[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]
EMERGING THREATS AND TECHNOLOGIES TO PROTECT THE HOMELAND
=======================================================================
HEARING
before the
SUBCOMMITTEE ON
CYBERSECURITY, INFRASTRUCTURE
PROTECTION, AND SECURITY
TECHNOLOGIES
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED FOURTEENTH CONGRESS
FIRST SESSION
__________
FEBRUARY 12, 2015
__________
Serial No. 114-3
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.gpo.gov/fdsys/
______
U.S. GOVERNMENT PUBLISHING OFFICE
94-107 PDF WASHINGTON : 2015
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
__________
COMMITTEE ON HOMELAND SECURITY
Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas Bennie G. Thompson, Mississippi
Peter T. King, New York Loretta Sanchez, California
Mike Rogers, Alabama Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice James R. Langevin, Rhode Island
Chair Brian Higgins, New York
Jeff Duncan, South Carolina Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania William R. Keating, Massachusetts
Steven M. Palazzo, Mississippi Donald M. Payne, Jr., New Jersey
Lou Barletta, Pennsylvania Filemon Vela, Texas
Scott Perry, Pennsylvania Bonnie Watson Coleman, New Jersey
Curt Clawson, Florida Kathleen M. Rice, New York
John Katko, New York Norma J. Torres, California
Will Hurd, Texas
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
Brendan P. Shields, Staff Director
Joan V. O'Hara, General Counsel
Michael S. Twinchek, Chief Clerk
I. Lanier Avant, Minority Staff Director
------
SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY
TECHNOLOGIES
John Ratcliffe, Texas, Chairman
Peter T. King, New York Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania Loretta Sanchez, California
Steven M. Palazzo, Mississippi Sheila Jackson Lee, Texas
Scott Perry, Pennsylvania James R. Langevin, Rhode Island
Curt Clawson, Florida Bennie G. Thompson, Mississippi
Michael T. McCaul, Texas (ex (ex officio)
officio)
Vacant, Subcommittee Staff Director
Dennis Terry, Subcommittee Clerk
Christopher Schepis, Minority Subcommittee Staff Director
C O N T E N T S
----------
Page
Statements
The Honorable John Ratcliffe, a Representative in Congress From
the State of Texas, and Chairman, Subcommittee on
Cybersecurity, Infrastructure Protection, and Security
Technologies:
Oral Statement................................................. 1
Prepared Statement............................................. 2
The Honorable Cedric L. Richmond, a Representative in Congress
From the State of Louisiana, and Ranking Member, Subcommittee
on Cybersecurity, Infrastructure Protection, and Security
Technologies:
Oral Statement................................................. 3
Prepared Statement............................................. 5
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Ranking Member, Committee on
Homeland Security:
Oral Statement................................................. 5
Prepared Statement............................................. 7
Witnesses
Mr. Andy Ozment, Assistant Secretary, Office of Cybersecurity and
Communications, National Protection and Programs Directorate,
U.S. Department of Homeland Security:
Oral Statement................................................. 8
Prepared Statement............................................. 10
Ms. Huban A. Gowadia, Director, Domestic Nuclear Detection
Office, U.S. Department of Homeland Security:
Oral Statement................................................. 15
Prepared Statement............................................. 16
Mr. Joseph F. Martin, Acting Director, Homeland Security
Enterprise and First Responders Group, Science and Technology
Directorate, U.S. Department of Homeland Security:
Oral Statement................................................. 24
Prepared Statement............................................. 26
Mr. William Noonan, Deputy Special Agent in Charge, Criminal
Investigative Division, U.S. Secret Service:
Oral Statement................................................. 31
Prepared Statement............................................. 33
Mr. William Painter, Analyst, Government and Finance Division,
Congressional Research Service, Library of Congress:
Oral Statement................................................. 36
Prepared Statement............................................. 37
Appendix
Questions From Ranking Member Bennie G. Thompson for Andy Ozment. 53
Questions From Hon. James R. Langevin for Andy Ozment............ 53
EMERGING THREATS AND TECHNOLOGIES TO PROTECT THE HOMELAND
----------
Thursday, February 12, 2015
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Cybersecurity, Infrastructure Protection,
and Security Technologies,
Washington, DC.
The subcommittee met, pursuant to call, at 2:37 p.m., in
Room 311, Cannon House Office Building, Hon. John Ratcliffe
[Chairman of the subcommittee] presiding.
Present: Representatives Ratcliffe, Palazzo, Clawson,
Richmond, Langevin, and Thompson.
Mr. Ratcliffe. The Subcommittee on Cybersecurity,
Infrastructure Protection, and Security Technologies will come
to order.
The subcommittee meets today to exam critically important
components within the Department of Homeland Security and to
provide each of them an opportunity to give Members an update
on the current state of affairs and direction moving forward,
which will help inform this subcommittee's future oversight and
legislative efforts.
Given the recent alarming terrorist attacks in Paris, the
increase in violent extremist activity across Europe, and the
increase in cyber attacks from nation-state and organized
criminal actors, it is important that each of these components
rise to the challenge and meet these threats.
Yesterday, the full committee heard from both the law
enforcement and intelligence communities about the rising
threat of foreign fighters and the risk from individuals who
have traveled and trained with ISIS or other extremist groups
in Syria and Iraq.
The National Protection and Programs Directorate is charged
with the protection of our Nation's critical infrastructure in
both the cyber and physical security realms. Cyber attacks and
breaches against our Government agencies and critical
infrastructure have grown exponentially, and the capabilities
of our adversaries are becoming more advanced. As we have seen
over the past few months with the hack of Sony Pictures and
last week's breach of health insurance giant Anthem, these
attacks are becoming the norm, and they are increasing in their
sophistication.
The National Cybersecurity Communications and Integration
Center, or NCCIC, within the NPPD is the leading the effort to
prevent, detect, and mitigate cyber attacks against critical
infrastructure, Federal agencies, and the private sector. The
NCCIC's mission is a critical civilian component in the sharing
of threat information between the Government and the private
sector.
The United States Secret Service also plays an important
role in the sharing of cyber threat information through the
NCCIC and back out to the private sector to help prevent and
mitigate future attacks. The Secret Service Criminal
Investigation Division investigates cyber crime cases involving
financial breaches, such as the Target and Home Depot
intrusions. The Secret Service also trains hundreds of State
and local law enforcement officers, prosecutors, and judges in
the field of computer forensics and digital evidence-handling
techniques through its National Computer Forensics Institute.
The Domestic Nuclear Detection Office within DHS is
responsible for detecting and deterring illicit nuclear and
radiological material from entering the United States. While
DNDO is the lead agency within the United States Government for
coordinating these efforts, it works hand-in-hand with other
DHS components, including TSA, Customs and Border Protection,
State and local law enforcement, and the intelligence
community. DNDO works with these partners to provide them with
the technology, training, and best practices to ensure the
interdiction of radiological or nuclear material before it can
enter the United States.
While DNDO had previously experienced some stumbles along
the way, under the current leadership of Dr. Gowadia it has
become one of the best-functioning components within the
Department of Homeland Security.
DNDO also works closely with the Science and Technology
Directorate to further its mission. S&T is the primary research
and development arm of DHS, and it manages science and
technology research, development, and acquisition for the
Department's operational components and first responders.
S&T has also experienced difficulties since its creation,
some of which it is still grappling with today. These have
included poor outreach efforts, inconsistent coordination with
other DHS components, and a lack of clear research and
development definitions. I know that S&T's director, Dr.
Reginald Brothers, has been working to correct some of these
issues over the past year, but it does concern me that some of
these more basic issues have yet to be corrected. I am very
much looking forward to working with Dr. Brothers and his staff
to move the directorate forward.
I look forward to hearing from each of you that are here on
today's panel about the current state of affairs and the
anticipated future direction of each of your vital components.
I am certain that Ranking Member Richmond and the other Members
of the subcommittee also look forward to working with you and
providing oversight and legislative solutions where
appropriate.
[The statement of Chairman Ratcliffe follows:]
Statement of Chairman John Ratcliffe
February 12, 2015
The subcommittee meets today to examine critically important
components within the Department of Homeland Security and to give each
of them an opportunity to give Members an update on the current state
of affairs and direction moving forward, which will help to inform this
subcommittee's future oversight and legislative efforts.
Given the recent alarming terrorist attacks in Paris, the increase
in radical and violent extremist activity across Europe and the
increase in cyber attacks from nation-state and organized criminal
actors, it's important that each of these components rise to the
challenge and meet these threats. Yesterday, the full committee heard
from the law enforcement and the intelligence communities about the
rising threat of foreign fighters, and the risks from individuals who
have traveled and trained with ISIS or other extremist groups in Syria
and Iraq.
The National Protection and Programs Directorate is charged with
the protection of our Nation's critical infrastructure in both the
cyber and physical security realms. Cyber attacks and breaches against
our Government agencies and critical infrastructure have grown
exponentially, and the capabilities of our adversaries are becoming
more advanced. As we have seen over the past few months with the hack
of Sony Pictures, and last week's breach of health insurance giant
Anthem, these attacks are becoming the norm and they're increasing in
sophistication. The National Cybersecurity Communications and
Integration Center within NPPD is leading the effort to prevent,
detect, and mitigate cyber attacks against critical infrastructure,
Federal agencies, and the private sector. The NCCIC's mission is a
critical civilian component in the sharing of threat information
between the Government and the private sector.
The United States Secret Service plays an important role in sharing
of cyber threat information through the NCCIC and back out to the
private sector to help prevent and mitigate future attacks. The Secret
Service's Criminal Investigative Division investigates cybercrime cases
involving financial breaches, such as the Target and Home Depot
intrusions. The Secret Service also trains hundreds of State and local
law enforcement officers, prosecutors, and judges in the field of
computer forensics and digital evidence handling techniques through its
National Computer Forensics Institute.
The Domestic Nuclear Detection Office within DHS is responsible for
detecting and deterring illicit nuclear and radiological material from
entering the United States. While DNDO is the lead agency within the
United States Government for coordinating these efforts, it works hand-
in-hand with other DHS components including TSA, Customs and Border
Protection, State and local law enforcement and the intelligence
community. DNDO works with these partners to provide them with the
technology, training, and best practices to ensure the interdiction of
radiological or nuclear material before it can enter the United States.
While DNDO had previously experienced some stumbles along the way,
under the current leadership of Dr. Gowadia, it has become one of the
best functioning components within the Department.
DNDO also works closely with the Science and Technology Directorate
to further its mission. S&T is the primary research and development arm
of DHS, and it manages science and technology research, development,
and acquisition for the Department's operational components and first
responders. S&T has also experienced difficulties since its creation,
some of which it is still grappling with today. These have included
poor outreach efforts, inconsistent coordination with other DHS
components, and a lack of clear research and development definitions. I
know that S&T's director, Dr. Reggie Brothers, has been working to
correct some of these issues over the past year but it does concern me
that some of these more basic issues have yet to be corrected. I am
very much looking forward to working with him and his staff to move the
directorate forward.
I look forward to hearing from each of you on the current state of
affairs and the anticipated future direction of each of your vital
components. I'm certain that Ranking Member Richmond and the other
Members of the subcommittee also look forward to working with you and
providing oversight and legislative solutions where appropriate.
Mr. Ratcliffe. The Chairman now recognizes the Ranking
Minority Member of the subcommittee, the gentleman from
Louisiana, Mr. Richmond, for any statement that he may have.
Mr. Richmond. Thank you, Mr. Chairman. Mr. Chairman,
congratulations on assuming the Chair of this important
subcommittee. Thank you for holding this hearing today on
programs that are central to our oversight responsibilities.
I also want to thank the Ranking Member of the full
committee, Mr. Thompson, for his participation in today's
hearing and to highlight the tremendous level of expertise and
experience that the Democrats bring to the subcommittee. In
addition to the three most senior Democrats of the full
committee, including Ranking Member Thompson, Ms. Sanchez, and
Ms. Jackson Lee, we have a past Chairman of this subcommittee,
Jim Langevin, who has returned to the committee after his term
on Select Intelligence. Needless to say, we have a very strong
team.
In the past, Chairs and Ranking Members of this
subcommittee have found common ground on vital areas of policy
that have helped protect our Nation's citizens and have been
focused on protecting our critical infrastructure. I look
forward to continuing this tradition of bipartisanship with
Chairman Ratcliffe.
My primary focus will be to identify, oversee, and improve
the authorities within DHS to help them assist our Nation's
critical infrastructure to find acceptable and achievable
levels of security from a wide range of man-made threats and
natural disasters.
We know that the privately-owned entities that make up the
Nation's critical infrastructure, including our ports, energy
networks, chemical manufacturers, transportation and financial
sectors, and telecommunication providers, are all vital to our
societal and economic well-being.
Many constituents know all too well--my constituents know
all too well what can happen when these systems fail. Ten years
ago, the destruction of Hurricane Katrina had a debilitating
impact on National security, economic security, and public
health and safety. Needless to say, it is in the National
interest to ensure that such critical infrastructure is
adequately protected.
What we do here in Washington affects how firefighters,
police, EMS technicians, border and maritime security, and
doctors and nurses protect Americans every day, especially in
times of disaster. Aside from the physical critical
infrastructure security issues, both man-made and natural, it
will be necessary to do all we can to develop a workable cyber
protection framework for critical-infrastructure entities in
order to protect the rest of our economy.
The President put forward a series of legislative proposals
at the State of the Union that I think are a solid beginning
for Congress to consider. These proposals would further refine
and expand the authorities that DHS gained by last year's
cybersecurity bills that were originated in and passed by this
subcommittee and full committee, the Senate, and signed by the
President.
In closing, I would be remiss if I did not mention the
looming funding crisis at DHS. Although this crisis is mainly
manufactured by my friends in the Majority, it is real
nevertheless. Sixteen days from now, the bulk of DHS's
management and support for the homeland security enterprise
will be forced to close due to political gamesmanship.
We will hear testimony from the Congressional Research
Service today that will outline the funding scenarios ahead of
us and their likely impact on the programs that are being
mentioned before us. I sincerely hope that we will all take
heed to this sobering testimony and come together to find a
solution.
Mr. Chairman, I look forward to working with you on the
many complex challenges that face our subcommittee.
Thank you, and I yield back.
[The statement of Ranking Member Richmond follows:]
Statement of Ranking Member Cedric L. Richmond
February 12, 2015
Mr. Chairman, congratulations on assuming the Chair of this
important subcommittee, and thank you for holding this hearing today on
programs that are central to our oversight responsibilities.
I also want to thank the Ranking Member of the full committee, Mr.
Thompson, for his participation in today's hearing and to highlight the
tremendous level of expertise and experience that the Democrats bring
to the subcommittee.
In addition to the three most senior Democrats of the full
committee including Ranking Member Thompson, Ms. Sanchez, and Ms.
Jackson Lee, we have a past Chairman of this subcommittee, Jim Langevin
who has returned to the committee after his term on Select
Intelligence.
Needless to say, we have a very strong team.
In the past, Chairs and Ranking Members of this subcommittee have
found common ground on vital areas of policy that have helped protect
our Nation's citizens, and have been focused on protecting our critical
infrastructure. I look forward to continuing that tradition of
bipartisanship with Chairman Ratcliffe.
My primary focus will be to identify, oversee, and improve the
authorities within DHS to help them assist our Nation's critical
infrastructure to find acceptable and achievable levels of security
from a wide range of man-made threats and natural disasters.
We know that the privately-owned entities that make up the Nation's
critical infrastructure; including our ports, energy networks, chemical
manufacturers, transportation and financial sectors, and
telecommunication providers, are vital to our societal and economic
well-being.
My constituents know all too well what can happen when these
systems fail. Ten years ago, the destruction of Hurricane Katrina, had
a debilitating impact on National security, economic security, and
public health and safety. Needless to say, it is in the National
interest to ensure that such critical infrastructure is adequately
protected.
What we do here in Washington affects how firefighters, police, EMS
technicians, border and maritime security, and doctors and nurses,
protect Americans every day, especially in times of disaster.
Aside from the physical critical infrastructure security issues,
both man-made and natural, it will be necessary to do all we can to
develop a workable cyber protection framework for critical
infrastructure entities in order to protect the rest of our economy.
The President put forward a series of legislative proposals at the
State of the Union that I think are a solid beginning for Congress to
consider. These proposals would further refine and expand the
authorities that DHS gained by last year's cybersecurity bills that
were originated in, and passed by this subcommittee and full committee,
the Senate, and signed by the President.
In closing, I would be remiss if I did not mention the looming
funding crisis at DHS. Although this crisis is mainly manufactured by
my friends in the Majority, it is real nevertheless. Sixteen days from
now, the bulk of DHS's management and support for the homeland security
enterprise would be forced to close due to political gamesmanship.
We will hear testimony from the Congressional Research Service
today that will outline the funding scenarios ahead of us, and their
likely impact on the programs testifying before us. I sincerely hope
that we all take heed to this sobering testimony and come together to
find a solution.
Mr. Chairman, I look forward to working with you on the many
complex challenges that face our subcommittee.
I yield back.
Mr. Ratcliffe. I thank the gentlemen from Louisiana.
The Chairman now recognizes the Ranking Minority Member of
the full committee, the gentleman from Mississippi, Mr.
Thompson, for any statement that he may have.
Mr. Thompson. Thank you very much. Likewise, Mr. Chairman,
welcome. I have been where you are. There is nothing like being
in charge, trust me.
I am happy to have our witnesses here today.
Also, thank you for holding this hearing to discuss the
developments and activities in the National Protection and
Program Directorate, the Domestic Nuclear Detection Office, and
the Science and Technology Directorate, all of which are
important areas of oversight for this subcommittee.
I note that we are also to hear testimony today from the
Cyber Operations Branch of the Secret Service. While I know
this subcommittee has oversight of cybersecurity issues,
Chairman McCaul and I agreed in the committee oversight plan
for the 114th to include oversight of the Secret Service under
the jurisdiction of the Subcommittee on Oversight and
Management Efficiency.
While I am sure we will find the testimony interesting, I
find it odd that the Service is testifying before a
subcommittee that does not have oversight responsibilities,
considering the difficulties the Service has experienced lately
and the intense scrutiny the Service is under at this moment
and especially in light of the recent shake-up in senior
leadership, some of which occurred just a few days ago.
On another matter, if there is no quick resolution to the
budget impasse regarding the continuing resolution in fiscal
year 2015 appropriations, there are only 16 calendar days and 5
legislative days until the Department of Homeland Security
shuts down on February 28, closing down the bulk of DHS's
management and support of the homeland security infrastructure
that was built following the 9/11 terrorist attack.
I will just mention a few of those things that would be
impacted: Shuttering the DHS Domestic Nuclear Detection Office,
which would no longer alert and coordinate with law enforcement
agencies and withholding the Securing the Cities grants that
pay for the critical nuclear detection capabilities in cities
across the country; halting research and development work on
countermeasures to devastating biological threats on nuclear
detection equipment and on cargo and passenger screening
technology; also crippling FEMA's preparation for future
disasters and furloughing 22 percent of FEMA's personnel, as
well as ending FEMA's training activities of local law
enforcement for weapons-of-mass-destruction events.
Also, Mr. Chairman, some of DHS's employees would continue
to work in the event of a shutdown. They would be forced to do
so without pay, creating a significant distraction and dealing
a tremendous blow to a Department with already low morale.
Among those who would be expected to protect Americans
without getting paid would be more than 40,000 Border Patrol
Agents and Customs and Border Patrol Officers; more than 50,000
TSA aviation security screeners; more than 13,000 Immigration
and Customs Enforcement agents, more than 40,000 Active Duty
Coast Guard military members; and more than 4,000 Secret
Service law enforcement agents and officers.
With such serious consequences, it is no wonder three
former DHS Secretaries sent a letter to Senators Mitch
McConnell and Harry Reid calling for a clean DHS funding bill.
The essential funding for the Department of Homeland Security
is no place for the majority to showboat against immigration
reform that strengthens our economy and our country.
Thank you, Mr. Chairman. With that, I yield back.
[The statement of Ranking Member Thompson follows:]
Statement of Ranking Member Bennie G. Thompson
February 12, 2015
Mr. Chairman, welcome to the gavel, and thank you for holding this
hearing to discuss developments and activities in the National
Protection and Program Directorate, the Domestic Nuclear Detection
Office, and the Science and Technology Directorate, all of which are
important areas of oversight for this subcommittee.
I note that we are also to hear testimony today from the cyber
operations branch of the Secret Service. While I know this subcommittee
has oversight on cybersecurity issues, Chairman McCaul and I agreed in
the Committee Oversight Plan for the 114th to include oversight of the
Secret Service under the jurisdiction of the Subcommittee for Oversight
and Management Efficiency.
While I am sure we will find the testimony interesting, I find it
odd that the Service is testifying before a subcommittee that does not
have oversight responsibilities, considering the difficulties the
Service has experienced lately and the intense scrutiny the Service is
under at the moment, and especially in light of the recent shakeup in
senior leadership, some of which occurred just a few days ago.
On another matter, if there is no quick resolution to the budget
impasse regarding the Continuing Resolution and Fiscal Year 2015
Appropriations, there are only 16 calendar days and 5 legislative days
until the Department of Homeland Security shuts down on February 28,
closing down the bulk of DHS's management and support of the homeland
security infrastructure that was built following the 9/11 terrorist
attacks.
I will just mention a few:
Shuttering the DHS Domestic Nuclear Detection Office, which
would no longer alert and coordinate with local law enforcement
agencies, and withholding the Securing the Cities grants that
pay for critical nuclear detection capabilities in cities
across the country;
Halting Research and Development work on countermeasures to
devastating biological threats, on nuclear detection equipment,
and on cargo and passenger screening technologies;
Crippling FEMA's preparations for future disasters, and
furloughing 22 percent of FEMA personnel;
Ending FEMA training activities with local law enforcement
for Weapons of Mass Destruction events.
Although some DHS employees would continue to work in the event of
a shutdown, they would be forced to do so without pay, creating a
significant distraction and dealing a tremendous blow to a Department
with already low morale.
Among those who would be expected to protect Americans without
getting paid would be:
More than 40,000 Border Patrol Agents and Customs and Border
Patrol Officers;
More than 50,000 TSA aviation security screeners;
More than 13,000 Immigration and Customs Enforcement law
enforcement agents and officers;
More than 40,000 active-duty Coast Guard military members;
and
More than 4,000 Secret Service law enforcement agents and
officers.
With such serious consequences, it is no wonder three former DHS
Secretaries sent a letter to Senators Mitch McConnell and Harry Reid
calling for a clean DHS funding bill. The essential funding for the
Department of Homeland Security is no place for the Majority to
showboat against immigration reform that strengthens our economy and
our country.
Thank you, Mr. Chairman, and with that I yield back.
Mr. Ratcliffe. I thank the gentleman from Mississippi.
Other Members of the subcommittee are reminded that opening
statements may be submitted for the record.
We are pleased today to have a distinguished panel of
witnesses before us on this very important topic.
I thank you all for being here.
I would like to recognize the panel en banc, and then each
of you will have the opportunity to provide opening statements.
Our first witness is Mr. Andy Ozment. He is the assistant
secretary for the Office of Cybersecurity and Communications
within the National Protection and Programs Directorate of the
Department of Homeland Security.
Welcome.
Our second witness, Dr. Huban Gowadia, is the director of
the Domestic Nuclear Detection Office in the Department of
Homeland Security.
Next, we will hear from Mr. Joseph Martin, who is the
acting director of the Homeland Security Enterprise and First
Responders Group within the Science and Technology Directorate
at the Department of Homeland Security.
Also joining us today is Mr. William Noonan, who is the
deputy special agent in charge of the Criminal Investigative
Division at the United States Secret Service.
Finally, we have with us Mr. William Painter, a government
and finance division analyst at the Congressional Research
Service.
Again, the Chairman, the Ranking Member, and the Members of
this subcommittee very much appreciate the witnesses' presence
today.
The witnesses' full statements will appear in the record.
The Chairman now recognizes Mr. Ozment for 5 minutes to
testify.
STATEMENT OF ANDY OZMENT, ASSISTANT SECRETARY, OFFICE OF
CYBERSECURITY AND COMMUNICATIONS, NATIONAL PROTECTION AND
PROGRAMS DIRECTORATE, U.S. DEPARTMENT OF HOMELAND SECURITY
Mr. Ozment. Thank you, Chairman.
Chairman Ratcliffe, Ranking Member Richmond, Ranking Member
Thompson, and Members of the subcommittee, I am pleased to
appear today to discuss the work of the Department of Homeland
Security's National Protection and Programs Directorate, or
NPPD, to address persistent and emerging cybersecurity risks to
the U.S. homeland.
As the internet and network technologies become an
increasingly omnipresent part of our daily lives, growing cyber
threats present an increasing risk to critical infrastructure,
our economy, and our National security.
As a Nation, we are faced with pervasive threats from
malicious cyber actors. These individuals and groups are
motivated by a variety of reasons that include espionage,
political and idealogical beliefs, and financial gain. For
example, certain nation-states pose a significant economic
cyber threat as they aggressively target and seek access to
public- and private-sector computer networks with the goal of
stealing and exploiting massive quantities of data, including
intellectual property and other sensitive information. In
another example, we saw in the recent Sony incident that cyber
attacks also have the potential to damage physical
infrastructure.
The DHS National Protection and Programs Directorate
undertakes its cybersecurity activities within its overarching
mission to secure and enhance the resilience of the Nation's
cyber and physical infrastructure. We view ourselves as a
customer service organization, and our customers are Federal
civilian department and agencies, private-sector infrastructure
owners and operators, and State, local, Tribal, and territorial
governments.
In serving these customers, our guiding principles are to
prioritize our customers' needs, to build and retain their
trust, to ensure privacy and civil rights across the depth and
breadth of our cyber and communications activities, and to
enable continuous improvement to stay ahead of the malicious
actors that we face.
To achieve our cybersecurity mission, we focus on helping
our partners understand and manage cyber risk, reduce the
frequency and impact of cyber incidents, and build partner
capacity. So what do we bring to our customers? Broadly, we
accomplish these goals through a variety of means, and I would
like to highlight a few of them.
We share timely and accurate information and analysis to
enable private and public-sector partners to protect
themselves. We provide on-site assistance to Federal agencies
and critical-infrastructure entities that are impacted by a
significant cybersecurity incident. We provide technology and
services to detect and block cyber threats from impacting
Federal civilian agency networks.
We enable Federal agencies to more readily identify network
security issues and take prioritized action. We provide
Classified information to commercial cybersecurity companies so
they can better protect their private-sector customers. And we
maintain a trusted environment for private-sector partners to
share information and collaborate to understand cybersecurity
threats and trends.
These activities are only successful through our continued
engagement and collaboration with public and private partners.
NPPD engages its cybersecurity stakeholders through a variety
of mechanisms, to include the National Cybersecurity and
Communications Integration Center, or the NCCIC.
The NCCIC is a 24/7 National hub for sharing cyber and
communications information between Federal agencies, the
intelligence community, law enforcement, and the private
sector. In 2014, the NCCIC received over 97,000 incident
reports and issued nearly 12,000 actionable cyber alerts or
warnings. NCCIC teams detected over 64,000 vulnerabilities on
Federal and non-Federal systems and directly responded to 115
significant cyber incidents with on-site support to our
customers.
Among its roles, the NCCIC provides incident response
assistance during significant cyber events. The NCCIC also
disseminates information on potential or active cybersecurity
threats, incidents, and vulnerabilities to both public and
private-sector partners. As a final example, the NCCIC conducts
vulnerability assessments to identify cybersecurity risks and
recommend mitigations.
Congress' support to these activities resulted in
bipartisan action last year to pass critical cybersecurity
legislation. That legislation enhanced our ability to measure
and motivate Federal civilian agencies to improve their own
security, it codified the NCCIC into law, and provides DHS with
the ability to enhance our cyber workforce.
Enactment of these bills represents a significant moment
for the Department's cybersecurity mission, and I thank
Congress for this action. This committee, in particular,
undertook significant efforts to bring these bills to
enactment.
However, additional legislation is needed. Carefully
updating laws to facilitate cybersecurity information sharing
is essential to improving the Nation's cybersecurity. While
many companies currently share cybersecurity threat information
under existing laws, we need to increase the volume and speed
of information shared between the Government and the private
sector. It is essential to ensure that cyber threat information
is shared quickly between trusted partners to detect and block
cyber threats before they can cause damage.
The NCCIC's role is a critical piece of the President's
recent legislative proposal because its core mission, as stated
in this committee's unanimously passed National Cybersecurity
Protection Act, is coordinating and serving as an interface for
cybersecurity information across the Government and private
sector. We must connect the dots, and the NCCIC is our
mechanism for doing so.
Thank you for the opportunity to testify, and I look
forward to any questions you may have.
[The prepared statement of Mr. Ozment follows:]
Prepared Statement of Andy Ozment
February 12, 2015
introduction
Chairman Ratcliffe, Ranking Member Richmond, and distinguished
Members of the subcommittee, I am pleased to appear today to discuss
the work of the Department of Homeland Security (DHS) to address
persistent and emerging cyber threats to the U.S. homeland.
In my testimony today, I would like to highlight how DHS helps
secure cyber infrastructure and discuss a few specific examples of
instances in which we prevented and responded to a serious
cybersecurity challenge.
the on-going cyber threat
Growing cyber threats are an increasing risk to critical
infrastructure, our economy and thus, our National security. As a
Nation, we are faced with pervasive threats from malicious cyber
actors. These individuals are motivated by a variety of reasons that
include espionage, political and ideological beliefs, and financial
gain. Certain nation-states pose a significant cyber threat as they
aggressively target and seek access to public and private-sector
computer networks with the goal of stealing and exploiting massive
quantities of data.
Some nation-states consistently target Government networks for
traditional espionage, theft of protected information for financial
gain, and other purposes. Increasingly, State, local, Tribal, and
territorial (SLTT) networks are experiencing nation-state cyber
activity similar to that seen on Federal networks. In addition to
targeting Government networks, there is a growing threat of nation-
states targeting and compromising critical infrastructure networks and
systems. Such attacks may provide persistent access for potential
malicious cyber operations that could lead to cascading effects with
physical implications, including injury or loss of life.
dhs cybersecurity role
The DHS National Protection and Programs Directorate (NPPD)
undertakes its cybersecurity activities within its overarching mission
to secure and enhance the resilience of the Nation's critical
infrastructure. By leveraging its core capabilities of information and
data sharing; incident response and capacity development; vulnerability
assessments; and situational awareness, NPPD applies its expertise and
resources to assist with building the Nation's resilience to physical
and cybersecurity risks.
NPPD works with infrastructure owners and operators and Government
partners, to provide timely information, analysis, and assessments
through its field force and headquarters components. These capabilities
are applied to maintain and provide situational awareness, increase
resilience, and understand and mitigate risk. Through established
partnerships including DHS support from partners in Science &
Technology, U.S. Secret Service, and the Domestic Nuclear Detection
Office, NPPD leads the National unity of effort for infrastructure
security and resilience and builds the capacity of partners across the
Nation. NPPD also directly protects Federal infrastructure against both
physical and cyber threats and responds to incidents that threaten
infrastructure or sensitive information.
NPPD executes this mission through several key responsibilities:
First, NPPD informs decision makers on potential impacts by
performing comprehensive consequence analyses that assess
cross-sector interdependencies and cascading effects.--NPPD
utilizes integrated analysis and modeling capabilities to
understand cyber and physical risk and assist with
prioritization of infrastructure to ensure resources are
focused on protecting the assets or services of greatest
significance. This capability also enables NPPD to maintain and
provide situational awareness to public and private-sector
partners about the potential impacts of future incidents and
inform investments of various forms in effective preparedness
given limited resources.
Second, NPPD reduces cyber and physical risks to critical
infrastructure through collaboration with Federal agencies,
State, local, Tribal, and territorial governments and the
private sector.--NPPD works with its partners to conduct
voluntary critical infrastructure and cybersecurity
assessments. These assessments allow partners to better
understand their physical and cybersecurity resilience and
vulnerabilities and provide recommendations for how they can
improve. At the National level, NPPD leads or contributes to
the development of risk management plans and approaches such as
the National Infrastructure Protection Plan and the
Cybersecurity Framework.
Third, NPPD programs promote cybersecurity knowledge and
innovation to create a safer and more secure cyber
environment.--NPPD enables Federal departments and agencies to
address cybersecurity challenges by providing guidance on
technology, emerging risks, and best practices. To this end,
NPPD partners with the private sector, law enforcement,
military, and intelligence communities to identify and mitigate
vulnerabilities and threats to information systems before they
can cause significant harm.
Fourth, NPPD provides direct protection and conducts
incident response activities to minimize the frequency and
impact of incidents affecting Federal networks and
facilities.--NPPD secures and protects the buildings, grounds,
and property owned or occupied by the Federal Government, as
well as the people on those properties, by conducting Facility
Security Assessments, recommending appropriate countermeasures,
overseeing a large contract Protective Security Officer
workforce, and exercising law enforcement authorities. On the
cyber side, NPPD directly protects Federal networks by
identifying vulnerabilities through the Continuous Diagnostics
and Mitigation (CDM) program and by detecting and blocking
threats through the EINSTEIN program. NPPD also responds to
cyber incidents affecting Federal networks upon request of the
impacted agencies to determine and recommend necessary
mitigations.
Fifth, NPPD is responsible for ensuring effective
telecommunications for Government users in National emergencies
and for establishing policies and promoting solutions for
interoperable emergency communications used on a daily basis
across the country at the Federal, State, and local levels.--As
the Sector Specific Agency for Communications and for Emergency
Services, NPPD protects and strengthens the security,
reliability, survivability, and interoperability of the
Nation's communications capabilities at the Federal, State,
local, Tribal, and territorial levels. NPPD serves the first
responder community by serving as a board member and providing
technical assistance for the initiative to establish a National
Public Safety Broadband Network and supports development of
standards and best practices for the interoperability of first
responder communications. NPPD is also helping lead the
transition of public safety communications from land-mobile
radio to broadband and Voice-Over-Internet Protocol (or VOIP).
In order to ensure that communications are available to manage
and coordinate a major incident, NPPD also assures the
provision of National Security and Emergency Preparedness
communications by administering the Priority Telecommunications
Service (PTS).
dhs shares information widely with federal agencies and the private
sector, and provides incident response
DHS takes a customer-focused approach to information sharing, using
information to detect and block cybersecurity attacks on Federal
civilian agencies and sharing information to help critical
infrastructure entities in their own protection. We provide information
to commercial cybersecurity companies so they can better protect their
customers through the Enhanced Cybersecurity Services program, or ECS,
and we maintain a trusted information-sharing environment for private-
sector partners to share information and collaborate on cybersecurity
threats and trends via a program known as the Cyber Information Sharing
and Collaboration Program, or CISCP. This trust derives in large part
from our emphasis on privacy, confidentiality, civil rights, and civil
liberties across all information-sharing programs, including special
care to safeguard personally identifiable information.
DHS also maintains the National Cybersecurity & Communications
Integration Center (NCCIC), which serves as a 24x7 centralized location
for the coordination and integration of cyber situational awareness and
incident management. NCCIC partners include all Federal departments and
agencies; State, local, Tribal, and territorial governments; the
private sector; and international entities. The NCCIC provides its
partners with enhanced situational awareness of cybersecurity and
communications incidents and risks, and provides timely information to
manage vulnerabilities, threats, and incidents.
In 2014, the NCCIC received over 97,000 incident reports, and
issued nearly 12,000 actionable cyber alerts or warnings. NCCIC teams
also detected over 64,000 vulnerabilities on Federal and non-Federal
systems and directly responded to 115 significant cyber incidents.
protecting federal civilian cyber infrastructure
DHS directly supports Federal civilian departments and agencies in
developing capabilities that will improve their own cybersecurity
posture. Through the Continuous Diagnostics and Mitigation (CDM)
program, DHS enables Federal agencies to more readily identify network
security issues, including unauthorized and unmanaged hardware and
software; known vulnerabilities; weak configuration settings; and
potential insider attacks. Agencies can then prioritize mitigation of
these issues based upon potential consequences or likelihood of
exploitation by adversaries. The CDM program provides diagnostic
sensors, tools, and dashboards that provide situational awareness to
individual agencies, and will provide DHS with summary data to
understand relative and system risk across the Executive branch. NPPD
is moving aggressively to implement CDM across all Federal civilian
agencies. Memoranda of Agreement with the CDM program encompass over 97
percent of all Federal civilian personnel. An initial award of CDM
tools in 2014 to fill immediate capability gaps at participating
agencies, will, in the future, provide DHS with better data to protect
the dot-gov, and has resulted in $26 million in cost avoidance. The
President's 2016 budget requests $102.7 million for the CDM program.
Two-thousand fifteen will be an exciting year for the CDM program:
Acquisition Groups A and B, covering 7 agencies and over 45% of all
Federal civilian personnel, will begin to deploy CDM tools starting in
the third quarter of fiscal year 2015. By the first quarter of fiscal
year 2016, 25 agencies and over 95% of all Federal civilian personnel
will have started deploying CDM tools provided by DHS. NPPD is
implementing a commercial off-the-shelf, or COTS, technology for the
CDM dashboard to provide agencies with a detailed understanding of
their cybersecurity risk and enable comprehensive situational awareness
across the Federal Government. The agency-level dashboards will begin
deployment in fiscal year 2015, and the Federal dashboard is expected
to reach Full Operating Capability in fiscal year 2017.
While CDM will identify vulnerabilities and systemic risks within
agency networks, the National Cybersecurity Protection System, or
EINSTEIN, detects and blocks threats at the perimeter of the network or
at the Internet Service Provider. EINSTEIN is an integrated intrusion
detection, analysis, information sharing, and intrusion-prevention
system. The President's 2016 budget requests $463.9 million for the
EINSTEIN program. Perhaps the best way to understand EINSTEIN is
through the analogy of a car attempting to enter a protected perimeter
such as a military base. EINSTEIN 1 can be thought of as analogous to a
cop on the beat looking for a particular license plate. The system
captures key data about internet traffic entering an agency through
basic network flow information. EINSTEIN 2 is akin to a cop who not
only sees the license plate but sends an alert to other security
personnel to alert them to a potentially prohibited or malicious
vehicle. EINSTEIN 2's network intrusion detection system (IDS)
technology uses custom signatures, based upon known or suspected cyber
threats within Federal network traffic. EINSTEIN 3A, or E3A, is much
like a gatehouse that prohibits vehicles whose license plates set off
an alert from entering the base. E3A supplements EINSTEIN 2 by adding
additional intrusion prevention capabilities and enabling ISPs, under
the direction of DHS, to detect and block known or suspected cyber
threats using indicators.
NPPD's Office of Cybersecurity and Communications (CS&C) screens
all data captured by EINSTEIN 1 and EINSTEIN 2 sensors to ensure it is
analytically relevant to a known or suspected cyber threat. E3A
combines existing analysis of EINSTEIN 1 and EINSTEIN 2 data as well as
information provided by cyber mission partners with existing commercial
intrusion prevention security services to allow for the near-real-time
deep packet inspection of Federal network traffic to identify and react
to known or suspected cyber threats. Participating agencies currently
have access to their network flow records through participation in
EINSTEIN 1 and receive information about their own data specific to
their networks in accordance with CS&C's cybersecurity information
handling policies and guidelines. E3A is currently deployed and
offering DNS and email services to eleven (11) departments and
agencies, covering approximately 25% of all dot-gov (.gov) traffic.
Forty-six (46) agencies have signed Memorandum of Agreements (MOA) to
participate in E3A services covering 90% of all Federal civilian
traffic. It reduces threat vectors available to actors seeking to
infiltrate, control, or harm Federal networks. We look forward to
working with Congress to further clarify DHS's authority to deploy this
protective technology to Federal civilian systems.
securing the homeland against persistent and emerging cyber threats
Cyber intrusions into critical infrastructure and Government
networks can cause significant damage and be perpetrated by
increasingly sophisticated actors. The complexity of emerging threat
capabilities, the inextricable link between the physical and cyber
domains, and the diversity of cyber actors present challenges to DHS
and our customers.
Financial Sector Distributed Denial of Service (DDoS) Attacks
Cyber attacks on the U.S. financial sector are often discussed as
an area of concern. There were increasingly powerful DDoS incidents
impacting leading U.S. banking institutions in 2012 and 2013, and high-
profile media coverage of financial sector cybersecurity challenges in
2014. US-CERT has a distinct role in responding to a DDoS: To
disseminate victim and potential victim notifications to United States
Federal Agencies, Critical Infrastructure Partners, International
CERTs, and U.S.-based Internet Service Providers.
US-CERT has provided technical data and assistance, including
identifying 600,000 DDoS-related IP addresses and supporting contextual
information. This information helps financial institutions and their
information technology security service providers improve defensive
capabilities. In addition to sharing with relevant private-sector
entities, US-CERT provided this information to over 120 international
partners, many of whom contributed to our mitigation efforts. US-CERT,
along with the U.S. Secret Service, FBI and other interagency partners,
also deployed to affected entities on-site technical assistance, or
``boots on the ground.'' US-CERT works with Federal civilian agencies
to protect USG systems from becoming part of a botnet, since botnets
are a tool that cyber criminals use to deflect attribution in DDoS
attacks.
During these attacks, our partners in the DHS Office of
Intelligence and Analysis, or I&A, provided long-term, consistent
threat updates to the Department of Treasury and private-sector
partners in the Financial Services Sector. I&A analysts presented
sector-specific Unclassified briefings on the relevant threat
intelligence, including at the annual Financial Services Information
Sharing and Analysis Center (FS-ISAC) conference, alongside the Office
of the National Counterintelligence Executive and the U.S. Secret
Service. At the request of the Treasury and the Financial and Banking
Information Infrastructure Committee (FBIIC), I&A analysts provided
Classified briefings on the malicious cyber threat actors to cleared
individuals and groups from several financial regulators, including the
Federal Deposit Insurance Corporation (FDIC), Securities and Exchange
Commission (SEC), and the Federal Reserve Board (FRB).
Point-of-Sale Compromises
On December 19, 2013, a major retailer publically announced it had
experienced unauthorized access to payment card data from the
retailer's U.S. stores. The information involved in this incident
included customer names, credit and debit card numbers, and the cards'
expiration dates and card verification value (CVV) security codes. The
CVV security codes are 3- or 4-digit numbers that are usually on the
back of the card. Separately, another retailer also reported a malware
incident involving its Point of Sale (POS) system on January 11, 2014,
that resulted in the apparent compromise of credit card and payment
information.
In response to this activity, NCCIC/US-CERT analyzed malware
identified by the Secret Service as well as other relevant technical
data and used those findings, in part, to create two information-
sharing products. The first product, which is publicly available and
can be found on US-CERT's website, provides a non-technical overview of
risks to Point-of-Sale systems, along with recommendations for how
businesses and individuals can better protect themselves and mitigate
their losses in the event an incident has already occurred. The second
product provides more detailed technical analysis and mitigation
recommendations, and has been securely shared with industry partners to
enable their protection efforts. NCCIC's goal is always to share
information as broadly as possible, including by producing products
tailored to specific audiences.
These efforts ensured that actionable details associated with a
major cyber incident were shared with the private-sector partners who
needed the information in order to protect themselves and their
customers quickly and accurately, while also providing individuals with
practical recommendations for mitigating the risk associated with the
compromise of their personal information. NCCIC especially benefited
from close coordination with the private-sector Financial Services
Information Sharing and Analysis Center during this response.
cybersecurity legislation
Last year, Congress acted in a bipartisan manner to pass critical
cybersecurity legislation that enhanced the ability of the Department
of Homeland Security to work with the private sector and other Federal
civilian departments in each of their own cybersecurity activities, and
enhanced the Department's cyber workforce. Enactment of these bills
represents a significant moment for the Department's cybersecurity
mission, and I thank Congress for this action. This committee in
particular undertook significant efforts to bring the bills to passage.
Additional legislation is needed. While many companies currently
share cybersecurity threat information under existing laws, there is a
heightening need to increase the volume and speed of such information
sharing between the Government and the private sector--and among
appropriate private-sector organizations--without sacrificing the trust
of the American people or individual privacy, civil rights, or civil
liberties. It is also essential that we ensure the integration of
threat indicators to provide shared situational awareness. We must
connect the dots. Carefully updating laws to facilitate cybersecurity
information sharing is essential to improving the Nation's
cybersecurity. We also must provide law enforcement additional tools to
fight crime in the digital age, create a National Data Breach Reporting
requirement, and further clarify DHS's authority to deploy protective
technologies to Federal, Executive branch, civilian systems.
conclusion
DHS will continue to work with our public and private partners to
create and implement collaborative solutions to improve cybersecurity,
focused on reducing frequency and impact of high-consequence
cybersecurity incidents. We work around the clock to ensure that the
peace and security of the American way of life will not be interrupted
by malicious actors seeking to exploit our reliance on the internet and
networked technologies. Each incarnation of the cyber threat has unique
traits, and mitigation requires agility and layered security.
Cybersecurity is a process of risk management in a time of constrained
resources, and we must ensure that our efforts achieve maximize
security as efficiently as possible while preserving privacy, civil
rights, and civil liberties.
DHS represents an integral piece of the National effort to increase
our collective cybersecurity, but we cannot achieve our mission without
a foundation of voluntary partnerships with the critical infrastructure
community, industry, and our Government partners. While securing
cyberspace has been identified as a core DHS mission since the 2010
Quadrennial Homeland Security Review the Department's view of
cybersecurity has evolved to include a more holistic emphasis on
critical infrastructure which takes into account the convergence of
cyber and physical risk.
DHS will continue to serve as the center of integration,
information sharing, and collaborative analysis, at machine-speed
wherever possible, of global cyber risks, trends, and incidents.
Through our unique role in protecting civilian Government systems and
helping the private sector protect themselves, DHS can correlate data
from diverse sources, in an anonymized and secure manner, to maximize
insights and inform effective risk mitigation. We are working to
further mature the ability of NCCIC to receive information at machine
speed, which will support emerging capabilities of networks to self-
heal and to recognize and block threats before they reach their
targets. This will in turn diminish the profit model for cyber
adversaries and reduce our response time to a cyber incident from days
or hours to seconds.
DHS provides the foundation of the U.S. Government's approach to
securing and ensuring the resilience of civilian critical
infrastructure and essential services. We look forward to continuing
the conversation and continuing to serve the American goals of peace
and stability, and we rely upon your continued support. Thank you for
the opportunity to testify, and I look forward to any questions you may
have.
Mr. Ratcliffe. Thank you, Mr. Ozment.
The Chairman now recognizes Dr. Gowadia to testify.
STATEMENT OF HUBAN A. GOWADIA, DIRECTOR, DOMESTIC NUCLEAR
DETECTION OFFICE, U.S. DEPARTMENT OF HOMELAND SECURITY
Ms. Gowadia. Good afternoon, Chairman Ratcliffe, Ranking
Member Richmond, and Ranking Member Thompson, distinguished
Members of the subcommittee. It is a pleasure to be here with
my colleagues from the Department of Homeland Security and the
Congressional Research Service to testify about the Domestic
Nuclear Detection Office, or DNDO, on our on-going efforts to
protect the homeland from nuclear and radiological threats.
As articulated in the new National security strategy, no
threat poses as grave a danger to our security and well-being
as the potential use of nuclear weapons and materials by
irresponsible states or terrorists. DNDO was created in 2005 as
an interagency with a singular focus--preventing nuclear
terrorism--realized through two missions: Technical nuclear
forensics and nuclear detection. We work with Federal, State,
local, and international partners, as well as those in the
private sector, academia, and the National laboratories.
For both missions, we are responsible for coordinating
interagency efforts to develop strategies, conduct research,
and deploy capabilities in support of our operational
stakeholders. For example, DNDO's National Technical Nuclear
Forensics Center provides centralized stewardship, planning,
and integration of U.S. Government-wide efforts. Since the
Center's establishment in 2006, DNDO has advanced nuclear
forensics capabilities and improved National exercises by
making them increasingly collaborative and realistic.
Focusing on an in extremis National capability, we are
investing in our technical expertise pipeline. DNDO is on track
to have 35 new Ph.D.'s added to the workforce by 2018.
On the detection mission, DNDO coordinates the United
States Government's capabilities through the construct of the
Global Nuclear Detection Architecture, or GNDA. Recently, in
collaboration with our interagency partners, we published the
2014 GNDA Strategic Plan, which will guide our efforts as we
collectively design and implement the architecture.
To address technical challenges, DNDO conducts an
aggressive program of transformational research and
development. Among our many accomplishments have been
breakthrough sensing materials that have transitioned from the
laboratory to commercially-available products. In fact, until
recently, one such material, Stilbene, was only available in
limited supplies from suppliers in Ukraine. Through our small-
business innovation research efforts, U.S. industry now
produces this material domestically at lower cost and in
greater quantities.
As the Department's lead for acquiring and deploying
radiation-detection systems, DNDO brings a rigorous and
disciplined approach to testing and procurement. Since
inception and in conjunction with our partners, we have
completed over 100 test campaigns and 7 pilots to evaluate the
performance of various nuclear detectors.
DNDO's collaborative systems acquisition efforts have
ensured that all Coast Guard boarding parties and all TSA Viper
teams are equipped with radiation detectors. All incoming
general aviation flights are met by detector-equipped Customs
and Border Protection officers. One hundred percent of trucks
and cars and almost 100 percent of maritime containerized cargo
is scanned for radiation at our ports of entry before release
into the United States.
Because detection is about more than just equipment, we
focus on the critical triad of intelligence, law enforcement,
and technology. The ability to detect and interdict nuclear
threats is maximized when well-trained law enforcement and
public safety personnel conduct intelligence or information-
driven operations using the right technology. Indeed, by the
end of this year and working with our State and local partners,
we intend to have basic preventive nuclear capabilities in all
50 States.
I would like to relate an excellent example of this triad
at work. Last month, in Fairfield, Connecticut, a police
officer stopped a stolen car and discovered an industrial
radioactive source in the trunk. The officer contacted the
local fire department and the Connecticut State Police
Emergency Services Unit. Within 4 minutes, a trooper responded,
equipped with radiation detectors provided via our Securing the
Cities program. I should note that our S&T's National Urban
Security Technology Laboratory supports this program.
The officers were thereby able to quickly resolve the
situation at the local level using the right technologies and
protocols. Information, law enforcement, and technology coming
together to address radioactive material that was out of
regulatory control.
In conclusion, DNDO has made considerable progress since
its creation in 2005. As I have shared today, we are realizing
the results of our research and development investments through
the maturation of our Nation's nuclear detection and technical
forensics capabilities. With your continued support, we will
work steadfastly to make nuclear terrorism a prohibitively
difficult undertaking for our adversaries.
Thank you for this opportunity, and I look forward to your
questions.
[The prepared statement of Ms. Gowadia follows:]
Prepared Statement of Huban A. Gowadia
February 12, 2015
Chairman Ratcliffe, Ranking Member Richmond, and distinguished
Members of the subcommittee. Thank you for the opportunity to testify
before you today. I am honored to join my esteemed colleagues from the
U.S. Department of Homeland Security (DHS) at this hearing regarding
the emerging threats we face and the development of technologies
employed to defend the homeland. Whether it is strengthening
cybersecurity, combating cyber crime, protecting critical
infrastructure, or preventing nuclear and radiological terrorism, DHS
seeks to employ our Nation's talents and technological edge to defeat
sophisticated and agile adversaries. I appreciate your attention to the
threat of nuclear terrorism and your interest in the efforts and
progress DHS' Domestic Nuclear Detection Office (DNDO) has made to
prevent its occurrence.
As President Obama stated on March 25, 2014 at the joint press
conference following the 2014 Nuclear Security Summit, ``I convened the
first Nuclear Security Summit in Washington four years ago because I
believed that we need a serious and sustained global effort to deal
with one of the greatest threats to international security--and that's
the specter of nuclear terrorism . . . given the catastrophic
consequences of even a single attack, we cannot be complacent.'' The
potentially catastrophic effects of a nuclear detonation, whether
executed surreptitiously by a state or a non-state actor, would have
far-reaching impacts on our Nation and the world. A radiological
attack, via a ``dirty bomb,'' would result in far less destruction, but
would still be extremely disruptive to our way of life.
The spectrum of nuclear security spans physical protection of
nuclear and other radioactive materials, detection of such materials
out of regulatory control, rendering devices safe, response and
recovery to incidents, and forensics and attribution of materials. DNDO
has specific, focused responsibilities for two elements in this
spectrum: Detection and nuclear forensics. And as reducing the risk of
nuclear terrorism is a whole-of-Government challenge, DNDO works with
Federal, State, local, Tribal, territorial, and international partners
as well as those in the private sector, academia, and the National
laboratories to fulfill its mission.
authorities
With the recognition of the need to focus efforts to detect nuclear
and other radioactive materials that have become unsecured, DNDO was
established in 2005 by National Security Presidential Directive (NSPD)-
43 and Homeland Security Presidential Directive (HSPD)-14 and
subsequently codified in Title V of the Security and Accountability For
Every (SAFE) Port Act (Pub. L. No. 109-347), which amended the Homeland
Security Act of 2002. Pursuant to section 1902 of the Homeland Security
Act, DNDO is required to develop, with the approval of the Secretary
and in coordination with the Departments of Energy (DOE), State (DOS),
Defense (DoD), and Justice (DOJ), an enhanced global nuclear detection
architecture (GNDA), and is responsible for implementing the domestic
portion.
The architecture serves as a framework for detecting (through
technical and non-technical means), analyzing, and reporting on nuclear
and other radioactive materials that are out of regulatory control.
Non-technical detection refers to an alert from law enforcement or
intelligence efforts and collected by GNDA partners under their
statutory authorities and consistent with National policy. DNDO is also
charged to enhance and coordinate the nuclear detection efforts of
Federal, State, local, and Tribal governments and the private sector to
ensure a managed, coordinated response. To accomplish this, DNDO leads
programs to conduct transformational research and development for
advanced detection technologies, deploy nuclear detection capabilities,
measure detector system performance, and ensure effective response to
detection alarms.
In 2006, DNDO's National Technical Nuclear Forensics Center was
established by NSPD-17/HSPD-4 and later authorized by the 2010 Nuclear
Forensics and Attribution Act (Pub. L. No. 111-140) with the mission of
characterizing radiological and nuclear devices prior to detonation.
DNDO was given responsibilities to provide centralized stewardship,
planning, and integration for all Federal nuclear forensics activities.
The Act also established the National Nuclear Forensics Expertise
Development program and required DNDO to lead the development and
implementation of the National Strategic Five-Year Plan for Improving
the Nuclear Forensics and Attribution Capabilities of the United
States.
These authorities have directed our focus in preventing nuclear
terrorism through the enhancement of nuclear detection and technical
forensics capabilities. In both instances, we rely on the critical
triad of intelligence, law enforcement, and technology. Thus, to
maximize the Nation's ability to detect and interdict a threat, it is
imperative that we apply detection technologies in operations that are
driven by intelligence indicators, and place them in the hands of well-
trained law enforcement and public safety officials. Similarly, to
enhance attribution capabilities, the U.S. Government (USG) must ensure
that information from law enforcement, intelligence, and technical
nuclear forensics is synthesized to identify the origin of the material
or device and the perpetrators.
While we have made significant improvements in both detection and
forensics over the years, the threat of nuclear terrorism persists, and
requires constant vigilance.
developing the global nuclear detection architecture
Cited in Presidential Directive and legislation, the GNDA is a
multi-faceted, layered, defense-in-depth framework, with the objective
of making the illicit acquisition, fabrication, and transport of a
nuclear or radiological device or material prohibitively difficult.
DNDO relies on a well-conceived arrangement of fixed and mobile
radiological and nuclear technical detection capabilities to present
terrorists with many obstacles to a successful attack, including
greatly increasing costs, difficulty, and risk.
To develop the architecture, DNDO assesses current and planned
capabilities against the evolving radiological and nuclear threat,
using rigorous risk assessments, for example. Since 2007, and as
directed by HSPD-18 (Medical Countermeasures against Weapons of Mass
Destruction), DNDO has collaborated with the DHS Science & Technology
Directorate (S&T) to produce the Integrated Chemical, Biological,
Radiological, and Nuclear Terrorism Risk Assessment. DNDO leads the
biennial radiological and nuclear terrorism risk assessment, which is
then combined with similar biological and chemical risk assessments. In
order to better inform resource allocation decisions, DNDO has improved
the threat models in the risk assessment by adding an adaptive,
intelligent adversary model and is working with DOE's National
Laboratories to enhance improvised nuclear device models. DNDO has also
supported DHS risk assessments such as the Strategic National Risk
Assessment and the Homeland Security National Risk Characterization.
DNDO is also working with operational partners to develop models that
will provide vulnerability estimates for the risk assessment and more
refined estimates for impacts to operations.
To guide the strategic direction of the GNDA, the USG interagency
developed the first-ever Global Nuclear Detection Architecture
Strategic Plan in December 2010. In April 2012, the Secretary of
Homeland Security issued a DHS Global Nuclear Detection Architecture
Implementation Plan, which identified priorities, necessary
capabilities, and monitoring mechanisms to assess progress. Recently,
DNDO has worked with interagency partners to update the Global Nuclear
Detection Architecture Strategic Plan. The 2014 Strategic Plan presents
an updated definition and vision for the GNDA, as well as a mission,
goals, and objectives for interagency efforts to detect, analyze, and
report on nuclear or other radioactive materials that are out of
regulatory control.
While USG efforts and programs are critical, developing a global
nuclear detection architecture relies largely on the decisions of
sovereign foreign partners to develop and enhance their own national
and regional detection programs. DNDO contributes to interagency
efforts led by the Department of State by laying the groundwork to
assist partner nations in developing defense-in-depth approaches to
detecting illicitly trafficked nuclear or other radioactive materials.
DNDO has also assisted in the development of guidelines and best
practices through the Global Initiative to Combat Nuclear Terrorism and
the International Atomic Energy Agency (IAEA) to outline the key
characteristics of an effective architecture. To date, IAEA has used
these guidelines and best practices in six regional training courses to
help 42 nations initiate planning of national-level detection
architectures, with over 100 planners trained in architecture
development. To make the course available to a broad set of
stakeholders, DNDO assisted the IAEA in conducting a train-the-trainer
session to further expand the instructor pool to allow for English,
Spanish, and French language versions of the course. This strategic
partnership will continue to serve as a force multiplier for USG
nuclear security efforts for years to come.
conducting transformational research and developing systems
Pursuant to Presidential Directive and the law, DNDO is also
responsible for conducting an aggressive, evolutionary, and
transformational program of research and development to generate and
improve technologies to detect nuclear and radioactive materials.
DNDO's transformational research and development efforts seek to
achieve dramatic advancements in technologies to enhance our National
detection and forensics capabilities. These developments may also
reduce the cost and operational burden of using advanced technology in
the field to maintain an enhanced level of protection. Annually, DNDO
updates its research and development strategy based on prevailing risk,
advancements in technology, and the availability of funding. By
supporting technological advancement for both nuclear detection and
forensics, DNDO achieves a strategic and fiscal benefit for the
Government.
Although significant progress has been made in addressing the gaps
and needs of the GNDA and nuclear forensics, several challenges remain
that require sustained investment. DNDO's technical challenges include
the need for systems that:
Are cost-effective with sufficient technical performance to
ensure wide-spread deployment;
Can detect special nuclear material, such as plutonium and
uranium, even when heavily shielded;
Facilitate enhanced wide-area searches in a variety of
scenarios, to include urban and highly cluttered environments;
Can be used to monitor traffic in challenging pathways, such
as between ports of entry along our land and sea borders; and
Determine the origin and manufacturing process of seized
material.
DNDO has and will continue to advance fundamental knowledge in
nuclear detection and forensics through a sustained long-term
investment in the Exploratory Research program and Academic Research
Initiative. These efforts directly address the aforementioned
challenges through basic and applied research to feed more mature
research and development projects such as DNDO's Advanced Technology
Demonstrations.
To develop essential technical expertise while advancing
fundamental knowledge in nuclear sciences, DNDO invests in academic
research through the Academic Research Initiative, supporting the next
generation of scientists and engineers in areas such as advanced
materials, nuclear engineering, radiochemistry, and deterrence theory.
Since inception in 2007, DNDO has awarded 77 grants to 50 academic
institutions, and supported over 400 students. On average, this program
support results in over 50 journal papers per year. We are beginning to
see these projects move up the technology pipeline. A new room
temperature thallium-based semiconductor detector was transferred from
Northwestern University to our Exploratory Research program and is now
in its preliminary design review phase of development. Nuclear
resonance cross-sections measured at Duke University are being used in
our shielded special nuclear material detection projects, and
background radiation measurements performed by University of California
at Berkeley are being used in support of programs across the
interagency.
Several DNDO-sponsored research efforts have also led to new
commercial products that provide enhanced operational capabilities to
Federal, State, and local law enforcement and public safety personnel.
Even before a Helium-3 shortage was identified, DNDO teamed with the
Defense Threat Reduction Agency to explore options for better, more
cost-effective alternatives for neutron detection.\1\ For portal
systems, which require the largest quantities of this gas, DNDO worked
with industry and is now deploying alternative detection technologies
that do not require Helium-3. This enables the country to devote the
scarce supplies of Helium-3 to those applications where no substitutes
are possible. We have tested Helium-3 alternative technologies for use
in mobile, backpack, and hand-held radiation detectors, several of
which have already shown performance superior to the current-generation
technologies. Importantly, due to a collaborative USG-wide effort to
address the shortfall, our USG strategic reserve of Helium-3 can meet
demand beyond fiscal year 2040.
---------------------------------------------------------------------------
\1\ Helium-3 is a gas that is widely used to detect neutrons that
are emitted by certain nuclear and other radioactive materials. Helium-
3 results from the radioactive decay of tritium. As the need for
tritium for nuclear weapons decreased, so too did the availability of
Helium-3.
---------------------------------------------------------------------------
Other recent DNDO technological successes that transitioned from
laboratories to commercially-available products include:
Advanced radiation sensing materials such as cesium lithium
yttrium chloride, strontium iodide, and stilbene, which have
enhanced detection characteristics and can be used to build
more capable systems featuring simplified electronics, low
power requirements, and greater reliability;
New electronics and advanced algorithms, for data processing
for identifying radioisotopes that support networked radiation
detection for improved wide-area search capabilities;
Compact dual-energy X-ray generators with improved density
discrimination and higher shielding penetration that have been
integrated into commercially-available mobile radiography
systems; and
Software to automatically detect special nuclear material
and shielding material in radiography images.
DNDO continues to develop breakthrough technologies that increase
performance and reduce the operational burdens of our front-line
operators and improve their mission performance. For example, we are
collaborating with U.S. Customs and Border Protection's (CBP)
Laboratories and Scientific Services to use machine learning to greatly
reduce the number of nuisance alarms in radiation portal monitors. In
addition, we work with the Massachusetts Port Authority, S&T's Border
and Maritime Security Division, and the United Kingdom's Home Office to
develop and evaluate the next generation non-intrusive inspection
imaging equipment. Of particular note, the collaboration in this case
is expected to produce the first wholly-integrated system capable of
detecting both nuclear material and contraband. Further, we jointly
evaluate parameter-setting modifications to reduce the number of alarms
from naturally-occurring radioactive material. In fact, after a
rigorous program of laboratory tests, modeling and simulation, field
trials, and successful pilots at two ports of entry, CBP has deployed
the new technique to 26 seaports and 7 land border crossings through
January 2015. This technique, which involves adjustments to the
settings on the radiation portal monitors, is yielding operational
efficiencies by reducing alarm rates from benign sources and the
associated time CBP Officers would have needed to manually inspect that
cargo.
In addition to CBP, DNDO worked closely with the U.S. Coast Guard
(USCG), the Transportation Security Administration (TSA), and State and
local partners to identify key operational requirements for the design
of next-generation radioisotope identification devices that can be used
by law enforcement officers and technical experts during routine
operations to identify radioactive materials and adjudicate alarms.
Based on the enhanced detection material lanthanum bromide and improved
algorithms, this new hand-held technology is easy-to-use, lightweight,
and more reliable and, because it contains built-in calibration and
diagnostics, has a much lower annual maintenance cost. An example of a
successful acquisition program, the new system is receiving very
positive reviews from operators in the field.
characterizing system performance
DNDO's technology development efforts are coupled with a rigorous
test and evaluation program. Over the years, DNDO's test program has
grown and matured. To date, we have conducted more than 100 test and
evaluation campaigns at more than 40 laboratory and operational venues,
and evaluated systems including pagers, handhelds, portals, backpacks,
and vehicle-, boat-, aircraft,- and crane-mounted detectors, as well as
next-generation radiography technologies. To ensure the equipment is
evaluated in the manner in which it will be used, these test campaigns
are always planned and executed with operational users. In addition, we
include interagency partners and use peer-reviewed processes. The
results from DNDO's test campaigns have informed Federal, State, local,
and Tribal partners on the technical and operational performance of
detection systems, allowing them to select the most suitable equipment
and implement the most effective concepts of operation for their unique
needs.
Pursuant to the law, DNDO leads the development of technical
capability standards, and in collaboration with the National Institute
of Standards and Technology, also supports the development,
publication, and adoption of National consensus standards for radiation
detection equipment. A total of 24 standards, including 11 U.S.
standards with the American National Standards Institute, 10
international standards with the International Electrotechnical
Commission, and 3 technical capability standards now exist for homeland
security applications. We have assessed commercially-available
detection systems against National and international standards and in
various operational scenarios. Notably, we completed the Illicit
Trafficking Radiation Assessment program, a collaboration with the
European Commission's Joint Research Center and the IAEA to evaluate
nearly 80 instruments against consensus standards. The results enabled
our stakeholders to compare the performance of commercially-available
radiation detection equipment and provided manufacturers with
constructive feedback on their products.
implementing the domestic component of the global nuclear detection
architecture
DNDO is instrumental in implementing the domestic component of the
global nuclear detection architecture. In conjunction with Federal,
State, local, Tribal, and territorial operational partners, DNDO
applies a disciplined approach to procure small and large-scale
radiation detection and/or identification systems and deploy them at
ports of entry, along our land and maritime borders, and in the
interior of the United States. In addition, as part of DHS's Strategic
Sourcing efforts, DNDO is the Department's commodity manager for hand-
held radiological and nuclear detection equipment. This enables us to
take advantage of technical advancements and achieve cost savings by
leveraging the volume demand of Department-wide and other Federal
users.
DNDO's collaborative system acquisition efforts have ensured that
all USCG boarding parties have radiation detection equipment; all in-
coming general aviation flights are met by CBP Officers with radiation
detectors; 100 percent of trucks and cars entering our Nation at land
ports of entry are scanned for nuclear and other radioactive materials;
almost 100 percent of maritime containerized cargo is similarly scanned
at our sea ports of entry; and the TSA's Visible Intermodal Prevention
and Response teams are equipped with radiation detectors.
While technology acquisition and deployments are critical, we must
also ensure that the training, exercise, and cross-jurisdictional
protocols integral to mission success are adopted and sustained by
operational partners. As such, DNDO provides program assistance
services to Federal, State, local, Tribal, and territorial stakeholders
who are developing or enhancing radiological and nuclear detection
capabilities. This support includes assistance in developing and
integrating local or regional programs into the global nuclear
detection architecture, guiding the development of concepts of
operations and standard operating procedures, and developing training
and exercise products to ingrain those procedures into day-to-day
activities.
DNDO has made considerable progress in enhancing National
radiological and nuclear detection capabilities in the following ways:
We are on schedule to complete discussions on the
establishment, maintenance, and sustainment of radiological and
nuclear detection programs in all 50 States by the end of 2015.
In conjunction with regional partners, we have developed
robust detection capability in the New York City region,
through the Securing the Cities program, where more than 19,450
personnel have been trained in nuclear detection operations and
more than 8,800 pieces of detection equipment have been
deployed. National program implementation began with expansion
to Los Angeles/Long Beach in 2012, and they are beginning to
train personnel and receive detection equipment. In 2014, the
National Capital Region was selected as the third Securing the
Cities site.
DNDO's Assistance Program is currently engaged with 33
States, two major Urban Area Security Initiative regions (non-
Securing the Cities), and 28 U.S. Coast Guard Area Maritime
Security Committees.
Since 2008, DNDO has deployed Mobile Detection Deployment
Units over 200 times to provide radiological and nuclear
detection and communications equipment for Federal, State, and
local agencies to augment their capabilities during special
events or in response to elevated threat conditions.
DNDO provides training products and support to develop, enhance,
and expand radiological and nuclear detection capabilities. In
partnership with the Federal Emergency Management Agency (FEMA), the
Federal Law Enforcement Training Center, DOE, and DOJ, DNDO develops
and implements protocols and training standards for the effective use
of radiation detection equipment and associated alarm reporting and
resolution processes. Since 2006, DNDO has developed 49 training
courses listed in the Federal course catalog. In collaboration with
interagency partners, including the Federal Law Enforcement Training
Center, more than 33,500 law enforcement personnel and public safety
officials from 35 States have participated in DNDO-supported
radiological and nuclear detection training.
DNDO also assists State and local partners in developing,
designing, and conducting exercises that are compliant with the
Homeland Security Exercise and Evaluation program methodology. The
exercises provide valuable hands-on experience for personnel performing
radiological and nuclear detection operations and assist decision
makers in integrating the detection mission into their daily
operations, while fostering the exchange of ideas and best practices
amongst State and local partners. Since 2006, DNDO has conducted
exercises with 21 States and annually supports up to 20 exercises. In
fiscal year 2014, DNDO conducted 19 domestic exercises with State and
local partners, as well as two international exercises.
DNDO fields a unique Red Team that can objectively assess the
operational effectiveness and performance of DNDO programs and deployed
radiological and nuclear detection capabilities at the Federal, State,
and local levels. Our Red Team works across the interagency employing a
whole-of-Government approach to improve our National capabilities. At
the Federal level we partner with DoD, DOE, and DOJ; within DHS with
CBP, FEMA, TSA, USCG, and U.S. Secret Service; and with a myriad of
State and local agencies across the United States. The Red Team
evaluates deployed systems and operations and their associated tactics,
techniques, and procedures, in as-close-to-realistic environments as
possible. As covert and overt assessments are generally the only
opportunity for operators of radiological and nuclear detection systems
to gain experience detecting uncommon nuclear sources, these operations
provide valuable feedback on the performance of tactics, techniques,
and procedures. This feedback enables operators to improve their
concepts of operation and readiness. For the past 5 years, DNDO's Red
Team has averaged more than 25 overt and covert assessments per year,
successfully conducting 33 evaluations in fiscal year 2014 in support
of operational partners.
DNDO is responsible for enhancing and coordinating the nuclear
detection efforts of Federal, State, local, and Tribal governments and
the private sector to ensure a managed, coordinated response. We also
coordinate across the interagency to establish protocols and procedures
to ensure that the technical detection of unauthorized nuclear
explosive devices, fissile material, or other active radioactive
material is promptly reported to the Secretaries of Homeland Security,
Defense, and Energy, the Attorney General, and others as appropriate
for action by law enforcement, military, emergency response, or other
authorities.
DNDO's Joint Analysis Center is essential in enhancing situational
awareness, as well as providing technical support and informational
products, to Federal, State, and local partners. The Joint Analysis
Center maintains and provides awareness for mission partners of
deployed detection capabilities, monitoring on-going events or threats,
and maintaining historical data. Using the Joint Analysis Center
Collaborative Information System, DNDO facilitates nuclear alarm
adjudication and the consolidation and sharing of information through
geographic information system displays and databases. This system is
available for direct access by our State and local partners, providing
them with the ability to manage, document, and execute a radiological
and nuclear detection program. This includes the ability to
electronically maintain training and certification, and consolidates
and maintains a database of detector equipment and Nuclear Regulatory
Commission State licensees. Through this information system, we connect
to the Triage system, maintained by DOE's National Nuclear Security
Administration, to enable a seamless transition when National-level
adjudication assistance is required. To increase awareness of lost and
stolen sources and other relevant information, DNDO's Joint Analysis
Center publishes Unclassified weekly information bulletins, summarizing
relevant news articles and providing useful facts about radioactive
materials. This weekly information bulletin currently reaches every DHS
Fusion Center and over 2,000 global nuclear detection architecture
stakeholders.
In addition to direct interaction with individual States and law
enforcement agencies, DNDO hosts biannual State and Local Stakeholder
Working Group meetings and Executive Steering Council meetings with law
enforcement and other supervisory personnel to exchange best practices
and to obtain feedback on DNDO's initiatives. The State and Local
Stakeholder Working Group provides a forum for DNDO to meet with our
stakeholders to discuss their current activities, lessons learned, and
planned detection initiatives. This forum also provides State and local
leaders an opportunity to convey their perspective on mission needs and
radiation detection requirements, so that DNDO can develop the
necessary products and services to support their efforts. The Executive
Steering Council provides policy coordination and implementation
between DNDO and senior-level State and local leaders regarding
radiation detection programs, and serves as a mechanism to solicit
input from senior leaders on their successes, evolving requirements and
challenges, as well as for DNDO to apprise them of on-going efforts to
support their jurisdictions. Both the Stakeholder Working Group and the
Executive Steering Council have been received favorably and continue to
reinforce the relationship between DNDO and key stakeholders.
acquisition process improvements
To enhance mission delivery and improve investment management, DNDO
designed the Solution Development Process. Aligned with DHS Acquisition
Management Directive 102-01, the Solution Development Process
institutes an integrated governance approach to program and project
oversight throughout the systems engineering life cycle. The process
brings all programs and projects under leadership governance-
establishing a shared language, with common practices to increase
efficiencies, promote programmatic and budgetary transparency, and
bolster accountability. It aligns with DHS enterprise architecture,
acquisition management, and capital planning and investment processes.
A critical component of the process is the active involvement of
operational partners, who serve as Lead Business Authorities, and
requires rigorous technical reviews at each programmatic stage. In
adhering to the process, DNDO ensures current and future programs are
appropriately structured and have the necessary oversight for success.
DNDO will continue to incorporate lessons learned and process
improvements as the process matures, sharing them throughout DHS to
strengthen Departmental unity of effort--one of the Secretary's top
priorities.
Based in part on lessons learned from the cancelled Advanced
Spectroscopic Portal program, DNDO has significantly bolstered
acquisition management policy and strengthened its implementation via
robust and disciplined governance and program management processes.
DNDO closely collaborated with CBP to complete a post-implementation
review and identified 32 lessons learned, including findings in
acquisition management. These efforts have enabled us to ensure that
programs are selected based on sound business cases and are well-
managed, resulting in an efficient and effective use of DNDO's
appropriated funds.
Finally, recognizing the important contributions and innovations of
private industry, National laboratories, and academia, DNDO has evolved
its acquisition focus from one that is predominantly fueled by a
Government-funded, Government-managed development process to one that
relies upon industry-led research and development. As such, DNDO
technology development programs now proceed with a ``commercial first''
approach; engaging first with the private sector for solutions and only
moving to a Government-sponsored and managed development effort if
necessary. This approach leverages private-sector innovation, taking
advantage of industry's innate flexibility and ability to rapidly
improve technologies. In some cases, shifting to commercial-based
acquisitions will even reduce the total time to test, acquire, and
field technology.
forensics capabilities
An act of nuclear terrorism or an interdiction of a nuclear threat
would necessitate rapid, accurate attribution. Any USG response would
need sound scientific evidence supporting the determination of the
responsible parties. Nuclear forensics would support leadership
decisions. DNDO's National Technical Nuclear Forensics Center focuses
on continuously evaluating and improving the nuclear forensics
capabilities with specific responsibilities to:
Improve the readiness of the overarching USG nuclear
forensic capabilities, from pre- to post-detonation, through
centralized stewardship, planning, assessment, exercises,
improvement, and integration;
Advance the technical capabilities of the USG to perform
forensic analyses on pre-detonation nuclear and other
radioactive materials; and
Build and sustain an expertise pipeline for nuclear forensic
scientists.
Operational readiness of USG nuclear forensics capabilities has
improved markedly in recent years. Efforts of the nuclear forensics
community are integrated through the alignment of program capabilities,
coordination of research and development and operational activities,
and accelerated capability development through synchronized interagency
investments. The interagency uses two primary DNDO-led mechanisms, the
Nuclear Forensics Executive Council and Steering Committee, to
facilitate consistent coordination across the USG. DNDO led the
interagency effort to update and extend the National Strategic Five-
Year Plan for Improving the Nuclear Forensics and Attribution
Capabilities of the United States, completing it in December 2014, and
continues to synchronize resources among partner agencies through an
established budget crosscut. Requirements are now regularly identified
and developed by the Nuclear Forensics Requirements Center, co-chaired
by DNDO and the FBI.
Since the Nuclear Security Summit in 2010, international
partnerships in nuclear forensics have greatly expanded, resulting in
stronger National and international capabilities. DNDO provides
subject-matter expertise to numerous initiatives, including
multinational nuclear forensics table-top exercises, to enhance
understanding among policy makers, law enforcement officials, and
scientists, and to encourage and assist other nations in developing
their national capabilities.
Forensics exercises have become increasingly realistic and complex,
with intensive multi-agency planning among the FBI, DOE, Army, Air
Force, and DNDO. Many of the exercises now include State and local law
enforcement. Other exercises have involved the Federal law enforcement
and intelligence communities in order to plan and synchronize the
fusion of intelligence, law enforcement, and technical forensics
information, leading to a more efficient and effective attribution
process. In the international context, DNDO was involved in the
``@tomic 2014'' table-top exercise in February of last year, bringing
together 31 nations and several international organizations to enhance
knowledge and awareness of how nuclear forensics can be used in nuclear
smuggling cases. The exercise served as a side event leading up to and
informing the Nuclear Security Summit 2014.
Technical nuclear forensics capabilities for analysis of nuclear
and other radioactive materials have steadily advanced. DNDO's efforts
are focused on continually improving the accuracy, precision, and
timeliness of material characterization information, and linking that
information to the process and place of that material's origin. To
date, DNDO has developed seven radiological and nuclear certified
reference materials, which are forensically-relevant calibration
standards used by the National laboratories to improve confidence in
analytical conclusions. Additionally, DNDO has developed the first-ever
laboratory-scale uranium processing capability that allows us to
determine forensic signatures associated with specific variations in
uranium manufacturing processes. This capability enables us to
determine forensics signatures without having direct access to samples
from foreign fuel cycles. We are now developing a similar plutonium
processing capability. Further, in cooperation with DOE and DoD, DNDO
has developed and installed a nuclear forensics data evaluation
capability at Sandia National Laboratories that enables forensic
scientists to develop and test data analysis tools and evaluate large
sets of data in order to identify distinguishing characteristics of
specific nuclear materials. DNDO remains focused on advancing the
National ability to trace nuclear materials back to their source.
DNDO's efforts to restore the National expertise pipeline have also
shown substantial success to date. The Congressionally-mandated
National Nuclear Forensics Expertise Development program is a
comprehensive effort to grow and sustain the scientific expertise
required to execute the National technical nuclear forensics mission.
Launched in 2008, this effort is a key component in assuring a robust
and enduring nuclear forensics capability and its contribution to the
Nation's efforts at preventing nuclear terrorism. In close partnership
with eight National Laboratories, the program has provided support to
more than 300 students and faculty and 27 universities in partnership
with 11 National laboratories. We are steadily progressing toward
adding 35 new Ph.D. scientists to the nuclear forensics field by 2018
to revitalize the pipeline and replace anticipated attrition or
retirements from the DOE National Laboratories. Twenty-four new nuclear
forensics scientists have come through the National Nuclear Forensics
Expertise Development program and been hired by the National
laboratories and Federal agencies since the program's inception.
closing
Thank you again for the opportunity to discuss the on-going efforts
of DNDO to prevent and protect against radiological threats.
While DNDO has made considerable progress since it was established
in 2005, much remains to be done. It will be a challenge to remain one
step ahead of the adversary--particularly one that is intelligent and
adaptable. We must ensure our efforts are robust so that the obstacles
terrorists face are many. DNDO's detection and forensics programs, in
concert with those of our partners and stakeholders, both in these
areas and along the spectrum of nuclear security, are foundational
elements in creating these impediments. Together, we can build upon
DNDO's integrated approach to architecture planning, testing and
assessments, research and development, operational support, and nuclear
forensics to strengthen the Nation's capabilities to deter, detect, and
interdict the nuclear threat and to hold those responsible accountable
for their actions. We remain committed to this challenge and deeply
appreciate this subcommittee's sustained interest and support in our
shared goals to secure the homeland.
Mr. Ratcliffe. Thank you, Dr. Gowadia.
The Chairman now recognizes Mr. Martin for his testimony.
STATEMENT OF JOSEPH F. MARTIN, ACTING DIRECTOR, HOMELAND
SECURITY ENTERPRISE AND FIRST RESPONDERS GROUP, SCIENCE AND
TECHNOLOGY DIRECTORATE, U.S. DEPARTMENT OF HOMELAND SECURITY
Mr. Martin. Good afternoon, Chairman Ratcliffe, Ranking
Member Richmond, and Ranking Member Thompson, and distinguished
Members of the subcommittee. Thank you for inviting me here
this afternoon.
My name is Jay Martin. I am the acting director of S&T's
First Responders Group. As a first responder for over 20 years
here in the National capital region, I understand the needs of
the first-responder community and the potential that innovative
technology can have on issues of emerging threats.
DHS and our Nation's first responders operate in an
evolving environment of both threats and opportunities. Our
accelerating pace of risk and technology development loom over
every mission in the Department. S&T's approach to R&D allows
us to be more agile in helping our partners stay ahead of the
threats and seize available opportunities.
Recognizing the needs of our partners, S&T leans forward in
engaging the end-user community to bring more focus to our
work. We leverage technical expertise in critical areas that
touch on all aspects of operations. We partner with emerging
innovation leaders in industry, like wearable-technology
developers. We strive to bring new solutions to widespread
operational use in the homeland security enterprise.
As part of being more forward-leaning, S&T recently
finalized five visionary goals--cross-cutting goals that focus
our work around common objectives. These align with
Congressional direction, support Departmental policy, and
address strategic challenges and threats identified by the
homeland security enterprise.
Our goals include: Screening at speed--that is, security
that matches the pace of life; a trusted cyber future--
protecting privacy, commerce, and community; enable the
decision maker--actionable information at the speed of thought;
responder of the future--protected, connected, and fully aware;
and, finally, resilient communities--disaster-proofing society.
To achieve these visionary goals, S&T built a prioritized
portfolio around Apex programs. Apex is focused on the most
challenging homeland security problems to take a broad approach
to reaching these goals, not a single-technology solution.
Since S&T's first Apex began with the Secret Service in
2010, we have helped partners identify efficiencies, save
money, and integrate emerging technologies. For example, my
group leads the Next Generation First Responder Apex. This
program will enable first responders to make faster decisions,
be more efficient, and operate safer as they respond to threats
and disasters.
Our Apex program is focused on unique challenges faced by
fully-networked responders and is considering the cybersecurity
impacts in all aspects of emerging technologies. This includes
wearable technologies, advanced communications, and enhanced
personal protective equipment.
Across this Nation, over 70,000 Federal, State, local,
Tribal, and territorial agencies are responsible for public
safety and emergency response. S&T's ability to build
partnerships is critical to supporting their efforts. S&T
tailors its business model to succeed with these responders,
including DHS operational components like my colleagues on the
panel.
Industry engagement is fundamental, and our programs are
innovative, not only in outreach to responder and commercial
entities but also in the use of alternative approaches to
conduct research and development. Price competitions and a
consolidation and integration of international markets are
examples of ways that we are evolving how S&T does business.
One of S&T's highest priority areas is in reinforcing
response and recovery to a potential radiological or nuclear
event. We work in conjunction with DNDO on pre-incident
operations and with FEMA, Department of Energy, and EPA on
response and recovery. S&T focuses lab and academia experts on
the immediate problem of how to prepare and use equipment
already in the hands of first responders if a radiological
nuclear event were to occur. Our work enables State and local
responders to increase their capabilities and to respond in the
first minutes, hours, and days of an emergency.
S&T conducts research development, testing, and evaluation
to secure our Nation's critical information infrastructure and
to plan for a more secure cyber future. S&T works to create
partnerships between Government and private industry, the
venture-capital community and the research community, including
academia and National laboratories.
Among our priorities is the financial sector, who we work
with to ensure market reliability and cyber protection, as well
as with the first responders on identity credentials and access
management. S&T also assists in transforming cybersecurity
technologies from research labs to the homeland security
enterprise and the commercial marketplace.
As our work with first responders demonstrates, we use
technology as a force multiplier to enhance responder
capabilities. We are also working with industry in new ways to
use evolving technology to its fullest by integrating it into
our approaches.
Thank you for inviting me to appear before you today. I
appreciate the opportunity to testify, and I will be pleased to
answer your questions.
[The prepared statement of Mr. Martin follows:]
Prepared Statement of Joseph F. Martin
February 12, 2014
Good morning Chairman Ratcliffe, Ranking Member Richmond, and
distinguished Members of the subcommittee. Thank you for the
opportunity to testify before you today on the role of the Department
of Homeland Security's (DHS) Science and Technology Directorate (S&T).
S&T's mission is to help strengthen America's security and resiliency
by providing assessments, analysis, and reports and developing
innovative technology solutions for the Homeland Security Enterprise.
In this testimony, I will discuss how technology shapes today's threat
environment, empowering homeland security operators and first
responders with new capabilities but also enabling malevolent actors.
To address this, S&T helps operators harness and utilize technology,
scientific knowledge, and engineering as a force multiplier and, where
possible, to gain leap-ahead capabilities. To illustrate the role of
technology and how S&T delivers it to the Homeland Security Enterprise,
I will talk about S&T's experience with first responders and how we
work with them to overcome gaps and achieve their missions more
effectively, efficiently, and safely.
Today, S&T and the Homeland Security Enterprise exist in an
environment of rapidly-evolving threats and opportunities, and the
accelerating pace of risk and technological development loom over every
mission in the Department. Threats now range from lone-wolf violent
extremists to non-state actors with state-like capabilities to rogue
states with increasingly sophisticated abilities. In the past, only
state actors had the resources and technical capacity necessary to
create extreme levels of destruction and disruption. Today, individual
actors have access to technology that is sufficient to make explosive
devices, develop biological weapons, or execute sophisticated cyber
attacks. The wide variation of potential malicious actors--ranging from
individuals to terrorist groups to state actors--each have a wide range
of capabilities and options to carry out acts that pose immense
challenges to homeland security operators. All of this is compounded by
the accelerating evolution and revolution of technology. The fields of
manufacturing and material sciences, information technology, and
biosciences have made revolutionary gains in the last decade. With the
commercial sector, particularly small and medium-sized business,
driving innovation and with trends like the maker movement
proliferating and democratizing technology, new homeland security
challenges and opportunities continue to mount.
reinventing r&d to be more modern and agile
The traditional Federal model for research and development (R&D) is
based on decades-old assumptions that, in many cases, are ill-suited to
today's environment and can stifle innovation in Government. Federal
funding still drives the majority of basic and applied research, but
private-sector investment focused on late-stage development surpassed
Government's total annual R&D investments in the 1980s and has
continued this trend. In homeland security, innovation cycles in areas
like advanced analytics, communications, additive manufacturing, and
cyber occur so quickly that traditional Government vehicles for
investment and acquisition struggle to keep up with advances and
changes in technology.
Recognizing the growing need for homeland security-tailored
technology paired with an evolving innovation ecosystem that includes
greater investment by the private sector, S&T is reinventing its
approach to R&D to be more agile in helping our partners stay ahead of
threat trends. We are becoming more forward-leaning, bringing more
focus to our portfolio, and engaging more effectively with industry. We
are dedicating a portion of our R&D programs to leveraging technical
expertise in critical areas that touch on all aspects of operation
(e.g., data analytics, network security). We are partnering with
emerging innovation leaders in industry and shifting our R&D and
testing and evaluation toward DHS component-based innovation centers
focused on bringing new solutions to wide-spread operational use. Taken
together, this will make S&T a more capable R&D agent for homeland
security operators and first responders.
S&T's Visionary Goals
As part of being more forward-leaning, S&T recently finalized five
visionary goals as North Star-like objectives. To arrive at the five
goals below, S&T used an inclusive, transparent platform to garner
input not only from all of S&T but also from our partners and
stakeholders inside and outside of Government. The goals are cross-
cutting and coalesce S&T around common objectives, align with
Departmental doctrine and policy, and address strategic challenges and
threats identified by the Homeland Security Enterprise. Finally, and
perhaps most importantly, the Visionary Goals inspire and excite the
science and technology ecosystem around ambitious, innovative
solutions.
Screening At Speed: Security that Matches the Pace of
Life.--Noninvasive screening at speed will provide for
comprehensive protection while adapting security to the pace of
life rather than life to security. With safeguards to protect
privacy, unobtrusive screening of people, baggage, or cargo
will enable the seamless detection of threats with minimal
impact on the pace of travel and speed of commerce.
A Trusted Cyber Future: Protecting Privacy, Commerce, and
Community.--In a future of increasing cyber connections,
underlying digital infrastructure will be self-detecting, self-
protecting, and self-healing. Users will trust that information
is protected, illegal use is deterred, and privacy is not
compromised. Security will operate seamlessly in the
background.
Enable the Decision Maker: Actionable Information at the
Speed of Thought.--Predictive analytics, risk analysis, and
modeling and simulation systems will enable critical and
proactive decisions to be made based on the most relevant
information, transforming data into actionable information.
Even in the face of uncertain environments involving chemical,
biological, radiological, or nuclear incidents, accurate,
credible, and context-based information will empower the
decision maker to take instant actions to improve critical
outcomes.
Responder of the Future: Protected, Connected, and Fully
Aware.--The responder of the future is threat-adaptive and
cross-functional. Armed with comprehensive physical protection,
interoperable tools, and networked threat detection and
mitigation capabilities, responders of the future will be
better able to serve their communities.
Resilient Communities: Disaster-Resilience for the Future.--
Critical infrastructure of the future will be designed, built,
and maintained to be resilient to naturally-occurring and man-
made disasters. Decision makers will know when a disaster is
coming, anticipate the effects, and use already-in-place or
rapidly deployed countermeasures to shield communities from
negative consequences. Resilient communities struck by
disasters will not only bounce back but bounce back quicker.
In establishing S&T's Visionary Goals, we took a major step forward
in creating two-way dialogue around our work. This crowdsourcing shaped
our final product with additional feedback that we would not
necessarily have otherwise been able to tap into. As a natural
extension, we created the National Conversation on Homeland Security
Technology, which brings together all interested parties (responders,
operational users, citizens, academia, and industry to name a few) to
play a role in shaping the future of homeland security technology.
Through on-line forums and in-person discussions, we will foster
understanding of the homeland security market and build progress toward
outcomes that will keep us all safer and minimize disruption to the
pace of daily life.
using science and technology to address first responder operational
needs
To look at the role of technology and how S&T delivers new
capabilities to the Homeland Security Enterprise, an illustrative
example is our work for the responder community. More than 70,000
Federal, State, local, Tribal, and territorial and entities support
public safety and emergency response in every community across the
Nation. First responders cross disciplines, including law enforcement,
fire services, emergency medical services and emergency management, and
serve communities of widely-ranging sizes and specific needs against a
backdrop of complex operational realities and limitations.
First responders also face a myriad of threats that materialize in
various fire, natural disaster, terrorism, and mass casualty
emergencies. As a result, responder organizations must plan for wide-
ranging response including routine, day-to-day duties as well as rare,
catastrophic events. Those organizations also face the challenge of
furnishing responders with equipment and training that enable all-
hazard response to rare events without interfering with routine duties.
To identify common gaps and address the most pressing responder
needs, S&T has an organization within the Directorate--its First
Responders Group (FRG)--dedicated to strengthening first responder
safety and effectiveness. S&T, through FRG, focuses on evolving, high-
impact threats and how to prepare responders without disrupting day-to-
day operational duties. Example projects include all-hazard
communications and data interoperability, situational awareness, and
personal protective equipment as well as more specific work in
radiological/nuclear response and recovery. As new threats emerge, S&T
works with the first responder community to identify and fill resulting
capability gaps guided by several principles for identifying solutions:
Operational Needs Drive Projects.--Recognizing that
initiatives must be based on user needs and driven from
responders in the field.
Building on Existing Investments.--Encouraging efficiencies
by building on existing investments saves money by avoiding
unnecessary and duplicative development of new hardware,
software, data development, and training.
Leveraging Existing Solutions.--Conducting technology
foraging to help leverage existing interagency and private-
sector solutions before any investments in new solutions are
made.
Forming Partnerships.--Building partnerships across Federal,
State, local, Tribal, and territorial agencies as well as with
international partners to maximize funding and increase
adoption.
Daily Use Solutions.--Seeking technological solutions that
improve not only catastrophic response but daily use by first
responders.
Non-Proprietary Solutions.--Ensuring that technologies from
different manufacturers can actually interoperate requires the
use of open-source, non-proprietary solutions and standards-
based approaches.
Affordable and Accessible Solutions.--Recognizing that
solutions need to be affordable and commercially available for
purchase.
As you will see detailed below, S&T tailors its business model to
succeed with State, local, Tribal, and territorial first responders in
addition to DHS operational components including the Domestic Nuclear
Detection Office (DNDO), National Protection and Programs Directorate
(NPPD), and Secret Service. Industry engagement is fundamental, and our
programs are innovative not only in outreach to responder and
commercial communities but also in use of funding vehicles. Prize
competitions and consolidation and integration of international
markets, for example, draw down risk to industry and incentivize
product development.
First responder engagement at every stage of development
FRG engages end-users at every stage of the technology development
process. By engaging end-users at the beginning of the technology
development cycle for requirements and then continuing throughout the
R&D process, FRG fosters user-produced innovation and ensures that the
solutions developed have a high probability of being transitioned to
the field. Prototypes will then be commercialized, deployed, and
adopted as rapidly as possible. For fielded technologies, this enhances
wide-spread adoption of these technologies in the field. This early and
frequent engagement also helps FRG to better align current and future
investments with responders' highest-priority needs.
First responder capability gaps are identified through a series of
studies that culminate in a knowledge product known as Project
Responder, which describes the highest-priority needs for catastrophic
incident response. The latest iteration, Project Responder 4, focuses
on identifying high priority capability needs, shortfalls, and
priorities for catastrophic incident response. It identifies a set of
enduring and emerging capability needs, frames them into technology
objectives, and assesses the state of science and technology to meet
those needs. Findings are based on discussions with Federal, State, and
local first responders as well as technical subject-matter experts.
These interactions ensure that potential solutions reflect operational
considerations and are based on an actionable and achievable technology
path or roadmap. With Project Responder as a foundation, FRG uses its
First Responder Resource Group, consisting of more than 120 first
responders and representatives of National first responder
associations, to translate broad capability gaps and needs into
defined, validated requirements, performance measures, and concepts of
operations that can be incorporated into FRG's solicitations for
projects. Recent requirements have ranged from location information and
proximity to risk for responders to communication in any environmental
condition to versatile clothing and equipment that protects against
multiple hazards.
After identifying requirements, FRG conducts internal and external
technology foraging to determine who else is working in this space and
what partial or complete solutions may already exist. Wherever
possible, existing investments by Federal partners, academia, and the
private sector are leveraged. FRG selects projects for funding based on
a number of criteria including the practitioner-identified gaps,
criticality/operational impact, threat likelihood, applicability, state
of the science, cost-benefit analysis, ease of integration, transition
likelihood, and time needed to prototype. Responders work with FRG
program managers throughout the life cycle of each project and assist
DHS in creating awareness in the field of these newly-developed
solutions.
Ultimately, S&T teams with the first responder community and
commercial sector to transition technologies, standards, and knowledge
products and integrate them into regular use. As solutions develop into
mature, commercial products, they ultimately can be purchased by first
responder organizations through the Federal Emergency Management
Agency's (FEMA) Authorized Equipment List (AEL), which is a list of
equipment approved for purchase using FEMA grants. As a service to
first responders, FRG also provides objective buying advice for first
responders looking at the AEL to help them make informed purchase
decisions. The System Assessment and Validation for Emergency
Responders (SAVER) program conducts objective assessments and
validations of commercial off-the-shelf equipment and publishes
explanations for different tools and technologies and their
application. After S&T has helped commercialize a product and published
it on the AEL, we still work with responders through FirstResponder.gov
and other Federal R&D agencies such as the National Institute of
Justice to promote awareness and enable informed procurement decisions
in the first responder community.
Radiological/nuclear response and recovery
One of FRG's highest-priority areas is reinforcing response and
recovery to a potential radiological or nuclear event. The detonation
of a radiological dispersal device or improvised nuclear device (IND)
has the potential to cause significant casualties, economic disruption,
and critical infrastructure destruction. Responding to and recovering
from such an event poses unique challenges to responder organizations.
S&T, through its National Urban Security Technology Laboratory (NUSTL),
works in conjunction with DNDO on pre-incident operations and with
FEMA, the Department of Energy (DOE), and the Environmental Protection
Agency (EPA) on response and recovery. A distinguishing aspect of S&T's
program is that, recognizing the significant lag between development of
new technology and broad deployment with responders, S&T focuses lab
and academia experts on the immediate problem of how to prepare and use
equipment already in the hands of first responders if a radiological or
nuclear event were to occur. S&T's products and science-based guidance
(e.g., how to manage complex incident data, methods to mitigate
community exposure to radiation hazards) go directly to State and local
responders, increasing their capabilities to respond in the first
minutes, hours, and days of a radiological emergency.
The foundation for S&T's work was analysis of significant but
broadly dispersed work already completed or under way in the field
combined with direct interaction with local agencies to understand
their major roadblocks in preparing for radiological response. This was
documented and synthesized in the DHS S&T Radiological/Nuclear Response
and Recovery Research and Development Investment Plan. Based on the
plan, the related portfolio now consists of 10 individual activities
serving a broad coalition of stakeholders. Examples include the
following:
Compiling guidance and best practices on radiological
particle containment, rapid gross-decontamination, and early
phase waste management into an electronic application, making
it easy for local agency decision makers and responders in the
field to access key information.
Revisiting scientific research and publications related to
radiological dispersal device response to make guidance
actionable for first responders through tools and preparedness
efforts.
Improving radiological data management and modeling
technology used by specialized Federal agencies and making it
more easily available and accessible to State and local
agencies to increase operational capability and also increase
communication and coordination between levels of government.
Another S&T project of interest is the Radiological Emergency
Management System (REMS), which is a network of gamma radiation
detectors that provides emergency managers with information on
environmental radiation levels to support response and recovery
operations in the event of a radiological or nuclear event. REMS was
designed at NUSTL in coordination with DNDO and commercialized by a
major instrument manufacturer. The New York Police Department, which
has a deep relationship with NUSTL, has purchased and deployed dozens
of REMS sensors as part of its operational system and stands as a
baseline for potential use in other major metropolitan areas.
Though S&T's investment in radiological/nuclear response and
recovery is relatively young, the portfolio is making a significant
impact by leveraging millions of dollars in previous and on-going
investments by DNDO, FEMA, the Department of Defense, EPA, and DOE and
by taking advantage of long-standing relationships with DHS components
like DNDO and FEMA with operational missions in this space.
Next Generation First Responder Apex program
Since S&T's first Apex program began with the Secret Service in
2010, Apex programs have been some of our most successful. With recent
expansion of Apexes as a portion of S&T's portfolio, much of the
original Apex structure will remain--these will still be cross-cutting,
multi-disciplinary efforts intended to solve problems of strategic
operational importance--but the projects are being scaled to apply to a
wider portion of the portfolio and will operate on longer 5-year time
lines. The Next Generation First Responder (NGFR) Apex program vision
is first responders who are protected, connected, and fully aware and
capable of faster, more efficient, and safer response to threats and
disasters of all types. NGFR is developing an integrated and modular
ensemble that includes an enhanced duty uniform, personal protective
equipment (PPE), wearable computing and sensing technology, and robust
communication capability. The modularity and flexibility of NGFR's
approach promotes affordability while still supporting diverse
environments, including PPE and duty uniforms enhanced for fire
resistance, liquid resistance and splash protection, puncture
resistance, and improved usability and comfort.
NGFR is harnessing the best existing and emerging technologies and
integrating them into a well-defined and standards-based open
architecture. A fundamental element of NGFR's strategy to accomplish
this will be tapping into the dynamic and growing market for wearable
sensors and smart technology. It will use innovative outreach and
funding vehicles like prize competitions to bring in innovative corners
of the market that have not historically partnered with the Federal
Government. NGFR will ultimately be able to provide real-time situation
awareness and give previously unattainable recognition and avoidance of
hazards before, during, and after incidents.
To support NGFR and many other projects, S&T is also being more
innovative in its interface with the international first responder
community. First responders around the globe share a common mission to
ensure the safety and security of the people they serve. They are often
asked to respond to complex incidents like the Deep Water Horizon oil
spill and Fukushima Daiichi nuclear disaster. Most countries
collaborate at an international level but largely address responder
challenges independently and face funding challenges, duplicate effort,
and struggle to gain traction in a fragmented global market. To
facilitate more robust cooperation and build a larger market for global
first responder needs, S&T leads the International Forum to Advance
First Responder Technology. The forum is a government-sponsored
platform for the following:
Defining a common set of capability gaps across the globe;
Using assessments of global markets and opportunities to
inform prioritization;
Providing a platform for international collaboration on R&D
initiatives and solutions;
Engaging industry throughout, to prepare it to make advanced
technology available at affordable prices.
The forum initially consists of government representatives from
S&T's 13 bilateral partners, Finland, and Japan. It will give
responders a global voice and use common problem sets and standards to
create or broaden global markets for first responder technology.
Ultimately, this lowers risk for industry and incentivizes investment
in more robust capabilities and product lines.
Identity, Credential, and Access Management
To protect first responder voice and data communications, assuring
secure access to networks and systems is critical. This requires the
registration, verification, authentication, and authorization of
network users. This technology area is commonly called Identity,
Credential, and Access Management (ICAM). FRG, in close partnership
with S&T's Cyber Security Division, NPPD's Office of Emergency
Communication (OEC), the DHS Office of the Chief Information Officer,
the White House's Program Manager for the Information Sharing
Environment (PM-ISE), and other partners, is developing ICAM approaches
for the Nation's public safety community. While many ICAM solutions do
exist today, significant interoperability issues remain for many
technical and policy reasons. This leads most public safety officials
to maintain multiple cyber identities to perform their job, which is
not only inefficient but also adds security risks.
With more than 60 percent of the public safety community leveraging
communication and information-sharing capabilities of broadband
services, S&T has a responsibility to help secure communications and
data across these networks. This is an increasingly complex problem,
but we collaborate with our partners to address this by developing and
proliferating standards-based approaches that align with Federal ICAM
guidance. Related to this problem, S&T must assure that ICAM practices
of the future (NPSBN) will meet the security needs of the public safety
community and be interoperable with the practices of other networks.
FirstNet is an independent authority charged with implementing a single
wireless broadband data-sharing network, the NPSBN, primarily for
public safety personnel. Ultimately, more than 5 million members of the
public safety community may use FirstNet, and S&T, along with other
public and private partners will help ensure the security and
dependability of communications across the NPSBN for first responders.
In January 2015, with our partners, the PM-ISE, and the
International Association of Chiefs of Police, S&T released a report
recommending principles and actions for developing an ICAM
interoperability strategy that will focus on registering, verifying,
and authorizing network users. While this strategy focuses on FirstNet,
the principles and actions will be relevant to any initiative that
needs to identify and authorize users for access to secure resources.
We will continue to work with our partners, in particular PM-ISE and
NPPD OEC, to address immediate and longer-term needs of first
responders on high-priority ICAM issues.
conclusion
Today, I discussed how technology shapes today's threat environment
as a double-edged sword, empowering operators and first responders on
one hand but enabling malevolent actors and raising the risk of complex
technological disasters on the other. As our work with first responders
demonstrates, S&T is helping the Homeland Security Enterprise harness
and utilize technology as a force multiplier and to gain leap-ahead
capabilities.
Thank you for inviting me to appear before you today. I appreciate
the opportunity to testify and would be pleased to answer any questions
you may have.
Mr. Ratcliffe. Thanks very much, Mr. Martin.
The Chairman would now like to recognize Mr. Noonan to
testify.
STATEMENT OF WILLIAM NOONAN, DEPUTY SPECIAL AGENT IN CHARGE,
CRIMINAL INVESTIGATIVE DIVISION, U.S. SECRET SERVICE
Mr. Noonan. Good afternoon, Chairman Ratcliffe, Ranking
Member Richmond, Ranking Member Thompson, and distinguished
Members of the subcommittee. Thank you for the opportunity to
testify with our DHS partners regarding the evolving threat of
cyber crime to our Nation and our work to research and develop
technologies that aid us in countering new and emerging
threats.
The Secret Service continues our founding mission to
investigate crimes impacting our Nation's financial system.
Over the past several decades, our financial system has
increasingly become dependent on information technology. As a
result, criminals motivated by greed have adapted their methods
and are using cyber space to steal sensitive information for
use in highly profitable fraud schemes and other illicit
activities.
The wealth accrued by the world's most skilled cyber
criminals is staggering. Most have become multi-millionaires
through their criminal endeavors, and they are not stopping
there.
Current cybersecurity efforts are being outpaced by
criminals, who reinvest their illicit proceeds to strengthen
their cyber capabilities. Over the past 10 years, the Secret
Service has observed the development of transnational cyber
criminals into highly-capable adversaries. They routinely
compromise highly secure computer networks, they accomplish
increasingly profitable schemes, they enable the malicious
cyber operations of others, and they undermine the rule of law
in order to protect their criminal enterprises.
Rich off the money they have stolen from Americans, our
Nation faces increasing risk that sophisticated cyber criminals
may coordinate their unique skill sets and combined expertise
to conduct cyber attacks against our critical infrastructure.
In considering all the high-profile cyber incidents this
past year, it is clear that defense alone is inadequate.
Proactive law enforcement investigations are essential in
combating these threats. Conducting these investigations is
what drives our work at the Secret Service. We focus on
investigating the most capable cyber criminals, those
individuals and groups that continue to reinvest their profits
in growing capability.
To combat these criminals, the Secret Service works closely
with our partners at DHS's Science and Technology and National
Protection and Programs Directorates in addition to our
partners in academia and the private sector to research and
develop technologies to enhance our operations.
Through our international network of Electronic Crimes Task
Forces, the Secret Service partners with over 4,000 private-
sector organizations; 2,500 international, Federal, State, and
local law enforcement agencies; and over 350 academic partners.
Just to highlight three examples of where Secret Service
works with our academic partners: At Carnegie Mellon
University, the Secret Service has assigned special agents to
the CERT Coordination Center since 1998. Through this
partnership, the Secret Service has been able to develop and
field innovative technologies that enable the Secret Service to
both investigate and protect against cyber threats. It is
through this partnership at Carnegie Mellon that the Secret
Service first established the Critical Systems Protection
Program in 2001 and continues to develop and field technologies
to secure the critical systems that our protective mission
depends on.
At the University of Tulsa, the Secret Service established
the Cell Phone Forensic Facility in 2008 to understand threats
involving mobile devices and support law enforcement
investigations. This facility continues to be a global center
of excellence in those fields, continually developing new
methods for recovering evidence from mobile devices and
performing the most challenging of forensic exams--those
involving damaged devices. This facility is an excellent
example of an effective academic partnership, where students
conduct work and research that directly address some of the
most challenging problems we face.
At the University of Texas, Austin, the Secret Service is a
member of the Center for Identity and serves on its board of
advisors. The Center for Identity was established in 2010 and
is focused on researching the identity ecosystem and
strengthening our ability to counter identity theft and other
emerging identity-related threats.
The work of our private and academic partners is critical
for the Secret Service to keep pace with the changing use of
technologies by adversaries who target our homeland.
As this panel demonstrates, cyber crime is just one of
several challenges at the intersection of technology and
security that our Department is charged with countering. We at
the Secret Service are committed to continuing to adapt and
innovate the performance of our integrated mission.
Thank you for the opportunity to testify, and I look
forward to your questions.
[The prepared statement of Mr. Noonan follows:]
Prepared Statement of William Noonan
February 12, 2015
Good morning Chairman Ratcliffe, Ranking Member Richmond, and
distinguished Members of the subcommittee. Thank you for the
opportunity to testify on the Secret Service's progressive efforts to
protect our homeland by countering cyber criminal activity.
The cyber crime threats to our homeland continue to rapidly grow
fuelled by the wealth these illicit activities are generating. For over
three decades the Secret Service has investigated cyber criminal
activity \1\ and worked to counter some of the most proficient
transnational cyber criminal groups. Based on our experience
investigating and apprehending many of the most capable and prolific
transnational cyber criminals, I hope to provide this committee with
useful insight into the continued threat our Nation faces from
malicious cyber activity.
---------------------------------------------------------------------------
\1\ Congress established 18 USC 1029-1030 as part of the
Comprehensive Crime Control Act of 1984 and explicitly assigned the
Secret Service authority to investigate these criminal violations.
---------------------------------------------------------------------------
the transnational cyber crime threat
Nearly 15 years ago, advances in computer technology and greater
access to personally identifiable information (PII) via the internet
created on-line marketplaces for transnational cyber criminals to share
stolen information and criminal methodologies. This has resulted in a
steady increase in the quality, quantity, and complexity of cyber
crimes targeting private industry and critical infrastructure. These
crimes include network intrusions, hacking attacks, and account
takeovers leading to significant data breaches affecting every sector
of the economy. Recently reported payment card data breaches are
examples of this long-term trend of major data breaches perpetrated by
transnational cyber criminals who are intent on targeting our Nation's
financial payment system for illicit gain.
The wealth accrued by the world's most capable cyber criminals is
staggering. Some have become millionaires through their cyber criminal
activities, even buying numerous resort properties in tropical
locations. More significantly they are reinvesting what they have
stolen to develop increasingly sophisticated cyber capabilities and
organizations to perpetuate and expand their illicit schemes. The
capabilities these criminals develop are increasingly being used by
foreign states for intelligence collection or military purposes.
The collaboration amongst top tier cyber-criminals is astounding.
These individuals routinely trust one another with millions of dollars
as they execute their highly distributed transnational criminal
conspiracies. These groups have increasingly segmented their
operations, allowing for the development of highly-talented specialists
in performing each part of the criminal schemes: From gaining
unauthorized access to protected computer networks, to engaging in
sophisticated frauds, to laundering and distributing their proceeds.
These growing specialties raise both the complexity of investigating
these cases, as well as the level of potential harm to companies and
individuals.
For example, illicit underground cyber crime marketplaces allow
criminals to buy, sell, and trade malicious software, access to
sensitive networks, spamming services, payment card data, PII, bank
account information, brokerage account information, hacking services,
and counterfeit identity documents. These illicit digital marketplaces
vary in size, with some of the more popular sites boasting membership
of approximately 80,000 users and some sites being highly exclusive
invitation-only associations. These digital marketplaces often use
various digital currencies, and cyber criminals have made extensive use
of digital currencies to pay for criminal goods and services or launder
illicit proceeds.
the secret service strategy for combating this threat
The Secret Service proactively investigates cyber crime using a
variety of investigative means to often infiltrate these transnational
cyber criminal groups and counter every element of their criminal
schemes. As a result of these proactive investigations, the Secret
Service is often the first to learn of planned or on-going data
breaches and is quick to notify affected companies and institutions
with actionable information to mitigate the damage from the data breach
and terminate the criminal's unauthorized access to their networks.
Victim companies rarely identify unauthorized access to their networks;
rather law enforcement, financial institutions, or other third parties
identify and notify the likely victim company of a data breach.
A trusted relationship with the victim is essential for confirming
the crime, remediating the situation, beginning a criminal
investigation, and collecting evidence. To foster these trusted
relationships, in 2001, Congress directed the Secret Service to develop
a National network of electronic crimes task forces, based on our
existing New York Electronic Crimes Task Force, for the purpose of
preventing, detecting, and investigating various forms of electronic
crimes, including potential terrorist cyber attacks against critical
infrastructure and financial payment systems. Today the Secret Service
operates a global network of 38 Electronic Crimes Task Forces (ECTF) as
part of this growing network. These ECTFs are the foundation for the
Secret Service's investigations of cyber crime and our primary means of
sharing actionable information with potential victim companies. For
example, in 2014, based on information discovered through just one of
our on-going cyber crime investigations, the Secret Service notified
hundreds of U.S. entities of cyber criminal activity targeting their
organizations.
The Secret Service also invests in developing the capabilities of
our State and local partners. In partnership with the State of Alabama,
the Secret Service operates the National Computer Forensic Institute
(NCFI) to train State and local law enforcement investigators,
prosecutors, and judges in how to conduct computer forensic
examinations, respond to network intrusion incidents, and conduct cyber
crimes investigations. Graduates of NCFI typically join the Secret
Service's network of ECTFs, and have frequently made vital
contributions to significant Secret Service investigations of
transnational cyber criminals.
As the Secret Service investigates cyber crime, we discover new and
emerging cyber criminal methods and share relevant cybersecurity
information broadly to enable other organizations to secure their
networks while protecting on-going investigations and the privacy and
civil rights of all involved. The Secret Service accomplishes these
objectives through contributions to industry-leading annual reports
like the Verizon Data Breach Investigations Report and the Trustwave
Global Security Report, and through more immediate reports, including
joint Malware Initial Findings Reports (MIFRs).
For example, this year UPS Stores Inc. used information published
in a joint report on the Back-Off malware to protect itself and its
customers from cyber criminal activity.\2\ The information in this
report was derived from a Secret Service investigation of a network
intrusion at a small retailer in Syracuse, New York. The Secret Service
partnered with the National Cybersecurity & Communications Integration
Center (NCCIC/US-CERT) and the Financial Services Information Sharing
and Analysis Center (FS-ISAC) to widely share actionable cybersecurity
information derived from this investigation to help numerous other
organizations, while protecting the integrity of the on-going
investigation and the privacy of all parties. For UPS Stores, Inc., the
result was the identification of 51 stores in 24 States that had been
impacted, enabling UPS Stores, Inc. to contain and mitigate this cyber
incident before it developed into a major data breach.\3\
---------------------------------------------------------------------------
\2\ See http://www.us-cert.gov/security-publications/Backoff-Point-
Sale-Malware.
\3\ See UPS Store's press release. Available at: http://
www.theupsstore.com/about/media-room/Pages/The-ups-storenotifies-
customers.aspx.
---------------------------------------------------------------------------
As we share cybersecurity information discovered in the course of
our criminal investigations, we also continue pursuing our
investigation in order to apprehend and bring to justice those
involved. Due to the inherent challenges in investigating transnational
crime, particularly the lack of cooperation of some countries with U.S.
law enforcement investigations, occasionally it can take years to
finally apprehend the top tier criminals. The Secret Service works
closely with its partners in the Departments of Justice and State to
develop the capabilities of foreign law enforcement partners and to
foster collaboration.
For example, in July of 2014 Secret Service agents arrested Roman
Seleznev of Vladivostok, Russia, through an international law
enforcement operation. Mr. Seleznev has been charged in Seattle in a
40-count indictment for allegedly being involved in the theft and sale
of financial information of millions of customers. Seleznev is also
charged in a separate indictment with participating in a racketeer
influenced corrupt organization (RICO) and conspiracy related to
possession of counterfeit and unauthorized access devices.\4\ This
investigation was led by the Secret Service's Seattle Electronic Crimes
Task Force.
---------------------------------------------------------------------------
\4\ See http://www.justice.gov/usao/waw/press/2014/October/
seleznev.html.
---------------------------------------------------------------------------
In another case, the Secret Service, as part of a joint
investigation with U.S. Immigration and Customs Enforcement's Homeland
Security Investigations (HSI) and the Global Illicit Financial Team
(GIFT), hosted by IRS-Criminal Investigations, shut down the digital
currency provider Liberty Reserve, which was allegedly widely used by
criminals worldwide to store, transfer, and launder the proceeds of a
variety of illicit activities. In addition, the Treasury Department's
Financial Crimes Enforcement Network found Liberty Reserve to be a
financial institution of primary money laundering concern pursuant to
Section 311 of the USA PATRIOT Act. Liberty Reserve had more than 1
million users, who conducted approximately 55 million transactions
through its system totaling more than $6 billion in funds. The founder
of Liberty Reserve, Arthur Budovsky, was recently extradited from Spain
to the United States. Mr. Budovsky is among seven individuals charged
in the indictment. Four co-defendants--Vladimir Kats, Azzeddine el
Amine, Mark Marmilev, and Maxim Chukharev--have pleaded guilty and
await sentencing. Charges against Liberty Reserve and two individual
defendants, who have not been apprehended, remain pending. This
investigation was led by the Secret Service's New York Electronic
Crimes Task Force.
legislative action to combat data breaches
While there is no technology available to prevent data breaches of
U.S. customer information, legislative action could help to improve the
Nation's cybersecurity, reduce regulatory costs on U.S. companies, and
strengthen law enforcement's ability to conduct effective
investigations. In January, the administration proposed law enforcement
provisions related to computer security, highlighting the importance of
additional tools to combat emerging criminal practices.\5\ We continue
to support changes like these that will assist us in countering the
rapidly-evolving threat of cyber crime.
---------------------------------------------------------------------------
\5\ This proposal is available at: http://www.whitehouse.gov/omb/
legislative_letters/.
---------------------------------------------------------------------------
conclusion
The Secret Service is committed to continuing to safeguard the
Nation's financial payment systems by defeating cyber criminal
organizations. Responding to the growth of these types of crimes, and
the level of sophistication these criminals employ, requires
significant resources and substantial collaboration among law
enforcement and its public and private-sector partners. Accordingly,
the Secret Service dedicates significant resources to improving
investigative techniques, providing training for law enforcement
partners, and sharing information on cyber threats. The Secret Service
will continue to coordinate and collaborate with other Government
agencies and the private sector as we develop new methods for combating
cyber crime. Thank you for your continued commitment to protecting our
Nation's financial system from cyber crime.
Mr. Ratcliffe. Thanks very much, Mr. Noonan.
Last but not least, the Chairman would like to recognize
Mr. Painter to testify.
STATEMENT OF WILLIAM PAINTER, ANALYST, GOVERNMENT AND FINANCE
DIVISION, CONGRESSIONAL RESEARCH SERVICE, LIBRARY OF CONGRESS
Mr. Painter. Good afternoon, Chairman Ratcliffe, Ranking
Member Richmond, Ranking Member Thompson, and distinguished
Members of the subcommittee. Thank you for inviting me to
appear before you today to discuss how DHS's budget situation
could affect the Department's efforts to develop new
technologies and confront emerging threats.
I will discuss three potential scenarios for the fiscal
year 2015 DHS appropriations and examine what each could entail
for the Department going forward. As you know, Congress has
not, to date, provided annual appropriations for DHS but,
instead, provided an extension of funding for the Department
through a continuing resolution, or CR, that expires on
February 27.
At least three possible immediate futures for DHS
appropriations exist. First is extension of the CR. The second
is enactment of a fiscal year 2015 annual appropriations bill
or, third, a lapse in annual discretionary appropriations.
First, extension. So far, in fiscal year 2015, DHS has been
operating under a series of interim CRs, which typically
provide temporary funding at a given rate of operations rather
than a set level for the year. Interim CRs expire at a
specified date prior to the end of the fiscal year. A second
type of CR is the full-year CR, which provides funding all the
way through to the end of the fiscal year. DHS has operated
under the terms of such a CR only once, in fiscal year 2011.
To preserve Congressional prerogatives, Congress generally
places several restrictions on the use of funding provided
under an interim CR. These include a prohibition on the start
of new projects, prohibiting funding decisions, including
grants, that would impinge on Congress' final funding
prerogatives, and allowing only the most limited funding action
permitted in the resolution to continue the Government's work.
As a result of these restrictions and uncertainty over when
they may be lifted and annual funding levels finally set, an
agency funded under an interim CR experiences several
challenges.
A CR may provide funding at a higher or lower rate than
needed to carry out Departmental priorities. For example, under
the current CR, S&T is being allocated funds as a rate higher
than needed for construction of the National Bio and Agro-
Defense Facility, while DNDO is getting funds at a much lower
rate than it needs to buy radiation detectors for front-line
DHS personnel. This mismatch is not on the basis of an
affirmative policy decision by Congress. It is simply because
those programs need to change from the previous year's
baseline, and the funding stream did not.
Timing can also be an issue. After an interim CR is
replaced, a Department may not have time to use some of the
funding it has been provided before it expires at the end of
the fiscal year. Although most of the budget for DNDO and S&T
can be used up to 3 to 5 years after it was appropriated, most
of NPPD's appropriation expires at the end of each fiscal year.
The second potential scenario is enactment of an annual
appropriations bill. This would allow DHS to carry out its
mission with transparent and explicit direction from Congress
in terms of funding levels for its many missions. DHS would be
able to hire staff, initiate new projects, and award grants
within the parameters laid out in the enacted legislation and
accompanying explanatory statement.
The third possible scenario is what would occur in the
event that the current CR expires without extension or
replacement. Annual appropriations for DHS would lapse. DHS
would be required to implement a shutdown furlough, as they did
in the Government-wide lapse in appropriations in October 2013.
This would represent a disruption in DHS operations and raise
obstacles to efficient management and oversight much greater
than those raised by an interim continuing resolution. In 2013,
roughly 85 percent of the Department's functions continued
during the shutdown, but 96 percent of S&T, 95 percent of DNDO,
and 43 percent of NPPD staff were furloughed.
DHS personnel who are legally permitted to continue to work
in the event of a lapse generally fall into two categories:
Those with activities that are not funded through 1-year
appropriations and those whose work is exempted under specific
authorities of the Antideficiency Act. Among the components of
interest today, only the Office of Biometric Identity
Management and Federal Protective Service under NPPD continued
to operate during the furlough, with funding made available
through fee revenues and multi-year appropriations. Most of the
Secret Service and NPPD cybersecurity function continued to
work in the absence of annual appropriations because of
Antideficiency Act exemptions.
As it faced the 2013 shutdown, DHS identified several
activities that would be subject to furloughs and curtailment
of activities under a lapse in annual appropriations, including
all non-disaster grant programs, NPPD's Critical Infrastructure
Protective Security Advisor Program, the Chemical Site Security
Regulatory Program, and research and development activities. As
the underlying laws that determine who is furloughed and who is
exempt have not changed, one can expect a similar result in the
event that fiscal year 2015 appropriations lapse.
I would like to thank the subcommittee again. Like all of
us at the Congressional Research Service, I am happy to answer
your questions.
[The prepared statement of Mr. Painter follows:]
Prepared Statement of William Painter
February 12, 2015
Good morning Chairman Ratcliffe, Ranking Member Richmond, and
Members of the subcommittee.
I am privileged to appear before you today on behalf of CRS in
response to your request to discuss how the budget situation for the
Department of Homeland Security (DHS) could affect the efforts of its
various components to develop new technologies and confront emerging
threats.
Accordingly, my statement summarizes key portions of several CRS
reports regarding DHS appropriations for fiscal year 2015, the impact
of continuing resolutions (CRs), and the impact of a lapse in annual
appropriations for DHS.
I will begin with a brief overview of the current status of the DHS
appropriations process, and then discuss three potential scenarios and
what each would entail for DHS developing technology and confronting
emerging threats.
When discussing specific programs, I will explore the impact of
various potential budget scenarios on the operations of the DHS
components represented on the panel with me today, National Programs
and Protection Directorate (NPPD), the Domestic Nuclear Detection
Office (DNDO), the Science and Technology Directorate (S&T), and to a
limited extent, the cybersecurity-related functions of the U.S. Secret
Service (USSS). Unfortunately, the publicly-available documentation
regarding the USSS budget lacks the granularity necessary to discuss
those functions in significant detail.
dhs appropriations current status
DHS operated with an overall budget of $59.2 billion for fiscal
year 2014. Forty-seven-point-nine billion dollars, or 81%, was
discretionary spending, which relied on budget authority provided
through appropriations acts.\1\ The fiscal year 2014 Homeland Security
Appropriations Act (Pub. L. No. 113-76, Division F) enacted almost $3
billion for DNDO, S&T, and NPPD.
---------------------------------------------------------------------------
\1\ Department of Homeland Security, Budget in Brief, Fiscal Year
2016, p. 8.
---------------------------------------------------------------------------
The administration requested $60.9 billion for DHS for fiscal year
2015, of which $49.0 billion was discretionary funding. DNDO, S&T, and
NPPD comprised $2.9 billion of that request.
As fiscal year 2014 drew to a close, no annual appropriations bills
for fiscal year 2015 had been enacted. On September 19, 2014, the
President signed into law Pub. L. No. 113-164, which provided temporary
funding for Government operations as senior appropriators indicated
they would pursue an omnibus appropriations package in the closing
months of the 113th Congress, rather than stand-alone appropriations
bills. The Consolidated and Further Continuing Appropriations Act,
2015, was signed into law as Pub. L. No. 113-235 on December 16, 2014.
Congress did not include full annual appropriations for DHS as part of
the package, but provided an extension of continuing appropriations for
the Department through February 27, 2015.\2\
---------------------------------------------------------------------------
\2\ Division L of Pub. L. No. 113-235.
---------------------------------------------------------------------------
The administration submitted its fiscal year 2016 budget request to
Congress on February 2, 2015. According to the Department, the request
includes almost $64.9 billion for DHS, more than $51.9 billion of which
is discretionary spending. When compared in fiscal year 2015, this
represents a $3.7 billion increase compared to the overall DHS budget
request, and a $2.8 billion increase in the DHS discretionary request.
The requested appropriations for NPPD, S&T, and DNDO total almost $2.8
billion.
The annual appropriation for DHS was not finalized when the budget
request was assembled. DHS does not directly compare in its public
budget request documentation the fiscal year 2016 request with the
legislation under consideration for fiscal year 2015. Table 1 provides
such a comparison for the selected agencies.
TABLE 1.--ENACTED, REQUESTED, AND PROPOSED APPROPRIATIONS FOR SELECTED DHS COMPONENTS, FISCAL YEAR 2014-FISCAL
YEAR 2016
(Budget Authority in Rounded Millions of Dollars)
----------------------------------------------------------------------------------------------------------------
Fiscal Fiscal Year 2015 Fiscal Analysis of Fiscal
Year 2014 ------------------------ Year 2016 Year 2016 Request
Component/Appropriation ------------ ------------ vs. H.R. 240
Budget H.R. 240 Budget ---------------------
Enacted Request Request +/- $ +/- %
----------------------------------------------------------------------------------------------------------------
U.S. Secret Service (USSS):
Salaries and expenses................. $1,538 $1,586 $1,616 $1,867 $252 15.6%
Acquisition, construction, 52 50 50 72 22 43.5%
improvements, and related expenses...
---------------------------------------------------------------------
USSS TOTAL.......................... 1,590 1,636 1,666 1,939 273 16.4%
National Protection and Programs
Directorate (NPPD):
Management and Administration......... 56 66 62 64 3 4.1%
Infrastructure Protection and 1,187 1198 1189 1,312 123 10.3%
Information Security.................
Federal Protective Service (FPS) *.... [1,302] [1343] [1343] [1,443] 101 7.5%
Office of Biometric Identity 227 252 252 284 31 12.5%
Management...........................
---------------------------------------------------------------------
NPPD TOTAL.......................... 1,471 1,515 1,502 1,659 157 10.5%
Science and Technology (S&T):
Management and Administration......... 129 130 130 132 2 1.6%
Research, Development, and Operations. 1,091 942 974 647 -327 -33.6%
---------------------------------------------------------------------
S&T TOTAL........................... 1,220 1,072 1,104 779 -325 -29.4%
Domestic Nuclear Detection Office (DNDO):
Management and Administration......... 37 37 37 38 1 2.6%
Research, Development, and Operations. 205 199 198 196 -2 -1.0%
Systems Acquisition................... 43 68 73 123 50 69.4%
---------------------------------------------------------------------
DNDO TOTAL.......................... 285 304 308 357 49 16.1%
----------------------------------------------------------------------------------------------------------------
* FPS is not included in the total resources because it is funded through collections from the agencies for whom
FPS provides services.
Sources.--CRS analysis of fiscal year 2014 explanatory statement, fiscal year 2015 DHS Congressional
justifications, H.R. 240 (114th Congress), and the DHS Budget in Brief, Fiscal Year 2016.
Notes.--Table displays rounded numbers for simplicity of presentation. To ensure validity of analysis, all
operations, including calculations of percentages, were performed with unrounded data.
The evolution of funding levels across the three fiscal years
reflected in this chart (as well as other changes below the
appropriations level that are not reflected here) could be taken as
evidence that DHS and Congressional priorities in confronting emerging
threats are evolving as well. The resolution of the fiscal year 2015
annual appropriations cycle will have a significant impact on the
ability of the Department to align its funding to those new priorities.
Budgets that are based on prior year funding streams or that are more
procedurally limiting than the annual appropriations process could
present additional challenges to the Department as it works to adjust
to the evolving threat environment.
fiscal year 2015 dhs appropriations: potential future scenarios
At least three possible scenarios exist as the February 27
expiration date of the current DHS funding stream approaches:
(1) extension of the continuing resolution;
(2) enactment of a fiscal year 2015 annual appropriations bill for
DHS; or
(3) a lapse in discretionary appropriations.
extension of the continuing resolution
Continuing resolutions (CRs)--the basis of the first possible
scenario--come in two forms, distinguished by the duration of funding
they provide. The most common type is an ``interim'' CR, which provides
temporary funding for departments or agencies that lack enacted annual
appropriations. Such finding is typically provided at a given rate for
operations. This type of CR expires at a specified date prior to the
end of the fiscal year. It may be extended through the enactment of
further interim CRs, or superseded by annual appropriations laws. DHS
has been operating under temporary CRs throughout fiscal year 2015,
providing funding slightly less than the fiscal year 2014 rate for
operations.
My colleagues have written extensively on the history, functions,
and impacts of interim continuing resolutions, and I refer you to their
work for detailed analysis.\3\ Usually funding is provided to sustain a
rate for operations defined in terms of funding enacted in the previous
fiscal year. That rate may be adjusted by formula or by specific
``anomalies''\4\ on a pro-rated basis, which is calculated based on the
CR's duration. Any obligations or expenditures that are made using this
temporary funding are typically deducted from the applicable full-year
appropriation once enacted.
---------------------------------------------------------------------------
\3\ For information on the history and procedural aspects of CRs,
see CRS Report R42647, Continuing Resolutions: Overview of Components
and Recent Practices, by Jessica Tollestrup; for information on the
impacts of interim CRs, see CRS Report RL34700, Interim Continuing
Resolutions (CRs): Potential Impacts on Agency Operations, by Clinton
T. Brass.
\4\ Anomalies are generally defined as provisions that alter the
funding stream provided under a continuing resolution or the
authorities under which that funding is utilized, i.e., increasing or
decreasing the rate for operations for a specific program, barring the
use of funds for a specific activity, or specifically authorizing an
activity.
---------------------------------------------------------------------------
The second type of CR is a ``full-year'' CR, which provides funding
through the end of the fiscal year. DHS has operated under the terms of
such a CR only once, in fiscal year 2011. That year, Congress agreed
only on the budget for the Department of Defense. The rest of the
Government operated under the terms of a full-year CR \5\ from mid-
April to the end of September, 2011. Defined funding levels (as opposed
to a rate of operations) were established, and were generally the
amounts in the previous fiscal year's appropriations laws (except when
set by anomalies).
---------------------------------------------------------------------------
\5\ Division B of Pub. L. No. 112-10.
---------------------------------------------------------------------------
To preserve Congressional prerogatives, Congress generally places
several key restrictions on the use of continuing funding under an
interim CR. The current CR,\6\ as amended, includes those traditional
restrictions, including:
---------------------------------------------------------------------------
\6\ Pub. L. No. 113-164 as amended.
---------------------------------------------------------------------------
Section 101(a).--That appropriations are provided ``under
the authority and conditions'' of the fiscal year 2014
appropriations laws, for projects or activities ``that were
conducted in fiscal year 2014'', and that were funded in those
specified appropriations acts;\7\
---------------------------------------------------------------------------
\7\ 128 Stat 1867.
---------------------------------------------------------------------------
Section 104.--That funds may not be used to initiate or
resume any project or activity not funded during fiscal year
2014;\8\
---------------------------------------------------------------------------
\8\ 128 Stat 1868.
---------------------------------------------------------------------------
Section 109.--That funding distributions or grant awards
shall not be made that would impinge on Congress's final
funding prerogatives;\9\ and
---------------------------------------------------------------------------
\9\ 128 Stat 1869.
---------------------------------------------------------------------------
Section 110.--That only the most limited funding action
permitted in the resolution shall be made to continue projects
and activities.\10\
---------------------------------------------------------------------------
\10\ Ibid.
---------------------------------------------------------------------------
The restrictions noted above in Sections 109 and 110 were not
included in the fiscal year 2011 full-year CR, and the restrictions in
Section 104 were modified, as the legislation was anticipated to be the
final action on appropriations for the fiscal year.
An agency funded under an interim CR experiences several challenges
in confronting a dynamic threat environment and developing new
technologies. To some extent, a status quo funding level combined with
the restrictions on the use of funds provided under the terms of a
continuing resolution may result in Federal agencies continuing to
support existing priorities--rather than shifting to new ones--since
only existing programs retain funding.
In reports stretching back several years, the Government
Accountability Office (GAO) has noted multiple negative effects of
interim continuing resolutions on efficient program management and
execution. GAO variously cited: The inability to allocate funds to
programs with current needs, rather than a (possibly no longer
relevant) recent history of funding; delays in planning; hiring
freezes; delays in construction projects; suspension of loan and grant
activities; inability to finalize or renew contracts in a timely
manner; reductions in technical assistance work; delays in funding that
increased program costs; and reductions in otherwise justifiable
travel.\11\
---------------------------------------------------------------------------
\11\ Summarized in CRS Report RL34700, Interim Continuing
Resolutions (CRs): Potential Impacts on Agency Operations, by Clinton
T. Brass.
---------------------------------------------------------------------------
Other observers concur that interim CRs can have negative impacts.
Past reporting by CRS regarding the impacts of interim CRs on the
Department of Defense noted that interim CRs create challenges in the
distribution of funds, requiring an ``inordinate amount of time and
paper,'' and drawing resources from ``more productive management.'' The
reporting also noted that interim CRs do not provide the authority to
reestablish bonuses and allowances for personnel, which can negatively
affect morale and retention of highly sought-after personnel.\12\
---------------------------------------------------------------------------
\12\ Ibid.
---------------------------------------------------------------------------
If full-year regular appropriations levels for fiscal year 2015
become law, thereby allowing new programs to receive funds, projects
may have difficulty meeting their projected time lines because of the
shortened time frame for obligating funds for these programs. With the
midpoint of the fiscal year approaching, difficulties may emerge in
obligating some of the new appropriations for NPPD, for example, before
they expire at the end of the fiscal year. Most of the budget for DNDO
and S&T does not expire for 3 or 5 years; however, 81% of NPPD's
Infrastructure Protection and Information Security appropriation in
H.R. 240 expires at the end of fiscal year 2015.
One example of how either an interim or year-long CR that extends
last year's funding levels with no anomalies \13\ could affect DHS
activities is the Chemical Facility Anti-Terrorism Standards (CFATS)
activity at NPPD.
---------------------------------------------------------------------------
\13\ In practice, interim and full-year CRs usually contain at
least some anomalies.
---------------------------------------------------------------------------
CFATS would be affected both in terms of its funding and its
operations. In terms of funding, the Infrastructure Security Compliance
Division (ISCD) requested an 8% increase in fiscal year 2015 from their
appropriated level in fiscal year 2014 ($87 million as opposed to $81
million). In practice, DHS had reprogrammed an additional $3 million to
ISCD in fiscal year 2014. Under a clean CR, ISCD would be funded at a
lower level than required to provide current services.
In terms of operations, in December 2014, ISCD received new
statutory authorization to regulate chemical facilities for security
purposes. The new authority contains new provisions for ISCD to
implement, including increased information sharing, the commission of
certain studies, and the establishment of a self-certification program
for regulated entities. Not all of these activities were in place in
fiscal year 2014. The costs of implementing them would not be
represented in a funding stream based on fiscal year 2014 funding, and
DHS may consider some of them as new activities that could not be
initiated under the continuing resolution.
Another potential effect of a CR that extended fiscal year 2014
levels would be on the S&T Laboratory Facilities appropriation. In
fiscal year 2014, the construction of the National Bio- and Agro-
defense Facility received $404 million in appropriations. The request
for fiscal year 2015 was $300 million, which was included in both the
House and Senate draft bills in the previous Congress and in H.R. 240.
Despite what appears as consensus on a funding level, a CR at fiscal
year 2014 levels would provide more for NBAF construction than either
Congress or the administration have proposed.
DNDO's Human Portable Radiation Detection Systems program would
have the opposite issue. This program purchases commercially-available
technology for front-line DHS personnel to detect radiological or
nuclear materials in the field. The fiscal year 2015 request of $51
million was almost triple the fiscal year 2014 funding level of $14
million. Again, the House and Senate generally concurred on providing
most of the increase, but an anomaly would be required to provide that
increase if the CR generally extended the fiscal year 2014 funding
level.
Given the structure of appropriations for S&T, funding shifts below
the level of the Project, Program, and Activity level are common. Such
shifts can provide the resources needed to carry out work under
existing authorities. However, given the level of budget uncertainty,
even in cases where S&T has the legal ability to engage in new work,
there may be a hesitancy to make a commitment of resources when
operating under a temporary CR.
enactment of fiscal year 2015 annual appropriations
The second potential next scenario--enactment of an annual
appropriations bill--would arguably allow DHS to carry out its mission
with more transparent and explicit direction from Congress in terms of
funding levels and funding limitations for many of its missions. DHS
may perceive more freedom to engage in certain activities, such as the
hiring of staff. It would also be able to initiate certain new
projects, as is the case for the other Government agencies funded
through the consolidated appropriations act enacted in December, 2014.
For the purposes of discussion, let us assume that the annual
appropriation includes the funding levels outlined in H.R. 240, the
fiscal year 2015 Homeland Security Appropriations bills introduced in
the House in the 114th Congress.
Under the terms of H.R. 240, in fiscal year 2015, DNDO would
receive an almost 8% increase overall above fiscal year 2014. A $7
million reduction in the Research Development and Operations account
would be offset by an increase of $35 million in the Human Portable
Radiation Detection Program. While $2 million less than requested by
the administration, the resources provided would still support the
purchase of portable radiation detectors for Customs and Border
Protection, the Transportation Security Administration, and the U.S.
Coast Guard.
S&T would be funded $116 million below fiscal year 2014 levels
under H.R. 240 as passed by the House. The major driver in this
reduction is the smaller tranche of funding for the construction of the
National Bio- and Agrodefense Facility. A 1% reduction in the Research,
Development, and Innovation subappropriation also is present. As with
DNDO, the funding levels included in the two bills are higher than the
administration's request for fiscal year 2015.
In House-passed H.R. 240, NPPD would be funded at slightly more
than $1.5 billion--almost $32 million above the fiscal year 2014 level,
and $13 million below the administration's request. Most of the
increase from the previous fiscal year is driven by a $32 million
increase in the Next Generation Networks program and rejection of an $8
million proposed reduction in the Global Cybersecurity Management
subappropriation. This would maintain funding levels for cybersecurity
education.
The explanatory statement for H.R. 240 notes that USSS ``cyber
activities, including electronic crimes investigations and State and
local cyber crime training'' would receive more than $108 million under
the terms of H.R. 240. A similar figure was not presented in the
explanatory statement for the fiscal year 2014 appropriation to allow
for definitive overall comparison, although the support for training
rose from $7.5 million in the fiscal year 2014 act to $12 million in
H.R. 240.
potential fiscal year 2015 funding lapse for dhs
The third scenario--a default option which will occur if neither of
the first two scenarios occur--is a lapse in annual appropriations for
the Department. DHS will be required to implement a shutdown furlough.
The events of October 2013 provide a reasonable understanding of this
case. The shutdown affected operations of different DHS components to
varying degrees. Roughly 85% of the Department's workforce continued
with their duties during the shutdown, because of exceptions identified
in long-standing interpretations of the Anti-Deficiency Act. Some DHS
employees were also recalled to work after the furloughs began on the
basis of unanticipated needs (such as disaster response activities) and
the enactment of an appropriations law that temporarily covered certain
personnel costs.
In the event of a lapse, DHS personnel who continue to work without
passage of annual appropriations or a continuing resolution generally
fall into two categories: Those whose activities are not funded through
1-year appropriations, and those whose work is necessary for the
preservation of the safety of human life or the protection of property.
The former generally continue to be paid as scheduled--contingent on
the availability of funds, whereas the latter are not paid while the
lapse in annual appropriations continues. Of DHS's estimated 231,117
civilian and military employees, nearly 200,000 were projected to be
exempted from the shutdown furlough, according to the Department. Most
of these employees relied on annual appropriations for their salaries,
and therefore were not paid during the funding lapse.
Among the components of interest today, only the Office of
Biometric Identity Management and Federal Protective Service under NPPD
continued to operate during the furlough with funding made available
through fee revenues and multi-year appropriations. Elements of the
Secret Service engaged in protection of persons and facilities and
NPPD's cybersecurity function continued to work in the absence of
annual appropriations.
Table 2 provides a breakdown of the initial exemption and furlough
data provided by DHS for the four components under discussion:\14\
---------------------------------------------------------------------------
\14\ A complete breakdown of DHS projected furloughs is available
in CRS Report R43252, FY2014 Appropriations Lapse and the Department of
Homeland Security: Impact and Legislation, by William L. Painter.
TABLE 2.--DHS PROJECTED INITIAL EXEMPTION AND FURLOUGH DATA FOR SELECTED COMPONENTS, FISCAL YEAR 2014 LAPSE
----------------------------------------------------------------------------------------------------------------
Projected
Employees Projected Projected % of
Component (as of 7/ Exempt Furlough Component
31/2013) Furloughed
----------------------------------------------------------------------------------------------------------------
U.S. Secret Service................................................ 6,537 6,003 534 8.17%
National Protection and Programs Directorate....................... 2,835 1,617 1,218 42.96%
Science and Technology Directorate................................. 469 20 449 95.74%
Domestic Nuclear Detection Office.................................. 115 6 109 94.78%
----------------------------------------------------------------------------------------------------------------
Source.--CRS analysis of DHS ``Procedures Relating to a Federal Funding Hiatus,'' September 27, 2013.
While DHS did not associate numbers of furloughed employees with
specific programs, the Department identified several activities that
would be subject to furloughs and curtailment of activities, including:
all non-disaster grant programs;
NPPD's Critical Infrastructure Protective Security Advisor
Program;
chemical site security regulatory program; and
research and development activities.\15\
---------------------------------------------------------------------------
\15\ ``DHS Lapse Contingency Plan Summary,'' September 27, 2013.
Provided by DHS Legislative Affairs.
---------------------------------------------------------------------------
Most of the research and development activities funded by S&T and
DNDO are performed by contractors. Even if its work was funded prior to
the shutdown, a contractor might be prevented from continuing its work
if it required access to a closed DHS facility or interaction with a
furloughed DHS employee. If the shutdown persisted for an extended
period, some contractors might suspend their work because of
uncertainty or cash flow issues.\16\
---------------------------------------------------------------------------
\16\ For additional information on how contracted work may be
affected by a lapse in annual appropriations, see CRS Report WSLG681,
What Would a Government Shutdown Mean for Federal Contractors?, by Kate
M. Manuel.
---------------------------------------------------------------------------
One difference from the consequences of the fiscal year 2013
shutdown would be in the CFATS program. Since DHS has received new
statutory authority to regulate chemical facility security,\17\ the
statute underlying chemical facility security regulation would remain
in force. The previous authority had a sunset date that was typically
extended each year in appropriations acts. In the prior shutdown, DHS
furloughed the staff of ISCD, which implements the program. If ISCD
staff were again furloughed, the regulatory program they implement
would pause, even though the statutory authority would continue in
force.
---------------------------------------------------------------------------
\17\ Pub. L. No. 113-254.
---------------------------------------------------------------------------
A lapse in annual appropriation and the shutdown furlough that
would follow could represent a disruption in certain DHS operations,
and potentially raise more obstacles to efficient management and
oversight than those raised by an interim continuing resolution.
I would be remiss if I did not close by noting that while I sit
before you today, the testimony I have provided would not have been
possible without the contributions of a number of my colleagues as
well, especially Clinton Brass, Jessica Tollestrup, Dana Shea, Daniel
Morgan, John Moteff, and Eric Fisher.
On behalf of CRS, thank you for the opportunity of appearing before
you today. I am happy to respond to your questions.
Mr. Ratcliffe. Thank you, Mr. Painter.
I now recognize myself for 5 minutes for questions.
Just a few days ago, President Obama announced the creation
of the Cyber Threat and Intelligence Integration Center, or
CTIIC, which will fall under the Office of the Director of
National Intelligence. The stated purpose of this new center
will be to integrate the intelligence community's cyber data
and share it with civilian agencies.
Mr. Ozment, I would like to start with you and ask if you
can discuss how DHS's NCCIC anticipates working with this new
center. Specifically, what do you anticipate the roles and
responsibilities will be for each?
Mr. Ozment. Thank you, Chairman.
As you know, NPPD and the NCCIC are not a part of the
intelligence community, nor is NPPD's NCCIC a law enforcement
organization. The CTIIC, the Cyber Threat Intelligence
Integration Center, is designed to address a specific problem:
The integration of intelligence from across intelligence
community agencies.
From the perspective to the NCCIC, the CTIIC will be a
supporting organization. The NCCIC is one of the operational
cybersecurity organizations, along with NCIJTF, the National
Cyber Joint Investigative Task Force, and U.S. Cyber Command's
Joint Operations Center.
The CTIIC will provide integrated intelligence in support
of the NCCIC's daily operations. From that perspective, the
CTIIC will help the NCCIC by providing that integrated
perspective.
Mr. Ratcliffe. Thank you, Mr. Ozment.
A question for you, Mr. Martin. In the past month, S&T has
published its visionary goals. You mentioned those five today
in your testimony. Is it S&T's intention to shape its research
agenda to align with these visionary goals? If so, what do you
envision as the right mix between basic research and the
applied science and engineering?
Mr. Martin. Thank you, Chairman.
It is the intention of the Directorate to shape its
portfolio based on these visionary goals. It is going to be a
split between research and development done to support the
operational needs of the component and a portion of the
portfolio to go towards Apex programs, which are mapped to
these visionary goals.
Our Apex programs take a more focused view at some pretty
critical problems in the Department. It is a mixture of both
basic and applied research. I can't give you exact amounts
because it depends on the maturity of the technology we are
looking at.
Ultimately, we want to have a relatively good mix of both
basic and applied research.
Mr. Ratcliffe. Thank you, Mr. Martin.
Dr. Gowadia, a question for you. Currently, as you know,
DHS is required by the SAFE Port Act to scan 100 percent of
containerized cargo at foreign ports of departure before that
is loaded onto ships coming to the United States. Currently,
DHS has requested waivers since 2012 because it has been unable
to reach that goal.
I want to know, do you think that, given that the Secretary
has requested these multiple waivers, is this law even
feasible, No. 1? No. 2, what are some of the recommendations
that you have for addressing the threat at foreign ports of
departure?
Ms. Gowadia. Thank you, Chairman Ratcliffe.
At the Department, we share your concern about the threat
of the use of a cargo container bringing a nuclear material to
our ports, and we have remained committed to make sure that
goods that arrive here are safe and secure before they are
released into the American public.
Our Secretary has directed us to take another look at the
100 percent overseas scanning mandate, and so we are doing that
in concert with our industry partners as well as with foreign
governments. This mandate cannot, of course, be implemented
without their engagement. We need to find a business model that
works for all of us to that end.
Also, DNDO has a fairly significant role to play, and we
collaborate with S&T to make sure that we are developing the
right technologies to be able to address this mandate.
That having been said, let me reassure you, sir, that 100
percent of cargo containers are scanned at our ports of entry
before they are released into the stream of commerce right here
in the United States.
So we are looking at this layered, disciplined approach to
attack the problem.
Mr. Ratcliffe. Terrific. Thank you, Dr. Gowadia.
Mr. Noonan, very quickly in my time remaining, can you
address Secret Service's relationship with DHS, with the NCCIC,
and how all that comes into play when investigating cyber
breaches?
Mr. Noonan. Yes, sir.
As a matter of practice over the last several years, when
we are engaged in a cyber investigation and we are working
together with a private-sector victim, we have our forensic
specialists that are working with that victim company, and we
are pulling out of those investigations evidence that is
important in that investigation.
When we pull out evidence in that investigation, we also
see the criminal tools that the criminal uses to gain access
and entry into those systems, we see the malicious code that
they use to insert in those systems. When these things are new
trends that we are observing, we take that information that we
glean out of that criminal investigation and we share that with
our partners at the DHS's NCCIC.
DHS's NCCIC, together with the Secret Service, will put
together a product. When we put this product together, we are
very concerned about the privacy of the victim company, so we
strip out everything related back to that company. We share
those cybersecurity matters through the NCCIC out to the rest
of infrastructure.
As a matter of fact, because US-CERT sits with the NCCIC,
US-CERT also pumps that same information out to the rest of a
number of CERTs around the globe, too. So we are getting those
cybersecurity concerns not just out to the critical
infrastructure here domestically, but we are also getting out
to our partners out there outside the borders of the United
States to better protect their systems from our criminal
adversaries that are taking advantage of our financial systems.
Mr. Ratcliffe. Thank you, Mr. Noonan.
My time has expired. The Chairman now recognizes the
Ranking Minority Member, Mr. Richmond, for his questions.
Mr. Richmond. Thank you, Mr. Chairman. I am going to yield
my time to the Ranking Member of the full committee, Mr.
Thompson.
Mr. Thompson. Thank you very much, Mr. Richmond.
We have had some very interesting testimony here today.
There is no question that cyber is a clear and present priority
as well as a danger for us as American citizens.
One of the things I want to highlight, though, is that if
we don't have a Department that is funded, a lot of the
missions we have talked about here today will suffer. So what I
want to give my time toward is to further elaborate on that 16-
day window that we are facing in terms of not having a funded
Department of Homeland Security.
Mr. Painter, you gave us three scenarios. I think all of
them, under any circumstance, gives pause for a Department that
really needs to get about its business of securing this
country.
What I am really concerned about, though, is the shutdown
possibility and what that does for us. Are you saying that S&T
would be one of those departments that would be impacted
disproportionately to others in terms of employees that would
be sent home?
Mr. Painter. Thank you for the question, Ranking Member
Thompson.
The analysis that was included in my testimony was based on
the shutdown furlough plan that was released for the October
2013 shutdown. As we approach the possibility of a lapse in
appropriations, the Department will release a similar plan that
will outline exactly how many employees are in each section and
who is likely to be furloughed.
However, one thing that the Department made clear in its
plan in 2013 and has been discussed is that the research and
development activities are not considered exempt under the
Antideficiency Act, and, therefore, those activities would be
shut down.
Mr. Thompson. Thank you.
Mr. Noonan, there is no question that our men and women in
the Secret Service do a wonderful job. We have been more than
supportive as a committee, but there are about 4,000 agents who
would be impacted if we don't have a budget at the end of this
month.
In your opinion, what effect would that have on the morale
of those men and women?
Mr. Noonan. Thank you for the question, sir.
I think a CR will inherently slow down the execution and
day-to-day operations of the Secret Service as it relates to
our cyber program. It will delay hiring. It will impact our
operations.
I think along with that, you know, I think the men and
women of the Secret Service are very dedicated to their
mission. At the end of day, we will get our mission done. But,
to your point, I think there will be a--obviously, there will
be some impact, of course.
Mr. Thompson. So the best way to get on with our challenge
is to have a budget so that we know how to plan and implement
accordingly. Thank you.
Dr. Ozment, how is the implementation of CFATS impacted by
this potential shutdown or lack of moneys for the Department?
Mr. Ozment. Ranking Member, I am here today to represent
NPPD. I will tell you, however, that I am the lead of our
cybersecurity programs, and, therefore, I am not confident that
I could give you the depth of answer that I would like to give
you on the CFATS program. So I will ask if we can respond to
your staff in more detail on that later.
If you are interested, however, I am happy to talk to you
about its impact on our cybersecurity programs.
Mr. Thompson. Go on.
Mr. Ozment. Thank you, Ranking Member.
Mr. Thompson. But get me the other information, too.
Mr. Ozment. Absolutely, sir.
Mr. Thompson. Okay.
Mr. Ozment. I am gravely concerned about the impact of a
shutdown on our cybersecurity efforts. NPPD will experience
three categories of significant impacts to our cybersecurity
mission if there is a shut down: To our operations, to our key
acquisition programs, and to our information-sharing
activities.
First, a shutdown will cause us to lose the support of over
140 staff in our NCCIC. Without these staff, the NCCIC's
capacity to provide a timely response to agencies or critical-
infrastructure customers seeking assistance after a
cybersecurity incident will be decreased, and we will be less
able to conduct expedited technical analysis of cybersecurity
threats.
Second, a shutdown will delay two acquisition programs that
are essential to protecting Federal agencies from cybersecurity
attacks and intrusions.
First is the National Cybersecurity Protection System,
otherwise known as EINSTEIN. We are currently ready to bring on
board new agencies for the protection of EINSTEIN 3. A shutdown
would prevent us from bringing on board those agencies and
essentially stop those agencies from receiving the protection
that they need from the cyber threats that are out there.
In addition, the Continuous Diagnostics and Mitigation
Program is on the verge of issuing a contract that will allow
Federal agencies to identify critical cyber vulnerabilities and
expedite their resolution. A shutdown would delay the issuance
of this award and again leave agencies unprotected and less
able to patch and be even cognizant of the vulnerabilities that
they have.
The final category of significant impacts would be to our
information-sharing activities. A shutdown would significantly
reduce the volume and timeliness of cyber threat information
that we are able to share with our Government partners and the
private sector. We will also be unable to bring on board new
companies as partners in information sharing and will be unable
to continue planning our next-generation information-sharing
capabilities that are necessary to make our information sharing
real-time and automated in order to enable us to combat highly-
sophisticated cyber threats.
Mr. Thompson. Thank you very much, Mr. Chairman, and I
appreciate your indulgence in allowing the question to be
answered. I yield back.
Mr. Ratcliffe. You are welcome.
The gentleman's time has expired.
The Chairman now recognizes the Ranking Minority Member and
gentleman from Louisiana, Mr. Richmond.
Mr. Richmond. Thank you, Mr. Chairman.
I will start with Dr. Gowadia, and I will continue where
the Ranking Member left off, which is, in the next 16 days, if
we don't do something to fund long-term the Department of
Homeland Security, how would that affect the work that the
Domestic Nuclear Detection Office does with local law
enforcement agencies as far as the alerts go?
Ms. Gowadia. Thank you, Mr. Richmond.
As far as responding to the alerts and alarms that come up
from our operational partners, we have actually established
that particular function as a mission-essential function. So,
with a skeletal staff, we will be able to support and answer
those phone calls, but it will be only with 10 civilian
personnel and about 5 military detailees. So it will be a
tremendous burden on the staff, sir.
Mr. Richmond. Now, let's talk about your fiscal year 2015
and 2016 budgets as far as acquisitions go. If we decrease your
budget for next year, how would that affect your acquisitions?
Ms. Gowadia. As you are aware, sir, we are a mission
support office. We buy detectors for our Customs and Border
Protection colleagues, TSA, Coast Guard. The big difference
between the 2014 budget and the 2015 budget, the President's
request, is a $37 million plug to get us in a position to buy
handheld detectors and identification systems for deployment in
the field.
Very specifically, the detectors that our CBP colleagues
have today are no longer supported by the vendor and have
reached the end of their service life. We need to replace them
so that we can make sure that commerce is not held up at the
ports while we wait to get the right detection technologies to
bear.
It is a tremendous operational burden on our CBP
colleagues, and so this is much-needed funds to make sure that
they are able to exercise their duties in the field.
Mr. Richmond. Which is very important to me and the
district I represent, considering that we have the Port of New
Orleans, Port of South Louisiana, Port of Baton Rouge, that, if
you add them up and make them one port complex, we are probably
No. 3 in the world, No. 1 in the United States.
As we continue to push trade and looming trade deals in
front of us, then this would be one example of really pushing a
trade deal but not putting the funds in a place to make sure
that we can get goods to commerce in a quick and orderly
fashion.
Mr. Martin, let me ask you almost the same question, that
if you don't have long-term funding or anticipated funding,
what do you think the long-term effects would be to the S&T and
First Responder programs, No. 1, if we fail to fund DHS; No. 2,
if we cut the budget?
Mr. Martin. Ranking Member Richmond, in a word, it is
disruptive. It is disruptive in the short term in that we can't
do the support work for the State and local first responders
that we do. It also puts a level of uncertainty in our research
and development. It is very difficult to turn research and
development on and off.
It is also very difficult to start and stop contracts that
do a lot of our research work. Probably one of the longer-term
effects of this is we lose confidence of small business, of
universities, of National labs to do work with the Federal
Government. If we can't have stable budgets and sustained
funding to support these programs, we lose the confidence of
those groups to do work with us.
From the first-responder perspective, it is going to be
difficult for us to maintain any level of direct support for
equipment testing, for any type of research or knowledge
products we develop to move to them. To be able to keep that
level of confidence in the responders of the work we do
requires a stable budget.
Mr. Richmond. Then I guess the common theme I am hearing is
that, although we would not fund you all and you all would be
disrupted and you would make do the best you can, the local law
enforcement agencies around the country, the State and locals,
would really be, for lack of a better description, left out
there on their own because they can't rely on your support and
help that you normally offer them.
So, with that, Mr. Chairman, I would just like to say that
I think that, you know, it is very critical that we fund it. I
know that both sides differ much on immigration, and we will
fight on immigration, and it is a legitimate difference of
opinion. But I think that their testimony highlights the fact
that we should not jeopardize the safety of the country over
that one fight, which we will continue to embark on.
So, with that, Mr. Chairman, thank you for your time, and I
yield back.
Mr. Ratcliffe. The Chairman thanks the gentleman.
The Chairman will now recognize other Members of the
subcommittee for questions they may wish to ask the witnesses.
I would like to recognize the gentleman from Florida, Mr.
Clawson.
Mr. Clawson. Thank you.
Thanks for coming, you all. I am always appreciative for
folks who show up and have to get in the middle of our big
battles that we have up here.
You know, I have spent a lot of time in boardrooms, not a
lot of time in these committees meetings. You know, I was
always surprised--the way we do things, the witnesses come,
they get in the middle of this partisan bashing. So if they get
the wrong question, they don't want to answer it because it
will make their side look bad; if they get the right question,
then they want to answer. Then we just dig the divide between
the two sides bigger and bigger. We don't learn anything as a
result of that because we have a hard time getting to full
disclosure because we are too busy being partisan.
I fly over that, or at least I try to. I appreciate you all
coming today. I hope you will be as open as we can because I
don't want to pick a partisan bone here. I think it is a waste
of time. We will have that fight another day, and that will be
a different conversation.
But I did want to pick your brain about a couple of things
that I am interested in as I did the study here. It feels
blurry to me on where the line is between private companies,
private data, private people, and our own defense of
cybersecurity. So I am curious, you know, how many different
agencies get involved with our private companies? What are the
limits of that? What is the kind of data that our Federal
agencies should be asking for?
If you put yourself in the position of somebody who is
running a company, who has fiduciary responsibility not just to
the community but also the privacy of customers, employees,
fiduciary responsibility to shareholders, kind-of, what is the
right answer to all that? As the stakes get higher here and we
get more and more unsafe, who gets to decide?
So two or three of you I am sure have strong opinions on
this, and I would objectively just like your objective
viewpoint on it. Whoever would like to start first, I would
really like it.
Mr. Noonan. Yes, sir.
As far as law enforcement goes and working with our
private-sector partners, it is really a two-way street of
working with the victim company. A lot of times, it is the
Secret Service and/or law enforcement that goes to the private
sector when there is an incident, when there is a data breach,
and we are the ones actually giving them information about the
data breach and showing them where that data breach is.
Mr. Clawson. What if it is not somebody who has been a
victim? I mean, don't we involve companies on a broad scale for
prevention?
Mr. Noonan. Absolutely. So, As a matter of fact, we are
partnered with private-sector partners through our Electronic
Crimes Task Forces. In those Electronic Crimes Task Forces, we
have quarterly meetings with the private sector, and we share
ideas on criminal trends, on how to better protect themselves--
--
Mr. Clawson. Is that mandatory participation?
Mr. Noonan. Not on the private sector's part. On the
Government's part, it is.
Mr. Clawson. What percentage of our private sector
participates? Is it enough to really make a dent on this for
what you all are trying to accomplish?
Mr. Noonan. So, as it relates to our Electronic Crimes Task
Forces, it depends on the city that we are in. There is no
mandatory requirement, of course, for the private sector to
belong to those.
In addition to that, we also send out industry notices to
the private sector to better help them defend themselves from
what we are seeing as the critical threat or the brand-new
threat that is coming out and arising in those situations.
Mr. Clawson. If you had to grade the private sector, 1 to
10, about the kind of cooperation and participation that you
are getting for disaster prevention, what would you give the
grade?
Mr. Noonan. I would give it a rather high grade as far as
working in the financial services sector in relation to the
work with law enforcement in prevention of those different
matters that you just brought up.
Mr. Clawson. In other industries?
Mr. Noonan. In other industries--I am not too involved with
many other industries. The retail sector, obviously, over the
last year, has become more engaged in information sharing with
law enforcement and more engaged with the Government in that
fashion.
Mr. Clawson. Dr. Ozment.
Mr. Ozment. Thank you, Congressman.
To your beginning point, I think it is worth noting that
cybersecurity is one of the critical threats our Nation will
face in the 21st Century. Given that, I believe almost every
Government department and agency will ultimately have a role in
cybersecurity as their traditional work moves on-line and every
agency has to work with the private sector as they normally
engage.
So you will see, as you already do, the Secret Service
engaging in electronic crimes, cybersecurity in their law
enforcement capacity; sector-specific agencies, like the
Department of Energy or Treasury, engaging with the sectors
that they engage with, focusing on helping them in their
cybersecurity; and, of course, the Department of Homeland
Security looking at cross-sectors, trying to build the security
and resilience of the American economy and our critical
infrastructure.
I would like to highlight--you mentioned concerns about the
protection of private-sector information--that the Department
has a Congressionally-legislated program called Protected
Critical Infrastructure Information, or PCII. Organizations,
companies that share information with the NCCIC, for example,
that request PCII protections are protected against civil
litigation, Freedom of Information Act laws at either the
Federal or State level, and from the disclosure of that
information to their regulators.
We have many information-sharing partners and many
companies who are participating, increasing the National
security, and also helping each other and themselves by being a
part of information-sharing efforts.
Nonetheless, I think it is important that we pass
additional cybersecurity information-sharing legislation. The
administration's cyber threat indicator sharing proposal is
carefully tailored to ensure that privacy and civil liberties
are protected while getting the very tactical threat
information that we need to protect ourselves and our companies
and our economy to the folks that need to use it to protect
themselves.
Mr. Clawson. I hope we can have on-going conversations so
that we can get the right balance here, because it very much
concerns me that we will overreact and that individual
customers and companies and folks will bear the price for that.
I yield back since I am over time. Sorry about that.
Mr. Ratcliffe. The gentleman's time has expired, but I
thank the gentleman from Florida.
I would also like to thank our panel of witnesses for your
very valuable testimony. I would like to thank the Members
present for their questions.
I know that some Members of the subcommittee may have
additional questions for the witnesses, but we are about to be
called to vote, and I know that we have some events after the
vote that would preclude continuing the hearing. So, instead,
we will ask you to respond to any questions in writing.
Pursuant to the committee rule 7(e), the hearing record will be
held open for 10 days.
Without objection, the subcommittee stands adjourned.
[Whereupon, at 4:00 p.m., the subcommittee was adjourned.]
A P P E N D I X
----------
Questions From Ranking Member Bennie G. Thompson for Andy Ozment
Question 1a. Please describe the status and activities of the CFATS
regulatory program under the second and third budget funding scenarios
given by CRS testimony today. In other words, describe in detail all
the activities, new or continuing, that would be curtailed, or not
curtailed under:
Another CR, or short-term funding, and
Question 1b. Under a DHS-wide or Government-wide shut down.
Please include detailed metrics.
Answer. Prior to the Protecting and Securing Chemical Facilities
from Terrorist Attacks Act of 2014 (the CFATS Act of 2014), the
Chemical Facility Anti-Terrorism Standards (CFATS) program was
authorized through the appropriations process; accordingly, when the
Federal Government faced a funding hiatus in 2013, the Department's
authority to implement the Chemical Facility Anti-Terrorism Standards
lapsed as well. It is not clear whether, had it been necessary, the
Department would have had the authority to take enforcement action
during the period of this lapse. With the enactment of the CFATS Act of
2014, the uncertainty surrounding the Department's authority has been
lifted. Regardless of whether the employees responsible for
administering the program would have been furloughed in the event of a
funding lapse this year, facilities with approved security plans in
place would have been required to implement those plans.
Had DHS not received funding and if the majority of CFATS program
employees had been furloughed, the CFATS program might have seen an
adverse impact to several high-priority activities. The program is
currently working through a backlog of unapproved Site Security Plans,
and a temporary stop to the CFATS program might have negatively
impacted the number of facilities that would have been approved and
therefore legally obligated to implement their security plans. For
every week that CFATS inspection and Site-Security-Plan review
activities might have ceased to occur during a funding hiatus, 20-30
additional high-risk chemical facilities that might otherwise have been
required to implement anti-terrorism security measures might have gone
unprotected against terrorist attack. Additionally, for every week of a
shut down, DHS might have been unable to authorize approximately 35 to
40 security plans, conduct approximately 25 to 30 inspections of high-
risk facilities, or issue nearly 30 final tiering letters.
A shut down might also have delayed the work being done to achieve
the deadlines laid out in the CFATS Act, including the development of
an outreach plan to identify potentially high-risk facilities that have
not complied with their obligations under CFATS, whistleblower
protection measures, and guidance for the regulated community on the
Expedited Approval Program. Other impacts might have included delays to
the development of information-sharing tools for first responders being
created as part of Executive Order 13650, delays in rulemaking work
being done to update the CFATS program, and delays in efforts to make
improvements to the CFATS risk-tiering methodology.
Questions From Hon. James R. Langevin for Andy Ozment
Question 1a. Signature-based threat detection is, by its very
nature, reactive. Using robust information sharing and a broad network
of intrusion detection and prevention systems, DHS can help ensure that
exploits directed at Federal networks are one-offs--that is, they can't
be reused. However, discovering the initial zero-day that a nation-
state adversary or cyber terrorist uses against us presents a different
problem. The incorporation of threat intelligence from the IC into E3A
(Einstein 3 Accelerated) is one way to expand the base of threat
indicators, but even E3A is only as good as the information it is fed.
How is NPPD addressing this challenge?
Answer. DHS intends to detect and block threats using three legs of
a stool: Signature-based systems to block threats, analysis systems to
identify new threats, and information sharing to disseminate threat
information and to gather information for analysis.
As you note, intrusion detection and prevention systems are only as
good as the information they have about ``bad'' traffic, which is
recorded as ``signatures.'' Signature-based systems are a necessary
tool: Once we know about a threat, we use signature-based systems to
block it rapidly and in a way that can scale across the whole
Government. While signature-based tools are necessary, they are not
sufficient. As you note, to detect and defend zero-day threats, we also
must be able to detect new threats, traffic, or access that we don't
already know is ``bad.'' Those capabilities are built into our plans
for the National Cybersecurity Protection System (NCPS), of which
EINSTEIN 3 Accelerated (E3A) is one part.
The second leg of the stool is analysis. We will combine into NCPS
the information that we gather from EINSTEIN 1, EINSTEIN 2, and
EINSTEIN 3 with information that we will obtain from other programs
like Continuous Diagnostics and Mitigation (CDM), other Government
agencies, and information shared by the private sector. We will then
use ``big data analytics'' to look at that information, identify
anomalies and patterns, and detect new threats. Once we have identified
previously-unknown threats, we will create signatures and push them out
to E3A to block those threats. To complement this big data analytics
approach, we are also exploring options to build adaptive analysis
solutions into E3A itself, as described in the response to the next
question.
The third leg of the stool is information sharing. When we learn
about new threats, we will push the corresponding cyber threat
indicators out to other Government agencies and the private sector in
near-real time: At machine speed. By sharing these indicators, we will
greatly reduce the likelihood that an adversary can re-use attack
infrastructure, tools, tactics, techniques, and procedures. This means
we increase the adversary cost, and decrease the likelihood, of
successful attacks.
Our vision of a ``weather map'' describes this planned approach--
and we are already in the process of implementing this vision. The
vision includes: (1) Bringing together into NCPS the data from the
EINSTEIN sensors, CDM, our Government partners, and information shared
by the private sector; (2) visualizing that data to aid in situational
awareness and analysis; (3) analyzing that data to detect and
potentially anticipate malicious actors, and (4) sharing the resulting
cyber threat indicators back to our Government partners and the private
sector, thus creating a virtuous circle. As in all of our activities,
we will incorporate the strong privacy and civil liberties protections
and oversight that are already described in our Privacy Impact
Assessments, which are publicly available at dhs.gov.
Question 1b. Are there other paradigms for detection that don't
rely on foreknowledge of a threat?
Answer. Threat actors continually modify their attacks and are
using increasingly targeted, clandestine, and dedicated techniques. As
a result, we must build upon our signature-based approaches with
solutions that will detect previously-unknown malicious activity. One
solution as described in the response to the previous question, is to
use big data analytics. In addition, we are currently exploring options
to build non-signature based capabilities into E3A.
The Advanced Countermeasures and Automated Analytics Project
utilizes the E3A Traffic Aggregation service to offer capabilities that
blend speed and flexibility to detect advanced cyber threats, execute
countermeasures to stop those threats from reaching their target, and
increase the real-time and rich information sharing with departments
and agencies. (E3A offers two services: Traffic Aggregation and
Intrusion Prevention Security Service.)
This prototype uses computational intelligence algorithms and
automated detection methods to identify and quantify anomalous
behaviors, and employs tools and techniques to support threat-driven
pattern recognition and ``learning'' algorithms.
Question 2a. I believe that convening stakeholders to help
establish standards and encourage their adoption is an excellent way to
leverage Federal investments in improving cybersecurity practices. DHS
has played a vital role in the development of the STIX/TAXII system and
in the deployment of the NIST Cybersecurity Framework (through the C3
Voluntary Program).
How can DHS continue to build upon these successes?
Answer. Voluntary cybersecurity standards and guidance through non-
regulatory agencies such as NIST help private-sector entities to
improve their own security.
DHS's Critical Infrastructure Cyber Community (C3, pronounced ``C-
Cubed'') Voluntary Program is an innovative public-private partnership
led by DHS as part of its continuing outreach and collaboration with
the civilian government, State, local, Tribal, and territorial (SLTT)
partners. The C3 Voluntary Program helps to align critical
infrastructure owners and operators with existing resources that assist
their efforts to manage their cyber risks, including through the use of
the Cybersecurity Framework. It also facilitates forums for knowledge
sharing and collaboration; provides access to free and readily-
available technical assistance, tools, and resources to strengthen
capabilities to manage cyber risks; and offers opportunities to
exchange opinions with peers and other partners in the critical
infrastructure community.
For the past 3 years, DHS has led the development in collaboration
with the private sector of specifications--known as STIX and TAXII--
which standardize the representation and exchange of cyber threat
information, including actionable cyber threat indicators. STIX, the
Structured Threat Information eXpression is a standardized format for
the representation and exchange of cyber threat information, including
indicators. TAXII, the Trusted Automated eXchange of Indicator
Information, is a standardized protocol for discovering and exchanging
cyber threat intelligence in STIX.
As you note, the STIX data format and the TAXII transport method
are increasingly compatible with commonly-used commercial information
technology (IT) products including platforms, network protection
appliances, and endpoint security tools.
The Enhance Shared Situational Awareness (ESSA) initiative has
chosen STIX as the basis for sharing cyber threat indicators between
the Federal cyber centers, ensuring interoperability between these key
sources of information. While the NCCIC has in-house systems and tools
to assist analysts in generating STIX indicators, those indicators are
currently analyzed and filtered by human analysts and shared back out
with the private sector and Federal partners through manual methods
such as e-mail and secure portals.
In 2014, the National Cybersecurity and Communications Integration
Center (NCCIC) began a limited pilot with several organizations to test
automated delivery of STIX indicators via TAXII and is currently
executing a number of activities to expand automated cyber threat
indicator-sharing capabilities. This means more entities are able to
send indicators automatically to the NCCIC, creating an ecosystem of
indicators which will in turn provide greater context to malicious
cyber activity and rapidly increase situational awareness.
Intentionally adaptable, the Cybersecurity Framework and the STIX/
TAXII protocols reflect a commitment to empowering Government and
private-sector entities to manage and mitigate their own cybersecurity
risks, with DHS as a coordination point and resource. DHS's NCCIC has a
unique role as the center of integration, a hub for information sharing
and collaborative analysis of global cyber risks, trends, and
incidents.
Our leadership role lies in protecting civilian government systems
and helping the private sector protect itself. In the future, we look
to make tailored information sharing as effective as possible through
voluntary collaboration. DHS looks to continue to correlate data from
diverse sources in an anonymized and secure manner, to maximize
insights and inform effective risk mitigation.
Question 2b. What are other areas that the Department sees as ripe
for this kind of collaboration?
Answer. Today American adversaries exploit a fundamental asymmetry
in our network infrastructure: While nearly all of our systems and
networks are globally interconnected, our defensive capabilities are
not. This gives the attackers an advantage as they can find and exploit
the weak links in our systems from anywhere around the world--at
machine speed. By sharing cyber threat indicators in near-real time, we
reduce that asymmetry. As the President's Executive Order 13691
reflects, DHS and our partners are working together to find new and
better ways to share accurate, timely data, including cyber threat
indicators, in a manner consistent with fundamental American values of
privacy, confidentiality, and civil liberties.
Question 3. Private industry and private researchers regularly make
important cybersecurity discoveries such as software vulnerabilities or
active malware campaigns. However, because even white hat security
research often involves essentially ``breaking in'' to secure systems,
some researchers are concerned that they could be subject to
prosecution under anti-hacking statutes.
How can we ensure that needed security research is not chilled by
these necessary laws?
Answer. The Department of Justice is best positioned to address
questions specifically pertaining to the Computer Fraud and Abuse Act
(CFAA), 18 U.S.C. 1030. That criminal statute is part of a relevant
exception to application of the Digital Millennium Copyright Act
(DMCA), 17 U.S.C. 512, 1201-05, 1301-1332, and 28 U.S.C. 4001,
specifically 17 U.S.C. 1201(g)(2).
The current statutory structure appears to be predicated upon the
``white hat'' researcher's gaining a copy of the protected copyrighted
work after attempting to acquire or actually acquiring the permission
of the owner of the data which is being protected by a cybersecurity
system.
The cybersecurity research programs within the Science and
Technology Directorate of the Department of Homeland Security complies
with the CFAA and the DMCA its work to date has not been hampered by
potential CFAA or DCMA liability. However, on occasion, DHS
cybersecurity program officials have been informed by certain
individuals performing academic research that their research has been
limited by the refusal of certain entities using cybersecurity systems
to permit research on the robustness of those systems.
The Department of Homeland Security believes that robust research
is an important driver of improved public safety, security, and social
progress and that the law must offer researchers the opportunity to
carry out their research free from the fear of legal liability in the
absence of being able to obtain permission.
Additionally, at the time the DMCA was designed, it was a commonly-
held view that cybersecurity systems were in place to primarily protect
against copyright violations. As our world becomes increasingly
digitized, other areas such as protection of the electric grid, other
infrastructure operational data, or, on an individual basis, research
into the emerging area of cyber-physical systems or the ``Internet of
Things,'' which consists of research into the vulnerabilities of the
increasing computerization of devices, such as automobiles and medical
devices, can touch us increasingly both as a society and as
individuals.
As a society, we must understand all such cybersecurity
vulnerabilities, analyze the impact of the current law, particularly
the DMCA and CFAA, and design a framework to assure an atmosphere that
gives research the best chance to succeed while assuring the rights of
the owners of the protected systems, the personally identifying
information, and societal interests at stake.
[all]