In a letter Monday to lawmakers, Adm. Chas Richard, U.S. Strategic Command’s chief, said he was otherwise satisfied with Biden’s fiscal 2023 defense budget proposal, but made the point about the SLCM-N. On Tuesday, it became fodder in an unfolding fight over plans to defund the submarine-launched low-yield missile.

“While I am satisfied USSTRATCOM priorities are adequately addressed, the current situation in Ukraine and China’s nuclear trajectory convinces me a deterrence and assurance gap exists,” Richard wrote.

“To address this gap, a low-yield, non-ballistic capability to deter and respond without visible generation is necessary to provide a persistent, survivable, regional capability to deter adversaries, assure allies, provide flexible options, as well as complement existing capabilities. I believe a capability with these attributes should be re-examined in the near future,” the letter continued.

Though military leaders are required by law to provide Congress with their wish lists or unfunded priorities, Richard’s letter did not make any requests for a particular program or funding amount. Biden’s $813.4 billion national defense budget includes $50.9 billon in nuclear weapons spending, up $7.7 billion from the 2022 request.

A House Armed Services Committee hearing Tuesday offered a stage for the debate over the composition of that budget.

Defense Secretary Lloyd Austin defended DoD’s $34.4 billion budget for nuclear weapons modernization as “very significant.” He acknowledged Russia has a nuclear-capable ballistic missile submarines, but downplayed the utility of the SLCM-N.

“The marginal capability that this provides is far outweighed by the cost,” he said.

Marking a break between civilian and uniformed leaders, the chief of U.S. European Command, Gen. Tod Wolters, told lawmakers last week he backs SLCM-N.

Then on Tuesday, the chairman of the Joint Chiefs of Staff, Gen. Mark Milley, said his past support for SLCM-N hasn’t changed. The Strategic Forces Subcommittee’s top Republican, Rep. Doug Lamborn, who elicited the answer, quoted Richard’s letter at the hearing.

But House Seapower Subcommittee Chairman Joe Courtney, D-Conn., defended the administration, arguing that installing low-yield nuclear warheads on Virginia-class attack subs would mean less space for conventional weaponry.

“I think the administration made the right choice in terms of keeping the attack subs focused on their main mission,” Courtney said. “Putting tactical [nuclear] weapons on there changes it in a clunky way.”

House Armed Services Committee Chairman Adam Smith, D-Wash., acknowledged the likelihood of a fight in the committee and echoed Courtney’s view that adding nuclear weapons would complicate the mission of attack submarines. He pointed to ongoing plans to develop a similarly capable air leg of the nuclear triad: the long-range standoff weapon.

Pressed by Smith to explain his views further, Milley said that with roughly 50 attack submarines in the fleet, there was room for some to get the SLCM-N and others to continue their usual missions.

“Some of those would have a mission change, others would not,” Milley said before pivoting to argue that America’s nuclear arsenal is sufficient.

“No foe should underestimate our capability because of … a decision to produce or not produce a SLCM-N. Our nuclear capability is much, much bigger than that,” he said.

The failed proposal came as Republicans, and some Democrats, have raised questions about whether Amazon tried to improperly influence the competition for the Joint Enterprise Defense Infrastructure, or JEDI, contract. In July, the New York Times reported on emails showing that an Amazon consultant turned Pentagon adviser pushed for a meeting between then-Defense Secretary Jim Mattis and Amazon founder Jeff Bezos.

The Department of Defense’s inspector general found in April that DoD’s award of JEDI to Microsoft over Amazon in 2019 didn’t violate any laws. The Pentagon subsequently announced in July it was canceling JEDI and replacing it with a new enterprise cloud contract that will likely include direct awards to Microsoft and Amazon next year.

During Wednesday’s markup of the National Defense Authorization Act, Rep. Jim Banks, R-Ind., proposed an amendment that would have required the DoD inspector general to submit to HASC all the documentation it collected and reviewed. He questioned the IG report’s credibility, alleging some of the emails it cited had been “edited and manipulated.”

“There have been allegations of corruption since JEDI’s inception, and recently the DoD Inspector General’s report has come under criticism,” said Banks, the top Republican on the cyber, innovative technologies, and information systems subcommittee.

The ensuing debate featured a tense exchange between HASC Chairman Adam Smith, D-Wash., and Rep. Matt Gaetz, R-Fla. Smith, leading opposition to the amendment, argued sharing the documents would slow the Pentagon’s follow-on enterprise cloud program by infusing it with the same toxic politics that encumbered JEDI.

“Politics came in because it was a $10 billion contract, and everybody wanted that money,” Smith said. “We can pull it back open again and have all those people go back at each other and restart the food fight, or we can move forward and actually get moving on the cloud.”

Gaetz told Smith, “I appreciate the gentleman from Washington making the pro-Amazon argument.” Smith cut him off and later responded that he had never supported Amazon and that Amazon’s competitor, Microsoft, is also based in Washington state.

Smith said Gaetz had made his point for him. “You were clearly, unequivocally, making the political argument that my argument must have less validity to it because I’m close to where Amazon is. That is exactly what happened over and over and over again as we tried to actually just move forward with the contract.”

Andrew Eversden contributed to this report.

In its version of the annual defense policy bill — which passed the committee last week, though full text of the language was only made public this week — the committee takes aim at U.S. Cyber Command’s so-called hunt forward operations.

Hunt forward operations involve teams from Cyber Command physically deploying to other nations to assist them with cyber defense. These operations provide American cyber teams insight into tactics that could be turned against U.S. networks or used to disrupt the elections process, officials have maintained.

The panel wants the department to develop a formal framework for these operations by February in order to enhance consistency, execution and effectiveness.

Such a framework should include, among others:

• Criteria for proposed hunt forward operations including specification of necessary thresholds for the justification of operations for partner cooperation.
• The roles and responsibilities of organizations in the support of the planning and execution of hunt forward operations such as Cyber Command, services components, the Office of the Secretary of Defense for Policy, the geographic combatant commands, cyber operations-integrated planning elements, joint cyber centers, and U.S> embassies and consulates.
• Predeployment planning guidelines to maximize operations success.
• Metrics to measure effectiveness of the operations.
• Roles and responsibilities of Cyber Command and the National Security Agency.

The bill’s provision also requires a briefing on the framework to Congress no later than March 21, 2021.

More broadly, the Senate Armed Services Committee’s draft of the National Defense Authorization Act asks for an assessment of cyber operational planning as well as deconfliction polices and processes by November 2021.

The assessment must evaluate:

• If the joint targeting cycle and relevant operational and targeting databases are suitable for the conduct of timely and well-coordinated cyber operations.
• If each of the policies and processes to facilitate technical, operational and capability deconfliction are appropriate for the conduct of timely and effective cyber operations.
• If intelligence gain-loss decisions made by Cyber Command are sufficiently well-informed and made in a timely fashion.
• If relevant intelligence data and products are consistently available and distributed to relevant planning and operational elements in Cyber Command.
• If collection operations and priorities meet the operational requirements of Cyber Command.
• If authorities relevant to intelligence, surveillance and reconnaissance as well as operational preparation of the environment are delegated to the appropriate level.

With several teams conducting offensive and defensive cyber operations around the world, deconfliction and planning is critical. The U.S. Cyber National Mission Force teams conduct offensive operations in the name of defending the nation in what are known as defensive cyber operations-response actions. The teams are aligned against specific nation-state actors. Teams that belong to the geographic combatant commands also conduct offensive operations against the actors within their purview.

On the defensive side, DoD-Information Network teams conduct global operations to operate and maintain the military’s network, while cyber protection teams across the world act as SWAT teams, defending and responding to network breaches.

Given the global nature of cyberspace, keeping these operations in check — and ensuring friendly forces aren’t tripping over one another — can be challenging.

DoD and Cyber Command have already established some mechanisms to ensure better planning and deconfliction of forces. They have established planning cells, known as cyber operations-integrated planning elements. Those elements are locally based within the staffs at the geographic combatant commands that are involved in the planning of operations, and they work alongside land, air and sea components.

Additionally, the Integrated Cyber Center and Joint Operations Center is tasked with, among other things, deconflicting Cyber Command’s global offensive cyber operations missions.

“Our job is now to provide the global view and to make global command and control decisions or to provide the data so that Gen. [Paul] Nakasone, [head of Cyber Command and director of the National Security Agency], can make those global decisions,” Maj. Gen. Charles Moore, director of operations at Cyber Command, told reporters last year. “We have to be able to look globally at the picture that we’re seeing, we have to be able to see what the enemy is doing, we have to know where our forces are positioned, and then obviously we want to be able to put our forces in the best position so that we can drive enemy activity as opposed to being in reactive mode.”

The committee’s version of the fiscal 2021 National Defense Authorization Act, released June 23, also includes other several other provisions designed to give the department increased insight into the cyber hygiene of its contractors.

For example, the legislation would direct the Secretary of Defense to establish a threat intelligence program “to share threat intelligence with, and obtain threat intelligence from, the defense industrial base.” This program would be required to include a mechanism for developing shared and real-time insight into the threat environment, as well as a “joint, collaborative, and co-located analytics.”

The program would also direct the DoD to invest in technology to advance automated threat detection and analysis capabilities for defense contractors.

The program proposed in the Senate NDAA stems from a similar recommendation made by the Cyberspace Solarium Commission’s final report, a congressionally mandated document that suggested a comprehensive overhaul of U.S. cyber strategy. That group recommended the DoD force contractors to participate in a threat intelligence sharing program.

“The program’s ideal end state is to leverage U.S. government intelligence collection to create a better understanding of adversaries’ intelligence collection requirements,” the report read. “This action would help DoD and the intelligence community anticipate where adversaries will seek to collect against DIB targets, and then communicate that information to DIB network owners and operators so that they can proactively defend against impending adversary activities.”

Under the Senate bill, participation in the program would be based on cybersecurity levels assigned to contractors under the Pentagon’s Cybersecurity Maturity Model Certification initiative, a new program pushing new cybersecurity requirements on contractors. To increase the participation in the program, the DoD would also have to “prioritize” available funding and support to help affect organizations participate.

The department would be required to produce a report on the program by March 2022.

The Senate bill also included language that would direct the DoD’s principal cyber adviser to develop a plan to deploy commercial-off-the-shelf sensors to DIB networks to monitor the cybersecurity of their public-facing websites by February 2021. In addition, the bill directs the department to assess the feasibility of threat hunting on DIB networks by December 2021.

The joint alert from the FBI and DHS’ Cybersecurity and Infrastructure Security Agency said the bureau is investigating hacks by Chinese-backed actors stealing intellectual property and public health data related to vaccines and treatments for COVID-19. The statement also warned that “the potential theft of this information jeopardizes the delivery of secure, effective, and efficient treatment options.”

Meanwhile, lawmakers on the Senate Homeland Security and Governmental Affairs Committee pressed members of the Cyberspace Solarium Commission on their 75 cyber policy recommendations. The commission’s aim was to improve U.S. cyber policy and the cybersecurity of America’s critical infrastructure, such as that related to health care or the electric grid.

“One of the things this pandemic has showed us is how vulnerable we are,” Sen. Angus King, I-Maine, said as a witness at the hearing. King serves as a co-chair on the Cyberspace Solarium Commission.

The commission report, released March 11, recommended a new, three-pronged U.S. cyber strategy dubbed “layered deterrence”: strengthening cyber defenses, establishing international norms and imposing costs.

The “imposing costs” piece has vexed policymakers from Capitol Hill to the executive branch, and the commission report doesn’t make specific recommendations for what that approach might look like. But one thing was clear to the commissioners: Costs must be imposed.

“If you come at us during a time of crisis, like the national pandemic, the response will be stronger,” King said. “The penalties will be stronger.”

Establishing international norms, or acceptable behavior in cyberspace, is another important piece of the solarium strategy, King said.

Gathering the support of the international community is critical to establishing these acceptable behaviors. For example, in February, the U.S. State Department and more than a dozen other nations joined to attribute a cyberattack on the country of Georgia to the Russian military .

“A system of norms, based on international engagement and enforced through these instruments of power, helps secure American interests in cyberspace,” King wrote in a joint opening statement with his fellow commissioners.

New roles in the executive branch

Both the commission report and the hearing signaled growing support for increasing the authorities of the Cybersecurity and Infrastructure Security Agency, or CISA.

The alert about Chinese-backed hackers boosted the sense of urgency. Just before the hearing, Sen. Gary Peters, D-Mich., sent a letter to President Donald Trump urging him to direct CISA and U.S. Cyber Command to prioritize assisting hospitals and medical research organizations with their cybersecurity.

CISA is supposed to be the lead agency on a range of cybersecurity issues, including protecting federal networks, election security and critical infrastructure. However, outside of federal agencies, CISA lacks the authority to direct organizations on what actions to take.

The Cyberspace Solarium Commission’s report seeks to boost CISA’s authorities — a step supported by several members of Congress. Sens. Ron Johnson, R-Wis., and Maggie Hassan, D-N.H., have introduced legislation that would give CISA the authority to issue administrative subpoenas to compel internet service providers to turn over contact information of critical infrastructure operators that CISA identifies as running vulnerable systems.

Right now, DHS has the ability to scan the internet for known vulnerabilities, but the challenging part for CISA is what comes next.

“What we cannot do without a tremendous amount of effort, and sometimes not at all, is to identify who owns that system so that we can reach out to them and warn them,” said Suzanne Spaulding, a commissioner and former director of the National Protection and Programs Directorate, which was later renamed CISA.

Johnson, the chairman of the committee, said he wants the administrative subpoena bill inserted into the annual defense policy bill. For its part, the commission wants to place about 30 percent of its recommendations into the defense policy bill, including pushing for the inclusion of several cyber workforce recommendations it outlined in a May 4 letter to leaders of the congressional Armed Services committees.

Senators also asked the commissioners how they propose the federal government can help state and local governments across the country, particularly as they deal with constant outbreaks of ransomware attacks. In the commission report, it recommends creating a cyber state of distress — a declaration that would give states access to federal resources.

“The key there is it would trigger the ability of CISA particularly to use funds to tap into a response and recovery fund to scale up to go out and help these researchers, these facilities that are being attacked, hospitals, our health care providers,” Spaulding said, adding that states would also be able to get help from the intelligence community or the Defense Department.

Cyber issues across the government, the commissioners argued, also require coordination under a new position in the executive branch, which the commission called the national cyber director.

There is interest in Congress about identifying the role of a national cyber director. King said he received a letter from Sen. Mike Rounds, R-S.D., asking for more details about structure and authorities of the position.

“We need somebody at a very high level who can oversee, coordinate and work on the planning with all these different disparate parts of the federal government that are working on this,” King said. “I think that’s an absolutely critical need.”

Top leaders from the National Security Commission on Artificial Intelligence, the Cyberspace Solarium Commission, and the National Commission on Military, National, and Public Service signed a joint letter dated May 4 urging top members of the House and Senate Armed Services committees to implement several recommendations to improve the government’s attraction, management and retention of cyber professionals.

“The United States is in a fierce competition to maintain its role as the leading world innovator,” leaders of the commissions wrote. “Losing our edge jeopardizes U.S. national security, U.S. global leadership and alliances, and, importantly, our values. In this strategic, global competition, the advantage will go to the competitor that can best attract, train, and retain world-class talent.”

The Cyberspace Solarium Commission, chaired by Rep. Mike Gallagher, R-Wis., and Sen. Angus King, I-Maine, urged the congressional committees to in turn push the Department of Defense to expedite the security clearance process, as well as research and develop clearer cyber workforce career paths and leadership roles across government.

The commission also urged committee leaders to boost funding for the CyberCorps program, a scholarship-for-service program meant as a pathway into the federal cyber workforce. The commission wants the program to graduate 2,000 students per year, a sharp rise over the 3,600 students it graduated since the program launched in 2001.

“While the implications of these workforce recommendations reach beyond the DoD and national security agencies, the organizations within the jurisdiction of the Armed Services Committees stand to feel the greatest impact of the success or failure of these efforts because an outsized proportion of the federal cyber workforce serves the national security mission,” King and Gallagher wrote.

Gallagher and King are scheduled to testify virtually on their report to the Senate Homeland Security and Governmental Affairs Committee on May 13. Gallagher recently said that the commission wants about 30 percent of its recommendations included in this year’s National Defense Authorization Act.

The National Security Commission on Artificial Intelligence, established by the fiscal 2019 NDAA to “consider the methods and means necessary to advance the development of artificial intelligence” for national security purposes, pushed for the legislation to include the expansion of the Cyber Excepted Service program to incorporate artificial intelligence programs. The Cyber Excepted Service program is a DoD program for managing civilian cyber talent, and offers recruitment and retention flexibilities.

Creating a new AI-specific hiring authority would only add to “the confusing proliferation of authorities,” the National Security Commission on Artificial Intelligence commissioners wrote. Its recommendations are part of its November 2019 interim report. Its final report is due March 2021.

The National Commission on Military, National, and Public Service, mandated by the FY17 NDAA, called on Congress to authorize every federal agency to adopt the Department of Homeland Security’s Cyber Talent Management System, a designated platform to manage DHS’ cybersecurity professionals.

It also pushed congressional leaders to start piloting a federal civilian cybersecurity reserve that would be run by DHS and the National Security Agency. Reservists would be called up in the event of an emergency that “exhausts agency cybersecurity capability.”

“To attract top talent, the government must streamline its hiring processes and recruit beyond conventional pathways into government,” the leaders of the commissions wrote. “Most, if not all, of the hiring authorities to do so are already in place, but institutional and cultural barriers reduce their use. To improve, we should encourage the use of existing authorities in a manner that maximizes flexibility to hire personnel for select billets and position descriptions. We should also collect better data and promote research on workforce dynamics to inform our next steps.”

In a May 4 letter sent to acting OMB Director Russ Vought, Sens. Marco Rubio, R-Fla., and Ben Cardin, D-Md., asked Vought to carefully consider to the needs of small businesses while the agency reviews a proposed rule.

The senators’ concern is in response to a proposed rule under review by OMB implementing Section 889(a)(1)(B) of the fiscal 2019 defense policy law — a provision that bans federal agencies from procuring or doing business with companies using “covered telecommunications equipment or services” in an effort to block Chinese tech companies like Huawei and ZTE from entering the U.S. government’s supply chain.

Rubio and Cardin are the top two senators on the Senate Committee on Small Business and Entrepreneurship.

According to the letter, OMB is currently reviewing the draft proposed rule, statutorily required to be implemented Aug. 13. Because smaller companies don’t have access to the same resources as larger suppliers, they may need “more assistance and time,” the senators wrote. The pair called the guidance for small businesses “vita,l” given that small businesses make up about one-quarter of federal procurement, worth $120 billion.

“By providing these small firms with a clear path toward compliance and a reasonable time frame, we believe that the goal of securing the United States supply chain will be better achieved,” Rubio and Cardin wrote.

Outside interest groups representing federal contractors have also pushed Congress to delay the implementation of Part B of Section 889. In a joint letter in late March, the National Defense Industrial Association and the Professional Services Council asked Congress to delay the Aug. 13 date to February 2021. They also cited the ongoing coronavirus pandemic as reason for a delay.

“Part B will impose significant financial and operational costs on medium and small-sized firms at a moment of substantial uncertainty and hardship. While we agree that Part B addresses a significant problem in defense supply chains, and that additional measures are needed to protect [Department of Defense] information assets from covered equipment, COVID-19 has made the current implementation timeline infeasible,” the groups wrote.

The United States government alleges that Huawei’s 5G technology allows for Chinese government espionage and poses a threat to national security. Senior U.S. officials have traveled the globe, urging allies not to include Huawei’s technology in their 5G networks. But the effort has been largely unsuccessful, particularly after the United Kingdom announced in January it would allow Huawei to build noncritical pieces of its 5G network. That decision was met with scorn by lawmakers on Capitol Hill.

Still, Rubio and Cardin warned that OMB needs to produce the regulation cautiously and carefully.

“We are concerned that if the regulatory implementation language fails to adequately consider small businesses, this process could not only result in an ineffective implementation of the prohibition, but also be both harmful and costly to thousands of small federal contractors,” they wrote.

According to Rep. Mike Gallagher, R-Wis., who co-chairs the Cyberspace Solarium Commission, which released a report with more than 75 cyber policy recommendations March 11, said on a webinar hosted by Palo Alto Networks that commission staff is working with the appropriate congressional committees and subcommittees to put about 30 percent of its recommendations into this year’s National Defense Authorization Act.

The report proposed a three-pronged strategy for securing cyberspace, called layered deterrence: shape behavior, deny benefit and impose cost.

The report also takes U.S. Cyber Command’s “defend forward” policy, which allows the military to take a more aggressive approach in cyberspace. It also suggests broadening the policy to encompass the entire federal government.

Gallagher didn’t specifically identify recommendations he thinks will be included in the NDAA, but given that the bill focuses on authorizing Defense Department programs, Pentagon-specific recommendations are the likeliest to be in the legislative text.

The recommendations for the department focus on ensuring that the Cyber Mission Force is adequately equipped; establishing vulnerability assessments for weapons and nuclear control systems; sharing threat intelligence; and threat hunting of the networks of the defense-industrial base.

The spread of the new coronavirus, COVID-19, disrupted the commission report’s rollout, which included congressional hearings on the commission’s recommendation. Those hearings have been canceled. But the pandemic also highlights the need to implement recommendations made in the report, Gallagher said, specifically the establishment of a national cyber director in the White House.

“The importance of having that one person, that singular belly button in the executive branch who’s coordinating efforts across government so that you don’t have to create an ad hoc task force, [so] you’re not scrambling to find who are the right people we need in the room after the crisis has already occurred,” Gallagher said

Before the spread of the coronavirus, congressional committees had planned to host hearings on the commission report, but those were canceled after the coronavirus spread throughout the United States. Congress is currently wrestling with how to remotely conduct voting and committee business, as the pandemic is restricting gatherings of large groups of people.

“Even though coronavirus has complicated some of … our commission rollout, we’re continuing the legislative process right now, and I’m pretty optimistic about our ability to shape this year’s NDAA,” Gallagher said.

As for the other recommendations, Gallagher said they aren’t germane to the NDAA and will take “some time.”

According to a letter from Rep. Jim Jordan, R-Ohio, addressed to Oversight Committee Chairwoman Carolyn Maloney, D-N.Y., an April 3 committee meeting with the special inspector general for Afghanistan reconstruction, was ‘zoom-bombed’ three times. Zoom-bombing is when a Zoom meeting is interrupted by an unauthorized attendee who disrupts a meeting with offensive images or language. The letter didn’t provide details of the incidents.

In the letter, Jordan urged Maloney to ban the use of Zoom by the committee for official business. Jordan cited reports of Zoom being used to deliver malware, occurrences of zoom-bomb attacks, an FBI warning about the platform’s cybersecurity protocols and concerns about Zoom’s business in China.

“Given the concerns surrounding Zoom’s security, it is clear Zoom is not an appropriate platform for Committee business, which may be particularly sensitive during the COVID-19 pandemic,” Jordan wrote.

Jordan added that “the impact of hacking and malware on Member and staff devices is still being determined” since the incidents. It is unclear who is leading the investigation. A spokesperson for the Republicans on the committee didn’t return a request seeking clarification.

The letter also stated that the committee planned to hold a Zoom meeting with the Federal Emergency Management Agency and the Department of Health and Human Services until it was switched over to a conference call hosted by HHS after the department and FEMA raised security concerns about using Zoom.

A spokesperson for the Democrats on the committee didn’t return a request for comment.

Earlier in the week, the Senate sergeant-at-arms circulated a memo to Senate offices warning of Zoom’s cybersecurity risks, according to Politico.

Zoom does have a government platform approved for use by the federal government, called Zoom for Government, which was authorized for use in the federal government by the Federal Risk and Authorization Management Program, which OKs cloud tools for use by government agencies.