Committee chair Rep. Mark Green (R-Tenn.) said it was “alarming that most of our critical infrastructure systems have been violated right under our noses.”
“We cannot allow this situation to continue. The American economy, our government, the military, depend on the resilience of our networks and our infrastructure,” Green said. “It’s past time for us to get a step ahead.”
The hearing called on four cybersecurity experts to testify about how the U.S. can better defend against foreign cyber threats.
Mark Montgomery, a retired rear admiral and now a senior director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, said the recent Chinese cyber incursions amount to battlefield preparations.
“It is a war-making action,” he said. “We have to take it much more seriously.”
Montgomery compared it to a situation in which China would have placed explosives on U.S. infrastructure, saying that would provoke a serious reaction from Washington “but somehow in cyberspace they get a pass.”
Montgomery recommended the U.S. respond in kind to disable foreign capabilities used for cyberattacks, and he also recommended spurring more public-private cybersecurity investment and using the National Guard for more defensive operations.
The Cybersecurity and Infrastructure Security Agency is the point agency for cyberdefense, but it needs strengthening in several areas, including its global response, said Kemba Walden, president of Paladin Global Institute.
“Strengthening CISA’s ability to [assist] across borders, recognizing that our digital infrastructure is global in nature,” she said. “CISA needs maybe some clarity on how to do that.”
The hearing comes just over a month after the discovery of Salt Typhoon, which penetrated telecommunication networks in the U.S. through devices from companies like Verizon and AT&T in an effort going back to at least 2022.
And in December, the Treasury Department also said it was hacked by Chinese actors who accessed some systems and unclassified files.
North Korea, Russia and Iran are also active in the cyberspace, with Tehran-linked actors responsible for hacking the Trump campaign last year.
Russia was responsible for the 2020 SolarWinds hack, which saw actors hack a Texas-based software company used by the U.S. government, giving them access to systems from federal agencies.
Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, said cyber intrusions increased 150 percent across all sectors in the past year.
“The cyber threat landscape is complex, dynamic and increasingly interconnected. Adversaries are constantly refining their tactics to exploit vulnerabilities across industries and sectors,” he said. “To counter these threats, we must raise the cost of cyber attacks and reduce their impact.”
