Communications and Technology Subcommittee: "Global Networks at Risk: Securing the Future of Telecommunications Infrastructure"

Chairman Richard Hudson (R-NC)SPEAKER_09

Subcommittee will come to order. The chair recognizes himself for an opening statement. Good morning. Welcome to today's subcommittee hearing on Global Networks at Risk: Securing the Future of Communications Infrastructure. This topic has never been more pressing. The United States is home to the world's leading companies and innovators who are driving the development of cutting-edge technologies like artificial intelligence, the Internet of Things, and next-generation wireless technologies. These innovations are critical not just to our economy, but the future of global connectivity. Communications are also central to our national defense. This is top of mind for me, especially as the representative of Fort Bragg, home of the U.S. Army Special Forces and the largest military base in the world. Connectivity and secure communication networks are vital to maintaining our defense capabilities and keeping our nation safe. Today, we rely on communications infrastructure in nearly every sector of our economy. As Americans become more connected, it is increasingly important the equipment we buy, the networks we rely on are secure, resilient, and protected from malicious actors. Unfortunately, the security of these networks is under threat. The Chinese Communist Party, for example, has been investing heavily to develop unsecure communications equipment and export it around the world to assist in their espionage activities, including in the United States. The known vulnerabilities in many technologies produced by foreign adversaries pose a direct threat to the national security of the United States. Last fall, we learned about Salt Typhoon, which may be the largest Chinese-backed telecommunications hack in our nation's history. These hackers infiltrated U.S. telecommunications companies' networks, impacting at least nine providers. This infiltration enabled the hackers to geolocate millions of individuals and record phone calls, and impacted senior U.S. officials, including then-President-elect Trump and Vice President-elect Vance. In addition to these vulnerabilities, there are an increasing number of physical attacks on communications infrastructure, such as undersea cables. These cables are responsible for carrying data traffic across oceans and are susceptible to damage by the elements and unintentional acts such as anchors dragging along the seafloor, but they've also been intentionally sabotaged, and because of their physical location under the ocean, it can be difficult to monitor unauthorized access to these cables. We must take decisive steps to address these threats. I was proud to support funding for the Secure and Trusted Communications Networks Reimbursement Program, which will support the removal of the remaining Chinese equipment in our communications networks. Another key aspect of securing our communications infrastructure is the review of foreign investments in U.S. networks. Team Telecom is an interagency working group that reviews foreign investments in certain communications applications that come before the FCC. Team Telecom assesses the national security risks, law enforcement, and other policy considerations that may be associated with such investments. While this process is important, applications often get bogged down by delays and bureaucratic hurdles. We must find ways to make sure that national security concerns are addressed without hindering deployment. Satellite technology also plays an increasingly important role in our communications infrastructure. Satellites provide broadband services as well as mission-critical services to critical infrastructure companies and the federal government. Yet the regulations governing satellite operations have not kept pace with the growth in the industry. Last Congress, this committee led bipartisan legislation to streamline regulatory processes for satellite operators, and the Federal Communications Commission has adopted many of these reforms. But more work remains to provide clarity and more certainty in the licensing process to ensure the U.S. remains a leader in this sector as well. We must meet these challenges head-on. Innovation has provided untold benefits to Americans and to our economy. I look forward to hearing from the witnesses today about these issues. I now recognize the ranking member, Doris Matsui, for her opening statement. You're recognized.

Ranking Member Doris Matsui (D-CA)SPEAKER_21

Thank you very much, Mr. Chairman. Today's hearing comes on the heels of Salt Typhoon, one of the worst hacks of U.S. history. Salt Typhoon is a wake-up call that drives home the vulnerabilities in our communications networks. These networks are the backbone of modern life, connecting us to businesses, public safety, healthcare, education, and communities. That's what makes them such a ripe target for attack by malicious actors and why we must strengthen how we protect this critical infrastructure. Yet, I fear that we are moving backwards, as the Trump administration won't even own up to its own pattern of security failures. President Trump is defending the indefensible, rallying behind the blunders of his Secretary of Defense, who leaked classified war plans to his wife and brother over an unsecured Signal chat. Likewise, he is standing blindly by his National Security Advisor and countless other senior officials who use Signal and personal Gmail accounts to conduct sensitive government business. The Trump administration is handing highly sensitive data to deeply unserious people who can't be bothered to follow the law or basic common sense when it comes to protecting cybersecurity and keeping sensitive information safe. The world is watching. Bad actors are ready to take advantage of this administration's gross incompetence. In Congress, my Republican colleagues talk tough about protecting America against foreign adversaries, but talk is cheap. Their refusal to hold the Trump administration accountable despite serious security breaches speaks volumes. Republicans are also staying silent as President Trump slashes our federal cyber workforce, gutting our nation's capability to prepare for and respond to attacks on our critical infrastructure. As one of his earliest acts in office, President Trump disbanded the Cyber Safety Review Board, leaving the in limbo our investigation into the largest telecommunications hack in U.S. history. Instead, Salt Typhoon remains active as this administration jeopardizes our government's ability to assess the damage and work on solutions. As President Trump is wreaking havoc on our critical communications infrastructure with his destructive tariffs, rather than boosting U.S. companies, his tariffs have driven up costs and damaged supply chains at exactly the wrong time. Meanwhile, Democrats have been working diligently to increase network safety and protect Americans' information. As co-author of the Secure and Trusted Communications Networks Act, I've been a staunch advocate of securing our network supply chains. Last Congress, we secured the last $3 billion to fully fund the Rip and Replace program and remove vulnerable Chinese equipment from our telecommunications infrastructure. I urge our agencies to ensure smooth and timely completion of this national security imperative. I've been dedicated to advancing innovations such as open radio access networks, or Open RAN, to bolster our supply chain diversity. And earlier this week, the Future Networks Act passed the House. This bill will bring the brightest minds across industry, academia, and government to collaborate on the development of our next-generation wireless technologies, including identifying supply chain and cybersecurity vulnerabilities so that we can more effectively prevent them. These are important steps to strengthen network security, and we must build on this work as America faces growing cyber threats. This is not the time for inaction. I urge my Republican colleagues to speak up and hold the administration accountable for security failures. We must work on bipartisan solutions to secure our communications networks, as our subcommittee has historically done. I look forward to hearing from our witnesses on how we can proactively protect against future attacks. And with that, I yield the balance of my time.

Chairman Richard Hudson (R-NC)SPEAKER_09

Thank you. I now recognize the chairman of the full committee, the gentleman from Kentucky, for 5 minutes for his opening statement.

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

Thank you. Thank you, Chair Hudson. I appreciate the opportunity to be here for this important hearing. Americans are connected to the internet in nearly every aspect of their daily lives, whether it's work, staying in touch with loved ones, or receiving healthcare. Reliable connectivity is essential. The underlying communications infrastructure is what allows Americans and businesses of all sizes to utilize the many digital services that have redefined our economy and society. And while reliable access is important, it must also be secure. That is why today's hearing is very important. Sophisticated cyber actors, specifically the governments of China, Russia, North Korea, and Iran, directly engage in activities aimed at infiltrating our critical infrastructure, especially our communications networks. These state adversaries and other malicious cyber actors continuously seek to exploit weaknesses in our networks, not only to steal sensitive data and commit fraud against Americans, but they also stand to gain sensitive business and government information as they seek to establish footholds for surveillance and future exploitation. We have seen these efforts play out in recent attacks. We only have to point back to October when Chinese hackers breached the American court wiretap system. Our adversaries could also have the capability to cut off our communication services altogether, and think about how disruptive and devastating that would be for society. Our networks are vulnerable to physical disruptions. For instance, fiber cuts can take months to repair depending on where they're located. And if we're talking about subsea cables that are isolated in the ocean, these cuts can interrupt international data flows and result in degraded service for millions of people over an extended period of time, given the relative difficulty of repair. Increasingly, satellite-provided services are being used to help close the digital divide and provide positioning, navigation, and timing data for government and private sector uses. Foreign adversaries, again, like China and Russia, are reportedly developing anti-satellite capabilities, which would cause serious disruption to critical services. And in the case of GPS, a satellite-provided service, we have very few alternatives. Disruption to these critical communication services has the potential to cause chaos here in the homeland and reverberate throughout the economy. It could also give our adversaries the ability to disrupt American military mobilization in the event of conflict or attack. Securing our communications systems from bad actors has been a longstanding priority, bipartisan priority of this committee, and is essential to preserving our national economic security. This committee led the effort to rip and replace untrusted vendor equipment from our mobile networks by passing the Secure and Trusted Communications Networks Act. We built on these efforts by passing the USA Telecommunications Act in 2020 to foster a more competitive market for trusted equipment vendors by promoting Open RAN technology. More work remains to protect our critical infrastructure and harden these essential services against adversarial threats. Thank you to the witness for your participation. I look forward to hearing from you about how to protect our communications and future communications infrastructure, and ensure that the U.S. is prepared to defend against the CCP and any other adversaries. I really appreciate you all being here today and look forward to the discussion. And with that, Mr. Chairman, I will yield back.

Chairman Richard Hudson (R-NC)SPEAKER_09

Gentleman yields back. I'll now recognize the gentleman from New Jersey, the ranking member, for 5 minutes for your opening statement.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

Thank you, Mr. Chairman. Well, today's discussion is important and timely. I'm worried that my Republican colleagues are failing to even acknowledge the unprecedented and troubling actions of the Trump administration that are putting our national security at risk. Defending our telecommunications infrastructure from our foreign adversaries and other bad actors is critically important. On a daily basis, our nation's telecommunications networks carry enormous amounts of data that not only include our most personal information, but also sensitive government materials that any foreign nation would love to digest. And late last year, we learned that, no, Salt Typhoon, I'm sorry, that Salt Typhoon, a cyber espionage operation backed by China, infiltrated several American telecommunications networks to gain access to detailed information on President Trump, former Vice President Harris, other political figures, and American surveillance information. And that's why it's so disturbing to watch as the Trump administration has mishandled sensitive national security information. In one of the worst security failures in decades, Defense Secretary Hegseth last month shared highly sensitive war plans on Signal, an unofficial and unsecure messaging app. The unsecure group chat was created by National Security Advisor Waltz, and he inadvertently included a reporter in the chat. Hegseth also shared the same information in a separate chat with some family members. Now, this reckless conduct put the lives of American troops at risk, in my opinion. If any adversary got access to these messages, they could have shut down or they could have shot down American planes or targeted American ships. And yet, Secretary Hegseth continues to lead the Department of Defense. I don't know for how long, but it is an outrage and shows that the administration doesn't take these threats very seriously. And this is on top of the fact that Elon Musk and his DOGE minions are being given access, often unauthorized, to sensitive information and undermining American security on a daily basis. And that could include our nuclear secrets. Musk and DOGE are also haphazardly and indiscriminately cutting and slashing important government programs and experienced public servants, which is weakening our country without any pushback from congressional Republicans. And while President Trump likes to act tough against China, he is blatantly violating Congress's bipartisan TikTok legislation and continuing to allow the Chinese Communist Party to compromise American devices, harvest Americans' data, promote pro-communist propaganda, and undermine American interests. So, securing our country's telecommunication networks and infrastructure is serious business, but the Trump administration is not taking the task seriously. Imposing arbitrary tariffs on telecommunications equipment and chips that are vital to enhancing the safety and security of our networks one day, and then pausing them the next day, is only causing chaos and confusion. The administration's actions are increasing the chances that our foreign adversaries and others attempt even larger-scale attacks on our telecommunications networks, which no one wants to see. Despite President Trump's recklessness and my Republican colleagues' silence, today's hearing topic underpins a significant part of the American economy. From healthcare to energy to public safety, nearly every facet of American life relies on our nation's telecommunications networks and infrastructure. And while the innovations and advancements that these networks enable us to do are remarkable, it also makes them and the devices that run on top of them targets. So, this will only increase as more devices in our homes are connected. If cars, television, home security systems, and more are connected to the Internet, they are vulnerable to attacks. The reality means that our homes can now be attacked without anyone touching a single door or window. So, it is imperative that we understand the vulnerabilities and risks our networks and devices face to better protect our country and consumers from attack and to keep up with the rapidly evolving technological landscape our nation faces. And I urge my Republican colleagues to stop these irresponsible budget reconciliation plans as well. Rather than using spectrum auction proceeds to fund giant tax breaks to American billionaires and big corporations, we should use the proceeds from spectrum to help fund Next Generation 911, which will enhance the safety of our energy networks and save countless American lives. The Trump administration must also stop delaying sending states their funds from the BEAD Program. These funds will ensure reliable connectivity across the country, which is crucial for our national security and economic prosperity. The only person who benefits from these delaying tactics is Elon Musk, who's trying to get taxpayer money funneled to his Starlink service. So, I look forward, Mr. Chairman, to hearing from today's witnesses, and I do think this is an important hearing about our telecommunication infrastructure and devices. Thank you, Mr. Chairman. Yield back.

Chairman Richard Hudson (R-NC)SPEAKER_09

Thank you. We've now concluded with member opening statements. The chair reminds members that pursuant to the committee rules, all members' opening statements will be made part of the record. We'd like to thank our witnesses for being here today to testify before this subcommittee. Our witnesses will have 5 minutes to provide an opening statement, which will be followed by a round of questions from the members. The witnesses here before us today are Tom Stroup, president of the Satellite Industry Association; David Stehlin, chief executive officer, Telecommunications Industry Association; Jamil Jaffer, or Jaffer, Jaffer, I apologize, founder and executive director, National Security Institute; and Laura Galante, former intelligence community cyber executive and director, Cyber Threat Intelligence Integration Center, Office of the Director of National Intelligence. Mr. Stroup, you're recognized for 5 minutes for your opening statement.

Tom StroupSPEAKER_15

Chairman Hudson, Ranking Member Matsui, Chairman Guthrie, Ranking Member Pallone, and distinguished members of the subcommittee, thank you for inviting me to testify before you today. I'm Tom Stroup, President of the Satellite Industry Association. Satellites are the backbone of modern society. We rely on them for communications, position navigation and timing, and remote sensing across the globe. Satellites provide critical services to hundreds of millions of Americans and billions of people around the world every day. The companies represented by SIA are poised to provide resilient services in any situation to empower U.S. leadership and support U.S. citizens and allies in an interconnected and contested world. We are at a time of tremendous innovation in the space industry, with over 12,000 active satellites on orbit today and plans for tens of thousands more through the end of the decade. Satellite services support all 16 critical infrastructures, including through communications for emergency services, position navigation and timing for agriculture, resilience for global telecommunications, and remote sensing data to improve our national security. Satellites are the fastest way to connect the unconnected, with multiple American companies providing high-speed internet and more launching in the near future. The satellite industry provides FCC-defined broadband service today across the globe and is ready to bring the nation into an interconnected future as a backbone for 5G, IoT, and AI technologies. In addition, satellites play a critical role in preparation, response, and recovery from natural disasters, electrical outages, and terrorist attacks. Remote sensing data and analytics can help pinpoint and quantify initial damage assessments in the immediate aftermath of a disaster. Synthetic aperture radar satellites can see through clouds and allow the mapping of damaged regions when storms are still overhead. Furthermore, unlike terrestrial communications counterparts, satellite networks are not susceptible to damage from such disasters because the primary repeaters are on board the spacecraft and not part of the ground infrastructure. In addition to the benefit of having its primary infrastructure in space, many communications satellite operators provide customer connectivity through multi-orbit services. These services marry the low latency of LEO systems with the ability of GEO systems to deliver large amounts of capacity in high-traffic areas. While both GEO and non-GEO systems have the ability to provide large amounts of capacity, the combined solutions offer the best of both systems, enhancing the resiliency and reliability of services. Another recent development furthering network resiliency is the deployment of direct-to-mobile satellite connectivity led through major partnerships between satellite operators and both wireless carriers and manufacturers, which greatly expand the range of communications available to mobile customers. The satellite industry today is investing continuously to ensure it can it can address the challenges of the future and to make its technologies available to every American. Satellite companies are working to optimize the use of spectrum by investing in high-throughput satellites and flexible, software-defined payloads that allow for instantaneous reallocation of spectrum resources and the mitigation of harmful interference. Satellite system operators are continuing to invest in network cybersecurity, including including using AI for vulnerability testing. Launch costs have also declined dramatically, providing opportunities for rapid replenishment of satellite constellations. While the U.S. has long led the space sector, China is closing the gap with similar investments in space technologies that will challenge our national security community while also undermining democracy around the globe. It is critical for Congress to support continued domestic innovation and avoid regulations that put U.S. providers on an unequal playing field internationally. Our members are dedicated to advancing the national interests, ensuring competitiveness of satellite companies in the U.S. and globally, and driving progress for the benefit of all Americans. In furtherance of these goals, we have five priorities. Number one, promote American space innovation through streamlined regulations without unnecessary red tape and bureaucracy. Two, lead standards development internationally. Third, enact effective space debris policies and rigorously advocate for adoption of similar policies in other countries and in international fora. Fourth, streamline space systems procurement for greater efficiency in government acquisition. And finally, spur development and investment through access to sufficient spectrum resources. I appreciate the opportunity to appear before you today on behalf of the satellite industry, and I look forward to your questions.

Chairman Richard Hudson (R-NC)SPEAKER_09

Thank you. Mr. Stehlin, you're recognized for 5 minutes for your opening statement.

David StehlinSPEAKER_11

Chairman Hudson—that's on—Vice Chair Allen, Ranking Member Matsui, and members of the subcommittee. My name is Dave Stehlin. I'm the CEO of TIA, the Telecommunications Industry Association, and I appreciate the opportunity to speak about this important subject: securing the future of telecommunications infrastructure so that Americans can depend on trusted, secure, resilient, high-speed networks. For more than 85 years, TIA has, with our 400-member organizations, developed technical and process improvement standards and advanced new technologies that drive our economy and improve the lives of our citizens. TIA's current standards cover a wide range of areas, including data center infrastructure, cell tower structures, structured cabling, public safety and emergency responder radios, hearing aid compatibility with mobile devices, telecom quality management, and our most recent focus on cyber and supply chain security. We're a technology-agnostic organization, meaning that we support all wireline, wireless, and satellite trusted technologies. In short, TIA has nearly a century of experience in ensuring that communications networks are built efficiently and resiliently with trusted suppliers. I've been the CEO of TIA for the past 5-plus years and have run both publicly traded and venture-backed telecom technology companies for the past 40 years. I've seen tremendous change and technology improvement, but I also recognize that security improvements always lag behind technology advancements. I've experienced firsthand how state-owned entities like Huawei operate on a global stage, undermining a competitive market of trusted ICT vendors. As a graduate of the Naval Academy and former Marine officer, I take national security very seriously, and I understand that the national security threat posed by entities controlled by our adversaries can cause dramatic and significant long-lasting effects to our communications networks. Every type of critical infrastructure, from electrical grid to water systems to emergency responders to the internet, all use similar information communications technologies and systems. Potential vulnerabilities in these systems have a broad impact due to the unique role played by communications networks in our infrastructure. Every one of CISA's 16 identified critical infrastructures uses fundamental ICT networks. Network attacks come from many directions, including state-sponsored enemies, criminals, and terrorists. And while the attack possibilities are endless, we must have a defense in depth, which starts with supply chain security. We must ensure that the products and services that make up our networks are coming from trusted suppliers who can demonstrate that security is designed in. We must verify before trusting. All of this is critical to the success of building trusted, resilient, and secure global networks. In this context, subsea cable systems are an area of growing concern. Across the globe, nefarious actors are increasingly disrupting networks by cutting cables and damaging the points where the cables come ashore. These subsea cable systems carry more than 99% of internet traffic across the continents and more than $10 trillion of financial transactions. These cables are irreplaceable backbones of the global internet. And while satellite communications plays an integral role in our networks, the data capacities of subsea cables cannot be overstated. Of course, in addition to these physical threats to our communications networks is the fundamental threat from untrusted software, hardware, and suppliers. As network architectures continue to advance and become more complex, the potential attack surface grows and expands as well. This gives bad actors, including those who are state-sponsored by foreign adversaries, such as the CCP, more targets. For example, the recent Salt Typhoon attack. The U.S. government has a long and bipartisan recognition of the supply chain threat vulnerabilities posed to our nation's infrastructure. The industry recognizes this, and that is one of the reasons we at TIA initiated and developed the industry's first supply chain security standard, SCS 9001, about 3 years ago. This standard was designed with input from our members and both the U.S. government and trusted allied governments, and aligns and operationalizes the NIST Cybersecurity Framework, the Prague Proposals, and many other guidelines. SCS 9001 is a supply chain security management system intended to define and measure the requirements and controls for the design, development, production, and operations of ICT products and services. This is an effort that reaches beyond our domestic infrastructure, and TIA has been working with the Department of Commerce and Department of State to help allied countries build trusted wireless, fiber, and satellite networks. We appreciate the leadership that this committee brings us and has demonstrated by holding this hearing, and I would like to thank you for your time.

Chairman Richard Hudson (R-NC)SPEAKER_09

Thank you. Mr. Jaffer, you are recognized for 5 minutes for an opening statement.

Jamil N. JafferSPEAKER_13

Chairman Hudson, Ranking Member Matsui, members of the subcommittee, thank you for inviting me here today to discuss the threats facing our global networks and the telecommunications infrastructure of our nation, its allies, and its partners. I want to thank the chairman and the ranking member for holding this hearing, particularly given the major threats that we face today against our global telecommunications infrastructure from China, Russia, Iran, and North Korea. While recent reports have come to light about the major hacks of the United States telecommunications infrastructure and the deployment of destructive capabilities within our infrastructure by China, these are only a small part of a much larger effort architected by our adversaries. These adversaries include not just the nations of China, Russia, Iran, North Korea, but their proxies as well. And they're aimed not just at collecting information and intelligence on American on the American government and our federal policies and priorities, but on our citizens, and putting in place capabilities that if they decide to use could take down significant parts of our financial system, our energy infrastructure, and the like. And of course, our entire nation and all of its capabilities, including the modern AI revolution, runs on top of the global telecommunications infrastructure that we're talking about today. And so while our hearing today is focused on this global infrastructure, we need to think about it in the context of two major issues: the larger national security and economic competition with China and its key economic and technological elements, and the increasingly robust collaboration between China, Russia, Iran, and North Korea. We know the Director of National Intelligence has told us that China presents the most comprehensive and robust military threat to U.S. national security, with a joint force capable of full-spectrum warfare. This is true in the cyber domain as well, where the Director of National Intelligence told us that China remains the most active and persistent cyber threat to the U.S. government, private sector, and critical infrastructure networks, and that China's demonstrated the ability not just to compromise U.S. infrastructure through its formidable cyber capabilities, but also that it has the ability to conduct destructive and disruptive activities. And this is where Volt Typhoon and Salt Typhoon come into play. Now, none of this is particularly new when it comes to China. Since at least 2019, we've known that the Director of National Intelligence has told us that China is improving its cyberattack capabilities and that it had the ability back in 2019, 6 years ago, to launch cyberattacks that could cause localized, temporary disruptions and disruptive effects on our critical infrastructure, including the disruption of natural gas pipelines for days to weeks. That was 6 years ago. And so we think about what their capabilities look like today, and we realize that this threat is much larger and much more significant than we think. And so let's talk about one particular example of how this plays out. We look at the Salt Typhoon hacks of the U.S. telecommunications infrastructure. In that effort, the FBI has told us that China targeted commercial telecommunications infrastructure and had a broad and significant cyber espionage campaign. They had compromised networks at multiple telecommunications companies—the Chairman mentioned nine of them—to enable the theft of customer call records, the compromise of private communications, actual content on a number of individuals, while primarily focused on U.S. government and political activity, and the copying of information subject to U.S. law enforcement requests. Let me say it again. The Chinese government was able to hack not just our call records, not just the communications of American government and political officials, but the records of U.S. law enforcement requests. That means people that we have on collection, whether for criminal purposes, maybe even for intelligence purposes, are now in the hands of the Chinese government. And if the Chinese have it, they're almost certainly going to share it with the Russians, potentially with the Iranians, and potentially with the North Koreans. And don't believe me. Then-Chairman of the Senate Intelligence Committee, John Warner—sorry, pardon me, Mark Warner—said it was the worst telecom hack in our nation's history. The current Secretary of State, Marco Rubio, referred to it as an egregious, outrageous, and dangerous breach of our telecommunications systems across multiple companies. So what can we do? In the last minute I have remaining, I want to suggest one thing we should not do: We should not blame the private sector standing alone. The idea that we would expect the private sector to defend against nation-state attacks standing alone makes no sense. We don't expect Target and Walmart to put surface-to-air missiles on the on the tops of their warehouses to defend against Russian Bear bombers. Why should we expect any of our telecommunications companies to be able to effectively defend against committed nation-state attackers who have virtually unlimited resources of national governments? It doesn't make sense. At the same time, we have to look internally at the government to say, what did the government know? When did it know about it? And why didn't it take action to protect its own data residing on these networks? So there's a lot of work to be done here. There are a lot of things we could talk about. I appreciate the opportunity to be here, and I look forward to your questions.

Chairman Richard Hudson (R-NC)SPEAKER_09

Thank you. Ms. Galante, you are recognized for 5 minutes for your opening statement.

Laura GalanteSPEAKER_06

Thank you. Telecommunications fail. Okay. All right. Good morning, Honorable Chair, Ranking Member, esteemed members of the committee. Thanks for the opportunity to testify. I'm Laura Galante. I served as the intelligence community's cyber executive and the director of the Cyber Threat Intelligence Integration Center at ODNI. I was also the intelligence community's lead for what's called the Unified Coordination Group, which responded to Salt Typhoon. Saal I'll focus my remarks today on the national security considerations for the U.S. telecom sector, whose growth has closely mirrored the digital transformation of our economy. Over the past 25 years, telco companies have evolved from phone service providers to complex, multi-service digital organizations navigating the convergence of communications, media, and technology. As with so many major digital shifts during this period, intelligence services have also become increasingly adept at targeting the immensely valuable data that telcos manage through their vast networks of digital roads. In short, companies in this sector have become key targets for foreign adversaries' operations. This leads us to the recent Chinese government-sponsored Operation Salt Typhoon, regarded as the most expansive and consequential cyber espionage ever conducted against the U.S. Sponsored by the Chinese government and executed by contractors working for Beijing's Ministry of State Security, their intelligence bureau, this operation was first publicly detailed last fall in 2024. At least nine U.S. telcos, that number was again confirmed by the FBI yesterday, and wireless communication companies were the victim of this extensive intelligence-gathering operation. The actors breached multiple layers of major telecoms networks. They gained unprecedented access to U.S. mobile communications across different carriers and various wireless technologies. The access enabled them to compromise voice and text communications of key political figures and national security officials. Salt Typhoon gives us a window into three major issues. The first is the increased scale of adversary intelligence operations. Rather than focusing just on the communications of specific high-target individuals, what these Chinese actors did was they went after multiple data and access points through different victim companies in order to have this broad-scoped approach and a persistent intelligence capability to get after high-value information for a period of time. This wasn't a smash-and-grab, in-and-out type of cyber operation that we saw for years in the past. This was much larger. Second was the delayed detection of Salt Typhoon across the sector. Despite the telcos' significant cybersecurity programs, detecting Salt Typhoon required and still requires an extensive joint government and industry effort to respond. The ability to detect and then rapidly remediate and respond to these compromises against our most high-value networks, which we've all discussed, must be a core capability for companies in the sector. Third is that AI is rapidly expanding our adversaries' ability to process data. Rapid breakthroughs in AI have now equipped these actors with the capability to make sense of large and disparate datasets that previously required immense amounts of time and resources to understand what the data they collected meant and what to do with it. AI has supercharged their ability to analyze this. These capabilities enable even less sophisticated actors, we've been talking about highly sophisticated ones with China, but now less sophisticated actors will be able to extract key insights from vast amounts of data collected in different sectors and different industries. The hard question that this committee faces is how to strike that balance between securing these digital roads in everyday life with the enormous and growing demand for digital connectivity. We're not going to regulate our way out to find an enduring answer. The technology changes too quickly. The ingenuity of our adversaries is relentless. We have to build a better dynamic operational security model than what we have today. That model requires bringing threat intelligence and national security expertise, the intelligence community, together with private sector representatives in the telco and secure technology sectors. This intelligence-driven approach is what will drive an operationally sound set of practices that companies can continue to implement and refine in their own infrastructure. The good news is we've done this before. One of the mechanisms available to drive this process until it was dissolved last month was called the Enduring Security Framework, founded in 2007. Implemented by the National Security Agency along with the Office of the Director of National Intelligence and then DHS's CISA's Critical Infrastructure Partnership Advisory Council, this framework proved successful enough that British intelligence and Australian intelligence used it as their model for their national cyber centers. In this model, security practitioners in government and industry alike used this to come up with dynamic processes about how you re-architected secure infrastructure for the future. Other boards that have also been dissolved, including the Cyber Safety Review Board, also worked to get to root causes of hard security and technical problems, and they investigated major cyber incidents like Salt Typhoon. These are the joint efforts that created evidence-based approaches to address major security breaches and threats in coordination with the private sector who owns the critical infrastructure in this country. This collaborative security and intelligence work has been America's differentiator in our global secure technology market. It's an ecosystem of security professionals, intelligence officials, analysts, and operators who work together to track vulnerabilities and threats as quickly as they spread, and that's fast in cyberspace, and deploy the patches and fixes and new security paradigms that we need to stay ahead of these threats. Dismantling this security ecosystem weakens our collective defense and our national security posture. It's not a risk we can afford at this moment. I look forward to your questions.

Chairman Richard Hudson (R-NC)SPEAKER_09

Thank you. We'll now begin questioning. I recognize myself for 5 minutes. Mr. Jaffer, I represent, as I mentioned, Fort Bragg. We like to call it the epicenter of the universe, home of our Special Forces and Airborne. Why is maintaining the security of our communication networks essential to protecting our warfighters and our national security, especially as it relates to our adversaries, as you mentioned?

Jamil N. JafferSPEAKER_13

Well, Mr. Chairman, it's hard to overstate how critical it is to protect our global telecommunications infrastructure. It is the backbone on which everything else runs, whether it's warfighter activities, communications with families and spouses, and the collection and analysis of all of our intelligence. While we do have highly classified systems that run on separate networks, that communications grid is connected. And if we don't— if that communications grid doesn't operate, it simply doesn't work. And fundamentally, our entire economic system turns on this global telecommunications infrastructure as well. The United States is so successful, particularly because we built the system. It runs on our equipment, it runs on our capabilities and that of our allies. And the day it doesn't, and as it has transitioned over to equipment run by adversaries, the more vulnerable it's become, the less secure we become, the less secure our warfighters are, and the less secure our entire economy is.

Chairman Richard Hudson (R-NC)SPEAKER_09

Appreciate that. Mr. Stehlin, do you have anything to add to that?

David StehlinSPEAKER_11

I would 100% agree with everything that's going on there. We do need the public-private connection to make sure we address this. Everything we do from the military to our home lives uses ICT networks, and fundamentally they're all based on the same set of technologies. And architectures, and we have to verify that those technologies and architectures are secure.

Chairman Richard Hudson (R-NC)SPEAKER_09

Emerging technologies have the potential to both enhance cybersecurity of our networks but also threaten their security. It's kind of a double-edged sword. Mr. Stroup, in your testimony, you talk about how AI can be harnessed to do vulnerability testing. Can you tell us more about how this is being deployed in the satellite industry?

Tom StroupSPEAKER_15

Yes, thank you for the question. There are a number of ways in which it's being deployed. First is for anomaly detection, being able to identify if there is a different type of data that is coming into a network, being able to identify that in advance. Another is being able to take advantage of cybersecurity enhancements, being able to detect and respond to threats in real time, also being able to address signal jamming detection and mitigation. And then finally, I'd also like to emphasize it's important in space situational awareness. There are so many objects in space, and the opportunity to be able to identify, analyze, and determine whether they're going to pose a risk— a threat or risk to satellites— are one of the uses of AI.

Chairman Richard Hudson (R-NC)SPEAKER_09

Appreciate that. Mr. Jaffer, how can AI be used in the communications networks to enhance security?

Jamil N. JafferSPEAKER_13

Look, there's a lot of opportunities we have. These LLMs can identify threats and vulnerabilities. We just saw in the last few months the discovery of brand new vulnerabilities that we weren't aware of, discovered by LLM models running over network data, right? So there's a big debate about will AI improve the attacker more or improve the defender more? And I actually think it's a mixed bag, right? In some ways it will definitely, as Ms. Galante pointed out, enable attackers who don't have capabilities today to have more capabilities. At the same time, the defender will have an edge as well because they'll be able to get ahead of the threats, identify vulnerabilities, cut them off at the pass, and go after the attackers. So while the offense, like in football, always has a little bit of an edge, right, and AI will enhance that, AI is going to enhance defenders as well. And its expanded use and ensuring that we don't overregulate it and crush it with unnecessary regulation will ensure that we maintain the edge. The reality is our adversaries are going to use it on the offense. If we overregulate it and don't use it on defense, we will fail.

Chairman Richard Hudson (R-NC)SPEAKER_09

I agree. Mr. Stehlin, economic security is national security, and one of President Trump's top priorities is reshoring American manufacturing. As the United States continues to reshore critical manufacturing and expand domestic data center capacity, secure high-speed connectivity will be essential. What specific policy actions do you believe are necessary to ensure our communications infrastructure can meet these increasing demands without compromising on supply chain security or network resiliency?

David StehlinSPEAKER_11

Yeah, two things come to mind. First of all, we need to reshore as much as possible the active components that make up our ICT networks, whether it be a core router or a base station or even a home IoT device. These devices have semiconductors which are not made for the most part in the United States. Major security shortfall. That is not something that can change overnight. It's something that'll take a long time and it's not only the moving the fabs and things like that back here, but it's the whole ecosystem moving that back here. And that's why many parts of Asia are successful in this area, because the whole ecosystem is closely located to each other. So that whole supply chain needs to be both closely located with each other, but also based in the United States. That's a fundamental strategic change and a long-term investment that we need to make. And I would refer back to something I mentioned before, supply chain security. You have to ensure that the supply chain itself is secure, not only that ecosystem, but all the devices that make up a product. And the only way to do that is ensure that the processes that are used to make a product are verified to be trusted. So that's something that this standard does, is it verifies trust. You have to verify it before giving trust out.

Chairman Richard Hudson (R-NC)SPEAKER_09

Got it. Thank you. My time has expired. I'll now recognize the ranking member, Ms. Matsui, for 5 minutes to ask her questions.

Ranking Member Doris Matsui (D-CA)SPEAKER_21

Thank you very much, Mr. Chairman. This Salt Typhoon attack exemplifies how expansive cyber operations against the U.S. have become. In an increasingly digital era where artificial intelligence and emerging technologies can increase the capabilities of bad actors, we must address how America stays ahead of our adversaries. Ms. Galante, what is the most pressing issue this committee must resolve to prevent major cyberattacks like Salt Typhoon?

Laura GalanteSPEAKER_06

Mature security programs in cyberspace are really important for major organizations, especially in the telco sector, to continue to refine and improve. There are some basic pillars of what a strong security program looks like: identity and access management, the tools and infrastructure to make sure they can look at their network and really log events that are happening, incident preparedness, risk and governance, and then their third-party vendor risk, which has been articulated quite a bit, and how to manage that. But one of the key performance measures that I look to when I'm talking with CISOs, Chief Information Security Officers, and others who have to secure these networks and are in charge of that edge of American security and competitiveness is their time to detect malicious activity and their time to respond. And it's those two measures that are key that we drive across critical industries like this so that we aren't caught with multi-year major operations that have the scale and impact like Salt Typhoon.

Ranking Member Doris Matsui (D-CA)SPEAKER_21

Okay. Now, you mentioned CISA, and, obviously, it provides crucial support also to the states and localities at the front lines for protecting critical infrastructure. Now, what does this administration risk when it downsizes our federal cyber workforce and puts more burdens on states and local agencies?

Laura GalanteSPEAKER_06

Cybersecurity is inherently a federal issue. The internet doesn't know state boundaries, to put it mildly. And what CISA does and what other federal cybersecurity and national cybersecurity agencies do is they're able to articulate the risk to networks out in states, critical infrastructure providers, energy companies, banks, and get that information out to them so that they can employ it in their security programs. We have to take a federal approach to do this because inherently the threat is one that goes after us at a national level Okay .

Ranking Member Doris Matsui (D-CA)SPEAKER_21

Now, I think this was mentioned before too, but as more smart devices known as the Internet of Things are adopted into Americans' homes, we need to help consumers make informed choices and decisions about the technology products that they purchase. Those interconnected smart devices can be an entry point also for cyberattacks. That's why I've supported steps like the FCC's U.S. Cyber Trust Mark, a labeling program that identifies trustworthy and secure products in the marketplace. Ms. Galante, how do voluntary measures like this instill trust and security in our technologies?

Laura GalanteSPEAKER_06

I like the Cyber Trust Mark program a lot. If people haven't seen it yet, it is a sticker, it's a badge and a QR code. And what it is is it's a shorthand to the consumer that says the product that you're buying here has a security management program behind it. It's going to get patched. There's going to be data protection, some of the key standards that we want behind that product. It's a little bit like when you turn your microwave around and there's that metallic sticker that you can't pull off that says you can plug this in and you're not going to get shocked. It's the same concept for interconnected devices. I think it should catch on.

Ranking Member Doris Matsui (D-CA)SPEAKER_21

Okay, great. And talking more about standards, I've long championed that the U.S. leadership in global technology standards and that the next generation reflect American values, including open markets, transparency, and democracy. Mr. Stehlin, you mentioned SCS 9001. It's a supply chain security standard for information and communications technology industry. How can this and other standards ensure communications infrastructure is resilient against attacks from malicious actors?

David StehlinSPEAKER_11

Yes, 9001 uses looking at not only the vendor or the supplier of the equipment—is it a trusted vendor?—but it looks at the hardware and the software used in a product. Every single product out there uses open-source software, for example. Yeah How do we trust that that open-source software is coming from an organization that can be trusted? Is there provenance that we can prove? Can we do things like incident management and move more quickly? We need to speak in one voice when it comes to cyber and supply chain security. And SCS allows the ability for both public networks and private networks to do so all the way down to IoT devices like the FCC is working on with the cyber labeling program.

Ranking Member Doris Matsui (D-CA)SPEAKER_21

Well, I consider that very important. The standards that we set in our country for U.S. leadership, in particular because we understand that the actors, the unfortunate actors that are against us, are going to be going out there and doing their own thing. I want to talk more about— oh, I think I'm out of time already, right, Mr. Chairman?

Chairman Richard Hudson (R-NC)SPEAKER_09

Time flies when you're having

Ranking Member Doris Matsui (D-CA)SPEAKER_21

fun. But I will follow up later. Okay, thank you very much.

Chairman Richard Hudson (R-NC)SPEAKER_09

Thank you. Now I'll recognize Dunn Dr. Dunn from Florida for 5 minutes to ask your questions.

Rep. Neal Dunn (R-FL)SPEAKER_07

Thank you very much, Mr. Chairman. You know I would say that Americans have every form of technology at their fingertips for broadband deployment, fiber-optic cable, fixed wireless, and particularly important where I live in rural Florida is satellite systems. Historically, our country's done very well. They've done a stellar job, in fact, at building our telecoms infrastructure, and I think that under U.S. leadership, that industry is flourishing. Despite many challenges, the marketplace is providing responsive, innovative capabilities for commercial use, research, intelligence, and national security. But to sustain that dominance, we must invest in the infrastructure necessary to continue that rapid expansion in the future. That's just basic infrastructure investment. Accordingly, this week Representative Carbajal and I are reintroducing the bipartisan bill, Securing the United States Leadership in Space Act, which enables the tax-exempt status of private bonds on FAA-licensed spaceports. Pretty basic stuff, it's like highways and seaports and whatnot. What makes this bill impactful is that it empowers the growth of the spaceport infrastructure that is so essential to a nation's enterprise to be funded more by private capital than, in fact, by the taxpayers, and this plays into the strengths, of course, of the U.S. system in our competition with China. As a member of this committee for many years, I've continued to work on legislation to streamline and secure our telecoms networks. Last year, Congress passed and the President signed into law with my friend Darren Soto the Launch Communications Act that addresses the satellite launch communications spectrum, so very outdated regulations at the FCC, and they're currently implementing those now. This year, we'll continue to prioritize that, all those efforts. Mr. Stroup, do you believe that the tax-exempt bonding rights for our spaceports can help secure U.S. leadership in space and space infrastructure and engage the private markets? Does that help the taxpayers?

Tom StroupSPEAKER_15

Yes, our industry is most dependent upon spaceports, and having access to as many spaceports as possible will benefit the industry. So while SIA does not represent the spaceport industry, our members are very dependent upon them.

Rep. Neal Dunn (R-FL)SPEAKER_07

So, I'm from Florida. We have at least as many spaceports as most states, and I'm very pleased with that. I sat on the board of Space Florida for a number of years. I'm really, really proud of the efforts in our state on that. Again, Mr. Stroup, you mentioned in your testimony access to sufficient spectrum resources is necessary to secure infrastructure. Can you briefly elaborate on this and share what kind of spectrum authorities you think would make the most sense right now for space industry?

Tom StroupSPEAKER_15

Yes, our industry is growing substantially. As an example, approximately 10 years ago we had about a thousand operational satellites. Today that number is over 12,000. That's just to give you a sense of the growth in the industry. We provide a wide range of services, and we're increasingly expected to share spectrum with other industries. In some cases, it's the wireless industry. The satellite industry, for a long time, shared spectrum amongst itself, as well as with some other terrestrial users, such as microwave systems. But there is a continuous effort to get more spectrum not only from the satellite industry, other growing industries like the wireless industry. So we are in a competitive environment just amongst ourselves, meaning those that use spectrum, but also in a global environment. And so, seeking to have access to additional spectrum via the ITU process, I might note that the next WRC, which is taking place in 2027, over 85% of the issues that are on the agenda are space-related, many of them giving us access to additional spectrum. So specifically relating to the ITU recommendations, seeking that the United States take the leadership position, as well as making additional spectrum available within the United States.

Rep. Neal Dunn (R-FL)SPEAKER_07

Well, thank you for that. I spent a lot of time speaking, on focusing on space, but let's be honest, there's a lot of information flowing through the fiber optic cables. And in the few seconds left to us, I'm hoping Mr. Stehlin can address the resilience of the cables, undersea cables. What can we do to protect these things? We've read nothing but interruptions of these cables lately. Seems like anybody with a motorboat can interfere. Can you give us some confidence?

David StehlinSPEAKER_11

First of all, it's— there are somewhere in the range of 600 cable— undersea cable systems around the globe, 1,700 landing points. More landing points will help for sure. More repair ships, very much needed. If you— if it takes a month or two to find a repair ship, you have a problem. So we need to rebuild the whole shipping side of things.

Rep. Neal Dunn (R-FL)SPEAKER_07

Well, thank you very much, Mr. Chairman. My time has elapsed, but I would love to talk to these people for the rest of the day. Thank you.

Rep. Rick Allen (R-GA)SPEAKER_10

I thank the gentleman for yielding. Now I'll turn it over to Ranking Member Pallone for 5 minutes for your questioning.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

Thank you, Mr. Chairman. As I mentioned earlier, it's critically important that our country's telecommunication networks have the capabilities to effectively defend against foreign adversaries and other bad actors. But given the Trump administration's mishandling of sensitive information on Signal and Musk and DOGE's access to sensitive government information, it's clear that it's not just our telecommunications infrastructure that needs updated security standards and protocols. So I wanted to ask Ms. Galante, are Signal, Gmail, and other commercial services the proper channels and tools for government officials to use in making national security decisions?

Laura GalanteSPEAKER_06

National security decisions and deliberations from our adversaries' standpoint are intelligence gold. This is what they seek out. And it's for this reason that we've got classified communications channels.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

Okay Now under— I have a bill, bipartisan bill, the Secure and Trusted Communications Networks Act, and the FCC must place communications equipment or services that have been deemed a national security threat on its covered list, which effectively removes the equipment or services from our country's supply chain. So again, Ms. Galante, will broadening the types of communications technology that can be placed on the FCC's covered list help us better secure our country's telecommunications networks and data from foreign adversaries?

Laura GalanteSPEAKER_06

The FCC's Covered List goes a long way to give predictability and clarity about what products are insecure and what technologies shouldn't be used in our telecommunications technology.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

Okay. And I, you know, the frequency of cyberattacks on our telecommunications networks I think shines a bright spotlight on the amount of personal data that these networks carry day in and day out. And it's imperative that our networks have strong security protocols in place so that our data is not an easy target for our foreign adversaries. But let me issue again— or let me issue this question. What types of capabilities should be built into our telecommunications networks to ensure they can successfully protect our data from the increasingly sophisticated cyberattacks and espionage we see from foreign adversaries? If you— if there's time, I'd ask the others the same question.

Laura GalanteSPEAKER_06

Telecommunications networks are incredibly complex. They're dealing with a stack of technologies that ranges from literally the ground up. And these are tough to secure, and they require really advanced security programs to do it the right way. Two of the measures that a secure program should be looking for, though, in how they perform, how the people and the tools and the team around this work, is their time to detect malicious activity and their ability to respond to it quickly. And the faster both of those things can happen, the more secure the program is going to be and the more resilient our entire sector will be.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

Okay. I wanted to ask others to comment on it, but I'm still not sure. When I asked the first question about Signal and email, and you said that I asked whether those are commercial services or the proper channels for government officials to use in making national security decisions, what was your response again?

Laura GalanteSPEAKER_06

Classified channels are the right place for national security deliberations.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

And these are not?

Laura GalanteSPEAKER_06

These are not classified channels. Okay.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

All right. Anyone else want to comment on the types of capabilities that should be built into the networks? We've still got another Yes. Yes,

David StehlinSPEAKER_11

sir. We should look at the entire makeup of the vendor base. It's one of the challenges we have around the world is as we try to bring Western technology to friendly countries, we know that the Chinese will and and have for years worked their way in there by offering way underpriced product, offering the ability to to fund the development and management of these networks. And then they work really hard with the legislative branch of many countries around the world. We have an uphill battle. And one of the challenges we have is as China has often sold products way under cost, it's put so much pricing pressure on Western technology that R&D investment has gone way down. So the things we can do to help R&D rebuild in the United States would make a big difference.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

Anyone else want to comment?

Jamil N. JafferSPEAKER_13

Mr. Ranking Member, I think the other important thing to keep in mind is that the government has a role to play here too. The government needs to partner tightly and collaborate with industry to defend against these threats. If we leave the private sector alone to defend against these threats, we will fail every time. These private sector companies are not in the business of defending against cyber threats. They're in the business of providing telecommunications services and capabilities to our citizens, to our allies, and to partners around the globe. And so if they're going to do it effectively, the government has to take the information it knows about and has. For example, in the Salt Typhoon case, it turns out we found out 5 days before the administration ended that we had detected the Salt Typhoon attackers on U.S. government networks, hadn't realized who they were, and hadn't shared that information. It's almost like before 9/11 where we knew the attackers, some of the terrorists were in Malaysia, in Kuala Lumpur, the CIA saw them there, and then didn't bother to tell the FBI. That is a massive, massive failure of the government to do its job, to share information with industry, help industry protect itself, and take accountability for the fact that we had that information, didn't know what to do with it.

Full Committee Ranking Member Frank Pallone (D-NJ)SPEAKER_24

Well, thank you. Thank you, Mr. Chairman.

Rep. Rick Allen (R-GA)SPEAKER_10

I thank the gentleman for yielding, and now I recognize myself for 5 minutes for questioning. I want to thank our expert witnesses for joining us here today. As home to the Army Cyber Command in Augusta, Georgia, my district is a hub for cybersecurity expertise. And we hear significant concerns about federal agency roles and regulatory burdens hindering our ability to secure critical infrastructure. Mr. Jaffer, and you've already started to comment on this, cybersecurity professionals in my district highlight confusion over which agency, CISA, the Department of Defense, FCC, or others, has primary jurisdiction over securing critical infrastructure, which would include telecommunications, satellites, and undersea cables. This lack of clarity can impede responses to threats like, you mentioned, the Salt Typhoon breach. Mr. Jaffer, how are the roles of CISA, DOD, and FCC currently defined, and what steps can reduce confusion to enhance coordination and protect our infrastructure?

Jamil N. JafferSPEAKER_13

Well, thanks, Mr. Vice Chairman. The challenge here is that there is no one agency in the government today responsible for defending our entire global cyber infrastructure, the US's, which we have built around the globe. And the problem is that if you expect private industry to do it, it won't succeed. If you don't task somebody in the government, give them the resources and authorities to do it, it won't succeed. Now, in theory, we've said to US Cyber Command, it's your job to defend the infrastructure against nation-states. But of course, US Cyber Command isn't resourced, doesn't have the authorities, and I'm not sure there's a consensus amongst Congress and the administration about whether the Department of Defense should do that defense. And in the absence of that consensus, the only way in which we can have the government work effectively with industry is to share information at scale. We have legislation today, the Cybersecurity Information Sharing Act that was passed in 2015, set to expire in the next few months. That needs to be reauthorized. But more importantly, we need to actually incentivize the sharing of information. We passed that authority, but we didn't provide the necessary regulatory and liability protections to encourage industry to actually share. And so their lawyers are telling them, do the minimal amount necessary. What you want to do is you want to line up boards of directors, you want to line up the lawyers, and you want to line up industry with government. Government wants information, it has information. Both need to share. Neither are doing it effectively because the incentives aren't there. And the government says, well, we're not going to share all classified information with industry. Well, if we're not going to do it, no one's going to do it. They're not going to know what the threat is, they're not going to defend well, and then we'll all be looking back and saying, why didn't they defend themselves better? And we'll have no one to blame but ourselves.

Rep. Rick Allen (R-GA)SPEAKER_10

Thank you, sir. The Cyber Incident Reporting for Critical Infrastructure Act aimed to streamline reporting to CISA, yet stakeholders note persistent issues with the duplicative requirements across other agencies, including varying definitions and timelines, the very things that you're talking about, inconsistent incident definitions like substantial loss versus potential adverse effects, and a lack of reciprocity diverting resources from mitigating threats like those from the Chinese Communist Party. Mr. Stroup and Mr. Stehlin, how do these challenges impact the communications sector's ability to secure infrastructure, and what can the FCC's new Council for National Security do alongside CISA to harmonize reporting, standardize definitions, and establish reciprocity to strengthen resilience? Mr. Stroup.

Tom StroupSPEAKER_15

Thank you for the question. So, most satellite systems are dual use, and as a result, many of the issues that we're talking about are addressed through our supply chain because, for a long time, the security of supply chain has been important. There's a certification process that satellite companies need to go through in order to provide service to the U.S. military. But I think that getting to the cybersecurity issue in terms of sharing information, I think that the key is that the points that have been made by other members of the panel today, ensuring that there is a means of sharing the threats, giving companies an opportunity to address it, and whether that's done through CISA, the FCC, I think making sure that there is a single point where members of our industry and other industries have access to that information is key to being able to address them.

Rep. Rick Allen (R-GA)SPEAKER_10

Mr.

David StehlinSPEAKER_11

Stehlin Thank you, sir. Yeah, I would agree. We have to speak in one voice. We have to send clear messages across the country for— on both the public and the private side. We have to send clear messages to our international partners that we speak in one voice. And then we have to use things like benchmarking and continuous improvement to to measure how we're doing and how we do things like incident reporting. How do we do more quickly deal with problems like that to more quickly identify these incidences and to fix them?

Rep. Rick Allen (R-GA)SPEAKER_10

Good. Well, I hear that we've got to centralize this issue and we've got multiple agencies involved. Thank you so much for sharing your expertise with us. Now let's see, who do we go to next? Representative Soto, I yield to you 5 minutes for questioning.

Rep. Darren Soto (D-FL)SPEAKER_02

Thank you, Chairman. From satellites to cellphones, Wi-Fi to the internet, there's so much information, communications, commerce, learning, telehealth, streaming, and other daily activities that go through our telecommunications system. We saw with SolarWinds, Salt Typhoon, and other cyberattacks, these were a huge warning across multiple administrations. And we're going to continue to work with you all on resiliency. Unfortunately, we still can't protect ourselves from stupidity, as we see with the SignalGate scandal. But there have been efforts under the CHIPS Act with $3 billion for rip and replace to help with both U.S. telecom manufacturing, microchip manufacturing, and trying to replace a lot of the this equipment made in China that we have no faith in anymore. U.S. telecom equipment will strengthen our network against attacks. Mr. Stehlin, we've seen some increase in manufacturing in the U.S. for telecom equipment and microchips. How's it going so far, and what can we do to improve it?

David StehlinSPEAKER_11

I would say at best it's going okay. We have a long way to go. As I mentioned before, this is a strategic, multidecade change that has to occur. We have to build the whole ecosystem for the supply chain for the ICT networks. Fundamentally, 50 to 60% of the cost of every active device is the chip itself, and those chips are not made in the United States. And if we can solve that problem, we'll go a long way to having much more success in rebuilding our infrastructure, making sure that it's secure, and also adding jobs. And since you're from Florida, sir, I want to mention that we recently started a program called Broadband Nation, which is a program to attract, train, and deliver the next generation of talent in the broadband space, from cybersecurity to installers. And the State of Florida is the first to sign up with us. So, we're working with Miami Dade College, the Secretary of Commerce in Florida to help push this across your state.

Rep. Darren Soto (D-FL)SPEAKER_02

Well, we're thrilled about that. I realize as we're doing U.S. manufacturing, there's still going to be some inputs from abroad, whether it's metals or other things. How are tariffs affecting our ability to bring back and manufacture telecom equipment?

David StehlinSPEAKER_11

Tariffs will only raise prices. At the end of the day, that's the problem. Fundamentally, it makes sense to find ways to bring things back to the U.S., but if over a long period of time those prices are raised, fewer networks are going to get built, and that's a problem.

Rep. Darren Soto (D-FL)SPEAKER_02

And how would a potential recession affect investment to bring more manufacturing back? We saw a negative first quarter, first one since 2022. Do you see investments slowing, or are things moving along steadily?

David StehlinSPEAKER_11

Haven't seen investments slowing yet, but fundamentally that's an issue. As somebody that's run a publicly traded company, I recognize that CapEx is critical, and that's one of the first things that you want to squeeze is CapEx.

Rep. Darren Soto (D-FL)SPEAKER_02

Mr. Stroup, we're proud to have Cape Canaveral in Central Florida. I'm, you know My colleague Dr. Dunn mentioned already the Launch Communications Act that we passed last term. We've seen 34 launches so far, mostly for satellites, right? What are some of the strengths and advantages of satellite internet against cyberattacks?

Tom StroupSPEAKER_15

Thank you for the question. I think that one of the key strengths of the industry is that the number of companies that are providing service and the ability to be able to provide service from multiple paths. Most satellite companies have multiple satellites, whether they're in GEO or non-GEO orbits, and as a result, If there's an attack on one of them, one of the satellites, there's an ability to be able to provide service from another satellite. In many cases, companies are also— have also deployed multi-orbit capabilities, so they're bringing to bear service from both GEO and non-GEO systems. And of course, it's not just the satellites that are key in making this work. Terminals that operate across multiple operate— multiple operators, multiple frequencies are some of the means that the industry has to be able to address those kinds of attacks on their systems.

Rep. Darren Soto (D-FL)SPEAKER_02

So you mentioned that hive technology where if you take out one satellite, the rest still operate as a network. We've seen that be a strength so far in some areas like in Ukraine. Ms. Galante, we saw the review board for cyber safety terminated before the end of the Salt Typhoon investigation. What effect does this have on learning from what happened with that cyber hack?

Laura GalanteSPEAKER_06

The Cyber Safety Review Board functioned like the National Transportation Safety Board, and that it root-caused major cybersecurity incidents to figure out what went wrong and then build a path towards a better remediation plan for others to learn from. Cutting off that investigation into Salt Typhoon early really limits the telco sector's ability to understand from all the different sides of the house, the intelligence side, law enforcement, and then victim networks, how we can improve. So it really shortchanges our national security to not have that investigative board available to learn from.

Rep. Darren Soto (D-FL)SPEAKER_02

Thank you. My time's expired.

Rep. Neal Dunn (R-FL)SPEAKER_07

Thank you, Mr. Soto. Appreciate your line of questioning. He yields back, and we recognize Representative Latta for 5 minutes of questions.

Rep. Robert Latta (R-OH)SPEAKER_03

Well, thank you very much, Mr. Chairman, and thanks very much for our witnesses for appearing today. Mr. Stehlin, we know that communist Chinese-flagged vessels have been suspected in cutting undersea cables across the the globe, but particularly those connected to Taiwan. Taiwan has reported five cases of seabed cable damage this year alone, compared with just three each in 2023 and '24. Is the answer to this growing problem more cable redundancy, or are there other technologies that can provide more reliable communications in the case of a coordinated attack?

David StehlinSPEAKER_11

Thank you for that question, sir. The answer is more redundancy. We're not going to find a way to find a more efficient and bandwidth-capable technology than fiber optics. So there are 600 or so cable systems, subsea cable systems, in operation today. On average, 200 are damaged per year. And the great majority of those are Mother Nature or an anchor, something like that that's just an accident. But more and more, as you say, are coming from nefarious actors. It could be the Taiwan Strait. It could be the Baltic Sea. We've seen those in the past 6 months or 12 months. And it takes a long time to first find the problem, where is the break, and then fix it. And as I mentioned earlier, we don't have enough ships out there to fix. One of the three biggest repair and installation companies is called WMN Technologies, which used to be called Huawei Marine Networks Technologies. So they're the ones that drive a lot of this activity in the Far East. In the U.S., we have SubCom, and in Japan, we have NEC as other examples for friendly countries. But this is a big issue that needs to be addressed. More redundancy, yes, but we've got to find ways to more quickly repair issues.

Rep. Robert Latta (R-OH)SPEAKER_03

Just a quick follow-up on what you just said. How long does it take to usually fix a cable?

David StehlinSPEAKER_11

A subcable, depending on where it is, if it's close to the shore, it's a lot quicker than if it's in the middle of the ocean. So it could take upwards of 2 months.

Rep. Robert Latta (R-OH)SPEAKER_03

Thank you. Yeah, let me follow up. You know, I've been really impressed by the technological innovation that's happened in the last several years as it relates to the internet and cellular connectivity using satellites. Are satellites at a point that they can provide backup for large amounts of data processing in the case of widespread physical cable outage? Just a quick follow-up.

David StehlinSPEAKER_11

Sure. Satellites can certainly help and support, but the bandwidth capability and the latency, low latency of fiber cables can't be replaced.

Rep. Robert Latta (R-OH)SPEAKER_03

Okay, thank you. And I hope I pronounce it— is it Galante? Galante, I'm sorry. Ms. Galante, I'm always I've really been alarmed when a business in my district says that they've had their cybersecurity handled because and hit because of bad actors. And they're always changing tactics and becoming more increasingly skilled at targeting our networks. As soon as you get one thing done, you find out somebody's figured a way around it. Many small businesses, and particularly small telecommunication companies in my district and across the country, are unlikely to have in-house personnel, let alone teams of professionals with cybersecurity expertise. You say in your written testimony that we can't regulate our way to securing our digital networks. So what role can the federal government play in ensuring that the private sector has those tools to secure our communications infrastructure?

Laura GalanteSPEAKER_06

I think we need a focused effort with telco security companies, and that's really a range of different types of companies, to focus on what the goals need to be for their specific technology stacks and systems. We've done this in a large way in the banking sector and also in the energy sector. In both of those areas, there's a level of predictability and an increased ability to find malicious activity and remediate it quickly. Those performance measures are what we need to implement and think through and make real for implementation with these variety of companies in the telco sector.

Rep. Robert Latta (R-OH)SPEAKER_03

Thank you. Mr. Stehlin, going back to you, I have legislation on the ROUTERS Act, which passed the House earlier this week, to study the threat of certain routers built by our adversaries. What should we be looking at to make American-made or routers made by our allies a better choice?

David StehlinSPEAKER_11

We need to eliminate those that are bad choices, first of all. And we have to do quick evaluations of those companies and their history and the products that they develop and remove those bad choices from the consumer. Probably there's an investigation underway right now for a company that is probably a bad choice but is the most frequently used home router out there.

Rep. Robert Latta (R-OH)SPEAKER_03

Well, thank you very much, Mr. Chairman. We have a lot of work to do in this area, and I want to I thank our witnesses for appearing today, and I yield back the balance of my time.

Rep. Neal Dunn (R-FL)SPEAKER_07

We thank the Chairman for his comments, and we recognize the gentlelady from Michigan, Representative Dingell.

Rep. Debbie Dingell (D-MI)SPEAKER_12

Thank you, Mr. Chair. This committee has led bipartisan efforts to secure our communications networks, strengthen resiliency, and work closely with both federal agencies and industry. We know threats are evolving and that we've got to continue to adapt. And now is the time to address additional risks across our communications technology networks, from vulnerabilities in our global supply chains and weaknesses in domestic critical infrastructure to the risk emerging from new technologies now maintain— mainstream in sectors like the automotive industry. To meet this moment, we must boost competition, continue to invest in domestic innovation and manufacturing, and ensure the integrity of systems Americans rely on daily, from wireless networks to broad— to broadband and cloud infrastructure. We're also seeing growing national security concerns from companies like BYD, a leading Chinese EV manufacturer, and DeepSeek, an emerging Chinese AI firm, raising alarms about how data is collected, transmitted, and exploited. We have to be proactive in addressing this. We've got to secure our critical infrastructure to ensure we outpace those who seek to undermine our national security and exploit our vulnerabilities. And we must also ensure that our government officials are using basic security protocols for national security matters, as we've discussed, instead of commercial apps like Signal and Gmail. But, Ms. Galante, as all of you know, China doesn't play by the rules, especially in the auto sector. China's propped up electric vehicle and battery manufacturers with state subsies— subsidies, allowing them to undercut global competitors, flood international markets, and distort competition. This not only threatens American jobs and undercuts domestic manufacturing, but it also raises serious concerns about the security and integrity of connected vehicles. As connected vehicles collect vast amounts of sensitive personal and location data, as well as the autonomous vehicles do that they're testing here, how can we ensure that foreign adversaries, especially those with ties to China, are not exploiting these technologies to access and misuse American data?

Laura GalanteSPEAKER_06

Thank you, Congresswoman Dingell. Really appreciate your question on connected vehicle security. This is a critical area, and you can't think of one where there's more of a combination of data privacy issues, potentially GPS and other location security needs, in addition to all of the different metrics that are used and will increasingly be used to have these autonomous vehicles and connected vehicles work. Security is critical here, and we can't tack it on after the fact. We've got to build this in, in what we call in the security industry, by design, security by design. And one of the engineering principles that has to be at the center of how Detroit and others are focused on security in this area is called DevSecOps, development security operations, right? We need to make sure that we've got the minds across companies and across this sector who are focused on the security implementations working together on this. And the security concerns need to outweigh some of the competitive concerns here because a secure auto industry is good for America, and it's good for our allies as well. We have to be the leaders on that, and we need to take it from the design level up.

Rep. Debbie Dingell (D-MI)SPEAKER_12

Well, I agree. As you know, I'm working with a group. I've got I'm going to go to a 5G question for Mr. Stehlin very quickly. Can you speak to the importance of beginning now to plan, to invest, and lead in the next generation of advanced wireless technologies?

David StehlinSPEAKER_11

Thank you for that question. Typically, these advancements take a decade. So we are starting to work on 6G, even though 5G has just been rolled out over the past couple of years. One of the challenges is we need 5G to be financially successful, or the CFOs at the big ISPs are not going to want to invest in 6G. So it's really critical that these technologies are successful. It takes a long time to make them strong. But yeah, we are working now on things like 6G that will affect everything from the home to the business to automated cars.

Rep. Debbie Dingell (D-MI)SPEAKER_12

So in 40 seconds, what specific steps should Congress take to better align its efforts to help you and ensure U.S. leadership stays?

David StehlinSPEAKER_11

R&D tax credits. Let's start there. Let's find ways to increase the investment in the United States so that we can spend more money in R&D. That innovation is something that's been a hallmark of our industry. Look at how your price per megabit has come down over the past 10 or 20 years as compared to your cost for kilowatt-hours. We've gone down by 95% because of innovation.

Rep. Debbie Dingell (D-MI)SPEAKER_12

Thank you, Mr. Chair, and I yield back.

Rep. Neal Dunn (R-FL)SPEAKER_07

Thank you, Representative Dingell. We now give 5 minutes to Dr. John Joyce from Pennsylvania.

Rep. John Joyce (R-PA)SPEAKER_08

Thank you, Mr. Chairman and Ranking Member Matsui, for holding today's hearing. Thank you also to our witnesses for agreeing to be present with us. We all know it's no secret that we are living in a world where our communications infrastructure is increasingly at risk. Between cyberattacks from foreign entities such as the Chinese Communist Party to targeted network infiltration, it is more important than ever that the United States is more vigilant and prepared to defend itself against these multiple bad actors. That is why, along with Representative Susie Lee, that I introduced H.R. 2061, the Information and Communication Technology Strategy Act. This important legislation will develop that the Department of Commerce is consistently updating Congress on what needs to be done to adequately secure our communications systems through our supply chains. This will be one step in a long list of necessary actions that the U.S. government needs to be taking to adequately protect our critical networks. Mr. Jaffer, how would you evaluate the readiness of our current telecommunications systems against these identifiable and well-known bad actors? And I will elicit them. Specifically, how are we prepared when it comes to China, when it comes to Iran, and when it comes to North Korea, who we recognize are repeat offenders?

Jamil N. JafferSPEAKER_13

Well, Dr. Joyce, we're ill-prepared. Our telecommunications infrastructure is vulnerable. We know it. Our government is not effective at deterring bad activity by our adversaries, and we're not working together collaboratively to defend that piece of critical infrastructure. There are other pieces of critical infrastructure as well that we're not good at defending, but that's one area where we need to work more effectively as a government and industry together. There are a few things we could do in the immediate term to address some of these issues. One, to your point about supply chains, we know today that we rely massively on China for things like semiconductors, critical minerals. We're seeing it today in the in the tariff wars, where China's cutting us off from critical minerals. We need to develop a domestic and allied capability to extract and refine those. We have critical minerals here in the United States. We have the ability to obtain them for our allies and partners abroad. We simply send 96% upwards of that material in key areas over to China to refine. It makes no sense. The same is true of semiconductors. We see the situation in Taiwan. If we're going to survive on our current technology basis, we've got to be able to defend Taiwan. China's threatening it. It's not clear that if today China were to go across the Taiwan Strait, that the United States would do anything or that we could get there in time to effectively defend our friends in Taiwan.

Rep. John Joyce (R-PA)SPEAKER_08

Mr. Jaffer, can you help me understand a different issue? How has Huawei become the global behemoth that it is today, and what more do we need to do to counter Huawei and the spread of untrusted telecommunications equipment, especially when we see allies and partners using equipment from Huawei?

Jamil N. JafferSPEAKER_13

Dr. Joyce, it's a great question. The way they've obtained this advantage is they've done it on the backs of stolen intellectual property from American companies, including Cisco. They've built routers that look a lot like a Cisco router because they stole that technology. Now, they've improved on it, they've modified it over time, but that's where they stole it from in the beginning. On top of that, they've depended on low-interest loans and no-interest grants from the Chinese government. The Chinese government goes around the globe subsidizing their purchases, giving countries other stuff, other benefits for taking Huawei equipment. And so we've got to compete in a world in which China is acting non-economically to put their surveillance gear in place in allied countries and countries around the globe, not just allies, but partners as well. We can't do that effectively until we partner with our friends who make telecommunications equipment. We don't make a ton of handsets. We make a lot of routers. We make a lot of core network gear. Then we got to get that into those networks. We did rip and replace at home. That's amazing. That's the right thing to do. We've got to do global rip and replace, and that means putting some of our money and incentivizing our manufacturers and giving them the capabilities to go abroad and deliver that capability to our friends the way the Chinese are doing against us with Huawei and ZTE.

Rep. John Joyce (R-PA)SPEAKER_08

Mr. Stehlin, in the moments that are remaining, first of all, thank you for your leadership and your advocacy at TIA. But what specific actions have your member organizations taken to protect themselves against the attacks and strengthen the supply chain?

David StehlinSPEAKER_11

Yeah, so we are and our members are very much focused on the processes that are used to develop new products. It is, as you mentioned a minute ago, a big challenge with companies, companies like Huawei, that undercut us financially, often selling below cost just to win the business and to hang on to it. We need to rebuild our infrastructure here in the U.S. We need to rebuild our vendor base in the U.S., and it starts with the ICT space, specifically with semiconductors.

Rep. John Joyce (R-PA)SPEAKER_08

And I thank you. And I think you, I, and President Trump all recognize that building that infrastructure, that supply chain right here in the U.S. is important and actually paramount for our success. I thank all of our witnesses for being with us here today. And Mr. Chair, I yield.

Rep. Russell Fry (R-SC)SPEAKER_05

Gentleman yields. The chair now recognizes the gentlelady from California, Ms. Barragan.

Rep. Nanette Barragan (D-CA)SPEAKER_19

Thank you, Mr. Chairman. We just heard that it's important to build the infrastructure here, chips made in the U.S., develop a domestic capability. I've kind of heard this. Mr. Stehlin, you brought this up. And this hearing, by the way, is called Securing the Future of Communications Infrastructure. If we repeal CHIPS, if we repeal the CHIPS Act, would that be helpful?

David StehlinSPEAKER_11

No.

Rep. Nanette Barragan (D-CA)SPEAKER_19

Okay. Why would not be helpful?

David StehlinSPEAKER_11

It would not be helpful because we need more capital investment in the United States. It needs to be a strategic investment. I won't address some of the specifics of the CHIPS Act, but fundamentally and strategically, it is critical that these skills be brought back to the United States as quickly as possible.

Rep. Nanette Barragan (D-CA)SPEAKER_19

Well, thank you. I also disagree with the president that we should repeal and end the CHIPS Act. Ms. Galante, in 2017, the San Pedro Bay Port Complex, the busiest in the nation and located in my district in Southern California, experienced a major ransomware attack that forced the shipping company Maersk to halt port operations for several days and ultimately cost the company over $300 million. This cyberattack prompted the port to establish a Cyber Resilience Center, which monitors the port's technology environment and now fends off 80 million cyberattacks per month. Ms. Galante, from a national security standpoint, how vulnerable are ports to cyberattacks from foreign adversaries and other bad actors, especially if cybersecurity has not been prioritized in these sectors?

Laura GalanteSPEAKER_06

Port security is national security, and this area and the technology underneath of it is incredibly reliant on digital technology and ever more so each year. We've also seen—you mentioned a recent ransomware attack. There's been a variety of targeting at ports in the U.S., but also globally. We have to up cybersecurity in this space. Last February, there was an EO on maritime cybersecurity. It put $20 billion into this, and I think that was an important investment, and it gave the Coast Guard additional authorities and responsibilities in cybersecurity. We have to take port security seriously.

Rep. Nanette Barragan (D-CA)SPEAKER_19

Thank you. Cyberattacks often also hit marginalized communities the hardest. Disruptions to hospitals, schools, and public services in communities of color that have already seen less resources and support. In fact, people of color have a 12% greater chance of experiencing some sort of financial damage resulting from a cybercrime incident and are 6% more likely to have their identity stolen. Ms. Galante, what steps should Congress take to ensure our national cybersecurity strategy prioritizes the protection of these vulnerable communities.

Laura GalanteSPEAKER_06

You mentioned two sectors specifically: healthcare and education and schools. These areas have been really hard-hit by ransomware attacks over the last few years, and one of the reasons is because their security posture is incredibly weak. Schools don't have the funding to put in place the types of security measures that the banks, for example, do. We need to find some middle ground that makes these targets more secure. The other piece here that we haven't talked about, but is an enormous problem across the country, are cyber scams. I bet everyone in this room has gotten some text saying an errant Amazon package is headed their way, or double click, or message me back, I have a great offer for you, even love scams. This is a real epidemic that we have here, and the the term in the cybersecurity community is called pig butchering. What they'll do is use social engineering, use a conversation to aggregate and get people to put their funds, sometimes student loan debt, other places where they have money and exposure and are really looking for a way to make money and get out of a bad situation, and they'll go and invest it in a fake crypto scheme. A lot of these criminals behind this activity are in Southeast Asia, they're in Eastern Europe, and they're profiting from it. We need more exposure, and we need to shine a light on these cyber scams and what they're doing to everyday Americans.

Rep. Nanette Barragan (D-CA)SPEAKER_19

Great. Thank you, Mr. Jaffer. When I got to Congress, I had 2 phones. One's my personal phone and one's a government-issued phone. If I'm going to have a conversation with somebody on one of these phones that has classified information, which one should I use?

Jamil N. JafferSPEAKER_13

Neither one.

Rep. Nanette Barragan (D-CA)SPEAKER_19

Okay, but this one has Signal on it. Are you telling me that Signal— I shouldn't be having classified conversations on Signal?

Jamil N. JafferSPEAKER_13

No. As Ms. Galante correctly laid out, we have systems for classified communications today, what are the only places to send classified communications. The problem, of course, is those devices, particularly if you're talking about TS/SCI data, are in SCIFs, right? They're You can't have classified communications outside of a SCIF at the TS/SCI level. So if you want to communicate about an ongoing activity, you've got to figure out a way to do it. Signal is not a good way to do it. At the same time, if we don't give our government officials capable ways of communicating on the fly, the reality is everyone expects instantaneous communication today. That's just the world we live in. And so if you're a government official, you're in a tough position of saying, do I have to go to a SCIF? How do I do that? Using Signal is not the right answer, but we've got to give our senior leaders and our government officials a way to communicate that works on the fly, on the run, that doesn't force them to go into a room and hide out there. Otherwise, they'll never use it, and they'll find workarounds, and then we'll have bad situations where they're having communications over systems that are not they're not authorized to have them over.

Rep. Nanette Barragan (D-CA)SPEAKER_19

Thank you. You would think the secretary of the Department of Defense would know that. I yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentlelady yields. The chair now recognizes the gentleman from Florida, Mr. Bilirakis.

Rep. Gus Bilirakis (R-FL)SPEAKER_04

Thank you. I appreciate it very much. I thank the witnesses for their testimony today. I want to start off with Mr. Stehlin. In your written testimony, you mentioned your organization developed the SCS 9001 supply chain security standard. I'm a big proponent for industry-led standards generally, but of course there has to be something in it for the participants for it to work. It to work. What fundamental elements does a company's product have to show to receive a certification under your system, and what benefits result from achieving certification?

David StehlinSPEAKER_11

Thank you for that question. Yeah, the benefits are tremendous in that you can verify trust and you can prove that your product, hardware, software, as well as the company itself is a trusted supplier. And a service provider or a government or a critical network operator is going to want to buy from companies that have proven that their products are trusted. And then we use continuous improvement to constantly upgrade the processes. We don't tell a company through the standard how they develop a product. They just have to have certain processes and controls in place and verify that those are there.

Rep. Gus Bilirakis (R-FL)SPEAKER_04

Thank you very much. Mr. Jaffer, when talking about the the Salt Typhoon, much is said about how data of political figures and corporations were compromised, and that the threats they can pose to national security and business interests. However, less is said about how the privacy and data for of everyday Americans was compromised and is impacted. Why should the the average American be concerned about the Salt Typhoon attacks on their own data, and what threats does China pose to them by having this individual data?

Jamil N. JafferSPEAKER_13

Well, Congressman Bilirakis, it's a great question. The challenge that we have today is that the Chinese deeply infiltrated our telecommunications networks. That means they had access to massive amounts of metadata of ordinary Americans: the communications that you and I have, a phone call, the date, time, and duration of that phone call, potentially the same date, time, and duration of emails that we engage in. And then they can choose who to go after. So we know they can get both metadata and content. So average Americans should be worried that they have all their metadata, and then on top of that, if the Chinese government chooses to, they can go collect the content of those communications as well. So it's a full-spectrum capability. If we had that capability on Chinese networks, we would be thrilled. The Chinese achieved it on our networks, and yet today we're not focused on this problem, right? We're talking about Signal chats and the like, and, no doubt, that's a big problem, but the real threat is that our entire telecommunications infrastructure was compromised, and the US government has not responded to it, has not taken accountability for its own failures in detecting that threat and helping our telecommunications system to defend it. Instead, our government has said, We'll blame the telecommunications providers. Look, you're never going to beat China if you're a private sector company. You've got to have the government's help. The government's not doing its job. This is never going to work. On top of that, the American people should also be worried about apps they have on their phones like TikTok, which collects massive amounts of data on them. People think, well, these are just videos of kids and dogs and, but the reality is that it's collecting a tremendous amount of information, not just who you're communicating with, but your voice as well, numerous times that it passed that data back to the Chinese Communist Party. The Congress passed a law in a bipartisan way. That law has yet to be implemented because we made a political call that it's better to have TikTok running. We need to enforce the law that's in place today. TikTok should be banned in this country. And to the extent that American people have access to it, they should take it off their phones, because they're voluntarily letting the Chinese government onto their devices to collect data on them. And when you combine that data with all the other information the Chinese government has, that's going to allow them to conduct very significant intelligence and offensive operations against American citizens around the globe. That's a bad day for America.

Rep. Gus Bilirakis (R-FL)SPEAKER_04

Thank you very much. I appreciate it. I yield back, Mr chairman.

Rep. Russell Fry (R-SC)SPEAKER_05

Gentleman yields. The chair now recognizes the gentleman from Louisiana, Mr. Carter.

Rep. Troy Carter (D-LA)SPEAKER_23

Thank you, Mr. Chairman, and thank you, witnesses, for being here today. Today's hearing addresses a matter of urgent national importance. I believe this is an important hearing, and the security challenges we face are real, and they can be met with bipartisan cooperation, and I'm enthusiastic that this committee can do just that. Our telecommunications infrastructure faces daily threats from hostile foreign actors, cyber criminals, and even policy failures here at home that we just heard of moments ago. While adversaries like the Chinese Communist Party exploit vulnerabilities in our networks to spy, disrupt, and steal, the American people are also endangered by reckless behaviors within our own government. However, I must echo many of my colleagues' comments who are concerned about recent security failures where senior defense officials using unofficial and unsecure messaging apps like Signal to share sensitive and classified information that should have been put in a SCIF or some much more secure place for communications. We cannot have an important hearing like this and ignore irresponsible and dangerous lapses of judgment like this. As President Trump shifts responsibility for cyber defense to underfunded localities, dismantling national protections and disregarding bipartisan security legislation, our country is left more vulnerable. Meanwhile, Democrats are always willing to work across the aisle to modernize and secure our communications. My home state of Louisiana and the nation must have the resources necessary to make sure we have the capacity to update our networks and provide for expanded broadband access. Funding for BEAD programs have been vital have been a vital component to the state's initiative to reduce the digital divide. Yet in Louisiana, abruptly, before just as we were completing our final stage, this administration froze those funds, negating all the work that had been done to advance this vital tool in our cybersecurity. This was a problem passed and implemented by a bipartisan Congress, a program that was passed, implemented by a bipartisan Congress. I can't say that enough. As we look forward to working with my colleagues across the aisle to pass the Next Generation 9-1-1 Act, we must not allow our public safety telecommunications and telecommunicators and first responders to do their jobs with outdated equipment and technologies. It's a must. I've heard each of you speak. You've spoken eloquently on the needs that we as members of Congress can do and how we can listen better. Some things are political and most things are not. This clearly is one that should not be. Ms. Galante, in your testimony you discussed the Salt Typhoon attack that was unprecedented in scope. What risk are we taking by not moving to provide adequate funding to update the 911 network infrastructure around the country and to to a more IP-based technology like NG9-1-1?

Laura GalanteSPEAKER_06

The emergency response and 911 networks are incredibly critical to secure, and we have to up the posture on these different organizations and provide the funding to do it. In fact, over the last several years, emergency response centers and 911 lines have been widely targeted, especially by ransomware groups who look to freeze those networks and then get a payment in return. We've seen this happen in Texas and Pennsylvania and Florida, and there's probably many unreported instances of this as well. This is critical. We don't want to be in manual dispatch mode when you have ambulances going out.

Rep. Troy Carter (D-LA)SPEAKER_23

Mr. Stehlin, Open RAN allows different parts of our network to be supplied by different equipment and software vendors. My understanding is this plug-and-play approach means that no one vendor has the lock on any component within the network. How does this plug-and-play approach promote competition among vendors while benefits to everyday consumers like we see with other emerging technologies?

David StehlinSPEAKER_11

Thank you for that question. Yeah, Open RAN is an excellent technology that allows various aspects of a wireless network to be purchased from various vendors. So if you have common continuity between the various parts, if the connections between a RAN device and a base station router are opened up, it allows more competition. So—

Rep. Troy Carter (D-LA)SPEAKER_23

Can you leave me about 6 seconds? Go on.

David StehlinSPEAKER_11

Yep. The last thing I would say there is Uh, it's a challenging game to build wireless networks.

Rep. Troy Carter (D-LA)SPEAKER_23

Thank you. Mr. Jaffer, you mentioned just a moment ago about TikTok and the fact that this bipartisan body passed a ban on TikTok because of the massive breach and threat that it has for our cybersecurity. It has been extended 90 days and now gone beyond that 90 days. Every day that goes by that the Communist China Party continues to collect their data, what kind of risk does that put our cybersecurity and our country in?

Jamil N. JafferSPEAKER_13

Mr. Carter, that allowing TikTok to remain on American phones creates a massive, unprecedented risk to America's national security and the privacy and security of every single American citizen who has that app on their phone. It should be People should voluntarily remove it immediately. The law should be enforced. There is no provision of the law that allows it to be extended beyond 90 days. There's one 90-day extension allowed by law if, in fact, there's a deal in process. There's no provision for a 90-day extension. The law should be being enforced today. And it's worth noting that even if the administration chooses to voluntarily not enforce the law against providers who allow TikTok to remain on their networks, in the app stores and the like, those app providers and App Store providers can be held liable in a future administration if it's within the statute of limitations. So everybody who's allowing TikTok to remain on their devices should know that they are potentially exposing themselves to liability even if this administration chooses not to enforce the law, in a future administration.

Rep. Russell Fry (R-SC)SPEAKER_05

Thank you. The gentleman's time has expired. The chair now recognizes the gentleman from Georgia, Mr. Carter.

Rep. Buddy Carter (R-GA)SPEAKER_22

The other Carter, from the right coast. Thank y'all for being here. Appreciate it very much. Let's talk about subsea cables, because we know they're the backbone of the internet, and we know that they're critical for intercontinental communication and transactions. In fact, it's estimated that $10 trillion of financial transfers occur daily as a result of the of the subsea cables—$10 trillion daily. That's a lot of money. That's a lot of transfers. Anybody who's read the news lately understands that, in the past six months, our adversaries have been using and targeting these cables and cutting them to cripple the economic and national security of countries around the world. Obviously, an easy target. We understand that. Let's talk about the the the importance of redundancy, because redundancy is extremely important in the resilience of our cables and the diversity of routes that are needed to ensure we limit our vulnerability whenever we're talking about these cables. I've been working to try to expedite the permitting process of of cables through the in the national marine sanctuaries with my bill, H.R. 261, the Undersea Cable Protection Act. And I think we need to think about ways to expedite the permitting process more generally, too. We need to get more cables deployed as quickly as possible and ensure that we can meet the capacity needs. Mr. Stehlin, I want to ask you, can you explain why redundancy is so important for subsea cables and how important it is from a national security perspective that that we don't have one single point of failure?

David StehlinSPEAKER_11

Thank you for that question. Yeah, it's really critical that you don't have a single point of failure. As I mentioned earlier, there are about 600 subsea cables in operation today around the world, but something like 1,700 landing points. So as a cable gets closer to shore, it'll split and have multiple landing points. We need to increase the number of cables, yes, but we also need to increase the number of landing points here in the United States. There may be 90 or so landing points in the United States. As you mentioned, permitting is a major issue. In some cases, it can take 400 days on average to get a permit, and sometimes up to 900 days. To get a permit.

Rep. Buddy Carter (R-GA)SPEAKER_22

900 days.

David StehlinSPEAKER_11

900 days. And so I would argue that perhaps we put NTIA, which is the President's advisor for telecom issues, in charge of Team Telecom instead of the DOJ. They look at it from a different perspective. DOJ absolutely should be on the committee, but perhaps not have the lead.

Rep. Buddy Carter (R-GA)SPEAKER_22

So I mentioned my bill, H.R. 261, which also aims to prohibit duplicate permits that are currently being required by NOAA in marine sanctuaries especially. I know that there are other areas where there are duplicate permitting reviews that are delaying the deployment of cables. Can you suggest, Mr. Stehlin, where the committee might be able to work to streamline the permitting process for subsea cables Yeah?

David StehlinSPEAKER_11

a great example might be a trusted partner framework. So if somebody has built a cable in the past and has proven themselves, should they have to go through every single step yet again, or can they get fast-tracked because they have proven themselves to be a trusted partner?

Rep. Buddy Carter (R-GA)SPEAKER_22

Good, good. Excellent. The special use permits that are issued by NOAA are limited to a 5-year license term, which is in stark contrast to the 25-year FCC license term. Can you speak to the justification of possibly having a 25-year license term for subsea cables and the importance of a guaranteed 25-year term from an investment perspective?

David StehlinSPEAKER_11

Yeah, typical payback for these subsea cables might be 7 years just to break even because you're talking hundreds of millions of dollars of investment up front. And then you have to go through this permitting process. It might be pulled out, et cetera. So by having a longer-term license, it ensures that the company is going to make that investment. If you have 7 years payback just to break even, that's a tough business decision.

Rep. Buddy Carter (R-GA)SPEAKER_22

You know, I want to talk in general terms right now, and when I say general terms, I do mean general. I don't care what sector of our economy you're talking about. When people come into my offices, when businessmen come into my— business people come into my office, it's always the same story, whether it be whether it be communications, healthcare, energy, permitting, regulations crushing us, crushing us. We've got to do something about this. Thank you all for being here. Very, very important. Now yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

Gentleman yields. The chair now recognizes the gentleman from New Jersey, Mr. Menendez.

Rep. Robert Menendez (D-NJ)SPEAKER_25

Thank you, Mr. Chairman. With international cybersecurity threats on the rise, we are facing increasing threats to our critical infrastructure and our economy. This past fall, the U.S. experienced a devastating Chinese state-sponsored attack on our telecommunications networks, stealing sensitive geolocation data and targeting both Democratic and Republican elected officials. We have heard throughout this hearing about bipartisan support for defending our country against cyber threats, as we should, but the Trump administration has been weakening our country's cybersecurity defense system by slashing our cyber workforce and recklessly transmitting sensitive information, making it easier for our foreign adversaries to access Americans' most sensitive personal data. Ms. Galante, just yes or no, will the Trump administration dismantling CISA's Cyber Safety Review Board weaken collaborative security and intelligence work?

Laura GalanteSPEAKER_06

Yes.

Rep. Robert Menendez (D-NJ)SPEAKER_25

Ms. Galante, is a public-private security ecosystem necessary for a strong collective defense and national security posture?

Laura GalanteSPEAKER_06

Yes, it's critical.

Rep. Robert Menendez (D-NJ)SPEAKER_25

Mr. Jaffer, you even said yourself private companies cannot compete with China alone. So it would seem that a public-private security ecosystem is essential for our national security. Would you agree with that, yes or no?

Jamil N. JafferSPEAKER_13

Absolutely.

Rep. Robert Menendez (D-NJ)SPEAKER_25

Thank you. Ms. Galante, going back to you, with China investing heavily in recruiting and training their cyber workforce, is it important to our national security for the U.S. government to maintain a robust cyber workforce capable of defending against cyberattacks?

Laura GalanteSPEAKER_06

Incredibly important.

Rep. Robert Menendez (D-NJ)SPEAKER_25

And not just maintain it, but we should be growing it. That's

Laura GalanteSPEAKER_06

right.

Rep. Robert Menendez (D-NJ)SPEAKER_25

And doing everything we possibly can to get more people at community colleges, at universities across the country to begin their, their career in cybersecurity. Is that correct?

Laura GalanteSPEAKER_06

Especially at this moment.

Rep. Robert Menendez (D-NJ)SPEAKER_25

Thank you. That's why I'm concerned about reports that DOGE plans to cut 1,300 jobs from the cybersecurity workforce at CISA. In fact, even the former head of CISA under the first Trump administration said that he is outraged by these cuts, and I look forward to all my Republican colleagues joining me on a letter to the administration on this issue. Sticking with the theme of DOGE cuts, I want to ask a few questions about the increasing number of reports that DOGE has been leaking and weaponizing Americans' personal data. It seems like every day we hear another report about the mishandling of our personal information, and this is just the first 100 days, from individuals with Russian IP addresses attempting to log into federal databases at the NLRB to DOGE employees gaining access to networks that hold nuclear secrets. It has become clear that the Trump administration cannot be trusted with our personal information. Ms. Galante, should Americans be concerned about reports that individuals with Russian IP addresses have attempted to log into a federal database that holds our personal information?

Laura GalanteSPEAKER_06

Yes. IP addresses coming from Russia and network traffic coming from Russia is typically blocked, so I'm surprised that this isn't already getting filtered out.

Rep. Robert Menendez (D-NJ)SPEAKER_25

There have also been reports that ICE is in the process of pulling together data from across federal agencies for a database they call the Alien Tracker in order to facilitate mass deportations. Ms. Galante, just yes or no, would a database that stores personal data from multiple agencies across the federal government, such as the Alien Tracker, be a target-rich environment for our foreign adversaries to attack?

Laura GalanteSPEAKER_06

It would be a prime target.

Rep. Robert Menendez (D-NJ)SPEAKER_25

And once we accept that this administration is going to collect our personal information and put it into a database, whether it's for immigrants or any other group of Americans, it makes it highly susceptible to foreign attacks and puts all of our personal information at jeopardy. Would you agree with that?

Laura GalanteSPEAKER_06

Highly valuable in our adversaries' hands.

Rep. Robert Menendez (D-NJ)SPEAKER_25

So let's turn to AI quickly. Because I believe you would agree that AI has increased the sophistication of cyberattacks against target-rich datasets.

Laura GalanteSPEAKER_06

Yes.

Rep. Robert Menendez (D-NJ)SPEAKER_25

And can you just briefly explain empowering AI? There's two components as I understand it. Downstairs we're on the Energy Subcommittee talking about the energy that goes into AI. The other is the collecting and use of data. Is that correct? And can you speak to that?

Laura GalanteSPEAKER_06

Sure on the collecting and use of data, your processing powers are incredibly multiplied when you're looking at datasets. You're able to find patterns, you're able to find different insights within large datasets, you're able to cross different modalities. This is the sort of way that highly analytic endeavors are shorthanded and quickly given to our adversaries so that they can figure out how to make sense out of the noise in huge datasets and deploy them against us.

Rep. Robert Menendez (D-NJ)SPEAKER_25

And this goes back to why we originally banned TikTok, is that correct?

Laura GalanteSPEAKER_06

It's one of the reasons why TikTok could provide a powerful data set to our adversaries.

Rep. Robert Menendez (D-NJ)SPEAKER_25

So, while AI is strengthening our enemies' cyber capabilities, the Trump administration is leaving us vulnerable to attacks and weaponizing our data against us. This is not a Democrat or Republican issue. Any administration should prioritize protecting Americans' sensitive data, and my Republican colleagues cannot pretend to take threats from foreign actors seriously while the Trump administration is slashing CISA's workforce and allowing unauthorized DOGE employees to access Americans' data on demand. This should be a bipartisan issue. It's one I am concerned about, I've dealt with in on Homeland Security with Mr. Pfluger. Sorry, the clock went off, so I couldn't tell. That we should all be in lockstep on, but that means we have to speak out when our when our administration, Democrat or Republican, are failing us. This administration is failing us on this critical issue. Thank you, and I yield.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentleman yields. The chair now recognizes the real chair, Mr. Guthrie from Kentucky.

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

Not the real chair, the other chair. So, hey, thanks a lot. I appreciate you guys being here. And first to Mr. Stroup, I'm kind of concerned about satellite GPS, and I'm an old artilleryman, old artilleryman. In my day, you actually had to use binoculars and see where a where a round landed, and then you would call it back in, and somebody used literally a slide rule to calculate what the firing data was, and you had to walk you had to you had to bracket the target, as you say, or walk it on. And and now, this has been years, so I don't even know what they do now, but they shot shoot a shot. They lase the well, they lase the target, sends a GPS code to the guns. They shoot, lase the bursts, send a GPS code to the gun, and the guns adjust, and it's one-round fire for effect now. That depends on satellites. So, my big concern on satellite security, I mean, why just walk through the the the national security. That's just shooting artillery. That's a whole lot of things that our satellites depend on in the civilian world, but also particularly our military world. I used to be the the proverbial lieutenant with a map. Now you get a eight-digit zip code grid code just by knowing where what your watch tells you. So, how do we do that? How do we fix them out? Mr. Stroup, I guess I was looking I couldn't see you for Mr. Pfluger a tall guy. Sorry.

Tom StroupSPEAKER_15

So thank you for the question. So yes, obviously adversaries can use location information. The key from our perspective is ensuring that they are not subject to spoofing and to jamming. So the next generation of GPS satellites have increased capabilities against them. And actually, I think it's important to note that there is already a redundant system for navigation systems.

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

Yeah, how do you make it redundant for stuff like— I know you got navigation, you've got I mean, that's as simple as like low artillery. You're talking about 2 or 3 miles communications to each other.

Tom StroupSPEAKER_15

So GPS is a free system provided by the government. There's also another system operating off of a constellation of satellites, and there are also studies underway to look at other systems. But certainly for the importance of all of the uses, whether it's military or commercial, we do have redundancy built into the system.

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

Okay, thank you. I was looking at Mr.—well, I was looking at you because I couldn't see Mr. Stroup, so I'll ask you this. I mentioned in my opening statement concern for subsea cables. I mean, gosh, we have so much to protect. What are the threat to subsea cables and how can we be less, how can they be less susceptible to damage?

David StehlinSPEAKER_11

Redundancy, number one. Number two is having a repair system that's very quick and accurate, meaning more ships. A big shortage of ships. More landing points adds redundancy in the United States. Uh, and, and working with friendly governments to ensure the equipment they're using is trusted equipment.

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

Okay, thanks. I'm not sure how much time I have, but, Mr. Jaffer, on rip and replace, we led that effort. And when we're thinking about supply chains, what else do we need to do?

Jamil N. JafferSPEAKER_13

Well, Mr. Chairman, I think certainly Rip and Replace going global is going to be critical, right? Because what's happening is our adversaries are putting this Huawei, ZTE, and other Chinese gear in around the globe. So it's important to expand that broadly. Beyond that, we need to look at other core supply chains—semiconductors, critical minerals. We know the Chinese have a chokehold on these things, whether it's processing critical minerals or the like. We need to get ahead of that and and get ourselves out of that. And then finally, we need to look at our the entirety of the American supply chain. We realized during COVID that we have this dependency on China on pharmaceutical precursors, and yet we continue to maintain and allow ourselves to be addicted to Chinese goods of all sorts. It's one thing to buy t-shirts from China; it's a whole nother to buy critical minerals, semiconductors, and and and routing and

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

We had a hearing on on medical devices, and and we found in the medical device—because it was an investigation and oversight hearing—they had connections to the URL at the University of Beijing in medical devices, just collecting massive amounts of data I think Mr. Menendez is talking about, so they use it in their AI.

Jamil N. JafferSPEAKER_13

And just think about connected cars. Think about the havoc you could cause if instead of having a bunch of, whether it's Teslas or Slates or whatever American EV manufacturer you want, Chevy, right, Ford, if we had a bunch of BYD cars running around the, running around the United States, which is what, by the way, China wants us to do. Part of the reason they're cutting us off from critical minerals is they want us to buy their electric cars so that those electric cars that are connected, they can turn off when the time is right.

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

Well, thanks. I'm not sure if my— someone see the clock? I've got a couple minutes. So I was in Europe. I was on a NATO meeting, and we were talking about all the privacy. We have to deal with privacy on this committee as well, so very interested in that. And my question was, if you have a system of Huawei and ZTE, should you worry about your privacy? Do you have privacy even if you regulate privacy? Doesn't it seem kind of inconsistent to say we're going to have all these privacy laws, but then we're going to let all the Chinese equipment in our country?

Jamil N. JafferSPEAKER_13

It is astounding to watch the Europeans come after American companies because they're concerned about our privacy rules and our privacy regulations. And yet, one, they buy tremendous amounts of Chinese gear and are willing to give their privacy up to the Chinese. We also know that the Europeans have massive surveillance capabilities internally. They never talk about those. They talk about our industry and our companies. They don't talk about their own government surveillance capabilities. And so I think it's really important to think, look, at the end of the day, if you have to make a decision, you could be like the Europeans and you can regulate first, innovate second, or you could be like the Americans and innovate first. That's what

Full Committee Chairman Brett Guthrie (R-KY)SPEAKER_16

we're going to do. I think I didn't— I can't see a clock, but I think they just gaveled me down. So thank you for your answers. Appreciate it very much. Thanks.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentleman yields. Before we recognize the next person, we're going to try to reset this clock. There we go. The chair now recognizes the gentleman from Ohio, Mr. Landsman.

Rep. Greg Landsman (D-OH)SPEAKER_20

Thank you, Mr. Chair. I appreciate all of you. I want to get into the the undersea cable issue. And we've talked about this extensively, rightfully so, and would ask, Mr. Chair, for unanimous consent to enter into the record an article in Newsweek about China, China Unveils Game-Changing Weapon That Could Decide Future Wars. It just speaks to the fact that cybersecurity is national security, national security is cybersecurity. And the article goes into, obviously, everything that China is doing with their submarine technology to disrupt these cables. The vast majority of communications goes through these cables, 95% of everything that we do globally. And your testimony today suggests there are several things that we have to do. One is the redundancy work, two is the ships, three, I'm assuming, is part of the repair work, but the technologies, the sensors. And maybe I'm jumping to a conclusion here that that doesn't exist, but I assume that there are early detection work that we could be doing, or do we find out immediately when these things happen? So I'm wondering if you can say a little bit more about or speak to existing legislation. I know Mr. Carter has a bill around permitting, and that's something that I think we should all jump on and support, especially to your point about trusted partners who are already doing this. Can you talk a little bit about the ships, what we would need to do? What does that look like?

David StehlinSPEAKER_11

Yeah, there are certain ships that are designed to lay and repair cables. You can go to Baltimore Harbor and see them from time to time. That's that's one place to see them. And these these ships lay out the cable. They're specifically designed to do this. Finding the problem, it can get isolated fairly quickly, because once you lose a signal, you can identify where the problem is using something called an OTDR, optical time-domain reflectometer. All right, so that's something that you can use to find out where the problem is. But then you've got an issue of what are the seas like? Has the cable moved or shifted around because of tides and currents and things like that? So, adding more ships and having this be a a better and bigger industry is really important on top of ensuring that Western technology and Western companies take back the lead in this rather than Huawei.

Rep. Greg Landsman (D-OH)SPEAKER_20

How many ships do we have now? How many do we need?

David StehlinSPEAKER_11

I can't answer specifically, but it's, it's single digits to low, maybe perhaps a dozen.

Rep. Greg Landsman (D-OH)SPEAKER_20

Yeah, go ahead, sir.

Tom StroupSPEAKER_15

If I may, since the issue of redundancy for undersea fiber cables has come up, I want to stress the importance of satellite, the ability to be able to transition immediately. And while we certainly don't have the ability to carry all of the traffic, as an example, that is carried into Taiwan, what they're doing I think is a good example of how we prepare for the potential of an undersea cable cut, and that is putting in place arrangements with multiple satellite companies, obtaining the terminals so that they do have true redundancy in real time.

Rep. Greg Landsman (D-OH)SPEAKER_20

Thank you. Yeah, I think that makes sense. And I think the only point you were making, sir, is that it's not— it's good for redundancy and for those moments of acute need, but not necessarily an alternative to the fiber optics. The— I want to get back to the ships. Sorry. If it's single digits, I mean, do we need twice as many?

David StehlinSPEAKER_11

The more landing points, the more cables we have, definitely the more ships you need. There's no doubt about it.

Rep. Greg Landsman (D-OH)SPEAKER_20

Okay. So, is there anything else? Between Mr. Carter bill, getting additional ships, the satellite partnerships that would expand our capacity, is there anything missing in terms of

David StehlinSPEAKER_11

Yeah, I would reiterate the permitting process needs to be sped up. And again, I think NTIA ought to have the lead.

Rep. Greg Landsman (D-OH)SPEAKER_20

Oh, NTIA, that was the other piece. NTIA, got it. And I know that Mr. Carter bill does the permitting, or at least that sounds like it does, but the NTIA piece, I'm not sure is— I'll look into that. I appreciate that. That makes sense. And I yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentleman yields. The chair now recognizes the gentleman from Ohio— or Idaho, Mr. Fulcher.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Thank you, Mr. Chairman. Mr. Stehlin, I represent the great state of Idaho, and there is a lot of rural space there. And a lot of the ISPs don't have a tremendous number of cybersecurity resources. But yet they will oftentimes be integrated with major infrastructure components, whether it be a power plant or a grid or flood control or some of those major things, and oftentimes can have an impact there without necessarily the infrastructure or the cybersecurity expertise to fend off some of these new threats that are on the way. I'd like to get any suggestions or comments from you on how CSRIC might be a resource for that or other sources of counsel through your role at TIA.

David StehlinSPEAKER_11

Thank you for that. Yeah Idaho is a tremendous opportunity to take advantage of the monies put forth with Rip and Replace, for example. These rural operators have a hard time making money running a business when you're so spread out. So removing untrusted gear like Huawei or ZTE gear, critically important. Number two, the BEAD money, very important for states like Idaho to help those unserved and underserved. So finding ways to continue to push that money out to rural America is very, very critical. And the way that it's connected to your industry, not just to the consumer, all that is especially interwoven in rural America. So industry, as well as rural America consumers, are tightly connected, and therefore the networks need to be tightly connected.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Thank you for that. I want to do a follow-up question. Same general subject matter but having to do with cybersecurity incident reporting requirements. That's another one of those things that can be cumbersome. Especially if you're a small ISP. And I wanted to get your comments on that as well. Is harmonizing maybe an option or other forms of report sharing something that we should be looking at a little bit deeper?

David StehlinSPEAKER_11

Absolutely. We need to speak in one voice. We need to have one way of reporting incidents. Right now, every company and many agencies and departments in the government and in state governments have different ways of reporting things. So with all these different requirements and you're in a small rural company, who do you respond to? How do you quickly identify the problem, quickly resolve the problem? If we speak in one voice and have one voice of mitigation and incident reporting, we'll more quickly fix the problem and then we'll continually improve because that's what a good benchmarking system does. Allows you to get better and better.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Thank you for that as well. I'm Going to shift to Mr. Jaffer and going to magically make you king for a day.

Jamil N. JafferSPEAKER_13

Okay I love that. All right. Congressman Fulcher.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Undersea cables, we've been talking about that a lot, and I don't want to regurgitate what others have brought up or similar questions. I know that I've made notes of the patrolling issues, satellite monitoring, the permitting issues that we've got, the need for redundancy. What we haven't talked about is penalties for nefarious actors, or at least that I've heard. But as king for a day, could you hit that topic again? What are the steps we need to be taking?

Jamil N. JafferSPEAKER_13

Look, we have to make it clear to our adversaries, Russia and China primarily when it comes to undersea cables, that we view those as part of our critical infrastructure. And if those are hit, and we know it's them, we will make them pay a price. That price can be economic. It might be sanctions. It might be military. The truth is that we rely so much on these networks. And by the way, they have similar capabilities to counter space as well. So it's both our satellites and our undersea cables that are at risk when it comes to China and Russia. They take out those systems, we have to make clear to them, you will pay a price. And then when they do it, we have to exact that cost. If we don't have credibility, deterrence doesn't work. And that's one of the fundamental problems is we don't we don't talk about where our red lines are. We don't talk about what our capabilities are to respond. And then when the bad thing happens, we don't respond. So it's no surprise our adversaries aren't deterred, whether it's the cyber domain, whether it's undersea cables, or it's counter-space. These are all vulnerabilities, and our adversary has gotten too used to coming after us and not paying a price.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Mr. Chairman, I think I'm going to wrap with that. I do have another question or two, but I'm going to submit that. Thank you, Mr. Jaffer, Mr. Stehlin, for your comments, and for the entire panel for joining us today. Also, please note that some of us have dueling committees, and so if you got repeat questions, you understand why. Mr. Chairman, with that, I yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentleman yields. The Chair now recognizes the gentlelady from New York, Mrs. Clarke.

Rep. Yvette Clarke (D-NY)SPEAKER_00

Thank you very much, Mr. Chairman. Good afternoon, everyone, and I thank our panelists for their expertise this afternoon. The security of our communications network is one of the utmost importance to America's national security and continued global economic leadership. Securing our critical infrastructure against cyberattacks has been a top priority of mine since entering Congress, and I'm proud to have served as chair of the Cybersecurity and Infrastructure Protection Subcommittee of the Homeland Security Committee in previous Congresses, where I was able to pass legislation to stand up a national reporting infrastructure for cyberattacks on critical infrastructure regime. We have seen an uptick in cyberattacks in recent years fueled by advances in technology, including artificial intelligence. Further advances in consumer and commercial technologies alike have helped spur innovation across industries, particularly with respect to the IoT devices, but also have the potential to create new vulnerabilities that must be addressed. The varied threat vectors which we now face require a serious, focused effort on the part of our federal government, and sadly, our current administration has not proven up to the task. Last month's executive order on cybersecurity preparedness will weaken our defenses at a time when we face more threats than ever by shifting the responsibility of defending critical infrastructure to state and local governments, which too often lack the funding and expertise to take on this role. This decision leaves schools, emergency service providers, local governments, and others at risk by shifting the burden of warding off attacks from hostile foreign actors onto their backs. Additionally, this administration's inane, half-baked tariff policy will devastate supply chains and drive up the costs related to defending our communications infrastructure. Further securing communications infrastructure begins with practicing good personal cyber hygiene, something the current defense secretary and national security advisor seems almost unwillfully aware of— unaware of. Their reliance on unofficial and unsecure messaging apps risks the lives of American troops and warrants a serious bipartisan investigation. It is extremely unfortunate that the current administration has consistently sought to dismantle tools and programs meant to protect our critical infrastructure from cyberattacks while senior officials ignore laws and best practices. We in Congress must, however, continue to our work to increase network and supply chain safety to allow consumers and business alike to make informed decisions impacting the security of our communications networks. Recent breaches have shown that vulnerabilities in communication networks stem not just from telecommunications infrastructure, but also from compromised end devices and personal behavior. To that end, the FCC under the Biden administration adopted a voluntary cybersecurity labeling program in March of last year so that approved devices would bear the U.S. Cyber Trust Mark to help consumers identify trustworthy and secure products in the IoT marketplace while encouraging manufacturers to meet higher standards in product development. My question is to Ms. Galante, but other panelists may weigh in as well. How could the implementation and possible expansion of the Cyber Trust Mark program help address the risks our communication networks face?

Laura GalanteSPEAKER_06

Thank you, Congresswoman Clarke. The Cyber Trust Mark cybersecurity mark on Internet of Things connected devices is an important step in getting a baseline so consumers know what products are secure. It's similar to the UL, that Underwriters Laboratories metallic sticker that we all have on our different appliances. And I hope that Cyber Trust Mark goes the same way, which is to give consumers confidence that the company behind that product is following basic rules in cybersecurity that will make that product safer for their own personal use, and also so that they have some reliability that it's going to be patched and updated over time.

Rep. Yvette Clarke (D-NY)SPEAKER_00

Very well. Anyone else want to add? Mr. Stehlin?

David StehlinSPEAKER_11

We're TIA is very close to the Cyber Trust Mark and has been involved with the FCC from its beginning. We hope that it gets rolled out later this year. It's a lot of steps forward. Right now, it's focusing on smart consumer devices and does not include things like home routers.

Rep. Yvette Clarke (D-NY)SPEAKER_00

Yes, very well. Well, listen, my time is up. I thank you all so much for adding your expertise to this very important conversation. And with that, Mr. Chairman, I yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentlelady yields.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Mr. Chairman? Mr. Chairman?

Rep. Russell Fry (R-SC)SPEAKER_05

Yes, sir.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Thank you, Mr. Chairman. At the request of my colleague, Mr. Pfluger, I'd like to request the committee's permission to enter into the record a letter to the Honorable Brendan Carr, Chairman of the FCC, from a number of us on this committee. It has to do with recommendations on network and cybersecurity. So with the permission of the committee, I'd like to submit that into the record.

Rep. Russell Fry (R-SC)SPEAKER_05

Without objection.

Rep. Russ Fulcher (R-ID)SPEAKER_18

Thank you.

Rep. Russell Fry (R-SC)SPEAKER_05

The chair now recognizes the gentleman from New Jersey, Mr.

Rep. Thomas Kean (R-NJ)SPEAKER_14

And thank you to our witnesses for being here today. As a member of this committee and the Foreign Affairs Committee, I have a strong interest in identifying and advancing common-sense measures that strengthen our communications infrastructure and counter the threats posed by adversaries like China, Russia, and Iran. Mr. Stehlin, first of all, welcome south. I'm happy to have a resident of New Jersey's 7th Congressional District here, and I'm glad you're here to share your expertise. I understand the Team Telecom process can be burdensome and cause delays. What are the obstacles that burden or delay deployment of additional undersea cables?

David StehlinSPEAKER_11

Thank you, sir, for that question. And I've been a longtime resident of East Amwell in the 7th District, 32 years in the same house. So, NTIA should be the lead in Team Telecom. They're the president's advisor for all telecom issues. Absolutely, the DOJ, Department of Defense, Department of State, DHS ought to be involved as well. But looking at it from the perspective of how we improve our telecom systems ought to be the first and lead of any type of evaluation. So, that type of change would improve the permitting duration. Today it averages over 400 days, some cases as long as 900 days to get a permit, and often before it even gets to the FCC for the final approval. So, this long, drawn-out process occurs before the FCC even sees the application. By fundamentally changing that and looking at it from the perspective of how can we improve our economy, rather than a Justice Department that maybe has a different perspective on things, I think that would go a long way to improving it.

Rep. Thomas Kean (R-NJ)SPEAKER_14

Okay. And what steps can we take to keep the U.S. as an attractive place for vendors and suppliers across the communications technology sector to do business, create jobs, and innovate here in the United States?

David StehlinSPEAKER_11

We ought to reward trust, reward investment, and we ought to point out with a big spotlight those that are not trusted and encourage both the United States and our friends around the world to not buy from folks that are not trusted.

Rep. Thomas Kean (R-NJ)SPEAKER_14

Yeah. Thank you. Mr. Stroup, I agree that it's important to maintain leadership within international standard-setting bodies. In your view, what should American leadership and investment in these international bodies look like to best counter China's efforts to advance its own agenda, particularly in the satellite industry?

Tom StroupSPEAKER_15

Thank you for the question. I think one of the first opportunities is relating to WRC-27, making sure that the United States has positions that are supportive of the satellite industry and that they advocate them with their international counterparts at WRC-27. If there is a void, China most definitely will step in. The same is true with respect to other standard-setting opportunities. If we are not participants, China will definitely take advantage of the opportunity.

Rep. Thomas Kean (R-NJ)SPEAKER_14

Okay and can you talk about whether satellites could play a role potentially as a redundancy in the event of a failure of or attack on undersea cables?

Tom StroupSPEAKER_15

Yes, absolutely. So I gave as an example previously, the government of Taiwan is making arrangements with multiple satellite operators, bringing in the terminals so that should there be a cut, there is an immediate transition to to satellite capability. So the good, the benefit of satellite capabilities are our infrastructure is in the sky, so they're not subject to something like a cable cut.

Rep. Thomas Kean (R-NJ)SPEAKER_14

Thank you. And Mr. Stehlin, I appreciate your discussion of strong supply chain security. What are the safeguards against, hypothetically, a previously trusted supplier or vendor suddenly being compromised by an adversarial actor? In other words, how can we make sure that trusted suppliers stay trusted?

David StehlinSPEAKER_11

Continuous verification of trust. So having a certification program that a company has to go through on a regular basis to ensure that the processes they're using are trusted and ensure that the company itself doesn't have injunctions against it since the last time it got certified. Those types of things are really important.

Rep. Thomas Kean (R-NJ)SPEAKER_14

Okay, thank you all for your testimony, and I yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentleman yields. The chair now recognizes the gentlelady from Virginia, Ms. McClellan. Perfect timing.

Rep. Jennifer McClellan (D-VA)SPEAKER_01

Thank you, Mr. Chairman thank you, Mr. Chairman and Ranking Member Matsui, and I apologize for my timing. But given the increased number of cybersecurity threats threatening our critical infrastructure, this hearing is incredibly important. And the irony of this hearing is not lost on me that while we scramble to catch up in the increasingly intense cybersecurity arms race, some of my colleagues ignore that one of our nation's biggest cybersecurity vulnerabilities is the current administration and its drastic cuts to the Cybersecurity and Infrastructure Security Agency, a national security team that prefers to coordinate via unsecure messaging apps instead of following standard security protocols. And it seems that the biggest step that we could take toward safeguarding our critical telecoms infrastructure is to hold the administration accountable for reckless behavior and unwarranted funding cuts that have made us more vulnerable. I want to start with Ms. Galante. Can you expand on what you mentioned in your testimony regarding the availability of AI to improve data processing capabilities to allow even unsophisticated adversaries to more effectively extract key insights from stolen data, and how worried we should be that AI will also greatly expand the ability of adversaries to get around our cyber defenses and commit even more devastating cyberattacks?

Laura GalanteSPEAKER_06

Thank you, Congresswoman McClellan. AI is a double-edged sword. You can use it for security purposes. You can use it for data exploitation and a whole myriad of other, other things. Specifically when it relates to how our adversaries are able to advance their skill set quickly when it comes to the exfiltration and the capture of large datasets. This is an area where we really need to focus on what the counterintelligence gain can be to them and what the vulnerability is to us. When you're able to sweep up huge amounts of data, whether it's from a telecoms network or another source, and then aggregate those data points, you get valuable patterns of life, you get valuable datasets and insights that can be used against us. It's critical that we understand how our adversaries use this.

Rep. Jennifer McClellan (D-VA)SPEAKER_01

Thank you for that. And also for you, Ms. Galante, given the growing cooperation that we have witnessed between Russia, Iran, China, and the DPRK in kinetic warfare against Ukraine, to the extent possible in an unclassified setting, can you elaborate on how concerned we should be about the possibility of greater cooperation among our adversaries to engage in cyberattacks against us? And to what extent do you believe that type of cooperation has already begun?

Laura GalanteSPEAKER_06

I am particularly concerned about the sharing, especially of vulnerabilities in widely used software in the US that our adversaries could share between each other. China, for example, has national laws that require that vulnerabilities found by Chinese researchers or Chinese citizens are first given to the government. That's really important. That, in a way, gives them, the Chinese government, an advantage on the zero days, the unexploited vulnerabilities, that are typically at the core of many of the products or a potential vulnerability in many of our products and critical infrastructure across the US. If those are shared broadly, this becomes an avenue for a scaled attack against the US.

Rep. Jennifer McClellan (D-VA)SPEAKER_01

And how should the United States be preparing itself for both the potential of AI-enhanced cyberattacks on critical infrastructure and the possibility of more coordinated cyberattacks amongst multiple hostile foreign adversaries?

Laura GalanteSPEAKER_06

We have to continue to invest in the ecosystem of security industry researchers and intelligence operatives with our U.S. intelligence and law enforcement national security agencies who together put together the picture of what our adversaries are doing next and the next edge of attacks that are going to be hitting us. It's that combination that's going to keep us ahead of the threat.

Rep. Jennifer McClellan (D-VA)SPEAKER_01

Thank you, and I yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

The gentlelady yields. The chair now recognizes himself for 5 minutes. The systems that connect us—our networks, our satellites, cables, towers, and data centers—form the invisible architecture of 21st-century life. Safeguarding that infrastructure, as you've all talked about, is not just a matter of technology. It's a matter of strategy, security, and sovereignty. The demand for our networks has exploded, obviously. Every year more devices connect to U.S. networks, more data flows, and more critical services depend on uninterrupted and secure access. Our systems are under strain not only from increased usage, but geopolitical risks, supply chain disruptions, and escalating cyber threats, particularly from nation-states like China, as you have talked about. This isn't only about protecting websites or cell towers. It's about protecting hospitals from ransomware, grid systems from blackouts, and first responders from dropped phone calls. Telecommunications is infrastructure. It's also national defense, and it's economic security. So let's treat it like that. It's a national priority. Mr. Stroup, you mentioned rapid expansion and innovation of the satellite industry. Can you elaborate on the most transformative advances that we've seen in maybe the last 5 to 10 years and what they mean for our national infrastructure?

Tom StroupSPEAKER_15

Thank you for the question. I believe that it starts with reusable launch capability. We have much more rapid launch than ever before. That has allowed many more companies to be able to launch their systems into space. I think in addition, in terms of capabilities, the utilization of high-throughput capacity capabilities allowed expansion for broadband services. So in terms of services, that's something that I would emphasize. The rapid growth of satellite broadband is really dependent upon that. In addition, with respect to the remote sensing sector of the industry, the ability to manufacture and launch sensors into space has opened up a completely new industry. So I would say those are just some of the points that I would emphasize. And then we've also seen within manufacturing manufacturing, utilization of mass manufacturing techniques, just given the increase in the number of satellites that are being manufactured, changing from bespoke manufacturing of large bus-sized satellites to hundreds of thousands of satellites being launched into space each year.

Rep. Russell Fry (R-SC)SPEAKER_05

Can you point to— and we've talked about this broadly with some of the other witnesses— but specific policies that put your industry at a competitive disadvantage compared to, say, foreign competitors?

Tom StroupSPEAKER_15

Yeah, certainly. I think that the the ease of licensing within the United States is extremely important, and we've made a number of recommendations to the FCC, and we also work with NOAA on remote sensing to be able to streamline the licensing process. We've seen, fortunately, a great deal of of investment that is made been made in the industry, but certainly we don't want to push any of the the licensing opportunities offshore, because that is something that I hear about from our members. In the past, it has taken a long time to be able to to get a a license approved. I will note that the last few years, we saw the creation of the Space Bureau at the FCC. At the time, there were 64,000 pending applications, and that has gone a great way to be able to address that. But that has been one of the key points that I've heard from our members, is being able to get a license quickly.

Rep. Russell Fry (R-SC)SPEAKER_05

Thank you for that. Mr. Stehlin, you talked about how vulnerable the U.S. telecom supply chain is today to foreign interference and dependency. What specific areas concern you the most?

David StehlinSPEAKER_11

Specifically, the lack of strategic investment in the United States in the ICT space. We have to pull back as much as possible the development of semiconductors and that entire ecosystem around semiconductor development. That's number one. Number 2, the lack of overall R&D investment. We have to encourage companies, incentivize them to spend more money on R&D, and we can do that through tax credits.

Rep. Russell Fry (R-SC)SPEAKER_05

So, reauthorizing that's critical. Absolutely. Okay. What key technical or architectural decisions must we make now to ensure that our networks can withstand cyberattacks or disruptions?

David StehlinSPEAKER_11

We need to speak in one voice. Right now, ISPs each have their own methodology for managing cybersecurity and supply chain security. The government has multiple ways of managing that. So we need to speak in one voice, which will allow us to react more quickly, to evaluate performance more quickly, and to continuously improve. We have to have a defense in depth, and speaking in one voice certainly helps.

Rep. Russell Fry (R-SC)SPEAKER_05

Thank you for that. Mr. Jaffer, you talked about our allies. This actually intrigued me a little bit. I assume that our allies are aware of the risks of buying this material from Communist China. And so if they're aware of that, what's causing them to continue to perpetuate the problem?

Jamil N. JafferSPEAKER_13

It's a great question. Two things. One, our allies—take Europe, for example—they've known long about their addiction to Russian gas and how that caused them problems. And yet they continue to buy it and buy it. We tried to build them a pipeline back in the Bush administration. They wouldn't do it. They built a pipeline to Russia instead. They're building a second one now. It makes no sense. They had the same attitude towards China. You look at even the United Kingdom, our closest partner or the special relationship. British Telecom built Huawei routers into their core networks. And when we went to them and told them this is a real problem, it took us a while to convince them. It took us a while to go around the globe. The first Trump administration spent lots of hours and days and months and weeks convincing our allies around the globe that this was a real threat. And that was only a decade after the House Intelligence Committee wrote a report about the threat from Huawei and ZTE. So we've known about this problem. We've been telling our friends and allies. And then, of course, we've had to pay rip and replace to take it out of our state and local networks as well. There's a coming threat, though: DJI drones being used by state and local law enforcement. Crazy for Americans to be buying that. We should not allow that to happen. It is a huge mistake for American law enforcement to have those drones in their networks.

Rep. Russell Fry (R-SC)SPEAKER_05

Thank you for that. I see my time is expired. The chair now recognizes the gentleman from California, Mr. Obernolte.

Rep. Jay Obernolte (R-CA)SPEAKER_17

Thank you very much, Mr. Chairman, and thanks to our witnesses. It's been a really important, really interesting hearing. Ms. Galante, I'd like to start with you if I could. I found your testimony very interesting and particularly the ways that foreign intelligence services are using security vulnerabilities at telcos to gather information on U.S. infrastructure and building the capacity to disrupt that infrastructure. I'm wondering about your thoughts about to what level that constitutes more than just an unfriendly act. You know, we have kind of an informal understanding that intelligence gathering is something that all countries do, but building the capability to disrupt our infrastructure, I think maybe goes beyond that. And, for example, if a foreign country did something that was overt, like came in on U.S. territory, kidnapped American citizens, and took them back to Iran or China, for example, obviously that would be tantamount to an act of war. That has started wars. Do we need to reprioritize our international reaction to acts like this?

Laura GalanteSPEAKER_06

Thanks for the question, Mr. Obernolte. One of the, one of the key distinctions that made this more than a sort of standard act of espionage, if you can think of it that way, is the level of access that these actors had within the telco networks. And with telco networks especially, you can almost think of it as sort of a multi-pronged tool. You're able to disrupt traffic. You would be able to take almost kinetic-like steps in a network because of the types of tech that are there that would cause an effect that everyone would agree is far beyond espionage. That hasn't happened yet as far as we know in these cases. It has just been an intelligence gathering effort and the access that these actors had presented additional opportunities. So that might be an area where you can really drive a distinction between what's traditionally known as espionage and what is largely considered prepositioning for an attack.

Rep. Jay Obernolte (R-CA)SPEAKER_17

Right. That's— I think you've illustrated the key distinction there. There's information gathering, which is what espionage is geared towards. But then building a destructive capability is something I think might go beyond that. And if someone did something overt, like kidnapping US citizens, we would say, that's not all right. That's not okay. We would take a stand. I'm wondering if maybe as an international community, we need to set new norms about that behavior.

Laura GalanteSPEAKER_06

And I think the discussion has to happen with our allies, right? This is not just a US problem, that Chinese access into telcos. We need to look at countries and allies in Southeast Asia. We also need to look at some of our European friends who have been dealing with this as well. This is not just a US problem, and we need to come together to be able to show where the real lines are here that we're not willing to tolerate

Rep. Jay Obernolte (R-CA)SPEAKER_17

Right. Thank you. Mr. Stehlin, you highlighted the vulnerability of some of our subsea cables, which I was very appreciative of because a lot of people don't realize that vulnerability. Could you talk a little bit about what the backup might be to that and how do we protect against that vulnerability? Because the problem is we're uniquely vulnerable in that way, and I just don't see an easy way around that.

David StehlinSPEAKER_11

There is no easy way around it other than having more cables and more landing points and quicker responses because of the volume of bandwidth, volume of traffic that goes across these cables. So that, that's really important. But we also need to be more on the offense. And as was described earlier, we need to tell our adversaries, don't do this. There will be a significant action on our part if you continue to conduct nefarious acts.

Rep. Jay Obernolte (R-CA)SPEAKER_17

Right. Well, I'm hopeful that we can also do some modeling about how much of that international traffic would be debilitating, because it would be— you never know how debilitating it's going to be until it happens. But if you've done some modeling and you've done some exercises, you can kind of predict some of those failures.

David StehlinSPEAKER_11

Yeah, to build on that, the Houthis took out some cables in the Red Sea last year, and between Asia and Africa, more than 50% of the traffic went down.

Rep. Jay Obernolte (R-CA)SPEAKER_17

Right. Mr. Stroup, with my remaining 47 seconds here, appreciate your testimony. One of the things that you didn't mention when you were talking about disaster modeling is the really innovative way that satellites are being used for early detection of wildfires. That's critically important to my district. If we can put these fires out with fast aerial resources before we need boots on the ground, it could be a total game changer. Could you give us a quick update on how that's going?

Tom StroupSPEAKER_15

Yes, I've actually seen a company just announce that they're providing that service, that as a service. A couple years ago when I had the pleasure of testifying, you'd asked a question about that capability and I'd identified a manufacturer of that capability. And in the last 2 years, we've seen companies moving forward with offering that as a service.

Rep. Jay Obernolte (R-CA)SPEAKER_17

Right. Well, we have, as you know, pilot programs, including some legislation that I offered to build out that capability because I am absolutely convinced it's going to be a game changer for us in the West. Well, thank you very much for your testimony. I see you're out of time. Mr. Chairman, I yield back.

Rep. Russell Fry (R-SC)SPEAKER_05

Gentleman yields, and the purpose of this hearing now being concluded, I want to thank the witnesses for being here. Appreciate the professionalism, the expertise. I appreciate your testimony, and we are adjourned. Oh, hold on. Just as a reminder, I remind all members that they have 10 business days to submit questions for the record, and I ask the witnesses to respond to the questions promptly. Members should submit their questions by the close of business on Wednesday, May 14th. This is— this hearing is adjourned.

Rep. Jay Obernolte (R-CA)SPEAKER_17

I

Rep. Russell Fry (R-SC)SPEAKER_05

also ask unanimous consent to insert into the record the documents included on the staff hearing document list. Without objection, that will be in order.

SPEAKER_UNKNOWN

Thanks for setting the material for us. Is it all right?