Frustrated senators demand cyber war strategy from Trump

Frustrated senators demand cyber war strategy from Trump
© Getty

Lawmakers are growing impatient with the Trump administration on the issue of cyber war, saying the United States lacks a clear policy for responding to attacks.

Frustrations over the lack of a comprehensive cyber policy boiled over during a Senate Armed Services Committee hearing on Thursday. The hearing ended with Chairman John McCainJohn Sidney McCainZuckerberg: Maybe tech should face some regulations Schiff mocks Trump: Obama, Bush didn't need staff warning 'do not congratulate' Putin GOP senator tears into Trump for congratulating Putin MORE (R-Ariz.) issuing a veiled threat to subpoena the White House national security official responsible for coordinating cybersecurity policy across the federal government.

“We have authorities that I don’t particularly want to use,” McCain said. “But unless we are allowed to carry out our responsibilities to our voters who sent us here, we’re going to have to demand better cooperation and teamwork than we are getting now.”

McCain and other lawmakers have been clamoring since the Obama administration for a comprehensive policy for the U.S. government to deter and respond to cyberattacks.

The issue has gained greater attention in the wake of Russia’s interference in the 2016 presidential election, which involved targeting Democrats’ personal email accounts as well as state and local election systems.  

On Thursday, top cyber officials from the Pentagon, FBI and Department of Homeland Security (DHS) were brought before the committee to answer questions about efforts to respond to threats to U.S. critical infrastructure from nation states, including Russia and North Korea. 

One invitee was notably absent. McCain announced at the start of the hearing that the White House had blocked cyber czar Rob Joyce from testifying, citing executive privilege and “precedent against having nonconfirmed [National Security Council] staff testifying before Congress.”

While not unusual, Joyce’s absence drew fire from both Democrats and Republicans.

“The empty chair is outrageous. We had a foreign government go at the heart of our democracy,” said Sen. Claire McCaskillClaire Conner McCaskillKoch-backed group launches six-figure ad buy against Heitkamp GOP Senate candidate slams McCaskill over Clinton ties Dems meddle against Illinois governor ahead of GOP primary MORE (D-Mo.). “I am disgusted that there isn’t a representative here that can address this.”

“I personally did not see this as an adversarial discussion today,” said Sen. Mike RoundsMarion (Mike) Michael RoundsGOP senators skeptical of DACA deal in funding bill Overnight Cybersecurity: Fallout from Tillerson's ouster at State | Trump blocks Broadcom deal | Military officials push for aggressive cyber stance Top officials: U.S. must shift to more aggressive cyber approach MORE (R-S.D.), who lamented the lack of “cooperation” from Joyce. “I saw this as one in which we could begin in a cooperative discussion about how we take care of the seams that … we believe exist between the different agencies responsible for the protection of the cyber systems within our country.” 

McCain told reporters after the hearing that the committee would meet to “discuss the issue” of potentially subpoenaing Royce.

Currently, cybersecurity authorities are spread across multiple agencies, including the departments of Defense, Homeland Security and Justice. Homeland Security is responsible for protecting federal civilian networks and critical infrastructure, while Cyber Command and the National Security Agency cultivate offensive cyber capabilities within the Pentagon.

Last year, lawmakers inserted language into annual defense policy legislation requiring the Pentagon to spell out the military and nonmilitary options for deterring and responding to malicious cyber activity. The report is supposed to trigger the Trump administration to stipulate what actions in cyberspace may constitute an act of war.

That report has not yet been completed, a top Pentagon official told senators on Thursday, despite the deadline that passed earlier this year. 

“We will be submitting it to you shortly,” said Kenneth Rapuano, the assistant defense secretary for homeland defense and global security 

“Shortly doesn’t make me feel better. Is that geologic time?” answered Sen. Angus KingAngus Stanley KingLindsey Graham: Trump firing Mueller would 'probably' be impeachable offense Angus King: McCabe firing seemed 'mean-spirited' With bills on the table, Congress must heed the call to fix our national parks MORE (I-Maine). 

“If all we do is try to patch networks and defend ourselves, we will ultimately lose,” King continued. “Right now, we are not imposing much in the way of consequences.”

Officials acknowledged Thursday that, while agencies have made progress in coordinating cyber deterrence and response efforts, more work needs to be done.

“I would suggest that we’re getting there, that we’re working on the coordination,” said Christopher Krebs, a top official at DHS’s National Protection and Programs Directorate. “This is a battle that is going to be going on for many years. We’re still trying to get our arms around it.”

That didn’t do much to assure lawmakers who have demanded the administrations of Barack ObamaBarack Hussein ObamaRivals and consumers will rein in Facebook, not regulation Obamas send handwritten note to Parkland students: 'We will be there for you' Water has experienced a decade of bipartisan success MORE and now Donald TrumpDonald John TrumpHouse expected to vote on omnibus Thursday afternoon House passes 'right to try' drug bill Spending bill rejects Trump’s proposed EPA cut MORE set forth a comprehensive policy. 

Senators particularly took issue with a chart dated January 2013 that officials circulated to committee members to explain the government’s efforts in cyberspace.

“To hand out a five-year-old chart as to how we are going to fix this situation is just — is totally, totally insufficient,” said Sen. Bill NelsonClarence (Bill) William NelsonSteyer brings his push to impeach Trump to town halls across the nation Overnight Defense: Senate sides with Trump on military role in Yemen | Dem vets push for new war authorization on Iraq anniversary | General says time isn't 'right' for space corps Senate sides with Trump on providing Saudi military support MORE (D-Fla.).

But officials sought to spotlight the difficulties of developing a doctrine that spells out distinct consequences for actions in cyberspace.

“I think the challenge that we have that is somewhat unique in cyber is defining a threshold that then does not invite adversaries to inch up close but short of it,” said Rapuano. “Therefore, the criteria, it’s very difficult to make them highly specific versus more general, and then the downside of the general is it’s too ambiguous to be meaningful.”

Rapuano said that the cybersecurity executive order signed by Trump in May, which triggered a number of assessments across the federal government, would pave the way for the administration to develop a doctrine for collective cyber defense. 

But lawmakers have already tried to take the issue into their own hands absent action from the executive branch. 

McCain has helped lead a charge to insert language into Senate-approved defense legislation that spells out a specific cyber warfare doctrine. The White House has sternly objected to the provision, saying it would infringe on the president’s powers. 

This week, Defense Secretary James MattisJames Norman MattisOvernight Cybersecurity: Zuckerberg breaks silence on Cambridge Analytica | Senators grill DHS chief on election security | Omnibus to include election cyber funds | Bill would create 'bug bounty' for State GOP rep introduces bill to address national security risks of artificial intelligence Overnight Defense: Senate sides with Trump on military role in Yemen | Dem vets push for new war authorization on Iraq anniversary | General says time isn't 'right' for space corps MORE also wrote to Congress encouraging lawmakers to drop the provision, which would require that the U.S. military to notify foreign governments of its intent to combat certain cyber threats by actors in that country.

“The nature of cyber-attacks is ever evolving, and we need to maintain our ability to take decisive action against this increasingly dangerous threat,” Mattis wrote. 

McCain did not appear deterred by Mattis’s objection to the provision on Thursday.

“We’ve had to push them for years,” he told reporters.