1
00:00:03,820 --> 00:00:09,180
...defense at the edge of a network that begins with a soldier in the foxhole and vice versa.

2
00:00:09,740 --> 00:00:14,040
We're trying to move from a smart push to a smart pull system.

3
00:00:14,220 --> 00:00:15,960
Smart push, think of a telephone.

4
00:00:15,960 --> 00:00:20,400
I need to know not only where you are, but what you need to know in order to convey the information.

5
00:00:20,620 --> 00:00:24,980
Smart pull says I probably don't know where you are and I certainly don't know what you need to know.

6
00:00:24,980 --> 00:00:29,420
So we'll use the network to provide the information for you to gather it.

7
00:00:29,420 --> 00:00:42,600
The basic thing we're trying to get to is to take data and turn it into information, and turn it into knowledge, and turn it into understanding, and then into action as quickly as possible in near real time if we can.

8
00:00:43,220 --> 00:00:47,100
And the point of this, it's not just material, we're not just talking about the networks.

9
00:00:47,320 --> 00:00:55,220
We're talking about you have to change the doctrine by which new business, we have to reorganize the way we are set up, we have to train our people.

10
00:00:55,220 --> 00:01:06,540
Obviously there's some material pieces, there's a key leadership piece, we need to get the personnel in place to be trained to do this, and we have to have the facilities and the infrastructure to support it.

11
00:01:06,540 --> 00:01:13,580
So all of this needs to be evolved together in order to get the objective we're looking for.

12
00:01:13,680 --> 00:01:16,940
The mission I think is more complex than a lot of people realize.

13
00:01:16,940 --> 00:01:26,280
It's not just war fighting, it's a mix of that, of course, plus business, plus intelligence, plus logistics, and also increasingly importantly peacekeeping.

14
00:01:26,540 --> 00:01:33,980
I was in Afghanistan in January talking with people in the provincial reconstruction teams working with the Afghan provinces.

15
00:01:33,980 --> 00:01:37,920
We did a lot with the tsunami relief efforts in Southeast Asia.

16
00:01:37,920 --> 00:01:41,300
We've had people supporting relief efforts in Darfur.

17
00:01:41,300 --> 00:01:44,600
All of this relies on the same network we're talking about.

18
00:01:45,420 --> 00:01:54,060
A point to be made is that when we do get to combat, it's a fundamentally different sort of thing than one might have expected in the past.

19
00:01:54,120 --> 00:01:57,380
Several people now talk about something called the three-block war.

20
00:01:57,520 --> 00:02:05,200
You're engaged in peacekeeping on one block, you're putting down a riot on the next, and you're engaged in full-fledged combat operations the next.

21
00:02:05,200 --> 00:02:12,140
It's not the clear kind of distinction most of the planning and most of the people are used to in terms of the phases of operations.

22
00:02:12,440 --> 00:02:26,160
People also talk about something called a strategic corporal, meaning that decisions made by people at every level at this point get into the newspapers, get into the CNN, get into whatever, and they become sort of national issues very quickly.

23
00:02:26,180 --> 00:02:34,940
So in short, the whole structure, the whole hierarchical structure, is breaking down to a much flatter, much more networked, much more dynamic organization.

24
00:02:36,540 --> 00:02:52,520
There are a lot of things in the security field that relate to what industry is doing, but frankly there's a scale and a complexity and perhaps even a sort of stakes issue here that doesn't really reflect a lot of what industry has.

25
00:02:52,600 --> 00:02:57,240
We have people whose lives literally are on the line today, depending on the network.

26
00:02:58,140 --> 00:03:03,380
Somebody described DoD as being just like Walmart, except that...

27
00:03:04,180 --> 00:03:05,540
Yo, Walmart!

28
00:03:05,540 --> 00:03:06,380
Okay.

29
00:03:08,040 --> 00:03:13,960
Except that every store is mobile, the competition fires ordnance at you, and Christmas comes randomly on any given day.

30
00:03:15,140 --> 00:03:17,580
So, other than that, we're more or less the same.

31
00:03:18,080 --> 00:03:23,080
We have this thing on which, of course, the key to network-centric operations, you've got to have a network.

32
00:03:23,500 --> 00:03:30,700
And the basis of this is something we call the Global Information Grid, or GIG, since we're addicted to acronyms.

33
00:03:31,960 --> 00:03:44,980
And there are six major programs that comprise this GIG, and it's not just material, it's also the people and processes who store, process, transmit, add value to information across the department.

34
00:03:45,360 --> 00:03:49,020
So, four of the programs deal with the transport of information.

35
00:03:49,620 --> 00:04:01,260
One deals with enterprise services, and I've just come from a very sobering talk from Scott Sender on vulnerabilities of network services.

36
00:04:01,820 --> 00:04:04,680
And one deals with the information assurance of the network.

37
00:04:04,680 --> 00:04:07,740
By the way, I'd like to talk for about 30 minutes, then I'll open it to questions.

38
00:04:08,800 --> 00:04:11,440
The program's first four deal with transport.

39
00:04:11,440 --> 00:04:13,360
One is a terrestrial fiber net.

40
00:04:13,360 --> 00:04:21,280
We call it the GIG bandwidth expansion, 10 gigabit per second, OC192 fiber, to the 80 largest command and control nodes around the world.

41
00:04:21,280 --> 00:04:24,700
That'll be full operational capability by the end of this year.

42
00:04:25,280 --> 00:04:37,840
The second is to extend this global network to mobile units, and that's a transformational satellite that's going to take lasers around the satellite ring to give you, again, 10 gigabits a second anywhere on the planet.

43
00:04:38,680 --> 00:04:49,700
One of the purposes of that is to use laser uplinks from aircraft, so we won't have to use so much spectrum to exfiltrate the data from the various kinds of reconnaissance sensors on the aircraft.

44
00:04:49,940 --> 00:04:54,160
The third piece of transport is something called the Joint Tactical Radio System.

45
00:04:54,160 --> 00:05:07,720
It's a software-defined radio, software-controllable architecture, and that's designed to provide the mobile routers on the IP mobile networks in order to bring these capabilities to the tactical units.

46
00:05:07,740 --> 00:05:13,700
Finally, there's something called teleports that links the ground infrastructure with the on-orbit infrastructure.

47
00:05:13,700 --> 00:05:18,200
So that's kind of the very heterogeneous network we're talking about.

48
00:05:18,200 --> 00:05:25,260
It's 10 gigabit per second, stable, to 10 kilobit per second, very unstable in tactical mobile environments.

49
00:05:26,140 --> 00:05:35,000
The enterprise service, Net-Centric Enterprise Services, is basically beginning to take you to a software as to a service-oriented architecture.

50
00:05:35,000 --> 00:05:36,960
I'll talk more about that in a bit.

51
00:05:36,960 --> 00:05:42,240
And then there's a whole information assurance program called the Gig Information Assurance Program.

52
00:05:42,240 --> 00:05:49,500
We spend about $2.2 billion a year in DoD and with NSA on the security of the network.

53
00:05:52,410 --> 00:05:58,410
One of the pieces we're trying to work on is to move from this stable environment to a tactical environment.

54
00:05:58,410 --> 00:06:07,270
This perhaps is something that a lot of the commercial analogies break down because we have to be able to handle very dynamic environments.

55
00:06:07,270 --> 00:06:16,250
Of course, the cell phone environment is dynamic also, mobile, but here with people jamming, shooting, very kind of severe environmental conditions.

56
00:06:19,440 --> 00:06:27,760
The paradigm that goes with this is a movement from need to know, which is kind of hoarding the information, I own it, to need to share.

57
00:06:27,760 --> 00:06:32,120
You're not going to get the value of the network until you get the information out on the network.

58
00:06:32,300 --> 00:06:37,120
And this is much more of a policy and a cultural thing than actually a technological thing.

59
00:06:38,340 --> 00:06:40,400
A couple people issues come to mind.

60
00:06:40,400 --> 00:06:51,780
In 1996 or 7 or so, I went up to New York and listened to a group of presentations by a series of analysts from the computer security industry talking to people on Wall Street.

61
00:06:52,360 --> 00:07:02,240
And so there's maybe a certain amount of hype in the presentations, but what I took away was, we, industry, can provide you, customer, with any level of security you want.

62
00:07:02,760 --> 00:07:05,520
But we need from you three things.

63
00:07:05,520 --> 00:07:10,560
We need to have a commitment from the top of your organization that security is important.

64
00:07:11,640 --> 00:07:25,240
We need to have you spend the resources, and by resources I don't mean the one-time procurement of firewalls and guards, but the ongoing expenditures to maintain near real-time situational awareness of what's going on in your networks.

65
00:07:25,880 --> 00:07:29,340
And you've got to be willing to drop the hammer on people who don't play by the rules.

66
00:07:30,240 --> 00:07:34,860
And I'd say in government at this point, we've done a pretty good job at conveying that security is important.

67
00:07:35,020 --> 00:07:37,400
God knows we're spending a lot of money on the problem.

68
00:07:37,500 --> 00:07:41,260
We have not done a good job in dropping the hammer on people who don't play by the rules.

69
00:07:41,340 --> 00:07:52,080
It's a lot easier for me right now to get a security violation by leaving my safe open than it is by posting my password on my computer or letting an unauthorized modem be attached to my network.

70
00:07:52,080 --> 00:07:53,740
We need to work on that.

71
00:07:55,700 --> 00:08:02,360
NSA has done a terrific job in putting together a new information assurance architecture for the gig.

72
00:08:03,020 --> 00:08:04,960
And this is being driven by several factors.

73
00:08:04,960 --> 00:08:11,540
I mean, obviously the environment is changing, the paradigm security is changing, moving network-centric operations.

74
00:08:12,020 --> 00:08:16,300
But we also have to pay a lot more attention to the insider threat.

75
00:08:16,300 --> 00:08:24,860
If you look at our major espionage cases over the past 25 years, almost every single one of them had their security clearances before they went bad.

76
00:08:25,200 --> 00:08:29,100
We focus a lot on the perimeter of the problem, keeping the bad guys out.

77
00:08:29,160 --> 00:08:34,960
The issue is we have to be able to detect anomalous behavior in the network and respond to it.

78
00:08:35,160 --> 00:08:40,120
I heard today from Paul Simmons of Jericho Forum the term deperimeterization.

79
00:08:40,340 --> 00:08:44,700
And I look forward to learning more about that because I think that's some description of where we're going.

80
00:08:45,140 --> 00:08:49,340
So there are five concepts, you will, in this new information assurance architecture.

81
00:08:49,340 --> 00:08:54,740
One is to separate the protection of the information from the protection of the infrastructure.

82
00:08:55,400 --> 00:09:00,060
Another is the end-to-end protection of information through enhanced access controls.

83
00:09:00,060 --> 00:09:09,680
We need to have strong identification and authentication, which is absolutely critical to being able to do security based on policy-based access.

84
00:09:10,100 --> 00:09:13,140
We've got to have enhanced misuse identification.

85
00:09:13,420 --> 00:09:15,040
For example, Visa and MasterCard.

86
00:09:15,040 --> 00:09:20,020
I was in Kuwait a couple of months ago and I went to buy my wife some jewelry.

87
00:09:20,060 --> 00:09:22,980
So I swiped the first card and it went through.

88
00:09:23,020 --> 00:09:25,760
Second time it went through and said, ah , denied.

89
00:09:25,940 --> 00:09:30,160
So we pulled the string on and it turned out, of course, they said, well, last Saturday you were in Virginia.

90
00:09:30,160 --> 00:09:31,140
Now you're in Kuwait.

91
00:09:31,140 --> 00:09:32,800
You never told us you're going overseas.

92
00:09:32,860 --> 00:09:34,060
Is this really you?

93
00:09:34,200 --> 00:09:35,260
And I appreciate that.

94
00:09:35,260 --> 00:09:42,480
On the one hand, if they can do this sort of thing on the basis of hundreds of millions of transactions, why can't we do this in our network?

95
00:09:42,480 --> 00:09:59,200
But it was pointed out to me on several occasions, most recently today, the problems we're looking about detecting anomalous behavior inside a military network are perhaps qualitatively different than those on just credit card transactions.

96
00:09:59,200 --> 00:10:14,380
If you want to ask why is Wells trying to hack into the Secretary of Defense's computer at midnight, if you want to say why is the Southeast Asian analyst all of a sudden more interested in Cuba, I submit that's a more complicated problem than just a transaction in a different physical location.

97
00:10:14,500 --> 00:10:17,060
And some of these, in fact, may not even be solvable problems.

98
00:10:17,060 --> 00:10:20,200
We need to understand just what the limits are of what we can do.

99
00:10:20,520 --> 00:10:26,240
So the fourth piece of these five characteristics is enhanced computer network defense.

100
00:10:26,260 --> 00:10:33,140
And I'll talk a little bit more in a minute about something called the Joint Task Force Computer Network Operations that's recently been set up.

101
00:10:33,460 --> 00:10:38,500
But basically it's improved detection, correlation of data, and visualization of data.

102
00:10:39,060 --> 00:10:42,300
Fifth point is we need very aggressive research and development.

103
00:10:42,560 --> 00:10:44,620
These are going to be different problems.

104
00:10:44,620 --> 00:10:48,140
We're building really for the world of 2012 to 2015.

105
00:10:50,020 --> 00:10:52,000
And they're not going to be solved in the near term.

106
00:10:52,000 --> 00:10:55,520
So first of all we have to stay abreast of the changing threat.

107
00:10:56,040 --> 00:11:03,200
But some examples of the really high-end computing that are going on, or high-end R&D, a lot of work in quantum computing.

108
00:11:03,900 --> 00:11:14,860
As Feynman said at one point, by the time every bit gets down to an atomic scale, then you're going to be at quantum principles whether you like it or not.

109
00:11:14,920 --> 00:11:20,180
And so as Moore's Law progresses, we're going to be driven to quantum computing whether we like it or not.

110
00:11:20,460 --> 00:11:38,900
Some of the breakthroughs recently, or some of the developments recently, much more control over single photons, the ability to separate electrons into separate streams based on their spin, the ability to combine information from multiple atoms onto a single photon,

111
00:11:38,900 --> 00:11:43,980
and the building of the first quantum registry with progress made towards a quantum gate.

112
00:11:44,020 --> 00:11:47,060
So that's a fairly aggressive program.

113
00:11:47,340 --> 00:11:47,980
DARPA.

114
00:11:48,020 --> 00:11:54,540
www.darpa.mil They have a strategic plan there which I encourage anybody interested to take a look at.

115
00:11:54,700 --> 00:11:58,180
Some of the things they're looking at are self-forming, self-healing networks.

116
00:11:58,180 --> 00:12:01,000
They've already made a lot of progress in tactical environments.

117
00:12:01,000 --> 00:12:17,980
There's a lot of questions about whether, in these dynamic networks, TCP, for example, is an acceptable protocol just because the overhead associated with all the handshaking is so high that we may not be able to get enough throughput.

118
00:12:17,980 --> 00:12:19,520
So we're looking at alternatives.

119
00:12:19,520 --> 00:12:21,460
Chips scale atomic clocks.

120
00:12:21,560 --> 00:12:28,120
200 times increase in power and size.

121
00:12:28,500 --> 00:12:31,060
300 in power, 200 in size.

122
00:12:31,200 --> 00:12:42,720
And then a lot of work on hybrid optical and RF connections so we can get much more robust, smaller units in the field to let us get around bandwidth limitations.

123
00:12:44,120 --> 00:12:51,640
So there's an awful lot of stuff going on and I think we're making some progress but obviously we don't have all the answers.

124
00:12:51,640 --> 00:12:54,800
I mentioned the Joint Task Force Global Network Operations.

125
00:12:54,800 --> 00:13:10,780
This was changed last year from the Joint Task Force Computer Network Operations because we're expressly trying to get to not just computer nets but telephone nets and space networks and a whole series of different approaches to the problem.

126
00:13:12,320 --> 00:13:25,920
Its responsibility is the operation and the defense of the network and it does this by coordinating and directing the activities of the network operations centers and the various components across the department and also the computer emergency response teams.

127
00:13:26,320 --> 00:13:30,620
We also work very closely with law enforcement and the intelligence community.

128
00:13:33,260 --> 00:13:42,020
The task force, I would say, has successfully responded on several occasions to attacks, whether direct or indirect, on the DoD network.

129
00:13:42,100 --> 00:13:45,520
I love you, NMDA, Witty Worm.

130
00:13:45,520 --> 00:13:48,840
We did not have significant degradations from those.

131
00:13:48,840 --> 00:14:00,300
We certainly don't have it 100% but I think we are getting better at containing the events early and mitigating the consequences of people, again, where folks' lives are quite literally on the line.

132
00:14:00,300 --> 00:14:01,800
We're not doing this for profit.

133
00:14:01,800 --> 00:14:04,480
We're not doing this for bragging rights.

134
00:14:04,480 --> 00:14:09,640
We're doing this to support people who are in the field today and whose lives are on the line.

135
00:14:10,520 --> 00:14:16,020
We've also had much better cooperation, I think, with other agencies and I'll talk more about that in a little bit.

136
00:14:16,120 --> 00:14:38,060
We certainly don't claim to have all the answers and we need talented people and that's one of the reasons why I really appreciate the chance to be here today because you all out there represent an enormous body of knowledge, an enormous amount of talent and we could use a better understanding of some of the skill sets you have.

137
00:14:38,400 --> 00:14:44,660
My main focus, frankly, is not on the hacker who's in it for sport or challenge.

138
00:14:44,660 --> 00:14:55,780
My concern is the people who want to steal DoD information and do harm, either sort of directly or indirectly, to these people who are out there every day putting their lives on the line.

139
00:14:56,060 --> 00:15:08,220
We do prosecute lawbreakers, those caught getting into DoD networks and so if you are going to try to break the law and hack into our nets, we will try to impose legal consequences.

140
00:15:08,240 --> 00:15:10,920
But I'd rather emphasize today something different.

141
00:15:11,220 --> 00:15:12,480
It's an opportunity.

142
00:15:12,920 --> 00:15:28,600
The opportunity is if you want to work on cutting-edge problems, if you want to be a part of the truly great issues of our time, if you want to literally write history, we invite you to work with us.

143
00:15:28,600 --> 00:15:38,560
Quite frankly, in my job, not a day goes by that I don't come to work and say, wow, what new and interesting thing is going on out there that I want to work on.

144
00:15:38,560 --> 00:15:42,460
And it's an absolutely fascinating environment and we definitely need your help.

145
00:15:44,420 --> 00:15:48,580
What I would ask for is your help in reducing the noise.

146
00:15:49,120 --> 00:15:59,760
All the scanning, all the probing, all the attempted intrusions, divert our resources from the truly serious attacks that are out there.

147
00:15:59,760 --> 00:16:09,820
And have no doubt, there are people out there who seriously want to do us harm and do not share the values of the freedom of information on the network.

148
00:16:10,000 --> 00:16:11,800
There are people who want to do us harm.

149
00:16:11,800 --> 00:16:18,980
If you haven't taken a look at it, I'd recommend Scott Borg, who's done some very interesting work on the economic consequences of cyber attack.

150
00:16:18,980 --> 00:16:21,900
He used to be up at Dartmouth and now he has his own company.

151
00:16:21,900 --> 00:16:23,720
Really worthwhile.

152
00:16:24,240 --> 00:16:29,060
So my final message is, again, we value your talents.

153
00:16:29,060 --> 00:16:32,140
I would like very much to learn from what you have to offer.

154
00:16:32,140 --> 00:16:41,280
I frankly have taken away just from the time I've been here so far an enormous amount of information that is really useful to me that I would not have gotten without coming here.

155
00:16:41,300 --> 00:16:45,960
I look forward to coming back and talking with you more on the Meet the Fed panel later on in the afternoon.

156
00:16:46,160 --> 00:16:47,980
And let me open it to questions.

157
00:16:48,100 --> 00:16:49,340
Thank you very much.

158
00:16:49,340 --> 00:16:49,960
Go

159
00:16:55,070 --> 00:16:56,610
ahead.

160
00:17:04,960 --> 00:17:07,160
The question is on full disclosure.

161
00:17:07,160 --> 00:17:08,580
And what is my...

162
00:17:12,490 --> 00:17:13,450
Sure.

163
00:17:14,170 --> 00:17:19,110
What's my take on full disclosure, national security compared with business, so on and so forth?

164
00:17:25,010 --> 00:17:36,530
By and large, as we move to a network environment, and again I mentioned the point is sharing of information, and we do better in the long run by having information out there and having us share it.

165
00:17:38,010 --> 00:17:47,770
It's a major cultural change for us in terms of people who've owned information and say my owning it is more important than getting out to other people.

166
00:17:48,390 --> 00:17:56,810
And so I can't draw you a clear line that says everything to the right of the line is kept hidden, everything to the left is shared.

167
00:17:56,810 --> 00:18:06,130
My inclination at this point is shared because, as I say, I've learned stuff today about vulnerabilities that we need to get back and work on that I wouldn't have known if I hadn't come to a place like this.

168
00:18:06,130 --> 00:18:11,130
At the same time, there clearly is stuff that needs to be protected.

169
00:18:11,130 --> 00:18:21,990
And my particular focus is on protecting that information that puts people's lives directly at risk, which tends to be fairly perishable operational information.

170
00:18:21,990 --> 00:18:24,310
And then the flip side is things to say the U.S.

171
00:18:24,310 --> 00:18:30,610
has invested tens of billions of dollars of research and development in that gives us some kind of competitive advantage long term.

172
00:18:30,610 --> 00:18:32,070
That needs to be protected.

173
00:18:32,070 --> 00:18:39,990
So those are the sorts of things that I tend to focus my concerns on, rather than just saying, well, everything has got to be kept secret.

174
00:18:40,290 --> 00:18:41,070
Is that fair?

175
00:18:45,990 --> 00:18:48,470
The use of COTS in weapon systems?

176
00:18:51,610 --> 00:18:55,890
Let me answer that in two... pardon me?

177
00:18:57,190 --> 00:18:58,710
Yeah, okay.

178
00:18:58,710 --> 00:19:00,490
So the use of COTS in weapon systems.

179
00:19:00,490 --> 00:19:11,950
There's an interesting study that says that the government as a whole, federal government as a whole, now outsources more than...

180
00:19:11,950 --> 00:19:17,730
now pays more in contracted services than it does in salaries of government employees.

181
00:19:18,770 --> 00:19:21,870
And this trend appears to be one that's only going to continue.

182
00:19:21,870 --> 00:19:31,510
So part of the problem is that almost none of us, gubbies, know how to manage those kinds of outsourced services.

183
00:19:31,510 --> 00:19:35,190
We may know how to manage a program where the gubbies are controlled and deliver it all.

184
00:19:35,190 --> 00:19:38,270
We don't know how to manage these outsourced services very well.

185
00:19:38,710 --> 00:19:54,970
And so the challenge is, as baby boomers shuffle off the stage, what are we doing to train up the next generation of managers to do a better job of managing these outsourced services and the COTS that go with them and avoiding more ADAs and things like that.

186
00:19:56,330 --> 00:20:07,230
From a security perspective, my concern is that this now means I will have almost no clue into the pedigree of the networks that we're becoming so dependent on.

187
00:20:07,230 --> 00:20:08,830
I may know who the prime is.

188
00:20:08,830 --> 00:20:12,850
I'm likely to have no idea who the second and third tier subs are and where they're coming from.

189
00:20:12,950 --> 00:20:33,610
And so this then leads me to a much greater emphasis on not only the near real-time situational awareness of the network I mentioned before, but on some kind of understanding of software and hardware assurance for those critical applications where it really does make or break the successful missile engagement or the tip of the spear issues.

190
00:20:34,010 --> 00:20:39,870
And so we're looking at, for example, we have a trusted foundry that we're building for hardware chips.

191
00:20:39,870 --> 00:20:44,190
For those certain applications, we absolutely have to make sure that the pedigree is right.

192
00:20:44,190 --> 00:20:54,510
We're looking at various ways through combinations of common criteria and CMM and others on how to get better software assurance involved.

193
00:20:54,510 --> 00:21:04,970
So I think there's going to be a graduation between GOTS and kind of trusted COTS and then what's just out there in the marketplace.

194
00:21:06,810 --> 00:21:22,370
Because I think we're migrating to this much more commercial environment where we, frankly, are never going to know where a lot of this stuff comes from, I would tend to put more of my emphasis on the anomaly detection of the network, the strong identification,

195
00:21:22,370 --> 00:21:33,950
authentication, and the response to problematic behavior in the net than I would worry about what was going on in every piece of software in the system.

196
00:21:34,170 --> 00:21:40,390
And so you draw the line here as to what's in a weapon system.

197
00:21:40,390 --> 00:21:54,010
If you're dealing with a fighter plane, that's pretty much going to be, at the very least, the high pedigree commercial software and probably is going to be dedicated design systems.

198
00:21:54,070 --> 00:22:07,110
But it turns out that for us, exercise after exercise after exercise shows that the most dangerous, most vulnerable parts of our operational chain, if you will, are things like logistics and medical.

199
00:22:07,110 --> 00:22:11,410
And in that, you're almost certainly going to have lots of cost products.

200
00:22:11,630 --> 00:22:14,490
So I'd love to give you an answer as to what's a weapon system.

201
00:22:14,490 --> 00:22:23,790
I'm more interested in what do you need to assure the mission to complete the job irrespective of the level of attack you're under, and that's going to be a layered process.

202
00:22:42,380 --> 00:22:51,380
The question is, what do I feel about how other foreign governments stand in information assurance in England, Russia, China, whatever.

203
00:22:53,140 --> 00:23:01,560
I think we understand at this point that almost every significant operation we're going to do is going to be in some kind of coalition environment.

204
00:23:02,860 --> 00:23:13,460
And therefore, we have to take into account the fact that our coalition partners are going to come from very different levels of information assurance and capability.

205
00:23:13,460 --> 00:23:17,140
I was struck by, at one point, one of our coalitions.

206
00:23:17,140 --> 00:23:22,640
Right now, you have long-time partners like Lithuania, Moldova, and Tonga.

207
00:23:23,580 --> 00:23:26,740
So this means that we're going to have to...

208
00:23:26,740 --> 00:23:32,600
In fact, we are working very hard on developing something called MNIS, multinational information sharing.

209
00:23:32,660 --> 00:23:48,660
And it's going to have to give you some sort of multi-level security, firewalls, and guards to allow you to interoperate them in some kind of a shared space while protecting those core command and control functions, say, and key pieces of data that you don't want to share.

210
00:23:48,660 --> 00:24:01,920
So I spend less time actually worrying about what foreign governments are doing because I don't have much control over that, and rather having to put together an operational networked environment where I can bring in unanticipated users.

211
00:24:02,300 --> 00:24:27,300
To that effort, I would say that we are trying to completely rethink the paradigm for DoD to operate outside the .mil domain, to work with non-traditional partners like the Agency for International Development, UN, Doctors Without Borders, and even commercial partners in the kind of stabilization and reconstruction operations that we're seeing more and more of in what we're doing.

212
00:24:27,360 --> 00:24:29,800
We learned a lot from tsunami.

213
00:24:30,160 --> 00:24:33,020
We learned a lot... we are learning a lot from Afghanistan.

214
00:24:33,360 --> 00:24:39,560
Some of you may know there's something called the World Summit on the Information Society that's coming up in Tunis.

215
00:24:39,620 --> 00:24:47,180
It's the second of two conferences this November, and we'll be working with a whole batch of the international community to try to look at ways we can do that.

216
00:24:47,440 --> 00:25:04,700
I personally think we are never going to get to the stage where we'll allow these pick-up team partners to get inside, say, the Nibarnet firewalls, which means that we have to go outside and have .net or .org-type domains in which we can operate and share the information.

217
00:25:04,700 --> 00:25:09,020
So the long answer is I'm not too much worried about what foreign governments are doing.

218
00:25:09,020 --> 00:25:14,500
I'm trying to set the conditions whereby we can work with a whole batch of different people in different circumstances.

219
00:25:14,800 --> 00:25:16,060
Back there first.

220
00:25:31,900 --> 00:25:43,140
The question has to do with integrated attacks, something like physical terrorist attacks coupled with attacks on PBX boxes and this sort of thing.

221
00:25:43,140 --> 00:25:46,980
And this clearly is an area that we have to be working on and working on harder.

222
00:25:46,980 --> 00:25:50,980
I personally think that the...

223
00:25:52,780 --> 00:25:57,660
Again, my goal is to get to mission assurance, not just information assurance.

224
00:25:57,880 --> 00:26:11,300
Coming from a Navy background, I tend to think of a ship which is built with watertight compartments and you can still float with a couple of compartments flooded and you have a starboard engineering plant and a port engineering plant so if one is damaged,

225
00:26:11,300 --> 00:26:12,440
you can still carry on.

226
00:26:12,440 --> 00:26:16,780
You've got multiple fighting men and you train and you train and you train and you train.

227
00:26:16,780 --> 00:26:28,020
So we need to take into account the fact that an attack may be just cyber, just physical, a mix of physical and cyber and work the problem in an integrated manner.

228
00:26:29,580 --> 00:26:33,060
This is not entirely within the domain of the Department of Defense.

229
00:26:33,060 --> 00:26:35,140
A lot of this comes now up in the U.S.

230
00:26:35,140 --> 00:26:41,680
with the Department of Homeland Security where a lot of the cyber defense and national infrastructure rides.

231
00:26:41,680 --> 00:26:57,720
So in fact, this week I've just spent several meetings with people from the Department of Homeland Security on how we in defense and the private sector can do a better job at coordinating the infrastructure defense on which things ride, E911, those sorts of things,

232
00:26:57,720 --> 00:26:59,240
to give an integrated approach.

233
00:27:01,810 --> 00:27:03,270
So is there an answer?

234
00:27:03,270 --> 00:27:03,710
No.

235
00:27:03,710 --> 00:27:05,150
Are we better off than we were?

236
00:27:05,150 --> 00:27:07,510
I mean, GETS worked very well.

237
00:27:07,510 --> 00:27:11,450
The Government Emergency Telephone System worked very well on 9-11.

238
00:27:11,450 --> 00:27:14,850
We now have the wireless equivalent of that in place.

239
00:27:15,190 --> 00:27:19,550
And so you basically priority overrides in the wireless service for first responders.

240
00:27:19,950 --> 00:27:38,270
We've had a series of major exercises called Top Off, Top Officials, where you bring the FBI and Homeland Security and National Security Council, all that together, and actually run through some pretty horrific scenarios and how the decision making would flow.

241
00:27:38,270 --> 00:27:46,450
So a lot of this stuff, quite frankly, is as much a policy and a decision making process as it is the technical parts of the network.

242
00:27:46,450 --> 00:27:54,370
And that's what we're trying to get right now, while we inventory the networks, and you will, and find out what's available out there to use when the situation comes up.

243
00:27:55,590 --> 00:27:56,010
Okay?

244
00:27:56,010 --> 00:27:57,010
Someone's down here?

245
00:27:57,230 --> 00:27:58,510
There's one behind.

246
00:27:59,510 --> 00:28:00,370
Go ahead.

247
00:28:08,790 --> 00:28:13,350
The question is, do we allow the implementation of software that hasn't been internally audited?

248
00:28:13,350 --> 00:28:28,750
All software needs to have been validated through the NIAP, to be used in the DOD National Information Assurance Partnership, to be used in the DOD networks, and in most cases it also has to go through an interoperability certification through the Joint Interoperability Test Center.

249
00:28:36,000 --> 00:28:39,360
Well, in some of the code, there is code review in the NIAP.

250
00:28:40,120 --> 00:28:42,460
Not in JITIC, but there is in the NIAP.

251
00:28:43,800 --> 00:28:48,100
And then there are other things that NSA does, review code and that sort of thing.

252
00:28:48,100 --> 00:28:49,860
So, you know, we're cautious.

253
00:28:49,860 --> 00:28:53,180
I mean, this question goes back earlier about what do we do with commercial software.

254
00:28:53,700 --> 00:29:11,260
And part of it is, you know, if we're going to use something, say, like enterprise resource software, ERP, or PeopleSoft, or something like that, I mean, you're obviously not going to go through and try to change or validate every piece of code in that,

255
00:29:11,260 --> 00:29:13,120
and yet we're going to be dependent on it.

256
00:29:13,120 --> 00:29:17,480
And so the question, again, is how do you detect anomalous behavior in that?

257
00:29:17,480 --> 00:29:25,980
But for those things that are in our nipper net or shipper net, we're requiring the NIAP certifications.

258
00:29:25,980 --> 00:29:26,720
Sir?

259
00:29:37,500 --> 00:29:46,680
The question is, has anybody given any thought to preventing cell phones from being used for detonating IEDs by war-dialing all the cell phones in Iraq?

260
00:29:47,620 --> 00:29:52,060
The amount of time we spend on IEDs is quite extraordinary.

261
00:29:52,060 --> 00:29:57,780
I mean, literally tens of hours a week on the IED problem.

262
00:29:58,200 --> 00:30:01,160
And the cell phone issue has actually come up a lot.

263
00:30:01,400 --> 00:30:04,740
Now, there are ways to get to cell phones beyond just war-dialing.

264
00:30:04,740 --> 00:30:07,080
I mean, there are different ways to get to them.

265
00:30:07,140 --> 00:30:09,400
And so that problem has been addressed.

266
00:30:09,400 --> 00:30:19,360
I have to tell you, there's not a lot of evidence that cell phones, per se, have been used to trigger IEDs.

267
00:30:19,360 --> 00:30:24,780
There's much more stuff on garage door openers and those sorts of things than cell phones, per se.

268
00:30:25,040 --> 00:30:30,320
But I guess all I can say in this forum is we understand the potential threat of a cell phone.

269
00:30:30,340 --> 00:30:35,920
Guys are spending lots and lots of time on, you know, when we see it being used like this, how would we counter it?

270
00:30:35,920 --> 00:30:43,640
I haven't heard war-dialing specifically as a suggestive way to do it, but there are other kind of electronic ways they've been looking at countering it.

271
00:30:45,220 --> 00:30:56,220
There's nothing, frankly, of a higher priority issue for the military right now than addressing this improvised explosive device issue in Iraq, because that's what's killing our people.

272
00:31:24,160 --> 00:31:28,180
The question is, the DOD has spent a lot of money to develop AIDA.

273
00:31:28,180 --> 00:31:29,340
We're not using it.

274
00:31:29,340 --> 00:31:30,320
Other people are.

275
00:31:30,320 --> 00:31:32,160
Is there a way we can bring it back?

276
00:31:33,840 --> 00:31:36,720
Let me take that for the record and go back and look at it.

277
00:31:36,740 --> 00:31:43,340
Frankly, my sense is that time has moved beyond AIDA.

278
00:31:45,120 --> 00:31:49,240
And there are lots of other ways to do business, especially if you go to the net-centric environment.

279
00:31:49,240 --> 00:31:52,100
So I haven't paid a lot of attention trying to revitalize it.

280
00:31:52,100 --> 00:31:55,580
If you want to give me your name later on, I'll take it for the record and get back to you.

281
00:31:55,580 --> 00:31:57,580
It just hasn't been something I've focused on.

282
00:32:12,980 --> 00:32:23,240
The question is, what's the ratio in the number of IEDs, improvised explosive devices, that are being detected and disarmed before they are exploded?

283
00:32:23,240 --> 00:32:25,000
And the answer is, yes, we have those data.

284
00:32:25,000 --> 00:32:26,780
I'm not sure I can share that.

285
00:32:27,200 --> 00:32:35,980
What's happening, though, is that we're getting better at detecting them and disarming them, but they're making them more lethal, so each one causes more attacks.

286
00:32:35,980 --> 00:32:46,480
I mean, using explosive-formed jets and things like that, as opposed to just focused explosive jets, rather than just a circular explosion.

287
00:32:46,540 --> 00:32:51,980
So, anyway, it's a typical dynamic of offense and defense.

288
00:32:53,760 --> 00:32:54,880
Sir?

289
00:33:03,520 --> 00:33:04,700
What kind of scorecard?

290
00:33:05,720 --> 00:33:06,700
Assist?

291
00:33:06,700 --> 00:33:07,260
Yeah.

292
00:33:25,640 --> 00:33:33,500
So the question is, is there anything like an assist scorecard, and what are we doing with guidance for the private sector about implementing data tagging?

293
00:33:33,500 --> 00:33:34,380
I'll get you next.

294
00:33:35,980 --> 00:33:40,400
And I would say that we're doing...

295
00:33:40,400 --> 00:33:43,760
I mean, a lot of our work is based on various kinds of balance scorecards.

296
00:33:43,760 --> 00:33:46,160
We're trying to put together metrics.

297
00:33:46,160 --> 00:33:50,940
Right now, the deputy is challenging us on getting metrics for the information assurance world.

298
00:33:51,080 --> 00:33:56,420
And I have to tell you, this is one of the hardest problems I've got, and this is something I would really ask for your help with.

299
00:33:56,420 --> 00:34:02,860
The question is how you measure return on investment on information assurance type things.

300
00:34:02,860 --> 00:34:22,260
So if I'm going to go in and put $100 million into some sort of technique to get to better multi-level security in 2012, and the budgeteers are out there saying, well, show me that's going to give us a 14% or a 22% or a 71% increase in security.

301
00:34:22,260 --> 00:34:24,120
It's really hard to do that.

302
00:34:24,120 --> 00:34:30,680
And so the idea of a link between metrics and investments and all that is a hard problem for us.

303
00:34:30,680 --> 00:34:44,620
I mean, I can go through right now and measure what's working in different network operation centers and all that, how we're doing on implementing known vulnerabilities and all that, and more concerned about the long-term return on investment metric.

304
00:34:44,620 --> 00:34:50,840
With regard to the public-private sector, again, a lot of this lies in the Department of Homeland Security.

305
00:34:50,840 --> 00:35:06,000
And part of the problem we've had ever since PDD 63, which is the critical infrastructure protection in the last administration, is building the trust, if you will, to be able for two-way sharing of information.

306
00:35:06,620 --> 00:35:20,980
We've spent a lot of time working with Congress and others on trying to change laws so you can provide better protection to proprietary information that comes up through the ISACs, these information-sharing and analysis centers.

307
00:35:20,980 --> 00:35:26,980
And we're trying to work with getting the government being more willing to share a sense of information on the way back down.

308
00:35:27,240 --> 00:35:40,680
If I were to say anywhere, I think the telecommunications sector, the National Security Telecommunications Advisory Committee, that process is working pretty well in the telecom sector.

309
00:35:40,900 --> 00:35:45,420
I don't think it's working as well in, say, transportation or energy or others.

310
00:35:45,420 --> 00:35:56,780
And what's coming to be a concern for me is, as SCATE is, the supervisory control and data acquisition nets become more and more a part of all of our critical infrastructures.

311
00:36:01,380 --> 00:36:06,300
We're making the most progress in the telecoms and the ISP world.

312
00:36:06,300 --> 00:36:14,320
I don't think we're getting as much progress in controlling the information technology in these other sectors where it may be equally critical to us on a national basis.

313
00:36:14,320 --> 00:36:26,820
So the answer is, one piece of advice I would have is the DoD and the Intel community have committed, I mentioned the global information grid and the programs.

314
00:36:26,820 --> 00:36:29,200
There are three other pieces that go with that.

315
00:36:29,200 --> 00:36:36,260
There's the network operations, network resources management piece, about how you balance the use of resources in the network.

316
00:36:36,260 --> 00:36:44,880
There's a spectrum management piece, and the key underlying bit is the net-centric data strategy, which is an XML-tagged approach to the problem.

317
00:36:45,440 --> 00:36:53,900
And it turns out that DoD and the intelligence community and NATO have almost identical net-centric data strategies.

318
00:36:53,900 --> 00:37:03,880
And we've really had some very good luck over the past several months in moving towards a service-oriented architecture approach and a shared situational awareness.

319
00:37:04,120 --> 00:37:12,780
That data strategy has not yet been adopted by the Department of Homeland Security, which means it's not being infused into the private sector through those channels.

320
00:37:12,940 --> 00:37:20,500
And over the past week, we've actually been working hard with the senior leadership of DHS to get them to adopt that kind of a strategy.

321
00:37:20,540 --> 00:37:23,740
So maybe that'll be an answer to one part of your question.

322
00:37:24,040 --> 00:37:28,380
The question

323
00:37:39,350 --> 00:37:47,610
is, as warfare goes net-centric, how do you envision managing security, connecting together what used to be stand-alone systems?

324
00:37:50,030 --> 00:37:58,250
I don't think there's ever going to be a closed-form solution where you lock the door and say, we got there, let's go home, turn off the lights and go home.

325
00:37:59,570 --> 00:38:06,790
There are just too many dynamic pieces of the puzzle in terms of not only the evolving threat, but the rolling out of new technologies.

326
00:38:06,790 --> 00:38:14,850
There was a very good session this morning on vulnerabilities associated with XML and service-oriented architectures.

327
00:38:14,910 --> 00:38:17,750
Three years ago, we wouldn't have paid any attention to that.

328
00:38:17,750 --> 00:38:20,930
And so now we need to fold that into the process.

329
00:38:20,930 --> 00:38:27,110
So I think it's going to have to be an ongoing, dynamic series of reviews.

330
00:38:28,310 --> 00:38:31,130
The first key part of this is cultural.

331
00:38:31,230 --> 00:38:39,650
If you talk to the intelligence community, they have a concept called ORCON, Originator Controlled, which basically says, I wrote the information, it's mine.

332
00:38:40,550 --> 00:38:51,090
And so just trying to break down the stovepipes to share that becomes much more an issue of politics and culture than it is of physically getting the bits and bytes to work out.

333
00:38:51,130 --> 00:39:00,510
So I think it's going to be a mix of cultural solutions, this doctrine, organization, training, evolution, the physical.

334
00:39:00,710 --> 00:39:09,070
And even if I could give you a solution today that said, I'm at the 95% level, I'm happy with it, it won't be that way tomorrow.

335
00:39:09,070 --> 00:39:30,590
The one thing I would say in DoD that, again, I look for your help on, if I'm a credit card company and I realize that I'll probably get 3-4% loss rates in fraud or whatever, I can factor that into my calculus, I can put that in my interest rates, I can factor that in.

336
00:39:30,750 --> 00:39:40,670
And what you get from that is an explosion of credit across the economy that transforms the ability of everyday people to buy things they never would have been able to buy before.

337
00:39:41,410 --> 00:39:48,170
I don't know anybody lately who's gone to the top secret control officer and say, it's okay to lose 3% of your documents a year.

338
00:39:48,570 --> 00:40:05,430
Even though, in the net-centric model, maybe 100 people were lost because some piece of information were compromised, maybe 10,000 were saved because the fight was over in three days rather than three months, and the value of net-centricity had an upside.

339
00:40:05,450 --> 00:40:15,990
So we need to think through our cost-benefit analysis to put more emphasis in the military on the upside benefit, even as we focus on the cost.

340
00:40:16,750 --> 00:40:20,530
Not a neat, clean answer, but that's where we're looking at.

341
00:40:20,630 --> 00:40:21,670
Over there, sir?

342
00:40:23,030 --> 00:40:24,070
Please.

343
00:40:38,650 --> 00:40:42,470
Critical factors in my going, I mean, how I got to be CIO.

344
00:40:43,850 --> 00:41:04,210
I'm sort of in a strange situation in that I was career Navy, and so I spent 26 years in uniform, and then about seven years in the Office of the Undersecretary for Policy, working largely on the interface between policy and technology issues.

345
00:41:04,550 --> 00:41:18,570
And so, in 1998, the Secretary decided to beef up the role of the Assistant Secretary for Command, Control, Communications, and Intelligence, which is what my organization was then known as.

346
00:41:18,570 --> 00:41:28,770
I was asked to go over and be the Principal Deputy in that organization because I had an understanding of less the technical details and the balance between policy and technology.

347
00:41:29,090 --> 00:41:33,950
I mean, my own education is, my undergraduate work was in physics and oceanography.

348
00:41:33,950 --> 00:41:35,830
My master's is in applied math.

349
00:41:35,830 --> 00:41:37,910
My doctorate's in international relations.

350
00:41:37,910 --> 00:41:43,810
And I found that mix of a policy science and engineering science to have been a really valuable combination.

351
00:41:43,810 --> 00:41:46,230
So, just a long story.

352
00:41:46,230 --> 00:41:51,010
What's happened now is my permanent title is Principal Deputy.

353
00:41:51,570 --> 00:41:57,970
Our Assistant Secretary left about 18 months ago, and so I've been acting as the CIO since.

354
00:41:57,970 --> 00:42:01,910
But I think, in my case, it certainly wasn't a commercial background.

355
00:42:01,910 --> 00:42:06,970
It was less a technical background than having the policy-technology interface understanding.

356
00:42:28,870 --> 00:42:33,030
The question is, I've been focusing a lot on information assurance.

357
00:42:33,030 --> 00:42:41,830
And as you play out 2012-2014, how do I see the offensive side playing out of information operations?

358
00:42:42,050 --> 00:42:46,090
I'm really limited in what I can say on that in this venue.

359
00:42:46,090 --> 00:42:55,730
But I think one of the key points is, as the network becomes the center of gravity for military operations...

360
00:42:55,730 --> 00:43:01,030
I mean, right now, we're probably the most net-centric of any military in the world.

361
00:43:01,030 --> 00:43:05,330
It's a model that's being adopted by a number of others as well.

362
00:43:05,850 --> 00:43:11,730
As more and more countries come to depend on the network, then how you attack that network...

363
00:43:11,730 --> 00:43:15,430
be it a physical attack or a cyber attack or whatever...

364
00:43:15,430 --> 00:43:18,790
will become a more important thing to work on.

365
00:43:18,790 --> 00:43:27,370
And I think, also, what I would expect to see is not just a single solution, but a broad...

366
00:43:27,370 --> 00:43:29,510
it'll become a target just like anything else.

367
00:43:29,510 --> 00:43:33,350
One of the things we're saying is we need to fight the network like a weapons system.

368
00:43:33,350 --> 00:43:35,630
You need to think of it as a ship, tank, an airplane.

369
00:43:35,630 --> 00:43:37,070
It's a critical component.

370
00:43:37,250 --> 00:43:40,570
And so, as a result, you have to defend it against the full range of threats.

371
00:43:40,570 --> 00:43:44,950
And we have to be able to, you know, similarly mount the full range of threats.

372
00:43:44,950 --> 00:43:46,570
That's probably about as far as I can go.

373
00:43:47,830 --> 00:43:48,710
Somebody in the back.

374
00:43:48,710 --> 00:43:50,450
I'm sorry, I can't see hands back there.

375
00:43:50,450 --> 00:43:51,510
I'd be glad to...

376
00:43:56,810 --> 00:43:57,810
Yeah, please.

377
00:44:23,080 --> 00:44:24,340
It's a really good question.

378
00:44:25,220 --> 00:44:31,860
What about cyber attacks and penetrations that originate from foreign countries and how do we prosecute them?

379
00:44:32,540 --> 00:44:37,980
I think, as most of you know, the attribution of a cyber attack can be a really hard thing to do.

380
00:44:38,580 --> 00:44:56,200
And so, with a number of countries, for example, in Europe and the Interpol and a number of bilateral agreements, we now have some pretty good mutual law enforcement rules to be able to address...

381
00:44:57,240 --> 00:44:58,580
For instance, the UK.

382
00:44:59,040 --> 00:45:05,720
The UK would either prosecute people who hack into our nets or, in some cases, we can extradite them to be prosecuted here.

383
00:45:05,840 --> 00:45:08,540
There are other countries where, frankly, it's a free ride.

384
00:45:08,540 --> 00:45:15,780
If you hack from there, there's no... In some cases, it's not a crime to the hacking in those nations' laws.

385
00:45:15,840 --> 00:45:18,620
And if we don't have agreements with them, there's not much you can do about it.

386
00:45:18,620 --> 00:45:29,260
So, I think over the past ten years, we've made a lot of progress in working out multilateral and bilateral law enforcement agreements, but it's certainly a patchwork quilt around the world.

387
00:46:06,760 --> 00:46:18,480
The question is, in these countries that are not doing a good job in policing their own cyber security, or which we don't have agreements with, are there other ways we could put pressure on them?

388
00:46:18,480 --> 00:46:20,860
Postal agreements or something like that, too.

389
00:46:20,860 --> 00:46:25,740
And the answer is, the Defense Department doesn't do... That's not our thing.

390
00:46:25,740 --> 00:46:28,140
That would be the law enforcement or State Department.

391
00:46:28,140 --> 00:46:35,820
When we have the Ask the Fed panel later on, if you come, that would be a very good question to ask for the folks who'd be here, because there'd be people who could address it.

392
00:46:37,300 --> 00:46:38,620
Back there first.

393
00:46:42,660 --> 00:46:45,600
What does IPv6 capable really mean?

394
00:46:47,740 --> 00:46:52,660
We've set a goal of 2008 to implement IPv6.

395
00:46:53,240 --> 00:46:59,840
And it's going to be done through a technology refresh policy rather than a Big Bang solution.

396
00:47:00,060 --> 00:47:04,380
And so I would guess we'll be running dual stack for a long time.

397
00:47:12,360 --> 00:47:14,320
Tell me more about your question.

398
00:47:14,320 --> 00:47:22,280
Because what we're essentially saying is anything that we're buying since last year, or 2003, I think, should have been IPv6 capable.

399
00:47:22,280 --> 00:47:25,300
And your question is, that's an ambiguous definition?

400
00:47:32,480 --> 00:47:39,720
I see the rollout of IPv6 is going to be, we're pushing as hard as possible.

401
00:47:39,720 --> 00:47:47,320
There was just a congressional hearing that was basically saying that the government as a whole should be doing more with IPv6.

402
00:47:47,320 --> 00:47:50,840
And the DoD was really the only organization that was taking the lead.

403
00:47:51,040 --> 00:47:53,680
And so the Congress seemed fairly happy with what we're doing.

404
00:47:53,680 --> 00:47:57,960
At the same time, as you know, there are lots of issues associated with it.

405
00:47:57,960 --> 00:48:00,260
What kind of costs are going to be imposed?

406
00:48:00,260 --> 00:48:06,980
How quickly are we going to retire the IPv4 systems if they can't run dual stack?

407
00:48:06,980 --> 00:48:13,900
So I don't think this is going to, you know, on the 31st of December 2008, there's not going to be a magic cutoff.

408
00:48:13,900 --> 00:48:16,220
We're just going to try to get there as fast as possible.

409
00:48:16,320 --> 00:48:23,240
Most of it's going to be new equipment we buy, data we refresh, are going to have to be IPv6 compatible.

410
00:48:23,240 --> 00:48:25,880
But we can talk later on if you want.

411
00:48:25,880 --> 00:48:26,860
I don't think that's the answer.

412
00:48:32,910 --> 00:48:34,630
By the which project?

413
00:48:35,890 --> 00:48:37,910
I can't actually know.

414
00:48:38,210 --> 00:48:42,150
The question is, can I comment on the achievements of the DTUR project?

415
00:48:42,250 --> 00:48:43,590
And I'm not familiar with the project.

416
00:48:43,590 --> 00:48:45,070
Give me some more background.

417
00:48:57,420 --> 00:49:02,980
It's an NSF DoD funded testbed, if you will, to look at the internet.

418
00:49:02,980 --> 00:49:13,800
Actually, I'd like to learn more about that because we're in the process right now of assembling an end-to-end testbed for the global information grid.

419
00:49:14,000 --> 00:49:16,060
And we've been going around inventorying, if you will.

420
00:49:16,060 --> 00:49:20,680
For example, I'm funding something at the Naval Research Lab that's an end-to-end testbed.

421
00:49:20,700 --> 00:49:24,200
The Joint Forces Command down in Norfolk has an end-to-end testbed.

422
00:49:24,360 --> 00:49:26,380
The Army has one out of Fort Hood.

423
00:49:26,380 --> 00:49:30,120
So I'd like to learn more about where DTUR goes because I'm not familiar with it.

424
00:49:40,210 --> 00:49:43,590
The question is, why are we moving towards IPv6?

425
00:49:44,630 --> 00:49:59,610
Well, we need the security and the mobile environment features of being able to automatically establish links with adjacent networks, those sorts of things.

426
00:49:59,910 --> 00:50:05,250
The security, there's a sense that the rest of the world, China, whatever, is likely to move to it.

427
00:50:05,250 --> 00:50:10,170
We're certainly not doing it because right now we're constrained in IP address space.

428
00:50:10,170 --> 00:50:19,550
But the department is going to be explosively moving to unattended ground sensors and unattended, well, mainly ground.

429
00:50:19,550 --> 00:50:22,710
And that's going to start using up our space.

430
00:50:22,730 --> 00:50:27,090
We were trying to not have to go to NATs for some of these sub-NATs.

431
00:50:27,110 --> 00:50:29,590
So that was essentially the reasons that drove it.

432
00:50:44,210 --> 00:50:50,370
The question is, how much collaboration do we do with other agencies on information sharing and information security?

433
00:50:51,030 --> 00:51:02,630
As I mentioned, we in the intelligence community and NATO have a very close relationship based on the fact we have a common data strategy.

434
00:51:03,830 --> 00:51:07,550
NATO has something called STANAG, Standing Agreements.

435
00:51:07,590 --> 00:51:14,010
And in fact, we've tried to base a lot of our policies and technologies on NATO STANAGs.

436
00:51:14,010 --> 00:51:16,010
So it's not just U.S.

437
00:51:16,010 --> 00:51:20,430
only, and we're actually trying to show it's an alliance event as well.

438
00:51:20,610 --> 00:51:29,990
I think there are still some major cultural differences in here, especially with the intelligence community, in terms of some of the stovepipes that have been around for a long time.

439
00:51:30,150 --> 00:51:35,230
And they probably feel that we're moving too quickly to need to share or vice need to know.

440
00:51:35,230 --> 00:51:40,090
And we probably feel that we'd like them to put some more information in the network faster.

441
00:51:40,090 --> 00:51:45,330
So the discussions are ongoing continuously.

442
00:51:45,330 --> 00:51:53,430
The President signed an executive order last summer mandating the sharing of terrorist information across the government.

443
00:51:53,930 --> 00:52:07,530
The legislation that set up the Director of National Intelligence amplified that to actually set up a position within the DNI's office as a program manager for information sharing.

444
00:52:07,530 --> 00:52:13,310
So there's just a lot of energy in this, and we're just trying to pull it together across the messy processes that are the U.S.

445
00:52:13,310 --> 00:52:13,970
government.

446
00:52:30,640 --> 00:52:36,220
The question is, do I think there's enough control by the government over the Internet, not enough control?

447
00:52:37,420 --> 00:52:45,720
This is going to come up in the World Summit in Tunis, and we're working out the various positions.

448
00:52:45,820 --> 00:52:47,500
I think, by and large, the U.S.

449
00:52:47,500 --> 00:52:59,000
is willing to see more role in Internet governance, by other countries, but we're not willing, at this point, to give up some of the key features like ICANN and that sort of thing.

450
00:52:59,060 --> 00:53:02,780
The positions, frankly, are still being refined.

451
00:53:16,380 --> 00:53:18,020
Let me see.

452
00:53:18,220 --> 00:53:21,600
First of all, I can only speak for the Department of Defense.

453
00:53:21,840 --> 00:53:28,600
And from the DoD perspective, I have no problem with the current level of control of the Internet.

454
00:53:29,120 --> 00:53:34,440
It's a good question to ask the Fed panel, because the law enforcement people might have a different view.

455
00:53:56,330 --> 00:54:02,150
The question is, there's a need to keep a 10- to 15-year focus on information assurance.

456
00:54:02,290 --> 00:54:09,070
The concern that recently the DARPA funding for the longer-term computer science projects has dried up.

457
00:54:09,070 --> 00:54:10,730
What do I think about that?

458
00:54:10,990 --> 00:54:22,830
I know there's been a conscious effort on the part of DARPA to focus on projects with more, what do I want to say, direct return on investment from the R&D.

459
00:54:23,250 --> 00:54:29,110
There's always going to be a tension between what the 10- or 15-year problem is and what the local one is.

460
00:54:32,610 --> 00:54:39,330
Candidly, I've more or less accepted the view of the director of DARPA where he should put his resources.

461
00:54:39,330 --> 00:54:47,490
We're doing a lot of work, not just with DARPA, but also with NSA, and also with the academic community, in terms of the long-term projects.

462
00:54:47,550 --> 00:55:05,590
And at this point, I have more problem with the point I made earlier of how to justify what I believe should be a higher level overall across the board in information assurance projects, rather than whether DARPA is not doing enough, because there are ways to cover that in other areas.

463
00:55:05,590 --> 00:55:07,550
So that hasn't bothered me particularly.

464
00:55:07,550 --> 00:55:08,950
Ma'am?

465
00:55:31,970 --> 00:55:45,050
I'm sorry, the question is, as we work outside the .mil domain, the areas, the ones I cited, were non-traditional partners within the U.S.

466
00:55:45,050 --> 00:56:05,450
government, like USAID, with whom DOD hasn't typically worked, international organizations like the United Nations, some NGOs, and I cited Doctors Without Borders, of course there are a whole raft of them, and some of these in the past have actually had in their charters that they should not work with the military.

467
00:56:05,950 --> 00:56:21,930
And I think one of the things that we've made some progress on over the past year or so, particularly since tsunami, is a recognition that if we really are going to provide services to people in distress, and frankly from my perspective, I'm just talking from my DOD hat,

468
00:56:21,930 --> 00:56:29,230
I'm interested in the stabilization of these situations so they don't turn into problems where the military has to intervene.

469
00:56:29,510 --> 00:56:32,590
So in those types of situations, we have a common interest.

470
00:56:32,670 --> 00:56:39,050
And that was, I just used Doctors Without Borders as an example of a broad class of non-governmental organizations.

471
00:56:40,850 --> 00:56:44,810
Absolutely, NGOs are a group who are actively courting.

472
00:56:49,410 --> 00:56:51,030
You had something here, right?

473
00:56:51,030 --> 00:56:53,650
Go ahead.

474
00:57:08,170 --> 00:57:15,050
The question is, have we seen anything similar to TPED, the Trusted Product Evaluation Program for military?

475
00:57:20,580 --> 00:57:25,320
Yeah, for power grid and banks and other critical infrastructures and things like that.

476
00:57:25,320 --> 00:57:26,660
That's a very interesting question.

477
00:57:26,660 --> 00:57:27,520
I hadn't thought of it.

478
00:57:27,520 --> 00:57:29,080
Let's talk afterwards.

479
00:57:29,240 --> 00:57:39,680
Because I think you could do a lot with that, but we need to work that through this messy interagency process and I haven't tried to do that.

480
00:57:39,680 --> 00:57:43,360
I'm getting a sign here, I think maybe two more questions and we'll have to call it a day.

481
00:57:43,480 --> 00:57:43,520
The

482
00:57:57,080 --> 00:58:06,480
question is, information assurance and contractors, how does that affect security when information assurance isn't part of their award fee?

483
00:58:06,900 --> 00:58:14,860
One of the things we've got to learn to do better in this outsourcing of services is to write our contracts smarter.

484
00:58:14,860 --> 00:58:26,060
I was out in Afghanistan earlier this year and the contracting officer's representative for the 25th Infantry Division in Bagram was actually down in Qatar.

485
00:58:26,200 --> 00:58:36,100
And if they wanted to do combat operations after hours, they would have to call Qatar and get money added to the contract in order to conduct the operations.

486
00:58:36,100 --> 00:58:38,300
Because we just hadn't written the contract right.

487
00:58:38,300 --> 00:58:44,740
So it seems to me in this environment we've got to write the contract so that information assurance becomes part of the award fee structure.

488
00:58:44,920 --> 00:58:47,600
We're not there yet, this is a learning process.

489
00:58:48,240 --> 00:58:51,840
Any more?

490
00:58:53,340 --> 00:58:56,140
Thank you very much, I appreciate a chance to talk with you today.

491
00:59:03,000 --> 00:59:05,780
Come work with us, I'd love to draw on your talent pool.

492
00:59:05,780 --> 00:59:06,580
Thanks again.