Hearings
Hearing Type:
Open
Date & Time:
Wednesday, June 20, 2018 - 10:45am
Location:
Hart 216
Witnesses
Ambassador
Victoria
Nuland
Chief Executive Officer
Center for a New American Security
Full Transcript
[Senate Hearing 115-579]
[From the U.S. Government Publishing Office]
S. Hrg. 115-579
OPEN HEARING: POLICY RESPONSE TO THE
RUSSIAN INTERFERENCE IN THE 2016 U.S. ELECTIONS
=======================================================================
HEARING
BEFORE THE
SELECT COMMITTEE ON INTELLIGENCE
OF THE
UNITED STATES SENATE
ONE HUNDRED FIFTEENTH CONGRESS
SECOND SESSION
__________
WEDNESDAY, JUNE 20, 2018
__________
Printed for the use of the Select Committee on Intelligence
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.govinfo.gov
_________
U.S. GOVERNMENT PUBLISHING OFFICE
30-501 PDF WASHINGTON : 2019
SELECT COMMITTEE ON INTELLIGENCE
[Established by S. Res. 400, 94th Cong., 2d Sess.]
RICHARD BURR, North Carolina, Chairman
MARK R. WARNER, Virginia, Vice Chairman
JAMES E. RISCH, Idaho DIANNE FEINSTEIN, California
MARCO RUBIO, Florida RON WYDEN, Oregon
SUSAN COLLINS, Maine MARTIN HEINRICH, New Mexico
ROY BLUNT, Missouri ANGUS KING, Maine
JAMES LANKFORD, Oklahoma JOE MANCHIN III, West Virginia
TOM COTTON, Arkansas KAMALA HARRIS, California
JOHN CORNYN, Texas
MITCH McCONNELL, Kentucky, Ex Officio
CHUCK SCHUMER, New York, Ex Officio
JAMES INHOFE, Oklahoma, Ex Officio
JACK REED, Rhode Island, Ex Officio
----------
Chris Joyner, Staff Director
Michael Casey, Minority Staff Director
Kelsey Stroud Bailey, Chief Clerk
CONTENTS
----------
JUNE 20, 2018
OPENING STATEMENTS
Burr, Hon. Richard, Chairman, a U.S. Senator from North Carolina. 1
Warner, Mark R., Vice Chairman, a U.S. Senator from Virginia..... 2
WITNESSES
Nuland, Ambassador Victoria, Former Assistant Secretary of State
for European and Eurasian Affairs.............................. 4
Prepared statement........................................... 7
Daniel, J. Michael, Former White House Cybersecurity Coordinator
and Special Assistant to President Barack Obama................ 10
Prepared statement........................................... 13
OPEN HEARING: POLICY RESPONSE TO THE
RUSSIAN INTERFERENCE IN THE 2016 U.S. ELECTIONS
----------
WEDNESDAY, JUNE 20, 2018
U.S. Senate,
Select Committee on Intelligence,
Washington, DC.
The Committee met, pursuant to notice, at 11:05 a.m., in
Room SH-216, Hart Senate Office Building, Hon. Richard Burr
(Chairman of the Committee) presiding.
Present: Senators Burr, Warner, Risch, Rubio, Collins,
Lankford, Feinstein, Wyden, Heinrich, King, Manchin, and
Harris.
OPENING STATEMENT OF HON. RICHARD BURR, CHAIRMAN, A U.S.
SENATOR FROM NORTH CAROLINA
Chairman Burr. I'd like to not only welcome our witnesses,
I'd like to apologize to our witnesses for the hour delay.
Unfortunately, neither the Vice Chairman nor I have any control
on the floor schedule for votes. And we had a couple snuck in
on us, and it may not be the last time today. But I'll do
everything I can to navigate us through this open session, and
then the closed session, as quickly as we possibly can.
I'd like to welcome Ambassador Victoria Nuland, former
Assistant Secretary of State for European and Eurasian Affairs,
and Michael Daniel, former special assistant to the President
and cybersecurity coordinator at the White House. I thank both
of you for making the time for us today.
Today's hearing is the next step in our efforts to fully
investigate and explain how Russia interfered in the 2016 U.S.
elections, how we reacted, and more importantly, what we've
learned. Earlier this year, the committee moved quickly to
discuss with the American people the threat to the voting
system, and we welcomed legislation that sent urgent assistance
to the states.
We thoroughly reviewed the Intelligence Community
Assessment on Russia Interference produced in November of 2017,
and all the sources that underpin it, and held a closed hearing
with the agency directors responsible for that product. The
committee is ready to finalize our assessment of the Obama
Administration's response to the Russian interference. And
today's hearing will be the first of a series of several
capstone events. We have invited Ambassador Rice and her
deputies to join us in a few weeks. We've also invited former
leaders from the FBI and the Department of Justice to testify
again in July.
Today, Ambassador Nuland and Mr. Daniel have joined us for
this important hearing. You sat on different sides of the same
policy debate. Mr. Daniel sat atop the government's cyber
apparatus, seeing indicators of Russian hacking activity unfold
both here in the U.S., as well as in countries like Germany and
Ukraine. Meanwhile, Ambassador Nuland sat at the State
Department watching Moscow aggressively pursue its interest in
Ukraine, Syria, and elsewhere.
Russia's interests and methods were a carryover from the
old Soviet Union that we knew, but with a new twist. The
Kremlin began to use social media, hack and leak operations,
and quasi-governmental agencies to discredit enemies and to
weaken adversaries. Ambassador, you and your team at State were
well-versed in the Russian toolkit. And you understand Putin's
political will to use those tools. In effect, to use the
metaphor, each of our witnesses will be touching a different
part of the same elephant. Today, we'd like to know when the
bigger picture emerged and how policymakers responded. Did they
seek to deter Russia from undermining our democratic
institutions? Did they take action? If not, what held them
back?
We as a committee have benefited from the insight of many
from the Obama Administration. I'd like to thank them publicly
today on behalf of the committee for coming voluntarily to talk
to our staff and for their candid interviews and testimony.
They consistently said that they were operating in the summer
and fall of 2016 without a playbook. This was a new threat with
an undefined set of rules. It seemed they struggled to balance
competing priorities.
They wanted to warn the Russians to stop interfering, but
avoid the appearance that the White House was putting a thumb
on the political scale during an election year. They wanted to
warn the public about Russia's efforts, but not carry Russia's
water for them. They wanted the states to rapidly secure voting
systems, but not alienate State election officials or undermine
public confidence. We can look back with the benefit of time
and distance and talk about what could have been done. As we do
so, we must also look forward a few short months to 2018
elections and forward a few more short years to the 2020
elections. More broadly, we now realize that the goal of the
Russian campaign was to fracture our society and cause general
discord using all the tools that our technologically connected
society offers. Our focus should be to prevent, to deter, and
to harden both our elections and our society for the future.
Again, I want to thank both of you for being here, and I
turn to the Vice Chairman for any comments he might have.
OPENING STATEMENT OF HON. MARK R. WARNER, VICE CHAIRMAN, A U.S.
SENATOR FROM VIRGINIA
Vice Chairman Warner. Thank you, Mr. Chairman, and again,
welcome to our witnesses. We appreciate your recapping of how
much good work this committee has done on a bipartisan basis
and we look forward to continuing that work.
At the January 2017 assessment, the Intelligence Community
assessment correctly judged the Russian efforts to influence
the 2016 presidential elections, quote, ``demonstrated a
significant escalation in directness, level of activity, and
scope of effort compared to previous operations.''
As we examine the policy questions faced by the Obama
Administration and this Congress during the 2016 campaign, it's
evident that, in many ways, we were caught flat-footed at the
outset and our collective response was inadequate to meet
Russia's escalation. At the end of the day, it's hard to see
the Russian influence campaign as anything but a success for
Vladimir Putin. Today is about learning from these past
missteps, because we all know on a going-forward basis we have
to do better.
Now, let me stipulate upfront, there are far too many
Monday morning quarterbacks around these days. However, looking
back, we should not have been surprised about how far Russia
was willing to go. The red flashing signals were all over
there. Allies in the Baltics and Eastern Europe had long
experienced aggressive Russian cyberattacks and disinformation
campaigns. Ukraine in many ways a testbed for many of these
tactics we saw in our own elections. Ambassador Nuland herself
was a firsthand witness to the weaponization of leaks in 2014
when her private conversations were intercepted and released.
Separately, I believe we profoundly missed the mark in
tracking and responding to influence operations on our social
media platforms. Russian-backed operatives were wreaking havoc
in spreading disinformation across Facebook, Twitter, YouTube,
and other platforms. We, both at the governmental level and at
the company level, were unprepared to address those attacks.
Even to this day, over a year-and-a-half later, I have
significant concerns that we are still behind the eight ball in
effectively combating these efforts.
Despite perhaps being too slow to see the threat initially,
it's not true that the Obama Administration stood idly by and
did nothing. Numerous steps were taken, both public and
classified, to try to better understand and defend against the
Russian activities and objectives.
Director Brennan issued a direct warning to his Russian
counterpart. The Administration engaged the cyber hotline with
Russia for the first time ever to warn the Kremlin against
further action. DHS attempted a series of engagements with
State election officials. President Obama himself took the
warning directly to President Putin at the September G20 in
China.
Finally, in what should have been a much more significant
event, the Administration attempted a fairly unprecedented
public statement attributing recent hacks and leaks to Russia.
But, as we all know, that joint DNI-DHS statement was quickly
overshadowed, as the media diverted much of its attention to
the Access Hollywood video and the WikiLeaks release of Podesta
emails. It remains unclear if the WikiLeaks release was
actually timed to undermine the joint statement. It is perhaps
impossible to know whether these steps the Administration took
ultimately deterred additional and even more aggressive action
by the Russians. However, with the benefit of hindsight, it is
evident that we could have done more to push back in the heat
of the campaign.
But the Administration was not solely responsible here. Two
factors made an already difficult policy challenge much more
problematic. First, as we all know and have heard in testimony,
the White House was concerned that engaging more publicly would
be seen as trying to put its thumb on the scale of the
election. No one did more to fan the flames of what he termed,
quote, ``a rigged election,'' than Candidate Trump. The Trump
campaign and its allies cravenly painted any attempt to call
out Russia for its attacks as a political effort to help
Clinton and to steal an election. Those irresponsible
statements further reinforced the dangers of speaking publicly
by the Obama Administration.
In addition, any fair scrutiny of policy decisions during
the campaign needs to also address congressional inaction.
Congress, all of us, need to look ourselves in the mirror and
see whether we could have done better, in particular the lack
of a bipartisan congressional warning to Russia. And the weeks
of delay it took to even get a letter out to State election
officials now looks like a failure to put our democracy ahead
of politics.
Again, I appreciate the witnesses' willingness to come
forward and relive 2016. But as the Chairman mentioned, 2018 is
already upon us, and this time there's no excuses for missing
the threat. We've heard unanimously from the Intelligence
Community that Russia continues to try and undermine our
democracy. They are attacking us and our allies on a regular
basis even today. If we allow this to happen again, if we don't
do all we can in a united front to protect our democracy, then
shame on all of us. I hope to hear from our witnesses today
some thoughts on where we go from here. The threat, as we all
know, is real. The time to act is urgent.
And, again, thank you, Mr. Chairman. I am eager to hear
from our witnesses.
Chairman Burr. I thank the Vice Chairman. And before I turn
to the ambassador for opening remarks from both her and Mr.
Daniel, let me say that we don't have a full complement today,
not because they're not interested, but because we're in
competition with a Rules Committee hearing on elections, the
first one, a meeting at the White House, and numerous other
things. So, I apologize to you.
I also say this to members. If, in fact, our delayed start
causes a conflict in your schedules, if anybody would just let
me know, I'll try to expedite recognition of you if that helps
alleviate anybody's problems with schedules.
With that, Ambassador Nuland, the floor is yours.
STATEMENT OF AMBASSADOR VICTORIA NULAND, FORMER ASSISTANT
SECRETARY OF STATE FOR EUROPEAN AND EURASIAN AFFAIRS
Ambassador Nuland. Thank you, Chairman Burr. Thank you,
Vice Chairman Warner, and members of this committee. I
appreciate the opportunity to appear before you today to
discuss the policy response to Russian malign influence in U.S.
politics.
As a citizen, as a 32-year veteran of the U.S. diplomatic
service, and as a regular target of Russian active measures, I
want to commend the leadership of this committee and all its
members for your thoroughness and your integrity in pursuing
your investigation into Russia's involvement in the 2016
elections. I especially commend the bipartisan spirit with
which you've done your work, which sets a powerful example in
this country.
When I testified before you in classified session last
summer, I put forward a number of recommendations regarding how
the U.S. government could organize itself and work with the
private sector to expose, deter, and defeat this threat to our
national security and our democracy. Rather than going
backwards into history, I'm going to focus my remarks on what
we can do. Since then, many of the ideas that I put forward a
year ago have been advocated publicly by others, including the
Atlantic Council, the Alliance for Securing Democracy at the
German Marshall Fund, the Belfer Center at Harvard, and in the
minority report of the Senate Foreign Relations Committee.
Russia, meanwhile, has not stopped its efforts to divide
our society and use our open system against us to spread false
narratives. There's every reason to believe the Kremlin will
again target our elections this fall and in 2020. Our major
technology companies whose platforms they exploit have all
taken some countermeasures but not enough. Other countries and
malign actors are now adopting and improving on Russia's
methodology. China, for example, now runs disinformation
campaigns and influence operations in Taiwan, Australia, and
other neighboring countries, and is working to acquire
information technology assets and data sets across Asia,
Europe, and the United States.
While the Trump Administration has taken some important
sanction steps to punish Russia for past actions, strengthen
Cyber Command, and harden our electoral infrastructure, it has
not launched the kind of presidentially led, whole-of-
government effort that's needed to protect our democracy and
security from malign state actors who are intent on weaponizing
information and the internet. We must urgently put the
policies, the funding, and the systems in place to speed our
ability to identify malicious activity, call it out, and take
countermeasures; to sharpen our deterrence toolbox so our
adversaries know that they will face crippling consequences; to
improve regulatory and legal standards to close the space that
bad actors exploit; and to lead a global campaign with allies
and partners to expose and defeat this threat together.
Today, I put forward five steps to protect our democracy,
improve deterrence, and blunt this new weapon in the hands of
any of our adversaries.
First, on the President's direction and with congressional
support, the Trump Administration could immediately establish a
multiagency fusion center modeled on the National
Counterterrorism Center, but smaller in size, to pull together
all of the information and resources of our government,
classified and open source, to identify, expose, and respond to
state-sponsored efforts to undermine American democracy through
disinformation, cyberattack, and abuse of the internet. All the
relevant intelligence and national security agencies should be
represented, as should the Treasury Department, the Justice
Department, and other agencies who have knowledge about how
dirty money and criminality often fuel these activities, and
with the tools to help with deterrence.
As this committee knows, much of our problem in responding
strongly and quickly enough in 2016 stemmed from insufficient
integration of information and policy options among government
agencies, which led to delays in attribution, slow response
times, and debates about the right overt and covert tools to
apply.
Second, the White House could establish and host a standing
U.S. public-private commission to combat internet abuse and
disinformation, inviting participation by all the major U.S.
technology companies with vulnerabilities and equities, the
academic community, and the private forensic experts in this
space. The commission would be charged with developing
technical, regulatory, and legal recommendations to protect the
integrity of the internet user experience and blunt the ability
of malign state actors to suborn democracy through the
internet. Done right, this commission could provide a protected
space for private sector stakeholders to share information and
experience with each other and with the government, and to
collaborate on responses and build campaigns of common action.
Third, and flowing from the second recommendation, the U.S.
government has to better advise, advocate for, and protect U.S.
companies when they do take bold and commercially costly action
to stand up to state sponsors of malign influence at home and
abroad. In weighing when and how to act, our companies often
face the threat of retaliation against their staffs and their
platforms, stiff fines, or even the closure of their operations
in countries that practice the dark arts of cyber and internet
abuse. Our companies need a place at State, at Commerce, in
this new commission to seek advice, pre-coordination, and rapid
support from the U.S. government when they take decisions to
resist foreign government pressure, when they close malign
accounts, and when they expose anti-democratic tactics.
Fourth, the President could appoint an international
coordinator to launch and lead a campaign to multilateralize
our efforts in this space with America's closest allies and
partners in line with the President's national security
strategy, which highlights the dangers to the U.S. and our
allies from this threat.
Fifth and finally, the Administration could put forward,
and the Congress could support, a significant budget increase
to strengthen U.S. capabilities in this area. The funding
should be targeted to appropriate U.S. agencies to strengthen
their forensic capability, shorten attribution timelines,
improve the government's ability to expose and debunk truly
fake news in real time, broaden public outreach to and
education of the American people about these threats, and
strengthen our stable of national experts in the field.
In the coming year, the Center for a New American Security,
which I lead, plans to join the community of think tanks
working on these issues. We will put special emphasis on
pulling together the best minds in industry, academia, and
government to craft full-spectrum deterrence strategies against
malign state actors in the cyber realm. This work can't replace
the responsibility of Federal and State government, but hope it
will help inform wise choices.
Again, thank you for inviting me to appear before you
today.
[The prepared statement of Ambassador Nuland follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Chairman Burr. Thank you, Ambassador. Mr. Daniel, the floor
is yours.
STATEMENT OF J. MICHAEL DANIEL, FORMER WHITE HOUSE
CYBERSECURITY COORDINATOR AND SPECIAL ASSISTANT TO PRESIDENT
BARACK OBAMA
Mr. Daniel. Thank you, Mr. Chairman. Thank you, Mr. Vice
Chairman and other distinguished committee members, for the
opportunity to come and testify this morning on the issue of
Russian interference in the 2016 election cycle.
Although ostensibly retrospective, understanding what
happened in 2016 is really critical to better protecting
ourselves in future elections and in future activities that we
do. And given that this committee has extensively reported on
this topic and those findings I very strongly support, I'm
going to keep my opening remarks at a very high level this
morning.
I think going into the late spring of 2016, we fully
expected Russian cyber-based espionage activities against our
major political campaigns. It had happened in previous election
cycles, and we assumed that it would happen again in 2016. But
by late June/early July, as stolen information began to show up
in public and as states began reporting suspicious activity
against some of their electoral infrastructure, we began to
realize that the Russians were doing something more than just
collecting intelligence.
They were carrying out operations aimed at the very least
at influencing our election and potentially even disrupting it.
But the true scope, scale, and breadth of this activity
remained unclear and actually developed over time, and in fact
this committee has contributed a lot to our understanding of
what was actually going on. But within the U.S. government, we
really developed two lines of effort in order to respond to
this activity. One was very public and outward-facing, and it
was designed to improve the security of our electoral
infrastructure across the board. The second was more behind the
scenes, and it was designed to respond to the actions that the
Russians were carrying out, to impose costs on them and to
deter future escalation or future actions.
So, the first line of effort, better protecting our
electoral infrastructure, was really focused on the State and
local electoral systems. But the first step was actually
deciding what it was that we were trying to protect. And given
that most of us at the Federal level didn't have a lot of
experience with how elections actually worked as a mechanical
thing at the State and local level, we all got a crash course
in how elections actually operate down at the State and local
level.
And we very quickly realized as part of that process that
the voting machines, while vulnerable, were not the most likely
vector for any Russian activity, nor was changing the outcome
of the election the most likely goal. Achieving that goal was
simply not feasible, as you've actually noted in some of your
reports. Instead, undermining confidence in the electoral
process and disrupting it were the more likely goals. So, we
then began to look for the points where the Russians could most
easily accomplish that goal, and that turned out to be the
points at which the electoral infrastructure touched the public
internet: voter registration databases, voter tabulation
reporting, and media reporting on election night.
And since State and local governments run the election
process in the U.S., by necessity our efforts then became
focused on providing assistance to the states. The Department
of Homeland Security spearheaded those efforts for the
Administration backed up by the Department of Justice and the
FBI. Over time, we also then began to shift our focus to
preparing for Election Day and being able to respond quickly to
any disruption that might have occurred. Fortunately, by the
time we got around to Election Day, none of what we feared
actually materialized. So, from that perspective, that turned
out to be a good thing.
On the second line of activity, pushing back on the
Russians and imposing costs, this line of effort was focused on
developing options for the decision-makers. The goal was to
respond to ongoing activity and to defer further escalation or
future activity. We used the normal NSC-led interagency process
to develop a suite of options to respond to this activity. One
of the key bodies that worked on that was the cyber response
group that I chaired within the White House, which had
representatives from all of the relevant agencies that could
have a role in developing and implementing response options.
The specific actions and options we developed were, and to
my knowledge remain, classified, other than those that became
public by necessity once they were implemented. However, I can
say that the options that we developed spanned the full gamut
of U.S. power, including diplomatic, intelligence, law
enforcement, economic, and cyber activities. Within these broad
categories, we created a range of potential actions, from low
risk/low impact, to high risk/higher impact options, as we
would for any national security issue. My responsibility in
that process was ensuring that the NSC principles, up to and
including the President, had a full range of options to
consider, along with the pros and cons of each of those.
Due to the significant concerns around escalation, the
overall geopolitical situation that we were in, the tensions
within the U.S. election, the presidential race that was
happening as both of you have noted, the desire not to do the
Russians' work for them by undermining confidence in the
electoral process, senior decision-makers proceeded carefully
and judiciously, and eventually we settled--eventually they
settled--on a set of options and actions that have been widely
reported in the press.
Now, not all of the options that we laid out were taken,
but that's not a surprise to anyone who's worked in the policy
process. That's how it works. Decision-makers never take all of
the possible actions that you develop.
In looking forward to the future, which is, I think, the
key aspect of what this committee is working on, now that the
Russians have proven that it can be done, we should expect not
only the Russians but others to follow their lead. We should
expect other nation-states and, frankly, other non-nation-state
actors to also attempt to do similar activities. And so, in
response, I think that we need to do several actions.
One is that we need to continue to invest in improving the
cybersecurity of our electoral infrastructure in its entirety
across the board. We need to figure out how to enable the
Federal Government to better support State and local
governments, because I think maintaining that State and local
control of elections is incredibly important. It's very central
to our system of federalism and democracy, and we need to
sustain that. But it's also not realistic to expect State and
local governments on their own to go up against nation-state
actors. So, we need to figure out how to enable the Federal
Government to assist those entities to better protect
themselves while enabling them to still maintain control of the
electoral process.
We should also, as Ambassador Nuland highlighted, invest in
our resilience to information operations, which is related to
but separate from these cybersecurity issues. Internationally,
we should continue to promote the idea that it is unacceptable
to surreptitiously interfere in another nation's electoral
process. The U.S. should continue to work with other allied
governments to identify, expose, and respond to Russian
activity in this area and embed it with our actions to deal
with other Russian activity. And we also need to maintain a
whole-of-government campaign to counter Russian cyber activity
across the board.
So those are my thoughts on where we need to head in the
future in order to continue dealing with this issue that I
think will be with us for all of our future election cycles,
and it's something we're going to need to learn how to deal
with and be able to counter as a Nation going forward.
Thank you very much.
[The prepared statement of Mr. Daniel follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Chairman Burr. Michael, thank you very much for that
testimony and to you, Ambassador.
The Chair would like to announce for members: I understand
that two votes are scheduled for about 12:30, so it's my
intention to finish this open session no later than 12:45. We
will immediately then, after completing the second vote, come
back for a closed session, and that will give our witnesses
time to do a choke and run on some lunch.
I'll recognize members by seniority for up to five minutes.
And the Chair would recognize himself.
Michael, let me just say, looking back, what seemed like
the right thing at the time, which was for the Secretary of the
Department of Homeland Security to declare that the election
system was critical infrastructure, in hindsight was the worst
thing we could have said to State officials because they took
it as the Federal Government taking over the election process.
So, we've tried to point some of these things out and need to
be sensitive in the future.
Ambassador, we've been told that all potential responses to
Russia's acts were on the table, most of them debated. And at
the end of the day, prior to the election, not the period in
between the election and swearing-in, really, the only big
thing that was done, the President contacted Putin personally
and raised this issue. One, is that an accurate depiction that
we have been given by people that we've interviewed? And, two,
what should have we done that would have changed where we are
today?
Ambassador Nuland. Thanks, Chairman. In this open session,
let me say I assume you're talking about what was done with
regard to the adversary, with regard to Russia, rather than the
things that Mr. Daniels has talked about with states, et
cetera.
Chairman Burr. Yes, Ma'am.
Ambassador Nuland. So, it's accurate to say that, in
September, the President made a stern and personal warning to
President Putin, that there were follow-up conversations in
other government channels with appropriate counterparts
including use of some pre-existing channels that we had with
the Russians. But we did not take deterrent measures in this
electoral period.
There was a lot of work going on, I would say, from June
onward as to what kinds of deterrent measures we could take
either in the electoral period or afterwards. A lot of that
work informed what was done later in December. But for a
variety of reasons--some of them you highlighted yourself, some
of them Mr. Daniels mentioned, there are others that are more
classified--the President chose to launch the full
investigation and response after the election.
I think, you know, it's fair to say that all of us in the
process assumed that what was done in December-January of 2016-
2017 would be a starting point for what the incoming
Administration would then build on. So, I think there's still
plenty of work to be done.
Chairman Burr. We would agree with you. Why do you think it
is Russia thought they could get away with treating the United
States just like the other countries that they meddled in, that
they really considered to be part of the Soviet Union?
Ambassador Nuland. You know, I think they saw and
increasingly understood the vulnerabilities in our democratic
system, that these same technologies and ways of communicating
that are so powerful in terms of the way we connect with each
other, also offered opportunities to turbocharge techniques
that they'd been applying even since the Soviet period to try
to cause dissent in U.S. politics, to try to pit us against
each other, and they got better and better at it. I think, as a
general matter, this Kremlin is highly opportunistic. It will
do--whether it's in their own country, whether it's in Ukraine,
whether it's in Europe, whether it's on other continents,
whether it's in the United States--they'll throw out lots of
chaff, lots of opportunities to probe, and when they feel a
weak spot, they'll push further and probe a little bit further.
There's a great quote attributed to Lenin: ``Thrust in the
bayonet. When you hit bone, stop. If you hit mush, push.'' And
I think they hit a lot of mush.
Chairman Burr. Michael, how exposed do you think that the
social media platforms make us in the future? And do you have
any confidence in the belief that they can self-police bad
actors?
Mr. Daniel. So, I think that, as with all of that kind of
technology, it's a double-edged sword, right? It provides a lot
of opportunity to get messages out very rapidly that are clear
and accurate, but it also provides a great opportunity for
misinformation and disinformation. I think that, on their own,
without assistance from not just the U.S. government but other
allied governments, it's going to be very hard for the social
media platforms to find all of the malicious actors. They're
actually quite good at finding a fair amount of it, but I think
that it's incumbent upon not just the U.S. government, but all
Western governments--democratic governments--to figure out how
to work with the social media platforms to better identify that
kind of misinformation and malign information that's on those
platforms.
Chairman Burr. We actually believe that there needs to be a
new type of collaboration between us and those companies, and
we're working on that.
Ambassador, I'm going to come back to you with a couple of
quick things, and I'll get into specifics on it when we get to
closed session.
At what point did you become aware of Mr. Steele's efforts?
Ambassador Nuland. Mr. Steele's efforts with regard to----
Chairman Burr. The dossier.
Ambassador Nuland. To the dossier?
Chairman Burr. Yes, Ma'am.
Ambassador Nuland. I was first shown excerpts from the
dossier, I believe, in mid-July of 2016. It wasn't the complete
thing, which I didn't see until it was published in the U.S.
press.
Chairman Burr. Sure. I know you've talked extensively with
our staff relative to Mr. Steele. Based upon our review of the
visitor logs at the State Department, Mr. Steele visited the
State Department briefing officials on the dossier in October
of 2016. Did you have any role in that briefing?
Ambassador Nuland. I did not. I actively chose not to be
part of that briefing.
Chairman Burr. But you were aware of the briefing?
Ambassador Nuland. I was not aware of it until afterwards.
Chairman Burr. Okay.
Vice Chairman.
Vice Chairman Warner. Thank you, Mr. Chairman. I'm going to
start with similar questions as the Chairman, but with a
slightly different approach.
I don't think enough was done, but there were a series of
actions taken. We had the President talking directly to Putin.
We had Mr. Brennan talking to his counterpart. There was the
first use of the cyber hotline. There was the October 7th ODNI-
DHS warning.
Do you think any of those actions resulted--and this is a
question for both of you--resulted in a diminution of the
Russian activities? Did they slow down anything? Or do you
think it was still full steam ahead? Or do you think if we had
not done those that the Russians might have even been more
nefarious?
Ambassador Nuland. I think it's certainly the case that it
was very important to tell the Russians at every level,
including the top level, that we were watching what they were
doing. Whether they slowed the Russian's roll, whether they did
less particularly after the President spoke directly to Putin
in early September, I don't know.
If you look at the record of their activity, they were
generally a little bit less active in September than they later
were in October. And then they particularly were at the end of
October, where they were quite active, when they thought that
the election might turn out differently than they previously
thought.
Vice Chairman Warner. Mr. Daniel.
Mr. Daniel. And I would generally agree with Ambassador
Nuland's remarks on that. I would draw a distinction between
when we saw a diminution of their cyberactivity aimed at the
electoral infrastructure, and now looking back we see very much
an increase in what they were doing on social media and the
influence operations.
So, I think my conclusion would be that they shifted their
focus away from pure cyber operations and more into the
information operations area as a result of what we were
communicating.
Vice Chairman Warner. But clearly, even the President's
warning, Brennan's warning, cyber hotline, DHS-ODNI public
warning, really didn't seem to have that much effect in terms
of diminution of their even more nefarious activities, I would
argue, both with social media and selectively leaking of
information that took place in October.
Ambassador Nuland. In my experience, the Russians and
particularly this Kremlin watch what we do more than what we
say. So active deterrence measures perhaps would have been more
effective.
Vice Chairman Warner. It appears to me--and again, for both
of you--that we were caught relatively flat-footed in terms of
how the Russians used social media. I would argue the companies
were caught flat-footed, as well, and part of this is due to
the fact that I think they exploited a seam between where
foreign agents impersonating Americans, but generating content
in Russia, delivering the content in America. That fell between
the cracks.
In light of the fact that we'd seen activities in Eastern
Europe, we've seen activities, again, Russians using social
media, do you have an explanation, do you have any--this is the
exact Monday morning quarterbacking that sometimes we'll do--of
why we were caught so flat-footed vis-a-vis social media now?
Ambassador Nuland. I think there are a number of
explanations, some of which we'll talk about in the follow-on
session. But the Russians were, over time, perfecting their
ability to target social media to specific political objectives
in their own country, in Ukraine, and then across Europe well
before 2016.
I think that some companies were aware of some abuse of
their platforms in other countries, but because they weren't
talking to each other, they weren't integrating what the
various companies were seeing, and developing a pattern. As the
Chairman said and I said to you last year, the private
companies were each touching a piece of the elephant and not
seeing the whole. I also think that there was a tendency in the
U.S. Intelligence Community to look only at classified
information. And the necessary integration of open source and
classified information was not happening the way it needed to.
So, we were as a government not as aware of what was happening
in the private sector.
Vice Chairman Warner. Mr. Daniel.
Mr. Daniel. And I would just, also, building on top of
that, my position was cybersecurity coordinator, focused on the
protection of information systems. We weren't set up then and
we aren't really set up now to have a focused effort within the
U.S. government to counter information operations, many of
which were not carried out through using malware or stealing
credentials. In many cases, for example, the Russian agents
that you talked about just signed up for Facebook accounts.
That's not a cybersecurity problem. That's an information
operations problem. And while those two things can often be
blended--and the Russians are very good at combining their
cyber capabilities with their information operations
capabilities--those are actually separate things and, in many
ways, require separate disciplines in order to counter.
Vice Chairman Warner. I know my time's about up. But you
just said certain companies were aware that Russians were
interfering prior to the election. What I think is remarkable
is that none of those companies acknowledged that ahead of
time. As a matter of fact, in our immediate aftermath of the
election, when public officials raised the concern that
Facebook and others could have been misused by the Russians,
actually the leadership of many of those companies dismissed
that notion wholeheartedly. And it literally was months and
months and months before these social media companies
acknowledged they'd been misused.
Thank you, Mr. Chairman.
Chairman Burr. Senator Risch.
Senator Risch. Thank you. First of all, Ambassador Nuland,
thank you for your well-thought-out recommendations. I think
those are serious and deserve serious consideration.
I want to summarize here a little bit. Both of you have
indicated, and I think it's well documented, that this whole
thing started in spring of 2016 and gradually grew through the
year, to the point where, in September at the G20 summit
President Obama confronted Mr. Putin and disclosed to him that
we knew what they were doing. Obviously, that was classified
information, but I am not criticizing him for that. That's a
President's job to do that. I think also, Ambassador Nuland,
your description is that confrontation may have slowed him down
briefly, but just briefly, and they continued on the direction
they were headed. Is that a fair statement?
Ambassador Nuland. That appears to be fair based on what we
know. Obviously, we don't have full knowledge of the Kremlin's
thinking.
Senator Risch. Okay, thank you. And one of the things that
puzzles me is that while the government--in fact, the next
month, in October, DNI went public with the fact that we knew
all about--we knew what the Russians were doing and people need
to pay attention to it, at least to some degree.
This is a question I have for you, Mr. Daniel, and this
puzzles me. There's a quote I want to read you from an article
that appeared of what happened in late August of 2016.
At his morning staff meeting, Daniel matter-of-factly said
to his team it had to stop working on options to counter the
Russian attack. Quote, ``We have been told to stand down.''
That's a quote from you. Daniel Prieto, one of Daniel's top
deputies, recalled, quote, ``I was incredulous and in
disbelief. It took me a moment to process. In my head I was
like, did I hear that correctly?'' End quote. Then Prieto
asked, quote, ``Why the hell are we standing down? Michael, can
you help us understand?'' End quote.
Is that an accurate description of what happened?
Mr. Daniel. So that is an accurate rendering of the
conversation at the staff meeting. But the larger context is
something that we can discuss in the classified session. But I
can say that there were many concerns about the widespread--how
many people were involved in the development of the options.
And so, the decision at that point was to neck down the number
of people that were involved in developing our ongoing response
options. And it's not accurate to say that all activities
ceased at that point.
Senator Risch. What about your area of supervision? Did it
completely cease as far as that was concerned?
Mr. Daniel. No. We shifted our focus in that September and
October timeframe to focus heavily on better protecting and
assisting the states in better protecting the electoral
infrastructure and ensuring that we had as great a visibility
as possible into what the Russians were doing and developing
our--essentially an incident response plan for Election Day.
Senator Risch. And you've described that. But as far as
your cyber response, you were told to stand down. Is that
correct?
Mr. Daniel. We were--those actions were put on the back
burner, yes, and that was not the focus of our activity during
that time period.
Senator Risch. What cyber options did you recommend? And
which ones were taken and which ones were rejected?
Mr. Daniel. Again, this is actually something we will have
to discuss in the classified session. And I am more than happy
to describe some of those there. But it was a full range of
potential actions where we could use to use our cyber
capabilities to impose costs on the Russians, both openly, to
demonstrate that we could do it as a deterrent; and also
clandestinely, to disrupt their operations, as well.
Senator Risch. And were any of those accepted?
Mr. Daniel. So, I can't really go into that here.
Senator Risch. I got it. How about you, Ambassador Nuland?
What did you recommend? And what did they take and what did
they trash?
Ambassador Nuland. Again, I think it's more appropriate to
do specific recommendations in the closed session. What I will
say is that we were aware as--I was aware as early as December
2015 that the DNC had been hacked. We didn't know by whom at
that point, but it bore a lot of signatures of other activity
we'd seen from the Russians in other parts of the world.
And then as we saw more hack activity during the spring,
those of us on the Russia account pushed very hard internally
to put more intelligence resources on this to better understand
what was going on. We didn't know at that point whether this
would take the form of intelligence-gathering during an
election period or whether it would be used for influence and
of what kind before or after the election.
We became more alarmed when throughout the spring, and in
June my team was authorized by Secretary Kerry to begin working
internally at State and interagency on what kinds of deterrence
opportunities there might be, whether in the cyber realm or
using other tools, like economic tools. We developed a full
suite of options in July and then we understood that this issue
would be taken up again after the election, but we were
authorized to continue our work on what might be effective in
the August and September period. And we did that so that we
were ready for the formal conversations when President Obama
authorized them after the election.
Senator Risch. My time's up. Thank you.
Chairman Burr. Senator Wyden.
Senator Wyden. Thank you, Mr. Chairman.
So, thank you both. The Chairman has called an important
hearing, because we're talking about policy responses to the
Russian attack on our democracy. And I have felt for a long
time that one of the best ways to be able to push back on
Russian attacks on our democracy is to have a lot of allies
close to us, allies who are going to stand with us.
And if you're going to focus on that, it is certainly
relevant to discuss President Trump's behavior toward the
Russians and towards our allies. So, at the G7--I think I'll do
this for you, Ms. Nuland, if I could--at the G7, not only did
the President criticize our allies, both individually and
collectively, he was unhappy that Vladimir Putin had not been
invited. And this week apparently he is trying to undermine the
German government by making false claims about migration and
crime. So, at every step of the way on these key kinds of
questions--climate change, trade, Iran, basic issues of human
rights--it seems to me the net effect is that the President has
isolated us from allies that we very much need to help us stand
up to Russia and the attacks on our democracy.
So, given your background, how important in your view are
these alliances to be able to push back against the Russians?
And what's your take? How would you evaluate the President's
recent actions that I have described?
Ambassador Nuland. Senator Wyden, in my professional
experience and study in history, the U.S. alliance system has
served our Nation superbly in terms of security, in terms of
prosperity, in terms of defense of the values in our
Constitution and Declaration of Independence, for more than 70
years. We don't always think our allies are doing enough. We
sometimes have frictions. We have in every decade, whether it
was over Suez or whether it was over Vietnam or whether it was
over Iraq. But it is important that we work together to get
through those as a family. And fundamentally, the system we
have in place is a collective security system, where we jointly
pay for it and jointly execute against our common enemy, and a
shared prosperity system where we push for maximum openness so
that we can all benefit and all prosper.
Obviously, adjustments are always needed. We adjusted NATO
after 9/11 to go to Afghanistan. And I would remind that allies
bore more than half of the combat burden for most of the
Afghanistan mission throughout the period. So, I am concerned.
Senator Wyden. What's your take on the President's recent
actions that I've described?
Ambassador Nuland. I am very concerned when America's
adversaries appear to get better public and private treatment
than America's closest friends. And we certainly should not be
in the business of interfering in internal politics. I am also
quite concerned on the trade side that if we are not careful we
could set off a renewed recession in Europe and perhaps even in
the United States.
Senator Wyden. I'm glad that you've pointed out this kind
of double standard. And it's a double standard that cuts
against America's security interests, in my view, when people
who have been hostile to us appear to get better treatment than
those who have not. So, I appreciate your pointing it out.
One last question on the remainder of my time, Mr. Daniel.
So, your position was eliminated, as you know, recently--the
cybersecurity coordinator--at a time when it seems to me you
have more and more cyber threats of a wide variety. I mean, we
saw press reports with respect to hacks from North Korea during
the middle of these discussions. These were in our
publications.
So, tell me in your view what capabilities do you think are
lost with respect to the elimination of your position? In other
words, I was going to ask you for your assessment of threats
today. But I said, well, Mr. Daniel is in a position where he
doesn't have that kind of current sort of situational
awareness, I guess, would be one of the technical terms. But
tell me, if you would, what capabilities are lost by the
elimination of your position?
Mr. Daniel. Thank you, Senator. It's not so much the
capabilities, but the ability to integrate those capabilities
and employ them. The departments and agencies are the ones that
develop and maintain those capabilities, and those are still
extant. But given the relative newness still of the law and
policy, and interagency cooperation on cyber-related issues and
the use of our cyber capabilities, I think it is still very
important to have a senior official at the NSC--at the White
House--that's actually driving policy and driving operational
collaboration in that area.
Senator Wyden. I'm over my time. Thank you, Mr. Chairman.
Chairman Burr. Senator Rubio.
Senator Rubio. Thank you. Thank you both for being here.
Mr. Daniel and Ambassador Nuland, throughout the campaign,
the Administration took a few steps to attempt to warn Russia
against additional activity. I think that includes the October
7th statement and direct warnings from the President, from
Director Brennan, and over the cyber hotline. Do you believe
any of these efforts had any deterrent effect at all?
Ambassador Nuland. Thanks, Senator Rubio. I think it's
pretty well unknowable what the total effect might have been.
It appears that there may have been a slowing of Russian
activity in September, after the President directly warned
President Putin. But clearly by the middle of October that
activity had resumed in full force.
Mr. Daniel. I would agree that it's essentially unknowable.
I think that it did. I believe it prompted them to shift some
of their focus away from trying to penetrate State-level voter
systems and focus more on the influence operations. But again,
I think that it's a very difficult question to answer.
Senator Rubio. Well, in that context, you both--I think the
date you pointed to is October, when you said you thought it
might have restarted up, even had been a different direction,
mid-October?
Ambassador Nuland. I think the Russians were constantly re-
evaluating the opportunity that this operation gave them and
seeing more and more advantage. I think by mid-, late-October,
they may well have changed their calculus about the outcome of
the election and accelerated their influence operation
accordingly.
Senator Rubio. So, in that context--and this happened after
the President's warning--the later release of the Podesta
emails, do you ascribe that to kind of moving in a different
direction, in particular towards the influence campaign that
Mr. Daniel referred to, as opposed to attacks on State systems
and the like?
Ambassador Nuland. I wasn't involved in working with the
states, obviously. I was only involved in the Russian piece of
it. I think what we saw was a move from the release of the
emails into our political conversation among ourselves moving
later in the campaign to the acceleration using the bot
networks and using the internet accounts that they had
established to push false narratives that were popular on the
fringes of U.S. politics and to try to mainstream those.
Senator Rubio. I forgot the exact quote, but you had said a
moment earlier that if you push and you hit something hard, you
stop, and if you feel mush, you keep pushing. In that context,
why did Vladimir Putin think he could get away with treating
the United States the way he treats countries in his near-
abroad, that they think they should be under Russia's control
and under their thumb? Why did he feel, in your opinion, that
he could get away with that--or treating us in the same way?
Ambassador Nuland. In my experience with this particular
leader, if you don't make these aggressive moves cost directly
for him and his circle in his own context, then he will keep
pushing.
Mr. Daniel. I don't really have anything to add on top of
what the ambassador has said.
Senator Rubio. But ultimately, I guess it sounds what
you're saying, or to rephrase it is, he has a cost-benefit
analysis. Here's the price of doing this. Here's the benefit of
doing it. I believe the benefit outweighs the cost, and
therefore I'm going to do it.
Ambassador Nuland. I think it's probably the case that the
Russians expected deterrent measures and didn't see them and so
felt they could keep pushing.
Senator Rubio. Well, in that context--and I know this is
kind of a hindsight 20/20 situation--but, Ambassador Nuland, if
you could do it over again, if we could go back to 2015 and
2016 and try to deter this activity, as you said that they were
expecting, what would you do? What language do you believe he
would have understood? What could we have done differently?
Part of this inquiry is to learn about what our policies should
be moving forward and whether there should--in addition to the
rhetorical one obviously--the actions that we would take. But
what would have worked, in your opinion, looking back now?
Ambassador Nuland. Again, we can talk a little bit more
about this in classified session. But I think part of the
problem that we had was that, as I said in my opening, we
didn't have sufficient integration of information to understand
fully how their campaign was structured.
We didn't have sufficient agreement in the interagency as
to what the deterrence tools were and what the effect on us
might be if the Russians chose to escalate, because we haven't
studied it hard enough and we weren't unified enough. We
weren't working closely enough with the companies to know what
might be possible, as well. And we were beginning the work with
our allies, but we hadn't done enough.
So, if you look at the more successful counteroperation
that French President Macron later did in the following years,
some of which built on our experience that we shared, what he
was able to do was to, much more quickly than we were, identify
Russian influence operations, to call them out, and to put a
legal structure in place to counter them. So, he essentially
neutered the influence by telling his people that this was
Russia. It was not part of the debate in France.
So, one concrete example, there was a poll about a month
out from the French election which showed Le Pen, the far-right
candidate, in the lead. It was a Russian operation. It was not
a true poll. And the French were able to prove that both in
terms of the origin of the information, heading back to Russia,
and in terms of their own data. And within the same news cycle,
virtually, or within a week, they were able to debunk it
publicly, and therefore they blunted the weapon.
We've got to be in the same situation at least, if not in
terms of countermeasures inside Russia and other adversaries,
so that they know that this is going to cripple them, as well.
We can talk about those later.
Chairman Burr. Ambassador, let me just say, the Vice
Chairman and I many times have wondered what we would have done
if we had the same ability that the French do to pull down the
media three weeks before the election. To some degree, it shows
you the vulnerabilities, but we are challenged to live within
the First Amendment, and clearly, they had some tools that we
didn't have.
Ambassador Nuland. And, Chairman, I'm obviously not
recommending that. But I do think that, you know, information
is the best. Sunshine is the best disinfectant, right?
Chairman Burr. But it is very obvious that it changed the
campaign for Russia as it related to France.
Senator King.
Senator King. Well, I'd like to follow up on that point. In
talking to people in Eastern Europe who have been living this
for years, Ambassador, I have asked them, what's the best
defense? What do you do? You can't cut off television, take
down the internet. They said the best defense is for the public
to understand that it's happening and then they can discount
it, and say, oh, it's just the Russians again. And that's why I
think what we're doing here is so important: to inform the
American people that this is real and that it's going to
continue, because then they're better prepared. Would you agree
with that?
Ambassador Nuland. Senator, I would completely agree with
that, because no population, no citizen wants to think that a
foreign entity is controlling their election. It should be a
national and sovereign right of every citizen to elect their
leaders.
And so, when you explain and expose exactly how these
campaigns work, and that the information they're getting is
manipulated by somebody outside of our country, not only does
it change their processing of the information, it actually
radically turns them off to that information, because they feel
appropriately that they have been manipulated.
Senator King. When did you two first meet in person?
Ambassador Nuland. I don't remember. I mean, we certainly
were part of meetings in the summer and fall of 2016. Did we
meet before that?
Senator King. That was really the point of my question.
There were meetings. You were in similar meetings. But I want
to go to your first recommendation, which is a fusion center.
It seems to me that one of the problems with that response to
cyber generally is a lack of a central focus. I believe it
should be a person, not just a fusion center, but someone who
has overall responsibility. I just listed nine agencies that
have a piece of this. And right now, I'm getting frustrated. I
hear the term whole of government, and to me that means none of
government, because there's no one in charge.
Do you believe that there should be some central authority,
somebody in government whose responsibility it is to think
about cyber and protecting this country?
Ambassador Nuland. Senator, there obviously has to be
somebody who looks at cyber. Cyber is obviously bigger than the
issue of malign state actors affecting politics.
Senator King. Yes.
Ambassador Nuland. In the concept of the fusion center that
I put forward, presumably there would be a director, as there
is for the National Counterterrorism Center, who would be the
single bellybutton for leaders to hold this together.
Senator King. As Mr. Daniel pointed out, someone to
integrate the data. And that was one of the problems early on
in our response, was it not? That we had data coming into the
FBI and the NSA and various places, and we didn't really have a
full picture of the magnitude of this attack until fairly late
in the summer or early fall. Is that correct, Mr. Daniel?
Mr. Daniel. I would actually argue that we didn't have a
full appreciation for the scope of what was going on until
actually well into 2017--that, in fact, in the fall of 2016,
the full extent of the Russian information operations,
everything that they were doing on social media, and the vast
number of trolls and activity that they had going on--I don't
think we fully understood that even in the fall of 2016. And
it's a picture that has continued to evolve over time, as
committees like this have done their work, and I think that
was, as the ambassador pointed out, part of the problem was
that we didn't actually have a complete understanding of the
campaign that was being carried out against us.
Senator King. Ambassador Nuland, a different tack.
President Obama has been criticized for not acting soon enough,
strong enough. What was the thinking, without revealing
classified conversations? But what was the President's
thinking, insofar as you know, in terms of how to respond to
this? And what were the risks and what were the benefits? For
example, why wasn't there a strong classified sanction or some
activity as opposed to a stern admonition at the G20 summit?
Ambassador Nuland. Senator, we can talk a little bit more
about this in classified session, as we did last year. I think
some of the reasons have been ventilated here. You know, there
was incomplete information at the right moment, which I think
is a fault of the systems that we had in place to integrate, as
you said, including the ability to integrate between the
government and the private sector, between classified and
unclassified.
There was already, by late July and early August,
accusation by Candidate Trump that the election would be
rigged. And I think there was a concern that if this wasn't
handled properly, any move publicly would be seen as President
Obama playing into those accusations. There were concerns about
how this might escalate. If we took countermeasures, there
could be escalatory measures, because one Russian goal was
obviously to undercut the integrity of the electoral system.
So, not wanting to play into that.
And I think there was a perception that this could be dealt
with after the election in a more fulsome way and that whomever
was elected would continue the work that the Administration
started to get to the bottom of it more fully.
Senator King. Thank you. Thank you, Mr. Chairman.
Chairman Burr. Senator Collins.
Senator Collins. Thank you, Mr. Chairman.
Mr. Daniels, how did the Administration view WikiLeaks? For
example, did you view it as a news organization, as a social
platform like Facebook, or in essence a hostile intelligence
service?
Mr. Daniel. Senator, I would actually say that in many ways
it was sort of all-of-the-above at various points. I mean,
certainly, as someone who had spent a large amount of time
working with the Intelligence Community over my career,
certainly we did not view a lot of what WikiLeaks was doing as
favorable.
You know, I think that our view was always split as to
exactly how witting a lot of the people that were involved were
with what was going on. Again, that's something we can explore
in more detail in the classified session. But clearly, the
Russians used them to great advantage.
Senator Collins. Exactly. Do you think that realization
existed in 2016? Or is that only a realization that we have
looking back?
Mr. Daniel. I don't think that we fully appreciated the
scope and scale of the Russian influence operations. And at the
time, certainly that was part of what prompted our initial
work, was the release of information into WikiLeaks with the
persona that was called Guccifer 2.0.
But in many ways, we were very much--certainly on the
cybersecurity side--we were very focused on the activity aimed
at the State and local electoral systems. And it wasn't until I
think later in the year, and even actually after the change of
Administrations, that we became fully cognizant of the scope
and scale of the influence operations.
Senator Collins. You mentioned the State and local
electoral systems. We have received from the Department of
Homeland Security inconsistent and varying numbers on the
number of states whose systems were scanned by the Russians.
How likely do you think it is that Russian cyber actors at
least scanned all 50 states?
Mr. Daniel. I think it is highly likely. It was always my
judgment that given the number that we reached, where we had
pretty good evidence of that, led me to believe that there was
no reason why they wouldn't have at least attempted
reconnaissance against all 50. And it was more likely that we
hadn't detected it than that it didn't occur.
Senator Collins. I really appreciate your being forthright
about that, because I believe that if states understood that,
they'd be more receptive to the help that I know Secretary
Johnson offered, and the help that they're being offered now,
since certainly that threat continues.
Ambassador Nuland, in 2016, the FBI was complaining to this
committee that Russian diplomats in the United States were not
following the established rules about travel and they were not
notifying the State Department. And it seemed that they were
traveling to odd locations on short notice.
Were you aware at the State Department of the FBI's
concerns?
Ambassador Nuland. Yes, Senator. As I testified in
classified session a year ago, and as I think we should review
again in the closed session, we had significant conversations
with the FBI about their concerns and took some actions and
prepared others as early as July and August of 2016 with regard
to their concerns. They also, as they've I'm sure told you, had
a severe understaffing problem in terms of their ability to do
their job in identifying when the Russians didn't obey the
rules and make it painful in those encounters.
Senator Collins. Do you think that that travel was related
to the Russian active measures against our electoral system?
Ambassador Nuland. I do.
Senator Collins. Thank you.
Chairman Burr. Senator Manchin.
Senator Manchin. Thank you, Mr. Chairman, and thank both of
you all for being here. And don't think there's any question
that the Russians were attempting to be as involved as they
possibly could at a higher level than they've ever done before.
So, I would ask, do you think that we have the assurances
that we know exactly what they did, how they tried to do it,
and are they still moving in that direction? Yes, go ahead.
Ambassador Nuland. Well, Mr. Daniels will speak from his
experience. Among the reasons I put forward the five
recommendations that I did is I do not think that we are yet
organized, funded, structured----
Senator Manchin. How much do we know about their internet
research area, basically in Saint Petersburg? Mr. Daniels,
would that be you or----
Ambassador Nuland. I would simply say we know quite a bit
about that one, with the help of the companies. What we don't
know is how many more of those there are, whether in Russia or
in other parts of the world.
Senator Manchin. Mr. Daniel.
Mr. Daniel. And I would just say that I have too much
appreciation for the capabilities of the Russians. They are an
incredibly sophisticated actor both on the cyber side and on
the information operations side. I have too much respect for
that to believe that we've detected all of the activity that
they either did do or are continuing to do.
Senator Manchin. With that being said, do you believe we
should have a policy to treat cyberattack, if proven, to be
sponsored by a foreign government--whether it be Russia or
anybody else--as an act of war and automatically retaliate in
cyberspace?
Mr. Daniel. So, I think that as with any issue in the
physical realm, I think what we have long argued and that I
support, is that the same ideas and concepts of proportionality
and the laws of war apply in cyberspace, just as they do in the
physical realm. And so, that if you had a cyber-incident that
rose to the same level of----
Senator Manchin. A use of force?
Mr. Daniel [continuing]. That you should be able to respond
using all the tools of national power, the same way we would to
an incident in the physical world.
Senator Manchin. We have the midterms elections we're all
concerned about because they're very critical for those of us
who are involved and everybody else who's paying attention to
it. And I'd like to know for the people in West Virginia that
our systems are safe. If there is any indication that there
might be an infiltration by a foreign actor to thwart the
outcome, can they prevent that or can they detect it?
Ambassador Nuland. Senator, Mr. Daniel will speak to the
technical capability, particularly in West Virginia. I would
simply say that as a matter of U.S.-Russia policy, this would
be a moment for the President to first be working with his
policy team to decide what the costs for Russia should be if
there is proven interference in the 2018 election.
Senator Manchin. Why don't we just say the whole thing? Do
you believe there should be the same alert that we have for a
nuclear attack as a cyber-attack?
Ambassador Nuland. What I would say, I would repeat what
Mr. Daniel said: that we want to make sure that any president
can have a full toolbox of response options. In some cases, it
may be that economic pressure is more effective, or more
costly, to the adversary.
Senator Manchin. Let me ask this question to either one of
you, or both of you. Do you believe there was anything the
Obama Administration could have done to break through the pre-
election political rhetoric and make people take that
seriously, take that threat seriously? I mean, it got to the
point that everything was after the fact, but they knew, you
all knew, something before the fact.
Mr. Daniel. I think, in my experience, it always takes an
extended period of education and engagement--whether it's the
financial sector, the electoral sector, the health-care
sector--all of them followed a similar pattern to what we saw
with the electoral infrastructure sector, in terms of it takes
time for people to grasp and understand that the threat is
real, that it's present, that it can affect them directly, and
that then there are things that they can actually do to try to
address it. And, in fact, actually I would say that timespan
has actually been shortened in the electoral infrastructure.
And people have gotten to that point much more quickly than
they did in some of our other areas.
Ambassador Nuland. I believe that there were deterrence
measures that we could have taken and should have taken earlier
in 2016.
Senator Manchin. Should we have made the public aware?
Ambassador Nuland. I think obviously the public should be
aware, but for a lot of reasons, some of which we'll discuss in
the next session, we were not sufficiently aware ourselves at
the right moment. But more importantly going forward, we know
that they may very well do this again. So, now we need to be
planning what the retaliation will be, and we need to be
signaling it so that the cost is evident.
Senator Manchin. My time is running out. I'm just saying,
you don't see the Russians or other foreign actors backing off
at all? I mean, do you see their involvement at the same level,
if not greater, Mr. Daniel?
Mr. Daniel. So, not having access to classified information
right now, certainly if you look at just the most recent
activity associated with a piece of malware called
``VPNFilter'' that is almost assuredly associated with the
Russian government, that targets routers and other things; it
includes a destructive capability. It's a type of malware that
we really hadn't seen before in the cybersecurity community.
That shows quite clearly the intent of the Russians to continue
using their cyber capabilities.
Senator Manchin. Thank you.
Chairman Burr. Thank you. Thanks, Senator.
Before I move to Senator Lankford, let me just ask both of
you, at what point did the cyber indicators match up with the
knowledge about Russia to form the complete picture of exactly
what this threat was?
Ambassador Nuland. Chairman, as you know, since I was
sitting at the center of government work on Russia, I was a
consumer of all of the different intelligence information that
there was.
Chairman Burr. Yes, this is more of a stovepipe question.
At what point did the technical--the cyber indicators that,
Michael, you were looking at on a constant basis--match with
the knowledge that you had in the field or somebody at State?
And were we able to put this together and see the complete
picture?
Ambassador Nuland. My feeling about this is that it wasn't
until the President ordered all of us to sit together and map
what we knew that the full elephant came into view for all of
us together. But even so, that was only an elephant that
represented the government's holdings of information. As Mr.
Daniel has said, we learned much later about the holdings that
the companies had, the information.
Chairman Burr. And roughly that time when the President
brought the team together, was----
Ambassador Nuland. December of 2016.
Vice Chairman Warner. I don't want to interrupt Senator
Lankford, but in other words, if the President had not asked
for this bringing together of the information, there was no
process in place that would have immediately aggregated this
information on a regular, on a normal operating bases?
Ambassador Nuland. There should have been, but there
wasn't. And that's why I advocate this fusion center and the
second recommendation to also have a continuing conversation
with the companies.
Chairman Burr. Michael, anything to add?
Mr. Daniel. I would just add that, to the extent that,
again, I would separate out some of the information on the
influence operations and the information operations side, but
on the targeting of the electoral infrastructure, the
integration of that happened through the Cyber Threat
Intelligence Integration Center within the Office of the DNI.
And that was why that entity was created, to try to combine the
cyber technical intelligence with the geopolitical
intelligence, because you can't actually understand one without
the other.
Chairman Burr. Senator Lankford.
Senator Lankford. Ambassador Nuland, tell me a little bit
more about this second recommendation that you have to try to
work with public and the private and to be able to work with
entities. How do you think that should be formed?
Ambassador Nuland. I think this should be a presidentially
directed commission, which meets at the technical level on an
ongoing basis, but at the leader-level, monthly or thereafter.
After I left government and had an opportunity to talk to a
lot of the big actors in the U.S. private cyberspace, it
becomes clear that for reasons of company privacy, et cetera,
proprietary business information, they don't want to talk to
each other. They're not comfortable. They worry. But yet
they're facing many of the same problems. And they're also
having conversations with the government about what they're
seeing, but it's limited to cyber experts. And it's not
integrated with policy. And often it wasn't getting to a high
enough level.
So, when I say the companies knew some of what was going
on, on their platforms in Russia, Ukraine, and Europe, as early
as 2014-2015, those were the cyber specialists, but not
necessarily the leaders of the companies. So, this would be
ideally a safe space where companies could speak to each other,
where they could speak to government, and where common
campaigns of action--whether they are regulatory, legal,
policy--can be formed, and where the companies can also say
what kinds of protection they need from government if they're
going to take bold moves.
Senator Lankford. So, from this perspective, how often
should they meet? And who do you think should be the primary
actors to be there?
Ambassador Nuland. How often they should meet, I think,
would be something we'd want to talk to both government and
industry about. I would say that there should be an ongoing
conversation, at least a virtual conversation at the working
level. There should be mid-upper-level meetings at least
monthly and probably senior cabinet-level meetings quarterly,
unless there is an emergent crisis of the kind we saw in 2016.
Senator Lankford. Who? Who do you think should be at that
table?
Ambassador Nuland. Again, I would want to do more work with
the companies on this and more work with government to get a
better sense of it. But on the company side, I would want to
see both cybersecurity experts and policy experts to make sure
they're integrating on the government side the same.
Senator Lankford. So, it is our great frustration, as you
know well, that we've worked with several of these social media
platforms, and they saw things and were taking in ads that were
election related. They were aware of it and trying to figure
out what to do with it, basically. They've now had some fairly
significant changes in their policy. They're still trying to be
able to address this, to figure out how to be able to monitor
it, but obviously they saw it throughout the election, as well.
So why I'm pressing you on this is that that's one aspect.
There will be others. That one's been tested. They're trying to
be able to respond to it. There will be others. And our
imagination can take us into places where they could go next.
What would you anticipate is the goal of this meeting time?
Is it maintaining what we already have? Or trying to imagine
what could be coming in the cooperation and sharing? As you
know in the private sector, there's not a lot of cooperation
and sharing between, ``We're seeing this threat, are you?''
They typically see this threat and they're trying to figure out
how to be able to manage it, the same as government did during
2015 and 2016.
Ambassador Nuland. I mean, obviously, it's to do past
forensics in order to inform future forensics and future
policy. As I said in my opening, I think Russia has done pretty
well with this tool, but other actors are starting to get even
better, notably including China.
Senator Lankford. So, let me back up a little bit on this.
And this is for both of you, to use your imagination.
Ambassador Nuland, you know the Russians. You know that region
extremely well. So, as you talk about other actors leaning into
this, whether it be nation-states or whether it be just
hacktivists that just want to be able to engage, or people that
have a political beef and they want to try to be able to effect
this, for you, and particularly with the Russians, and, Mr.
Daniel, in a broader setting, what do you think the Russians'
next move is? Where do you think they're going next, based on
what you've seen? And I know you're not there all the time on
it, but what do you think is the next move?
Ambassador Nuland. Well, I think we're already seeing some
of the moves on the Russian side. There's obviously the
electoral target. But over the course of 2017 and 2018, they've
had great success turbocharging their efforts to divide the
U.S. on race, on issues of gun control, on any of the seams
that stretch us. So, I think they will accelerate that.
I don't know whether they will have a view about the 2020
election, but having been more successful than they anticipated
the last time, I think you could see them be quite aggressive
on both sides--both at primary time and at general election
time--in trying to influence how Americans choose their next
leaders.
Senator Lankford. Right. Mr. Daniel, any other view for
other actors?
Mr. Daniel. Well, I would certainly say that both the
Russians and other actors, including China, Iran, North Korea,
criminal organizations, terrorist organizations, hacktivists,
all of them, are discovering that cyberspace is a great place
to try to advance their agenda. And we are seeing a
proliferation of capabilities across the globe, and we should
expect that to continue. Our adversaries are also going to get
better at integrating their cyber capabilities with other
aspects of their national power. The Russians are already quite
far along in that, but the Chinese and others are not far
behind.
Ambassador Nuland. Senator, if I may just highlight one.
There's also the risk that you'll have American-on-American
violence in this space: that if we don't put the right laws and
regulatory policy in place, that it will create a jungle in our
own politics against each other.
Senator Lankford. Thank you.
Chairman Burr. Thank you, Senator Lankford. If no members
are seeking any additional questions, I think we've come to the
end of the open session.
I do have one final question, if I could, Ambassador. Can
you provide us any insight as to why INR was not included in
the team that comprised the ICA, the Intelligence Community
Assessment?
Ambassador Nuland. I thought, Chairman, that they were
included. Mr. Daniel would know better because he was closer.
But I thought that they were included. They were certainly
included in the work we did on potential deterrence steps.
Mr. Daniel. To the best of my knowledge, they should have
been included, because by definition, the ICA should be
coordinated across the community.
Chairman Burr. We'll check.
Ambassador Nuland. I have a vague memory of their coming to
us on the policy side thinking that things could be more
rigorous at a certain point in December. So, I think they were
involved in some way.
Chairman Burr. To the best of our understanding, the
participants were FBI, NSA, and CIA. And again, it gets back to
our ability to look forward and to figure out how we create a
pathway that has no stovepipes where these things are
instinctively created correctly.
Vice Chairman, do you have anything in closing?
Vice Chairman Warner. No, Chairman.
Chairman Burr. Let me say thank you to both of you for your
insight, for everything on this important issue. While we'd all
like to look exclusively forward, our mission for this
investigation was to fully review Russia's involvement and
intentions in the 2016 election. You both played a pivotal
role.
And I hope both of you will continue to stay engaged with
the committee as we finish the investigation on areas that you
might be able to provide some texture and clarity on. But I
hope also you'll stay involved with the committee as it relates
to future policies that, Ambassador, I assure you will be on
the table.
Nobody would like to concentrate solely on oversight more
than the Russia investigative team, I can assure you. So, it's
my hope and it's my belief that this hearing has helped us get
closer to the end than to the beginning. And you have helped us
today better understand some of the issues that we've tussled
with for the last 16 months now. So, we are grateful to you.
With that, I will adjourn this hearing with the intent to
start the closed hearing at approximately 1:15 and would
encourage you to seek nourishment during that period.
This hearing is adjourned.
[Whereupon, at 12:33 p.m., the hearing was adjourned.]