[House Hearing, 112 Congress]
[From the U.S. Government Publishing Office]
THE DEPARTMENT OF HOMELAND SECURITY: AN ASSESSMENT OF THE DEPARTMENT
AND A ROADMAP FOR ITS FUTURE
=======================================================================
HEARING
before the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED TWELFTH CONGRESS
SECOND SESSION
__________
SEPTEMBER 20, 2012
__________
Serial No. 112-119
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.gpo.gov/fdsys/
_____
U.S. GOVERNMENT PRINTING OFFICE
81-128 PDF WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC
area (202) 512-1800 Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC
20402-0001
COMMITTEE ON HOMELAND SECURITY
Peter T. King, New York, Chairman
Lamar Smith, Texas Bennie G. Thompson, Mississippi
Daniel E. Lungren, California Loretta Sanchez, California
Mike Rogers, Alabama Sheila Jackson Lee, Texas
Michael T. McCaul, Texas Henry Cuellar, Texas
Gus M. Bilirakis, Florida Yvette D. Clarke, New York
Paul C. Broun, Georgia Laura Richardson, California
Candice S. Miller, Michigan Danny K. Davis, Illinois
Tim Walberg, Michigan Brian Higgins, New York
Chip Cravaack, Minnesota Cedric L. Richmond, Louisiana
Joe Walsh, Illinois Hansen Clarke, Michigan
Patrick Meehan, Pennsylvania William R. Keating, Massachusetts
Ben Quayle, Arizona Kathleen C. Hochul, New York
Scott Rigell, Virginia Janice Hahn, California
Billy Long, Missouri Ron Barber, Arizona
Jeff Duncan, South Carolina
Tom Marino, Pennsylvania
Blake Farenthold, Texas
Robert L. Turner, New York
Michael J. Russell, Staff Director/Chief Counsel
Kerry Ann Watkins, Senior Policy Director
Michael S. Twinchek, Chief Clerk
I. Lanier Avant, Minority Staff Director
C O N T E N T S
----------
Page
Statements
The Honorable Peter T. King, a Representative in Congress From
the State of New York, and Chairman, Committee on Homeland
Security....................................................... 1
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Ranking Member, Committee on
Homeland Security.............................................. 3
Witnesses
Mr. Richard L. Skinner, Former Inspector General, Department of
Homeland Security:
Oral Statement................................................. 5
Prepared Statement............................................. 7
Mr. Stewart A. Baker, Former Assistant Secretary for Policy,
Department of Homeland Security:
Oral Statement................................................. 14
Prepared Statement............................................. 15
Mr. Frank J. Cilluffo, Former Principal Advisory to Governor Tom
Ridge, White House Office of Homeland Security:
Oral Statement................................................. 20
Prepared Statement............................................. 22
Mr. David C. Maurer, Director, Homeland Security and Justice,
Government Accountability Office:
Oral Statement................................................. 30
Prepared Statement............................................. 32
Appendix
Questions From Chairman Peter T. King for Richard L. Skinner..... 63
Questions From Chairman Peter T. King for Stewart A. Baker....... 64
Questions From Chairman Peter T. King for Frank J. Cilluffo...... 64
Questions From Chairman Peter T. King for David C. Maurer........ 65
THE DEPARTMENT OF HOMELAND SECURITY: AN ASSESSMENT OF THE DEPARTMENT
AND A ROADMAP FOR ITS FUTURE
----------
Thursday, September 20, 2012
U.S. House of Representatives,
Committee on Homeland Security,
Washington, DC.
The committee met, pursuant to call, at 10:07 a.m., in Room
311, Cannon House Office Building, Hon. Peter T. King [Chairman
of the committee] presiding.
Present: Representatives King, Lungren, Rogers, McCaul,
Bilirakis, Miller, Walberg, Marino, Turner, Thompson, Jackson
Lee, Cuellar, Richardson, Richmond, Clarke of Michigan, and
Hahn.
Chairman King. Okay. Good morning. The Committee on
Homeland Security will come to order. The Ranking Member has
been delayed, but he will be here. His staff has suggested that
we start the hearing, since our witnesses are here.
The committee is meeting today to examine the current state
of the Department of Homeland Security--oh, the Ranking Member
is here, thank you--and the solution to the future. I will now
recognize myself for an opening statement.
I want to thank each of the witnesses for being here today.
I believe all of you have testified here before. Mr. Baker has
done double duty, also, by being in the Department testifying
and now coming back. He is also a noted author. Again, it is
great to have all of you here today.
This, I think we always try to keep this committee as
bipartisan as possible. But I would say that today's hearing
will probably be the essence of bipartisanship because everyone
on the committee wants the Department to succeed. All of us
believe that progress has been made.
There are questions, of course, of where more progress can
be made where there are still deficiencies. Each of you is an
expert on the issues so we really look forward to your
testimony. I know since September 11 we had four Islamist
attacks or attempted attacks within the United States. In
addition to that, there have been dozens of disrupted terrorist
attacks against the homeland.
Just in the last 2 years alone we have had a series of
them, including bomb plots against the Capitol Building. There
was a young man arrested in Chicago last week. So this is an
on-going threat against the United States. I think the fact
that none of these attacks has succeeded is at least partially
due to the efforts of the Department of Homeland Security and
also how it fits into the overall counterterrorism matrix that
has been established since September 11.
Now, the current unrest in the Middle East involving
radicals and affiliates of al-Qaeda further underscores how
threats from that part of the world impact our counterterrorism
efforts to prevent weapons of mass destruction from getting
into the hands of those who want to kill Americans in the
homeland.
Now, during the 112th Congress, this committee has examined
a series of issues. Obviously, there was a lot of publicity and
notoriety, or interest, in the hearings we had on the issue of
radicalization in the Muslim-American community, steps to
address the issue. But we also had a series of other hearings,
including cybersecurity, hardening our critical infrastructure,
protecting chemical facilities.
The operations of TSA, Chairman Rogers has been especially
active on that. That is an area of particular concern to us on
both sides of the aisle as far as making the TSA more efficient
and also more effective. Also, what it can do to, again,
improve its image. Not in the sense of image, but in gaining
the confidence of the American people, which it has not been
able to do.
Also, we have looked into issues regarding reforms to the
Department--in its management, improve employee morale, cut red
tape, save taxpayer dollars. Also emergency communications, the
effective administration of Homeland Security grants, reduce
our vulnerability to attacks on the homeland using IEDs such as
the Times Square car bomb.
Also the whole issue of border security along the land and
maritime borders. We look forward to building on this
oversight. But this hearing today, and your testimony, can, I
believe, help guide us in the right direction and provide a
more coherent framework for us.
As we consider the road map for DHS, some of the questions
we have is: How can the Department use scarce taxpayer dollars?
Because unlike after 9/11, when basically the money that was
felt was needed was given, the fact is that we do face budget
restraints. I believe, in too many cases there has been too
much money cut from the Department of Homeland Security.
Whether I like it or not or the Ranking Member likes it or
not, for the foreseeable future that is the reality that DHS is
going to have to face. Even if the cuts are not as severe in
the future as they have been over the last several years, it is
going to be a very, very tight, tight budget no matter what.
So how can the Department use the taxpayers' dollars more
wisely? How effective are the Department's efforts to counter
violent extremism? To what extent is DHS able to work with our
allies overseas? To what extent have they become a player in
the intelligence community, both here and overseas?
Also, just what recommendations that you believe the
Department should make to strengthen the overall homeland
security of the United States. Now, there has been progress
made in a lot of areas. I am sure you are going to touch on
that, and all sides can agree that there has been progress
made. Certainly involving FEMA, involving strategic and
operational plans, allocating funding based on risk, raising
public awareness about the importance of reporting suspicious
activity.
Yet there is so much more work to be done as far as
integrating management functions, strengthening information
technology and financial management, improving contracting and
acquisition practices and controls, ultimately establishing a
biometric exit screening system, securing the border using
objective measures, enforcing penalties against immigration
violators, exercising authority to secure chemical facilities,
developing a risk-based approach to screening airline
passengers, strategically managing risks and assessing program
performance.
Also, I think one thing we all agree on is that Congress
has to undertake its own reform. If we are going to be able to
effectively oversee the Department of Homeland Security, we
can't have this number of committees and subcommittees--
depending on what number you want to use, it is in the eighties
or nineties, it is more than 100 of committees, subcommittees--
commissions, boards that the Department has to report to, often
giving the same testimony, just to a different set of Members
of Congress; some of whom are just interesting in getting their
spot on the evening news on a committee that has, at best,
tangential association with the Department of Homeland
Security.
So that is really our burden and not yours. But any
testimony you could give us to strengthen our case for both
sides of the aisle would be greatly appreciated. So I want to
thank all of you for being in here today. I look forward to
your testimony. This will be, I assume, the last full committee
hearing of the year; certainly until after the recess.
I want to thank the Ranking Member. We haven't always
agreed, but I believe we have been able to work in a collegial
way. I say, that is all Members on the committee. Considering
the divisions that there have been in Congress over the past 2
years, while maybe everything isn't perfect on this committee I
think we can say we have done, I think, as well if not better
than almost any other committee in Congress in trying to find
ways to work together.
So with that softball approach, I am recognizing the
Ranking Member, the distinguished gentleman from Mississippi,
for his opening statement.
Mr. Thompson. Thank you very much, Chairman King. I do
agree with you on your last statement. We, I think, have set
the bar for a lot of other committees on our ability to work. I
look forward to continuing to work with you on that.
But there are differences, and I think from time to time
those differences are reflected. But the greatness of this
country is that people who differ can still come together for
the common good. We do that. Again, thank you for holding this
hearing.
In March 2003 the Federal Government stood up the
Department of Homeland Security in response to the separate
2001 terrorist attack. Today, the Department of Homeland
Security is the third-largest agency in the Federal Government,
employing about 220,000 people and operating both domestically
and internationally.
Prior to the September 2001, the United States used various
approaches to handle catastrophic dangers, including National
Guard involvement, law enforcement, and emergency management.
But the events of 2001 forced us to begin a process aimed at
the development of a cohesive homeland security policy.
Over the last 10 years, the concept of homeland security
has evolved and expanded. While the need to address terrorism
remains central to our understanding of homeland security, we
now understand that homeland security must include other
catastrophic incidents. We must remain concerned about the
risks that may threaten the lives of our people.
But we cannot fail to recognize those things that may
threaten the strength of our democracy, the vitality of our
economy, as well as the continuation of public and private-
sector activities that impact our daily lives. From critical
infrastructure protection to cybersecurity, the evolution and
expansion of our understanding of homeland security has
required us to ask the Department about risk assessment,
strategic development, and operational priorities.
From my vantage point, the ability to come to grips with
these questions of risk strategy and operations has formed a
core of the Department's struggles as well as form the basis
for its successes. So as we begin to discuss the Department's
road map to the future, we must acknowledge that its presence
on GAO's high-risk list remains a continuing cause for concern.
The importance of the Department's high-risk designation,
and its ability to implement its plans to resolve the
transformation and integration issues that continue to hamper
its development into a cohesive organizational unit, cannot be
understated. For several years, I have noted the need to
strengthen the ability of the under secretary for management to
require and enforce uniform administrative practices and
procedures through each component.
It seems to me that the lack of power in the management
office will continue to permit ineffective and inconsistent
practices in procurement and personnel throughout the
components. We see the results of these inconsistencies each
time we learn about wasted money. We read about the fallout of
these inconsistent practices every year when a Department ends
up near the bottom of OPM's annual survey of employee
satisfaction.
So as we consider the road map forward, let us be sure to
consider how the Department can achieve the mission, and
improve its internal operations. The biggest challenge,
however, is whether Congress will fully fund Homeland Security
efforts as opposed to slashing the Homeland Security budget as
proposed by the Majority.
While the threat to homeland security has not diminished,
the Department of Homeland Security has been required to do
more with less. The fiscal 2012 Homeland Security
appropriations short-changed homeland security from border
security to aviation security, science, and technology. In
particular, the management directorate and the budget
environment for fiscal year 2013 has not changed.
In fact, it may have worsened. I would like to also say at
this point that Congress hasn't been really helpful in some of
these situations because we have not, when I was chair--and now
Chairman King, since he is back--been able to convince our
leadership that a consolidated jurisdiction for the Department
of Homeland Security would be in the best interests of this
country.
I think we still agree on that, right?
Chairman King. Absolutely.
Mr. Thompson. Okay. Just checking. So I want to make sure
that everybody understands that as long as jurisdiction is
split the Department is tasked with responding to over 100
committees and subcommittees on this Hill. That is just too
much. So I look forward to hearing from our witnesses on these
and other issues as we discuss the path forward for the
Department.
I yield back the balance of my time.
Chairman King. I thank the Ranking Member for his statement
and for yielding back. Also emphasize again that we stand as
one on the whole issue of jurisdictional consolidation. It
makes absolutely no sense, the current situation; absolutely
none whatsoever.
As I mentioned before, we are pleased to have a
distinguished panel of witnesses before us today on this vital
topic. It is, again, a privilege to have you here today once
again. Let me begin with Mr. Richard Skinner, who was the first
Senate-confirmed inspector general of the Department of
Homeland Security. He served in that capacity from 2008 to
early 2011.
He has held managerial positions in various agencies
throughout the Federal Government, including FEMA, the
Department of Agriculture, the Department of Justice, the
Department of Commerce and the State Department. In 1998, he
received the President's meritorious executive rank award for
superior accomplishment in management programs of the United
States Government.
I would just say, as Chairman and as former Ranking Member,
your testimony before our committee has always been extremely
helpful. I think we would agree, totally nonpartisan and in the
best interests of the country.
With that, the gentleman's recognized for 5 minutes.
Mr. Thompson. If the gentleman will yield, we agree on
that, too.
[Laughter.]
STATEMENT OF RICHARD L. SKINNER, FORMER INSPECTOR GENERAL,
DEPARTMENT OF HOMELAND SECURITY
Mr. Skinner. Well, thank you very much and good morning,
Chairman King and Ranking Member Thompson. It is good to see
everyone again. It is truly an honor to be here today, and I
really thank you very much for this opportunity.
Since its inception in 2003, the Department has worked to
accomplish the largest reorganization of the Federal Government
in more than a half a century. This task has presented many
challenges. While it is making progress, the Department still
has much to do to be a cohesive, efficient, and effective
organization.
Today, I would like to talk about four often-overlooked
management support functions that constitute the platform upon
which the Department's programs must operate and are critical
to the successful accomplishment of the Department's mission.
That is financial management, IT management, acquisition
management, and grants management.
Concerning financial management, in 2011 the Department was
again unable to obtain an opinion on its financial statements.
Numerous material internal control weaknesses were again
reported. Although it has reduced the number of material
weaknesses and has received a qualified audit opinion on its
consolidated balance sheet and custodial activity, it is
unlikely this progress will continue unless the Department
modernizes its financial systems.
Due to 2012 budget reductions--and also it looks like in
2013, as well--recent modernization initiatives have been on
hold indefinitely. It is not clear now when the Department will
resume its modernization strategy, nor is it clear whether
these initiatives, if and when they are ever implemented, will
ensure that financial management systems can generate reliable,
useful, timely information for day-to-day decision-making.
In the interim, the Department must continue to use
archaic, unreliable systems to manage its financial resources.
Also, the Department and its components are still struggling to
upgrade and integrate their respective IT infrastructures.
According to recent OIG reports as recent as this past July,
program and field offices continue to develop information
technology systems independently of the CIO, and have been slow
to adopt the Department's standard information technology
development approach.
As a result, critical systems are not integrated, do not
meet user requirements, and do not provide the information
technology capabilities that agency personnel and its external
partners both in the Federal Government as well as the State
and local levels need to carry out critical infrastructures in
a timely, effective, and efficient manner.
With regard to acquisition management, Secretary Napolitano
and her executive team have demonstrated a genuine commitment
to improve the Department's acquisition management function.
However, much work remains to be done. Most notably, the
Department needs to identify and acquire the resources needed
to fulfill its acquisition management responsibilities.
The urgency and complexity of the Department's mission will
continue to demand rapid pursuit of major investments in high-
risk, complex acquisition programs. To effectively manage these
large-dollar procurements, the Department will need a sustained
commitment, increased resources, and smarter processes to
administer and oversee the contractors' work.
Finally, since its inception the Department has distributed
over $18 billion through the Homeland Security Grant Program.
Yet, according to an OIG report released earlier this year, the
Department does not have a system in place to determine the
extent that these funds enhance the State's capabilities to
prevent, deter, respond to, and recover from terrorist attacks,
major disasters, and other emergencies.
Consequently, the Department has been awarding Homeland
Security Grant funds to States each year for on-going programs
without knowing the accomplishments from prior years' fundings
or the extent to which additional funds are needed to achieve
desired results. Strategic planning, performance measurement,
and oversight are essential management controls to ensure that
grant funds are used for their intended purpose and that
enhancements in preparedness capabilities are being achieved.
Otherwise, it is impossible to determine whether annual
investments are actually improving our Nation's homeland
security posture. In today's economic climate, it is critical
that the Department concentrate its limited resources on those
threats that pose the greatest threat to the country.
In summary, it is evident that the Department's senior
officials are well aware of these challenges and are attempting
to remedy them. Yet they have actually made headway, Mr.
Chairman, as you pointed out. The question is, however: Does
the Department have the resolve and wherewithal to sustain
those efforts?
The ability of the Department to do so is fragile, not only
because of the early stage of development of those efforts, but
also because of the Government's budget constraints and the
current lack of resources to implement planned corrective
actions. In today's environment of large Government deficits
and pending budget cuts, the new challenge will be to sustain
the progress already made and, at the same time, continue to
make necessary improvements.
Unless the Department and Congress stay focused on these
challenges, it will be harder than ever to facilitate solutions
to strengthen the Department's critical management support
functions and, ultimately, to ensure the success of the
Homeland Security mission.
Mr. Chairman, this concludes my prepared statement. I will
be happy to answer any questions the committee may have.
[The prepared statement of Mr. Skinner follows:]
Prepared Statement of Richard L. Skinner
September 20, 2012
Good afternoon, Chairman Rogers, Ranking Member Thompson, and
Members of the committee. It is truly an honor to be here today to
discuss what the Department of Homeland Security needs to do in the
years ahead to become a more efficient organization. I thank you for
this opportunity.
Since its inception in 2003, the Department has worked to
accomplish the largest reorganization of the Federal Government in more
than half a century. This task, creating the third-largest Cabinet
agency with the missions of protecting the country against another
terrorist attack, responding to threats and hazards, ensuring safe and
secure borders, welcoming lawful immigrants and visitors, and promoting
the free flow of commerce, has presented many challenges. While the
Department has made progress over the past 9 years, it still has much
to do to establish a cohesive, efficient, and effective organization.
The OIG's latest major management challenges report, dated November
10, 2011, continues to address a broad range of issues, including both
program and administrative challenges. In total, the OIG identified
nine categories of challenges: Financial Management, Information
Technology Management, Acquisition Management, Grants Management,
Emergency Management, Infrastructure Protection, Border Security,
Transportation Security, and Trade Operations and Security. These are
essentially the same management challenges that the the OIG reported as
early as 2005. Today, I would like to talk about four of those
management challenges:
Financial management,
Information technology management,
Acquisition management, and
Grants management.
These management support functions constitute the platform upon
which the Department's programs must operate and are critical to the
successful accomplishment of the Department's mission. Some of these
challenges were inherited by the Department from the legacy agencies.
Nevertheless, the complexity and urgency of the Department's mission
have hampered its efforts to make sustainable progress in implementing
corrective actions.
Senior officials at the Department recognize the significance of
these challenges and understand that addressing them will take a
sustained and focused effort. They have, in fact, taken actions over
the past several years to implement, transform, and strengthen the
Department's management support functions; albeit, in my opinion, at a
snail's pace.
financial management
Financial management has been and continues to be a major
management challenge for the Department since its creation in 2003. In
fiscal year 2011, the Department was again unable to obtain an opinion
on its financial statements, and numerous material internal control
weaknesses were again reported. These weaknesses, due to their
materiality, are impediments to obtaining a clean opinion and providing
positive assurance over internal controls at the Department level. The
Department has made progress from its early days, however. It has
reduced the number of material weaknesses in internal controls from 18
to 5. It also received a qualified audit opinion on its consolidated
balance sheet and custodial activity for the first time in fiscal year
2011. Unfortunately, unless the Department modernizes its financial
systems, it is unlikely this progress will continue.
The Department twice unsuccessfully attempted to implement an
integrated Department-wide financial management system, wasting
millions of dollars. In 2007, the Department ended its first attempt,
the Electronically Managing Enterprise Resources for Government
Effectiveness and Efficiency system after determining it would not
provide the expected functionality and performance. In 2011, the
Department decided to change its strategy for financial system
modernization. Rather than implement a Department-wide integrated
financial management system solution, the Department decided to take a
decentralized approach to financial management systems modernization at
the component level. Specifically, the Department reported in its
December 2011 strategy that it plans to replace financial management
systems at three components it has identified as most in need, e.g.,
FEMA, USCG, and ICE. However, due to fiscal year 2012 budget
reductions, these initiatives have been put on hold indefinitely. It is
now not clear when the Department will resume its modernization
strategy, nor is it clear whether this new, decentralized approach, if
and whenever it is implemented, will ensure that components' financial
management systems can generate reliable, useful, timely information
for day-to-day decision making; enhance the Department's ability to
comprehensively view financial information across the Department; and
comply with related Federal requirements at the Department and its
components. In the interim, the Department must continue to use
archaic, unreliable systems to manage it financial resources, which is
unfortunate, particularly in this day and age of budget austerity and
the public demand for increased fiscal transparency and accountability.
information technology management
According to recent OIG and GAO reports, DHS and its components are
still struggling to upgrade or transition their respective IT
infrastructures, both locally and enterprise-wide.
Integrating the IT systems, networks, and capabilities of the
various legacy agencies to form a single infrastructure for effective
communications and information exchange remains one of the Department's
biggest challenges.
For example, on October 20, 2011, the Assistant IG for Emergency
Management Oversight, Matt Jadacki, testified that FEMA's existing
information technology systems do not effectively support disaster
response activities. FEMA has not completed its efforts to establish an
enterprise architecture, and its IT strategic plan was not
comprehensive enough to coordinate and prioritize its modernization
initiatives and IT projects. The plan did not include clearly-defined
goals and objectives, nor did it address program office IT strategic
goals. Without these critical elements, FEMA is challenged to establish
an effective approach to modernize its information technology
infrastructure and systems.
According to Mr. Jadacki, there is not an adequate understanding of
existing information technology resources and needs throughout the
agency. Specifically, FEMA's Office of the Chief Information Officer
(CIO) does not have a complete, documented inventory of systems to
support disasters. Further, program and field offices continue to
develop information technology systems independently of the CIO and
have been slow to adopt the agency's standard information technology
development approach. As a result, systems are not integrated, do not
meet user requirements, and do not provide the information technology
capabilities agency personnel and its external partners need to carry
out disaster response and recovery operations in a timely, effective,
and efficient manner.
Furthermore, according to a report issued recently by GAO, FEMA
does not have an effective system to manage flood insurance and claims
data, although it invested roughly 7 years and $40 million on a new
system whose development has been halted because it did not meet users'
needs.
Most recently, on June 29, 2012, the Assistant IG for Information
Technology Audits, Frank Deffer, reported that the information
technology environment and the aging IT infrastructure within CBP does
not fully support CBP's mission needs. According to Mr. Deffer,
interoperability and functionality of the technology infrastructure
have not been sufficient to support CBP mission activities fully. As a
result, CBP employees have created workarounds or employed alternative
solutions, which may hinder CBP's ability to accomplish its mission and
ensure officer safety.
Similar problems also have been reported at the Coast Guard,
Citizen and Immigration Services, Immigration and Customs Enforcement,
and Secret Service. Technical and cost barriers, aging infrastructure
that is difficult to support, outdated IT strategic plans to guide
investment decisions, and stove-piped system development have impeded
the Department's efforts to modernize and integrate its IT systems,
networks, and capabilities.
Information Sharing
The Homeland Security Act of 2002 makes coordination of homeland
security communication with State and local government authorities, the
private sector, and the public a key Department responsibility.
However, due to time pressures, the Department did not complete a
number of the steps essential to effective planning and implementation
of the Homeland Security Information Network (HSIN)--the ``sensitive
but unclassified'' system it instituted to help carry out this mission.
For example, the HSIN and the Homeland Security State and Local
Community of Interest systems, both developed by DHS, are not
integrated. As a result, users must maintain separate accounts, and
information cannot easily be shared across the systems. State and local
fusion center personnel expressed concern that there were too many
Federal information sharing systems that were not integrated. As such,
effective sharing of the counter-terrorist and emergency management
information critical to ensuring homeland security remains an on-going
challenge for the Department. Resources, legislative constraints,
privacy, and cultural challenges--often beyond the control of the
Department--pose obstacles to the success of the Department's
information-sharing initiatives.
On a broader scale, the Department is also challenged with
incorporating data mining into its overall strategy for sharing
information to help detect and prevent terrorism. Data mining aids
agents, investigators, and analysts in the discovery of patterns and
relationships from vast quantities of data. The Homeland Security Act
authorizes the Department to use data mining and tools to access,
receive, and analyze information. However, the Department's data mining
activities consist of various stove-piped activities that use limited
data mining features. For example, CBP performs matching to target
high-risk cargo. The Secret Service automates the evaluation of
counterfeit documents. TSA collects tactical information on suspicious
activities. ICE detects and links anomalies indicative of criminal
activity to discover relationships. Without Department-wide planning,
coordination, and direction, the potential for integrating advanced
data mining functionality and capabilities to address homeland security
issues remains untapped.
acquisition management
DHS has taken notable action to implement, transform, and
strengthen its acquisition management capabilities. During my tenure as
the IG of the Department, the Secretary and Deputy Secretary of
Homeland Security, and other senior officials demonstrated a genuine
commitment to improve the Department's acquisition management function.
In its December 2011 strategy for high-risk management, the Department
presented detailed plans to address a number of acquisition management
challenges. However, much work remains to fully implement these plans
and address these challenges. Most notably, the Department needs to
identify and acquire the resources needed to implement its acquisition
policies.
OIG and GAO audits over the past 9 years have identified problems
related to acquisition oversight, cost growth, and schedule delays,
resulting in performance problems and mission delays, as illustrated by
the problems the Department experienced with the Coast Guard's
Deepwater program, CBP's SBINet program, FEMA's flood map modernization
program, and the CFO's financial systems consolidation initiatives.
Each of these efforts failed to meet capability, benefit, cost, and
schedule expectations. For example, in June 2010 my former office
reported that over half of the programs we reviewed awarded contracts
to initiate acquisition activities without component or Department
approval of documents essential to planning acquisitions, such as
mission need statements outlining the specific functional capabilities
required to accomplish DHS' mission and objectives; operational
requirements; and acquisition program baselines. Additionally, the OIG
reported that only a small number of DHS' major acquisitions had
validated cost estimates.
The urgency and complexity of the Department's mission will
continue to demand rapid pursuit of major investment programs. Between
fiscal years 2003 and 2010, the Department spent about 40 percent of
its budget through contracts. Although that figure may have decreased
over the past 2 years, the Department will continue to rely heavily on
contractors to accomplish its multifaceted mission and will continue to
pursue high-risk, complex acquisition programs.
The Department must have an infrastructure in place that enables it
to effectively oversee the complex and large-dollar procurements
critically important to achieving its mission.
Both the OIG and the GAO have reported that the Office of the Chief
Procurement Officer needs more staff and authority to carry out its
general oversight responsibilities. The GAO recommended that the
Department provide the Office of the Chief Procurement Officer
sufficient resources and enforcement authority to enable effective,
Department-wide oversight of acquisition policies and procedures. The
OIG made a similar recommendation.
Common Themes in Audits of Department Contracts
Over the past several years, the OIG and GAO conducted numerous
audits of individual Department contracts, such as TSA's information
technology services, CBP's SBInet program, the Coast Guard's Deepwater
program, and FEMA contracting. Common themes and risks emerged from
these audits, primarily poor planning, the dominant influence of
expediency, poorly-defined requirements, and inadequate oversight that
contributed to ineffective or inefficient results and increased costs.
To ensure that its acquisition programs are successful, the Department
must lay the foundation to oversee and assess contractor performance,
and control costs and schedules. This requires a sustained commitment,
increased resources, and smarter processes to administer and oversee
the contractors' work.
FEMA Procurements
The Assistant IG for Emergency Management Oversight, Matt Jadacki,
testified on October 20, 2011 that FEMA has developed and strengthened
acquisition management policies and processes, but it continues to face
challenges. For example, weak internal controls have resulted in multi-
million dollar contracts with vague and questionable requirements and
no performance measures. Agency employees responsible for managing and
monitoring the contractors do not always receive written guidance or
training on how to evaluate contractor performance or certify billing
invoices. Continued improvements are needed in FEMA's oversight of
contracts.
During my tenure as the IG, my office issued several reports
recommending improvements to FEMA's acquisition processes. Those
recommendations have resulted in policies and procedures on contract
closeout, transferring contract files from one contracting officer to
another, and labeling and organizing contract files so all contract
actions are properly documented.
In fiscal year 2010, FEMA deployed Disaster Assistance Employees to
accelerate contract closeout efforts for the Disaster Relief Fund, de-
obligating $1.2 billion. These contract closeout efforts continue
annually and are in direct response to an OIG recommendation. I was
pleased to learn that FEMA has created Disaster Acquisition Response
Teams, whose focus on contract administration and oversight of large
disaster contracts is much needed. My office also reported FEMA's need
for an overarching sourcing strategy. Headquarters, regional, and local
FEMA representatives were ordering goods without communicating with
their counterparts at other locations. This resulted in goods ordered
that were not needed, purchased from the wrong source, or at the wrong
time. My former office recommended that FEMA adopt the single-point
ordering concept, to coordinate all sourcing decisions through the
Logistics Section. As a result of this recommendation, FEMA piloted the
single-point ordering concept during its response to Hurricane Irene.
Strategic Sourcing
The Department can improve management of its strategic sourcing. In
March 2011, the OIG reported that the Department did not have a
logistics process in place to facilitate strategic sourcing of
detection equipment. Strategic sourcing would require that management
standardize equipment purchases for explosive, metal, and radiation
detection equipment; identify common mission requirements among
components; and develop standard data elements for managing the
inventory accounts of detection equipment. Improving its management of
detection equipment will offer the Department opportunities to
streamline the acquisition process and improve efficiencies.
Acquisition Workforce
DHS made progress in the recruitment and retention of a workforce
capable of managing a complex acquisition program. At the time of my
retirement on March 1, 2011 the number of procurement staff had more
than doubled since 2005. In addition, participation in the Acquisition
Professional Career Program, which seeks to develop acquisition
leaders, increased 62 percent from 2008 to 2010. Nevertheless, DHS
continues to face workforce challenges across the Department. For
example, according to GAO, the Coast Guard reduced its acquisition
workforce vacancies from approximately 20 percent to 13 percent, and
had filled 832 of its 951 acquisition positions as of November 2010.
Although acquisition workforce vacancies have decreased, program
managers have on-going concerns about staffing program offices. Also,
according to its August 2010 human-capital staffing study, program
managers reported concerns with staffing adequacy in program management
and technical areas. To make up for shortfalls in hiring systems
engineers and other acquisition workforce positions for its major
programs, the Coast Guard must use contractors.
Likewise, according to the OIG's Major Management Challenges
report, dated November 2011, acquisition staff turnover in FEMA has
exacerbated file maintenance problems and resulted in multimillion-
dollar contracts not being managed effectively or consistently. One of
FEMA's challenges is hiring experienced contracting officers to work
disaster operations. The majority of FEMA staff at a disaster site work
on an on-call, intermittent basis, and, oftentimes, they lack the
training and experience to manage large disaster response and recovery
contracts.
FEMA also has made great strides in improving its contracting
officer's technical representative (COTR) cadre. FEMA has designated
staff to oversee the COTR program; developed a tiered system which ties
training requirements to dollar values of contracts a COTR can monitor;
and established an intranet site containing tools for COTR use.
However, many trained COTRs have never been assigned a contract and are
unsure of their ability to be effective. And, although they represent
the contracting officer, the COTRs' appraisals are completed by their
supervisors in the program offices for which they work, rather than the
applicable contracting officer, thus leading to divided loyalties.
Finally, the Department has not fully planned for or acquired the
workforce needed to implement its acquisition oversight policies.
According to a GAO report issued in February 2011, the Department needs
to continue its efforts to: (1) Identify and acquire resources needed
to achieve key actions and outcomes; (2) implement a program to
independently monitor and validate corrective measures; and (3) show
measurable, sustainable progress in implementing corrective actions and
achieving key outcomes. The Department needs to demonstrate sustained
progress in all of these areas to strengthen and integrate the
acquisition management functions throughout the Department.
Knowledge Management and Information Systems
According to the OIG's annual Major Management Challenges report,
the Department has made progress in deploying an enterprise acquisition
information system and tracking key acquisition data. The Department's
acquisition reporting system of record, known as nPRS (next-Generation
Periodic Reporting System), tracks components' major acquisition
investments. It also has capabilities to store key acquisition
documents, earned value management information, and risk
identification. Component personnel are responsible for entering and
updating information, which includes cost, budget, performance, and
schedule data. However, components did not complete and report all key
information in nPRS. The OIG reported that only 7 of 17 programs (41%)
reported Acquisition Program Baseline required milestones. These
milestones establish the acquisition cost, schedule, and performance
values. Only 13 (76%) programs reviewed contained required key
documentation such as mission needs statements, acquisition plans,
operational requirements documents, and integrated logistics support
plans.
In addition, the Department reported in its December 2011 strategy
for high-risk management that senior executives are not confident
enough in the data to use the Department's Decision Support Tool which
was developed to help make acquisition decisions, address problems
meeting cost or schedule goals, and prepare for program review
meetings.
Although the Department continues to make progress in improving its
acquisition management, it remains a significant challenge, in part
because of the magnitude of the number, dollar value, and complexity of
its acquisition activity.
grants management
Disaster Grants Management
FEMA oversees billions of dollars in disaster grant funds each
year, and, due to the environment under which these funds are
administered, they are highly vulnerable to fraud, waste, and abuse. To
illustrate, during fiscal years 2010 and 2011, the OIG's audits of 105
disaster grants identified $365 million in questionable cost and funds
that could be put to better use. The extent of the fraud, waste, and
abuse that the OIG uncovers year after year in the disaster relief
program, for the past 20 years, is unacceptable, and it needs to be
vigorously addressed. Yet FEMA still has not developed a robust program
to curtail fraud, waste, and abuse within its disaster relief programs.
Preparedness Grants Management
During fiscal years 2002 through 2011, FEMA distributed over $18
billion through the Homeland Security Grant Program. According to an
OIG report released this past July, FEMA does not have a system in
place to determine the extent that Homeland Security Grant Program
funds enhanced the States' capabilities to prevent, deter, respond to,
and recover from terrorist attacks, major disasters, and other
emergencies. Also, FEMA does not require States to report progress in
achieving milestones as part of the annual application process. As a
result, when annual application investment justifications for
individual continuing projects are being reviewed, FEMA does not know
whether prior year milestones for the projects have been completed.
FEMA also does not know the amount of funding required to achieve
needed preparedness and response capabilities.
Furthermore, according to the OIG's annual Major Management
Challenges report, dated November 2011, FEMA continues to face
challenges in mitigating redundancy and duplication among preparedness
grant programs, including barriers at the legislative, departmental,
and State levels. The preparedness grant application process is
ineffective because FEMA does not compare and coordinate grant
applications across preparedness programs. Since grant programs may
have overlapping goals or activities, FEMA risks funding potentially
duplicative or redundant projects.
Public Law 110-53, Implementing Recommendations of the 9/11
Commission Act of 2007, required the OIG to audit individual States'
management of State Homeland Security Program and Urban Areas Security
Initiatives grants and annually submit to Congress a report summarizing
the results of these audits. In the audits completed to date, the OIG
concluded that the States have generally done an efficient and
effective job of administering the grant management program
requirements, distributing grant funds, and ensuring that all the
available funds were used.
However, on March 20, 2012, the assistant inspector general for
audits testified that FEMA needs to make improvements in strategic
management, performance measurement, and oversight. According to Ms.
Richards, FEMA needs to improve its guidance on strategic plans for
State Homeland Security Grants. While current guidance for State
Homeland Security strategic plans encourages revisions every 2 years,
the language is such that it does not require revisions to be made--it
is just strongly encouraged. Consequently, many States have outdated
strategic plans, and many do not have Homeland Security strategic plans
with goals and objectives that are specific, measurable, achievable,
results-oriented, and time-limited. Without some form of measurable
goal or objective, or a mechanism to objectively gather results-
oriented data, States have no assurance of the level of effectiveness
of their preparedness and response capabilities. Also, States are less
capable of determining progress toward goals and objectives when making
funding and management decisions. The OIG reported deficiencies in
strategic planning in 15 of the 20 State audits completed as of March
2012.
In regard to performance measurement, Ms. Richards said that FEMA
needs to improve its guidance on establishing metrics and measuring
performance. The OIG continues to report that many States have not
received proper guidance and, consequently, have not adequately
documented or tracked their progress and performance. Providing
guidance on the appropriate metrics and requiring those metrics to be
documented would provide the States with tools to help them understand
the effectiveness of each grant program. FEMA also needs to strengthen
its guidance on reporting progress in achieving milestones as part of
the States' annual program justifications. Because of insufficient
information on milestones and program accomplishments, FEMA has been
annually awarding Homeland Security Grant Program funds to States for
on-going programs without knowing the accomplishments from prior years'
funding or the extent to which additional funds are needed to achieve
desired capabilities. Tracking accomplishments and milestones are
critical elements in making prudent management decisions because of the
evolving, dynamic changes that can occur between years or during a
grant's period of performance. OIG audits reported problems with
performance measurement in 19 of 20 State audits completed as of March
2012.
Finally, Ms. Richards said that FEMA needs to improve its oversight
to ensure the States are meeting their reporting obligations in a
timely manner to ensure FEMA has the information it needs to make
program decisions and oversee program achievements. Further, FEMA needs
to improve its oversight to ensure that States are complying with
Federal regulations in regard to procurements and safeguarding of
assets acquired with Federal funds. In its annual audits of the State
Homeland Security Program, the OIG repeatedly found weaknesses in the
States' oversight of grant activities. Those weaknesses include
inaccuracies and untimely submissions of financial status reports;
untimely allocation and obligation of grant funds; and not following
Federal procurement, property, and inventory requirements. Delays in
the submission of Financial Status Reports hampers FEMA's ability to
effectively and efficiently monitor program expenditures and prevents
the State from drawing down funds in a timely manner, ultimately
affecting the effectiveness of the program.
Strategic planning, performance measurement, and oversight are
important management controls for FEMA to ensure that Federal funds are
used for their intended purpose and that enhancements in preparedness
capabilities are being achieved. Without a bona fide performance
measurement system, it is impossible to determine whether annual
investments are actually improving our Nation's homeland security
posture. Furthermore, without clear, meaningful performance standards,
FEMA lacks the tools necessary to make informed funding decisions. In
today's economic climate, it is critical that FEMA concentrate its
limited resources on those threats that pose the greatest risk to the
country.
While some aspects of the Department's management support
challenges were inherited from the Department's legacy agencies, the
complexity and urgency of the Department's mission has oftentimes
exacerbated the Department's ability to address them in a disciplined
and effective manner.
It is evident that the Department's senior officials are well aware
of these challenges and are attempting to remedy them, and they have
actually made some headway. The question is, however: Does the
Department have the resolve and wherewithal to sustain those efforts?
The ability of the Department to do so is fragile, not only because of
the early stage of development that the initiatives are in, but also
because of the Government's budget constraints and the current lack of
resources to implement planned corrective actions. In today's
environment of large Government deficits and pending budget cuts, the
new challenge will be to sustain the progress already made and at the
same time continue to make the necessary improvements that are critical
to the success of the Department's management functions.
Unless the Department and Congress stay focused on these
challenges, it will be harder than ever to facilitate solutions to
strengthen the Department's management support functions and,
ultimately, its homeland security mission.
Mr. Chairman, this concludes my prepared statement. I will be
pleased to answer any questions you or the Members may have.
Chairman King. Thank you very much, Mr. Skinner, for your
testimony.
Our next witness, Stewart Baker, is a partner in the law
office of Steptoe & Johnson here in Washington, DC. I first met
Mr. Baker when he was the first assistant secretary for policy
at the Department of Homeland Security. In that role, he led a
staff of 250 people and was responsible for the Department-wide
policy analysis as well as the Department's affairs, strategic
planning, and relationships with law enforcement and public
advisory committees.
Other than that, he had nothing to do. It was a 48-hour-a-
day job, and Secretary Baker did an outstanding job. He was
named the top lawyer in international security by Washingtonian
magazine in 2011, and is an exceptionally distinguished
attorney and public servant.
I am privileged to recognize Secretary Baker for 5 minutes.
STATEMENT OF STEWART A. BAKER, FORMER ASSISTANT SECRETARY FOR
POLICY, DEPARTMENT OF HOMELAND SECURITY
Mr. Baker. Thank you, Chairman King, Ranking Member
Thompson. It is a pleasure to be back here. I have almost
recovered from my time in Government. You have seen my prepared
testimony. What I thought I would do is just touch on three
areas where the Department has big challenges, and actually
challenge myself to give the Department a grade. So I will give
the Department a grade on these things.
On the question of unity, coordination, making the
Department work as a whole, I think a C-minus is the best the
Department can get. It gets that because we have had three
strong Secretaries in a row who will not be denied when they
are paying attention, the components, the Department act more
or less as a whole. But the spotlight of Secretarial attention
is not the only place that coordination has to take place.
Outside that spotlight, we are not seeing the coordination
that is necessary. Probably more important in times of tough
budgets than any other because we can no longer afford
duplication of effort or initiatives that may meet a particular
component's priorities but don't fit into the overall National
priorities that the Secretary is setting.
I think Ranking Member Thompson pointed out how important
it is that we have a cohesive Department. I couldn't agree
more, and we are not there and not even close. As I think the
Chairman pointed out, having 100 oversight committees means
there is one committee in each body that actually wants a
single policy to come out of the Department.
Everybody else sees that the Secretary and the Secretary's
priorities as potentially getting in the way of their ability
to oversee some component of the Department. So having reform
of jurisdiction is absolutely essential if you are going to get
that grade above a gentleman's C-minus.
Let me turn to something where I think the story is very
good, in contrast, and where I would give the Department an A.
That is in carrying out the vision of the Homeland Security
Act, of thinking seriously about keeping terrorists from
crossing our borders. That used to be spread among three or
four different agencies, and none of them thought that was
their most important mission.
Putting all of those authorities in one place has led to a
transformation of the way we think about border security. The
way we have transformed that is in getting more data about the
people who are coming across the border--whether it is the ESTA
or PNR or the overseas interviews that Customs and Border
Protection does, or for the first time--we actually know
whether the people who are coming from other countries are
criminals or not, something we never knew.
None of that would have happened because all of it came
with a privacy resistance, an international resistance that
three Secretaries in a row have stood up to, to build a much
clearer sense of who is coming across our borders so we focus
our attention on the riskiest travelers. Chairman King, you
mentioned all of the domestic attacks, many of them thwarted.
What is little covered--although I think this committee
knows it quite well--is that in practically every one of those
CBP, thanks to its data programs, knew something about, and
contributed to the thwarting of, those attacks, or the
apprehension of the attackers. That is a complete change from
where we were when the Homeland Security Act was passed.
Finally, let me turn to someplace where I would give the
Department, I guess, a B-plus for defending its turf but a D-
plus for actually making us safer. That is in cyber. We are not
safer than we were when the Homeland Security Act was passed.
Things have gotten worse there.
We need to be doing much more. I believe that more
regulatory authority is necessary. Certainly the Department
needs a better relationship with NSA than they have today. But
I think even without taking on the regulatory issue, there are
ways to work with the private sector to build a better
information-sharing system than we currently have without
having to go back and change some of the privacy laws that have
made it hard to do that.
By opening up the resources of the private sector to
actually fund more investigations. I won't dwell on that, but I
think the Department, if they are serious about this, can make
a big difference in cyber. But they are going to need to
improve their workforce substantially.
Thank you.
[The prepared statement of Mr. Baker follows:]
Prepared Statement of Stewart A. Baker
September 20, 2012
Thank you, Chairman King, Ranking Member Thompson, and
distinguished Members of the committee, for this opportunity to testify
on the state of the Department of Homeland Security.
This is a timely hearing. We are approaching the tenth anniversary
of the Homeland Security Act that created the Department. It's time to
ask what the Department has done well, where it has failed, and how it
can do better in the future.
where dhs still falls short
I will cut to the chase. The Department's biggest unmet challenge
is making sure that its components are working together to the same
goal. This was a central objective of the Homeland Security Act. It
combined many agencies into a single Department so that all of them
would use their authorities cooperatively in the fight against
terrorists.
That may seem obvious, but this is Washington, and doing the
obvious is not easy. The coordination efforts of a 10-year-old
Department do not always impress component agencies that can trace
their origins to the founding of the Republic.
The good news of the last 10 years is that the Department has had
three Secretaries who had no doubt about who was running the Department
and who insisted on the cooperation of all parts of the Department to
implement their highest priorities. The bad news is that, in my view,
these accomplishments owe more to the Secretaries' personalities than
to the institutions they have built. In general, the offices that
support the Secretary, from the various management offices to the
office of policy, have not created a framework that can coordinate the
big, proud components of DHS on issues that are outside the spotlight
of Secretarial attention.
The need to strengthen those institutions is especially pressing
now. We face a possible change of leadership at DHS no matter who wins
the next election. And the Department faces a difficult budget outlook.
Even in a time of record deficits, DHS's budget has hit a ceiling.
There is almost no prospect of overall budget increases in the future,
and cuts are likely. Budget decisions simply must be based on how each
component's expenditures fit the Department's highest priorities. The
Department will have to identify redundancies and may have to eliminate
programs with powerful constituencies. If that is not done on the basis
of a careful, institutionalized review of the Department's overall
strategy, we will not use the scarce dollars that remain in a way that
best protects the country. That would be a tragedy.
three case studies
That, of course, is a very general evaluation. Let me be more
specific about several important DHS initiatives.
1. Data-based security screening
One of the Department's unquestionable successes is the way it has
unified the Government's screening and enforcement on the border,
something that was once a side business for three or four departments
with other priorities. DHS realized early that it couldn't spend even 5
minutes with every traveler who was crossing the border. Instead, it
had to concentrate on the riskiest travelers, and to do that it needed
more information about travelers, as far in advance as possible. As
with so much at the Department, this has been a bipartisan priority;
Secretary Napolitano has preserved and improved many data programs
launched under earlier Secretaries. And DHS's data programs have
contributed to the identification and apprehension of several travelers
seeking to commit acts of terror on U.S. soil in recent years.
This initiative has been a great success--one that could not have
been achieved without the Department. The use of travel reservation
(``PNR'') data to screen travelers has come under constant attack on
bogus privacy grounds from the European Union, which has torn up its
earlier agreement to honor the program every time a new Secretary has
been sworn in. Every time, the new Secretary has insisted on
maintaining the program.
The Department has also gone on the offensive to get other
important data about travelers. Before the Department was created,
remarkably, our border inspectors had no way to know whether travelers
from other countries had been convicted even of the most serious
crimes. Now, thanks to the leverage of the Visa Waiver Program, every
participating country other than Japan has a ``PCSC'' agreement with
the United States, that will provide access to travelers' criminal
records. The Department has also implemented ESTA, a ``reservation''
system that allows the Department to screen VWP travelers for potential
risk before they begin their trips.
The Department has further expanded available information by
launching Global Entry, which speeds clearance at the border for
travelers who have been vetted in advance. Going forward, it will have
background information on frequent travelers from a number of foreign
partners, including the Netherlands, South Korea, Germany, Australia,
and Brazil. As a result, DHS can focus more resources on riskier
travelers.
Finally, DHS has begun gathering more data in foreign airports,
successfully posting U.S. Government officers there to interview and in
some cases to pre-clear travelers, a security enhancement that benefits
both the individual traveler and the host government.
These data programs have improved the efficiency of border
screening while also speeding most travelers across the border more
quickly. Despite the hostility of privacy campaigners, the programs
have proved themselves. There have been no known abuses of the data.
This is a success that could only have been achieved by a unified
Department. It is a success that DHS can be proud of.
That does not mean that it is perfect. In my view, our
international negotiation strategy needs a coherent plan, with
priorities, to make sure we get the most important information about
the riskiest travelers at least cost to the United States. I also fear
that our last PNR agreement accepted too many of Europe's limitations
on PNR while surrendering too many protections for the program. And I'm
disappointed that we have not persuaded Japan to supply information
about the yakuza, or professional criminals, who may be traveling to
the United States. But these are tactical criticisms of a program that
is a great strategic victory.
Indeed, it is a victory that is paying dividends in airports around
the country. Everyone likes to criticize TSA, and one of the most valid
criticisms is that it treats all of us like suspected terrorists.
What's less known is that this treatment was more or less mandated by
privacy campaigners, who persuaded Congress that TSA could not be
trusted with the same travel reservation data that our border officials
use every day. Lacking any information about travelers, TSA had no
choice but to treat them all alike.
Now that the use of data for screening at the border has proven
itself, the dam is beginning to break for TSA as well. TSA now has
access to each traveler's name, gender, and date of birth.
Increasingly, it also knows about the traveler's travel history, based
on the voluntary provision of frequent flier data. It has shown how
this data allows risk-based variations in screening, using date of
birth to reduce screening hassles for children under 12 and seniors
over 75. And overseas, in response to the Christmas day bomb attempt,
CBP and TSA are combining forces to do data-based screening of
passengers on U.S.-bound foreign flights. Finally, TSA is using Global
Entry and other data to create a known traveler screening process for
domestic flights.
This is all great progress, though more is needed. In the next 5
years, TSA should expand its use of data-based screening further,
expediting travel for the great majority while demonstrating that it
can be trusted with personal data. Because of past privacy limitations,
it is likely that TSA will need Congressional assistance to achieve
this goal.
2. cybersecurity
Sometimes it's easier to persuade the team to give you the ball
than to actually run with it. That is DHS's problem in cybersecurity
right now.
DHS seems to have successfully fended off the many agencies and
committees that wanted to seize parts of its cybersecurity mission.
Whether DHS can carry out the mission, though, remains uncertain.
Although the Homeland Security Act clearly gave DHS authority over
civilian cybersecurity issues, it did not give DHS the kind of trained
personnel it needed. Finding talented cyberwarriors is a challenge even
for private-sector firms. Attracting them to the Department has been
doubly difficult, especially with a hiring process that in my
experience was largely dysfunctional. The Department's biggest
challenge is hiring and maintaining a cybersecurity staff that can earn
the respect of private cybersecurity experts. With the exception of a
handful of officials, DHS has not yet built a cadre of employees who
can match their counterparts at NSA or Goldman Sachs. This is critical.
If DHS fails in personnel, it will likely fail in the rest of its
cybersecurity-related activities.
There are other challenges for DHS in cybersecurity. They include:
Building a better relationship with NSA.--The outlines of a
working relationship with NSA are obvious. DHS should provide
policy guidance based in law and prudence for any cybersecurity
mission affecting the civilian sector, but it must rely heavily
on NSA's technical and operational expertise. This fundamental
truth has been obscured by personalities, mistrust, and
impatience on both sides. It's got to end, especially in the
face of adversaries who must find the squabbling email messages
especially amusing because they are reading them in real time.
Gaining authority to insist on serious private-sector
security measures.--DHS has plenty of legislative authority to
cajole and convene the private sector in the name of
cybersecurity. It's been doing that for 10 years. The private
sector has paid only limited attention. In part that's because
DHS had only modest technical expertise to offer, but it's
largely because few industries felt a need to demonstrate to
DHS that they were taking its concerns seriously. That is one
reason that DHS needs at least some authority to demand that
industry respond to the cybersecurity threat, especially where
it poses risks to civilian life that are not adequately
recognized by the market. I fully recognize that cybersecurity
measures do not lend themselves to traditional command-and-
control regulation, and that information technology is a major
driver for economic growth. That's a reason to be cautious
about how Government approaches the private sector. But it's
not a reason for Government to ignore the risk of a
cybersecurity meltdown. It's worth remembering that, for a
couple of decades, we were told that the financial derivatives
trade was too complex for traditional Government regulation and
a major driver of economic growth, and that the private sector
could do a better job of internalizing risk than any Government
regulator. We should not wait for the cybersecurity equivalent
of the financial meltdown to give DHS a larger role in
cybersecurity standards.
Sometimes the businessmen arguing against regulation are wrong--so
wrong that they end up hurting their own industries. I believe that
this is true of those who oppose even the lightest form of
cybersecurity standards. Most of the soft quasi-regulatory provisions
that business groups rejected in talks with the Senate will likely be
incorporated into an Executive Order that they will have little ability
to influence. Even worse from their point of view, the pressure for
legislation is likely to continue--and will become irresistible if we
suffer a serious infrastructure failure as a result of hacking. In that
event, the cybersecurity legislation that Congress adopts will have to
go beyond the Executive Order and into the territory of much tougher
regulation. By failing to adopt more limited legislation now, Congress
is sowing the seeds for more aggressive regulation in the future.
Moving beyond the fight over ``regulation''.--That said, DHS cannot
wait for a National consensus on its regulatory role. There are many
other steps that DHS could take to improve cybersecurity without
touching the regulatory third rail. Let me outline a few of them here:
Information-sharing.--It should be obvious why the targets
of cyber attacks need to share information. We can greatly
reduce the effectiveness of those attacks if we use the
experience of others to bolster our own defenses. As soon as
one victim discovers a new command-and-control server, or a new
piece of malware, or a new email address sending poisoned
files, that information can be used by other companies and
agencies to block similar attacks on their networks. This is
not information sharing of the ``let's sit around a table and
talk'' variety. It must be automated and must occur at the
speed of light, not at the speed of lawyers or bureaucrats.
I supported CISPA, which would have set aside two poorly-conceived
and aging privacy laws that made it hard to implement such
sharing. I still do. But if CISPA is going to be blocked for a
time by privacy objections, as seems likely, we need to ask a
different question: Can the automated information-sharing
system that we need be built without rewriting those aging
privacy laws? I believe that it can; we simply need a more
creative and determined approach to the law. Administration
lawyers, who have taken an unnecessarily rigid view of existing
law, should be sent back to find ways to build automated
information sharing under existing law.
Emphasize attribution.--We will never defend our way out of
the cybersecurity crisis. I know of no other crime where the
risk of apprehension is so low, and where we simply try to
build thicker and thicker defenses to protect ourselves.
The obvious alternative is to identify the attackers and to find
ways to punish them. But many information security experts have
grown skeptical of this alternative. As they point out,
retribution depends on attribution, and attribution is
difficult; attackers can hop from country to country and from
server to server to protect their identities.
That skepticism is outmoded, however. Investigators no longer need
to trace each hop the hackers take. Instead, they can find
other ways to compromise and then identify the attackers,
either by penetrating hacker networks directly or by observing
their behavior on compromised systems and finding behavioral
patterns that uniquely identify the attackers. It is harder and
harder for anyone to function in cyberspace without dropping
bits of identifying data here and there. If our security is
inherently flawed, so too is the security of our attackers.
This means that it is realistic to put attribution at the
center of our response to cyberattacks.
We should take the offense, surrounding and breaking into hacker
networks to gather information about what they're stealing and
who they're giving it to. That kind of information will help us
prosecute criminals and embarrass state-sponsored attackers. It
will also allow us to tell the victim of an intrusion with some
precision who is in his network, what they want, and how to
stop them. DHS's intelligence analysis arm should be issuing
more such reports and fewer bland generalities about terrorism
risks for local law enforcement agencies.
Use DHS law enforcement authorities more effectively.--Law
enforcement agencies have a vital role to play in
cybersecurity--even when the prospect of actually arresting the
attacker is remote. Law enforcement agencies have investigative
authorities, including search warrants and wiretaps, that can
help identify attackers. Those authorities should be used
strategically to aid in the overall attribution effort.
The best way to achieve that goal is for DHS's cybersecurity office
to be fully coordinated with law enforcement agencies that have
criminal investigative authorities. By pooling information,
authorities, and resources, these agencies should pursue a
common strategy--one that identifies the bad guys, first to
disable their attacks and eventually to bring them to justice.
Coordination between DHS and the FBI may have its challenges,
but today it seems that there is only modest coordination even
between DHS's cybersecurity office and its own cybercrime
investigators. Certainly I have seen no sign that ICE and
Secret Service investigations are prioritized strategically
based on guidance from the DHS cybersecurity office. The result
is wasted opportunities and wasted resources. Instead, ICE and
Secret Service cybercrime investigators should be detached to a
task force ran by the cybersecurity office as a way of
dramatizing the need for an all-of-DHS approach to the problem.
Law enforcement authorities create a second opportunity that we are
not fully exploiting. Increasingly, it is law enforcement that
tells businesses they have been compromised. But usually the
first question from businesses is one best directed towards the
cyber defenders rather than the cyber cops: ``What can we do to
get the attacker out?'' This is a ``teachable moment,'' when
all of DHS's cyberdefense and industry-outreach capabilities
should be engaged, talking to the compromised company about the
nature of the intruder, his likely goals and tactics, and how
to defeat them. Currently, however, DHS's cybersecurity office
and its cybercrime investigators do not present themselves as a
unified team when visiting the victims of attacks. Better
coordination within the Department would pay dividends and
provide a model for coordination across Department lines.
Recruit private-sector resources to the fight.--In my
private practice, I advise a fair number of companies who are
fighting on-going intrusions at a cost of $50 or $100 thousand
a week. The money they are spending is going almost entirely to
defensive measures. At the end of the process, they may succeed
in getting the intruder out of their system. But the next week,
the same intruder may get another employee to click on a
poisoned link and the whole process will begin again. It's a
treadmill. Like me, these companies see only one way off the
treadmill: To track the attackers, figure out who the attackers
are and where they're selling the information, and then
sanction the attackers and their customers.
When private companies' cybersecurity executives were surveyed
recently, ``more than half thought their companies would be
well served by the ability to `strike back' against their
attackers.'' W. Fallon, Winning Cyber Battles Without Fighting,
Time (Aug, 27, 2012). And the FBI's top cybersecurity lawyer
just this week called our current strategy a ``failed
approach'' and urged that the Government enable hacking victims
``to detect who's penetrating their systems and to take more
aggressive action to defend themselves.'' Washington Post (Sep.
17, 2012).
He's right. But under Federal law, there are grave doubts about how
far a company can go in hacking the hackers. I happen to think
that some of those doubts are not well-founded, but only a very
brave company would ignore them.
Now, there's no doubt that U.S. intelligence and law enforcement
agencies have the authority to conduct such an operation, but
by and large they don't. Complaining to them about even a
state-sponsored intrusion is like complaining to the D.C.
police that someone stole your bicycle. You might get a visit
from the police; you might get their sympathy; you might even
get advice on how to protect your next bicycle. What you won't
get is a serious investigation. There are just too many crimes
that have a higher priority.
In my view, that's a mistake. The Department, drawing on the
resources of the entire Government, should do some full-bore
criminal and intelligence investigations of private-sector
intrusions, especially those that appear to be state-sponsored.
We can identify the attackers, and we can make them pay.
But if we want do that at scale, we have to let the victims
participate in, and pay for, investigations that the Government
will never have the resources to pursue. Too many Government
officials have viewed such private countermeasures as a kind of
vigilante lynch mob justice. That just shows a lack of
imagination. In the real world, if someone stops making
payments on a car loan but keeps the car, the lender doesn't
call the police; he hires a repo man. In the real world, if
your child is kidnapped, and the police aren't making it a
priority, you hire a private investigator. And, if I remember
correctly the westerns I watched growing up, if a gang robs the
town bank and the sheriff finds himself outnumbered, he
deputizes a posse of citizens to help him track the robbers
down. Not one of those solutions is the equivalent of a lynch
mob or of vigilante justice. Every one allows the victim to
supplement law enforcement while preserving social control and
oversight.
DHS could probably experiment with that solution tomorrow if it
chose, as could the FBI. Its law enforcement agencies often
have probable cause for a search warrant or even a wiretap
order aimed at cyber intruders. I know of no legal barrier to
obtaining such an order, then relying on a private contractor
paid by the victims to actually carry out the search or the
tap, as long as that happens under Government supervision. (The
Antideficiency Act, which arguably prohibits the Government
from accepting free services, has more holes than my last pair
of hiking socks, including exceptions for protection of
property in emergencies and for gifts that also benefit the
donor.)
If systematic looting of America's commercial secrets truly is a
crisis, and I believe that it is, why have we not already
unleashed the creativity and resources of the private sector
that attackers are victimizing?
Mr. Chairman, that concludes my prepared testimony. I will be
pleased to answer any questions the committee may have.
Chairman King. Thank you, Secretary Baker.
Our next witness, Frank Cilluffo, is associate vice
president at George Washington University, where he directs the
Homeland Security Policy Institute. I have had the privilege of
being out there. You know, it is accurate to say that Mr.
Cilluffo was present at the creation.
Shortly after the 9/11 attacks, Mr. Cilluffo was appointed
by the President to the Office of Homeland Security, and served
as the principle advisor to Governor Tom Ridge. Prior to his
White House appointment, Mr. Cilluffo served in policy
positions at the Center for Strategic and International
Studies.
His work has been widely published in academic, law,
business, and policy journals, as well as magazines and
newspapers around the world. Without giving away too much, I
can tell you often, before we prepare our committee agenda or
look into topics we are going to cover, we look at what you
have been saying on it lately. We certainly appreciate your
wisdom and input.
With that, Mr. Cilluffo, I am privileged to recognize you
for 5 minutes.
STATEMENT OF FRANK J. CILLUFFO, FORMER PRINCIPAL ADVISORY TO
GOVERNOR TOM RIDGE, WHITE HOUSE OFFICE OF HOMELAND SECURITY
Mr. Cilluffo. Thank you, Mr. Chairman. Thank you for the
opportunity to appear before you today. Mr. Thompson, good to
see you again, as well. Let me also, before jumping in--and I
was asked to talk on the threat-related issues--thank you for
your leadership in this committee. I mean, you really have
taken on the hard issues facing this country.
I think you have tackled them head-on. Not an easy set of
issues. I will be very brief, not my strong suit as I have
never had an unspoken thought. But what I thought I would do is
touch on some of the counterterrorism issues that we see and
the current terrorism threat, as well as some of the cyber
challenges where I am very much in agreement with Stewart's
prognosis.
Firstly, as the recent terrorist attack in Benghazi clearly
demonstrated, as well as unrest not only the Middle East, in
North Africa, but also in Southeast Asia, there is no time to
be lulled into a sense of complacency. A set of issues that I
think a lot of people have been.
Yes, we have had a number of successful counterterrorism
events of late. Most notably, the successful strike against
Osama bin-Laden, Anwar al-Awlaki, Ilyas Kashmiri, probably the
most dangerous unknown terrorist out there. But by no means
does this mean that ding-dong, the witch is dead.
Unfortunately, what we have seen is the threat metastasize.
It has morphed. Today, it comes in various shapes, sizes,
flavors, and forms, ranging from al-Qaeda senior leadership,
still operating out of the Fatah as well as its affiliates,
most notably al-Qaeda in the Arabian Peninsula; home to
probably the world's most dangerous bomb maker, in Ibrahim al-
Asiri, to al-Qaeda and the Islamic Maghreb, which is growing
leaps and bounds not only across the Maghreb but also
throughout the Sahel, as well as like-minded jihadi
organizations in the African continent as a whole.
Ansar al-Dine in Mali, you are seeing Mauritania being
taken over by Islamist groups, all the way through to the Horn
of Africa, with Al Shabaab in Somalia. So the prognosis is not
very good. Actually, if you have seen the way it has spread, I
am not sure that some of our traditional counterterrorism
instruments are the most appropriate right now.
Moreover, the reason you have seen some success in the
Fatah is because we have--think of it as--suppressive fire. It
is based on our successful counterterrorism initiatives. If we
ease off that gas pedal, don't think that that vacuum isn't
going to be instantaneously filled not only by al-Qaeda, but
other like-minded individuals.
Bottom line here is, is the more time they are looking over
their shoulder the less time they are plotting, training, and
executing attacks. So I just warn the Congress to be able to
support some of our counterterrorism measures. African
continent, I can get into that in greater depth later.
But you literally are seeing swaths; the entire Maghreb,
northwest Africa, all the way through from Mauritania to the
Horn of Africa, in Somalia. These are areas where you are
seeing Jihadi groups take advantage of under- and un-governed
spaces. Why any of these regions? Because they are un-governed
spaces.
I would also note that you have seen the homegrown threat
in the United States. This is not an insignificant set of
issues. We have had 58 cases, 58 plots, that have been
prevented since 9/11. Some of those very significant. In New
York City, for example, Naji Bolazazi. That was a very
significant plot.
That was blinking red as red could be red. Faisal Shahzad,
also a very significant plot. So as much as we can lean forward
and support our State and local law enforcement authorities, I
think we need to be able to do so very quickly on cyber. I
think it is fair to say that our cyber community is where
homeland and counterterrorism community was shortly after 9/11.
We have a lot to do. Long on nouns, short on verbs. We have
been talking about it, but we are not actually addressing some
of the most significant issues. To rack and stack the threat,
you have got countries that are integrating computer network
attack and computer network exploit into their warfighting
capabilities.
Russia, China, at the top of the list. But also, you have
countries like North Korea, Iran, who are increasingly becoming
a terrorist threat. Their proxies, Hezbollah, are of great
concern. What they lack in capability they more than make up
for in intent. In the cyber domain, you can buy capabilities.
Intent and cash can take you a long way, something I think
we need to be thinking about. Finally, in terms of
recommendations--and I will be very quick here--one policy
recommendation. The biggest, biggest missing dimension of our
counterterrorism statecraft thus far, in my eyes, has been,
``It is the ideology.'' To paraphrase Bill Clinton, it is not,
``the economy, stupid,'' but, in this case, ``the ideology,
stupid.''
We have got to get a comprehensive approach that exposes
the hypocrisy of the jihadists and ultimately helps facilitate
it fall under its own weight. Think of negative political
campaigning. We need to do more in this respect. We also need
to start focusing on the victims, not only the perpetrators.
Ultimately, to me, this is where we have an awful lot we
should and can do beyond the traditional battlefields. Second,
a structural one. That Department of Homeland Security, I would
argue, needs an office of net assessment; someone who is not
fettered by day-to-day intelligence needs, not fettered by day-
to-day policy needs, but has the ability to step back, think
big, ask the what-ifs, look for the game-changers.
That doesn't currently exist because everyone is running
out of their inboxes daily. A very tactical one, NPPD as well
as intelligence and analysis at DHS. I think they have a very
unique thing that they can bring to the counterterrorism fight.
That is, coming up with new intelligence products that are very
oriented around critical infrastructures.
No one else in the intelligence community has that
capability. We need to make that a reality. Information
sharing, we have got to move at least the CISPA bill that Mr.
Rogers and others had proposed, if you ask me. Is it enough?
Probably not. But at the very least, we need to move on those
measures.
Finally, in the cyber domain we are never going to firewall
our way out of the problem. At the end of the day, the
initiative stands with the offender, on the offense. So we have
got to clearly articulate a cyber deterrent strategy, one that
is actor-specific. Because right now, we are lumping China and
Russia with a kid operating out of his basement, drinking a lot
of Jolt Cola or whatever they drink nowadays.
But at the end of the day we need to get to the point where
we can actually have a clearly articulated cyber deterrent
strategy, and one that we are willing to act when red lines are
crossed.
Thank you, Mr. Chairman.
[The prepared statement of Mr. Cilluffo follows:]
Statement of Frank J. Cilluffo
September 20, 2012
Chairman King, Ranking Member Thompson, and distinguished Members
of the committee, thank you for the opportunity to testify before you
today. Throughout your tenure as Chairman of this committee,
Congressman King, you have consistently taken on the hard issues facing
our country, and have committed to addressing them. Thank you for your
leadership. Turning to the timing and subject of today's hearing both
are well-selected. As recent events from the Middle East and North
Africa through to Southeast Asia regrettably illustrate, violent
extremism continues to thrive. With the United States and its interests
still in the cross-hairs of jihadi and Islamist militants across the
globe, the present moment is sadly opportune to assess the activities
of the Department of Homeland Security (DHS) and give careful
consideration to a roadmap for its future. Despite significant
progress, especially on the counterterrorism front, the existing and
projected threat climate is such that continued vigilance and a robust
as well as proactive posture is needed--not only at DHS but throughout
Government, at all levels, and supported by approaches that effectively
integrate the private sector and the efforts of individual citizens
too.
the threat ecosystem of today and tomorrow: challenges for dhs and
beyond
Al-Qaeda (AQ) has been a shrewd practitioner of the art of stoking,
piggybacking upon, and exploiting local grievances in order to further
AQ's own goals and objectives and the broader global jihad. In a
military context, this is referred to as tactical, operational, and
strategic ``swarming''; and it has clearly been adopted by others as
well, as recent incidents around the globe have unfortunately
demonstrated. Usama bin Laden may be dead, but the toxic ideology that
he left behind lives on, and the narrative that it informs continues to
resonate powerfully in certain quarters. Today perhaps the most
significant locus of his legacy and methods is in Africa; though
Pakistan's Federally Administered Tribal Areas, better known as FATA,
remain a combustible region, one where it would be imprudent to ease up
on U.S. pressure against militants.\1\
---------------------------------------------------------------------------
\1\ U.S. military actions, including the use of drones, have had
significant operational effects on al-Qaeda (and associated entities)
by disrupting foreign fighter pipelines to the region, activities of
key facilitators, and training camps. Think of it as suppressive fire.
The more time al-Qaeda and associated entities spend looking over their
shoulders, the less time they have to train, plot, and execute
terrorist attacks. And with al-Qaeda senior leaders on their back
heels, now is the time to exploit this unique window of
counterterrorism opportunity by maintaining the operational tempo to
consolidate these gains.
---------------------------------------------------------------------------
In Africa, al-Qaeda in the Arabian Peninsula (AQAP), al-Qaeda in
the Islamic Maghreb (AQIM), Al Shabab (Somalia), Ansar al-Dine (Mali),
Boko Haram (Nigeria), and their ilk persist in sowing discord and
violence in a cross-continental swath ranging from east to west,
leaving not even Timbuktu untouched. Indeed, even Yemen, the subject of
significant counterterror efforts on the part of the United States (and
others), remains home to AQAP and to one of the world's most dangerous
bomb-makers, Ibrahim al-Asiri. Notwithstanding U.S. and allied
counterterrorism efforts that have yielded a good measure of success,
these terror affiliates remain committed to carrying forward the mantle
of bin Laden, and to exploiting both ungoverned and under-governed
spaces. The latter tactic pre-dated the Arab Spring, but evidenced
reinforcement and magnification thereafter. The tragic violence of
recent days, beginning in Benghazi and directed against U.S. personnel
and interests (and those of allies), may come to further prove this
point, though key facts remain under investigation.
As observed in a report on Mauritania published earlier this year
by the Carnegie Endowment for International Peace, Africa is a hot spot
because of the confluence of multiple factors, including poverty,
corruption, and weak governance. The ensuing void left in countries
like Mauritania, where state infrastructure like the education system
is weak, offers an opening to ``mahadras'' (religious schools)
propagating violent ideologies, which in turn spur the growth of
militancy. The outlook for the Continent is not entirely bleak however;
as the study points out, ``there is a high level of distrust between
black Africans and AQIM, a movement led and dominated by Arabs''--which
portends a recruitment challenge for al-Qaeda forces in the area, at
least in the longer term.\2\ The outcome is not predetermined, though,
as AQ was able to surmount and ingrain itself into the tribal
populations indigenous to the FATA by pursuing a concerted strategy of
marrying into these clans. Whether a similar or other course might
further pave the way for inroads into African countries remains to be
seen and merits continued U.S. vigilance, as well as that of our
allies.
---------------------------------------------------------------------------
\2\ Anouar Boukhars, The Drivers of Insecurity in Mauritania
Carnegie Paper (April 2012) http://carnegieendowment.org/2012/04/30/
drivers-of-insecurity-in-mauritania#.
---------------------------------------------------------------------------
The various terrorist organizations cited above are exhibiting,
moreover, an increasing willingness to reach out and partner with one
another, as well as with others, who may be able to help build their
indigenous capacities and further their particular goals. The twin
phenomena of violent extremism and cross-group cooperation of such
forces is assuredly not limited to Africa, and extends to the veritable
witch's brew of forces that ranges from Iraq, Pakistan, and the
Caucasus, to Mali, Nigeria, and Somalia--where militants linked to al-
Qaeda tried to kill the country's new President just last week in a
double suicide/homicide blast. Pakistan is especially complex, and
dangerous. Groups that were once regionally focused now subscribe ever-
more to al-Qaeda's goals and the broader global jihad. This toxic blend
includes the Haqqani network,\3\ Laskhar-e-Taiba (LeT), Tehrik-i-
Taliban Pakistan, Harkat-ul-Jihad al-Islami (HuJI), Jaish-e-Mohammed,
and the Islamic Movement of Uzbekistan; all of which cooperate with al-
Qaeda on a tactical and sometimes strategic basis, linked by an
affinity for militant Islamist ideology--with United States, Indian,
Israeli, and Western targets increasingly in their cross-hairs.
Historically, collaborative efforts among such groups were primarily
linked to covert logistical support, including the provision of money,
safe havens, and arms, as well as the movement back and forth of key
personnel from one entity to another.
---------------------------------------------------------------------------
\3\ Recently designated a Foreign Terrorist Organization by the
Department of State (a too-long delayed move, though one rightly
supported by the Chairman of this Committee). http://
translations.state.gov/st/english/article/2012/09/
20120907135632.html#axzz26kbUie00; see also Frank J. Cilluffo, ``U.S.-
India Counterterrorism Cooperation: Deepening the Partnership'' Hearing
before the House of Representatives Committee on Foreign Affairs,
Subcommittee on Terrorism, Non-proliferation and Trade (September 14,
2011) http://www.gwumc.edu/hspi/policy/testimony9.13.11_cilluffo.pdf.
---------------------------------------------------------------------------
Not so today, where the relationships between terrorist groups are
becoming more overt and strategic in nature. As events on the ground in
Syria demonstrate, there will be no shortage of opportunities for
foreign fighters who wish to travel to jihadi conflict zones. Consider
also Africa, where the head of U.S. Africa Command General Carter Ham
has stated that ``the linkages between AQIM and Boko Haram are probably
the most worrisome in terms of the indications we have that they are
likely sharing funds, training and explosive materials that can be
quite dangerous.''\4\ So too closer to home, where the Commander of
U.S. Southern Command General Douglas M. Fraser has observed a similar
type of convergence (based on convenience) between terrorist and
criminal organizations in the Tri-Border area of Argentina, Brazil, and
Paraguay.\5\ Within the Continental United States, furthermore, the New
York City Police Department has expanded its decade-plus focus on core
al-Qaeda, affiliates, and the homegrown threat (inspired by AQ), to
include Iran and Hezbollah--as part of NYPD's continuing efforts to
build a robust and independent counterterror posture for the City of
New York.\6\ In turn, the Los Angeles Police Department recently
elevated the government of Iran and its proxies (notably Hezbollah) to
a Tier I threat.\7\ This last development is particularly concerning
given Iran's on-going drive to achieve nuclear weapons capability, and
the statement this month of Lebanese Hezbollah leader Sayyed Hassan
Nasrallah to the effect that there will be no distinction drawn between
Israel and the United States in terms of retaliation, should Israel
attack Iran to halt its progress toward the nuclear goal: ``If Israel
targets Iran, America bears responsibility.''\8\ Both the Director of
the (U.S.) National Counterterrorism Center and the Director of
National Intelligence have underscored concern about Iran and their
proxies, suggesting respectively in recent testimony (the former before
this committee) that ``Iran remains the foremost state sponsor of
terrorism''\9\; and that Iran is ``now more willing to conduct an
attack in the United States.''\10\
---------------------------------------------------------------------------
\4\ Tristan McConnell, ``Triple threat: Coordination suspected
between African terrorist organizations'' Global Post (June 26, 2012)
http://www.globalpost.com/dispatches/globalpost-blogs/africa/triple-
threat-coordination-suspected-between-african-terrorist-or.
\5\ Statement before the Senate Armed Services Committee (March 6,
2012) http://www.armed-services.senate.gov/statemnt/2012/03%20March/
Fraser%2003-13-12.pdf.
\6\ Testimony of Mitchell D. Silber before the U.S. House of
Representatives Committee on Homeland Security Iran, Hezbollah, and the
Threat to the Homeland (March 21, 2012) http://homeland.house.gov/
sites/homeland.house.gov/files/Testimony-Silber.pdf.
\7\ Frank J. Cilluffo, Sharon L. Cardash, and Michael Downing, ``Is
America's view of Iran and Hezbollah dangerously out of date?''
FoxNews.com (March 20, 2012) http://www.foxnews.com/opinion/2012/03/20/
is-americas-view-iran-and-hezbollah-dangerously-out-date/
\8\ Reuters, ``Nasrallah: Iran could strike US bases if attacked''
The Jerusalem Post (September 3, 2012) http://www.jpost.com/
IranianThreat/News/Article.aspx?id=283706.
\9\ Matthew G. Olsen, ``Understanding the Homeland Threat
Landscape'' Hearing before the House Committee on Homeland Security
(July 25, 2012) http://homeland.house.gov/sites/homeland.house.gov/
files/Testimony-Olsen.pdf.
\10\ James R. Clapper, ``Unclassified Statement for the Record on
the Worldwide Threat Assessment of the US Intelligence Community for
the Senate Select Committee on Intelligence'' (January 31, 2012) http:/
/intelligence.senate.gov/120131/clapper.pdf.
---------------------------------------------------------------------------
All this to say there is little ground for complacency, as toxic
forces converge and cooperate in multiple spots across the globe, more
than ever before; as ideology and narrative continue to inspire,
including those here in the United States--recall that 58-plus
homegrown jihadi terrorism plots have been discovered in this country
since 9/11; and as foreign fighters return to their homelands battle-
hardened and armed with Western passports--10 feet tall in the eyes of
those who admire their exploits, and more importantly, a direct threat
to Western security given their familiarity with potential targets they
may select to attack.\11\ Where foreign fighters are concerned, so-
called ``bridge figures'' are of special importance, as they ensure
that particular fighter pool is replenished, by helping to inspire,
radicalize, and motivate. These figures exude charisma, and exhibit
cultural and linguistic fluency as well as other skills that propel
them to positions of leadership, guidance, and prominence. Abdullah al-
Faisal, a Jamaican with ties to shoe bomber Richard Reid and to
(attempted) Times Square bomber Faisal Shahzad, is but one example.\12\
---------------------------------------------------------------------------
\11\ Frank J. Cilluffo, ``Open Relationship'' ForeignPolicy.com
(February 15, 2012) http://www.foreignpolicy.com/articles/2012/02/15/
open_relationship?page=0,0; and Jerome P. Bjelopera ``American Jihadist
Terrorism: Combating a Complex Threat'' CRS Report for Congress
(November 15, 2011) http://www.fas.org/sgp/crs/terror/R41416.pdf (but
note that numbers have increased since the Report was published).
\12\ Frank J. Cilluffo, Jeffrey B. Cozzens, and Magnus Ranstorp,
Foreign Fighters: Trends, Trajectories & Conflict Zones (October 1,
2010 http://www.gwumc.edu/hspi/policy/report_foreignfighters501.pdf.
---------------------------------------------------------------------------
Just as the threat has gravitated and metastasized to areas in the
physical world that will best support the ideology and activities at
issue, so too has the threat taken hold in (and of) the cyber domain--
where terrorists are still afforded too much freedom of maneuver. Being
squeezed in Pakistan's FATA, the Sahel, Yemen, or elsewhere, does not
mean ``game over'' when the internet offers a transnational base and
springboard for a variety of operations, including fundraising,
recruitment, planning, training, and even implementation and execution
of plots and plans.\13\ As I outlined in testimony before the Senate 5
years ago: ``Extremists value the internet so highly that some have
adopted the slogan `keyboard equals Kalashnikov'. Terrorist groups now
have their own media production arms (al-Qaeda relies on As-Sahab and
the Global Islamic Media Front, for example). Terrorists produce their
own television programs and stations, websites, chat rooms, on-line
forums, video games, videos, songs, and radio broadcasts.''\14\ Having
said that, and as I have indicated in further Senate testimony, this
one more than a decade ago: ``Bits, bytes, bugs, and gas will never
replace bullets and bombs as the terrorist weapon of choice.''\15\
---------------------------------------------------------------------------
\13\ The George Washington University Homeland Security Policy
Institute (HSPI) and the University of Virginia Critical Incident
Analysis Group (CIAG), NETworked Radicalization (Special Report: May
2007) http://www.gwumc.edu/hspi/policy/NETworkedRadicalization.pdf.
\14\ ``The Internet: A Portal to Violent Islamist Extremism'' (May
3, 2007) http://www.gwumc.edu/hspi/policy/testimony5.3.07_cilluffo.pdf.
\15\ ``Critical Infrastructure Protection: Who's In Charge''
(October 4, 2001) http://www.gwumc.edu/hspi/policy/
testimony10.4.01_cilluffo.pdf.
---------------------------------------------------------------------------
However, as kinetic measures (U.S. and allied) generate gains in
the real-world, this may lead al-Qaeda and its sympathizers to enter
even more deeply into the cyber domain. Indeed, al-Qaeda and their
jihadi ilk may be surfing in the wake of ``Anonymous'' and other such
groups, to learn from and perhaps also exploit their actions. The cyber
threat writ large is much broader and more multifaceted, though. It may
emanate from individual hackers, ``hacktivists,'' criminal or terrorist
groups, nation-states or those that they sponsor. Moreover, the threat
spectrum affects the public and private sectors, the interface and
intersections between them, as well as individual citizens. From a
homeland security perspective, foreign states are (by and large) our
principal concerns in the cyber domain, at least in terms of
sophistication; specifically those countries that pose an advanced and
persistent threat, namely Russia and China. Their tactics may also be
exploited by others.\16\ Furthermore, as laid out in my testimony to a
joint hearing of two subcommittees of this body in April 2012, the
government of Iran and its terrorist proxies are serious concerns in
the cyber context. What Iran may lack in capability, it makes up for in
intent; and our adversaries do not need highly sophisticated
capabilities--just intent and cash--as there exists an arms bazaar of
cyber weapons, allowing our adversaries to buy or rent the tools they
need or seek.\17\
---------------------------------------------------------------------------
\16\ Frank J. Cilluffo, ``The U.S. Response to Cybersecurity
Threats'' American Foreign Policy Council (AFPC) Defense Dossier
(August 2012) http://www.afpc.org/files/august2012.pdf; see also Office
of the National Counterintelligence Executive (NCIX), Foreign Spies
Stealing U.S. Economic Secrets in Cyber Space: Report to Congress on
Foreign Economic Collection and Industrial Espionage 2009-2011 (October
2011) http://www.ncix.gov/publications/reports/fecie_all/
Foreign_Economic_Collection_2011.pdf.
\17\ ``The Iranian Cyber Threat to the United States'' Statement
before the House of Representatives Committee on Homeland Security,
Subcommittees on Counterterrorism and Intelligence, and on
Cybersecurity, Infrastructure Protection, and Security Technologies
(April 26, 2012) http://www.gwumc.edu/hspi/policy/
Iran%20Cyber%20Testimony%204.26.12%20Frank%20- Cilluffo.pdf.
---------------------------------------------------------------------------
The cyber threat (and supporting technology) has markedly outpaced
our prevention and response efforts. Use of cyber means as a force
multiplier for kinetic activities, which would represent the
convergence of the physical and cyber worlds, constitutes probably the
area of greatest concern over the next 5 to 10 years. Foreign
militaries are increasingly integrating computer network attack (CNA)
and computer network exploitation (CNE) capabilities into their
warfighting, and military planning and doctrine.\18\ Such activity may
involve ``intelligence preparation of the battlefield,'' to include the
mapping of perceived adversaries' critical infrastructures. To my mind,
the line between this type of reconnaissance and an act of aggression
is very thin, turning only on the matter of intent. Foreign
intelligence services, too, are engaging in cyber espionage against us,
often combining technical and human intelligence in their exploits.
Here, everything from critical infrastructure to intellectual property
is potentially at risk. These exploits permit others to leapfrog many
bounds beyond their rightful place in the innovation cycle, by
profiting from (theft of) the research and development in which private
and public U.S. entities invested heavily. At worst, these exploits
hold the potential to significantly degrade our National defense and
National security, and thereby undermine the trust and confidence of
the American people in their Government.
---------------------------------------------------------------------------
\18\ Bryan Krekel, Patton Adams, and George Bakos, Occupying the
Information High Ground: Chinese Capabilities for Computer Network
Operations and Cyber Espionage, Prepared for the U.S.-China Economic
and Security Review Commission by Northrop Grumman Corporation (March
7, 2012) p. 54 http://www.uscc.gov/RFP/2012/USCC%20Report_Chinese_Capa-
bilitiesforComputer_NetworkOperationsandCyberEspionage.pdf.
---------------------------------------------------------------------------
New opportunities for resilience, generated by forces including
changing technologies, will assuredly present themselves. Indeed it is
this ability to reconstitute, recover, and get back on our feet is in
fact perhaps the best deterrent. The storms that battered the National
Capital Region this summer leaving close to a million people without
power during a week-long heat wave are instructive in terms of our
shortcomings on resilience. Mother Nature may be a formidable
adversary, but just imagine the level of damage and destruction that a
determined and creative enemy could have wrought. There is no lack of
trying, as a recently published DHS report makes clear, noting the
spike in attacks (from 9 incidents to 198) against U.S. critical
infrastructure from 2009 to 2011.\19\ The good news, on the other hand,
is that the most serious of these incidents could have been avoided
through the adoption of basic security steps and best practices. The
bad news, of course, is that these fundamental measures were not yet
put into place.
---------------------------------------------------------------------------
\19\ Suzanne Kelly ``Homeland security cites sharp rise in cyber
attacks'' CNN.com (July 4, 2012). http://security.blogs.cnn.com/2012/
07/04/homeland-security-cites-sharp-rise-in-cyber-attacks/.
---------------------------------------------------------------------------
dhs: a look back and ahead
Looking ahead, U.S. and allied counterterrorism efforts that
achieved localized successes must be woven into a larger, sustained,
and strategic effort; one that continues to apply targeted pressure to
deny adversaries the time and space to maneuver, including in
cyberspace. Since the threat now comes in various shapes, sizes, and
forms--ranging from al-Qaeda's Senior Leadership (Ayman al-Zawahiri and
his top deputies), to its principal franchises and affiliates, to
individuals inspired by (if not directly connected to) al-Qaeda's
ideology, which includes the ``home-grown'' threat--the U.S. response,
and that of DHS in turn, must be at once both sufficiently
comprehensive in scope and sufficiently nimble in approach to address
effectively the multi-dimensional threat landscape of today as well as
tomorrow.
Unfortunately our efforts to counter and defeat the jihadist
ideology have been lacking, with the result that the terrorist
narrative lives on, and continues to attract and inspire those who wish
us harm. A sustained, comprehensive, integrated, and effective effort
to combat violent Islamist extremism is, in my view, the biggest
element missing from U.S. statecraft on counterterrorism. Although the
Department of State's Center for Strategic Counterterrorism
Communications (CSCC) is doing some good work and represents a positive
development in this space, now is the time to double down, do more, and
hit back harder. The power of negative imagery, as in a political
campaign, could be harnessed to hurt our adversaries and further chip
away at their appeal and credibility in the eyes of peers, followers,
and sympathizers. A sustained and systemic strategic communications
effort aimed at exposing the hypocrisy of Islamists' words versus their
deeds, could knock them off balance, as could embarrassing their
leadership by bringing to light their seamy connections to criminal
enterprises and drug-trafficking organizations. The increasingly hybrid
nature of the threat presents additional opportunities in this last
regard, as drugs and arms trafficking are used to finance terrorism,
and so too kidnapping for ransom (think Abu Sayyaf and AQIM). Brokering
in-fighting between and among al-Qaeda, its affiliates, and the broader
jihadi orbit in which they reside, will damage violent Islamists'
capability to propagate their message and organize operations both at
home and abroad. Locally administered programs are especially
significant, as many of the solutions reside outside the U.S.
Government and will require communities policing themselves. In short,
we could and should do more to drive wedges and foment distrust
(including by exploiting points of conflict between local interests and
the larger global aims of AQ); encourage defectors; delegitimize and
disaggregate our adversaries' narrative; and above all, remember the
victims.\20\
---------------------------------------------------------------------------
\20\ Frank J. Cilluffo, ``The Future of Homeland Security: Evolving
and Emerging Threats'' Hearing Before the Senate Committee on Homeland
Security & Governmental Affairs (July 11, 2012) http://www.gwumc.edu/
hspi/policy/Testimony%20-%20SHSGAC%20Hearing%20-
%2011%20July%202012.pdf.
---------------------------------------------------------------------------
As the distinction between home and abroad increasingly blurs, due
in part to technologies and tools such as social media, it is important
to study and ultimately institutionalize counterterrorism lessons
learned elsewhere, including about tactics, techniques, and procedures.
In the aftermath of the ``26-11'' Mumbai attacks, for instance, the Los
Angeles, Las Vegas, and New York City Police Departments each sent a
team of experts to Mumbai. The objective was to meet with Indian
counterparts to learn about Mumbai's response model and then-existing
loopholes, which knowledge LAPD, LVPD, and NYPD could then apply to
their home cities, with an eye to closing gaps in their own
counterterrorism strategies and operations. More initiatives of this
kind are needed, as is the continuation of those that already exist
(such as police exchanges). Endeavors of this type are particularly
important in a resource-scarce environment, as they can help avoid the
need to reinvent the wheel.\21\
---------------------------------------------------------------------------
\21\ Cilluffo, ``U.S.-India Counterterrorism Cooperation.''
---------------------------------------------------------------------------
To obtain a truly ``rich picture'' of the threat in this country,
we must focus on the field--not the Beltway. As recent history shows,
the military and intelligence communities have come to just such a
field bias. For the counterterrorism community to do otherwise is to
risk stifling and stymieing the good work being done where the rubber
meets the road. State and local authorities can and should complement
what the Federal Government does not have the capacity or resources to
collect (or is simply not best-suited to do) in terms of intelligence;
and thereby help determine the scope and contours of threat domains in
the United States. Further leveraging our decentralized law enforcement
infrastructure could also serve to better power our Fusion Centers,
which should be given ample opportunity to flourish. The equivalent of
Commanders' Intent, which gives those in the field the leeway to do
what they need to do and which incorporates an honest ``hotwash'' after
the fact to determine what went wrong and how to fix that, is needed in
present civilian context for counterterrorism and intelligence
purposes. Moreover, opportunities still exist to tap and apply
intelligence and information from the field of organized crime to the
field of counterterrorism, and vice versa. Hybrid thinking that marries
up the two fields in this way, in order to further build our reservoir
of knowledge on the counterterrorism side could prove valuable.
Straightforward yet powerful steps remain to be taken. This was
revealed starkly in multiple rounds of survey work--first with the
major metropolitan intelligence chiefs and later with the fusion
centers--that the Homeland Security Policy Institute (HSPI) recently
completed in an attempt to bring a little science to the art of
intelligence. For example, too few Fusion Centers currently do threat
assessments. This is unacceptable, especially in a climate of limited
resources in which allocation decisions (regarding human, capital, and
financial resources) should be priority-ordered, meaning that scarce
resources should be directed to those counter-threat measures, gaps,
and shortfalls that constitute areas of greatest need. And Fusion
Center-specific threat assessments are just a start. Regional threat
assessments are also needed. Our adversaries do not respect local,
State, or even National boundaries hence our response posture must be
similarly nimble and cohesive. Yet according to HSPI survey research
published in June of this year, only 29% of Fusion Center respondents
reported that their Center conducted a regional threat assessment on at
least a yearly basis. Almost half reported that their Centers simply
did not conduct regional threat assessments. Furthermore, those working
in the Fusion Centers have yet to be invested with the analytical
skill-craft and training necessary for them to accomplish their
mission. Current incentive structures place too much emphasis on
information processing and not enough on analytical outcome. Greater
resources should be allocated to the professional development of those
working in the Centers. Within them lies untapped collection and
analysis potential. Realizing and unleashing that potential will
further bolster State and local law enforcement efforts, and help
develop anticipatory intelligence to prevent terrorist attacks and the
proliferation of criminal enterprise operations.\22\ In tandem, and
without taking anything away from the Fusion Centers, Joint Regional
Intelligence Groups (JRIGs) also have a role to play, including by
helping to place National threat information into State and local
context.
---------------------------------------------------------------------------
\22\ Frank J. Cilluffo, Joseph R. Clark, Michael P. Downing, and
Keith D. Squires ``Counterterrorism Intelligence: Fusion Center
Perspectives'' HSPI Counterterrorism Intelligence Survey Research
(CTISR) (June 2012). http://www.gwumc.edu/hspi/policy/
HSPI%20Counterterrorism- %20Intelligence%20-
%20Fusion%20Center%20Perspectives%206-26-12.pdf. See also Frank J.
Cilluffo, Joseph R. Clark, and Michael P. Downing ``Counterterrorism
Intelligence: Law Enforcement Perspectives'' CTISR (September 2011).
http://www.gwumc.edu/hspi/policy/HSPI%20Research%20Brief%20-
%20Counterterrorism%20Intelligence.pdf.
---------------------------------------------------------------------------
DHS continues to mature over time. However its capacities generally
still remain reactive in nature. As a result, the Department's internal
capabilities to assess future threats and then take actions are not yet
evolved to the level that the security ecosystem demands. This is a
significant shortfall, especially relative to the cyber domain where
threats may morph and metastasize in milliseconds. Volume and pace in
the cyber arena alone make for a serious challenge, including the
potential for damage to critical U.S. infrastructure such as water and
power systems, and telecommunications and finance. Since (as mentioned
above) cyber tools/attacks may also be leveraged, acting as a force
multiplier in connection with kinetic actions undertaken by our
adversaries, the ability to look over the horizon and think creatively,
including through the eyes of those of those who may bear hostile
intent towards this country, is to be prized. Yet DHS does not
currently have the built-in structural capacity to do so. Precisely
because the Department must be able to respond to a wide range of
threats that may materialize quickly, an Office of Net Assessment (ONA)
could and should be created.
The ONA would fill the much-needed role of brain trust, while
remaining unfettered by the ``crisis du jour'' or the day-to-day
demands flowing from intelligence needs and operations. The ever-
shifting and unpredictable security environment facing the United
States requires the constant questioning of assumptions, the asking of
what-ifs, and the thinking of the unthinkable, all in order to identify
game changers. The ONA should take a comprehensive, multi-disciplinary
approach to its analysis, looking at the full range of factors which
will alter and shape the security environment of the future, including
social, political, technological, economic, demographic, and other
trends. The duties of ONA should include studying existing threats in
order to project their evolution into the future; studying trends in
the weapons, technologies, modalities, and targets utilized by our
adversaries (i.e., the events that can transform the security
landscape); reviewing existing U.S. capabilities in order to identify
gaps between current capabilities and the requirements of tomorrow's
threats; conducting war games and red team scenarios to introduce
innovative thinking on possible future threats; assessing how terrorist
groups/cells could operate around, and/or marginalize the effectiveness
of, policies and protective measures. Admittedly, this is a tall order.
The alternative, however, is to walk into the future partly blind and
thus remain more vulnerable than we need to or should be.
This proposal is not new, I should add. To the contrary, it
appeared in the January 2007 Homeland Security Advisory Council Report
of the Future of Terrorism Task Force, for which I served as Vice
Chairman together with Chairman Lee Hamilton.\23\ Now is the time--
indeed it is well past time--to take this recommendation off the page
and enact it. Our adversaries are patient and they are long-term
thinkers whose horizons extend well beyond weeks and months. To help
counter them effectively, we must not lose sight of the long game
either. Indeed, the general qualities needed from an organizational
standpoint (U.S./DHS) mirror many of the traits that our adversaries
have exhibited over time. They are proactive, innovative, well-
networked, flexible, patient, young and enthusiastic, technologically
savvy, and learn and adapt continuously based upon both successful and
failed operations around the globe. We and our Government must be and
do likewise. Our institutions, both their structure and culture, must
be responsive to the ever-changing threat environment. This entails
much more than rearranging boxes on an organization chart. Together
with policy and technology, people are a crucial component of the
equation. Organizational change will not take root unless supported by
cultural change, which in turn takes time, leadership, and both
individual and community commitment. Many at DHS have worked long and
hard to bring about a cohesive and collaborative culture that drives
mission success; but we would do well to keep striving on that front,
if only because sustaining an end-state can be as difficult as arriving
at it in the first place.
---------------------------------------------------------------------------
\23\ http://www.dhs.gov/xlibrary/assets/hsac-future-terrorism-
010107.pdf.
---------------------------------------------------------------------------
The type of forward-leaning assessment and evaluation described
above could have a range of salutary knock-on effects, including the
possibility of better-calibrated budgeting, operational planning, and
acquisitions, through the provision of a foundation from which forward-
estimates may be derived. As things now stand, the Department still has
a ways to go in terms of aligning actions with future threats--although
the Quadrennial Homeland Security Review (QHSR), while less than
perfect, has served as a useful starting point. Still, as a mechanism
and process for helping to bring DHS resources and plans into sync with
the threat environment, the QHSR is not as forward-leaning as it could
or should be. The country would be better served by a more robust
posture and process, one that anticipates threats before they manifest,
and that allows the Secretary to determine what tools are needed for
meeting them, what force structure is needed (at the Federal, State,
and local levels), and what resources are needed from Congress to make
that plan a reality. Importantly, we do not yet have a true ``rich
picture'' of the domestic threat landscape because the National
Intelligence Estimate (NIE) does not fully elaborate upon that
dimension. This gap must be remedied, with State and local officials at
the heart of that exercise, because they are best-positioned to
undertake the task.
Cyber threats in particular manifest in nanoseconds, and we need to
be able to enact cyber response measures that are almost as quick. This
means developing and implementing an ``active defense'' capability to
immediately attribute and counter attacks and future threats in real-
time. Although much work remains to be done on the counterterrorism
side, the country has achieved significant progress in this area. In
contrast, the U.S. cybersecurity community's state of development is
akin to that of the counterterrorism community as it stood shortly
after 9/11. Despite multiple incidents that could have served as
galvanizing events to shore up U.S. resolve to formulate and implement
the changes that are needed, and not just within Government, we have
yet to take those necessary steps. Officials in the homeland security
community should therefore undertake contingency planning that
incorporates attacks on U.S. infrastructure. At minimum, ``red-
teaming'' and additional threat assessments are needed. The latter
should include modalities of attack and potential consequences. Working
together with DHS Intelligence and Analysis colleagues, the
Department's National Protection and Programs Directorate (NPPD) could
and should do more in terms of threat and intelligence reporting,
especially in relation to critical infrastructure, where DHS is well-
positioned to add real and unique value given the Department's
relationship with and responsibilities towards the private sector.
Consider the cyber-attacks on Saudi Aramco and Qatari RasGas this past
summer, which hit thousands of computers at these critical oil and gas
producers with a virus. As events unfolded, one would expect that
counterpart industries here in the United States would have welcomed
DHS products that directly assessed these events and kept U.S. owners
and operators abreast of latest developments, their broader
significance and potential follow-on implications.
The United States should also develop and clearly articulate a
cyber-deterrence strategy. Such a deterrence policy should apply
generally, and also in a tailored manner that is actor/adversary-
specific. A solid general posture could serve as an 80 percent
solution, neutralizing the majority of threats before they manifest
fully. This, in turn, would free up resources (human, capital,
technological, etc.) to focus our limited resources and bandwidth on
the high-end of the threat spectrum and on those which are most
sophisticated and persistent. To operationalize these recommendations,
we must draw lines in the sand. Preserving flexibility of U.S. response
by maintaining some measure of ambiguity is useful, so long as we make
parameters clear by laying down certain markers or selected redlines
whose breach will not be tolerated. More investment needs to be made in
our offensive capability as well, in order to support the foregoing
proposals in terms of practice and at the level of principle (to signal
a credible commitment). Cybersecurity by definition is transnational in
nature and will require some level of transnational solutions, yet it
must not be approached like an arms control treaty (i.e., attribution
and verification are still a ways away). Notably NPPD, which manages
the cyber-portfolio for DHS, has done some good work in the
international arena, including cyber-specific capacity-building efforts
and exercises, in multilateral settings and with bilateral partners.
However, as the Department's Inspector General noted in a report issued
just this month,\24\ DHS must continue to build on its Cybersecurity
Strategy of November 2011,\25\ such as by clearly delineating ``roles
and responsibilities'' for NPPD.\26\
---------------------------------------------------------------------------
\24\ DHS Office of Inspector General, DHS Can Strengthen Its
International Cybersecurity Programs (Redacted) (August 2012) http://
www.oig.dhs.gov/assets/Mgmt/2012/OIGr_12-112_Aug12.pdf.
\25\ Blueprint for a Secure Cyber Future: The Cybersecurity
Strategy for the Homeland Security Enterprise http://www.dhs.gov/
xlibrary/assets/nppd/blueprint-for-a-secure-cyber-future.pdf.
\26\ Mickey McCarter, ``NPPD Lacks Strategy To Guide International
Cybersecurity Efforts'' Homeland Security Today (September 4, 2012)
http://www.hstoday.us/
index.php?id=3392&no_cache=1&tx_ttnews%5Btt_news%5D=25801.
---------------------------------------------------------------------------
Plainly we have not yet made the requisite business case for the
private sector to undertake and implement needed cybsecurity measures.
This represents a fundamental problem, given that the majority of
critical infrastructure in this country is owned and operated by the
private sector. The urgency for making this case needs no further
explanation, but we must take care to strike just the right balance of
carrots--such as tax breaks, priority in Government contracting
opportunities, and indemnification of liability, allowing those who
have done what has been asked of them to avoid costly litigation--and
sticks; and of measures that ensure both privacy and security. To help
ensure compliance with standards and best practices, a ``Good
Housekeeping'' seal of approval could be granted to those who meet the
bar. To the extent that this encourages industry-wide adoption and
robust outcomes, such measure could spur the insurance and reinsurance
sectors to step into the fray. In addition, the Federal Government has
a responsibility to share threat information (i.e., signatures, hostile
plans and techniques to degrade, disrupt or destroy systems) that
places our critical infrastructures at risk. The pilot program
introduced within the confines of the defense industrial base offers a
solid starting point, and an example of a promising information-sharing
environment.\27\ It probably should go without saying, but part of
leading by example also entails the U.S. Government striving to place
its own house in order, as a crucial corollary to meeting the threat.
---------------------------------------------------------------------------
\27\ Frank J. Cilluffo and Andrew Robinson, ``While Congress
Dithers, Cyber Threats Grow Greater'' Nextgov.com (July 24, 2012)
http://www.nextgov.com/cybersecurity/2012/07/while-congress-dithers-
cyber-threats-grow-greater/56968/.
---------------------------------------------------------------------------
In conclusion, the challenges that lie on the horizon remain
substantial, but with the requisite will and leadership--to lean
forward and exhibit a field bias towards military, intelligence
community, and law enforcement experts on the front lines--the country
can and will continue to make progress towards meeting those
imperatives. Again, I wish to thank the Committee and its staff for the
opportunity to testify today, and I would be pleased to try to answer
any questions that you may have.
Chairman King. Thank you, Mr. Cilluffo.
Our final witness is Mr. David Maurer. He is a GAO director
in the Homeland Security and Justice Team, where he leads GAO's
work reviewing DHS and DOJ management issues. His recent work
in these areas includes DHS management integration, the
Quadrennial Homeland Security Review, Secret Service financial
management, DOJ grant management, Federal prison system, and an
assessment of technologies for detecting explosives in the
passenger rail environment.
Mr. Maurer has testified before this committee several
times and, surprisingly, he has agreed to come back again. So
we thank you very much for your testimony, and look forward to
it. Thank you for your service.
STATEMENT OF DAVID C. MAURER, DIRECTOR, HOMELAND SECURITY AND
JUSTICE, GOVERNMENT ACCOUNTABILITY OFFICE
Mr. Maurer. Great. Thank you very much. Good morning,
Chairman King, Ranking Member Thompson, other Members and
staff. I am pleased to be here today to talk about DHS's on-
going efforts to build a unified Department and position itself
for the future.
Since it began operations nearly a decade ago, DHS has made
significant strides. Today, it has almost $60 billion in budget
authority to carry out a wide variety of critical missions.
Fending off terrorist threats, securing the border,
safeguarding cyberspace, and providing disaster relief.
However, DHS has considerable work ahead to address
weaknesses in its current operations and management that hinder
the Department's ability to achieve its full potential. As a
result, DHS remains on our high-risk list. My main message
today is this. At the root of many of the Department's problems
is a fundamental cross-cutting and significant challenge;
namely, DHS needs to do a better job managing its resources.
Specifically, DHS needs a strong, unified management
foundation that enables its components to execute their vital
missions. DHS also needs to ensure that increasingly scarce
resources are strategically managed and aligned with risk-based
priorities. Making tough, informed resource decisions is
important because DHS will never have enough people, money, and
systems to fully address every threat.
DHS has a lot of work ahead to achieve these goals. Two
years ago, to help DHS with that task we identified 31 actions
and outcomes that are critical to addressing the Department's
challenges. DHS agreed to achieve these outcomes, and has taken
actions to do so. But DHS isn't there yet.
It currently lacks vital management capabilities to
integrate the Department into something greater than the sum of
its parts. For example, nearly every major DHS acquisition
program has experienced funding instability, workforce
shortfalls, and/or changes to their planned capabilities. DHS
morale scores consistently among the lowest in the Federal
Government.
DHS has twice attempted, and failed, to build an integrated
Department-wide financial management system. The Department has
also struggled to achieve strategic visibility over how it
allocates its resources. For example, Congress has appropriated
nearly $40 billion for DHS grant programs, however DHS has
limited visibility over how these funds are used, does not
effectively coordinate across its various programs, and lacks
mechanisms for assessing grant effectiveness.
DHS also does not know how much it spends on research and
development activities, and lacks policies to define and
coordinate R&D across the Department. DHS says it plans to
spend $167 billion on major acquisition programs in the coming
years. But that is, at best, an educated guess.
Most programs lack validated cost estimates, and DHS is
still in the early stages of grappling with strategically
managing these programs as a portfolio rather than on an
individual basis. In recent years, DHS has worked hard to fix
problems like these, and has achieved some key successes. For
example, DHS obtained a qualified audit opinion on its balance
sheet for the first time since its operation last year.
It has significantly lowered its senior leadership vacancy
rates. It has developed a promising new approach for reviewing
its IT investments. We have also seen substantial senior-level
support for a series of plans to help ensure that DHS's
missions are supported by a sound management infrastructure.
In particular, the Department's June 2012 strategy for
addressing its high-risk designation is a good road map for
taking DHS to where it wants to be. Looking ahead, DHS needs to
show continued progress executing this ambitious agenda. Now, I
know that ``management'' is not the most exciting word in the
world, but it is vital.
In fact, management is the glue that holds DHS together,
the daily missions of the various DHS components, and the
threats that they address very widely. To ensure the Department
works as one, DHS needs a clear common vision, a unified
management structure, and the ability to make tough, risk-based
resource decisions to ensure that strategies drive budgets and
not the other way around.
DHS has made important strides achieving these goals, but
the Department still has a great deal of work ahead. Improving
how it manages its resources will help DHS carry out its vital
missions and help secure the homeland.
Mr. Chairman, thank you for the opportunity to testify this
morning. I look forward to your questions.
[The prepared statement of Mr. Maurer follows:]
Prepared Statement of David C. Maurer
September 20, 2012
department of homeland security.--continued progress made improving and
integrating management areas, but more work remains
gao-12-1041t
Chairman King, Ranking Member Thompson, and Members of the
committee: I am pleased to be here today to discuss the Department of
Homeland Security's (DHS) efforts to strengthen and integrate its
management functions. DHS now has more than 200,000 employees and an
annual budget of almost $60 billion, and its transformation is critical
to achieving its homeland security and other missions. Since 2003, GAO
has designated the implementation and transformation of DHS as high-
risk because DHS had to combine 22 agencies--several with major
management challenges--into one Department, and failure to effectively
address DHS's management and mission risks could have serious
consequences for our National and economic security.\1\ This high-risk
area includes challenges in strengthening DHS's management functions--
financial management, acquisition management, human capital, and
information technology (IT)--the effect of those challenges on DHS's
mission implementation, and challenges in integrating management
functions within and across the Department and its components.
---------------------------------------------------------------------------
\1\ GAO, High-Risk Series: An Update, GAO-03-119 (Washington, DC:
January 2003); GAO, High-Risk Series: An Update, GAO-09-271
(Washington, DC: January 2009); High-Risk Series: An Update, GAO-07-310
(Washington, DC: January 2007); and High-Risk Series: An Update, GAO-
05-207 (Washington, DC: January 2005).
---------------------------------------------------------------------------
In November 2000, we published our criteria for removing areas from
the high-risk list.\2\ Specifically, agencies must have: (1) A
demonstrated strong commitment and top leadership support to address
the risks; (2) the capacity (that is, the people and other resources)
to resolve the risks; (3) a corrective action plan that identifies the
root causes, identifies effective solutions, and provides for
substantially completing corrective measures in the near term,
including but not limited to steps necessary to implement solutions we
recommended; (4) a program instituted to monitor and independently
validate the effectiveness and sustainability of corrective measures;
and (5) the ability to demonstrate progress in implementing corrective
measures.
---------------------------------------------------------------------------
\2\ GAO, Determining Performance and Accountability Challenges and
High Risks, GAO-01-159SP (Washington, DC: November 2000).
---------------------------------------------------------------------------
On the basis of our prior work, in a September 2010 letter to DHS,
we identified, and DHS agreed to achieve, 31 actions and outcomes that
are critical to addressing the challenges within the Department's
management areas and in integrating those functions across the
Department to address the high-risk designation.\3\ These key actions
and outcomes include, among others, obtaining and then sustaining
unqualified audit opinions for at least 2 consecutive years on the
Department-wide financial statements; validating required acquisition
documents in accordance with a Department-approved, knowledge-based
acquisition process; and demonstrating measurable progress in
implementing its IT human capital plan and accomplishing defined
outcomes.\4\ In January 2011, DHS issued its initial Integrated
Strategy for High-Risk Management, which included key management
initiatives (e.g., financial management controls, IT program
governance, and procurement staffing model) to address challenges and
the outcomes we identified for each management area. DHS provided
updates of its progress in implementing these initiatives in later
versions of the strategy--June 2011, December 2011, and June 2012.
Achieving and sustaining progress in these management areas would
demonstrate the Department's ability and on-going commitment to
addressing our five criteria for removing issues from the high-risk
list.
---------------------------------------------------------------------------
\3\ See appendix I for a summary of the 31 actions and outcomes.
\4\ An unqualified opinion states that the audited financial
statements present fairly, in all material respects, the financial
position, results of operations, and cash flows of the entity in
conformity with generally accepted accounting principles.
---------------------------------------------------------------------------
My testimony this morning, as requested, will discuss our
observations, based on prior and on-going work, on DHS's progress in
achieving outcomes critical to addressing its high-risk designation for
the implementation and transformation of the Department.
This statement is based on prior reports and testimonies we issued
from June 2007 through September 2012 and letters we submitted to DHS
in March and November 2011 providing feedback on the Department's
January and June 2011 versions of its Integrated Strategy for High-Risk
Management.\5\ For the past products, among other methodologies, we
interviewed DHS officials; analyzed DHS strategies and other documents
related to the Department's implementation and transformation high-risk
area; and reviewed our past reports, issued since DHS began its
operations in March 2003. All of this work was conducted in accordance
with generally accepted Government auditing standards; more-detailed
information on the scope and methodology from our prior work can be
found within each specific report. This statement is also based on
observations from our on-going work related to DHS IT investments.\6\
For this work, we analyzed recent cost and schedule performance for
DHS's major IT investments as reported to the Office of Management and
Budget as of March 2012. We will report on the final results of this
review later this month. We are conducting this work in accordance with
generally accepted Government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions
based on our audit objectives.
---------------------------------------------------------------------------
\5\ See the related products list at the end of this statement.
\6\ This review is being conducted at the request of this
Committee's Subcommittee on Oversight, Investigations, and Management;
and Senator Thomas Carper, Chairman, Subcommittee on Federal Financial
Management, Government Information, Federal Services and International
Security of the Senate Committee on Homeland Security and Governmental
Affairs.
---------------------------------------------------------------------------
dhs has made progress in addressing its management challenges, but has
significant work ahead to achieve high-risk outcomes
Since we designated the implementation and transformation of DHS as
high-risk in 2003, DHS has made progress addressing management
challenges and senior Department officials have demonstrated commitment
and top leadership support for addressing the Department's management
challenges. However, the Department has significant work ahead to
achieve positive outcomes in resolving high-risk issues. For example,
DHS faces challenges in modernizing its financial systems, implementing
acquisition management controls, and improving employee satisfaction
survey results, among other things. As DHS continues to mature as an
organization, it will be important for the Department to continue to
strengthen its management functions, since the effectiveness of these
functions affects its ability to fulfill its homeland security and
other missions.
Financial management.--DHS has made progress in addressing its
financial management and internal controls weaknesses, but has been
unable to obtain an unqualified audit opinion on its financial
statements since the Department's creation and faces challenges in
modernizing its financial management systems. DHS has, among other
things,
reduced the number of material weaknesses in internal
controls from 18 in 2003 to 5 in fiscal year 2011;\7\
---------------------------------------------------------------------------
\7\ A material weakness is a significant deficiency, or a
combination of significant deficiencies, in internal control such that
there is a reasonable possibility that a material misstatement of the
entity's financial statements will not be prevented or detected and
corrected on a timely basis. A significant deficiency is a deficiency,
or combination of deficiencies, in internal control that is less severe
than a material weakness, yet important enough to merit attention by
those charged with governance. A deficiency in internal control exists
when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions,
to prevent, or detect and correct, misstatements on a timely basis.
---------------------------------------------------------------------------
achieved its goal of receiving a qualified audit opinion on
its fiscal year 2011 consolidated balance sheet and statement
of custodial activity for the first time since the Department's
creation;\8\
---------------------------------------------------------------------------
\8\ A qualified opinion states that, except for the effects of the
matter(s) to which the qualification relates, the audited financial
statements present fairly, in all material respects, the financial
position, results of operations, and cash flows of the entity in
conformity with generally accepted accounting principles. The matter(s)
to which the qualification relates could be due to a scope limitation,
or the audited financial statements containing a material departure
from generally accepted accounting principles, or both.
---------------------------------------------------------------------------
established a goal of obtaining an audit opinion on all of
its fiscal year 2012 financial statements; and
expanded the scope of the annual financial audit to the
complete set of fiscal year 2012 financial statements, which
DHS believes will help it to obtain an unqualified opinion for
fiscal year 2013.\9\
---------------------------------------------------------------------------
\9\ DHS's complete set of financial statements consist of the
Balance Sheet, Statement of Net Cost, Statement of Changes in Net
Position, Statement of Budgetary Resources, and Statement of Custodial
Activity.
---------------------------------------------------------------------------
However, DHS continues to face challenges in financial management.
For example, DHS anticipates difficulties in providing its auditors
transaction-level detail to support balances reported in its fiscal
year 2012 financial statements in order to obtain an opinion on its
financial statements. This is due to, among other things, components
not retaining original acquisition documentation or enforcing policies
related to recording purchases and making payments. DHS also
anticipates its auditors issuing a disclaimer in their fiscal year 2012
report on internal controls over financial reporting due to material
weaknesses in internal controls, such as lack of effective controls
over the recording of financial transactions related to property,
plant, and equipment.
In addition, in December 2011, DHS reported that the Federal
Emergency Management Agency (FEMA), U.S. Coast Guard (USCG), and U.S.
Immigration and Customs Enforcement (ICE) have an essential business
need to replace their financial management systems, but DHS has not
fully developed its plans for upgrading existing or implementing new
financial systems at these agencies. According to DHS's June 2012
version of its Integrated Strategy for High-Risk Management, the
Department plans to extend the useful life of FEMA's current system by
about 3 years, while FEMA proceeds with a new financial management
system solution, and is in the process of identifying the specific
approach, necessary resources, and time frames for upgrading existing
or implementing new financial systems at USCG and ICE. Without sound
processes, controls, and systems, DHS faces long-term challenges in
obtaining and sustaining an unqualified opinion on both its financial
statements and internal controls over financial reporting, and ensuring
its financial management systems generate reliable, useful, timely
information for day-to-day decision-making. We currently have on-going
work related to DHS's efforts to improve its financial reporting that
we expect to report on in the spring of 2013.\10\
---------------------------------------------------------------------------
\10\ We are doing this work at the request of the Subcommittee on
Federal Financial Management, Government Information, Federal Services
and International Security of the Senate Committee on Homeland Security
and Governmental Affairs.
---------------------------------------------------------------------------
Acquisition management.--DHS has made progress in the acquisition
management area by enhancing the Department's ability to oversee major
acquisition programs. For example:
DHS has established eight Centers of Excellence for cost
estimating, systems engineering, and other disciplines to bring
together program managers, senior leadership staff, and subject
matter experts to promote best practices, provide expert
counsel, technical guidance, and acquisition management tools;
and each DHS component has established a Component Acquisition
Executive (CAE) to provide oversight and support to programs
within the component's portfolio.
According to DHS, as of June 2012, 75 percent of the core CAE
support positions were filled.
In March 2012, DHS completed the development of a
Procurement Staffing Model to determine optimal numbers of
personnel to properly award and administer contracts. In June
2012, DHS reported that it is taking steps to implement the
staffing model throughout headquarters and the components.
DHS included a new initiative (strategic sourcing) in its
December 2011 Integrated Strategy for High-Risk Management to
increase savings and improve acquisition efficiency by
consolidating contracts Department-wide for the same kinds of
products and services. The Office of Management and Budget's
Office of Federal Procurement Policy has cited DHS's efforts
among best practices for implementing Federal strategic
sourcing initiatives. Earlier this month, we reported that the
Department has implemented 42 strategically-sourced efforts
since the Department's inception.\11\ According to DHS data,
the Department's spending through strategic sourcing contract
vehicles has increased steadily from $1.8 billion in fiscal
year 2008 to almost $3 billion in fiscal year 2011,
representing about 20 percent of DHS's procurement spending for
that year.
---------------------------------------------------------------------------
\11\ GAO, Homeland Security: DHS Has Enhanced Procurement Oversight
Efforts, but Needs to Update Guidance, GAO-12-947 (Washington, DC:
Sept. 10, 2012).
---------------------------------------------------------------------------
However, DHS continues to face significant challenges in managing
its acquisitions. For example:
Earlier this week, we reported that 68 of the 71 program
offices we surveyed from January through March 2012 responded
that they experienced funding instability, workforce
shortfalls, and/or changes to their planned capabilities over
the programs' duration.\12\ We have previously reported that
these challenges increase the likelihood acquisition programs
will cost more and take longer to deliver capabilities than
expected.\13\
---------------------------------------------------------------------------
\12\ GAO, Homeland Security: DHS Requires More Disciplined
Investment Management to Help Meet Mission Needs, GAO-12-833
(Washington, DC: Sept. 18, 2012).
\13\ GAO, Department of Homeland Security: Assessments of Complex
Acquisitions, GAO-10-588SP (Washington, DC: June 30, 2010).
---------------------------------------------------------------------------
Our recent review of DHS acquisition management also
identified that while DHS's acquisition policy reflects many
key program management practices that could help mitigate risks
and increase the chances for successful outcomes, it does not
fully reflect several key portfolio management practices, such
as allocating resources strategically.\14\ DHS plans to develop
stronger portfolio management policies and processes, but until
it does so, DHS programs are more likely to experience
additional funding instability, which will increase the risk of
further cost growth and schedule slips. We recommended that DHS
take a number of actions to help mitigate the risk of poor
acquisition outcomes and strengthen the Department's investment
management activities. DHS concurred with all of our
recommendations and noted actions it had taken or planned to
address them.
---------------------------------------------------------------------------
\14\ GAO-12-833.
---------------------------------------------------------------------------
Human capital management.--DHS has taken a number of actions to
strengthen its human capital management. For example:
DHS issued human capital-related plans, guidance, and tools
to address its human capital challenges, including a Workforce
Strategy for 2011-2016; a revised Workforce Planning Guide,
issued in March 2011, to help the Department plan for its
workforce needs; and a Balanced Workforce Strategy tool, which
some components have begun using to help achieve the
appropriate mix of Federal and contractor skills.
The Department implemented two programs to address senior
leadership recruitment and hiring, as we reported in February
2012.\15\ While DHS's senior leadership vacancy rate was as
high as 25 percent in fiscal year 2006, it varied between 2006
and 2011 and declined overall to 10 percent at the end of
fiscal year 2011.\16\
---------------------------------------------------------------------------
\15\ GAO, DHS Human Capital: Senior Leadership Vacancy Rates
Generally Declined, but Components' Rates Varied, GAO-12-264
(Washington, DC: Feb. 10, 2012).
\16\ GAO-12-264.
---------------------------------------------------------------------------
DHS developed outreach plans to appeal to veterans and other
underrepresented groups.
While these initiatives are promising, DHS continues to face
challenges in human capital management. For example:
As we reported in March 2012, based on our preliminary
observations of DHS's efforts to improve employee morale,
Federal surveys have consistently found that DHS employees are
less satisfied with their jobs than the Government-wide
average.\17\ DHS has taken steps to identify where it has the
most significant employee satisfaction problems and developed
plans to address those problems, such as establishing a
Department-wide Employee Engagement Executive Steering
Committee, but has not yet improved employee satisfaction
survey results. We plan to issue a final report on our findings
later this month.\18\
---------------------------------------------------------------------------
\17\ GAO, Department of Homeland Security: Preliminary Observations
on DHS's Efforts to Improve Employee Morale. GAO-12-509T (Washington,
DC: Mar. 22, 2012).
\18\ We are doing this work at the request of this Committee's
Subcommittee on Oversight, Investigations, and Management; and Senator
Susan Collins, Ranking Member of the Senate Committee on Homeland
Security and Governmental Affairs.
---------------------------------------------------------------------------
As we reported in April 2012, changes in FEMA's workforce,
workload, and composition have created challenges in FEMA's
ability to meet the agency's varied responsibilities and train
its staff appropriately.\19\ For example, FEMA has not
developed processes to systematically collect and analyze
agency-wide workforce and training data that could be used to
better inform its decision making. We recommended that FEMA,
among other things, identify long-term quantifiable mission-
critical goals, establish lines of authority for agency-wide
workforce planning and training efforts, and develop systematic
processes to collect and analyze workforce and training data.
DHS concurred with our recommendations and reported actions
underway to address them.
---------------------------------------------------------------------------
\19\ GAO, Federal Emergency Management Agency: Workforce Planning
and Training Could Be Enhanced by Incorporating Strategic Management
Principles, GAO-12-487 (Washington, DC: Apr. 26, 2012).
---------------------------------------------------------------------------
Information technology management.--DHS has made progress in
strengthening its IT management, but the Department has much more work
to do to fully address its IT management weaknesses. Among other
accomplishments, DHS has:
strengthened its enterprise architecture;\20\
---------------------------------------------------------------------------
\20\ An enterprise architecture can be viewed as a blueprint for
organizational transformation and IT modernization.
---------------------------------------------------------------------------
defined and begun to implement a vision for a tiered
governance structure intended to improve program and portfolio
management, as we reported in July 2012;\21\ and
---------------------------------------------------------------------------
\21\ GAO, Information Technology: DHS Needs to Further Define and
Implement Its New Governance Process, GAO-12-818 (Washington, DC: July
25, 2012).
---------------------------------------------------------------------------
established a formal IT Program Management Development Track
and staffed Centers of Excellence with subject matter experts
to assist major and non-major programs.
Based on preliminary observations from our review of DHS's major
at-risk IT acquisitions we are performing for the committee, these
improvements may be having a positive effect. Specifically, as of March
2012, approximately two-thirds of the Department's major IT investments
we reviewed (47 of 68) were meeting current cost and schedule
commitments (i.e. goals).
DHS has made progress, but the Department has much more work to do
to fully address its IT management weaknesses. For example, the
Department needs to:
finalize the policies and procedures associated with its new
tiered governance structure and continue to implement this
structure, as we recommended in our July 2012 report;\22\
---------------------------------------------------------------------------
\22\ GAO-12-818.
---------------------------------------------------------------------------
continue to implement its IT human capital plan, which DHS
believed would take 18 months to fully implement as of June
2012; and
continue its efforts to enhance IT security by, among other
things, effectively addressing material weaknesses in financial
systems security, developing a plan to track and promptly
respond to known vulnerabilities, and implementing key security
controls and activities.
Management integration.--DHS has made progress in integrating its
individual management functions across the Department and its component
agencies. For example, DHS has put into place common policies,
procedures, and systems within individual management functions, such as
human capital, that help to integrate its component agencies, as we
reported in September 2011.\23\ To strengthen this effort, in May 2012,
the Secretary of Homeland Security modified the delegations of
authority between the Management Directorate and their counterparts at
the component level. According to DHS, this action will provide
increased standardization of operating guidelines, policies,
structures, and oversight of programs. Additionally, DHS has taken
steps to standardize key data elements for the management areas across
the Department to enhance its decision making. For example, in April
2012, the under secretary for management appointed an executive
steering committee and tasked this committee with creating a ``Data
Mart'' to integrate data from disparate sources and allow the
dissemination of timely and reliable information by March 2013.
Further, consistent with our prior recommendations, DHS has implemented
mechanisms to promote accountability for management integration among
Department and component management chiefs by, among other things,
having the Department chiefs develop written objectives that explicitly
reflect priorities and milestones for that management function.\24\
---------------------------------------------------------------------------
\23\ GAO, Department of Homeland Security: Progress Made and Work
Remaining in Implementing Homeland Security Missions 10 Years after 9/
11, GAO-11-881 (Washington, DC: Sept. 7, 2011).
\24\ GAO, Department of Homeland Security: Actions Taken Toward
Management Integration, but a Comprehensive Strategy Is Still Needed,
GAO-10-131 (Washington, DC: Nov. 20, 2009).
---------------------------------------------------------------------------
Although these actions are important, DHS needs to continue to
demonstrate sustainable progress in integrating its management
functions within and across the Department and its components and take
additional actions to further and more effectively integrate the
Department. For example, DHS recognizes the need to better integrate
its lines of business. The Integrated Investment Life Cycle Model
(IILCM), which the Department is establishing to manage investments
across the Department's components and management functions, is an
attempt at doing that. DHS identified the IILCM as one of its most
significant management integration initiatives in January 2011.
However, the June 2012 update reported that this initiative is in its
early planning stages, will be phased in over multiple budget cycles,
and requires additional resources to fully operationalize. In September
2012, DHS reported that it has developed draft policy and procedural
guidance to support implementation of the IILCM and now plans to begin
using aspects of this new approach to develop portions of the
Department's fiscal years 2015 through 2019 budget.
DHS strategy for addressing GAO's high-risk designation.--In
January 2011, DHS issued an agency-wide management integration
strategy--the Integrated Strategy for High-Risk Management--as we
recommended in our March 2005 report on DHS's management integration
efforts.\25\ DHS's most recent version of the strategy, issued in June
2012, greatly improved upon prior versions and addressed feedback we
previously provided by, for example, identifying key measures and
progress ratings for the 18 initiatives included in the strategy and
the 31 outcomes.\26\ We believe the June 2012 strategy, if implemented
and sustained, provides a path for DHS to address our high-risk
designation.
---------------------------------------------------------------------------
\25\ GAO, Department of Homeland Security: A Comprehensive and
Sustained Approach Needed to Achieve Management Integration, GAO-05-139
(Washington, DC: Mar. 16, 2005).
\26\ GAO-10-131.
---------------------------------------------------------------------------
DHS can further strengthen or clarify its Integrated Strategy for
High-Risk Management to better enable DHS, Congress, and GAO to assess
the Department's progress in implementing its management initiatives
by, among other things: Determining the resource needs for all of the
corrective actions in the strategy; communicating to senior leadership
critical resource gaps across all initiatives; and identifying program
and project risks in a supporting risk mitigation plan for all
initiatives.
Going forward, DHS needs to continue implementing its Integrated
Strategy for High-Risk Management and show measurable, sustainable
progress in implementing its key management initiatives and corrective
actions and achieving outcomes. We will continue to monitor, assess,
and provide feedback on DHS's implementation and transformation efforts
through our on-going and planned work, including the 2013 high-risk
update that we expect to issue in January 2013.
Chairman King, Ranking Member Thompson, and Members of the
committee, this concludes my prepared statement. I would be pleased to
respond to any questions that you may have.
Appendix I: Summary of Actions and Outcomes for Addressing the
Implementing and Transforming the Department of Homeland Security High-
Risk Area
On the basis of our prior work, in a September 2010 letter to the
Department of Homeland Security (DHS), we identified 31 actions and
outcomes that are critical to addressing the challenges within the
Department's management areas and in integrating those functions across
the Department, thus addressing the high-risk designation. This
appendix provides a summary of the 31 actions and outcomes.
financial management
1. Maintain top management commitment to correcting weaknesses.
2. Address internal control, business process, and systems
weaknesses.
3. Commit sufficient resources to implement financial system
modernization and complete a full-scope audit of the
Department's basic financial statements.
4. Expand scope of financial statement audit to include an opinion
on all of the Department's basic financial statements.
5. Sustain clean opinions for at least 2 consecutive years.
6. Comply with the Federal Financial Management Improvement Act of
1996.
7. Embrace best practices for financial system modernization.
8. Establish contractor oversight mechanisms for financial system
modernization.
9. Successfully implement new or upgrade existing financial systems
as needed throughout the Department, including the U.S. Coast
Guard (USCG), Federal Emergency Management Agency (FEMA), and
U.S. Immigration and Customs Enforcement (ICE).
acquisition management
1. Validate required acquisition documents in a timely manner at
major milestones, including life-cycle cost estimates, in
accordance with a Department-approved, knowledge-based
acquisition process.
2. Improve component acquisition capability.
3. Establish a Joint Requirements Council or a similar body.
4. Ensure a sufficient number of trained acquisition personnel are
in place at the Department and component levels.
5. Establish and demonstrate measurable progress in achieving goals
that improve programs' compliance with the Department's
established processes and policies. For major acquisitions,
demonstrate that actual cost and schedule performance are
within baseline thresholds.
human capital management
1. Implement a human capital strategic plan.
2. Link workforce planning to other Department planning efforts.
3. Enhance recruiting to meet current and long-term needs.
4. Base human capital decisions on competencies and performance.
5. Seek employees' input to strengthen human capital approaches and
activities.
6. Improve scores on the Office of Personnel Management's Federal
Employee Viewpoint Survey.
7. Assess and improve training, education, and development
programs.
information technology management
1. Demonstrate achievement of stage 4 of GAO's Enterprise
Architecture Management Maturity Framework (that is, completing
and using an enterprise architecture for targeted results).
2. Establish and implement information technology (IT) investment
management best practices.
3. Establish and implement IT system acquisition management
processes.
4. Show progress in implementing the IT strategic human capital
plan.
5. Demonstrate for at least two consecutive investment increments
that cost and schedule performance is within the established
threshold baseline for major investments.
6. Enhance the security of internal IT systems and networks.
management integration
1. Implement actions and outcomes in each management area.
2. Revise management integration strategy to address
characteristics we previously recommended, such as set
implementation goals and a time line to monitor progress.
3. Establish performance measures to assess progress made in
achieving Department-wide management integration.
4. Promote accountability for management integration among
Department and management chiefs through the performance
management system.
Chairman King. Thank you, Mr. Maurer.
Now I will recognize myself for questions. I would ask this
question of each of you. Mr. Baker gave the Department an A as
far as thinking seriously about keeping terrorists out. I would
like to ask each of you, though, how effective do you think DHS
has been in making itself part of the counterterrorism
community, the intelligence community, and receiving the
cooperation from the other big players?
What appeared to be my personal experience at the time, at
least anecdotally, they were not getting the respect early on.
They were considered, you know, the new kids on the block. Has
that improved, and how well-integrated are they into a cohesive
counterterrorism system?
Mr. Skinner.
Mr. Skinner. I do agree that early on they did not get the
respect that they should have. At the time I left, I think they
were still facing challenges with bringing something to the
table, so to speak, in the intelligence community. A lot of
this dealt with the simple issues of trust. Other issues were
just the mere nature of what they were bringing to the table.
It was historic data. It wasn't something, a strategic
dialogue, as to where the challenges were. I think someone hit
on this earlier today. That we need to do a better job of
actually stepping back and thinking the what-ifs that can occur
in this country. Also the things that we can be doing better
with regard to infrastructure.
So in my assessment, I think we have a very, very long way
to go yet in the intelligence community as far as being a major
player, at least at the time I left about 18 months ago.
Chairman King. Thank you.
Secretary Baker.
Mr. Baker. Well, I used to say that--at the beginning of
DHS, your assessment is quite correct. I once described hiring
Charlie Allen as the equivalent of the Mets hiring Casey
Stengel. It gave us more credibility than we had before, but we
still have a long way to go.
DHS is an unusual participant in the intelligence
community. There are a lot of participants who are basically
takers of intelligence and analysts of the intelligence that
they get. Then there are some very big producers of
intelligence. DHS is neither of those things. It does analyze
intelligence, and it does produce intelligence of a sort.
Particularly travel data.
That has proven to be increasingly useful. So my sense is
that, indeed, there is a little bit of tension between them and
NCTC over who is in charge of gathering and using this data.
You know, if you have turf tension that suggests you are
contributing something that somebody else would like to be
contributing.
So I think they have moved forward substantially. One area
they are not yet maximizing their opportunities in is cyber,
where we know a lot about the attackers. We learn that by using
law enforcement authorities. DHS has all these law enforcement
investigators, Secret Service and ICE, that should be carrying
out law enforcement investigations strategically to learn more
about our attackers and then embarrass them as dramatically as
possible.
My sense is that the law enforcement guys are all overdoing
their investigations without a lot of coordination and a lot of
strategy from NPPD and the cyber operations. We could
contribute more if we were a little more strategic about how we
used our law enforcement resources.
Chairman King. Thank you.
Mr. Cilluffo.
Mr. Cilluffo. Clearly, intelligence is the lifeblood for
our campaign against terrorism in all facets. I would argue
that I probably take a less positive view in terms of where the
Department is writ large. First, I don't think we have the
equivalent. We all know National intelligence estimates in
terms of racking and stacking capabilities of our adversaries
overseas.
We have intelligence estimates that look at threats to the
homeland. But what do we have where you have a legitimate home-
grown threat? The foreign-domestic divide is blurring today.
Social technology and everything else makes it very difficult.
The word over here has an effect over there, and vice versa.
So I would argue the emphasis should be pushing out our
capabilities to support and enable our fusion centers on the
front lines. State and local law enforcement is ultimately best
positioned and, in many cases, most competent to deal with
these issues.
The joint regional intelligence groups that the FBI is
standing up, we have got to find ways to make sure that all
these pieces can, in fact, come together. To take National
data, to put it into local context. Ultimately, that is
translating that data for our State and local authorities who
are best positioned to address these issues.
On the cyber side, we have a long ways to go. I mean, if
you look back since 9/11, I would argue the greatest
breakthroughs which no one is really talking about in our
counterterrorism efforts have been the synchronization of
Titles 10 and Title 50; basically, where the intelligence
community meets the defense establishment.
Cyber. This is an area where we clearly need to look at
some of those same synchronizations of authorities and
capabilities. Doesn't exist at the State and local. Then when
you start looking at the homeland, in particular, I think
Stewart captured it. NSA has got the capability, DHS has the
authority. NSA doesn't have many of the authorities, and DHS
doesn't have many of the capabilities.
How do we start bridging that gap in a way that is true to
who we are as a country from a privacy perspective? I think
that is the big issue we are all struggling with right now.
Chairman King. Thank you.
Mr. Maurer.
Mr. Maurer. Yes. Mr. Chairman, I mean obviously, over the
course of the last decade there have been a number of
substantial changes in the overall structure of the
intelligence community. I mean, sort of operating in parallel
with a stand-up in operation of DHS was the creation of the
NCTC, the standing up of OD&I, the fundamental restructuring
and refocus of the FBI.
All these things were happening simultaneously. DHS is
clearly at the table as part of this on-going effort. I
wouldn't characterize them as playing their leading role. In
some respects, appropriately so. FBI is late on some things,
for example. We issued a report earlier this morning looking at
DHS's central efforts to improve information sharing of
terrorist-related information.
What we found there was encouraging. We think that DHS is
on a good path on that front. They have shown good leadership.
We are concerned about their lack of metrics to be able to
establish whether or not they are making progress towards their
goals. But we think they are off to a good start in that
respect.
So we will be certainly watching that area, as well. That
is another one of our high-risk issues, and DHS is one of 5
main agencies that play in that realm.
Chairman King. Thank you.
My time has expired. I would ask you if you could get back
to me in writing. I have two quick questions. No. 1: How
significant is it that the Saint Elizabeths project has been
pushed back? How important is it for the Department to have,
you know, one coherent central location?
Second: Is there any way that the progress of DHS could be
compared to the growth of the Defense Department after World
War II? Are they on the same path?
With that, I yield to the gentleman. If you can get back to
me in 30 days, in writing, I would appreciate it.
The gentleman from Mississippi.
Mr. Thompson. Thank you very much, Mr. Chairman.
Some will argue that the direction of this Department
mirrors the direction it receives. Part of that direction comes
from Congress. I have shared with you my concern about
jurisdiction. But since we have four very qualified individuals
to talk about the subject of jurisdiction and the Department,
can you just share individually whether or not you believe it
is a good thing for Congress to vest jurisdiction for DHS
within one committee like a number of other departments have?
Agriculture, just to talk a little bit about one, there are
some small pieces elsewhere. But primarily, jurisdiction is
there. I will start with you, Mr. Skinner.
Mr. Skinner. Absolutely. My own experiences when I was the
IG at DHS, people talk about over 100. I dealt with about 88
committees and subcommittees. This is very time-consuming,
resource-intensive. We receive, constantly, mixed messages as
to the direction the Congress wanted the Department to go.
It created, in my opinion, a lot of problems. Not only for
our office, but this is also compounded when you look at it
from a Department-wide perspective. Having to answer to so many
different committees, so many different directions. The time
spent, I think, can be better spent in building a better
Department.
But yes, absolutely. I think it would be very worthwhile if
we could consolidate some of this oversight into one committee.
Mr. Thompson. Mr. Baker.
Mr. Baker. I completely agree. It is a sign of lack of
seriousness that the Congress did not accept even the 9/11
Commission recommendations on this regard. It is very
disappointing that it has continued as long as it has, very
strong.
I do agree. Imagine trying to run a company and you have 88
outside boards of directors you are held accountable to, none
of whom agree in the common end-state. Well, everyone agrees
that we want to make the country more safe, but with changes.
I think it is debilitating. I don't think the Department
can mature when it has so many different approaches in terms of
oversight. The big issue, I would also suggest, is to be able
to align budgets to priorities. You have got to also look at
the appropriator-authorizer connect, which--I know, I chuckle
myself.
I sometimes say we have three parties in this country--
Republicans, Democrats, and Appropriaters. But at the end of
the day----
Mr. Thompson. You are correct.
Mr. Baker [continuing]. That is a big issue.
Mr. Cilluffo. That has certainly been an issue that DHS
has--been a burden for them from the time the Department has
been created. But I think as you know that, you know, GAO works
for the Congress as a whole. Obviously, we are strong advocates
of very aggressive and hands-on oversight.
So we don't take a position on how Congress divides up its
jurisdiction, other than to say that we are there to support
making those decisions. So if there is any information we can
offer to help with that, we would be glad to offer that. I will
say that this problem is not necessarily unique to DHS, but it
is probably unusual relative to other departments in the
Executive branch.
Mr. Thompson. Thank you. I would like just to go on the
record in support of what Mr. Baker and the others have said.
That the 9/11 report, Commission report, this is really the
only thing that is still left outstanding. Is that somehow we
all agree that it is outstanding, but we can't agree to do it.
I think that is a failure on Congress' part to step up. I
will just say for the record again, Mr. King--whether you are
Chair or I am Chair--we need to send that letter again to our
leadership, jointly signed by us, saying it should be done and
already has been made part of the record. We agree on it.
I look forward in January to authoring or coauthoring a
letter indicating a continuing interest on our part for that
consolidated jurisdiction.
I yield back.
Chairman King. The Ranking Member yields back.
I recognize the gentleman from Alabama, the subcommittee
Chairman, Mr. Rogers.
Mr. Rogers. Thank you, Mr. Chairman.
It is good to have Mr. Skinner and Mr. Baker back before
us, as they have been many times in the past. I look forward to
hearing from our other witnesses. As you all are aware, I chair
the TSA subcommittee. We have held, as a part of our hearing
process, three hearings on the procurement acquisition process,
which has a problem in TSA. But it has a problem Department-
wide, as you all know.
GAO just released its most recent report examining this
acquisition process. One of the most disappointing facts, which
we also found in our hearings, was that most of DHS's major
programs reported their planned capabilities changed well into
the procurement process. Which obviously costs money, but not
just for the Department. But it costs money for the private
sector.
When you throw out these requests for proposals without
talking to anybody first about what is possible, and then when
they come back and say, ``Well, we can't do that, but here is
what we can do,''--and they have spent several hundred thousand
dollars--you say, ``Well, that is not what we want,'' and they
pull it back, it is completely unfair to the private sector.
But it also doesn't help us achieve the goals that we are
trying to achieve with the Department. I am interested in your
thoughts on what we can do to remedy that. What is practical?
Let us start with Mr. Baker.
Mr. Baker. I will not pretend to be an acquisition expert.
But my overall view of the acquisition process of the various
parts of the Department is, this has turned out to be something
that only a truly mature agency can do well. CBP certainly has
problems, but has managed its procurements better than most of
the components of the Department.
TSA, as a new agency, doesn't have the kind of depth of
staff and experience to do it as well as CBP.
Mr. Rogers. Right. Well, that is one of the things I have
mentioned to them in the hearings, is you are exactly right. A
mature department does it well. And the best example is DoD.
They found all the potholes in the road, and they know how to
get around them.
I have urged TSA and DHS as a whole to model their process
after DoD, and they pushed back hard against it. I don't
understand why.
Mr. Baker. You know, it is the process, it is certainly
true, where DoD has been in every pothole that you can find out
there. Part of it is just personnel. You need personnel who
have been doing this and made some mistakes, and understand how
those mistakes are going to play out, and who are not wooed
away by contractors to get new business in the future.
I have often thought that we ought to find a way to
penalize people who hire our procurement officials in the first
5 years of their service. Because part of the problem is having
a real depth of staff.
Mr. Rogers. Anybody else? Mr. Maurer.
Mr. Maurer. Yes, I think the first thing that DHS needs to
do is just follow their own policies and procedures on
acquisition. One of the things we found in the report that was
issued yesterday was that we actually gave their policies
pretty good marks. Their best practice, the problem has been
they haven't been consistently following them. If they followed
their own rules they would have better outcome.
Mr. Rogers. Why do you think that is?
Mr. Maurer. Well, I think in the early years of the
Department, and it continues even today, there is an overriding
sense of urgency, which is important. It is part of their
mission. But it leads to----
Mr. Rogers. Purchasing puffer machines.
Mr. Maurer. Puffer machines that don't work. It leads to
rushing to failure. There has been a whole host of those.
SBInet and ASP and CAARS. There is a whole alphabet soup of
failed acquisitions that DHS has had over the years. This
report is the latest example of that.
I know the subcommittee--Mr. McCaul's subcommittee--
tomorrow is having a hearing on this to talk more in depth. So
I think, yes, first-off DHS needs to follow their policies. I
think they have some real shortages in terms of qualified staff
to help oversee and review these acquisition programs.
The third issue they really have to come to terms with is
that they probably signed themselves up to purchase more
acquisition programs than they are likely to be able to afford
in outyears. I mentioned in my statement, there is almost $170
billion in sort-of total life-cycle costs.
That is a rough guess. I mean, they don't really know what
they have signed themselves up for. If we are going to continue
to face tough budget times, they are going to have to make some
really hard decisions on where they are going to put their
resources.
Mr. Rogers. I agree. One of the things I have pushed them
to do, though, and it is hard to get them to do, is to start
conversing with the private sector in advance. To call the
private sector in, do a notice on FedBizOpps or whatever. Bring
them in, and say, ``Listen, these are the things we are trying
to accomplish. What is possible?'' Get some dialogue going.
Yes, sir.
Mr. Cilluffo. Mr. Rogers. Beyond simply as it affects TSA,
but generally speaking, metric performance measures. I don't
mean to get too philosophical, but at the end of the day what
gets measured gets done. But are we measuring what matters? It
is that second set of questions that I think you can see
improvement in the future.
Wherein the Quadrennial Homeland Security Review aligns
with a bottom-up review so you can actually--a policy without
resources is rhetoric. But if you can actually match up the
priorities from a budgetary standpoint, that is kind of the way
the Department of Defense does it with the Palm process and
with the QDR.
One thing I might note though, that it took the Goldwater-
Nichols Act to be able to really prioritize those needs that
were purple, that were across services, that were unique beyond
any particular military service. The Department doesn't have a
COCOM-like structure. Maybe it should. That is a different set
of questions. But it doesn't at this point.
Mr. Rogers. Excellent. Thank you.
I yield back.
Chairman King. The gentleman yields back.
The gentleman from Michigan, Mr. Clarke, is recognized for
5 minutes.
Mr. Clarke of Michigan. Thank you, Mr. Chairman.
Just to all of those who are testifying, my major concern
is about the security of our power systems, our power grid, or
airports, especially our municipal drinking water and sewage
systems. A cyber attack on the industrial control systems that
govern these assets could have a devastating impact on areas
like metropolitan Detroit, especially if there was a cyber
attack against our municipal drinking water and sewage system.
If any of you have some thoughts on the type of policies
that we could implement here to better protect the American
people from such a cyber attack, that is information I would
like to hear. I do have some specific questions. One issue,
raised by Mr. Baker, about the role that private companies who
are victims of a cyber attack could play in terms of funding
Federal investigations into those attacks.
Also, Mr. Cilluffo raised the issue of Iran and Hezbollah.
Are there any specific instances or concerns that we should
have regarding Iran and Hezbollah regarding a cyber attack on
our country?
I yield back my time.
Chairman King. The gentleman----
Mr. Clarke of Michigan. Well, I would like to get a
response, and then I yield back my time afterwards.
Mr. Baker. In terms of industrial control systems, you are
absolutely right that practically everything that civilized
life in Detroit or any other American city depends on is an
industrial control system. Those systems, as the Stuxnet attack
on Iran's Natanz enrichment facility shows, are vulnerable to
attacks that can break the systems.
No major city is going to survive in an orderly fashion if
it has no power and no water and the sewers are not functioning
properly. You can break all of those things with a properly
designed attack. To prevent that, we need to make sure that our
systems, to the extent possible, have been pulled off of the
internet and that there are not internet connections.
We need to talk to the software manufacturers and hold them
to high standards in terms of how secure those systems are.
They have never been secure because they didn't think they were
connected to the internet. They are now discovering that they
are. The hardware in those systems is also not secure, and we
need a research agenda that will improve the security of the
hardware.
Finally, in my personal view we are probably putting far
too much emphasis on smart grid deployments today. We talked
earlier, Mr. Maurer talked, about rushing to failure. Smart
grids are connecting our power systems, and they offer some
real savings. But they are connecting our entire power system
to the internet in ways that we could end up regretting.
So those are all things that I would suggest we begin
immediately to pursue. I will come back to the private-sector
issue if others finish in time.
Mr. Cilluffo. Mr. Clarke, thank you for your question. I
mean, this is a multifaceted set of issues. Clearly, we have
seen attempts, and successful hacks, on supervisory data and
acquisition systems. The underpinnings of our critical
infrastructure is not only overseas, but those attempts are
spiking domestically, as well.
So in terms of critical infrastructure, yes. But I think
you have got a bigger issue. Back to some of the acquisition
questions, we haven't baked security into the design of our
architectures. That is why I think, rightfully so, the House
Intelligence Committee is asking very tough questions vis-a-vis
Huawei, ZTE, and anyone else who could potentially have access
to our backbone, our very critical infrastructures, that are
most significant for computer network exploit, espionage, or
potential attack.
More needs to be done there. We have got to figure out what
are the right carrots and what are the right sticks. We have
talked a lot about the sticks, but I think there are some
carrots; tax incentives, liability protections, if you meet a
certain standard in BAR. Which I think should be initiated by a
third party. I call it a Good Housekeeping seal of approval.
So it is looking at what are the right carrots and sticks.
Some critical infrastructures are more critical than others.
Those that really affect our ability and could impede our
ability to project power, deploy forces and, from a National
security standpoint, I think take on a different set of issues.
Very, very, very briefly on Iran. Yes, we have seen a lot
of activity in this space. I recently testified--I see Mr.
Lungren here--before one of his committee hearings specifically
on Iran before all these unhelpful leaks in terms of what we
have seen on the cyber side. They have stood up a cyber army,
the Baseez and some of their proxies have been involved. There
is a cyber Hezbollah that is involved in primarily intelligence
collection.
So there is reason to be concerned. There are attacks going
on as we speak on some of our banking sectors that some people
aren't sure where they are necessarily generating from; notably
Bank of America, Chase, and others. So I think that is an area
we need to be concerned about.
But let us not treat all attacks the same. Hacking a
website is like graffiti in cyberspace. It is bad, but it is
not the same as attacking the very critical infrastructures or
damaging the data that those systems run. So we have got to
take some of those issues into consideration.
Finally, there were attacks this summer on Saudi Aramco and
on Qatari RasGas. To me, this is where I was talking about what
sorts of products NPPD and INA could provide to the critical
infrastructure owners. They should have taken those lessons
learned and be able to share some of the signature data with
our own critical infrastructures.
I might note that a big thing I have been pushing is the
Defense Industrial Base pilot, which right now is primarily
focused on the defense contractors. I really feel that should
be expanded to our critical infrastructure owners and
operators; at least the most critical infrastructure owners and
operators.
Mr. Clarke of Michigan. Mr. Chairman, if we do have time I
would like Mr. Baker--the opportunity to----
Chairman King. Actually, we are running on this. I
appreciate it, but let me just say I want to thank you for your
service on the committee, Mr. Clarke. No one knows what the
future holds, but it has been a privilege having you work with
us on the committee. Even if you are on that side, and ask some
tough questions sometimes.
Mr. Clarke of Michigan. It is an honor to serve our country
here, and it is an honor to serve with you in this panel. Thank
you.
Chairman King. Thank you.
The gentleman from California, our leader on cybersecurity,
Mr. Lungren.
Mr. Lungren. Thank you very much. Thank the panelists.
I hope I am not contrarian in this. I have been on this
committee for 8 years now, and been part of the oversight for
the Homeland Security Department. Frankly, I think they are
better now than they were back then. I think there has been
improvement, there has been some maturation.
I guess the question is: How far along are we in the
maturing process? When we compare this to DoD, as was
mentioned, it took a long time for us to have the
reorganization of DoD to get where we are today. So I, frankly,
have seen what I consider to be improvement.
I believe we are safer today because of DHS, even with all
the warts and the shortcomings that we have. So I wanted to
start with that.
The second thing I wanted to say is fusion centers. We have
a fusion center in my district, which I have been out to see
any number of times. I am impressed by the level of
cooperation, collaboration, exchange of information and respect
for all the participants--local, State, Federal, including DHS.
Mr. Baker, have you seen that? What I see in the Sacramento
region, is that the same as you have observed or that you have
been made aware of around the country?
Mr. Baker. Yes, there are some very successful fusion
centers that are doing great work and that have really built
deep relationships between DHS and local and State authorities.
I have had people say if you have seen one fusion center you
have seen one fusion center. They are very variable, and not
all of them are as successful as the one in your district.
But I think they have turned out to be an enduring
institution. We may end up seeing consolidation or
rationalization of some of them as the budget gets tighter. But
it seems to me they have been a very valuable way for DHS to
actually make a difference in local policing.
Mr. Lungren. See, that is one of the concerns we have. When
we look at budgets, there are those who look at things like
that as the first thing to go. I don't think it ought to be the
first thing to go. I think it ought to be one of the things
that we try and make even better. Because in the area of
terrorism, as in so much other things, much of the intelligence
is gathered by people who weren't looking for terrorists as
their first objective.
Mr. Baker. Right.
Mr. Lungren. There are so many more eyes and ears with
local law enforcement than there are Federal agents. Part of
our job is to make sure that we give the expertise, share the
expertise, on the Federal level with those at the local and
State level. Then, with the analysts--perhaps they are Federal
analysts, perhaps they are analysts that come from other
departments--but utilize that, that ability.
I fear that when we run into these tough budget times that
is the first thing to go because it is not a fancy gadget, it's
not a new thing that comes out of S&T, even though I want
things to come out of S&T. So I am concerned about that.
In the area of cyber, one of the concerns I have had has
been the tremendous personnel turnover we have seen within the
cybersecurity mission within the Department. At the same time,
I have been impressed most recently with an added robustness of
that element of DHS. In part, because of the infusion of a good
number of people from the private sector.
So two questions for you, Mr. Cilluffo, and also Mr. Baker:
What is the basis of the difficulty for us keeping people in
the cybersecurity arena in DHS, No. 1? No. 2, do you think the
failure of the Congress to get a statutory authority and an
institutionalization of the lines of authority within the
Executive branch on cybersecurity is, in fact, a serious
problem? Or is it just something we can take care of by way of
Executive Order?
Mr. Cilluffo.
Mr. Cilluffo. I will start, and I am just going to say one
thing on fusion centers. Because we have done a number of
surveys, the first surveys, to try to bring a little bit of
science to the art of intelligence. I agree with your position
100 percent.
The one thing I would note that they are lacking, and the
majority of them suggested as much, was analytical tradecraft
and capability, No. 1. Second, their ability to do threat
reporting on the cyber side is weak, and they need to build
that up.
But to your question on cyber retention, it is a huge
issue. Not only at the Department of Homeland Security, but
across the Department of Defense and the intelligence
community. Because you have so many greater opportunities in
the private sector. Not only financial, but sometimes less
bureaucratic. One of the things I think we need to start
thinking about in terms of authority is our active defenses,
where you give other entities the ability to respond in real
time, in certain circumstances, in accordance with our laws.
So I don't think an Executive Order--I mean, this is an
issue that is so important for our country, it is so important
for all branches of Government to be able to acknowledge and
recognize that this is a significant set of issues. I don't
think you can just pay for it forward by Executive Order. I
think it requires a debate, it requires a discussion.
It is extremely important, looking to future, that you--I
don't think you can promulgate it through an Executive Order
alone. I think Congress has not only an opportunity, a
responsibility, to address these issues.
Mr. Baker. On personnel, look, this is a hot field and
people who do well in it in Government are going to get lots of
job offers. We do need to face the fact that we will have
turnover at some point. I will note that NSA, where I have also
worked, has addressed that issue by and large as a culture
where they expect people to come in and spend 25 or 30 years
doing what NSA does. They get some very talented people.
They lose people, but they have held onto their people
better than DHS cyber has. My suggestion would be, on this as
on many other things, DHS needs to be borrowing personnel and
capability from NSA, bringing them over, making them part of
the career progression within NSA so that they can get the
benefit of the talented folks that NSA has.
On the question of Executive Order versus legislation,
legislation would be better but I am a realist. I actually
think the Homeland Security Act gave a lot of authority, at
least within the civilian arm of the Federal Government, to
DHS. What we have seen is, the President by and large seems
prepared to back that up by saying no, I really want you to do
what the Homeland Security Act conveyed to you.
That is progress. So I have supported an Executive Order, I
think it is a good idea. There are things that can't be fixed.
The Rogers bill, CISPA would be a much better solution than any
private or Executive Order solution to the information-sharing
problem. I frankly think, though, we are in for a period of a
year or more in which nothing is going to happen in Congress so
we need to be looking at everything that can be done within the
Executive.
I don't think we have gotten to the end of the things the
administration can do to improve cybersecurity.
Chairman King. The time of the gentleman is expired.
The gentleman from New York, Mr. Turner. I am sorry, how
did I forget? Here I am talking away to the temporary Ranking
Member, who has ascended very quickly to the throne.
The gentlelady from California, who has been a very close
bipartisan worker on this committee, Ms. Hahn.
Ms. Hahn. Thank you, Chairman King. I will start by adding
my shout-out to my colleague from California, Mr. Lungren, on
the necessity of our fusion centers. There is one in the Los
Angeles region, as well, that is very significant.
I would dare say many of the plots that have been foiled
over the last years were a result of the information that was
cobbled together in our fusion center. I think we, as Members
of this committee, ought to be very clear and very precise in
advocating for the continence of our fusion centers.
I have appreciated the gentlemens' testimony, and your
knowledge about our Department of Homeland Security and the
future. I have a district that borders the largest port complex
in our country, Los Angeles and Long Beach. To that end, I have
been concerned about port security.
In fact, my very first hearing here in the Homeland
Security Committee was the 9/11 report card. At that time, it
had come out that probably we were a little lacking. I would
like to hear Mr. Baker's grade for port security in this
country.
To that end, I will say thanks to Chairman King, and a real
bipartisan support. I was able to pass my first bill this year,
on asking the Department of Homeland Security to report back to
Congress on assessment of our port security. I would love to
hear your analysis of how we are doing.
I tend to think it is still a very vulnerable entryway into
our country through our Nation's ports. Specifically, I would
like to know, generally, how you feel about that. But
specifically, speaking of managing our resources, I have heard
from a number of ports across this country that the port
security grants, which I am a big advocate of.
We have done things in this committee to continue port
security grants. But some of the deadlines, some of the
requirements, some of the, you know, burdens that, apparently,
we are putting on port authorities to actually use these port
security grants in an efficient way are hindering what I
believe ultimately is the securing of our Nation's ports.
So I would love to hear your assessment specifically of
port security, and how we are managing our port security
grants.
Mr. Baker. So I can't give you much useful information
about the grant management because I think I am out-of-date on
that. I did participate heavily in the Port Security Act
process and the implementation of that, and it's been continued
by the next administration.
On the whole, I would give that effort about a B. I think,
given the amount of attention that has been put on that and the
number of authorities--not just CBP, but also Coast Guard, that
are available--the Department has done a reasonably good job of
trying to improve port security. You know, obviously it has not
been able to move inspection for nuclear weapons overseas the
way one would like, and that isn't going to happen anytime
soon.
Not because of incompetence on the Department's part, but
because, you know, we have to persuade our negotiating partners
to do that. One of my biggest worries is that if we are looking
for nuclear weapons, which is a fundamental part of our port
security program, that may be smuggled into the United States
we have pretty good mechanisms--not perfect, but pretty good
mechanisms--for identifying those weapons if they come in in
containers through the ports.
We are much less well-protected against the possibility
that someone will put that into a private jet and just file a
plan for Teterboro and never get to Teterboro. Just set it off
before they land it in the United States. We need an approach
to nuclear weapon smuggling that looks not just at ports, but
at all the ways people might smuggle stuff in.
The joke is, the best way to get it in is to wrap it in a
bale of marijuana. We need to be looking at all of those. I
think actually we have done a better job of securing our ports
against that threat than most of the other mechanisms by which
people would bring a nuclear weapon in.
Ms. Hahn. Any other members of the panel want to speak on
port security?
Mr. Maurer. We issued a report specifically on the Port
Security Grant Program about a year or so ago, and highlighted
some of the issues you pointed out. Specifically, it takes too
long for the money to flow out to the actual recipients. I
think the good news there, in a nutshell, is that FEMA and DHS
are taking actions to address our recommendations.
My understanding is, they are starting to make progress on
that. So that is good news. The second point, real quickly, is,
one of my colleagues from GAO, Steve Caldwell, recently
testified on the overall state of port security. I think we
would agree with Mr. Baker's assessment. Generally speaking,
that has been one of the relative areas of success for DHS over
the course of the last 10 years.
Ms. Hahn. Thank you.
Mr. Cilluffo. A very general point. Smuggling is smuggling
is smuggling is smuggling, whether it is drugs, weapons,
people, or whatever illicit or even licit goods in tough areas.
So one area where I think beyond just ports that we need to be
doing more is we are seeing hybrid threats. Is it terrorism, is
it crime, is it this, is it that?
At the end of the day, I think there is some real
opportunity between the counternarcotics community and the
counterterrorism community to further cooperate on some of
these issues. Because again, the routes are going to be the
same. The TTP, the terror tactics, might be the same. So how do
we start bringing those worlds together?
Ms. Hahn. Thank you.
I yield back.
Chairman King. The time of the gentlelady has expired.
Now the gentleman from New York. Mr. Turner.
Mr. Turner. Thank you, Mr. Chairman.
One of the most important elements here in counterterrorism
is intelligence. If you could give us a minute, maybe, on what
you think can be done and improved for intelligence sharing. I
am particularly taking this from a view as a New York
representative, which comes both ways.
The NYPD, as you may know, has its own intelligence
operation. If you have a thought on the efficacy of that, and
what are the things that could be improved upon in the next
year or two. If you would be kind enough to begin, Honorable
Skinner?
Mr. Skinner. I would be happy to. That is one of the
things. I think the biggest concerns I had dealt with the
integration of our IT systems and creating a capability to
communicate on a real-time basis. The Department, within
itself, has problems just communicating across the various
component lines.
One of the biggest challenges--and I believe I alluded to
this earlier--is our ability to then communicate on a real-time
basis with our Federal partners and, particularly, with our
State and local partners. The fusion centers, I think, is a
good step forward to improving that communication capability.
But I still think we have problems with getting access on a
real-time basis, giving people the clearances so that they can
communicate on a real-time basis, and developing a trust.
Fusion centers, I think some operate very well. But again,
we talk about do we need as many as we have? Probably not. Can
we do a better job in consolidating those fusion centers and
building on a cadre where they are most needed on a risk basis
would be, I think, a step forward. But building an IT
capability to allow us to communicate, I think, is one step
that we need to continue to work on.
Mr. Turner. How far away are we from that ideal?
Mr. Skinner. Quite frankly, I think we are very far away.
Mr. Turner. Thank you.
Mr. Baker. You know, the New York police department is one
of the crown jewels of our counterterrorism effort, and the
only non-Federal agency that really provides an alternative
model for how you respond to terrorism effectively. I was
disappointed to see the Associated Press and a few other folks
kind of sniping at NYPD and inviting Federal oversight as a way
of kind of making them less effective.
We should have more local law enforcement agencies that
were learning from NYPD, that were willing to talk directly to
the U.S. intelligence agencies. So I would say they should be a
model, rather than somebody subjected to criticism.
On information sharing, let me just highlight an area of
information sharing that I think is far worse than the
relationship with State and locals. It is information sharing
on cyber intrusions where, in fact, law enforcement agencies
know an enormous amount about who is doing them, what tactics
they are using, why they are targeting people, and who they are
targeting.
The targets are in the private sector. The sharing with the
private sector at that level of detail, in my view, is nowhere
near as good as it with State and locals on the
counterterrorism mission.
Mr. Cilluffo. I think Stewart and I are hanging out too
much. NYPD is clearly the gold standard in this business. I
might note, though, Ms. Hahn and others that if New York police
department is the gold standard, LAPD is the silver standard.
But once you get outside of New York, Los Angeles, Texas
and some of these other areas, Arizona, you really have a mixed
bag. At the end of the day, that is why I think we really do
need to invest in the fusion centers. It could probably afford
some culling to be able to build on the best.
The last thing I want is the successful initiatives to be
thrown out--the baby thrown out with the bath water--if we see
the need to cut, and we are not going to cut the right ones. In
essence, you are going to have entities that perhaps ought to
be put on life support, and you have got the gems that are
going to be stymied.
New York has its own intelligence capabilities. They have
an overseas presence. Very few police departments have an
overseas presence. So I don't think it is even constructive to
compare that--maybe LAPD--with the rest of the country. But as
much as can lean forward, enable and support, it has been a
target multiple times.
Unfortunately, it is a target almost every day; much of
which we don't read about. So I support that 110 percent. One
thing on the intelligence picture writ large. I would argue
that we need a true domestic intelligence estimate. We don't
have regional threat assessments domestically for the Jihadi
threat, for Islamist threats. The United Kingdom, for example,
does.
I am not suggesting we need a security service or an MI5 in
the United States. Actually, quite the opposite. Push the
capabilities to our State and local authorities. One area where
we are the best in the world, hands down, are JTTFs. But that
is only when an investigation is open.
Once we get the blip on the radar screen we are the best,
period. But what about in that steady state, to be able to see
what that threat environment looks like for the unknown
unknowns. That, I think, we still have a lot of work to do. As
much as we can invest in our State and local authorities, we
ought to.
Mr. Maurer. Very quickly, I think you should know
information sharing is one of GAO's high-risk areas. So clearly
there is a lot of work that still needs to be done there. We
want to see closer collaboration among all the Federal partners
and a greater ability to work with State and locals, as well.
Chairman King. The time of the gentleman has expired.
Again, Mr. Turner will be leaving the committee at the end
of the day. I want to thank him for his service. He does an
outstanding job, and I want to thank him for his dedication to
the committee and to the people of New York overall.
Also, let me associate myself with the remarks of Mr. Baker
and Mr. Cilluffo on the NYPD. I just hope that the Associated
Press and New York Times were listening.
With that, I recognize the gentlelady lady from Texas, Ms.
Jackson Lee, for 5 minutes.
Ms. Jackson Lee. Let me also thank my colleague for his
service, as well. I think, as the Ranking Member and the
Chairman mentioned at the beginning of this hearing, we are
committed in a bipartisan way to the security of this
homeland--and, I would like to put on the record--for the
greatest country in the world. I heard someone define us as the
greatest democracy in the world. I am going to redefine us as
the greatest country in the world.
So I am very grateful for our commitment. I also want to
associate myself with the comments ``maybe one day.'' I am
going to ask for just a yes or no answer. That the streamlining
of jurisdiction oversight of homeland security is imperative
for a consistent and efficient and effective securing of the
homeland.
Mr. Skinner, do you agree?
Mr. Skinner. Yes.
Ms. Jackson Lee. Mr. Baker.
Mr. Baker. Amen.
Ms. Jackson Lee. Mr. Cilluffo. Do I get it right?
Mr. Cilluffo. Yes.
Ms. Jackson Lee. GAO in particular, Mr. Maurer?
Mr. Maurer. You know, we got to be agnostic on that one
because we serve the whole Congress. I don't say that to dodge
the question, but because I know this has been an issue that
has been debated among the Members across the various----
Ms. Jackson Lee. We will give you a pass.
Mr. Maurer. Okay.
Ms. Jackson Lee. Let me also indicate that I look forward,
if we all return by way of election, to really look at this
regional security threat concept. I think that is a very
important new note to hear.
I am going to try and ask a number of fast-moving
questions, and try to get through all of you. May not, but let
me start with Mr. Maurer. I hope you can comment that investing
resources, or the utilization of resources funding, is crucial
to some of the assessments that you have made.
Do we need to continue the right and reasonable and
effective and continued funding for Homeland Security?
Mr. Maurer. Absolutely. You are going to need resources to
achieve many of the things the Department wants to do. They are
making----
Ms. Jackson Lee. That are still not done.
Mr. Maurer. That are still not----
Ms. Jackson Lee. And are crucial to securing the Nation.
Mr. Maurer. Absolutely. They have made good progress so far
to date. One of the biggest criticisms we have had of their
plans to date, frankly, is the fact that they have resource
limitations in executing those plans. Now some of that rests in
the Department, quite frankly, and setting priorities on where
they are going to spend the money that Congress appropriates to
them.
Ms. Jackson Lee. The border, which is something that I have
been particularly attentive to because I come from the State of
Texas. Have we made improvements since, for example, 2005? I
particularly remember enhancing the Border Patrol agent census,
or population; adding more, and giving them enhanced equipment.
Has that made a difference?
Mr. Maurer. Yes, it has. There are certainly many more
Border Patrol agents on the Southwest Border as well as the
Northern Border. DHS continues to invest in enhancing the
training that they receive, as well as the acquisition tools
and the systems that they use in the course of their job.
We still have a number of concerns about the technology
enhancements DHS plans to make on the Southwest Border. The
collapse of SBInet was a major failure for the Department, and
we are watching what they are doing on that front very
carefully right now.
Ms. Jackson Lee. I think we would be very eager to know
that even though we have the rise of drug cartels, gun
trafficking, which we just heard the IG's report that I think I
can put on the record. That the attorney general had no
knowledge of the gun trafficking and the Fast and Furious
issue.
But we do know that there are elements that were not
effective. But with all of that, getting those other agencies
to collaborate, we can see in the future a secure border or a
securer border?
Mr. Maurer. It definitely depends on the execution among
the various departments and agencies. That is certainly our
hope, and we will be there to provide oversight to help assist
the Congress in its own deliberation.
Ms. Jackson Lee. All right. Gentlemen, I am going to give
three questions and I would like you to answer. I see my time
is--and I ask the Chairman for an indulgence. They could pick
the ones that they would like.
I do want to indicate that I would like to see the CERT1
program improved--I don't think the outreach goes to minority
communities sufficiently--and that is the response program
during disasters. I think the procurement is way in need of
repair in terms of outreach to small businesses.
But these are the questions I would like. We have seen a
rash of attacks or threats to universities, bomb threats. I
believe we need an ombudsman or a focus inside Homeland
Security that is an immediate response team to our
universities. Some of these, obviously, are prank calls. Or at
least they have been determined as that.
But with the rash of incidences that have occurred, I would
appreciate your comment. I would appreciate your comment on the
importance of reaching out to Muslim-Americans and retaining
and hiring them in the security process. I would appreciate
your comment on the importance of homeland security and civil
liberties.
Anyone want to start first?
Chairman King. I would ask the gentlemen if they would try
to, you know, give brief answers. Try to keep it in the next 2
or 3 minutes.
Ms. Jackson Lee. Mr. Chairman, I thank you.
Mr. Baker, you are up.
Mr. Baker. Okay. So I would say ombudsman to universities,
or at least a place to call after you get a call you can't tell
is crank or not, absolutely it is a great idea. It should be
part of information sharing. Outreach to Muslims has been going
on, should continue to go on and I think, on the whole, has
been successful for the Department and the U.S. Government
generally.
On civil liberties and privacy, frankly if there were a job
I wanted in Government it would be chief privacy skeptic. I
think the privacy groups have not, on the whole, treated DHS
well or its programs. We probably should be more skeptical
about privacy claims than we are.
Ms. Jackson Lee. All right. Well, Mr. Skinner.
Mr. Skinner. I have nothing to add to what Mr. Baker just
said. Very well put.
Mr. Cilluffo. Just that I agree on the university side we
need a bellybutton. I am not sure exactly how that looks like,
but I am standing where I sit. I am at George Washington
University now.
Second, in terms of civil liberties, I don't think the
debate has been cast as an either/or proposition. I don't think
that is healthy. You can, and must, have both. When you start
looking in the cyber domain in particular, there are going to
be a lot of questions.
But I agree with Stewart. Many of them are red herrings. A
lot of them are not necessarily--that is not to suggest we
don't take it seriously. We do. But I think most of the people,
having been on the inside you hear more from your lawyers than
you hear from the ops guys in terms of what it is you can and
cannot do.
That creates, to some extent, a chilling effect. Which is
why, again, Congress, I think, has an opportunity and a
responsibility to address some of these issues and move some
legislation.
Ms. Jackson Lee. You should not take privacy lightly,
however.
Mr. Cilluffo. Absolutely not. It is you build too many
walls, the bad guys win by default because our way of life has
been lost. That is what we are, is a federalist democracy, of
course.
Ms. Jackson Lee. Mr. Maurer.
Mr. Maurer. You definitely want to consider civil liberties
as part of the overall approach to cybersecurity. Absolutely in
agreement on that. Outreach to the Muslim community is
absolutely vital. I agree with that, as well. I think it is an
interesting concept you talk about for an ombudsman, and
certainly worth looking into.
Ms. Jackson Lee. Thank you very much. Mr. Chairman, thank
you.
I yield back.
Chairman King. The time of the gentlelady has expired.
The gentleman from Texas, chairman of the Oversight
Subcommittee, Mr. McCaul.
Mr. McCaul. I thank the Chairman.
I want to follow up on something Mr. Lungren talked about.
That is, you know I think one of the greatest disappointments I
think I, and this committee I think, share in is that the
Congress did not pass cybersecurity legislation, which is so
important. Every day that goes by without those authorities,
more Americans are at risk.
So I hope that if we can't get it done in this Congress we
can certainly get it done next Congress. A very small point,
and I want to go on to two other points.
But, Mr. Baker, you mentioned an interesting idea. I think
part of the problem is the perception that DHS just doesn't
have the capability that NSA has. That probably is reality,
too. So to put that faith and trust in DHS because I personally
think, and I think Mr. Lungren and the Chairman agree, that a
civilian authority is the more appropriate in a domestic sense
rather than a military.
Now, NSA can work with DHS and that is what you want. But
how do you get NSA, you know, capability or NSA employees to
come to DHS?
Mr. Baker. So, in fact, some of that is happening. You
know, I am an alumnus of both organizations, and may be the
only one who has had a political appointment in both. But I
don't think that you can bring staff over from NSA, detail them
in. They are operating under DHS authorities and constraints,
but they are bringing a raft of technical capability that
otherwise it would be very hard for the Department to hire.
What we need is enough technically competent people at the
Department so they feel that they can take advice from NSA
employees without fearing that they are getting a whole bunch
of policy advice they don't see buried in the technical----
Mr. McCaul. I like the detail approach. Because I think,
again, they kind of have to earn the respect of the Congress
for the Congress to give them those authorities. I think there
is an issue with that. I personally think it should be more
under civilian control.
So, quickly, to move on, I am chairing a hearing tomorrow--
I think, Mr. Maurer, you are going to be there--on acquisition,
procurement. You know, we still see all the silos that Mr.
Skinner talked about. Yet, you know, it is still a very solid F
in terms of the acquisitions. So we don't see--there were these
recommendations that were made, you know, several years ago.
But they don't seem to be followed. So you got a
procurement process that has become very wasteful in its
management. I mean, so overall how do you integrate this
management together? But then how do you fix the procurement
process? If you could answer it in a fairly short manner I
would appreciate that.
Mr. Maurer. Sure, absolutely. First off, I want to give
good credit to my colleague, John Hutton. He will be the GAO
witness tomorrow at your hearing. So he is taking the lead on
this issue at GAO.
But how to address the problem? First and foremost, DHS
needs to follow its own rules. They haven't been doing that,
that has been at the root of the problem. Second, they do need
to do a better job of managing the overall portfolio, and start
making the hard decisions and figuring out what they can
actually afford out in the future.
But a third issue, they need to do a better job of coming
up with life-cycle cost estimates. That sounds wonky and down
in the weeds, but what it basically means is figuring out the
price tag. What is it going to cost to procure these different
systems, and over how many years is that going to take? Until
they come to grips with all three of these issues they are
going to continue to have problems.
Mr. McCaul. Okay. A final a point is, Mr. Cilluffo, you
talked about regional threats. I think that is a very smart
approach. I led a delegation down to Latin America, and we went
to, you know, the tri-border area, a Jewish community center in
Buenos Aires. As you know, the Saudi ambassador applied the
Quds forces. They were going to hit the embassies--and Israel,
Saudi, and Argentina.
So we look a lot at the Middle East, but there is a lot
going on right here, too. My kind of nightmare scenario is a
strike from Israel, against Iran. With everything that is
happening right now already, with these embassies already being
targeted, you throw that cocktail on top of everything and it
is a Molotov cocktail.
I can see, you know, there will be ramifications to that.
There will be a response. I can see the Hezbollah operatives
not only there but in this hemisphere which we know are here. I
can see them lining up.
So is DHS prepared? Do you think they are even looking at
this issue and planning to defend?
Mr. Cilluffo. Mr. McCaul, you raise a number of very
important points. I think as much as you can raise awareness in
terms of the challenges you saw in the tri-border area would be
helpful to the American people. Because we do have problems on
our hands.
It is not just in the tri-border area. Hezbollah has got a
presence in the United States. In fact, the Los Angeles police
department elevated the government of Iran and its proxies,
notably Hezbollah, as a Tier I threat; highest threat level.
NYPD has been leaning forward in terms of addressing some of
these challenges.
So I don't think it is only in response to some actions
that Israel or others may take. I think that you are seeing an
uptick in activity that, even short of that, warrants greater
concern from the U.S. National security.
Mr. McCaul. Then, in closing, I hope the Department is
focused on this very aggressively in terms of defending the
Nation rather than responding, or reacting to, a crisis.
Mr. Cilluffo. I can tell you some are. I am not sure that
is percolating throughout the entire Department. But I have
worked with some folks who are recognizing that as a challenge.
Mr. McCaul. I thank the Chairman.
Chairman King. The gentleman yields back.
I would just point out, as Mr. McCaul knows, and he was
part of the hearing, we held a hearing--at least one hearing,
full committee also, I think, some subcommittee involvement--on
the whole issue of Hezbollah in this country. My impression was
the same as yours. It is a serious threat not being taken
seriously enough by everyone. By some, but not by all.
With that, the gentlelady from California, Ms. Richardson,
is recognized for 5 minutes.
Ms. Richardson. Yes, thank you, Mr. Chairman.
I just have two questions for Mr. Skinner. One, in fiscal
year 2011 the Department entered into over 133,000 procurement
transactions and over 81,000 thus far in 2012. I am concerned
about the oversight of these transactions. On your watch,
during the Department, we have obviously heard, and learned of,
various problems of the procurement process, including
contracts with SBInet, Deepwater, and Federal Protective
Service contracts and Guard contracts.
Yet the Department's management budget appears to leave
little room for improved oversight during the procurement
process. How can you improve upon your contract oversight?
Mr. Skinner. It is, I think, very basic. That is, increased
staffing. Because I think the acquisition management function
within the Department when it stood up, and even today, as much
as they are trying to build a capability is still grossly
understaffed. I think as part of the procurement process, when
you develop your strategic plans, your operational plans, as to
what you are going to be buying in the outyears and in the
current years, that we need to budget in, or factor in, the
cost of the total procurement.
Just not the cost that we pay the contractor, but the cost
to provide oversight of those contracts. It is all part of the
contract administration process.
Ms. Richardson. Has that----
Mr. Skinner. I do not think that is being done right now.
Ms. Richardson. Is there anything you need us to do to be
able to assist you to have that happen?
Mr. Skinner. The authorities are there, the guidelines are
there, the policies are there. They just simply need to be
implemented. I think with additional staffing, we could do a
better job of managing the contracts as opposed to just simply
awarding and then reacting to problems.
Ms. Richardson. Okay. So, Mr. Chairman, if you would be
willing maybe the committee would want to consider requesting
of the Secretary that as contracts are distributed that, as Mr.
Skinner has suggested, that the oversight be included in the
overall cost that is being considered.
Then that way, they might be able to have adequate staffing
to take control of the taxpayers' money, which I know you and
all of us here are very concerned about.
Chairman King. We will certainly consider that, and I will
work with you and your office to try to bring that about.
Ms. Richardson. Thank you, Mr. Chairman.
The second question is: Mr. Skinner, on a scale of 1 to 10,
how would you rate the Department of Homeland Security on its
cybersecurity efforts? Meaning, where are there improvements
most needed from the Department's perspective, and what
legislation could we do to help you to better achieve those
results?
Mr. Skinner. First, let me say I am probably the least
qualified person to ask that question on this panel. But based
on my observations when I was serving with the Department, they
are making modest progress through their hiring efforts, their
attention to the cybersecurity issues. But on a scale of 1 to
10, I would have to give them something around a 4.
We have a long, long way to go. I think one of the primary
things, and it has been repeated several times this morning, is
that we definitely could use legislation to help guide the
Department.
Ms. Richardson. Okay. Would anyone else like to give a very
brief response that wanted to chime in?
Mr. Cilluffo. Just to piggyback Mr. Skinner's comments,
General Alexander, when asked very specifically where the U.S.
readiness was on a scale from 1 to 10, said a 3. So it is
pretty much in line with some of that thinking. He is the
commander of Cyber Command, and director of the National
Security Agency.
I do feel this is a big area that the United States--we are
not any further along than our homeland community was shortly
after 9/11.
Ms. Richardson. Wow.
Mr. Cilluffo. The difference is, is we know the risks. So I
think we have got a responsibility to move.
Mr. Baker. I can just add, if the people who are attacking
us for getting grades from their governments they would get at
least a 6. So we are losing ground to the attackers.
Ms. Richardson. Mr. Chairman, I know that when
appropriations come forward in the House, typically where we
look to add more programs, Members of Congress will typically
take money out of the management and oversight or salary bucket
of a particular department. Take money from there and, you
know, fund for another program.
I would be more than willing to join you of us educating
our colleagues that in this particular area of cybersecurity--
we can't speak to every area--but the impacts of these cuts to
the staffing in particular is really hindering the ability to
move forward. If you would like to join me, or suggestions on
how we might do that, I would welcome that.
Thank you, sir.
Chairman King. Be delighted to work with you. The time of
the gentlelady has expired.
Before I go on to Mr. Marino, I just want to acknowledge,
in the audience, Robert Matticola, who is homeland security
director for the New York waterway ferry in New York, and he
has held that position since July 2008. It is obviously a job
that is in the line of fire, and I want to commend you for your
service.
Now the gentleman from Pennsylvania, former United States
attorney, Mr. Marino is recognized for 5 minutes.
Mr. Marino. Thank you, Mr. Chairman. I apologize for being
late. I am trying to get to all of my committee hearings today.
Gentlemen, it is a pleasure. As my distinguished Chairman
stated, I have been in law enforcement and I have been there
for 19 years. So I know what our men and women go through. I
have been out there on the front line with them, I have their
backs. I have worked closely with all the agencies throughout
my career.
You know, it is easy for us and anyone else to Monday-
morning-quarterback our men and women and our agents on the
line and in the field. Just unfortunate that much of the
information and much of our operations--and I still say ``our''
because I still feel I am part of law enforcement, I will
always be--has to be kept close to the chest because we don't
want the enemy knowing what is going on out there.
But each one of you can respond to my question, if you
would like to. Are our agents, are our people in the field,
fully equipped with what they need to do what we expect them to
do? Equipment, training, et cetera?
Mr. Skinner, would you like to start?
Mr. Skinner. I believe because of the rapid buildup within
our law enforcement community, particularly with CBP and ICE
over the past 5 to 6 years, that we are still behind the curve
as far as providing the types of training and the degree of
training that they need.
As far as equipping them, I also believe that our
infrastructure is trailing our hiring. We are hiring faster
than we can build an infrastructure to support them. Third, as
far as supervision and management, as we hire so many people so
rapidly that brought some of our more experienced--or what we
have done is, in essence, taken very inexperienced individuals
and put them in supervisory and management roles.
That was the only alternative they had at that time. That
does not mean to be a criticism. But all in all, I think we
still have to catch up to the hiring.
Mr. Baker. I don't have anything to add to that.
Mr. Cilluffo. I would just underscore field bias, field
bias, field bias. As much as we can lean forward, if you look
at the military community, the intelligence community, and
other communities that have gone through similar issues
commanders intent; push the capability down to the pointy end
of the spear.
In this case, I think the big potential gap is, we need to
enhance our analytical capacity so State and local can--so they
are not going in with--not blind, but with less vision, given
the fog of crises and situations. So push to State and local.
That is my one takeaway. DHS's role in that is significant and
important, but it is really about looking at State and local
authorities as their force multipliers. They are our boots.
Mr. Maurer. I think DHS definitely deserves some credit,
particularly in the last couple of years, in coming to grips
with its management problems. It gets right to your question.
They are trying to do a better job with procurements, they are
trying to do a better job with training, they are trying to do
a better job with all the different entities working as one
unified whole within DHS as well as their interagency partners.
They are definitely not where they want to be or where they
need to be, and they fully recognize that. But I am just
encouraged by the fact they are paying more attention to sort
of these basic fundamental resource and management issues.
Mr. Marino. I understand that, being in the field, there
are many agencies and many different types of work that has to
be done. But can you give me a ball-park figure? We talked
about training--and behind the curve on that--to adequately
train our people on the front lines. Whether it is ICE, you
know, whether it is DEA or whoever is--and Homeland Security
protecting our borders, or even overseas.
How much time are we talking about for training?
Mr. Maurer. I don't know if you can put an exact time frame
or dollar figure on it because training is an on-going thing. I
mean, it is not only bringing in new Border Patrol agents. It
is continuing to offer training throughout that person's
career.
Mr. Marino. But I mean, you know, bringing someone in
initially. I know training is on-going, and should be. But let
me put it this way. I don't think there is any agency with whom
I have worked where it is a 6-week training course and you are
ready to rock and roll.
Is that a correct statement? A significant amount of time
is required?
Mr. Skinner. Absolutely yes, there is significant time
required. I almost equate it to like a boot camp. Because when
you bring someone in, you are giving them basic training. But
as you progress, you are going to have to receive additional
training. That training has to be kept up-to-date.
It is just not a one-shot deal. It is constant.
Mr. Marino. Totally agree.
Mr. Skinner. So there is a lot--the more investment we make
in our training, the better performance we are going to get
from our employees.
Mr. Marino. Thank you, gentlemen.
I yield back.
Chairman King. The gentleman yields back.
I want to thank all the witnesses for their testimony
today. I think this is one of the most thoughtful and
substantive hearings we have had. Your testimony was really
invaluable. I think as Members of the committee, we often tend
to focus on issues that are particularly important to us, a
component to the Department that are important to us, or parts
of the Department where particular errors have been made.
I think you were able to bring it together today and really
show us the Department as a whole, its weaknesses and its
strengths. As Mr. Lungren said, I think significant progress
has been made. It is important to keep that in mind. But at the
same time, we have to, you know, continue to make more
progress. Especially address some of the more significant
deficiencies.
But at the same time, I think it is important that we let
the public know, really, the overall job that DHS is doing.
Because too often, when it comes time for budget cuts or
whatever, people look upon DHS as not really contributing that
much. The fact is, despite its persistence, al-Qaeda has not
been able to perpetrate an attack on the scale of 9/11 in the
past 11 years. The DHS has been a vital component of that.
So with that, I want to thank you for your testimony. I
would also want to thank the Members of the committee who were
here today. Some Members may have additional questions for the
witnesses, and we would ask you to respond to those in writing.
The hearing record will be held open for 10 days.
Without objection from the distinguished acting Ranking
Member----
Ms. Hahn. No objection.
Chairman King [continuing]. The committee stands adjourned.
[Whereupon, at 12:03 p.m., the committee was adjourned.]
A P P E N D I X
----------
Questions From Chairman Peter T. King for Richard L. Skinner
Question 1. Will you please share your views on the importance of
the completion of the St.Elizabeths project to the Department's efforts
to consolidate operations and its potential impact on the Department's
performance?
Answer. In my opinion, the inability of the Department to complete
the St. Elizabeths project as originally planned should have little, if
any, impact on the Department's efforts to consolidate operations and,
most certainly, should not adversely impact its performance.
Consolidating the Department's components ``under one roof'' so to
speak is an issue of convenience, not one of performance, particularly
in today's IT environment of borderless networks, where any employee
should be able to connect with anyone or any information from anywhere,
using any device. Housing ``people'' in one location may make it
convenient for officials to conduct face-to-face meetings, but it will
not address the real challenges facing the Department, and that is
consolidating and integrating management support systems and
operations. Consolidating operations and improving performance are
``management'' issues, not ``logistical or housing'' issues.
Question 2a. How would you compare the creation and maturation of
the Department of Homeland Security to date to that experienced by the
Department of Defense in the decade after its establishment?
Do you believe that now, almost 10 years after its creation, the
Department should have matured more quickly and its components should
be operating more effectively and efficiently?
Answer. While the creation of the Department of Homeland Security
may be the largest Government reorganization since the creation of the
Department of Defense, it pales in comparison to the enormity of the
challenges faced by DoD upon its creation. Accordingly, in my opinion,
the Department of Homeland Security has, and should have, matured more
rapidly to date than the Department of Defense in the decade after its
establishment.
I believe that now, almost 10 years after its creation, the
Department should have matured more quickly and its components should
be operating more effectively and efficiently. During its first 3 years
of existence, neither the Congress nor the administration gave the
Department the resources needed to properly support the programs and
operations inherited from its legacy agencies. In particular, its
management support functions were shortchanged, i.e., the financial,
information technology, acquisition, human resources, and grants
management functions. During the second 3 years of its existence, both
the Congress and the administration increased the Department's funding
for its management support functions, but, while making modest
improvements, it fell far short of its goal to establish a cohesive,
efficient, and effective organization. For example, the Department is
still unable to obtain a clean opinion on its financial statements and
internal controls; its components are still struggling to upgrade or
transition their respective IT infrastructures; resources needed to
implement acquisition policies are still lacking; and, it is impossible
to determine whether the Department's grant programs are actually
improving our Nation's homeland security posture. During the past 3
years, budget constraints have impeded the Department's ability to make
any significant headway and build on the modest improvements made since
its creation. The Department's new challenge will be to sustain the
progress already made and at the same time continue to make necessary
improvements.
Question 2b. How much longer is the argument that bringing together
so many Federal agencies a legitimate explanation for the Department's
shortcomongs?
Answer. Bringing together so many Federal agencies should no longer
be a legitimate explanation for the Department's shortcomings. The
Department had many opportunities to address its management challenges,
but, for a myriad of reasons, it failed to do so. Although some were
out of its control, many opportunities were lost due to poor management
decisions or just plain indecision. Unless the Department stays focused
on its shortcomings, it will be harder than ever to find solutions to
strengthen critical management support functions and, ultimately, to
ensure the success of its homeland security mission.
Questions From Chairman Peter T. King for Stewart A. Baker
Question 1. Will you please share your views on the importance of
the completion of the St. Elizabeths project to the Department's
efforts to consolidate operations and its potential impact on the
Department's performance?
Answer. As noted in my testimony before the committee, one of the
greatest challenges facing the Department of Homeland Security going
forward will be developing a framework to enable proper coordination
among all of the Departments big and proud components. Department
leadership has done a good job at bringing the various components
together to respond to major crises, but coordination on day-to-day
issues is very much lacking. The St. Elizabeths Campus project, by
bringing together the leaders of all of DHS's components under one
roof, is critical to addressing this larger Departmental challenge.
Placing component and Departmental leadership in the same office space
will, I believe, go far in building a unified organizational culture
and providing daily opportunities for DHS components to work together
cooperatively.
Question 2a. How would you compare the creation and maturation of
the Department of Homeland Security to date to that experienced by the
Department of Defense in the decade after its establishment?
Do you believe that now, almost 10 years after its creation, the
Department should have matured more quickly and its components should
be operating more effectively and efficiently?
Answer. The Department of Defense's history illustrates just how
difficult integrating all of the components at DHS will be. When DoD
was formed in the late 1940s out of the Department of War and the
Department of Navy, both of which had been established in the 1700s,
DoD at least had the advantage of an existing unified office space and
the recent experience of coordinating operations during World War II.
All the same, it took years for DoD's leadership to establish its
authority within the entire Department. As late as the Cuban Missile
Crisis in 1962, Secretary McNamara's authority over the Navy was still
in doubt. When the Secretary asked Admiral Anderson:
``what would happen if a Soviet ship refused to stop or resisted
boarding. Anderson answered angrily, `This is none of your goddamn
business. We've been doing this since the days of John Paul Jones, and
if you'll go back to your quarters, Mr. Secretary, we'll handle this.'
''--Dobbs, One Minute to Midnight: Kennedy, Khrushchev, and Castro on
the Brink of Nuclear War (2008).
I'm quite confident that today, just 10 years into the Department,
no DHS component head would dare to say that to the Secretary of
Homeland Security, even though several of the components have been
carrying out their missions as long as the Navy.
Question 2b. How much longer is the argument that bringing together
so many Federal agencies a legitimate explanation for the Department's
shortcomings?
Answer. The understandable challenges of post-merger integration at
DHS, however, do not excuse component or Departmental leadership from
fulfilling their missions. Responsibility for building the Department's
capacity and accomplishing its objectives still has to lie with
individual components or offices at DHS. To the extent that individual
parts of DHS are underperforming, they should be held individually
accountable for making the necessary programmatic and staffing changes
to turn the Department around.
Questions From Chairman Peter T. King for Frank J. Cilluffo
Question 1. Will you please share your views on the importance of
the completion of the St. Elizabeths project to the Department's
efforts to consolidate operations and its potential impact on the
Department's performance?
Answer. While I am not fully up to speed on all of the developments
surrounding the St. Elizabeths project, I am of the view that
consolidating operations in a single location could have a range of
salutary benefits, including the prospect of synergies between and
among offices and individuals that derive simply from physical
proximity (through increased daily interactions, etc). In addition to
tangible advantages, such as the facilitation of communications between
and among offices and individuals, there are likely to be intangible
advantages as well, such as a greater sense of unity of mission and the
boost to morale that may occur as a result of co-location (which may
engender a greater sense of esprit de corps).
However, there are a range of factors that may affect the timing of
completion of the St. Elizabeths project, including of course the
current budgetary situation; hence it may be some time before the
project's benefits come to fruition. Let me underscore, though, that
future developments should not come at the expense of the Department's
operating budget. Having said that, perhaps the most forceful and vivid
argument in favor of timely completion of the St. Elizabeths project is
as follows: Just imagine the Department of Defense without the
Pentagon, or the CIA without the George (H.W.) Bush Center for
Intelligence in Langley, Virginia.
Question 2a. How would you compare the creation and maturation of
the Department of Homeland Security to date to that experienced by the
Department of Defense in the decade after its establishment?
Do you believe that now, almost 10 years after its creation, the
Department should have matured more quickly and its components should
be operating more effectively and efficiently?
Question 2b. How much longer is the argument that bringing together
so many Federal agencies a legitimate explanation for the Department's
shortcomings?
Answer. There are certainly some similarities between the
Department of Homeland Security and the Department of Defense in the
context described above (creation and maturation a decade after
establishment). In both instances, it took time to synchronize each of
the following--operations, planning, strategy, etc.--from an
organization-wide perspective. Likewise, both cases evidence the pace
at which a cohesive organizational culture takes shape; this is not
something that appears or grows overnight.
Notably, for the Defense Department, thinking purple is a mindset
and action posture that took time to cultivate and instill; and even
then, in order to genuinely root itself required legislation (the
Goldwater-Nichols Department of Defense Reorganization Act of 1986) and
a supporting incentive structure that tied education and training,
interagency rotations, promotion and professional advancement to
``jointness.'' Given that DHS initiatives in the realm of education and
training, for example, remain nascent, it is no surprise that there are
still some bumps in the road when it comes to execution and
implementation in an effective and efficient manner. On paper and in
principle, 10 years may seem like a long time. Yet that first decade of
DHS' existence has been marked by unprecedented and almost constant
challenges. The fact that DHS was created at a time of crisis, and also
evolved in such a climate, suggests that an extended interval may be
warranted in order to judiciously evaluate its progress.
Having said that, DHS as an enterprise needs a sharper focus and a
greater prioritization of its activities, to include more and better
alignment of budgets with priorities. In addition, DHS has yet to
define its Office of the Secretary, writ large. Compare the Defense
Department, whose counterpart Office for Policy (OSD/Policy) for
example, serves a robust and genuine Department-wide, cross-cutting
function. This is the bar which DHS should, and must, aim to reach.
Indeed, the Defense Department today is the gold standard when it
comes to plans and planning, after-action reflection, and a range of
other matters. Both regional and functional/thematic approaches to a
range of complex challenges are successfully integrated and
incorporated into outputs, including budgeting for future years. Yet
there was a time when DoD's ability to bring these various pieces
together so effectively was in some question; and this was so despite
the fact that military endeavors permit a type of mandating vis-a-vis
Service members that civilian entities do not. The challenge at hand is
thus compounded: While DoD is founded upon the science of command and
control, DHS must rely instead on cooperation and coordination, and the
art of persuasion, to successfully achieve its ends.
Accordingly, I would submit that DHS remains a work in progress,
but one that must be evaluated in context, with due regard for the
substantial challenges that the Department has faced in past, and which
it will continue to face in future--including an inhospitable climate
of financial austerity, coupled with a rapidly evolving threat spectrum
that encompasses both cyber and kinetic components.
Questions From Chairman Peter T. King for David C. Maurer
Question 1. Will you please share your views on the importance of
the completion of the St. Elizabeths project to the Department's
efforts to consolidate operations and its potential impact on the
Department's performance?
Answer. We have previously reported that consolidation or co-
location of Federal Government offices or functions--a goal of the St.
Elizabeths project--may result in several benefits, including more
effective and efficient operations. In 2011, we reported that co-
locating services can result in improved communication among programs,
improved delivery of services for clients, and elimination of
duplication.\1\ For example, programs can be co-located within one-stop
centers or electronically linked, which affords the potential for
sharing resources and cross-training staff. In 2006, we reported that
DHS's plans to co-locate its headquarters, its component headquarters,
and their respective staffs and operations centers at one location
could further enhance collaboration among DHS's component agencies.\2\
DHS has also identified that consolidating most of its headquarters
operations at St. Elizabeths would enhance communication, increase
efficiency, facilitate mission integration, and foster a ``One DHS''
culture.
---------------------------------------------------------------------------
\1\ GAO-11-92.
\2\ GAO-07-89.
---------------------------------------------------------------------------
However, given the constrained budget environment, the future of
the St. Elizabeths project is uncertain. In December 2011, DHS
estimated the project would take 4 to 5 years longer to complete and
cost about $600 million to $700 million more than originally planned,
largely due to shortfalls in funding. At that time, DHS estimated that
the project would be completed in 2020 or 2021. In March 2012, DHS
reported that it was in the process of revising its plan of options for
completing the St. Elizabeths project, and would continue analyzing
options throughout the summer. One option, which includes large
segments based on the original construction plan, would take 6 years
longer to complete and cost more than $700 million more than originally
planned. Under this option, DHS estimated planned construction will be
completed in 2022 at an overall cost of about $4 billion.
In addition, while headquarters consolidation may result in gained
efficiencies, under DHS's current plan, not all headquarters offices
and components will be located at St. Elizabeths. For example, although
all of the Secretary's office and the Federal Emergency Management
Agency and the U.S. Coast Guard headquarters staff will be relocated,
only the headquarters leadership of five major DHS components--U.S.
Immigration and Customs Enforcement, U.S. Customs and Border
Protection, Transportation Security Administration, U.S. Secret
Service, and U.S. Citizenship and Immigration Services--will be moved.
Headquarters staff from these five components will remain in other
locations around the National capital region, which limits the
potential benefits of consolidation.
Finally, since the planned completion date of the St. Elizabeths
project could be 10 years in the future, DHS will not reap the planned
benefits of consolidation for some time. During the interim, we believe
DHS should continue to focus on executing its plans for addressing
GAO's designation of implementing and transforming DHS as a high-risk
issue. Doing so will enhance the management platform for the entire
Department and better position DHS to carry out its various missions in
a more efficient and effective manner.
Question 2a. How would you compare the creation and maturation of
the Department of Homeland Security to date to that experienced by the
Department of Defense in the decade after its establishment?
Do you believe that now, almost 10 years after its creation, the
Department should have matured more quickly and its components should
be operating more effectively and efficiently?
Question 2b. How much longer is the argument that bringing together
so many Federal agencies a legitimate explanation for the Department's
shortcomings?
Answer. As DHS continues to implement plans to address its long-
standing management challenges, it can learn from the experience of
other departments, including the Department of Defense (DoD).
Specifically, since its creation in 1949, DoD has worked to unify the
Department, enhance its management practices, and foster a joint
approach to operations and decision making. However, it is also
important to note that some of DoD's experiences may not be appropriate
for DHS. For example, as of October 2012, 63 years after DoD's
creation, it remains on GAO's high-risk list for seven management-
related topics, including financial management, weapon systems
acquisition, and business systems modernization. In addition, several
important aspects of DoD's organization and approach are devoted to
deterrence, combat operations, and other National security missions
that, while complimentary to DHS's homeland security focus, differ
significantly from the day-to-day operations and requirements of DHS's
components. DHS can certainly learn from DoD's experience, but should
exercise care in appropriately selecting and applying those lessons
that can be best applied to DHS.
Prior to DHS's creation, we reported that building a common,
unified Department from several legacy agencies represented a
significant challenge that would take several years to achieve.\3\ This
has proven to be the case. DHS has remained on GAO's high-risk list
since it began operations in 2003.
---------------------------------------------------------------------------
\3\ GAO-03-260.
---------------------------------------------------------------------------
Since its creation, DHS has implemented key homeland security
operations and achieved important goals in many areas to create and
strengthen a foundation to reach its potential. DHS has made important
progress, particularly on the mission side. For example, DHS:
Implemented the U.S. Visitor and Immigrant Status Indicator
Technology program to verify the identities of foreign visitors
entering and exiting the country by processing biometric and
biographic information;
Developed and implemented Secure Flight--a program for
screening airline passengers against terrorist watch list
records--and new programs and technologies to screen
passengers, checked baggage, and air cargo;
Assessed risks posed by chemical, biological, radiological
and nuclear threats and deployed capabilities to detect these
threats; and
Created new programs and offices to implement its homeland
security responsibilities, such as establishing the U.S.
Computer Emergency Readiness Team to help coordinate efforts to
address cybersecurity threats.
But at the same time, our work has identified three key themes--
leading and coordinating the homeland security enterprise, implementing
and integrating management functions for results, and strategically
managing risks and assessing homeland security efforts--that have
impacted the Department's progress since it began operations.\4\ DHS
had successes in all of these areas, but our work found that these
themes have been at the foundation of DHS's implementation challenges
and need to be addressed from a Department-wide perspective. As DHS
continues to mature, more work remains for it to strengthen the
efficiency and effectiveness of those efforts to achieve its full
potential.
---------------------------------------------------------------------------
\4\ DHS defines the homeland security enterprise as the Federal,
State, local, Tribal, territorial, non-governmental, and private-sector
entities, as well as individuals, families, and communities, who share
a common National interest in the safety and security of the United
States and the American population.
---------------------------------------------------------------------------
Of particular note, DHS continues to face several management
challenges. For example, DHS's major acquisitions programs face
challenges that increase the risk of poor outcomes, such as cost growth
and schedule delays. Additionally, DHS has been unable to obtain an
audit opinion on its internal controls over financial reporting due to
material weaknesses in internal controls. Further, despite DHS efforts
to improve employee morale, Federal surveys have consistently found
that DHS employees are less satisfied with their jobs than the
Government-wide average.
DHS has several initiatives underway that, if fully implemented and
sustained, could help address the Department's management challenges.
For example, as I noted in my September 2012 testimony before this
committee, DHS's Integrated Strategy for High-Risk Management
identifies 18 key initiatives and corresponding corrective action plans
for addressing the Department's management challenges and improving
operational efficiency through better integration of people,
structures, and processes. This strategy provides a path for moving DHS
from where it is now--a large Department with several management
challenges--to where it wants to be--a unified Department, supported by
integrated management functions. DHS must now focus on executing the
strategy. Doing so is important because building a solid management
foundation will help DHS carry out its homeland security missions.