[00:03.820 --> 00:09.180]  ...defense at the edge of a network that begins with a soldier in the foxhole and vice versa.
[00:09.740 --> 00:14.040]  We're trying to move from a smart push to a smart pull system.
[00:14.220 --> 00:20.400]  Smart push, think of a telephone. I need to know not only where you are, but what you need to know in order to convey the information.
[00:20.620 --> 00:24.980]  Smart pull says I probably don't know where you are and I certainly don't know what you need to know.
[00:24.980 --> 00:29.420]  So we'll use the network to provide the information for you to gather it.
[00:29.420 --> 00:35.040]  The basic thing we're trying to get to is to take data and turn it into information,
[00:35.040 --> 00:38.060]  and turn it into knowledge, and turn it into understanding,
[00:38.060 --> 00:42.600]  and then into action as quickly as possible in near real time if we can.
[00:43.220 --> 00:47.100]  And the point of this, it's not just material, we're not just talking about the networks.
[00:47.320 --> 00:50.920]  We're talking about you have to change the doctrine by which new business,
[00:50.920 --> 00:55.220]  we have to reorganize the way we are set up, we have to train our people.
[00:55.220 --> 00:59.460]  Obviously there's some material pieces, there's a key leadership piece,
[00:59.460 --> 01:03.880]  we need to get the personnel in place to be trained to do this,
[01:03.880 --> 01:06.540]  and we have to have the facilities and the infrastructure to support it.
[01:06.540 --> 01:13.580]  So all of this needs to be evolved together in order to get the objective we're looking for.
[01:13.680 --> 01:16.940]  The mission I think is more complex than a lot of people realize.
[01:16.940 --> 01:23.560]  It's not just war fighting, it's a mix of that, of course, plus business, plus intelligence, plus logistics,
[01:23.560 --> 01:26.280]  and also increasingly importantly peacekeeping.
[01:26.540 --> 01:31.700]  I was in Afghanistan in January talking with people in the provincial reconstruction teams
[01:31.700 --> 01:33.980]  working with the Afghan provinces.
[01:33.980 --> 01:37.920]  We did a lot with the tsunami relief efforts in Southeast Asia.
[01:37.920 --> 01:41.300]  We've had people supporting relief efforts in Darfur.
[01:41.300 --> 01:44.600]  All of this relies on the same network we're talking about.
[01:45.420 --> 01:48.780]  A point to be made is that when we do get to combat,
[01:48.780 --> 01:54.060]  it's a fundamentally different sort of thing than one might have expected in the past.
[01:54.120 --> 01:57.380]  Several people now talk about something called the three-block war.
[01:57.520 --> 02:02.180]  You're engaged in peacekeeping on one block, you're putting down a riot on the next,
[02:02.180 --> 02:05.200]  and you're engaged in full-fledged combat operations the next.
[02:05.200 --> 02:09.960]  It's not the clear kind of distinction most of the planning and most of the people are used to
[02:09.960 --> 02:12.140]  in terms of the phases of operations.
[02:12.440 --> 02:15.780]  People also talk about something called a strategic corporal,
[02:15.780 --> 02:18.820]  meaning that decisions made by people at every level at this point
[02:18.820 --> 02:22.920]  get into the newspapers, get into the CNN, get into whatever,
[02:22.920 --> 02:26.160]  and they become sort of national issues very quickly.
[02:26.180 --> 02:29.400]  So in short, the whole structure, the whole hierarchical structure,
[02:29.400 --> 02:34.940]  is breaking down to a much flatter, much more networked, much more dynamic organization.
[02:36.540 --> 02:41.320]  There are a lot of things in the security field that relate to what industry is doing,
[02:41.320 --> 02:49.340]  but frankly there's a scale and a complexity and perhaps even a sort of stakes issue here
[02:49.340 --> 02:52.520]  that doesn't really reflect a lot of what industry has.
[02:52.600 --> 02:57.240]  We have people whose lives literally are on the line today, depending on the network.
[02:58.140 --> 03:03.380]  Somebody described DoD as being just like Walmart, except that...
[03:04.180 --> 03:06.380]  Yo, Walmart! Okay.
[03:08.040 --> 03:11.640]  Except that every store is mobile, the competition fires ordnance at you,
[03:11.640 --> 03:13.960]  and Christmas comes randomly on any given day.
[03:15.140 --> 03:17.580]  So, other than that, we're more or less the same.
[03:18.080 --> 03:21.920]  We have this thing on which, of course, the key to network-centric operations,
[03:21.920 --> 03:23.080]  you've got to have a network.
[03:23.500 --> 03:28.320]  And the basis of this is something we call the Global Information Grid, or GIG,
[03:28.320 --> 03:30.700]  since we're addicted to acronyms.
[03:31.960 --> 03:35.540]  And there are six major programs that comprise this GIG,
[03:35.540 --> 03:38.160]  and it's not just material, it's also the people and processes
[03:38.160 --> 03:44.980]  who store, process, transmit, add value to information across the department.
[03:45.360 --> 03:49.020]  So, four of the programs deal with the transport of information.
[03:49.620 --> 03:54.440]  One deals with enterprise services, and I've just come from a very sobering talk
[03:54.440 --> 04:01.260]  from Scott Sender on vulnerabilities of network services.
[04:01.820 --> 04:04.680]  And one deals with the information assurance of the network.
[04:04.680 --> 04:07.740]  By the way, I'd like to talk for about 30 minutes, then I'll open it to questions.
[04:08.800 --> 04:11.440]  The program's first four deal with transport.
[04:11.440 --> 04:13.360]  One is a terrestrial fiber net.
[04:13.360 --> 04:18.320]  We call it the GIG bandwidth expansion, 10 gigabit per second, OC192 fiber,
[04:18.320 --> 04:21.280]  to the 80 largest command and control nodes around the world.
[04:21.280 --> 04:24.700]  That'll be full operational capability by the end of this year.
[04:25.280 --> 04:29.860]  The second is to extend this global network to mobile units,
[04:29.860 --> 04:32.700]  and that's a transformational satellite that's going to take lasers
[04:32.700 --> 04:37.840]  around the satellite ring to give you, again, 10 gigabits a second anywhere on the planet.
[04:38.680 --> 04:42.500]  One of the purposes of that is to use laser uplinks from aircraft,
[04:42.500 --> 04:46.460]  so we won't have to use so much spectrum to exfiltrate the data
[04:46.460 --> 04:49.700]  from the various kinds of reconnaissance sensors on the aircraft.
[04:49.940 --> 04:54.160]  The third piece of transport is something called the Joint Tactical Radio System.
[04:54.160 --> 04:57.980]  It's a software-defined radio, software-controllable architecture,
[04:57.980 --> 05:03.400]  and that's designed to provide the mobile routers on the IP mobile networks
[05:03.400 --> 05:07.720]  in order to bring these capabilities to the tactical units.
[05:07.740 --> 05:11.100]  Finally, there's something called teleports that links the ground infrastructure
[05:11.100 --> 05:13.700]  with the on-orbit infrastructure.
[05:13.700 --> 05:18.200]  So that's kind of the very heterogeneous network we're talking about.
[05:18.200 --> 05:22.300]  It's 10 gigabit per second, stable, to 10 kilobit per second,
[05:22.300 --> 05:25.260]  very unstable in tactical mobile environments.
[05:26.140 --> 05:30.040]  The enterprise service, Net-Centric Enterprise Services,
[05:30.040 --> 05:35.000]  is basically beginning to take you to a software as to a service-oriented architecture.
[05:35.000 --> 05:36.960]  I'll talk more about that in a bit.
[05:36.960 --> 05:39.640]  And then there's a whole information assurance program
[05:39.640 --> 05:42.240]  called the Gig Information Assurance Program.
[05:42.240 --> 05:49.500]  We spend about $2.2 billion a year in DoD and with NSA on the security of the network.
[05:52.410 --> 05:54.810]  One of the pieces we're trying to work on
[05:54.810 --> 05:58.410]  is to move from this stable environment to a tactical environment.
[05:58.410 --> 06:02.610]  This perhaps is something that a lot of the commercial analogies break down
[06:02.610 --> 06:07.270]  because we have to be able to handle very dynamic environments.
[06:07.270 --> 06:10.310]  Of course, the cell phone environment is dynamic also, mobile,
[06:10.310 --> 06:16.250]  but here with people jamming, shooting, very kind of severe environmental conditions.
[06:19.440 --> 06:23.820]  The paradigm that goes with this is a movement from need to know,
[06:23.820 --> 06:26.380]  which is kind of hoarding the information, I own it,
[06:26.380 --> 06:27.760]  to need to share.
[06:27.760 --> 06:29.320]  You're not going to get the value of the network
[06:29.320 --> 06:32.120]  until you get the information out on the network.
[06:32.300 --> 06:34.840]  And this is much more of a policy and a cultural thing
[06:34.840 --> 06:37.120]  than actually a technological thing.
[06:38.340 --> 06:40.400]  A couple people issues come to mind.
[06:40.400 --> 06:43.180]  In 1996 or 7 or so, I went up to New York
[06:44.000 --> 06:47.400]  and listened to a group of presentations by a series of analysts
[06:47.400 --> 06:49.420]  from the computer security industry
[06:49.900 --> 06:51.780]  talking to people on Wall Street.
[06:52.360 --> 06:55.320]  And so there's maybe a certain amount of hype in the presentations,
[06:55.320 --> 06:57.480]  but what I took away was,
[06:57.480 --> 07:02.240]  we, industry, can provide you, customer, with any level of security you want.
[07:02.760 --> 07:05.520]  But we need from you three things.
[07:05.520 --> 07:08.540]  We need to have a commitment from the top of your organization
[07:08.540 --> 07:10.560]  that security is important.
[07:11.640 --> 07:14.600]  We need to have you spend the resources,
[07:14.600 --> 07:19.000]  and by resources I don't mean the one-time procurement of firewalls and guards,
[07:19.000 --> 07:23.240]  but the ongoing expenditures to maintain near real-time situational awareness
[07:23.240 --> 07:25.240]  of what's going on in your networks.
[07:25.880 --> 07:27.540]  And you've got to be willing to drop the hammer
[07:27.540 --> 07:29.340]  on people who don't play by the rules.
[07:30.240 --> 07:31.820]  And I'd say in government at this point,
[07:31.820 --> 07:34.860]  we've done a pretty good job at conveying that security is important.
[07:35.020 --> 07:37.400]  God knows we're spending a lot of money on the problem.
[07:37.500 --> 07:39.600]  We have not done a good job in dropping the hammer
[07:39.600 --> 07:41.260]  on people who don't play by the rules.
[07:41.340 --> 07:43.840]  It's a lot easier for me right now to get a security violation
[07:43.840 --> 07:45.280]  by leaving my safe open
[07:45.280 --> 07:48.420]  than it is by posting my password on my computer
[07:48.420 --> 07:52.080]  or letting an unauthorized modem be attached to my network.
[07:52.080 --> 07:53.740]  We need to work on that.
[07:55.700 --> 07:57.780]  NSA has done a terrific job
[07:57.780 --> 08:00.780]  in putting together a new information assurance architecture
[08:00.780 --> 08:02.360]  for the gig.
[08:03.020 --> 08:04.960]  And this is being driven by several factors.
[08:04.960 --> 08:07.160]  I mean, obviously the environment is changing,
[08:07.160 --> 08:09.460]  the paradigm security is changing,
[08:09.460 --> 08:11.540]  moving network-centric operations.
[08:12.020 --> 08:16.300]  But we also have to pay a lot more attention to the insider threat.
[08:16.300 --> 08:20.760]  If you look at our major espionage cases over the past 25 years,
[08:20.760 --> 08:23.400]  almost every single one of them had their security clearances
[08:23.400 --> 08:24.860]  before they went bad.
[08:25.200 --> 08:27.540]  We focus a lot on the perimeter of the problem,
[08:27.540 --> 08:29.100]  keeping the bad guys out.
[08:29.160 --> 08:32.260]  The issue is we have to be able to detect anomalous behavior
[08:32.260 --> 08:34.960]  in the network and respond to it.
[08:35.160 --> 08:38.020]  I heard today from Paul Simmons of Jericho Forum
[08:38.020 --> 08:40.120]  the term deperimeterization.
[08:40.340 --> 08:41.940]  And I look forward to learning more about that
[08:41.940 --> 08:44.700]  because I think that's some description of where we're going.
[08:45.140 --> 08:47.060]  So there are five concepts, you will,
[08:47.060 --> 08:49.340]  in this new information assurance architecture.
[08:49.340 --> 08:52.040]  One is to separate the protection of the information
[08:52.040 --> 08:54.740]  from the protection of the infrastructure.
[08:55.400 --> 08:57.680]  Another is the end-to-end protection of information
[08:57.680 --> 09:00.060]  through enhanced access controls.
[09:00.060 --> 09:03.000]  We need to have strong identification and authentication,
[09:03.000 --> 09:06.240]  which is absolutely critical to being able to do security
[09:06.240 --> 09:09.680]  based on policy-based access.
[09:10.100 --> 09:13.140]  We've got to have enhanced misuse identification.
[09:13.420 --> 09:15.040]  For example, Visa and MasterCard.
[09:15.040 --> 09:17.100]  I was in Kuwait a couple of months ago
[09:17.820 --> 09:20.020]  and I went to buy my wife some jewelry.
[09:20.060 --> 09:22.980]  So I swiped the first card and it went through.
[09:23.020 --> 09:24.600]  Second time it went through and said,
[09:24.600 --> 09:25.760]  ah, denied.
[09:25.940 --> 09:28.120]  So we pulled the string on and it turned out, of course,
[09:28.120 --> 09:30.160]  they said, well, last Saturday you were in Virginia.
[09:30.160 --> 09:31.140]  Now you're in Kuwait.
[09:31.140 --> 09:32.800]  You never told us you're going overseas.
[09:32.860 --> 09:34.060]  Is this really you?
[09:34.200 --> 09:35.260]  And I appreciate that.
[09:35.260 --> 09:37.400]  On the one hand, if they can do this sort of thing
[09:37.400 --> 09:40.580]  on the basis of hundreds of millions of transactions,
[09:40.580 --> 09:42.480]  why can't we do this in our network?
[09:42.480 --> 09:45.880]  But it was pointed out to me on several occasions,
[09:45.880 --> 09:47.540]  most recently today,
[09:47.540 --> 09:50.520]  the problems we're looking about detecting anomalous behavior
[09:50.520 --> 09:54.420]  inside a military network are perhaps qualitatively different
[09:54.420 --> 09:59.200]  than those on just credit card transactions.
[09:59.200 --> 10:01.480]  If you want to ask why is Wells trying to hack into
[10:01.480 --> 10:03.900]  the Secretary of Defense's computer at midnight,
[10:03.900 --> 10:06.080]  if you want to say why is the Southeast Asian analyst
[10:06.080 --> 10:08.480]  all of a sudden more interested in Cuba,
[10:08.480 --> 10:10.420]  I submit that's a more complicated problem
[10:10.420 --> 10:14.380]  than just a transaction in a different physical location.
[10:14.500 --> 10:17.060]  And some of these, in fact, may not even be solvable problems.
[10:17.060 --> 10:20.200]  We need to understand just what the limits are of what we can do.
[10:20.520 --> 10:23.760]  So the fourth piece of these five characteristics
[10:23.760 --> 10:26.240]  is enhanced computer network defense.
[10:26.260 --> 10:28.660]  And I'll talk a little bit more in a minute about something called
[10:28.660 --> 10:31.400]  the Joint Task Force Computer Network Operations
[10:31.400 --> 10:33.140]  that's recently been set up.
[10:33.460 --> 10:35.580]  But basically it's improved detection,
[10:35.580 --> 10:38.500]  correlation of data, and visualization of data.
[10:39.060 --> 10:42.300]  Fifth point is we need very aggressive research and development.
[10:42.560 --> 10:44.620]  These are going to be different problems.
[10:44.620 --> 10:48.140]  We're building really for the world of 2012 to 2015.
[10:50.020 --> 10:52.000]  And they're not going to be solved in the near term.
[10:52.000 --> 10:55.520]  So first of all we have to stay abreast of the changing threat.
[10:56.040 --> 10:59.760]  But some examples of the really high-end computing that are going on,
[10:59.760 --> 11:03.200]  or high-end R&D, a lot of work in quantum computing.
[11:03.900 --> 11:05.600]  As Feynman said at one point,
[11:05.600 --> 11:09.540]  by the time every bit gets down to an atomic scale,
[11:09.540 --> 11:14.860]  then you're going to be at quantum principles whether you like it or not.
[11:14.920 --> 11:17.320]  And so as Moore's Law progresses,
[11:17.320 --> 11:20.180]  we're going to be driven to quantum computing whether we like it or not.
[11:20.460 --> 11:24.460]  Some of the breakthroughs recently, or some of the developments recently,
[11:24.460 --> 11:27.100]  much more control over single photons,
[11:27.100 --> 11:32.500]  the ability to separate electrons into separate streams based on their spin,
[11:32.500 --> 11:38.900]  the ability to combine information from multiple atoms onto a single photon,
[11:38.900 --> 11:41.160]  and the building of the first quantum registry
[11:41.160 --> 11:43.980]  with progress made towards a quantum gate.
[11:44.020 --> 11:47.060]  So that's a fairly aggressive program.
[11:47.340 --> 11:50.120]  DARPA. www.darpa.mil
[11:50.120 --> 11:54.540]  They have a strategic plan there which I encourage anybody interested to take a look at.
[11:54.700 --> 11:58.180]  Some of the things they're looking at are self-forming, self-healing networks.
[11:58.180 --> 12:01.000]  They've already made a lot of progress in tactical environments.
[12:01.000 --> 12:05.060]  There's a lot of questions about whether, in these dynamic networks,
[12:05.800 --> 12:09.700]  TCP, for example, is an acceptable protocol
[12:09.700 --> 12:15.700]  just because the overhead associated with all the handshaking is so high
[12:15.700 --> 12:17.980]  that we may not be able to get enough throughput.
[12:17.980 --> 12:19.520]  So we're looking at alternatives.
[12:19.520 --> 12:21.460]  Chips scale atomic clocks.
[12:21.560 --> 12:28.120]  200 times increase in power and size.
[12:28.500 --> 12:31.060]  300 in power, 200 in size.
[12:31.200 --> 12:34.660]  And then a lot of work on hybrid optical and RF connections
[12:34.660 --> 12:40.220]  so we can get much more robust, smaller units in the field
[12:40.220 --> 12:42.720]  to let us get around bandwidth limitations.
[12:44.120 --> 12:46.540]  So there's an awful lot of stuff going on
[12:46.540 --> 12:49.460]  and I think we're making some progress
[12:49.460 --> 12:51.640]  but obviously we don't have all the answers.
[12:51.640 --> 12:54.800]  I mentioned the Joint Task Force Global Network Operations.
[12:54.800 --> 12:59.300]  This was changed last year from the Joint Task Force Computer Network Operations
[12:59.300 --> 13:02.800]  because we're expressly trying to get to not just computer nets
[13:02.800 --> 13:06.740]  but telephone nets and space networks
[13:06.740 --> 13:10.780]  and a whole series of different approaches to the problem.
[13:12.320 --> 13:15.800]  Its responsibility is the operation and the defense of the network
[13:16.400 --> 13:20.980]  and it does this by coordinating and directing the activities of the network operations centers
[13:20.980 --> 13:22.920]  and the various components across the department
[13:22.920 --> 13:25.920]  and also the computer emergency response teams.
[13:26.320 --> 13:30.620]  We also work very closely with law enforcement and the intelligence community.
[13:33.260 --> 13:37.820]  The task force, I would say, has successfully responded on several occasions
[13:37.820 --> 13:42.020]  to attacks, whether direct or indirect, on the DoD network.
[13:42.100 --> 13:45.520]  I love you, NMDA, Witty Worm.
[13:45.520 --> 13:48.840]  We did not have significant degradations from those.
[13:48.840 --> 13:50.400]  We certainly don't have it 100%
[13:50.400 --> 13:54.140]  but I think we are getting better at containing the events early
[13:54.140 --> 14:00.300]  and mitigating the consequences of people, again, where folks' lives are quite literally on the line.
[14:00.300 --> 14:01.800]  We're not doing this for profit.
[14:01.800 --> 14:04.480]  We're not doing this for bragging rights.
[14:04.480 --> 14:09.640]  We're doing this to support people who are in the field today and whose lives are on the line.
[14:10.520 --> 14:13.520]  We've also had much better cooperation, I think, with other agencies
[14:13.520 --> 14:16.020]  and I'll talk more about that in a little bit.
[14:16.120 --> 14:18.260]  We certainly don't claim to have all the answers
[14:19.020 --> 14:21.100]  and we need talented people
[14:21.100 --> 14:24.880]  and that's one of the reasons why I really appreciate the chance to be here today
[14:25.400 --> 14:30.600]  because you all out there represent an enormous body of knowledge,
[14:30.600 --> 14:31.880]  an enormous amount of talent
[14:33.500 --> 14:38.060]  and we could use a better understanding of some of the skill sets you have.
[14:38.400 --> 14:44.660]  My main focus, frankly, is not on the hacker who's in it for sport or challenge.
[14:44.660 --> 14:48.140]  My concern is the people who want to steal DoD information
[14:48.140 --> 14:52.620]  and do harm, either sort of directly or indirectly,
[14:52.620 --> 14:55.780]  to these people who are out there every day putting their lives on the line.
[14:56.060 --> 15:01.080]  We do prosecute lawbreakers, those caught getting into DoD networks
[15:01.080 --> 15:04.740]  and so if you are going to try to break the law and hack into our nets,
[15:04.740 --> 15:08.220]  we will try to impose legal consequences.
[15:08.240 --> 15:10.920]  But I'd rather emphasize today something different.
[15:11.220 --> 15:12.480]  It's an opportunity.
[15:12.920 --> 15:17.980]  The opportunity is if you want to work on cutting-edge problems,
[15:17.980 --> 15:23.120]  if you want to be a part of the truly great issues of our time,
[15:23.120 --> 15:26.080]  if you want to literally write history,
[15:26.660 --> 15:28.600]  we invite you to work with us.
[15:28.600 --> 15:33.180]  Quite frankly, in my job, not a day goes by that I don't come to work and say,
[15:33.180 --> 15:38.560]  wow, what new and interesting thing is going on out there that I want to work on.
[15:38.560 --> 15:42.460]  And it's an absolutely fascinating environment and we definitely need your help.
[15:44.420 --> 15:48.580]  What I would ask for is your help in reducing the noise.
[15:49.120 --> 15:53.900]  All the scanning, all the probing, all the attempted intrusions,
[15:54.380 --> 15:59.760]  divert our resources from the truly serious attacks that are out there.
[15:59.760 --> 16:04.140]  And have no doubt, there are people out there who seriously want to do us harm
[16:04.140 --> 16:09.820]  and do not share the values of the freedom of information on the network.
[16:10.000 --> 16:11.800]  There are people who want to do us harm.
[16:11.800 --> 16:14.700]  If you haven't taken a look at it, I'd recommend Scott Borg,
[16:14.700 --> 16:18.980]  who's done some very interesting work on the economic consequences of cyber attack.
[16:18.980 --> 16:21.900]  He used to be up at Dartmouth and now he has his own company.
[16:21.900 --> 16:23.720]  Really worthwhile.
[16:24.240 --> 16:29.060]  So my final message is, again, we value your talents.
[16:29.060 --> 16:32.140]  I would like very much to learn from what you have to offer.
[16:32.140 --> 16:35.000]  I frankly have taken away just from the time I've been here so far
[16:35.000 --> 16:38.440]  an enormous amount of information that is really useful to me
[16:38.440 --> 16:41.280]  that I would not have gotten without coming here.
[16:41.300 --> 16:44.480]  I look forward to coming back and talking with you more on the Meet the Fed panel
[16:44.480 --> 16:45.960]  later on in the afternoon.
[16:46.160 --> 16:47.980]  And let me open it to questions.
[16:48.100 --> 16:49.340]  Thank you very much.
[16:49.340 --> 16:56.610]  Go ahead.
[17:04.960 --> 17:07.160]  The question is on full disclosure.
[17:07.160 --> 17:08.580]  And what is my...
[17:12.490 --> 17:13.450]  Sure.
[17:14.170 --> 17:19.110]  What's my take on full disclosure, national security compared with business, so on and so forth?
[17:25.010 --> 17:27.810]  By and large, as we move to a network environment,
[17:27.810 --> 17:30.750]  and again I mentioned the point is sharing of information,
[17:30.750 --> 17:36.530]  and we do better in the long run by having information out there and having us share it.
[17:38.010 --> 17:42.690]  It's a major cultural change for us in terms of people who've owned information
[17:42.690 --> 17:47.770]  and say my owning it is more important than getting out to other people.
[17:48.390 --> 17:55.330]  And so I can't draw you a clear line that says everything to the right of the line is kept hidden,
[17:55.330 --> 17:56.810]  everything to the left is shared.
[17:56.810 --> 17:59.710]  My inclination at this point is shared because, as I say,
[17:59.710 --> 18:03.550]  I've learned stuff today about vulnerabilities that we need to get back and work on
[18:03.550 --> 18:06.130]  that I wouldn't have known if I hadn't come to a place like this.
[18:06.130 --> 18:11.130]  At the same time, there clearly is stuff that needs to be protected.
[18:11.130 --> 18:18.270]  And my particular focus is on protecting that information that puts people's lives directly at risk,
[18:18.270 --> 18:21.990]  which tends to be fairly perishable operational information.
[18:21.990 --> 18:26.630]  And then the flip side is things to say the U.S. has invested tens of billions of dollars
[18:26.630 --> 18:30.610]  of research and development in that gives us some kind of competitive advantage long term.
[18:30.610 --> 18:32.070]  That needs to be protected.
[18:32.070 --> 18:36.070]  So those are the sorts of things that I tend to focus my concerns on,
[18:36.070 --> 18:39.990]  rather than just saying, well, everything has got to be kept secret.
[18:40.290 --> 18:41.070]  Is that fair?
[18:45.990 --> 18:48.470]  The use of COTS in weapon systems?
[18:51.610 --> 18:55.890]  Let me answer that in two... pardon me?
[18:57.190 --> 18:58.710]  Yeah, okay.
[18:58.710 --> 19:00.490]  So the use of COTS in weapon systems.
[19:00.490 --> 19:06.310]  There's an interesting study that says that the government as a whole,
[19:06.310 --> 19:11.950]  federal government as a whole, now outsources more than...
[19:11.950 --> 19:17.730]  now pays more in contracted services than it does in salaries of government employees.
[19:18.770 --> 19:21.870]  And this trend appears to be one that's only going to continue.
[19:21.870 --> 19:27.870]  So part of the problem is that almost none of us, gubbies,
[19:27.870 --> 19:31.510]  know how to manage those kinds of outsourced services.
[19:31.510 --> 19:35.190]  We may know how to manage a program where the gubbies are controlled and deliver it all.
[19:35.190 --> 19:38.270]  We don't know how to manage these outsourced services very well.
[19:38.710 --> 19:43.990]  And so the challenge is, as baby boomers shuffle off the stage,
[19:43.990 --> 19:47.150]  what are we doing to train up the next generation of managers
[19:47.150 --> 19:50.690]  to do a better job of managing these outsourced services
[19:50.690 --> 19:54.970]  and the COTS that go with them and avoiding more ADAs and things like that.
[19:56.330 --> 20:01.350]  From a security perspective, my concern is that this now means
[20:01.350 --> 20:05.410]  I will have almost no clue into the pedigree of the networks
[20:05.410 --> 20:07.230]  that we're becoming so dependent on.
[20:07.230 --> 20:08.830]  I may know who the prime is.
[20:08.830 --> 20:11.510]  I'm likely to have no idea who the second and third tier subs are
[20:11.510 --> 20:12.850]  and where they're coming from.
[20:12.950 --> 20:16.050]  And so this then leads me to a much greater emphasis on
[20:16.050 --> 20:20.350]  not only the near real-time situational awareness of the network I mentioned before,
[20:20.350 --> 20:24.310]  but on some kind of understanding of software and hardware assurance
[20:24.310 --> 20:29.410]  for those critical applications where it really does make or break
[20:29.410 --> 20:33.610]  the successful missile engagement or the tip of the spear issues.
[20:34.010 --> 20:37.810]  And so we're looking at, for example, we have a trusted foundry
[20:37.810 --> 20:39.870]  that we're building for hardware chips.
[20:39.870 --> 20:42.410]  For those certain applications, we absolutely have to make sure
[20:42.410 --> 20:44.190]  that the pedigree is right.
[20:44.190 --> 20:49.790]  We're looking at various ways through combinations of common criteria
[20:49.790 --> 20:54.510]  and CMM and others on how to get better software assurance involved.
[20:54.510 --> 21:02.290]  So I think there's going to be a graduation between GOTS and kind of trusted COTS
[21:02.290 --> 21:04.970]  and then what's just out there in the marketplace.
[21:06.810 --> 21:10.650]  Because I think we're migrating to this much more commercial environment
[21:10.650 --> 21:14.570]  where we, frankly, are never going to know where a lot of this stuff comes from,
[21:14.570 --> 21:21.050]  I would tend to put more of my emphasis on the anomaly detection of the network,
[21:21.050 --> 21:29.150]  the strong identification, authentication, and the response to problematic behavior in the net
[21:29.150 --> 21:33.950]  than I would worry about what was going on in every piece of software in the system.
[21:34.170 --> 21:40.390]  And so you draw the line here as to what's in a weapon system.
[21:40.390 --> 21:47.450]  If you're dealing with a fighter plane, that's pretty much going to be, at the very least,
[21:47.450 --> 21:54.010]  the high pedigree commercial software and probably is going to be dedicated design systems.
[21:54.070 --> 21:58.890]  But it turns out that for us, exercise after exercise after exercise shows
[21:58.890 --> 22:04.990]  that the most dangerous, most vulnerable parts of our operational chain, if you will,
[22:04.990 --> 22:07.110]  are things like logistics and medical.
[22:07.110 --> 22:11.410]  And in that, you're almost certainly going to have lots of cost products.
[22:11.630 --> 22:14.490]  So I'd love to give you an answer as to what's a weapon system.
[22:14.490 --> 22:19.450]  I'm more interested in what do you need to assure the mission to complete the job
[22:19.450 --> 22:23.790]  irrespective of the level of attack you're under, and that's going to be a layered process.
[22:42.380 --> 22:47.180]  The question is, what do I feel about how other foreign governments stand
[22:47.180 --> 22:51.380]  in information assurance in England, Russia, China, whatever.
[22:53.140 --> 22:58.160]  I think we understand at this point that almost every significant operation we're going to do
[22:58.160 --> 23:01.560]  is going to be in some kind of coalition environment.
[23:02.860 --> 23:07.960]  And therefore, we have to take into account the fact that our coalition partners
[23:07.960 --> 23:13.460]  are going to come from very different levels of information assurance and capability.
[23:13.460 --> 23:17.140]  I was struck by, at one point, one of our coalitions.
[23:17.140 --> 23:22.640]  Right now, you have long-time partners like Lithuania, Moldova, and Tonga.
[23:23.580 --> 23:26.740]  So this means that we're going to have to...
[23:26.740 --> 23:30.340]  In fact, we are working very hard on developing something called MNIS,
[23:30.340 --> 23:32.600]  multinational information sharing.
[23:32.660 --> 23:37.580]  And it's going to have to give you some sort of multi-level security, firewalls, and guards
[23:37.580 --> 23:41.660]  to allow you to interoperate them in some kind of a shared space
[23:41.660 --> 23:45.880]  while protecting those core command and control functions, say,
[23:45.880 --> 23:48.660]  and key pieces of data that you don't want to share.
[23:48.660 --> 23:53.020]  So I spend less time actually worrying about what foreign governments are doing
[23:53.020 --> 23:55.260]  because I don't have much control over that,
[23:55.260 --> 23:59.140]  and rather having to put together an operational networked environment
[23:59.140 --> 24:01.920]  where I can bring in unanticipated users.
[24:02.300 --> 24:07.980]  To that effort, I would say that we are trying to completely rethink the paradigm
[24:07.980 --> 24:12.240]  for DoD to operate outside the .mil domain,
[24:12.640 --> 24:17.540]  to work with non-traditional partners like the Agency for International Development,
[24:17.540 --> 24:21.080]  UN, Doctors Without Borders, and even commercial partners
[24:21.080 --> 24:24.180]  in the kind of stabilization and reconstruction operations
[24:24.180 --> 24:27.300]  that we're seeing more and more of in what we're doing.
[24:27.360 --> 24:29.800]  We learned a lot from tsunami.
[24:30.160 --> 24:33.020]  We learned a lot... we are learning a lot from Afghanistan.
[24:33.360 --> 24:37.340]  Some of you may know there's something called the World Summit on the Information Society
[24:37.340 --> 24:39.560]  that's coming up in Tunis.
[24:39.620 --> 24:42.720]  It's the second of two conferences this November,
[24:42.720 --> 24:45.180]  and we'll be working with a whole batch of the international community
[24:45.180 --> 24:47.180]  to try to look at ways we can do that.
[24:47.440 --> 24:50.500]  I personally think we are never going to get to the stage
[24:50.500 --> 24:54.440]  where we'll allow these pick-up team partners
[24:54.440 --> 24:57.560]  to get inside, say, the Nibarnet firewalls,
[24:57.560 --> 25:01.740]  which means that we have to go outside and have .net or .org-type domains
[25:01.740 --> 25:04.700]  in which we can operate and share the information.
[25:04.700 --> 25:09.020]  So the long answer is I'm not too much worried about what foreign governments are doing.
[25:09.020 --> 25:12.780]  I'm trying to set the conditions whereby we can work with a whole batch of different people
[25:12.780 --> 25:14.500]  in different circumstances.
[25:14.800 --> 25:16.060]  Back there first.
[25:31.900 --> 25:34.800]  The question has to do with integrated attacks,
[25:34.800 --> 25:38.860]  something like physical terrorist attacks
[25:38.860 --> 25:43.140]  coupled with attacks on PBX boxes and this sort of thing.
[25:43.140 --> 25:46.980]  And this clearly is an area that we have to be working on and working on harder.
[25:46.980 --> 25:50.980]  I personally think that the...
[25:52.780 --> 25:57.660]  Again, my goal is to get to mission assurance, not just information assurance.
[25:57.880 --> 26:00.720]  Coming from a Navy background, I tend to think of a ship
[26:00.720 --> 26:03.260]  which is built with watertight compartments
[26:03.260 --> 26:06.680]  and you can still float with a couple of compartments flooded
[26:06.680 --> 26:10.240]  and you have a starboard engineering plant and a port engineering plant
[26:10.240 --> 26:12.440]  so if one is damaged, you can still carry on.
[26:12.440 --> 26:16.780]  You've got multiple fighting men and you train and you train and you train and you train.
[26:16.780 --> 26:21.820]  So we need to take into account the fact that an attack may be just cyber,
[26:21.820 --> 26:24.220]  just physical, a mix of physical and cyber
[26:25.280 --> 26:28.020]  and work the problem in an integrated manner.
[26:29.580 --> 26:33.060]  This is not entirely within the domain of the Department of Defense.
[26:33.060 --> 26:36.620]  A lot of this comes now up in the U.S. with the Department of Homeland Security
[26:36.620 --> 26:41.680]  where a lot of the cyber defense and national infrastructure rides.
[26:41.680 --> 26:44.960]  So in fact, this week I've just spent several meetings with people
[26:44.960 --> 26:46.580]  from the Department of Homeland Security
[26:46.580 --> 26:51.160]  on how we in defense and the private sector can do a better job
[26:51.160 --> 26:55.520]  at coordinating the infrastructure defense on which things ride,
[26:55.520 --> 26:59.240]  E911, those sorts of things, to give an integrated approach.
[27:01.810 --> 27:05.150]  So is there an answer? No. Are we better off than we were?
[27:05.150 --> 27:07.510]  I mean, GETS worked very well.
[27:07.510 --> 27:11.450]  The Government Emergency Telephone System worked very well on 9-11.
[27:11.450 --> 27:14.850]  We now have the wireless equivalent of that in place.
[27:15.190 --> 27:19.550]  And so you basically priority overrides in the wireless service for first responders.
[27:19.950 --> 27:24.870]  We've had a series of major exercises called Top Off, Top Officials,
[27:24.870 --> 27:32.710]  where you bring the FBI and Homeland Security and National Security Council,
[27:32.710 --> 27:36.050]  all that together, and actually run through some pretty horrific scenarios
[27:36.050 --> 27:38.270]  and how the decision making would flow.
[27:38.270 --> 27:41.430]  So a lot of this stuff, quite frankly, is as much a policy
[27:41.430 --> 27:46.450]  and a decision making process as it is the technical parts of the network.
[27:46.450 --> 27:48.390]  And that's what we're trying to get right now,
[27:48.390 --> 27:50.650]  while we inventory the networks, and you will,
[27:50.650 --> 27:54.370]  and find out what's available out there to use when the situation comes up.
[27:55.590 --> 27:57.010]  Okay? Someone's down here?
[27:57.230 --> 28:00.370]  There's one behind. Go ahead.
[28:08.790 --> 28:11.330]  The question is, do we allow the implementation of software
[28:11.330 --> 28:13.350]  that hasn't been internally audited?
[28:13.350 --> 28:16.550]  All software needs to have been validated through the NIAP,
[28:16.550 --> 28:20.450]  to be used in the DOD National Information Assurance Partnership,
[28:20.450 --> 28:22.190]  to be used in the DOD networks,
[28:22.190 --> 28:25.950]  and in most cases it also has to go through an interoperability certification
[28:26.510 --> 28:28.750]  through the Joint Interoperability Test Center.
[28:36.000 --> 28:39.360]  Well, in some of the code, there is code review in the NIAP.
[28:40.120 --> 28:42.460]  Not in JITIC, but there is in the NIAP.
[28:43.800 --> 28:46.380]  And then there are other things that NSA does,
[28:46.380 --> 28:48.100]  review code and that sort of thing.
[28:48.100 --> 28:49.860]  So, you know, we're cautious.
[28:49.860 --> 28:53.180]  I mean, this question goes back earlier about what do we do with commercial software.
[28:53.700 --> 29:00.440]  And part of it is, you know, if we're going to use something, say,
[29:00.440 --> 29:05.360]  like enterprise resource software, ERP, or PeopleSoft, or something like that,
[29:05.360 --> 29:08.060]  I mean, you're obviously not going to go through and try to change
[29:08.060 --> 29:11.260]  or validate every piece of code in that,
[29:11.260 --> 29:13.120]  and yet we're going to be dependent on it.
[29:13.120 --> 29:17.480]  And so the question, again, is how do you detect anomalous behavior in that?
[29:17.480 --> 29:23.160]  But for those things that are in our nipper net or shipper net,
[29:23.160 --> 29:25.980]  we're requiring the NIAP certifications.
[29:25.980 --> 29:26.720]  Sir?
[29:37.500 --> 29:41.440]  The question is, has anybody given any thought to preventing cell phones
[29:41.440 --> 29:46.680]  from being used for detonating IEDs by war-dialing all the cell phones in Iraq?
[29:47.620 --> 29:52.060]  The amount of time we spend on IEDs is quite extraordinary.
[29:52.060 --> 29:57.780]  I mean, literally tens of hours a week on the IED problem.
[29:58.200 --> 30:01.160]  And the cell phone issue has actually come up a lot.
[30:01.400 --> 30:04.740]  Now, there are ways to get to cell phones beyond just war-dialing.
[30:04.740 --> 30:07.080]  I mean, there are different ways to get to them.
[30:07.140 --> 30:09.400]  And so that problem has been addressed.
[30:09.400 --> 30:17.320]  I have to tell you, there's not a lot of evidence that cell phones, per se,
[30:17.320 --> 30:19.360]  have been used to trigger IEDs.
[30:19.360 --> 30:24.780]  There's much more stuff on garage door openers and those sorts of things than cell phones, per se.
[30:25.040 --> 30:30.320]  But I guess all I can say in this forum is we understand the potential threat of a cell phone.
[30:30.340 --> 30:34.720]  Guys are spending lots and lots of time on, you know, when we see it being used like this,
[30:34.720 --> 30:35.920]  how would we counter it?
[30:35.920 --> 30:40.020]  I haven't heard war-dialing specifically as a suggestive way to do it,
[30:40.020 --> 30:43.640]  but there are other kind of electronic ways they've been looking at countering it.
[30:45.220 --> 30:50.660]  There's nothing, frankly, of a higher priority issue for the military right now
[30:50.660 --> 30:56.220]  than addressing this improvised explosive device issue in Iraq, because that's what's killing our people.
[31:24.160 --> 31:28.180]  The question is, the DOD has spent a lot of money to develop AIDA.
[31:28.180 --> 31:30.320]  We're not using it. Other people are.
[31:30.320 --> 31:32.160]  Is there a way we can bring it back?
[31:33.840 --> 31:36.720]  Let me take that for the record and go back and look at it.
[31:36.740 --> 31:43.340]  Frankly, my sense is that time has moved beyond AIDA.
[31:45.120 --> 31:49.240]  And there are lots of other ways to do business, especially if you go to the net-centric environment.
[31:49.240 --> 31:52.100]  So I haven't paid a lot of attention trying to revitalize it.
[31:52.100 --> 31:55.580]  If you want to give me your name later on, I'll take it for the record and get back to you.
[31:55.580 --> 31:57.580]  It just hasn't been something I've focused on.
[32:12.980 --> 32:18.500]  The question is, what's the ratio in the number of IEDs, improvised explosive devices,
[32:18.500 --> 32:23.240]  that are being detected and disarmed before they are exploded?
[32:23.240 --> 32:25.000]  And the answer is, yes, we have those data.
[32:25.000 --> 32:26.780]  I'm not sure I can share that.
[32:27.200 --> 32:31.820]  What's happening, though, is that we're getting better at detecting them and disarming them,
[32:31.820 --> 32:35.980]  but they're making them more lethal, so each one causes more attacks.
[32:35.980 --> 32:43.900]  I mean, using explosive-formed jets and things like that, as opposed to just focused explosive jets,
[32:43.900 --> 32:46.480]  rather than just a circular explosion.
[32:46.540 --> 32:51.980]  So, anyway, it's a typical dynamic of offense and defense.
[32:53.760 --> 32:54.880]  Sir?
[33:03.520 --> 33:04.700]  What kind of scorecard?
[33:05.720 --> 33:06.700]  Assist?
[33:06.700 --> 33:07.260]  Yeah.
[33:25.640 --> 33:28.520]  So the question is, is there anything like an assist scorecard,
[33:28.520 --> 33:33.500]  and what are we doing with guidance for the private sector about implementing data tagging?
[33:33.500 --> 33:34.380]  I'll get you next.
[33:35.980 --> 33:40.400]  And I would say that we're doing...
[33:40.400 --> 33:43.760]  I mean, a lot of our work is based on various kinds of balance scorecards.
[33:43.760 --> 33:46.160]  We're trying to put together metrics.
[33:46.160 --> 33:50.940]  Right now, the deputy is challenging us on getting metrics for the information assurance world.
[33:51.080 --> 33:53.640]  And I have to tell you, this is one of the hardest problems I've got,
[33:53.640 --> 33:56.420]  and this is something I would really ask for your help with.
[33:56.420 --> 34:02.860]  The question is how you measure return on investment on information assurance type things.
[34:02.860 --> 34:13.680]  So if I'm going to go in and put $100 million into some sort of technique to get to better multi-level security in 2012,
[34:14.240 --> 34:22.260]  and the budgeteers are out there saying, well, show me that's going to give us a 14% or a 22% or a 71% increase in security.
[34:22.260 --> 34:24.120]  It's really hard to do that.
[34:24.120 --> 34:30.680]  And so the idea of a link between metrics and investments and all that is a hard problem for us.
[34:30.680 --> 34:36.180]  I mean, I can go through right now and measure what's working in different network operation centers and all that,
[34:36.180 --> 34:40.840]  how we're doing on implementing known vulnerabilities and all that,
[34:40.840 --> 34:44.620]  and more concerned about the long-term return on investment metric.
[34:44.620 --> 34:50.840]  With regard to the public-private sector, again, a lot of this lies in the Department of Homeland Security.
[34:50.840 --> 34:59.560]  And part of the problem we've had ever since PDD 63, which is the critical infrastructure protection in the last administration,
[34:59.560 --> 35:06.000]  is building the trust, if you will, to be able for two-way sharing of information.
[35:06.620 --> 35:12.620]  We've spent a lot of time working with Congress and others on trying to change laws
[35:12.620 --> 35:18.660]  so you can provide better protection to proprietary information that comes up through the ISACs,
[35:18.660 --> 35:20.980]  these information-sharing and analysis centers.
[35:20.980 --> 35:26.980]  And we're trying to work with getting the government being more willing to share a sense of information on the way back down.
[35:27.240 --> 35:37.060]  If I were to say anywhere, I think the telecommunications sector, the National Security Telecommunications Advisory Committee,
[35:37.060 --> 35:40.680]  that process is working pretty well in the telecom sector.
[35:40.900 --> 35:45.420]  I don't think it's working as well in, say, transportation or energy or others.
[35:45.420 --> 35:49.480]  And what's coming to be a concern for me is, as SCATE is,
[35:49.480 --> 35:56.780]  the supervisory control and data acquisition nets become more and more a part of all of our critical infrastructures.
[36:01.380 --> 36:06.300]  We're making the most progress in the telecoms and the ISP world.
[36:06.300 --> 36:11.180]  I don't think we're getting as much progress in controlling the information technology in these other sectors
[36:11.180 --> 36:14.320]  where it may be equally critical to us on a national basis.
[36:14.320 --> 36:23.460]  So the answer is, one piece of advice I would have is the DoD and the Intel community have committed,
[36:23.460 --> 36:26.820]  I mentioned the global information grid and the programs.
[36:26.820 --> 36:29.200]  There are three other pieces that go with that.
[36:29.200 --> 36:32.560]  There's the network operations, network resources management piece,
[36:32.560 --> 36:36.260]  about how you balance the use of resources in the network.
[36:36.260 --> 36:41.740]  There's a spectrum management piece, and the key underlying bit is the net-centric data strategy,
[36:41.740 --> 36:44.880]  which is an XML-tagged approach to the problem.
[36:45.440 --> 36:53.900]  And it turns out that DoD and the intelligence community and NATO have almost identical net-centric data strategies.
[36:53.900 --> 36:57.480]  And we've really had some very good luck over the past several months
[36:57.480 --> 37:03.880]  in moving towards a service-oriented architecture approach and a shared situational awareness.
[37:04.120 --> 37:08.480]  That data strategy has not yet been adopted by the Department of Homeland Security,
[37:08.480 --> 37:12.780]  which means it's not being infused into the private sector through those channels.
[37:12.940 --> 37:17.320]  And over the past week, we've actually been working hard with the senior leadership of DHS
[37:17.320 --> 37:20.500]  to get them to adopt that kind of a strategy.
[37:20.540 --> 37:23.740]  So maybe that'll be an answer to one part of your question.
[37:24.040 --> 37:44.530]  The question is, as warfare goes net-centric, how do you envision managing security,
[37:45.050 --> 37:47.610]  connecting together what used to be stand-alone systems?
[37:50.030 --> 37:54.870]  I don't think there's ever going to be a closed-form solution where you lock the door and say,
[37:54.870 --> 37:58.250]  we got there, let's go home, turn off the lights and go home.
[37:59.570 --> 38:04.790]  There are just too many dynamic pieces of the puzzle in terms of not only the evolving threat,
[38:04.790 --> 38:06.790]  but the rolling out of new technologies.
[38:06.790 --> 38:14.850]  There was a very good session this morning on vulnerabilities associated with XML and service-oriented architectures.
[38:14.910 --> 38:17.750]  Three years ago, we wouldn't have paid any attention to that.
[38:17.750 --> 38:20.930]  And so now we need to fold that into the process.
[38:20.930 --> 38:27.110]  So I think it's going to have to be an ongoing, dynamic series of reviews.
[38:28.310 --> 38:31.130]  The first key part of this is cultural.
[38:31.230 --> 38:36.530]  If you talk to the intelligence community, they have a concept called ORCON, Originator Controlled,
[38:36.530 --> 38:39.650]  which basically says, I wrote the information, it's mine.
[38:40.550 --> 38:44.430]  And so just trying to break down the stovepipes to share that
[38:45.290 --> 38:51.090]  becomes much more an issue of politics and culture than it is of physically getting the bits and bytes to work out.
[38:51.130 --> 39:00.510]  So I think it's going to be a mix of cultural solutions, this doctrine, organization, training, evolution, the physical.
[39:00.710 --> 39:06.230]  And even if I could give you a solution today that said, I'm at the 95% level, I'm happy with it,
[39:07.270 --> 39:09.070]  it won't be that way tomorrow.
[39:09.070 --> 39:14.430]  The one thing I would say in DoD that, again, I look for your help on,
[39:14.430 --> 39:25.350]  if I'm a credit card company and I realize that I'll probably get 3-4% loss rates in fraud or whatever,
[39:25.350 --> 39:30.590]  I can factor that into my calculus, I can put that in my interest rates, I can factor that in.
[39:30.750 --> 39:35.070]  And what you get from that is an explosion of credit across the economy
[39:35.070 --> 39:40.670]  that transforms the ability of everyday people to buy things they never would have been able to buy before.
[39:41.410 --> 39:45.390]  I don't know anybody lately who's gone to the top secret control officer and say,
[39:45.390 --> 39:48.170]  it's okay to lose 3% of your documents a year.
[39:48.570 --> 39:57.290]  Even though, in the net-centric model, maybe 100 people were lost because some piece of information were compromised,
[39:57.290 --> 40:02.250]  maybe 10,000 were saved because the fight was over in three days rather than three months,
[40:02.250 --> 40:05.430]  and the value of net-centricity had an upside.
[40:05.450 --> 40:13.730]  So we need to think through our cost-benefit analysis to put more emphasis in the military on the upside benefit,
[40:13.730 --> 40:15.990]  even as we focus on the cost.
[40:16.750 --> 40:20.530]  Not a neat, clean answer, but that's where we're looking at.
[40:20.630 --> 40:21.670]  Over there, sir?
[40:23.030 --> 40:24.070]  Please.
[40:38.650 --> 40:42.470]  Critical factors in my going, I mean, how I got to be CIO.
[40:43.850 --> 40:52.170]  I'm sort of in a strange situation in that I was career Navy, and so I spent 26 years in uniform,
[40:52.170 --> 40:58.550]  and then about seven years in the Office of the Undersecretary for Policy,
[40:58.550 --> 41:04.210]  working largely on the interface between policy and technology issues.
[41:04.550 --> 41:15.430]  And so, in 1998, the Secretary decided to beef up the role of the Assistant Secretary for Command, Control, Communications, and Intelligence,
[41:15.430 --> 41:18.570]  which is what my organization was then known as.
[41:18.570 --> 41:21.490]  I was asked to go over and be the Principal Deputy in that organization
[41:21.490 --> 41:28.770]  because I had an understanding of less the technical details and the balance between policy and technology.
[41:29.090 --> 41:33.950]  I mean, my own education is, my undergraduate work was in physics and oceanography.
[41:33.950 --> 41:35.830]  My master's is in applied math.
[41:35.830 --> 41:37.910]  My doctorate's in international relations.
[41:37.910 --> 41:43.810]  And I found that mix of a policy science and engineering science to have been a really valuable combination.
[41:43.810 --> 41:46.230]  So, just a long story.
[41:46.230 --> 41:51.010]  What's happened now is my permanent title is Principal Deputy.
[41:51.570 --> 41:57.970]  Our Assistant Secretary left about 18 months ago, and so I've been acting as the CIO since.
[41:57.970 --> 42:01.910]  But I think, in my case, it certainly wasn't a commercial background.
[42:01.910 --> 42:06.970]  It was less a technical background than having the policy-technology interface understanding.
[42:28.870 --> 42:33.030]  The question is, I've been focusing a lot on information assurance.
[42:33.030 --> 42:41.830]  And as you play out 2012-2014, how do I see the offensive side playing out of information operations?
[42:42.050 --> 42:46.090]  I'm really limited in what I can say on that in this venue.
[42:46.090 --> 42:55.730]  But I think one of the key points is, as the network becomes the center of gravity for military operations...
[42:55.730 --> 43:01.030]  I mean, right now, we're probably the most net-centric of any military in the world.
[43:01.030 --> 43:05.330]  It's a model that's being adopted by a number of others as well.
[43:05.850 --> 43:11.730]  As more and more countries come to depend on the network, then how you attack that network...
[43:11.730 --> 43:15.430]  be it a physical attack or a cyber attack or whatever...
[43:15.430 --> 43:18.790]  will become a more important thing to work on.
[43:18.790 --> 43:27.370]  And I think, also, what I would expect to see is not just a single solution, but a broad...
[43:27.370 --> 43:29.510]  it'll become a target just like anything else.
[43:29.510 --> 43:33.350]  One of the things we're saying is we need to fight the network like a weapons system.
[43:33.350 --> 43:37.070]  You need to think of it as a ship, tank, an airplane. It's a critical component.
[43:37.250 --> 43:40.570]  And so, as a result, you have to defend it against the full range of threats.
[43:40.570 --> 43:44.950]  And we have to be able to, you know, similarly mount the full range of threats.
[43:44.950 --> 43:46.570]  That's probably about as far as I can go.
[43:47.830 --> 43:51.510]  Somebody in the back. I'm sorry, I can't see hands back there. I'd be glad to...
[43:56.810 --> 43:57.810]  Yeah, please.
[44:23.080 --> 44:24.340]  It's a really good question.
[44:25.220 --> 44:31.860]  What about cyber attacks and penetrations that originate from foreign countries and how do we prosecute them?
[44:32.540 --> 44:37.980]  I think, as most of you know, the attribution of a cyber attack can be a really hard thing to do.
[44:38.580 --> 44:51.060]  And so, with a number of countries, for example, in Europe and the Interpol and a number of bilateral agreements,
[44:51.060 --> 44:56.200]  we now have some pretty good mutual law enforcement rules to be able to address...
[44:57.240 --> 45:02.140]  For instance, the UK. The UK would either prosecute people who hack into our nets
[45:02.140 --> 45:05.720]  or, in some cases, we can extradite them to be prosecuted here.
[45:05.840 --> 45:08.540]  There are other countries where, frankly, it's a free ride.
[45:08.540 --> 45:15.780]  If you hack from there, there's no... In some cases, it's not a crime to the hacking in those nations' laws.
[45:15.840 --> 45:18.620]  And if we don't have agreements with them, there's not much you can do about it.
[45:18.620 --> 45:26.440]  So, I think over the past ten years, we've made a lot of progress in working out multilateral and bilateral law enforcement agreements,
[45:26.440 --> 45:29.260]  but it's certainly a patchwork quilt around the world.
[46:06.760 --> 46:13.280]  The question is, in these countries that are not doing a good job in policing their own cyber security,
[46:13.280 --> 46:18.480]  or which we don't have agreements with, are there other ways we could put pressure on them?
[46:18.480 --> 46:20.860]  Postal agreements or something like that, too.
[46:20.860 --> 46:25.740]  And the answer is, the Defense Department doesn't do... That's not our thing.
[46:25.740 --> 46:28.140]  That would be the law enforcement or State Department.
[46:28.140 --> 46:33.900]  When we have the Ask the Fed panel later on, if you come, that would be a very good question to ask for the folks who'd be here,
[46:33.900 --> 46:35.820]  because there'd be people who could address it.
[46:37.300 --> 46:38.620]  Back there first.
[46:42.660 --> 46:45.600]  What does IPv6 capable really mean?
[46:47.740 --> 46:52.660]  We've set a goal of 2008 to implement IPv6.
[46:53.240 --> 46:59.840]  And it's going to be done through a technology refresh policy rather than a Big Bang solution.
[47:00.060 --> 47:04.380]  And so I would guess we'll be running dual stack for a long time.
[47:12.360 --> 47:14.320]  Tell me more about your question.
[47:14.320 --> 47:22.280]  Because what we're essentially saying is anything that we're buying since last year, or 2003, I think, should have been IPv6 capable.
[47:22.280 --> 47:25.300]  And your question is, that's an ambiguous definition?
[47:32.480 --> 47:39.720]  I see the rollout of IPv6 is going to be, we're pushing as hard as possible.
[47:39.720 --> 47:47.320]  There was just a congressional hearing that was basically saying that the government as a whole should be doing more with IPv6.
[47:47.320 --> 47:50.840]  And the DoD was really the only organization that was taking the lead.
[47:51.040 --> 47:53.680]  And so the Congress seemed fairly happy with what we're doing.
[47:53.680 --> 47:57.960]  At the same time, as you know, there are lots of issues associated with it.
[47:57.960 --> 48:00.260]  What kind of costs are going to be imposed?
[48:00.260 --> 48:06.980]  How quickly are we going to retire the IPv4 systems if they can't run dual stack?
[48:06.980 --> 48:13.900]  So I don't think this is going to, you know, on the 31st of December 2008, there's not going to be a magic cutoff.
[48:13.900 --> 48:16.220]  We're just going to try to get there as fast as possible.
[48:16.320 --> 48:23.240]  Most of it's going to be new equipment we buy, data we refresh, are going to have to be IPv6 compatible.
[48:23.240 --> 48:26.860]  But we can talk later on if you want. I don't think that's the answer.
[48:32.910 --> 48:34.630]  By the which project?
[48:35.890 --> 48:37.910]  I can't actually know.
[48:38.210 --> 48:42.150]  The question is, can I comment on the achievements of the DTUR project?
[48:42.250 --> 48:45.070]  And I'm not familiar with the project. Give me some more background.
[48:57.420 --> 49:02.980]  It's an NSF DoD funded testbed, if you will, to look at the internet.
[49:02.980 --> 49:08.200]  Actually, I'd like to learn more about that because we're in the process right now of assembling
[49:09.500 --> 49:13.800]  an end-to-end testbed for the global information grid.
[49:14.000 --> 49:16.060]  And we've been going around inventorying, if you will.
[49:16.060 --> 49:20.680]  For example, I'm funding something at the Naval Research Lab that's an end-to-end testbed.
[49:20.700 --> 49:24.200]  The Joint Forces Command down in Norfolk has an end-to-end testbed.
[49:24.360 --> 49:26.380]  The Army has one out of Fort Hood.
[49:26.380 --> 49:30.120]  So I'd like to learn more about where DTUR goes because I'm not familiar with it.
[49:40.210 --> 49:43.590]  The question is, why are we moving towards IPv6?
[49:44.630 --> 49:52.810]  Well, we need the security and the mobile environment features
[49:52.810 --> 49:59.610]  of being able to automatically establish links with adjacent networks, those sorts of things.
[49:59.910 --> 50:05.250]  The security, there's a sense that the rest of the world, China, whatever, is likely to move to it.
[50:05.250 --> 50:10.170]  We're certainly not doing it because right now we're constrained in IP address space.
[50:10.170 --> 50:15.590]  But the department is going to be explosively moving to unattended ground sensors
[50:15.590 --> 50:19.550]  and unattended, well, mainly ground.
[50:19.550 --> 50:22.710]  And that's going to start using up our space.
[50:22.730 --> 50:27.090]  We were trying to not have to go to NATs for some of these sub-NATs.
[50:27.110 --> 50:29.590]  So that was essentially the reasons that drove it.
[50:44.210 --> 50:47.130]  The question is, how much collaboration do we do with other agencies
[50:47.130 --> 50:50.370]  on information sharing and information security?
[50:51.030 --> 50:59.350]  As I mentioned, we in the intelligence community and NATO have a very close relationship
[50:59.350 --> 51:02.630]  based on the fact we have a common data strategy.
[51:03.830 --> 51:07.550]  NATO has something called STANAG, Standing Agreements.
[51:07.590 --> 51:14.010]  And in fact, we've tried to base a lot of our policies and technologies on NATO STANAGs.
[51:14.010 --> 51:20.430]  So it's not just U.S. only, and we're actually trying to show it's an alliance event as well.
[51:20.610 --> 51:24.190]  I think there are still some major cultural differences in here,
[51:24.190 --> 51:27.930]  especially with the intelligence community, in terms of some of the stovepipes
[51:27.930 --> 51:29.990]  that have been around for a long time.
[51:30.150 --> 51:35.230]  And they probably feel that we're moving too quickly to need to share or vice need to know.
[51:35.230 --> 51:40.090]  And we probably feel that we'd like them to put some more information in the network faster.
[51:40.090 --> 51:45.330]  So the discussions are ongoing continuously.
[51:45.330 --> 51:49.090]  The President signed an executive order last summer
[51:49.090 --> 51:53.430]  mandating the sharing of terrorist information across the government.
[51:53.930 --> 52:00.050]  The legislation that set up the Director of National Intelligence
[52:00.050 --> 52:04.550]  amplified that to actually set up a position within the DNI's office
[52:04.550 --> 52:07.530]  as a program manager for information sharing.
[52:07.530 --> 52:10.630]  So there's just a lot of energy in this, and we're just trying to pull it together
[52:10.630 --> 52:13.970]  across the messy processes that are the U.S. government.
[52:30.640 --> 52:34.900]  The question is, do I think there's enough control by the government over the Internet,
[52:34.900 --> 52:36.220]  not enough control?
[52:37.420 --> 52:43.220]  This is going to come up in the World Summit in Tunis,
[52:43.220 --> 52:45.720]  and we're working out the various positions.
[52:45.820 --> 52:51.260]  I think, by and large, the U.S. is willing to see more role in Internet governance,
[52:51.260 --> 52:54.180]  by other countries, but we're not willing, at this point,
[52:54.180 --> 52:59.000]  to give up some of the key features like ICANN and that sort of thing.
[52:59.060 --> 53:02.780]  The positions, frankly, are still being refined.
[53:16.380 --> 53:21.600]  Let me see. First of all, I can only speak for the Department of Defense.
[53:21.840 --> 53:28.600]  And from the DoD perspective, I have no problem with the current level of control of the Internet.
[53:29.120 --> 53:31.860]  It's a good question to ask the Fed panel,
[53:31.860 --> 53:34.440]  because the law enforcement people might have a different view.
[53:56.330 --> 54:02.150]  The question is, there's a need to keep a 10- to 15-year focus on information assurance.
[54:02.290 --> 54:09.070]  The concern that recently the DARPA funding for the longer-term computer science projects has dried up.
[54:09.070 --> 54:10.730]  What do I think about that?
[54:10.990 --> 54:13.650]  I know there's been a conscious effort on the part of DARPA
[54:13.650 --> 54:22.830]  to focus on projects with more, what do I want to say, direct return on investment from the R&D.
[54:23.250 --> 54:29.110]  There's always going to be a tension between what the 10- or 15-year problem is and what the local one is.
[54:32.610 --> 54:39.330]  Candidly, I've more or less accepted the view of the director of DARPA where he should put his resources.
[54:39.330 --> 54:45.110]  We're doing a lot of work, not just with DARPA, but also with NSA, and also with the academic community,
[54:45.110 --> 54:47.490]  in terms of the long-term projects.
[54:47.550 --> 54:52.350]  And at this point, I have more problem with the point I made earlier of how to justify
[54:52.350 --> 54:58.870]  what I believe should be a higher level overall across the board in information assurance projects,
[54:58.870 --> 55:05.590]  rather than whether DARPA is not doing enough, because there are ways to cover that in other areas.
[55:05.590 --> 55:07.550]  So that hasn't bothered me particularly.
[55:07.550 --> 55:08.950]  Ma'am?
[55:31.970 --> 55:40.310]  I'm sorry, the question is, as we work outside the .mil domain, the areas, the ones I cited,
[55:40.310 --> 55:49.650]  were non-traditional partners within the U.S. government, like USAID, with whom DOD hasn't typically worked,
[55:49.650 --> 55:57.550]  international organizations like the United Nations, some NGOs, and I cited Doctors Without Borders,
[55:57.550 --> 56:02.630]  of course there are a whole raft of them, and some of these in the past have actually had in their charters
[56:02.630 --> 56:05.450]  that they should not work with the military.
[56:05.950 --> 56:10.730]  And I think one of the things that we've made some progress on over the past year or so,
[56:10.730 --> 56:18.270]  particularly since tsunami, is a recognition that if we really are going to provide services to people in distress,
[56:18.270 --> 56:21.930]  and frankly from my perspective, I'm just talking from my DOD hat,
[56:21.930 --> 56:26.970]  I'm interested in the stabilization of these situations so they don't turn into problems
[56:26.970 --> 56:29.230]  where the military has to intervene.
[56:29.510 --> 56:32.590]  So in those types of situations, we have a common interest.
[56:32.670 --> 56:39.050]  And that was, I just used Doctors Without Borders as an example of a broad class of non-governmental organizations.
[56:40.850 --> 56:44.810]  Absolutely, NGOs are a group who are actively courting.
[56:49.410 --> 56:51.030]  You had something here, right?
[56:51.030 --> 56:53.650]  Go ahead.
[57:08.170 --> 57:15.050]  The question is, have we seen anything similar to TPED, the Trusted Product Evaluation Program for military?
[57:20.580 --> 57:25.320]  Yeah, for power grid and banks and other critical infrastructures and things like that.
[57:25.320 --> 57:29.080]  That's a very interesting question. I hadn't thought of it. Let's talk afterwards.
[57:29.240 --> 57:38.340]  Because I think you could do a lot with that, but we need to work that through this messy interagency process
[57:38.340 --> 57:39.680]  and I haven't tried to do that.
[57:39.680 --> 57:43.360]  I'm getting a sign here, I think maybe two more questions and we'll have to call it a day.
[57:43.480 --> 58:03.660]  The question is, information assurance and contractors, how does that affect security
[58:03.660 --> 58:06.480]  when information assurance isn't part of their award fee?
[58:06.900 --> 58:14.860]  One of the things we've got to learn to do better in this outsourcing of services is to write our contracts smarter.
[58:14.860 --> 58:26.060]  I was out in Afghanistan earlier this year and the contracting officer's representative for the 25th Infantry Division in Bagram was actually down in Qatar.
[58:26.200 --> 58:36.100]  And if they wanted to do combat operations after hours, they would have to call Qatar and get money added to the contract in order to conduct the operations.
[58:36.100 --> 58:38.300]  Because we just hadn't written the contract right.
[58:38.300 --> 58:44.740]  So it seems to me in this environment we've got to write the contract so that information assurance becomes part of the award fee structure.
[58:44.920 --> 58:47.600]  We're not there yet, this is a learning process.
[58:48.240 --> 58:51.840]  Any more?
[58:53.340 --> 58:56.140]  Thank you very much, I appreciate a chance to talk with you today.
[59:03.000 --> 59:06.580]  Come work with us, I'd love to draw on your talent pool. Thanks again.