Sen. Rounds on cybersecurity, shutdown risks, and the future of defense

Well, Senator, thank you for joining us today. Appreciate it

Thank you. Appreciate the opportunity. Let's start with as bleak of an intro as we can here and panic over the impending shutdown

Talk to me about where you think we're going here and what do you think is going to happen

because there is a fair amount of concern, not just in this room, but on Capitol Hill

that we're headed towards an inevitable shutdown here. Okay, I can't speak on behalf of the House, and I won't try to

on behalf of the Senate, I think we agree that a shutdown is stupid

And I think we're going to try to do everything we can to avoid a shutdown. And I think, I'm on the Intel Committee, I'm on the Appropriations Committee

and I'm on the Armed Services Committee, all of which focuses back on the need to have a continuing flow of resources in

so that we don't have a shutdown, particularly when it comes to contracts

when it comes to the day-to-day operations. So number one, in talking with our leadership and talking with other members of the Senate, Republican and Democrat alike

there just simply is no desire on our part to get to a shutdown

And I think our leadership team is one that is focused on how do we get past that before we get to the crisis point

So we've got appropriations, which we're moving through right now. We've not had appropriate, in like 18 years, we haven't had as many of the appropriation bills to the floor of the Senate as what we've already got now

We're going to have more next week that will be coming through. This week we're going to be doing the NDAA, the National Defense Authorization Act

We've got our first manager's package is being debated right now. We'll have another one, I suspect, at least another one for sure

It's one of the few bills, as you may know, that for like 64 or 65 years in a row, it passes every single year

So anybody that's got a special provision someplace, they want to find a way, if at all possible, to attach it to the NDAA

because it's a piece of legislation that actually acts the way Congress is supposed to act in the first place

which is to do legislation. But for right now, in the Senate, we are working together

We are finding a path forward, and I'm optimistic that we can avoid a shutdown

So we heard from the majority leader today that he's thinking that there may be a short-term CR deal or something like that

But one of the things that struck me is he said he wants to see what happens with appropriations over the next few weeks

So, Tom, you mentioned this backstage. You think that we're going to see some significant movement in the next few weeks here

Yeah, I do. Look, I think there is a desire on the part of members to actually have an impact on what we're going to be spending at the federal level

Now, there's disagreement between those who want to spend more and those that want to spend less

But when the Appropriations Committee comes out with levels of 25 to 2 and 24 to 3 on the 12 appropriation bills, that tells you there is a desire to find a path forward that will avoid a shutdown

And the fact that the different subcommittee chairmen have been working now on, even though they got into the ballgame late because the president didn't deliver his stuff over to us until 8

But the fact that it's there and we've worked our way through it, and even before the August recess, we had a number of the hearings already completed and stuff on the floor of the Senate

It tells you that there is a desire, Republican and Democrat alike, to find a path forward so we don't have a long-term continuing resolution

We need a short term just because of the limited amount of time on the floor of the Senate to actually work our way through each of those separate bills

When we get to that stage, and I think Senator Thune, as the leader, has honored his request

He told us to begin with he wanted to get back to regular order. He wanted to see the appropriations process work

And he has given us time on the floor of the Senate already before the August recess

He's going to give us more time here in September to get more of them done. But once again, you can have one or two people in the Senate that can delay a lot of stuff

if they're mad about something or if they're acting out. And there's always a few characters along the line

that will try to wedge as much as they can. We'll get through that. Bottom line, in the Senate, I firmly believe

that we will get the vast majority of the Senate appropriations that are going to be similar, not identical

but similar to the House appropriations in a timely fashion. I'm convinced we will need a short-term CR

sometime until November, mid-November, in that range. but that should give us enough time to get the vast majority of it done

The challenge we have is that the people that are really going to make or break this process

Mike, the Speaker in the House, is going to have to get an agreement on his group

In the Senate, Chuck Schumer and the President are going to have to have some kind of an agreement as well

because they determine whether or not you get the 60 votes as to whether or not you're going to get this deal done

I think our leadership team recognizes that and they're going to facilitate as much as possible getting this across the finish line

Can't guarantee it because there's other forces out there at work, but I'm pretty optimistic that we're going to at least get a fighting chance to get it done

So we should delay the full-blown panic for a week or two and then we can come back to it

Yeah, I think you can hold off on the panic for a little while. In the meantime, celebrate the National Defense Authorization Act

I think once again we're going to get that done in a timely fashion. and just the fact that we're actually trying to find a path forward in the Senate that seems to be moving

I think that says some good things about the process. Okay. Well, I'm going to come back to NDA in a minute

but I wanted to talk more broadly just about cyber threats and cybersecurity

As they said in the intro, you're the chairman of the subcommittee on cybersecurity for the Senate Armed Services Committee

I know at the start of the year you talked about, well, you put out a statement

said, we must make certain the Department of Defense has the personnel and tools to respond

swiftly and decisively to cyber attacks, as well as the ability to conduct offensive cyber

operations when the situation dictates. So my question for you is, how are we doing? I mean

how is that going? Do you feel like things are moving in the right direction? Because this is

one of the quickest moving threats quickest evolving threats that the Defense Department finds is the department up for keeping up with it Remember you have five domains now that we defending in

Air, land, and sea, space, and cyberspace. The area in which our adversaries are probably

going to be the most active will be in cyberspace, because it's the least expensive, and it is the most

and it's the easiest way to get inside all of the defenses and offensive capabilities that would be

and all of the other domains. And so for adversaries, particularly China, Russia, North Korea, Iran

they will focus on using cyber to get in and to try to get into our other offensive and defensive systems

The Dodon is huge. It has literally a million different entry points in and out

It's the one that they're going to try to get into to find out what they can. That is an ongoing thing

I do believe that we have the technical capabilities to defend the DOTAN, the defense network

The question is whether or not we have not only the capability but the capacity

And I think that's where we really need to work. It's one thing to have the capacity or the capability to do it

It's another thing to actually have the resources dedicated to having enough of the capability to defend everywhere

and from all angles. The other side of it is that if you're only defending

and you are not providing deterrence, at some point, all the bad guys got to do is get in once

and they can wreak havoc. So we also need to be able to deter

which includes having offensive cyber operations equal to or better than everybody else in the world

I think we've got a lot of that right now. The question is going to be, number one, when do you deploy it

And this is one of the things that is going to be an ongoing discussion always

At what point do you actually utilize an offensive capability? And once you've done it, do you have the other offensive capabilities

Because with cyber, once you use it, they can then patch against it

And at that point, then you've got to go out and find another way to get into other people's systems. So it's very selectively used

But we do have the capability. Now the question is, is the capacities

So we worry about that. The other thing I'm just going to share with you is this

I think it's more than simply defending the Dodon. It is also a matter of what happens if they get in

And I'll just tell you, I think China has come a long, long way in their offensive capabilities

And they've done it in such a fashion that it used to be you could find them pretty easy

because they would break things coming in and they didn't do a good job of hiding their tracks

But they're kind of like mice. And by that, I mean if you've got a farmhouse, they're going to try to find a way to get in

Once they get inside, it's tough to get them out unless you've got trackers inside that are constantly looking

So you have to have what I consider to be a tomcat on the job all the time looking through the farmhouse

to find out where that mouse is that got in because somebody left a door open

And the same thing within Dodon, the same thing within the other networks outside of the Department of Defense

You've got to have and be constantly on the look for the bad guys that have gotten inside the systems

You have to have both. And in the meantime, if you can keep the mice out

and chase them down before they ever get into the farmhouse, you're doing a lot better

So you better have the poison on the outside. You better have maybe a tomcat on the outside looking to find it

It's one of the reasons why we do what we call Defend Forward, where literally our guys

go out into other countries that have given us permission to look at their systems

They trust us. We go in, we find out where the adversaries have been trying to get in, we learn what

patches are necessary, and then we share that with the creators of those patches back in

the Western world. And it makes it more difficult for the adversaries to actually stay ahead of the guys that are

catching them. I'm going on, but this to me is really a fascinating part of it

It's fascinating stuff. What's the buy-in on this right now? Again, as chairman of the committee, when you're pushing this message out there

are you getting resistance from other lawmakers? Are you getting resistance from the DOD about the needs to focus in these areas

We try to do a... Every two weeks, I do an education seminar

And I bring in folks from the Department of Defense, sometimes from Homeland Security

and they will come in and sit down in a skiff and we invite staff members or other members of the Senate

and even in the House to come back in and we'll have 25 to 30 staff members or other members

come in and listen to what the threats are, what the challenges are, and then what we're doing about it

So you get an inside story anecdotally about the successes that we're having

but also then some of the challenges that we still face out there in terms of what China in particular is doing

they are very good at hiding their tracks. And everybody's got to recognize that

So we're doing this to educate other members so that they have a better sense of they do know what's going on

I think it's as much making it so that they're not afraid to ask the questions

And I tell them that my whole goal is to get out of the third grade

when it comes to cybersecurity and to help other people to get to that same stage

We don't have to be experts in terms of how you do it, but we have to understand what the threat is

So that's part of our role right now. And it has been very well received

and it makes it easier to get stuff through the Senate because when we start talking about the cyber threats out there

it's a matter of how quickly they can get a threat into our system

and how quickly we can detect it. The next step is how do you integrate artificial intelligence

AI, into that system. I call it agentizing it, where we want, we've got a system set up to actually find the bad guys

But we've got to make those decisions faster. And if you can use machines to make those

decisions faster to detect, you're better off because you've got to be faster than they

are to create a new one. So this is going to be an ongoing battle. We don't have an

end in sight but it a battle we have to win it a race that we have to win to always be faster at detecting them and faster at getting them out of the system than they can create a new way to get into our systems

Artificial intelligence is in the middle of it, so we've got stuff in the NDA this year

creating programs that will incorporate artificial intelligence or machine learning, if you prefer, into creating the software

and into integrating into all of our software ways to detect incursions

something that we've got to have. We're not going to be perfect at it, but we've got to get this rolling

And so far, we've had very good acceptance on the part of the rest of the United States Senate

and we believe in the House as well in incorporating AI as an agentized

an accelerator for making decisions about how we defend the grid. Well, that transitions right into the NDA again

So what else is in there? You mentioned that provision. Are there other provisions in there

that folks should be watching? And it sounds like you've got some good buy-in in the Senate, but are you having conversations with your counterparts in the House, and do you think these can survive the negotiation process

Yeah, look, I think we've had good cooperation in the House, and yes, I believe that they will survive

The House, the folks in the House get just as deep into it, if not deeper than what we do

A couple of areas. Number one, strategically, we've got to have an oversight committee that actually incorporates AI into a lot of different systems within the Department of Defense

a steering committee more or less that says, look, this stuff is here, it's for real, it's not going away

China's doing it, Russia's doing it, Iran, North Korea are doing it. We've got to be faster at it than they are

We've got to incorporate it and actually make it happen. A steering committee at the secretarial level that actually is responsible for making sure that AI is incorporated into our systems

The other piece of this is, for the warfighter, the practical side of this is that his systems

he is going to be subject to a kill web on the behalf of

if we ever get past the point where deterrence doesn't work, China's going to have a kill web

It's going to use multiple sensors, and they're going to have multiple ways of communicating

their plan to attack our good guys, and they're going to use weapon systems that are from multiple different vectors

That kill web is something that we've got to be better at. Number one, diffusing, taking out some of the communications in it

But second of all, our kill web, which is lots of different sensors

lots of different radars all communicating together to actually identify targets and then to allow the shooters to actually get to those targets

It's going to be complicated. It's going to get more complicated. But they're going to start taking out some of our systems, and we're going to have to redirect

You've got to use artificial intelligence in order to do that. You've got to be able to make the decisions more rapidly than we ever have before

And that's part of what cyber is going to be, and the cyber protection that we've got today is going to be there

So in that, we've also directed within the NDAA that you have to have these kill webs identified

you've got to have a way to incorporate artificial intelligence into that

We've directed that within it as well. The other piece on it is that you've got to have the manpower

And our young men and women, look, they get it. They're doing their best not to give away the secrets for how you..

They don't want to give information away. They try not to. But every once in a while, all of us can get caught in a fishing expedition, so to speak

where you think you're talking to somebody and you're not. You're actually talking to a bad guy

These folks, for the most part, they understand that. They do their best not to get caught in those very simple programs

But somebody along the way is going to, and at that point you've got to be able to detect it

and stop it before it gets into the bowels of the Department of Defense networks

That is part of the training that we continue to have. It's going to be directed within the NDAA as well

to make sure that we are training people appropriately in those areas. So not just something high level where we're looking at these big problems, but really something that's got to go force wide for a level of education there

Yeah, and look, they're not that far off now. I mean, these kids, they've grown up with it

They understand it. They know that the bad guys are out there. They saw it in terms of all the stuff that you'll see on your commercial applications today where there's always somebody trying to get you to give up a bank account or trying to give you out information about what you're doing and so forth

They've lived with it. it's up to us to try to say, look, it's a matter of you can't give out your personal information

Look, if you're wearing a Fitbit and you walk into a classified setting with one of those on

they transmit. You can't do that. So we've got detection systems to try to find that kind of

stuff. If you're out and you're all about and you're running around, I think we've talked about

the fact that sometimes on those items that will transmit, other people can see where you're

gathering. Well, we know that when you're gathering a whole lot of people together

if the bad guys can see where you're gathering, you become a target. So those types of things

we have to continue to identify and pick out and defend against without getting into

something that I shouldn't talk about. I don't know. Please feel free

Back on the AI piece, before we get too far away, one of the challenges the Defense Department has always had

is the size and how quickly they can turn that chip around

So when you're looking at AI, which is a field right now that seems to be changing exponentially from day to day

how do you make sure that you're creating a system that can respond that rapidly, that can keep up with it

You mentioned the idea of an oversight board that's getting into that, but oversight boards can also be slow and cumbersome when you get to that

So how do you, from a legislative side, try and institute something that can be that adaptable and fast-moving

It's not a one-shot walk-away deal. It's a constant reminder. It's a constant asking the question

question, it's a due diligence thing of this is our job to

continue to remind the Department of Defense that this has got to be top of order it got to be top of attention And it impacts all of the other domains because cyber influx or it is into the middle of all of the other stuff The

bad guys really are there. So it's just a matter of due diligence and it's a matter of

reminding them and it's a matter of not letting our guard down. And human nature says, yeah

I just did it, I just passed great legislation. But then you have to take the next step, which is, so did the legislation actually get followed up on

What have you done? When have you done it? Did you get the money? And that's one of the things I like is, now I'm on the Appropriations Committee

so number one, we can figure out what the bad guys are doing in intel

Number two, we can figure out what weapons systems or capabilities we need in armed services

And number three, on Appropriations, we can make sure that if we're authorizing something

we are appropriating correctly to get the authorization in place. But you need all three

You've got to know what the bad guys are doing. You've got to know what our capabilities are

And then you've got to make sure that you actually authorize and appropriate the money to do it

But the next piece on it then is, did we do our due diligence

Did we go back and say, hey, have you got this done again? Have you fixed it

Are you continuing to upgrade it? Where's the upgrade? Why hasn't it been done

And that's our role. I don't think Congress has done a good job of that in the past, and that's on us

But we've got to be able to push back and to remind them that that's our job as well

almost as a board of directors saying, tell us what you've done and show us that you've done it correctly

But if we let our guard down, if we get lax, that's when problems are going to happen

because human nature says they're going to go on and they're going to be focused on whatever we focus on next

We just have to continue in Congress to continue to remind, continue to push, continue to ask the questions, and do the follow-ups

So that's the oversight piece. You mentioned earlier there is a challenge with the resourcing piece of it, too

What is the stumbling block there? Because it sounds like there is, at least when you get a chance to talk to folks, there is the idea of buy-in there

But, you know, this still does not fit into the traditional model of how we fund the Defense Department. Right

The way I look at it is this. We're going to spend a trillion dollars a year in defense of our country

But it goes to the places where we think it should go

but we've got to continue to look and make sure that strategically

sometimes that exotic piece or the thing that you think is exotic today

is tomorrow an expected item that has to be in place. an F-35 fighter. People look at that and they say, my God, those things are expensive

But if you've got a series of F-35 fighters that are now in the third and fourth generations on this system

these things can detect passively what we didn't used to be able to do

and they can share it instantaneously with folks on the ground about what the battlefield is looking like

Now, it may sound like, well, we're spending a lot of money there, But if you can get that high-end product in place

whether it's in cyber detection or not, you save lives. We were talking with some folks today

Look, if you have a B-21 bomber, and the B-21 bomber is the most advanced weapon system

that I think we've ever developed. The capabilities on a B-21 bomber are unbelievable

but part of it is using cyber, the ability to communicate with lots of other assets

What does that mean in terms of one B-21 bomber and the capability that it might have to actually save an aircraft carrier

And so are we putting our money in those strategic areas that will save lives and save other assets for the next part of an ongoing fight

Where are we spending our money the best? And so when we talk about the resources, it's a matter not just of making the day-to-day stuff to make sure we've got the munitions, but it's also a matter of do we have the munitions in terms of the magazine, is the magazine big enough so that if you're going to have a weapon system out there, do you have enough of the anti-aircraft missiles

Do you have enough of the 155 shells? So you may have the capabilities, and you may have very advanced capabilities

but do you have enough of them to survive the first onslaught and get into the second one

And that's where I really look at it and say you need both the high-end technical capabilities

to be the best at it and to save lives, but you've also got to allow those same soldiers to have enough ammo

to actually get through not just the first 10 days, but an extended period of fighting as well

All right. We're almost out of time here, but your staff did promise me that you would tell us the exact day the NDA will be finished this year

So if you could just let everybody know, that'd be. You said you're pretty optimistic that's going to move ahead now

Are you any reason to think that this is going to be the year that that 60 plus year streak ends and that we don't have an NDA

No, look, I tell people, behind closed doors, it's really difficult to tell the Republicans and the Democrats apart when they're behind closed doors

The vast majority of the NDAA that we do in the Senate is behind closed doors

And it is a very, very good product to begin with. But other members believe in it as well, and they want to add to it

And the intel committee, I can tell you that behind closed doors, it's really difficult to tell the Republicans from the Democrats

National defense is critical, and we've got a good team in there

It's a matter of getting us to the point where we don't always feel like in the public

we have to be shirts or skins, and yet we're always pushed in that direction

because they always want to see the exciting clash between Republicans and Democrats

And I can just share with you, the vast majority of the good work that we do on intel and on armed services, it's done on a very bipartisan basis

All right. So I'm going to put you down for November 15th, then. Jump in and go

Senator, thank you so much. Appreciate the conversation here. And I'm looking forward to talking to you more in the future

Thank you, sir. Appreciate the opportunity. Thank you