Military cyber operations

I note that just about exactly 2 months ago President Obama confirmed for the first time that the U.S. is conducting cyber operations against ISIS [Islamic State of Iraq and Syria]. And as the leadership of the Department of Defense [DOD] was discussing this, they said it was the first time that Cyber Command has been given the guidance to go after ISIS. Just like we have an air campaign, we want to have a cyber campaign. And some of the press went on to discuss that Secretary Carter was pushing for U.S. Cyber Command [CYBERCOM] to have greater freedom to launch attacks and to address tactical cyber threats against ISIS. I know this committee remains committed to ensuring that the Department of Defense's capabilities to fight and win the country's wars and to be prepared and ready to execute those missions remain on solid footing regardless of which domain we are talking about, including the cyber domain. The Department has been developing the organizations, capabilities, and personnel needed to operate in cyber since at least 2010. Billions of dollars have been spent. And yet the perception-and you all can disagree with this if you think I am wrong-the perception is the threat is still multiplying faster and growing faster than at least our laws and regulations, policies, rules of engagement are developing. Still, a fundamental question: What is the role of the military to protect civilian infrastructure in the United States against cyber attack? I do not suggest we are going to get the definitive answer to all of those questions today, but I think that it is important that we discuss not only those but the tactical use of cyber, which the President talked about and which the leadership of the Department has talked about. It is a significant change just in the past few months.