“Data Centers, Telecommunications Networks, and Space-Based Systems: Modernizing DHS’s SRMA Role for the Communications and IT Sectors”
No chapters available yet
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection U.S. House of Representatives
Follow its sittingsSpeaker 1
Thank you, ranking member Thompson. Before we proceed, I would like to also take a moment to formally welcome ranking member Ramirez as the ranking member of the cybersecurity and infrastructure protection subcommittee. The subcommittee has often been a setting for bipartisanship and collaboration, and I look forward to working with you going forward as we examine and address key issues of cyber and national security. And just as I am going to reserve my opening statement till after the vote series, would you like to do the same? The ranking member is gonna reserve her opening statement as well, and then we'll proceed forward.
Other members of the committee are reminded that opening statements may be submitted for the record. I'm pleased to have a distinguished panel of witnesses before us today on this important topic pursuant to committee rule eight c. I ask that our witnesses please rise and raise their right hands. Do you solemnly swear that the testimony you will give before the committee on homeland security of the United States House of Representatives will be the truth, the whole truth, and nothing but the truth? So help you God.
Let the record reflect that the witnesses have answered in the affirmative. Thank you, and please be seated. I would like to formally introduce our witnesses. And, again, thank you for being here, and my humble apologies for the disruption and the flow. Make sure that's not me.
Okay. Of the proceedings, we'll get to votes, we'll come back as quickly as possible. Mister Robert Mayer is senior vice president of cybersecurity and innovation at US Telecom, the broadband association with responsibility for leading cyber and national security policy and strategic initiatives. He's the current chair of the communications sector coordinating council and serves as co-chair of the Department of Homeland Security's ICT supply chain risk management task force. Mister mayor has previously served as the top telecommunications official for New York State, held various regulatory consulting and analyst roles, and served in the US Air Force, supervising intelligence communications operations.
Mister Sam Visner is the chair of the board of directors for the Space Information Sharing and Analysis Center. He also serves as security director of Netcracker Technology, which he represents as a member of the executive committee of the communications sector coordinating council. Mister Visner is the former director of MITRE's National Cybersecurity FFRDC, or NCF, and served as chief of signals intelligence programs at the National Security Agency. Rear Admiral Mark Montgomery is senior director of the Center on Cyber and Technology, Innovation, CCTI, and a senior fellow at the Foundation for Defense of Democracies. At CCTI, he leads efforts to advance US national and economic security, counter cyber threats, and combat adversary cyber-enabled economic warfare campaigns.
RADM Montgomery also serves, also leads, rather, CSC 2.0, an initiative focused on implementing the recommendations of the Cyberspace Solarium Commission. Prior to these roles, he was the policy director for the Senate Armed Services Committee and served for 32 years in the US Navy. Mister Scott Alger is the founder, president, and CEO of cybersecurity consulting firm Conrad Inc, executive director of the information technology, information sharing, and analysis center, ITISAC, and executive director of the food and agriculture information sharing and analysis center. He has spent the past 20 years at the intersection of cybersecurity policy and operations. Previously, Scott was manager of homeland security at the US Chamber of Commerce, where he coordinated the US Chamber's critical infrastructure protection, cybersecurity, and disaster management public policy initiatives.
I wanna thank each of our distinguished witnesses. The amount of experience you have on this panel is, represents a couple 100. And for that, we thank you for your time here. So with that, I now recognize Mister Mayer for five minutes to summarize his opening statement.
Speaker 2
Chairman Gaborino, ranking member Thompson, chairman Ogles, ranking member Mire Ramirez, and members of the subcommittee. Thank you for the opportunity to testify today. I'm Robert Mayer, senior vice president of cybersecurity and innovation at US Telecom, and chair of the communication sector coordinating council. I also serve as cochair of the Department of Homeland Security's ICT supply chain risk management task force. Today, I will focus my remarks on three areas.
Our partnership with the Cybersecurity and Information Security Agency, CISA, the importance of sustaining and modernizing authorities for public-private coordination, and the need for greater visibility and coherence in the ICT supply chain. For over six decades, the communication sector has worked hand in hand with the federal government to help protect the systems Americans rely on every day. And that partnership has become even more critical as cyber threats have grown more persistent, sophisticated, and far-reaching. Some of the most meaningful advances in communication security have come from sustained operational engagement between government and industry through efforts like the president's National Security Telecommunications Advisory Committee, NSTAC, the Joint Cyber Defense Collaborative, JCDC, and the Enduring Security Framework, ESF. We look forward to supporting the critical infrastructure fortify program, which will deepen structured engagement between CISA, allied partners, and industry to help critical infrastructure organizations rapidly respond during periods of degradation.
We should also build on proven mechanisms for collaboration while advancing durable programs such as the proposed Alliance of National Councils for Homeland Operational Resilience or Anchor Initiative, to support continuous engagement between government and industry on cybersecurity and resilience. This commitment must also extend beyond federal coordination. Strengthening resilience requires investment across the broader ecosystem that critical infrastructure depends on, including support for state and local cybersecurity preparedness. That is why it is essential that chairman Ogle's bipartisan pillar act move swiftly through Congress to help strengthen cybersecurity capabilities at the state and local level. Congress can also help by delivering robust communications infrastructure through streamlined permitting processes and accelerating broadband deployment.
Equally important is modernizing broadband networks. Continued investment in next-generation infrastructure such as fiber deployment and data center connectivity enhances both performance and security of the communications networks. Congress and multiple administrations have taken important steps to address legitimate national security concerns tied to the supply chain ecosystem, particularly as geopolitical threats have intensified. But too often, these efforts develop across multiple agencies and authorities in parallel, rather than in coordination. Greater alignment across agencies, clearer lines of authority, and more transparency in how supply chain-related risks are identified and managed would help industry respond more effectively to emerging threats while strengthening broader national security objectives.
As the president, cyber strategy for America strongly emphasized, strengthening the partnership between government and industry and modernizing the frameworks that support coordination will bring greater coherence to cybersecurity policy and operations. We look forward to working with our government partners as we build a more secure and resilient foundation for the systems that our nation depends on every day. Thank you, and I look forward to your questions.
Speaker 1
Thank you, Mr. Mayor. I now recognize Mister Visner for five minutes to summarize his opening statement.
Speaker 4
Thank you, mister chairman Ogalls, ranking member Jimenez, mister Thompson, and members of the subcommittee on cybersecurity and infrastructure security protection. Thank you for the opportunity to speak before your subcommittee and share with you my thoughts on the protection of the swiftly evolving telecommunications, information technology, and space ecosystems, all of which are vital to our national and economic security. Having failed retirement, I have the honor to serve as the chair of the board of directors of the Space Information Sharing Analysis Center, or ISAC. We were founded in 2019, and we are the principal information sharing platform for industry and between industry and government regarding threats to our space systems. And while our initial focus was on cyber threats to these systems, we look at a wide range of threats, including cyber, jamming, spoofing, supply chain challenges, space weather, and more.
The space ISAC and other ISACs, as you know, are led by and funded principally by our industry and academic members. The ISAC partners, however, with the public sector. We have in place MOUs with several US government agencies as well as space and cybersecurity government authorities in Australia, Canada, France, Greece, Germany, Israel, Taiwan, and the United Kingdom. And more partnerships are in progress, including a recent MOU we signed with NATO. We set up in 2023 an operational watch center in Colorado Springs, one that monitors threats to space systems using a wide range of data from our members, partners, and open sources.
And we use the DHS traffic light protocol to control the dissemination of that reporting. We've also announced global hubs in Australia, Canada, Japan, and the UK. As these global hubs become operational and as we build watch center components in these countries, the ISAC will gain 24/7 follow the sun coverage of space systems environment, threats to that environment, and incidents that affect the security and resilience of that environment. Information about these and other space ISAC developments can be found at the length that I've been placed into my written testimony. We also convened task forces and working groups to examine and propose challenges and approaches to key space system security challenges, including space system governance, analysis, quantum security, and now the security of CISLUNAR operations and other domains.
The ISAC has grown rapidly. We have over 120 members. We're a member of the National Council of ISACs in the US and the EU Council of ISACs as well. From this foregoing, I hope to make clear a few key points. First, the speed and scope with which we have operated and will continue to operate reflect our view that all critical infrastructures depend on space.
While in 2019, there were about 2,000 active satellites, today we count over 14,500 with estimates ranging from 30,000 to as many as 60,000 by 2030. Surface and air transportation systems depend on space-based navigation. Maritime fleets use space systems for navigation as well as communication. Space systems provide timing data for our power grid. Space based remote sensing is vital to farming, including what we call precision agriculture, which uses space based systems to pinpoint areas for cultivation and fertilization.
Financial systems depend on space infrastructure, with satellite communication technology providing precision timing for transaction time stamps, GPS for global synchronization, and secure data connectivity, even for remote ATMs and high frequency trading. Space-based communications link remote locations, and commercial space systems are being used by our government for national security and civil government. Industry now leads government in the number of space-based imagery platforms. Global 5G networks using thousands of satellites are providing worldwide 5G IT backplane. So space ISAC's members and partners regard space systems as absolutely critical.
Second, much of the space systems domain is comprised of unique infrastructure, including manufacturing, launch, ground segment, user segment, and now cislunar operations. These infrastructures are growing rapidly, and our members and partners believe we can book no delay in the protection, security, and resilience of these supply chains. Cislunar operations are gonna have their own unique infrastructures, including their own navigation satellites, and planning for the security of these new infrastructures should start now. Next space system missions are evolving. We're likely to see Cislunar and asteroid mining, new commercial space stations, energy production, orbital cloud, and data centers.
And all of these, securing all of these, will pose their own challenges. And I'm gonna abbreviate my comments because we are running out of time. From the, we leave that these the security of these systems must be a global endeavor. To that end, the space ISAC has been, from its inception, a global effort that includes our allies and partners. We should remind each other that prior to Russia's attack on Ukraine, the first thing they did the day before they crossed that border was, in fact, an attack on a commercial space-based satellite communication system.
And we have continued to track and report to our members and partners attacks by our adversaries on the space systems on which we depend. Let me, at this point, abbreviate my comments. Thank you very much. I look forward to your questions. Thank you.
Speaker 1
Thank you, Mr. Vishnar. I now recognize Rear Admiral Montgomery for five minutes to summarize his opening statement.
Speaker 5
Thank you, Chairman Ogles, ranking members Thompson and Ramirez, and distinguished members of the subcommittee. On behalf of the Foundation for Defense and Democracies, thank you for the opportunity to testify today. The subject of this hearing is timely. You know, our nation is under attack in cyberspace. Our adversaries are increasingly seeing our communications networks as a US vulnerability, and China particularly is conducting operational preparation of the battlefield, activities that attack and put malware into our systems.
They also do espionage and intellectual property theft against companies and critical infrastructure. At the same time, we appear to be reducing our investments in cyber defense. I think America's national cyber resilience rests on three legs. The first is a capable federal government able to mitigate, thwart, deter, and punish attackers. The second is an informed private sector properly resourced to defend itself from these attacks.
And third is a robust public-private collaboration together that facilitates the collective defense of the US economy and national security. Surprisingly, over the past year, the administration's reduced funding for key offices and decommissioned collaboration mechanisms such as CPAC, which I think are critical to our cyber defense. But honestly, Congress hasn't done much better. While this committee has shown important leadership on cybersecurity issues, unrelated partisan fights and inter-chamber disagreements have blocked the passage of important legislation. And while we fumble this ball, our adversaries are advancing.
As I said, China continues to position destructive capabilities on our critical infrastructure. They use covert compromised networks strategically and at scale to conduct their malicious campaigns. Countering these threats is gonna require reinforcing the three legs of that national cyber resilience table. A critical component of that reinforcement is what this committee is looking at today, how the federal government fulfills its commitments to the private sector. Most specifically, how does DHS support the resilience of the rapidly expanding and evolving components of the communications and information technology sectors, data centers, telecommunication networks, and space-based systems?
If our nation does not properly secure these assets, our adversaries will steal, corrupt, and disrupt the data and communications that allow our economy to function. Now data centers and cloud infrastructure are becoming more vital to the American economic prosperity in our society, due to their important role in enabling online services and telecommunications networks. The explosion of AI innovation has catapulted debates about the construction of data centers in the national spotlight, but I believe the cyber and physical resilience of those data centers merits an equal level of attention. The proliferation of these data centers is also increasing the demand for electricity, and it's also leading to the digitization of the grid. We gotta make sure that in the pursuit of cost savings, we don't embed Chinese-made components in critical control layers of the grid.
Now understanding these sorts of risks and prioritizing mitigations requires a collaboration between the hyperscalers, the energy providers, and the federal government, and within the government between the Department of Energy and CISA. Now, over the past year, there have been some bright spots. The FCC has supercharged its efforts to ban Chinese state-owned emerging technology from critical infrastructures. And specifically, the FCC leveraged its regulatory authority to prohibit the sale of Chinese-made connected devices in the United States. This is vital national security work, but it should not diminish what CISA needs to do as the secretary's management agency for the communications sector.
You know? And in fact, banning Chinese telecommunications equipment is important. But in the case of Salt Typhoon that ranking member Thompson mentioned, the access vector was American Cisco routers. So, really, critical infrastructure is not just about who manufactures the hardware, but also about whether the manufacturers and the operators properly maintain it. In this regard, the administration's recent dissolving of CPAC and disbanding of the cyber safety review board were both unhelpful actions.
And I'm concerned that these failures are symptomatic of a greater problem in CISS' ability to carry out its SRA duties for the communications sector writ large. And within that sector, it's the security of the satellite communications and other space-based assets that gives me the greatest heartburn. As Sam mentioned, one of the first volleys in the Ukraine war was a Russian cyberattack against an American satellite communications company. You know, the consequences of failing to protect US space systems and ceding space superiority to adversaries would be detrimental to national security. That's why I continue to endorse designating space systems as a US critical infrastructure sector, so that space-based assets receive the policy attention and risk management support they deserve.
And I also support making NASA the sector's risk management agency. Now we need to act, now as our adversaries pursue these deliberate efforts to erode US space superiority. In my written testimony, I provided 6 good recommendations. I'll just say the one that I really wanna emphasize is fully funding CISA and ensuring that CISA conducts an effective force-structure assessment. Thank you for the invitation to testify, and I look forward to your questions.
Speaker 1
Thank you, admiral. I now recognize Mister Al Alger for five minutes to summarize his opening statement.
Speaker 6
Thank you, Mr. Chairman. Thank you, ranking member Thompson. Thank you, ranking member Ramirez, members of the committee. Thank you for the opportunity to be here today. As mentioned, my name is Scott Alger.
For nearly 21 years, I have served as the executive director of the information technology, information sharing, and analysis center. The ITI SAC is a not-for-profit, nonproducing industry association formed in 2000 with a simple premise that we're all stronger together. At a time when we are resourced and highly skilled nation state actors are targeting industry, the IT helps companies make informed risk management decisions through voluntary threat intelligence sharing. Our members span almost every segment of the IT sector that propels today's global economy. The ITI stack has long considered CISA to be a key partner.
We value the relationships we have built with CISA. We have always engaged in an honest and nonpartisan way, and we'll continue to do so. The threats facing critical infrastructure have never been more serious, and the ability to defend against them is strained. Capabilities, partnerships, and programs that industry depends on have been reduced or eliminated. Engagement with industry on operational threat intelligence matters is also reduced.
The good news is that there is a path to renew and strengthen CISA. This could be achieved through the following actions. Implement a replacement for the CPAC. When CPAC, when DHS disbanded CPAC, it removed the legal framework that enabled and protected the strategic engagement between CISA and industry. As a result, most of the work with CISA is at a standstill.
Our adversaries have not paused. They have not stopped. They are continuing to attack with impunity. Provide for a long-term extension of the Cybersecurity Information Sharing Act of 2015. CISA 2015 is a critical tool that provides liability, antitrust, and euphoria protections for sharing cyber threat intelligence.
It is important to maintain a trusted legal framework that incentivizes and protects companies that voluntarily share threat intelligence. Confirm, assistant director. While this is not the purview of the house, the absence of a confirmed director creates a leadership gap, and makes it harder for CISA to advocate for resources and priorities. While Nick Anderson is doing an admirable job as acting director, the agency will benefit from having a senior, confirmed director. Prioritize resources through collaboration.
Resources, time, money, and people are limited and must be leveraged to maximum effect. Collaboratively developing priorities can help industry and government allocate resources more effectively. Analyze the impacts of CISA staff funding reductions. Changing staffing levels based on organization priorities is a common management practice. But to ensure CISA can maintain its vital core functions, it should engage with industry partners to understand the impact reductions are having, and evaluate whether any adjustments are warranted.
Enhanced analytical engagement with the industry. CISCES should designate cybersecurity analysts to support specific sectors. The analysts would build relationships with sector ISACs and their members, to know and understand their specific industries and threats to them. This will create trusted relationships, better analysis, and improve threat intelligence. Create common situational awareness.
CISA currently sends alerts on specific incidents, but this is a whack-a-mole approach that is not suitable for a sustained capability that provides near real-time strategic and tactical threat intelligence. It doesn't create shared situational awareness to inform decision making. Vulnerability management modernization. Our vulnerability disclosure and past management processes are already struggling with today's pace of disclosures. AI threatens to further stress this.
CISA can convene relevant communities to address this. Refining Socia, the ITI Act and the IT sector coordinating council have expressed concern that the proposed Socia regulations were too broad and would result in it receiving more information than it could process. Limiting Sociea's scope and scale to more closely align with legislative intent not only reduces the reporting burden on industry, but helps CISA develop and distribute more meaningful threat intelligence. We applaud CISA for planning a series of town halls to receive additional input. Implement effective partnership principles.
In 2012, the IT sector coordinating council identified 12 partnership practices that lead to successful outcomes. Assista should review and renew these. I would like to reiterate our support and appreciation for everyone that sits there who works tirelessly to protect our country. I thank you all for the opportunity, and I recommend you ask questions you have.
Speaker 1
Thank you, Mr. Al Jir. As they have called votes, we will take a brief recess, and reconvene promptly thereafter. Again, thank you to the witnesses for your patience. Pursuant to committee rules, the committee stands in recess.
Speaker 7
We're gonna reconvene this committee hearing. I know the votes are still ongoing, so we're gonna jump right into questions. And so I'll recognize myself for five minutes of questioning, and then I'll turn it over to the ranking member for questions as well. Thank you all for being here. Thank you for the information you provided.
My first question is to Mr. Mayer. How can SIS better facilitate intelligence and information sharing with the private sector, especially when it comes to the communications and information technology sectors? I read your testimony, but can you get, can you dive down a little more specific?
Speaker 2
Sure. So I would say that over the last two years, we've seen a marked increase in the quality and the frequency of intelligence briefings, classified briefings. Information on all of the major attacks were discussed in those environments. We shared with assist of what we were seeing on our networks. They were sharing with us what the intelligence community was seeing. And I think we've made a lot of progress in that area.
I think one area that deserves greater attention is the ability to convey that information to the local and regional providers in the communication sector. There are hundreds of such providers, and getting very quick information is very important to them. But I also will say that CISA has done a better job in terms of releasing cybersecurity advisories at the unclassified level, and that has been very helpful as well.
Speaker 7
Oh, thank you. I'll go to Admiral Montgomery. With the rapid increase in reliance on hyperscale data centers, which enable cloud services like Amazon Web Services, what safeguards are necessary to ensure these facilities are protected against adversarial threats? What are the consequences of leaving these facilities vulnerable?
Speaker 5
Yeah. Thanks for asking that. It's exactly my greatest concern is that in our rush to build them or to have the environmental discussions about them, we're missing the really important physical and cybersecurity discussions. We have to make sure that they're both physically secure, but then we, and there I think about drone attacks as you probably have been briefed in the Iran, the recent conflict with Iran. The Iranians directly attacked US owned data centers in the, you know, within our era partners.
But the second part is cybersecurity, and this has to do with both the supply chain of the parts you have in the data center, making sure that they're not from countries of concern like China. But secondly, that you're doing the proper level, that you've set up the proper standards for security on them, and that you have the proper operational environment. One thing I'd recommend is there should be a strong consideration of whether data centers and cloud need to be a separate critical national critical infrastructure. There's been a push for that in the past. It fell short with the cloud, but now the other data centers as well, and we can all see the dynamic of the large role they're gonna play in The United States, possibly an independent national critical infrastructure that handles data center and clouds separate from communications.
Speaker 7
So you may have answered my next question, but The UK has designated data centers as critical national infrastructure. Do you believe that the United States should follow suit? And that I'll open that question up to the rest of the panel, admiral.
Speaker 5
I do. In fact, of the things we're talking about today, data center, space, and telecommunications, I think they're three separate critical structures. So I don't know if Sam joins me with this, but I think space is a critical structure. I think data centers are critical infrastructure.
Speaker 2
Look. Given the exponential growth in data centers, we're going to see more of that. Connectivity is gonna be a major aspect of that. So there are links to the communication sector. But I think given the scrutiny that is required to make sure that those data centers are secure, there would be a benefit, I think, in having them work together as a unique coordinating counsel.
Speaker 4
I thank you. Thank you for the question, Congressman. I'd have to agree. If you take a look at what's happening with data centers, the infrastructure that data centers are building and that they're going to be driving with energy, you're gonna have massive data centers, hyperscalers, data centers that are gonna be powered independently by small and modular nuclear reactors. That infrastructure is going to become an important part of the national landscape.
It's gonna employ thousands of people. It's going to contribute hundreds of billions and eventually trillions of dollars to the national economy. Our national defense will depend on these data centers. Our economic security will depend on these data centers. Much of our critical infrastructure, particularly as we use AI-enabled smart cities and infrastructures, they're going to depend on these data centers.
So finding a way to regard them as part of our critical infrastructure and to protect them accordingly, I think, is sine qua non. I think it's absolutely required.
Speaker 6
Mister Roger. Mister chairman, thank you for the question. I would like to just note that the data center community is currently represented within the information technology ISAC. We have a number of data center providers who are members. We've formed what we call a special interest group for the data center providers so that they can communicate with other data center providers and share threat intelligence, share mitigation practices, share policies on both cyber and physical security.
So the data centers are integrated already into the critical infrastructure discussions, and we serve them through the information technology ISAC.
Speaker 7
Thank you, ma'am. Thank you very much. I now recognize ranking member, the gentleman from Illinois, Miss Ramirez, for five minutes of questions.
Speaker 8
Thank you, chair. I wanna thank the four witnesses for being here. I know that it's been a little untraditional having the votes in between our committee sessions. I wanna also thank Chairman Ogles for his warm welcome today. I look forward to the work that we do in this subcommittee, particularly as we improve the cybersecurity posture of federal networks and critical infrastructure.
Since today is my first hearing after being appointed the ranking member of the cybersecurity infrastructure protection subcommittee, I do think it's important for me to share my perspective on this work. Under this administration, it's clear that the security of our communities, information, federal networks, and critical infrastructure has not been prioritized in the way that they should. Between the security failures of DOGE, the abuses of immigrant families' data, and the designation of CISA's workforce and resources, my colleagues here have demonstrated a lack of interest in safeguarding our nation's cybersecurity and our residents' civil rights and privacy. In neglecting necessary oversight, Republicans have deregulated emerging technologies, allowed bad actors to profit from violations of our civil rights, and consented to the weaponization of government systems. It's more critical than ever that we assert our congressional authority and that we disrupt the reelection of duty and blame corruption, making us all less safe.
So I'm clear. There's a lot of work that we have to do, especially in the subcommittee. And I'm ready to roll up my sleeves and get to work to protect the data, the rights, and privacy, to defend CSA's mission. And to do so, I wanna talk a little bit about where we are. You see, it's ironic to talk about modernizing DH as a sector risk management agency when Trump has been on a vindictive campaign to dismantle CISA.
The very agency he established but started attacking the minute it became an obstruction to his interests. CISA, serving as a sector risk management agency, requires adequately resourcing and staffing the agency's critical infrastructure. That includes checks and balances, and policy solutions that make us all more secure. So I want to establish some facts. Since January 2025, CISA has lost nearly one third of its workforce through terminations, involuntary reassignments, or deferred resignations that workers were harassed into accepting.
The stakeholder engagement division, which conducts CISA's sector risk management work, was cut nearly in half. Between January 2025 and 12/13/2025, CISA's stakeholder engagement division said it lost 96 of its 189 employees. When you look at that math, that's half of the workforce. And during the Republican shutdown last year, CISA attempted to fire additional staff, it said. Under the president's proposed budget of 2027, funding for sets international affairs, council management, and strategic relations units would be eliminated, only leaving such sector risk management agency unit still funded.
These facts make it clear we're not just talking about a personal loss. We're actually talking about a loss in institutional knowledge, sector-specific expertise, and trusted relationships that we've built over time. So my question is for Mr. Montgomery. How has the loss of key CISA personnel affected the agency's ability to execute its sector risk management agency responsibilities? In particular, Mister Montgomery, can you talk to me about how the loss of individuals with institutional knowledge undermines Caesar's ability to carry out its mission?
Speaker 5
First, congratulations on your selections, ranking member, and I share your concerns about the loss of personnel. You know, I served 36 years in the military, and I never once had a subordinate say to me, sir, the right way forward is to cut 35 percent of my people, and I'll get the mission done. I'm sorry. I love, I do like Nick Anderson, the acting director, but I believe we're doing him a great disservice with these personnel cuts. Having said that, how it specifically impacts is that without the stakeholder engagement division, you don't have the ability to set up the information sharing agreements, to do the engagement with the sector.
You know, when I said there's three legs to the national cyber resilience, it's how the government does, how the private sector does, and how we collaborate together. It's that collaboration that gets lost. And I'd emphasize the removal of the CPAC, the Current Infrastructure Partnership Advisory Council, and most importantly, the removal of the multistate ISAC and the loss of its funding. That's how we get funding down to our public utilities and our local hospitals. Because I'm very concerned that the lack of these are two these organizations in rural hospitals and in underserved communities where the medical centers don't have the money to pay for the basic IT services themselves.
So without those programs running properly, I think the most likely to be ill served are underserved communities in rural, public health utilities.
Speaker 7
We're gonna do a second round of questions. So I'll start with myself. I wanted to follow-up with you, Admiral Montgomery, and others can jump in as well on you mentioned the supply chain risk with components manufactured by the PRC, including chips, power systems, and cooling infrastructure. How and how would you or is it possible to harden our supply chain and become less reliant on the PRC for these parts and components?
Speaker 5
Yeah. Thanks for asking. I did a report and testified to Congress last year to the China Select Committee about something called illuminations, where we illuminated 180 US weapon systems. The vast majority of which had Chinese parts only two or three dou levels down the supply chain. So even our military does have a hard time with this.
And I in my testimony, I mentioned the Federal Communications Commission among the many things it's doing. One of the things that I could really support is their national security effort to remove China from our emerging technologies. When you ask, how do we get our supply chain right? We have to decide what are emerging technologies, you know, 5G, drones, lidar, motor cellular modems. You know, we need to get the, we did not have Chinese state-owned enterprises providing products to the US military and to the .gov.
And so what I've noticed Congress does is they first pass a law to remove these components from the dot mill. Then the next year, we pass a law to remove them from the .gov. And then the next year, we'd move them from the critical infrastructure, and that's a nice sequence, way. And if I were to recommend an area to do it right now, it's cellular modems, which are in all our operational technology, communicate back and forth to their point of origin, which tends to be China. I'm not sure we want our cranes, our tractors, our planes, all communicating back to China each night with different material.
Even if it's innocuous at first, it could become completely sensitive later.
Speaker 4
I'd like to. Thank you. And I agree with Admiral Montgomery's comments, but I wanna add a point. If you take one takes a look, at the space at space systems, at the whole ecosystem, it's very much a commoditized industry now. Going back in time to the early days of NASA, you know, where'd you get this part?
I wanna see the factory. Where'd you get the bolt? I wanna see the people who made the bolt. Where'd you get the steel? I wanna see where the steel was made.
Where'd you get the iron ore? I wanna see the vein of iron. So you had a great deal of visibility. That's not true anymore, necessarily. And we have a global supply chain.
It's not just China for space systems. And since we're gonna be depending not only on our space systems, but on those produced by allies and partners, better technology and better means to find vulnerabilities in space systems regardless of where they're manufactured. And I think one of the other panelists here talked about, well, there were problems with domestically manufactured routers in which we found vulnerabilities. So it's not just, yes, we should be worried about Chinese infiltration of the supply chain, but we also need better technology and better understanding of how vulnerabilities can be introduced into any of our systems, particularly given the commoditized nature of this where you don't necessarily have the same level of visibility. I think we're all aware of what's happening right now with the undetected vulnerabilities in operating systems, are now only being uncovered by the, by the, you know, by the mythos tool.
We need to understand that we're likely to have vulnerabilities that have existed in some of these systems for many years, and the commoditization of the supply chain is something that is a challenge that we're not going to be able to overcome simply by eliminating one country. We might that will help, but it won't be enough. The means to detect vulnerabilities and to mitigate them on anything that's manufactured wherever it occurs. And that's one of the reasons why I've been pushing for a national R and D strategy on cybersecurity, and particularly one for an R and D strategy on the security of our space systems. Thank you. Thank you.
Speaker 2
Yeah. I'll be real quick. As I mentioned in my testimony, there has to be a coherent policy across the government agencies with respect to supply chain risk management. Right now, we have Commerce, BIS. We have the FCC.
We have CISA. We have federal acquisition security councils. We wanna see a coherent approach to the supply chain. We also wanna see the intelligence community be more forthcoming with us with respect to supply chain risks that they've identified. And lastly, I would say the DHS ICT task force, that I co-chair, has been an excellent venue for working with our IT partners, the entire comm sector, including the vendors, as well as government participation.
We did, for example, work on a hardware bill of materials to identify what the criteria needs to be for evaluating your supply chain. So there's a lot of activity that can be rationalized, but it should continue with coordination with the IT sector, the comm sector, and government participants. Thank you.
Speaker 7
I'll let you go a little bit over. But, let me go back to the second round. Let me yield and recognize the ranking member again for the five minutes of questions.
Speaker 8
Thank you. I want to come back to Admiral Montgomery. In the first round, we talked a little bit about the impact that the cut in the workforce has had on CSA. Now I wanna also ask you to comment on how the administration's actions cutting CISA more broadly undermine its ability to support SMAs that are building capacity, building capacity like the EPA and the Department of Agriculture. Can you talk a little bit more about that?
Speaker 5
Thank you. You know, one of the responsibilities is that a national CISA should be the national coordinator for our resilience effort. In the cuts that have occurred, their ability I would not have given them high grades previously on their ability to work with EPA, health and human services, agriculture. You know, those are the three. The water, health care, and food and agriculture are three of our worst performing.
Critical infrastructures, and yet three of the most important are to public health and safety. So they were poor before. It has only gotten worse under this. And as I said, it's a combination of cutting the people and then cutting the programs. And in congress, you all have the state and local cybersecurity grant program, which you've been unable to reauthorize for an extended period of time.
When you combine those three efforts together, the cutting of the multistate ISAC, the cutting of the personnel, and the cutting of the cybersecurity state and local cybersecurity grant programs, there's no way that these small public utilities who don't have two wood nickels to rub together normally in their budget for cybersecurity are able to make the proper investments to protect those utilities against ransomware and against nation state actors. And so our public health and safety at the very core, at our most vulnerable level is, weak. Yeah.
Speaker 8
Thank you, Admiral. Look. I hear you loud and clear, and this has been a concern for us here in the committee for a while now. Cutting people, cutting programs in a time where we should be investing in the infrastructure of CISA, is really detrimental to the security and safety of every single person in this country. So I am committed as ranking member, as this new ranking member, to make sure that CISA is resourced and is capable of working with the critical infrastructure owners and operators, so that we can keep our network secure.
And I look forward to the work that we do in the subcommittee in the upcoming months. With that, I want to thank the witnesses for being here today, and I want to yield back to the chairman.
Speaker 7
I now wanna recognize my colleague from Rhode Island, mister Magaziner, for his five minutes and questions.
Speaker 9
Thank you to the chair and to the new ranking member. Congratulations. I have to say, cybersecurity is one of the issues here in Congress where I think there's the biggest disconnect between the rhetoric and the reality. The rhetoric is always very positive that this is a bipartisan issue, that everyone agrees that we need to do more to protect our country against cyber threats from state actors, from international criminal organizations, and the like. But the reality is that the administration, with the complicity of the majority party in Congress, continues to cut our cyber defense capabilities at the worst possible time, and in fact, even does things that undercut our defenses.
And so I just wanna make sure everybody who's watching at home understands that the Trump administration has already eliminated a third of the entire CISL workforce, 1,000 employees. These are the people whose job is to keep our country safe from cyberattacks and has proposed an additional 800 cuts at CISA in their fiscal 27 budget. The leadership at CISA has been a mess under the administration. The last acting director was a disaster. He failed a counterintelligence polygraph test.
He was caught uploading sensitive government documents to ChatGPT before he ultimately was removed from his position. Now the next guy, the appointee, just withdrew himself from consideration because he couldn't get confirmed by the Senate. And so the administration is not acting like they are taking cybersecurity seriously. And, frankly, our colleagues of the majority are not doing anything about it either. The rhetoric is there.
The rhetoric is always very positive, but the reality has been woefully lacking. So I'll ask all four of our expert witnesses here. Do any of you think that the huge staffing cuts at CISA are making our country safer?
Speaker 5
I'll go ahead and start. I already said no. First, I wanna say your predecessor, representative Jim Langevin, absolutely did, with representative Mike Gallagher from Wisconsin, a significant amount of bipartisan work both in this committee and in the House Armed Services Committee. So it is absolutely achievable. Whether it can get done now, I would leave it to your judgment.
I do wanna say that Nick Anderson, the current acting administrator, is a humble professional cyber leader at CISA, and I think he'll do well. But you're absolutely right. As I said, thirty-five years in the military, nobody ever came up to me and said, the next move is cut 35% of my workforce, I'll do better. So, no, they're not gonna do better with a 35% cut. They've got it.
That 300% edition that ranking member Thompson mentioned in his opening remarks is just a down payment on what we need to do to recover CISA to get it to a place where it's useful. I wanna say one other thing. You know, I graded the Biden, I'm a lax grader at Georgetown, but I still would give the Biden administration a D. I'd give this administration an F on their performance. It says, it's completely unacceptable that our civilian cyber defense agencies are treated like this.
We would never treat the National Security Agency or US Cyber Command the same way.
Speaker 9
Yeah. I agree. And just because I have limited time, I have to move to a different topic. So I still have not had anyone give me a good reason why we should allow the administration to sell the H200 AI chips, the NVIDIA chips, to China. Like, to a country that is actively engaging in cyber warfare against us, and we are apparently now selling them the tools to do it.
So I'll ask you all, would anyone like to take a crack at explaining why we should allow these chips to be sold to China? There's no good, no one has been able to give me a good answer. There is no good answer. Congress is not powerless here. We could pass a bill to stop it today.
As a matter of fact, a bill already passed out of committee over in Foreign Affairs, but it's been sitting on Speaker Johnson's desk for months. We ought to do something about this. And with that, I'm just about out of time. But I do wanna elevate the point. I think it was Mister Visner made.
You know, the mythos from Anthropic, we're still learning about it. But I think it does speak to the need to have some sort of a consumer safety test for AI products before they are released to the market because Anthropic is doing the right thing by voluntarily holding back on releasing it until the big players can be warned about what their vulnerabilities are, but they didn't have to do that. There was no law that required them to. And so there is, I think, a desperate need for congress to step up and ensure that there's some safety in these products before they go to market. With that, I'll yield back.
Speaker 7
Thank you. We'll do one last round of questions, and then, we'll conclude this at this hearing. Let me go to Mr. Visitor. You know, clearly, there's an intense threat environment when it comes to our space systems. What specifically is missing from the current US approach to space infrastructure security, and what changes to law, policy, or federal organization would meaningfully improve our ability to defend these systems?
Speaker 4
Thank you, Mr. Chairman, for the question. I don't know that I'm gonna be in a position to propose any legislative remedies, but there are some things that I think we ought to do. First, we need to recognize that space systems are, in fact, critical to every aspect of our national security, every aspect of our economic security, and every aspect of the security of our critical infrastructure. And we need to say so. We need to say so to ourselves.
We need to say so to our people. We need to say so to our partners and our allies, and we need to say so to our adversaries as well, that this is a line you may not cross. That's a first thing. I would refer you as well to a report done last year by the council on foreign relations, and I was a member of the task force that produced that report. It's called Securing Space.
And it said that the White House should, in fact, declare that that space is a top priority for this country. It recommended that the White House convene a space summit in the first year of the administration, or as soon as possible. And it also said that we ought to launch an assessment of the vulnerability of space vulnerability remediation deterrence that included the participation of the Department of War, the intelligence community, the private sector, representatives of civil space organizations, and academia. And I would add, by the way, that it certainly should include DHS, which despite the decrement in its staffing, there have been people at DHS who at CSA who have worked very closely with the space ISAC and with the space systems domain, and have shown a great deal of interest. So I do think that before we do anything else, we ought to get our act together.
And one of the things that I would ask that we look at is, the National Security Council could play a role in coordinating the various stakeholders in the federal government to coordinate space system security, and that would include the National Space Council, which I think, could and hopefully will be reconstituted. That's something I think could be done. Thank you.
Speaker 5
Sir, can I add one thing to that? You actually Congressman Liu has twice tabled a bill to make space a critical infrastructure, and a bipartisan bill. You should recon you should retake that bill up and pass it. That if Congress wants to impact things, you force the government to make it a national critical infrastructure, treat it that way. And the challenging part will be across congressional, you know, kind of, not partisanship, but parochialism about who should be the sector risk management agency.
My strongest recommendation is NASA. Representative Lou left it to the government to determine.
Speaker 7
Thank you for that. I'll stay with you, admiral. You also mentioned the threat to subsea cable infrastructure. We did have a hearing on that previously by the full committee. How serious is this threat?
And how would a successful attack on a major cable route affect connectivity? How would it impact our security, the financial system, and the government's ability to operate? And I would like to just hear your perspective on this.
Speaker 5
I'm glad you mentioned that. It's absolutely the most significant kinetic threat to the communications network. In other words, if I went after the satellites, I could attack the ground stations. I could take out 5% of the data flow. If I went after the submarine cables and cut the cables, I could cut 95% of the data flow.
So it's obviously critical that we defend these. They are generally undefended assets. We know both Russia and China are aggressively designing weapon systems to attack them. Less sophisticated countries like Iran or North Korea can drop anchors on those cables. That does less damage, but can still have an effect.
So my recommendation, sir, is that we take a look at how we defend those cables, how we empower the coast guard to do it, and then I would step even one farther back. What is the supply chain for those cables to ensure that there isn't a preexisting flaw inserted in them? So I'm glad you brought that up. It's well worth the congratulations congress' attention.
Speaker 7
Thank you very much. I'll conclude my questioning. I'll recognize the gentleman from New Jersey, Miss McGyver.
Speaker 10
Thank you so much, Chairman and Ranking Member. Look. AI data centers are reshaping American cities, and they may be doing more harm than good. For many, an AI data center in your area means a decline in the quality of life. It can mean higher utility costs, sometimes up to 300% more per month.
It means air pollution already causing up to 100,000,000 a year in health damages, and a strain on water supply with numerous reports of contaminated well water. This reality is especially true for lower-income communities and communities of color. My neighbors back home know this very well. A plant data center in Kenilworth, New Jersey, in my district has received major pushback just in the last couple of days from the community. These constituents deserve to be heard.
That is why I introduced the AI Data Center Site Selection Transparency Act of 2026. This bill would ensure communities are informed at least 180 days in advance before any major step toward developing an AI data center. So communities have a real chance to organize, raise concerns, and demand accountability. It will be impossible to regulate AI data centers if they are forced on to people with no community input, which makes things a lot worse. We know that the future is coming quickly, and we need to make sure people are prepared to thrive, not ignored or harmed.
With that, mister Montgomery, first of all, I wanna thank each of the witnesses for your testimony today and for coming here to be with us even in our tricky schedules here in this place. Mister Montgomery, as AI data centers rapidly expand across the country, how should we be thinking about ensuring both the cyber and physical security of these facilities as they are built within our communities?
Speaker 5
For that question. Of course, I'm never gonna be opposed to transparency, so that's always a good thing. What I've argued for here is that we need to make data centers and cloud an independent critical infrastructure. Mhmm. One with which a federal agency is charged with coordinating across other agencies to make sure that sort of transparency is clear.
Whoever the agency in charge is understands what the Department of Energy is setting for standards, what the Homeland Security is setting for standards, when they're on military bases, what the Department of Defense is setting for standards. And we have consistency across those. And then most importantly, it sets what are the physical standards in terms of, and it might be in terms of pollution, but it also could be in terms of physical security, and what the cyber standards are for the security, whether it's the actual cybersecurity or the supply chain. So if we do that and make it an independent critical infrastructure sector, I think we'll begin to get the kind of transparency, consistency, and security that you're demanding.
Speaker 10
Got it. Thank you so much for that. You've also noted that the cyber and physical resilience of these facilities merits the same level of attention. And we've already seen real-world risks, including reported attacks on data centers abroad that disrupted essential services for millions. Given those vulnerabilities, what baseline security standards or planning considerations should be in place before a data center is approved or constructed?
Speaker 5
Well, I think the physical security ones would begin with standoff distances. You that you traditionally have for military facilities against explosive devices. We're going to start thinking about drone security for these as we look at what's happened, not just in Iran, but in your own state. New Jersey.
Speaker 5
State of New Jersey. And then we're gonna, as I mentioned earlier, we're gonna need cyber standards both in terms of the supply chain and the actual operational technology running on the systems. Look. And look. I would hope that NIST, which is also, we've talked about funding challenges.
I think NIST cybersecurity division has been cut too far, but it needs to become more involved in this and start setting the NIST 800 series for data centers to establish the proper level of cybersecurity on those centers.
Speaker 7
Thank you very much. I wanna congratulate the new ranking member. I look forward to working with you. I wanna thank the witnesses for their testimony, and the members for their questions. Members of the subcommittee may have some additional questions for the witnesses, and we would ask the witnesses to respond to these in writing.
Pursuant to committee rule 7e, the hearing record will be held open for 10 days. Without objection, the subcommittee stands returned.
Ask anything about this video — I analyse its transcript to answer.