January 12, 2017
Sasse: "Do you believe that the U.S. military has a sophisticated, broadly understood cyber doctrine?"
Mattis: "No, I do not believe so."
U.S. Senator Ben Sasse (R-NE), a member of the Senate Armed Services Committee, thanked retired Marine General James Mattis, President-elect Donald Trump's nominee for Secretary of Defense, for his exemplary service and discussed the need for a clear and coherent cyber doctrine.
A full transcript of the exchange is found below.
Senator Ben Sasse: General, thanks for your past service and your soon to be future service. Could you tell me, do you believe that the U.S. military has a sophisticated, broadly understood cyber doctrine?
General James Mattis (Ret.): No, I do not believe so.
Sen. Sasse: When will we? Can you unpack for us a little bit of the path toward both an offensive and defensive strategy?
Gen. Mattis: Because of the cyber domain, Senator, it is not something the military can do in isolation. This is going to require us to work with Homeland Security and a number of other government elements in order to make certain what we do in the military realm is connected to what they're doing in their realm because cyber cuts across everything we do today. So you can't do something in isolation and that slows down the process. Now I’ve not been part of it up until now, but I anticipate that's part of the reason why I can't give you a positive answer right now.
Sen. Sasse: Thank you, sir. I’m one of only five people in the Senate who’s never been a politician before. So I've been here 24 months and over those 24 months, we've consistently heard that we're right around the corner from having a cyber doctrine. Do you think we will in 18 months?
Gen. Mattis: Sir, I've got to scope this problem and figure out what are the issues that have caused us not to have an integrated policy right now and especially being this is going to take an integrated effort by the Executive Branch and probably up here on Capitol Hill. There are also, perhaps, privacy concerns, constitutional concerns as part of this, we're going to have to put all of this together and take it one step at a time and come out with what we think we can do quickly and I would hope that part of it can be done faster than 18 months from now. But, this is a very big issue.
Sen. Sasse: Thank you. Do you think it is possible that a traditional espionage operation could constitute an act of war? For example, if Russia were to hack and publish U.S. Continuity of Operation plans, would that be an act of war?
Gen. Mattis: Senator, I think I would have to study act of war and the ramifications of making that statement. Generally to me, an act of war means we're going to war if it happens. That's a grave decision and I wouldn't put it on automatic pilot. I would make certain we know where we stand, make certain we know what happened, and then you would have to act appropriately.
Sen. Sasse: Many of us here are concerned that the public crisis of confidence, the accelerating public distrust, is partly related to the perception that governmental responses in the Executive Branch right now to different foreign hacks are treated differently, partly based on the partisan and political assumptions people make about them. If you look back to the OPM hack 18 months ago, we were told this was a fairly traditional espionage operation. But it seems to me when 22 million, or whatever the exact number is, of Americans who have been serving their government have their information hacked and stolen and potentially leaked, that isn't just traditional espionage operation, and certain uses of that data in the future, we need to countenance what that might mean. Could you tell me, do you believe that the U.S. should be actively deterring these sorts of cyber attacks? And I assume that you’re going to say yes and can you tell us a little bit more about what the doctrine of deterrence looks like in the cyber domain?
Gen. Mattis: Senator, the answer is yes, and my personal information was part of that leak. So I understand it--
Sen. Sasse: Mine too.
Gen. Mattis: --in rather personal terms. But I would also tell you that we have got to put together a doctrine that works. I have looked at several different doctrines back when I was on active duty. I looked at nuclear warfare doctrine. Mutual assured destruction will not work, by the way. I came to the conclusion that that one was not the right way to go. But we're going to have to come up with the guiding principles for how we're going to deal with this sort of thing and right now I can't give you a good answer.
Sen. Sasse: I have only a few seconds left so, in closing could you just tell me a little bit about what you think our human capital pipeline looks like in cyberspace? Are we prepared for the kinds of battles we're going to be facing going forward?
Gen. Mattis: Senator, I think we have to get the best possible people in. This is a complex area that requires technical expertise and once we get the policy written, that will help us to guide recruiting and organization and that sort of thing but we've got to get the policy right up front.
Sen. Sasse: Thank you, sir.