WEBVTT

00:00.009 --> 00:02.176
I'm gonna call this um open hearing on

00:02.176 --> 00:04.342
the security clearance reform to order

00:04.342 --> 00:06.287
and I welcome to today's executive

00:06.287 --> 00:08.509
branch witnesses . It's good to see all

00:08.509 --> 00:10.731
of you again . Apologies for starting a

00:10.731 --> 00:14.659
little bit late . Um uh It was not any

00:14.670 --> 00:17.889
of the other uh reported intrigues that

00:17.899 --> 00:20.250
are going on . It was simply uh uh the

00:20.260 --> 00:22.482
vote got started a little bit late . So

00:22.482 --> 00:24.649
um we will , we will get at it . Our ,

00:24.649 --> 00:26.760
our witnesses today are the honorable

00:26.760 --> 00:28.482
Lancy Harris , uh acting under

00:28.482 --> 00:30.049
Secretary of Defense um for

00:30.059 --> 00:32.290
Intelligence and Security . Mr David

00:32.540 --> 00:34.207
Ker , director of the defense

00:34.207 --> 00:36.429
counterintelligence and security agency

00:36.429 --> 00:38.762
D CS A , the honorable Doctor Rada Plum ,

00:38.762 --> 00:40.689
chief of Digital and Artificial

00:40.700 --> 00:42.930
Intelligence at Dod , the honorable

00:42.939 --> 00:44.828
Stacey Dickson , principal Deputy

00:44.830 --> 00:47.270
director , National Intelligence PB D

00:47.279 --> 00:49.229
and I representing DN I as the

00:49.240 --> 00:51.518
government's security executive agency .

00:51.860 --> 00:54.082
Today , the committee will get a status

00:54.082 --> 00:56.138
update on efforts to improve how the

00:56.138 --> 00:58.360
government conducts security clearances

00:58.360 --> 01:00.471
for our national security workforce .

01:00.471 --> 01:02.360
As many have known , we have long

01:02.360 --> 01:04.416
prioritized the need for fundamental

01:04.416 --> 01:06.527
reforms in this area . That's because

01:06.527 --> 01:08.360
we need intelligence community ,

01:08.360 --> 01:10.582
community personnel and others who hold

01:10.582 --> 01:12.416
security clearances to be vetted

01:12.416 --> 01:14.638
effectively and expeditiously to ensure

01:14.638 --> 01:16.582
classified information is properly

01:16.582 --> 01:18.582
protected . We also need to balance

01:18.582 --> 01:20.804
this with the I CS agency's urgent need

01:20.804 --> 01:23.220
to quickly bring on board , the very

01:23.230 --> 01:25.341
best people needed to staff sensitive

01:25.341 --> 01:27.620
positions and that's obviously

01:27.629 --> 01:29.296
increasingly important in the

01:29.296 --> 01:32.000
challenging world . Now , when I first

01:32.010 --> 01:34.066
got involved in this and , and uh it

01:34.066 --> 01:37.080
may have been um somebody who used to

01:37.089 --> 01:39.279
work on this committee , staff , John

01:39.290 --> 01:42.660
Rosenwasser fault . Um uh and a series

01:42.669 --> 01:45.910
of folks who came to me from the uh the

01:45.919 --> 01:47.808
consulting consulting industry in

01:47.808 --> 01:50.529
Virginia . Um I didn't think that I

01:50.540 --> 01:52.819
would be a decade in , it's been almost

01:52.830 --> 01:55.709
a decade since we started this . Uh I

01:55.919 --> 01:58.349
knew it would take some time . Uh but I

01:58.360 --> 02:00.620
did not realize this pursuit would be a

02:00.629 --> 02:03.629
career path , but the truth is the need

02:03.639 --> 02:05.528
for reform was clear . Our legacy

02:05.528 --> 02:07.472
vetting system was anchored in the

02:07.472 --> 02:09.639
system that was set up literally in 19

02:09.639 --> 02:11.830
forties and 19 fifties . Um usually

02:11.839 --> 02:13.950
with the workforce at that point that

02:13.950 --> 02:16.172
once they got cleared , they were there

02:16.172 --> 02:18.117
for life . Um very little mobility

02:18.117 --> 02:20.172
between agencies or with the private

02:20.172 --> 02:22.339
sector and it face focused on periodic

02:22.339 --> 02:24.339
time based reinvestigation that was

02:24.339 --> 02:27.539
almost done all by paper and in person .

02:28.399 --> 02:30.539
And that meant that people waited way

02:30.550 --> 02:32.439
too long to get clearances and it

02:32.439 --> 02:34.494
frankly allowed a lot of mistakes to

02:34.494 --> 02:36.479
happen . Then in 2014 0 PM , data

02:36.490 --> 02:38.169
breach highlighted the system

02:38.179 --> 02:40.068
structural failures and it nearly

02:40.068 --> 02:43.509
collapsed . The backlog um for

02:43.610 --> 02:45.721
investigation swelled to , I think my

02:45.721 --> 02:47.943
number here is 725 . My memories got as

02:47.943 --> 02:51.679
high as 750,000 stuck in limbo . And um

02:51.990 --> 02:54.240
at that point to get a top secret

02:54.250 --> 02:56.699
clearance on average about two years .

02:56.839 --> 02:59.800
That's crazy today with nudging from

02:59.809 --> 03:02.229
Congress and frankly bipartisan nudging

03:02.240 --> 03:04.399
from this committee . The backlog has

03:04.410 --> 03:06.577
been significantly reduced to a steady

03:06.577 --> 03:08.759
state of about 200,000 . However ,

03:08.770 --> 03:10.826
however , and that's the good news .

03:11.250 --> 03:14.110
But over the last nine months , we've

03:14.119 --> 03:17.889
seen what literally is a disaster

03:18.360 --> 03:20.949
unfold with the National Background

03:20.960 --> 03:23.669
Investigation Systems in this , which

03:23.679 --> 03:25.846
is supposed to deliver the it backbone

03:25.846 --> 03:28.123
for the government's trusted workforce ,

03:28.123 --> 03:31.039
workforce 2.0 the way forward , which

03:31.050 --> 03:33.217
frankly if we don't get MS right , the

03:33.217 --> 03:35.439
whole security clearance reform process

03:35.439 --> 03:38.550
crumbles . Um I mean , amongst and I

03:38.559 --> 03:40.726
know we've got mostly folks who follow

03:40.726 --> 03:42.948
this stuff , but there may be some that

03:42.948 --> 03:44.837
Ibis doesn't roll quite off their

03:44.837 --> 03:46.615
tongues regularly , but Ibis is

03:46.615 --> 03:48.781
supposed to enable key components such

03:48.781 --> 03:50.781
as continuous vetting . We've moved

03:50.781 --> 03:52.892
from episodic every five year vetting

03:52.892 --> 03:52.190
to what's using technology , a

03:52.199 --> 03:54.330
continuous vetting process . So both

03:54.339 --> 03:56.589
better process , but it doesn't require

03:56.600 --> 03:58.656
the kind of e effort that every five

03:58.656 --> 04:01.089
year with , with um uh all the staffing

04:01.100 --> 04:03.089
required . And we're supposed to

04:03.100 --> 04:04.933
recognize we've got to have more

04:04.933 --> 04:06.822
workforce mobility . We've got to

04:06.822 --> 04:08.433
realize there's got to be re

04:08.433 --> 04:10.220
reciprocity between uh security

04:10.229 --> 04:12.340
clearance at one agency and another .

04:12.340 --> 04:14.889
Um And again , in BS was supposed to be

04:14.899 --> 04:16.399
the linchpin of this whole

04:16.399 --> 04:18.399
transformation . When the committee

04:18.399 --> 04:20.232
last heard a hearing on security

04:20.232 --> 04:22.829
clearance reform in March 2023 we were

04:22.839 --> 04:25.690
told and other than Stacey , I think

04:25.700 --> 04:27.922
most of the rest of you were , were not

04:27.922 --> 04:30.144
involved . At that point , we were told

04:30.144 --> 04:32.256
that Ibis was making great process in

04:32.256 --> 04:34.200
meeting developmental milestones .

04:34.230 --> 04:36.720
Since then , we've learned that I BS

04:36.730 --> 04:38.952
has been plagued with problems stemming

04:38.952 --> 04:40.674
from po poor leadership , poor

04:40.674 --> 04:42.940
executive branch oversight , a lack of

04:42.950 --> 04:44.869
clarity about requirements and

04:44.880 --> 04:46.769
questionable contract and program

04:46.769 --> 04:48.940
management and to just kind of drive

04:48.950 --> 04:51.200
this home Ibis was supposed to be

04:51.209 --> 04:54.790
delivered in 2019 . We're

04:54.799 --> 04:57.720
2014 at this point and unfortunately ,

04:57.730 --> 05:00.339
with , with not a lot of clarity in

05:00.350 --> 05:02.959
sight . Um This is not the only place

05:02.970 --> 05:05.192
where big software development projects

05:05.519 --> 05:07.519
have run afoul . I think all of the

05:07.519 --> 05:09.630
senators up here have dealt with them

05:09.649 --> 05:12.079
students and parents over the last year ,

05:12.089 --> 05:14.033
who've had to do the updated FAFSA

05:14.033 --> 05:16.089
system in terms of financial student

05:16.089 --> 05:18.256
aid . It's been a disaster in terms of

05:18.256 --> 05:20.200
the roll out . We've seen problems

05:20.200 --> 05:20.140
oftentimes with our veterans health

05:20.149 --> 05:22.670
care systems . But what we're gonna at

05:22.679 --> 05:24.901
least one of the items gonna talk about

05:24.901 --> 05:28.500
today um meets the level of , of

05:28.510 --> 05:31.089
inefficiency of any of these prior

05:31.100 --> 05:34.720
screw ups . So N BS was supposedly just

05:34.730 --> 05:36.563
give you a data point . N BS was

05:36.563 --> 05:39.269
supposedly um be completed by 2019 at

05:39.279 --> 05:42.850
an estimated cost of 700 million bucks .

05:43.540 --> 05:46.220
Yet five years later , we are not fully

05:46.230 --> 05:50.000
operational . $850 million

05:50.190 --> 05:52.589
has been spent on N BS . In addition ,

05:52.619 --> 05:54.970
we just got this updated from Gao today ,

05:55.100 --> 05:57.760
another 850 million on trying to deal

05:57.769 --> 06:00.140
with some of the legacy systems . And

06:00.149 --> 06:03.100
while there is a plan um that we will

06:03.109 --> 06:05.165
actually get this completed over the

06:05.165 --> 06:07.220
next 18 months , which will put us ,

06:07.220 --> 06:09.709
you know , late 2025 calendar year ,

06:09.720 --> 06:12.079
2025 it's still uncertain what the

06:12.089 --> 06:15.809
balance of getting this done will cost .

06:16.619 --> 06:18.786
I know getting these new systems right

06:19.100 --> 06:22.450
is hard , but it shouldn't be this hard .

06:23.320 --> 06:27.250
And the truth is this kind of uh screw

06:27.260 --> 06:30.440
up and this kind of inefficiency is

06:30.450 --> 06:33.200
what robs so many of our citizens of

06:33.209 --> 06:35.500
their trust in government . Now let me

06:35.510 --> 06:37.732
add and again , I know there's a 90 day

06:37.732 --> 06:40.049
review that's been done . I'd like all

06:40.059 --> 06:42.281
of our witnesses to tell us about , you

06:42.281 --> 06:44.503
know , what happened during that review

06:44.503 --> 06:46.726
and what we're doing on a going forward

06:46.726 --> 06:48.948
basis . And today we're gonna need some

06:48.948 --> 06:51.170
firm commitments about when we're gonna

06:51.170 --> 06:53.448
see the delivery of those capabilities .

06:53.448 --> 06:56.440
And that again , Mr Caller , you know ,

06:56.589 --> 06:58.756
the of customers have been waiting for

06:58.756 --> 07:00.867
literally for years . Um We've got to

07:00.867 --> 07:02.978
get this right . Uh We've got to make

07:02.978 --> 07:05.200
sure that , that the good men and women

07:05.200 --> 07:07.422
who want to join the IC are not put off

07:07.422 --> 07:09.645
by the normal time , enormous time that

07:09.645 --> 07:11.756
takes to get a clearance . Uh We also

07:11.756 --> 07:13.978
got to get the whole implementation . I

07:13.978 --> 07:16.145
think we're roughly 1.5 on our trusted

07:16.145 --> 07:18.311
workforce . We've got to get it to 2.0

07:18.311 --> 07:20.422
we've got to make sure the continuous

07:20.422 --> 07:22.589
vetting workforce mobility clearance ,

07:22.589 --> 07:24.811
uh reciprocity and timetables are met .

07:24.811 --> 07:27.440
Um I also want to add in my questions a

07:27.450 --> 07:29.561
little bit of an update on commercial

07:29.561 --> 07:31.506
skiffs , which is something that I

07:31.506 --> 07:33.728
think post , post uh COVID that we need

07:33.728 --> 07:35.839
to see . Um I apologize again for the

07:35.839 --> 07:37.850
length of my opening . Um but it's

07:37.859 --> 07:40.630
really important issue and I'm grateful

07:40.640 --> 07:42.807
for you all being here and I turn that

07:42.807 --> 07:44.807
over to the vice chairman . Thank ,

07:44.807 --> 07:46.529
thank you and thank you to the

07:46.529 --> 07:48.751
witnesses for being here . Um This last

07:48.751 --> 07:50.940
year we held a hearing on this topic

07:50.950 --> 07:53.006
and I stated that that time that the

07:53.006 --> 07:54.894
clearance process and the ongoing

07:54.894 --> 07:58.119
reforms are at the fundamental core of

07:58.130 --> 07:59.908
protecting our security and our

07:59.908 --> 08:01.963
nation's most sensitive assets , our

08:01.963 --> 08:04.609
capabilities and information . And you

08:04.619 --> 08:06.730
know , it's the job of this committee

08:06.730 --> 08:08.675
to ensure that our intelligence is

08:08.675 --> 08:10.841
secure , at least from that's our jobs

08:10.841 --> 08:12.563
from a congressional oversight

08:12.563 --> 08:14.730
perspective . And so it's with serious

08:14.730 --> 08:14.339
concern that we're back here a year

08:14.350 --> 08:16.128
later . And what I believe is a

08:16.128 --> 08:18.294
position worse off than we were a year

08:18.294 --> 08:20.350
ago . And I'm hoping that I , I hear

08:20.350 --> 08:22.517
from testimony today . That that's not

08:22.517 --> 08:25.480
the case . We had the 2014 Chinese hack

08:25.489 --> 08:27.822
into the office of Personnel management .

08:27.822 --> 08:30.640
The next generation security clearance

08:30.649 --> 08:32.649
it system , the National Background

08:32.649 --> 08:35.039
Investigation Service was expected to

08:35.049 --> 08:38.890
be online by 2019 . It's now 2024 . We

08:38.900 --> 08:42.049
don't have full NBI S utilization , no

08:42.059 --> 08:44.281
termination of expensive and old legacy

08:44.281 --> 08:46.115
security clearance systems . And

08:46.115 --> 08:48.059
already at the tune of more than a

08:48.059 --> 08:50.170
billion dollars per year And look , I

08:50.170 --> 08:52.115
recognize these it systems require

08:52.115 --> 08:54.281
upgrades . But in this case , with all

08:54.281 --> 08:56.170
this expensive security clearance

08:56.170 --> 08:58.392
legacy system still online , we have no

08:58.392 --> 09:00.392
timeline for full utilization being

09:00.392 --> 09:02.337
finalized and an opt in or opt out

09:02.337 --> 09:04.170
confusing option for any federal

09:04.170 --> 09:07.080
department or agency . And so I wanna

09:07.090 --> 09:09.989
be persuaded why this isn't waste and

09:10.000 --> 09:11.833
redundancy and a serious lack of

09:11.833 --> 09:14.349
ownership and accountability . Um So I

09:14.359 --> 09:16.549
go sort of end where we begin and that

09:16.559 --> 09:18.739
is our , our oversight responsibility

09:18.750 --> 09:21.260
as a committee is to protect our nation

09:21.270 --> 09:23.270
to make sure that our nation's most

09:23.270 --> 09:25.381
sensitive secrets are being protected

09:25.381 --> 09:27.437
while at the same time enhancing our

09:27.437 --> 09:29.603
workforce . So we've got to be able to

09:29.603 --> 09:31.714
protect our secrets and make sure the

09:31.714 --> 09:31.309
people that we're bringing in are

09:31.320 --> 09:33.431
properly vetted . But we also have to

09:33.431 --> 09:35.598
be able to bring in the best people we

09:35.598 --> 09:37.709
possibly can into the workforce . And

09:37.709 --> 09:39.820
it's essential these efforts that the

09:39.820 --> 09:41.931
timely and secure means of recruiting

09:41.931 --> 09:43.820
on boarding and retaining cleared

09:43.820 --> 09:45.820
personnel exists . And so I'm , I'm

09:45.820 --> 09:47.987
hoping that I can hear something today

09:47.987 --> 09:50.042
that makes me feel better about what

09:50.042 --> 09:49.849
everything I've just said because when

09:49.859 --> 09:51.970
I compare where we are today to where

09:51.970 --> 09:54.192
we are a year ago , I think it's gotten

09:54.192 --> 09:56.303
worse , not better . So thank you for

09:56.303 --> 09:58.359
coming and again for my colleagues ,

09:58.359 --> 10:00.581
you know , open hearing the committee's

10:00.581 --> 10:02.748
process as we do five minute rounds in

10:02.748 --> 10:04.526
by order of seniority with that

10:04.526 --> 10:06.748
secretary Harris . I think you're gonna

10:06.748 --> 10:05.640
get us started . Thank you .

10:42.679 --> 10:44.846
I'm not sure you still working but why

10:44.846 --> 10:47.159
don't you , you know , shout

12:12.010 --> 12:12.530
or the

12:21.989 --> 12:22.989
so .

13:22.020 --> 13:23.020
All right .

13:32.119 --> 13:34.230
Joining us with a wealth of expertise

13:34.230 --> 13:36.452
and experience in delivering some agile

13:36.452 --> 13:38.397
methodology , something lacking in

13:38.397 --> 13:40.508
previous program management . We have

13:40.508 --> 13:42.341
also enlisted expertise from the

13:42.341 --> 13:44.341
defense digital Services under with

13:44.349 --> 13:46.859
artificial intelligence . Doctor B will

13:46.919 --> 13:49.469
testify today to TS to focus on modular

13:49.479 --> 13:51.646
data architecture , building the right

13:51.646 --> 13:53.146
teams and adopting digital

13:53.146 --> 13:55.312
transformation best practices , all of

13:55.312 --> 13:56.979
which will be instrumental in

13:56.979 --> 13:59.146
strengthening , strengthening and this

13:59.146 --> 14:01.035
moving forward by giving improved

14:01.039 --> 14:03.206
oversight , new leadership and greater

14:03.206 --> 14:05.206
technical expertise . We are moving

14:05.206 --> 14:07.372
forward with several initiatives . The

14:07.372 --> 14:09.261
program is fully focused on agile

14:09.261 --> 14:11.095
software development with strong

14:11.095 --> 14:13.206
involvement from our users to include

14:13.206 --> 14:15.261
to ensure finding feedback and value

14:15.261 --> 14:17.372
assessments of product delivered . To

14:17.372 --> 14:19.317
support this , we are updating our

14:19.317 --> 14:21.428
foundational documentation to clearly

14:21.428 --> 14:23.095
outline roles and responses ,

14:23.095 --> 14:24.872
establishing the program's core

14:24.872 --> 14:26.983
capability requirements in support of

14:26.983 --> 14:28.872
trusted workforce 2.0 and driving

14:28.872 --> 14:30.983
improvements across the board efforts

14:30.983 --> 14:33.299
will result in more robust , reliable

14:33.309 --> 14:35.309
and transparent cost , schedule and

14:35.309 --> 14:37.531
performance efforts . We should improve

14:37.531 --> 14:40.989
the , we , we , you know , we'd ask

14:41.000 --> 14:43.309
everybody to do three minutes . I'm not

14:43.320 --> 14:45.542
sure . And I feel bad for her . I think

14:45.542 --> 14:47.542
we've probably got a lot of interns

14:47.542 --> 14:47.359
here that I'm not sure they can hear a

14:47.369 --> 14:49.739
word of what's being said . Do any of

14:49.750 --> 14:50.750
your mic's work ?

14:56.530 --> 14:58.586
They could sit here , they could sit

14:58.586 --> 15:02.270
here testing , testing

15:02.359 --> 15:05.809
these work . Sounds like we need to fix

15:05.820 --> 15:08.153
the mics before we fix the clearing the ,

15:08.153 --> 15:11.320
the clearance system . This will be a

15:11.330 --> 15:13.989
li this will be a little unorthodox .

15:14.309 --> 15:16.880
But um I think it would be important

15:16.890 --> 15:18.946
for that . People actually hear what

15:18.946 --> 15:21.001
we're saying , uh what you're saying

15:21.520 --> 15:23.631
and , and uh well , if we're gonna do

15:23.631 --> 15:25.742
questioning , you know , so why don't

15:25.742 --> 15:27.742
we , why don't you all go up over ,

15:27.742 --> 15:29.909
over here ? Is that all right ? And um

15:29.909 --> 15:31.964
um I would ask you because we've got

15:31.964 --> 15:35.700
lots of questions . And um so I would

15:35.729 --> 15:37.840
urge everybody to please stick to the

15:37.840 --> 15:40.007
three minutes that we were promised on

15:40.007 --> 15:41.007
your openings

15:51.320 --> 15:53.929
just to make clear for all of those who

15:53.940 --> 15:57.780
are interested . Um This is not an

15:57.789 --> 16:00.609
intelligence failure . Uh It is not D A ,

16:00.640 --> 16:03.289
it is not in BS the Senate recording

16:03.299 --> 16:05.700
studio , owns the microphones and

16:05.710 --> 16:07.654
something I guess right before the

16:07.654 --> 16:09.710
hearing started fried . That doesn't

16:09.710 --> 16:11.988
mean that the Chinese are not culpable ,

16:11.989 --> 16:14.045
but uh we don't have direct proof on

16:14.045 --> 16:16.045
that yet . Until proven otherwise .

16:18.039 --> 16:20.780
I think Miss C , you're up next , right .

16:24.789 --> 16:26.900
Chairman Warner , Vice chairman Rubio

16:26.900 --> 16:28.733
and distinguished members of the

16:28.733 --> 16:30.789
committee . I'm honored and grateful

16:30.789 --> 16:33.011
for the privilege to testify before you

16:33.011 --> 16:35.122
today . Thank you for the attention .

16:35.122 --> 16:37.233
You're giving a trusted workforce 2.0

16:37.233 --> 16:36.580
and into the National Background

16:36.590 --> 16:39.179
Investigation Services Program . I will

16:39.190 --> 16:41.190
act with the same urgency to ensure

16:41.190 --> 16:42.857
that D CSA is responsible and

16:42.857 --> 16:44.857
accountable in both what we say and

16:44.857 --> 16:47.270
what we deliver D CS A provides

16:47.280 --> 16:49.169
integrated security services that

16:49.169 --> 16:51.391
protect America's trusted workforce and

16:51.391 --> 16:53.613
cleared workspaces . We are the federal

16:53.613 --> 16:55.558
government's largest investigative

16:55.558 --> 16:57.613
service provider and provide vetting

16:57.613 --> 16:59.391
services for 95% of the federal

16:59.391 --> 17:01.169
government . Last year . DC SAS

17:01.169 --> 17:03.280
personnel security team conducted 2.7

17:03.280 --> 17:05.420
million investigations . 668,000

17:05.430 --> 17:07.250
adjudications and performed the

17:07.260 --> 17:09.427
continuous vetting of over 3.8 million

17:09.427 --> 17:12.199
people in the trusted workforce . D CS

17:12.209 --> 17:14.265
A is also the primary implementer of

17:14.265 --> 17:16.431
the trusted workforce 2.0 initiative .

17:16.670 --> 17:18.781
Our N BS program supports this reform

17:18.781 --> 17:20.892
effort as a federal it system for end

17:20.892 --> 17:22.837
to end personnel vetting . We have

17:22.837 --> 17:24.837
faced challenges delivering N BS to

17:24.837 --> 17:27.059
meet the expected timelines for trusted

17:27.059 --> 17:29.281
workforce . 2.0 implementation NBI S is

17:29.281 --> 17:31.392
unacceptably delayed and has cost far

17:31.392 --> 17:34.010
more than anticipated . Internal and

17:34.020 --> 17:36.242
external assessments of the NIS program

17:36.242 --> 17:38.076
identified key problems across a

17:38.076 --> 17:40.353
variety of aspects including oversight ,

17:40.353 --> 17:42.020
program management , software

17:42.020 --> 17:44.242
development methodologies , acquisition

17:44.242 --> 17:46.076
strategy , team competencies and

17:46.076 --> 17:48.242
leadership . As under secretary Harris

17:48.242 --> 17:50.242
indicated , the department's 90 day

17:50.242 --> 17:52.298
sprint effort has focused efforts on

17:52.298 --> 17:51.959
understanding and addressing these

17:51.969 --> 17:54.319
issues . One of the outcomes of this

17:54.329 --> 17:55.996
effort is an initial 18 month

17:55.996 --> 17:57.607
capability roadmap for embus

17:57.607 --> 17:59.773
development . It addresses the trusted

17:59.773 --> 18:01.829
workforce 2.0 technical requirements

18:01.829 --> 18:03.996
and also secures requirement alignment

18:03.996 --> 18:06.880
across the dod . We have a plan but we

18:06.890 --> 18:09.329
are not yet recovered . Our plan is not

18:09.339 --> 18:11.339
yet approved by our dod acquisition

18:11.339 --> 18:13.506
decision authority and once approved ,

18:13.506 --> 18:15.617
we will need time to execute the plan

18:15.619 --> 18:17.786
to be clear N VS development then will

18:17.786 --> 18:19.952
extend beyond the next 18 months . But

18:19.952 --> 18:22.175
I'm confident in this path to reset the

18:22.175 --> 18:24.230
program and any and also in D CS A's

18:24.230 --> 18:26.063
internal actions to support N VS

18:26.063 --> 18:28.230
recovery and to improve our visibility

18:28.230 --> 18:30.397
and management of the program itself .

18:30.397 --> 18:32.563
Also as under secretary Harris noted D

18:32.563 --> 18:34.786
CS A has on boarded new N VS leadership

18:34.786 --> 18:36.675
to develop and implement this new

18:36.675 --> 18:38.897
roadmap . This leadership team has also

18:38.897 --> 18:40.841
evaluated and aligned a discipline

18:40.841 --> 18:42.897
contracting strategy to support this

18:42.897 --> 18:44.841
way forward . We will obtain a new

18:44.841 --> 18:46.841
independent cost estimate to assist

18:46.841 --> 18:48.786
with developing a reliable funding

18:48.786 --> 18:50.619
profile for the program . In the

18:50.619 --> 18:52.786
meantime , we are committed to funding

18:52.786 --> 18:54.786
additional N BS development without

18:54.786 --> 18:57.008
passing the costs on to our customers .

18:57.008 --> 18:59.063
We are working with our dod partners

18:59.063 --> 19:01.180
and with OMB on funding options , we

19:01.189 --> 19:03.022
continue to engage customers and

19:03.022 --> 19:05.078
partners to ensure their feedback is

19:05.078 --> 19:07.300
incorporated . As we implement this new

19:07.300 --> 19:09.522
roadmap we will continue to address the

19:09.522 --> 19:11.522
JO recommendations as well . I have

19:11.522 --> 19:13.411
also directed our DCs A inspector

19:13.411 --> 19:15.411
general to audit the NBS program to

19:15.411 --> 19:17.633
ensure internal accountability for both

19:17.633 --> 19:19.760
the past and moving forward . We will

19:19.770 --> 19:21.881
move forward at a responsible pace to

19:21.881 --> 19:24.048
ensure that we understand the problems

19:24.048 --> 19:25.826
and are addressing them . So in

19:25.826 --> 19:27.992
conclusion , we will move forward with

19:27.992 --> 19:30.159
a program that instills confidence , a

19:30.159 --> 19:32.326
program that delivers and upholds this

19:32.326 --> 19:34.437
mission without fail . We've embraced

19:34.437 --> 19:33.989
collaboration with our oversight

19:34.000 --> 19:36.056
partners and with our mission owners

19:36.189 --> 19:38.022
together , we will put N VS on a

19:38.022 --> 19:40.245
sustainable pathway forward to ensure a

19:40.245 --> 19:42.467
trusted workforce to protect the nation

19:42.467 --> 19:44.467
and secure the public's trust . I'm

19:44.467 --> 19:46.522
confident in our path forward and do

19:46.522 --> 19:48.633
expect to be held accountable for our

19:48.633 --> 19:50.800
performance . Thank you , Doctor Plumb

19:50.800 --> 19:52.689
will now testify to D DS focus on

19:52.689 --> 19:54.745
modular data architecture , building

19:54.745 --> 19:56.800
the right teams and adopting digital

19:56.800 --> 20:00.439
transformation best practices . Uh

20:00.449 --> 20:02.719
Chairman Warner , vice chairman Rubio

20:02.729 --> 20:04.562
and distinguished members of the

20:04.562 --> 20:06.729
committee , appreciate the opportunity

20:06.729 --> 20:08.951
to testify here before you today on the

20:08.951 --> 20:10.562
Chief Digital and Artificial

20:10.562 --> 20:12.673
Intelligence officer role in the N BS

20:12.673 --> 20:15.579
recovery efforts . Um Our C CD A O team

20:15.589 --> 20:17.478
has partnered with our colleagues

20:17.478 --> 20:19.311
across the Department of Defense

20:19.311 --> 20:21.478
through a 90 day Discovery sprint . We

20:21.478 --> 20:23.589
focused on characterizing the problem

20:23.589 --> 20:25.533
space user needs as of mission and

20:25.533 --> 20:27.756
technical requirements . We then worked

20:27.756 --> 20:29.922
with partners across dod to ensure any

20:29.922 --> 20:32.089
proposed technology changes aligned to

20:32.089 --> 20:34.200
the full set of requirements for N BS

20:34.200 --> 20:36.422
as we've seen in other enterprise level

20:36.422 --> 20:38.533
implementation issues with across dod

20:38.533 --> 20:40.700
with analogous examples in the private

20:40.700 --> 20:42.756
industry , modernizing and scaling a

20:42.756 --> 20:44.700
technical capability requires both

20:44.700 --> 20:46.922
change in the underlying technology and

20:46.922 --> 20:49.033
a change in mindset and culture . The

20:49.033 --> 20:51.089
CD A O has made a number of specific

20:51.089 --> 20:53.145
recommendations to D CS A related to

20:53.145 --> 20:55.367
the technical and BI solution which can

20:55.367 --> 20:57.367
be grouped in three big areas . The

20:57.367 --> 20:59.200
first group relates to technical

20:59.200 --> 21:01.311
approach to delivering a modular data

21:01.311 --> 21:03.533
architecture . The second group focuses

21:03.533 --> 21:05.311
on building the right teams and

21:05.311 --> 21:07.533
aligning those teams on products rather

21:07.533 --> 21:09.589
than features and capabilities . And

21:09.589 --> 21:11.645
the third area focuses on a adopting

21:11.645 --> 21:13.867
digital transformation best practices .

21:13.867 --> 21:15.978
The overall techni technical approach

21:15.978 --> 21:15.469
we recommend is to build upon the

21:15.479 --> 21:17.569
existing systems where possible and

21:17.579 --> 21:19.801
build the digital solutions needed in a

21:19.801 --> 21:21.857
tar in targeted areas where needed .

21:21.857 --> 21:23.857
This combined with the expansion of

21:23.857 --> 21:25.912
technical talent and the adoption of

21:25.912 --> 21:27.412
agile software development

21:27.412 --> 21:29.190
methodologies provides a robust

21:29.190 --> 21:31.301
framework for success . I'll close by

21:31.301 --> 21:33.523
noting that in addition to the shift in

21:33.523 --> 21:35.690
technical approach , we need a mindset

21:35.690 --> 21:37.912
set shift . Unlike hardware procurement

21:37.912 --> 21:39.801
software delivery never reaches a

21:39.801 --> 21:41.968
discrete endpoint . For both the front

21:41.968 --> 21:43.968
and backend system development . We

21:43.968 --> 21:45.968
should anticipate needing to devote

21:45.968 --> 21:47.801
time and resources to continuous

21:47.801 --> 21:49.912
development cycles that will maintain

21:49.912 --> 21:52.246
and continuously improve the technology .

21:52.246 --> 21:54.357
Thank you . And I'll now forward uh t

21:54.357 --> 21:56.468
turn over to honorable Stacy Dixon to

21:56.468 --> 21:58.357
discuss the implementation of the

21:58.357 --> 22:00.579
trusted workforce 2.0 Chairman Warner ,

22:00.579 --> 22:02.635
Vice Chairman Rubio , members of the

22:02.635 --> 22:02.209
committee , thank you for the

22:02.219 --> 22:04.386
opportunity to appear before you today

22:04.386 --> 22:06.552
to discuss personal vetting reform . I

22:06.552 --> 22:08.775
am pleased to represent the Director of

22:08.775 --> 22:10.830
National Intelligence of Real Haines

22:10.830 --> 22:12.886
who serves as the security executive

22:12.886 --> 22:12.689
agent for the federal government in

22:13.099 --> 22:14.821
this role . And as head of the

22:14.821 --> 22:16.932
intelligence community , she develops

22:16.932 --> 22:19.155
and oversees policies and standards for

22:19.155 --> 22:21.377
determining an individual's eligibility

22:21.377 --> 22:23.432
for access to classified information

22:23.432 --> 22:25.488
and to occupy a national security or

22:25.488 --> 22:27.655
sensitive position . Trusted workforce

22:27.655 --> 22:29.766
2.0 helps us ensure vetting processes

22:29.766 --> 22:32.250
are effective , timely fair and secure .

22:32.510 --> 22:34.454
It is centered around a risk-based

22:34.454 --> 22:36.288
model that leverages modern . It

22:36.288 --> 22:38.930
improves timeliness reduces complexity

22:38.979 --> 22:41.199
and eliminates re repetitive and loop

22:41.209 --> 22:43.349
and duplicative into investigative

22:43.359 --> 22:45.569
actions . Doing so improves the

22:45.579 --> 22:47.801
mobility of the workforce to respond to

22:47.801 --> 22:49.912
mission needs and helps us direct and

22:49.912 --> 22:52.079
detect , detect me and mitigate risk .

22:52.079 --> 22:54.023
Earlier , we've established a more

22:54.023 --> 22:55.857
consistent vetting foundation by

22:55.857 --> 22:58.023
creating guidelines and standards that

22:58.023 --> 23:00.246
identify intended outcomes for personal

23:00.246 --> 23:02.357
vetting . Despite many achievements ,

23:02.357 --> 23:04.579
much work remains implementing the most

23:04.579 --> 23:06.801
aggressive security clearance reform in

23:06.801 --> 23:08.857
decades . Takes time . The honorable

23:08.857 --> 23:11.079
Harris the other pack principal OMB and

23:11.079 --> 23:13.190
O PM and I work diligently to address

23:13.190 --> 23:15.079
clearance reform challenges in an

23:15.079 --> 23:17.190
intentional way , taking into account

23:17.190 --> 23:19.412
views from multiple partners to include

23:19.412 --> 23:21.412
Congress . We acknowledge there are

23:21.412 --> 23:23.635
still areas where we must together plan

23:23.635 --> 23:23.630
for how best to achieve success ,

23:23.829 --> 23:26.170
reciprocity and the broader transfer of

23:26.180 --> 23:28.729
trust is one such area the security

23:28.739 --> 23:30.199
portion of rec reciprocal

23:30.209 --> 23:32.489
determinations continues to improve

23:32.500 --> 23:34.444
with most agencies completing that

23:34.444 --> 23:36.278
determination within five days .

23:36.290 --> 23:38.512
Nevertheless , other transfers of trust

23:38.512 --> 23:40.457
take more time as one would expect

23:40.650 --> 23:42.928
factors such as polygraph requirements ,

23:42.928 --> 23:44.983
medical evaluations , new continuous

23:44.983 --> 23:47.199
vetting alerts or new jobs . The new

23:47.209 --> 23:49.431
job requiring different kinds of access

23:49.431 --> 23:51.320
to sensitive information may also

23:51.320 --> 23:53.265
increase the time it takes to move

23:53.265 --> 23:55.542
individuals from one agency to another .

23:55.609 --> 23:57.665
There's also an increased demand for

23:57.665 --> 23:59.831
expanded transparency between agencies

23:59.831 --> 24:01.776
related to personnel mobility . To

24:01.776 --> 24:03.498
address this challenge , we're

24:03.498 --> 24:05.609
developing software that will provide

24:05.609 --> 24:05.569
greater visibility for the gaining

24:05.579 --> 24:07.829
agency . So they have direct access to

24:07.839 --> 24:09.617
information . They need to make

24:09.617 --> 24:11.561
transfer of trust determinations ,

24:11.880 --> 24:13.713
measuring the success of trusted

24:13.713 --> 24:15.602
workforce 2.0 is also important .

24:15.602 --> 24:17.713
Therefore , we're working to create a

24:17.713 --> 24:19.602
more automated solution to assist

24:19.602 --> 24:21.713
agencies in reporting their metrics .

24:21.713 --> 24:23.380
In closing . We believe it is

24:23.380 --> 24:25.158
imperative . We stay focused on

24:25.158 --> 24:27.380
improving and completing implementation

24:27.380 --> 24:28.991
of the trusted workforce 2.0

24:28.991 --> 24:31.047
transformation . The success of this

24:31.047 --> 24:33.047
personal vetting reform effort will

24:33.047 --> 24:34.936
continue to require strong senior

24:34.936 --> 24:34.819
leadership commitment as well as

24:34.829 --> 24:36.940
congressional support . Thank you for

24:36.940 --> 24:39.051
the opportunity to testify before you

24:39.051 --> 24:40.829
today . We look forward to your

24:40.829 --> 24:43.107
questions . All right , Senator Rounds .

24:43.107 --> 24:42.699
What do you got to say for yourself ?

24:43.619 --> 24:45.952
No , no , no , you're not up on the pen .

24:45.952 --> 24:47.952
All right . So the mics are working

24:47.952 --> 24:50.008
again and I'm gonna have you go take

24:50.008 --> 24:52.119
your place cards and I'm gonna give a

24:52.119 --> 24:54.341
little , you know , there's some really

24:54.341 --> 24:56.508
tough questions need to be asked . You

24:56.508 --> 24:58.786
guys go ahead . I'm gonna give the and ,

24:58.786 --> 25:01.008
and let me , you know , kind of set the

25:01.008 --> 25:03.930
stage because um you know , this is a ,

25:04.020 --> 25:07.479
a screw up of a royal proportion . But

25:08.050 --> 25:10.959
let me make clear while , you know ,

25:10.969 --> 25:13.229
Deputy Director Dixon has been on the

25:13.239 --> 25:15.780
pack , the oversight board , she was

25:15.790 --> 25:19.229
not directly responsible for um

25:20.089 --> 25:23.010
you know , some of the , the , the the

25:23.020 --> 25:25.187
the details of some of this . I though

25:25.187 --> 25:27.464
I will ask why the PAC didn't catch it .

25:27.464 --> 25:29.760
Doctor Plumb has been brought in as one

25:29.770 --> 25:33.199
of the experts to help us figure it out .

25:33.839 --> 25:37.329
And you know , Mr Ketler and Secretary

25:37.339 --> 25:40.810
Harris are , you know , were not there

25:41.869 --> 25:44.560
when the , the screw ups took place .

25:45.069 --> 25:48.189
Um uh So while I'm going to be very

25:48.199 --> 25:51.050
tough on them , you know , my hope is

25:51.060 --> 25:53.060
that that will be , we can get some

25:53.060 --> 25:55.760
answers . But I want to um make clear

25:55.770 --> 25:57.937
that uh for the most part , these were

25:57.937 --> 26:00.048
not the individuals , unfortunately ,

26:00.048 --> 26:03.609
uh uh that were um uh that were

26:03.619 --> 26:05.786
directly responsible and I will will ,

26:05.786 --> 26:07.897
will add as well . Some of the people

26:07.897 --> 26:09.952
who were responsible have almost all

26:09.952 --> 26:12.119
left the government and they got quite

26:12.119 --> 26:14.230
an earful from me uh in the interim .

26:14.230 --> 26:16.397
And let just to put this in , in again

26:16.397 --> 26:18.619
in a little bit of context , you know ,

26:18.920 --> 26:21.979
March of 23 we do our normal update .

26:21.989 --> 26:23.600
We're trying to figure out ,

26:23.600 --> 26:25.878
reciprocity is a huge issue . You know ,

26:25.878 --> 26:28.100
you get a clearance at security on , on

26:28.100 --> 26:30.770
doe or Dod Hs was one of them . Even if

26:30.780 --> 26:32.836
you got a security clearance at DH S

26:32.836 --> 26:35.002
and you wanted to move from a contract

26:35.002 --> 26:37.224
from one DH S contract to another , you

26:37.224 --> 26:37.160
still had to go through another process .

26:38.060 --> 26:40.171
It was great . I remember , um , um ,

26:40.171 --> 26:42.280
Dan Coats , uh , who was on this

26:42.290 --> 26:44.512
committee for many years when he became

26:44.512 --> 26:46.819
OD and I had to go through what took

26:46.829 --> 26:48.829
the , a much longer process than it

26:48.829 --> 26:50.940
should , having him had access to all

26:50.940 --> 26:53.162
of the , uh , the information from this

26:53.162 --> 26:55.479
committee . Um , so we've been working

26:55.489 --> 26:57.767
this process trying to drive the , the ,

26:57.767 --> 26:59.767
the wait time down , trying to make

26:59.767 --> 27:01.933
sure that a clearance wouldn't have to

27:01.933 --> 27:04.267
be redone all the time . And , you know ,

27:04.267 --> 27:06.045
to try to do this where we have

27:06.045 --> 27:08.267
continuous vetting , using technology ,

27:08.267 --> 27:10.322
not sending retired FBI agents out ,

27:10.322 --> 27:12.600
you know , to check whether somebody's ,

27:12.600 --> 27:14.711
they actually went to college X , you

27:14.711 --> 27:16.711
know , makes sense and , and should

27:16.711 --> 27:19.900
bring about a , a more efficient system .

27:20.280 --> 27:22.336
But as you said , for a program that

27:22.336 --> 27:24.558
was supposed to be done by 2019 and you

27:24.558 --> 27:26.724
can go ahead and start the clock . I'm

27:26.724 --> 27:29.002
not gonna go forever on this . Um , uh ,

27:29.002 --> 27:31.058
you know , this is supposed to be in

27:31.058 --> 27:33.224
2019 and 2023 . We were led to believe

27:33.224 --> 27:36.589
that things were , were going along

27:36.599 --> 27:38.655
even though there have been delays .

27:39.280 --> 27:41.391
The amazing thing was in September of

27:41.391 --> 27:44.359
23 . At this ,

27:45.199 --> 27:48.930
there was a sudden deletion of 90

27:48.949 --> 27:51.540
terabytes of information .

27:54.780 --> 27:56.800
That's a lot of information . Now ,

27:56.810 --> 27:59.920
luckily there were some backups that

28:00.599 --> 28:03.569
were able to re restore that . But we

28:03.579 --> 28:07.579
asked if you hadn't had that holy heck

28:07.589 --> 28:10.010
moment . Would this committee have ever

28:10.020 --> 28:12.800
been informed of how screwed up things

28:12.810 --> 28:15.650
were and to give a

28:15.660 --> 28:19.359
framework um , at D CS , a

28:19.369 --> 28:22.239
5400 employees , roughly about 1000 of

28:22.250 --> 28:24.472
them , almost all the time were working

28:24.472 --> 28:28.420
on this project . The outside

28:28.430 --> 28:31.719
contractor had 1000 plus people working

28:31.729 --> 28:35.719
on , on it . The contractor was

28:35.729 --> 28:37.618
my understanding was developing a

28:37.618 --> 28:40.670
program that would have never scaled to

28:40.680 --> 28:44.439
meet the needs . How did this go on

28:44.449 --> 28:47.469
without anybody saying of a few 1000

28:47.479 --> 28:49.479
people , contractors and government

28:49.479 --> 28:51.646
policing this isn't gonna work . Now ,

28:51.646 --> 28:53.590
some of this is due to fixed price

28:53.590 --> 28:55.701
contracts where I don't believe we've

28:55.701 --> 28:57.646
actually set the incentives in the

28:57.646 --> 28:59.868
right place to get a pro product that's

28:59.868 --> 29:01.868
deliverable . But it still begs the

29:01.868 --> 29:04.339
question of my gosh , if there hadn't

29:04.349 --> 29:06.460
been the misplacement of 90 terabytes

29:06.460 --> 29:09.069
of data , would we have , when would we

29:09.079 --> 29:11.246
have been informed ? Starting in about

29:11.670 --> 29:14.199
November , December , we had a series

29:14.209 --> 29:17.469
of , of um meetings I did and others

29:17.479 --> 29:19.590
with the former secretary Moultrie on

29:19.599 --> 29:22.270
these issues and there was , and it

29:22.280 --> 29:24.113
went from one story to another ,

29:24.113 --> 29:28.000
getting worse and worse and worse . So

29:28.349 --> 29:31.209
we've not only wasted . And we don't

29:31.219 --> 29:33.441
know for a project that was supposed to

29:33.441 --> 29:35.949
co cost in total an initial estimate

29:35.959 --> 29:39.319
$700 million and we're at a , a billion

29:39.329 --> 29:41.385
seven now and we don't even know how

29:41.385 --> 29:44.089
much to finish you

29:45.150 --> 29:47.317
for you guys who thought ac a roll out

29:47.317 --> 29:49.428
was bad . This may get close in terms

29:49.428 --> 29:53.020
of cost overruns . Um We , we , we need

29:53.030 --> 29:56.290
to know what the , the , um , the

29:57.300 --> 29:59.467
expectation would be . I'm gonna start

29:59.467 --> 30:01.578
with Secretary Harrison and David you

30:01.578 --> 30:03.689
to give us an update and I appreciate

30:03.689 --> 30:05.744
the 90 day sprint . Um And then I am

30:05.744 --> 30:07.930
gonna ask Stacey like or doctor Doctor

30:07.939 --> 30:10.161
Dickon , you know , why didn't the pack

30:10.161 --> 30:12.819
catch this ? And how do we have

30:12.829 --> 30:14.996
confidence ? I mean , we can bring you

30:14.996 --> 30:17.051
guys in on a regular basis , but how

30:17.051 --> 30:16.260
are we gonna have confidence ? This

30:16.270 --> 30:18.492
doesn't happen again because the end of

30:18.492 --> 30:20.659
the day , as , as Senator Rubio said ,

30:20.659 --> 30:22.881
you know , we got to guard our nation's

30:22.881 --> 30:22.839
secrets and if we can't get people

30:22.849 --> 30:25.016
cleared and we can , people won't come

30:25.016 --> 30:27.780
to work for the IC and we can't get

30:27.790 --> 30:29.623
them to move from our contractor

30:29.623 --> 30:31.679
community . If we can't get folks to

30:31.679 --> 30:31.380
move from one contract to another ,

30:31.390 --> 30:33.557
we're not going to be as sufficient as

30:33.557 --> 30:35.810
she would , we should be . So MS

30:35.819 --> 30:38.041
Harrison and Mr Cat , if you could talk

30:38.041 --> 30:41.290
and then M Dickson , if you could um uh

30:41.339 --> 30:44.339
answer . Thank you for the question .

30:45.709 --> 30:47.900
So , first and foremost , we are , we

30:47.910 --> 30:51.069
are focused on doing this once . So

30:51.079 --> 30:53.246
this uh this sprint to effort has been

30:53.246 --> 30:55.357
focused on diagnosing what has been ,

30:55.357 --> 30:57.468
what has gone on with the program and

30:57.468 --> 30:59.023
focused on moving out on an

30:59.023 --> 31:01.609
implementation plan that that leads to

31:01.619 --> 31:04.130
success . That includes , as I

31:04.140 --> 31:06.251
mentioned , new oversight authority ,

31:06.251 --> 31:08.473
both for the sponsorship of the program

31:08.473 --> 31:10.709
and for the uh uh the acquisition . So

31:10.719 --> 31:13.770
that will both happen at the in the

31:13.780 --> 31:15.891
Pentagon . This is a cross functional

31:15.891 --> 31:18.800
effort . D CS A needs the full team at

31:18.810 --> 31:21.229
its back . So we are also working on

31:21.239 --> 31:23.128
clarity on requirements and a new

31:23.128 --> 31:25.183
requirements management process that

31:25.183 --> 31:27.128
will be in in conjunction with our

31:27.128 --> 31:29.295
partners in the pack to ensure that we

31:29.295 --> 31:31.295
understand what the system needs to

31:31.295 --> 31:33.406
deliver , how our customers are using

31:33.406 --> 31:35.628
it and what needs to be integrated into

31:35.628 --> 31:37.739
the road map for future development .

31:37.739 --> 31:39.961
We are also working on as you reference

31:39.961 --> 31:42.183
this road map for delivery . So we have

31:42.183 --> 31:44.295
some predictability so we can measure

31:44.295 --> 31:46.350
how we are doing against those goals

31:46.350 --> 31:48.295
and that we can better better mark

31:48.295 --> 31:50.517
where we have delays or other technical

31:50.517 --> 31:52.683
problems that are are interrupting the

31:52.683 --> 31:54.739
development cycle . And finally , we

31:54.739 --> 31:56.628
are working to develop a reliable

31:56.628 --> 31:58.628
funding profile aligned to that new

31:58.628 --> 32:00.739
road map . As David alluded to in his

32:00.739 --> 32:02.850
statement , we are , we are conscious

32:02.850 --> 32:05.017
that we need to as the department take

32:05.017 --> 32:07.579
the costs of this delay and , and fund

32:07.589 --> 32:09.478
those internally . We are working

32:09.478 --> 32:11.478
through that in our current program

32:11.478 --> 32:13.533
budget review , but we are confident

32:13.533 --> 32:15.589
that we can continue to deliver this

32:15.589 --> 32:18.140
program um if we align to these goals .

32:18.150 --> 32:20.039
Well , I would like brief answers

32:20.039 --> 32:22.206
because I'm chasing away my colleagues

32:22.206 --> 32:24.372
because we're going , but I'm gonna be

32:24.372 --> 32:23.579
here as long as it takes . So I've got

32:23.589 --> 32:25.756
lots of rounds of additional questions

32:25.756 --> 32:28.219
but you know , and I appreciate uh Mr

32:28.229 --> 32:30.285
call you coming into taking , taking

32:30.285 --> 32:32.530
this on because it was a , it's a mess

32:32.829 --> 32:34.996
and appreciate that . And , but if you

32:34.996 --> 32:37.162
could briefly and then uh Secretary di

32:37.162 --> 32:39.385
or director Dickson , could you briefly

32:39.385 --> 32:41.496
because I want to make sure everybody

32:41.496 --> 32:45.280
gets a bite . Say I want to save you

32:45.290 --> 32:47.234
for my second round . So you get a

32:47.234 --> 32:49.401
reprieve . But I wanna make sure , you

32:49.401 --> 32:51.346
know , um how do we make sure that

32:51.346 --> 32:53.401
we've actually got a plan and please

32:53.401 --> 32:55.568
give as much specificity as possible .

32:55.568 --> 32:57.790
But briefly , you know , I have lots of

32:57.790 --> 32:57.640
follow ups for later . Well , thank you ,

32:57.650 --> 32:59.939
Chairman . Um I just reinforced what

32:59.949 --> 33:02.060
the acting under secretary said first

33:02.060 --> 33:04.949
by saying that I , I joined literally a

33:04.959 --> 33:07.060
week before that 90 day period began

33:07.069 --> 33:09.500
for the review and was able to then

33:09.510 --> 33:11.232
plug into that fully . And I'm

33:11.232 --> 33:13.232
confident that we brought the right

33:13.232 --> 33:15.343
people to bear to take a hard look at

33:15.343 --> 33:17.121
this . From my perspective , we

33:17.121 --> 33:19.066
considered uh personnel , personal

33:19.066 --> 33:21.288
expertise as a first basket . We looked

33:21.288 --> 33:23.177
at procurement as a second and we

33:23.177 --> 33:25.121
looked at oversight as a third and

33:25.121 --> 33:27.288
we've both made many points uh already

33:27.288 --> 33:29.121
but happy to amplify on what the

33:29.121 --> 33:31.288
specifics were . So we went through as

33:31.288 --> 33:33.232
we did that review . Um But moving

33:33.232 --> 33:35.010
forward , we have new oversight

33:35.010 --> 33:37.121
authorities , we will have clarity on

33:37.121 --> 33:36.859
program requirements and new

33:36.869 --> 33:39.091
requirements management process . And I

33:39.091 --> 33:41.202
think it's important to say here that

33:41.202 --> 33:43.425
the trusted workforce requirements , as

33:43.425 --> 33:45.369
well as those of N BS as initially

33:45.369 --> 33:47.536
conceived , are understood and sound .

33:47.536 --> 33:49.591
I think the problem really was their

33:49.591 --> 33:51.758
interpretation and making sure that my

33:51.758 --> 33:53.869
agency had what it needed in terms of

33:53.869 --> 33:53.449
its knowledge and capability to

33:53.459 --> 33:55.403
actually deliver properly on those

33:55.403 --> 33:57.626
requirements . This was a large part of

33:57.626 --> 33:59.515
this discovery process as we went

33:59.515 --> 34:01.570
through it . Uh we will also have an

34:01.570 --> 34:03.579
updated and uh and good vetting

34:03.589 --> 34:05.867
capability , road map for delivery and ,

34:05.867 --> 34:08.033
and a reliable funding profile aligned

34:08.033 --> 34:10.089
to that new road map . And after its

34:10.089 --> 34:11.922
approval , we will also get that

34:11.922 --> 34:14.145
outside independent cost estimate to be

34:14.145 --> 34:16.311
even more confident in compliance than

34:16.311 --> 34:18.422
with policy and statute . We show you

34:18.422 --> 34:20.589
the right documents . So at the end of

34:20.589 --> 34:20.469
this 90 days , we will deliver , have

34:20.479 --> 34:22.701
delivered an updated set of acquisition

34:22.701 --> 34:24.868
documents , this revamp requirements ,

34:24.868 --> 34:27.035
governance procedures , agile training

34:27.035 --> 34:29.260
and documentation . Uh As Doctor Plumb

34:29.270 --> 34:31.381
has also said , we've brought in some

34:31.381 --> 34:33.603
new people , we know where our gaps are

34:33.603 --> 34:33.260
and the skill sets that we need to hire

34:33.270 --> 34:35.437
on the government side . We're working

34:35.437 --> 34:37.603
with the contractor as well on actions

34:37.603 --> 34:39.714
need to be taken there and we're also

34:39.714 --> 34:41.881
evaluating the requirements baseline .

34:41.881 --> 34:43.826
So I , I have a lot to say on this

34:43.826 --> 34:43.239
point , but again , in the interest of

34:43.250 --> 34:45.472
time , I'll stop , you know , I'll come

34:45.472 --> 34:48.080
back around Senator Rubio . Um

34:49.459 --> 34:51.770
so this could be the Director Dixon or

34:51.780 --> 34:54.610
Secretary Harris or both . Um The

34:54.620 --> 34:56.564
continuous vetting in the national

34:56.564 --> 34:58.787
background investigation service is not

34:58.787 --> 35:01.620
mandatory for all the agencies and

35:01.629 --> 35:03.889
departments to use their system under

35:03.899 --> 35:05.843
the counterintelligence . Security

35:05.843 --> 35:07.939
agency . This directly

35:09.129 --> 35:11.679
impacts oversight by OD and I as a

35:11.689 --> 35:14.179
security executive agent . Um

35:14.879 --> 35:17.046
Additionally , contractors have a real

35:17.046 --> 35:19.268
tough time being able to plan and train

35:19.268 --> 35:21.580
to these very different systems and

35:21.590 --> 35:23.701
it's not easy to track to contact for

35:23.701 --> 35:25.590
security clearance , tracking and

35:25.590 --> 35:28.889
reciprocity . So the D CS A and NBI S

35:28.899 --> 35:30.955
systems of security clearance do not

35:30.955 --> 35:34.479
cover um or support the IC . Why is

35:34.489 --> 35:36.433
that ? And what , what is the plan

35:36.433 --> 35:38.378
going forward in particular ? What

35:38.378 --> 35:40.433
about reciprocity for employees that

35:40.433 --> 35:42.600
are moving , for example , from CIA to

35:42.600 --> 35:46.370
Dia I will take that one , sir . The ,

35:46.459 --> 35:48.459
you're absolutely right that D CS A

35:48.459 --> 35:50.237
does not cover the intelligence

35:50.237 --> 35:52.015
community . We have a number of

35:52.015 --> 35:54.070
agencies within our community and we

35:54.070 --> 35:56.292
essentially allow them to determine the

35:56.292 --> 35:58.459
types of risks that they're willing to

35:58.459 --> 35:58.340
take as they're bringing on board their

35:58.350 --> 36:00.406
folks . So they don't do their own ,

36:00.406 --> 36:02.017
many of them do their own uh

36:02.017 --> 36:05.419
investigative service . They also have

36:05.429 --> 36:07.151
uh enhanced , enhanced vetting

36:07.169 --> 36:09.336
processes that they include to include

36:09.336 --> 36:11.058
Polygraphs , medical , um some

36:11.058 --> 36:13.290
psychological screenings that D CS A

36:13.300 --> 36:15.479
does not provide . But those are what

36:15.489 --> 36:17.433
they believe they need to bring on

36:17.433 --> 36:19.489
board . The kinds of folks that they

36:19.489 --> 36:21.656
need for their particular workforce to

36:21.656 --> 36:23.711
expect DC AD CS A to do that sort of

36:23.711 --> 36:25.919
tailoring for different agencies to

36:25.929 --> 36:27.929
deliver what they need is something

36:27.929 --> 36:29.818
that we wouldn't put on them . We

36:29.818 --> 36:31.873
believe that the agencies themselves

36:31.873 --> 36:31.520
are best positioned to bring their

36:31.530 --> 36:33.752
folks on and know what kinds of vetting

36:33.752 --> 36:35.808
they actually need to do . Uh We are

36:35.808 --> 36:37.974
very comfortable with what D CS A does

36:37.974 --> 36:37.889
just with the rest of the government .

36:37.899 --> 36:39.955
But with respect to the intelligence

36:39.955 --> 36:41.955
community because it is so variable

36:41.955 --> 36:44.121
between the agencies , it's better for

36:44.121 --> 36:46.288
them to be able to uh to actually pick

36:46.288 --> 36:46.010
their process . So what , which

36:46.020 --> 36:49.860
agencies don't use NBI S and DC SAS

36:49.889 --> 36:52.120
CV program , which are the agencies

36:52.129 --> 36:54.462
that do not . We have a within , within ,

36:55.360 --> 36:58.419
within uh within C the CV . Particular

36:59.070 --> 37:01.292
continued vetting is done by everyone .

37:01.292 --> 37:03.459
It's just done differently . We have a

37:03.459 --> 37:05.514
continuous evaluation system that we

37:05.514 --> 37:07.737
use within the intelligence community ,

37:07.737 --> 37:09.959
but it uses many of the same uh reports

37:09.959 --> 37:12.070
and , and uh data sources that the CV

37:12.070 --> 37:14.429
does U is , uses for D CS A . So

37:14.439 --> 37:16.489
there's commonalities there , it is

37:16.500 --> 37:18.611
just a different system that we run .

37:18.611 --> 37:20.889
David . Do you wanna ? Uh Yes , thanks .

37:20.889 --> 37:23.167
I just add from the D CS a perspective .

37:23.167 --> 37:25.167
We're managing enrollment and alert

37:25.167 --> 37:27.278
resolution for 3.8 million department

37:27.278 --> 37:29.333
of Defense , military , civilian and

37:29.333 --> 37:31.389
national industrial security program

37:31.389 --> 37:33.500
contractors , but also for 44 non dod

37:33.500 --> 37:36.100
federal agencies . So it's a , it's a

37:36.110 --> 37:37.943
very large population that we're

37:37.943 --> 37:40.054
handling outside the IC . So , is not

37:40.054 --> 37:42.277
having a sort of a single or at least ,

37:42.277 --> 37:44.780
uh , as a baseline , a single NBI S

37:44.790 --> 37:47.068
like system for the federal government .

37:47.068 --> 37:49.679
Doesn't that hamper efforts at reform

37:49.689 --> 37:51.745
and , and oversight because we're in

37:51.745 --> 37:53.856
essence , dealing with all these silo

37:53.856 --> 37:56.022
type systems . And our answer actually

37:56.022 --> 37:57.911
would be no sir , because trusted

37:57.911 --> 37:59.745
workforce 2.0 is bringing in the

37:59.745 --> 38:01.856
standardization and the guidelines so

38:01.856 --> 38:04.022
that even though we're using different

38:04.022 --> 38:05.689
investigative processes , the

38:05.689 --> 38:07.800
underlying principles behind them are

38:07.800 --> 38:09.856
the same and what will happen with a

38:09.856 --> 38:12.078
clearance , the , the types of security

38:12.078 --> 38:14.300
clearances that are being granted , the

38:14.300 --> 38:16.522
types of , of vetting that's being done

38:16.522 --> 38:18.633
is similar across the board . When it

38:18.633 --> 38:20.800
comes to the IC , we just require more

38:20.800 --> 38:20.040
than some of the other government

38:20.050 --> 38:22.161
agencies . And so we're handling that

38:22.161 --> 38:24.050
more section . So it's really the

38:24.050 --> 38:26.106
baseline and foundation is similar .

38:26.106 --> 38:28.328
It's just the extra parts are different

38:28.328 --> 38:30.606
for what our community needs . OK . OK .

38:31.659 --> 38:34.489
Thank you . Thank you very much uh Mr

38:34.500 --> 38:36.667
Chairman . And let me say to our panel

38:36.899 --> 38:40.129
years ago when Senator Moran of this

38:40.139 --> 38:43.639
committee and I started on the

38:43.649 --> 38:47.040
declassification reform issue , we

38:47.050 --> 38:50.580
learned that a staff actually had to

38:50.590 --> 38:53.659
trek around from office to

38:53.669 --> 38:57.560
office with a blue bag waiting

38:57.570 --> 39:00.699
around for approval . And I always

39:00.709 --> 39:03.229
wondered whether this took so long that

39:03.500 --> 39:06.239
the staffer had to pack a lunch because

39:06.250 --> 39:09.090
it looked like they were out there for

39:09.199 --> 39:12.419
great lengths of time . And this was

39:12.429 --> 39:15.899
because Senator Moran and I found that

39:15.909 --> 39:19.379
the different systems didn't talk to

39:19.389 --> 39:21.449
each other . So we're gonna start

39:21.459 --> 39:24.939
speaking English now about exactly what

39:24.949 --> 39:28.280
is at issue and then with digital

39:28.290 --> 39:31.260
records , they just overwhelmed this

39:31.270 --> 39:34.350
broken system . So I had a number of

39:34.360 --> 39:36.949
conversations with Director Haines and

39:36.959 --> 39:39.510
she said , you and Senator Moran are

39:39.520 --> 39:41.742
absolutely right . And we've got to get

39:41.742 --> 39:43.909
serious about it . She went and gave a

39:43.909 --> 39:46.110
big speech in Texas . Senator Cornyn ,

39:46.120 --> 39:48.287
who's taken a great interest in it and

39:48.287 --> 39:50.453
she said we're going to reform it . So

39:50.453 --> 39:53.379
I want to ask some questions now of you ,

39:53.389 --> 39:56.010
Doctor Dixon to pick up where we left

39:56.020 --> 39:59.629
off on this kind of setting the table

39:59.639 --> 40:02.870
that I have uh done here . And

40:03.620 --> 40:06.399
you were last in our hearing last March .

40:06.409 --> 40:08.919
And I asked , then I'm gonna ask now ,

40:08.929 --> 40:11.320
has any progress been made in the

40:11.330 --> 40:14.159
administration's rewrite of the

40:14.169 --> 40:16.879
executive order governing

40:16.889 --> 40:19.439
classification and declassification ?

40:19.929 --> 40:22.229
The , the administration continues to

40:22.239 --> 40:24.406
make progress on that . I believe that

40:24.406 --> 40:26.017
they will have some upcoming

40:26.017 --> 40:28.017
deliverables over the course of the

40:28.017 --> 40:30.128
summer that we're all looking forward

40:30.128 --> 40:32.350
to . But it's been a very collaborative

40:32.350 --> 40:31.959
process across the inter agency making

40:31.969 --> 40:34.191
sure that everyone's equities are being

40:34.191 --> 40:36.413
taken into account . So you expect that

40:36.413 --> 40:38.629
we'll get that this summer ? I believe

40:38.639 --> 40:40.780
that is their goal . Ok . Now ,

40:40.790 --> 40:43.969
obviously , real reform means you gotta

40:43.979 --> 40:46.610
have somebody in charge is the

40:46.620 --> 40:48.479
administration any closer to

40:48.489 --> 40:51.510
designating an executive agent for

40:51.520 --> 40:55.239
classification and declassification ? I

40:55.250 --> 40:57.361
would say part of the executive order

40:57.361 --> 40:59.250
conversations that they're having

40:59.250 --> 41:01.361
involve who that executive agent will

41:01.361 --> 41:04.919
be for declassification . So will

41:04.929 --> 41:08.699
we be close to actually getting an

41:08.709 --> 41:12.010
executive agent for classification and

41:12.020 --> 41:14.850
declassification in your view by fall ?

41:14.860 --> 41:18.739
That's a yes or no answer . I am not in

41:18.750 --> 41:20.959
charge of the process . Their goal is

41:20.969 --> 41:23.620
to deliver the administration itself is

41:23.629 --> 41:25.851
actually delivering the executive order

41:25.851 --> 41:27.851
update . And once they deliver that

41:27.851 --> 41:29.907
part of that is a description of who

41:29.907 --> 41:31.629
will be the declassification ,

41:31.629 --> 41:33.907
executive agent . Once that is defined ,

41:33.907 --> 41:33.899
they will then go about filling the

41:33.909 --> 41:36.131
process . So when , when do you believe

41:36.131 --> 41:38.739
we'll have an executive agent for

41:38.750 --> 41:40.639
classification declassification ?

41:40.639 --> 41:42.583
Because that's key , you know , in

41:42.583 --> 41:44.750
other words , Senator Warner , Senator

41:44.750 --> 41:47.239
Rubio , talking about all kinds of very

41:47.250 --> 41:49.379
serious things . And I think back

41:49.389 --> 41:51.556
through some of what Senator Moran and

41:51.556 --> 41:53.556
I have been through and we , so the

41:53.556 --> 41:55.667
first thing we gotta do is figure out

41:55.667 --> 41:57.778
how to put this in terms . People can

41:57.778 --> 42:00.000
understand the system we found with the

42:00.000 --> 42:02.939
person in his blue bag made a mockery

42:03.330 --> 42:05.441
out of what government is supposed to

42:05.441 --> 42:07.774
be all about . I'm at the point I'm now ,

42:07.774 --> 42:09.997
I believe the longest serving member of

42:09.997 --> 42:12.108
this committee . I think we're at the

42:12.108 --> 42:14.219
point where the classification system

42:14.219 --> 42:15.830
is so broken . We can't even

42:15.830 --> 42:18.052
necessarily figure out who the bad guys

42:18.052 --> 42:20.274
are and who the good guys are . So , uh

42:20.274 --> 42:22.386
I hope you'll take back and I'm gonna

42:22.386 --> 42:24.441
be on the phone with Director Haines

42:24.441 --> 42:26.552
very quickly on this question of when

42:26.552 --> 42:30.189
we're going to get a executive agent

42:30.199 --> 42:32.366
for classification . In the meantime ,

42:32.366 --> 42:34.421
we're also , we are also making some

42:34.421 --> 42:35.977
strides to actually improve

42:35.977 --> 42:37.977
declassification . But I do believe

42:37.977 --> 42:39.977
once the EEO the executive order is

42:39.977 --> 42:41.977
delivered , it will explain who the

42:41.977 --> 42:41.280
executive or agent is for

42:41.300 --> 42:43.669
classification is . So one last

42:43.679 --> 42:45.909
question , my time is short for you ,

42:45.939 --> 42:48.830
MS Dixon . So I think it is generally

42:48.840 --> 42:51.870
believed that declassification reform

42:52.070 --> 42:54.500
is going to save taxpayers some money

42:54.510 --> 42:57.159
in the long term . But we're going to

42:57.169 --> 42:59.889
have to have some investments in order

42:59.899 --> 43:02.060
to modernize the current obsolete

43:02.070 --> 43:06.010
system . Has the ODNI arrived at some

43:06.020 --> 43:09.290
estimates for how much declassification

43:09.300 --> 43:12.030
reform will cost in the next few years ?

43:12.040 --> 43:15.919
A and B ? Will you make public

43:15.989 --> 43:18.100
what those estimates are ? Because we

43:18.100 --> 43:20.489
have spent so much money on this . I

43:20.500 --> 43:22.389
think people have a right to know

43:22.399 --> 43:24.621
what's the answer to that . And I guess

43:24.621 --> 43:26.843
I got eight seconds to get it under the

43:26.843 --> 43:29.010
gun with respect to the first one . We

43:29.010 --> 43:31.232
are in the process of figuring out what

43:31.232 --> 43:33.399
tools , capabilities , incentives . We

43:33.399 --> 43:35.510
need to actually put in place so that

43:35.510 --> 43:35.090
people are thinking more about what

43:35.100 --> 43:37.267
information they can declassify versus

43:37.267 --> 43:39.267
how we've been protecting it in the

43:39.267 --> 43:41.378
past . Uh I will take it back whether

43:41.378 --> 43:43.433
or not we're going to be publicizing

43:43.433 --> 43:43.399
that number just , just now and I'm

43:43.409 --> 43:45.465
going to say it right , right here ,

43:45.465 --> 43:47.631
Senator Rubio kids . Me from a , we're

43:47.631 --> 43:49.853
gonna have a real fight . If there is a

43:49.853 --> 43:51.909
resistance to making those estimates

43:51.909 --> 43:53.965
public , we have spent so much money

43:53.965 --> 43:56.131
for so long , the public's got a right

43:56.131 --> 43:58.076
to know on where we go from here ,

43:58.076 --> 44:00.298
especially given the fact that my chair

44:00.298 --> 44:02.409
has asked these serious questions and

44:02.409 --> 44:04.576
we're kind of in the dark about what's

44:04.576 --> 44:06.742
happening with the delay . So that's ,

44:06.742 --> 44:08.965
and I wouldn't , you know , and we , we

44:08.965 --> 44:11.600
had , we took your bill and you j you

44:11.659 --> 44:13.548
and Senator Rand's bill . Senator

44:13.548 --> 44:15.659
Cornyn had a lot of work on this . We

44:15.659 --> 44:17.659
built it in , we had , we went even

44:17.659 --> 44:20.050
further and it was all in the IA a last

44:20.060 --> 44:23.179
year and we got it to the , it ended up

44:23.189 --> 44:25.356
not being this committee , it ended up

44:25.356 --> 44:27.356
being some of our colleagues in the

44:27.356 --> 44:29.578
house and we've still got many of those

44:29.578 --> 44:29.330
provisions in this year's IA A so we ,

44:29.340 --> 44:31.229
we are not letting go of that and

44:31.229 --> 44:33.284
appreciate the , the great work that

44:33.284 --> 44:35.507
you and Senator Moran have done . And I

44:35.507 --> 44:35.129
know Senator Cornyn's been an advocate

44:35.139 --> 44:37.417
on this as well . Senator Cornyn . You ,

44:38.030 --> 44:40.280
well , let me start with , uh where

44:40.290 --> 44:43.149
Senator Wyden left off the , uh and

44:43.159 --> 44:44.826
Senator Warner , the Sensible

44:44.826 --> 44:46.992
Classification Act that we passed last

44:46.992 --> 44:50.120
year . Part of that required studies

44:50.209 --> 44:52.600
and recommendations on the necessity of

44:52.610 --> 44:54.610
security clearances . I believe the

44:54.610 --> 44:56.689
testimony we've heard was that there

44:56.699 --> 44:59.550
are 4 million people with security

44:59.560 --> 45:02.250
clearances in America . If 4 million

45:02.260 --> 45:04.038
people are supposed to keep the

45:04.038 --> 45:06.500
nation's secrets , it seems to me that

45:07.139 --> 45:10.250
there's a lot of not secrets being kept .

45:10.260 --> 45:12.149
I mean , the , the things are not

45:12.149 --> 45:14.204
secret . So , and we've learned that

45:14.204 --> 45:17.469
some of the FTEs require a security

45:17.479 --> 45:19.535
clearance without regard to actually

45:19.535 --> 45:21.701
the necessity of that person getting a

45:21.701 --> 45:24.189
security clearance and the like . So

45:24.530 --> 45:26.600
what I wanted to ask is have the

45:26.610 --> 45:28.554
agencies that you've over that you

45:28.554 --> 45:31.330
oversee begun the studies on the

45:32.139 --> 45:34.083
necessity of security clearances ,

45:34.083 --> 45:36.028
including a description of how the

45:36.028 --> 45:38.250
agencies will make sure that the number

45:38.250 --> 45:40.417
of security clearances granted will be

45:40.417 --> 45:42.528
kept to a minimum . Let me start with

45:42.528 --> 45:44.583
you Dr Dixon . I actually don't know

45:44.583 --> 45:46.806
the answer to that question . I will go

45:46.806 --> 45:46.350
back and find out whether the studies

45:46.360 --> 45:49.000
have begun that concerns me . You're

45:49.010 --> 45:51.260
the Deputy Director of National

45:51.270 --> 45:53.381
Intelligence . So you don't have that

45:53.381 --> 45:55.659
information , that particular one . No ,

45:55.659 --> 45:58.189
sir . I do not . Any of the rest of you

45:58.199 --> 46:01.300
have any knowledge of any um , studies

46:01.310 --> 46:03.699
that have been done or , or in the

46:03.709 --> 46:05.820
process being done as required by the

46:05.820 --> 46:09.649
statute . Ok .

46:09.659 --> 46:12.479
Well , that's kind of a , not a great

46:12.489 --> 46:15.459
start . Let me go back . And uh

46:17.939 --> 46:19.995
as I understand it , the defense and

46:19.995 --> 46:21.995
talent counterintelligence Security

46:21.995 --> 46:23.995
Agency was established in 2018 . Of

46:23.995 --> 46:27.070
course , the NBI S , the uh personal

46:27.080 --> 46:29.191
vetting system was supposed to be the

46:29.191 --> 46:31.840
end , the end to end it infrastructure

46:31.850 --> 46:34.399
to enable the comprehensive personal

46:34.409 --> 46:37.800
vetting on a single platform . Um

46:38.479 --> 46:42.229
And uh it was originally supposed to be

46:42.239 --> 46:46.169
completed by 2019 , that was five years

46:46.179 --> 46:49.590
ago at a cost of $700 million . But

46:49.600 --> 46:52.310
here we are five years later and the

46:52.320 --> 46:54.909
program's not operational and

46:55.070 --> 46:58.780
$850 million has been spent . Can any

46:58.790 --> 47:02.610
of you tell us when this , the N

47:02.620 --> 47:04.800
BS will become operational ?

47:08.270 --> 47:10.570
So we have delivered some NBI S

47:10.580 --> 47:13.889
capability to date uh at this time as

47:13.899 --> 47:16.300
part of the 90 day effort , we are re

47:16.310 --> 47:18.610
baselining to make sure we understand

47:18.620 --> 47:20.676
exactly . That means you're starting

47:20.676 --> 47:22.842
over , we're not starting over as , as

47:22.842 --> 47:25.009
I think you've heard some of the other

47:25.009 --> 47:24.959
witnesses talk about , we're , we're

47:24.969 --> 47:27.510
looking to make sure that we can , can

47:27.520 --> 47:29.631
use what has been built . We are , we

47:29.631 --> 47:31.853
are exploring exactly what , what needs

47:31.853 --> 47:33.909
to happen going forward to ensure we

47:33.909 --> 47:35.576
meet the full , full level of

47:35.576 --> 47:37.631
capability that is expected from the

47:37.631 --> 47:39.742
system there at this time , we are in

47:39.742 --> 47:41.742
the process of refining exactly our

47:41.742 --> 47:44.076
understanding of that timeline I commit .

47:44.076 --> 47:46.298
In other , in other words , you don't ,

47:46.298 --> 47:48.298
you can't tell us at this point . I

47:48.298 --> 47:48.246
cannot tell you at this point , what I

47:48.256 --> 47:50.478
can commit to is that we will keep this

47:50.478 --> 47:52.589
committee informed as those estimates

47:52.589 --> 47:54.700
take shape . We are going through the

47:54.700 --> 47:57.302
process as I as I discussed to , to

47:57.312 --> 47:59.423
work with uh the undersecretary's and

47:59.423 --> 48:01.590
sustainment . As part of that , we are

48:01.590 --> 48:03.645
rebase line in the program , we will

48:03.645 --> 48:05.868
have an independent cost estimate . All

48:05.868 --> 48:05.822
of these are things that I commit to

48:05.832 --> 48:07.888
keeping the committee informed on as

48:07.888 --> 48:09.888
this work takes shape . It couldn't

48:09.888 --> 48:11.888
happen in 90 days . This is a month

48:11.888 --> 48:13.610
long effort , but we are fully

48:13.610 --> 48:15.776
committed to making sure that you have

48:15.776 --> 48:15.541
the full visibility as it comes

48:15.552 --> 48:18.092
together . So you can't tell us when

48:18.102 --> 48:21.231
the uh NBI S will be operational at

48:21.241 --> 48:24.132
this point . As I look at the um

48:25.510 --> 48:27.689
the new NBI S program manager and

48:27.699 --> 48:29.850
program executive officer has

48:29.860 --> 48:33.129
identified , it looks like four main

48:33.139 --> 48:37.020
reasons why this program is overdue and

48:37.030 --> 48:40.370
over budget . Um One was the trouble

48:40.379 --> 48:42.760
with requirements . The second is too

48:42.770 --> 48:45.379
much focus on technical debt . The

48:45.389 --> 48:48.449
third is poor contract management and

48:48.459 --> 48:50.909
the fourth is insufficient time and

48:50.919 --> 48:53.810
criteria for review . The GAO , the

48:53.820 --> 48:55.709
general accountability office has

48:55.709 --> 48:57.850
conducted multiple studies and made a

48:57.860 --> 49:00.629
variety of recommendations . Um

49:01.590 --> 49:03.909
Are those recommendations being

49:03.919 --> 49:07.010
implemented in the current efforts ,

49:07.929 --> 49:10.151
Senator , yes , they are . We're taking

49:10.151 --> 49:12.373
corrective action on those . That's one

49:12.373 --> 49:14.096
commitment that I make to this

49:14.096 --> 49:16.096
committee and to my agency . And is

49:16.096 --> 49:18.590
there who , who is in charge in the

49:18.600 --> 49:22.280
sense that there needs to be

49:22.290 --> 49:25.320
somebody held accountable . And as long

49:25.330 --> 49:27.441
as everybody's accountable , no one's

49:27.441 --> 49:29.608
accountable who is in charge of making

49:29.608 --> 49:32.320
sure this program is back on track and

49:32.330 --> 49:35.780
will be delivered as promised . So I

49:35.790 --> 49:38.479
believe that as the program sponsor ,

49:38.770 --> 49:41.719
the undersecretary's

49:43.239 --> 49:45.406
a shared responsibility with the under

49:45.406 --> 49:47.100
secretary for acquisition and

49:47.110 --> 49:49.332
sustainment to ensure that this program

49:49.332 --> 49:51.489
is sufficiently overseen and that we

49:51.500 --> 49:53.667
are , we are doing this soundly and in

49:53.667 --> 49:55.889
line with the requirements as they have

49:55.889 --> 49:58.000
been . So , the Department of Defense

49:58.000 --> 49:57.719
is responsible , the Department of

49:57.729 --> 49:59.951
Defense is responsible and we are fully

49:59.951 --> 50:02.062
committed to making sure that this is

50:02.062 --> 50:04.229
the path to success for and as we move

50:04.229 --> 50:07.969
forward . Well , it's no surprise to

50:07.979 --> 50:11.810
me that uh a program as complex as this

50:12.479 --> 50:16.270
is overdue and

50:16.280 --> 50:18.820
over budget when apparently the most

50:18.830 --> 50:20.580
basic requirements were never

50:20.590 --> 50:23.100
identified initially . Is that correct ?

50:24.370 --> 50:26.426
I think the requirements were , were

50:26.426 --> 50:28.426
outlined in trusted workforce 2.0 I

50:28.426 --> 50:30.481
think what we had was a breakdown in

50:30.481 --> 50:32.370
how those requirements were being

50:32.370 --> 50:34.592
managed into technical requirements for

50:34.592 --> 50:36.759
the development and how we were taking

50:36.759 --> 50:38.981
account of the delays in that process .

50:38.981 --> 50:40.870
And that is something that we are

50:40.870 --> 50:43.092
seeking to remedy immediately with more

50:43.092 --> 50:45.037
proactive oversight from the under

50:45.037 --> 50:47.259
secretary of Inss office in partnership

50:47.259 --> 50:49.370
with D CS A . As we look to make sure

50:49.370 --> 50:51.537
we put this on a sound foundation , my

50:51.537 --> 50:53.870
time is overdue and I just to make you

50:53.879 --> 50:56.909
feel one I think you can all get on

50:56.919 --> 50:59.949
Doctor Dixon on classification . The

50:59.959 --> 51:02.181
other folks who are here , it's more in

51:02.181 --> 51:04.237
security clearance reform but do add

51:04.237 --> 51:06.348
kind of insult to injury . You know ,

51:06.348 --> 51:08.459
you had 1000 people at D CS A working

51:08.459 --> 51:07.879
on this and 1000 people at Periton ,

51:07.889 --> 51:10.056
the contractor working on this and why

51:10.056 --> 51:12.310
nobody raised their hand earlier is uh

51:12.439 --> 51:14.661
something we're going to get to at some

51:14.661 --> 51:16.828
point today , Mr Senator Mr Chairman ,

51:16.828 --> 51:18.717
if I could just add the fact that

51:18.717 --> 51:20.939
there's a couple of 1000 people working

51:20.939 --> 51:22.939
on , it doesn't mean that they know

51:22.939 --> 51:22.889
what they're doing or they're working

51:22.899 --> 51:25.000
in , in alignment to a , to a

51:25.010 --> 51:27.288
achievable objective on a timely basis .

51:27.379 --> 51:29.379
To me , that seems like the biggest

51:29.379 --> 51:31.157
problem here is lack of lack of

51:31.157 --> 51:32.810
leadership and a lack of any

51:32.820 --> 51:35.659
accountability and I grant that they're

51:35.669 --> 51:37.558
working on it , but I don't think

51:37.558 --> 51:39.820
that's a great answer . No , I , we do

51:39.830 --> 51:42.052
have new people in because it was I , I

51:42.052 --> 51:44.163
wish we would have done this when the

51:44.163 --> 51:46.330
prior people were here . So we could ,

51:46.330 --> 51:48.274
you know , appropriately scour and

51:48.274 --> 51:50.219
again , when we get around another

51:50.219 --> 51:52.274
round , Doctor Plumb has got because

51:52.274 --> 51:54.552
she's got a team that has been helping ,

51:54.552 --> 51:56.663
try to help figure this out as well .

51:56.663 --> 51:58.886
So Senator Bennett , thanks Mr Chairman

51:58.886 --> 51:58.330
and I appreciate your mentioning that

51:58.340 --> 52:00.562
Doctor Plum , that's actually where I'm

52:00.562 --> 52:02.979
headed . So I appreciate it , Mr

52:02.989 --> 52:06.020
Chairman . We have heard what a

52:06.030 --> 52:07.919
disaster . The development of the

52:07.919 --> 52:09.808
National Background Investigation

52:09.808 --> 52:11.863
system has been and it sounds like I

52:11.863 --> 52:13.697
hope the review team has a clear

52:13.697 --> 52:15.808
understanding of what needs to happen

52:15.808 --> 52:17.974
to get this back on track . And I look

52:17.974 --> 52:19.863
forward to regular updates on the

52:19.863 --> 52:21.808
progress . Others have covered the

52:21.808 --> 52:23.697
costs here . I wanna focus on the

52:23.697 --> 52:25.979
schedule delays . Gao reported in June

52:25.989 --> 52:29.409
2023 that 16 of the 25 major it

52:29.419 --> 52:32.469
business programs at dod reported cost

52:32.479 --> 52:35.850
or schedule changes since January 2021

52:35.860 --> 52:38.040
including 12 , that had cost increases

52:38.050 --> 52:41.560
ranging from 43,000 to 100 and $94

52:41.570 --> 52:45.040
million had um scheduling delays . I

52:45.050 --> 52:47.209
think there were 12 ranging from 3 to

52:47.219 --> 52:49.830
33 months . Program officials

52:49.840 --> 52:52.800
attributed to the changes to factors

52:52.810 --> 52:54.421
such as new requirements and

52:54.421 --> 52:57.419
unanticipated technical complexities

52:57.429 --> 53:00.080
that I'm sure drove scope in some way

53:00.090 --> 53:02.090
that might have been predicted , I

53:02.100 --> 53:04.909
guess . But my question is broader than

53:04.919 --> 53:07.409
NBI S gets at the pattern of large

53:07.419 --> 53:10.229
scale it acquisition and software

53:10.239 --> 53:11.961
development across the federal

53:11.961 --> 53:13.961
government . The chairman mentioned

53:13.961 --> 53:16.320
FAFSA and our veterans health systems ,

53:16.590 --> 53:18.646
but we could list what feels like an

53:18.646 --> 53:21.260
endless , endless , endless list of ,

53:21.270 --> 53:23.899
of examples by the way , examples where

53:23.909 --> 53:25.989
people are here to do the work , but

53:26.000 --> 53:28.167
never here for the accountability when

53:28.167 --> 53:31.209
we we were doing our oversight .

53:31.620 --> 53:35.159
Um The IRS you know , uh

53:35.189 --> 53:37.669
comes to mind in my , in my mind

53:37.679 --> 53:40.870
actually , recently as a as a decent um

53:40.879 --> 53:42.990
implementation , but I'll put that to

53:42.990 --> 53:44.879
one side . Doctor Plumb . In your

53:44.879 --> 53:47.101
statement for the record , you laid out

53:47.101 --> 53:49.157
three key points that this team will

53:49.157 --> 53:51.212
adopt , fixing the data architecture

53:51.212 --> 53:53.046
and adopting a modern approach ,

53:53.046 --> 53:54.990
building . The right team with the

53:54.990 --> 53:57.101
right skills and technical acumen and

53:57.101 --> 53:59.157
adopting digital transformation best

53:59.157 --> 54:01.419
practices . My question is , why can't

54:01.429 --> 54:03.489
we seem to adopt these principles

54:03.810 --> 54:05.810
across the federal government or at

54:05.810 --> 54:09.199
least in the IC and the dod until these

54:09.209 --> 54:11.376
principles are mandatory . We're gonna

54:11.376 --> 54:13.376
experience these failures again and

54:13.376 --> 54:15.320
again , wasting time and money and

54:15.320 --> 54:17.489
failing to deliver for the taxpayers .

54:17.500 --> 54:19.833
Would you like to say a word about that ?

54:19.833 --> 54:22.219
Doctor Plum ? Uh Thank you , Senator .

54:22.229 --> 54:24.659
Uh I think maybe the way to start this

54:24.669 --> 54:27.709
is fundamentally our acquisition models

54:27.719 --> 54:29.941
in the US government and the Department

54:29.941 --> 54:32.108
of Defense in particular have remained

54:32.108 --> 54:34.219
hardware centric . So we fund them in

54:34.219 --> 54:36.229
similar ways to the way we fund

54:36.260 --> 54:38.840
hardware procurement and we use feature

54:38.850 --> 54:41.520
delivery as our milestone markers for

54:41.530 --> 54:44.540
progress on them companies that manage

54:44.550 --> 54:46.772
it successfully with minimal disruption

54:46.772 --> 54:48.949
to users . Have a more continuous

54:48.959 --> 54:51.181
integration and continuous delivery and

54:51.181 --> 54:53.629
deployment pipeline process that for

54:53.639 --> 54:55.750
instance , only take software offline

54:55.750 --> 54:57.806
for very short periods of time to do

54:57.806 --> 55:00.120
upgrades and invest 70 to 80% of the

55:00.129 --> 55:02.340
total program cost into the back end

55:02.350 --> 55:04.625
data architecture and infrastructure as

55:04.635 --> 55:06.357
compared to the front end user

55:06.357 --> 55:09.865
interfaces and features . So inside um

55:09.875 --> 55:11.931
inside the , the broader question of

55:11.931 --> 55:13.986
software acquisition , while we have

55:13.986 --> 55:15.676
authorities and the software

55:15.686 --> 55:18.486
acquisition pathway , the traditional

55:18.496 --> 55:20.406
program management oversight and

55:20.416 --> 55:24.122
processes have tended to drive focus on

55:24.132 --> 55:27.241
the wrong areas and um that creates

55:27.251 --> 55:29.832
both a prioritization problem where

55:29.842 --> 55:32.152
prioritization is on front end user

55:32.162 --> 55:34.521
interface faces and new features rather

55:34.531 --> 55:37.642
than backend investments and funding um

55:37.652 --> 55:41.001
issues because those backend technical

55:41.011 --> 55:43.842
complexities cost money and take extra

55:43.852 --> 55:47.370
time . Um in the context of N BS are

55:47.379 --> 55:49.689
driving our recommendations is really

55:49.699 --> 55:52.810
focusing on those back end improvements .

55:53.110 --> 55:55.330
Uh keeping what we can building new

55:55.340 --> 55:57.310
things where we need to and then

55:57.320 --> 55:59.350
marrying that up with an agile

55:59.360 --> 56:01.780
continuous process for software

56:01.790 --> 56:04.360
development and delivery . Um so that

56:04.379 --> 56:06.546
we have , we don't face these problems

56:06.546 --> 56:08.546
again in the future . And I'll just

56:08.546 --> 56:10.879
close by saying that while we of course ,

56:10.879 --> 56:12.935
want to get to the point where we're

56:12.935 --> 56:14.490
meeting the full set of the

56:14.490 --> 56:16.490
requirements , there is no point at

56:16.490 --> 56:18.712
which this is done . And I think moving

56:18.712 --> 56:21.084
to a mindset where this is a continuous

56:21.094 --> 56:23.415
development and improvement process

56:23.564 --> 56:25.594
that will continually manage and

56:25.604 --> 56:27.548
upgrade the backend technology and

56:27.548 --> 56:29.715
front end features is part of what can

56:29.715 --> 56:31.882
prevent this . And doctor Plum , could

56:31.882 --> 56:34.160
I with the last 30 seconds that I have ?

56:34.160 --> 56:36.271
Could you talk a little bit about the

56:36.271 --> 56:38.548
defense digital Service ? And you know ,

56:38.548 --> 56:40.771
is this the type of team that , that we

56:40.771 --> 56:42.993
can bring in that , that agencies , you

56:42.993 --> 56:45.229
know , working with either the

56:45.239 --> 56:47.239
principles that you've described or

56:47.239 --> 56:50.370
some rationale at least could help make

56:50.379 --> 56:52.070
a difference in these kind of

56:52.080 --> 56:54.191
implementations . Absolutely . Um The

56:54.191 --> 56:56.570
defense digital service um focuses on

56:56.580 --> 56:58.802
they service . Our chief product office

56:58.802 --> 57:01.070
inside the Chief Digital and A I office

57:01.080 --> 57:03.340
in the Pentagon . They um focus on a

57:03.350 --> 57:05.128
what we call product management

57:05.128 --> 57:07.350
approach to delivery , which means they

57:07.350 --> 57:09.409
combine a product manager who owns a

57:09.419 --> 57:11.699
road map and that agile development

57:11.709 --> 57:13.750
process oversight with software

57:13.760 --> 57:15.538
engineers and user experience ,

57:15.538 --> 57:17.909
designers and researchers . The idea of

57:17.919 --> 57:20.830
that what we call product trio is to

57:20.840 --> 57:23.649
focus on turning the requirements that

57:23.659 --> 57:26.389
come in from customers into technical

57:26.399 --> 57:28.489
requirements and road maps and then

57:28.500 --> 57:31.030
ensuring that there is a systematic uh

57:31.040 --> 57:33.750
execution of those that are linked to

57:33.760 --> 57:36.629
continuous testing and user experience .

57:36.659 --> 57:39.229
And this team is one that we apply to

57:39.239 --> 57:41.295
major issues and concerns inside the

57:41.295 --> 57:43.183
department that rise to a sort of

57:43.183 --> 57:46.310
priority uh senior leader level like NB

57:50.659 --> 57:53.860
for your oversight of this side , it's

57:53.870 --> 57:55.981
gonna be hard to get to the bottom of

57:55.981 --> 57:57.870
all of it . And I'm grateful that

57:57.870 --> 57:59.537
you're making it a priority .

58:02.090 --> 58:05.300
Thank you , Mr Chairman . Away . We go

58:06.050 --> 58:08.709
uh II I think I , I really want to

58:08.719 --> 58:10.886
focus on one particular issue to begin

58:10.886 --> 58:12.941
with . And , and , and I think um uh

58:12.941 --> 58:15.629
Deputy Dixon , I think I'm gonna focus

58:15.639 --> 58:17.949
with you simply because you come with

58:17.959 --> 58:21.709
DN . I , what I'm curious about is

58:22.399 --> 58:25.000
we're doing our best here to identify

58:25.010 --> 58:26.954
and to be able to get folks in for

58:26.954 --> 58:28.899
security clearances . And get them

58:28.899 --> 58:31.179
through extremely frustrating and , and

58:31.189 --> 58:33.245
it's in all branches of government .

58:33.729 --> 58:35.896
But at the same time , we want to make

58:35.896 --> 58:38.118
sure that we keep these individuals and

58:38.120 --> 58:39.731
that they feel that they are

58:39.731 --> 58:41.879
appreciated and that , and that their

58:41.889 --> 58:43.820
service is meaningful and that

58:44.090 --> 58:46.879
basically we have their back . The

58:46.889 --> 58:48.889
reason why I lay it out that way is

58:48.889 --> 58:50.945
because most recently for the second

58:50.945 --> 58:53.350
time now on a 60 minutes display , we

58:53.360 --> 58:57.110
talked about um uh the , the A H I

58:57.120 --> 59:00.500
or the anomalous health incidences in

59:00.510 --> 59:03.110
which individual members who are well

59:03.120 --> 59:05.530
respected within your community have

59:05.540 --> 59:08.550
clearly identified health issues that

59:08.560 --> 59:11.899
they attribute to specific identifiable

59:11.909 --> 59:14.810
incidences that have occurred . Now ,

59:14.860 --> 59:18.580
we've had classified briefings on ,

59:18.590 --> 59:21.300
on the topic and I understand that this

59:21.310 --> 59:23.959
is a very sensitive area . But I think

59:23.969 --> 59:26.419
for the individuals that are outside of

59:26.429 --> 59:28.959
those meetings that we have individuals

59:28.969 --> 59:32.050
that are within the community , I think

59:32.060 --> 59:35.330
we should publicly talk about how we

59:35.340 --> 59:38.090
are going to address their concerns .

59:38.520 --> 59:40.520
And probably to the American people

59:40.520 --> 59:42.520
that this is not something which is

59:42.520 --> 59:45.800
being ignored or put on the back

59:45.810 --> 59:48.659
shelf . Can you share with us , first

59:48.669 --> 59:50.889
of all , within your office , who is

59:50.899 --> 59:53.850
responsible and accountable for

59:53.860 --> 59:57.510
actually chasing down what is going

59:57.520 --> 01:00:00.709
on and not just simply the fact that we

01:00:00.719 --> 01:00:02.441
know that these incidences are

01:00:02.441 --> 01:00:04.540
occurring , there's a recognition of

01:00:04.550 --> 01:00:06.772
that and we respect these individuals ,

01:00:06.772 --> 01:00:09.110
but there doesn't seem to be a an

01:00:09.120 --> 01:00:11.790
attribution or a discussion of the

01:00:11.800 --> 01:00:14.209
attribution which has occurred . Could

01:00:14.219 --> 01:00:17.149
you perhaps in this open discussion at

01:00:17.159 --> 01:00:19.381
least give us some assurances that this

01:00:19.381 --> 01:00:21.492
is an ongoing thing that is gonna get

01:00:21.492 --> 01:00:23.548
followed up on ? Thank you , Senator

01:00:23.548 --> 01:00:25.603
rounds and , and absolutely , we are

01:00:25.603 --> 01:00:27.659
our first priority is taking care of

01:00:27.659 --> 01:00:27.320
the individuals within our community .

01:00:27.330 --> 01:00:30.139
So our employees , their family members ,

01:00:30.149 --> 01:00:31.871
whoever is being uh whoever is

01:00:31.879 --> 01:00:33.879
experiencing health challenges as a

01:00:33.879 --> 01:00:35.879
result of whatever the cause of the

01:00:35.879 --> 01:00:38.540
thing is , um we have from the top

01:00:38.550 --> 01:00:40.661
levels of every agency made sure that

01:00:40.661 --> 01:00:43.510
it's very clear that whatever they are

01:00:43.520 --> 01:00:45.520
experiencing should be reported and

01:00:45.520 --> 01:00:47.631
once reported , we should do our best

01:00:47.631 --> 01:00:49.798
to get them the kind of help that they

01:00:49.798 --> 01:00:51.853
need if that ends up being a payment

01:00:51.853 --> 01:00:51.729
out of the Havana Act , that is , that

01:00:51.739 --> 01:00:53.628
is one route that they can go but

01:00:53.628 --> 01:00:55.628
making sure that they get the quick

01:00:55.628 --> 01:00:57.739
medical care with respect to the side

01:00:57.739 --> 01:00:59.961
of who's actually looking for and who's

01:00:59.961 --> 01:01:02.295
going after . It's really an entire age .

01:01:02.295 --> 01:01:04.461
It's all of IC process . It's not just

01:01:04.461 --> 01:01:06.239
with all due respect . If it is

01:01:06.239 --> 01:01:08.350
everybody , it is nobody , somebody's

01:01:08.350 --> 01:01:10.406
got to be in charge . I guess that's

01:01:10.406 --> 01:01:12.628
what I'm asking is , is who's in charge

01:01:12.628 --> 01:01:15.159
of this very serious issue . It has to

01:01:15.169 --> 01:01:18.219
be the because the information that we

01:01:18.229 --> 01:01:20.060
need to collect is collected by

01:01:20.070 --> 01:01:22.292
different agencies , different agencies

01:01:22.292 --> 01:01:24.459
are responsible for different parts of

01:01:24.459 --> 01:01:26.570
it . The DN I has very clearly stated

01:01:26.570 --> 01:01:28.737
that it is our there , it is our , our

01:01:28.737 --> 01:01:30.959
plan to not only take care of employees

01:01:30.959 --> 01:01:33.126
but to try to close those intelligence

01:01:33.126 --> 01:01:35.292
gaps that have kept us from being able

01:01:35.292 --> 01:01:35.064
to do the attribution that you're

01:01:35.074 --> 01:01:37.241
talking about . So the DN I at the top

01:01:37.324 --> 01:01:41.235
OD and I can be in charge within the ,

01:01:41.245 --> 01:01:43.475
the ODNI the office of the Director of

01:01:43.485 --> 01:01:46.564
National Intelligence . Somebody has to

01:01:46.574 --> 01:01:48.995
be the person responsible for

01:01:49.004 --> 01:01:51.754
accumulating , acquiring and pushing

01:01:51.764 --> 01:01:54.729
for this information . I don't need

01:01:54.739 --> 01:01:57.620
that name here . But is there a person

01:01:57.629 --> 01:02:00.090
who is responsible for getting this

01:02:00.100 --> 01:02:03.239
done ? There are different people

01:02:03.250 --> 01:02:05.361
responsible for different parts , the

01:02:05.361 --> 01:02:07.361
part of collecting the reports from

01:02:07.361 --> 01:02:09.528
across the community ? Yes , there are

01:02:09.528 --> 01:02:11.639
individuals who do that , the part of

01:02:11.639 --> 01:02:13.750
making sure that the agencies are out

01:02:13.750 --> 01:02:13.229
collecting information so we can close

01:02:13.239 --> 01:02:15.350
those intelligence gaps . Yes , we're

01:02:15.350 --> 01:02:17.406
overseeing that as well . So not one

01:02:17.406 --> 01:02:19.406
person doing both parts but because

01:02:19.406 --> 01:02:21.461
one's focus on the work , the people

01:02:21.461 --> 01:02:23.239
and the other ones focus on the

01:02:23.239 --> 01:02:25.295
adversary or whatever may be causing

01:02:25.295 --> 01:02:27.350
these things . So there are an image

01:02:27.350 --> 01:02:29.517
and , and how about the technical side

01:02:29.517 --> 01:02:31.683
of this ? Is there a person working on

01:02:31.683 --> 01:02:33.906
the technical side of who is using what

01:02:33.906 --> 01:02:36.284
type of a weapon system or a AAA

01:02:36.294 --> 01:02:39.495
technology ? Do we have another person

01:02:39.504 --> 01:02:41.560
responsible for chasing that down as

01:02:41.560 --> 01:02:43.615
well ? The folks that are overseeing

01:02:43.615 --> 01:02:45.671
the collection side are also working

01:02:45.671 --> 01:02:47.837
with those who have the . So now we're

01:02:47.837 --> 01:02:50.004
down to just two people basically that

01:02:50.004 --> 01:02:51.782
are working on this or that are

01:02:51.782 --> 01:02:53.615
accountable for putting this all

01:02:53.615 --> 01:02:55.615
together and is somebody overseeing

01:02:55.615 --> 01:02:57.448
those two individuals or is that

01:02:57.448 --> 01:02:59.448
directly reporting to ODN those are

01:02:59.448 --> 01:03:01.171
within ODN we have individuals

01:03:01.171 --> 01:03:03.171
overseeing them . So those that are

01:03:03.171 --> 01:03:05.115
overseeing what's happening in the

01:03:05.115 --> 01:03:04.489
community with respect to collection ,

01:03:04.500 --> 01:03:06.800
as well as what's overseeing that the

01:03:06.810 --> 01:03:08.866
guidance that we're putting forth on

01:03:08.866 --> 01:03:10.921
how to take care of our workforce is

01:03:10.921 --> 01:03:13.088
being followed . Yes , correct . So we

01:03:13.088 --> 01:03:15.143
have one person in charge of each of

01:03:15.143 --> 01:03:17.199
those two at some point , somebody's

01:03:17.199 --> 01:03:19.310
got to be in charge . I think if , if

01:03:19.310 --> 01:03:21.643
you were to ask my boss , Director Hane ,

01:03:21.643 --> 01:03:21.129
she would say she's in charge , she is

01:03:21.139 --> 01:03:23.195
the place where it , where it ends .

01:03:23.195 --> 01:03:25.306
And so by default , I am in charge as

01:03:25.306 --> 01:03:27.195
well . We will make sure that our

01:03:27.195 --> 01:03:29.139
communities are doing what we have

01:03:29.139 --> 01:03:31.250
provided guidance then to do which is

01:03:31.250 --> 01:03:30.600
to take care of the people and to do

01:03:30.610 --> 01:03:32.888
our best to close the intelligence and ,

01:03:32.888 --> 01:03:34.943
and I don't mean to belabor this and

01:03:34.943 --> 01:03:34.610
I'm already over my time , but it just

01:03:34.620 --> 01:03:36.564
seems to me that if , unless there

01:03:36.564 --> 01:03:38.676
isn't somebody who can look at us and

01:03:38.676 --> 01:03:40.898
tell us this is my responsibility . I'm

01:03:40.898 --> 01:03:43.231
in charge of getting through this thing ,

01:03:43.231 --> 01:03:45.342
I'm responsible for having this thing

01:03:45.342 --> 01:03:47.509
fixed , then it means that , that it's

01:03:47.509 --> 01:03:47.489
gonna be on the backside and it's gonna

01:03:47.500 --> 01:03:49.667
get delayed and we're not gonna get it

01:03:49.667 --> 01:03:51.790
completed in a timely fashion , I

01:03:51.800 --> 01:03:53.689
simply bring it to your attention

01:03:53.689 --> 01:03:55.689
because I think we're gonna have to

01:03:55.689 --> 01:03:57.856
continue to ask that question until we

01:03:57.856 --> 01:04:00.022
get a , a direct answer about somebody

01:04:00.022 --> 01:04:02.133
who is responsible for following this

01:04:02.133 --> 01:04:04.300
through . Just to make sure that those

01:04:04.300 --> 01:04:03.860
folks out there that are suffering

01:04:03.870 --> 01:04:07.010
through this and that may be impacted

01:04:07.020 --> 01:04:09.242
by this in the future , know that it is

01:04:09.242 --> 01:04:10.576
not on the back shelf .

01:04:12.949 --> 01:04:15.060
Thank you , Mr Chairman . I , I would

01:04:15.060 --> 01:04:17.116
say Mr Rs , I think , you know , the

01:04:17.116 --> 01:04:19.171
vast majority of folks affected were

01:04:19.171 --> 01:04:21.739
CIA and CIA was taking the point but

01:04:21.750 --> 01:04:23.694
there were then a people that were

01:04:23.694 --> 01:04:25.472
affected dod that was kind of a

01:04:25.472 --> 01:04:27.472
separate chain and , and then there

01:04:27.472 --> 01:04:29.639
were some treasury . So there was , it

01:04:29.639 --> 01:04:31.806
was a cross of surgery . No question .

01:04:31.806 --> 01:04:33.861
But , but the problem is , is unless

01:04:33.861 --> 01:04:35.806
we've got somebody responsible for

01:04:35.806 --> 01:04:35.320
actually chasing this stuff down and

01:04:35.330 --> 01:04:37.330
everybody's looking at each other ,

01:04:37.330 --> 01:04:39.497
we're not gonna get this thing fixed .

01:04:39.497 --> 01:04:41.552
And it seems to me that we owe it to

01:04:41.552 --> 01:04:43.774
the intelligence community to the folks

01:04:43.774 --> 01:04:42.679
that are actually doing the hard work

01:04:42.689 --> 01:04:45.310
outside of our boundaries that we're

01:04:45.320 --> 01:04:47.320
gonna follow this thing through and

01:04:47.320 --> 01:04:49.376
that we have not simply said we know

01:04:49.376 --> 01:04:51.598
something happened , we don't know what

01:04:51.598 --> 01:04:51.149
it is and we're not gonna do and until

01:04:51.159 --> 01:04:53.381
it comes to us we're not going to chase

01:04:53.381 --> 01:04:55.603
it . Well , we have a hearing , I think

01:04:55.603 --> 01:04:57.937
July 31st on this topic . Exactly . And ,

01:04:57.937 --> 01:05:00.103
and you know , again , I think we need

01:05:00.103 --> 01:05:02.326
to get it fully aired out and hopefully

01:05:02.326 --> 01:05:02.040
by then we'll know who the folks are

01:05:02.050 --> 01:05:04.161
that are actually chasing it down and

01:05:04.161 --> 01:05:04.100
they can share with us what they've

01:05:04.110 --> 01:05:06.221
gotten done . Thank you , Mr Chairman

01:05:06.800 --> 01:05:10.770
Senator Kelly , Miss Harris . Uh

01:05:10.780 --> 01:05:14.649
when , when was the initial RFP

01:05:14.659 --> 01:05:18.050
for the program ? And , and bess , when

01:05:18.060 --> 01:05:21.520
did we , when did we start ? So I will

01:05:21.530 --> 01:05:24.399
refer to D CS A for the specifics on

01:05:24.409 --> 01:05:26.465
the , the contracts . But this was ,

01:05:26.465 --> 01:05:28.631
this has been a multiyear process that

01:05:28.631 --> 01:05:31.020
when was the contract awarded ? I will

01:05:31.030 --> 01:05:33.030
defer to David for the specifics on

01:05:33.030 --> 01:05:35.086
that . The first one with the , with

01:05:35.086 --> 01:05:38.300
Periton and Senators program was begun

01:05:38.310 --> 01:05:41.110
in 2016 as a disa effort . So the first

01:05:41.120 --> 01:05:43.669
RFP would have been issued , then , you

01:05:43.679 --> 01:05:45.901
know , a typical software program , you

01:05:45.901 --> 01:05:47.957
come up with a set of requirements ,

01:05:47.957 --> 01:05:50.068
you come up with a plan on how you're

01:05:50.068 --> 01:05:52.401
gonna , you know , develop the software ,

01:05:52.401 --> 01:05:51.659
how you're gonna verify it , how you're

01:05:51.669 --> 01:05:55.320
gonna test it , how you're gonna um

01:05:55.679 --> 01:05:57.901
make sure all the parts work together ,

01:05:58.270 --> 01:06:00.479
make sure it's integrated with other

01:06:00.489 --> 01:06:04.379
systems pretty early in a program , you

01:06:04.389 --> 01:06:07.870
fix requirements and you say this is it

01:06:09.000 --> 01:06:11.500
and contractor you need to build this ,

01:06:12.010 --> 01:06:14.919
you know , software acquisition often

01:06:14.929 --> 01:06:16.985
goes , you know , one of the ways it

01:06:16.985 --> 01:06:19.340
can go kind of sideways on you is if

01:06:19.350 --> 01:06:21.294
you keep changing , you know , the

01:06:21.294 --> 01:06:23.128
requirements , I heard , I can't

01:06:23.128 --> 01:06:25.128
remember who said it . Maybe Doctor

01:06:25.128 --> 01:06:26.794
Plumb that you now have a new

01:06:26.794 --> 01:06:29.209
requirements management process that

01:06:29.219 --> 01:06:31.889
you're putting into place . So it

01:06:31.899 --> 01:06:34.149
sounds like the requirements are still

01:06:34.159 --> 01:06:38.090
being developed for this system

01:06:38.459 --> 01:06:41.129
that we started to acquire in 2016 .

01:06:42.030 --> 01:06:44.308
That could be the problem . I mean , I ,

01:06:44.308 --> 01:06:46.141
I have yet to hear what the real

01:06:46.141 --> 01:06:48.500
problem was that caused this to be

01:06:48.510 --> 01:06:50.677
delayed from something that started in

01:06:50.677 --> 01:06:52.843
2016 that was supposed to be delivered

01:06:52.843 --> 01:06:55.010
in 2019 . And now we're in 2024 and it

01:06:55.010 --> 01:06:56.954
sounds like we're still working on

01:06:56.954 --> 01:06:59.929
requirements . Um Le let me , let me

01:06:59.939 --> 01:07:01.550
ask one question , the other

01:07:01.949 --> 01:07:04.370
possibility or maybe it's a combination

01:07:04.379 --> 01:07:06.323
of a few things . I think somebody

01:07:06.323 --> 01:07:08.323
mentioned production challenges and

01:07:08.323 --> 01:07:10.212
difficulties and requirements was

01:07:10.212 --> 01:07:12.770
thrown out . There is the contractor ,

01:07:13.449 --> 01:07:16.110
you know , software is , you know ,

01:07:16.120 --> 01:07:18.231
it's hard , I'd say , you know , it's

01:07:18.231 --> 01:07:20.009
different , it's different than

01:07:20.009 --> 01:07:22.231
manufacturing hardware . Obviously , it

01:07:22.231 --> 01:07:24.564
presents its own set of challenges . So ,

01:07:25.010 --> 01:07:26.843
are you having problems with the

01:07:26.843 --> 01:07:29.540
contractor being able to write the code

01:07:29.550 --> 01:07:31.661
and then verify the code and test the

01:07:31.661 --> 01:07:34.550
code or is it the thing I started with

01:07:34.560 --> 01:07:36.479
with which you keep changing the

01:07:36.489 --> 01:07:38.600
requirements and they can never catch

01:07:38.600 --> 01:07:41.379
up ? So I'll start with the

01:07:41.389 --> 01:07:43.389
requirements and then I'll defer to

01:07:43.389 --> 01:07:45.611
David on , on the specifics on the , on

01:07:45.611 --> 01:07:47.722
the engineering . I think when , when

01:07:47.722 --> 01:07:49.945
you hear us talk about the requirements

01:07:49.945 --> 01:07:52.167
process , what we have is for something

01:07:52.167 --> 01:07:51.629
like this , we're getting real time

01:07:51.639 --> 01:07:53.649
user feedback , the the federal

01:07:53.659 --> 01:07:55.603
customers are using it . There are

01:07:55.603 --> 01:07:57.826
things that will be , need , need to be

01:07:57.826 --> 01:07:59.770
integrated into future development

01:07:59.770 --> 01:08:01.992
cycles right now , what we did not have

01:08:01.992 --> 01:08:04.215
was a rigorous way for us to take those

01:08:04.215 --> 01:08:06.326
requirements and kind of look at them

01:08:06.326 --> 01:08:08.159
against a technical road map and

01:08:08.159 --> 01:08:10.159
understand where they would , where

01:08:10.159 --> 01:08:09.814
they would affect the development

01:08:09.824 --> 01:08:11.895
timelines . And so that is a place

01:08:11.905 --> 01:08:13.794
where the under secretary of Inss

01:08:13.794 --> 01:08:16.016
office will be taking an active role to

01:08:16.016 --> 01:08:17.905
make sure we have a better set of

01:08:17.905 --> 01:08:19.961
processes to make sure that as we're

01:08:19.961 --> 01:08:21.794
getting feedback from users , as

01:08:21.794 --> 01:08:24.016
they're using NBI S as the capabilities

01:08:24.016 --> 01:08:26.127
roll out , and there are requests for

01:08:26.127 --> 01:08:28.294
new and different things we understand

01:08:28.294 --> 01:08:30.294
the the effect they may have on our

01:08:30.294 --> 01:08:32.516
long term development timeline was that

01:08:32.516 --> 01:08:34.516
built into the contract that , that

01:08:34.516 --> 01:08:36.830
that you were gonna continue to feed

01:08:36.839 --> 01:08:39.689
back new requirements to them as this

01:08:39.700 --> 01:08:41.811
was tested and they have , they would

01:08:41.811 --> 01:08:44.033
have to make changes . So I think as we

01:08:44.033 --> 01:08:46.367
are on boarding folks into this process ,

01:08:46.367 --> 01:08:48.589
right ? There is an expectation that as

01:08:48.589 --> 01:08:48.509
we are developing under agile

01:08:48.700 --> 01:08:50.867
methodologies that we would be getting

01:08:50.867 --> 01:08:53.089
user feedback and we would be ingesting

01:08:53.089 --> 01:08:55.200
that into future deliveries . I think

01:08:55.200 --> 01:08:57.089
what we did not have was a really

01:08:57.089 --> 01:08:58.922
mature infrastructure to kind of

01:08:58.922 --> 01:09:01.089
translate government requirements into

01:09:01.089 --> 01:09:03.200
technical requirements as Doctor Plum

01:09:03.200 --> 01:09:05.422
mentioned . And so that's a key finding

01:09:05.422 --> 01:09:07.422
from this 90 days is we need to get

01:09:07.422 --> 01:09:09.533
more rigorous around that the overall

01:09:09.533 --> 01:09:11.700
requirement is trusted workforce 2.0 .

01:09:11.700 --> 01:09:13.811
The requirements for what NBI S needs

01:09:13.811 --> 01:09:15.867
to deliver that end to end it system

01:09:15.867 --> 01:09:17.922
for vetting have been clear from the

01:09:17.922 --> 01:09:19.922
beginning , the enforcement and the

01:09:19.922 --> 01:09:21.978
kind of interaction of that with the

01:09:21.978 --> 01:09:23.922
technical development and the user

01:09:23.922 --> 01:09:25.922
feedback is where I think the rigor

01:09:25.922 --> 01:09:28.033
needs to come in . I'll defer to , to

01:09:28.033 --> 01:09:29.922
David for specifics on the on the

01:09:29.922 --> 01:09:32.680
contractor performance . Senator , we

01:09:32.689 --> 01:09:34.745
started with a firmly defined set of

01:09:34.745 --> 01:09:36.689
requirements . We had requirements

01:09:36.689 --> 01:09:38.856
first from the Secretary of Defense in

01:09:38.856 --> 01:09:40.856
2016 as the acting undersecretaries

01:09:40.856 --> 01:09:42.990
laid out about that nn system , those

01:09:43.000 --> 01:09:44.611
were complemented by further

01:09:44.611 --> 01:09:45.944
requirements . When the

01:09:45.944 --> 01:09:48.089
administration's agenda in that time

01:09:48.100 --> 01:09:50.970
frame , 2018 for trusted workforce came

01:09:50.979 --> 01:09:53.180
together those requirements though are

01:09:53.189 --> 01:09:55.939
essentially the same . They're just at

01:09:55.950 --> 01:09:58.061
a higher level . When you combine the

01:09:58.061 --> 01:10:00.283
departmental requirements and the cross

01:10:00.283 --> 01:10:02.394
governmental requirements , I'm gonna

01:10:02.394 --> 01:10:04.617
give you a perspective from inside D CS

01:10:04.617 --> 01:10:04.479
A . Now looking at this , what I would

01:10:04.490 --> 01:10:06.601
say is that they were realistic , the

01:10:06.601 --> 01:10:08.712
requirements , they were achievable ,

01:10:08.712 --> 01:10:11.339
but my agency did not have a firm

01:10:11.350 --> 01:10:13.517
understanding of the complexity of the

01:10:13.517 --> 01:10:15.628
technical features nor how exactly to

01:10:15.628 --> 01:10:17.683
approach those and accomplish them .

01:10:17.683 --> 01:10:19.850
Now , as Doctor Plumb has also said it

01:10:19.850 --> 01:10:21.794
would seem from our review from my

01:10:21.794 --> 01:10:23.906
review now as a director at about 100

01:10:23.906 --> 01:10:26.072
days that we did , in fact , as Doctor

01:10:26.072 --> 01:10:28.239
Plumb said , focused first on features

01:10:28.239 --> 01:10:30.461
and a bit less on functional capability

01:10:30.461 --> 01:10:32.517
delivery and there's a related point

01:10:32.517 --> 01:10:34.406
here then about cost about legacy

01:10:34.406 --> 01:10:37.020
system sunsetting . Because if , for

01:10:37.029 --> 01:10:39.140
example , we had taken an approach to

01:10:39.140 --> 01:10:41.362
prioritize the sunsetting of the legacy

01:10:41.362 --> 01:10:43.529
systems and especially those that cost

01:10:43.529 --> 01:10:45.696
the most . First , we could have wound

01:10:45.696 --> 01:10:47.862
up in a different financial picture at

01:10:47.862 --> 01:10:49.696
this point . If not actually had

01:10:49.696 --> 01:10:51.918
delivered more capability at an earlier

01:10:51.918 --> 01:10:55.330
time was the uh was the contractor

01:10:55.339 --> 01:10:57.810
aware of the complexity of the system ?

01:10:57.819 --> 01:11:01.140
Do you think they were pretty um you

01:11:01.149 --> 01:11:02.982
know , honest with you about the

01:11:02.982 --> 01:11:05.149
challenges that they were gonna face ?

01:11:05.149 --> 01:11:07.260
Senator II ? I think there's a couple

01:11:07.260 --> 01:11:09.538
things in there . I'd say one is , yes ,

01:11:09.538 --> 01:11:11.705
I think the contractor has been honest

01:11:11.705 --> 01:11:11.609
with the government about what they can

01:11:11.620 --> 01:11:13.676
deliver and they've done the work as

01:11:13.676 --> 01:11:15.731
the government specified it . But at

01:11:15.731 --> 01:11:17.953
the same time , the government reserved

01:11:17.953 --> 01:11:17.649
for itself the role of being the

01:11:17.660 --> 01:11:20.759
software integrator . So in that we

01:11:20.770 --> 01:11:22.659
asked for certain things . That's

01:11:22.659 --> 01:11:24.714
Senator , that's why I'm emphasizing

01:11:24.714 --> 01:11:24.700
the significance of my agency's

01:11:24.709 --> 01:11:26.569
decision making . Has that the

01:11:26.689 --> 01:11:29.250
requirements ha ha did have those

01:11:29.259 --> 01:11:31.426
individuals within the government that

01:11:31.426 --> 01:11:33.037
was gonna do the software in

01:11:33.037 --> 01:11:35.148
integration . Have they done software

01:11:35.148 --> 01:11:37.203
integration on any programs before ?

01:11:37.479 --> 01:11:39.759
Yes , sir . My new N BS program manager

01:11:39.770 --> 01:11:41.881
has deep and lengthy experience doing

01:11:41.881 --> 01:11:43.826
this for the Army , for enterprise

01:11:43.826 --> 01:11:45.937
Information Systems . It's one of the

01:11:45.937 --> 01:11:48.048
primary reasons why I selected him to

01:11:48.048 --> 01:11:50.379
be the program manager . And could you

01:11:50.390 --> 01:11:52.446
give us an example of Periton , what

01:11:52.446 --> 01:11:56.439
else they have built . Uh sir ,

01:11:56.450 --> 01:11:58.561
in this case , all I could say now is

01:11:58.561 --> 01:12:01.060
that uh what I rely on Periton for are

01:12:01.069 --> 01:12:03.291
these software services related to N BS

01:12:03.291 --> 01:12:05.347
and also for a very extensive effort

01:12:05.347 --> 01:12:07.125
related to field operations for

01:12:07.125 --> 01:12:09.291
background investigations themselves ?

01:12:09.291 --> 01:12:11.458
Ok . Well , thank you . Thank you , Mr

01:12:11.458 --> 01:12:13.680
Chairman . Let me , let me make AAA try

01:12:13.680 --> 01:12:15.291
at this . This is my kind of

01:12:15.350 --> 01:12:17.740
understanding and I welcome anyone on

01:12:17.750 --> 01:12:21.270
the panel to , to correct this is a

01:12:21.279 --> 01:12:24.700
hard issue . You've been trying it for

01:12:24.709 --> 01:12:28.529
a long time . Conceptually ,

01:12:29.129 --> 01:12:32.859
I think , you know , a tested workforce

01:12:32.870 --> 01:12:35.819
2.0 is a great goal to get to

01:12:38.370 --> 01:12:41.879
D CS A is a relatively new entity . And

01:12:41.890 --> 01:12:45.270
we , I think they got the big

01:12:45.279 --> 01:12:48.529
picture requirements in

01:12:48.540 --> 01:12:52.020
place . But candidly from

01:12:52.029 --> 01:12:53.680
conversations I've had with

01:12:53.689 --> 01:12:55.745
predecessors and others , D CS A did

01:12:55.745 --> 01:12:59.250
not have the technology knowledge of

01:12:59.259 --> 01:13:01.203
how complicated these requirements

01:13:01.203 --> 01:13:03.790
would be to actually build and build at

01:13:03.799 --> 01:13:07.560
scale . And one of the

01:13:07.569 --> 01:13:09.930
key things that astrologist said was my

01:13:09.939 --> 01:13:13.479
new ibis supervisors got this

01:13:13.490 --> 01:13:16.669
experience , which by , yeah , um

01:13:17.919 --> 01:13:20.209
previously , they didn't have that

01:13:20.220 --> 01:13:23.089
experience and there was a while and ,

01:13:23.100 --> 01:13:25.156
and some of the predecessors who had

01:13:25.156 --> 01:13:28.410
positions here were either they

01:13:28.419 --> 01:13:31.529
couldn't , wouldn't or shouldn't . Kind

01:13:31.540 --> 01:13:33.720
of say this is above my my knowledge

01:13:33.729 --> 01:13:36.600
level . So you have the problem that

01:13:36.609 --> 01:13:38.831
the requirements and you know , look at

01:13:38.831 --> 01:13:40.942
the , you know , we all see the place

01:13:40.942 --> 01:13:40.390
mat here . We've already seen the

01:13:40.399 --> 01:13:42.649
gazillions of these , but we're taking

01:13:42.660 --> 01:13:46.080
a system that was really antiquated and

01:13:46.089 --> 01:13:48.311
trying to come up with this new cutting

01:13:48.311 --> 01:13:50.422
edge idea , the good idea . But boy ,

01:13:50.422 --> 01:13:52.589
the implementation has been really bad

01:13:53.100 --> 01:13:55.810
to compound this . And the Periton does

01:13:55.819 --> 01:13:57.875
a , you know , a lot of work in , in

01:13:57.875 --> 01:14:01.750
other parts of the IC . You know , I

01:14:01.759 --> 01:14:05.160
think we had a fixed price contract .

01:14:06.479 --> 01:14:08.757
That's why we came up with this notion .

01:14:08.757 --> 01:14:10.923
Well , it's got to be only 700 million

01:14:10.923 --> 01:14:14.149
bucks and I worry that there was not

01:14:14.160 --> 01:14:16.271
even any incentive because I think at

01:14:16.271 --> 01:14:18.438
some point along the way , even though

01:14:18.438 --> 01:14:20.660
they may have been , I don't think D CS

01:14:20.660 --> 01:14:22.382
A got the requirements right ,

01:14:22.382 --> 01:14:24.049
specifically to the technical

01:14:24.049 --> 01:14:26.216
capability , the need to draw it , but

01:14:26.216 --> 01:14:28.509
probably the contractor bid against an

01:14:28.520 --> 01:14:31.069
inappropriate set of requirements . But

01:14:31.080 --> 01:14:33.247
what makes me crazed a little bit ? Is

01:14:33.247 --> 01:14:35.413
that somewhere along the way ? I think

01:14:35.413 --> 01:14:37.080
even if they had built to the

01:14:37.080 --> 01:14:39.136
requirements that they'd opted for ,

01:14:39.136 --> 01:14:42.129
they couldn't scale those anyway . And

01:14:42.140 --> 01:14:44.850
because , you know , I wonder , and

01:14:44.859 --> 01:14:46.637
again , I'm , I'm anxious to be

01:14:46.637 --> 01:14:49.140
contradicted on this . Is you had folks

01:14:49.149 --> 01:14:51.260
at the contract saying , well , we're

01:14:51.260 --> 01:14:53.482
on a fixed price contract as long as we

01:14:53.482 --> 01:14:55.705
hit , hit these things , we're going to

01:14:55.705 --> 01:14:57.760
be fine even though I think probably

01:14:57.760 --> 01:15:00.093
people had to have known . Oh , my gosh ,

01:15:00.093 --> 01:15:02.260
what we're building can never scale to

01:15:02.260 --> 01:15:05.270
the needs of the whole classified and

01:15:05.279 --> 01:15:09.149
secret uh workforce and maybe D

01:15:09.160 --> 01:15:11.879
CS A , you didn't have enough folks or

01:15:11.890 --> 01:15:14.160
maybe we were so far along , they kept

01:15:14.169 --> 01:15:16.113
with a hope and a prayer that this

01:15:16.113 --> 01:15:19.279
would figure itself out . And we had a

01:15:19.290 --> 01:15:21.990
holy heck moment and we , we weren't ,

01:15:22.520 --> 01:15:24.631
we were pushing , we were told things

01:15:24.631 --> 01:15:26.631
were going along and frankly , only

01:15:26.631 --> 01:15:29.410
because an inadvertent loss of nine

01:15:29.419 --> 01:15:31.660
terabytes of data that they did recover

01:15:32.959 --> 01:15:35.070
that we even found out about this . I

01:15:35.070 --> 01:15:37.070
mean , when would we have known ? I

01:15:37.070 --> 01:15:40.589
mean , at some point , you know , the ,

01:15:41.080 --> 01:15:43.810
yeah , the , the game was up because

01:15:43.819 --> 01:15:46.180
there was not gonna be any plan where

01:15:46.410 --> 01:15:48.632
they would have had a fully operational

01:15:48.632 --> 01:15:50.759
system by September of 24 even like a

01:15:50.770 --> 01:15:53.189
year ago . And then there was like as a

01:15:53.200 --> 01:15:55.367
deeper , we got into the rabbit hole ,

01:15:55.367 --> 01:15:57.533
it was more like , holy heck , this is

01:15:57.533 --> 01:15:59.589
not a short term . This is a massive

01:15:59.589 --> 01:16:01.879
screw up . So we got 850 million bucks

01:16:01.890 --> 01:16:05.479
that we've spent so far . We got $850

01:16:05.490 --> 01:16:07.810
million of maintaining legacy systems

01:16:07.819 --> 01:16:09.930
that we wouldn't have had to spend if

01:16:09.930 --> 01:16:12.152
we would have gotten the new systems in

01:16:12.152 --> 01:16:14.660
place by 2019 . I think Secretary

01:16:14.669 --> 01:16:16.891
Harris and director Kettler are working

01:16:16.891 --> 01:16:19.540
their tail off to try to , um ,

01:16:20.520 --> 01:16:23.220
get us this output of what it's gonna

01:16:23.229 --> 01:16:25.229
take in 18 months and how much it's

01:16:25.229 --> 01:16:27.660
gonna cost . But thank goodness , and I

01:16:27.669 --> 01:16:29.836
hope this is where we've got to figure

01:16:29.836 --> 01:16:32.109
out your capabilities overall . What

01:16:32.140 --> 01:16:34.251
Doctor Plum's group is supposed to be

01:16:34.251 --> 01:16:36.251
doing is they're supposed to be the

01:16:36.251 --> 01:16:36.240
technical Mike . Uh Senator Senator

01:16:36.250 --> 01:16:38.417
Benner said , you know , the technical

01:16:38.417 --> 01:16:40.472
swat team to come in because I don't

01:16:40.472 --> 01:16:43.910
think you had the technical wat team at

01:16:43.919 --> 01:16:46.140
the D CS A

01:16:47.689 --> 01:16:49.578
and how we get at the contractual

01:16:49.578 --> 01:16:51.356
obligation that if the , if the

01:16:51.356 --> 01:16:53.189
contractor has got the technical

01:16:53.189 --> 01:16:52.970
knowledge , why don't they raise their

01:16:52.979 --> 01:16:55.609
hand and say , hey , this is , we're

01:16:55.620 --> 01:16:57.842
building you stuff , by the way , we're

01:16:57.842 --> 01:16:59.842
not building you something that can

01:16:59.842 --> 01:17:01.787
scale . We gotta figure out how we

01:17:01.787 --> 01:17:03.731
think about contract and , and one

01:17:03.731 --> 01:17:06.000
thing I would also say is if there are

01:17:06.009 --> 01:17:08.231
other , I mean , the committee wants to

01:17:08.231 --> 01:17:09.953
work with , if there are other

01:17:09.953 --> 01:17:12.649
legislative authorities you need in

01:17:12.660 --> 01:17:14.493
this software management , we're

01:17:14.493 --> 01:17:16.660
willing to take a good hard look at

01:17:16.669 --> 01:17:20.560
that but is the

01:17:20.569 --> 01:17:22.740
characterization of how we got here

01:17:22.750 --> 01:17:25.930
that I just laid out . Am I right ? Am

01:17:25.939 --> 01:17:27.995
I partially right ? Am I wrong ? Who

01:17:27.995 --> 01:17:30.161
wants , who wants to take that lots of

01:17:30.161 --> 01:17:33.060
hands going ? But so please , so I

01:17:33.069 --> 01:17:35.291
think at the beginning , we expected we

01:17:35.291 --> 01:17:37.402
would gain co efficiencies by putting

01:17:37.402 --> 01:17:39.513
this ad CS a between mission and what

01:17:39.513 --> 01:17:41.458
mission , what this is supposed to

01:17:41.458 --> 01:17:43.625
deliver . I think what we have we have

01:17:43.625 --> 01:17:45.847
realized is that this a program of this

01:17:45.847 --> 01:17:47.902
scale and complexity to exactly your

01:17:47.902 --> 01:17:49.791
point needs a whole of department

01:17:49.791 --> 01:17:49.379
approach . So I think that's what

01:17:49.390 --> 01:17:51.390
you're you're seeing reflected here

01:17:51.390 --> 01:17:53.390
today . You know , we need Director

01:17:53.390 --> 01:17:55.446
Cutler's leadership . We need Doctor

01:17:55.446 --> 01:17:57.668
Plumb's squad . We need under Secretary

01:17:57.668 --> 01:17:59.834
La Plante's acquisition oversight . We

01:17:59.834 --> 01:18:01.890
need our cio looking at this against

01:18:01.890 --> 01:18:03.557
other software systems in the

01:18:03.557 --> 01:18:05.723
department and we need uh intelligence

01:18:05.723 --> 01:18:07.779
and security to make sure this meets

01:18:07.779 --> 01:18:10.057
the mission and that is what we needed .

01:18:10.057 --> 01:18:09.939
And so I think the road you laid out

01:18:09.950 --> 01:18:12.117
senator is exactly right . But I think

01:18:12.117 --> 01:18:14.117
what you need is the , the team you

01:18:14.117 --> 01:18:16.339
have right now looking at this , wasn't

01:18:16.339 --> 01:18:20.189
that the fact that if we had been

01:18:20.200 --> 01:18:23.990
smarter in 2017 , 2018 , shouldn't we

01:18:24.000 --> 01:18:26.000
have known that we were asking this

01:18:26.000 --> 01:18:28.056
relatively small entity to take on a

01:18:28.056 --> 01:18:30.167
task that was too big for its bridges

01:18:30.167 --> 01:18:32.333
and there were our capabilities inside

01:18:32.333 --> 01:18:34.950
of dod that can um now the bug's gone

01:18:34.959 --> 01:18:37.181
from your mics to our mics . You know ,

01:18:37.181 --> 01:18:39.348
there are capabilities and that's what

01:18:39.348 --> 01:18:41.459
I think Secretary Harris is saying is

01:18:41.459 --> 01:18:43.292
we're gonna try to bring all the

01:18:43.292 --> 01:18:45.403
capabilities of dod to the table . We

01:18:45.403 --> 01:18:47.348
should have probably had that . We

01:18:47.348 --> 01:18:49.459
probably were expecting too much from

01:18:49.459 --> 01:18:51.570
an agency that was not fully prepared

01:18:51.570 --> 01:18:53.626
to , can we get back to the contract

01:18:53.626 --> 01:18:55.848
though ? So what happens now , I mean ,

01:18:55.848 --> 01:18:57.848
at one point , the contractor , the

01:18:57.848 --> 01:18:59.903
prime contractor sent an invoice for

01:18:59.903 --> 01:19:02.070
something that was beyond $700 million

01:19:02.479 --> 01:19:04.257
right ? And they had to explain

01:19:04.257 --> 01:19:06.312
themselves . I mean , what was their

01:19:06.312 --> 01:19:08.790
explanation ? And then have we resolved

01:19:08.799 --> 01:19:11.021
that issue or is this is the cost gonna

01:19:11.021 --> 01:19:12.910
just continue to grow . Because I

01:19:12.919 --> 01:19:16.529
imagine my guess is uh because , you

01:19:16.540 --> 01:19:18.484
know , I've seen this before , the

01:19:18.484 --> 01:19:20.262
contractor says , well , you're

01:19:20.262 --> 01:19:22.318
changing the requirements on me . We

01:19:22.318 --> 01:19:22.189
had a fixed price , you know , we had a

01:19:22.200 --> 01:19:25.390
fixed price contract to build this box

01:19:25.399 --> 01:19:27.740
that does these things . And now a few

01:19:27.750 --> 01:19:29.870
years later , you've got , we've

01:19:29.879 --> 01:19:32.509
deployed parts of this and you have the ,

01:19:32.520 --> 01:19:35.750
the end user is saying that they want

01:19:35.759 --> 01:19:37.981
changes and you're feeding this changes

01:19:37.981 --> 01:19:40.092
back to the contract . And they say ,

01:19:40.092 --> 01:19:42.259
well , we weren't contracted to , to ,

01:19:42.259 --> 01:19:44.426
to do that . So then they say , well ,

01:19:44.426 --> 01:19:46.592
it's gonna cost you this much more and

01:19:46.592 --> 01:19:48.648
every change order is gonna be , you

01:19:48.648 --> 01:19:50.648
know , whatever , $10,000 for every

01:19:50.648 --> 01:19:52.815
single change has that portion of this

01:19:52.815 --> 01:19:54.870
been resolved . Well , yes , Senator

01:19:54.870 --> 01:19:56.815
and that's why I've said my second

01:19:56.815 --> 01:19:58.926
basket of issues we looked at in this

01:19:58.926 --> 01:20:01.148
90 day review was in fact procurement .

01:20:01.148 --> 01:20:03.315
And that's , you know , as I said , my

01:20:03.315 --> 01:20:02.319
statement for the record , that's

01:20:02.330 --> 01:20:04.330
everything from not just how we got

01:20:04.330 --> 01:20:06.220
here but also how we need to move

01:20:06.229 --> 01:20:08.562
forward . Do we have the right contract ?

01:20:08.562 --> 01:20:10.562
Vehicles ? Are we incentivizing and

01:20:10.562 --> 01:20:12.673
disincentivizing properly to hold the

01:20:12.673 --> 01:20:14.451
contractor accountable ? Is the

01:20:14.451 --> 01:20:16.618
government clear in terms of what it's

01:20:16.618 --> 01:20:18.562
calling for , do we have the right

01:20:18.562 --> 01:20:20.507
expertise ? I mean , as I say , we

01:20:20.507 --> 01:20:22.729
didn't just need technical expertise on

01:20:22.729 --> 01:20:24.896
the , it , we also need to take a hard

01:20:24.896 --> 01:20:27.007
look at the procurement . I mean , to

01:20:27.007 --> 01:20:28.729
link both of your both of your

01:20:28.729 --> 01:20:28.569
interventions . What I would say is ,

01:20:29.180 --> 01:20:32.020
uh I also agree that it , it would seem

01:20:32.029 --> 01:20:33.973
to me it was a lot to put on a new

01:20:33.973 --> 01:20:36.029
agency to tackle this as well as the

01:20:36.029 --> 01:20:38.080
agency was standing up . However ,

01:20:38.089 --> 01:20:40.600
there was too much authority vested in

01:20:40.609 --> 01:20:42.810
the previous incumbent in my role in

01:20:42.839 --> 01:20:44.617
this context . And that's why I

01:20:44.617 --> 01:20:46.879
wholeheartedly agree with the elevation

01:20:46.890 --> 01:20:49.520
of pro product ownership , the program

01:20:49.529 --> 01:20:51.751
ownership up to the under secretary for

01:20:51.751 --> 01:20:53.918
Intel and Security and the acquisition

01:20:53.918 --> 01:20:56.140
decision milestone authority also being

01:20:56.140 --> 01:20:59.220
elevated away from me at D CS A to the

01:20:59.229 --> 01:21:01.229
under secretary for acquisition and

01:21:01.229 --> 01:21:03.350
sustainment . Because in effect , my

01:21:03.359 --> 01:21:06.020
agency was allowed to call the shots on

01:21:06.029 --> 01:21:08.029
how to interpret the requirements .

01:21:08.029 --> 01:21:09.807
Figure out what the procurement

01:21:09.807 --> 01:21:11.862
approach should be . Figure out what

01:21:11.862 --> 01:21:13.930
the technical details then uh were

01:21:13.939 --> 01:21:16.161
inherent in all that development , take

01:21:16.161 --> 01:21:17.883
the decisions about contractor

01:21:17.883 --> 01:21:19.772
performance and compliance , what

01:21:19.772 --> 01:21:21.606
information was reported out for

01:21:21.606 --> 01:21:23.890
oversight . So I if I may senator to

01:21:23.899 --> 01:21:25.955
back to both of you , because you've

01:21:25.955 --> 01:21:27.955
also asked , is there anything that

01:21:27.955 --> 01:21:30.066
needs just clarify uh a couple points

01:21:30.066 --> 01:21:32.066
um that I think are important . The

01:21:32.066 --> 01:21:34.288
first is that you've asked the question

01:21:34.288 --> 01:21:36.455
of when we would have , when you would

01:21:36.455 --> 01:21:38.566
have been notified and when you would

01:21:38.566 --> 01:21:40.788
have found out . And I think two things

01:21:40.788 --> 01:21:43.010
I would say here just so at least me as

01:21:43.010 --> 01:21:45.177
the D CS A director where I'm clear on

01:21:45.177 --> 01:21:46.955
what I communicate to you . The

01:21:46.955 --> 01:21:49.066
previous under se under secretary for

01:21:49.069 --> 01:21:51.180
Intelligence and Security came before

01:21:51.180 --> 01:21:53.347
this committee in November of 2023 and

01:21:53.347 --> 01:21:55.569
did inform you that largely the program

01:21:55.569 --> 01:21:57.950
was on track . My agency did not inform

01:21:57.959 --> 01:22:00.015
the under secretary for intelligence

01:22:00.015 --> 01:22:02.237
and security in the office that we were

01:22:02.237 --> 01:22:04.348
substantially off track and would not

01:22:04.348 --> 01:22:06.459
meet the 2024 deliverable until after

01:22:06.470 --> 01:22:08.748
that hearing had concluded . So that's ,

01:22:08.748 --> 01:22:10.803
that's one point I just want to make

01:22:10.803 --> 01:22:13.026
sure that , that I share with you . And

01:22:13.026 --> 01:22:15.081
the other thing I would say is a big

01:22:15.081 --> 01:22:17.081
freaking deal . It's a , it's a big

01:22:17.081 --> 01:22:19.192
deal that he , they , he was , it's a

01:22:19.192 --> 01:22:21.303
big deal . Yes , Senator . That's why

01:22:21.303 --> 01:22:23.414
I'm making sure that I clarify that .

01:22:23.414 --> 01:22:25.581
The other thing I would say is that on

01:22:25.581 --> 01:22:27.637
your , on your observation about the

01:22:27.637 --> 01:22:30.200
opus outage . So this is the , the O PM ,

01:22:30.470 --> 01:22:32.919
uh one of the O PM legacy systems that

01:22:32.930 --> 01:22:35.759
we rely on essentially a data storage

01:22:35.770 --> 01:22:39.629
system for the records . I do not think

01:22:39.640 --> 01:22:42.819
that the two ends and opus are actually

01:22:42.850 --> 01:22:45.990
not linked in a direct causal way ,

01:22:46.330 --> 01:22:49.069
meaning that the opus outage that

01:22:49.080 --> 01:22:51.299
occurred would not in itself have

01:22:51.310 --> 01:22:53.310
triggered my predecessor nor anyone

01:22:53.310 --> 01:22:55.310
else to come here and say that ends

01:22:55.310 --> 01:22:57.477
would not be delivered on time . But I

01:22:57.477 --> 01:22:59.588
believe what happened and you weren't

01:22:59.588 --> 01:23:01.699
there . But I believe what happened .

01:23:01.699 --> 01:23:01.529
Some of the folks who are working on

01:23:01.540 --> 01:23:03.879
this are not here now , they're over

01:23:03.890 --> 01:23:07.390
with Dr Dixon but was that we , people

01:23:07.399 --> 01:23:09.455
came in and informed . Well , we got

01:23:09.455 --> 01:23:11.788
this problem . We're gonna get it fixed .

01:23:11.788 --> 01:23:11.640
We've lost nine , you know how

01:23:11.649 --> 01:23:13.705
terabytes of data . But we , we , we

01:23:13.705 --> 01:23:15.927
got a backup . So we're gonna find it .

01:23:15.927 --> 01:23:18.038
And oh , by the way , there was not a

01:23:18.038 --> 01:23:20.205
linkage that loss was related in . But

01:23:20.205 --> 01:23:23.450
when in that notification around the 90

01:23:23.459 --> 01:23:26.169
terabyte , oops that was when we were

01:23:26.180 --> 01:23:28.291
notified by them . So I don't want to

01:23:28.291 --> 01:23:30.458
imply that they were linked but it was

01:23:30.458 --> 01:23:32.402
like a simultaneous notification .

01:23:32.402 --> 01:23:34.624
They're coincident in time Senator . Um

01:23:34.624 --> 01:23:36.791
But my , my review of this and again ,

01:23:36.791 --> 01:23:38.902
I had my inspector general helping me

01:23:38.902 --> 01:23:38.490
with this also . But my review of this

01:23:39.100 --> 01:23:40.656
because we did conclude the

01:23:40.656 --> 01:23:42.767
investigation into the opus outage at

01:23:42.767 --> 01:23:44.878
my first week in the role here as the

01:23:44.878 --> 01:23:46.890
director . Uh we already knew

01:23:46.899 --> 01:23:49.109
internally that we had a real problem

01:23:49.120 --> 01:23:51.120
on our hands here . We've known for

01:23:51.120 --> 01:23:53.290
quite some time about en vs but it

01:23:53.299 --> 01:23:55.549
didn't become clear enough to actually

01:23:55.560 --> 01:23:57.504
I think pop a flare and go back to

01:23:57.504 --> 01:23:59.879
intel and security and say clearly

01:24:00.330 --> 01:24:02.608
we're not going to meet that milestone .

01:24:02.839 --> 01:24:05.729
Um So all I'm saying is so both of

01:24:05.740 --> 01:24:07.907
these problems were quite bad for what

01:24:07.907 --> 01:24:09.962
they one opus for what it could have

01:24:09.962 --> 01:24:12.018
been because as you've said , we did

01:24:12.018 --> 01:24:13.962
recover the 90 terabytes of data .

01:24:13.962 --> 01:24:15.907
Thankfully , that was a failure to

01:24:15.907 --> 01:24:18.200
follow internal controls , meaning that

01:24:18.209 --> 01:24:20.459
we had an employee , some employees

01:24:20.470 --> 01:24:22.692
together that did not follow the proper

01:24:22.692 --> 01:24:24.692
procedures for the ways in which we

01:24:24.692 --> 01:24:28.500
would clear um storage memory on the

01:24:28.509 --> 01:24:30.919
system and instead issued an order that

01:24:30.930 --> 01:24:33.350
wiped out 90 terabytes of data . Now

01:24:33.359 --> 01:24:35.192
again , it's great . We have mag

01:24:35.192 --> 01:24:37.359
magnetic tapes that have the backup on

01:24:37.359 --> 01:24:39.415
it . But the root cause of that is a

01:24:39.415 --> 01:24:41.526
failure of accountability , a failure

01:24:41.526 --> 01:24:43.859
to follow proper procedure concurrently .

01:24:43.919 --> 01:24:46.086
We have long standing problems related

01:24:46.086 --> 01:24:48.339
to NS what ? But let me go to . This is

01:24:48.350 --> 01:24:50.669
where I think we're Senator Carol and I

01:24:50.689 --> 01:24:52.967
are both trying to hit a little bit on .

01:24:53.310 --> 01:24:56.819
I was informed or told that , you know ,

01:24:56.830 --> 01:24:58.941
the that goes back to the fixed price

01:24:58.941 --> 01:25:01.163
contract , the nature of the contract ,

01:25:01.163 --> 01:25:02.886
there was no incentive for the

01:25:02.886 --> 01:25:04.997
contractor to say , oh , by the way ,

01:25:04.997 --> 01:25:07.108
we're meeting you , we believe we are

01:25:07.108 --> 01:25:09.386
contractually meeting your requirement .

01:25:09.386 --> 01:25:11.497
But by the way , we could never scale

01:25:11.497 --> 01:25:14.319
this to meet the full needs of the , of

01:25:14.330 --> 01:25:16.386
the community . Senator I'd say , is

01:25:16.386 --> 01:25:18.441
that fair or not fair ? I'm not sure

01:25:18.441 --> 01:25:20.410
it's entirely fair , but it's not

01:25:20.419 --> 01:25:22.641
unfair . I think , I think what I would

01:25:22.641 --> 01:25:24.689
say in response is the contractor

01:25:24.700 --> 01:25:26.756
doesn't get paid unless the software

01:25:26.756 --> 01:25:28.811
they develop meets the specification

01:25:28.811 --> 01:25:31.033
and is successful . So in that regard ,

01:25:31.080 --> 01:25:33.247
the government gets what it pays for ,

01:25:33.247 --> 01:25:35.358
the government gets what it tells the

01:25:35.358 --> 01:25:37.469
contractor it needs to do . However ,

01:25:37.469 --> 01:25:39.413
it is not the contractor's primary

01:25:39.413 --> 01:25:41.636
responsibility to inform the government

01:25:41.636 --> 01:25:43.858
that it might not scale or it might not

01:25:43.858 --> 01:25:45.636
be able to be aggregated as the

01:25:45.636 --> 01:25:47.636
government performs the role of the

01:25:47.636 --> 01:25:49.858
software integrator . But you could ask

01:25:49.858 --> 01:25:52.024
the question of whether it's incumbent

01:25:52.024 --> 01:25:53.913
upon the contractor to inform the

01:25:53.913 --> 01:25:53.660
government . Hey , government , your

01:25:53.669 --> 01:25:55.891
ideas don't make sense . Right . Well ,

01:25:55.891 --> 01:25:58.002
that wouldn't , you know , especially

01:25:58.002 --> 01:26:01.109
if D CSA didn't write the specs .

01:26:02.669 --> 01:26:04.891
But isn't there some obligation , moral

01:26:04.891 --> 01:26:06.836
or otherwise , maybe not legal but

01:26:06.836 --> 01:26:09.450
moral or otherwise to say , hey , we're

01:26:09.459 --> 01:26:11.799
building , we're building a machine

01:26:12.160 --> 01:26:15.370
that's not gonna be able to service the

01:26:15.379 --> 01:26:17.546
scope of the problem that we're trying

01:26:17.546 --> 01:26:19.657
to address . Well , Senator , I can't

01:26:19.657 --> 01:26:22.100
comment too much on that piece of it in

01:26:22.109 --> 01:26:24.331
the past , but just to say that again ,

01:26:24.331 --> 01:26:26.442
as we review the procurement approach

01:26:26.442 --> 01:26:28.387
and the ways in which we will move

01:26:28.387 --> 01:26:30.609
forward , these are all key factors and

01:26:30.609 --> 01:26:30.330
the company's got a good reputation .

01:26:30.339 --> 01:26:32.506
Let me , let me state that the company

01:26:32.506 --> 01:26:34.506
is the , the contractors got a good

01:26:34.506 --> 01:26:36.783
reputation . But I just , this where I ,

01:26:36.783 --> 01:26:40.490
I , I remember as a new , um ,

01:26:41.299 --> 01:26:44.390
senator having a lot of contractor base

01:26:44.399 --> 01:26:46.819
in Virginia , um ,

01:26:48.520 --> 01:26:50.187
in the beginning of the Obama

01:26:50.187 --> 01:26:52.242
administration , I thought I'm gonna

01:26:52.242 --> 01:26:54.298
figure out defense contracting . And

01:26:54.298 --> 01:26:57.270
the then number two at Dod came over

01:26:57.279 --> 01:26:59.390
and brought four contracting officers

01:26:59.390 --> 01:27:02.399
and 12 volumes and I was cured of my ,

01:27:02.410 --> 01:27:04.688
uh , thought that I was gonna fix this ,

01:27:04.688 --> 01:27:08.629
um , uh , in any , any shape or form ,

01:27:08.640 --> 01:27:10.862
but at least in terms of what we've got

01:27:10.862 --> 01:27:13.084
ability to say purview over and this is

01:27:13.084 --> 01:27:15.196
one of those areas where , you know ,

01:27:15.196 --> 01:27:14.990
we're gonna stay obsessed about this

01:27:15.000 --> 01:27:17.056
until at least as long as I'm here .

01:27:17.399 --> 01:27:19.620
You know , is there legislative

01:27:19.629 --> 01:27:21.796
authority and maybe do this is for not

01:27:21.796 --> 01:27:24.029
just Mr Harrison and Director Kleer ,

01:27:24.259 --> 01:27:26.549
but Doctor Doctor Dickon .

01:27:27.859 --> 01:27:31.479
Yep , he either in terms of a

01:27:31.490 --> 01:27:33.546
stick of a penalty that if you don't

01:27:33.546 --> 01:27:35.768
inform or an incentive if you do . Oh ,

01:27:35.768 --> 01:27:37.879
by the way , we'll , we'll give you a

01:27:37.879 --> 01:27:40.101
little extra spliff here . If you , you

01:27:40.101 --> 01:27:42.212
know , if you tell us government that

01:27:42.212 --> 01:27:44.212
we are completely screwed up on our

01:27:44.212 --> 01:27:46.157
requirements or we're not building

01:27:46.157 --> 01:27:45.859
something that's gonna meet the problem ,

01:27:47.799 --> 01:27:49.855
Senator . That's just not the way we

01:27:49.855 --> 01:27:51.799
built that contract architecture .

01:27:51.799 --> 01:27:53.855
That's not to say we couldn't in the

01:27:53.855 --> 01:27:55.910
future or that we shouldn't , but we

01:27:55.910 --> 01:27:58.077
did not . But it's , but , and again ,

01:27:58.077 --> 01:28:00.188
this is not just uh uh your problem .

01:28:00.188 --> 01:28:02.410
It is across as we all cite our various

01:28:02.410 --> 01:28:04.077
examples , but it is a little

01:28:04.077 --> 01:28:07.540
frustrating that when we see and , and

01:28:07.549 --> 01:28:09.549
it's not like every large corporate

01:28:09.549 --> 01:28:11.660
software problem project doesn't have

01:28:11.660 --> 01:28:13.716
problems , but we do seem to have an

01:28:13.716 --> 01:28:17.000
extraordinarily higher failure rate on

01:28:17.009 --> 01:28:19.009
big software projects in government

01:28:19.009 --> 01:28:20.953
than almost anything else . And Dr

01:28:20.953 --> 01:28:20.509
Plumber looked like you were going to

01:28:20.520 --> 01:28:22.689
hit your button . I was just um I was

01:28:22.700 --> 01:28:25.259
gonna add Senator , I think , you know ,

01:28:25.270 --> 01:28:28.799
a big part of the issue uh that , that

01:28:28.810 --> 01:28:30.643
our defense digital service team

01:28:30.643 --> 01:28:32.754
identified that we're working closely

01:28:32.754 --> 01:28:34.810
with T CS A is making sure the right

01:28:34.810 --> 01:28:36.754
technical talent exists inside the

01:28:36.754 --> 01:28:39.459
government to vet and review what's

01:28:39.470 --> 01:28:41.526
going on . In this case , just as an

01:28:41.526 --> 01:28:44.015
example , the decision was made on this

01:28:44.024 --> 01:28:46.725
contract in 2018 to have essentially a

01:28:46.734 --> 01:28:49.834
low code solution , which means it's um

01:28:49.875 --> 01:28:52.097
it's like a sort of simple drag and dot

01:28:52.104 --> 01:28:55.915
drop coding solution to uh to solve a

01:28:56.064 --> 01:28:59.915
massive data architecture engineering

01:28:59.924 --> 01:29:02.055
problem , including with some legacy

01:29:02.064 --> 01:29:05.104
systems that are uh that use code that

01:29:05.115 --> 01:29:07.337
doesn't exist anymore that people don't

01:29:07.337 --> 01:29:08.893
use anymore . Um That's not

01:29:08.893 --> 01:29:11.004
traditionally , we would not consider

01:29:11.004 --> 01:29:13.115
that a best practice . Um We wouldn't

01:29:13.120 --> 01:29:14.898
even consider that an advisable

01:29:14.898 --> 01:29:16.819
practice because you want a true

01:29:16.830 --> 01:29:18.719
programming language , a job or a

01:29:18.719 --> 01:29:20.899
sequel to be able to manage the

01:29:20.910 --> 01:29:23.649
interaction between those databases in

01:29:23.660 --> 01:29:25.882
a a flexible and continuous development

01:29:25.882 --> 01:29:28.129
way . So as a just a concrete example ,

01:29:28.140 --> 01:29:30.669
the lack of technical expertise in the

01:29:30.680 --> 01:29:32.859
government to review those types of

01:29:32.870 --> 01:29:35.109
decision , the tech , the decisions to

01:29:35.120 --> 01:29:37.734
how to meet the requirements , which ,

01:29:37.745 --> 01:29:39.801
which as we mentioned , I think were

01:29:39.801 --> 01:29:41.745
clear how to translate that into a

01:29:41.745 --> 01:29:44.004
technical solution was missing . I

01:29:44.015 --> 01:29:47.015
think what we have now is a team of

01:29:47.024 --> 01:29:48.968
technical experts with our defense

01:29:48.968 --> 01:29:51.135
digital services that are working hand

01:29:51.135 --> 01:29:53.191
in glove with the program management

01:29:53.191 --> 01:29:55.413
office and are working with that office

01:29:55.413 --> 01:29:57.865
to identify and hire inherent technical

01:29:57.875 --> 01:30:00.042
talent that but does that ? Let's take

01:30:00.042 --> 01:30:02.153
it out of D CS A ? Let's take another

01:30:02.153 --> 01:30:04.264
part of the government , another part

01:30:04.264 --> 01:30:06.431
of dod , you know , are we gonna bring

01:30:06.431 --> 01:30:06.259
your swat team in on the front end

01:30:06.270 --> 01:30:08.750
before we put these contracts out in

01:30:08.759 --> 01:30:10.759
other area ? I mean , just , well ,

01:30:10.759 --> 01:30:13.092
that's what we're trying . I mean , yes ,

01:30:13.092 --> 01:30:16.089
we're trying to do that . Um uh for

01:30:16.100 --> 01:30:18.156
future solutions , I think better to

01:30:18.156 --> 01:30:19.989
solve it on the front end of the

01:30:19.989 --> 01:30:22.156
procurement than the back end . Uh And

01:30:22.156 --> 01:30:24.378
I think there are broader efforts to do

01:30:24.378 --> 01:30:26.489
this across the , the department that

01:30:26.489 --> 01:30:28.600
don't , that have technical talent in

01:30:28.600 --> 01:30:30.656
them , that don't need that . What ,

01:30:30.656 --> 01:30:30.589
what you guys are doing and , and your

01:30:30.600 --> 01:30:33.310
um defense digital services . I mean ,

01:30:33.319 --> 01:30:35.720
how long is that enterprise been around ?

01:30:36.299 --> 01:30:39.089
Uh I think II I can get the exact

01:30:39.100 --> 01:30:41.267
answer but I think since roughly about

01:30:41.267 --> 01:30:43.322
2017 or 20 . OK . So it has been , I

01:30:43.322 --> 01:30:45.378
mean , so I keep thinking about like

01:30:45.378 --> 01:30:45.200
under Obama administration , there was

01:30:45.209 --> 01:30:47.098
A and F and there was the Digital

01:30:47.098 --> 01:30:49.265
Services . It feels like these kind of

01:30:49.265 --> 01:30:51.689
crack swat teams that come and go

01:30:51.700 --> 01:30:53.811
inside the government enterprise in a

01:30:53.811 --> 01:30:57.209
way that we don't build that at least

01:30:57.220 --> 01:30:59.819
review part of the process in , in

01:30:59.870 --> 01:31:02.319
enough of our systems . Is that fair ?

01:31:02.680 --> 01:31:04.624
Uh That probably is fair . I think

01:31:04.624 --> 01:31:06.736
inside of the Department of Defense ,

01:31:06.736 --> 01:31:08.736
we've tried to establish this Chief

01:31:08.736 --> 01:31:11.229
Digital and A I office , my office as

01:31:11.240 --> 01:31:13.850
the uh lead staff assistant inside the

01:31:13.859 --> 01:31:17.330
department to oversee that uh data ,

01:31:17.339 --> 01:31:19.395
data architecture , data oversight ,

01:31:19.395 --> 01:31:22.205
data principles to help drive alignment

01:31:22.214 --> 01:31:24.765
both in how we build the technical

01:31:24.774 --> 01:31:26.830
requirements we're talking about and

01:31:26.830 --> 01:31:29.052
what the procurement requirements are .

01:31:29.052 --> 01:31:30.552
So what does it mean to be

01:31:30.552 --> 01:31:32.663
interoperable ? What does it mean for

01:31:32.663 --> 01:31:34.885
the government to have data rights ? Um

01:31:34.885 --> 01:31:36.663
So that , that's baked into the

01:31:36.663 --> 01:31:38.552
contracts , the government rights

01:31:38.552 --> 01:31:40.774
instead of trying to solve that problem

01:31:40.774 --> 01:31:42.885
over and over again ? And that's work

01:31:42.885 --> 01:31:44.885
we have ongoing and we have sort of

01:31:44.885 --> 01:31:47.052
large scale initiatives underway to do

01:31:47.052 --> 01:31:49.052
that . Dr K is , you know , and you

01:31:49.052 --> 01:31:51.107
mentioned the fact that , you know ,

01:31:51.149 --> 01:31:54.819
maybe your predecessors mhm ,

01:31:55.899 --> 01:31:58.740
weren't aware or ask for too much power

01:31:58.750 --> 01:32:01.439
and authority um without enough

01:32:01.450 --> 01:32:05.359
oversight or didn't recognize , um

01:32:06.870 --> 01:32:08.648
they didn't have the technology

01:32:08.648 --> 01:32:10.870
components . Is there a way to build in

01:32:11.600 --> 01:32:13.711
somebody with , you know , you got an

01:32:13.711 --> 01:32:15.767
agency with 5400 people , somebody's

01:32:15.767 --> 01:32:17.989
got to have been willing to say , hey ,

01:32:17.989 --> 01:32:17.950
you know , we're biting off more than

01:32:17.959 --> 01:32:21.529
we can chew or , or are there any

01:32:21.540 --> 01:32:24.430
things again with your agency and

01:32:24.439 --> 01:32:26.606
specifically , but is there other ways

01:32:26.606 --> 01:32:28.550
to build in some kind of incentive

01:32:28.550 --> 01:32:30.772
within the agency to say before we bite

01:32:30.772 --> 01:32:34.109
this ? We have to think twice or ? Well ,

01:32:34.120 --> 01:32:36.479
yes , sir . And , and I think that's ,

01:32:36.490 --> 01:32:38.323
these are some of the issues I'm

01:32:38.323 --> 01:32:40.434
alluding to and I talk about having a

01:32:40.434 --> 01:32:42.434
culture of accountability . We also

01:32:42.434 --> 01:32:44.546
need to look hard inside ourselves as

01:32:44.546 --> 01:32:46.657
well and determine where we organized

01:32:46.657 --> 01:32:49.410
the proper way broadly . But on

01:32:49.419 --> 01:32:51.586
specifically on these issues to be the

01:32:51.586 --> 01:32:53.752
right people in the right places . And

01:32:53.752 --> 01:32:55.697
have we segregated to the decision

01:32:55.697 --> 01:32:57.641
authority in a way that'll give us

01:32:57.641 --> 01:32:59.808
first internal checks and balances and

01:32:59.808 --> 01:33:01.863
also um some different expertise and

01:33:01.863 --> 01:33:03.863
some differences of view as we take

01:33:03.863 --> 01:33:06.250
these decisions . So I've already

01:33:06.259 --> 01:33:07.870
mentioned , we lacked a firm

01:33:07.870 --> 01:33:09.759
understanding , the complexity of

01:33:09.759 --> 01:33:12.037
technical features required to deliver .

01:33:12.037 --> 01:33:13.981
We underestimated the timelines it

01:33:13.981 --> 01:33:13.589
would take . Now those are both of that

01:33:13.600 --> 01:33:15.589
expertise . We had a shortage of

01:33:15.600 --> 01:33:17.656
critical technical agile acquisition

01:33:17.656 --> 01:33:19.544
and integration skills within the

01:33:19.544 --> 01:33:21.156
program when the program was

01:33:21.156 --> 01:33:23.322
transferred to us . But then also over

01:33:23.322 --> 01:33:25.378
time within D CS A when I talk about

01:33:25.378 --> 01:33:27.544
leadership , um I think it's important

01:33:27.544 --> 01:33:29.433
to point out I also hired another

01:33:29.433 --> 01:33:31.322
program , a new program executive

01:33:31.322 --> 01:33:33.211
officer , the role of the program

01:33:33.211 --> 01:33:33.209
executive officer here is to look

01:33:33.220 --> 01:33:36.029
across in my agency nine programs

01:33:36.040 --> 01:33:38.109
embassies , but one of them to make

01:33:38.120 --> 01:33:40.470
sure that they're compliant with proper

01:33:40.479 --> 01:33:42.201
acquisition strategies and the

01:33:42.201 --> 01:33:44.540
documentation is robust is also

01:33:44.549 --> 01:33:46.660
compliant . Why , why were we able to

01:33:46.660 --> 01:33:49.479
set up D CS A without having a program

01:33:49.490 --> 01:33:51.379
executive in place as part of the

01:33:51.379 --> 01:33:53.490
initial structure of the Senator ? In

01:33:53.490 --> 01:33:55.546
this case , we had the two billets .

01:33:55.546 --> 01:33:57.490
But for a period of time , the NVS

01:33:57.490 --> 01:33:59.268
program manager and the program

01:33:59.268 --> 01:34:01.490
executive officer were in fact the same

01:34:01.490 --> 01:34:03.546
individual person , which is why I'm

01:34:03.546 --> 01:34:05.768
saying the decision authority was a bit

01:34:05.768 --> 01:34:05.490
too concentrated a while since I've

01:34:05.500 --> 01:34:07.389
been in business . But I realized

01:34:07.389 --> 01:34:09.500
that's , that's this was that these ,

01:34:09.500 --> 01:34:11.500
these functions check each other or

01:34:11.500 --> 01:34:14.009
somebody overseeing the actual program

01:34:14.390 --> 01:34:16.879
management itself at a somewhat of a

01:34:17.020 --> 01:34:18.742
checkpoint level . Senator . I

01:34:18.742 --> 01:34:21.270
completely agree . And again , if I'm

01:34:21.279 --> 01:34:24.319
not in a position to record

01:34:24.709 --> 01:34:26.653
properly , diagnostic and accurate

01:34:26.653 --> 01:34:29.720
internal information , nor report it up

01:34:29.729 --> 01:34:31.729
to my higher headquarters where I'm

01:34:31.729 --> 01:34:33.785
held accountable , then it's easy to

01:34:33.785 --> 01:34:36.007
see where you'll have a breakdown uh in

01:34:36.007 --> 01:34:38.560
process that can over time lead to

01:34:38.569 --> 01:34:40.513
these sorts of problems that we're

01:34:40.513 --> 01:34:42.625
experiencing with NS . And that's why

01:34:42.625 --> 01:34:44.736
again , I say this 90 day period that

01:34:44.736 --> 01:34:46.847
the acting under secretary called for

01:34:46.847 --> 01:34:48.902
this 90 day review has been critical

01:34:48.902 --> 01:34:50.830
and really fruitful , well timed

01:34:51.250 --> 01:34:53.472
because she did bring in new leadership

01:34:53.472 --> 01:34:55.694
at the agency level by extension . Then

01:34:55.694 --> 01:34:57.917
brought in a new pe O and a new program

01:34:57.917 --> 01:34:59.528
manager . We're able to look

01:34:59.528 --> 01:35:01.750
comprehensively with partners from CD A

01:35:01.750 --> 01:35:05.129
OD DS counted on Gao here . Also to go

01:35:05.140 --> 01:35:07.362
back through those reports , we invited

01:35:07.362 --> 01:35:09.529
them in . They came in to see me at my

01:35:09.529 --> 01:35:11.640
invitation the first week of May . Uh

01:35:11.640 --> 01:35:13.640
It was critically important that we

01:35:13.640 --> 01:35:15.862
brought the right people to the table .

01:35:16.009 --> 01:35:18.120
Well , I would ask again if there are

01:35:18.120 --> 01:35:20.176
additional legislative authorities ,

01:35:20.176 --> 01:35:22.287
but I do think , you know , and , and

01:35:22.287 --> 01:35:22.069
maybe we are not being harsh enough . I

01:35:22.080 --> 01:35:25.069
mean , this , yeah , and it's a strange

01:35:25.080 --> 01:35:27.180
time in lots of government at this

01:35:27.189 --> 01:35:29.450
point . But , you know , to me in many

01:35:29.459 --> 01:35:32.149
ways , uh you know , this is in a

01:35:32.160 --> 01:35:33.882
different setting with maybe a

01:35:33.882 --> 01:35:36.104
different membership here that was more

01:35:36.104 --> 01:35:38.327
willing to kind of flog the heck out of

01:35:38.327 --> 01:35:42.069
you guys . This is as , as , you

01:35:42.080 --> 01:35:45.500
know , holy heck government abuse

01:35:45.509 --> 01:35:48.140
contract problem is as , you know ,

01:35:48.919 --> 01:35:51.839
pretty much anything I've , I've seen ,

01:35:51.850 --> 01:35:54.689
you know , you could make a lot of , of ,

01:35:54.700 --> 01:35:58.220
hey , with how this started new agency ,

01:35:58.319 --> 01:36:00.799
we're five years behind , we didn't get

01:36:00.810 --> 01:36:03.390
fully notified , you know , they didn't ,

01:36:03.399 --> 01:36:05.399
your , your predecessor , Secretary

01:36:05.399 --> 01:36:07.621
Harris wasn't even fully notified in an

01:36:07.621 --> 01:36:10.490
appropriate way . And we're , we are ,

01:36:10.790 --> 01:36:12.734
you know , what was supposed to be

01:36:12.734 --> 01:36:14.901
probably wrong sized at 700 million to

01:36:14.901 --> 01:36:17.179
start . But we're , you know , roughly ,

01:36:17.179 --> 01:36:19.500
you know , 1.7 billion now , five years

01:36:19.509 --> 01:36:22.629
late with another 18 months and no cost

01:36:22.640 --> 01:36:26.600
estimate to go . We wouldn't , you know ,

01:36:26.620 --> 01:36:28.842
I'm , I'm glad we got the new team here

01:36:28.842 --> 01:36:30.842
because if it was the old team , it

01:36:30.842 --> 01:36:32.787
would just be too easy not to just

01:36:32.787 --> 01:36:34.842
whack the heck out of you guys . But

01:36:34.842 --> 01:36:38.540
the next time you come , you know ,

01:36:38.549 --> 01:36:41.279
if we're not seeing market improvement

01:36:42.310 --> 01:36:44.421
and you just need to be straight with

01:36:44.421 --> 01:36:46.620
us if it's , uh , I , I do think , you

01:36:46.629 --> 01:36:48.851
know , this is broader than your , your

01:36:48.851 --> 01:36:50.962
respective roles , but the incentives

01:36:50.962 --> 01:36:53.018
to get the contractor to raise their

01:36:53.018 --> 01:36:55.240
hand and say , hey , we're not building

01:36:55.240 --> 01:36:55.060
something that can scale or we're not

01:36:55.069 --> 01:36:57.236
building something that's gonna really

01:36:57.236 --> 01:36:59.291
meet the need or within the agency ,

01:36:59.291 --> 01:37:01.458
there's gotta be somebody that kind of

01:37:01.458 --> 01:37:03.680
felt this doesn't pass the smell test .

01:37:03.680 --> 01:37:05.549
And I obviously think you and I

01:37:05.560 --> 01:37:07.616
remember when your predators came in

01:37:07.616 --> 01:37:09.616
and said we're going to bring it up

01:37:09.616 --> 01:37:11.560
into big Dod and bring more of the

01:37:11.560 --> 01:37:13.727
expertise , how we let it get this far

01:37:13.727 --> 01:37:16.270
along the way . Um , is a real

01:37:16.279 --> 01:37:18.223
challenge because if we go back to

01:37:18.223 --> 01:37:20.229
where we start , uh , and Doctor

01:37:20.240 --> 01:37:22.240
Dickerson , you're not going to get

01:37:22.240 --> 01:37:24.240
away completely unscathed here . Um

01:37:24.979 --> 01:37:27.201
Where is the pack through all of this ?

01:37:29.060 --> 01:37:31.338
Uh Senator Warner ? Thank you for that .

01:37:31.338 --> 01:37:33.504
I , you , you're absolutely right . We

01:37:33.504 --> 01:37:35.504
did not recognize that there was an

01:37:35.504 --> 01:37:37.689
issue . Um We talked about in BS at

01:37:37.700 --> 01:37:39.922
every time we met his pack principles ,

01:37:39.922 --> 01:37:42.033
which was very frequent , but we were

01:37:42.033 --> 01:37:43.922
also working across all the other

01:37:43.922 --> 01:37:46.089
things that we're trying to deliver as

01:37:46.089 --> 01:37:48.311
part of trusted workforce 2.0 so we did

01:37:48.311 --> 01:37:50.478
not dedicate enough time diving in and

01:37:50.478 --> 01:37:52.644
asking the hard questions . I think we

01:37:52.644 --> 01:37:54.867
all made assumptions that some of these

01:37:54.867 --> 01:37:54.740
other levels of oversight actually

01:37:54.750 --> 01:37:56.972
existed when it turns out that they did

01:37:56.972 --> 01:37:59.139
not , but we did not ask the questions

01:37:59.139 --> 01:38:01.330
that would have gotten us to realize

01:38:01.339 --> 01:38:03.506
that there was a problem earlier . But

01:38:03.506 --> 01:38:05.672
again , but , well , that's not , that

01:38:05.672 --> 01:38:07.728
doesn't totally pass the smell to us

01:38:07.728 --> 01:38:07.620
either because , you know , we know

01:38:07.629 --> 01:38:09.740
this knew this was a problem that was

01:38:09.740 --> 01:38:11.685
supposed to be delivered in 2019 .

01:38:11.685 --> 01:38:13.959
Didn't somebody say in 2022 or 2029 .

01:38:13.970 --> 01:38:16.081
Again , you gotta argue . We've asked

01:38:16.081 --> 01:38:18.248
that question too , but you had a more

01:38:18.248 --> 01:38:20.248
direct ongoing responsibility . Why

01:38:20.248 --> 01:38:22.414
didn't somebody in the pack say we had

01:38:22.414 --> 01:38:22.029
to dig into this a little more ? I

01:38:22.040 --> 01:38:24.350
think when , when the group of us that

01:38:24.500 --> 01:38:26.556
the , the former people that were at

01:38:26.556 --> 01:38:28.667
the table with me back in March of 23

01:38:28.667 --> 01:38:30.950
all of us came in in 21 . And so we

01:38:30.959 --> 01:38:33.126
actually thought that we were on track

01:38:33.126 --> 01:38:35.126
for the redo , redo the and the new

01:38:35.126 --> 01:38:37.181
process and the new plan for in this

01:38:37.181 --> 01:38:39.459
and every time we looked at the slides ,

01:38:39.459 --> 01:38:41.292
there was not so many tremendous

01:38:41.292 --> 01:38:44.069
changes in the deliverables to raise

01:38:44.080 --> 01:38:46.302
the concern to us , it looked like they

01:38:46.302 --> 01:38:48.413
were minimal slips . So when you came

01:38:48.413 --> 01:38:50.636
in in 21 they were still expecting a 20

01:38:50.636 --> 01:38:53.180
September of 24 deliverable II , I

01:38:53.189 --> 01:38:55.356
don't remember the exact date , but it

01:38:55.356 --> 01:38:57.411
was , it was definitely something in

01:38:57.411 --> 01:38:59.467
the future beyond 21 . But , but did

01:38:59.467 --> 01:39:01.633
you have in September when you came in

01:39:01.633 --> 01:39:03.856
in 21 ? Did you have a plan that says ,

01:39:03.856 --> 01:39:06.078
ok , by September of 24 we're gonna get

01:39:06.078 --> 01:39:08.078
it done and it's gonna cost X , you

01:39:08.078 --> 01:39:10.245
must have had some presumption of what

01:39:10.245 --> 01:39:12.245
the costs were gonna be . I , I'm ,

01:39:12.245 --> 01:39:14.356
well , I'm , I'm absolutely sure that

01:39:14.356 --> 01:39:16.467
we did as PAC principles . We sort of

01:39:16.467 --> 01:39:18.633
were all looking at our own particular

01:39:18.633 --> 01:39:18.229
pieces of the puzzle . And so I don't

01:39:18.240 --> 01:39:20.351
know that we were how do we make sure

01:39:20.351 --> 01:39:22.462
the pack doesn't miss this again or ,

01:39:22.462 --> 01:39:24.462
or , you know , because again , and

01:39:24.462 --> 01:39:26.700
this is just one piece of this

01:39:26.709 --> 01:39:28.987
glorified idea . I mean , I , you know ,

01:39:28.987 --> 01:39:31.153
I had a lot of problems with the , you

01:39:31.153 --> 01:39:33.320
know , the previous administration but

01:39:33.320 --> 01:39:32.680
the previous administration did at

01:39:32.689 --> 01:39:34.745
least start to take on this and help

01:39:34.745 --> 01:39:36.967
work to bring down the , you know , the

01:39:36.967 --> 01:39:39.300
backlog . But I feel like we , you know ,

01:39:39.300 --> 01:39:41.411
we knock out one of these issues , we

01:39:41.411 --> 01:39:43.522
knocked out the backlog . Then we had

01:39:43.522 --> 01:39:45.745
to deal with the adjudication piece and

01:39:45.745 --> 01:39:47.967
you know , again , um talk preaching to

01:39:47.967 --> 01:39:47.790
the choir here when we , you know ,

01:39:47.799 --> 01:39:50.850
didn't have enough polygraph trainers ,

01:39:50.859 --> 01:39:52.915
then we didn't have enough people to

01:39:52.915 --> 01:39:55.026
train the polygraphers . You know , I

01:39:55.026 --> 01:39:54.899
think we keep knocking these things

01:39:54.910 --> 01:39:57.021
down , but then you get this , we got

01:39:57.021 --> 01:40:00.729
this glorified great new system and

01:40:00.740 --> 01:40:03.990
this is an embarrassment . I , I agree .

01:40:04.000 --> 01:40:06.222
I am , what I can say is I am much more

01:40:06.222 --> 01:40:08.111
comfortable now with the level of

01:40:08.111 --> 01:40:10.222
oversight that's going to be provided

01:40:10.222 --> 01:40:12.444
with Doctor Plumb with uh acquisition ,

01:40:12.444 --> 01:40:14.667
sustain and sustainment as well as with

01:40:14.667 --> 01:40:14.430
what the honorable Harris and her staff

01:40:14.439 --> 01:40:16.550
are going to do . This is what should

01:40:16.550 --> 01:40:18.550
have been in place beforehand . Now

01:40:18.550 --> 01:40:20.550
that it is in place , we will , are

01:40:20.550 --> 01:40:20.009
there one of the things we're gonna ask

01:40:20.020 --> 01:40:22.169
the Packer , how many other of these

01:40:22.180 --> 01:40:24.410
potential , you know , ticking time

01:40:24.419 --> 01:40:26.530
bombs or not ticking time bombs , you

01:40:26.530 --> 01:40:29.399
know , uh potential . Oh , my gosh ,

01:40:29.410 --> 01:40:31.466
we're not going to hit these metrics

01:40:32.040 --> 01:40:34.149
very little of what is left to be

01:40:34.160 --> 01:40:37.180
delivered . Is , is it solutions ? Uh ,

01:40:37.189 --> 01:40:39.189
most of what's left to be delivered

01:40:39.189 --> 01:40:41.189
include , how do you take the , the

01:40:41.189 --> 01:40:43.411
guidelines and the standards we've pros

01:40:43.411 --> 01:40:45.467
we've created and then roll them out

01:40:45.467 --> 01:40:45.450
into the workforce . How do you get

01:40:45.459 --> 01:40:47.500
everyone ready to do the types of

01:40:47.509 --> 01:40:49.731
investigations ? And so a lot of things

01:40:49.731 --> 01:40:51.898
are dependent on Ibis , but Ibis is by

01:40:51.898 --> 01:40:54.549
far the largest it part of trusted

01:40:54.560 --> 01:40:56.671
workforce department . Well , I would

01:40:56.671 --> 01:40:58.859
say this , you know , um a great

01:40:58.870 --> 01:41:01.037
respect for you . I also great respect

01:41:01.037 --> 01:41:03.259
for your predecessor , Sue Gordon . She

01:41:03.259 --> 01:41:05.426
promised me she was not going to leave

01:41:05.426 --> 01:41:07.537
the job until we had reciprocity with

01:41:07.537 --> 01:41:09.537
CIA . We are making a great deal of

01:41:09.537 --> 01:41:11.426
progress on reciprocity . I think

01:41:11.426 --> 01:41:13.537
across the whole community across the

01:41:13.537 --> 01:41:15.314
community . When you talk about

01:41:15.314 --> 01:41:17.481
specifically someone that's going from

01:41:17.481 --> 01:41:19.370
a civil similar level of security

01:41:19.370 --> 01:41:21.537
classic or security clearance needed .

01:41:21.537 --> 01:41:23.648
That person . As I mentioned before ,

01:41:23.648 --> 01:41:25.870
that process can take as little as five

01:41:25.870 --> 01:41:27.981
days when it is apples to apples . In

01:41:27.981 --> 01:41:27.859
many cases though it's not , you're

01:41:27.870 --> 01:41:29.592
going from an agency where the

01:41:29.592 --> 01:41:31.648
responsibilities you have in one job

01:41:31.648 --> 01:41:33.592
are actually less and require less

01:41:33.592 --> 01:41:35.648
sensitive information than the other

01:41:35.648 --> 01:41:37.870
one . And so then you have to look at ,

01:41:37.870 --> 01:41:37.520
ok . Does the person need , do we have

01:41:37.529 --> 01:41:39.473
to go back and look at those , the

01:41:39.473 --> 01:41:41.362
continuing vet continuous vetting

01:41:41.362 --> 01:41:43.529
alerts ? Did something come in between

01:41:43.529 --> 01:41:42.930
the time the person was hired in the

01:41:42.939 --> 01:41:45.161
one agency or the other one . Does this

01:41:45.161 --> 01:41:47.106
one agency , the second agency now

01:41:47.106 --> 01:41:48.717
require medical screening or

01:41:48.717 --> 01:41:50.883
psychological screening or a different

01:41:50.883 --> 01:41:53.050
kind of polygraph ? So there are other

01:41:53.050 --> 01:41:54.883
things that make it not a simple

01:41:54.883 --> 01:41:56.995
movement , but when it is exactly the

01:41:56.995 --> 01:41:58.717
same level of clearance , same

01:41:58.717 --> 01:42:00.883
responsibilities and same process from

01:42:00.883 --> 01:42:03.050
one agency to another that pro this is

01:42:03.050 --> 01:42:02.970
very quick and we are working on the

01:42:02.979 --> 01:42:05.146
other one and is there any way as well

01:42:05.146 --> 01:42:06.979
that I can hold our former staff

01:42:06.979 --> 01:42:09.090
director , Mike Casey responsible for

01:42:09.090 --> 01:42:08.910
anything screwing up going forward .

01:42:08.919 --> 01:42:10.919
Mike Casey and his organization are

01:42:10.919 --> 01:42:13.141
going to deliver a tool that's going to

01:42:13.141 --> 01:42:15.252
significantly help with reciprocity .

01:42:15.252 --> 01:42:14.970
And I'm absolutely sure that they are

01:42:14.979 --> 01:42:17.090
all on what timeline ? No , he , he's

01:42:17.090 --> 01:42:19.459
looked to your left . Um

01:42:21.290 --> 01:42:23.401
We are in the requirements definition

01:42:23.401 --> 01:42:25.568
stage and we may actually uh reach out

01:42:25.568 --> 01:42:27.679
to requirements definition stage . We

01:42:27.679 --> 01:42:29.568
may need doctor plums or a team .

01:42:29.959 --> 01:42:31.681
Exactly . I think we have some

01:42:31.681 --> 01:42:33.737
oversight that we're already talking

01:42:33.737 --> 01:42:35.959
about . And how do we make sure that we

01:42:35.959 --> 01:42:35.459
honorable Casey does not want to be up

01:42:35.470 --> 01:42:37.470
here in front of this panel talking

01:42:37.470 --> 01:42:39.581
about this issue at some point in the

01:42:39.581 --> 01:42:41.803
future . I would , I am absolutely sure

01:42:41.803 --> 01:42:41.270
you think you would agree with that

01:42:41.279 --> 01:42:44.200
statement . Well , um

01:42:45.770 --> 01:42:47.992
you know , I , I I'm disappointed where

01:42:47.992 --> 01:42:49.826
we're that we're here . I , I do

01:42:49.826 --> 01:42:53.790
appreciate , um , you know , the

01:42:53.799 --> 01:42:55.688
new members of the team , we were

01:42:55.688 --> 01:42:57.855
trying to get this , but we're gonna ,

01:42:57.855 --> 01:42:57.450
we have to stay on it . You know , end

01:42:57.459 --> 01:42:59.626
of the day , we get caught up on these

01:42:59.626 --> 01:43:01.848
details . But end of the day , we gotta

01:43:01.848 --> 01:43:03.570
make sure we've got a security

01:43:03.570 --> 01:43:05.626
clearance process that works that we

01:43:05.626 --> 01:43:07.570
can still recruit the best and the

01:43:07.570 --> 01:43:09.681
brightest into the community that our

01:43:09.681 --> 01:43:11.737
government contracting workforce can

01:43:11.737 --> 01:43:13.681
not be delayed and , you know , uh

01:43:13.681 --> 01:43:15.792
driven to not be as efficient because

01:43:15.792 --> 01:43:18.070
they , they have to waste so much time .

01:43:18.070 --> 01:43:20.070
And , you know , we didn't even get

01:43:20.070 --> 01:43:22.403
today to the , um the whole question of ,

01:43:22.403 --> 01:43:22.080
you know , smaller companies who don't

01:43:22.089 --> 01:43:24.200
even have billets based upon butts in

01:43:24.200 --> 01:43:26.422
the seats so that you , you know , your

01:43:26.422 --> 01:43:28.256
CFO , you make it , the CEO is a

01:43:28.256 --> 01:43:30.311
clearance but the CFO doesn't know .

01:43:30.311 --> 01:43:29.759
And how do you have a CFO ? That

01:43:29.770 --> 01:43:31.770
doesn't even know what the projects

01:43:31.770 --> 01:43:33.881
that are working on . We are actually

01:43:33.881 --> 01:43:36.048
making progress on that too . We heard

01:43:36.048 --> 01:43:38.159
you loud and clear that there are who

01:43:38.159 --> 01:43:40.270
can't charge to a contract , who need

01:43:40.270 --> 01:43:40.209
to have clearances , who need to have

01:43:40.220 --> 01:43:42.442
their senior executive team has to have

01:43:42.442 --> 01:43:44.442
those billets or have to have those

01:43:44.442 --> 01:43:46.664
numbers . We're trying to work with our

01:43:46.664 --> 01:43:48.720
contracting organization to actually

01:43:48.720 --> 01:43:47.799
make sure that can happen , but

01:43:47.810 --> 01:43:50.100
respectfully . Uh and I know you've

01:43:50.109 --> 01:43:53.560
only been saying it for 2.5 years , but

01:43:53.569 --> 01:43:55.791
I've had other people sat in that , sit

01:43:55.791 --> 01:43:57.791
in this seat . Now for the seven or

01:43:57.791 --> 01:43:59.958
eight years , not almost 10 years that

01:43:59.958 --> 01:44:02.013
I've been talking about it . And I ,

01:44:02.013 --> 01:44:04.180
you know , I just don't understand why

01:44:04.180 --> 01:44:06.689
it's taken so long and why some of this ,

01:44:07.890 --> 01:44:11.279
it's so hard and maybe that will be the ,

01:44:11.609 --> 01:44:14.089
the function of our , our next hearing

01:44:14.100 --> 01:44:16.319
for those of you at D CS A and in BS .

01:44:16.959 --> 01:44:20.299
Uh we've got great expectations . Um

01:44:20.439 --> 01:44:22.620
but I strongly strongly suggest that

01:44:22.629 --> 01:44:25.299
you , if you've got need for different

01:44:25.310 --> 01:44:27.421
authorities , I'd like to hear Doctor

01:44:27.421 --> 01:44:29.477
Plum . I know we say this is not the

01:44:29.477 --> 01:44:32.390
way we structure um software and

01:44:32.399 --> 01:44:34.510
government contracting , but maybe we

01:44:34.510 --> 01:44:36.740
ought to take some experiments . You

01:44:36.750 --> 01:44:38.917
know , we can call it A I . That means

01:44:38.917 --> 01:44:40.917
we can get funding for it no matter

01:44:40.917 --> 01:44:43.139
what if we call it A I in your office .

01:44:43.139 --> 01:44:45.306
And , you know , but think about where

01:44:45.306 --> 01:44:47.528
we actually try to align the agency and

01:44:47.528 --> 01:44:47.490
the contractors interest to kind of

01:44:47.500 --> 01:44:51.310
come to the same you technology

01:44:51.319 --> 01:44:53.319
driven success goal , which I think

01:44:53.319 --> 01:44:55.208
again , and I don't think this is

01:44:55.208 --> 01:44:57.319
unique to end this but is too often a

01:44:57.319 --> 01:44:59.790
problem where they are not aligned . Um

01:45:00.870 --> 01:45:03.450
You know , uh uh I think I've driven

01:45:03.459 --> 01:45:05.737
all my other colleagues wafer out . II ,

01:45:05.737 --> 01:45:07.959
I was actually surprised we got as many

01:45:07.959 --> 01:45:10.509
showing up as we did . Uh um But as

01:45:10.520 --> 01:45:12.687
long as I'm here , we're gonna stay on

01:45:12.687 --> 01:45:14.853
this and we're gonna get it fixed . We

01:45:14.853 --> 01:45:15.430
are joined . Thank you .