The exchange began when Sen. Martha McSally, R- Ariz., questioned if there was enough informatjon sharing.

“Vertical information sharing amongst the government and with the private sector is something that is lacking,” McSally said. “The clearance issues, the opportunity to do tare lines so that the information can be shared out there is really important.”

In response, Karen Evans, the assistant secretary for cybersecurity at the Department of Energy, agreed that “the clearance process is an amorphous process.”

Energy committee chairwoman Sen. Lisa Murkowski, R-Alaska, continued: “We have heard that time and time and time again. I understand that it is still an issue even though we had addressed it through the fast tracks, that we continue to have holdups through the FBI.”

Sen. Angus King, I-Maine, expanded on the frustration with the background investigations bottleneck.

“The last time we checked in the intelligence committee there was a backlog of something like 750,000 security clearances. It’s a huge problem,” King said.

In fiscal 2016, only 10 percent of executive agencies reviewed in a Government Accountability Office report met timeliness standards for Top Secret clearances. But the American government has made some efforts to fix issues with security clearances in the cybersecurity sector.

During the 2018 midterm election season, the Department of Homeland Security pushed for more state and local officials to receive security clearances so they could receive classified threat briefings. Programs were also created to read-in executives of critical infrastructure sectors about cybersecurity threats the intelligence community was monitoring.

However, there have also been some setbacks.

Efforts from Sen. Mark Warner, D-Va. to reform the security clearance process in the 2019 Intelligence Authorization Act were stifled at the last moment and not included in the final bill. However, Warner has continued to push for the measure in new legislation proposed Feb. 1.

“The current vetting process for security clearances and positions of trust is too complicated, takes too long, costs too much, and fails to capitalize on modern technology and processes,” Warner said. “We must act now, especially amidst allegations of inappropriate granting and revoking of clearances and anxieties caused by the government shutdown.”

Released Feb 12, the Pentagon’s strategy shows how the American military will rely on artificial intelligence as a defensive tool.

“We will increase our focus on defensive cybersecurity of hardware and software platforms as a precondition for secure uses of AI,” the Pentagon’s new strategy states. “ In order to ensure DoD AI systems are safe, secure, and robust, we will fund research into AI systems that have a lower risk of accidents; are more resilient, including to hacking and adversarial spoofing.”

A particular focus of the new strategy is researching “emergent effects,” which is what happens when two artificial intelligence systems interact. The Army’s Aberdeen Proving Ground, for one, is conducting studies into how artificial intelligence can protect soldiers’ tactical networks and communications from cyberattacks.

The Pentagon’s artificial intelligence strategy comes as both the American military and hackers have embraced machine learning for cyberattacks.

According to an analysis by Fifth Domain, more than half of the new challenges and programs announced by the intelligence community’s research arm in 2018 involve machine learning or predictive analytics, which represents a potential boon for cybersecurity researchers.

In December, the Pentagon announced that Air Force Lt. Gen. Jack Shanahan would be head of a new artificial intelligence center.

Hackers are using artificial intelligence during cyberattacks, Sam Curry, the chief security officer at Cybereason, a threat intelligence firm, told Fifth Domain. Curry said that a particular risk with artificial intelligence is the use of “second order chaotic systems,” where events cause data inputs to change, using the stock market as an example.

“Second order systems with badly applied, overreacting machine learning are prone to exploitation,” Curry said.

With the release of the artificial intelligence strategy, the Pentagon is attempting to combat significant investments in machine learning by other countries.

“Other nations, particularly China and Russia, are making significant investments in AI for military purposes, including in applications that raise questions regarding international norms and human rights,” the strategy says. “The costs of not implementing this strategy are clear. Failure to adopt AI will result in legacy systems irrelevant to the defense of our people, eroding cohesion among allies and partners, reduced access to markets that will contribute to a decline in our prosperity and standard of living, and growing challenges to societies that have been built upon individual freedoms.”

Three recently announced solicitations are all efforts to expand the cyber training environment for American soldiers, which was recently called insufficient by experts.

The Air Force released a Feb. 5 public solicitation to support expansion of its CyberWorx project by building new training facilities located at the service’s academy in Colorado. The $30 million expansion is expected to be the first phase of the project and will include new cyber research and testing facilities. CyberWorx is a Pentagon effort to partner with cybersecurity businesses and researchers. Ultimately, the Air Force vision includes a 40,000-square-foot center at the Air Force Academy in Colorado that will also be home to the Department of Homeland Security’s Center of Innovation.

The U.S. Army Cyber Center of Excellence also released a public solicitation for information about classroom and virtual training and hands-on exercises for the center’s cybersecurity courses. Specifically, the solicitation notes a need for instructors and doctrine developers. The Army Cyber Center of Excellence provides training to American soldiers and is home to its signals school, among other institutions.

Finally, a Feb. 8 solicitation details U.S. Army plans to build new cyber ranges in four locations; Orlando, Florida, Charleston, South Carolina, Patuxent River, Maryland, and Fort Walton Beach, Florida. Tied specifically to the Pentagon’s new cyber mission force, the new ranges are an effort to conduct more cybersecurity training and certification events.

The flurry of solicitations comes as the Trump administration announced plans to be more aggressive in cyberspace, and require more hackers. But experts have criticized the lack of hands on training that American soldiers receive.

“A common mantra within the U.S. military has been to ‘train as you fight,’” wrote Jennifer McArdle, a non-resident fellow at the Center for Strategic and Budgetary Assessments, in a Jan. 25 paper. “Yet, live training fails to replicate with fidelity the type of cyber and informationized operations that war fighters will experience in a contested and complex battlespace.”

Researchers from the Florida Institute for Human and Machine Cognition said in a December 2018 paper that artificial intelligence that analyzed open data on the internet failed to predict cyberattacks on an organization.

By combing through news of publicly reported cyberattacks, the study aimed to predict when a hacker might infiltrate a computer system. However, researchers found “there is not always a clear causal link between news reports of attacks and future cyberattacks.”

Although the authors said their strategy might have worked under different circumstances, the study is significant because it depicts the difficulties of using open sourced data to plan for an incoming cyberattack.

The idea that public data can point to future cyberattacks has been embraced by several government agencies.

The intelligence community’s research arm, the Intelligence Advanced Research Projects Activity, is researching how data can help forecast a cyberattack by using sensors that predict when a target is vulnerable to hackers. BAE Systems, Charles River Analytics, Leidos, and the University of Southern California are the prime contractors on the project.

There is a “significant link between hackers use of social media platforms, especially Twitter and Facebook, and the volume of web defacement attack,” according to 2017 research backed by the Office of the Director of National Intelligence and IARPA.

But experts have had mixed results with predicting cyberattacks with machine learning and open data.

By analyzing conversations of known criminals on the dark web, researchers from the University of California also tried to create an early warning system for incoming cyberattacks in 2017. That approach was 84 percent effective at predicting current or imminent cyberattacks.

Also in 2017, three researchers used historical attack count data to predict future cyberattacks to some success. It was 14 percent more effective than other models.

However, others believe the future of predicting cyberattacks through artificial intelligence will combine both humans and computers.

Researchers from the Massachusetts Institute of Technology created a computer system in 2016 that continuously incorporated information from human experts with a success rate of 85 percent while also decreasing false positives by a significant factor.

“The more attacks the system detects, the more analyst feedback it receives, which, in turn, improves the accuracy of future predictions,” said Kalyan Veeramachaneni, a research scientist at MIT in a release. “That human-machine interaction creates a beautiful, cascading effect.”

“You can outsource your operations but you cannot outsource your risk,” Bradford Wilkie, head of stakeholder engagement at the Department of Homeland Security’s cyber division said during a Feb. 6 briefing.

The Department of Homeland Security and the information security firms, Recorded Future and Rapid 7, said that the Chinese government sponsored group APT10 is responsible for attacking third-party companies that could leave the door open to a broad swath of potential victims. Examples of third-party companies include cloud service providers, data storage companies, internet providers and credit card companies.

“Malicious cyber actors working on behalf of the Chinese government have been targeting managed cloud service providers,” Wilkie said.

The Chinese embassy in Washington D.C. did not respond to a request for comment.

DHS officials specifically warned about the Cloud Hopper campaign, one that targets managed service providers who store sensitive details from the finance, telecommunications, biotechnology, consulting, and automotive industries. The Chinese hacking campaign is not limited to one location and has been spotted on every continent, according to a Homeland Security slide.

“This actor sweeps up collateral targets of opportunity, in addition to their primary targets of interest,” another slide said.

“In general, they are using widely available tools or living-off-the-land,” said Casey Kahsen, an incident response engagement lead at the Department of Homeland Security. “That’s part of what makes attribution so difficult.”

The hacking effort is tied to China’s five-year plan that promotes economic growth in the fields of robotics, next-generation information technology and biotechnology, according to the Department of Homeland Security.

Recorded Future and Rapid 7 also released a joint report Feb. 6 that warned of hackers targeting third-party service providers. The report cited the infiltration of Visma, a Norway-based cloud services provider worth more than $1 billion as an example.

“We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks, and not of stealing Visma intellectual property,” the joint report said.

An international apparel company and a U.S. law firm with experience in intellectual property law were also targeted by similar campaigns, the report said.

“It’s a lot more efficient to victimize a managed service provider if you know that 10 of your potential targets use that managed service provider for say, internet access,” said Priscilla Moriuchi, director of strategic threat development at Recorded Future told Fifth Domain.

“The global business community doesn’t have a handle on” supply chain management,” Moriuchi said. “Attackers know that. In this case we’ve seen the [Chinese] Ministry of State Security. The [Russian] GRU and likely a lot of others in the future are going to be employing a technique to attack third-party supply chains.”

The United States intelligence community’s ability to boost its surveillance of American computer networks, foreign adversaries and even third-party countries is integral to the Trump administration’s plan to be more aggressive in cyberspace.

“We are building relationships with U.S. institutions that are likely to be targets of foreign hacking campaigns — particularly in the nation’s critical infrastructure — before crises develop, replacing transactional relationships with continuous operational collaboration among other departments, agencies, and the private sector.” Gen. Paul Nakasone, head of U.S. Cyber Command and the NSA, said in the January edition of Joint Force Quarterly, a Pentagon publication. “This is a domain where 90 percent of the networks — the critical infrastructure — resides in the private sector, not in the public. This is primarily a private industry-driven domain.”

Under Nakasone, U.S. Cyber Command has embraced the concept of “defend forward,” meaning that cyber staffers operate against enemies on their own virtual territory. It is a tactic that requires significant intelligence capabilities.

“The framing of Cyber Command’s mission requires that it have real-time, fine-grained and current knowledge about adversary forces, capabilities, routines, operating venues and intentions,” wrote Chris Inglis, former deputy NSA director, in the new book “Bytes, Bombs and Spies.” Cyber operations require surveillance “that enables the command to go from a standing start to a precise and responsive engagement in the shortest possible time.”

To boost intelligence and surveillance activities, Inglis recommended improvements in three areas.

First, he suggested boosting sensors deployed in both Pentagon and adversarial networks that operate under existing and “emerging rules.”

Second, he advocated for a greater sharing of bilateral and multilateral information. Inglis appeared to suggest a greater collaboration with private critical infrastructure companies, but admitted it would be limited by “privacy protections and concerns over legal liability.”

Finally, Inglis suggested greater use of commercially available threat information to fuel the intelligence demands of more offensive cyber operations.

“The intelligence requirements for offensive cyber operations are going to be enormous,” Amy Zegart, a senior fellow at the Hoover Institution, a research organization, said during a Jan. 30 event at the National Defense University. But she said it was not clear what the surveillance requirements would mean for the structure of the intelligence community.

“The key is that the operational decisions need to be made with an understanding of the intelligence requirements behind them, and then dedicate the organizational structures and talent to match that.”

Acting Attorney General Matthew Whitaker and Homeland Security chief Kirstjen M. Nielsen said in a Feb. 4 report to President Donald Trump that both the election and political infrastructure used during the midterm vote were free from meaningful interference. The election marked a key test for Pentagon leaders, who were using the event as a measuring stick for a new cybersecurity strategy.

In the weeks leading up to the midterm elections, senior Trump administration officials worried about the potential for a series of cyber mishaps, from hacked preliminary results to inaccurate voter registration databases. Burke Wilson, the deputy assistant secretary of defense for cyber, told reporters Oct. 30 that the midterm elections was one metric that could be used to judge the success of the Trump administration’s plan to become more aggressive in cyberspace. But the administration’s worst case scenario did not

But the new report does not mean that other nations were quiet or that their efforts were non-existent during the midterm elections, only that they had no significant impact on the vote.

“Russia, and other foreign countries, including China and Iran, conducted influence activities and messaging campaigns targeted at the United States to promote their strategic interests,” Dan Coats, the director of national intelligence, said in a Dec. 21 report.

During the 2018 midterm vote, the intelligence community created an election security group dedicated to preventing foreign interference. However, their work is continuing into the next election cycle. Already, the intelligence community is focused on protecting the 2020 elections, which the intelligence community says is a target for foreign nations.

“We assess that foreign actors will view the 2020 U.S. elections as an opportunity to advance their interests,” Coats told lawmakers Jan. 29. “We expect them to refine their capabilities and add new tactics as they learn from each other’s experiences and efforts in previous elections.”

“There is nothing more rewarding than protecting the American people,” FBI Director Chris Wray said when asked by Senator Richard Burr, R-N.C., how the government can draw in engineers and ingenuity to help secure the nation in the face of big data-driven adversaries.

“If it’s cutting edge, we will be doing it in the National Security Agency,” added NSA chief Paul Nakasone.

The responses, which came during a Jan. 29 Senate Intelligence Committee hearing on worldwide threats, acknowledged the challenges and opportunities for staffing the intelligence community.

Recruitment has long been a challenge and Amy Zegart, a senior fellow at the Hoover Institution, a research organization, suggests a more blunt approach.

“You come work for me, you get to break into other people’s networks and we won’t get you arrested — we will give you a medal.” she said. “’You want impact, I’ll give you impact.’ That’s the message the Pentagon needs to send to be sending to these kids.”

Extolling the impact of government service will not convince coders and other techies to forgo a career in Silicon Valley in favor of joining the IC, Zegart told reporters Jan. 30. She spoke to the media for the release of a book she co-edited, “Bytes, Bombs, and Spies: The Strategic Dimensions of Offensive Cyber Operations.” Zegart did not directly address the intelligence officials’ testimony to lawmakers; however, her overall critique mirrored their statements. Her comments come amid fears of a tech talent gap inside the U.S. government.

“Recent college graduates think that they are changing the world doing their apps,” Zegart said.

She recounted a story of how former NSA chief Mike Rogers came to Stanford years ago and made a pitch similar to the ones from the intelligence chiefs in 2019. “That messaging doesn’t work,” Zegart said.

As to why young people are choosing one power center over another, some differences in Silicon Valley versus Washington, D.C., are stark and one example is the relationship with China.

Washington views China as an adversary, while Silicon Valley views the Asian power as an investor and business market, Zegart said. It can lead to differences between the two communities regarding whether tech companies should work with Beijing’s leaders.

Zegart also suggested that the American national security establishment should not create “lifers inside the government but ambassadors back to these tech companies.”

“The Mark Zuckerbergs are not going to be converted. We need to think about the Mark Zuckerberg of 10 years from now,” Zegart said.

Security Scorecard, an organization that tests cybersecurity, found that both endpoint security and patching actually increased inside the federal government during the five-week partial shutdown.

The study illustrates the complicated nature of improving cybersecurity inside the federal government and the overwhelming workloads IT officials face.

“The most secure computer is one that is turned off, and there were a lot of turned off computers during the shutdown,” Alex Heid, chief research officer at Security Scorecard, told Fifth Domain. “We saw a drop in internet traffic coming from .gov during the shutdown,” which made the federal government “less of an exploitable attack vector.”

And for the computers that were on, the Security Scorecard research found that patching, or applying critical updates, experienced a 1.38 percent gain during the shutdown.

Two potential reasons were cited. First, many essential security employees of the U.S. government were still working — with pay or without — during the federal shutdown. And because traffic was significantly reduced it was easier to patch devices during the shutdown.

“A lot of the more critical functions of the federal government continued to operate and it seems that patching exploitable conditions was one of them,” Heid said.

Federal employee workstations and mobile devices are considered to be the most vulnerable attack vectors, according to Security Scorecard.

The research also found that there was a 9.16 percent increase in endpoint security during the partial shutdown, which is correlated to the total number of internet traffic.

“Since the U.S. federal government was shut down, so were many of the workstations and endpoints. There was a noticeable drop in internet browsing traffic coming from the U.S. federal government,” the report said.

However, the report from Security Scorecard was not all positive.

The research found that network security decreased by 1.58 percent during the shutdown, which was caused by a rise in expiration of SSL certificates, which ensure encryption between a computer and a website. Still, this change was within the normal patterns of the U.S. government, according to Security Scorecard.

Heid admitted that he was “surprised by what we found,” but that it “makes a lot of sense.”

The federal government typically has some of the worst cybersecurity standards, according to the Security Scorecard report, although it has marginally increased over the past few years.

Overall, Heid said the positive and negative findings of the shutdown balanced out.

“There was very little impact from the standpoint of an external attack perspective,” Heid said. “The federal government’s network have always been a punching bag and incredibly vulnerable.”

In what is considered the seminal yearly report of foreign threats to the United States, leaders from six high profile intelligence agencies warned that the “post-World War II international system is coming under increasing strain amid continuing cyber” threats, among other avenues of attack.

“China, Russia, North Korea and Iran are advancing their cyber capabilities, which are relatively low-cost and growing in potential severity,” Director of National Intelligence Dan Coats told the Senate Intelligence Committee. “As the world becomes increasingly interconnected, we expect these actors, and others, to rely more and more on cyber capabilities when seeking to gain political economic and military advantages over the United States and its allies and partners.”

China topped the list of cyber threats facing the United States.

“China remains the most active strategic competitor responsible for cyber espionage against the U.S. government, corporations and allies,” the accompanying document read. “Beijing will authorize cyber espionage against key U.S. technology sectors when doing so addresses a significant national security or economic goal not achievable through other means.”

“The Chinese counterintelligence threat is more deep, more diverse, more vexing, more challenging, more comprehensive and more concerning than any other counterintelligence threat that I can think of,” FBI Director Christopher Wray told lawmakers.

Questions emailed to the Chinese embassy in Washington D.C. were not returned.

The sharp rhetoric regarding Beijing comes just one day after the Justice Department accused Chinese telephone conglomerate Huawei of fraud and stealing sensitive trade secrets. American intelligence officials have previously warned against using Huawei phones out of fears it was a sieve for Chinese intelligence. In August, Fifth Domain reported that Huawei phones are vulnerable to hacking.

“China had a remarkable rise in capabilities that are stunning. A significant amount of that was achieved through stealing information of our companies,” Coats, the intelligence chief, warned.

The American intelligence community’s assessment of Chinese digital aggression comes during a trade war between the two countries, and after an agreement between the two nations to limit the use of cyberattacks for business intelligence broke down.

Experts say that China frequently uses publicly available tools, which are relatively cheap, during their cyberattacks. Their attack patterns are also easy to emulate, and experts say that hackers are increasingly making their viruses look like they came from China.

The intelligence chiefs’ briefing also offered insights into how the cyberthreat against the United States is growing more complex.

Wray told lawmakers that nation-states are working with criminal hackers in a “form of outsourcing that makes it even more of a menace.”

“Foreign cyber criminals will continue to conduct for-profit, cyber-enabled theft and extortion against U.S. networks,” the 2019 intelligence assessment said.

However in the immediate future, Coats warned that protecting the 2020 presidential elections represent “a top priority for the intelligence community.”

“We assess that foreign actors will view the 2020 U.S. elections as an opportunity to advance their interests,” Coats said.

The intelligence community assessed that the 2018 midterm elections were targets of foreign nations. Both Democratic and Republican party officials were targets of cyberattacks or misinformation, U.S. officials said.

During his testimony to lawmakers, Coats said election security would continue to be a top focus for the intelligence community.

“On the heels of our successful efforts to protect the integrity of the 2018 midterm elections, we are now focused on incorporating lessons learned in preparation for the 2020 elections.”