The exchange began when Sen. Martha McSally, R- Ariz., questioned if there was enough informatjon sharing.

“Vertical information sharing amongst the government and with the private sector is something that is lacking,” McSally said. “The clearance issues, the opportunity to do tare lines so that the information can be shared out there is really important.”

In response, Karen Evans, the assistant secretary for cybersecurity at the Department of Energy, agreed that “the clearance process is an amorphous process.”

Energy committee chairwoman Sen. Lisa Murkowski, R-Alaska, continued: “We have heard that time and time and time again. I understand that it is still an issue even though we had addressed it through the fast tracks, that we continue to have holdups through the FBI.”

Sen. Angus King, I-Maine, expanded on the frustration with the background investigations bottleneck.

“The last time we checked in the intelligence committee there was a backlog of something like 750,000 security clearances. It’s a huge problem,” King said.

In fiscal 2016, only 10 percent of executive agencies reviewed in a Government Accountability Office report met timeliness standards for Top Secret clearances. But the American government has made some efforts to fix issues with security clearances in the cybersecurity sector.

During the 2018 midterm election season, the Department of Homeland Security pushed for more state and local officials to receive security clearances so they could receive classified threat briefings. Programs were also created to read-in executives of critical infrastructure sectors about cybersecurity threats the intelligence community was monitoring.

However, there have also been some setbacks.

Efforts from Sen. Mark Warner, D-Va. to reform the security clearance process in the 2019 Intelligence Authorization Act were stifled at the last moment and not included in the final bill. However, Warner has continued to push for the measure in new legislation proposed Feb. 1.

“The current vetting process for security clearances and positions of trust is too complicated, takes too long, costs too much, and fails to capitalize on modern technology and processes,” Warner said. “We must act now, especially amidst allegations of inappropriate granting and revoking of clearances and anxieties caused by the government shutdown.”

“You can outsource your operations but you cannot outsource your risk,” Bradford Wilkie, head of stakeholder engagement at the Department of Homeland Security’s cyber division said during a Feb. 6 briefing.

The Department of Homeland Security and the information security firms, Recorded Future and Rapid 7, said that the Chinese government sponsored group APT10 is responsible for attacking third-party companies that could leave the door open to a broad swath of potential victims. Examples of third-party companies include cloud service providers, data storage companies, internet providers and credit card companies.

“Malicious cyber actors working on behalf of the Chinese government have been targeting managed cloud service providers,” Wilkie said.

The Chinese embassy in Washington D.C. did not respond to a request for comment.

DHS officials specifically warned about the Cloud Hopper campaign, one that targets managed service providers who store sensitive details from the finance, telecommunications, biotechnology, consulting, and automotive industries. The Chinese hacking campaign is not limited to one location and has been spotted on every continent, according to a Homeland Security slide.

“This actor sweeps up collateral targets of opportunity, in addition to their primary targets of interest,” another slide said.

“In general, they are using widely available tools or living-off-the-land,” said Casey Kahsen, an incident response engagement lead at the Department of Homeland Security. “That’s part of what makes attribution so difficult.”

The hacking effort is tied to China’s five-year plan that promotes economic growth in the fields of robotics, next-generation information technology and biotechnology, according to the Department of Homeland Security.

Recorded Future and Rapid 7 also released a joint report Feb. 6 that warned of hackers targeting third-party service providers. The report cited the infiltration of Visma, a Norway-based cloud services provider worth more than $1 billion as an example.

“We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks, and not of stealing Visma intellectual property,” the joint report said.

An international apparel company and a U.S. law firm with experience in intellectual property law were also targeted by similar campaigns, the report said.

“It’s a lot more efficient to victimize a managed service provider if you know that 10 of your potential targets use that managed service provider for say, internet access,” said Priscilla Moriuchi, director of strategic threat development at Recorded Future told Fifth Domain.

“The global business community doesn’t have a handle on” supply chain management,” Moriuchi said. “Attackers know that. In this case we’ve seen the [Chinese] Ministry of State Security. The [Russian] GRU and likely a lot of others in the future are going to be employing a technique to attack third-party supply chains.”

Security Scorecard, an organization that tests cybersecurity, found that both endpoint security and patching actually increased inside the federal government during the five-week partial shutdown.

The study illustrates the complicated nature of improving cybersecurity inside the federal government and the overwhelming workloads IT officials face.

“The most secure computer is one that is turned off, and there were a lot of turned off computers during the shutdown,” Alex Heid, chief research officer at Security Scorecard, told Fifth Domain. “We saw a drop in internet traffic coming from .gov during the shutdown,” which made the federal government “less of an exploitable attack vector.”

And for the computers that were on, the Security Scorecard research found that patching, or applying critical updates, experienced a 1.38 percent gain during the shutdown.

Two potential reasons were cited. First, many essential security employees of the U.S. government were still working — with pay or without — during the federal shutdown. And because traffic was significantly reduced it was easier to patch devices during the shutdown.

“A lot of the more critical functions of the federal government continued to operate and it seems that patching exploitable conditions was one of them,” Heid said.

Federal employee workstations and mobile devices are considered to be the most vulnerable attack vectors, according to Security Scorecard.

The research also found that there was a 9.16 percent increase in endpoint security during the partial shutdown, which is correlated to the total number of internet traffic.

“Since the U.S. federal government was shut down, so were many of the workstations and endpoints. There was a noticeable drop in internet browsing traffic coming from the U.S. federal government,” the report said.

However, the report from Security Scorecard was not all positive.

The research found that network security decreased by 1.58 percent during the shutdown, which was caused by a rise in expiration of SSL certificates, which ensure encryption between a computer and a website. Still, this change was within the normal patterns of the U.S. government, according to Security Scorecard.

Heid admitted that he was “surprised by what we found,” but that it “makes a lot of sense.”

The federal government typically has some of the worst cybersecurity standards, according to the Security Scorecard report, although it has marginally increased over the past few years.

Overall, Heid said the positive and negative findings of the shutdown balanced out.

“There was very little impact from the standpoint of an external attack perspective,” Heid said. “The federal government’s network have always been a punching bag and incredibly vulnerable.”

The attack involves targeting the Domain Name System, the department said, which is the backbone of the internet’s address system.

“Using compromised credentials, an attacker can modify the location to which an organization’s domain name resources resolve,” the department’s Computer Emergency Readiness Team said Jan. 10 in a post on DNS hijacking. “This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization’s domain names, enabling man-in-the-middle attacks.”

Homeland Security ordered federal agencies to take four steps within 10 business days. That process included auditing DNS records, changing DNS account passwords, adding multi-factor authentication and monitoring certificate logs. It’s not clear how many employees will be effected by the change or if the changes can take place during a partial government shutdown.

The Washington Post reported that no intelligence or Defense Department networks have been affected, citing U.S. officials.

The emergency directive is one of the most significant public operations undertaken by the Cybersecurity and Infrastructure Security Agency since it was created in November, 2018.

In a previous update that detailed the DNS attack, Homeland Security referred to an analysis from the threat intelligence firm FireEye.

Then, FireEye said the DNS hacking campaign has “affected dozens of domains belonging to government, telecommunications and internet infrastructure entities across the Middle East and North Africa, Europe and North America.”

FireEye said there was evidence Iran was behind the campaign, citing IP addresses.

The threat intelligence firm said it found no clear pattern in how the attackers gained access to the DNS files, but added that in some instances used “sophisticated phishing attacks.”

“This type of attack is difficult to defend against, because valuable information can be stolen, even if an attacker is never able to get direct access to your organization’s network,” FireEye said. “This DNS hijacking, and the scale at which it has been exploited, showcases the continuing evolution in tactics from Iran-based actors.”

In the last two years, that’s meant new AI initiatives from the Pentagon, the Defense Advanced Research Projects Agency and the intelligence community. Now, the Intelligence Advanced Research Projects Activity is requesting information about research efforts on “cutting-edge machine learning techniques.” IARPA posted the formal request for information Dec. 4. The deadline for industry to submit information is Jan. 17.

“Of specific interest is the respondent’s knowledge of, and experience implementing, current, cutting-edge machine learning techniques,” the intelligence community’s research arm said. Respondents are required to have top secret clearances to work on the project, according to the IARPA listing.

In addition to its deep learning program, IARPA leaders want information about research into “future computing systems” that can self-learn. Such a move could have implications for improving government cybersecurity.

“The need for real-time (or near-real-time) analysis of massive amounts of heterogeneous data in this new era of explosive data growth has dramatically broadened the application space for advanced computers,” IARPA said. “The current volume and variety of data are already beginning to exceed the ability of today’s most advanced classical systems to deliver optimal solutions.”

Most cyber threat detection platforms use some form of artificial intelligence to create warning indicators, according to public and private sector officials. However, the U.S. government is behind the private sector when it comes to use of AI, said James Yeager, the public sector vice president at cybersecurity firm Crowdstrike.

“There is, by design, a more staggered type of approach to some of these advances in technology in the public sector, and as a result, the government is going to be behind the private sector,” Yeager said.

IARPA has a “very high-risk-but-high-reward approach to solving complex problems. They take a lot of time and take a lot of resources,” said Yeager. “But If they can come out of that research project with a silver bullet, it is going to benefit everyone.”

Andrew Laskow, a senior manager at Blue Prism, which provides AI products to federal government and defense agencies, said that in the U.S. government many people are “looking to AI for problems that they cannot solve.”

“There is still a misunderstanding at the highest levels of what AI can and cannot do,” Laskow said.

Public and private sector officials warn that AI-backed threat network indicators can overload users and create too many warnings.

Michael McGeehan, head of business development at Blue Prism, described intelligent automation being broken down into the “thinking side” and the “execution side.”

The artificial intelligence platform is the “thinking side” that makes decisions and is analogous to the human brain. On the other hand, robotic processing automation is the “execution side” that carries out tasks, like an arm or a leg.

“How can we ever hope to recruit or maintain IT talent when hardworking government workers are told: ‘Sorry, you aren’t getting paid, but you still need to come to work’ or ‘Sorry, but no paycheck this week because of politics?’” Rep. Robin Kelly, D-Ill., said in a statement. “Large private sector companies never say this to their employees and these are our competitors when it comes to IT talent recruitment.”

In the previous Congress, Kelly was ranking member of the IT subcommittee and is expected to chair the body in the new session.

Concerns about the shutdown only complicate an already difficult job market for federal government agencies. Between April 2017 and March 2018 there were more than 300,000 open cybersecurity jobs, according to research by CompTIA, with more than 13,000 alone in the public sector.

However, the talent gap in Washington, D.C., is already expected to worsen with the introduction of Amazon’s second headquarters in the Crystal City area of Arlington, Virginia, just blocks from the Pentagon.

“With the addition of an Amazon HQ2, federal agencies are no longer going to be able to recruit top-tier talent to the government directly. Not many are going to want to work for a federal agency when they can work for Amazon,” said Steve Witt, a director at Nintex, a software company specializing in automation. “With government shutdowns occurring on a somewhat regular basis, and the current shutdown being longer than past ones, it’s making private employment far more appealing.”

Roughly 800,000 federal workers are affected by the shutdown, which has taken a particular toll on the cybersecurity community.

The National Institute of Standards and Technology is experiencing an 85 percent cut in its workforce. The Director of National Intelligence’s analysis and operations staff has been slashed 60 percent. And the newly created Cybersecurity and Infrastructure Security Agency has 45 percent of its staff furloughed.

In addition to federal employees who are either furloughed or working without pay, the shutdown affects private contractors as well. Experts have previously told Fifth Domain that federal services companies may experience cash-flow shortages.

“Unlike federal civilian employees, no one provides these contractor employees with back pay to cover their lost work,” wrote David Berteau, president of the Professional Services Council, a membership organization of government contractors, in a Jan. 8 letter to President Donald Trump. “These contractors work side-by-side with their government counterparts, motivated by the same goals of public service and safety. They deserve to be treated the same as their federal civilian counterparts.”

Jessie Bur contributed to this report.

As President Donald Trump and congressional Democrats continue to feud over spending for a border wall and parts of the federal government remain shutdown, some of the federal government’s cybersecurity community remains out of commission.

Among the heaviest hit areas of the government are the National Institute of Standards and Technology, which has 85 percent of its staff furloughed. Because of the shutdown its public standards, which are also relied on by private companies and for cybersecurity courses, have been removed from the internet. Nearly half of the staff from the Department of Homeland Security’s new Cybersecurity and Infrastructure Security Agency are furloughed.

“A lot of real heavy lifting to secure the critical infrastructure is done by my DHS colleagues,” wrote Allan Friedman, a director of cybersecurity at the Department of Commerce’s National Telecommunications and Information Administration. “None are being paid — including those running the 24-hour watch at the [National Cybersecurity and Communications Integration Center]. Only half of them are able to do their job.”

Other parts of the federal government’s cybersecurity remain fully operational. The Pentagon, U.S. Cyber Command and most areas of the intelligence community are not affected by the shutdown. The Treasury Department’s IT and computer security incident response are deemed essential as well.

However, the biggest impact of the shutdown will not necessarily be felt in the short term.

“Operational, mission-critical employees are mostly designated as essential, and so we can expect that network monitoring will continue and cyber security incidents will get an appropriate response,” wrote Phil Reitinger in a post for the Global Cyber Alliance, a membership organization that promotes strong cybersecurity behavior. “What worries me most is the long-term effect of further limiting the pool of cybersecurity people who are willing to work for government.”

As the standoff continues, available financial reserves that agencies have saved are set to dwindle, Alan Chvotkin, executive vice president for the Professional Services Council, previously told Fifth Domain. Some contractors are also facing cash-flow difficulties, Chvotkin said. Some government officials contacted by Fifth Domain needed special permission to even answer emails and make phone calls. Those who had previously scheduled travel plans were unsure if their trips would go through.

Roughly 800,000 federal workers have been affected by the shutdown, according to the White House.

Political disagreements over $5 billion in funding for a southern border wall showed no signs of abating Jan. 2, after Trump met with incoming House Majority leader Rep. Nancy Pelosi, D-Calif., and Sen. Chuck Schumer, D-N.Y.

Some 800,000 government workers are affected by the shutdown, which is set to enter its third week.

For government contractors, the impasse may bring uncomfortable dilemmas.

Some government contractors may face cash-flow shortages if the shutdown continues, Alan Chvotkin, executive vice president for the Professional Services Council, told Federal Times. Because some contract-workers are still required to perform their contracts but their employers are not being paid, the government service providers face an unexpected cash-flow deficit, Chvotkin said.

The financial impact of this budget shortfall will vary based on the size and cash reserves of each contractor, he said.

“Smaller companies that do not have a large number of contracts may not have the cash reserves, and the risk for them is greater,” Chvotkin said.

These companies may ask their employees to take time off, ask them to take training days or will ask banks for lines of credit to cover the timing of any cash-flow shortage, he said.

The practice of “working at risk,” when government contractors perform services without funding or a contract, is common during shutdowns, Guy Timberlake, chief visionary officer of the American Small Business Coalition, told Federal Times.

“Some companies will take a loss since they may not be able to invoice some or all of the time worked by employees during the shutdown,” Timberlake said. The practice “is not specific to one industry, but spread across healthcare, intelligence, cybersecurity and other sectors.”

Some government employees are also working without pay.

According to Senate Democrats, 6,503 staff from the State Department, 35,000 Internal Revenue Service and more than 50,000 staff from them U.S. Department of Agriculture are currently working without pay.

The last time government contractors faced such a dilemma was in 2013 during a 16-day shutdown. That may be a case study for government contractors and their employees.

“Some contractor employees were reportedly laid off during the shutdown and furloughed contractor employees were not necessarily paid by their employer during or after the shutdown,” according to a Government Accountability Report that analyzed the impact of the 2013 spending shortage.

The effects of today’s shutdown are being felt in other ways as well.

In most circumstances, the Pentagon cannot enter into new contracts with defense firms, according to the National Defense Industrial Association. Nineteen Smithsonian museums and the National Zoo closed to the public on Jan. 2 because of their funding shortfall. The National Institute of Standards and Technology website, which offers guidance on federal cybersecurity standards that are often used by businesses, has a temporary homepage.

Two new papers attempt to narrow that expansive philosophical divide and give an insight into how AI will be used for cybersecurity in the future.

Artificial intelligence-powered machines are “likely to become primary cyber fighters on the future battlefield,” Alexander Kott, chief scientist at the Army Research Lab, wrote in a Dec. 18 edition of the Army’s Cyber Defense Review.

“Today’s reliance on human cyber defenders will be untenable in the future,” Knott wrote, citing the growing complexity of future fighting. Those conflicts are made more difficult by exponentially more connected devices, robotic battles and other coming technological innovations.

Knott, whose research is specific to cybersecurity in future battlefields, suggested that current AI technology is not adequate. He argued that because of the fluid nature of fighting, the number of connected devices and deficiencies in mobile computing power, machine learning “must experience major advances to become relevant to the real battlefield.”

But Knott’s criticisms of current artificial intelligence capabilities on the battlefield mirror other complaints about the technology from the broader cybersecurity industry.

Most advanced threat-detection technologies use some form of AI to flag a potential incident, but experts have told Fifth Domain that an influx of false positives from this technique can create “threat fatigue” if not properly calibrated. For example, IT and security organizations receive roughly 17,000 malware alerts per week, according to a study by research firm Ponemon. Only 19 percent of those alerts are considered reliable, and only 4 percent are investigated, according to the research.

Another paper in the same Dec. 18 edition of the Army Cyber Review argues that using blended approaches to AI might enhance cybersecurity defense.

Most artificial intelligence can be categorized as either “symbolic” or “non-symbolic.”

Symbolic AI means the use of automated logic that has been pre-programmed, like decision trees.

Non-symbolic AI means the use of a program that is able to self-learn threats and identify anomalies.

Researchers at AI research firm Soar Technology have used both machine-learning concepts in a Navy project to boost cybersecurity defense.

“To realize the full potential of AI, we must integrate its various forms in order to offset the limitations of each,” wrote the paper’s authors, Scott Lathrop and Fernando Maymí, who both work for Soar technology. “No one approach will be sufficient because each approach is optimized for one specific set of problems at the expense of others.”

Researchers are already addressing these and other current limits of AI.

Examples include autonomous deception tactics, deep learning research that uses high-powered computers and autonomously distributing networks to prevent DDoS attacks.

In July, the Pentagon signed a five-year, $885 million contract with Booz Allen Hamilton, a defense contractor, for an AI project. Specific details of the project are not clear.

In addition, the Pentagon released its AI strategy in August. That document suggested that in the short term the Department of Defense should develop “a database that captures potential or known cybersecurity vulnerabilities of the various sensors” that are essential to machine learning.

Regardless of the length of his tenure, Shanahan, the Pentagon deputy since 2017, has been one of the Pentagon’s top advocates for stronger contractor cybersecurity and IT acquisition and will lead the department months after it was given expansive and loosely defined authorities to conduct offensive cyber operations.

How Shanahan will handle these greater cyber authorities, even on a temporary basis, remains an open question that will be tested immediately amid evolving challenges, such as an alleged hacking campaign from China.

Unclear views on cyber operations

In August, the secretary of defense was given the ability to conduct offensive cyber operations without informing the president as long as it does not interfere with the “national interest” of the United States, four current and former White House and intelligence officials have told Fifth Domain.

A Pentagon official told Fifth Domain that while there is a general outline of what specific operations may affect the American “national interest,” some details are not explicitly defined.

And a review of his public remarks show that Shanahan has not made significant comments about how America should conduct offensive cyber operations. He has shied away from giving detailed responses about U.S. Cyber Command.

“There are two new war-fighting domains, cyber and space, for which we are developing doctrine and capabilities,” Shanahan said Sept. 19.

A spokesperson for Shanahan did not respond to questions from Fifth Domain.

Focus on defense contractors

As deputy, Shanahan has focused on “re-wiring” the Pentagon. He has called good cybersecurity “foundational” to working with the department.

“Cybersecurity is, you know, probably going to be what we call the ‘fourth critical measurement.’ We’ve got quality, cost, schedule, but security is one of those measures that we need to hold people accountable for,” Shanahan said Sept. 19 during an Air Force Association conference.

Shanahan’s focus on contractor cybersecurity comes as China is believed to be targeting defense contractors, particularly those on the lower end of the supply chain, in an attempt to steal sensitive American secrets, according to intelligence officials and industry executives.

Shanahan, however, has placed responsibility among the top defense firms.

“I’m a real strong believer that the Tier 1 and Tier 2 leadership has a responsibility to manage the supply chain,” Shanahan said in the Sept. 19 speech.

In October, Shanahan was put in charge of a new Pentagon task force to combat data exfiltration that focuses in part on these defense firms.

“Together with our partners in industry, we will use every tool at our disposal to end the loss of intellectual property, technology and data critical to our national security,” Shanahan told Fifth Domain in October.

A specific area of focus inside the department is finding out which companies are in the Pentagon’s supply chain, according to officials involved in the process, but it is not clear if it is specifically part of Shanahan’s task force.

Inside the Pentagon, Shanahan has also emphasized the need for smarter IT acquisition.

In an October. interview with Fifth Domain, Shanahan expressed frustration with the Pentagon’s procurement process, but said to expect “a number of things that are foundational to being able to achieve enterprise solutions.”

He hinted that those changes are focused on the “right platforms and the right level of integration” that can support high-end computing and artificial intelligence.

“I’m super frustrated that we can’t go faster on like basic things like the cloud,” Shanahan said. “Most of everything we do is software-driven.”

Aaron Mehta contributed to this report.