start	end	text
3820	9180	...defense at the edge of a network that begins with a soldier in the foxhole and vice versa.
9740	14040	We're trying to move from a smart push to a smart pull system.
14220	20400	Smart push, think of a telephone. I need to know not only where you are, but what you need to know in order to convey the information.
20620	24980	Smart pull says I probably don't know where you are and I certainly don't know what you need to know.
24980	29420	So we'll use the network to provide the information for you to gather it.
29420	35040	The basic thing we're trying to get to is to take data and turn it into information,
35040	38060	and turn it into knowledge, and turn it into understanding,
38060	42600	and then into action as quickly as possible in near real time if we can.
43220	47100	And the point of this, it's not just material, we're not just talking about the networks.
47320	50920	We're talking about you have to change the doctrine by which new business,
50920	55220	we have to reorganize the way we are set up, we have to train our people.
55220	59460	Obviously there's some material pieces, there's a key leadership piece,
59460	63880	we need to get the personnel in place to be trained to do this,
63880	66540	and we have to have the facilities and the infrastructure to support it.
66540	73580	So all of this needs to be evolved together in order to get the objective we're looking for.
73680	76940	The mission I think is more complex than a lot of people realize.
76940	83560	It's not just war fighting, it's a mix of that, of course, plus business, plus intelligence, plus logistics,
83560	86280	and also increasingly importantly peacekeeping.
86540	91700	I was in Afghanistan in January talking with people in the provincial reconstruction teams
91700	93980	working with the Afghan provinces.
93980	97920	We did a lot with the tsunami relief efforts in Southeast Asia.
97920	101300	We've had people supporting relief efforts in Darfur.
101300	104600	All of this relies on the same network we're talking about.
105420	108780	A point to be made is that when we do get to combat,
108780	114060	it's a fundamentally different sort of thing than one might have expected in the past.
114120	117380	Several people now talk about something called the three-block war.
117520	122180	You're engaged in peacekeeping on one block, you're putting down a riot on the next,
122180	125200	and you're engaged in full-fledged combat operations the next.
125200	129960	It's not the clear kind of distinction most of the planning and most of the people are used to
129960	132140	in terms of the phases of operations.
132440	135780	People also talk about something called a strategic corporal,
135780	138820	meaning that decisions made by people at every level at this point
138820	142920	get into the newspapers, get into the CNN, get into whatever,
142920	146160	and they become sort of national issues very quickly.
146180	149400	So in short, the whole structure, the whole hierarchical structure,
149400	154940	is breaking down to a much flatter, much more networked, much more dynamic organization.
156540	161320	There are a lot of things in the security field that relate to what industry is doing,
161320	169340	but frankly there's a scale and a complexity and perhaps even a sort of stakes issue here
169340	172520	that doesn't really reflect a lot of what industry has.
172600	177240	We have people whose lives literally are on the line today, depending on the network.
178140	183380	Somebody described DoD as being just like Walmart, except that...
184180	186380	Yo, Walmart! Okay.
188040	191640	Except that every store is mobile, the competition fires ordnance at you,
191640	193960	and Christmas comes randomly on any given day.
195140	197580	So, other than that, we're more or less the same.
198080	201920	We have this thing on which, of course, the key to network-centric operations,
201920	203080	you've got to have a network.
203500	208320	And the basis of this is something we call the Global Information Grid, or GIG,
208320	210700	since we're addicted to acronyms.
211960	215540	And there are six major programs that comprise this GIG,
215540	218160	and it's not just material, it's also the people and processes
218160	224980	who store, process, transmit, add value to information across the department.
225360	229020	So, four of the programs deal with the transport of information.
229620	234440	One deals with enterprise services, and I've just come from a very sobering talk
234440	241260	from Scott Sender on vulnerabilities of network services.
241820	244680	And one deals with the information assurance of the network.
244680	247740	By the way, I'd like to talk for about 30 minutes, then I'll open it to questions.
248800	251440	The program's first four deal with transport.
251440	253360	One is a terrestrial fiber net.
253360	258320	We call it the GIG bandwidth expansion, 10 gigabit per second, OC192 fiber,
258320	261280	to the 80 largest command and control nodes around the world.
261280	264700	That'll be full operational capability by the end of this year.
265280	269860	The second is to extend this global network to mobile units,
269860	272700	and that's a transformational satellite that's going to take lasers
272700	277840	around the satellite ring to give you, again, 10 gigabits a second anywhere on the planet.
278680	282500	One of the purposes of that is to use laser uplinks from aircraft,
282500	286460	so we won't have to use so much spectrum to exfiltrate the data
286460	289700	from the various kinds of reconnaissance sensors on the aircraft.
289940	294160	The third piece of transport is something called the Joint Tactical Radio System.
294160	297980	It's a software-defined radio, software-controllable architecture,
297980	303400	and that's designed to provide the mobile routers on the IP mobile networks
303400	307720	in order to bring these capabilities to the tactical units.
307740	311100	Finally, there's something called teleports that links the ground infrastructure
311100	313700	with the on-orbit infrastructure.
313700	318200	So that's kind of the very heterogeneous network we're talking about.
318200	322300	It's 10 gigabit per second, stable, to 10 kilobit per second,
322300	325260	very unstable in tactical mobile environments.
326140	330040	The enterprise service, Net-Centric Enterprise Services,
330040	335000	is basically beginning to take you to a software as to a service-oriented architecture.
335000	336960	I'll talk more about that in a bit.
336960	339640	And then there's a whole information assurance program
339640	342240	called the Gig Information Assurance Program.
342240	349500	We spend about $2.2 billion a year in DoD and with NSA on the security of the network.
352410	354810	One of the pieces we're trying to work on
354810	358410	is to move from this stable environment to a tactical environment.
358410	362610	This perhaps is something that a lot of the commercial analogies break down
362610	367270	because we have to be able to handle very dynamic environments.
367270	370310	Of course, the cell phone environment is dynamic also, mobile,
370310	376250	but here with people jamming, shooting, very kind of severe environmental conditions.
379440	383820	The paradigm that goes with this is a movement from need to know,
383820	386380	which is kind of hoarding the information, I own it,
386380	387760	to need to share.
387760	389320	You're not going to get the value of the network
389320	392120	until you get the information out on the network.
392300	394840	And this is much more of a policy and a cultural thing
394840	397120	than actually a technological thing.
398340	400400	A couple people issues come to mind.
400400	403180	In 1996 or 7 or so, I went up to New York
404000	407400	and listened to a group of presentations by a series of analysts
407400	409420	from the computer security industry
409900	411780	talking to people on Wall Street.
412360	415320	And so there's maybe a certain amount of hype in the presentations,
415320	417480	but what I took away was,
417480	422240	we, industry, can provide you, customer, with any level of security you want.
422760	425520	But we need from you three things.
425520	428540	We need to have a commitment from the top of your organization
428540	430560	that security is important.
431640	434600	We need to have you spend the resources,
434600	439000	and by resources I don't mean the one-time procurement of firewalls and guards,
439000	443240	but the ongoing expenditures to maintain near real-time situational awareness
443240	445240	of what's going on in your networks.
445880	447540	And you've got to be willing to drop the hammer
447540	449340	on people who don't play by the rules.
450240	451820	And I'd say in government at this point,
451820	454860	we've done a pretty good job at conveying that security is important.
455020	457400	God knows we're spending a lot of money on the problem.
457500	459600	We have not done a good job in dropping the hammer
459600	461260	on people who don't play by the rules.
461340	463840	It's a lot easier for me right now to get a security violation
463840	465280	by leaving my safe open
465280	468420	than it is by posting my password on my computer
468420	472080	or letting an unauthorized modem be attached to my network.
472080	473740	We need to work on that.
475700	477780	NSA has done a terrific job
477780	480780	in putting together a new information assurance architecture
480780	482360	for the gig.
483020	484960	And this is being driven by several factors.
484960	487160	I mean, obviously the environment is changing,
487160	489460	the paradigm security is changing,
489460	491540	moving network-centric operations.
492020	496300	But we also have to pay a lot more attention to the insider threat.
496300	500760	If you look at our major espionage cases over the past 25 years,
500760	503400	almost every single one of them had their security clearances
503400	504860	before they went bad.
505200	507540	We focus a lot on the perimeter of the problem,
507540	509100	keeping the bad guys out.
509160	512260	The issue is we have to be able to detect anomalous behavior
512260	514960	in the network and respond to it.
515160	518020	I heard today from Paul Simmons of Jericho Forum
518020	520120	the term deperimeterization.
520340	521940	And I look forward to learning more about that
521940	524700	because I think that's some description of where we're going.
525140	527060	So there are five concepts, you will,
527060	529340	in this new information assurance architecture.
529340	532040	One is to separate the protection of the information
532040	534740	from the protection of the infrastructure.
535400	537680	Another is the end-to-end protection of information
537680	540060	through enhanced access controls.
540060	543000	We need to have strong identification and authentication,
543000	546240	which is absolutely critical to being able to do security
546240	549680	based on policy-based access.
550100	553140	We've got to have enhanced misuse identification.
553420	555040	For example, Visa and MasterCard.
555040	557100	I was in Kuwait a couple of months ago
557820	560020	and I went to buy my wife some jewelry.
560060	562980	So I swiped the first card and it went through.
563020	564600	Second time it went through and said,
564600	565760	ah, denied.
565940	568120	So we pulled the string on and it turned out, of course,
568120	570160	they said, well, last Saturday you were in Virginia.
570160	571140	Now you're in Kuwait.
571140	572800	You never told us you're going overseas.
572860	574060	Is this really you?
574200	575260	And I appreciate that.
575260	577400	On the one hand, if they can do this sort of thing
577400	580580	on the basis of hundreds of millions of transactions,
580580	582480	why can't we do this in our network?
582480	585880	But it was pointed out to me on several occasions,
585880	587540	most recently today,
587540	590520	the problems we're looking about detecting anomalous behavior
590520	594420	inside a military network are perhaps qualitatively different
594420	599200	than those on just credit card transactions.
599200	601480	If you want to ask why is Wells trying to hack into
601480	603900	the Secretary of Defense's computer at midnight,
603900	606080	if you want to say why is the Southeast Asian analyst
606080	608480	all of a sudden more interested in Cuba,
608480	610420	I submit that's a more complicated problem
610420	614380	than just a transaction in a different physical location.
614500	617060	And some of these, in fact, may not even be solvable problems.
617060	620200	We need to understand just what the limits are of what we can do.
620520	623760	So the fourth piece of these five characteristics
623760	626240	is enhanced computer network defense.
626260	628660	And I'll talk a little bit more in a minute about something called
628660	631400	the Joint Task Force Computer Network Operations
631400	633140	that's recently been set up.
633460	635580	But basically it's improved detection,
635580	638500	correlation of data, and visualization of data.
639060	642300	Fifth point is we need very aggressive research and development.
642560	644620	These are going to be different problems.
644620	648140	We're building really for the world of 2012 to 2015.
650020	652000	And they're not going to be solved in the near term.
652000	655520	So first of all we have to stay abreast of the changing threat.
656040	659760	But some examples of the really high-end computing that are going on,
659760	663200	or high-end R&D, a lot of work in quantum computing.
663900	665600	As Feynman said at one point,
665600	669540	by the time every bit gets down to an atomic scale,
669540	674860	then you're going to be at quantum principles whether you like it or not.
674920	677320	And so as Moore's Law progresses,
677320	680180	we're going to be driven to quantum computing whether we like it or not.
680460	684460	Some of the breakthroughs recently, or some of the developments recently,
684460	687100	much more control over single photons,
687100	692500	the ability to separate electrons into separate streams based on their spin,
692500	698900	the ability to combine information from multiple atoms onto a single photon,
698900	701160	and the building of the first quantum registry
701160	703980	with progress made towards a quantum gate.
704020	707060	So that's a fairly aggressive program.
707340	710120	DARPA. www.darpa.mil
710120	714540	They have a strategic plan there which I encourage anybody interested to take a look at.
714700	718180	Some of the things they're looking at are self-forming, self-healing networks.
718180	721000	They've already made a lot of progress in tactical environments.
721000	725060	There's a lot of questions about whether, in these dynamic networks,
725800	729700	TCP, for example, is an acceptable protocol
729700	735700	just because the overhead associated with all the handshaking is so high
735700	737980	that we may not be able to get enough throughput.
737980	739520	So we're looking at alternatives.
739520	741460	Chips scale atomic clocks.
741560	748120	200 times increase in power and size.
748500	751060	300 in power, 200 in size.
751200	754660	And then a lot of work on hybrid optical and RF connections
754660	760220	so we can get much more robust, smaller units in the field
760220	762720	to let us get around bandwidth limitations.
764120	766540	So there's an awful lot of stuff going on
766540	769460	and I think we're making some progress
769460	771640	but obviously we don't have all the answers.
771640	774800	I mentioned the Joint Task Force Global Network Operations.
774800	779300	This was changed last year from the Joint Task Force Computer Network Operations
779300	782800	because we're expressly trying to get to not just computer nets
782800	786740	but telephone nets and space networks
786740	790780	and a whole series of different approaches to the problem.
792320	795800	Its responsibility is the operation and the defense of the network
796400	800980	and it does this by coordinating and directing the activities of the network operations centers
800980	802920	and the various components across the department
802920	805920	and also the computer emergency response teams.
806320	810620	We also work very closely with law enforcement and the intelligence community.
813260	817820	The task force, I would say, has successfully responded on several occasions
817820	822020	to attacks, whether direct or indirect, on the DoD network.
822100	825520	I love you, NMDA, Witty Worm.
825520	828840	We did not have significant degradations from those.
828840	830400	We certainly don't have it 100%
830400	834140	but I think we are getting better at containing the events early
834140	840300	and mitigating the consequences of people, again, where folks' lives are quite literally on the line.
840300	841800	We're not doing this for profit.
841800	844480	We're not doing this for bragging rights.
844480	849640	We're doing this to support people who are in the field today and whose lives are on the line.
850520	853520	We've also had much better cooperation, I think, with other agencies
853520	856020	and I'll talk more about that in a little bit.
856120	858260	We certainly don't claim to have all the answers
859020	861100	and we need talented people
861100	864880	and that's one of the reasons why I really appreciate the chance to be here today
865400	870600	because you all out there represent an enormous body of knowledge,
870600	871880	an enormous amount of talent
873500	878060	and we could use a better understanding of some of the skill sets you have.
878400	884660	My main focus, frankly, is not on the hacker who's in it for sport or challenge.
884660	888140	My concern is the people who want to steal DoD information
888140	892620	and do harm, either sort of directly or indirectly,
892620	895780	to these people who are out there every day putting their lives on the line.
896060	901080	We do prosecute lawbreakers, those caught getting into DoD networks
901080	904740	and so if you are going to try to break the law and hack into our nets,
904740	908220	we will try to impose legal consequences.
908240	910920	But I'd rather emphasize today something different.
911220	912480	It's an opportunity.
912920	917980	The opportunity is if you want to work on cutting-edge problems,
917980	923120	if you want to be a part of the truly great issues of our time,
923120	926080	if you want to literally write history,
926660	928600	we invite you to work with us.
928600	933180	Quite frankly, in my job, not a day goes by that I don't come to work and say,
933180	938560	wow, what new and interesting thing is going on out there that I want to work on.
938560	942460	And it's an absolutely fascinating environment and we definitely need your help.
944420	948580	What I would ask for is your help in reducing the noise.
949120	953900	All the scanning, all the probing, all the attempted intrusions,
954380	959760	divert our resources from the truly serious attacks that are out there.
959760	964140	And have no doubt, there are people out there who seriously want to do us harm
964140	969820	and do not share the values of the freedom of information on the network.
970000	971800	There are people who want to do us harm.
971800	974700	If you haven't taken a look at it, I'd recommend Scott Borg,
974700	978980	who's done some very interesting work on the economic consequences of cyber attack.
978980	981900	He used to be up at Dartmouth and now he has his own company.
981900	983720	Really worthwhile.
984240	989060	So my final message is, again, we value your talents.
989060	992140	I would like very much to learn from what you have to offer.
992140	995000	I frankly have taken away just from the time I've been here so far
995000	998440	an enormous amount of information that is really useful to me
998440	1001280	that I would not have gotten without coming here.
1001300	1004480	I look forward to coming back and talking with you more on the Meet the Fed panel
1004480	1005960	later on in the afternoon.
1006160	1007980	And let me open it to questions.
1008100	1009340	Thank you very much.
1009340	1016610	Go ahead.
1024960	1027160	The question is on full disclosure.
1027160	1028580	And what is my...
1032490	1033450	Sure.
1034170	1039110	What's my take on full disclosure, national security compared with business, so on and so forth?
1045010	1047810	By and large, as we move to a network environment,
1047810	1050750	and again I mentioned the point is sharing of information,
1050750	1056530	and we do better in the long run by having information out there and having us share it.
1058010	1062690	It's a major cultural change for us in terms of people who've owned information
1062690	1067770	and say my owning it is more important than getting out to other people.
1068390	1075330	And so I can't draw you a clear line that says everything to the right of the line is kept hidden,
1075330	1076810	everything to the left is shared.
1076810	1079710	My inclination at this point is shared because, as I say,
1079710	1083550	I've learned stuff today about vulnerabilities that we need to get back and work on
1083550	1086130	that I wouldn't have known if I hadn't come to a place like this.
1086130	1091130	At the same time, there clearly is stuff that needs to be protected.
1091130	1098270	And my particular focus is on protecting that information that puts people's lives directly at risk,
1098270	1101990	which tends to be fairly perishable operational information.
1101990	1106630	And then the flip side is things to say the U.S. has invested tens of billions of dollars
1106630	1110610	of research and development in that gives us some kind of competitive advantage long term.
1110610	1112070	That needs to be protected.
1112070	1116070	So those are the sorts of things that I tend to focus my concerns on,
1116070	1119990	rather than just saying, well, everything has got to be kept secret.
1120290	1121070	Is that fair?
1125990	1128470	The use of COTS in weapon systems?
1131610	1135890	Let me answer that in two... pardon me?
1137190	1138710	Yeah, okay.
1138710	1140490	So the use of COTS in weapon systems.
1140490	1146310	There's an interesting study that says that the government as a whole,
1146310	1151950	federal government as a whole, now outsources more than...
1151950	1157730	now pays more in contracted services than it does in salaries of government employees.
1158770	1161870	And this trend appears to be one that's only going to continue.
1161870	1167870	So part of the problem is that almost none of us, gubbies,
1167870	1171510	know how to manage those kinds of outsourced services.
1171510	1175190	We may know how to manage a program where the gubbies are controlled and deliver it all.
1175190	1178270	We don't know how to manage these outsourced services very well.
1178710	1183990	And so the challenge is, as baby boomers shuffle off the stage,
1183990	1187150	what are we doing to train up the next generation of managers
1187150	1190690	to do a better job of managing these outsourced services
1190690	1194970	and the COTS that go with them and avoiding more ADAs and things like that.
1196330	1201350	From a security perspective, my concern is that this now means
1201350	1205410	I will have almost no clue into the pedigree of the networks
1205410	1207230	that we're becoming so dependent on.
1207230	1208830	I may know who the prime is.
1208830	1211510	I'm likely to have no idea who the second and third tier subs are
1211510	1212850	and where they're coming from.
1212950	1216050	And so this then leads me to a much greater emphasis on
1216050	1220350	not only the near real-time situational awareness of the network I mentioned before,
1220350	1224310	but on some kind of understanding of software and hardware assurance
1224310	1229410	for those critical applications where it really does make or break
1229410	1233610	the successful missile engagement or the tip of the spear issues.
1234010	1237810	And so we're looking at, for example, we have a trusted foundry
1237810	1239870	that we're building for hardware chips.
1239870	1242410	For those certain applications, we absolutely have to make sure
1242410	1244190	that the pedigree is right.
1244190	1249790	We're looking at various ways through combinations of common criteria
1249790	1254510	and CMM and others on how to get better software assurance involved.
1254510	1262290	So I think there's going to be a graduation between GOTS and kind of trusted COTS
1262290	1264970	and then what's just out there in the marketplace.
1266810	1270650	Because I think we're migrating to this much more commercial environment
1270650	1274570	where we, frankly, are never going to know where a lot of this stuff comes from,
1274570	1281050	I would tend to put more of my emphasis on the anomaly detection of the network,
1281050	1289150	the strong identification, authentication, and the response to problematic behavior in the net
1289150	1293950	than I would worry about what was going on in every piece of software in the system.
1294170	1300390	And so you draw the line here as to what's in a weapon system.
1300390	1307450	If you're dealing with a fighter plane, that's pretty much going to be, at the very least,
1307450	1314010	the high pedigree commercial software and probably is going to be dedicated design systems.
1314070	1318890	But it turns out that for us, exercise after exercise after exercise shows
1318890	1324990	that the most dangerous, most vulnerable parts of our operational chain, if you will,
1324990	1327110	are things like logistics and medical.
1327110	1331410	And in that, you're almost certainly going to have lots of cost products.
1331630	1334490	So I'd love to give you an answer as to what's a weapon system.
1334490	1339450	I'm more interested in what do you need to assure the mission to complete the job
1339450	1343790	irrespective of the level of attack you're under, and that's going to be a layered process.
1362380	1367180	The question is, what do I feel about how other foreign governments stand
1367180	1371380	in information assurance in England, Russia, China, whatever.
1373140	1378160	I think we understand at this point that almost every significant operation we're going to do
1378160	1381560	is going to be in some kind of coalition environment.
1382860	1387960	And therefore, we have to take into account the fact that our coalition partners
1387960	1393460	are going to come from very different levels of information assurance and capability.
1393460	1397140	I was struck by, at one point, one of our coalitions.
1397140	1402640	Right now, you have long-time partners like Lithuania, Moldova, and Tonga.
1403580	1406740	So this means that we're going to have to...
1406740	1410340	In fact, we are working very hard on developing something called MNIS,
1410340	1412600	multinational information sharing.
1412660	1417580	And it's going to have to give you some sort of multi-level security, firewalls, and guards
1417580	1421660	to allow you to interoperate them in some kind of a shared space
1421660	1425880	while protecting those core command and control functions, say,
1425880	1428660	and key pieces of data that you don't want to share.
1428660	1433020	So I spend less time actually worrying about what foreign governments are doing
1433020	1435260	because I don't have much control over that,
1435260	1439140	and rather having to put together an operational networked environment
1439140	1441920	where I can bring in unanticipated users.
1442300	1447980	To that effort, I would say that we are trying to completely rethink the paradigm
1447980	1452240	for DoD to operate outside the .mil domain,
1452640	1457540	to work with non-traditional partners like the Agency for International Development,
1457540	1461080	UN, Doctors Without Borders, and even commercial partners
1461080	1464180	in the kind of stabilization and reconstruction operations
1464180	1467300	that we're seeing more and more of in what we're doing.
1467360	1469800	We learned a lot from tsunami.
1470160	1473020	We learned a lot... we are learning a lot from Afghanistan.
1473360	1477340	Some of you may know there's something called the World Summit on the Information Society
1477340	1479560	that's coming up in Tunis.
1479620	1482720	It's the second of two conferences this November,
1482720	1485180	and we'll be working with a whole batch of the international community
1485180	1487180	to try to look at ways we can do that.
1487440	1490500	I personally think we are never going to get to the stage
1490500	1494440	where we'll allow these pick-up team partners
1494440	1497560	to get inside, say, the Nibarnet firewalls,
1497560	1501740	which means that we have to go outside and have .net or .org-type domains
1501740	1504700	in which we can operate and share the information.
1504700	1509020	So the long answer is I'm not too much worried about what foreign governments are doing.
1509020	1512780	I'm trying to set the conditions whereby we can work with a whole batch of different people
1512780	1514500	in different circumstances.
1514800	1516060	Back there first.
1531900	1534800	The question has to do with integrated attacks,
1534800	1538860	something like physical terrorist attacks
1538860	1543140	coupled with attacks on PBX boxes and this sort of thing.
1543140	1546980	And this clearly is an area that we have to be working on and working on harder.
1546980	1550980	I personally think that the...
1552780	1557660	Again, my goal is to get to mission assurance, not just information assurance.
1557880	1560720	Coming from a Navy background, I tend to think of a ship
1560720	1563260	which is built with watertight compartments
1563260	1566680	and you can still float with a couple of compartments flooded
1566680	1570240	and you have a starboard engineering plant and a port engineering plant
1570240	1572440	so if one is damaged, you can still carry on.
1572440	1576780	You've got multiple fighting men and you train and you train and you train and you train.
1576780	1581820	So we need to take into account the fact that an attack may be just cyber,
1581820	1584220	just physical, a mix of physical and cyber
1585280	1588020	and work the problem in an integrated manner.
1589580	1593060	This is not entirely within the domain of the Department of Defense.
1593060	1596620	A lot of this comes now up in the U.S. with the Department of Homeland Security
1596620	1601680	where a lot of the cyber defense and national infrastructure rides.
1601680	1604960	So in fact, this week I've just spent several meetings with people
1604960	1606580	from the Department of Homeland Security
1606580	1611160	on how we in defense and the private sector can do a better job
1611160	1615520	at coordinating the infrastructure defense on which things ride,
1615520	1619240	E911, those sorts of things, to give an integrated approach.
1621810	1625150	So is there an answer? No. Are we better off than we were?
1625150	1627510	I mean, GETS worked very well.
1627510	1631450	The Government Emergency Telephone System worked very well on 9-11.
1631450	1634850	We now have the wireless equivalent of that in place.
1635190	1639550	And so you basically priority overrides in the wireless service for first responders.
1639950	1644870	We've had a series of major exercises called Top Off, Top Officials,
1644870	1652710	where you bring the FBI and Homeland Security and National Security Council,
1652710	1656050	all that together, and actually run through some pretty horrific scenarios
1656050	1658270	and how the decision making would flow.
1658270	1661430	So a lot of this stuff, quite frankly, is as much a policy
1661430	1666450	and a decision making process as it is the technical parts of the network.
1666450	1668390	And that's what we're trying to get right now,
1668390	1670650	while we inventory the networks, and you will,
1670650	1674370	and find out what's available out there to use when the situation comes up.
1675590	1677010	Okay? Someone's down here?
1677230	1680370	There's one behind. Go ahead.
1688790	1691330	The question is, do we allow the implementation of software
1691330	1693350	that hasn't been internally audited?
1693350	1696550	All software needs to have been validated through the NIAP,
1696550	1700450	to be used in the DOD National Information Assurance Partnership,
1700450	1702190	to be used in the DOD networks,
1702190	1705950	and in most cases it also has to go through an interoperability certification
1706510	1708750	through the Joint Interoperability Test Center.
1716000	1719360	Well, in some of the code, there is code review in the NIAP.
1720120	1722460	Not in JITIC, but there is in the NIAP.
1723800	1726380	And then there are other things that NSA does,
1726380	1728100	review code and that sort of thing.
1728100	1729860	So, you know, we're cautious.
1729860	1733180	I mean, this question goes back earlier about what do we do with commercial software.
1733700	1740440	And part of it is, you know, if we're going to use something, say,
1740440	1745360	like enterprise resource software, ERP, or PeopleSoft, or something like that,
1745360	1748060	I mean, you're obviously not going to go through and try to change
1748060	1751260	or validate every piece of code in that,
1751260	1753120	and yet we're going to be dependent on it.
1753120	1757480	And so the question, again, is how do you detect anomalous behavior in that?
1757480	1763160	But for those things that are in our nipper net or shipper net,
1763160	1765980	we're requiring the NIAP certifications.
1765980	1766720	Sir?
1777500	1781440	The question is, has anybody given any thought to preventing cell phones
1781440	1786680	from being used for detonating IEDs by war-dialing all the cell phones in Iraq?
1787620	1792060	The amount of time we spend on IEDs is quite extraordinary.
1792060	1797780	I mean, literally tens of hours a week on the IED problem.
1798200	1801160	And the cell phone issue has actually come up a lot.
1801400	1804740	Now, there are ways to get to cell phones beyond just war-dialing.
1804740	1807080	I mean, there are different ways to get to them.
1807140	1809400	And so that problem has been addressed.
1809400	1817320	I have to tell you, there's not a lot of evidence that cell phones, per se,
1817320	1819360	have been used to trigger IEDs.
1819360	1824780	There's much more stuff on garage door openers and those sorts of things than cell phones, per se.
1825040	1830320	But I guess all I can say in this forum is we understand the potential threat of a cell phone.
1830340	1834720	Guys are spending lots and lots of time on, you know, when we see it being used like this,
1834720	1835920	how would we counter it?
1835920	1840020	I haven't heard war-dialing specifically as a suggestive way to do it,
1840020	1843640	but there are other kind of electronic ways they've been looking at countering it.
1845220	1850660	There's nothing, frankly, of a higher priority issue for the military right now
1850660	1856220	than addressing this improvised explosive device issue in Iraq, because that's what's killing our people.
1884160	1888180	The question is, the DOD has spent a lot of money to develop AIDA.
1888180	1890320	We're not using it. Other people are.
1890320	1892160	Is there a way we can bring it back?
1893840	1896720	Let me take that for the record and go back and look at it.
1896740	1903340	Frankly, my sense is that time has moved beyond AIDA.
1905120	1909240	And there are lots of other ways to do business, especially if you go to the net-centric environment.
1909240	1912100	So I haven't paid a lot of attention trying to revitalize it.
1912100	1915580	If you want to give me your name later on, I'll take it for the record and get back to you.
1915580	1917580	It just hasn't been something I've focused on.
1932980	1938500	The question is, what's the ratio in the number of IEDs, improvised explosive devices,
1938500	1943240	that are being detected and disarmed before they are exploded?
1943240	1945000	And the answer is, yes, we have those data.
1945000	1946780	I'm not sure I can share that.
1947200	1951820	What's happening, though, is that we're getting better at detecting them and disarming them,
1951820	1955980	but they're making them more lethal, so each one causes more attacks.
1955980	1963900	I mean, using explosive-formed jets and things like that, as opposed to just focused explosive jets,
1963900	1966480	rather than just a circular explosion.
1966540	1971980	So, anyway, it's a typical dynamic of offense and defense.
1973760	1974880	Sir?
1983520	1984700	What kind of scorecard?
1985720	1986700	Assist?
1986700	1987260	Yeah.
2005640	2008520	So the question is, is there anything like an assist scorecard,
2008520	2013500	and what are we doing with guidance for the private sector about implementing data tagging?
2013500	2014380	I'll get you next.
2015980	2020400	And I would say that we're doing...
2020400	2023760	I mean, a lot of our work is based on various kinds of balance scorecards.
2023760	2026160	We're trying to put together metrics.
2026160	2030940	Right now, the deputy is challenging us on getting metrics for the information assurance world.
2031080	2033640	And I have to tell you, this is one of the hardest problems I've got,
2033640	2036420	and this is something I would really ask for your help with.
2036420	2042860	The question is how you measure return on investment on information assurance type things.
2042860	2053680	So if I'm going to go in and put $100 million into some sort of technique to get to better multi-level security in 2012,
2054240	2062260	and the budgeteers are out there saying, well, show me that's going to give us a 14% or a 22% or a 71% increase in security.
2062260	2064120	It's really hard to do that.
2064120	2070680	And so the idea of a link between metrics and investments and all that is a hard problem for us.
2070680	2076180	I mean, I can go through right now and measure what's working in different network operation centers and all that,
2076180	2080840	how we're doing on implementing known vulnerabilities and all that,
2080840	2084620	and more concerned about the long-term return on investment metric.
2084620	2090840	With regard to the public-private sector, again, a lot of this lies in the Department of Homeland Security.
2090840	2099560	And part of the problem we've had ever since PDD 63, which is the critical infrastructure protection in the last administration,
2099560	2106000	is building the trust, if you will, to be able for two-way sharing of information.
2106620	2112620	We've spent a lot of time working with Congress and others on trying to change laws
2112620	2118660	so you can provide better protection to proprietary information that comes up through the ISACs,
2118660	2120980	these information-sharing and analysis centers.
2120980	2126980	And we're trying to work with getting the government being more willing to share a sense of information on the way back down.
2127240	2137060	If I were to say anywhere, I think the telecommunications sector, the National Security Telecommunications Advisory Committee,
2137060	2140680	that process is working pretty well in the telecom sector.
2140900	2145420	I don't think it's working as well in, say, transportation or energy or others.
2145420	2149480	And what's coming to be a concern for me is, as SCATE is,
2149480	2156780	the supervisory control and data acquisition nets become more and more a part of all of our critical infrastructures.
2161380	2166300	We're making the most progress in the telecoms and the ISP world.
2166300	2171180	I don't think we're getting as much progress in controlling the information technology in these other sectors
2171180	2174320	where it may be equally critical to us on a national basis.
2174320	2183460	So the answer is, one piece of advice I would have is the DoD and the Intel community have committed,
2183460	2186820	I mentioned the global information grid and the programs.
2186820	2189200	There are three other pieces that go with that.
2189200	2192560	There's the network operations, network resources management piece,
2192560	2196260	about how you balance the use of resources in the network.
2196260	2201740	There's a spectrum management piece, and the key underlying bit is the net-centric data strategy,
2201740	2204880	which is an XML-tagged approach to the problem.
2205440	2213900	And it turns out that DoD and the intelligence community and NATO have almost identical net-centric data strategies.
2213900	2217480	And we've really had some very good luck over the past several months
2217480	2223880	in moving towards a service-oriented architecture approach and a shared situational awareness.
2224120	2228480	That data strategy has not yet been adopted by the Department of Homeland Security,
2228480	2232780	which means it's not being infused into the private sector through those channels.
2232940	2237320	And over the past week, we've actually been working hard with the senior leadership of DHS
2237320	2240500	to get them to adopt that kind of a strategy.
2240540	2243740	So maybe that'll be an answer to one part of your question.
2244040	2264530	The question is, as warfare goes net-centric, how do you envision managing security,
2265050	2267610	connecting together what used to be stand-alone systems?
2270030	2274870	I don't think there's ever going to be a closed-form solution where you lock the door and say,
2274870	2278250	we got there, let's go home, turn off the lights and go home.
2279570	2284790	There are just too many dynamic pieces of the puzzle in terms of not only the evolving threat,
2284790	2286790	but the rolling out of new technologies.
2286790	2294850	There was a very good session this morning on vulnerabilities associated with XML and service-oriented architectures.
2294910	2297750	Three years ago, we wouldn't have paid any attention to that.
2297750	2300930	And so now we need to fold that into the process.
2300930	2307110	So I think it's going to have to be an ongoing, dynamic series of reviews.
2308310	2311130	The first key part of this is cultural.
2311230	2316530	If you talk to the intelligence community, they have a concept called ORCON, Originator Controlled,
2316530	2319650	which basically says, I wrote the information, it's mine.
2320550	2324430	And so just trying to break down the stovepipes to share that
2325290	2331090	becomes much more an issue of politics and culture than it is of physically getting the bits and bytes to work out.
2331130	2340510	So I think it's going to be a mix of cultural solutions, this doctrine, organization, training, evolution, the physical.
2340710	2346230	And even if I could give you a solution today that said, I'm at the 95% level, I'm happy with it,
2347270	2349070	it won't be that way tomorrow.
2349070	2354430	The one thing I would say in DoD that, again, I look for your help on,
2354430	2365350	if I'm a credit card company and I realize that I'll probably get 3-4% loss rates in fraud or whatever,
2365350	2370590	I can factor that into my calculus, I can put that in my interest rates, I can factor that in.
2370750	2375070	And what you get from that is an explosion of credit across the economy
2375070	2380670	that transforms the ability of everyday people to buy things they never would have been able to buy before.
2381410	2385390	I don't know anybody lately who's gone to the top secret control officer and say,
2385390	2388170	it's okay to lose 3% of your documents a year.
2388570	2397290	Even though, in the net-centric model, maybe 100 people were lost because some piece of information were compromised,
2397290	2402250	maybe 10,000 were saved because the fight was over in three days rather than three months,
2402250	2405430	and the value of net-centricity had an upside.
2405450	2413730	So we need to think through our cost-benefit analysis to put more emphasis in the military on the upside benefit,
2413730	2415990	even as we focus on the cost.
2416750	2420530	Not a neat, clean answer, but that's where we're looking at.
2420630	2421670	Over there, sir?
2423030	2424070	Please.
2438650	2442470	Critical factors in my going, I mean, how I got to be CIO.
2443850	2452170	I'm sort of in a strange situation in that I was career Navy, and so I spent 26 years in uniform,
2452170	2458550	and then about seven years in the Office of the Undersecretary for Policy,
2458550	2464210	working largely on the interface between policy and technology issues.
2464550	2475430	And so, in 1998, the Secretary decided to beef up the role of the Assistant Secretary for Command, Control, Communications, and Intelligence,
2475430	2478570	which is what my organization was then known as.
2478570	2481490	I was asked to go over and be the Principal Deputy in that organization
2481490	2488770	because I had an understanding of less the technical details and the balance between policy and technology.
2489090	2493950	I mean, my own education is, my undergraduate work was in physics and oceanography.
2493950	2495830	My master's is in applied math.
2495830	2497910	My doctorate's in international relations.
2497910	2503810	And I found that mix of a policy science and engineering science to have been a really valuable combination.
2503810	2506230	So, just a long story.
2506230	2511010	What's happened now is my permanent title is Principal Deputy.
2511570	2517970	Our Assistant Secretary left about 18 months ago, and so I've been acting as the CIO since.
2517970	2521910	But I think, in my case, it certainly wasn't a commercial background.
2521910	2526970	It was less a technical background than having the policy-technology interface understanding.
2548870	2553030	The question is, I've been focusing a lot on information assurance.
2553030	2561830	And as you play out 2012-2014, how do I see the offensive side playing out of information operations?
2562050	2566090	I'm really limited in what I can say on that in this venue.
2566090	2575730	But I think one of the key points is, as the network becomes the center of gravity for military operations...
2575730	2581030	I mean, right now, we're probably the most net-centric of any military in the world.
2581030	2585330	It's a model that's being adopted by a number of others as well.
2585850	2591730	As more and more countries come to depend on the network, then how you attack that network...
2591730	2595430	be it a physical attack or a cyber attack or whatever...
2595430	2598790	will become a more important thing to work on.
2598790	2607370	And I think, also, what I would expect to see is not just a single solution, but a broad...
2607370	2609510	it'll become a target just like anything else.
2609510	2613350	One of the things we're saying is we need to fight the network like a weapons system.
2613350	2617070	You need to think of it as a ship, tank, an airplane. It's a critical component.
2617250	2620570	And so, as a result, you have to defend it against the full range of threats.
2620570	2624950	And we have to be able to, you know, similarly mount the full range of threats.
2624950	2626570	That's probably about as far as I can go.
2627830	2631510	Somebody in the back. I'm sorry, I can't see hands back there. I'd be glad to...
2636810	2637810	Yeah, please.
2663080	2664340	It's a really good question.
2665220	2671860	What about cyber attacks and penetrations that originate from foreign countries and how do we prosecute them?
2672540	2677980	I think, as most of you know, the attribution of a cyber attack can be a really hard thing to do.
2678580	2691060	And so, with a number of countries, for example, in Europe and the Interpol and a number of bilateral agreements,
2691060	2696200	we now have some pretty good mutual law enforcement rules to be able to address...
2697240	2702140	For instance, the UK. The UK would either prosecute people who hack into our nets
2702140	2705720	or, in some cases, we can extradite them to be prosecuted here.
2705840	2708540	There are other countries where, frankly, it's a free ride.
2708540	2715780	If you hack from there, there's no... In some cases, it's not a crime to the hacking in those nations' laws.
2715840	2718620	And if we don't have agreements with them, there's not much you can do about it.
2718620	2726440	So, I think over the past ten years, we've made a lot of progress in working out multilateral and bilateral law enforcement agreements,
2726440	2729260	but it's certainly a patchwork quilt around the world.
2766760	2773280	The question is, in these countries that are not doing a good job in policing their own cyber security,
2773280	2778480	or which we don't have agreements with, are there other ways we could put pressure on them?
2778480	2780860	Postal agreements or something like that, too.
2780860	2785740	And the answer is, the Defense Department doesn't do... That's not our thing.
2785740	2788140	That would be the law enforcement or State Department.
2788140	2793900	When we have the Ask the Fed panel later on, if you come, that would be a very good question to ask for the folks who'd be here,
2793900	2795820	because there'd be people who could address it.
2797300	2798620	Back there first.
2802660	2805600	What does IPv6 capable really mean?
2807740	2812660	We've set a goal of 2008 to implement IPv6.
2813240	2819840	And it's going to be done through a technology refresh policy rather than a Big Bang solution.
2820060	2824380	And so I would guess we'll be running dual stack for a long time.
2832360	2834320	Tell me more about your question.
2834320	2842280	Because what we're essentially saying is anything that we're buying since last year, or 2003, I think, should have been IPv6 capable.
2842280	2845300	And your question is, that's an ambiguous definition?
2852480	2859720	I see the rollout of IPv6 is going to be, we're pushing as hard as possible.
2859720	2867320	There was just a congressional hearing that was basically saying that the government as a whole should be doing more with IPv6.
2867320	2870840	And the DoD was really the only organization that was taking the lead.
2871040	2873680	And so the Congress seemed fairly happy with what we're doing.
2873680	2877960	At the same time, as you know, there are lots of issues associated with it.
2877960	2880260	What kind of costs are going to be imposed?
2880260	2886980	How quickly are we going to retire the IPv4 systems if they can't run dual stack?
2886980	2893900	So I don't think this is going to, you know, on the 31st of December 2008, there's not going to be a magic cutoff.
2893900	2896220	We're just going to try to get there as fast as possible.
2896320	2903240	Most of it's going to be new equipment we buy, data we refresh, are going to have to be IPv6 compatible.
2903240	2906860	But we can talk later on if you want. I don't think that's the answer.
2912910	2914630	By the which project?
2915890	2917910	I can't actually know.
2918210	2922150	The question is, can I comment on the achievements of the DTUR project?
2922250	2925070	And I'm not familiar with the project. Give me some more background.
2937420	2942980	It's an NSF DoD funded testbed, if you will, to look at the internet.
2942980	2948200	Actually, I'd like to learn more about that because we're in the process right now of assembling
2949500	2953800	an end-to-end testbed for the global information grid.
2954000	2956060	And we've been going around inventorying, if you will.
2956060	2960680	For example, I'm funding something at the Naval Research Lab that's an end-to-end testbed.
2960700	2964200	The Joint Forces Command down in Norfolk has an end-to-end testbed.
2964360	2966380	The Army has one out of Fort Hood.
2966380	2970120	So I'd like to learn more about where DTUR goes because I'm not familiar with it.
2980210	2983590	The question is, why are we moving towards IPv6?
2984630	2992810	Well, we need the security and the mobile environment features
2992810	2999610	of being able to automatically establish links with adjacent networks, those sorts of things.
2999910	3005250	The security, there's a sense that the rest of the world, China, whatever, is likely to move to it.
3005250	3010170	We're certainly not doing it because right now we're constrained in IP address space.
3010170	3015590	But the department is going to be explosively moving to unattended ground sensors
3015590	3019550	and unattended, well, mainly ground.
3019550	3022710	And that's going to start using up our space.
3022730	3027090	We were trying to not have to go to NATs for some of these sub-NATs.
3027110	3029590	So that was essentially the reasons that drove it.
3044210	3047130	The question is, how much collaboration do we do with other agencies
3047130	3050370	on information sharing and information security?
3051030	3059350	As I mentioned, we in the intelligence community and NATO have a very close relationship
3059350	3062630	based on the fact we have a common data strategy.
3063830	3067550	NATO has something called STANAG, Standing Agreements.
3067590	3074010	And in fact, we've tried to base a lot of our policies and technologies on NATO STANAGs.
3074010	3080430	So it's not just U.S. only, and we're actually trying to show it's an alliance event as well.
3080610	3084190	I think there are still some major cultural differences in here,
3084190	3087930	especially with the intelligence community, in terms of some of the stovepipes
3087930	3089990	that have been around for a long time.
3090150	3095230	And they probably feel that we're moving too quickly to need to share or vice need to know.
3095230	3100090	And we probably feel that we'd like them to put some more information in the network faster.
3100090	3105330	So the discussions are ongoing continuously.
3105330	3109090	The President signed an executive order last summer
3109090	3113430	mandating the sharing of terrorist information across the government.
3113930	3120050	The legislation that set up the Director of National Intelligence
3120050	3124550	amplified that to actually set up a position within the DNI's office
3124550	3127530	as a program manager for information sharing.
3127530	3130630	So there's just a lot of energy in this, and we're just trying to pull it together
3130630	3133970	across the messy processes that are the U.S. government.
3150640	3154900	The question is, do I think there's enough control by the government over the Internet,
3154900	3156220	not enough control?
3157420	3163220	This is going to come up in the World Summit in Tunis,
3163220	3165720	and we're working out the various positions.
3165820	3171260	I think, by and large, the U.S. is willing to see more role in Internet governance,
3171260	3174180	by other countries, but we're not willing, at this point,
3174180	3179000	to give up some of the key features like ICANN and that sort of thing.
3179060	3182780	The positions, frankly, are still being refined.
3196380	3201600	Let me see. First of all, I can only speak for the Department of Defense.
3201840	3208600	And from the DoD perspective, I have no problem with the current level of control of the Internet.
3209120	3211860	It's a good question to ask the Fed panel,
3211860	3214440	because the law enforcement people might have a different view.
3236330	3242150	The question is, there's a need to keep a 10- to 15-year focus on information assurance.
3242290	3249070	The concern that recently the DARPA funding for the longer-term computer science projects has dried up.
3249070	3250730	What do I think about that?
3250990	3253650	I know there's been a conscious effort on the part of DARPA
3253650	3262830	to focus on projects with more, what do I want to say, direct return on investment from the R&D.
3263250	3269110	There's always going to be a tension between what the 10- or 15-year problem is and what the local one is.
3272610	3279330	Candidly, I've more or less accepted the view of the director of DARPA where he should put his resources.
3279330	3285110	We're doing a lot of work, not just with DARPA, but also with NSA, and also with the academic community,
3285110	3287490	in terms of the long-term projects.
3287550	3292350	And at this point, I have more problem with the point I made earlier of how to justify
3292350	3298870	what I believe should be a higher level overall across the board in information assurance projects,
3298870	3305590	rather than whether DARPA is not doing enough, because there are ways to cover that in other areas.
3305590	3307550	So that hasn't bothered me particularly.
3307550	3308950	Ma'am?
3331970	3340310	I'm sorry, the question is, as we work outside the .mil domain, the areas, the ones I cited,
3340310	3349650	were non-traditional partners within the U.S. government, like USAID, with whom DOD hasn't typically worked,
3349650	3357550	international organizations like the United Nations, some NGOs, and I cited Doctors Without Borders,
3357550	3362630	of course there are a whole raft of them, and some of these in the past have actually had in their charters
3362630	3365450	that they should not work with the military.
3365950	3370730	And I think one of the things that we've made some progress on over the past year or so,
3370730	3378270	particularly since tsunami, is a recognition that if we really are going to provide services to people in distress,
3378270	3381930	and frankly from my perspective, I'm just talking from my DOD hat,
3381930	3386970	I'm interested in the stabilization of these situations so they don't turn into problems
3386970	3389230	where the military has to intervene.
3389510	3392590	So in those types of situations, we have a common interest.
3392670	3399050	And that was, I just used Doctors Without Borders as an example of a broad class of non-governmental organizations.
3400850	3404810	Absolutely, NGOs are a group who are actively courting.
3409410	3411030	You had something here, right?
3411030	3413650	Go ahead.
3428170	3435050	The question is, have we seen anything similar to TPED, the Trusted Product Evaluation Program for military?
3440580	3445320	Yeah, for power grid and banks and other critical infrastructures and things like that.
3445320	3449080	That's a very interesting question. I hadn't thought of it. Let's talk afterwards.
3449240	3458340	Because I think you could do a lot with that, but we need to work that through this messy interagency process
3458340	3459680	and I haven't tried to do that.
3459680	3463360	I'm getting a sign here, I think maybe two more questions and we'll have to call it a day.
3463480	3483660	The question is, information assurance and contractors, how does that affect security
3483660	3486480	when information assurance isn't part of their award fee?
3486900	3494860	One of the things we've got to learn to do better in this outsourcing of services is to write our contracts smarter.
3494860	3506060	I was out in Afghanistan earlier this year and the contracting officer's representative for the 25th Infantry Division in Bagram was actually down in Qatar.
3506200	3516100	And if they wanted to do combat operations after hours, they would have to call Qatar and get money added to the contract in order to conduct the operations.
3516100	3518300	Because we just hadn't written the contract right.
3518300	3524740	So it seems to me in this environment we've got to write the contract so that information assurance becomes part of the award fee structure.
3524920	3527600	We're not there yet, this is a learning process.
3528240	3531840	Any more?
3533340	3536140	Thank you very much, I appreciate a chance to talk with you today.
3543000	3546580	Come work with us, I'd love to draw on your talent pool. Thanks again.