WEBVTT 00:03.820 --> 00:09.180 ...defense at the edge of a network that begins with a soldier in the foxhole and vice versa. 00:09.740 --> 00:14.040 We're trying to move from a smart push to a smart pull system. 00:14.220 --> 00:15.960 Smart push, think of a telephone. 00:15.960 --> 00:20.400 I need to know not only where you are, but what you need to know in order to convey the information. 00:20.620 --> 00:24.980 Smart pull says I probably don't know where you are and I certainly don't know what you need to know. 00:24.980 --> 00:29.420 So we'll use the network to provide the information for you to gather it. 00:29.420 --> 00:42.600 The basic thing we're trying to get to is to take data and turn it into information, and turn it into knowledge, and turn it into understanding, and then into action as quickly as possible in near real time if we can. 00:43.220 --> 00:47.100 And the point of this, it's not just material, we're not just talking about the networks. 00:47.320 --> 00:55.220 We're talking about you have to change the doctrine by which new business, we have to reorganize the way we are set up, we have to train our people. 00:55.220 --> 01:06.540 Obviously there's some material pieces, there's a key leadership piece, we need to get the personnel in place to be trained to do this, and we have to have the facilities and the infrastructure to support it. 01:06.540 --> 01:13.580 So all of this needs to be evolved together in order to get the objective we're looking for. 01:13.680 --> 01:16.940 The mission I think is more complex than a lot of people realize. 01:16.940 --> 01:26.280 It's not just war fighting, it's a mix of that, of course, plus business, plus intelligence, plus logistics, and also increasingly importantly peacekeeping. 01:26.540 --> 01:33.980 I was in Afghanistan in January talking with people in the provincial reconstruction teams working with the Afghan provinces. 01:33.980 --> 01:37.920 We did a lot with the tsunami relief efforts in Southeast Asia. 01:37.920 --> 01:41.300 We've had people supporting relief efforts in Darfur. 01:41.300 --> 01:44.600 All of this relies on the same network we're talking about. 01:45.420 --> 01:54.060 A point to be made is that when we do get to combat, it's a fundamentally different sort of thing than one might have expected in the past. 01:54.120 --> 01:57.380 Several people now talk about something called the three-block war. 01:57.520 --> 02:05.200 You're engaged in peacekeeping on one block, you're putting down a riot on the next, and you're engaged in full-fledged combat operations the next. 02:05.200 --> 02:12.140 It's not the clear kind of distinction most of the planning and most of the people are used to in terms of the phases of operations. 02:12.440 --> 02:26.160 People also talk about something called a strategic corporal, meaning that decisions made by people at every level at this point get into the newspapers, get into the CNN, get into whatever, and they become sort of national issues very quickly. 02:26.180 --> 02:34.940 So in short, the whole structure, the whole hierarchical structure, is breaking down to a much flatter, much more networked, much more dynamic organization. 02:36.540 --> 02:52.520 There are a lot of things in the security field that relate to what industry is doing, but frankly there's a scale and a complexity and perhaps even a sort of stakes issue here that doesn't really reflect a lot of what industry has. 02:52.600 --> 02:57.240 We have people whose lives literally are on the line today, depending on the network. 02:58.140 --> 03:03.380 Somebody described DoD as being just like Walmart, except that... 03:04.180 --> 03:05.540 Yo, Walmart! 03:05.540 --> 03:06.380 Okay. 03:08.040 --> 03:13.960 Except that every store is mobile, the competition fires ordnance at you, and Christmas comes randomly on any given day. 03:15.140 --> 03:17.580 So, other than that, we're more or less the same. 03:18.080 --> 03:23.080 We have this thing on which, of course, the key to network-centric operations, you've got to have a network. 03:23.500 --> 03:30.700 And the basis of this is something we call the Global Information Grid, or GIG, since we're addicted to acronyms. 03:31.960 --> 03:44.980 And there are six major programs that comprise this GIG, and it's not just material, it's also the people and processes who store, process, transmit, add value to information across the department. 03:45.360 --> 03:49.020 So, four of the programs deal with the transport of information. 03:49.620 --> 04:01.260 One deals with enterprise services, and I've just come from a very sobering talk from Scott Sender on vulnerabilities of network services. 04:01.820 --> 04:04.680 And one deals with the information assurance of the network. 04:04.680 --> 04:07.740 By the way, I'd like to talk for about 30 minutes, then I'll open it to questions. 04:08.800 --> 04:11.440 The program's first four deal with transport. 04:11.440 --> 04:13.360 One is a terrestrial fiber net. 04:13.360 --> 04:21.280 We call it the GIG bandwidth expansion, 10 gigabit per second, OC192 fiber, to the 80 largest command and control nodes around the world. 04:21.280 --> 04:24.700 That'll be full operational capability by the end of this year. 04:25.280 --> 04:37.840 The second is to extend this global network to mobile units, and that's a transformational satellite that's going to take lasers around the satellite ring to give you, again, 10 gigabits a second anywhere on the planet. 04:38.680 --> 04:49.700 One of the purposes of that is to use laser uplinks from aircraft, so we won't have to use so much spectrum to exfiltrate the data from the various kinds of reconnaissance sensors on the aircraft. 04:49.940 --> 04:54.160 The third piece of transport is something called the Joint Tactical Radio System. 04:54.160 --> 05:07.720 It's a software-defined radio, software-controllable architecture, and that's designed to provide the mobile routers on the IP mobile networks in order to bring these capabilities to the tactical units. 05:07.740 --> 05:13.700 Finally, there's something called teleports that links the ground infrastructure with the on-orbit infrastructure. 05:13.700 --> 05:18.200 So that's kind of the very heterogeneous network we're talking about. 05:18.200 --> 05:25.260 It's 10 gigabit per second, stable, to 10 kilobit per second, very unstable in tactical mobile environments. 05:26.140 --> 05:35.000 The enterprise service, Net-Centric Enterprise Services, is basically beginning to take you to a software as to a service-oriented architecture. 05:35.000 --> 05:36.960 I'll talk more about that in a bit. 05:36.960 --> 05:42.240 And then there's a whole information assurance program called the Gig Information Assurance Program. 05:42.240 --> 05:49.500 We spend about $2.2 billion a year in DoD and with NSA on the security of the network. 05:52.410 --> 05:58.410 One of the pieces we're trying to work on is to move from this stable environment to a tactical environment. 05:58.410 --> 06:07.270 This perhaps is something that a lot of the commercial analogies break down because we have to be able to handle very dynamic environments. 06:07.270 --> 06:16.250 Of course, the cell phone environment is dynamic also, mobile, but here with people jamming, shooting, very kind of severe environmental conditions. 06:19.440 --> 06:27.760 The paradigm that goes with this is a movement from need to know, which is kind of hoarding the information, I own it, to need to share. 06:27.760 --> 06:32.120 You're not going to get the value of the network until you get the information out on the network. 06:32.300 --> 06:37.120 And this is much more of a policy and a cultural thing than actually a technological thing. 06:38.340 --> 06:40.400 A couple people issues come to mind. 06:40.400 --> 06:51.780 In 1996 or 7 or so, I went up to New York and listened to a group of presentations by a series of analysts from the computer security industry talking to people on Wall Street. 06:52.360 --> 07:02.240 And so there's maybe a certain amount of hype in the presentations, but what I took away was, we, industry, can provide you, customer, with any level of security you want. 07:02.760 --> 07:05.520 But we need from you three things. 07:05.520 --> 07:10.560 We need to have a commitment from the top of your organization that security is important. 07:11.640 --> 07:25.240 We need to have you spend the resources, and by resources I don't mean the one-time procurement of firewalls and guards, but the ongoing expenditures to maintain near real-time situational awareness of what's going on in your networks. 07:25.880 --> 07:29.340 And you've got to be willing to drop the hammer on people who don't play by the rules. 07:30.240 --> 07:34.860 And I'd say in government at this point, we've done a pretty good job at conveying that security is important. 07:35.020 --> 07:37.400 God knows we're spending a lot of money on the problem. 07:37.500 --> 07:41.260 We have not done a good job in dropping the hammer on people who don't play by the rules. 07:41.340 --> 07:52.080 It's a lot easier for me right now to get a security violation by leaving my safe open than it is by posting my password on my computer or letting an unauthorized modem be attached to my network. 07:52.080 --> 07:53.740 We need to work on that. 07:55.700 --> 08:02.360 NSA has done a terrific job in putting together a new information assurance architecture for the gig. 08:03.020 --> 08:04.960 And this is being driven by several factors. 08:04.960 --> 08:11.540 I mean, obviously the environment is changing, the paradigm security is changing, moving network-centric operations. 08:12.020 --> 08:16.300 But we also have to pay a lot more attention to the insider threat. 08:16.300 --> 08:24.860 If you look at our major espionage cases over the past 25 years, almost every single one of them had their security clearances before they went bad. 08:25.200 --> 08:29.100 We focus a lot on the perimeter of the problem, keeping the bad guys out. 08:29.160 --> 08:34.960 The issue is we have to be able to detect anomalous behavior in the network and respond to it. 08:35.160 --> 08:40.120 I heard today from Paul Simmons of Jericho Forum the term deperimeterization. 08:40.340 --> 08:44.700 And I look forward to learning more about that because I think that's some description of where we're going. 08:45.140 --> 08:49.340 So there are five concepts, you will, in this new information assurance architecture. 08:49.340 --> 08:54.740 One is to separate the protection of the information from the protection of the infrastructure. 08:55.400 --> 09:00.060 Another is the end-to-end protection of information through enhanced access controls. 09:00.060 --> 09:09.680 We need to have strong identification and authentication, which is absolutely critical to being able to do security based on policy-based access. 09:10.100 --> 09:13.140 We've got to have enhanced misuse identification. 09:13.420 --> 09:15.040 For example, Visa and MasterCard. 09:15.040 --> 09:20.020 I was in Kuwait a couple of months ago and I went to buy my wife some jewelry. 09:20.060 --> 09:22.980 So I swiped the first card and it went through. 09:23.020 --> 09:25.760 Second time it went through and said, ah , denied. 09:25.940 --> 09:30.160 So we pulled the string on and it turned out, of course, they said, well, last Saturday you were in Virginia. 09:30.160 --> 09:31.140 Now you're in Kuwait. 09:31.140 --> 09:32.800 You never told us you're going overseas. 09:32.860 --> 09:34.060 Is this really you? 09:34.200 --> 09:35.260 And I appreciate that. 09:35.260 --> 09:42.480 On the one hand, if they can do this sort of thing on the basis of hundreds of millions of transactions, why can't we do this in our network? 09:42.480 --> 09:59.200 But it was pointed out to me on several occasions, most recently today, the problems we're looking about detecting anomalous behavior inside a military network are perhaps qualitatively different than those on just credit card transactions. 09:59.200 --> 10:14.380 If you want to ask why is Wells trying to hack into the Secretary of Defense's computer at midnight, if you want to say why is the Southeast Asian analyst all of a sudden more interested in Cuba, I submit that's a more complicated problem than just a transaction in a different physical location. 10:14.500 --> 10:17.060 And some of these, in fact, may not even be solvable problems. 10:17.060 --> 10:20.200 We need to understand just what the limits are of what we can do. 10:20.520 --> 10:26.240 So the fourth piece of these five characteristics is enhanced computer network defense. 10:26.260 --> 10:33.140 And I'll talk a little bit more in a minute about something called the Joint Task Force Computer Network Operations that's recently been set up. 10:33.460 --> 10:38.500 But basically it's improved detection, correlation of data, and visualization of data. 10:39.060 --> 10:42.300 Fifth point is we need very aggressive research and development. 10:42.560 --> 10:44.620 These are going to be different problems. 10:44.620 --> 10:48.140 We're building really for the world of 2012 to 2015. 10:50.020 --> 10:52.000 And they're not going to be solved in the near term. 10:52.000 --> 10:55.520 So first of all we have to stay abreast of the changing threat. 10:56.040 --> 11:03.200 But some examples of the really high-end computing that are going on, or high-end R&D, a lot of work in quantum computing. 11:03.900 --> 11:14.860 As Feynman said at one point, by the time every bit gets down to an atomic scale, then you're going to be at quantum principles whether you like it or not. 11:14.920 --> 11:20.180 And so as Moore's Law progresses, we're going to be driven to quantum computing whether we like it or not. 11:20.460 --> 11:38.900 Some of the breakthroughs recently, or some of the developments recently, much more control over single photons, the ability to separate electrons into separate streams based on their spin, the ability to combine information from multiple atoms onto a single photon, 11:38.900 --> 11:43.980 and the building of the first quantum registry with progress made towards a quantum gate. 11:44.020 --> 11:47.060 So that's a fairly aggressive program. 11:47.340 --> 11:47.980 DARPA. 11:48.020 --> 11:54.540 www.darpa.mil They have a strategic plan there which I encourage anybody interested to take a look at. 11:54.700 --> 11:58.180 Some of the things they're looking at are self-forming, self-healing networks. 11:58.180 --> 12:01.000 They've already made a lot of progress in tactical environments. 12:01.000 --> 12:17.980 There's a lot of questions about whether, in these dynamic networks, TCP, for example, is an acceptable protocol just because the overhead associated with all the handshaking is so high that we may not be able to get enough throughput. 12:17.980 --> 12:19.520 So we're looking at alternatives. 12:19.520 --> 12:21.460 Chips scale atomic clocks. 12:21.560 --> 12:28.120 200 times increase in power and size. 12:28.500 --> 12:31.060 300 in power, 200 in size. 12:31.200 --> 12:42.720 And then a lot of work on hybrid optical and RF connections so we can get much more robust, smaller units in the field to let us get around bandwidth limitations. 12:44.120 --> 12:51.640 So there's an awful lot of stuff going on and I think we're making some progress but obviously we don't have all the answers. 12:51.640 --> 12:54.800 I mentioned the Joint Task Force Global Network Operations. 12:54.800 --> 13:10.780 This was changed last year from the Joint Task Force Computer Network Operations because we're expressly trying to get to not just computer nets but telephone nets and space networks and a whole series of different approaches to the problem. 13:12.320 --> 13:25.920 Its responsibility is the operation and the defense of the network and it does this by coordinating and directing the activities of the network operations centers and the various components across the department and also the computer emergency response teams. 13:26.320 --> 13:30.620 We also work very closely with law enforcement and the intelligence community. 13:33.260 --> 13:42.020 The task force, I would say, has successfully responded on several occasions to attacks, whether direct or indirect, on the DoD network. 13:42.100 --> 13:45.520 I love you, NMDA, Witty Worm. 13:45.520 --> 13:48.840 We did not have significant degradations from those. 13:48.840 --> 14:00.300 We certainly don't have it 100% but I think we are getting better at containing the events early and mitigating the consequences of people, again, where folks' lives are quite literally on the line. 14:00.300 --> 14:01.800 We're not doing this for profit. 14:01.800 --> 14:04.480 We're not doing this for bragging rights. 14:04.480 --> 14:09.640 We're doing this to support people who are in the field today and whose lives are on the line. 14:10.520 --> 14:16.020 We've also had much better cooperation, I think, with other agencies and I'll talk more about that in a little bit. 14:16.120 --> 14:38.060 We certainly don't claim to have all the answers and we need talented people and that's one of the reasons why I really appreciate the chance to be here today because you all out there represent an enormous body of knowledge, an enormous amount of talent and we could use a better understanding of some of the skill sets you have. 14:38.400 --> 14:44.660 My main focus, frankly, is not on the hacker who's in it for sport or challenge. 14:44.660 --> 14:55.780 My concern is the people who want to steal DoD information and do harm, either sort of directly or indirectly, to these people who are out there every day putting their lives on the line. 14:56.060 --> 15:08.220 We do prosecute lawbreakers, those caught getting into DoD networks and so if you are going to try to break the law and hack into our nets, we will try to impose legal consequences. 15:08.240 --> 15:10.920 But I'd rather emphasize today something different. 15:11.220 --> 15:12.480 It's an opportunity. 15:12.920 --> 15:28.600 The opportunity is if you want to work on cutting-edge problems, if you want to be a part of the truly great issues of our time, if you want to literally write history, we invite you to work with us. 15:28.600 --> 15:38.560 Quite frankly, in my job, not a day goes by that I don't come to work and say, wow, what new and interesting thing is going on out there that I want to work on. 15:38.560 --> 15:42.460 And it's an absolutely fascinating environment and we definitely need your help. 15:44.420 --> 15:48.580 What I would ask for is your help in reducing the noise. 15:49.120 --> 15:59.760 All the scanning, all the probing, all the attempted intrusions, divert our resources from the truly serious attacks that are out there. 15:59.760 --> 16:09.820 And have no doubt, there are people out there who seriously want to do us harm and do not share the values of the freedom of information on the network. 16:10.000 --> 16:11.800 There are people who want to do us harm. 16:11.800 --> 16:18.980 If you haven't taken a look at it, I'd recommend Scott Borg, who's done some very interesting work on the economic consequences of cyber attack. 16:18.980 --> 16:21.900 He used to be up at Dartmouth and now he has his own company. 16:21.900 --> 16:23.720 Really worthwhile. 16:24.240 --> 16:29.060 So my final message is, again, we value your talents. 16:29.060 --> 16:32.140 I would like very much to learn from what you have to offer. 16:32.140 --> 16:41.280 I frankly have taken away just from the time I've been here so far an enormous amount of information that is really useful to me that I would not have gotten without coming here. 16:41.300 --> 16:45.960 I look forward to coming back and talking with you more on the Meet the Fed panel later on in the afternoon. 16:46.160 --> 16:47.980 And let me open it to questions. 16:48.100 --> 16:49.340 Thank you very much. 16:49.340 --> 16:49.960 Go 16:55.070 --> 16:56.610 ahead. 17:04.960 --> 17:07.160 The question is on full disclosure. 17:07.160 --> 17:08.580 And what is my... 17:12.490 --> 17:13.450 Sure. 17:14.170 --> 17:19.110 What's my take on full disclosure, national security compared with business, so on and so forth? 17:25.010 --> 17:36.530 By and large, as we move to a network environment, and again I mentioned the point is sharing of information, and we do better in the long run by having information out there and having us share it. 17:38.010 --> 17:47.770 It's a major cultural change for us in terms of people who've owned information and say my owning it is more important than getting out to other people. 17:48.390 --> 17:56.810 And so I can't draw you a clear line that says everything to the right of the line is kept hidden, everything to the left is shared. 17:56.810 --> 18:06.130 My inclination at this point is shared because, as I say, I've learned stuff today about vulnerabilities that we need to get back and work on that I wouldn't have known if I hadn't come to a place like this. 18:06.130 --> 18:11.130 At the same time, there clearly is stuff that needs to be protected. 18:11.130 --> 18:21.990 And my particular focus is on protecting that information that puts people's lives directly at risk, which tends to be fairly perishable operational information. 18:21.990 --> 18:24.310 And then the flip side is things to say the U.S. 18:24.310 --> 18:30.610 has invested tens of billions of dollars of research and development in that gives us some kind of competitive advantage long term. 18:30.610 --> 18:32.070 That needs to be protected. 18:32.070 --> 18:39.990 So those are the sorts of things that I tend to focus my concerns on, rather than just saying, well, everything has got to be kept secret. 18:40.290 --> 18:41.070 Is that fair? 18:45.990 --> 18:48.470 The use of COTS in weapon systems? 18:51.610 --> 18:55.890 Let me answer that in two... pardon me? 18:57.190 --> 18:58.710 Yeah, okay. 18:58.710 --> 19:00.490 So the use of COTS in weapon systems. 19:00.490 --> 19:11.950 There's an interesting study that says that the government as a whole, federal government as a whole, now outsources more than... 19:11.950 --> 19:17.730 now pays more in contracted services than it does in salaries of government employees. 19:18.770 --> 19:21.870 And this trend appears to be one that's only going to continue. 19:21.870 --> 19:31.510 So part of the problem is that almost none of us, gubbies, know how to manage those kinds of outsourced services. 19:31.510 --> 19:35.190 We may know how to manage a program where the gubbies are controlled and deliver it all. 19:35.190 --> 19:38.270 We don't know how to manage these outsourced services very well. 19:38.710 --> 19:54.970 And so the challenge is, as baby boomers shuffle off the stage, what are we doing to train up the next generation of managers to do a better job of managing these outsourced services and the COTS that go with them and avoiding more ADAs and things like that. 19:56.330 --> 20:07.230 From a security perspective, my concern is that this now means I will have almost no clue into the pedigree of the networks that we're becoming so dependent on. 20:07.230 --> 20:08.830 I may know who the prime is. 20:08.830 --> 20:12.850 I'm likely to have no idea who the second and third tier subs are and where they're coming from. 20:12.950 --> 20:33.610 And so this then leads me to a much greater emphasis on not only the near real-time situational awareness of the network I mentioned before, but on some kind of understanding of software and hardware assurance for those critical applications where it really does make or break the successful missile engagement or the tip of the spear issues. 20:34.010 --> 20:39.870 And so we're looking at, for example, we have a trusted foundry that we're building for hardware chips. 20:39.870 --> 20:44.190 For those certain applications, we absolutely have to make sure that the pedigree is right. 20:44.190 --> 20:54.510 We're looking at various ways through combinations of common criteria and CMM and others on how to get better software assurance involved. 20:54.510 --> 21:04.970 So I think there's going to be a graduation between GOTS and kind of trusted COTS and then what's just out there in the marketplace. 21:06.810 --> 21:22.370 Because I think we're migrating to this much more commercial environment where we, frankly, are never going to know where a lot of this stuff comes from, I would tend to put more of my emphasis on the anomaly detection of the network, the strong identification, 21:22.370 --> 21:33.950 authentication, and the response to problematic behavior in the net than I would worry about what was going on in every piece of software in the system. 21:34.170 --> 21:40.390 And so you draw the line here as to what's in a weapon system. 21:40.390 --> 21:54.010 If you're dealing with a fighter plane, that's pretty much going to be, at the very least, the high pedigree commercial software and probably is going to be dedicated design systems. 21:54.070 --> 22:07.110 But it turns out that for us, exercise after exercise after exercise shows that the most dangerous, most vulnerable parts of our operational chain, if you will, are things like logistics and medical. 22:07.110 --> 22:11.410 And in that, you're almost certainly going to have lots of cost products. 22:11.630 --> 22:14.490 So I'd love to give you an answer as to what's a weapon system. 22:14.490 --> 22:23.790 I'm more interested in what do you need to assure the mission to complete the job irrespective of the level of attack you're under, and that's going to be a layered process. 22:42.380 --> 22:51.380 The question is, what do I feel about how other foreign governments stand in information assurance in England, Russia, China, whatever. 22:53.140 --> 23:01.560 I think we understand at this point that almost every significant operation we're going to do is going to be in some kind of coalition environment. 23:02.860 --> 23:13.460 And therefore, we have to take into account the fact that our coalition partners are going to come from very different levels of information assurance and capability. 23:13.460 --> 23:17.140 I was struck by, at one point, one of our coalitions. 23:17.140 --> 23:22.640 Right now, you have long-time partners like Lithuania, Moldova, and Tonga. 23:23.580 --> 23:26.740 So this means that we're going to have to... 23:26.740 --> 23:32.600 In fact, we are working very hard on developing something called MNIS, multinational information sharing. 23:32.660 --> 23:48.660 And it's going to have to give you some sort of multi-level security, firewalls, and guards to allow you to interoperate them in some kind of a shared space while protecting those core command and control functions, say, and key pieces of data that you don't want to share. 23:48.660 --> 24:01.920 So I spend less time actually worrying about what foreign governments are doing because I don't have much control over that, and rather having to put together an operational networked environment where I can bring in unanticipated users. 24:02.300 --> 24:27.300 To that effort, I would say that we are trying to completely rethink the paradigm for DoD to operate outside the .mil domain, to work with non-traditional partners like the Agency for International Development, UN, Doctors Without Borders, and even commercial partners in the kind of stabilization and reconstruction operations that we're seeing more and more of in what we're doing. 24:27.360 --> 24:29.800 We learned a lot from tsunami. 24:30.160 --> 24:33.020 We learned a lot... we are learning a lot from Afghanistan. 24:33.360 --> 24:39.560 Some of you may know there's something called the World Summit on the Information Society that's coming up in Tunis. 24:39.620 --> 24:47.180 It's the second of two conferences this November, and we'll be working with a whole batch of the international community to try to look at ways we can do that. 24:47.440 --> 25:04.700 I personally think we are never going to get to the stage where we'll allow these pick-up team partners to get inside, say, the Nibarnet firewalls, which means that we have to go outside and have .net or .org-type domains in which we can operate and share the information. 25:04.700 --> 25:09.020 So the long answer is I'm not too much worried about what foreign governments are doing. 25:09.020 --> 25:14.500 I'm trying to set the conditions whereby we can work with a whole batch of different people in different circumstances. 25:14.800 --> 25:16.060 Back there first. 25:31.900 --> 25:43.140 The question has to do with integrated attacks, something like physical terrorist attacks coupled with attacks on PBX boxes and this sort of thing. 25:43.140 --> 25:46.980 And this clearly is an area that we have to be working on and working on harder. 25:46.980 --> 25:50.980 I personally think that the... 25:52.780 --> 25:57.660 Again, my goal is to get to mission assurance, not just information assurance. 25:57.880 --> 26:11.300 Coming from a Navy background, I tend to think of a ship which is built with watertight compartments and you can still float with a couple of compartments flooded and you have a starboard engineering plant and a port engineering plant so if one is damaged, 26:11.300 --> 26:12.440 you can still carry on. 26:12.440 --> 26:16.780 You've got multiple fighting men and you train and you train and you train and you train. 26:16.780 --> 26:28.020 So we need to take into account the fact that an attack may be just cyber, just physical, a mix of physical and cyber and work the problem in an integrated manner. 26:29.580 --> 26:33.060 This is not entirely within the domain of the Department of Defense. 26:33.060 --> 26:35.140 A lot of this comes now up in the U.S. 26:35.140 --> 26:41.680 with the Department of Homeland Security where a lot of the cyber defense and national infrastructure rides. 26:41.680 --> 26:57.720 So in fact, this week I've just spent several meetings with people from the Department of Homeland Security on how we in defense and the private sector can do a better job at coordinating the infrastructure defense on which things ride, E911, those sorts of things, 26:57.720 --> 26:59.240 to give an integrated approach. 27:01.810 --> 27:03.270 So is there an answer? 27:03.270 --> 27:03.710 No. 27:03.710 --> 27:05.150 Are we better off than we were? 27:05.150 --> 27:07.510 I mean, GETS worked very well. 27:07.510 --> 27:11.450 The Government Emergency Telephone System worked very well on 9-11. 27:11.450 --> 27:14.850 We now have the wireless equivalent of that in place. 27:15.190 --> 27:19.550 And so you basically priority overrides in the wireless service for first responders. 27:19.950 --> 27:38.270 We've had a series of major exercises called Top Off, Top Officials, where you bring the FBI and Homeland Security and National Security Council, all that together, and actually run through some pretty horrific scenarios and how the decision making would flow. 27:38.270 --> 27:46.450 So a lot of this stuff, quite frankly, is as much a policy and a decision making process as it is the technical parts of the network. 27:46.450 --> 27:54.370 And that's what we're trying to get right now, while we inventory the networks, and you will, and find out what's available out there to use when the situation comes up. 27:55.590 --> 27:56.010 Okay? 27:56.010 --> 27:57.010 Someone's down here? 27:57.230 --> 27:58.510 There's one behind. 27:59.510 --> 28:00.370 Go ahead. 28:08.790 --> 28:13.350 The question is, do we allow the implementation of software that hasn't been internally audited? 28:13.350 --> 28:28.750 All software needs to have been validated through the NIAP, to be used in the DOD National Information Assurance Partnership, to be used in the DOD networks, and in most cases it also has to go through an interoperability certification through the Joint Interoperability Test Center. 28:36.000 --> 28:39.360 Well, in some of the code, there is code review in the NIAP. 28:40.120 --> 28:42.460 Not in JITIC, but there is in the NIAP. 28:43.800 --> 28:48.100 And then there are other things that NSA does, review code and that sort of thing. 28:48.100 --> 28:49.860 So, you know, we're cautious. 28:49.860 --> 28:53.180 I mean, this question goes back earlier about what do we do with commercial software. 28:53.700 --> 29:11.260 And part of it is, you know, if we're going to use something, say, like enterprise resource software, ERP, or PeopleSoft, or something like that, I mean, you're obviously not going to go through and try to change or validate every piece of code in that, 29:11.260 --> 29:13.120 and yet we're going to be dependent on it. 29:13.120 --> 29:17.480 And so the question, again, is how do you detect anomalous behavior in that? 29:17.480 --> 29:25.980 But for those things that are in our nipper net or shipper net, we're requiring the NIAP certifications. 29:25.980 --> 29:26.720 Sir? 29:37.500 --> 29:46.680 The question is, has anybody given any thought to preventing cell phones from being used for detonating IEDs by war-dialing all the cell phones in Iraq? 29:47.620 --> 29:52.060 The amount of time we spend on IEDs is quite extraordinary. 29:52.060 --> 29:57.780 I mean, literally tens of hours a week on the IED problem. 29:58.200 --> 30:01.160 And the cell phone issue has actually come up a lot. 30:01.400 --> 30:04.740 Now, there are ways to get to cell phones beyond just war-dialing. 30:04.740 --> 30:07.080 I mean, there are different ways to get to them. 30:07.140 --> 30:09.400 And so that problem has been addressed. 30:09.400 --> 30:19.360 I have to tell you, there's not a lot of evidence that cell phones, per se, have been used to trigger IEDs. 30:19.360 --> 30:24.780 There's much more stuff on garage door openers and those sorts of things than cell phones, per se. 30:25.040 --> 30:30.320 But I guess all I can say in this forum is we understand the potential threat of a cell phone. 30:30.340 --> 30:35.920 Guys are spending lots and lots of time on, you know, when we see it being used like this, how would we counter it? 30:35.920 --> 30:43.640 I haven't heard war-dialing specifically as a suggestive way to do it, but there are other kind of electronic ways they've been looking at countering it. 30:45.220 --> 30:56.220 There's nothing, frankly, of a higher priority issue for the military right now than addressing this improvised explosive device issue in Iraq, because that's what's killing our people. 31:24.160 --> 31:28.180 The question is, the DOD has spent a lot of money to develop AIDA. 31:28.180 --> 31:29.340 We're not using it. 31:29.340 --> 31:30.320 Other people are. 31:30.320 --> 31:32.160 Is there a way we can bring it back? 31:33.840 --> 31:36.720 Let me take that for the record and go back and look at it. 31:36.740 --> 31:43.340 Frankly, my sense is that time has moved beyond AIDA. 31:45.120 --> 31:49.240 And there are lots of other ways to do business, especially if you go to the net-centric environment. 31:49.240 --> 31:52.100 So I haven't paid a lot of attention trying to revitalize it. 31:52.100 --> 31:55.580 If you want to give me your name later on, I'll take it for the record and get back to you. 31:55.580 --> 31:57.580 It just hasn't been something I've focused on. 32:12.980 --> 32:23.240 The question is, what's the ratio in the number of IEDs, improvised explosive devices, that are being detected and disarmed before they are exploded? 32:23.240 --> 32:25.000 And the answer is, yes, we have those data. 32:25.000 --> 32:26.780 I'm not sure I can share that. 32:27.200 --> 32:35.980 What's happening, though, is that we're getting better at detecting them and disarming them, but they're making them more lethal, so each one causes more attacks. 32:35.980 --> 32:46.480 I mean, using explosive-formed jets and things like that, as opposed to just focused explosive jets, rather than just a circular explosion. 32:46.540 --> 32:51.980 So, anyway, it's a typical dynamic of offense and defense. 32:53.760 --> 32:54.880 Sir? 33:03.520 --> 33:04.700 What kind of scorecard? 33:05.720 --> 33:06.700 Assist? 33:06.700 --> 33:07.260 Yeah. 33:25.640 --> 33:33.500 So the question is, is there anything like an assist scorecard, and what are we doing with guidance for the private sector about implementing data tagging? 33:33.500 --> 33:34.380 I'll get you next. 33:35.980 --> 33:40.400 And I would say that we're doing... 33:40.400 --> 33:43.760 I mean, a lot of our work is based on various kinds of balance scorecards. 33:43.760 --> 33:46.160 We're trying to put together metrics. 33:46.160 --> 33:50.940 Right now, the deputy is challenging us on getting metrics for the information assurance world. 33:51.080 --> 33:56.420 And I have to tell you, this is one of the hardest problems I've got, and this is something I would really ask for your help with. 33:56.420 --> 34:02.860 The question is how you measure return on investment on information assurance type things. 34:02.860 --> 34:22.260 So if I'm going to go in and put $100 million into some sort of technique to get to better multi-level security in 2012, and the budgeteers are out there saying, well, show me that's going to give us a 14% or a 22% or a 71% increase in security. 34:22.260 --> 34:24.120 It's really hard to do that. 34:24.120 --> 34:30.680 And so the idea of a link between metrics and investments and all that is a hard problem for us. 34:30.680 --> 34:44.620 I mean, I can go through right now and measure what's working in different network operation centers and all that, how we're doing on implementing known vulnerabilities and all that, and more concerned about the long-term return on investment metric. 34:44.620 --> 34:50.840 With regard to the public-private sector, again, a lot of this lies in the Department of Homeland Security. 34:50.840 --> 35:06.000 And part of the problem we've had ever since PDD 63, which is the critical infrastructure protection in the last administration, is building the trust, if you will, to be able for two-way sharing of information. 35:06.620 --> 35:20.980 We've spent a lot of time working with Congress and others on trying to change laws so you can provide better protection to proprietary information that comes up through the ISACs, these information-sharing and analysis centers. 35:20.980 --> 35:26.980 And we're trying to work with getting the government being more willing to share a sense of information on the way back down. 35:27.240 --> 35:40.680 If I were to say anywhere, I think the telecommunications sector, the National Security Telecommunications Advisory Committee, that process is working pretty well in the telecom sector. 35:40.900 --> 35:45.420 I don't think it's working as well in, say, transportation or energy or others. 35:45.420 --> 35:56.780 And what's coming to be a concern for me is, as SCATE is, the supervisory control and data acquisition nets become more and more a part of all of our critical infrastructures. 36:01.380 --> 36:06.300 We're making the most progress in the telecoms and the ISP world. 36:06.300 --> 36:14.320 I don't think we're getting as much progress in controlling the information technology in these other sectors where it may be equally critical to us on a national basis. 36:14.320 --> 36:26.820 So the answer is, one piece of advice I would have is the DoD and the Intel community have committed, I mentioned the global information grid and the programs. 36:26.820 --> 36:29.200 There are three other pieces that go with that. 36:29.200 --> 36:36.260 There's the network operations, network resources management piece, about how you balance the use of resources in the network. 36:36.260 --> 36:44.880 There's a spectrum management piece, and the key underlying bit is the net-centric data strategy, which is an XML-tagged approach to the problem. 36:45.440 --> 36:53.900 And it turns out that DoD and the intelligence community and NATO have almost identical net-centric data strategies. 36:53.900 --> 37:03.880 And we've really had some very good luck over the past several months in moving towards a service-oriented architecture approach and a shared situational awareness. 37:04.120 --> 37:12.780 That data strategy has not yet been adopted by the Department of Homeland Security, which means it's not being infused into the private sector through those channels. 37:12.940 --> 37:20.500 And over the past week, we've actually been working hard with the senior leadership of DHS to get them to adopt that kind of a strategy. 37:20.540 --> 37:23.740 So maybe that'll be an answer to one part of your question. 37:24.040 --> 37:28.380 The question 37:39.350 --> 37:47.610 is, as warfare goes net-centric, how do you envision managing security, connecting together what used to be stand-alone systems? 37:50.030 --> 37:58.250 I don't think there's ever going to be a closed-form solution where you lock the door and say, we got there, let's go home, turn off the lights and go home. 37:59.570 --> 38:06.790 There are just too many dynamic pieces of the puzzle in terms of not only the evolving threat, but the rolling out of new technologies. 38:06.790 --> 38:14.850 There was a very good session this morning on vulnerabilities associated with XML and service-oriented architectures. 38:14.910 --> 38:17.750 Three years ago, we wouldn't have paid any attention to that. 38:17.750 --> 38:20.930 And so now we need to fold that into the process. 38:20.930 --> 38:27.110 So I think it's going to have to be an ongoing, dynamic series of reviews. 38:28.310 --> 38:31.130 The first key part of this is cultural. 38:31.230 --> 38:39.650 If you talk to the intelligence community, they have a concept called ORCON, Originator Controlled, which basically says, I wrote the information, it's mine. 38:40.550 --> 38:51.090 And so just trying to break down the stovepipes to share that becomes much more an issue of politics and culture than it is of physically getting the bits and bytes to work out. 38:51.130 --> 39:00.510 So I think it's going to be a mix of cultural solutions, this doctrine, organization, training, evolution, the physical. 39:00.710 --> 39:09.070 And even if I could give you a solution today that said, I'm at the 95% level, I'm happy with it, it won't be that way tomorrow. 39:09.070 --> 39:30.590 The one thing I would say in DoD that, again, I look for your help on, if I'm a credit card company and I realize that I'll probably get 3-4% loss rates in fraud or whatever, I can factor that into my calculus, I can put that in my interest rates, I can factor that in. 39:30.750 --> 39:40.670 And what you get from that is an explosion of credit across the economy that transforms the ability of everyday people to buy things they never would have been able to buy before. 39:41.410 --> 39:48.170 I don't know anybody lately who's gone to the top secret control officer and say, it's okay to lose 3% of your documents a year. 39:48.570 --> 40:05.430 Even though, in the net-centric model, maybe 100 people were lost because some piece of information were compromised, maybe 10,000 were saved because the fight was over in three days rather than three months, and the value of net-centricity had an upside. 40:05.450 --> 40:15.990 So we need to think through our cost-benefit analysis to put more emphasis in the military on the upside benefit, even as we focus on the cost. 40:16.750 --> 40:20.530 Not a neat, clean answer, but that's where we're looking at. 40:20.630 --> 40:21.670 Over there, sir? 40:23.030 --> 40:24.070 Please. 40:38.650 --> 40:42.470 Critical factors in my going, I mean, how I got to be CIO. 40:43.850 --> 41:04.210 I'm sort of in a strange situation in that I was career Navy, and so I spent 26 years in uniform, and then about seven years in the Office of the Undersecretary for Policy, working largely on the interface between policy and technology issues. 41:04.550 --> 41:18.570 And so, in 1998, the Secretary decided to beef up the role of the Assistant Secretary for Command, Control, Communications, and Intelligence, which is what my organization was then known as. 41:18.570 --> 41:28.770 I was asked to go over and be the Principal Deputy in that organization because I had an understanding of less the technical details and the balance between policy and technology. 41:29.090 --> 41:33.950 I mean, my own education is, my undergraduate work was in physics and oceanography. 41:33.950 --> 41:35.830 My master's is in applied math. 41:35.830 --> 41:37.910 My doctorate's in international relations. 41:37.910 --> 41:43.810 And I found that mix of a policy science and engineering science to have been a really valuable combination. 41:43.810 --> 41:46.230 So, just a long story. 41:46.230 --> 41:51.010 What's happened now is my permanent title is Principal Deputy. 41:51.570 --> 41:57.970 Our Assistant Secretary left about 18 months ago, and so I've been acting as the CIO since. 41:57.970 --> 42:01.910 But I think, in my case, it certainly wasn't a commercial background. 42:01.910 --> 42:06.970 It was less a technical background than having the policy-technology interface understanding. 42:28.870 --> 42:33.030 The question is, I've been focusing a lot on information assurance. 42:33.030 --> 42:41.830 And as you play out 2012-2014, how do I see the offensive side playing out of information operations? 42:42.050 --> 42:46.090 I'm really limited in what I can say on that in this venue. 42:46.090 --> 42:55.730 But I think one of the key points is, as the network becomes the center of gravity for military operations... 42:55.730 --> 43:01.030 I mean, right now, we're probably the most net-centric of any military in the world. 43:01.030 --> 43:05.330 It's a model that's being adopted by a number of others as well. 43:05.850 --> 43:11.730 As more and more countries come to depend on the network, then how you attack that network... 43:11.730 --> 43:15.430 be it a physical attack or a cyber attack or whatever... 43:15.430 --> 43:18.790 will become a more important thing to work on. 43:18.790 --> 43:27.370 And I think, also, what I would expect to see is not just a single solution, but a broad... 43:27.370 --> 43:29.510 it'll become a target just like anything else. 43:29.510 --> 43:33.350 One of the things we're saying is we need to fight the network like a weapons system. 43:33.350 --> 43:35.630 You need to think of it as a ship, tank, an airplane. 43:35.630 --> 43:37.070 It's a critical component. 43:37.250 --> 43:40.570 And so, as a result, you have to defend it against the full range of threats. 43:40.570 --> 43:44.950 And we have to be able to, you know, similarly mount the full range of threats. 43:44.950 --> 43:46.570 That's probably about as far as I can go. 43:47.830 --> 43:48.710 Somebody in the back. 43:48.710 --> 43:50.450 I'm sorry, I can't see hands back there. 43:50.450 --> 43:51.510 I'd be glad to... 43:56.810 --> 43:57.810 Yeah, please. 44:23.080 --> 44:24.340 It's a really good question. 44:25.220 --> 44:31.860 What about cyber attacks and penetrations that originate from foreign countries and how do we prosecute them? 44:32.540 --> 44:37.980 I think, as most of you know, the attribution of a cyber attack can be a really hard thing to do. 44:38.580 --> 44:56.200 And so, with a number of countries, for example, in Europe and the Interpol and a number of bilateral agreements, we now have some pretty good mutual law enforcement rules to be able to address... 44:57.240 --> 44:58.580 For instance, the UK. 44:59.040 --> 45:05.720 The UK would either prosecute people who hack into our nets or, in some cases, we can extradite them to be prosecuted here. 45:05.840 --> 45:08.540 There are other countries where, frankly, it's a free ride. 45:08.540 --> 45:15.780 If you hack from there, there's no... In some cases, it's not a crime to the hacking in those nations' laws. 45:15.840 --> 45:18.620 And if we don't have agreements with them, there's not much you can do about it. 45:18.620 --> 45:29.260 So, I think over the past ten years, we've made a lot of progress in working out multilateral and bilateral law enforcement agreements, but it's certainly a patchwork quilt around the world. 46:06.760 --> 46:18.480 The question is, in these countries that are not doing a good job in policing their own cyber security, or which we don't have agreements with, are there other ways we could put pressure on them? 46:18.480 --> 46:20.860 Postal agreements or something like that, too. 46:20.860 --> 46:25.740 And the answer is, the Defense Department doesn't do... That's not our thing. 46:25.740 --> 46:28.140 That would be the law enforcement or State Department. 46:28.140 --> 46:35.820 When we have the Ask the Fed panel later on, if you come, that would be a very good question to ask for the folks who'd be here, because there'd be people who could address it. 46:37.300 --> 46:38.620 Back there first. 46:42.660 --> 46:45.600 What does IPv6 capable really mean? 46:47.740 --> 46:52.660 We've set a goal of 2008 to implement IPv6. 46:53.240 --> 46:59.840 And it's going to be done through a technology refresh policy rather than a Big Bang solution. 47:00.060 --> 47:04.380 And so I would guess we'll be running dual stack for a long time. 47:12.360 --> 47:14.320 Tell me more about your question. 47:14.320 --> 47:22.280 Because what we're essentially saying is anything that we're buying since last year, or 2003, I think, should have been IPv6 capable. 47:22.280 --> 47:25.300 And your question is, that's an ambiguous definition? 47:32.480 --> 47:39.720 I see the rollout of IPv6 is going to be, we're pushing as hard as possible. 47:39.720 --> 47:47.320 There was just a congressional hearing that was basically saying that the government as a whole should be doing more with IPv6. 47:47.320 --> 47:50.840 And the DoD was really the only organization that was taking the lead. 47:51.040 --> 47:53.680 And so the Congress seemed fairly happy with what we're doing. 47:53.680 --> 47:57.960 At the same time, as you know, there are lots of issues associated with it. 47:57.960 --> 48:00.260 What kind of costs are going to be imposed? 48:00.260 --> 48:06.980 How quickly are we going to retire the IPv4 systems if they can't run dual stack? 48:06.980 --> 48:13.900 So I don't think this is going to, you know, on the 31st of December 2008, there's not going to be a magic cutoff. 48:13.900 --> 48:16.220 We're just going to try to get there as fast as possible. 48:16.320 --> 48:23.240 Most of it's going to be new equipment we buy, data we refresh, are going to have to be IPv6 compatible. 48:23.240 --> 48:25.880 But we can talk later on if you want. 48:25.880 --> 48:26.860 I don't think that's the answer. 48:32.910 --> 48:34.630 By the which project? 48:35.890 --> 48:37.910 I can't actually know. 48:38.210 --> 48:42.150 The question is, can I comment on the achievements of the DTUR project? 48:42.250 --> 48:43.590 And I'm not familiar with the project. 48:43.590 --> 48:45.070 Give me some more background. 48:57.420 --> 49:02.980 It's an NSF DoD funded testbed, if you will, to look at the internet. 49:02.980 --> 49:13.800 Actually, I'd like to learn more about that because we're in the process right now of assembling an end-to-end testbed for the global information grid. 49:14.000 --> 49:16.060 And we've been going around inventorying, if you will. 49:16.060 --> 49:20.680 For example, I'm funding something at the Naval Research Lab that's an end-to-end testbed. 49:20.700 --> 49:24.200 The Joint Forces Command down in Norfolk has an end-to-end testbed. 49:24.360 --> 49:26.380 The Army has one out of Fort Hood. 49:26.380 --> 49:30.120 So I'd like to learn more about where DTUR goes because I'm not familiar with it. 49:40.210 --> 49:43.590 The question is, why are we moving towards IPv6? 49:44.630 --> 49:59.610 Well, we need the security and the mobile environment features of being able to automatically establish links with adjacent networks, those sorts of things. 49:59.910 --> 50:05.250 The security, there's a sense that the rest of the world, China, whatever, is likely to move to it. 50:05.250 --> 50:10.170 We're certainly not doing it because right now we're constrained in IP address space. 50:10.170 --> 50:19.550 But the department is going to be explosively moving to unattended ground sensors and unattended, well, mainly ground. 50:19.550 --> 50:22.710 And that's going to start using up our space. 50:22.730 --> 50:27.090 We were trying to not have to go to NATs for some of these sub-NATs. 50:27.110 --> 50:29.590 So that was essentially the reasons that drove it. 50:44.210 --> 50:50.370 The question is, how much collaboration do we do with other agencies on information sharing and information security? 50:51.030 --> 51:02.630 As I mentioned, we in the intelligence community and NATO have a very close relationship based on the fact we have a common data strategy. 51:03.830 --> 51:07.550 NATO has something called STANAG, Standing Agreements. 51:07.590 --> 51:14.010 And in fact, we've tried to base a lot of our policies and technologies on NATO STANAGs. 51:14.010 --> 51:16.010 So it's not just U.S. 51:16.010 --> 51:20.430 only, and we're actually trying to show it's an alliance event as well. 51:20.610 --> 51:29.990 I think there are still some major cultural differences in here, especially with the intelligence community, in terms of some of the stovepipes that have been around for a long time. 51:30.150 --> 51:35.230 And they probably feel that we're moving too quickly to need to share or vice need to know. 51:35.230 --> 51:40.090 And we probably feel that we'd like them to put some more information in the network faster. 51:40.090 --> 51:45.330 So the discussions are ongoing continuously. 51:45.330 --> 51:53.430 The President signed an executive order last summer mandating the sharing of terrorist information across the government. 51:53.930 --> 52:07.530 The legislation that set up the Director of National Intelligence amplified that to actually set up a position within the DNI's office as a program manager for information sharing. 52:07.530 --> 52:13.310 So there's just a lot of energy in this, and we're just trying to pull it together across the messy processes that are the U.S. 52:13.310 --> 52:13.970 government. 52:30.640 --> 52:36.220 The question is, do I think there's enough control by the government over the Internet, not enough control? 52:37.420 --> 52:45.720 This is going to come up in the World Summit in Tunis, and we're working out the various positions. 52:45.820 --> 52:47.500 I think, by and large, the U.S. 52:47.500 --> 52:59.000 is willing to see more role in Internet governance, by other countries, but we're not willing, at this point, to give up some of the key features like ICANN and that sort of thing. 52:59.060 --> 53:02.780 The positions, frankly, are still being refined. 53:16.380 --> 53:18.020 Let me see. 53:18.220 --> 53:21.600 First of all, I can only speak for the Department of Defense. 53:21.840 --> 53:28.600 And from the DoD perspective, I have no problem with the current level of control of the Internet. 53:29.120 --> 53:34.440 It's a good question to ask the Fed panel, because the law enforcement people might have a different view. 53:56.330 --> 54:02.150 The question is, there's a need to keep a 10- to 15-year focus on information assurance. 54:02.290 --> 54:09.070 The concern that recently the DARPA funding for the longer-term computer science projects has dried up. 54:09.070 --> 54:10.730 What do I think about that? 54:10.990 --> 54:22.830 I know there's been a conscious effort on the part of DARPA to focus on projects with more, what do I want to say, direct return on investment from the R&D. 54:23.250 --> 54:29.110 There's always going to be a tension between what the 10- or 15-year problem is and what the local one is. 54:32.610 --> 54:39.330 Candidly, I've more or less accepted the view of the director of DARPA where he should put his resources. 54:39.330 --> 54:47.490 We're doing a lot of work, not just with DARPA, but also with NSA, and also with the academic community, in terms of the long-term projects. 54:47.550 --> 55:05.590 And at this point, I have more problem with the point I made earlier of how to justify what I believe should be a higher level overall across the board in information assurance projects, rather than whether DARPA is not doing enough, because there are ways to cover that in other areas. 55:05.590 --> 55:07.550 So that hasn't bothered me particularly. 55:07.550 --> 55:08.950 Ma'am? 55:31.970 --> 55:45.050 I'm sorry, the question is, as we work outside the .mil domain, the areas, the ones I cited, were non-traditional partners within the U.S. 55:45.050 --> 56:05.450 government, like USAID, with whom DOD hasn't typically worked, international organizations like the United Nations, some NGOs, and I cited Doctors Without Borders, of course there are a whole raft of them, and some of these in the past have actually had in their charters that they should not work with the military. 56:05.950 --> 56:21.930 And I think one of the things that we've made some progress on over the past year or so, particularly since tsunami, is a recognition that if we really are going to provide services to people in distress, and frankly from my perspective, I'm just talking from my DOD hat, 56:21.930 --> 56:29.230 I'm interested in the stabilization of these situations so they don't turn into problems where the military has to intervene. 56:29.510 --> 56:32.590 So in those types of situations, we have a common interest. 56:32.670 --> 56:39.050 And that was, I just used Doctors Without Borders as an example of a broad class of non-governmental organizations. 56:40.850 --> 56:44.810 Absolutely, NGOs are a group who are actively courting. 56:49.410 --> 56:51.030 You had something here, right? 56:51.030 --> 56:53.650 Go ahead. 57:08.170 --> 57:15.050 The question is, have we seen anything similar to TPED, the Trusted Product Evaluation Program for military? 57:20.580 --> 57:25.320 Yeah, for power grid and banks and other critical infrastructures and things like that. 57:25.320 --> 57:26.660 That's a very interesting question. 57:26.660 --> 57:27.520 I hadn't thought of it. 57:27.520 --> 57:29.080 Let's talk afterwards. 57:29.240 --> 57:39.680 Because I think you could do a lot with that, but we need to work that through this messy interagency process and I haven't tried to do that. 57:39.680 --> 57:43.360 I'm getting a sign here, I think maybe two more questions and we'll have to call it a day. 57:43.480 --> 57:43.520 The 57:57.080 --> 58:06.480 question is, information assurance and contractors, how does that affect security when information assurance isn't part of their award fee? 58:06.900 --> 58:14.860 One of the things we've got to learn to do better in this outsourcing of services is to write our contracts smarter. 58:14.860 --> 58:26.060 I was out in Afghanistan earlier this year and the contracting officer's representative for the 25th Infantry Division in Bagram was actually down in Qatar. 58:26.200 --> 58:36.100 And if they wanted to do combat operations after hours, they would have to call Qatar and get money added to the contract in order to conduct the operations. 58:36.100 --> 58:38.300 Because we just hadn't written the contract right. 58:38.300 --> 58:44.740 So it seems to me in this environment we've got to write the contract so that information assurance becomes part of the award fee structure. 58:44.920 --> 58:47.600 We're not there yet, this is a learning process. 58:48.240 --> 58:51.840 Any more? 58:53.340 --> 58:56.140 Thank you very much, I appreciate a chance to talk with you today. 59:03.000 --> 59:05.780 Come work with us, I'd love to draw on your talent pool. 59:05.780 --> 59:06.580 Thanks again.