitions, I look forward to working with
stakeholders, including agency partners and companies, to
streamline and simplify how they interact with GSA. I want to
provide easy access and great value to those who buy through
GSA and an easier on-ramp for businesses, especially small
businesses, interested in selling through GSA.
As President Biden recently said in his speech to Congress,
``We have to prove democracy still works. That our government
still works--and can deliver for the people.''
For me, helping our government, our democracy, effectively
deliver for the people and taxpayers is why I am so excited
about the opportunity to lead GSA.
Thanks for the chance to testify today. I am humbled, and I
look forward to answering your questions.
Chairman Peters. Thank you, Ms. Carnahan, for your opening
remarks.
Ms. Easterly, you are now recognized for your opening
remarks.
TESTIMONY OF JEN EASTERLY,\1\ NOMINEE TO BE DIRECTOR,
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY, U.S.
DEPARTMENT OF HOMELAND SECURITY
Ms. Easterly. Chairman Peters, Ranking Member Portman,
distinguished Members of the Committee, I am honored to appear
before you to discuss my nomination for Director of the
Cybersecurity and Infrastructure Security Agency. I want to
thank the President for nominating me, Secretary Mayorkas for
his confidence in me, and Congressman Gallagher for his very
kind introduction, and, more importantly, for his and Senator
King's absolutely superb leadership of the Cyberspace Solarium
Commission.
---------------------------------------------------------------------------
\1\ The prepared statement of Ms. Easterly appears in the Appendix
on page 108.
---------------------------------------------------------------------------
I also want to thank my family and, in particular, my
parents: my father, Noel Koch, a Vietnam veteran whose
forebears fought in the Civil War to ensure that the Nation
experienced ``a new birth of freedom''; and my mother, Dr. June
Koch, an English professor and the daughter of immigrants from
Russia and Poland who came to America to enjoy that freedom.
Both led lives of public service, instilling in me the
importance of service and of actively participating in our
great democratic project, to form, continuously, a more perfect
union. Their example inspired me to commit 27 years of my life
in service to the Nation, including more than two decades in
the United States Army, leading soldiers in peacetime and in
combat. It also motivates my return to public service after
4\1/2\ years in the private sector at one of our Nation's
leading financial institutions.
Additionally, I want to thank my husband, Jas, for his love
and support over the past 17 years, through multiple moves and
four separate deployments. As a fellow U.S. Army combat
veteran, I also want to thank him for his service to our
country. I especially want to recognize our son Jet, the light
and joy of our life, who aspires to one day be President.
Twenty years ago, the attacks of 9/11 fundamentally altered
the course of my life, as it did for so many. As noted by Tom
Kean, the Co-Chairman of the 9/11 Commission, ``We were
unprepared. We did not grasp the magnitude of a threat that had
been gathering over a considerable period of time. This was a
failure of policy, of management, of capability, and, above
all, a failure of imagination.'' If the past year has taught us
anything, it is the obligation we have as leaders to anticipate
the unimaginable.
While the digital revolution of the past several decades
enabled unprecedented growth and innovation, the increasing
connectivity also introduced great peril: nation-states and
non-state actors alike now leverage cyberspace with near
impunity to threaten our security, our privacy, and our
physical and digital infrastructure. Our adversaries combine
hacking with malign influence operations to interfere in our
democratic processes. They breach major corporations to steal
capital and intellectual treasure, target industrial control
systems to disrupt critical infrastructure, and incapacitate
entities large and small with the scourge of ransomware. Even
as we contend with the billions of daily intrusions against our
networks by malicious actors, I believe that as a Nation we
remain at great risk of a catastrophic cyber attack.
Congress established CISA in 2018 as the country's
operational entity for managing and mitigating such risk,
working closely with partners at the State, local, tribal, and
territorial level, as well as with the private sector to ensure
the security and resilience of our critical infrastructure.
Within the Federal cyber ecosystem, CISA is the
``quarterback,'' charged with protecting and defending Federal
civilian government networks; leading asset response for
significant cyber incidents; and ensuring that timely and
actionable information is shared across Federal, non-Federal,
and industry partners.
In this context, I also thank the Committee for your
leadership in establishing CISA, my good friend Chris Krebs for
his absolutely superb work in standing up and leading the
agency, and Acting Director Wales and the dedicated men and
women of CISA for their tireless efforts defending our
infrastructure against a myriad of significant and serious
threats, and ensuring secure, interoperable emergency
communications. If confirmed, it will be the greatest honor of
my career to join their incredible team, to continue building
the culture and the workforce of CISA, and to strengthen its
capacity and capability to defend today and secure tomorrow.
The best quarterback, however, cannot win a game alone;
cyber is and must always be a team sport. CISA fulfills its
lead operational role for national cyber and infrastructure
resilience in collaboration with other agencies at every level
of government and with our industry and international partners.
A critical element of this ecosystem is the National Cyber
Director, who will ensure a coherent and unified Federal effort
as the President's principal cyber adviser. If we are both
confirmed, I look forward to working, once again, with Mr.
Inglis. I also look forward to a productive and transparent
partnership with this Committee.
I thank the Committee for considering my nomination and
look forward to your questions.
Chairman Peters. Thank you, Ms. Easterly, for your opening
remarks.
Mr. Inglis, you are now recognized for your opening
remarks.
TESTIMONY OF JOHN C. (CHRIS) INGLIS,\1\ NOMINEE TO BE NATIONAL
CYBER DIRECTOR, EXECUTIVE OFFICE OF THE PRESIDENT
Mr. Inglis. Thank you, sir. Chairman Peters, Ranking Member
Portman, and distinguished Senators, I am honored to appear
before you. I thank this Committee for its support in the
creation of this new role and your strategic leadership on
cybersecurity. I thank the President for nominating me and
Senator King for his generous introduction. I also want to
thank both Senator King and Congressman Gallagher for their
work leading the Cyberspace Solarium Commission's efforts to
improve our Nation's ability to fully realize its aspirations
in and through the critical realm of cyberspace.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Inglis appears in the Appendix on
page 189.
---------------------------------------------------------------------------
I also want to recognize my family. I thank my parents,
Robert and Kathleen Inglis, who gave their children the
priceless gift of a home where service to others, respect, and
accountability was expected and freely given as the foundation
of life. I want to thank my wonderful wife, Anna, who is with
me here today, and our children, Luciana, Paul, and George, for
their love and support, which has inspired and sustained me
through all of my adult life.
I am humbled by the privilege and the opportunity to
reenter public service. While the position of National Cyber
Director may be new, I am mindful that the team that I would
join, should I be confirmed, is one that is already on the
field, impressively diverse, and broadly engaged. It is a team
that includes public servants at Federal, State and local
levels, and private sector professionals whose collective
efforts build, operate, innovate, and defend the digital
infrastructure upon which the delivery of critical services
increasingly depends. I am particularly pleased to testify
alongside Jen Easterly, the prospective Director of CISA, and
Robin Carnahan, the prospective Administrator of GSA. Should we
be confirmed, our collaboration will be an important element of
any Federal cyber strategy going forward.
If confirmed, I expect that I should and will be held
accountable to add context, leverage, and strength to the
distributed work of that full cyber team. To that end, the
enabling legislation for the National Cyber Director has
clearly laid out its core responsibilities. These include
forging a coherent and unified Federal effort; developing and
overseeing the implementation of the National Cyber Strategy;
ensuring the coordination of appropriate Federal budgets,
policies, and plans; fostering mutually beneficial public-
private collaboration; and, more importantly than all of those,
demonstrable improvements in the resilience, the robustness,
and the defense of the cyber ecosystem.
As the legislation acknowledges, these duties require
robust engagement with both the private sector, which is on the
front lines of this effort, and with the Congress, to whom the
National Cyber Director owes regular updates on cyber risk and
the status of U.S. cybersecurity efforts. Additionally, the
National Cyber Director occupies a highly visible position
within the U.S. Government--one that should be expected to
offer a clear, unified voice in public communications and
advocacy.
Supporting lines of effort must necessarily address the
fact that cyberspace is not built and operated as a single,
centralized organization and that it is comprised of far more
than technology. Essential collaboration and integration will
heavily depend on how roles and responsibilities are defined
and executed, while the success of a national strategy will
depend as much on the skills of our people as on the
technologies that they employ.
Given those realities, we must ensure that our technology
is built and deployed with security foremost in mind; that the
supply chains that support them are free from security risk;
that our people are cyber literate; and that roles,
responsibilities, and attendant accountability are sufficiently
well defined that we remove the fissures and seams in cyber
defenses that offer adversaries opportunities to find and
exploit weakness.
As this Committee and recent witnesses before you have so
frequently discussed, SolarWinds, Hafnium, Colonial Pipeline,
JBS, and other incidents all signal the urgent need to secure
our national critical infrastructure. The pace of events and
our adversaries deny us the luxury of biding our time before we
seize back the initiative that has too long been ceded to
criminals and rogue nations who determine the time and manner
of their transgressions.
If confirmed, I will work closely with the Congress, the
Executive Branch, the private sector, and State and local
entities to stand up, harness, and realize the expected
benefits of the Office of the National Cyber Director (ONCD).
I thank the Committee for considering my nomination, and I
look forward to your questions.
Chairman Peters. Thank you, Mr. Inglis, for your opening
comments.
There are three questions that this Committee asks of every
nominee, and I will ask each of you to respond briefly with a
yes or no to these questions.
First, is there anything you are aware of in your
background that might present a conflict of interest with the
duties of the office to which you have been nominated? We will
start with Ms. Carnahan and then go to Ms. Easterly and then
Mr. Inglis. Ms. Carnahan?
Ms. Carnahan. No, sir.
Ms. Easterly. No, sir.
Mr. Inglis. No, sir.
Chairman Peters. Second, do you know of anything, personal
or otherwise, that would in any way prevent you from fully and
honorably discharging the responsibilities of the office to
which you have been nominated?
Ms. Carnahan. No, Senator.
Ms. Easterly. No, sir.
Mr. Inglis. No, sir.
Chairman Peters. Last, do you agree without reservation to
comply with any request or summons to appear and testify before
any duly constituted committee of Congress if you are
confirmed?
Ms. Carnahan. Yes, sir.
Ms. Easterly. Yes, sir.
Mr. Inglis. Yes, sir.
Chairman Peters. Great. Thank you.
Mr. Inglis, if confirmed, you will be in a very challenging
position of being the first National Cyber Director. Your
authorities have never been utilized, your role has never been
performed, and many other leaders in government have cyber and
security responsibilities as well.
So my question to you, sir, is: If confirmed, how would you
see your role as being unique and different from that of the
Director of CISA?
Mr. Inglis. Senator Peters, thank you for the question, and
thank you again for the work that this Committee did to invest
the National Cyber Director with the authorities and the
accountability that we are discussing here today. I think that
if you stand back and read the very detailed language of the
National Cyber Director authorization, what it really is
pushing for is to create coherence, unity of effort, unity of
purpose across what are already impressive, deep, and sharp
capabilities within the Federal enterprise and a partnership
with the private sector where most of cyber gets built,
operated, innovated, and defended.
I think that the primary purpose of the National Cyber
Director must be to add value, coherence, leverage, connection
to all of those other pieces and to identify, when necessary,
when something is missing and to ensure that the national
strategy and that our implementation of that strategy
ultimately creates a coherent effort. I think that the premise
for us within the United States and like-minded nations must
increasingly be that if you are an adversary in this space, you
have to beat all of us to beat one of us. The National Cyber
Director needs to make that true.
Chairman Peters. Thank you.
Ms. Easterly, a similar question for you. CISA is the lead
cybersecurity agency for operational Federal cybersecurity and
supporting critical infrastructure. So my question to you is:
If confirmed, where would you see the boundary between your
work and that of the National Cyber Director?
Ms. Easterly. Thank you very much for the question, Mr.
Chairman. As we know, CISA is the operational entity charged
with managing and mitigating risk to digital and physical
infrastructure working closely with partners at the State,
local, tribal, and territorial level, and then, of course, with
the private sector to be able to ensure the resilience and the
security of our critical national infrastructure. I see CISA's
role within the Federal cyber ecosystem as the quarterback, if
you will, responsible for protecting and defending Federal
civilian government networks in close partnership with the
Office of Management and Budget (OMB), which, is responsible
overall for Federal cybersecurity, also leading asset response
for significant cyber incidents, and then, finally, for
ensuring that timely and actionable information is shared
across Federal and non-Federal and private sector partners.
Within that ecosystem, I see the National Cyber Director as a
critical partner, essentially the coach of the team responsible
for overseeing the implementation of cyber strategy and policy
and really bringing that sense of coherence and unity of effort
to the Federal cyber ecosystem. If confirmed, I would look
forward to working closely and collaboratively with Mr. Inglis.
Chairman Peters. This next question will be to both of you
as well. Ransomware attacks are nothing new, but they have been
increasing in their impact, particularly the recent attacks
that we have seen of our critical infrastructure. We had the
Chief Executive Officer (CEO) of Colonial Pipeline in this room
a short while ago. If confirmed, you each will play a
significant role in helping us address this ever growing
threat.
Ms. Easterly, my question for you is: How do you view the
role of CISA in fighting back against these ransomware attacks?
Ms. Easterly. It is a very important question, Mr.
Chairman. Thanks for asking it. Ransomware is clearly a
scourge, clearly a national security threat, 2,400 incidents
last year alone, $350 million in cryptocurrency. This requires
an all-hands-on-deck effort that leverages the talents and
capabilities across the interagency, from law enforcement to
the intelligence community (IC) to diplomacy to Treasury.
Very importantly, CISA's role in this ecosystem is to
prevent people from having to make the really difficult
decision about whether they end up paying the ransom or not.
CISA's role is to provide the technical assistance, the threat
information, the guidance, the educational resources to ensure
that entities across the Federal Government, the non-Federal
Government, and, of course, the private sector are prepared to
defend themselves in this very complex cyber threat
environment.
Chairman Peters. Mr. Inglis, what role should the National
Cyber Director play?
Mr. Inglis. Thank you for the question. I would complement
Ms. Easterly's answer by saying that the National Cyber
Director needs to be an advocate and a connector for those
various capabilities represented in places like CISA, but also
the Department of Justice (DOJ), Department of Treasury, within
the private sector that can systematically attack the system
that today is the scourge known as ``ransomware.'' When you
think about how that system works, there are weaknesses in our
technology and oftentimes in the knowledge of the people who
are on the front lines. There are sanctuaries that give safe
harbor to the transgressors. There are other transgressors who
must be dealt with. We must bring them to justice. There are
financial systems, there are a great many things that we need
to knock the legs out from under, and that will require a team
effort. The National Cyber Director has to ensure that there
is, in fact, a strategy that connects all those pieces and that
that is being implemented in a concurrent, unified way, such
that we might take this down using all instruments of power.
Chairman Peters. I am currently working on legislation that
would help illuminate this threat and get more information on
ransomware attacks into the government so that we can both warn
potential victims and also work to dismantle these criminal
networks that are engaged in these activities. My question to
both of you: Would you commit, if confirmed, to working with me
on this important legislation so that we can enhance our
ability to fight against this threat? Ms. Easterly?
Ms. Easterly. Absolutely, Mr. Chairman. I would look
forward to that if confirmed.
Mr. Inglis. If confirmed, absolutely, sir.
Chairman Peters. Great. Thank you.
Ms. Easterly, the threat of foreign disinformation is real
and has had particular impacts on our elections and on our
ability to combat COVID-19. CISA has recently stood up a mis-,
dis-, and malinformation team to help address this threat. If
confirmed, what role would you see CISA playing to help us
address this issue?
Ms. Easterly. Thanks very much for the question. It is a
very important one, Mr. Chairman. First I would say I
absolutely agree with you about misinformation and
disinformation. It is a particular worry of mine. You need to
have the best information, the facts, to be able to make the
best decision, and so I think that is absolutely critical. I am
aware of CISA's work stood up during the 2020 elections in
particular known as ``Rumor Control'' to deal with some of the
misinformation and disinformation efforts and then the MDM team
that now sits under the National Risk Management Center.
If I am confirmed, I would take a very hard look at that
effort to see what CISA's role can be and should be in
misinformation/disinformation, and I would also want to make
sure that CISA is continued to be seen as a nonpartisan and
apolitical agency in all of the actions that it took.
Chairman Peters. Absolutely, and I appreciate your focus on
this.
I am also currently working on legislation to codify CISA
and DHS' authorities in this area, so my question to you is: If
confirmed, do you commit to working with me on this bill to
ensure that the Department has the proper authorities and
limits to combat this threat?
Ms. Easterly. Absolutely, Mr. Chairman.
Chairman Peters. Thank you.
Ranking Member Portman, you are recognized for your
questions.
Senator Portman. Thank you, Mr. Chairman. I look forward to
working with you on that legislation, and we will talk about
accountability in a moment and the importance of having clear
lines of accountability in what is an increasingly concerning
issue, which is not ransomware but cyber attacks generally.
With regard to our oversight role here, in order to do it
properly, we need to have information. One of the congressional
complaints sometimes is about responsiveness. This is
particularly true, unfortunately, in this area, and so I want
to ask you some questions about that.
Ms. Carnahan, I will start with you on the video. I will
ask you, do you agree to promptly provide the Committee with
documents and information that we request?
Ms. Carnahan. Certainly, Senator.
Senator Portman. Thank you.
Ms. Easterly, yes or no would suffice.
Ms. Easterly. Absolutely, sir.
Senator Portman. Mr. Inglis?
Mr. Inglis. Yes, sir.
Senator Portman. Let me give you an example of this. Ms.
Easterly, the authorization for CISA's flagship cybersecurity
program, the EINSTEIN program, as you know, is expiring. It
expires next year, so we have been working on a reauthorization
bill. I hope to work with Chairman Peters and all Members of
this Committee on that. It has to be reauthorized. And yet we
are having a really hard time getting information.
On April 5th, Chairman Peters and I sent to CISA a letter
requesting information about EINSTEIN to inform our legislative
efforts. Until earlier this week, the only response we received
were documents previously provided to Congress, so nothing new,
and a lot of the documents we received this week were heavily
redacted. Let me give you an example of that. We will put it up
here behind me.
This is the document where everything apparently describing
the mission needs of EINSTEIN is redacted. Not terribly useful
and not helpful in order for us to give you the key tool that
you would need, should you be confirmed, to be sure that DHS is
effective at combating cybersecurity.
So my question for you would be, understanding you were not
involved in this decision, but should you be confirmed, would
you agree that the Chair and Ranking Member of an authorize
committee should be allowed to review the mission needs of a
program before attempting to reauthorize it?
Ms. Easterly. Thanks for that question, Ranking Member
Portman. I would say that I absolutely believe in the strong
oversight role that this Committee has, and if confirmed, I
would 100 percent commit to doing everything I possibly can to
make sure that you get all of the information that you need to
perform those important oversight roles.
Senator Portman. Thank you. We will hold you to that.
Mr. Inglis, we also sent a letter to the Federal Chief
Information Security Officer (CISO), as opposed to CISA--this
is OMB--on April 5th, which asked about the accountability for
Federal cybersecurity, an issue, as you know from our
conversation, I have a lot of interest in. All we have received
to date is a list of public websites. That is it. Does that
seem like a timely and sufficient response to you?
Mr. Inglis. Senator, I similarly, if confirmed, commit to
providing the Committee with all of the resources and insight
required for them to do their duty. We know that the Senate is
a principal source of authorization and resources necessary.
Without insight into that specific kind of request, not knowing
what the question is, I am unable to comment on that, but only
to say that it does not sound correct and that, if confirmed, I
will work to accommodate----
Senator Portman. Thank you. I ask unanimous consent (UC),
Mr. Chairman, that we submit for the record the letters\1\ we
have sent and the redacted page behind me.
---------------------------------------------------------------------------
\1\ The letters submitted by Senator Portman appears in the
Appendix on page 266.
---------------------------------------------------------------------------
Just personally, I need to know from all three of you, you
are going to be more responsive. We are trying to work with you
and do our work.
Ms. Carnahan, GSA has a lot of responsibilities. One, of
course, is with regard to procurement. If confirmed, how would
you increase Federal agency usage of GSA schedules and
governmentwide acquisition contracts for procurement?
Ms. Carnahan. Yes, thanks for that question, Senator. I am
very interested in making GSA's services more user friendly. I
know and I have talked to businesses that have tried to get on
GSA's schedules. They have told me about how difficult that
process is. I am interested in learning more about how we can
streamline that. It creates more competition, and it creates
good jobs in our country if we can get more people able to sell
through the government and GSA schedules. Likewise, we need to
make it easier for agencies to be able to buy through GSA
schedules and make sure we are getting them the best price and
the best value.
I am very interested in this topic, Senator, and look
forward to working with you more on----
Senator Portman. Good. I appreciate that. I think you are
absolutely right; improving the user experience is key, and
your commitment to it is appreciated.
During COVID-19, as you know, the government had waived
certain requirements in order to move more quickly to acquire
goods and services to respond to the pandemic. My question is
for you: Why shouldn't we continue to waive these requirements
for the urgent and critical non-pandemic contracts?
Ms. Carnahan. Thanks for that question. I will tell you,
Senator, I am not familiar with all of the waiver requirements
and waiver rules that were put in during the pandemic. But I
think it is worth figure out how we can streamline and speed up
the process. I think it is cumbersome now. I think it can be
better. We know what good marketplaces look like. There are
security and other kinds of implications that we have to think
about all the time, but I am very committed to trying to make
this work better.
Senator Portman. We would appreciate working with you on
that, particularly given the opportunity we have post-COVID. We
have had this experience during COVID that worked pretty well
and would help in terms of that responsiveness.
On accountability, again, this is an issue that I think is
a deep concern of not just mine but a lot of Members of this
Committee. In the Federal Government, we have CISA and Jen
Easterly is up for the CISA confirmation. We have CISO at OMB.
We haven't had the National Cyber Director. Mr. Inglis is the
nominee for that job. We also have the Deputy National Security
Adviser for Cyber. All have not just roles in cybersecurity but
coordinating roles in cybersecurity.
I am concerned about the overlap. I am concerned about the
duplication leading to a lack of accountability. I noticed in
the conversation earlier, Mr. Inglis, you talked about the job
is one of encouraging coherence, unity of purpose, partnership
with the private sector. CISA talked about partnership with the
private sector. You talked ensuring a national strategy. You
talked about this being sort of like a coach, Ms. Easterly, the
role that Mr. Inglis would play, if confirmed, and that you
were the quarterback. What is CISO? Is CISO the running back?
What is the Deputy National Security Adviser? Is that a
defensive player, a linebacker?
I mean, really, all joking aside, I think we have a real
opportunity here with real experts coming into these jobs to be
able to be sure we are not duplicating efforts and, frankly,
without accountability, no one is in charge. So ultimate
accountability, if everyone is in charge, no one is in charge.
So can you speak to that briefly, Ms. Easterly?
Ms. Easterly. Yes, Ranking Member Portman. Thank you very
much for that question because I do think it is incredibly
important.
As I said in my opening statement, cyber is and has to be a
team sport, but I 100 percent agree with you that
accountability is critical. I come before you as the nominee
for Director of CISA. If I am confirmed, I would expect you and
Secretary Mayorkas and the Committee to hold me accountable for
the very specific operational mission that CISA has to manage
and mitigate risk to our digital and physical critical
infrastructure and resilience, working with all of our
partners. So that is what I would expect to be held accounts
for.
Senator Portman. OK. In the wake of the Colonial Pipeline
hack, we have a lot to talk about. They did not even manage to
work with you guys. They reached out to the Federal Bureau of
Investigation (FBI). The FBI reached out to your prospective
new agency. I mean, if that is your responsibility at CISA,
should you be confirmed, it does not seem to be working very
well. We have lots to talk about, and I know, Mr. Inglis, you
and I talked about having a whiteboard exercise where we can
actually see all these different roles. That does not include
all the roles at the agencies where there is also
accountability. We look forward to working with you on that,
but I would like a commitment from you all today that you will
help us to ensure that we have the right people in the right
place and that we are not overlapping responsibilities so that
we can more effectively provide both the defense and the
offense on cybersecurity.
Thank you.
Ms. Easterly. I commit to that.
Senator Portman. Thank you.
Mr. Inglis. I do as well, Senator.
Senator Portman. Thank you.
Thank you, Mr. Chairman.
Chairman Peters. Thank you, Senator Portman.
The Chair recognizes Senator Carper for your questions.
OPENING STATEMENT OF SENATOR CARPER
Senator Carper. Thanks, Mr. Chairman. Can you hear me?
Chairman Peters. I can hear you just fine.
Senator Carper. I just want to say a special welcome to
each of our witnesses, and especially to Robin Carnahan, with
whose father I served as a Governor together. We were Governors
together. We actually ran for the U.S. Senate together. He was
killed in a fatal plane crash, very sadly, during the course of
that campaign. Her mother went on to become a Senator from
Missouri for a period of time, and so I have had the pleasure
of serving with Robin's Dad as Governor and with her mom as a
U.S. Senator, and we are thrilled that you have been nominated
for this position. I look forward to being able to support your
nomination.
Robin Carnahan and I discussed, colleagues, the
intersection between GSA and the Government Accountability
Office (GAO), and how GAO puts out at the beginning of every 2
years, at the beginning of a new Congress, the High-Risk List,
high-risk ways of wasting money, and gives us a whole laundry
list of things that we can do to save taxpayers' money and draw
on bipartisan support for doing so. The High-Risk List includes
things like real property management, IT acquisition
management, just to name a couple of things on the GAO High-
Risk List.
Ms. Carnahan, would you please take a moment to discuss
your plans for working with the Comptroller General, who is now
Gene Dodaro--I call him ``Comptroller General for Life''--to
address these and other high-risk areas where GSA can make
meaningful progress? Please go ahead.
Ms. Carnahan. Yes, thank you, Senator, for those kind words
about my father and mother and also for that question. I have
lots of respect for the GAO and the oversight role that they
play in all of these things. I think more eyes on these
projects and thoughts about how they can be improved make
sense.
I know with respect to some of the high-risk topics that
you mentioned, GSA has made some progress by following some of
the GAO recommendations and getting the leasing segment off the
GAO High-Risk List. But there are more that are left. My
interest would be sitting down with the GAO to talk about how
we can implement some of these recommendations and, frankly,
understanding what the blockers have been to getting that done
sooner.
Senator Carper. Let me just interrupt and say I think that
is a great idea. When I was privileged to chair this Committee,
Senator Tom Coburn I think was the Ranking Member, there was a
woman named Jane Holl Lute, who was the Deputy Secretary of
Homeland Security, and that was at a time when Homeland
Security led the hit parade in things, we were wasting money,
badly managed, bad morale, and Jane Holl Lute, the Deputy
Secretary for Janet Napolitano, who was the Secretary, she
would go meet with Gene Dodaro and the team at GAO literally
every month and say, ``How do we get off your High-Risk List?''
They would just literally go through the list. It was sort of a
personal approach, but a very deliberate approach. And you know
what? They got off the High-Risk List before the end of this
administration. It actually worked.
I like to say find out what works and do more of that, so I
would urge you to--if you do not know Gene Dodaro already, get
to know him. He and his team do great work. I think you will
find him a good partner.
Ms. Carnahan. Thank you, Senator.
Senator Carper. For Colonel Easterly, I am a Navy guy. Navy
salutes Army, and they are proud of your history and your
service, two Bronze Stars, as I recall. Not many people I know
can claim that. But as I was going through your written
statement, I came across something where you referred to Tom
Kean. I am a former Governor of Delaware; he is a former
Governor of New Jersey. I have huge respect for him, and he was
the Co-Chair, of the 9/11 Commission. But I think you mentioned
in reference to the 9/11 Commission a quote from him. Former
Governor Tom Kean said, ``We did not grasp the magnitude of a
threat that had been gathering over a considerable period of
time. This was a failure of policy, of management, of
capability, and, above all, a failure of imagination.'' That is
his quote, the Co-Chair of the 9/11 Commission, Republican from
New Jersey.
In light of that quote, Ms. Easterly, I want to ensure our
country is adequately addressing the magnitude and the severity
of the increased cyber and ransomware attacks we are grappling
with today. I would ask you, Ms. Easterly, how would you
propose to work to improve our Nation's cyber posture in the
role of CISA Director to ensure we have strong policy
management and capabilities to address the increased cyber
threats we are facing?
Ms. Easterly. Thanks very much for that question, Senator,
and thank you for your service to the Nation, particularly your
time in the Navy.
If confirmed, I would focus initially on three major things
to ensure that CISA has the capacity and capability to execute
its very complicated mission. First, I would ensure that CISA
has the right resources to execute that mission, and that is
people, its authorities, and its budget. Most importantly, I
would say people. I think the quality of the workforce is
incredibly important to be able to effectively execute the
mission.
Second, I would ensure that CISA has the operational and
technical visibility that it needs to be able to effectively
defend Federal Government networks. We know if you cannot see
it, you cannot defend it. So that is absolutely critical.
Third, I think it is absolutely fundamental for CISA to
have the right partnerships to make it successful. We know that
CISA is really an agency of partnerships, and its success is
highly dependent on the quality of those partnerships, whether
that is State and local, tribal, territorial, whether that is
partnerships within DHS, across the Federal Government, or the
very important partnerships that CISA has with the private
sector. So incredibly important to focus on resources, on
visibility, and on those partnerships if I am confirmed,
Senator.
Senator Carper. Good. Thanks for that response.
Mr. Inglis, Ms. Easterly, same question for both of you,
and that would be: How will each of you work to select,
recruit, and retain a talented cyber workforce? How do you
believe your past working experiences will serve you well in
your new roles, if confirmed? Mr. Inglis, would you go first?
Then Ms. Easterly. Just be fairly brief, if you would, Mr.
Inglis.
Mr. Inglis. Senator, thank you for the question. I think,
first, in order to recruit to a workforce, you need to inspire
them to come to a mission. You need to be very clear about what
the purpose is and how they can make a difference to that. That
culture is absolutely essential.
You need to then make sure that that workforce is not
simply fit for purpose, but that broadly across that workforce
it is sufficiently diverse that you will have the benefit of
all the perspectives that are necessary.
Finally, you need to give them a viable career path. You
need to ensure that you have accounted for their aspirations to
do something more than what perhaps might be the opportunity of
the moment. And to the extent that they can have agility and
longevity in that career and you give them that feedback and
you give them those investments, they will come and they will
stay, and they will exceed your expectations.
Senator Carper. Mr. Chairman, could I have 30 seconds maybe
for Jen Easterly to respond to the same question, please?
Chairman Peters. Without objection, yes.
Ms. Easterly. Thanks, Senator. A very important question
and a personal passion of mine. Three things.
One, culture, as Mr. Inglis mentioned. Leaders need to
create a culture that prizes collaboration and innovation and
inclusion and ownership and empowerment. A good culture is key
to being able to attract the best talent.
Second, you have to look at this not as a one-off position
but as part of a talent ecosystem from recruiting to onboarding
to integration to training and certification to rewards and
recognition and promotion as part of a whole ecosystem to allow
you not just to attract the best talent but also to retain the
best talent.
Finally, you need to be relentlessly creative in using
various different approaches to tap into a diverse pipeline of
cyber talent, whether that is through internships, through
apprenticeships, through expanding the cyber corps program,
through reserve programs, through rotational programs, and then
creating corridors with the private sector to enable easier
passage so that you can bring in more private sector people to
help to strengthen the connective tissue between the private
sector and the government.
Senator Carper. Very thoughtful responses from both of you.
Thank you so much.
Thank you, Mr. Chairman.
Chairman Peters. Thank you, Senator Carper.
I am going to need to step away briefly. The Senate Armed
Services Committee (SASC) has a hearing with the Secretary of
Defense and others that I need to go to to ask a few questions.
Senator Padilla, you will be taking the gavel and the Chair. As
the Senator comes up here to take the gavel, Senator Lankford,
you are recognized for your questions.
OPENING STATEMENT OF SENATOR LANKFORD
Senator Lankford. Chairman, thank you very much.
Thanks to all of you from going through the process on
this. I want to first say about the workforce issue that you
were just talking about with Senator Carper as well, Senator
Sinema and I spent a lot of time working on this issue, on the
hiring. We obviously have great complications in the process.
We are still over 100 days in hiring in the Federal workforce.
There are lots of issues with bringing interns on as interns
and then moving them to actually hire. What is common in the
workplace is uncommon still in the Federal workplace. All those
issues, as you rise up and start to reach out to people, please
stay engaged with us and with our Committee in the days ahead.
It will be essential that we make sure that we are removing
barriers from the process.
Senator Peters and I have even worked for a while on
dealing with some of the specialists in NASA and trying to
figure out how to get a pilot project there so they can
continue to be able to tap into some of the scientists. You
will run into barriers in trying to get some of these
professionals. We make sure that we are clearing as many of
those as possible. But that is going to require communication
among our teams to be able to do that. We invite that kind of
communication so we can make sure that we are clearing the
path.
I do want to ask a question that involves all three of you,
and it is a point of connection for all three of you. Ms.
Carnahan, I want you to be able to answer this first. I am
going to take you back 7 years ago. This Committee was working
with GSA to identify a vendor that was on the GSA approved list
named ``Kaspersky.'' At the time the GSA had approved them as a
software package and said this is approved software. Many
agencies were using it. More and more evidence came out that
Kaspersky was housing the information that they were harvesting
from users in Russia and were filtering those, and it became a
pretty rapid issue of how do we actually get Kaspersky out of
our system.
This is an intersection of all three of you in this process
to deal with a vendor on multiple agencies to be able to
identify who is a qualified vendor, who is a hostile vendor
that is out there like Kaspersky clearly was, and how do we
actually make sure that that does not happen that they get into
the system, because at the time we were then trying to figure
out with GSA how they would unwind, how agencies would switch
virus protection to a different one, and how we could actually
pull that out and replace and what is a decent vendor in this.
All three of you would have to be engaged in that at some
level to make sure we do not get vendors like that. I would
like to ask how we are going to deal with the integration to be
able to deal with it? Ms. Carnahan, you are up first.
Ms. Carnahan. Thank you, Senator, for that question. I will
tell you that I see GSA's role here as really twofold: one,
staying very tightly and closely coordinating with CISA and the
National Cyber Director as they set policy and identify these
threats. The main thing we all need to understand is that
threats are not static. They are going to be changing all the
time. And GSA's role in all of this is to be the implementing
partner. We are the ones who will be helping agencies get the
secure tools that they need and the services that they need,
and they have to be always evolving with the evolving threats.
So my interest is making sure that GSA is using the best
practices for the private sector and changing with those
threats not being static and automating as much as we can to be
able to continue to monitor the threats. I look forward to
working with you more on that, but that would be my general
approach to this.
Senator Lankford. Ms. Carnahan, I would say one of the
challenges we will face will be trying to be able to go through
that process in a timely manner, because we do not want every
one of our agencies to all just have 3-year-old software by the
time we actually get through all the approval process as well.
So it is going to be the coordination, I completely agree, but
also a timely process as well.
Ms. Easterly.
Ms. Easterly. Yes, Senator, thanks for the question. Hugely
important. Could not agree with you more on the need to have
rigorous and accelerated processes in place to ensure the
security of the supply chain from foreign nation-state threats.
Two things that CISA does in this space that I am aware of.
First, it hosts an Information and Communications Technology
(ICT) supply chain risk management effort between the public
and the private sector to work on recommendations for ensuring
the supply chain. I think more importantly, though, CISA is a
member of the Federal Acquisition Security Council (FASC) that
was, of course, created by this Committee in 2018. That is a
hugely important capability that I think came out of the
Kaspersky piece to enable dangerous products that could present
security threats to be excluded or removed from software.
I agree with you that as that is done, it needs to be done
in a way that keeps up with the pace of technology. If
confirmed, I look forward to advancing both of those efforts
along with the GSA Director as well as the National Cyber
Director and other key stakeholders.
Senator Lankford. OK. Thank you.
Mr. Inglis.
Mr. Inglis. Senator, if confirmed, the National Cyber
Director, I believe, must be committed to advocating the
techniques, the mechanisms you have already heard described I
think thoughtfully and well from the prospective head of GSA
and the prospective Director of CISA. Also, these issues
transcend cyber. I think you have thoughtfully pointed out some
of the cyber relevant issues and would argue in some cases
against the use of this technology within either the Federal
enterprise or the kind of U.S. larger cyber enterprise. But
there are issues of economic fairness as to whether these are
level playing fields that foreign competitors are playing on
and whether we should stand in to perhaps adjudicate and render
a perhaps level playing field for the benefit of U.S. industry.
There are issues of legal perils that might not be directly
injected into these systems because of some back door but,
rather, because a legal system in another country that has
access to this information can access it under something that
we do not find suitable for our probable cause standard. That
then moves this to a higher level where the National Cyber
Director would be expected to participate in the National
Security Council to bring to bear all the instruments of power
to understand how do we render a level playing field for these
systems and remove them when they are not in the U.S. interest.
Senator Lankford. OK. Thank you.
Ms. Carnahan, quickly, I want to be able to bounce a very
complicated question off of you, and I am sorry for the short
time on it. We can talk at greater length at another time also,
but that is the issue of real property and our moving out of
COVID-19 time period where we will have the Federal workforce
returning back to buildings, but we will also have a
significant number of the Federal workforce that will start
working remotely permanently. We found a lot of flexibility in
a lot of offices, and they are going to find ways to be able to
say we could hire more people in more places and we will need
less footprint of actual space.
You are in the difficult position, if confirmed in this, to
have to manage that transition of work space while agencies are
trying to also figure out how many more people they are going
to have remote. How are you planning for that, thinking through
that?
Ms. Carnahan. Thanks for that question, Senator. It is a
very big deal for the Federal Government, just as it is a big
deal in the private sector. The pandemic changed the way all of
us did business and really is going to, I am sure, cause
agencies to be rethinking how they want longer term to
implement remote work and what the options are. That is going
to impact their physical space needs.
I think as you said it is a great opportunity to think
about how to right-size the Federal footprint of real estate
and do that at a time where we can be smart about understanding
the marketplace and where it is going and what future needs are
going to be. I look forward to this. I, like you, think this is
a big opportunity to rethink what our Federal Government looks
like, what the future is going to look like. I know that there
are task forces that are underway right now with OPM and OMB
and GSA to think about all of these issues, and I look forward
to seeing what they come up with and talking to you and other
Members of the Committee about this, because I think this
really is a long-term issue that we are going to be dealing
with in the government, and we need to get it right.
Senator Lankford. It is exceptionally important, but the
real property management has been a problem for GSA for quite a
while. This is a fixable problem, but it has definitely been a
problem. Another one I will talk about and put in a question
for the record is the relationship between GSA and Customs and
Border Protection (CBP) on those Ports of Entry (POE), because
that has been a point of frustration for a long time because
CBP is pretty frustrated how the ports of entry are managed.
They will say, ``We are not a courthouse. We are not an agency
building the same way that we are a port of entry.'' That is a
relationship we have to be able to work out in the days ahead.
Thank you, Mr. Chairman.
OPENING STATEMENT OF SENATOR PADILLA
Senator Padilla [presiding]. Thank you.
For Members watching, it is my opportunity to ask questions
next, followed by Senator Scott. Thank you to the witnesses and
folks before us today.
I want to start by talking about my experience for the
prior 6 years before my appointment to this body in January. I
think we all agree that our right to vote is indeed the
foundation of our democracy. Prior to joining the Senate, I
served as California's Secretary of State and helped oversee
the 2020 election, and not just in that cycle but in prior
years I saw firsthand CISA's commendable work, particularly
through the Project 2020 Campaign. Election cybersecurity, like
all cybersecurity in all sectors, is certainly a work in
progress.
In 2020, we learned about specific vulnerabilities
highlighted in the 2016 election and were able to take actions
to defend against those. But from this last election cycle, we
learned specifically how dangerous it can be for election
security to become politicized.
My first question is for Ms. Easterly. How are you thinking
about CISA's election security work and the challenge of
ensuring the agency's work is viewed as apolitical?
Ms. Easterly. Thank you for that question, Senator, and
thanks again for your incredible leadership during 2020. As we
know, fair and free elections are critical to the fabric of
democracy, really foundational, and the American people's
belief that their vote is going to be counted is largely
reliant on the security and resilience of election
infrastructure.
As we know, State and local officials administer those
elections. CISA's role is to be a strong partner in this space
to ensure that election officials have the resources, the
technical guidance, the threat information sharing, and the
assessment support that they need to be able to ensure the
security of those elections.
I have had conversations with folks at CISA that worked as
a part of that effort in 2020, and I think it was a real bright
spot, as you pointed out. I have also had an opportunity to
speak with some of the executive board of the National
Association of Secretaries of State and know how important it
is that CISA is seen as a nonpartisan, apolitical agency
because CISA needs to be seen as an enabler for all Secretaries
of State and all officials, regardless of party.
I would make it a very early priority to start building
those relationships off the back of the superb relationships
that Chris Krebs developed as the Director and would make that
a significant area of focus.
Senator Padilla. Thank you.
Mr. Inglis, a similar question. Your position is a new one,
and so how would you see the role of National Cyber Director
when it comes to election security specifically?
Mr. Inglis. Senator, thank you for the question and for the
opportunity to follow Ms. Easterly in answering that question.
I think she gave an excellent answer. I think first and
foremost I would fully support all of what she said in terms of
the nature of the Federal Government's relationship with the
States and locales who actually conduct those elections.
The National Cyber Director needs to make sure that at any
moment in time that we have a viable strategy to effect that
support that we can render the support, the assistance that is
necessary and appropriate to those who conduct these elections,
who execute these elections. That needs to ensure that not
simply CISA has the resources necessary to do their job, but
that the FBI, the intelligence community, the other resources
the Federal Government can bring to bear can detect threats to
those election systems, both in the technology and perhaps in
the constitution of that threat from perhaps foreign entities,
and that all of that is provided so that we can render the
social contract between the Federal Government, the States, and
the locales on something that is intact and sustained.
Senator Padilla. And that actually anticipates my next
question. We know that in order to defend our networks, we need
both a robust community of cybersecurity professionals in
government as well as a shared sense of responsibility to
practice good cyber hygiene. Research points to a gap between
the cybersecurity capabilities we need in the United States and
those we currently have. According to the 2020 ISC
Cybersecurity Workforce study, the U.S. cybersecurity gap is
still a staggering 359,000 employees. When the Federal
Government does hire, we have a lot of work to do to be able to
retain cyber talent.
I want to pose a question to all three of you, and the
question is this: What has been your experience in recruiting
talent? How do you plan to recruit and retain cybersecurity
professionals? We will start with Ms. Easterly, then Mr.
Inglis, and then Ms. Carnahan.
Ms. Easterly. Thank you, Senator. Very important question
and a real passion of mine. As you point out, the cyber
workforce is lacking in a significant number of personnel, both
within the Federal Government as well as within society, writ
large. The approach that I would take is very similar to what I
have been doing over the past 4\1/2\ years, building a team
virtually from scratch to help defend Morgan Stanley in this
very complex cyber threat environment.
A couple key pieces that I think we need to recognize.
First, culture is foundationally important. You have to
build a culture of excellence that prizes inclusion,
innovation, collaboration, empowerment, and ownership so that
people wake up in the morning and they love what they do and
they enjoy their teammates and they like who they work for.
That is how you attract the best talent and retain the best
talent.
Second, you need a talent ecosystem that treats a job not
as one-off but as part of a career development strategy, so you
look at recruiting all the way to training, certification,
promotion, retention, all of those things together as part of
the ecosystem.
Finally, creative approaches, all different approaches to
be able to tap into highly diverse pipelines of talent.
I think those are the three tenets that I would leverage if
I am confirmed.
Senator Padilla. Thank you.
Mr. Inglis.
Mr. Inglis. Sir, I would only add to Ms. Easterly's very
thoughtful answer and I think comprehensive answer that we have
found that the pipelines are not generating enough, either in
the diversity or in the literal numbers. We need to actually
work those pipelines. We need to start as early as possible, K
through 12, in creating awareness on the part of those up-and-
coming students about what the possibilities are to take on
very viable careers. If we meet their needs with the qualities
that Ms. Easterly described, then I think we will find a
greater number kind of come into those systems.
I think we also need to revisit what the fundamental
qualifications are to take one of these jobs. Not all of them
require a Bachelor of Science (BS) in computer science. Many of
them simply need good, critical thinkers, people who have a
good work ethic, and we need to open the doors for them to make
their way into these jobs such that they can make an immediate
and positive difference.
Finally, we need to have some flexibility such that if you
are hired into a job in one place, you are a candidate to take
in any number of other places, and you see yourself as part of
a larger community, an ecosystem where you can flow back and
forth and everyone benefits from the diversity of experience
that we then accrue.
Senator Padilla. Ms. Carnahan.
Ms. Carnahan. Yes, thank you for that question, Senator. I
worked actually on a tech team inside the government, and it
was fascinating to watch how they were able to recruit talent.
I think that there are ways we can do this just by being
smarter.
One is we need to streamline human resources (HR) practices
to make it so we are actually defining jobs as they are defined
in the private sector, not as how they are defined in
government, so people know what roles might make sense for
them.
No. 1, we need to make use of remote work. That is a thing
that is attractive to lots of people in the technology
industry, not to have to pick up and move to another city or to
move to Washington in order to do the important work.
No. 2, if we promote this as tours of duty in government so
that they can get good experience and serve their country, it
turns out that folks in technology and cybersecurity are
patriotic and want to figure out ways to serve their government
as well. So we should give them that opportunity.
Finally, I think the way you recruit is you talk about the
impact. We often hear in government that you cannot afford
people, but it turns out people will do a lot to serve their
country, and if they know it has an impact on people, they are
willing to do that as well.
I think there are some very practical things that we can do
to recruit talent, and we need to get on it right away.
Senator Padilla. Thank you very much.
Senator Scott has yet to arrive, so we will turn to Senator
Hassan followed by Senator Hawley.
OPENING STATEMENT OF SENATOR HASSAN
Senator Hassan. Thank you so much, Senator Padilla. Good
morning to all three of our nominees. Thank you. I thank your
families for your willingness to serve. Thank you for your
expertise and your patriotism.
I want to start with a question to you, Mr. Inglis. I would
like to follow up on a discussion we had in our prior meeting.
It is clear that we have to work together to strengthen public-
private cybersecurity information sharing, especially in light
of the recent SolarWinds, Microsoft Exchange, and Colonial
Pipeline attacks.
In your view, what are the biggest barriers inhibiting
effective cybersecurity information sharing in both directions
between the private and public sector? If confirmed, are there
changes to the current information sharing framework that you
would recommend?
Mr. Inglis. Senator, thank you for the question, and thank
you especially for the conversation we had, which I found quite
enriching to my own understanding of some of these challenges.
With respect to information sharing, I think that that is a
very important dimension of public-private collaboration, but
often that fails because that is all we do, is share
information. We do not share perspectives. We do not share what
perhaps might be a hunch or an insight on one side of an
otherwise stovepiped organization to another and, therefore,
not feeling we have common cause, not sharing insight as
opposed to simply information. We find that we disappoint one
another. What you give me or what I give you is not as useful
because I lack the context.
I think, therefore, we need to create common cause. We need
to lower the boundaries, share at the lowest possible level,
not after we have a well-formed idea but to put people shoulder
to shoulder on floor plates where they can co-discover and co-
mitigate threats on the fly. To the extent that we do that and
we provide mutual advantage, the government to the private
sector and vice versa, I think you will find that those
relationships will take off and that they will then be self-
sustaining and they will grow.
Senator Hassan. Thank you. I really look forward to working
on that with you.
Ms. Easterly, FBI Director Chris Wray recently indicated
that the Bureau would be escalating the fight against
ransomware and stated that disrupting and preventing ransomware
attacks is a shared responsibility all across government
agencies. However, the Federal Government only successfully
prosecutes a small fraction of cyber criminals each year.
If confirmed, how would CISA work with law enforcement
agencies such as the FBI to increase costs and deterrence for
cyber criminals?
Ms. Easterly. Thanks for that question, Senator. I think as
we heard earlier this week from the CEO of Colonial in dealing
with that incident, they reached out to the FBI, and the FBI
immediately brought in CISA. I know some people look at that
and say, ``Well, the company did not call CISA,'' but I
actually think it is a tribute to those very strong
collaborative relationships within the Federal Government that
the FBI immediately brought in CISA. I think those
relationships have actually evolved over the past couple years,
and if confirmed, I would look to strengthen them.
We understand that the FBI's role is, of course, from an
investigation and a pursuit perspective. CISA's role is to
ensure that all the key stakeholders at the State, local,
Federal, non-Federal, private sector have the guidance and
information and resources that they need to be able to prevent
such attacks.
We know at the end of the day a lot of this comes down to
the basics of cyber hygiene, passwords, multifactor
authentication, and so these basics are absolutely critical to
be able to get out the information that is needed so that folks
know how to protect themselves.
Senator Hassan. Thank you. It is also important to note
that Colonial said that it had not actually planned for a
ransomware attack. It had planned for some other things, but
not that, so we have some work to do.
Ms. Carnahan, when we met a few weeks ago, you remarked
this is, I think, a quote from our conversation ``The future of
service is digital.'' But the COVID-19 pandemic revealed just
how many Federal agencies are not equipped to offer digital
services due to their use of expensive outdated technology and
paper-based data systems.
For Granite Staters, this meant significant delays in
delivery of stimulus checks and the inability to access
emergency funding to support their small businesses.
How will you proactively assist agencies in achieving their
IT modernization goals and in turn save taxpayer dollars by
reducing their reliance on outdated legacy IT systems?
Ms. Carnahan. Yes, that is a great question, Senator, and I
enjoyed our conversation. I have lots of thoughts about this.
As you know, I come from a State government perspective as
well, and I watched, just as all of us did, horrified, that so
much of the quick policy work and appropriation that was done
by Congress was not able to get to the people that needed it
because of outdated or not-working technology systems; and,
likewise, that cyber criminals were able to take advantage of
that and steal money.
Bottom line, if we cannot implement government policy, if
we cannot make the damn websites work, I think that is my
bottom line. We have to get that right. I want to ensure that
we both serve people well and do that in a way that is a smart
investment of money. I will also add that many times people
think, if we are going to upgrade technology systems, it is
going to cost a fortune, and it is going to take forever. What
we know is that you can incrementally improve these systems,
and you can do it for less money. It really is about focusing
on the value that we are giving to users and also doing that in
a way that is smart for taxpayers. I am very interested in
getting your thoughts on this and getting started.
Senator Hassan. I thank you, and I think one of the reasons
to do this, too, is to your point about making sure that people
understand that their government can work for them. They need
to be able to get the same level of service from their
government that they get from the private sector digitally. I
look forward to working on this issue with you as well.
Ms. Easterly, I have been particularly concerned about
cyber attacks against State and local governments and entities.
In your view, should the Department of Homeland Security
provide more resources to State and local governments to
improve their cyber posture?
Ms. Easterly. As a private citizen, I do not have a good
sense of the resources that are being provided right now, but I
absolutely agree with you on the importance of partnering
closely with State and local so that they do have the resources
to protect themselves. I think the addition of a cybersecurity
coordinator at the State level was an important enabler there,
and if I am confirmed, I will make that a priority to develop,
continue to develop those partnerships.
Senator Hassan. Thank you. Would you support creating a
stand-alone cybersecurity grant program for State and local
governments?
Ms. Easterly. At this point in time, Senator, I do not know
much about that, but it certainly seems to make sense. I think
grants are a very important vehicle to allow State and local to
have the resources that they need to defend themselves. If
confirmed, I would love to be able to learn from you more about
that and to work with you on it.
Senator Hassan. Thank you. Mr. Chair, I will turn my time
back, but I would look forward to a deeper conversation with
both Ms. Easterly and Mr. Inglis, too, about the
appropriateness of apprenticeship programs as a way to really
build our cyber workforce, and I look forward to that
conversation.
Thank you, Mr. Chair.
Senator Padilla. Senator Hawley.
OPENING STATEMENT OF SENATOR HAWLEY
Senator Hawley. Thank you, Mr. Chairman. Thanks to all the
witnesses for being here. Congratulations on your nominations.
Ms. Carnahan, if I could just start with you, I enjoyed
your conversation, I guess it has now been a couple of weeks
ago. Congratulations on your nomination. I want to follow up on
this important issue--you and I talked about it--of Federal
procurement, so important to what GSA does and the Federal
Acquisition Service, which is an important part of GSA's work.
Give me a sense of what role you see for GSA in ensuring
that we protect our procurement process from security risks.
What I am thinking here specifically--and we talked a little
bit about his--is the threat from Chinese-based
telecommunications products in government networks. What is
your view on how to protect our procurement process from those
kind of risks?
Ms. Carnahan. Thank you, Senator. I share your urgency
about this issue and understand that Congress has been very
clear about the dangers from both telecommunications equipment
and other things under the National Defense Authorization Act
(NDAA). I think it is important that GSA get on with, as the
chief buyer, strengthening the supply chain to ensure that it
is complying with Section 889. My understanding is that it has
worked on that, but in the end, there is no excuse for not just
getting it done.
I do not know what the blockers are currently to having
this fully implemented and enforcing these rules, but if I am
confirmed, I am going to be interested in, as quickly as
possible, getting to bottom of that issue.
Senator Hawley. Great. Thanks very much. I look forward to
working with you on that.
Switching topics, I have been a big advocate of reopening
the Federal agency field offices to ensure that our fellow
Missourians and other folks around the country can get the
services that they rely on and that they need. GSA, of course,
operates a huge property portfolio that include many of those
field offices.
Give me a sense of what role you see for remote work going
forward. You have mentioned this a time or two today in your
testimony, but what role do you see for remote work? What kind
of balance do you think we need to strike between in-person
work so folks can come in and ask their questions, get the
information they need, get answers, and then the remote work
for Federal employees. Tell me how you would strike that
balance and what your view is there.
Ms. Carnahan. Yes, it is a great question, and I think it
is something that the government is trying to get a handle on
as well as private businesses. I think the pandemic has changed
the way a lot of people are thinking about this, and it is
certainly changing the way how government is thinking about it.
I know that GSA is currently in the mix with a task force
on both reopening, but also the future of work and what that is
going to look like. I will look forward to learning more about
what that task force comes up with. I am not privy to that
right now, but my sense is a lot of these agencies are going to
be rethinking how many people need to be onsite, how many
people need to be in buildings, and it is all going to be based
on the mission. I think that is going to be different from one
agency to the next, and our job at GSA is going to be just
responding to agencies' needs as their workplace needs change.
I know it is a big topic, and I will be spending a lot of
time on it, and I look forward to getting started.
Senator Hawley. Very good. Thanks very much.
Ms. Easterly, let me turn to you, if I could. We had the
CEO of Colonial Pipeline before the Committee earlier this
week. I was troubled, to be honest with you, about his lack of
transparency over how much Colonial has invested in
cybersecurity and just the steps that they were taking
proactively before the most recent crisis in cybersecurity.
Do you think that we have currently adequate accountability
for private sector companies in place?
Ms. Easterly. It is a great question, Senator. Thank you. I
do not have a sense across the board in terms of
accountability. I currently work in the financial services
sector, and I think there is strong accountability there
because of our regulatory framework. But I do think
accountability is incredibly important for cybersecurity
standards across the board.
Senator Hawley. Do you think that the Federal Government
needs to require more of companies that operate critical
infrastructure? For example--and I asked the Colonial CEO about
this--until last month, I think the TSA reviews were optional,
were voluntary. Do you think we need to impose new
cybersecurity standards for companies that, again, in
Colonial's case really are almost public utilities, serve 100-
million-plus Americans; 16,000 different service stations were
fueled, or not, by Colonial Pipeline fuel. What is your view
about the level of standards that we may need to require?
Ms. Easterly. I think that is a great and important issue.
I do not have a sense across the board, but it seems to me that
voluntary standards are probably not getting the job done and
that there probably is some sort of role for making some of
these standards mandatory, to include notification. I do think
it is important that if there is a significant cyber incident,
critical infrastructure companies have to notify the Federal
Government, in particular CISA. We have to be able to warn
other potential victims.
Senator Hawley. Yes. Mr. Inglis, you were nodding your head
there. Do you want to add to this? I would be curious as to
your view.
Mr. Inglis. Yes, Senator, I would simply add I strongly
agree with the premise of your question, which is that this is
an important question and that at the end of the day we have to
ensure that our critical services, our critical functions, that
we have confidence that they will be delivered. There are
generally three ways that the standards kind of can come about.
One is enlightened self-interest. That is apparently not
working. The second is market forces. That is apparently not
working. The third is some imposition of standards or
regulation on top of that. We begin to take some steps in that
direction. It remains to be seen how we can achieve kind of the
full flowering of the innovation that we still need in the
private sector while imposing an expectation in the standards
that go with that to ensure that those critical services can
and will be delivered, even under duress.
I am a big fan on market forces as the primary way to
essentially drive the economy, but we have to kind of examine
that. If confirmed, I would be happy to work with this
Committee. I certainly will within the Federal branch or the
Executive Branch to consider the problem.
Senator Hawley. Very good. Let me just ask you, Mr. Inglis,
here in the brief time remaining how you would assess the
current organizational structure around cybersecurity
governance within the Federal Government. There are lots of
agencies, dozens that are involved in cybersecurity. Congress
created CISA obviously in order to drive coordination. Is the
current structure working, in your view? If not, what do we
need to do differently?
Mr. Inglis. Senator, thank you for the question. I think it
is the question of the moment. I think that is in part why the
National Cyber Director, by virtue of the work of this
Committee, has been created, that we want coherence, we want
unity of effort, unity of purpose. Without kind of detailed
knowledge, having not been on the job--and, if confirmed it
will be my first question--I cannot give you a detailed answer.
I would simply observe the following: that we have plenty of
diversity, we have some deep and sharp strengths. We have
strength in places like CISA, the FBI, the national agencies
that do intelligence, and GSA. But it is not entirely clear
that they are coherent, that we have achieved unity of purpose,
that they are all operating according to a single strategy that
would connect that diversity such that it becomes a strength.
I think that we can and should become greater than the sum
of our parts. I am not sure that we are yet there.
Senator Hawley. Very good. Thank you very much for your
testimony. Thanks to both of you and Ms. Carnahan.
Thank you, Mr. Chairman.
Chairman Peters [presiding]. Thank you, Senator Hawley.
OPENING STATEMENT OF SENATOR OSSOFF
Senator Ossoff, you are recognized for your questions.
Senator Ossoff. Thank you, Mr. Chairman. And
congratulations to these nominees. Thank you for your
attendance today.
We have rightfully spent a significant amount of time in
this hearing discussing cybersecurity given recent events. I
want to turn to that in a moment, but first, Mr. Inglis, given
your long tenure at the National Security Agency (NSA), I would
like to ask you, how do you view the role of National Cyber
Director and what is your understanding from the White House
about this role as it pertains to surveillance, as it pertains
to decisions that you may have to make or weigh in one that
balance privacy and national security needs domestically?
Mr. Inglis. Senator, thank you for the question. I will
just start by saying that in the context of surveillance, if by
that you mean kind of surveillance by national agencies of
various activities that we would want to know something about
in order to defend networks of interest, we have authorities in
place that restrict surveillance conducted by the government to
very narrow lanes, and I think that is appropriate, and we
should not take those walls down.
To the extent that that surveillance can be of a more
general sort, which is can we combine the insights that the
private sector might have, the network owners might have, the
commercial providers who run analytics across these networks
might have, with the knowledge the government has about, say,
foreign threats, I think that is where we can make some
progress and we can put those together. But we never, ever take
down the barriers that have provided protection for privacy,
for proprietary information, for classified information at the
same time we pursue collective security.
Senator Ossoff. Mr. Inglis, I appreciate that answer. I
just want to drill down a little bit more on what I mean by
surveillance here. Do you anticipate that in your capacity,
should you be confirmed, as National Cyber Director that you
will be involved in decisions regarding, for example,
collection of phone records or meta data of U.S. persons or
other data pertaining to U.S. persons under, for example, but
not limited to, Foreign Intelligence Surveillance Act (FISA) or
PATRIOT Act authorities?
Mr. Inglis. Sir, as I understand the National Cyber
Director's responsibilities, as the law lays it out, I would
not expect to be in those conversations. But I would be happy
to answer questions based on my prior experience about those.
Senator Ossoff. Thank you, Mr. Inglis. On that note, what
is your personal view of the balance that the Federal
Government has tried to strike between national security and
privacy interests? If you could comment specifically on what
has been referred to as the bulk collection of phone records
and meta data under Section 215 of the USA PATRIOT Act.
Mr. Inglis. Yes, sir, I think that is a very important
question. I think we go back to the Preamble of the
Constitution, which does not use the word ``or'' when it
describes the aspirations of this Nation. We have to defend
privacy at the same time we pursue collective security. We
cannot choose between them. We then have to work harder to
deliver both of them. Those are difficult policy issues each
generation has to face. How do we reconcile the technology, the
threats, to the aspirations that endure? So in my view, privacy
needs to be on the table up front. It is not something we can
deliver as an afterthought.
Senator Ossoff. Do you believe that there has been
overreach in the collection of data pertaining to U.S. persons
since the enactment of Section 215 of the PATRIOT Act and other
similar authorities?
Mr. Inglis. Sir, if by that you mean the collection of
telephone meta data that would have occurred in the early 2000s
and say up through perhaps the middle-2000-teens, I think that
looking back over our shoulder with hindsight as our experience
that we have decided as a Nation that that program is no longer
necessary and, therefore, no longer appropriate. My
understanding of the program at the time--and I was responsible
for implementing that program--was that it worked very hard to
align the interests of privacy at the same time pursuing
security, and there were any number of controls that were
imposed on it in deference to privacy as opposed to the simple
pursuit of security.
Senator Ossoff. Thank you, Mr. Inglis.
Ms. Easterly, when we met prior to this hearing, you and I
discussed our shared desire, I believe, to help promote a
culture of privacy, attention to the protection of personally
identifying information (PII), and cybersecurity more broadly
through American society to increase our resilience and the
responsibility we take as individuals to protect our data and
data that could impact the privacy of our fellow citizens.
What role do you see for CISA in helping to build that
broader culture of privacy and cybersecurity and good data
hygiene? Will you commit to engaging with my office to
determine how Congress can support such efforts?
Ms. Easterly. Thanks for that question, Senator. It is a
very important one. CISA is an agency of partnerships with the
Federal Government, non-Federal, and then with our private
sector partners. I believe that CISA can play a very important
role working with partners at every level to ensure that they
have the information that they need to be able to strike that
very important balance between privacy and security and,
importantly, to deal with some of the malicious cyber attacks
that we are seeing at every place in society to have that
critical information that they need to ensure that they have
good practices of cyber hygiene that are well implemented.
I would really enjoy the opportunity, if confirmed, to be
able to work closely with your office on how to make this a
culture of national resilience because it has to be more than
the Federal Government. It has to really be a societal level
that, frankly, starts at the youngest of levels so that folks
understand at the end of the day what it means to be a good
digital citizen.
Senator Ossoff. Thank you, Ms. Easterly.
Ms. Carnahan, my office has been inundated with requests
for assistance from Georgians who, through no fault of their
own, experienced job loss due to the COVID-19 pandemic and,
despite meeting eligibility criteria to receive unemployment
benefits from Georgia's Department of Labor (DOL), have
experiences, long delays in the processing and payment of their
approved claims, which has sent them and their families into
financial distress in the midst of a pandemic. These payment
delays involving Georgia's Department of Labor were detailed in
a report released by the Georgia Budget and Policy Institute in
February of this year, and according to that report, a reliance
on outdated technology at Georgia's Department of Labor is one
of the key factors contributing to these ongoing delays, which
is leaving Georgians in hardship.
So will you please commit to working with my staff and
using the authorities and expertise of the GSA to assist State
and local governments in improving these processes, including
specifically supporting improvement of Georgia's Department of
Labor's unemployment claims processing system so that so many
Georgians are not left without vital support in a crisis?
Ms. Carnahan. Thanks for bringing that issue up, Senator.
This is something that has happened across the country. Georgia
is not alone in this. I know it feels like it sometimes, but
every State has had similar issues because these unemployment
systems were, frankly, not invested in for so many years and
then were overwhelmed. But that is no excuse, and now we have
to think of this as an opportunity to rebuild better.
What we know is that these unemployment systems from one
State to the next are very similar. They are more similar than
they are different, and so the key here, Senator, I believe, is
to help figure out how to think about shared services that do
not have to be reinvented and rebuilt and paid for by taxpayers
over and over again in every State and if there are things that
we can do to help that collaboration.
I am very interested in this topic. I know GSA has the
ability to have technical talent and some resources that can be
supportive of both the Department of Labor and, to a lesser
degree, States. I would like to be able to expand our ability
to work with State and local governments because, frankly,
Senator, from a citizen's perspective, they do not care which
part of government serves them. They just want good service.
From a taxpayer's point of view, if it is tax money from the
Federal Government or State government, they want it well
spent. I think it is GSA's responsibility to try to work on
that.
Senator Ossoff. Thank you, Ms. Carnahan.
Mr. Chairman, I yield.
Chairman Peters. Thank you, Senator Ossoff.
Senator Scott, you are recognized for your questions.
OPENING STATEMENT OF SENATOR SCOTT
Senator Scott. Thank you, Chairman Peters.
First off, for all three of you, thank you for your
willingness to serve. You are not taking easy jobs, and, all
these jobs are pretty significant. We have seen all these cyber
attacks, and they can impact hospitals, businesses I used to be
in, looking at the grid, looking at the Colonial Pipeline and
all this stuff. I have friends of mine in business, and it has
never become public, but they have been attacked and paid out
unbelievable amounts in ransom.
One, do you think this is going to stop? Either of you, Ms.
Easterly and Mr. Inglis, do you think there is any reason this
is going to slow down?
Ms. Easterly. I agree with you in particular with
ransomware, but cyber attacks more broadly, we are now at a
place where nation-states and non-nation-state actors are
leveraging cyberspace largely with impunity to threaten our
privacy, our security, and our infrastructure. I think we
really are at a moment that requires an all-hands-on-deck
approach that leverages the talents and capabilities across the
interagency. If I am confirmed at CISA, I will ensure that CISA
does everything it can within its multitude partners to manage
and mitigate risk. I think we do have an opportunity to bring
the government together to work with our partners to make a
difference in this space.
Mr. Inglis. Senator, I would add to that. It will not stop
of its own accord. It is not a fire raging across a prairie
that, once it has consumed the fuel, it will simply stop and we
can simply wait for that moment. We must stand in, and there is
a range of activities that we must undertake. We must create
resilience and robustness not simply in technology but in
people. We must align actions to consequences. There should be
benefits for behaving well and consequences of a negative sort
for behaving badly. We should make this such that it is not
simply a cyber-on-cyber problem. We should bring to bear all
instruments of power in a hugely collaborative way across not
just the private and public sector but nations, plural. Like-
minded nations need to remove the sanctuary and bring to bear
consequences on those who hold us at risk.
Senator Scott. Do you think it is doable? I mean, it sounds
good----
Mr. Inglis. I do think it must be doable. I do not think--
so there is a really good discussion that takes place and this
Committee has participated at length in it about whether
deterrence is possible in cyberspace, whether we can----
Senator Scott. Right.
Mr. Inglis [continuing]. Impact the decision calculus of
adversaries in this space, and it often gets conflated with
nuclear deterrence where kind of the job was to keep the
nuclear weapon off the field. Thank goodness we have been
successful in that.
Senator Scott. Right.
Mr. Inglis. We are not going to be successful in that if
that is the goal in cyber. What we need to do is to make these
systems defensible. They will never be secure. We need to then
defend them. That is a human endeavor such that we can change
the decision calculus of adversaries so we reduce it by 85, 90
percent. I am to understand that if we did two-factor
authentication, something other than a password, if we did
routine patching every Tuesday, if we built in segmentation
fire breaks in our networks, 85 percent of the problem goes
away. If we train our people, which are the vast majority of
the weakness that adversaries take advantage of, maybe we can
reduce that still further. Get it down to a reasonable kind of
fire such that we can then manage that. It will never go away
completely, but we can bring it down, we can bring it to heel
significantly.
Senator Scott. Is there anything that Congress needs to do?
Mr. Inglis. Sir, I would say Congress is doing it. Your
investment in the authorities or the resources that we are
having a discussion about today are an important part of that.
The consultation between the Congress and the private sector
that it serves and the Executive Branch that essentially
derives its authorities and resources, that is important. That
is vital. I would say that we need to continue that
consultation. If confirmed, I know that the members at this
table look forward to that continued consultation.
Senator Scott. Ms. Easterly.
Ms. Easterly. Yes, thanks for the question, Senator. I
suspect there are probably things that Congress needs to do to
help in this problem set. One of the things that I will look at
very early on, if confirmed, is whether CISA itself has the
right resources from a budgetary, a personnel, and an
authorities perspective. I know that there is some discussion
about FISMA reform to ensure that accountability is rightly
structured. I know there is some discussion around whether
there should be mandatory instant reporting. I think things
like that are very important discussions to have, and if
confirmed, I would look forward to working with this Committee
on it.
Senator Scott. Who can take the leadership position to have
the pulpit to get the private sector to do more? Because, I
mean, Colonial Pipeline, a private company, but it impacted a
lot of families, right? Who can do that? Whose responsibility
is that, and who is going to do it, do you think?
Mr. Inglis. Sir, I will start. I would say the private
sector first is not a monolithic entity, and so you find great
variance in terms of what influences the private sector.
Second, the private sector is influenced by quite a lot of
activities, influences, or people. As I had indicated earlier,
the private sector sometimes has enlightened self interest
where they say that digital infrastructure is our business. It
is not merely a commodity. And those tend to be leading the
pack in terms of what they are doing to get ahead of this
problem.
There are some that understand the market forces are going
to drive them out of business if they do not prepare for this.
Those market forces are beginning to have kind of a duly noted
effect. But there are some that remain that do not think this
problem affects them. It affects all of us, right? We are all
in the boat. You do not need to be the target to be the victim.
For them, when they are conducting critical activities upon
which the Nation's interests depend, it may well be that we
need to step in and we need to regulate or mandate in the same
way we have done that for the aviation industry and for the
automobile industry. I think it is going to be a combination of
all those factors. The influence will come from many places.
Ultimately, we have put people in place that ultimately are
going to ensure that the system is working to that purpose. If
confirmed, the National Cyber Director will have the
responsibility to ensure to the President and to the Congress
that the Federal cybersecurity strategy is the right one and
then to oversee its implementation. We have had a rich
discussion today here about what CISA's role would be, but
there are so many other points of influence. We need to
consider all of them and apply all of concurrently.
Ms. Easterly. The only thing I would add to Mr. Inglis'
excellent answer, having spent the past 4\1/2\ years in the
private sector at one of our critical infrastructure owners, is
it is very important to have a coherence to the U.S.
Government. I know sometimes when there is a threat stream or a
vulnerability, there will be multiple outreach from different
agencies, and I think it is incredibly important that the
government is able to speak with one voice and that there is
coordination across the board.
In particular, I think CISA as a trusted partner to the
private sector can serve as a very effective front door. I
think it then mandates that CISA is able to in near-real time
share necessary information that comes in with the rest of the
Federal Government to ensure that these problems can be
addressed effectively. But those partnerships are incredibly
important. I appreciate that from a firsthand view, and if
confirmed, I would look to further cultivate that, working with
colleagues across the Federal Government.
Senator Scott. I am almost out of time, but do you think it
is appropriate to pay ransom? What do you all think?
Ms. Easterly. I am hesitant to start with that----
Mr. Inglis. Sir, you have made----
Senator Scott. I do not know--I mean, I am not telling you
because I know, but----
Mr. Inglis [continuing]. Easy question, but as framed, no,
it is not appropriate to pay ransom. Unfortunately, we get into
a place where that is the only thing that is the remedy----
Senator Scott. Feasible, right?
Mr. Inglis. Feasible to save lives or to bring back
critical capabilities. It is a really important question, and I
am not sure that I have the yes-no answer to it kind of out of
context. We need to attack the problem as a system, make it
such that we are a hard target, remove the sanctuary, the
garrisons that give harbor to these transgressors, make it such
that it is harder to move that money without some visibility,
hold accountable companies not so much for paying the ransom,
but for being in a position where they had to pay the ransom in
the first place--right?--for the failure to prepare for that.
That is where I think the point of accountability should be
placed.
Ms. Easterly. It is an incredibly tough choice to make to
pay the ransom. I think we heard that from the CEO of Colonial,
Mr. Blount, and I have great sympathy for that. I think CISA's
role is to prevent people from being in that position by
ensuring that they have the technical guidance, the threat
information, the best practices to protect themselves. If
confirmed, that is what I would hope to do as the Director of
CISA.
Senator Scott. Thanks.
Mr. Inglis. Thank you, sir.
Senator Scott. Thank you, Madam Chair.
Senator Rosen [Presiding.] I want to thank our nominees for
your time today and for your work in the past and your work
going forward. But I want to build a little bit on what my
colleagues have already been discussing with you, and that is
cyber workforce, because recent attacks like we have been
talking about, SolarWinds, Colonial Pipeline, they are
unprecedented, and we know attacks like these are going to
continue.
Experts have been warning about this for years, and, of
course, here we are. Policymakers at all levels in all branches
of government must recruit and retain qualified IT workers and
cybersecurity experts in every area across the spectrum to
prevent--like you said, to prevent and respond to attacks.
To address the gap, I recently introduced bipartisan
legislation establishing a Civilian Cybersecurity Reserve
Corps. The Civilian Cybersecurity Reserve Corps would authorize
civilian cybersecurity personnel to serve in temporary
positions at the Department of Homeland Security or at the
Department of Defense (DOD) to supplement existing agency
cybersecurity personnel. This bill is based on a recommendation
from the Cyberspace Solarium Commission.
I have a two-part question, the first part for you, Ms.
Easterly, and the second part for you, Mr. Inglis. Ms.
Easterly, if you are confirmed, will you ensure that DHS can
mobilize the cybersecurity surge capacity at times of greatest
need? And then for you, Mr. Inglis, how should the Federal
Government support State and local governments in recruiting
and retaining a strong cyber workforce?
Ms. Easterly. Thanks for that question, Senator. It is
hugely important, and I really enjoyed our discussion on this.
You know that workforce development and talent management is a
particular passion of mine, and I did see your legislation. I
think it speaks to the fact that we need to use all of the
creative approaches to be able to attract and retain,
importantly, talent into the U.S. Government, ensure that we
are building a culture that people want to be a part of and
that they feel like they have a career path. But reserve
programs, apprenticeship programs, internship programs, and
allowing for opportunities for people who want to come from the
private sector to serve their country, I think that is where a
reserve program could be incredibly effective. If confirmed, I
would really look forward to working with you on this issue.
Senator Rosen. Mr. Inglis.
Mr. Inglis. Senator, thank you for the question, and thank
you for the benefit of our conversation. I, too, enjoyed it
greatly. My sense is that the greatest contribution we can make
to making a difference in the cyber ecosystem is to address the
human factors, the people piece of that.
You have asked whether or not the Federal Government has a
role or what that role might look like in aiding and abetting
States and locals with the creation of the cyber talent. I
think there is a very strong role for the Federal Government.
It should not encroach upon the initiatives and the sovereignty
of the States and locales, but it can help quite a great deal.
It has the convening power such that we can have the venues
where we can exchange best practices. It has the power to
create ideas, initiatives to perhaps inspire people to think
about talent development in a fundamentally different and new
way.
It has the ability to curate and to share how do we create
critical thinking skills, cyber literacy, at the earliest
possible level. It has the ability to use the power of its
purse to encourage the development of talent not simply in the
old traditional ways of you have to be a computer scientist in
order to enter into one of these jobs, but there is a role for
everyone. It can perhaps help us redefine what it means to be a
cyber-literate society.
I think there is an all-many-few kind of relationship here.
There are a few that have the word ``cyber'' and ``IT'' in
their names. We are critically short of those. There are many
who need to know more about and do more about cyber than they
might otherwise have learned from their professional schools.
Every one of us needs to learn how to cross the cyber street in
the same way we learned how to cross a physical street when we
were young. The Federal Government, again, can be helpful in
all of that, should not take over or perhaps kind of block out
the initiative that the States and the locales I think are
generating with great success.
Senator Rosen. Thank you. I want to build on that because,
obviously, we have had problems with our pipeline, but we have
similar challenges with securing our electric grid. Last
Congress I introduced the Cyber Sense Act, and, again, it is
bipartisan legislation that would create a voluntary cyber
sense program at the Department of Energy (DOE) to test the
cybersecurity of products and technologies intended for use in
our bulk power system. The bill would also direct the Energy
Secretary to consider incentives perhaps to encourage the use
of analysis and testing results when designing products and
technologies.
Ms. Easterly, if confirmed, how do you envision CISA
working with the Department of Energy to ensure the
cybersecurity of our electric grid?
Ms. Easterly. Thanks for that question, Senator, and I did
see that legislation, and I agree with you. One of the biggest
threats is the threat to our energy grid. I am aware of the
100-day plan that we saw that brings together CISA and the
Department of Energy to focus on efforts to help protect the
energy grid, which I think is incredibly important. CISA, of
course, works closely with the Department of Energy, who is the
sector risk management agencies for the energy sector. If
confirmed, I would look to continue to cultivate that
relationship and collaborate closely with the leadership of the
Department of Energy and with Cybersecurity, Energy Security,
and Emergency Response (CESER) to do everything we can to
continue to protect and help all of the critical infrastructure
owners and operators protect the energy grid.
Senator Rosen. Thank you. I want to move on a little bit
and continue to talk to you about some of our vulnerabilities.
Last year I introduced a bill with Senator Cassidy, the PROTECT
Act, that is going to make permanent the Cybersecurity
Education and Training Assistance Program (CETAP), as we call
it. It is going to provide lots of resources--awareness,
curricular resources, professional development--to elementary
and secondary schools. The Clark County School District, the
largest school district in my State, one of the largest in the
country, had a large ransomware attack recently, and so I want
to be sure that we keep CETAP funded.
So if confirmed to the position, do you have any insight
into the administration's plans to support K through 12 schools
or soft targets in the ransomware space?
Ms. Easterly. Thanks for the question, Senator. I have some
awareness of the CETAP program and some of what CISA does to
protect schools and other facilities that may be vulnerable
around the country.
I absolutely agree with you that starting young is critical
to building that national societal resilience, providing cyber
awareness, knowledge of how to protect yourself, even at the
youngest level, particularly now that kids are using all kinds
of technology.
I also think it is important because that helps to create a
pipeline for the workforce, the earlier piece that we were
talking about. If, in fact, I am confirmed, I look forward to
working with you on this issue and also working with partners
at National Institute of Standards and Technology (NIST) and
National Science Foundation (NSF) to ensure that there is the
capability to be able to provide education to the K through 12
community.
Senator Rosen. Thank you. I appreciate that.
And now, via Webex, I would like to recognize Senator
Sinema.
OPENING STATEMENT OF SENATOR SINEMA
Senator Sinema. Thank you, Chair Rosen. I appreciate the
nominees joining us today, and I want to thank them for their
willingness to serve our Nation in these critical positions.
Now more than ever, we see the importance of enhancing
cybersecurity efforts and protecting critical infrastructure.
We need only look to the most recent attacks of SolarWinds, the
Microsoft Exchange Server, the Colonial Pipeline, and JBS
Foods, which has a production facility in Arizona, to see how
expansive cyber attacks have become and how damaging the
results can be at the Federal, State, and local levels. The
amount of time and resources needed to recover is daunting, and
the number of attacks is only increasing.
The newly established role of the National Cyber Director
and the office this person will lead is an important step to
ensure cross-government coordination on cyber strategy and
policy. The role of CISA Director has also never been more
important to coordinate security and resilience efforts across
the public and private sectors. These positions are a critical
piece to ensuring that the United States can address the
growing threat of cybersecurity attacks on our critical
infrastructure.
My first question is for Mr. Inglis. Many of the recent
attacks we have seen across the United States come down to a
lack of standard cyber hygiene practices, for example, weak
passwords or a lack of two-factor authentication at the user
level. This is an education issue that I am extremely concerned
about. There are a number of efforts across and outside the
Federal Government to enhance cyber education efforts beginning
in grades K through 12. But as we talk to stakeholders, they
are asking for a lead entity to coordinate efforts and create a
strategic plan to organize around.
Do you believe that the National Cyber Director is that
entity?
Mr. Inglis. Senator, thank you for the question, and thank
you for the benefit of our conversation, which I very much
enjoyed, on these topics. I do believe the National Cyber
Director has a role. The Cyber Director by law has a
responsibility to inform and to ensure the adequacy of programs
and policies intended to improve the cybersecurity posture of
the United States. If cyber is a compilation of not simply the
technology but of the people who live on the front lines of
this as well as doctrine, what are the roles and
responsibilities, the National Cyber Director by definition has
to ensure that our strategy is the right strategy.
As Ms. Easterly has indicated, we have a number of entities
within the Federal enterprise that are doing good work in
curating and delivering cyber curricula, K through 12,
sometimes in college. Whether that is the National Institute of
Standards and Technology with their National Initiative for
Cybersecurity Education (NICE) program, the National Science
Foundation with their CyberCorps for Service, we need to make
sure that those are coherent, that they are complementary, and
that they cover the waterfront. I think the National Cyber
Director would have a responsibility in that regard, and I
would commit to working with this Committee and with you, if
confirmed, on that role.
Senator Sinema. Thank you.
Ms. Easterly, what role do you believe that CISA should
play to enhance cyber education at the national, State, and
local levels?
Ms. Easterly. Thanks for that question, Senator Sinema.
Incredibly important. As I have said, CISA is an agency of
partnerships, and among the critical partnerships are at the
State and local level, and a lot of that is through our CISA's
ten Regional Directors, ensuring that the State and local
communities have the resources that they need, specifically the
educational resources, the assistance, the information about
cyber hygiene to be able to protect themselves I think is
incredibly important. As I mentioned earlier, I am aware of
CETAP; I am aware of other efforts being worked at NIST and
NSF, as Mr. Inglis alluded to. If confirmed, I would look to
better understand those efforts and really ensure that we can
help with this issue of K through 12. It is a particular
interest of mine because I think educating from the youngest is
critical to ensuring that national resilience as well as
creating that pipeline of talent that will need to enable our
Federal cyber workforce and the larger workforce for the
Nation.
Senator Sinema. Ms. Easterly, last Congress I introduced
legislation to establish a Cybersecurity Advisory Committee
that would advise, consult with, and make recommendations to
the Director of CISA on development, refinement, and
implementation of policies, programs, planning, and training
pertaining to the cybersecurity mission of the agency. The
language was included and passed into law in the fiscal year
(FY) 2021 NDAA. Now, recent cyber attacks have highlighted the
importance of public-private partnerships and working with
companies to protect against attacks on our infrastructure.
Do you agree that this Advisory Committee can play a
critical role in supporting CISA's efforts to defend against
threats, particularly those to critical infrastructure?
Ms. Easterly. Thanks for that question, Senator Sinema. I
am aware of the Cybersecurity Advisory Committee. I think it is
a terrific entity to help advise the CISA Director,
particularly leveraging the private sector, but also I know
that there are entities on there that are supposed to be from
State and local. I think this can be a very powerful capability
for the CISA Director to help further promote the public-
private operational collaboration and to ensure that CISA can
effectively coordinate and continue to cultivate those very
important public-private partnerships.
I would very much welcome the opportunity to leverage the
power of that Cybersecurity Advisory Committee if I am
confirmed.
Senator Sinema. Upon confirmation, I would like our staffs
to stay connected on the progress of establishing this
committee, so thank you.
Ms. Carnahan, as part of the 2018 National Defense
Authorization Act, the GSA was directed to create three e-
commerce marketplace pilot programs. In June 2020, GSA awarded
proof of concepts to Amazon Business, Overstock Pro, and Fisher
Scientific. I am hearing from businesses in Arizona that as of
now only the Amazon model has been tested. If confirmed, will
you work to ensure that the other models receive adequate
testing before the conclusion of the 3-year pilot?
Ms. Carnahan. Thanks for bringing that up, Senator. This is
not a topic I have been fully briefed on, but I certainly will
do so and look forward to working with you and your team to
make sure we get that done.
Senator Sinema. When I talk to Arizona small business
owners who depend on government contracts to keep their
businesses open, they have two major concerns: first, that a
move to a true e-commerce marketplace will obscure the
origination of products and leave us vulnerable to the purchase
of counterfeit products; and, second, specific to the Amazon
marketplace, the platform provider is also a reseller on the
platform, which could create a conflict of interest where their
products are promoted instead of those of small businesses.
What steps would you take upon confirmation to ensure that
the purchase of legitimate products and fairness exist in the
system and to ensure that small retailers are treated equally
in a system where the platform provider is also a reseller?
Ms. Carnahan. Yes, thanks for that. I will say that I have
heard, too, from small businesses about their frustration in
both getting on GSA's schedules and how hard it is to work
through that. I am very focused on making sure that these
marketplaces both serve well the agency partners and give them
the best possible value and transparency about what they are
buying, and also for the small businesses and companies in the
United States that want to sell to the government. So these are
important issues that you raise. They are things I will look
forward to looking into once confirmed, if that happens, and
working with your staff. I think these are worthy of very
serious consideration, and I think it has long-term impacts for
our country.
Senator Sinema. Thank you, Madam Chair. I yield back my
time.
Chairman Peters [presiding]. Thank you, Senator Sinema.
I think we have gone through the list of Senators who have
questions, but I will have one more questions for you, Ms.
Carnahan, before we wrap up this hearing. As Chairman of this
Committee, I am focused on making sure that we use our Federal
fleet, which consists of well over 650,000 vehicles to manage
those responsibly and efficiently, and also deal with the
detrimental impacts of climate change that threaten
irreversible damage to our climate, and sustainable fleet
management is clearly critical for both the environment as well
as from a fiscal perspective.
So my question to you is--President Biden has recently
directed GSA to devise a clean and zero-emission vehicle
procurement strategy for its portion of the fleet. So my
question is: If confirmed, how would you work to expeditiously
implement this plan while navigating supply chain and other
implementation and adoption challenges?
Ms. Carnahan. Yes, thanks for that question. It is a really
interesting one. This is a high priority for the Biden
administration, and, interestingly to me, the marketplace is
already moving and transitioning toward electric vehicles. I am
sure you have seen that in your State, and we are seeing it
across the country.
This creates all kinds of good opportunities for good-
paying jobs in these sectors, and GSA has this important role
to play. I think the key here is to make sure that there is a
close consultation with the industry. There is a limitation now
on some of the inventory of vehicles because the missions of
some of the agencies have specific vehicle needs, and they are
not always available in the marketplace right now. Signaling to
the market what those needs are is going to be important so
they can do their planning. Improved battery life is going to
be an issue that everybody is going to want dealt with, and
then with the government in particular, charging stations and
more access to those charging stations is going to be
important.
I think this is about closely coordinating with both
industry, this Committee, and the administration on how to get
this done, but it is a huge opportunity both to lower costs
long term for these vehicles and the use of vehicles in the
government, but also have all kinds of benefits for our
environment. So this is an exciting opportunity that I really
look forward to working with you on.
Chairman Peters. Thank you, Ms. Carnahan. We look forward
to working with you on it as well, because you are right, it is
an important and exciting initiative.
In closing, I want to thank once again each of our nominees
for being here today and congratulate each of you on your
nomination for these very challenging positions. When I say
that, very challenging positions, I also want to thank you for
your willingness to take on these positions. They are
incredibly important, incredibly time-consuming, so that means
I definitely have to thank your families as well for their
support and love and guidance in the years ahead, as all of
you, you and your families, are going to be engaged in public
service, and we certainly appreciate that.
The nominees have filed responses to biographical and
financial questionnaires, answered prehearing questions
submitted by the Committee,\1\ and had their financial
statements reviewed by the Office of Government Ethics.\2\
Without objection, this information will be made part of the
hearing record with the exception of the financial data,\3\
which are on file and available for public inspection in the
Committee offices.
---------------------------------------------------------------------------
\1\ The information of Ms. Carnahan appears in the Appendix on page
52.
\2\ The information of Ms. Easterly appears in the Appendix on page
110.
\3\ The information of Mr. Inglis appears in the Appendix on page
191.
---------------------------------------------------------------------------
The hearing record will remain open until 12 p.m. tomorrow,
June 11th, for the submission of statements and questions for
the record.
This hearing is now adjourned.
[Whereupon, at 12:23 p.m., the Committee was adjourned.]
A P P E N D I X
----------
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[all]