A clearly frustrated, bipartisan panel of senators today threatened to subpoena the Trump administration’s cyber czar, demanding to know how the White House plans to address “the disarray” that has embodied the U.S. government’s response to cyber threats from Russia and other adversaries.
“Do you know that for eight years we’ve been trying to get a policy? For eight years we’ve been trying to get a strategy,” an exasperated Sen. John McCain, R-Ariz., told top cyber officials from the FBI, Defense Department, and Department of Homeland Security during a Senate Armed Services Committee hearing today.
At the end of the hearing’s witness table, sitting beside Defense Department Assistant Secretary Kenneth Rapuano, was an empty chair that had been set aside for White House Cybersecurity Coordinator Rob Joyce, who declined an invitation to appear before the committee today.
A more coordinated effort
Senators indicated they want a more coordinated federal effort to combat growing cyber threats and prevent Russia from trying to influence U.S. elections as they had last year.
Republicans and Democrats alike mocked what they described as a confusing and compartmentalized distribution of authorities for government agencies, and McCain said it’s important that a single, high-level administration official coordinates the government-wide effort.
“Mr. Joyce’s absence here, whose job it is to do all this, is an example of the disarray in which this whole issue rests,” said McCain, the committee’s chairman.
Russian hackers allegedly used popular antivirus software to steal NSA secrets
McCain also accused the Defense Department of deflecting responsibility for certain cyber-related threats, particularly threats against U.S. elections systems.
Rapuano told McCain, “When you look at the separation of authorities between state and local government, the lead for that coordination and support in our current system is DHS.”
Rapuano added that it’s problematic for the Pentagon to be “attempting to insert itself into a process.”
But McCain countered: “It’s the Department of Defense’s job to defend this nation; that’s why it’s called the Department of Defense.”
“This is cyber warfare. Cyber is warfare,” McCain told Rapuano. “Cyber is an attempt to destroy a democracy. That is what [Russian president Vladimir] Putin is all about.
“I steadfastly reject your shuffling off the responsibilities of cyber over to the Department of Homeland Security,” McCain added.
‘A lot of work to do’
Generally, DHS is charged with protecting “critical infrastructure,” assisting states in their efforts to protect voting systems, and distributing threat information to other government agencies and private-sector partners. The FBI is responsible for investigating intrusions and potential threats from foreign governments, and the Defense Department is responsible for protecting military systems and developing offensive cyber tools.
A chart, provided by the U.S. government, was displayed at today’s hearing to outline those differences.
“For eight years, we’ve been trying to get something besides this convoluted chart,” McCain said.
The DHS official testifying, Chris Krebs, noted that he’s only been in his role at the DHS National Protection and Programs Directorate for eight weeks, but he understands the Senators’ unease.
“I share your frustration, and I think we have a lot of work to do,” Krebs said. “I think this is going to require both the executive branch and the Congress working together to continue understanding how we need to address this threat.”
McCain shot back: “Well, when the coordinator doesn’t show up for a hearing, that’s not an encouraging sign.”
At that point, Sen. Bill Nelson, D-Fla., told McCain he should “consider a subpoena to get the main witness” to appear.
“I think that has to be discussed in the committee,” McCain responded.
Threats of subpoenas
Asked why Joyce did not show up to today’s hearing, a White House spokesman said: “It has been the longstanding practice of presidents of both parties not to make White House advisers available for congressional testimony or oversight. This practice is rooted in the separation of powers and in the confidentiality interests of the executive branch. Officials from relevant departments and agencies are available to accommodate the committee’s legitimate oversight needs without violating the confidentiality interests that attach to White House staff.”
During today’s hearing, Rapuano said he was not aware of any specific effort within his department to prepare a coordinated response to threats against upcoming elections, but Krebs said DHS has “absolutely” been engaged in such an effort.
While Rapuano said he was not aware of any specific effort within his department to prepare a coordinated response to threats against upcoming elections, Krebs said DHS has “absolutely” been engaged in such an effort.
“I didn’t need anybody to tell me to stand up a task force,” Krebs said, adding that it was one of the first things he did after joining DHS from the private sector.
DHS has also recently issued security clearances to “a number” of state election officials so they can be read-in on classified information pertaining to threats against their systems, Krebs said.
“There’s no question [foreign hackers] are going to come back, and we’re going to be fighting them every day,” Krebs said.
McCain’s threat to subpoena Joyce was his second of the day. After today’s hearing, he said he is willing to subpoena Trump administration officials to get more information about the recent ambush in Niger in which four American soldiers were killed.