a dhs has a senior executive you now, the dhs cordinator's a sole role is to work the efforts. you are the new strategy has new and strengthened the local communities and the premise that well informed and equipped will families and communities and represent the best defense against violent extremism. a against violent extremism. dhs will work with colleagues and partners and within the state department to identify potential threats to security both at home and abroad. chairman mccaul, and ranking member thompson and distinguished members of the committee, thank you for the opportunity to appear before you. >> the chair recognizes assistant director michael steinbach. >> good morning chairman mccaul, ranking member thompson, and members of the committee, thank you for the opportunity to appear before you and discuss the recent terrorist influence that go across boundaries like never before. it is aiding in the rhetoric and encouraging attacks on the homeland and abroad. as the threat to harm evolves we must adapt to confront the challenge and this includes working with state an

dhs has a senior executive now, the dhs cordinator's sole role is to work the efforts. the new strategy has strengthened the local communities and the premise that well informed and equipped families and communities represent the best defense against violent extremism. dhs will work with colleagues and partners and within the state department to identify potential threats to security both at home and abroad. chairman mccaul and ranking member thompson and distinguished members of the committee, thank you for the opportunity to appear before you. >> the chair recognizes assistant director michael steinbach. >> good morning chairman mccaul ranking member thompson and members of the committee, thank you for the opportunity to appear before you and discuss the recent terrorist influence that go across boundaries like never before. it is aiding in the rhetoric and encouraging attacks on the homeland and abroad. as the threat to harm evolves we must adapt to confront the challenge and this includes working with state and local partners. we continue to identify individuals who

predated dhs. when the bush and ministration came in and he put his former chief of staff when he was governor of texas and is fema director that began an immediate process of downgrading that agency and that position. and that brings me to something that was mentioned earlier which i believe you i believe you said personalities matter. i think that is something that is often overlooked. especially in social science organizations matter command vigils don't. i think that's a terrible mistake an incredibly shortsighted and really not very sophisticated and unrealistic. personalities absolutely matter. i think they i think they certainly did in the case of the people that were put in to direct fema. your.is well taken about the secret service. we can see some that our current today. the problem the secret service has which predates dhs as well. >> if i could add really quickly i think the argument is in many ways the early structure was lean and mean and flexible. by replacing it with this 22 agency

so it's particularly disappointing to see that dhs dhs foia program, and the gao's duplication report. even the gao has come in and said, this is a terribly mismanaged, ill executed system. so much so that there's highlights in the the gao's 2015 duplication report. my disappointment grew yesterday when the foia research center revealed to us that dhs hired contractors for the primary purposes of closing rather than completing cases. individuals requesting records from homeland security might hear from contractors multiple times inquiring about whether or not they're still interested in their requests. that always cracks me up, right? citizen, person from the media goes out of their way to put in a foia request so much time goes by that government comes back to them and says are you still interested? that takes time and resources. the state department is as bad if not worse than dhs on foia compliance. the agency has opened cases dating back for decades decades. last year the state department failed to fully respond to more than 65% of its requests. the center for efficiency governmen

dhs received 40,000 requests in fiscal year 2014. in this 12-month period alone, we received an unprecedented, 291,242 requests. as a result, we also have the largest backlog. since january 2009 dhs experienced a 182% increase in its number of foia requests. at the same time our foia professionals have significantly increased their output to meet this increased demand. in fiscal year 2014 these professionals processed 238,031 requests. the department of homeland security takes our obligation to promote transparency and further the values of open government embodied in the statute very seriously. nonetheless, we face serious challenges to connecting requesters with the records they seek. i'd like to briefly highlight some of the measures we've implemented to address these challenges, including to reduce our backlog. the government accountability office was asked by congress to review the processing of foia requests. in november 2014, the report was published with four recommendations. we conquered with all four and are taking steps to

the state department is as bad if not worse than dhs on foia compliance. the agency has opened cases dating back for decades, decades. last year the state department failed to fully respond to more than 65% of its requests. the center for efficiency government graded 15 of the top foia agencies and gave the state department an f on foia processing. the agencies before the committee today need to bring sunshine to their foia programs. the agency leadership has failed to make it a priority. and that makes the job of the witnesses before the committee much more difficult if not impossible. we know you have a tremendous amount of requests coming your direction. there are a lot of good people who work in your departments and agencies and we thank them for , their service. not everything is bad. but it is our role and responsibility to understand how it really works, what you're up against, what you're dealing with in a very candid way. so that we can help make it better. and that we can understand it. and there undoubtedly have to be changes. my guess is you wa

>> u.s., the computer emergency readiness team dhs. spent you did it to dhs.did you report to congress to? >> we reported to the fbi and we made our business required notification to congress as well. >> that was april 15. what about the first one? >> for the first breach, again dhs notified us of that activity in our network and so they already knew about that one. and yes we made notifications to congress about one as well. >> when? >> i'm sorry i don't have that date in my notes. i would be happy to get you -- >> could you please get back to the committee for us? did you notify the contractors of the breach? >> at the first breach there was not an awareness of of what the adversaries were targeting and that this may go beyond opm. i know that our staffs at my staff my security staff had conversations with the security staffs at the contractor organizations. i also know that the indicators of compromise that dhs had were provided to other government organizations, were put into einstein as well as the communications that they would normally -- >> but the bre

so it's particularly disappointing to see that dhs dhs foia program, and the gao's duplication report. even the gao has come in and said, this is a terribly mismanaged, ill executed system. so much so that there's highlights in the the gao's 2015 duplication report. my disappointment grew yesterday when the foia research center revealed to us that dhs hired contractors for the primary purposes of closing rather than completing cases. individuals requesting records from homeland security might hear from contractors multiple times inquiring about whether or not they're still interested in their requests. that always cracks me up, right? citizen, person from the media goes out of their way to put in a foia request so much time goes by that government comes back to them and says are you still interested? that takes time and resources. the state department is as bad if not worse than dhs on foia compliance. the agency has opened cases dating back for decades decades. last year the state department failed to fully respond to more than 65% of its requests. the center for efficiency governmen

-- >> was dhs one of your contractors?no, sir. >> i didn't think so. that doesn't really help me understand the regulation because this says contractor, not dhs. why didn't you notify the contractor? >> we were still investigating what happened in our network. >> what does the word immediately mean to you? >> without undo -- >> did you do so? >> no, we did not. >> does it say as soon as you figure out what happened or after you talk to dhs? that is not in my version of the regulation. is it in yours? >> i have not read that regulation. >> that one doesn't exist. the one that says notify dhs or try to figure it out. the only one that exists says to notify the contractor. you didn't do it and my question is why? >> i can't answer that question. >> who can? >> i will take that back and get you -- >> to whom will you take it? >> i believe i would take it back to my staff to see if we have processes in place. >> do you think it's staff's responsibility to notify the contractor? >> we have processes in place for making notificat

in april dhs's u.s. computer emergency readiness team informed doi about a potential malicious activity which was later determined to be a sophisticated intrusion on doi's network. doi immediately began working with u.s. sert the fbi and other federal agencies to initiate an investigation and determine what information may have been compromised. doi allowed dhs and the other investigating agencies immediate access to the doi computer systems and doi dedicated support -- people to support the investigation. although there is evidence that the adversary had access to the doi data center's overall environment, today the investigation has not discovered evidence that any data other than opm data was exfiltrated. however, the investigation remains ongoing. concurrent with the investigation doi immediately initiated a major planning effort to address short medium and long-term remediation to strengthen our cyber security protections. we undertook those efforts in the context of other cyber security improvement

-- >> was dhs one of your contractors?>> no, sir. >> i didn't think so. that doesn't really help me understand the regulation because this says contractor not dhs. why didn't you notify the contractor? >> we were still investigating what happened in our network. >> what does the word immediately mean to you? >> without undo -- >> did you do so? >> no, we did not. >> does it say as soon as you figure out what happen after you talk to dhs? that is not in my version of the regulation. is it in yours? >> i have not read that regulation. >> that one doesn't exist. the one that says notify dhs or try to figure it out. the only one that exists says to immediately notify the contractor. you didn't do it and my question is why? >> i can't answer that question. >> who can? >> i will take that back and get you -- >> to whom will you take it? >> i believe i would take it back to my staff to see if we have processes in place. >> do you think it's staff's responsibility to notify the contractor? >> we have processes in place for making

dhs now has a senior executive the dhs coordinator whose sole role is to coordinator and improve theartment's see the efforts. the new dhs cve strategy recognizes the strength of local communities and the well-informed and well-equipped families to community and personnel represent the best defense against violent extremism. dhs will continue to work with our international counterparts and our colleagues within the fbi, state department, and across to identify threats to our security both at home and abroad. chairman mccaul, running backing member thompson and distinguished members of the committee, thank you for the opportunity to appear before you today, and i look forward to your questions. >> thank you secretary taylor. the chair now recognizes steinbach. >> good morning chairman m mccaul members of the committee, thank you for the opportunity to appear before you today to discuss the recent terrorist influence which transskends boundaries like never before. terrorist's use of technology has aided in the desemination of rhetoric in the homeland and aboard. as it evolves we must c

the deadlines are when dhs will provide the capability and will takes additional months to agencies to deploy einstein and cdm once available. agencies must supplement with additional tools appropriate to their needs. i'd like to conclude by noting that federal agencies are a rich target and will continue to experience frequent attempted intrusions. this problem is not unique to the government. as our detection methods continue to improve we will detect more incidents. incidents that are already occurring and we didn't know it yet. the recent breach is emblematic of this trend. we are facing a major challenge in protecting our most sensitive information against economist kated, well resourced and persistent adversaries. further, the entire nation is now making up for 20 years of underinvestment in our nation's cyber security in both the public and private sectors. in response, we in the government are accelerating the deployment of the tools we have and are bringing cutting edge capabilities online. we are asking our partner agencies and congress to take action and work with us to stre

what is the dhs doing to keep pace with its attackers. dr. ozment? >> einstein is necessary. we need a defense in-depth strategy. we're sup meant l einstein at the agencies and we're looking at einstein with taking what is currently a signature focused system and adding capabilityies to let us detect previously unknown intrusions. as you do that you receive more false positives, more indications that an intrusion occurred even if it did not occur. we have to do that carefully. >> and it seems to be that you're more excited or more confident in the einstein 3 a version is that going to be more solid? >> it will be a significant step forward. it uses classify information. it is still a signature based program but will rely upon classified information obtained from the intelligence community to help us block them from -- >> >> i heard you say something earlier about even that system needs to be supplemented with others is that correct?? >> that is correct. no single system here will solve this problem. >> >> and this lies my problem. because even on the dhs's own website when ta

-- >> was dhs one of your contractors?no, sir. >> i didn't think so. that doesn't really help me understand the regulation because this says contractor, not dhs. why didn't you notify the contractor? >> we were still investigating what happened in our network. >> what does the word immediately mean to you? >> without undo -- >> did you do so? >> no, we did not. >> does it say as soon as you figure out what happened or after you talk to dhs? that is not in my version of the regulation. is it in yours? >> i have not read that regulation. >> that one doesn't exist. the one that says notify dhs or try to figure it out. the only one that exists says to notify the contractor. you didn't do it and my question is why? >> i can't answer that question. >> who can? >> i will take that back and get you -- >> to whom will you take it? >> i believe i would take it back to my staff to see if we have processes in place. >> do you think it's staff's responsibility to notify the contractor? >> we have processes in place for making notificat

however, according to an official at the dhs office of policy, tsa and dhs have yet to formalize their request to be watchlist interagency policy committee in order to receive additional categories. additionally, we found an issue with the manner in which airport workers are checked for criminal histories. the airports themselves maintain the ultimate authority to review and determine whether an individual costs criminal history contains this qualifying crimes under federal law. however, tsa did not have adequate monitoring processes in place to ensure that airport operators properly entered a gated these histories. tsa officials informed us that airport officials rarely or almost never, documented the results of their criminal history reviews electronically. without sufficient documentation, tsa cannot systematically determine whether individuals with access to secure areas of the airport are free of disqualifying criminal convictions. moreover, under current law and fbi policy, tsa and the airports are not legally authorized to conduct recurrent vetting of criminal histories. we also

within dhs. i cannot speak to how it is working on current acquisition projects, but it is something that frankly remains a challenge. ait machines, that is a single vendor. there is no competition within the market for what is a very significant capital purchase. senator langford: we have had a lot of conversations about pre-check and about how pre-check, you have had a million people who have gone through that process, but we have 7 million people that are authorized to go through other variations. do we need to change the name from pre-check to something else? we have a large number of people that are just being expedited through this process. is that correct? mr. roth: go ahead. >> yes, that is correct. these are not individuals who were previously identified as low risk. tsa's premise is that they are providing real-time threat assessment through the use of behavior detection officers and explosives detection. we have raised concerns about the lack of effectiveness data. during the time of o

process within dhs. i cannot speak to how it is working on current acquisition projects, but it is something that frankly remains a challenge. i will say for example the ait machines, that is a single vendor. there is no real competition within the market for what is a very significant capital purchase. senator langford: we have had a lot of conversations about pre-check and about how pre-check, you have had a million people who have gone through that process, but we have 7 million people that are now authorized to go through it at some point through other variations. do we need to change the name from pre-check to something else? we have a large number of people that are just being expedited through this process. and i getting that correct? mr. roth: go ahead. >> yes, that is correct. and particularly for people who are selected at the airport. these are not individuals who were previously identified as low risk. tsa's premise is that they are providing real-time threat assessment through the use of beh

my organization within dhs is part of the national cybersecurity center. we focus on analyzing the risks, sharing information about responding to significant cyber incidents. we work with trusted partners around the world and focus on threats facing the government in critical sector networks. our role is largely voluntary. we build and rely upon trusted relationship to share information and respond to incidents. when an entity believes they've been a victim of a significant cyber incident, they invite us to help them assess the scope of my intrusion as well as provide recommendations op how they can mitigate the incident and improve their security posture. our current involvement with opm began in march of 2014 when they learned there was a potential compromise within the opm networks. from march to may, uwe part of of the team that remeet yated the intrusion. throughout that time we shared information that we had learned about the intrusion with our governmental partners as well as private sector partners so they could better protect themselves. we on may

my organization within dhs is part of the national cybersecurity center. we focus on analyzing the risks, sharing information about responding to significant cyber incidents. we work with trusted partners around the world and focus on threats facing the government in critical sector networks. our role is largely voluntary. we build and rely upon trusted relationship to share information and respond to incidents. when an entity believes they've been a victim of a significant cyber incident, they invite us to help them assess the scope of my intrusion as well as provide recommendations op how they can mitigate the incident and improve their security posture. our current involvement with opm began in march of 2014 when they learned there was a potential compromise within the opm networks. from march to may, we part of of the team that remediated the intrusion. throughout that time we shared information that we had learned about the intrusion with our governmental partners as well as private sector partners so they could better protect themselves. on may 28, 2

dhs provides a baseline of security and helps better manage their risk.e protect agencies by providing a common set of capabilities through the einstein and continuous diagnosis program. we measure and motivate agencies to implement best practices. we service a hub for information sharing. i will focus on the first area how dhs revives a baseline of security through einstein and cdm. i've describe the other three areas and him happy to take questions. the einstein system protects agencies at the perimeter. a facility, it is similar to a camera the entrance to the facility that records traffic coming and going and identifies anomalies. einstein 2 heads -- adds the ability to alert security when a prohibited vehicle is identified. einstein 2 does not stop cars that sets off an alarm. they are fully deployed and screen federal civilian traffic. all traffic goes through trusted internet connections. the latest phase of the program is akin to a guard post. einstein three uses classified information to compare them with a watchlist. it actively blocks prohibite

the ngo now has five schools in cambodia, dh are run mostly on donations, with tuition provided for free. >> all the children in this elementary school class have profound or total visual impairment. >> phalla always wanted to become a teacher, since she was a very young girl. during the days of pol pot's dictatorship, schools were used as jails. teachers, doctors, and other educated people were sent to labor camps. and towns people were forced to move to rural areas. at the time, phalla was a high school student. >> as a result of pol pot's bloody rule, as many as 1.7 million people are believed to have perished. >> when she was 18, phalla was fortunate move to escape cambodia to a refugee camp in thailand. at the camp she took a teacher training course run by the united nations. she began teaching the visually impaired children that she met there. ♪ >> in 1991, she returned to cambodia. the country had been stripped of everything, including its traditions, and educational systems. phalla set about building a school for disabled children. ♪ >> the school also houses around 60 boarders,

when i was at dhs, i was a proponent of diagnostics and mitigation programs. it is dismaying to see how long it took, two plus years just to intimate phase one. that does not include the additional competitive process for agency to obtain get abilities. sophisticated adversaries will exploit any and all one abilities. the government is even more honorable what it takes months not years to deploy new security capabilities. my recommendations to address these causes -- first, effectively implement the federal reform act. this law is meant to address the systemic problem in managing i.t. effectively and the main intent of the law is to power the cio to address these issues. so far, i am pleased with tony scott and the role of the rollout. congress can support these efforts by demanding aggressive implementation development of measures for assessing the impact, and transparency in reporting ongoing process. effective and limitation is the government's best hope. second, dry adoption of best practices. there have been positive movements with the updated law and the

what is dhs doing to keep pace with the hackers the? >> einstein is necessary but not sufficient to for protecting networks. as mr. scott notably need them in debt strategy. we are also looking with einstein at taking what is currently a signature focused system and adding capabilities to let detect previously unknown intrusion. but as you got you also receive more false positives are in other words, you receive more indications that an intrusion occurred even if it did not occur so we had to do that carefully so we are not overwhelmed by a essentially bad data. >> it seems to be that you're more excited or more confident in the einstein, what is it three a version come is that going to be more solid? >> einstein 38 with a significant step forward using classic information and is modeled on an similar department of defense program. it is still a signature-based program that will rely on classified information from intelligencetheintelligence committee to help us detect adversaries and block them. >> i even heard you earlier say somethin

. >> it used to be every position in city government 90 in addition to getting the dhs dhs that was changed and the change now to allow annex approval as long as as long as you have the salaries to cover and that's why it is important to have sufficient money in our budget if you don't you'll not been able to fill the budgeted positions. >> thank you, mr. chair one other comment the gentleman when we came before i last year, he knew the rules the rules were that the mayor's office was going to hold up he couldn't fill those positions in an expressed basis he know that at this point yet he told you he didn't absorb the attrition savings we proved were significantly more but ended up with a $400,000 surplus today, we agree he can higher those position without the mayor holding up the position we're making a similar recommendations based on the new rules we acknowledge. >> so based on the new rules we'll not have a delay i think mr. rose made my case. >> i said we considered the new rules and came up with a significant similarly savings and maybe there if i'm still alive we've come back to the

i mean we would do a dhs, to call out dhs specifically, we would do inventories and find owl of the systems that we had. i think we did a relatively good job at that. but it would not be -- every year we would find more. try to secure that. and i say that's the first thing, is that most agencies i believe have that problem. when i talk to -- and i don't want to put a percentage of it because i don't know thou measure that as far as a percentage. most o the major agencies have this problem that the cio does not -- would not be able to sit here and say they have a good handle on their true inventory of i.t. systems. >> what about use of credentials? >> i give all of the world credit to d.o.d. for having rolled out that card use ago and having the leadership and the wherewithal to make that happen. most government agents are struggling to rolled out the piv card, the smart card and use it for laj call network access control. it's still on issue. if you go to the goals and look at where we're at it's still an issue at most of the agencies on the civilian side. >> authorizations? networks? >> i

the 2014 survey resulted in dhs receiving the lowest ratings any of federal government agency and tsa receiving low marks. the survey showed the frontline employees feel strongly the work they do is important they are not valued. a culture of fear and distress has been created in the agency also impacting the morale and performance of the employees. this is documented in the security talk. the tsa pre-check program is a concern as well. tsa has expanded pre-check to large amounts of passengers who have not paid or enrolled in. i expressed concern to the leadership of the expansion of pre-check and later reported the concerns to the office of special council for investigations. my allegations were confirmed by the dhs inspector general in a report called security enhancement leading to the pre-check initiative. they are handing out pre-check status like halloween candy in an effort to get the passengers through as quickly as possible despite the security gaps. the pre-check enrollment program didn't meet the expectation in terms of volume oh the pre-check rules are expanding. insider t

it says contractor and not dhs. why didn't you notify the contractor. >> and that time we were trying to understand what happened to our network. >> what does the word immediately mean to you. >> without due. >> does it mean after you understand what happened or talk to dhs. that is not in my version of the regulation, is it in yours. >> i have not read that version of the regulation. >> you know why you haven't. because that one doesn't exist. the one that says notify dhs or try to figure it out. and the only one exists is notify the contractor and you didn't do it and my question is why. >> i can't answer that question. >> who can? >> i will take that back and get you -- >> to whom will you take it? >> i believe -- i would take it back to my staff to see if we have processes in place. >> do you think it is staff's responsibility to notify the contractor? >> we have processes in place for making notifications when we find these -- >> who is ultimately responsible for that process? who failed to meet the contractual

there are, indeed, red teams at dhs, and you are not going to a non-classified setting clarifying thenature of the investigation leaked but i think you clearly said your employees are mostly auditors. >> that's correct. >> last week's report was just one. can you tell us a little bit more about the number both classified and unclassified of tsa, dhs ig reports that you have issued since 2004? >> i can't give you an exact number. a dozen is my best estimate of what we have done since 2004. we did a series 6 penetration testings in 2011, both penetration testing to determine the security of the so-called sterile area, just being able to move into the sterile area without any sort of examination covert testing, for example, carry on carry on luggage through the screening process and we did penetration testing of the ait machines, the first generation ait machine which is different than the ones we have done most recently as well as penetration testing of the checked baggage. >> are all of your investigations ultimately briefed to the leadership of dhs? >> yes. >> and you said tsa disagre

>> absolutely, it's a shared responsibility between dhs and the fbi, nctc and justice department.vernment and local government effort, not just the federal government. it has to be a whole community effort. >> i want to talk all three can answer this question the jtts has been the backbone of our anti-terrorism efforts and done a terrific job. it seems to me lately they are under more and more stress with the additional things they have to look into on a regular basis. and it seems that there may be more of a reliance on getting state and local law enforcement involved with the jttf's. is it a concern going forward, are there staffing concerns going forward and is there a concern that there's not enough federal agents involved going forward? >> i would be happy to answer that question. >> it's fbi, you're going to say yes, right? >> i will say as the head of the counter terrorism division of the fbi, the media reports last week were completely wrong. the jttf is fully staffed and relies on a robust partnership. those resources are there. they have not waned and we are certainly no

the ig and independent review of dhs's vetting process deemed the tsa vetting process to be effective. tsa made key enhancements through projects that began in 2012 including the ability for airport to upload immigration and identity documents to conduct more robust checks and implement implementing system logic to reject inaccurate information. airport operators are responsible for reviewing fbi criminal history records and ultimately making a determination about granting badges to workers that provide secure access to our nation's airport according to tsa's requirements. an airport operator may not issue a badge if tsa deems the individual to be ineligible. airports make risk-based decisions using tsa provided information and locally derived information for the final batting decision. tsa recognizes the value of conducting more frequency or reoccurring criminal checks on workers to identify cases of criminal activity. the u.s. of criminal record checks is considered by the fbi to be for non-criminal justice purchases according to pre-9/11 law. in september of 2014, the fbi implement

and we continue to work with dhs and our agency partners to test those systems and make sure that they are working appropriately. >> mr. esser, the office of inspector general conducted an audit in 2014, the chairman was talking about this, of opm's security information and programs and found several weaknesses. can you briefly identify the weaknesses that you found? >> yes, sir. the most critical weaknesses that we identified in our report from 2014 were the continued information security governance problems that have existed since 2007, the decentralization of the controls over systems. that, however, is an area that is certainly close to being improved to a full extent. another area of weakness were the security area and authorize, which is, each system that opm owns, should go under an assessment every three years and be authorized for usage. we identified 11 systems at the end of 2014 that had not been authorized, that were due to be authorized. the technical security controls was another big area that we identified. while opm has implemented a number of strong tools and is improv

the majority of foia backlogs exist at dhs so this is something i hope you will look at and i hope it will be something to assist you and help you and help us to eliminate the backlog as best we can. >> thank you. >> thank you mr. chairman and i yield back. >> thank you. i'll recognize the gentleman from the virgin islands for five minutes. >> thank you very much, mr. chairman. good morning witnesses, good morning to you-all and thank you for the information you're providing to us. one of the things the that i really wanted us to focus on is pie my colleagues here discussed there is a problem and everyone is aware there is problem, i don't think you sitting here are the problems. i think that the there are processes and directives and issues that have happened within your agencies that create these backlogs we're talking about and i would like to try and get to the root of what the what is the reason for this. we've talked about in some instances, ms. pustaayy, you have more requests and you highlighted in your testimony that the federal government receives 714,231 now foia requests i

with our dhs colleagues we have created and deliver a resilience exercise program a table top exercise that brings together law enforcement and community leaders to run through a hypethetical scenario and potential responses. in summary we need multi level partnership efforts to enable local u.s. communities to deal with the dual capabilities of addressing radicalization and insuring responses when an individual moves from radical ideas to radical violence. we need to communicate the knowledge so it could be used to minimize the application of terrorist online tactics against our citizens. i will stop there mr. chairman. thank you for the opportunity to address the community. >> chair new recognizes secretary taylor to testify. >> chairman mccaul representative thompson and members of the committee thank you for the opportunity to appear with my colleagues to discuss the home-grown violent extremist threat. the terrorist threat is decentralized and complex and not constrained to one group race ethnicity, origin religion or geographic location. isis and others have expanded their recrui

prior to serving as dhs' inspector general, mr.ted career as a federal prosecutor with the department of justice. inspector general roth? >> chairman johnson, ranking member carper, and members of the committee, thank you for inviting me here to testify today to discuss our work examining tsa's programs and operations. before discussing tsa's challenges, i'd like to acknowledge the tsa whistle-blowers i join on this panel today. we are grateful when tsa employees, as well as employees from other parts of the department of homeland security, are willing to step forward to identify problems within the agency. whistle-blower disclosures have saved lives as well as taxpayer dollars, and whistle-blowers play a crucial role in keeping our department efficient and accountable. we review over 16,000 complaints per year, more than 300 per week, to better understand and respond to potential waste, fraud, and abuse in the department's programs and operations. with regard to tsa, we face a classic asymmetric threat in attempting to secure our

i would focus on hue dhs provides a baseline of security through einstein and cdm.described the other three areas in my written statement and am happy to take your questions. our first line of defense is the einstein system which protects agencies at the perimeter. a useful analogy is that of a fizz physical government facility. einstein one is similar to a camera at the entrance of the facility that records the traffic coming and going and identifies anomalies in the number of cars. einstein two, adds the ability to detect suspicious cars and to alert security cars when the prohibited vehicle is identified. einstein two does not stop cars but it does set off an alarm. einstein one and two are fully deployed in screening of all federal civilian traffic, all of the traffic that goes through trusted internet connections. einstein 3-a is akin to a guard post at the highway for multiple government facilities. it uses classified information to look at the cars and compare them with the classified watch list. it then actively blocks prohibited cars from entering the facil

opm immediately contacted dhs and the fbi and together we initiated an investigation to determine thepe and the impact of the intrusion. in early may, the inner agency incident response team shared with relevant agencies that the exposure of personnel records had occurred. in early june opm informed congress and the public that notification actions would be sent to affected individuals beginning on june 8th through june 19th. we are continuing to learn more about the systems that contributed to individuals' data potentially being compromised. for example, we have now confirmed being compromised. we have confirmed that any federal employee across all branches of government who submitted service records to opm may have been compromised even if their full personnel file is not stored in the opm system. these individuals were included in the previously identified population of approximately 4 million concern the and former federal employees and have been included in the notification. early in may the team concluded that additional systems were likely compromised. this separate incident wh

can you tell us a little bit more about the number, both classified and unclassified of tsa, dhs, ig reports that you've issued since 2004? >> i can't give you an exact number. a dozen is my best estimate of what we have done since 2004. we did a series of penetration testing in 2011, both penetration testing to determine the security of the so-called sterile area being able to just move into the sterile area without any sort of examination. covert testing, for example, carry on luggage through the screening process. we had done penetration testing of the ait machine, sort of the first generation ait machine which is different than the ones we've done most recently. as well as penetration testing of the checked baggage process. and that report was earlier this year. >> are all of your investigations ultimately briefed to the leadership of dhs? >> yes. >> you said in testimony last month that tsa days agreed with most of your recommendations to a classified report on precheck, and you concluded and i quote "we believe this represents tsa's failure to understand the gravity of the situ

those are tests administered by undercover agent in a dhs inspector general probe.ose tests include sneaking fake bombs and banned weapons through security. 96% failure rate. that's almost 100%. so outrageous that i don't know what to say. here is what white house press secretary joshernest said today about it. >> the president does believe the american people should feel confident traveling across the country. there are security measures in place to protect the american traveling public. >> really? confident? maybe the white house feels that way. the president has air force 1 and we americans, as we should what about the american people? why do they have to fly scare air? that's my off the record comment tonight. thank you for being with us. see you tomorrow night here at 7:00 p.m >>> live from america's news headquarters i'm patricia stark. president obama signing the nsa reform bill just hours after it was approved by the senate. it replaces and makes changes to the patriot act that temporarily expired on sunday night. the phone companies will still keep records

i'm curious as to what letter grade you would give tsa and dhs as you begin this mission? >> it's difficult to assign a letter grade to it. i'll come back to you with that if i get confirmed. ly tell you they're not where they need to be. >> as a former college president, i don't know any institution where a 4% success rate could be anything other than an "f." i think we need to admit the magnitude of this problem and i think the american people have a right to understand the problem more clearly. thank you. >> thank you, senator. i want to underscore your point. solved a lot of problems. the first step in solving a problem is fully admitting it, that you have the problem and properly defining it. admiral, have i to say, i feel safe flying as well. i think the line of questioning senator sass was undertaking there is exactly right. we have to admit the problem properly define it. senator ayotte. >> thank you, chairman. admiral, i appreciate you being here and for your willingness to take on this position. you are a nominee for this very important position as has been outli