would like to pause and remind the committee that stratcom is headquartered in the great state of nebraska. and i wanted to take this opportunity to thank senator ben nelson for his service. senator nelson will retire at the end of the congress and during his service he has worked dill gently to better the lives of our troops and strategic offices. those who work at the air force base are well aware of his deep commitment to them. on behalf of your fellow nebraskans at stratcom, senator, we off our thanks. thank you for this opportunity. i look forward to your questions. >> thank you very much, general. thank you for your reference to general ben -- now i call hem a general and you a senator -- to senator ben nelson. we all feel very much the way you do and grateful for your reference to him. thank you. general alexander? >> chairman levin, ranking member mccain and distinguished members of the committee, thank you for the community to appear before you today.

i'm pleased to appear with general bob kehler, and i echo his comments all across the board, including with senator nelson. i would start up front by echoing some of those comments which is, is it a privilege and honor to lead the soldiers, sailors, airmen, civilians of cybercommand in nsa. we have great people. thanks for what you do to get those great people for us. i'd like to thank you and your colleagues to your support and helping the command move rapidly forward in our efforts to address emerging threats and concerns to our nation. i need to thank all of our partners throughout d.o.d., dhs, and the fbi, and the endeavor to build capability and capacity. cyber is a team sport and we could not have come this far and accomplished as much as we have without them. many changes and substantial progress have been made since i

last spoke to the committee almost two years ago. cyberspace has increasingly become more critical to our national and economic security, and chairman, you brought up one of the quotes about the greatest transfer of wealth. i think that is absolutely correct. we are seeing increased exploitation into industry, government government, other government agents and the tlehreat of intellectual property is astounding. i'll address part of that shortly in comments coming up. ly eye also think that the threat has grown in terms of activists, nation state actors. the chairman emphasize cyber has area of investment and a liner defense budget. the task of assuring cyberspace access and security has drawn attention of all of our nations' leadership. u.s. cybercommand is a component of a larger u.s. government-wide

effort to make cyberspace, one, safer and a form for vibrant citizen interaction, reserve our freedom to act in cyberspace and defend our vital interests those of our allies. cybercommand is charged to direct the security, operations and defense of the department of defense information systems. but our work is affected by threats outside d.o.d.'s networks. threats the nation cannot ignore. what we see both inside and outside d.o.d. information systems underscores the imperative to act now to defend america in cyberspace. the american people expect broad and efficient access to cyberspace. military and civilian sectors rely on accessibility, increased inner connectedness of information systems, growing sophistication of cybercriminals and foreign intelligence actors has increases our risk. last spring, international

strategy for cyberspace the president confirmed inherent right to protect ourselves against attacks in this domain as in traditional domains. he said, when warranted, the united states will respond to hostile acts in cyberspace as you would to any other threat to our country. cybercommand exists to ensure the president can rely on the d.o.d. information systems and has military options available to defend our nation. the president and secretary of defense recently reviewed our nation's strategic interests issued guidance on defense priorities. in sustaining u.s. global leadership, priorities to 21st century defense, the secretary focuses on protecting access throughout the cyber domain. the u.s. cybercommand role is to pay attention how nations and nonnation state actors are developing asymmetric capabilities to conduct cyberespionage and attacks. d.o.d. recently added detail to that position in accordance with

the president's strategy the department further explained our deterrent posture to congress in a cyberspace policy report last november. d.o.d. components especially cybercommand, worked to dissuade others from attacking our planning to attack the united states in cyberspace. we worked with a range of partners, u.s. governmental lies, private industry, strengthen defense of our citizens, the nation, and allies in cyberspace. i wanted to assure you that all of our work is performed to safeguard the privacy and civil liberties of u.s. persons. these responsibilities are very much on our minds. in establishing the co-com relationships you asked about our relationships with other commands and i'd like to establish a. dress that. first establishing a cybersupport element at each of the six geographically-based cocom. u.s. centcom is operation pmg

u.s. paycoms is partially operational and others are on the way. the purpose is to provide technical expertise and cape ability and improve capabilities to the cocom planning efforts. our goal to ensure each has full suite of cyberoptions to choose from and understanding of effects these options can produce in aor. chairman, you also asked about the standing rules of engagement. the department's conducting a review of the joint staff of existing standing rules of engagement on cyberspace. these revised standing rules of engagement should give us authorities we need to maximize preauthorization of defense responses and empower activity at the lowest level. issues being ironed out are what specific he set of authorities we will receive conditions in which we conduct response actions and we expect those will be done in the next few months.

d.o.d.'s role in defense against cyberattacks, the defending the nation in cyberspace requires coordination with several key government players, notably, dhs, the fbi, the intelligence community. i'd like to put some of those on the table because it is my opinion that we need all three working together as a joint team. dhs has to lead for coordinating overall national effort to enhance cybersecurity of the u.s. critical infrastructure. they lead in resilience and preparing the defense. fbi has lead for detection investigation prevention and mitigation response within domestic arena under their authorities for law enforcement, domestic intelligence, counterintelligence, and counterterrorism. and of course d.o.d. and nsa and cybercommand lead for detection, prevention and defense in foreign space. defense of the nation comes under if the nation comes under

attack. i'd line to go into a few, if i could, a little bit on what i see we need in cyberspace. the requirements to defend the nation from attack, because there's been a lot of discussion on this and i think it's important to put this up front. i think this is the heart of some of the discussion that's going on with the legislation today. first, we need to see the attack. what do i mean by that? that was a quote that we made up at the fordham university. if we can't see the attack, we can't stop it. what we're not talking about is putting nsa or the military into our networks to see the attack. what we're talking about that all of you have put on the table is, we have to have the ability to work with industry, our partners, so that when they are attacked or they see an attack, they can share that with us immediately. the information sharing and the liability that goes along would allow industry, armed with

signatures that we can provide, signatures that they have i agree it takes all of us working together to provide a better defense. what we need is for them to tell us that something is going on. there's a couple of analogies that i'd like to use. these are not perfect analogies, just best that i can come up with. being in the armed services committee here i use the missile analogy. if a missile were coming into the country and we had no radars to see it, we couldn't stop that missile. if we have a cyberattack coming in and no one tells us that that's that cyberattack is going on, we can't stop it. today, we're in the forensics mode. what that means is, an attack or an exploit normally occurs, we're told about it after the fact. i think we should be in the prevention mode in stopping that. a lot of that can be done by industry. i think that industry should have the ability to see these

and share that with government in real-time. when you think about it it's almost like the neighborhood watch program. somebody's breaking into a bank, somebody needs to call the authorities to stop it. in cyberspace, what we're saying is armed with the signatures, the software, those things that help us understand an attack is going on we believe that industry is the right ones to tell the government that they see that, and get us respond to it. so i just want to clarify, because i do not believe we want nsa or cybercommand or the military inside our networks watching it. we think industry can do that. we think that's the right first step. and we think actually that's in both of these bills. the second part, i used that bank one because i think there's another part to this, that we have enforced within d.o.d., and that's what standards do we bill our networks to? how much of a defense do we put

in there? how do we make our defense better? we have put in a series of defensive capabilities, if you will, standards that we operate and defend our networks. how do you align your networks, how do you know they're configured right? how do you make them defensible so they will last when somebody's trying to get? i -- we have a great information assurance directorate and one of the former directors told me that 80% of the exploits in attacks that come in could be stopped just by the hygiene itself. chairman, you also brought up the issue of the carnegie melon report and i would like to hit some of that because i do think that's an important report, and it has -- it really applies to this discussion that we have going on now. as i have stated previously, that report and that assessment was early on in the d.i.b. pilot. that done mean that we can't do

better. in fact, let me turn that around and say, for us to be successful in cyberspace, it's going to require government and industry working together with best of both. industry partners see signatures that government doesn't see and government sees signatures or militia software, exploitations and attack into the country that industry doesn't see. information sharing and the ability to do that is key to stopping that. what i see from the d.i.b. pilot was increased discussion between government and industry, and this was a good thing. and it has grown. it continues to grow and we're getting better. so in legislation, what i think is we need to make the first step. we need to start. we won't get it perfect but we need that ability for industry to share with us the fact that these attacks and expoits are s exploits are going on. we cannot stop them, we cannot help. five areas that ifo cussed on

with the folks at u.s. cybercommand. first, we have to build and train cyberforces and these are things that bob kehler and i are arm and arm on. second a defense ibl architecture. you mentioned 15,000 enclaves and our antiquated architecture, if we went to the way google, yahoo! and others are doing in the defense department we'd have a more defensible architecture and that's the way we are pushing, and the services are helping us get there. i think we have to partner with dhs and fbi. the reason that i bring dhs into this is that, i believe we want them working with rest of government to help set up the rest of government networks and work with that. we do not want to take the people that i have and push them over here. i think we want people that we have looking outside and that goes to senator mccain's comments, we're the offensive force. we're the ones that are going to protect the nation, we need to see what's going on and be

prepared to do that. we can give and work with dhs and provide capabilities and technical expertise, and that's growing. finally, i'd add in fbi. they have some tremendous capabilities, they have the law enforcement arm, and when you put all three of us together, i think our country knows that what we're doing is transparent and we're doing the right thing. in doing that, you've brought all three players to the table. i see command and control in partnership is key, especially with our allies, and i'd put the allies on the table because this is going to be huge for our future and the concept of operating in cyberspace we mentions earlier. so, it is an honor and privilege to represent the soldiers, sailors, air american, marines and civ andi civilians of u.s. cybercommand today. a thank you. i'd ask my statement for the record be included on the

record. and that's all i have, chairman. >> thank you so much, general. the statement will be made part of the record. we'll start with a seven-minute first round. general kehler, first, do you support the fiscal year 2013 budget request? >> yes, sir, i do. >> general kehler, you made reference to effective nuclear command and control network that needs improvement, i believe, in your opening statement. are those efforts under way to modernize that command and control network? can you describe those efforts a little bit? >> yes, sir, i can. of course as you know the nuclear command and control system is composed of many, many parts. there are parts of the nuclear command and control system that are not survivable. there is, however, as part inher

rent in the nuclear command and control systems a thin line that ultimately would be survivable under any conditions, so that we could always ensure that the president of the united states is connected to the nuclear forces. investments are under way in those critical capabilitcapabile capabilities that are part of the space architecture layer. of course dhs satellites, the first one is on orbit, the second will go to orbit in the next year, i don't have the exact date. that will be the satellite-based survivable part of our thin line network, as we go forward. we have some issues with terminals and terminals lagging deployment of the satellites. that means we have to use older terminals we won't get the full capability of the satellites at first. we're working that program. we have some issues to make sure that our bomber connectivity is maintained. the air force program supports

that. and so i am comfortable that we're going forward there to maintain the connectivity at the force end of this. we're also upgrading some of our other components to the network, ground-based parts of the network, et cetera. i believe i will always be a little uncomfortable about the network. i will tell you that i think there's more to be done. we are working that inside the department for future budget requests and in fact, we're under taking a fairly substantial review at this point in time about the nuclear command and control system and how it does or doesn't support other issues as well. >> thank you, general. the 2010 nuclear posture you call out for studying additional reductions in nuclear weapons, do you think it is possible to further reduce our nuclear weapons s beyond the new start levels? >> mr. chairman i think there are opportunities to reduce

further, but i think there are factors that bear on that ultimate outcome. and rather than get into those, and i don't think would be appropriate, i would simply say i do think there are tu opportunities here but recognizing there are factors that bear on this. i would also mention it is never our view that we start with numbers. we start with an assessment of the situation we find ourselves in, the strategy, our objectives, et cetera, and ultimately then you get to numbers. >> thank you. general alexander, are you advocating for any additional legal authorities that are not included in the cybersecurity legislation that was proposed by the administration to congress or that's included in the lieberman-collins bill? >> no, chairman. >> industrial espionage

campaign, i noted in my opening statement, and you made reference to it in your statement, particularly china's relentless industrial espionage campaign through cyberspace, i wonder, can you give us examples in open session of the technologies that have been stolen through penetration of major d.o.d. contractors and perhaps the department itself? and do you know whether or not, in fact, we have raised this issue, particularly vice president biden, with the chinese? >> senator, i'm not aware on the last what vice president biden has shares with the chinese that discussion. but we are seeing a great deal of d.o.d.-related equipment stolen by the chinese. i can't go into the specifics here but we do see that from defense, industrial-based companies throughout. there are some very public ones,

though, that give you a good idea of what's going on. the most recent one, i think, was the rsa exploits. rsa creates the two factor a authentication for things like paypal so when you order something and pay for it over the network the authentication is done by encryption systems that rsa creates. the exploiters took many of those certifications and underlying software, which makes it almost impossible to ensure that what you're certifying or what someone else is certifying is in fact correct. now rsa acted quickly, and is replacing all of the certificates and has done that in priority order for the defense department and others. but when you think about it, the ability to do it against a company like rsa is such a high order capability, rsa being one

of best, that if they can do it against rsa, that makes most of the other companies vulnerable. >> well, we took some action on the counterfeiting area in our defense authorization bill to try to stop that type of theft, particularly, again, by the chinese when it came to the supply of parts for our weapons systems. we -- i think it would be important for you to talk to vice president biden or his office so that you can see what steps were taken to inform the chinese of our position on this. and we've now got to find ways -- and i think you're the perfect person to be a spokesman for this -- to stop their theft of other kinds of intellectual property through the use of cyber. and i wonder if you could give us some examples of -- give us some options.

i think senator mccain also made reference to this. what are the options for us in terms of action for them or anyone else who is stealing our information, our enlech actual property to pay a price for this? >> well, i suppose using the rest of stratcom would be out, chairman. i think the first -- the first thing that strikes my mind, and i want to be clear on this because the most important thing that we can do right now is make it more difficult for the chinese to do what they're doing. analogy i put on the table is, we have all of our money in our banks but the banks have the money out on tables in new york city at the park. and we're losing the money and we're wondering why, nobody's protecting or it's not well-protected. our intellectual property's not well-protected and we could do better protecting it.

step unis take those steps to do that. i do think what the department is doing, you asked for authorities that would need legislation, i think those are in the legislation, and what the department is doing with the authorities we already have is maturing the standing rules of engagement that would allow us st stop some of the exploits going on. i think those are some of the things we can do, stop them in progress. as an example, we saw an adversary trying to take about three giga the gu gigabytes from our contractors. the issue is now we had to work in human space to reach out to them to say they're trying to steal something you, you've got to stop it. there's got to be a better way to do that because that's like going at network speed, trying to send a regular mail letter to them that you're being attacked.

so we've got to bring this up into the network age to get these responses out. so i would advocate, and i think the way we're going is, to, one, bill our defense and two have options that would stop it. beyond that, i think the president and secretary need options that would take it to the next step. these are not options that we would take but these are options that we would propose the administration. if they exceed certain limits, i think it is our responsibility jointly and with the co-coms to say these are actions to take on stopping the act and here's what we propose to be done. i think our job would be to defend and protect astop some attack analogous to the missiles coming in and give the administration options to take it to the next step if they chose. those include cyber and other options available. i think the white house has put that forward in their

cybersecurity thoughts. >> thank you. senator mccain? >> i want to thank the witnesses. i would ask general alexander, do you agree that secretary panetta and the fbi have said that cyberattacks may soon be the number one threats to the united states? >> absolutely, senator. >> and would you agree that a major threat to our national security come from outside the united states? specifically, obviously, from unclassified information from china? >> absolutely. >> absolutely. so then what's the logic in providing the overall authority to the department of homeland security? anyone who has been through an airport, as i do regularly, as most of us do, have no confidence in the technological capabilities of the department

of homeland security. in fact, as an example, nothing has changed as far as airport security is concerned since probably september 12th, 2011. so the major threat comes from overseas. what would be the logic, then in making the lead organization the department of homeland security? >> senator, i think the issue, if i could, i want to break this out into three areas to make sure my responses -- >> make it brief. i have additional questions. >> yes, sir. i see three major things. we want dhs to take the lead on resilience and working with civilian agencies in critical infrastructure. we want d.o.d. to take the lead on defending the nation under cyberattack, fbi under law enforcement, and intelligence. and i think all three of us are need to work together as a joint team to move this forward. if we don't work as a team, then the nation suffers. so inside the united states, that's where i think dhs has the

lead. they don't in terms of the foreign and the things coming in, that's where you'd want us to have the lead. >> how many people are under your command? >> in cybercommand, counting our service components, a little under 13,000. >> so we now have 13,000 in cybercommand recently formed up, so now we need other agencies. why shouldn't the responsibility lay with -- lie with cybercommand? >> senator, i do think the responsibility for defending the nation against attack lies within cybercommand out. i think the lead for working with critical infrastructure and helping them defend and prepare their networks should lie with dhs. >> that's a curious logic, general. in fact, most curious. so really, all we formed up cybercommand for was to worry about external threats?

is that what you're saying? >> i -- >> so if department of homeland security should take the lead of anything that happens in the united states from outside, but you are still there with your 13,000 people? >> not quite that way. probably i'm not clear enough on this. in terms of dhs' role and responsibility it's working with critical infrastructure and other government agencies on developing the standards in the protocols of how they build their networks and to be the public interface. i think that's the role that we want them to do, and their people reach out with critical infrastructure and make sure those government systems are adequately developed. if they're attacked, no matter where that comes from, now i think the president has options of what he can do. we are one of those sets of options and if chosen, we are prepared to do that. more importantly, where those people really come in is in our

offensive capabilities. you asked that earlier. so the offensive capabilities would be to support the other combatant commands in their plans and capabilities. the bulk of our people -- >> so your job is to support other commands with their offensive capability? general, one of the conclusions of the 9/11 commission was there's too much stove piping in our intelligence community. you're describing stove piping to me at its ultimate. >> well, that's not the intent. if i could go one point further, the bulk of our forces are folks that operate and defend the d.o.d. networks. that's where we are today. the bulk of them are operating and defepnding our networks. think about what the army, navy and air force do in operating and defending the networks, that's the first mission that u.s. cybercommand was given. we are developing the second parts of that. but i would point out when you say stove pipe, senator i do not agree with that because this is

an integrated network. it is one network trying to work everything together. so it is just the option of a stove pipe. >> it's interesting that michael mcconnell, at george washington university, former director of national intelligence said current u.s. cyberdefenses are work and the bills on capitol hill are insufficient. the former director of national intelligence has a significant disagreement with your assessment. so, according to a reason article in "the washington post," the white house blocked draft legislation that would have given nsa or any government entity the authority to monitor private sector networks for computer viruss are operate active defenses to block them. the nsa supported the authority but the white house did not according to administration official blocking of the draft caused some consternation

because nsa want to get that authority. there are some who propose that nsa should be able to detect but not read the cyberattack information. do you agree or disagree with that? >> i disagree. i think the approach that we have put on the table is the appropriate one, which is we give that to industry, they can look at that and when they i think that is the first rights that. if we go too far it sends the wrong message and i think we can take this journey and learn as we go on it. >> you will leave -- general car right stated the former vice chairman, joint chiefs of staff said dod is spending 90% of its time playing defense against cybertax and 10% playing -- the department should avert the defense/offense ratio to signify the attack will have negative

consequences and your answer is -- perhaps you can be more specific how we can regain the offense here. >> i agree with his statements and would like to characterize in my words in that 90% of our force developed all of our force in cyber was on defense. we didn't have offensive capability. what we are looking at is how to grow that capability. if we look what we have in our fleet, air wings and brigades, defend capabilities. the offensive capabilities primarily live in the exploitation capabilities of an essay and others. i agree we need to develop those more and faster and we are working on that with services and that is part of our growth

plan. in terms -- said don't want to give the impression i don't believe we should defend the united states. i do but i do think we can do that in a way that works with industry without having as in the middle of the network. they share the information with us and that is the right set to take. >> it does not need additional regulations. they need the ability to share information which is our proposal rather than new government regulation implemented by the most inefficient bureaucracy i have ever encountered in my number of years. the department of homeland security wasted $887 million on a virtual fence on the arizona/mexico border that has made not a single technological advance as far as airport security is concerned to ease passengers' transit one place to

another, an incredible ability -- i thank you, mr. chairman. >> senator lieberman? >> very briefly, come to the defense of the department of homeland security. the fact is we haven't had a major terrorist attack on the u.s. since 9/11 and you have to give the leadership -- bipartisan over two administrations and thousands of people for credit for that. certainly in terms of the stove piping, the better analogy, to compare the relationship between the cia and the fbi to the relationship between cybercommand and dhs. the cia has authority outside the united states of america. the fbi has the authority --

speaking about terrorism or threats to the nation. fbi has the authority within the country. the problem before 9/11 is there were -- they were not cooperating enough. in the same way and as a cybercommand has the responsibility to protect americans. a national treasure from attack along with many other cyberattacks with many other responsibilities that you have. dhs has a domestic responsibility. preventive responsibility. that is a little different and less expensive. the interesting thing the chief testified to and senator mccain wasn't hearing it is you are building exactly the cooperative relationship, and the fbi, didn't exist before 9/11 and the fact is senator mccain and i introduced an amendment to the national defense authorization

act last december that code of fires in wall the working agreement between nsa and dhs. they who will say this for the record. i talked to admiral mcconnell and heard him speak in a public setting. he thinks both bills are not strong enough but if you ask do you prefer cybersecurity act of 2012 which senator collins and senator rockefeller and i and secure i t which my colleagues foot in he couldn't be clearer. secure i t doesn't do it because it doesn't provide for defensive preparation by the private sector. the private sector is lobbying against this. as a terrible track here. it is not just a question of regulation of business. this is a protection of our homeland.

you told us in response to senator mccain's questioned general dempsey, director miller, cyber attack is the main area of vulnerability we have today. shame on us if we look at this as business regulation. this is homeland security. we have got to get together before long and make this happen. i want to come to the particular difference between the two build. there are two critical things that need to be done. there are many important things. one is information sharing authorizations section and the others protection of the most critical cyberinfrastructure which is owned by the private sector. 90% of it financed legal and transportation, electricity, water, all of which is vulnerable to attack by an enemy. both bills have information

sharing. we introduced this provision by the department of homeland security to have worked to acquire the most critical government infrastructure. to take certain actions to defend their network, to defend our country. i believe i heard you say -- help confirm that you believe we need both of those authorities legal information sharing and a system for protecting and defending privately-owned critical infrastructure. is that right? >> that is correct. as you stated that is the hard part. how do you do that in such a way not to burden industry? we have to set up some standards. i am not sure -- we use what we call the gold standard. the gold standard was one that provided our net works the best defensible posture and we give that out free.

we put that on the nsa.gov standards. if we work with industry the issue is how to make sure they are as defensible as possible without being overburdensome. we have to set that up. roads and cars. >> exactly. this is not regulation. these are standards for what we're going to arrest them to do to defend our country and they are going to figure out how to do it. businesses worried about the bottom line. we have got to be worried about the security of the american people. incidentally, i take it from what you said earlier that the fear of a cyberattack against the united states, major cyberattack is not theoretical but real in your mind. >> that is correct. >> it literally could happen any day. i'm not predicting that it will but right now are privately

owned cyberspace infrastructure as compared and distinguished from dod's is vulnerable to attack. >> that is correct. if i could add, it is my opinion that every day probability of an attack increases as more tools and capabilities are on the network on the internet. >> very important for people to hear that. i want to relate the requirement on the most critical government infrastructure to take some defensive action to your description which was excellent about what you mean when you say you want to see an enemy cyberattack coming. you made clear you don't want nsa into our private cybersystems but you need to have the private cybersystem is be able to tell you when an enemy attack is coming. to me that is probably the most

significant gain that we will have from the department of homeland security and formed by you setting standards for defense for privately-owned cyberspace. i hear so many stories about critical infrastructure operating systems using defensive systems that our 15 years old without even basic detection capabilities. one of the most important things that is going to happen as a result of the system we are talking about is the most critical infrastructure, not every business at home but the most critical infrastructure will have to develop within itself or higher the private companies that do this, would defensive systems that will let them know when they're being attacked so they can immediately get you to spring into action to

counterattack. is that correct? >> correct. under what condition is what the administration and department is looking at on the rules of the engagement. when we actually do that those with the rules of engagement we are working on. >> is your relationship under the memorandum recodified with the department of homeland security working well as far as you are concerned? >> it is. it is growing. secretary of paul lozano is wonderful to work with. she came to cybercommand and had a chance to sit down with all of us. her heart is in the right direction. she understands not only in the cybermission but across-the-board and we are making the correct strides. when you add fbi's tremendous capable -- that is the team i think the government wants and needs in place. the reality is we can put all manage and -- manpower in turtle and it won't solve the problem.

we have to work together as a team. that is the way to approach it. to answer your question dhs is good to work with. they're growing their capabilities. will take time. we think that is a good relationship. >> that is what they told me. good relationship and they're benefiting enormously from your extraordinary expertise. >> catch a comment? >> if you make a brief. >> it is about balance responsibilities. when you look at balancing the responsibilities between the military, law-enforcement and department of homeland security, if we weren't talking about cyber we know how to do that. we understand what that balance looks like. we understand when dhs needs military support we have civil authorities. ways that we can provide support. the question is what happens

when you add cyberspace to the fixture? that is the balance we are making sure we're striking. that is an important point as we go forward. the bottom line is all of us working together to improve protection of our nation and national security. the second point i would make quickly is there are three things we have to do. one is protect ourselves better related to cyberspace. we have to be more resilient, recognizing we are not going to be perfect at protection or defense. we have to be more resilient particularly on the military side. lastly we have got to do better at offensive capability and balance that in better high-fashion as we go forward. >> senator >> -- senator inhofe. >> thank you. the first question i'm going to ask. i already know the answer but i have to ask just to get it in the record.

in yesterday's wall street journal they talked about president obama's meeting with russian president mad that of --medvedev i assume he said this without knowing the mike was on, needs to be in the record and let the record reflect this accurately, on all these issues but particularly missile defense, this can be solved but it is important for him, incoming russian president vladimir putin to give me space. my last election, i have more flexibility. do either one of you want to comment? i didn't think so. the second thing i would like to mention is i thank you for making the trip you made out and real briefly kind of tell me what you found out during your

visit. >> i am really impressed with the way the american people especially in tulsa have come to fund that university and from my perspective one of the key things, i thought about this earlier, tulsa university, information insurance area coming up with better ways to defend networks. when you think about that that is exactly what we're talking about on the resilience side. when you think of what those young people do, they find problems in net works. if we now make some slight changes those changes and upgrades to security of those networks would make a more secure. what i found was tremendous young people doing great things, some of whom we hired and we continue to hire from tulsa and the universities throughout the country that doing programs like

that. >> i thank you for going out. one of the things we do have that you probably witnessed was community support behind the program and the university. it is a great program. general taylor -- just a minute here. back during the time that we were considering the bill a year ago, we were talking about the fact that president obama is weighing options, in the nuclear arsenal unilaterally and in agreement with russia to bring it down to the 1550. it was a month ago as reported that president obama is waiting of the options of the nuclear

arsenal unilaterally. 80% proposing two plans that could limit as low as 300. i'll always remember, and nuclear-weapons, and potential adversaries, and that is about 30. rely on our nuclear umbrella. making it unnecessary to develop their own. what we come up with in terms of our hot lines with other countries if we were to voluntarily bring it down. 80%. >> i make a couple points. the first thing i would say, we don't start with numbers.

we have been starting with strategy objectives, national security objectives, etc.. the study referred to is still ongoing. there are no conclusions that have been reached yet. it is inappropriate for me to comment on the study. tom --stratcom has participated in the study and there are opportunities for additional reductions. >> unilateral reductions. >> going back to the nuclear posture in view i think the viewpoint is it is best to do this with russia. the russian and u.s. arsenals really drive this conversation and doing this with russia is certainly the preferred way forward. i think the need to continue to be turned assure allies remains. >> the point i am getting is

unilateral. that concerns me. wet me quickly cover a couple of other things. this is the triad -- about 2004-2005 showing the cliff. i am wondering if we could get this updated. first of all, during the consideration of the new start, the president said i would intend to modernize or replace the triad strategy. ville strategic nuclear delivery system, heavy bomber, icbm and nuclear power ballistic missile submarine and maintain the united states rocket motor industrial base. 2 goes on and elaborates on that. this statement was made after this chart. you have an updated chart to reflect what is happening today?

>> i take that for the record. >> something no one ever talks about that i have always been concerned and relating to the tactical nuclear weapons, on the other side of the aisle made an effort to include nuclear weapons in the time we're looking at the new s.t.a.r.t. program. it is a 10-1 led vantage of russia over ourselves. do you agree or disagree with me that that should be part of the plan? >> i agree it should be part of the plan. >> senator nelson? >> thank you to both of you for your service and kind remarks.

general kehler and general alexander. the comments today and all the discussion for some period of time has indicated a growing threat of cyberwarfare and threat to the united states national security. as we engage in this discussion there is an ongoing restructuring of stratcom's new headquarters, can you give some indication why an aging facility would not be an appropriate facility as we take on new responsibilities but particularly as it relates to a high-tech cybersituation? and general alexander, if you have some thoughts about that it would be helpful too. >> the activities that go on at stratcom are unique activities. we perform those activities

particularly their command-and-control of our strategic forces, planning we do for our strategic forces, intelligence support required behind our continuing need for strategic level deterrents and being able to command and control forces under high stress. all of those really come together at stratcom headquarters. the demand that today's systems placed on that headquarters building outpace the ability to keep up. not only do we not have vulnerability is because of the cyberconcerns we expressed earlier but physical plant will abilities. you are well aware of the catastrophic failures, and make it inoperable for month.

we barely averted that kind of catastrophe with a flood of all things and look that way forward given the nature of what we do given the 1-of-a-kind responsibilities that are performed there. continue the importance of all of that in our deterrence posture. the conclusion that the engineers reached was you could not modify the building. and go and build a new command and control facility that houses all the activities we need to perform. that remains my assessment that we need to get moving on this. it is proceeding well. i believe we are headed towards a contract award. the corps of engineers has responsibility in this award and

things are moving forward. it needs to be in the realm of the corps and others. recognition we did something unique, a brick and mortar building. and support systems and information technology, and we are prepared to continue to go as far into the future. >> when it comes to the replacement facility. and for five years, chemistry and metallurgy and radiological, is this the way in the replacement facility, and not

only meeting our responsibilities and obligations and commitments on the new s.t.a.r.t. 3d and keep our snow current. >> it is a concern for me. of all the items in the 13 budget. the portfolio of mission responsibilities, and programmatic adjustments that can be made we can manage risk. the ability of the complex to provide us the weapons we need to that have appropriately extensions provided. to 4 and -- manage the head and look at potential reductions as we go to the future in the stockpile. and the continued investment in weapons complex so the issue

does concern me. i understand the 13 budget does provide for us to get moving in a number of areas. secretary of energy and secretary of defense said the letter that reminded congress we are not ready to lay out what happens in 14 and beyond. until we are ready to lay all of that out i remain concerned. >> as in the case of the stratcom headquarters which is phased in funding over several years. and in a similar fashion. and put together the wire and the structure to get us through 13 budget wise. >> this is ultimately the due out from the department of energy, and we owe you the

alternatives. it might be a set of viable alternatives and we can present that. and aside from modernizing the complex. regardless what happens we have a backlog of weapons awaiting dismantlement. and to dismantle. and for both sides of this equation and there are modern weapons industrial complex that is highly unique. and a secure and effective deterrent? >> hard to draw an analogy. and a stop gap basis might get us through the position as to what we might do years beyond

and particularly with an aging stockpile. >> we know you some answers and the study to produce those is underway. >> thank you. senator alexander, as you relate to responsibilities with cyber, very clear there is a rule for dod and homeland security and law-enforcement agencies and continuing to find ways to work together there is a reduction of stove piping that has been so predominant in the past. are you comfortable that the agencies that are trying to work together understand the important need not to stovepipe and breakdown even with some comparable authorities going to different agencies, to continue to work together on this important threat to our country and our business which is its

own country. >> i do. >> thank you very much, senator nelson. senator brown? >> i was wondering, general kehler, do you consider the global strike command a pretty valuable -- let me restate that question. would you consider the air operations group currently supporting global strike command a valuable resource? >> we sure do. >> are they irreplaceable? and in troubled part of what you are doing if you didn't have them, we would be in trouble? >> the entire force the global strike command brings is one of our air force components. they bring us the entire bomber

force. they bring us the entire icbm force and air operations center that allows us to manage all of our activities in stratcom. what global strike brings and all that support let's are very valuable. >> that provides real world time sensitive planning support as well. i am a little concerned with the air national guard base. i was there a couple weeks ago and they have a great mission in air operations group supporting stratcom's command which provides what you indicated. the replacement of real time sensitive support and i have heard the air force wants to break up this voluble and irreplaceable units to save money. i was wondering if what you were aware of or given the opportunity to comment on the proposal affecting that group.

>> if i could take that for the record i would appreciate that. i don't know enough about the details. >> it would be helpful. i agree with you. i agree with everything you said in your opening response that it is eerie place land valuable and i know what these folks do and especially being on the eastern seaboard of the united states covering the eastern united states in some respects. the air guard in particular, and army guard and reserves give you a great value for the dollar and i am deeply concerned that we're cutting off our nose to spite our face and kind of like the air force is saying i'm going to keep my choice here and the garden reserves we're going to take away what you have and i have not been convinced that these cuts represent either an acceptable level of risk for any efficient use of the money so i would ask and i will get you the very specific questions for the record and i appreciate that. i was wondering -- i know we are

talking about cybersecurity. there are many proposals, the administration, military is working on a host of things. how are the rules of engagement actually working for being implemented or coming along with regard to the cybercommand operation? >> right now -- >> i meant that too. >> thank you. right now we are updating the rules of engagement that the chairman has put out were dated 2005. given where we are today the joint staff has taken on to update those. right now all our measures are internal to are networks what dod is authorized to do. we're looking at within the inner agency, what are the next steps we should have and how do we take those steps? over the next month or two the

joint staff will complete those rules of engagement and move those to the interagency and -- >> what role do you see or what segments of the private sector should fall into dod's responsibility if any? >> this is where the discussion comes in. >> if attacked what entities would be considered an extension of u.s. government facilities? >> those are decisions that you in the bill and the administration would make on when we actually implement actions for response options to support or defend against an attack. that is the first step. let me start with technically what we are doing. the first part of that is have the information sharing to know that an attack is going on. we discussed that previously. that is the ability for industry to tell us something is happening. either fbi if it is domestic,

for fbi and cybercommand is able to respond to the issue and what we will walk away through candidly is we have to start some place. putting out where we are on the information sharing and have industry take the lead with dhs on providing the insights of what is going on is the first rights that. the best that we could take. we need to take bets that. what we can't do is wait. where you are going on this is absolutely right. we have got to take measures now. those are absolutely important. my concern in the statements is that if somebody is attacked, the way we find out about it today is after the fact. you can't stop it then. now you're in for an vix mode. what everybody agrees is we have to get to a point where industry

can tell us what is going on so we can help prevent it. than the options come up to what industries included at those are part of the bill -- >> that is great. we don't have all the answers. we create a bill with so much red tape and overlap that you can't get out of your own way. i would ask for your recommendations and guidance as well to be part of the process and let us know where you feel the weaknesses or strength law so we can expand or the track from that and i am deeply concerned. i know you are right that we are always reacting instead of being proactive when the attack happens. we find out about it after our technology and intellectual property and military secrets and plans are stolen and it is deeply concerned.

as the technologies move with potential cyberattacks and reference to execute increasing speed. do you have enough legroom from authorization standpoint to act at the earliest possible opportunity or earliest possible opportunity to feed a cyberattack? do you have enough flexibility? >> those are the issues being considered in the rules of engagement. i won't know until we are complete with that. we are pushing for what we think we need an what would be the chairman and joint staff will do is say what makes sense? being extremely candid on this it comes down to what are those actions that we can do defensively? analogous to missiles shoot down? there are some that we are getting agreement on and have to make sense to stop that attack from going but if you are to go after a computer or some other things that might be a response

option that would not take the president and secretary to make decisions or take that on. that is where we will end up and that makes a lot of sense. >> thank you very much. this is an issue that deeply concerns me and other members of the committee. i will be submitting some questions for the record or maybe we can speak offline and have to reinvent the wheel. certain areas we need more understanding of. thank you very much. >> thank you, senator brown. senator hagan. >> thank you for your testimony and your service to our country. general alexander, the administration believes it is crucial for critical infrastructure companies to carefully diagnose their cybervulnerability and the risk posed to the american people should these vulnerabilities be exploited and take steps to eliminate these vulnerabilities.

the administration has proposed legislation to ensure that industry stands up to these responsibilities as a matter of national security. the administration is also seeking to extend the signature based defense that the nsa and cybercommand have developed for dod critical infrastructure. administration seeking to implement those approaches the implication is neither one alone is seen as efficient to meet the threat. others take the position that information sharing in conjunction with the national security agency's defensive solution would be enough. that it is not necessary to require critical infrastructure companies to build up their run defenses. do you believe nsa's signature base in the industrial base pilot program can defend our nation's critical infrastructure against a cyberthreat or do you

believe the critical infrastructure companies need to close their vulnerabilities? >> first, i think the latter. we need both. i would like to take it one step further because i don't think what we're talking about is having nsa the boy capabilities out there. what we are talking about is nsa providing technical capability to others to run. we don't want nor do we want to run stuff within -- i want to make it clear. it is not us putting stuff out there for us to operate. what we are really saying is industry has a bunch of signatures coming against them. government has some of those. nsa, dhs and fbi. we need to work together to provide the best signatures to it -- protect that critical infrastructure. industry can operate that and tell us when that occurs. i also think you need to set standards for how those systems operate to give you the best -- i will call that -- general

kehler mentioned it -- resilience. we need the resilience of the networks to ensure they, operate and be defendable what we are trying to defend the country outside. does that make sense? >> last friday, microsoft was accompanied by a u.s. marshal and office buildings in pennsylvania and illinois to disrupt a group of computers harvesting bank accounts, passwords and other personal information from millions of computers. microsoft actions show what is possible and some say is the necessary to stop cybercrimes. what are your thoughts on these actions taken recently and should they serve as a model for other private industry and is there a takeaway for the department of defense on this recent rate? >> i think it shows how we work together industry and government to show what is right about

bringing those together. what we have got to do is come up with a solution in this area too. both bills on looking at that and that information sharing is critical. >> it is often argued that terrorist groups like north korea do not yet possess the sophisticated and expensive cyber capabilities to effectively cripple our nation's critical infrastructure. for example general card right, former vice chairman of the joint chiefs has expressed doubt that this could carry out such an attack today. however we are aware of what is described as a thriving international black market possible to buy or rent cyberattack tool that large-scale supporting infrastructure such as thousands or millions of compromise computers that are deemed to be

effective against almost any network information system. this black market has developed to support the vast cyber criminal activities that have been estimated by some to now yield more revenue for the global legal narcotics trade. this criminal money than fuels research and development of modern and up-to-date cyberattack tools. could this black market erode nations -- could this black market in cyberattack tools and infrastructure now or in the future enabled terrorists or rogue nations to acquire capabilities to sir inflict significant damage on the u.s. economy and are critical infrastructure? >> that is my greatest worry and i would go beyond that group. i think the proliferation of cyberweapons of, if you will, grows. we cannot discount the actions that one smart person can do.

from my perspective when we see what our folks are capable of doing we need to look back -- we need to look at that and from my opinion that can go -- as you describe accurately and i agree with it could be non nation state actors all the way up to nation state actors like north korea. i wouldn't discount any of them. we need to be prepared for all of them. only one could do tremendous damage to this country. >> last july general card right, also speaking as vice-chairman noted the challenges of recapitalizing all three legs of the triad with constrained resources. general kehler, you raise the similar point that we are not going to be able to go forward with weapons systems that cost what weapons systems are currently costing today. in the search for a solution to these challenges options seemed

to take the form of delaying the current programs reducing the size of the planned programs. what are your thoughts on the pluses and minuses of these options? >> i support the need for a balanced triad of strategic deterrent forces. it has served us well. it continues to serve us well. as we look to the future there are attributes that are spread across the triad that make sense for our national security. having said that i am concerned about the costs so i think there are a couple things to keep in mind. we need to phase these programs appropriately. we need to make sure we have match the investment with the needs and control costs. there are a number of programmatic steps to take as we go forward. when we look at the ohio replacement program i know we are making decisions today that will be with us for decades to

come. the ohio replacement program as far as we can see into the future we believe we see the strategic need for and strategic value of the submarine base part of our deterrent. moving forward with that even though we had to delay the program some is going to be important. is also 4 with our allies the bricks. is important we have a dual capable long-range bomber. it needs to be nuclear capable but won't just be used for nuclear purposes and if we the deterrence right it will never be used for that purpose. will likely be used to employ conventional weapons which is what b-52s and be 2s and be 1s have done. that is underway. controlling costs is going to be the big issue in both of those programs. the next question becomes the future icbm and we have begun an analysis to determine what shape or form that might take. as we go to the future we will

get to number of decision points on all of these systems that will allow the future environment to shape what the ultimate force outcome becomes. >> my time is up. thank you. >> senator ayotte. >> thank you, general alexander and general kehler for being here and for your service. general kehler, the senate support for the new s.t.a.r.t. treaty was tied to modernization of the united states nuclear complex and strategic delivery system. specifically during the senate confirmation the president committed to modernization in what became known as the 1251 plan that was incorporated in the 2010 nba a. is that right? >> yes. >> if you will look at that commitment in the 1251 plan,

there was an initial plan submitted in may of 2010 and a month before the ratification of the senate treaty there was $4.1 billion added over five years to the plan. isn't that right? >> yes. talking about the dod? >> yes. specifically reflect a month before the ratification of the s.t.a.r.t. treaty put into the 1251 plan to incorporate the 2010 nbaa. >> that was before my time but i think that is right. >> that was done because modernization was such an important issue to getting that treaty through the united states senate. and because modernization is very important for our nuclear program. is that correct? >> yes it is. >> the 2013 budget request

underfunds the commitment made that was expressly made in conjunction with the ratification of the s.t.a.r.t. treaty by $4 billion over the next five years. isn't that the case? >> it is lower than the level of the 1251 report. >> it is $4 billion lower? >> i think that is right. >> which the president a month before ratification to get the senate to sign on to the reductions in the s.t.a.r.t. treaty added $4 billion because we were so worried. i wasn't here but many of my colleagues were so worried about modernization of the program as we going to make the reductions required by the s.t.a.r.t. treaty and the president is not following through, why didn't we include the $4 billion in the

commitment on modernization and in particular just to break that down, you, senator nelson asked you about the chemical and metallurgy research replacement facility. that is an 83% cut in that facility. we are not following through at all in our commitment to that facility, are we? >> the commitment has been delayed if i understand the budget correctly. the building has been slipped to the right five to seven years. >> would that not be a broken promise from what was required by the 2010 nbaa and what came within the 1251 plant? >> it is certainly different than the 1251 plan clearly. >> if my colleagues signed on to the s.t.a.r.t. treaty concerned about modernization with a commitment from the administration of a certain level of resources for tacoma the in this facility that we

talked about, it is critical to modernization? >> it certainly is. >> no doubt that we needed to modernize. >> in the long run there is no doubt we need it. >> okay. so when you were questioned by senator nelson you said you owe us questions and answers to this. that is true? >> yes. >> what we need is a commitment from the administration to follow through on what they promised in conjunction with the ratification of the s.t.a.r.t. treaty. without modernization of our nuclear deterrent, what are the concerns you have if we don't modernize? >> a lot of concerns if we don't modernize. you have to look at this in terms of there are four pieces to this from my vantage point. peace number 1 is the delivery

systems and i just mentioned there are modernization plans in place for the delivery systems or there's a study underway to take a look at the icbm wagon and what we might need as we look at the future. there's command and control and commitment to both of those. the real issue for me is the weapons and the weapons complex that supports in an era that we are in today without nuclear explosive package testing where we don't do any yield testing. that puts a strain in a way that i believe hasn't been strained in the past. it strains the science and engineering skills that we have to make sure as we do life extensions that we have the appropriate science basis in being able to do those extensions without nuclear testing. we have issues with aging. most of the problems with the weapons we have today is they are reaching the end of their

lifetimes in various stages. being able to have life extension for those weapons is very important. at an end of the day if you have a more modern complex we think we can have a smaller stockpile. the way we would hedge against failure would be different as we go to the future. >> if we just reduce our stockpile and don't modernize are we taking on additional risk? >> there are some areas where that can be additional. >> i would like to know why as reflected in the dod searching budget the administration has not followed through on its commitment to other -- authorization. that was critical and i understand it towards many individuals around here that are concerned about that in the debate over the s.t.a.r.t. treaty so it is an important issue and if it was incorporated and tied to the s.t.a.r.t. treaty. i would hope you would take that for the record and get back to

was. >> fully understand the concern, recognizing nothing was in new and when we went through the budget reduction to include the nuclear force. i believe we balanced the investments in much of the portfolio. doesn't look like a 1251 report but we balance much of it. what concerns me most is the industrial complex. >> thank you. i also wanted to follow-up with a question about russia which is as i understand it, historically, general kehler, why do the russians not want us to improve our missile defense system in europe and expand it? they have been very concerned about that. why is that? >> i could give you my understanding of where i think they are. they are very concerned, at least in the informal context i

had with some russian officials they continue to save that they are concerned that our deployment of a missile defense system will tip the strategic balance in our favor. that it will render their offensive capabilities irrelevant. our contention is that is not at all true. that has been the conversation. >> my time is up. when the president said that essentially he had to give the human space to the russians the other day, what he was really talking about is there concern about us expanding or enhancing our missile defense system in europe and i am very -- even on the continental u.s. it could be interpreted that way because the russians don't want us to do that. i am concerned about that statement that senator inhofe asked you about in the context

of what it means in terms of what we would be conceding to the russians going forward and protecting the united states of america and our allies. thank you for appearing today. appreciate it. >> senator blumenthal. >> thank you for your extraordinary service to our nation in each of your commands and responsibilities and to the men and women who served under you. general kehler, if i could begin just briefly following up on a remark about the ohio class submarine which you said is going to be of strategic vital importance. as far as we can see into the future, i am paraphrasing you. i agree completely. i wonder if you could speak to

the significance of the ohio class submarine replacement in terms of what its value is. adding value to our strategic force and why is it so important to continue building and without further delay action stress? >> each of the elements of our nuclear deterrent force brings something unique to the mixture and the strength of the overall deterrent has always been in the some of its parts. as we look at this today and as we go to the future, the inherent survivability of the submarine based deterrent has been of great value. it continues to be of great value as we go forward. at many levels, strategic stability is built on survivability. the understanding that neither side possesses an overwhelming

advantage to strike first. that even in the event of that kind of highly unlikely -- and the world is different -- we understand that. but stability, particularly in an unforeseen crisis as we look to the future, something would arise that would put us in crisis with any of the nuclear contenders, having a survivable element of our strategic deterrent is extraordinarily valuable and we believe that remains valuable as we look to the future. you can get survivability in a lot of ways. the airborne aircraft reaser viable platform and if it stands off or can penetrate or has still a lot of attributes get the survival and we have looked at our submarine forces providing the bulk of our deterrent in particular the day to day survivable deterrent. submarines that are at sea are inherently survivable. the issue will be with ohio replacements making sure it

stays that way and making sure we can deploy a platform that has those attributes perhaps lower in cost to operate what is fielded and we can guarantee as we look to the future that it can stay a step ahead of any developing technologies that might threaten. >> so you wouldn't say the commitment of our military or defense partners or strategic planners is not diluted when it comes to that. >> within the modernization efforts we are undertaking in our strategic deterrent, this one and the long-range strike bomber are at the top of my list. we don't talk much about the need, the need for replacement painter is equally important to strategic command and that is under way with the air force. >> thank you. general