High profile cases of corporate hacking and election interference have brought cybersecurity into the national spotlight.
South Dakota Senator Mike Rounds says cyber defense is an evolving process.
He says the United States has been successful at learning from the past and going on the offensive to prevent future attacks.
“Even though Russians, and others, were able to manipulate information and get into the United States – into our platforms, our software our social media platforms and so forth – with misinformation, when they tried and started to prepare to do that in the 2018 elections, it is not an accident that they were unable to get into the 2018 election cycle and manipulate and provide misinformation and circulate it.”
Rounds says this serves as proof that offensive cyber operations are necessary to improve national defense.
Full Question
Lori Walsh:
Tell me a little bit about the new Secretary of Defense and a new Biden administration and whether or not they will focus on cybersecurity in ways that are different or more expansive or less expensive than the Trump administration. What are you seeing so far in the early days of Biden's administration?
Senator Mike Rounds:
Well, yeah. Let me go back a little bit farther, and let me go into the Obama administration to begin with. And remember, as cyber is being developed, we learn as we move through. And so, I don't mean this to be derogatory towards the Obama administration, but we learned some lessons about what happened during the time period as we became more adept at cyber. And what we had discovered was that, during the time in which the Obama administration was in, they had created classified documents that gave directions about how cyber could be utilized. And it was called PPD-20 Presidential Policy Directive 20. That particular one was their best effort at trying to regulate and to separate out, so that we weren't stepping on each other, the different agencies of government and approval processes for allowing us to get outside of a war zone and to get in and to do offensive cyber operations.
It did not work. And what we discovered was is that, over a period of five years, the individuals within the Department of Defense that were responsible for doing offensive cyber operations to slow down the guys who are out there trying to get into our stuff, that are literally throwing the arrows at us, shooting the arrows at us, we didn't have one single offensive cyber operation successfully attempted during that five-year period of time because of the approval process, and how difficult it was, and how many different areas of government could negate or veto the operation, and the timeframe it took to actually work through. I do give credit to John Bolton and to members of the Trump team who listened to us when we went in and sat down and explained to them what we were discovering in our oversight capacity as a subcommittee on the Armed Services Committee, specifically with regard to cybersecurity. And our recommendation in conversations with them was, "You need to change and streamline this process."
A new classified document was prepared, and that was called NSPM-13, National Security Policy Memorandum 13, which has since been amended by NSPM-21, just to be clear. But it classified. But I can share with you what it does in essence is, it lays out a process in which we are allowed to do offensive cyber operations and to do it in such a fashion that, while the whole of government, other people are aware of it, their ability to get in and to restrict it or to stop it without having a good reason and one that could be basically overcome or change, this process that we have in place now actually allows us to do offensive cyber operations. It has been successful.
And the best example I can give you is that, even though Russians and others were able to manipulate information and get into the United States, into our platforms, our software, our social media platforms, and so forth with misinformation, when they tried and started to prepare to do that in the 2018 elections, it is not an accident that they were unable to get into the 2018 election cycle and manipulate and provide misinformation and circulate it. It was a significant success for our offensive cyber capabilities. And it was basically proof of concept that doing what we call defending forward was a success. And it is part of what we do right now, which is we engage on a daily basis with cyber operations and those actors that are out there. So, they know that we are engaged and that we are doing it forward in other areas outside of the United States so that they know that we're watching them and that we are interacting with them to delay their capabilities.