FEATURED:

Frustrated senators demand cyber war strategy from Trump

Frustrated senators demand cyber war strategy from Trump
© Getty

Lawmakers are growing impatient with the Trump administration on the issue of cyber war, saying the United States lacks a clear policy for responding to attacks.

Frustrations over the lack of a comprehensive cyber policy boiled over during a Senate Armed Services Committee hearing on Thursday. The hearing ended with Chairman John McCainJohn Sidney McCainMcConnell: GOP could try to repeal ObamaCare again after midterms Comey donates maximum amount to Democratic challenger in Virginia House race Live coverage: McSally clashes with Sinema in Arizona Senate debate MORE (R-Ariz.) issuing a veiled threat to subpoena the White House national security official responsible for coordinating cybersecurity policy across the federal government.

“We have authorities that I don’t particularly want to use,” McCain said. “But unless we are allowed to carry out our responsibilities to our voters who sent us here, we’re going to have to demand better cooperation and teamwork than we are getting now.”

McCain and other lawmakers have been clamoring since the Obama administration for a comprehensive policy for the U.S. government to deter and respond to cyberattacks.

The issue has gained greater attention in the wake of Russia’s interference in the 2016 presidential election, which involved targeting Democrats’ personal email accounts as well as state and local election systems.  

On Thursday, top cyber officials from the Pentagon, FBI and Department of Homeland Security (DHS) were brought before the committee to answer questions about efforts to respond to threats to U.S. critical infrastructure from nation states, including Russia and North Korea. 

One invitee was notably absent. McCain announced at the start of the hearing that the White House had blocked cyber czar Rob Joyce from testifying, citing executive privilege and “precedent against having nonconfirmed [National Security Council] staff testifying before Congress.”

While not unusual, Joyce’s absence drew fire from both Democrats and Republicans.

“The empty chair is outrageous. We had a foreign government go at the heart of our democracy,” said Sen. Claire McCaskillClaire Conner McCaskillMcCaskill calls on GOP opponent to appoint special prosecutor to look into undercover video Dems go on offense against GOP lawsuit on pre-existing conditions Credit union group to spend .8 million for vulnerable Dem, GOP incumbents MORE (D-Mo.). “I am disgusted that there isn’t a representative here that can address this.”

“I personally did not see this as an adversarial discussion today,” said Sen. Mike RoundsMarion (Mike) Michael RoundsOn The Money: Deficit hits six-year high of 9 billion | Yellen says Trump attacks threaten Fed | Affordable housing set for spotlight in 2020 race Lawmakers, Wall Street shrug off Trump's escalating Fed attacks GOP shrugs off dire study warning of global warming MORE (R-S.D.), who lamented the lack of “cooperation” from Joyce. “I saw this as one in which we could begin in a cooperative discussion about how we take care of the seams that … we believe exist between the different agencies responsible for the protection of the cyber systems within our country.” 

McCain told reporters after the hearing that the committee would meet to “discuss the issue” of potentially subpoenaing Royce.

Currently, cybersecurity authorities are spread across multiple agencies, including the departments of Defense, Homeland Security and Justice. Homeland Security is responsible for protecting federal civilian networks and critical infrastructure, while Cyber Command and the National Security Agency cultivate offensive cyber capabilities within the Pentagon.

Last year, lawmakers inserted language into annual defense policy legislation requiring the Pentagon to spell out the military and nonmilitary options for deterring and responding to malicious cyber activity. The report is supposed to trigger the Trump administration to stipulate what actions in cyberspace may constitute an act of war.

That report has not yet been completed, a top Pentagon official told senators on Thursday, despite the deadline that passed earlier this year. 

“We will be submitting it to you shortly,” said Kenneth Rapuano, the assistant defense secretary for homeland defense and global security 

“Shortly doesn’t make me feel better. Is that geologic time?” answered Sen. Angus KingAngus Stanley KingCollusion judgment looms for key Senate panel People have forgotten 'facade' of independent politicians, says GOP strategist Senate poised to confirm Kavanaugh after bitter fight MORE (I-Maine). 

“If all we do is try to patch networks and defend ourselves, we will ultimately lose,” King continued. “Right now, we are not imposing much in the way of consequences.”

Officials acknowledged Thursday that, while agencies have made progress in coordinating cyber deterrence and response efforts, more work needs to be done.

“I would suggest that we’re getting there, that we’re working on the coordination,” said Christopher Krebs, a top official at DHS’s National Protection and Programs Directorate. “This is a battle that is going to be going on for many years. We’re still trying to get our arms around it.”

That didn’t do much to assure lawmakers who have demanded the administrations of Barack ObamaBarack Hussein ObamaCampaign staffers sue Illinois Dem governor candidate over alleged racial discrimination Bipartisanship is a greater danger than political polarization GOP group makes late play in Iowa seat once seen as lost MORE and now Donald TrumpDonald John TrumpTrump renews attacks against Tester over VA nominee on eve of Montana rally Trump submits 2017 federal income tax returns Corker: Trump administration 'clamped down' on Saudi intel, canceled briefing MORE set forth a comprehensive policy. 

Senators particularly took issue with a chart dated January 2013 that officials circulated to committee members to explain the government’s efforts in cyberspace.

“To hand out a five-year-old chart as to how we are going to fix this situation is just — is totally, totally insufficient,” said Sen. Bill NelsonClarence (Bill) William NelsonGillum holds razor-thin lead in Florida race Senate panel wants Hyundai, Kia to answer over reported engine fires Election Countdown: Dems outraise GOP in final stretch | 2018 midterms already most expensive in history | What to watch in second Cruz-O'Rourke debate | Trump raises 0M for reelection | Why Dems fear Avenatti's approach MORE (D-Fla.).

But officials sought to spotlight the difficulties of developing a doctrine that spells out distinct consequences for actions in cyberspace.

“I think the challenge that we have that is somewhat unique in cyber is defining a threshold that then does not invite adversaries to inch up close but short of it,” said Rapuano. “Therefore, the criteria, it’s very difficult to make them highly specific versus more general, and then the downside of the general is it’s too ambiguous to be meaningful.”

Rapuano said that the cybersecurity executive order signed by Trump in May, which triggered a number of assessments across the federal government, would pave the way for the administration to develop a doctrine for collective cyber defense. 

But lawmakers have already tried to take the issue into their own hands absent action from the executive branch. 

McCain has helped lead a charge to insert language into Senate-approved defense legislation that spells out a specific cyber warfare doctrine. The White House has sternly objected to the provision, saying it would infringe on the president’s powers. 

This week, Defense Secretary James MattisJames Norman MattisOvernight Defense: Trump worries Saudi Arabia treated as 'guilty until proven innocent' | McConnell opens door to sanctions | Joint Chiefs chair to meet Saudi counterpart | Mattis says Trump backs him '100 percent' Joint Chiefs chairman to meet with Saudi counterpart Mattis says Trump backs him '100 percent' despite 'Democrat' remark MORE also wrote to Congress encouraging lawmakers to drop the provision, which would require that the U.S. military to notify foreign governments of its intent to combat certain cyber threats by actors in that country.

“The nature of cyber-attacks is ever evolving, and we need to maintain our ability to take decisive action against this increasingly dangerous threat,” Mattis wrote. 

McCain did not appear deterred by Mattis’s objection to the provision on Thursday.

“We’ve had to push them for years,” he told reporters.