Fully Operational: Stuxnet 15 Years Later and the Evolution of Cyber Threats to Critical Infrastructure.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Committee on Homeland Security, Subcommittee on Cybersecurity and Infrastructure Protection will come to order. Without objection, the chair may declare the committee in recess at any point. Purpose of this hearing is to examine the evolution of cybersecurity threats to US critical infrastructure following discovery of the Stuxnet malware 15 years ago. We will highlight the importance of securing operational technology, or OT, to bolster critical infrastructure resilience. I now recognize myself for an opening statement. 15 years ago, the world learned of Stuxnet, a computer worm that forever altered the cyber threat landscape. Regarded as the world's first digital weapon, it was designed to target industrial control systems. It was used against Iran's nuclear program, reportedly destroying 1,000 centrifuges at the Natanz enrichment plant. Malware, or malicious software, has existed since at least the 1970s. However, Stuxnet was different from its predecessor. The discovery of it demonstrated both the physical impact of malware and raised important questions about cybersecurity defense and offense. These are issues we continue to face today. It revealed the significant impact that offensive cyber tools can have on critical infrastructure. It also demonstrated the importance of securing operational technology by exploiting key vulnerabilities in industrial control systems. It proved that cybersecurity is not only an IT issue. Cybersecurity threats can affect critical infrastructure we depend on daily, from water treatment to energy facilities. The cybersecurity threat landscape continues to expand, and we need to make sure our cyber professionals are prepared to defend both IT and OT. Doing so will strengthen the public and private sector's ability to rapidly respond to threats. Since discovering Stuxnet 15 years ago, cybersecurity threats to critical infrastructure have drastically evolved and spread beyond just malware. We now see various cyber capabilities being used to hack critical infrastructure, including phishing, social engineering, denial-of-service attacks, and more. While cyberattack vectors have grown and matured, malware is still of great concern. Malware comes in many forms, such as keyloggers, spyware, viruses, and ransomware, with ransomware comprising one-third of all cyberattacks in 2024. The interconnected nature of our networks, devices, and infrastructure means that critical infrastructure owners and operators now experience far more attacks than when Stuxnet was unleashed, and zero-day vulnerabilities are far from being eliminated. Strengthening domestic cybersecurity resilience remains a key priority for this committee. Considering the sophisticated cybersecurity threats we now face, we are once again reminded of the importance of reauthorizing two key authorities ahead of their expiration this year: the Cybersecurity Information Sharing Act and the State and Local Cybersecurity Grant Program. Reauthorizing CISA 2015 will ensure we keep encouraging rapid and trusted information sharing among public and private sector entities, and extending the State and Local Cybersecurity Grant Program will make sure that states and localities have reliable funding to strengthen their cybersecurity posture. It is also worth examining that state of the Iranian cyber threat and potential impact that Stuxnet had on Iran's cybersecurity posture. According to Nozomi Networks Labs, cyberattacks from Iranian threat actors surged by 133% in May and June of 2025. An active Department of Homeland Security National Terrorism Advisory System notice also emphasizes the need to remain on high alert to Iranian cybersecurity threats to U.S. critical infrastructure. Iran has embraced the targeting of critical infrastructure. The Islamic Revolutionary Guard Corps-affiliated actors have recently targeted OT, such as U.S. industrial control systems, in key sectors such as water and healthcare. I look forward to examining the current threats facing U.S. critical infrastructure and enduring significance of Stuxnet with our panel of expert witnesses today. Today's witnesses represent a range of perspectives, and I thank you all for contributing to our discussion about this pivotal moment in the history of cybersecurity. I'm confident that your testimony will help us form a better understanding of today's digital weapons and the state of U.S. critical infrastructure resilience. I now recognize the ranking member, the gentleman from California, Mr. Swalwell, for his opening statement.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

Thank you, Chairman. And Chairman, that was an eloquent, impactful, artful statement. But you buried the lede. Our chairman of the subcommittee has been selected by his colleagues to be the chairman of the full committee with the resignation of Chairman Green, effective earlier this week. So congratulations. I'm excited for what that means for the full committee. You and I have worked quite well over the last 3 years on this committee, especially to take on our cyber challenges and to have somebody at the full committee with your cyber knowledge and expertise as our cyber threats are only escalating and AI has made that even more challenging and the threat of quantum computing and what that means for cryptology, you're the right person to help lead the committee to do that. So looking forward to working with you. And I think I speak on behalf of my colleagues that we congratulate you on that win. Earlier this summer, Chairman Mark Green and I went out to my congressional district and visited Lawrence Livermore National Laboratory, and committee staff from both sides were there as well. As you know, Lawrence Livermore National Lab is the nation's premier research and development facility. It attracts the best and brightest minds from around the world and helps keep the United States on the cutting edge of innovation, particularly related to national security technologies. Lawrence Livermore and our national labs are indispensable partners in our national effort to defend cyberspace, keeping their finger on the pulse of our adversaries' tactics and motivations while helping to develop novel technologies to detect and disrupt malicious cyber campaigns. We saw Lawrence Livermore works firsthand, and it's critical to national efforts to secure critical infrastructure our constituents rely on every day and the operational technology that underpins it. The lab's work is paying off dividends, especially related to the Chinese threat actors like Volt Typhoon, and I'm pleased that the lab today, through Dr. Gleason testimony, will talk about its important work. Notably, the lab is a key partner in CISA's CyberSentry program, which places sensors on private-sector networks on a voluntary basis to monitor for and detect cyber threats. The lab contextualizes data from the CyberSentry program with other intelligence feeds, generates unique insights into malicious cyber activity, and provides network defenders the know-how to kick out the adversaries. The knowledge derived through the lab's work benefits programs and activities across CISA, and I'm eager to learn how Lawrence Livermore and the national lab community can continue to support federal efforts to better secure operational technology. Additionally, I'm interested to learn how other programs at sector risk management agencies and CISA, like the Joint Cyber Defense Collaborative, JCDC, support efforts to mature our collective approach to security. It's incumbent on the federal government to collaborate with its private sector partners to bring security resources to bear to these under-resourced sectors. Also, at this point, I want to just remind the committee and the public that CISA can only function when it is fully staffed. It should not be free from reforms, but currently it has lost approximately 1,000 employees since the DOGE cuts began to take place. That affects its ability to work with the private sector and be responsive. Fewer brains and reduced funding means less capability, less capacity, and less collaboration, which is detrimental to ongoing efforts to mature operational technology security programs. And also, I'd like to reiterate my strong support for the reauthorization of the other CISA, CISA 2015. Stakeholders have referred to CISA 2015 as the most successful cyber law ever passed, and I was a part of writing it and passing it in 2015 as a member of both this committee and the House Intelligence Committee. We cannot allow this critical authority to lapse. Toward that end, I was pleased to see a clean 10-year extension included in the Senate Intelligence Authorization Act for fiscal year 2026. It sends a clear message to our partners and our adversaries that cybersecurity continues to be a bipartisan priority in Congress. I look forward to working with my House colleagues to provide non-federal stakeholders the certainty they need to continue their strategic collaboration with the government by passing a clean authorization before it lapses later this fall. With that, I yield back.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

The gentleman yields back. Other members of the committee are reminded that opening statements may be submitted for the record. I am pleased to have a distinguished panel of witnesses before us today. I ask that our witnesses please rise and raise their right hand. Do you solemnly swear that the testimony you will give before the Committee on Homeland Security of the United States House of Representatives will be the truth, the whole truth, and nothing but the truth, so help you God? Let the record reflect that the witnesses have answered in the affirmative. Thank you, and please be seated. I would now like to formally introduce our witnesses. Ms. Kim Zetter is the author of Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon, and an adjunct professor at Georgetown University. She's also an award-winning investigative journalist who has written on cybersecurity and national security for more than 20 years. Zetter began her career covering security and privacy issues for Wired, where she wrote for 13 years. Mr. Robert Lee is the chief executive officer and co-founder of Dragos, a global technology leader in cybersecurity for OT and ICS environments. Mr. Lee also serves as a lieutenant colonel in the Army National Guard, where he designs and leads OT cybersecurity response efforts. He's a member of the World Economic Forum subcommittees for the oil, gas, and electricity communities, and he serves on the advisory boards of the International Society of Automation and National Cryptologic Foundation. Ms. Tatyana Bolton currently serves as executive director of the Operational Technology Cyber Coalition, where she advocates for effective OT cybersecurity and critical infrastructure resilience. Prior to her current role, Ms. Bolton served as a senior security policy manager at Google's Security Center of Excellence. Before joining Google, Ms. Bolton directed the Cybersecurity and Emerging Threats Program at the R Street Institute and served as policy director of the Cyberspace Solarium Commission. Dr. Nate Gleason is the program leader for cybersecurity infrastructure resilience within the Energy and Homeland Security Program at Lawrence Livermore National Laboratory. Prior to joining Lawrence Livermore, Dr. Gleason spent 12 years at Sandia National Laboratories in a variety of technical and management positions, including deputy to the vice president for the California laboratory and deputy program director for Sandia's Homeland Security Program. I thank the witnesses for being here today. I now recognize Ms. Zetter for 5 minutes to summarize her opening statement.

Ms. Kim ZetterSPEAKER_02

Thank you. Chairman Garbarino, Ranking Member Swalwell, and members of the subcommittee, thank you for this opportunity to testify about Stuxnet and threats to critical infrastructure. My name is Kim Zetter, and I'm a cybersecurity and national security journalist, as well as an adjunct professor at Georgetown University and the author of the book on Stuxnet, Countdown to Zero Day. It was 15 years ago that Stuxnet was discovered on systems in Iran, but despite the passage of time, its impact is still felt today. Stuxnet was a digital weapon designed to sabotage Iran's nuclear program by targeting industrial control systems at its uranium enrichment plant at Natanz. But these are the same kinds of systems used in U.S. critical infrastructure. I've been asked to describe how Stuxnet operated and the implications for U.S. critical infrastructure and whether these systems are any more secure today than when Stuxnet was discovered. Stuxnet was a first-of-its-kind attack, the first known case of malicious code designed to leap from the digital world to the physical realm to cause disruption and destruction, not of the computers it infected, but of equipment and processes these computers controlled, in this case, the centrifuges at Natanz. The same techniques Stuxnet used can be used against critical infrastructure in the U.S. to disrupt services the public, government, and military rely on or to damage equipment. They can also cause death, either directly by causing passenger trains to collide, or indirectly by preventing patients from being treated at hospitals because the electricity is out. I provided in my written testimony details about how Stuxnet operated, so I won't go into them here. But I want to point out two things that are relevant. First, Stuxnet spread to millions of computers, but it only unleashed its destructive payload on the specific systems its creators were targeting. It didn't sabotage other systems because Stuxnet was a highly sophisticated, carefully crafted, and tested precision weapon designed to avoid collateral damage. Other attacks, however, don't need to be precise or sophisticated to cause disruption or damage. This is worth noting given the recent warnings about the potential for Iran to launch cyberattacks against the U.S. Iranian hackers don't have the skills to pull off a Stuxnet-like attack, but they don't need them to disrupt or damage systems. Second, when Stuxnet was first discovered, researchers believed it was an espionage tool. This is because every time it infected a new system, it searched for the presence of Siemens industrial control system software. Siemens software is used to control manufacturing assembly lines and other industrial processes, so researchers believed whoever was behind the malware was trying to steal blueprints or designs for industrial plants. After reverse-engineering the code, however, they realized it was designed for sabotage. This is significant because disruptive or damaging attacks can be indistinguishable from espionage in the initial stages of infection. Both can use the same tools and techniques to gain access and move within networks to find data or the systems they want to disrupt. What's more, intrusions done initially for intelligence purposes can morph into disruptive or destructive operations. I say this because a lot has been written recently about the Salt and Volt Typhoon intrusions of telecoms and critical infrastructure that are attributed to China. These compromises don't appear now to be aimed at disruption or damage, but could morph into such operations in the future. One of the most significant impacts Stuxnet had was to raise awareness about vulnerabilities in critical infrastructure. Prior to Stuxnet, the security community was focused on IT networks, the business networks that you use to send email. But Stuxnet put OT networks in the spotlight, and once researchers began to examine them, they discovered serious software flaws as well as architectural problems that couldn't be fixed with a software patch. They also found many systems connected to the internet. The following is a small sample of processes that industrial control systems control: opening and closing cell doors at high-security prisons, operating traffic lights and HVAC systems, routing commuter and freight trains to prevent collisions, controlling temperature at which food is pasteurized and steel is forged, operating chemical and pharmaceutical plants, and control of the flow of electricity. A lot has been done since Stuxnet to secure critical infrastructure in the U.S., but many issues persist. I'll just give one example before I close. In 2009 in Washington, D.C., a Metro train plowed into the back of another train stopped at a station during the afternoon commute. Sensors on the track should have indicated to the incoming train that a train was stopped ahead of it, but the sensors failed, and the collision killed 9 people and injured 80 others. This wasn't caused by a cyberattack, but this month, CISA issued a security alert about a decade-old flaw in train braking systems that hackers could exploit to cause a collision like the one in 2009. That flaw exists in the protocol that devices located in the front and back of trains use to communicate with each other to engage the brakes. The protocol uses weak authentication, which means an attacker can impersonate one of these devices to cause a train to suddenly halt or the brakes to fail. The flaw can't be exploited over the internet. An attacker needs proximity to send a command, but this doesn't make it any less dangerous. The researcher who discovered the flaw discovered it in 2012 and reported it to the Association of American Railroads, but the AAR reportedly dismissed it, believing no one could exploit it. It was only this year, after the research in CISA threatened to go public, that the AAR announced it would replace the protocol. A new protocol won't be ready until 2027 at the earliest. Thank you.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Thank you, Ms. Zetter. I now recognize Mr. Lee for 5 minutes to summarize his opening statement.

Mr. Robert M. LeeSPEAKER_04

Chairman Garbarino, Ranking Member Swalwell, members of the subcommittee: 15 years ago, Stuxnet proved cyberattacks could cause physical destructions. Attacks on OT networks are under sustained and sophisticated assault from our adversaries today. I'm Robert Lee, CEO of Dragos, a former Air Force officer at NSA, and now serving, since the last time we all met in this committee, in my role of Lieutenant Colonel in the Army Guard designing out OT defense strategies. I've spent my career protecting these industrial systems that power our society. Let me be blunt: we are not prepared for a major attack on our critical infrastructure. We know that such an attack would be part of any major conflict with an adversary, but we are not doing enough to prepare, and the results of continued failure could be catastrophic, including the loss of life. At Dragos, we track over 25 state and non-state actors that target operational technology directly. Nine different malware families have been built specifically for industrial systems. The most versatile is very opposite to Stuxnet. Where Stuxnet was very, very targeted, PIPEDREAM can be used against everything from unmanned aerial vehicles to water systems to power systems. Increasingly homogeneous machinery and technical systems have increased the OT attack surface and raised the potential consequences of a large-scale attack. But defense is doable. One example: Littleton Electric in Massachusetts used a federal grant to install our technology on their network after FBI intel indicated to them that they were being targeted by Volt Typhoon. We detected, isolated, and mitigated the attack with their partnership. They were able to do this because they had visibility in their OT networks and they were proactive in their security. Most companies don't do this. We know what works. Here are a few things that I recommend that we can do. First, we must stop treating OT like IT. These systems have different risks and require different defense strategies. Hearings like this one are critical to raise awareness of this distinction. A significant portion of the funding and resourcing in the community goes to IT, whereas the critical part of critical infrastructure is OT. Second, make public-private partnerships count. At Dragos, we uncovered PIPEDREAM in coordination with the NSA and an undisclosed third party. We ended up coordinating with CISA and the E-ISAC, and that allowed us to warn operators before the adversary was even allowed to deploy it against targets across the United States. Broad, unfocused information-sharing efforts, though, do not work. Targeted, focused coordination does. Third, we must streamline federal guidance. Right now, too many agencies are sending too many messages, many of which are overlapping and often contradictory, to our industry. We have to tell the industry, here's the threat, here's what success looks like, but we have to let them handle the how. Right now, it is extremely confusing for asset owners and operators on turning to who is going to be the one to help them, and most importantly, what the actual guidance is that they should follow beyond regulatory. Fourth, we have to let the private sector lead on technology. We already have the tools to detect advanced threats. Federal efforts to replicate them just waste money and slow adoption. Fund deployment, not reinvention. Government should focus on over-the-horizon threats. The private sector has already created the tools and techniques needed to deal with the threats in the here and now. It's just about execution. Government tools have consistently underperformed in comparison to private sector tools and at a higher cost to taxpayers. Fifth, secure the supply chain. Critical infrastructure vendors must meet real security standards. Right now, all of the focus is placed on asset owners and operators and not the vendors. Asset operators and their vendor community should share responsibility for meeting basic security requirements for all the components that are installed into our critical infrastructure, even the security vendors. As the CEO of Dragos, I'm surprised that I have the amount of flexibility I do to make willfully poor security choices to increase my margins. Though we have not done that and would not do that, I'm surprised by the ability of CEOs to make that decision. I believe we need higher standards and more selectivity into who can sell into critical infrastructure and how. Finally, we need to fix federal response coordination. Most operators simply don't know who to turn to to call after an incident or what they'll get in response. And responses differ across state lines, and there's no basic credentialing for who shows up and what they can do. I'm helping write a national OT response plan in my role at the 91st Cyber Brigade, but we need legislative support to cut through the bureaucracy. I've found great partnership in this effort with CISA, particularly strong support with Sean Plankey, and I look forward to his confirmation. We simply know what needs to be done, and it's time to stop standing in our own way. Our kids' lives depend on it. To close, our adversaries are gaining ground, but we have the tools, the knowledge, and the people to win. Now we need large-scale execution in the public and private sectors. We know what needs to be done. We just need to do it. I'm grateful to all of you for holding this hearing, and look forward to the rest of our conversation. I yield back my time.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Thank you, Mr. Lee. I now recognize Ms. Bolton for five minutes to summarize her opening statement.

Ms. Tatyana BoltonSPEAKER_03

Thank you, Chairman. Chairman Garbarino, Ranking Member Swalwell, and members of the subcommittee, thank you so much for the opportunity to testify today. I commend the subcommittee for prioritizing critical infrastructure security and holding this hearing to discuss the heightened threat landscape. My name is Tatyana Bolton, and I'm the executive director of the Operational Technology Cybersecurity Coalition. The OTCC is a coalition of OT cybersecurity organizations, critical infrastructure operators, and thought leaders representing the entire OT lifecycle and protecting our nation's critical infrastructure assets. We provide vendor-neutral perspectives on securing our collective defense and advocate for improved OT security policy. Stuxnet marked a pivotal moment in cyber warfare by demonstrating that digital tools could indeed cause real-world physical destruction to systems known as operational technology, or OT. OT is the technology that makes machines run, like pumps and valves on a manufacturing room floor, or machines that control compressors and filters in a water treatment facility. It's crucial to recognize, as Rob said, that operational technology, OT, is distinct from information technology, IT. Their respective security requirements differ considerably. OT cybersecurity must prioritize safety, reliability, and physical process continuity. And these systems can be older, having been built to last decades, and many never designed to be connected to the internet in the first place. Despite the elevated risks associated with attacks on OT systems, this area of cybersecurity remains significantly underprioritized and underfunded. The OTCC is working on a number of efforts and has provided multiple recommendations to the committee, and I'd like to highlight a few of them here from my written testimony. First, we need to focus on awareness. The United States must prioritize OT cybersecurity to prepare critical infrastructure against the growing threats. Our government has acknowledged that U.S. infrastructure is at risk. However, it has not taken sufficient steps to address the growing vulnerabilities in the wake of attacks like CyberAveng3rs or Volt and Salt Typhoon. While securing IT is important, the OT systems that, if attacked, turn off our lights, bring hospitals to a standstill, and disrupt essential services. Congress must urgently answer the question of who holds responsibility for these risks, as a debilitating cyberattack on our critical infrastructure would demand clear accountability. Second, Congress must reauthorize CISA 2015. In May, our coalition submitted a letter to this committee urging the reauthorization of the Cybersecurity Information Sharing Act of 2015, which will expire in September of this year, as you well know. This legislation is crucial to information sharing and strengthening U.S. collective defense. Both public and private sector security teams rely on information sharing from other organizations to strengthen their defenses. If the legal protections established by this act were to lapse, this flow of information would be disrupted up to 80 to 90%, and national security put in jeopardy. Third, we must better resource OT security. From addressing the growing tech debt, hiring cybersecurity experts, to procuring and building updated and secure systems, OT owners and operators don't have the necessary funding to defend their networks, and often 99 cents of every dollar is spent on physical security. We need to address critical infrastructure security through a whole-of-nation approach. Just as we wouldn't expect an individual county, such as Polk County in Texas, to defend themselves against missile strikes from a nation-state actor, we shouldn't expect them to respond to cyberattacks on their own. This is a national security priority. This is why the State and Local Cybersecurity Grant Program must be reauthorized. These resources allow underfunded critical entities to remove Chinese routers, hire cybersecurity staff, and replace outdated servers. Congress should also explore whether there are other opportunities to provide economic incentives to critical infrastructure owners and operators to invest in OT security. The biggest vulnerability in any of your states, and all of the states, is your lowest common denominator. So we must increase the security baseline across the board. The threat to critical infrastructure and operational technology from our adversaries, including Iran, is real and growing. OTCC aims to work with this committee and our stakeholders to achieve our common objective. With the right policies, resources, and partnerships, we can build a more resilient and secure nation. Thank you again for the opportunity to testify, and I look forward to your questions.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Thank you very much. I now recognize Dr. Gleason for 5 minutes to summarize his opening statement.

Dr. Nathaniel GleasonSPEAKER_06

Chairman Garbarino, Ranking Member Swalwell, and members of the subcommittee, thank you for the opportunity to testify today. My name is Dr. Nate Gleason. I'm the program leader for the Cyber and Infrastructure Resilience Program at Lawrence Livermore National Laboratory in Livermore, California. I lead a multidisciplinary team that works to develop technologies to address nation-state threats in the domain of gray-zone conflict. Our primary emphasis is on the role of critical infrastructure in national security. I appreciate the committee's interest in our work, particularly your visit to the lab earlier this summer, which reflects your commitment to bolstering the nation's cybersecurity. I'm honored to be here on behalf of Lawrence Livermore, a National Nuclear Security Administration laboratory and proud member of DOE's network of national laboratories. Nearly everything we do as a nation, from energy transmission to projecting force around the globe, depends on critical infrastructure. This makes these systems prime targets. Our adversaries are highly capable and invest heavily to hold our infrastructure systems and the functions that depend on them at risk. To defend against this threat, government and the private sector must partner to out-innovate the competition and bring our best technology into operations. One way CISA helps address this need is through the CyberSentry program. Since 2020, it has looked to Lawrence Livermore for core support for CyberSentry, with our role being to develop and deploy advanced analytics to monitor and hunt for threats. Through CyberSentry, cyber researchers gain real-time access to operational networks and can leverage significant investments in national laboratory computational and analytical capability, combined with information from the intelligence community, to develop and deploy tools to detect the latest attack techniques. As one example of program success, in 2022 we detected high-risk Chinese surveillance cameras, just like these on the table in front of me, that were stealthily built into U.S. infrastructure systems. We leveraged our Skyfall Laboratory to develop an advanced beacon detection analytic that increased sensitivity to detect these threats while improving selectivity to dramatically reduce false positives. When we deployed the analytic to CyberSentry partners, almost immediately our analysts detected anomalous beacons on the OT network of a participating company. Our team identified the beaconing device as a camera manufactured by the Chinese company Dahua. Livermore developed a machine learning model to detect these devices at scale and deployed it. We found cameras on most of the participating CyberSentry entities, in some cases hundreds of them. Network traffic showed that these devices were beaconing to suspected hostile overseas servers. Some appeared to be transmitting encrypted video. Reverse engineering of the devices revealed they were also capable of providing a back door to any connected network. Notably, these devices were mostly sitting on OT networks, providing direct access to the physical processes. We worked with CISA to create and publish a set of playbooks that went out broadly to help asset owners who are not part of CyberSentry detect these devices on their own systems. This illustrates how the CyberSentry partnership between just a few dozen critical infrastructure asset owners, national labs, and CISA enhances cybersecurity across U.S. critical infrastructure. It's important to recognize detection represents just one aspect of defense against cyber threats to our infrastructure. The current threat picture demands a multi-layer approach. At Livermore, we use what we call the immune infrastructure framework. This four-layer approach recognizes that we can't stop all attacks and instead seeks to make it as difficult as possible for adversaries to achieve their goals. Layer 1 focuses on understanding critical infrastructure systems through modeling, simulation, and analysis. This essentially allows us to look at U.S. infrastructure through the eyes of our adversaries. Layer 2 attempts to keep the adversary out of our systems through supply chain assurance. Layer 3 focuses on detecting and responding to intrusions. We put significant focus on addressing the previously unseen over-the-horizon threats that China, Russia, and Iran are developing that could hold our systems at risk. In Layer 4, we engineer our systems to operate through compromise by using techniques like collaborative autonomy, which are designed to provide redundant decentralized control of systems. While all 16 critical infrastructure sectors are important, we pay particular attention to energy, water, transportation, and communication because of their close connection to national security. The energy sector is among the most forward-leaning in cybersecurity. Its sector risk management agency, DOE CESER, invests resources in creating capabilities for the energy sector that, in coordination with CISA, helps set the pace for other sectors. CESER is currently working to ensure that AI can be securely integrated into energy sector operations. Livermore is leading its analysis of potential risks and benefits of AI in the energy sector. We are also developing test beds to assess the security and efficacy of various AI capabilities for the sector. Another way CESER is working to enhance cybersecurity is through its Energy CyberSense program, which focuses on supply chain security. We also work closely with the Defense Department on defense critical infrastructure. Through this work, we have identified how adversaries with advanced knowledge of our infrastructure and interdependencies that exist between components could exploit multiple assets simultaneously to create cascading damage far worse than any single-point attack. Thank you again for the opportunity to testify. I would be happy to answer any questions.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Thank you, Dr. Gleason. Members will be recognized by order of seniority for their five minutes of questioning. An additional round of questioning may be called after all members have been recognized. I now recognize the gentleman from Florida, Mr. Gimenez, for five minutes.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

Thank you, Mr. Chairman. And let me congratulate you on winning the chairmanship of the entire committee. It's well done, and I look forward to working with you. I also share the concerns of the ranking member about the reauthorization of CISA 2015. And now that the chairman of the subcommittee is now the chair of the entire committee, I'm sure that we're going to be accelerating that process. And it's a clean a clean reauthorization, but then eventually we're going to have to look and see how we can tweak that. But first, we need a clean reauthorization. Ms. Zetter, I'm curious about the viruses and the malware, and I'm wondering if they're starting to act like real viruses. A real virus, when they enter the body and the body starts to attack it, can react. It evolves to defend itself. Have you seen that that progress with computer viruses, with cyber viruses, the ability of a virus to evolve so that it can it can protect itself from any kind of defense mechanism?

Ms. Kim ZetterSPEAKER_02

We've seen the early stages of that. I don't think that we've seen something that's fully, I would say, mature and operational. Rob has a better idea of that because he deals with the malware that comes in. But we've seen sort of even sort of hints of that even years ago, just not fully developed. Obviously, now with AI, that opportunity exists to make something even more autonomous and also the ability to morph very rapidly to the environment.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

Interesting. That's a scary thought, right, that whatever we do, the virus will protect itself somehow and find a new way to do what it needs to do? And I also agree that OT is actually the more important aspect of cyberattack. That's really the stuff that's really going to hurt us, cause accidents, kill people, disrupt everything that we do. If I can foresee a day where somebody presses a button, and next, all the lights go out in North America, right? And that would be a little bit disruptive, I believe. Ms. Bolton, you talked about the lack of the lack of coordination here in the United States, and I would think that if you kind of map out who's got what, who's responsible for what, it would look like a bowl of spaghetti. Am I too far off?

Ms. Tatyana BoltonSPEAKER_03

Uh, i'd say you're not very far off at all. Um, I think there are, uh, a wide range of frameworks that are in place, a wide range of coordination mechanisms, as Rob mentioned in his testimony. Uh, also difficulty for the industry to, uh, come into the federal government. There's not one specific door. There's not one agency that's responsible for cyber incident response. And so they all work together. And so, but we've got local and state agencies responding to incidents. You've got vendors and industry. You've also got federal government involvement. So I absolutely believe that we need to streamline that process. I know the committee is, is working on harmonization, cyber harmonization. I very much, we very much support that effort. Because we need to have one easy way, one door for the industry to come in, to come into the federal government for support, and then also for the response and collaboration to be more clear.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

Now, you said that they work with each other, but do they really? Don't they? Do you see turf guarding a lot?

Ms. Tatyana BoltonSPEAKER_03

I can't say that we don't see turf guarding. I will say that there are, there are experts, national security professionals who are absolutely intent on securing the networks for which they're responsible.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

A lot of people will say, Well, that's really my realm. Well, no, it's my realm. I mean, look, that's just the norm in any bureaucracy, okay? And so when we have so many agencies doing the same things, that's a natural tendency of bureaucracy to try to protect themselves, okay, and turf-guard. Mr. Gleason, in terms of China, I serve on the Select Committee on China, and I have been calling for— we cannot decouple fast enough from China. Things that may be innocuous, cameras, all right, there's nothing innocuous about them. They are malicious. They are relentless in their attacks on us. I was thinking, yeah, cameras is one way, and then they report back to China, right? And they can also integrate themselves into the IT system. That becomes an OT problem maybe, all right? We had issues where I used to be the mayor of Miami-Dade County with cameras at our port system that was reporting back to China. We don't know what it was reporting, probably what kind of commerce we were doing at that port, and we also found that they had infected our systems. They were just lying around, okay? We don't know what they were lying around for, but I'm sure that it wasn't for a good purpose. So what can we do to stop this, this relentless attacks that we're getting from these systems? I'm sorry. My time is up, and I yield back.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Okay, I was gonna say they can answer the questions if they— if you had— if you want, I'll

Ms. Kim ZetterSPEAKER_02

ask it for you about that.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

All right, I now recognize the gentleman from Texas, Mr. Luttrell, for 5 minutes. If you're

Rep. Morgan Luttrell (R-TX)SPEAKER_07

reading my notes, sir.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Yeah, i

Rep. Carlos Gimenez (R-FL)SPEAKER_01

stole it.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Yeah, then you could—yeah. What can we do to—I don't even know how you scale something to this size. What can we do looking forward or looking downstream? I cast that out to Mr. Gleason. You start. You had the—

Dr. Nathaniel GleasonSPEAKER_06

Yeah, I think everything you are mentioning, I would agree with. I think what this phenomena that we're seeing is, is China has recognized that critical infrastructure is a new domain of conflict. I think we are catching up to that still. They put a lot of energy into this. They are very good. We are not going to stop them. One of the goals that we have with the approach we've taken, as I mentioned, the immune infrastructure framework, our goal is to make it as hard as possible for them to achieve their objective at each, at each layer. That includes understanding what they're trying to do. It includes securing our supply chains. It includes detecting, responding, and most importantly, it includes building our systems so that we can live even if they compromise them. That doesn't make our mission fail.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

The cyber defense is very reactionary. We have no idea what's coming at us. The challenging part, I think personally, and I'm not speaking for—look, there's only four of us. It is hard to dork out on cybersecurity, cyber risk, and cyber threat. You really got to be passionate about this thing. And the number of subject-matter experts that walk into our offices every single day that say they're the absolute best at what they do is mind-numbing. The committee is very open-minded to the collective, your group, of saying the best way forward to defensively and offensively, This is what we need. This is most likely the best way forward, OT/IT. Okay? How do we get that done? Because it changes every single second of every minute of every hour of every day. Cyber—the cyber profile, the cyber technology, the cyber understanding—everybody's trying to outdo somebody else. Again, very reactionary. How do you defend against something like that?

Ms. Tatyana BoltonSPEAKER_03

Uh, so I would say we need to start even at the very beginning. Most agencies, most sectors have not done an OT asset inventory, so they don't even know what they have.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Scale that to the continental United States.

Ms. Tatyana BoltonSPEAKER_03

Absolutely. Absolutely. So I'll give you an example. There was an incident responder team, an incident response team that went out to a pipeline. This was several years ago. They asked them how many open ports or ports they have. They said, well, just these that you see in this room here. And that was all their IT systems. By doing investigations through the internet billing that that pipeline had, they found they had over 10,000 open, unprotected ports. And so that's, you know, you need to be able to at least on some kind of spreadsheet be able to tell what you have in order to be able to start fixing it. And that includes things like putting in multifactor authentication where it's possible, doing supply chain security, as you said, Uh, building defense in depth and building resilience.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Is that even a probability to do?

Mr. Robert M. LeeSPEAKER_04

Yeah, if I could add to that, we very much know what to do. But again, if you think about it from a government perspective with private sector, if I'm in the water sector and I'm trying to look to CISA, EPA, and all the other components and players on what should I focus on, there's a lot of, Go be cyber safe. Go be cyber secure. Go do cyber, cyber, cyber something, not actual guidance. Not, Well, we want to prepare for Volt Typhoon. This is what we're looking at. Here is what we think success looks like. However you want to figure it out, go, and then resourcing it. We have the technologies that exist, we have the people trained, but there is a lot of overlapping guidance and it's paralyzing the private sector.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

We weren't ready for Volt Typhoon. Stuxnet— Ms. Zetter, I'm going to shift over to you as a— and I don't know how long whomever created that handed that football off to where it landed. But the technology in the early 2000s is not the same as it is in 2025 with the use of AI, AGI. I'm assuming that you can take the baseline algorithm from Stuxnet because it had a few bugs in it. That's how we found it, if I'm speaking correctly. When they started digging in and found Stuxnet, there were just a small bit of glitches in there, like, All right, here it is. Now we're tracking. And then we unpacked it, and, OK, here it is.

Ms. Kim ZetterSPEAKER_02

The core— I'm sorry.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Yes, ma'am, go ahead.

Ms. Kim ZetterSPEAKER_02

The core of Stuxnet did not have glitches, but the spreading mechanisms were reckless, and it caused Stuxnet to spread around the world. And this is why it got caught.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Okay, well, I'm going to make the assumption that since that thing has been handed back to us globally, that technology and AI, AGI will advance Stuxnet, SolarWinds in some way, and we won't be able to not only keep up, catch up, but I'm assuming there's a probability that it's just going to outrun everything. That fair statement?

Ms. Kim ZetterSPEAKER_02

Yeah, the details that I provided in the written testimony goes in depth into how Stuxnet operated and how sophisticated it was. That was state of the art in 2010. And it was really genius the way that it was designed. If you can imagine now, 15 years later, how much more advanced that that should be at this point.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Yes.

Ms. Kim ZetterSPEAKER_02

And then also with AI, then yes, it's going to really fast forward.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

I yield back.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Gentleman yields back. Thank you very much. I now recognize Ranking Member Mr. Swalwell for 5 minutes of questioning.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

Thank you. As part of the fiscal year 2022 NDAA, the National Defense Authorization Act, Congress authorized the CyberSentry program, which deploys sensors on a voluntary basis on critical infrastructure partners in order to detect malicious activity. As I noted in my opening statement, a critical part of that program is the role that Lawrence Livermore National Laboratory plays in analyzing CyberSentry data. Dr. Gleason, what is the current status of Lawrence Livermore's partnership with CISA on CyberSentry?

Dr. Nathaniel GleasonSPEAKER_06

We've supported CISA in various aspects of critical infrastructure security for for about a decade. Currently, we have agreements that are making—our funding agreements are making their way through DHS processes. Unfortunately, those are still making their way through DHS processes, and our work with CISA expired last Sunday.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

What, what does it mean that it expired? Is it turned off? Are you able to operate without authorities or funding? Like, what, what is the posture right now for this important work?

Dr. Nathaniel GleasonSPEAKER_06

Yeah, national laboratories are not legally able to operate without being funded by a government agency. So our threat hunters stopped monitoring networks on Sunday.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

Who needs to turn it back on?

Dr. Nathaniel GleasonSPEAKER_06

We need the interagency agreement between DHS and DOE to be completed.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

Would this be a sign-off from the secretaries of both Energy and Homeland Security?

Dr. Nathaniel GleasonSPEAKER_06

Um, somewhere in that chain, yes. I'm not completely familiar with the funding processes that exist those agencies right now, but yes, it needs to be signed off by both, both organizations.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

And earlier in your testimony, you alluded to some cameras and malicious activity that you had found that had been Chinese-placed. Is that the type of work that the Sentry program does?

Dr. Nathaniel GleasonSPEAKER_06

Absolutely. We're looking for threats that haven't been seen before. We're looking for threats that exist right now in our in our infrastructure. One of the great things about the CyberSentry program is it takes the research and marries it with what is actually happening on the real networks. So we're not just doing science projects, we're deploying that technology out in the real world, detecting real threats.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

And just so I understand, so you now, with the program that has at least lapsed or hopefully temporarily lapsed, the sensors are still deployed, is that right?

Dr. Nathaniel GleasonSPEAKER_06

That's correct. The sensors are still deployed. They're still gathering data. We just aren't analyzing the data that's coming in.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

So i guess you're telling me you're— because you don't have the funding, you're not allowed to look at the data legally. That's the problem. That's correct. So theoretically, we have deployed sensors on critical infrastructure and there could be a malicious attack occurring right now. That you are not legally able to see until the program is refunded?

Dr. Nathaniel GleasonSPEAKER_06

That is correct. Lawrence Livermore analysts are not able to monitor that data right now.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

What is the risk of you being blind to what these sensors are detecting?

Dr. Nathaniel GleasonSPEAKER_06

I think everything that we've talked about in this hearing, we've seen how important critical infrastructure is to everything we do as a country. I think I'll echo a talking point I frequently hear from Dragos. One of the most important things is getting visibility into what's happening on our OT networks. We don't have enough of that, and so losing this visibility through this program is a significant loss.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

A major priority of mine has been to improve operational collaboration between the Federal Government and the private sector. To do so, CISA must have the appropriate forums for such collaboration, including the JCDC and CSAC. Ms. Bolton, how can JCDC be strengthened so that it can better facilitate OT security collaboration, and why is it important that CSAC be restored?

Ms. Tatyana BoltonSPEAKER_03

Thank you for the question. I think CIPAC is an organization that allows industry to talk to the government, and right now industry is not able to convene with the liability protections that come or the information sharing protections that come with CIPAC authorities. And so that becomes a bit of a— that becomes a problem, and it's a national security concern when operational collaboration can't happen between those two entities. I believe it's very important for CIPAC authorities to come back. I think as much as possible, industry is continuing to try to work through other mechanisms, but there was nothing specifically like CIPAC. And we also are— we're continuing to work with JCDC and other areas within CISA on OT security issues. I think what we'd like to see from JCDC, if we're talking about additional work, is more concrete OT efforts that industry can get involved with from the ground up.

Chairman Andrew Ogles (R-TN)SPEAKER_08

Great. Thank you. Yield back.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

The gentleman yields back. I now recognize the gentleman from Tennessee, Mr. Ogles, for 5 minutes of questions.

Chairman Andrew Ogles (R-TN)SPEAKER_08

Thank you, Mr. Chairman, and thank you to witnesses for being here. Obviously, this is a high-stakes issue. I mean, it's the next battlefront, if not the battlefront, as we as we move forward. And when you look at the the China threat that Ms. Zetter, I think, you've touched on, or all of you have touched on, but specifically I want to I want to start with Ms. Bolton. So formerly, I was county executive in my community, and what I can say is that although we were one of the fastest-growing counties in the state of Tennessee, number one producer for manufacturing jobs in the state of Tennessee while I was county executive, I can tell you that from a cyber and IT/OT perspective, we were arguably vulnerable. Please expand on that vulnerability when you look at bad actors as it relates to kind of just our infrastructure security, and and what the consequences might be if there was a coordinated, systematic attack against those local communities?

Ms. Tatyana BoltonSPEAKER_03

So, a lot of what we see, and you're completely right, a lot of what we see is that the threat actors are targeting the most vulnerable organizations, right? Many times, those are smaller organizations without cybersecurity expertise. They're at the county level, they're at the local level, and you see actors either targeting those for target practice, learning, and then moving to bigger systems, or they're doing it in a coordinated manner across a number of different states and localities. Particularly, we see that in the energy sector, and they're using that as a means to prepare the battlefield, if you will, for if they're in a contingency. If it's China, for example, if they're sitting on our networks, that is extremely dangerous, even if they're not conducting any particular operations right now. One, we can't guarantee that they're off the networks even when we find them. We find them too late. We find them three years after the fact. And what we don't want to have happen, if, for example, we're planning for a 2027 contingency, then we need to start doing the work now to build resiliency, defense in depth, the ability for those smaller local and county entities to be able to secure all of those ports, right? Secure the remote access, put in stronger multifactor authentication, modernize their legacy IT. And that's why I think it's so important to reauthorize the State and Local Cybersecurity Grant Program, because without those resources, like I said, most of those localities are using all the funding for physical security and not OT.

Chairman Andrew Ogles (R-TN)SPEAKER_08

And Mr. Chairman, you know, again, coming from that that local governance background, county executive, and I can— I'll speak for Tennessee. Obviously, everybody knows Nashville and knows Memphis, larger cities with more arguably or hopefully more robust systems. But a lot of Tennessee is rural, just like a lot of states across the country. And what you see are electric cooperatives. So just like the county may be vulnerable to that infrastructure attack, my guess is, in most cases, so are those local cooperatives, so is some of the water cooperatives as well. And so as we look forward to, again, the next battlefield and what keeps me up at night, and quite frankly, Mr. Chairman, what I would argue the the the most important, some of the most important work that we'll do on this committee, this whole committee, is what we're doing in cyber as we prepare this country for that next battle. And it's going to be on our computers. It's going to be across our networks. And I would argue it's going to be in our local rural communities that they're going to hit first, because then they can Swiss cheese our electrical grids and our water systems and our water treatment plants, et cetera. That's what keeps me up at night. So with that, I'd love to stay on this topic and just kind of go down the line. We'll talk— start with you, Ms. Zetter, to see what you might want to add to this subject matter, please.

Ms. Kim ZetterSPEAKER_02

I think you're absolutely right in terms of the small utilities and cooperatives like that. They don't have the money, they don't have the resources, they don't have the expertise on staff. They don't even hire security people. But I want to also say that we sort of anticipate that the large organizations would be more secure. And if you look at what happened to Colonial Pipeline in 2021, we see that this was really a major organization, critical infrastructure, supplying a lot of gasoline to the East Coast. And yet Colonial Pipeline, at the time that it was attacked, did not have a CISO on staff. They also had a legacy system that the attackers got in, an old VPN account they were no longer using but hadn't bothered to disable. And they came in through a password that potentially was, well, it was leaked on the internet. So the employee who had the password had used it for other accounts, and then it was leaked on the internet in other breaches. One other point about that was the attackers, we think, only got to the IT network, didn't actually make it to the OT network. But Colonial Pipeline shut down the pipeline because they feared that the attackers would get to the OT network and then encrypt it and lock it. But when the CEO of Colonial Pipeline testified to Congress, he testified that they had very secure, highly segmented OT and IT networks. But if they were that confident that the networks were segmented, then they wouldn't have had to shut down the pipeline as a precaution. So I just want to say that, yes, those smaller entities are a big issue and a prime concern, but also the larger entities are having the same problems and not keeping up.

Chairman Andrew Ogles (R-TN)SPEAKER_08

Yeah, thank you, ma'am. And I apologize, Mr. Chairman, I'm over time, but I yield back.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Not a problem. The gentleman yields back, and I recognize myself for 5 minutes of questions. We all know CISA plays an important role, Sector Risk Management Agency for 8 of the 16 critical infrastructure sectors, as well as the national coordinator of the Sector Risk Management Agencies. They do a lot of work. I'd like to hear from you all. What do you think, how would you assess CISA's effectiveness as as a partner when it comes to OT cybersecurity? We can start with Ms. Zetter, if you want.

Ms. Kim ZetterSPEAKER_02

I don't have direct, because I'm not a practitioner, so I don't have that assessment to know firsthand. But what I do know is that CISA in the past had, I would say in the last decade, really, a lot of expertise that they were able to give to critical infrastructure, either to go out into the field and do critical assessments of the networks, give them risk assessments about what they needed to do, and then also they had flyaway teams that when a system was compromised, that they would be able to go out and assist directly in doing some kind of remediation. So I think that the impact of CISA has been really great, but of course they're limited in their resources and who they can give assistance to.

Mr. Robert M. LeeSPEAKER_04

I would say that my commentary about CISA probably is reflective of a number of government agencies that deal in this space, which is really good Americans trying really hard to do good work that have very talented people, but are hardly being effective for the amount of money we're spending on it in comparison to what's happening elsewhere. As an example, flyaway teams, the incident response teams, et cetera, there's absolutely nothing unique happening there in comparison already in the private sector. I think there's a very important role and responsibility for government to play, and I think a focused CISA would be extremely impactful. And I've, in passing, talked to Sean Plankey. I'm really excited about the way they're looking at it now. But I think a lot of times we overstate the effectiveness. And I'm sure that this is not going to earn me any friends at CISA, and many of my friends are there. But I will say that we've got a couple of years before we have significant issues. And I'm very concerned about the next couple of years going to war with China and it being focused on our OT. And I would really like to move past pleasantries. So, we should focus them a heck of a lot more.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Thank you.

Ms. Tatyana BoltonSPEAKER_03

I would say that I think CISA can certainly grow in its effectiveness, and I think we will see that under Sean Plankey. I think things like automated information sharing, the EINSTEIN program, CyberSentry, I think there's a number of places there where we can modernize some of that legacy infrastructure. They're operating not necessarily with the most updated sensors, and I understand that it is expensive to upgrade the systems. But if we want CISA to be acting as the frontline defense for cybersecurity and as an expert, they need to have up-to-date systems. They need to have sensors on the networks that are what is modern right now. But I think that'll—

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Dr. Gleason.

Dr. Nathaniel GleasonSPEAKER_06

I would say some of our best and most effective work with CISA has been when they've worked in partnership with some of the other federal departments with stake in the space, in particular with the Department of Energy looking at threats to the energy sector and the Department of Defense looking at defense-critical infrastructure. Just to echo on some earlier comments, I think CISA also works best when they do work that is appropriate to the government to do and not trying to do what the private sector is already taking care of. The government has specific advantages in our access to the intelligence community, in the ability to do things that the private sector is not or shouldn't be doing. I think the more that the government sticks to that space, the more effective that those programs will be. And I also want to echo definitely look forward to Sean Plankey coming in and very excited about Nick Anderson coming in. We've had great experiences working with him previously and think their leadership will be very effective.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

I think we can all agree that we're very excited to see Sean Plankey get confirmed as soon as possible. It'll be a good day, I think, for CISA to have him in there. Mr. Lee, I want to go back to you, because you were very passionate in your hands today, and you really want to get involved. Can you go a little more in depth? Because this is the stuff we're going to have to work on.

Mr. Robert M. LeeSPEAKER_04

SANS Institute, which is the leading cybersecurity provider, analyzed every single industrial cyberattack that's ever taken place and just asked the basic question of what security controls actually worked. It was five. And we know exactly what those five are, we know exactly how to do it, and if you look at regulations, standards, and everything else, it's not five. Further, when you look at our rural communities, as mentioned, about 98% of this country is in that sort of below the cyber poverty line discussion, and they're not doing pretty much anything unless it's really passionate members there trying to help. But going back to what Kim said as well, you've got a large number of companies that will stand up and say how robust their security programs are, and I'm in a lot of those environments and they're terrifying. So I have three kids. I did not really want to go back in the Army for extra time. It was, I really want to get this right. And I think if we're going to be serious about the conversation, it's focus on what we can actually do across the next couple of years. Pick a point of view. You're going to upset some people in doing so, but we need to do it. And at the same time, I would say you can roll out quickly. I think about 95%, anecdotally, about 95% of all cyber spend goes to enterprise IT, about 5% to OT. That is where your national security is, your environments, your local communities, and all of your ability to generate revenue. You look at sort of the visibility in this country. If you actually want to monitor your OT infrastructure to figure out is China already there, I would say probably about 10% of the infrastructure around the country is being monitored. So when we're having big discussions about what comes next, I would just highlight that we're not even really being serious about what we know today.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

I appreciate that. Thank you very much. We're going to now start our second round of questions. So I recognize for the second round the gentleman from Florida, Mr. Gimenez, for 5 minutes.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

Thank you, Mr. Chairman. And I'm going to pivot a little bit. So do you all know what MAD is? Mutually assured destruction. MAD is not really all that mad. MAD kept us safe for about, you know, 50 years, 60 years, right? Where, yeah, the Soviet Union had, you know, thousands of nuclear weapons, but so did we. And if they ever used it, then we would use it on them, and that that kept us safe. In a frightening kind of way, but it did. It kept us safe, all right? And so, my question to you is, is there is the Department of Defense, but part of the Department of Defense is the department of offense. So it's If we were just, Hey, well, we're here to defend the homeland, and we're going to play defense, well, you're inviting attacks because there's no there's no counterpunch. What's our offensive capability? What is your assessment of our offensive capability in this realm?

Mr. Robert M. LeeSPEAKER_04

I'll take first pass at that. We are very, very good at our offensive capability. I think some concerns I have, you have to be able to get to root cause analysis on determining if we were attacked for us to go back and do something. I'm aware of numerous cases the government is currently tracking as maintenance issues for explosions and otherwise that were actually cyberattacks. If we're not detecting what's happening, then we're just going to say, Oh, it must have been something random, and we're never going to get offensive. But putting my military hat on now, even just down the 91st Brigade alone, we've got a lot of offensive capability, and I would not want to be on the other side of us. But we also have to make it extremely hard for our competition to come back at us and at least know when they do it so that we can unleash our warriors.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

Do we do that often enough? Do we flex our muscle often enough?

Mr. Robert M. LeeSPEAKER_04

I think just looking back to testimony and commentary from Joe Naglisoni General Nakasone, General Haugh, and others, I would say that we do not. I do not want to see an offensive world. I do not want to see targeting of civilian infrastructure. But when our adversaries make it very clear that they want to hurt us and hurt our families, I think we have to be very serious about showing them that we can do the same.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

I agree. So if we actually flexed our muscle every once in a while—the DOD flexes its muscle every once in a while, right? So do—I guess you're saying we don't flex our muscle often

Mr. Robert M. LeeSPEAKER_04

saying we don't flex it enough, but I would also advise that we have to be very serious on defense because we will see things back. Even if one agency in a government authorizes something at us and we are doing something that we view to be retaliatory, other agencies in that same government may not be aware of it unless we're able to call it out. And then all of a sudden you have a very escalatory situation.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

We have a new realm of warfare, I guess defense and offense, is space. And so we created the Space Force, all right? Should we create a cyber force?

Mr. Robert M. LeeSPEAKER_04

I'll stick with it and then open up to the panelists. I think it's time. I was very against it when I was in the Air Force. I was very against it for the years after, looking at how it was going to be orchestrated. I think it's time to do it, sticking to its OT&E mission of organizing, training, and equipping. Let Cyber Command and the combatant commands be the actual Title 10 authorities that we have, but we definitely need a dedicated service. But I think if you're going to do it right, you have to do it extremely big and right, because the problem that you'll have is all that infighting and the stuff that people say, Oh, we politely work together in interagency. No, we don't. People are very territorial, and people will keep their best cyber warriors to themselves and others

Rep. Carlos Gimenez (R-FL)SPEAKER_01

So you're going back to my first round of questioning, right? That there's turf guarding.

Mr. Robert M. LeeSPEAKER_04

There's a lot of turf

Rep. Carlos Gimenez (R-FL)SPEAKER_01

guarding. Oh, there is a lot of turf guarding. And so I would figure that now with Space Force and the Air Force, there's probably a lot of turf guarding there, right?

Mr. Robert M. LeeSPEAKER_04

I don't see it as much myself, but I did leave the Air Force a while ago. I will say the Army would be very happy to have a cyber force under it from a department level, but I'm not so sure that it shouldn't just be made a department-level service.

Rep. Carlos Gimenez (R-FL)SPEAKER_01

Okay, fair enough.

SPEAKER_UNKNOWN

Um,

Rep. Carlos Gimenez (R-FL)SPEAKER_01

okay, that's, uh, that's, uh, all the questions I have, and I yield back the rest of my time. Thank you.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Gentleman yields back. I now recognize the gentleman from Texas, Mr. Luttrell, for 5 minutes of questions.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Good to hear you say— I've been working on that cyber force idea for a while, and General Haugh and I had some pretty interesting conversations behind closed doors. Absolutely a brilliant guy in his stance, but I think he was trying to protect the nest. But I think we're far enough along where a cyber force should be absolutely— the conversation should be had. To the conversations that you were having with the chairman, and you listed five things, I come from a very rural district, and I've had CISA out to the district to talk to our business owners. But where's the piece of paper at? What can I hand off to everybody that is in my district and to my state and say, Here, implementation of these five things will get you to a better place? And, of course, as you said, everybody's going to beat it up because they're not going to be the ones that are involved in it or whatever, but, I mean, from our nursing homes, to our banks, to our school districts, they've all been hit, and we have those— very— again, you heard me say it in my last line of questioning— very reactionary, because we don't know what we don't know. Where does that live? Hand it to me. Help me out here.

Mr. Robert M. LeeSPEAKER_04

Yes, sir. Yeah, the SANS Institute published the five critical controls. It's been backed by other governments as

Rep. Morgan Luttrell (R-TX)SPEAKER_07

well. The what did?

Mr. Robert M. LeeSPEAKER_04

SANS Institute.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Where does that live? Because if I walked into Conroe, Texas, and said, Hey, go visit this place, they're going to look— they're going to look at me like I'm crazy. Yes, something that the legislation all the way up needs to be talking about. I like to say we need to Facebook this thing so everybody and their cousin knows about it.

Mr. Robert M. LeeSPEAKER_04

Yes, sir. Yeah, I would love to see, again, government have a single voice to say, Here is actually what's working. And as a rural guy from Alabama who joined the military, if I can figure it out, I promise everyone in your district can as well. But we need to speak, again, with one voice of government. If CISA had a single page of, Here is the resources available to you. This is what you can do, and every agency around supported it instead of their own thing, I think you'd see a lot more outcomes.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

And if we do do that, will the bad actors globally pinpoint those specific IT/OT and go after it, and then we're just dead in the water?

Mr. Robert M. LeeSPEAKER_04

No, I, I don't think it would work in that such way. Um, even if you advertise broadly what your strategy for security is, it's the fact that you're actually doing and implementing it that makes you defended. The fact that your adversary knows you want to invest in secure remote monitoring or secure remote access or monitoring, that doesn't make you any less, uh, secure.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

They're— well, they'll most likely look somewhere else.

Mr. Robert M. LeeSPEAKER_04

I hope so. Right now it is way too easy to target our systems, and right now we are doing very little. I would love to raise the bar where they actually have to come up with something creative.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Raise it. I mean, you're sitting in front of the group that's sitting here. Hey, we're asking you to— I won't speak for my colleagues, but hey, I'm asking you right now on record, do it. Bring it to us.

Mr. Robert M. LeeSPEAKER_04

Yes, sir. I provided some written testimony. I'm happy to brief you at any time, and I am trying my best.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

I will absolutely see you after class, sir. With that, Mr. Chairman, I I yield back.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

The gentleman yields back. I now recognize the gentlelady from New Jersey, Ms. McIver, for 5 minutes of questions.

Rep. LaMonica McIver (D-NJ)SPEAKER_00

Thank you so much, Chairman, and thank you to our ranking member. My district sits at the heart of our nation's largest metropolitan area and is home to a major airport, one of our nation's busiest ports, numerous railroads and pipelines, and key industrial facilities, among other critical infrastructure. Securing these facilities requires resources, and for publicly owned critical infrastructure, those resources have often been lacking. As part of the Infrastructure Investment and Jobs Act, Congress provided $1 billion to establish the State and Local Cybersecurity Grant Program. State and local governments can use this funding to strengthen the OT security of publicly owned critical infrastructure. Unfortunately, under current law, the program is set to expire in just over 2 months. Ms. Bolton, I have a question for you. How important is it to continue funding for the State and Local Cybersecurity Grant Program?

Ms. Tatyana BoltonSPEAKER_03

I think it's critical to continue that funding. I mentioned in my testimony that most— a third of districts around the country are rural districts. And obviously that's not the case for your district, but I think it's still incredibly important. There are not only large ports and airports in your district, but also smaller smaller entities, and those are the ones that really desperately need help. I will add to your question earlier as well that CISA has released a top five OT cybersecurity guide. So I think that also can help to to provide guidance to those entities as to what they can use their cybersecurity spend on. And at OTCC, we're also working on guidance as well.

Rep. LaMonica McIver (D-NJ)SPEAKER_00

Thank you. Can you just elaborate a little bit more on how should state and local governments prioritize their resources to strengthen their OT security?

Ms. Tatyana BoltonSPEAKER_03

So I think it's very important to start at the very beginning. We do know some of the controls that work, and so we should put those in place: multi-factor authentication, segmenting, even micro-segmentation of networks, making sure that we are securing remote access. And also I'd add that most of the attacks that are happening on our critical infrastructure aren't zero days. They're not the most sophisticated vulnerability or the most sophisticated attacks. They are using things that we've seen before, sometimes not changed at all, sometimes mildly changed, and we continue to be hit by these attacks. I think, for example, CISA releases a top 12 cyber vulnerabilities top 12 Routinely Exploited Vulnerabilities list. Why would the government or any state entity still be able to buy those products off of that list if one side of the government is saying, These are commonly and routinely exploited? We should never be allowed to buy those. So things like that, I think, are extremely important.

Rep. LaMonica McIver (D-NJ)SPEAKER_00

Thank you so much. I want to thank the witnesses for being here today, for providing testimony, and I really do appreciate the chairman and the ranking member's steadfast focus on this issue, and also being supporters of the reauthorizing of the State and Local Cybersecurity Cybersecurity Grant Program. So I look forward to continuing to work with both of you and this committee to provide state and local governments the resources they so desperately need to secure their critical infrastructure. With that, I yield back.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Will the gentlewoman yield? Can I, can I borrow your minute?

Rep. LaMonica McIver (D-NJ)SPEAKER_00

Sure.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

This is piggybacking off one of the questions you asked. You said CISA listed five things as well. Is it the exact same list is what you're saying?

Ms. Tatyana BoltonSPEAKER_03

It is not. This is another issue that we have.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Okay, so there's, there's a problem. I, I had— now I'm taking 2 lists.

Ms. Tatyana BoltonSPEAKER_03

Yep.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

And saying, here you go. And then that, that is an issue.

Ms. Tatyana BoltonSPEAKER_03

Absolutely.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

On top of those 2 and the $10,100 million that everybody else brings to you. And it did— for a poor, poor district like ours, like, I mean,

Ms. Tatyana BoltonSPEAKER_03

yeah,

Rep. Morgan Luttrell (R-TX)SPEAKER_07

here we go. Thank you very much.

Ms. Tatyana BoltonSPEAKER_03

Well, and I will say this, um, the cybersecurity industry as a whole is aligned on things like implementing multi-factor authentication, network segmentation, continuous monitoring and detection, uh, but there are sort of these, um, there are sort of these conflicting guidances that do exist. Same with frameworks, conflicting frameworks for OT. So the, the people in your district or the operators in your district that are trying to just do the the right thing, they don't know where to start.

Ms. Kim ZetterSPEAKER_02

Correct.

Ms. Tatyana BoltonSPEAKER_03

And especially when it's like NIST Cybersecurity Framework 2.0, there's like 80 pages, right? People who are running these OT networks don't have the knowledge to read through an 80-page document and know where to start. So one of the things is like NIST is creating some quick start guides. I think that would be very important to do for OT security.

Rep. Morgan Luttrell (R-TX)SPEAKER_07

Thank you. I yield back. Thank you, ma'am.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

gentlelady yields. And thank you very much for your enthusiasm about state and local, the grant program. I hope it's something that we can get reauthorized right away. I think it could be a very big bipartisan issue. I now recognize the gentleman from Tennessee, Mr. Ogles, for his second 5 minutes of questions.

Chairman Andrew Ogles (R-TN)SPEAKER_08

Thank you, Mr. Chairman. Mr. Lee, I think you said 98% of communities were below the cyber poverty line.

Mr. Robert M. LeeSPEAKER_04

Yes, Congressman. About— if you look at companies under about $100 million in revenue, of Across all of our electric and water utilities, that's about 95 to 98% of them. Goodness

Chairman Andrew Ogles (R-TN)SPEAKER_08

gracious. And so I want to go back and just double down on this issue again, coming from the county executive level. And, to my good friend to my left here, his district as well, I'm sure he's seeing the same thing, is that your IT director is also the guy that's setting up emails and plugging in keyboards and probably spends 60 to 80% of his time not in his office, not at his desk, not being offensive, because a good defense is a good offense, looking for those weaknesses, looking for those back doors, looking for those left-around passwords and such. And so, and I'll use the word framework in the context of more like a toolbox. And I want to be careful here because, borrowing from Reagan, he said the scariest phrase in the English language is, I'm from the government, and I'm here to help. And what we don't want to do is create a monster that suddenly is nothing more than a big bureaucracy that is designed to grow and gobble up resources. But what I do see here, again coming from that local background, is there is a vacuum here. There is a void. And quite frankly, our communities don't have the expertise. And even if they do have the expertise, I'm not sure they have the bandwidth—bandwidth in the context of man or woman-hours. And so we've got to figure out how we move forward and how we quite frankly equip some of our local communities, because, again, if I'm on the other side of the pond and I'm seeing the opportunity, that moment to seize, I'm going after the locals. I'm going after those water systems. And you want to talk about creating pandemonium, suddenly your small rural cooperative electric or water system goes down and it's not working and it's not coming back online for a few weeks, and that's been Swiss-cheesed across the country. That's what, again, I go back, having been the county executive, that's what keeps me up at night. And Mr. Chairman, I think my challenge to the committee is that's something that we need to work on, being careful not to create, again, a monster that grows and grows and feeds at the trough, that government trough. And then back to the whole idea of creating a department-level service with Cyber Force, I think that's incredibly, incredibly important because cyber is not just across the networks. It touches into the drones and the capability of jamming and all sorts of things. So those capabilities have to become—we have to lead on that frontier and quite frankly become untouchable in the same way we're untouchable in airspace and communications. With that, Mr. Chairman, I yield back.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Gentleman yields back. I now recognize the ranking member, gentleman from California, Mr. Swalwell, for his second 5 minutes of questions.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

Dr. Gleason, what is the status of Lawrence Livermore's other partnerships, including its support for the National Infrastructure Simulation and Analysis Center?

Dr. Nathaniel GleasonSPEAKER_06

Those are in a similar status to our our support for CyberSentry. Our work for National Risk Management Center, again, looking at infrastructure interdependencies and cascading consequences of disruption to infrastructure has been going on for a decade. Our interagency agreement expired in March for that work.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

What is the risk to what you're able to see or what you were able to see and what you don't see now as far as cyber vulnerabilities that are out there?

Dr. Nathaniel GleasonSPEAKER_06

I think one of the big things that we miss, and I want to emphasize the idea of cascading consequences, a lot of times when we're thinking about cyber attacks on critical infrastructure, the target may not be that infrastructure system itself. It may be what is supported by that infrastructure system. And when we fail to understand those interdependencies, we are opening up avenues for our adversaries to disrupt key national security capabilities. A great example of this is some of the capabilities on on the territory of Guam. This is a a small, very hard-working, very dedicated power company, but very under-resourced. And some of our most important capabilities for defending against a potential China invasion scenario are based in Guam. There are ways to defeat those capabilities that go through, for lack of a better word, the back door by exploiting kind of the the weak underbelly, the underdefended part of our critical infrastructure, because those are very small systems. By not understanding those interdependencies, it's not that they don't exist, our adversaries know them. If we don't, we're not looking in the right place for our defense.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

In just over 2 months, the— I'm sorry, did someone else— you're good. In just over 2 months, the Cybersecurity Information Sharing Act of 2015, the other CISA, is set to expire. And Mr. Gimenez alluded to this. It's essential that we act promptly to reauthorize it in a clean way, and I'm open to any reforms that we could discuss down the road under the chairman's leadership of the full committee, but I think there is a wide consensus that we don't have time to do that now. Congress will be in recess effective this week until after Labor Day, and then we will be right up against CISA's expiration. Ms. Bolton, your testimony discusses the importance of reauthorizing CISA 2015. What would be the national security impact if the law lapses?

Ms. Tatyana BoltonSPEAKER_03

The estimates are that about 80 to 90% of information sharing would be cut off from the federal government. When I was at the Cyberspace Solarium Commission, one of the main things that we tried to get— tried to do was to make sure that the federal government at least had a full threat picture. And this authority is part of that work, a significant part of that work, and we must reauthorize it. If we are about 2 years away from a contingency with China in 2027, as ODNI has said, then we have to be fully prepared. We have to be taking steps now and not just addressing the information sharing piece. That should be a baseline. It should be a given, and we should be focused on the additional steps that we need to take. So I hope that that gets reauthorized quickly and that we can move on to some of these other topics that we've been discussing and addressing some of the other extremely serious issues, because China is not waiting. China is preparing now. And so are all our other adversaries.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

Mr. Lee, your experience in the private sector, is there any world where CISA 2015 lapses and a private sector company that has been hit would still be willing to come forward and share information with the Department of Homeland Security?

Mr. Robert M. LeeSPEAKER_04

No, I think it's incredibly important to reauthorize it, and the bidirectional communication from government to private sector, especially on the threat picture overall, is exactly one of the roles and responsibilities that makes a lot of sense.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

And that's because no CISO would be able to go to DHS without liability protection.

Mr. Robert M. LeeSPEAKER_04

Yes.

Ranking Member Eric Swalwell (D-CA)SPEAKER_09

And their fiduciary duty to the shareholders. I mean, they would be exposing themselves to a lot of risk. Is that right?

Mr. Robert M. LeeSPEAKER_04

Absolutely. And that's actually a broader issue, even looking from a National Guard perspective of could we go in and respond to a utility that gets hit. We have no indemnification to give utilities, so they're not going to let us touch anything and do any action on it. There are very simple bureaucratic things that could be fixed to increase national security tomorrow.

Chairman Andrew Ogles (R-TN)SPEAKER_08

Great, thank

Mr. Robert M. LeeSPEAKER_04

you.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Gentleman yields back, and I can't agree with him and the witnesses more and my other colleagues that we have to reauthorize it. We do have to change the name though. Yeah Okay, that's got to be at least one change we have to do. I understand people want to do clean, and we have to get it done, but I do want to hear from you all because I think there should be changes. There should be. It's a 10-year-old law, and clean reauth, it doesn't include things that we've learned over the last 10 years. So, I would like to hear from you all. Is there language or are there changes or focuses that we should implement into the law that we should consider to ensure OT is better protected or covered?

Ms. Tatyana BoltonSPEAKER_03

Well, I would just add that, and I think you all are already considering this, but including OT much more directly within the language. It's currently not in the bill, or not in the legislation. And I would also say that identifying DHS and CISA as the main sort of gateway for sharing would be ideal. Because as we've spoken before, the the the confusion for industry of coming into the and talking with the federal government, sharing information with the federal government, that remains a problem. And we hear that all the time from our member companies and from other companies that I work with, that they don't know where to go. They they say, Well, I need to talk to maybe I should talk to TSA, maybe I need to talk to FBI, and then maybe FBI will tell CISA. That can't be assumed. And so we need to make sure that we need to make sure that that language is clear within the legislation.

Mr. Robert M. LeeSPEAKER_04

Yeah, I would completely agree with that. And also there needs to be, here's what you get in return, here is what we can do to help you because you gave us this information. A lot of times that a lot of asset owners and operators feel that it's a one-way communication into government with no expectation of what comes out of it. You want somebody to go through the risk of sharing information, there's got to be a very clear, and here's the rules of the road of what we can provide for you as a result, cross-agency without any drama. We talked about turf wars. I led the OT portion of the incident response for Colonial Pipeline. I witnessed a lot of turf wars between FBI and CISA. It needs to be very clean or no asset owner and operator will want to work with them. They view them as children.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

Yeah, I've heard from I've heard from a bunch of— it's very important. This was a major part of my, by the way, my presentation to become chair of the full committee was making sure that this does not lapse. So it is a top priority for me, and as I know for the other members on the committee. And I have spoken to many people in the private sector that said it would be devastating and they would not uh, they would not be able to talk to the government if this expires, and it would be devastating for us. I do want to get back to the Stuxnet. And we're very privileged to have Ms. Zetter here to talk about it. So I want to get it back into the— what is the significance of Stuxnet today, and what lessons did we learn? What lessons should we have learned that we have not learned yet from it?

Ms. Kim ZetterSPEAKER_02

The primary lesson is the focus on OT systems, that Stuxnet showed the danger that weapons like this can have against critical infrastructure and, of course, not just doing what a normal virus does, but causing destruction. I think also the basically the small utilities and the small organizations. I just want to emphasize that because it's been brought up a lot. I talked about when you asked me how effective CISA has been, and I said that they've been effective in terms of providing these small organizations with a service that they can't otherwise get. And the panelists had said that the CISA shouldn't be doing what local or what private industry can be doing. The problem is, is that those small utilities and small organizations don't have the funds or haven't had the funds, in many cases, to actually get it privately. So, they have relied on CISA for that kind of service. And I think that when we have legislation, of course, that has that that that that ability to provide the funds, that's really significant for those organizations and that shouldn't go away. So, I think that the overall lesson from Stuxnet is that the capabilities out there are really sophisticated, really advanced, and we haven't seen the full use of the capabilities that Stuxnet showed for various reasons. Probably deterrence is one of the good ones, at least from the US perspective, that adversaries are having second thoughts about targeting US infrastructure. But also, there's a I sort of make a distinction between those who have the will and those who have the ability. And those who have the ability haven't until now really had the will to go after US critical infrastructure. And those who have had the will, perhaps maybe terrorist groups, others, haven't necessarily had the ability. It doesn't take much to marry those two together. Even someone that has will and doesn't have ability can purchase that ability, can purchase that capability. And now we're entering into a a phase where even we've relied on the large nation-states, China and Russia, we've relied on them not having the will to target US infrastructure. And I think what we're talking about and going into potential conflict with China, we've reduced we've eliminated that that gate now, and and they do have the will potentially to go after US infrastructure. So, I think that that's the lesson learned from Stuxnet.

Chairman Andrew Garbarino (R-NY)SPEAKER_05

It's a scary way to end this, uh, committee hearing, um, but I appreciate it. And that, that's a big concern for me, is when the people with the will and the ability are the same person, because, uh, That's a scary thought, and that's what we have to be prepared for. I want to thank all the witnesses and all the members. This is— I mean, the fact that so many people stuck around for second round of questions just shows you how important this topic is. So I want to thank you all for your valuable testimony, the members for their questions. The members of the committee may have additional questions for the witnesses, and we ask that you all respond to those in writing pursuant to Committee Rule 7(e). The hearing record will be held open for 10 days. Without objection, this committee stands adjourned.