Nakasone deflects senators' invitations to seek domestic spying powers

Senate lawmakers on Wednesday continued to press Army Gen. Paul Nakasone for solutions that might prevent another massive cybersecurity intrusion into federal networks, but the director of the National Security Agency and head of U.S. Cyber Command insisted the answer cannot be boiled down to a single authority or investment.

“Senator, I’m not seeking legal authorities either for NSA or for U.S. Cyber Command,” Nakasone told Sen. Richard Burr (R-N.C.) during a hearing with the Senate Select Committee on Intelligence.

Nakasone was testifying along with several other intelligence agency chiefs about the IC’s new worldwide threat assessment report, which, among other things, notes that all of the United States’ primary adversaries are ramping up their activities and capabilities in cyberspace.

The general has been a fixture at most congressional hearings where the breach into nine federal networks involving SolarWinds has been either a primary or tangential topic of discussion. During previous hearings and the one today, lawmakers have repeatedly offered Nakasone a chance to make his case for expanded surveillance powers.

Despite several senators extending that invitation, Nakasone declined. Instead, he re-iterated that foreign actors are exploiting the well-known “blind spot” in the United States’ laws. Hostile actors can use U.S. digital infrastructure to conduct operations because they know it will take time before law enforcement can obtain a warrant to surveil domestic networks, Nakasone explained.

He also noted that those in the intelligence community has struggled to gain visibility over the full scope and scale of the problem because the laws in place have created an environment in which the private sector does not always choose to share information.

 “While there is no one solution to what’s going on, I think we have to understand the program in totality,” Nakasone said.

The general’s comments seemed to frustrate lawmakers, who for months have pressed law enforcement and cybersecurity officials for direct and expedient answers on how to prevent another intrusion similar to the one discovered in December.

“I don’t like hearing that we have blind spots,” Sen. Kirsten Gillibrand (D-N.Y.) said before asking Nakasone what new authorities he needs. She acknowledged his previous remarks to Burr, but added, “I am not willing to accept that we are going to have blind spots.”

Sen. Ron Wyden (D-Ore.) took exception to Nakasone’s suggestion that the need for a warrant hampered the government’s ability to detect and stop the intrusion involving SolarWinds.

“My understanding is that the government has the ability now to watch every bit of data going in and out of a federal network, including the SolarWinds malware, and yet the hacking of nine federal agencies somehow went unnoticed,” said Wyden -- an apparent reference to the Department of Homeland Security’s Einstein program.

“Before seeking new powers to surveil the domestic internet, we all ought to be working together … so that more can be done to detect hacking that’s going on in our own network,” Wyden continued.

Einstein, managed by the Cybersecurity and Infrastructure Security Agency, is one of the government’s foundational cybersecurity programs and is designed to monitor the data flowing in and out of federal networks.

However, CISA’s leadership has made clear at public events and during congressional hearings that Einstein’s capabilities were never intended to prevent the techniques used in the campaign against SolarWinds.

That admission has spurred some lawmakers to seek significant changes to the program when it comes up for reauthorization in December 2022.

This article first appeared on FCW, a Defense Systems partner site.