Statement for the Record
Mr. Michael Moss
Deputy Director
Cyber Threat Intelligence Integration Center
Office of the Director of National Intelligence
FOR A HEARING ON
“Cyber Threats to Our Nation’s Critical Infrastructure”
BEFORE THE
UNITED STATES SENATE
COMMITTEE ON JUDCIARY
SUBCOMMITTEE ON CRIME AND TERRORISM
Tuesday 21 August 2018

Senate Dirksen 226 2:30pm – 4:00pm

Washington, DC

 Chairman Graham, Ranking Member Whitehouse, Members of the Subcommittee,
thank you for the opportunity to appear before you today to discuss cyber threats.
I would first like to extend my appreciation for your efforts to focus attention on
cyber threats through such forums as this subcommittee hearing.
It is hard to believe that just a year or two ago, cyber security experts routinely
lamented the lack of attention these threats received in our public discourse. Now, it seems
that we do not go a single day without a headline about a concerning vulnerability, a serious
breach, or a call to action from a local, state, or federal official. Awareness of the threat is a
critical first step to action, not only by the government but also, especially, every citizen,
each of whom can take important steps to protect themselves while also increasing our
collective cyber security.
The Director of National Intelligence wants the American people to know the
Intelligence Community (IC) is postured to identify threats of all kinds against the U.S. and
our allies, and to provide appropriate warnings.
Regarding the threat to our elections, and efforts to undermine our democracy, the
IC’s TOP priority is to identify threats against the U.S. and provide accurate, timely
warnings. With respect to operations that target elections, it is important to distinguish
between two types: (1) cyber operations that target our election systems, such as voting
machines and voter databases, and (2) foreign malign influence operations designed to
influence the views of voters, depress voter turnout, or undermine confidence in election
results.


The IC continues to be concerned about threats to upcoming US elections – both
the mid-terms and the 2020 election cycle.



Regarding Russian involvement in the mid-term elections, we continue to see a
pervasive messaging campaign by Russia to try to weaken and divide the U.S.
These efforts are not exclusive to the election, but certainly cover issues relevant
to the election.



We also know Russia tries to hack into and steal information from candidates and
government officials alike.



We are very cognizant that Russia is not the only country that has an interest in
trying to influence our domestic political environment. We know there are others
who have the capability and may be considering influence activities.

We have incorporated lessons learned from the 2016 elections, and implemented a
broad spectrum of initiatives to share more information across the federal government, state
and local governments, and with the private sector. Among those initiatives:


The Office of the Director of National Intelligence’s (ODNI’s) National
Counterintelligence and Security Center (NCSC) and Cyber Threat Intelligence
Integration Center (CTIIC) co-sponsored an elections-focused Tabletop Exercise
(TTX) in April, where we examined how to strengthen the U.S. Government’s
ability to share information on foreign threats to U.S. elections. The day-long
TTX was attended by more than 50 senior representatives from the National
Security Council and offices in the Central Intelligence Agency (CIA),
2

 Department of Homeland Security (DHS), Federal Bureau of Investigation (FBI),
National Security Agency (NSA), and ODNI that have cyber, counterintelligence,
regional, and intelligence reporting responsibilities.


ODNI leads the interagency working group with the Department of Justice (DOJ),
FBI, DHS, CIA and NSA, regional, cyber and counterintelligence experts now
meeting weekly as we push towards November all focused on ensuring election
security and integration of our efforts.



ODNI supports both DHS and FBI, in their respective roles, in their efforts to
effectively provide States and State Election Officials with up to date and relevant
information from the IC.

Cyber Threat Intelligence Integration
Enhanced awareness of cyber threat is one of the core missions of the center I am
privileged to lead CTIIC and I would like to share with you our approach to this important
mission.
CTIIC is the newest of four multiagency intelligence centers under the ODNI and was
authorized under the Intelligence Authorization Act for Fiscal Year 2016. Our mission is to
build understanding of foreign cyber threats to U.S. national interests to support decisionmaking. We do this by working with, and integrating information from, the Federal centers,
and other departments and agencies that make up the federal cyber community. Elements of
this community specialize in intelligence, law enforcement, network defense, operations, and
incident response. CTIIC brings together information from these partners to build awareness,
integrate analysis context, and identify opportunities to mitigate and counter cyber threats
using all instruments of national power.
CTIIC’s workforce is mostly composed of personnel on loan to us from these very
partners. Our leadership team includes senior executives from FBI, NSA, and CIA; and our
workforce includes analysts from those three agencies, DHS, the Defense Intelligence
Agency, the Department of Energy, and the ODNI. These professionals contribute their
unique expertise, knowledge and tradecraft, and notably their reach back to other experts in
their parent Agency. Anticipating and countering foreign cyber threats is a whole-ofgovernment effort, and the makeup of CTIIC is reflective of that effort.
In 2016, our first year of operation, CTIIC’s role was further emphasized in
Presidential Policy Directive 41. This PPD, outlining the Federal government’s approach to
Cyber Incident Coordination, named CTIIC as one of three Federal leads, along with DHS
and FBI, responsible for coordinating the government’s response to significant cyber
incidents.
CTIIC does not direct or engage in intelligence collection, operations, or unilateral
engagement with the private sector. Rather, we support the agencies who do have those
responsibilities and relationships by providing integrated intelligence and assessments that
support their efforts.
CTIIC is committed to overcoming the jargon barrier that sometimes limits our ability
to have meaningful discussions of cyber threat. Part of enabling a whole-of-government
3

 approach to countering these cyber threats is building understanding of how our adversaries
are using capabilities in cyber space to address their strategic objectives. We, and our
colleagues in ODNI, are focused on making that analysis available and comprehensible to the
non-cyber experts in government, who vastly outnumber those of us who focus daily on this
threat.
In many ways, the nature of the cyber threat requires that we, the national security
community, also treat the private sector and American people as intelligence customers.
That is why you will see us address this threat more publicly and why you will continue to
see us publish unclassified estimates and statements to inform the American people.
Cyber Threats to U.S. Critical Infrastructure
To that end, I will now address the IC’s estimates of cyber threats to critical
infrastructure. These threats include not only destructive attacks but also cyber-enabled theft
of information that undermines our strategic advantage.
Our adversaries are becoming more assertive, more capable, and more adept at using
cyberspace to threaten our interests. And, the number of adversaries is growing as nation
states, terrorist groups, criminal organizations, and others continue to develop cyber
capabilities.
The risk is growing that some adversaries will conduct cyber attacks—such as data
deletion or localized and temporary disruptions of critical infrastructure—against the U.S. in
a crisis short of war.
The potential impact of these cyber threats is amplified by our growing
interconnectedness. The advancing integration of technology—such as artificial intelligence
and the internet of things—into both our critical infrastructure and our daily lives adds
convenience but also significant risk.
The potential for surprise in the cyber realm will increase in the next year and beyond
as billions of additional digital devices connect—with relatively little built-in security—and
both nation states and malign actors become more emboldened and better equipped in the use
of increasingly widespread cyber toolkits.
In 2016 and 2017, state-sponsored cyber attacks against Ukraine and Saudi Arabia
targeted multiple sectors across critical infrastructure, government, and commercial
networks. In the case of Ukraine, over 225,000 citizens lost power for over 3 hours.
Ransomware and malware attacks have spread globally, disrupting global shipping
and production lines of U.S. companies. The availability of criminal and commercial
malware is creating opportunities for new actors to launch cyber operations.
In March, the city of Atlanta, Georgia, was hit by ransomware, crippling a large
portion of the city’s online systems. Citywide services came to a grinding halt. More than a
third of the 424 software programs used by the city were knocked offline or partially
disabled, and nearly 30% of those were “mission critical,” affecting core city services.
We believe that concerns about U.S. retaliation, and still developing adversary
capabilities, will mitigate the probability of attacks aimed at causing major disruptions of

4

 U.S. critical infrastructure, but we remain concerned by the increasingly damaging effects of
cyber operations and the apparent acceptance by adversaries of collateral damage.
Adversaries and Malign Actors Poised for Aggression
Russia, China, Iran, and North Korea will pose the greatest cyber threats to the U.S.
during the next year. These states are using cyber operations as a low-cost tool of statecraft,
and we believe they will work to use cyber operations to achieve strategic objectives unless
they face clear repercussions for their cyber operations. Meanwhile, non-state actors will
continue to use cyber operations for financial crime and to enable propaganda and
messaging.
Of these adversaries, we believe Russia poses the greatest threat to U.S. critical
infrastructure. We expect that Russia will conduct bolder and more disruptive cyber
operations during the next year, most likely using new capabilities against Ukraine. In
June 2017, the Russian military launched the most destructive and costly cyber-attack in
history. The attack, dubbed “NotPetya,” quickly spread worldwide, causing billions of
dollars in damage across Europe, Asia, and the Americas. The Russian Government is likely
to build on the wide range of operations it is already conducting, including disruption of
Ukrainian energy distribution networks, hack-and-leak influence operations, distributed
denial-of-service attacks, and false flag operations. Over the next year, Russian intelligence
and security services will continue to probe U.S. and allied critical infrastructures, and target
the U.S., NATO, and allies for insights into U.S. policy.


In March, DHS and FBI issued a Technical Alert regarding Russian government
targeting of U.S. Government entities and organizations in the energy, nuclear,
commercial facilities, water, aviation, and critical manufacturing sectors.



In April, as a result of analytic efforts between DHS, FBI, and the United
Kingdom’s National Cyber Security Centre, DHS and FBI issued an alert
regarding the worldwide cyber exploitation of network infrastructure devices
(e.g., router, switch, firewall, and Network-based Intrusion Detection System
devices) by Russian state-sponsored cyber actors.



In May, DOJ announced they had seized an internet domain at the center of a
hacking campaign, thus thwarting the potential weaponization of a network of
more than half a million web-connected devices across the globe. The network of
infected devices, or “botnets”, was one of the largest of its kind.

China will continue to use cyber espionage and bolster cyber attack capabilities
to support national security priorities. The IC and private-sector security experts continue
to identify ongoing cyber activity from China, although at volumes lower than before the
bilateral U.S.-China cyber commitments of September 2015. Most detected Chinese cyber
operations against U.S. private industry are focused on cleared defense contractors or IT and
communications firms whose products and services support government and private sector
networks worldwide. Since 2015, China has been advancing its cyber attack capabilities by

5

 integrating its military cyber attack and espionage resources in the Strategic Support Force,
which it established in 2015.
We believe that Iran will continue working to penetrate U.S. and Allied
networks for espionage and to position itself for potential future cyber attacks. Tehran
probably views cyberattacks as a versatile tool to respond to perceived provocations, despite
Iran’s recent restraint from conducting cyber attacks against the U.S. or Western allies.
Iran’s cyber attacks against Saudi Arabia in late 2016 and early 2017 involved data deletion
on dozens of networks across government and the private sector.
We expect the heavily sanctioned North Korea to use cyber operations to raise
funds and to gather intelligence or launch attacks on South Korea and the U.S.
Pyongyang probably has a number of techniques and tools it can use to achieve a range of
offensive effects with little or no warning, including distributed denial of service attacks, data
deletion, and deployment of ransomware. North Korean actors developed and launched the
WannaCry ransomware in May 2017. We also believe that these actors conducted the cyber
theft of $81 million from the Bank of Bangladesh in 2016.
Terrorist and criminal groups will continue to use the Internet to organize,
recruit, spread propaganda, raise funds, collect intelligence, inspire action by followers,
and coordinate operations. Given their current capabilities, cyber operations by terrorist
groups most likely would result in personally identifiable information (PII) disclosures,
website defacements, and denial-of-service attacks against poorly protected networks.
Transnational criminals will continue to conduct for-profit cyber-enabled crimes, such as
theft and extortion against U.S. networks. We expect the line between criminal and nationstate activity to become increasingly blurred as states view cyber criminal tools as a
relatively inexpensive and deniable means to enable their operations
Mr. Chairman, I look forward to the Sub-committee’s questions.

6