Open/Closed: To receive testimony on defense of the Department of Defense Information Network

SPEAKER_00

on the defense of the Department of Defense information

Chairman Mike Rounds (R-SD)SPEAKER_03

Cybersecurity Subcommittee today. You did an excellent job at the Army Cyber Center of Excellence on Fort Eisenhower, and it is great to see that the Army is cultivating and rewarding capable cyber operators and leaders like yourself. Your testimony on securing and defending the DODIN comes at a critical juncture for our nation's cybersecurity posture. Our military must maintain a ceaseless vigil against relentless attacks on our networks from sophisticated adversaries. This is not a theoretical battle. Cyber operators actively defend our networks against state and non-state actors 24/7, 365 days a year. The fundamentals of the cyber domain present a persistent challenge. Adversaries require only a single successful breach, while we must maintain perfect defensive integrity across all systems at all times. The department has invested billions in active defense of the network that supports the entire DOD. Defense Information Systems Agency, or DISA, is the organization responsible for providing and running the department's secure systems and networks. The organization responsible for protecting and securing the daily operations of those networks is an organization called the Joint Force Headquarters - Department of Defense Information Network, or JFHQ-DODIN, and Lieutenant General Stanton oversees both and, as such, is one of the many individuals across the department that is dual-hatted. The DODIN has been around for 10 years, and the directive to elevate it to a sub-unified command represents a significant organizational milestone. Making it a sub-unified command allows it to be task-oriented underneath Cyber Command to focus on running and securing the DOD's networks, and will further strengthen our defense. DISA and JFHQ-DODIN use different tools to protect DOD networks, such as Thunderdome and the Zero Trust Security program, both of which are being implemented very quickly. Today, we will hear about these two systems, which will be ready by 2027, along with other important network security programs. Despite progress in these security programs, the road ahead demands continued focus and urgency, from securing the operational technology in end-user devices and weapons systems to implementing artificial intelligence capabilities that can detect adversary activities before they approach our networks or hunt them down if they make it in. The technological imperatives are clear. We must develop and implement emerging technologies in innovative ways, securely and quickly. Our adversaries are rapidly innovating, and we must do the same. The threat of cyber attacks is not diminishing; it grows more sophisticated each day. When we examine the resources near-peer competitors like China are devoting to developing their cyber forces, the gravity of the threat becomes more stark. They are aggressively pursuing technology to enhance their effectiveness in cyberspace and continue to make significant investments in artificial intelligence to build more sophisticated capabilities. American technological superiority has historically been our asymmetric advantage, and we must maintain this in the cyber domain. We cannot permit a capability gap to develop in such an all-encompassing and important domain of warfare. The first proverbial shots to be fired will take place in this domain. Any attack in any other domain will be preceded by an attack on our vital cyber networks. While initiatives to develop capabilities such as exquisite AI-enabled cyber defense are underway, the timelines associated with delivery of these needed cybersecurity capabilities and environments are clearly too slow. Extended deployment schedules create operational risk that our forces have to mitigate through other means. Our adversaries operate on compressed timelines. Our response capabilities must match or exceed their tempo. Today, I look forward to understanding more of the notable achievements in securing and defending the DODIN. I am particularly interested in how DISA and JFHQ-DODIN intend to accelerate delivery of these critical systems to enhance our defensive capabilities, from the cellphone to the laptop to the enterprise network. This subcommittee stands ready to provide the support needed to guarantee these vital efforts succeed in protecting our nation's most critical networks. I'll now recognize my friend and colleague, the ranking member, Senator Rosen, for opening remarks. Senator Rosen.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

Well, thank you, Chairman Rounds. And I'd like to begin by welcoming our witness, General Stanton, and thanking him for joining us today to discuss the security and resilience of the Department of Defense Information Network, what we know as DODIN. So much easier to say DODIN, lots faster. This is a critical issue, not just for cybersecurity professionals, but for every person in uniform and for every single mission around the globe. We must rely on trusted real-time access to information and communication. As the Director of the Defense Information Systems Agency and the Commander of the Joint Force Headquarters-DODIN—so we have JFHQ and DODIN, we're going to be in alphabet lots of acronyms today, but, General Stanton, we're so proud—you oversee one of the largest, most complex, and most targeted networks in the world, one that supports the President, the Secretary of Defense, the Joint Chiefs of Staff, and our warfighters operating across the globe. That is no small task, sir, and I want to recognize the incredible scope of your mission and the personnel who support it. We are operating in an era of persistent threats, cyber threats, where our adversaries, they're probing, they're testing our systems every single day, seeking any opportunity, however small, to degrade our command and control, to disrupt our operations, or steal our most sensitive information. This makes defense of the DODIN a linchpin for national security, for national safety, our personal security. As a former systems analyst and computer programmer, I've seen how much the technological landscape has evolved since I began, and how deeply integrated digital infrastructure has become to our operations and, frankly, every single bit of our lives. But with that evolution comes an expanded attack surface. And as we integrate to more cloud-based services, AI tools, zero-trust architectures, we also face increasingly complex security challenges. In this hearing, I hope we can explore how DISA is managing that complexity, how you're building resilience into the system, how you're attracting and retaining cyber talent, and integrating innovation into what you do without compromising our operational security. I'm also particularly interested in how your team is implementing zero-trust principles across such a vast and frankly diverse enterprise, and what this subcommittee can do to support this critical effort. We know that the threats are evolving faster than ever, and that's not ever going to change, I don't think. So we must evolve our defenses to meet the ever-changing threat. So I look forward to today's discussion, to working with you, with Chairman Rounds, and our colleagues on both sides of the aisle to ensure that DODIN remains well protected, agile, and always mission-ready. So thank you, Mr. Chairman. I yield back.

Chairman Mike Rounds (R-SD)SPEAKER_03

Thank you. And Lieutenant General Stanton, you may begin if you have opening remarks. Your full statement will be in the record.

Lieutenant General Paul T. StantonSPEAKER_01

Chairman Rounds, Ranking Member Rosen, thank you for your support and the privilege of representing the men and women of the Joint Force Headquarters-Department of Defense Information Network and the Defense Information Systems Agency. I appreciate the opportunity to share our progress in designing, building, deploying, and defending the Department of Defense Information Network. It's a central resource and critical weapon system for meeting our nation's objectives, including defending the homeland, deterring China, and rebuilding our military. Our mission never rests. It's hard to imagine any aspect of planning, preparing, or executing modern warfighting that does not include data production, consumption, transport, or analysis. Joint Force Headquarters-DODIN and DISA have the responsibility of securely delivering real-time, globally accessible information to the joint warfighter. We ensure the right data is at the right place at the right time, empowering commanders to make better and faster decisions than our adversaries. We are warfighters supporting warfighting. We inculcate the warrior ethos. Joint Force Headquarters-DODIN and DISA maintain distinct responsibilities, yet support one another to balance performance and security in the context of risk. On behalf of U.S. Cyber Command, the Joint Force Headquarters-DODIN organizes, observes, and maneuvers within cyberspace to defeat enemy aggression and preserve functionality for friendly operations. Under the direction of the DOD Chief Information Officer, DISA designs, builds, and securely operates the DODIN. Together, we enable the inherently joint, partner, and enterprise-scale capabilities that ensure mission success. Accordingly, our priorities to meet the urgency of our challenges are consistent for both the command and the agency. First, we are building collective readiness across the department and with our industry partners. Success in warfighting requires forces that are manned, organized, trained, and equipped to operate effectively at both the individual and collective levels. Cyber operations require combining skill sets such as host, network, and data analysis towards mutually supporting outcomes. Each must do his or her part with confidence and competence. Importantly, our headquarters must also confidently issue DODIN-wide orders knowing that receiving organizations are ready to execute. The elevation of Joint Force Headquarters-DODIN to a sub-unified command will significantly increase readiness by establishing a unified command structure that drives consistent training standards and readiness evaluations across all 45 organizations that own a portion of the DODIN battlespace. Our second priority is campaigning. We are proactively planning and prioritizing to defeat cyber adversaries and to provide functionally relevant capability to warfighters at the time and place of need. Understanding cyberspace dependencies, the enemy's intent, the enemy's capabilities, and the potential for the enemy's capability to actually impact the mission provides focus for our defensive operations. We prioritize our limited resources against the most critical systems and preserve our freedom of action while imposing cost on the adversary. Just as fast as capabilities are in place, they require upgrades. Our third priority is, therefore, continuous modernization. We actively field emerging technologies and iterate within our development process. We design for extensibility, with the understanding that technology and the operating environment will inevitably change. As we rebuild our military, we shape the information environment according to how we intend to use it. We ensure it is always ready to meet expeditionary warfighting requirements. Our final priority is to establish lethality. We impose cost on our enemies and provide decision advantage to our warfighters. Deterrence in the cyber domain includes raising the cost of attack beyond that which an adversary is willing or able to bear. Thinking beyond cyberspace, all battlefield operations are subject to the proliferation of data. We must transform it to enable lethal and oftentimes kinetic action. We are charged with sensing and transporting disparate data streams into coherent and comprehensive picture that empowers decision makers at all levels. Securing our nation requires a robust, resilient, and well-defended cyber environment. I'm proud to represent the individuals serving Joint Force Headquarters-DODIN and DISA who carry out this mission every day. With the continued support of this committee, our cyber forces will remain prepared to meet the challenges of today and the threats of tomorrow. Thank you, and I look forward to your questions.

Chairman Mike Rounds (R-SD)SPEAKER_03

Lieutenant General Stanton, thank you. I'll begin, and we'll move back and forth in five-minute rounds, and we'll do a couple of them, and then, if we have other members join, they'll be welcome to come in as well. In April, the Zero Trust Portfolio Management Office announced a 2030 timeline for full implementation of zero trust across operational technology devices and a date of 2035 for weapons systems. Given the rapid evolution of threats targeting these systems, what interim security measures are being deployed to mitigate risks during this extended period?

Lieutenant General Paul T. StantonSPEAKER_01

Senator, I appreciate your question. DISA has introduced Thunderdome, which is our implementation of zero trust. So, we are able to look at individual systems, the individuals that are using those, make informed decisions about what resources they are able to access. We follow the zero trust principles. In fact, Thunderdome was recently assessed by a third party, meeting all 132 of the 132 Department of Defense standards and activities for zero trust. We have it in action already. We have implemented zero trust in coordination with SOUTHCOM, and in addition, we have it embedded into the evolution of what we refer to as DODNet, the modern and secure infrastructure and architecture that DISA is providing.

Chairman Mike Rounds (R-SD)SPEAKER_03

Since this is an open session, let's talk a little bit about Thunderdome. And can you give us a little bit of an indication here so that folks that are listening to it and sounds interesting, but just exactly how does it work?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. So we have a number of appliances and software products that are state-of-the-art provided by our commercial industry partners that we integrate into a coherent solution. We first check to see who individuals are in the environment. We also check the state and security of the device upon which they are operating. We put those 2 together to make sure that the user on the device are authorized to access resources, and then we have fine-grained controls that determine which resources they're able to access.

Chairman Mike Rounds (R-SD)SPEAKER_03

So when you're doing this, and for the next couple of years, it really is a challenge for any defense system to actually modernize while still maintaining that operational capability. And what you've done is taken Thunderdome, and during this interim time period, you've integrated into the systems, and basically every single user, along with the platform that they're on, is checked before it's authorized entrance into the DODIN. Accurate?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator.

Chairman Mike Rounds (R-SD)SPEAKER_03

Okay. And successful in terms of what do you— is it 100% successful? Is it— what's the probability of somebody getting around that? And what's the biggest risk to it?

Lieutenant General Paul T. StantonSPEAKER_01

So another inherent principle to zero trust is to continuously evaluate the access to the resources. So it's not just getting into the DODIN, but it's each time that you go to access resources, you're reevaluated. So the risk of someone gaining access, that exists. We will never be 100% secure. However, we check and validate every subsequent access, and if the enemy gained a foothold into the environment, they can't operate without impunity, and we log everything to track what is happening in the environment.

Chairman Mike Rounds (R-SD)SPEAKER_03

kind of leads me into the next question, which is the September 2024 DODIN Command Operational Framework introduced new requirements for reporting readiness through the department's readiness tool called the Defense Readiness Reporting System, or DRRS. What specific cybersecurity metrics, what are the metrics for being, what are you capturing with that, and how do these metrics provide a more comprehensive view of the DODIN operational readiness?

Lieutenant General Paul T. StantonSPEAKER_01

Senator, readiness is my number one priority, and the question you're asking is exactly what we're driving towards. We have baseline metrics that assess the effectiveness of a cybersecurity service provider. The Joint Force Headquarters-DODIN has evaluations teams that travel out to the 45 DODIN areas of operation and assess the effectiveness of their CSSPs. We record that in the Defense Readiness Reporting System, DRRS. We can do better, and we're working on establishing additional metrics that can develop a more comprehensive picture for us to have confidence that all of the DODIN areas of operation can operate effectively.

Chairman Mike Rounds (R-SD)SPEAKER_03

Thank you.

SPEAKER_UNKNOWN

Senator Rosen.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

Well, thank you. I was going to ask something different about the workforce first, but I'm going to build on the zero trust architecture. I understand what you're saying. Who is the person/user? Who is the device? You're going to check them every time. We have that a lot in our own— in other things that regular people do, with banking, other kinds of things. But I would think, as I'm listening to you, I'm thinking about how does the user or device get into the registry, if you will? And I'm thinking that that could be a point of vulnerability. And so, how often— like, I know there's many ways that people gain access, understanding that you have things all around the globe, but thinking that that's a point of vulnerability, because if somehow someone can put themselves as a trusted user or device, then that's how one— maybe a big way they can get into the system, not the silent way. So how are you securing that piece, if you will?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. Enterprise Identity, Credential, and Access Management, or ICAM, as we refer to it, is a central component to the effective employment of a zero-trust environment. Yes So making sure that we know who you are and we have multiple different forms of validating your identity is an inherent principle. Additionally, once we issue a certificate that authenticates you into the environment, that certificate is time-bound and continuously checked, and we have measures by which we can revoke it. So in the event that we see something that is anomalous through our logging, we can revoke that certificate on the spot and deny further access into the environment.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

Thank you. That answers the question for me. And I guess the question we always ask, do you have the resources that you need now to continue to build out your zero trust architecture going forward as we're entering into the NDAA season, if you will?

Lieutenant General Paul T. StantonSPEAKER_01

Thank you, Senator. There are two primary initiatives through which DISA is implementing zero trust. DoDNet is our initiative to establish a modern and secure infrastructure for the defense agencies and field activities. They had independently run their networks previously. We're in the process of migrating them. As we do, we build in the Thunderdome zero trust model into that environment. Additionally, we're working with the Multi-Partner Environment Executive Agent to incorporate Thunderdome into our implementation of the multi-partner environment, or MPE, as we refer to it. We're not waiting. We're moving out aggressively.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

Very good. Well, this all leads to my first question that I was going to ask. It's about, well, it's kind of two-part: the impacts of recent civilian workforce cuts and DODIN's ability to conduct your assigned missions, but I think it's more than that. Because sometimes the workforce cuts, we understand we want to streamline, do things better. We're going to do things better with computing, for sure. But that can have an impact on both our future recruitment, retention, morale, which is key to maintaining our readiness and preparing for the future. We know we have these issues, particularly when the public sector can be very lucrative for folks who work in that. So if you would kind of speak of a snapshot of the impact of these cuts from deferred retirement, probationary employees, planned reductions in force, and how is this really going to impact you going forward?

Lieutenant General Paul T. StantonSPEAKER_01

Thanks, Senator. First, I'd like to acknowledge that I personally have the utmost respect for anyone that has raised his or her right hand and sworn an oath to support and defend the Constitution of the United States, as do all of our civilian and uniformed servicemembers that operate within the Joint Force Headquarters and within DISA. We will suffer about a 10% loss in terms of the numbers of individuals that are within the Defense Information Systems Agency. It's giving us an opportunity to ruthlessly realign and optimize how we are addressing what is an evolving mission. So things like the multipartner environment and initiatives like DoDNet are driving our workforce to perform roles that they hadn't previously. And so we are doing a realignment, and we're going back to the department to ask for what we refer to as a surgical rehiring. We need to hire the right people back into the right positions to then lead us forward.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

So we'll talk about those resources, and if I can, this is my last part on this question, because on April 10th there was a memo that was issued by Secretary of Defense that announced the termination of several contracts and insourcing of IT consulting and management services to our civilian workforce. So could you provide any details to us in this open hearing? If not, we could do it in the closed, but what are your security concerns here? Everyone does take an oath, but you have these public-private partnerships, and with all of this happening, how is that really impacting you?

Lieutenant General Paul T. StantonSPEAKER_01

Thank you, Senator. So reviewing contracts is a necessary part of our business in the IT world. As technology changes, we have to continually evaluate whether or not we have the, the right industry partner performing the right mission. I mean, so we routinely evaluate—

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

want to be sure it's the right It's strategic and not— it's surgical, not just across the board.

Lieutenant General Paul T. StantonSPEAKER_01

That's absolutely correct, and that has been our approach, and the Department of Defense has given us within DISA the opportunity to handle it through a surgical lens. So our contracts are aligned to the highly technical IT and cybersecurity workforce. They're not consulting contracts. These are individuals that are putting hands on keyboard, that are running fiber-optic cables, that are performing server maintenance in a global footprint. And our contracts are healthy and are in a good spot. The impetus and drive from the department is, however, forcing our industry partners to evaluate how they are presenting their technical force to us, and we're gaining some efficiencies in the process.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

Thank you, I appreciate it.

Chairman Mike Rounds (R-SD)SPEAKER_03

Let's follow that up a little bit. You not only have to have the tools, but you've got to have the manpower as well. Talk a little bit about just the size and the scope of what this is to begin with. You're protecting the Department of Defense's entire system. Talk about how big that is and about the number of people that you employ either in uniform or by contract to begin with.

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. Our population size is roughly 20,000. Slightly more than half are contracted, about 6,800 are civilians, and about 1,200 are active duty military service members.

Chairman Mike Rounds (R-SD)SPEAKER_03

And then the, the pipeline for bringing in individuals— what, what types of, uh, of professional backgrounds or what types training are you looking for, for the, for the majority of these individuals? Can you give us a sense for the folks that are out there that are looking at it, wondering whether or not some young man or young woman decided they want to be involved in this? Talk about what the, what, what the qualifications are that you're looking for or that you can train for.

Lieutenant General Paul T. StantonSPEAKER_01

Senator, I'll tell you that the first characteristic that we target in recruiting is inquisitiveness and the and the ability to innovate, someone that's going to be a lifelong learner that's going to adjust on the fly. The technology that we put in their hands today won't be that which they're using two years down the road. And so someone has to be willing to engage with and learn on their own so that they can incorporate new technology. I'm quite proud of our Scholarship for Service program that we have within DISA, where we actively recruit highly technical folks and help pay for the remaining two years of their tuition in order to bring them onto our team for three to five years.

Chairman Mike Rounds (R-SD)SPEAKER_03

So you would actually—for, okay, I'll just take an example. Dakota State University in Madison, South Dakota is known for their cybersecurity operations. You would actually look for someone who had an interest in coming to work either in uniform or outside of uniform, bring them in, and offer to pick up their cost of education basically for the two years with an agreement that they come to work for you. Is that what we're talking about?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator, absolutely.

Chairman Mike Rounds (R-SD)SPEAKER_03

So what type of an appetite do you have for young men and women who want to serve? How, how many are you talking?

Lieutenant General Paul T. StantonSPEAKER_01

So it— in this, this past year, um, we brought 39 individuals into our Scholarship for Service program.

Chairman Mike Rounds (R-SD)SPEAKER_03

Could you do 100?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator, we can.

Chairman Mike Rounds (R-SD)SPEAKER_03

Could you do 150?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. Did

Chairman Mike Rounds (R-SD)SPEAKER_03

you do 200?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator.

Chairman Mike Rounds (R-SD)SPEAKER_03

So for young men and women out there, this is not like a selected group only. This is, this is to where you need more individuals that have this, this, this interest.

Lieutenant General Paul T. StantonSPEAKER_01

We do, Senator. And we recently, in February, published our workforce strategy within DISA, and part of it is to do exactly what we're discussing: create a pipeline, not necessarily hire an individual and expect them to stay for 30 years and become a member of the Senior Executive Service. Some will, and and we need that, but many will stay on our team for 3 to 5 years, be enthused by being able to execute the mission, be in contact with the adversary, support our nation, and then they'll move on and do other things. So

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

let's ask a question. Could you talk about, like, give a job description? You talk about people going into the, the phone lines, like phone hardware, software. Could

SPEAKER_UNKNOWN

just,

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

if we were talking to young folks when we go back home, give us a couple of actual job descriptions that you might get people who are just sitting here chatting, if that's all right with you.

Chairman Mike Rounds (R-SD)SPEAKER_03

I'd like

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

to be able to tell some of those young folks.

Chairman Mike Rounds (R-SD)SPEAKER_03

This is important because it's not just the type of a job description, but the types of tools they're going to be working with as well.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

That's right. I was a software developer. Don't help— I don't want to— don't make me work with the tools to put the hardware in, but let me code away. And so there are different kinds of things. Maybe you might give us some insight so when we talk to young people, which we do all the time, we might share with them the jobs that you are thinking about filling.

Lieutenant General Paul T. StantonSPEAKER_01

Fantastic, Senator. We need data analysts. We need data engineers. We need data scientists. We need folks that understand routing and large-scale routing. So folks that know how to configure a router securely. We need folks that are also very willing to dive into newest cybersecurity tools and actually implement them. And when we establish a defense, our intent is to gain and maintain contact with the adversary. So folks that understand host analysis and network analysis from a cybersecurity perspective are at the top of our list as well.

Chairman Mike Rounds (R-SD)SPEAKER_03

Fair to say that these young men and women that want to come and participate on this would have the opportunity to learn tools that enable or that, that, that are part of an artificial intelligence system or agent in terms of accelerating inquiries as to people trying to get into the systems. Would it be fair to also say that quantum is, is not far off with regards to what they would be working— the environment that they would be working in?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. I'll start with artificial intelligence. It's central to our way forward. It's central to our current operations, but, but absolutely central to the direction that we're headed. Quantum is a little bit further out, but as I said previously, as soon as quantum breaks and becomes a technology that's readily available, it will proliferate very rapidly. And so we need individuals that are— that can adjust dynamically to the change in the technology.

Chairman Mike Rounds (R-SD)SPEAKER_03

Thank you. Senator Rosen.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

I'm just going to build— we're just going to have a good time building on each other here. How are you leveraging the AI? We know that quantum is a little ways away, but how are you leveraging the AI capabilities capabilities, particularly as you're modernizing, streamlining, and thinking about all of your architecture. So just to kind of build off each other a bit.

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. So first, I'll start with what I think would be obvious: large language models and chatbot capabilities across different classification levels. I have them on all of my machines currently, and I use them on a daily basis. So chatbot capabilities to help make the workforce more efficient. We're also using AI to help us model and understand our transport network. So if you think about undersea cables as an example, if one were to be cut based off of an anchor that was dragged across the ocean floor, can we do the what-if analysis to understand how much bandwidth we have left so that we can dynamically reallocate how we move data from one spot to the next? We're using AI in that context. We're also using it for network defense. Senator, to your point earlier, we need to be able to see the enemy's campaign and not just an incident or an event in isolation. And so being able to make correlations across very large datasets in real time is key to our success. We're using AI inside of our Thunderdome zero-trust environment. So we log everything, and all of those logs from every— and then we learn from it. Absolutely, Senator. And then lastly, looking at the threat detection again from a campaign perspective, being able to zoom out and not just look at the incident that manifests in an alert from our cybersecurity system, but how do I trace that all the way back to the enemy's infrastructure that they used to gain access?

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

And so you mentioned something that is going to be a little bit of a hot button coming forward, and I just want to know if you have any opinion on this. You said, what if an anchor cut an undersea cable, and how would you dynamically move things around? So we think about all this computing. And of course, we can't do a lot of it without spectrum. Right. And so do you have an opinion about spectrum in this, in this regard? We know that there are other things that use the DOD spectrum, um, our airplanes and our, you know, all of our military, you know, our tanks, airplanes, radar and all of that. But do you have an opinion about spectrum? And of course, Well, there is no dynamic spectrum sharing right now. We understand that. But if you would— you don't have to, but I know that's not why you're here, but I just know we're going to be talking about it a lot.

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. So I think any discussion about spectrum has to be conducted through the lens of the military warfighting capability upon which that spectrum depends. So if we take the— what's colloquially known as the lower 3 bands, as an example. That's where we maintain our station-keeping radars. And so a station-keeping radar is required to track objects that move at Mach 15. That's 15 miles per second. There's no room for error, and there's no room for ambiguity or disambiguation and latency associated with that analysis. So we need to make sure— be very, very clear that we understand what systems are operating within the portions of the spectrum, and then be incredibly confident that we can deconflict the military operations from however it might be used commercially.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

Thank you. I know as we move a little bit closer to the NDAA, this is going to be— we can maybe dig deeper in the classified, but this is going to be an area for discussion, so you can give us any other input that you can't do in an open setting.

Lieutenant General Paul T. StantonSPEAKER_01

Yes, ma'am.

Chairman Mike Rounds (R-SD)SPEAKER_03

I think you were referring specifically to the 3.1 to 3.45 gigahertz portion,

Lieutenant General Paul T. StantonSPEAKER_01

Senator,

Chairman Mike Rounds (R-SD)SPEAKER_03

which always seems to be under attack. Nonetheless, it's just the physics of it are such that it's the best place to have the radar and a lot of our other capabilities located today and fully utilized today. Um, let me go back to this just a little bit because I, I think the The young men and women that are out there that are looking at this, some of them would love to have the uniform on. Some would say that maybe they don't want to have the uniform on, but they would still love to participate and to help their country. Can you talk a little bit about, okay, a young man, young woman come in, they want to participate in this, love the excitement of actually engaging with adversaries on a, on a, on a, you know, in the protection of our system. But at some stage of the game, industry is going to come and industry is going to look at these folks and say, you realize how valuable you are. That happens on a regular basis now. Can you talk about how you can compete with industry that recognizes just how valuable these young, talented individuals are and what we can do to perhaps keep them with us for a little bit longer before they finally decide to head on out and, and, and join the business community?

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. So first, in my experience and in my personal opinion, the mission is the most enticing characteristic that we have to offer young men and women, old men and women too. Being in the game and in contact with our adversaries in defense of the nation is exhilarating. It's challenging, but it is also motivating. So I, so I think that there are a number of the folks that we bring in when they're young that will, that will get that taste and stay with us. But I also think that we need to be willing to let folks go. So the concept of a pipeline, I think, is critically important, knowing that today's youth switch jobs readily. My daughter had her first job for a year and she already has a new job. She has a master's degree in nursing and is quite talented. But that's how our youth is switching jobs now. We have to be receptive of that concept, and we have to acknowledge that coming to work for us, gaining security clearances, gaining operational experience is going to make them better when they go to industry. When we partner with industry, we have to recognize that folks that learned how to fight defensively in cyberspace with us are now defending industry. I think that there's positive— there's a positive aspect to that. Some subset of them will stay on our team, and we need to, uh, to make sure that we develop them effectively.

Chairman Mike Rounds (R-SD)SPEAKER_03

Do you have the resources to be able to compete enough to keep some of those top-level folks there today? Do— are— have we provided you with the authorizations and the funding to be able to do that, to make it worth their time to stay with the team?

Lieutenant General Paul T. StantonSPEAKER_01

Senator, I believe that we do. Um, and, and, uh, again, it's a combination. I don't think we'll ever be able to pay an individual as much as they would make in, in the private sector. However, we can pay them enough, um, and we can give them the mission that is, that, that is the reason why they stay.

Chairman Mike Rounds (R-SD)SPEAKER_03

And for some of them, we're talking not just defensive operations, but offensive operations as well. Commercial sector doesn't give them the opportunity to reach out and touch someone, whereas within the operations here within CYBERCOM, occasionally they have the opportunity to reach out and actually touch someone and make a difference. Fair enough?

Lieutenant General Paul T. StantonSPEAKER_01

Gaining and maintaining contact with the enemy is central to the evolution of defensive cyber operations. Doctrinally, the United States military goes on the defense to posture for the offense. Why is cyberspace any different? It's not.

Chairman Mike Rounds (R-SD)SPEAKER_03

Great. Senator Rosen?

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

I'm going to build on this one because I speak from personal experience, uh, writing software, designing it. When you hit that Enter key, boy, you're a bum or a hero. It is dynamic. It is exciting. It is challenging. You solve problems, and it is a— I I speak a lot from personal experience on that. I understand the mission. We've talked a lot about for folks in some of these very specific kinds of jobs where if you rotate out—sometimes people have rotate in order to gain experience for their next promotions—you you end up losing some of your skills if you don't keep them up all the time. We've talked about not rotating certain folks so they can maintain and grow in the cyber, uh, area. And I've also set up, because I did this for a living, something that I thought of and others as well, a civilian cyber reserve. So there's a lot of jobs in cybersecurity that they could be engineering, they could be programming, linguistics. There's so many areas that, um, you might be a professor. You might be someone who's a little bit older who wants to give back, but doesn't want to quit their their other jobs. So standing up a civilian cyber reserve so we can surge up or have people come to teach us. We We have some pilot programs out there, and just wondering if you—I know it's kind of off the cuff—how you feel about this would allow for some of those folks that may leave to continue to stay, um, to stay engaged in a in a reserve component, if you will, like we do in other areas of our military.

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator. So first, just to nerd out for a second, I wrote my first computer program in 1985 in the BASIC programming language on an Apple IIc computer.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

I'm a little bit ahead of you. You because I wrote my first programs on keypunch cards in BASIC.

Lieutenant General Paul T. StantonSPEAKER_01

I walked

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

around campus like that.

Lieutenant General Paul T. StantonSPEAKER_01

I absolutely share that thrill of when the compiler actually completes.

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

When the compiler— oh yeah, it's true. It's real. It's real.

Lieutenant General Paul T. StantonSPEAKER_01

Yes, Senator But to the I think that retaining our talent through the reserves and keeping them engaged is critical to our success. It also gives the opportunity for gaining different perspective that's incredibly valuable for the ultimate defense of the nation. As if someone operating, for instance, in the Joint Force Headquarters-DODIN leaves and goes to industry and works at a bank or works at an oil company, they're gaining a very different perspective that is certainly relevant to defense, and keeping them in the reserves allows them to bring that perspective and infuse it into our forces at the time of need. We must do that.

Chairman Mike Rounds (R-SD)SPEAKER_03

Thank you. We've, uh We want to give you a little bit of a break. We will be going into a closed session in the SCIF shortly, and we wanted to give you a little bit of a break. I've really appreciated your responses to these, and hopefully we're giving folks back home a little bit of a sense of just what you do and the opportunities that are out there for young men and women to come in to help us in this very challenging environment. And Senator Rosen, do you have anything else to add before we close

Ranking Member Jacky Rosen (D-NV)SPEAKER_02

out? Give you a break. And this is a topic I think both of us could talk about, all of us could talk about all day. There's so many important issues. So Um, just appreciate— we'll look forward to what we can talk about in the closed session. Thank you, Mr. Chairman.

Chairman Mike Rounds (R-SD)SPEAKER_03

Very good. And with that, this will conclude the open portion of today's Cybersecurity Subcommittee hearing. For the information of members who will not be joining us for the closed briefing, questions for the record will be due to the committee within 2 business days of the conclusion of this hearing. And with that, the open portion of the hearing will stand adjourned.