    [Senate Hearing 119-75, Part 8]
    [From the U.S. Government Publishing Office]

                                                     S. Hrg. 119-75, Pt. 8

                      DEPARTMENT OF DEFENSE AUTHORIZATION
     REQUEST FOR APPROPRIATIONS FOR FISCAL YEAR 2026 AND THE FUTURE YEARS
                                DEFENSE PROGRAM

    =======================================================================

                                    HEARING

                                   before the

                          COMMITTEE ON ARMED SERVICES
                              UNITED STATES SENATE

                        ONE HUNDRED NINETEENTH CONGRESS

                                 FIRST SESSION
                                       ON

                                    S. 2296

         TO AUTHORIZE APPROPRIATIONS FOR FISCAL YEAR 2026 FOR MILITARY
    ACTIVITIES OF THE DEPARTMENT OF DEFENSE AND FOR MILITARY CONSTRUCTION,
    TO PRESCRIBE MILITARY PERSONNEL STRENGTHS FOR SUCH FISCAL YEAR, AND FOR
                                 OTHER PURPOSES

                                   __________

                                     PART 8

                                 CYBERSECURITY

                                   __________

                                 APRIL 9, 2025

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

             Printed for the use of the Committee on Armed Services

                                                      S. Hrg. 119-75, Pt. 8

                      DEPARTMENT OF DEFENSE AUTHORIZATION
     REQUEST FOR APPROPRIATIONS FOR FISCAL YEAR 2026 AND THE FUTURE YEARS
                                DEFENSE PROGRAM

    =======================================================================

                                    HEARING

                                   before the

                                     of the

                          COMMITTEE ON ARMED SERVICES
                              UNITED STATES SENATE

                        ONE HUNDRED NINETEENTH CONGRESS

                                 FIRST SESSION

                                       ON

                                    S. 2296

         TO AUTHORIZE APPROPRIATIONS FOR FISCAL YEAR 2026 FOR MILITARY
    ACTIVITIES OF THE DEPARTMENT OF DEFENSE AND FOR MILITARY CONSTRUCTION,
    TO PRESCRIBE MILITARY PERSONNEL STRENGTHS FOR SUCH FISCAL YEAR, AND FOR
                                 OTHER PURPOSES

                                   __________

                                     PART 8

                                 CYBERSECURITY

                                   __________

                                 APRIL 9, 2025

                                   __________

             Printed for the use of the Committee on Armed Services

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                     Available via: http://www.govinfo.gov
                                       _______

                     U.S. GOVERNMENT PUBLISHING OFFICE

    61-986 PDF                   WASHINGTON : 2025

                          COMMITTEE ON ARMED SERVICES

                    ROGER F. WICKER, Mississippi, Chairman

    DEB FISCHER, Nebraska                 JACK REED, Rhode Island
    TOM COTTON, Arkansas                  JEANNE SHAHEEN, New Hampshire
    MIKE ROUNDS, South Dakota             KIRSTEN E. GILLIBRAND, New York
    JONI K. ERNST, Iowa                   RICHARD BLUMENTHAL, Connecticut
    DAN SULLIVAN, Alaska                  MAZIE K. HIRONO, Hawaii
    KEVIN CRAMER, North Dakota            TIM KAINE, Virginia
    RICK SCOTT, Florida                   ANGUS S. KING, Jr., Maine
    TOMMY TUBERVILLE, Alabama             ELIZABETH WARREN, Massachusetts
    MARKWAYNE MULLIN, Oklahoma            GARY C. PETERS, Michigan
    TED BUDD, North Carolina              TAMMY DUCKWORTH, Illinois
    ERIC SCHMITT, Missouri                JACKY ROSEN, Nevada
    JIM BANKS, Indiana                    MARK KELLY, Arizona
    TIM SHEEHY, Montana                   ELISSA SLOTKIN, Michigan

                       John P. Keast, Staff Director
                  Elizabeth L. King, Minority Staff Director

                                      ________

                         Subcommittee on Cybersecurity

                MIKE ROUNDS, South Dakota, Chairman

    TOM COTTON, Arkansas                  JACKY ROSEN, Nevada
    JONI ERNST, Iowa                      KIRSTEN E. GILLIBRAND, New York
    TED BUDD, North Carolina              GARY C. PETERS, Michigan
    ERIC SCHMITT, Missouri                ELISSA SLOTKIN, Michigan

                                      (ii)

                              C O N T E N T S

                                ________

                              April 9, 2025

                                                                       Page

    United States Cyber Command......................................     1

                               Members Statements

    Statement of Senator Mike Rounds.................................     1

    Statement of Senator Jack Reed...................................     2

    Statement of Senator Jacky Rosen.................................     3

                               Witness Statements

    Hartman, Lieutenant General William J., USA Acting Commander,         4
      United States Cyber Command/Acting Director, National Security
      Agency/Acting Chief, Central Security Service.

    Questions for the Record.........................................    34

                                     (iii)

    DEPARTMENT OF DEFENSE AUTHORIZATION FOR APPROPRIATIONS FOR FISCAL YEAR
                   2026 AND THE FUTURE YEARS DEFENSE PROGRAM

                                  ----------

                            WEDNESDAY, APRIL 9, 2025

                          United States Senate,
                         Subcommittee on Cybersecurity,
                                   Committee on Armed Services,
                                                        Washington, DC.

                          UNITED STATES CYBER COMMAND

        The Committee met, pursuant to notice, at 3:40 p.m. in room
    SD-G50, Dirksen Senate Office Building, Senator Mike Rounds
    (Chairman of the Subcommittee) presiding.
        Committee Members Present: Senators Rounds, Rosen, King,
    and Reed.

                OPENING STATEMENT OF SENATOR MIKE ROUNDS

        Senator Rounds. Good afternoon. I'd like to express my
    gratitude to Lieutenant General Hartman for his attendance at
    today's hearing.
        Before I proceed any further, I want to acknowledge the
    incredible momentum set by General Haugh and the strategic
    transformation needed to meet the evolving threats of today and
    the emerging challenges of tomorrow in cyberspace. General
    Haugh was a strong leader with a deep knowledge of the art and
    science of cyber warfare, hard earned over three decades of
    service to our country.
        Men and women capable of leading the National Security
    Agency and the United States Cyber Command are in short supply.
    Such leaders require years of experience to develop with
    deliberate and dedicated career focus. To put it more directly,
    we do not have enough of these types of leaders, and a loss of
    any one of them without strong justification is disappointing.
    The departure of General Haugh is a loss for our Nation, but
    will be a tremendous gain for any private or public entity
    where he decides to lend his expertise and leadership. I wish
    him Godspeed.
        That said, as our adversaries watch this hearing, it will
    be clear, that no matter the scenario, our cyber mission forces
    are ready. Lieutenant General Hartman's presence is more than
    just an annual congressional activity. His presence is more
    than just a general annual congressional activity. It shows the
    strength and resiliency of the cyber mission force. It is a
    testament to how much this command has matured since its
    inception in 2009, and the steadfast nature of our military,
    civilian and uniformed, to step up and fight when the Nation
    needs them.
        It also reflects the absolute importance of the dual hat
    arrangement, in the face of unexpected change there remains
    tight integration of cyber and intelligence operations, thanks
    to alignment under a single leader. Such an arrangement remains
    paramount in future decisions of General Haugh's formal
    successor.
        I have had the pleasure of working with Lieutenant General
    Hartman in his prior role as Deputy Commander of the United
    States Cyber Command, and I am confident in his ability to lead
    these organizations through this transition, maintaining the
    combat capability of a force that operates in an environment of
    constant change. He is one of the few, with a strong
    understanding of this domain, built over decades of experience.
        The importance of the cyber domain cannot be overstated.
    Our adversaries understand the dynamic and permeable nature of
    cyberspace and have clearly demonstrated their intent to
    exploit it to their advantage. General Hartman, as we discussed
    in detail during our closed session, the threats our Nation
    faces in the cyber domain have only intensified since we last
    convened for an update from United States Cyber Command
    (CYBERCOM) a year ago.
        The detection of additional Chinese advanced persistent
    threat groups throughout the past year has reinforced both the
    determination of our adversaries to own this domain, and their
    technical capability to do so. With the release of the Chinese
    generative artificial intelligence, large language model or
    DeepSeek-R1, earlier this year, competitive advantage will now
    be measured in weeks and months, not years. Our cyber mission
    force must be ready with training, technology, and operational
    structure to deter and defend against this new reality.
        I have been encouraged by the work the command has
    conducted on CYBERCOM 2.0 in collaboration with the services
    and the Assistant Secretary of Defense for cyber policy. I want
    to hear what policy changes are needed to realize the vision
    behind this effort. While I understand the implementation plan
    has not been delivered to Congress, our adversaries are not
    waiting for our process to conclude.
        I look forward to hearing more from you about the efforts
    underway to implement CYBERCOM 2.0 and how you intend to make
    sure the force is maturing, to conduct persistent engagement in
    this competitive environment.
        I will now recognize Ranking Member Reed, from the full
    Committee, at Senator Rosen's request, for opening remarks.

                     STATEMENT OF SENATOR JACK REED

        Senator Reed. Thank you very much, Mr. Chairman, and thank
    you Senator Rosen. I just want to take a moment to recognize
    General Haugh for his 35 years of dedicated service to this
    country and to the United States Air Force.
        His sudden and inexplicable firing is disrespectful to his
    service, but also disrespectful to every military member in or
    out of uniform, and an indication that their service and
    sacrifice is in no way respected by this Administration. The
    callous nature of the decision, the result of a meeting with a
    partisan conspiracy theorist, not on any kind of informed or
    experienced judgment, puts our security at grave risk and
    cannot be tolerated or continued.
        We salute a dedicated American for his service and
    sacrifice and his family for standing with him and wish him
    well. Thank you, Mr. Chairman.
        Senator Rounds. Ranking Member Rosen.

                    STATEMENT OF SENATOR JACKY ROSEN

        Senator Rosen. Thank you, Chair Rounds, and thank you
    Ranking Member Reed. Of course, this is such an important
    hearing, and I appreciate General Hartman, our meetings that we
    had yesterday and your team, all of your service, your
    commitment to the mission and on the success, because that
    means that we're all kept safe.
        You're also here on very short notice, as we've all been
    talking about, and we appreciate that as well, and so, I look
    forward to continuing our conversations and our continued
    partnership to ensure that success.
        Like my colleagues, I want to begin by addressing a matter
    of significant concern, the sudden and inexplicable firing of
    General Haugh, a trusted and dedicated Air Force officer for
    over 34 years, a true patriot. His abrupt and unjustified
    removal was conducted in the dead of night, with absolutely no
    consultation with Congress, the full committee, or this
    Subcommittee.
        According to press reports, it was at the request of a
    private individual outside of the government, outside the chain
    of command, who has a long record of pedaling in vicious
    conspiracy theories. This action compromises CYBERCOM and the
    National Security Agency (NSA) ability to keep Americans safe.
        United States faces major cyber threats from foreign
    adversaries, China, Russia, Iran, near daily cyber-attacks and
    our critical infrastructure. At the same time, we are engaged
    in ongoing operations against multiple threats across the
    globe, from Russian aggression against Ukraine to Iranian
    backed proxies in the Middle East and North Africa.
        Given the dangers facing the United States and our troops,
    it is inexplicable and unconscionable that the President would,
    at the mere request of an online provocateur, remove the leader
    of CYBERCOM, completely without cause and in doing so, risk
    undermining vital intelligence operations.
        Moreover, General Haugh has been a trusted leader. His
    experience and expertise have been crucial in guiding and
    shaping the efforts of U.S. Cyber Command and our overall
    national defense posture. At a time when our adversaries are
    constantly evolving their cyber capabilities, whether it's from
    State actors like Russia, China, Iran, or North Korea, or non-
    State actors with nefarious intent, leadership continuity and
    clear vision are more critical than ever.
        Cybersecurity and cyber operations are not and cannot be a
    partisan issue. It is a national security imperative, and the
    threat environment as we all know, continues to intensify every
    single day. We must maintain experienced leadership to counter
    the ever-evolving cyber challenges facing our country. As
    Members of this Committee and the full committee, we must
    demand clarity from the administration about the rationale for
    this decision, and we must not rest until we have answers and
    accountability from both President Trump and Secretary Hegseth.
        This afternoon though, our focus will be on our Nation's
    cyber capabilities and how Congress can help support the
    critical work that CYBERCOM personnel do every single day. I
    might say 24 hours a day, 24-7, 365.
        I look forward to hearing from General Hartman and to
    discussing how we can meet our Nation's challenge. Today, in
    the future and over the course of this congress, again, I know
    how much General Hartman you are invested in the mission of
    CYBERCOM, how much you know about it, your experience, your
    expertise and how invested you are in the ongoing success in
    combating cyber threats going forward. I do look forward to
    working with you on that. So, thank you, Mr. Chairman.
        Senator Rounds. Thank you, Ranking Member Rosen, and with
    that, Lieutenant General Hartman, welcome. Thank you for your
    service. We thank your family as well for their sacrifice, and
    there's a lot of things that you literally don't get an
    opportunity to share with the American public because of the
    type of responsibilities that you have. But today, you have an
    opportunity to share with the American people and with this
    committee a little bit about what you are doing. We welcome
    your opening remarks at this time, sir.

    STATEMENT OF LIEUTENANT GENERAL WILLIAM J. HARTMAN, USA ACTING
       COMMANDER, UNITED STATES CYBER COMMAND/ ACTING DIRECTOR,
       NATIONAL SECURITY AGENCY/ ACTING CHIEF, CENTRAL SECURITY
                                SERVICE

        Lieutenant General Hartman. Good afternoon. Chairman Rounds
    Ranking Member Rosen, thank you for your unwavering support and
    for the honor of representing U.S. Cyber Command today.
        I'm here to discuss the evolving strategic landscape and
    our approach as we look forward to 2026. CYBERCOM's mission is
    straightforward: We defend the Nation from cyber threats, we
    protect the Department of Defense's Networks, and we support
    the joint force. We are dedicated to ensuring the Department's
    mission advantage, and providing options across the conflict
    continuum to the President, the Secretary of Defense, and the
    American people.
        Achieving our assigned objectives in the mission set forth
    by the President of ``Peace through strength'', requires a
    force equipped with a strong warrior ethos and the lethality
    necessary to meet our national objectives.
        Deterrence is essential to our strategy. In cyberspace,
    we're focused on maintaining a credible capability that
    dissuades adversaries from targeting our critical
    infrastructure. Cyberspace is a rapidly evolving domain
    influenced by technological advancements, which necessitates a
    close partnership with industry. As the environment changes,
    CYBERCOM will adapt by swiftly developing and deploying new
    capabilities. Our commitment is to lead from the front, staying
    ahead of threats, through a proactive and agile approach.
        Our people are our greatest asset, capturing our ethos, we
    win with people. The dedicated professionals of CYBERCOM are at
    the forefront, defending networks, encountering threats every
    day. Their innovation and perseverance are essential to
    maintaining our Nation's advantage in cyberspace.
        But we're not alone in the fight. Our allies and partners
    are crucial components of our collective defense. Key
    collaborations like our partnership with the National Security
    Agency, enhance our Nation's security by creating a unified
    effort that surpasses the capabilities of our adversaries.
        Moving forward in 2026, our focus is not only on
    maintaining readiness, but also elevating the level of mastery
    within our cyber forces. Our initiative, CYBERCOM 2.0 seeks to
    overmatch our adversary's quantity with the quality of our
    people, capabilities, and operations. Modernizing our force
    design and rapidly integrating new technologies, are vital
    components of our strategy here. Partnership with industry and
    academia become indispensable, enabling us to stay at the
    forefront of cybersecurity advancements.
        Our adversaries are persistent and they are sophisticated.
    State sponsored cyber actors from China, Iran, North Korea, and
    Russia, pose significant threats to our critical infrastructure
    and military systems. China is the most persistent threat while
    Russia has gained significant capabilities through their
    ongoing operations.
        To counter these threats, CYBERCOM develops robust
    deterrent strategies, ensuring that any attempt to undermine
    our security will face an overwhelming response. An essential
    part of our future strategy includes the accelerated
    integration of artificial intelligence. Artificial intelligence
    offers unparalleled speed and precision in cyberspace
    operations, making it a key enabler for anticipating and
    countering emerging threats.
        By expanding Artificial Intelligence (AI) across our
    operations, we will strengthen our deterrence posture and
    maintain superiority in the cyber domain. True excellence in AI
    requires a world class workforce. Through initiatives like
    CYBERCOM 2.0, CYBERCOM will continue to collaborate with the
    Department to develop, pilot, and implement new tools and
    opportunities to invest in our workforce. A world class
    workforce requires world class training, facilities, and
    capabilities to excel and thrive. With the support and
    assistance, we received from the Department and from Congress,
    CYBERCOM is well positioned to achieve these world class
    results.
        Our work is far from finished, but with your continued
    partnership, I'm confident we'll succeed in defending our
    Nation. CYBERCOM is prepared to rise to the challenge,
    outpacing our adversaries, securing our interests, and
    protecting our future.
        Thank you, and I look forward to answering any questions
    you may have.
        [The prepared statement of Lieutenant General Hartman
    follows:]

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Senator Rounds. Thank you, General Hartman. I'll begin. In
    the wake of the various persistent cyber threats originating
    from the People's Republic of China over the last 2 years, it
    is my firm conclusion that the importance of the dual hat is as
    important today as it has ever been.
        Given these events, how has the dual hat arrangement
    between USCYBERCOM and NSA evolved to address the emerging
    threats from our adversaries?
        Lieutenant General Hartman. Senator, thank you for your
    question. The relationship between CYBERCOM and NSA continues
    to evolve so that we really achieve two key objectives. The
    first is that we see and understand what our adversary is
    doing. The second piece of that is that, we enable CYBERCOM or
    other elements of the U.S. Government in order to operate, in
    order to defend our critical infrastructure, our key networks
    and the Department of Defense Information Network.
        The ability for us to execute those operations clearly,
    understanding that we have to act, but that we also have to
    protect things like intelligent sources and methods, is
    fundamentally important to the dual hat. From my standpoint--
    and Senator, I've been sitting on the campus of the National
    Security Agency in CYBERCOM for most of the last 15 years, I've
    continued to see this partnership evolve, and our ability to
    execute increasingly more precise operations is fundamentally
    because the dual hat allows me, in my current capacity, to move
    with the speed and agility of unity of effort that is required,
    but it also forces leaders across the organization to
    collaborate, to do the hard work and to provide the best
    options for the national security of the country.
        That's what I believe is the importance of the dual hat,
    and that is really where I believe we've evolved to.
        Senator Rounds. Recognizing that this is an open setting
    and we can't get into specifics. I think another item, not only
    the dual hat, has been successful, but also the NSPM 13
    [National Security Presidential Memorandum 13], which was
    incorporated under President Trump in his first term, I
    believe, has been very successful in the process.
        The determining of when you can do your offensive cyber
    operations in an efficient manner, and making sure that all
    parties involved are appropriately apprised, but there is a
    decision process in place. Can you talk a little bit about the
    successes in terms of just the magnitude of the successes that
    you have seen achieved since the creation of the National
    Security Policy Memorandum 13 by President Trump in his first
    term?
        Lieutenant General Hartman. Thank you, Senator Rounds for
    the question. NSPM 13 is a repeatable, sustainable, agile
    process that is recognized across the Department of Defense and
    across the interagency that allows us to move at the speed and
    agility that's required, based on our intelligence, based on
    operational requirements, and it has increased our ability to
    execute cyber operations tenfold.
        Senator Rounds. Excellent. Thank you. This is just to give
    the American public some sense of what happens when you do the
    dual hat, and you also have the ability to make the decisions
    and to move quickly, how quickly we can actually accommodate
    our need for offensive cyber operations. Thank you for that
    information.
        Lieutenant General Hartman, in the commands testimony last
    year, General Haugh previewed the CYBERCOM 2.0 initiative, to
    focus on delivering a bold step forward in the future of the
    Cyber Mission Force. What is the status of this effort and what
    are the major recommendations of this plan?
        Lieutenant General Hartman. Chairman Rounds, thanks for the
    question. As you're well aware, one of the impetuses for
    CYBERCOM 2.0 was Section 1533 of last year's National Defense
    Authorization Act. Based on that, we put together a planning
    team and really studied hundreds of different references over
    the last year, and studied different force presentation models.
    We briefed the recommendations of CYBER COM 2.0 to the last
    administration and the Secretary of Defense approved it. We
    briefed this to the new Secretary of Defense who asked us to
    work the implementation strategy that we were previously
    working on a 6-month timeline down to 45 days.
        So, we brought an operational planning team together, or
    really what we called a cross-functional team. Over the last 45
    days, we've submitted a series of recommendations that we have
    concurrence, generally from across the services and across the
    Department, which honestly is pretty extraordinary in a 45-day
    time period, for us to get that level of consensus.
        Those recommendations are really built around how do we
    improve talent management in the force? How do we improve
    advanced training in the force? and how do we improve our
    ability to innovate and bring new capabilities to the force at
    the scale and speed that we need to compete with our
    adversaries there.
        That seems relatively simple. It's about 80 pages; we've
    delivered it to the Department. The Department is going through
    a very reasonable process and we're pending the results of that
    feedback from the Department chairman.
        Senator Rounds. Thank you General. Ranking Member Rosen.
        Senator Rosen. Well, thank you. I want to talk a little bit
    maybe about policy challenges. So, as we continue to evolve and
    develop our cyber capabilities to address the emerging threats,
    it's clear that there's a number of challenges, both within the
    Department of Defense and across agencies that can impede
    everybody's progress.
        I'd like to ask you about these obstacles and how they
    impact CYBERCOM's efforts to stay ahead of the growing cyber
    threat landscape. So, we know that you have many challenges,
    but based on CYBERCOM's plan for development, could you speak
    to some of the key policy obstacles that remain challenges for
    your operations, both within the Department of Defense and in
    the broader interagency context?
        Lieutenant General Hartman. Senator Rosen, thanks for the
    question. First, I just want to highlight that I think we have
    made significant progress. You know, one of the things we have
    discussed previously is the ability for us to support critical
    infrastructure that is off Department of Defense Information
    Network (DODIN), but critical to the Department's mission.
        We do appreciate the support from Congress in giving us the
    Federal labs authority that has allowed us to execute
    cooperative research agreements. I know that we've talked about
    Guam being a key component of this, and, you know, I, I'm happy
    to report that we have executed six different craters over the
    last 6 months with a number of very important critical
    infrastructure organizations in Guam. Our assessment is we have
    reduced the threat that those organizations face by about 25
    percent.
        That has been really key for us. We continue to work to
    better integrate the Reserve component into our operations to
    help secure critical infrastructure. It is an area where we
    think we need both an improvement from a policy standpoint, but
    we also need improvement from an appropriation standpoint, so
    we're able to better leverage the Reserve component force in
    order to support some of these critical mission sets.
        Senator Rosen. So, could you elaborate a little further
    maybe, with the primary sticking points what would hinder that
    coordination effectiveness, expansion of our cyber
    capabilities? Are you taking some steps there or how can we
    help as we begin to think about what those policy and
    appropriations needs might be?
        Lieutenant General Hartman. Senator Rosen, thanks for the
    question. I think on the defense of critical infrastructure,
    there continues to be a key role that a number of different
    organizations will take. I don't believe the Department will
    necessarily be the lead, but you know, there are
    recommendations that we will bring to the committee to how we
    might better work with organizations like the Department of
    Homeland Security, certainly organizations like the National
    Guard Bureau and we do believe that there are some policy
    recommendations that will work through the process that will be
    beneficial.
        I didn't talk about the United States Coast Guard. The
    United States Coast Guard has been a key partnership over the
    last 12 months. We have signed a memorandum of understanding
    with the Coast Guard. So, as a Coast Guard executes operations
    under the Department of Homeland Security (DHS) authorities, we
    do have the ability to support their operations, in a case
    where they have an authority, but they don't have the capacity.
    Certainly, as we look at the security of port facilities,
    critical infrastructure that supports port facilities, that is
    what we think is a very important MOU [Memorandum of
    Understanding].
        At the same time, if we have a CYBERCOM mission, we're
    operating on a facility that is specifically suited to the
    expertise the Coast Guard brings, they also have the ability to
    reinforce our operations. I do think we've made progress. I
    think there are additional policy recommendations. Senator, I
    look forward to working with the committee in order to provide
    those recommendations.
        Senator Rosen. Thank you. I want to talk a little bit about
    cyber workforce, because you can't do any of this without
    maintaining a robust cyber workforce. Our defense posture
    depends on it, we have to be sure that they're capable, that
    they're equipped, that they're trained, like you're talking
    about, these are our challenges to constantly be training,
    working on the mission, because the threats are ever evolving.
    The cyber domain is incredibly dynamic and achieving mastery
    it's just crucial, and it isn't done overnight.
        So what steps are you taking in CYBERCOM to make sure that
    we're keeping our personnel ahead of the curve? Talk to me
    about the workforce cuts and the hiring freeze and how that's
    impacting your ability to meet the mission.
        Lieutenant General Hartman. Senator Rosen, thanks. First of
    all, I would like to highlight that over the last year, we've
    had a number of things that have significantly impacted how
    we're managing particularly our civilian workforce.
        The first is the Cyber Excepted Service (CES). The ability
    to hire under CES has reduced the lag time by 45 percent, from
    over a year to less than 6 months now, in order to bring
    civilian personnel on board, that has been impactful. We went
    through a transition from what we call a Combatant Command
    Support Agency, from the Department of the Air Force to the
    Department of the Army. I'm in the army, but I'm not saying one
    is better than the other. But the transition, you know, did
    provide a little bit of friction as we work from one service to
    the other.
        We transitioned to the army last June and that has improved
    sort of a repeatable process to bring the civilians on board.
    Then there have been things like the 4092 authorizations from
    Congress, that have been important and allowed us to hire
    really, really high-end talent. So, I think we are on a glide
    path.
        The current hiring freeze has impacted our ability to bring
    new hires into the force. We'll continue to work with the
    Department on the way ahead for that. We have, however, not
    been impacted by any cuts. We have been able to go back to the
    Department and get an exemption.
        It is important because, as I think you're aware, Senator,
    we're only a little over 50 percent man with our civilian force
    but It's because those authorizations have all come really in
    the last year and a half. So, we do think it's important to get
    the civilian hiring freeze moved, and we do think it's
    important to be able to rapidly bring talent into the force.
        Senator Rosen. Thank you.
        Senator Rounds. General, I have just one other question. In
    early 2024, Congress received a briefing on the commands AI
    roadmap as required by the fiscal year 2023 National Defense
    Authorization Act. Given the release of the Chinese generative
    AI model, DeepSeek-R1, what steps has the command taken to
    accelerate delivery of the capabilities and milestones in this
    roadmap? What is needed to make certain that we will be
    successful in this acceleration?
        Lieutenant General Hartman. Chairman Rounds, thanks so much
    for the question, and so over a year ago, we produced again,
    based on a congressional requirement, so thanks, our AI roadmap
    that laid out a plan for the next 5 years. Very close
    partnership with NSA, and their artificial intelligence
    experts. A little over a year ago, we decided that we had a
    really good plan from a staff standpoint, but where CYBERCOM
    could add value, was in operationalizing these capabilities.
        So, we took the majority of the staff portion of that AI
    task force, and we moved it to the Cyber National Mission
    Force. We went out and hired some additional AI talent, really
    focused on 90-day pilot projects that we could evaluate, and if
    successful, we could scale across the force. If they weren't
    successful or didn't meet a need that we would then focus our
    efforts elsewhere.
        Over the last 12 months, we have executed artificial
    intelligence pilots to secure the DODIN, right? This is at the
    edge of the DODIN network, this is across network devices and
    it's at our end points. It has been very successful, and it is
    where we're moving to in the future.
        We have integrated large language models into our ``hunt
    forward'' kits. We have integrated large language models into
    our offensive capabilities. We have partnered very closely with
    DARPA [Defense Advanced Research Projects Agency], under
    Project Constellation and continue to transition capabilities,
    mostly based on artificial intelligence to the force.
        Additionally, Senator, we have and will continue to work
    with the Department on long-term resourcing that ensures we
    maintain advantage over China and any other adversary. I will
    say, we were all--paid close attention to, and we're alarmed by
    the DeepSeek model, right, But the United States of America
    builds the best software in the world, all right. We believe
    working with private industry, working across the government,
    that unique advantage in building the best software in the
    world, will allow us to stay ahead of the Chinese.
        Senator Rounds. Thank you General. Ranking Member Rosen.
        Senator Rosen. Thank you. I want to build a little bit on
    Senator Round's AI question, because we look to the future of
    cybersecurity. How else do we need, besides artificial
    intelligence, how do we need to adapt our training and
    development pipeline to ensure that our human workforce
    achieves mastery in the cyber domain?
        Additionally, with the increasing demands on our personnel
    and the nature of the cyber operations, how else can we perhaps
    leverage industry or commercial training opportunities to
    supplement the more specific on-net training that takes place
    in a classified environment?
        Lieutenant General Hartman. Senator, thanks for the
    question. You know, we've talked about CYBERCOM 2.0 and one of
    the big ideas in CYBERCOM 2.0 is advanced training. right?
    Right now, CYBERCOM is very fortunate and the services have
    done a very good job in order to present a C2 [Command and
    Control] force. The first time in the history of the command
    over the last year, we've reached C2, which means manned 80
    percent in the aggregate and trained it to 70 percent.
        But as we look at things like artificial intelligence, and
    cloud computing, and data scientists, and other advanced
    capabilities, we do think that the model we've laid out in
    CYBERCOM 2.0 is really where we need to go. It's my role with
    service-like authorities and as a joint force trainer, to take
    servicemembers and civilians that are presented to us by the
    services, and take them from that basic level and make them
    masters, and that is masters in data science, that's masters in
    cloud computing, that's masters in artificial intelligence.
        Then immediately take those lessons and feed them back, not
    only into the training base from the services, but also into
    our operational organization. That is really the best way that
    we think we can get after the training part of this. We are
    also working very closely with private industry, the creator
    authority that the committee has given us, also allows us to
    execute creators within private industry. We continue to work
    very closely with UARCs [University Affiliated Research
    Centers] and FFRDCs [Federally Funded Research and Development
    Centers], who provide us access to really high-end, really
    responsive talent, particularly as it relates to artificial
    intelligence and machine learning.
        Senator Rounds. Thank you, and I do believe we have another
    Member that is just arriving, and I would simply ask Senator
    King, are you ready with questions?
        Senator King. I'm always ready.
        Senator Rosen. I was going to say I knew how he would
    answer that. He's always ready.
        Senator Rounds. Senator King.
        Senator King. Thank you very much General for being here
    today. I take it my colleagues have talked, I'm sorry. I was at
    a hearing upstairs in the Intelligence Committee and it was an
    open hearing, so I can even tell you about it. But in any case,
    I understand that my colleagues have talked a lot about the
    firing of General Haugh and how unfortunate that was, so I
    don't need to plow that ground.
        One of the issues that I'm principally concerned with in
    cyber, is that we have no deterrent. Our strategy in all of our
    other military and national security approaches is based upon
    deterrence, except in cyber, where we continually are attacked,
    as we were salt typhoon for example, going all the way back to
    Sony, nothing ever happens to the adversary. My belief is, that
    until we start to impose costs and they understand that there
    will be costs, these attacks are going to continue, they're
    cheap, and there's really no consequences.
        If you're sitting in the Kremlin and somebody said, let's
    interfere with the next election in the United States, your
    answer would be, why not? It's not going to really cost us
    anything, and they don't respond, we're not in at any risk. Do
    you agree with me that we need to have a more stronger
    retaliatory capacity, No. 1, and demonstrate the will to use
    it? Otherwise, these attacks are simply going to continue.
        Lieutenant General Hartman. Senator, thanks for your
    question. It's good to see you again.
        Senator King. Yes, sir.
        Lieutenant General Hartman. So, Senator, we certainly agree
    that we need to continue to improve our capability in order to
    deter and respond to attacks. I will tell you that from our
    standpoint, there is certain activity that adversaries to
    include China, will always continue to conduct. We got to focus
    on the most credible capabilities to deter operations that
    significantly impact the national security.
        Just like you, I am aware of salt typhoon and volt typhoon,
    and while we're certainly concerned about that, and we will
    certainly develop a broad range of options to deal with that, I
    will tell you that the fact that we are able to see and observe
    that activity, and we are able to work with industry partners
    in order to build defenses against that activity, is something
    that provides us some advantage vis-a-vis adversaries like the
    Chinese.
        I assure you, we are dedicated to developing options in
    order to counter that. I would be more than happy to work with
    your staff in a different setting to provide you some details.
        Senator King. Well, I understand that you have capacity and
    you have capabilities. We demonstrated that in 2018 with the
    hunt forward, defend forward, that General Nakasone initiated.
    So, I understand we have the capacity. My problem is we don't
    have a doctrine. We don't have--a deterrence doesn't work
    unless the other side knows about it. Dr. Strangelove, why
    didn't you tell us about the doomsday machine? Well, the
    Premier like surprises.
        A deterrent isn't a deterrent: It takes two things, three
    things, capacity-which we have, will-which we apparently don't
    have and knowledge of the adversary that--we have those two
    things, and that they're being held at risk.
        So, I'm not questioning the capabilities. What I'm
    questioning is, here we are with salt typhoon, you know, two or
    three, 6 months ago nothing's happened, no response, no. You
    know, like I said, we haven't even responded to the Sony
    attack, and that was 10 or 15 years ago. There's never a price
    to be paid by our adversaries. Until we develop that theory, it
    seems to the concept of deterrence, and let them know that
    they're at risk, they're going to keep doing what they're
    doing.
        I understand defending and working with our private sector
    partners, that's all good. But you can't patch your way out of
    this. There's got to be, I believe, a credible deterrent that
    the adversaries understand, that if they attack us in
    cyberspace, they will pay a price. It doesn't necessarily have
    to be in cyberspace. It may be some other kind of harm that
    puts them at risk.
        But the point is, until we start to develop that doctrine
    and let our adversaries know, it's just going to keep
    happening.
        Lieutenant General Hartman. So, Senator, I acknowledge your
    concern. Again, I look forward to working with the committee,
    with the Department and I do think we could provide you some
    more information in a closed session.
        Senator King. Well, I appreciate that. Thank you, Mr.
    Chairman.
        Senator Rounds. Thank you, Senator King. I do have one last
    question for you, General and then I will allow Ranking Member
    Rosen a final question as well.
        Last year, the Defense Science Board briefed Congress on
    the status of the Joint Cyber Warfighting Architecture or JCWA.
    How is this command addressing the Defense Science Board's
    concerns about excessive bureaucracy, and length the
    acquisition timelines, that prevent cutting edge cyber
    technologies from being integrated into the Joint Cyber
    Warfighting Architecture, before they become obsolete?
        Lieutenant General Hartman. Chairman Rounds, thanks for
    your question. In the 2022 National Defense Authorization Act,
    CYBERCOM was given a number of things, we put it under the
    banner of service like authorities. One of those was
    acquisition authorities. The other piece was enhanced budget
    control.
        Under those authorities, we have consolidated our efforts
    as it relates to JCWA, and we are fielding relevant, agile, and
    not obsolete capabilities, that are positioning us to execute
    our UCP [Unified Command Plan] mission to defend the Nation, as
    well as to support key geographic commanders like Admiral
    Paparo and United States Indo-Pacific Command (INDOPACOM).
        We have a plan to take the six programs that are part of
    JCWA, that have currently been developed by the services, and
    to bring those underneath our program executive office, really
    focused on offensive, defensive and enterprise level
    operations, and it's working senator and I look forward to
    providing you and the committee additional updates on that.
        Senator Rounds. Excellent. Senator Rosen.
        Senator Rosen. Thank you. I actually have a compound last
    question. So, I want a clarification on some terms that we use
    on about the PRC [People's Republic of China]. So, could you
    explain for the layman what ``living off the land'' tactics are
    and why it's important from a cyber defense perspective? The
    compound part of the question is, and finally, what do you
    really want us to know that we haven't asked you today. We know
    you've had just a short time to prepare for this, but maybe
    we'll give you that final word there too.
        Lieutenant General Hartman. Hey, thanks, Senator Rosen. So,
    living off the land, you know, really describes when an
    adversary gains access to your network and then uses legitimate
    user credentials and legitimate user behavior in order to live
    in your network, in a way that makes it really hard to detect
    them using a standard antivirus or alert-based program.
        Senator Rosen. So secretly living in the basement, I
    suppose then, right?
        [Laughter.]
        Lieutenant General Hartman. It makes it really difficult
    because it's the behavior that you've got to detect. But look,
    we do know how to do that. We have gained a significant amount
    of knowledge. Artificial intelligence is going to help us,
    working with private industry is going to help us. And we're
    dedicated to continue to get after that problem.
        Senator Rounds. Thank you. And then I think Senator King
    had one more question?
        Lieutenant General Hartman. I didn't answer the second part
    of her question.
        Senator Rounds. Oh, I apologize. Go ahead.
        Lieutenant General Hartman. So, I think the thing that I
    would most like the Committee to take away is, Congress and the
    Department have given us authorities, right? They've given us
    Service-like authorities. They've given us control of the
    resources that apply to the ? one, so the Cyber Mission Force
    and the headquarters that employ them. We've been given
    acquisition authorities, we've been given joint force trainer
    authorities, and all those things are enabling us to evolve the
    command in a way that better enables us to compete with China
    or any other adversary. It is working. Okay.
        There are things that slow down the process: continuing
    resolutions slow down the process, hiring freezes slow down the
    process, transitions between one combatant command support
    agency and the other, slow down the process. But we have a
    plan, we're executing it, and it's all about the ecosystem that
    we have to build that provides precise intelligence to really
    smart capability developers, that then field it to a force that
    has been trained and operationally aligned to receive that
    capability.
        We're doing it with DARPA, we're doing it with the S&T
    community. We're doing it with the communities across our
    services that have significant investments in cyber
    capabilities. We're doing it based on operational requirements
    of geographic combatant commanders like INDOPACOM, and based on
    CYBERCOM requirements to defend the Nation.
        So that's really the message I have here, those
    authorities, those resources, they're relatively new, but they
    are allowing us to really increase our ability to really get
    after all the things that we've talked about here.
        Senator Rosen. Thank you.
        Senator Rounds. Senator King.
        Senator King. I realize this isn't exactly in your lane,
    but it's certainly close. You talked in your prior answer about
    the work with the private sector and alerting them to the
    threats and to what was going on, and that's very important.
    But the principal agency that actually has performed that
    function as an interface between the Federal Government and the
    private sector, is CISA [Cybersecurity and Infrastructure
    Security Agency].
        My concern is that we've seen reports of cuts at CISA up to
    90 percent. I believe 40 percent may be the latest number. and
    I think they've eliminated the office that interfaced with
    State election officials, that enabled them to share threat
    data and information and protections with State election
    officials to keep our election safe and secure.
        I am just puzzled, at a time of heightened cyber threat,
    that we are essentially unilaterally disarming one of the most
    important tools that we have to protect ourselves in
    cyberspace. Do you have any views on the dismantling of CISA?
        Lieutenant General Hartman. Senator King, thanks for the
    question. To be honest, I do not understand what the actual
    decisions are for any reduction or reorganization as it relates
    to CISA. I will tell you that we continue to talk to CISA
    leadership, and we continue to share information with CISA
    leadership as it relates to threats that are relevant to their
    mission for defenses in the United States.
        Senator King. Well, Mr. Chairman, I realize that again,
    this isn't his land, but this Subcommittee's dealing with the
    issue of cyber, and CISA is one of our most important tools to
    deal with that and they've been very effective. Having worked
    with some Members of the private sector that have worked with
    CISA, it took years to build a trusting relationship between
    this government agency and these companies, as well as the
    State election officials.
        I remember when that initiative first started, and those
    State election officials were very reluctant to interface with
    this Federal Agency. But they became very--I wouldn't say
    dependent, but they became very engaged with CISA in the last
    several elections and to basically dismantle that capability, I
    think is very dangerous for national security at a time of
    heightened cyber-attack. We're under attack right now, and to
    be unilaterally disarming and disabling what amounts to a
    carrier fleet, I think is very damaging to the security of the
    country. Thank you.
        Senator Rounds. I think Your concern is noted, Senator.
    With that, I want to thank General Hartman for coming in on
    short notice and participating in this Subcommittee hearing.
    This does conclude the open portion of today's cybersecurity
    subcommittee hearing.
        I'd like to once again, thank our witness, Lieutenant
    General Hartman, for his testimony. For the information of
    Members, questions for the record will be due to the Committee
    within two business days of the conclusion of the hearing, and
    with that, Senator, any final remarks?
        Senator Rosen. No. Thank you for coming.
        Senator Rounds. And with that, then this Subcommittee
    hearing is adjourned.
        Lieutenant General Hartman. Thank you, Chairman, Ranking
    Member.
        [Whereupon, at 4:27 p.m., the Committee adjourned.]

        [Questions for the record with answers supplied follow:]

                   Questions Submitted by Senator Tom Cotton
                            offensive cyber strategy
        1. Senator Cotton. Lieutenant General Hartman, what actions can
    U.S. Cyber Command (CYBERCOM) take as part of an offensive strategy to
    deter cyberattacks by China on our critical infrastructure?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.

        2. Senator Cotton. Lieutenant General Hartman, what offensive
    actions can CYBERCOM take in response to new attacks on our critical
    infrastructure?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.

        3. Senator Cotton. Lieutenant General Hartman, do you have the
    necessary authorities to conduct these operations?
        Lieutenant General Hartman. USCYBERCOM has a variety of authorities
    that enable the Command to conduct Cyber Operations that may deter
    Chinese attacks on Critical Infrastructure and Key Resources (CIKR).
    These authorities include those contained in statutes and as authorized
    by the President. Existing authorities may be leveraged to conduct
    cyber operations for the specific purpose of deterring Chinese attacks
    on CIKR.

        4. Senator Cotton. Lieutenant General Hartman, is the Department of
    Defense (DOD) able to effectively leverage the most innovative
    technologies for offensive cyber operations, and, if not, what needs to
    be done?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.
                            critical infrastructure
        5. Senator Cotton. Lieutenant General Hartman, what are key trends
    in cyberattacks on our critical infrastructure in the past year?
        Lieutenant General Hartman. In 2024, we observed an increase in
    criminal cyber activity in response to the conflicts in the Ukraine and
    Gaza. Ransomware attacks, some possibly linked to State actors, persist
    as a major threat to United States critical infrastructure. Incidents
    related to ransomware increased by approximately 9 percent from
    2023.\1\ According to FBI reporting, U.S. critical infrastructure
    companies (i.e. energy, manufacturing, healthcare and finance)
    experienced more cyber threats than any other sector in the past
    year.\2\
    ---------------------------------------------------------------------------
        \1\ FBI;2024--IC3Report; 23 APR 2025;(U) Federal Bureau of
    Investigation Internet Crime Report 2024; https://www.ic3.gov/
    Annua1Report/Reports/2024_IC3Report.pdf; Classification of extracted
    information is U; Overall classification is U.
        \2\ FBI; 2024--IC3Report; 23 APR 2025; (U) Federal Bureau of
    Investigation Internet Crime Report 2024; https://www.ic3.gov/
    Annua1Report!Reports/2024_1C3Report.pdf; Classification of extracted
    information is U; Overall classification is U.
    ---------------------------------------------------------------------------
        State actors continued to target common vulnerabilities in outdated
    hardware and software, with over 25 percent of vulnerabilities
    exploited within 24 hours of disclosure.\3\ Despite the relative
    increase in ransomware threats against U.S. critical infrastructure,
    the average ransom payment decreased by almost 33 percent worldwide,
    suggesting efforts from the U.S. and global law-enforcement operations
    very likely contributed to the decrease in profitability for ransomware
    operations, according to cybersecurity and open source reporting.\4\\5\
    ---------------------------------------------------------------------------
        \3\ New Article;15 April 25; 159 CVE's Exploited in Q1 of 2025;
    https://thehackemews.com/2025/04/159-cves-exploited-in-q1- 2025-
    283.html; Classification of extracted information is U; Overall
    classification is U.
        \4\ Article,Mandiant; 25-10005992; 10 FEB 2025; (U) Ransomware
    Payments Declined in 2024 Despite Massive Well-Known Hack;
    Classification of extracted information is U; Overall classification is
    U.
        \5\ Article,Recorded Future; 5 FEB 2025; https://
    www.therecord.media/ransomware-payments-drop-2024-chainalysis-report;
    (U) Ransomware Payments Drop for First Time in Years Following Law
    Enforcement Disruptions; Classification of extracted information is U;
    Overall classification is U.
    ---------------------------------------------------------------------------
        Due to classification, please refer to the classified annex/or the
    remainder of this response.

        6. Senator Cotton. Lieutenant General Hartman, do you think DOD
    needs more cyber-related information sharing with Cybersecurity and
    Infrastructure Security Agency (CISA) and other agencies?
        Lieutenant General Hartman. DOD would benefit from more cyber-
    related information sharing across the government and with private
    industry, and vice-versa. Malicious cyber actors rarely target a single
    sector of the United States. The techniques tactics and procedures
    (TTPs) and indicators of compromise (IOCs) used against government and
    commercial entities are almost certainly relevant to all parties.
    Cyber-related information sharing between CISA and DOD exists, but
    authorities and information sharing agreements between military and
    government entities are bespoke and vary between agencies.
    Standardizing cyber-related information sharing across all Government
    and military entities would provide a more complete picture of
    adversary campaigns across the cyber spectrum. The result would be
    shared situational awareness for critical infrastructure, which would
    enable greater burden sharing and efficient response across the whole
    of government for cyber defense.
        Due to classification, please refer to the classified annex/or the
    remainder of this response.

        7. Senator Cotton. Lieutenant General Hartman, how would CYBERCOM's
    plans to partner with the Defense Intelligence Agency (DIA) help us
    defend and deter cyberattacks from China?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.
                        u.s. cyber command capabilities
        8. Senator Cotton. Lieutenant General Hartman, I'm concerned that
    CYBERCOM should be able to offer more significant combat power to the
    joint force. What are the biggest limitations to capability
    development?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.

        9. Senator Cotton. Lieutenant General Hartman, what have been some
    of your greatest challenges when partnering with the private sector or
    academia to leverage the most innovative cyber capabilities and how can
    Congress help alleviate these challenges?
        Lieutenant General Hartman. Navigating the complexities of the
    Defense Acquisition process is a challenge. For example, in our ongoing
    collaboration with the Defense Innovation Unit (DIU), we are working to
    unify the DODIN Hunt Kit and the CNMF Hunt Forward Kit under a common
    platform-the Joint Cyber Hunt Kit (JCHK). This effort involves
    leveraging multiple Research (IO US. C Sec.  2371) and Prototype (IO
    US. C. Sec.  2371b) Other Transaction (OT) awards to engage with
    industry partners in a nimble and collaborative manner. While the OT
    authority provides some flexibility, challenges remain in aligning
    government and industry timelines and ensuring sustained funding to
    support rapid innovation.
        Another significant challenge is integrating cutting-edge
    technologies from non-traditional and non-Defense Industrial Base (DIB)
    companies into military operations. For instance, our strategic
    partnership with In-Q-Tel (IQT), a private, independent, and non-profit
    organization funded by the US. Intelligence Community, allows us to
    bridge the gap between venture capital companies, commercial startups,
    and government partners. Through this partnership, we can efficiently
    deliver critical technologies to the Cyber Mission Force (CMF).
    However, the rapid innovation cycles of private sector startups are
    often at odds with the deliberate pace of government acquisition
    processes. Additionally, small, non-traditional companies frequently
    struggle with navigating the complexities of the defense sector,
    including strict regulatory and security requirements that can slow the
    adoption of innovative technologies.
        USCYBERCOM also leverages Cooperative Research and Development
    Agreements (CRADAs) to conduct joint research and development with
    Federal Labs and non-Federal entities. CRADAs enable us to combine
    resources and collaborate with partners on cyber capability research.
        The Software Acquisition Pathway empowers USCYBERCOM to rapidly
    acquire, develop, and deploy innovative software solutions, leveraging
    key partnerships with academia and the private sector. This agile
    approach accelerates the delivery of critical capabilities, enabling
    USCYBERCOM to stay ahead of evolving cyber threats and improve
    operational effectiveness. By fostering innovation and ensuring a more
    resilient and responsive cyber posture, these collaborations bring
    cutting-edge research and commercial expertise to bear on our Nation's
    toughest cyber challenges. This streamlined process allows them to
    experiment with emerging solutions, adapt to evolving threats, and
    maintain a technological edge. Your continued support for the Software
    Acquisition Pathway ensures USCYBERCOM, in partnerships with leading
    experts, has the tools needed to defend the Nation in the cyber
    battlespace.
                            artificial intelligence
        10. Senator Cotton. Lieutenant General Hartman, what are the most
    promising artificial intelligence (AI)-enabled cyber capabilities you
    are aware of and have you seen adversaries deploying these technologies
    against our Nation's critical infrastructure?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex/or this response.

        11. Senator Cotton. Lieutenant General Hartman, how do you assess
    China's AI-enabled cyber capabilities?
        Lieutenant General Hartman. USCYBERCOM assesses that AI is a pillar
    of China's military modernization strategy, which pursues the concept
    of ``intelligent-ized warfare.''
        Due to classification, please refer to the classified annex for the
    remainder of this response.

        12. Senator Cotton. Lieutenant General Hartman, have you shifted
    your strategy and investments following the release of DeepSeek?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.

        13. Senator Cotton. Lieutenant General Hartman, as the DOD starts
    to increasingly use AI and partner with vendors that use AI, how is DOD
    ensuring a secure AI environment both at the Department and among
    partners in the Defense Industrial Base?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.

        14. Senator Cotton. Lieutenant General Hartman, are there tools to
    automate or streamline compliance with cybersecurity requirement?
        Lieutenant General Hartman. Current investment plans for AI
    adaption are not focused on resourcing non-operational usage, though
    tools to automate or streamline compliance are being evaluated. There
    are commercially available automated penetration testing tools.
                             post-quantum security
        15. Senator Cotton. Lieutenant General Hartman, as we look forward
    to developments in the quantum computing field, what are we doing to
    advance quantum-resistant methods to protect the Department of Defense
    Information Network (DODIN)?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.

        16. Senator Cotton. Lieutenant General Hartman, do you have the
    necessary expertise and resources to accomplish this?
        Lieutenant General Hartman. USCYBERCOM will leverage the expertise
    resident in the NSA. NSA is responsible for cryptology for the
    Department of Defense, and as such they provide quantum-resistant
    methods for the Department.
                              technical personnel
        17. Senator Cotton. Lieutenant General Hartman, can greater
    automation or the use of AI-enabled tools help close the cybersecurity
    skills gap?
        Lieutenant General Hartman. Greater automation and AI-enabled tools
    are essential to closing the cybersecurity skills gap; this is a
    capability we are deliberately building toward. At USCYBERCOM, we've
    outlined a strategic vision to integrate AI to enhance operator
    effectiveness, streamline cyber workflows, and expand the impact of our
    existing workforce.
        While technologies such as AI-enabled copilots, agentic assistants,
    and low/no-code development platforms are not yet fielded, we plan to
    begin deploying them across mission areas in FY26 and beyond. These
    tools are intended to allow less experienced personnel to contribute
    more rapidly while taking on high value tasks to ease our reliance on
    hard to fill technical and institutional roles.
        Due to classification, please refer to the classified annex for the
    remainder of this response.
                               maven smart system
        18. Senator Cotton. Lieutenant General Hartman, I understand that
    CJADC2 [Combined Joint All Domain Command and Control] and AI
    capabilities significantly enhance a commander's decision making and
    operational advantages. Have you utilized the Maven Smart System to
    achieve these benefits in your missions? If so, how?
        Lieutenant General Hartman. Due to classification, please refer to
    the classified annex for this response.

                                     [all]