WASHINGTON — Two top national security nominees advocated Tuesday for stronger federal cybersecurity and increased collaboration with contractors in the aftermath of a supply chain breach that infiltrated numerous federal agencies.
If confirmed, retired Army Gen. Lloyd Austin and Avril Haines, President-elect Joe Biden’s nominees for defense secretary and director of national intelligence, respectively, would start their jobs in the middle of the national security community’s assessment of damage from a cybersecurity breach pinned on Russian hackers. They gained access through software from SolarWinds, a major government contractor.
“We must elevate cybersecurity as an imperative across the government in order to defend the American people and U.S. critical infrastructure,” Austin told the Senate Armed Services Committee in his answers to the lawmaker’s advance policy questions. “Additionally, the government must continue to strengthen its partnership with the private sector to foster greater information sharing and collaboration.”
So far, federal investigators have discovered breaches at “fewer than 10” federal agencies, though the Pentagon and intelligence community haven’t confirmed whether their offices were among the victims. Haines, who served as deputy CIA director and deputy national security adviser to President Barack Obama, found it concerning that the breach first came to light through cybersecurity company FireEye, instead of through U.S. government cybersecurity operators.
“[I] absolutely share ... concern that we’re actually able to detect these because that’s obviously absolutely critical to us protecting against them,” Haines said before the Senate Select Committee on Intelligence. “I think ... it was pretty alarming that we found out about it through a private company as opposed to our being able to detect it ourselves to begin with.”
In response to the breach, Austin committed to reviewing the DoD’s cyber posture and emphasized that Russia must be punished for infiltrating federal networks. In the advance questions, Austin stopped short of calling the breach an act of war, arguing that designation “requires a case-by-case and fact-specific determination.”
“For example, malicious cyber activities could result in injury, death or significant property destruction,” Austin wrote. “These activities would need to be considered in their totality.”
An early January announcement from several federal investigators, including the NSA and Office of the Director of National Intelligence, stated that the breach was believed to be an espionage campaign and “likely Russian in origin.”
“If that’s the case, I think Russia should be held accountable,” Austin said at the hearing. “That’s my personal belief.”
Sen. Jack Reed, D-R.I., who sits on both SASC and SSCI, called the breach “the greatest cyber intrusion in the history, I think, perhaps, of the world” and said that the stovepiped nature of the U.S. national security apparatus needed to be addressed. Reed said one challenge for Haines will be developing a “more coherent, cohesive, integrated approach” to dealing with cybersecurity threats, particularly from advanced nation-state actors.
Under questioning from senators, Haines said the SolarWinds supply chain hack was a “grave threat,” and the government needs new to improve its defenses against such attacks, though she noted that she hasn’t received a classified briefing on the intrusion. In 2019, a report from ODNI warned of growing software supply chain hacks that provide an “efficient way to bypass traditional defenses and compromise a large number of computers.”
“To prevent a recurrence of this kind of attack, we need to close the gap between where our capabilities are now and where they need to be in order to deter, detect, disrupt and respond to such intrusions far more effectively in the future,” Haines wrote in her questionnaire. “If confirmed as DNI, I will review the expert conclusions from the SolarWinds incident and the current intelligence about supply chain vulnerabilities and what steps may be taken to address any vulnerabilities.”
Haines told senators that she would assess how the intelligence community can improve its cybersecurity partnerships with industry and the whole federal government.
“I believe that the IC plays an integral role in detecting and warning against nation-state targeting of U.S. networks and infrastructure,” she wrote. “If confirmed, I will examine how better collaboration between the IC and the rest of the U.S. government, coupled with closer partnerships with the private sector and our international allies, can enhance our ability to deter, detect, and mitigate cyberattacks.”
Haines will review whether the intelligence community is allocating resources properly to face advanced cyber threats and will examine the adequacy of the IC’s existing authorities to protect the digital infrastructure of the United States, she said. Austin pointed to a cyber-threat sharing partnership the department has with the defense industrial base and stated that the department should “continue to look for ways to better integrate with interagency partners and the private sector.”
In light of the SolarWinds breach, the senators on SSCI wrote that they are worried about a “lack of mandatory threat information sharing between the private sector and government,” adding that any information sharing from the private sector after the breach is voluntary. Haines would review the relationship.
“Information sharing between the IC and the private sector is increasingly important to ensure that our data systems and networks are secure,” she wrote. “If confirmed as DNI, I look forward to reviewing the Intelligence Community’s data sharing and information exchange relationship with the private sector, to engaging with IC experts and private sector leaders on what information is currently being shared, and to examining the efficacy of the current framework for sharing threat information.”
RELATED
The incoming Biden administration has signaled that it will prioritize cybersecurity in the aftermath of the SolarWinds breach. The Biden team named Anne Neuberger, the NSA’s cybersecurity director who worked to improve information sharing with the private sector, to National Security Council as deputy national security adviser for cyber and emerging technology.
Haines wrote that she will “ensure” that the intelligence community has a “robust data sharing and information exchange relationship” with private companies and said that she will be “studying current information sharing to determine how it can be improved and what types of information can be shared to enhance cybersecurity protections.”
“The private sector has unique insight and expertise on malicious activity occurring within its networks,” Haines said. “Real-time integration of private sector and government data could lead to more effective prevention and mitigation outcomes.”
Cyber norms and deterrence
For the last few years, the U.S. government wrestled with the concept of deterrence in the cyber domain, a complex challenge that including resilient defenses, risk management and strong international partnerships. As the SolarWinds breach demonstrated, deterring adversaries from hacking, which is seen as below the threshold of an armed response, is difficult.
In response to a question from Sen. John Cornyn, R-Texas, about how to approach cyber deterrence, Haines pointed to many of the same tenets of current U.S. cyber deterrence, including imposition of costs for malicious actors’ behavior, bringing foreign allies together to impose those costs, building resilient systems that are hard to hack, developing norms and creating strong relationship with the private sector.
Haines wrote that setting norms should include outlining sanctionable behavior with the agreement from allies. A cornerstone to sanctioning is attributing cyberattacks to actors, a challenging undertaking in the cyber realm. Sen. Mark Warner, D-Va., said he wanted Haines to be more forthcoming with attribution of cyberattacks, stating that he found it “extraordinarily concerning” that the “[Trump] White House underplay[ed] attribution on Russia.”
Attribution, Haines said, would be a major piece of the ODNI’s role in deterrence.
“Something we [ODNI] can do is promote the ability to detect when adversaries are engaging in such activity so as then to provide information about attribution, for example. And then hold adversaries to account through that.”
Andrew Eversden covers all things defense technology for C4ISRNET. He previously reported on federal IT and cybersecurity for Federal Times and Fifth Domain, and worked as a congressional reporting fellow for the Texas Tribune. He was also a Washington intern for the Durango Herald. Andrew is a graduate of American University.
