Lawmakers are growing impatient with the Trump administration on the issue of cyber war, saying the United States lacks a clear policy for responding to attacks.
Frustrations over the lack of a comprehensive cyber policy boiled over during a Senate Armed Services Committee hearing on Thursday. The hearing ended with Chairman John McCain
John Sidney McCainTexas Democrats plan 7-figure ad buy to turn state blue Lawmakers set for tearful goodbye to John Lewis Harris seen as Biden VP favorite as clock ticks MORE (R-Ariz.) issuing a veiled threat to subpoena the White House national security official responsible for coordinating cybersecurity policy across the federal government.
“We have authorities that I don’t particularly want to use,” McCain said. “But unless we are allowed to carry out our responsibilities to our voters who sent us here, we’re going to have to demand better cooperation and teamwork than we are getting now.”
McCain and other lawmakers have been clamoring since the Obama administration for a comprehensive policy for the U.S. government to deter and respond to cyberattacks.
The issue has gained greater attention in the wake of Russia’s interference in the 2016 presidential election, which involved targeting Democrats’ personal email accounts as well as state and local election systems.
On Thursday, top cyber officials from the Pentagon, FBI and Department of Homeland Security (DHS) were brought before the committee to answer questions about efforts to respond to threats to U.S. critical infrastructure from nation states, including Russia and North Korea.
One invitee was notably absent. McCain announced at the start of the hearing that the White House had blocked cyber czar Rob Joyce from testifying, citing executive privilege and “precedent against having nonconfirmed [National Security Council] staff testifying before Congress.”
While not unusual, Joyce’s absence drew fire from both Democrats and Republicans.
“The empty chair is outrageous. We had a foreign government go at the heart of our democracy,” said Sen. Claire McCaskill
Claire Conner McCaskillDemocratic-linked group runs ads in Kansas GOP Senate primary Trump mocked for low attendance at rally Missouri county issues travel advisory for Lake of the Ozarks after Memorial Day parties MORE (D-Mo.). “I am disgusted that there isn’t a representative here that can address this.”
“I personally did not see this as an adversarial discussion today,” said Sen. Mike Rounds
Marion (Mike) Michael RoundsSenate GOP punts coronavirus package to next week Lincoln Project offers list of GOP senators who 'protect' Trump in new ad Republicans fear backlash over Trump's threatened veto on Confederate names MORE (R-S.D.), who lamented the lack of “cooperation” from Joyce. “I saw this as one in which we could begin in a cooperative discussion about how we take care of the seams that … we believe exist between the different agencies responsible for the protection of the cyber systems within our country.”
McCain told reporters after the hearing that the committee would meet to “discuss the issue” of potentially subpoenaing Royce.
Currently, cybersecurity authorities are spread across multiple agencies, including the departments of Defense, Homeland Security and Justice. Homeland Security is responsible for protecting federal civilian networks and critical infrastructure, while Cyber Command and the National Security Agency cultivate offensive cyber capabilities within the Pentagon.
Last year, lawmakers inserted language into annual defense policy legislation requiring the Pentagon to spell out the military and nonmilitary options for deterring and responding to malicious cyber activity. The report is supposed to trigger the Trump administration to stipulate what actions in cyberspace may constitute an act of war.
That report has not yet been completed, a top Pentagon official told senators on Thursday, despite the deadline that passed earlier this year.
“We will be submitting it to you shortly,” said Kenneth Rapuano, the assistant defense secretary for homeland defense and global security
“Shortly doesn’t make me feel better. Is that geologic time?” answered Sen. Angus King
Angus KingThe Susan Collins conundrum Trump ramps up China tensions with consulate shutdown Congress backs push for national cyber czar MORE (I-Maine).
“If all we do is try to patch networks and defend ourselves, we will ultimately lose,” King continued. “Right now, we are not imposing much in the way of consequences.”
Officials acknowledged Thursday that, while agencies have made progress in coordinating cyber deterrence and response efforts, more work needs to be done.
“I would suggest that we’re getting there, that we’re working on the coordination,” said Christopher Krebs, a top official at DHS’s National Protection and Programs Directorate. “This is a battle that is going to be going on for many years. We’re still trying to get our arms around it.”
That didn’t do much to assure lawmakers who have demanded the administrations of Barack Obama
Barack Hussein ObamaObama, George Clooney to hold virtual fundraiser for Biden on Tuesday Kaepernick, Fauci to receive Robert F. Kennedy Human Rights Award Texas Democrats plan 7-figure ad buy to turn state blue MORE and now Donald Trump
Donald John TrumpRead: Attorney General William Barr's written testimony to the House Judiciary Committee Barr expected to blast Democrats for efforts to 'discredit' him in upcoming hearing 22 people facing federal charges in connection to Portland protests MORE set forth a comprehensive policy.
Senators particularly took issue with a chart dated January 2013 that officials circulated to committee members to explain the government’s efforts in cyberspace.
“To hand out a five-year-old chart as to how we are going to fix this situation is just — is totally, totally insufficient,” said Sen. Bill Nelson
Clarence (Bill) William Nelson Trump, facing trouble in Florida, goes all in NASA names DC headquarters after agency's first Black female engineer Mary W. Jackson NASA, SpaceX and the private-public partnership that caused the flight of the Crew Dragon MORE (D-Fla.).
But officials sought to spotlight the difficulties of developing a doctrine that spells out distinct consequences for actions in cyberspace.
“I think the challenge that we have that is somewhat unique in cyber is defining a threshold that then does not invite adversaries to inch up close but short of it,” said Rapuano. “Therefore, the criteria, it’s very difficult to make them highly specific versus more general, and then the downside of the general is it’s too ambiguous to be meaningful.”
Rapuano said that the cybersecurity executive order signed by Trump in May, which triggered a number of assessments across the federal government, would pave the way for the administration to develop a doctrine for collective cyber defense.
But lawmakers have already tried to take the issue into their own hands absent action from the executive branch.
McCain has helped lead a charge to insert language into Senate-approved defense legislation that spells out a specific cyber warfare doctrine. The White House has sternly objected to the provision, saying it would infringe on the president’s powers.
This week, Defense Secretary James Mattis
James Norman MattisAre US-Japan relations on the rocks? Trump flails as audience dwindles and ratings plummet Budowsky: Biden-Duckworth would be America's team MORE also wrote to Congress encouraging lawmakers to drop the provision, which would require that the U.S. military to notify foreign governments of its intent to combat certain cyber threats by actors in that country.
“The nature of cyber-attacks is ever evolving, and we need to maintain our ability to take decisive action against this increasingly dangerous threat,” Mattis wrote.
McCain did not appear deterred by Mattis’s objection to the provision on Thursday.
“We’ve had to push them for years,” he told reporters.
