    [House Hearing, 106 Congress]
    [From the U.S. Government Publishing Office]

                       OVERSIGHT OF THE STATE DEPARTMENT:
                 TECHNOLOGY MODERNIZATION AND COMPUTER SECURITY

    =======================================================================

                                    HEARING

                                   BEFORE THE

                                  COMMITTEE ON
                            INTERNATIONAL RELATIONS
                            HOUSE OF REPRESENTATIVES

                           ONE HUNDRED SIXTH CONGRESS

                                 SECOND SESSION

                                   __________

                                 JUNE 22, 2000

                                   __________

                               Serial No. 106-171

                                   __________

        Printed for the use of the Committee on International Relations

            Available via the World Wide Web: http://www.house.gov/
                      international--relations

                                     ______

                        U.S. GOVERNMENT PRINTING OFFICE
    68-288 CC                   WASHINGTON : 2000

                      COMMITTEE ON INTERNATIONAL RELATIONS

                     BENJAMIN A. GILMAN, New York, Chairman
    WILLIAM F. GOODLING, Pennsylvania    SAM GEJDENSON, Connecticut
    JAMES A. LEACH, Iowa                 TOM LANTOS, California
    HENRY J. HYDE, Illinois              HOWARD L. BERMAN, California
    DOUG BEREUTER, Nebraska              GARY L. ACKERMAN, New York
    CHRISTOPHER H. SMITH, New Jersey     ENI F.H. FALEOMAVAEGA, American
    DAN BURTON, Indiana                      Samoa
    ELTON GALLEGLY, California           MATTHEW G. MARTINEZ, California
    ILEANA ROS-LEHTINEN, Florida         DONALD M. PAYNE, New Jersey
    CASS BALLENGER, North Carolina       ROBERT MENENDEZ, New Jersey
    DANA ROHRABACHER, California         SHERROD BROWN, Ohio
    DONALD A. MANZULLO, Illinois         CYNTHIA A. McKINNEY, Georgia
    EDWARD R. ROYCE, California          ALCEE L. HASTINGS, Florida
    PETER T. KING, New York              PAT DANNER, Missouri
    STEVE CHABOT, Ohio                   EARL F. HILLIARD, Alabama
    MARSHALL ``MARK'' SANFORD, South     BRAD SHERMAN, California
        Carolina                         ROBERT WEXLER, Florida
    MATT SALMON, Arizona                 STEVEN R. ROTHMAN, New Jersey
    AMO HOUGHTON, New York               JIM DAVIS, Florida
    TOM CAMPBELL, California             EARL POMEROY, North Dakota
    JOHN M. McHUGH, New York             WILLIAM D. DELAHUNT, Massachusetts
    KEVIN BRADY, Texas                   GREGORY W. MEEKS, New York
    RICHARD BURR, North Carolina         BARBARA LEE, California
    PAUL E. GILLMOR, Ohio                JOSEPH CROWLEY, New York
    GEORGE RADANOVICH, California        JOSEPH M. HOEFFEL, Pennsylvania
    JOHN COOKSEY, Louisiana
    THOMAS G. TANCREDO, Colorado
                        Richard J. Garon, Chief of Staff
              Kathleen Bertelsen Moazed, Democratic Chief of Staff
                   Kristin Gilley, Professional Staff Member
                        Marilyn C. Owen, Staff Associate

                                C O N T E N T S

                                  ----------

                                   WITNESSES

                                                                       Page

    Fernando Burbano, Chief Information Officer, U.S. Department of
      State..........................................................     4
    Jack L. Brock, Jr., Director of Government and Defense Systems,
      U.S. General Accounting Office.................................     6
    Mark T. Maybury, Ph.D., Executive Director, Information
      Technology Division, The MITRE Corporation.....................     9
    Wayne Rychak, Deputy Assistant Secretary for Diplomatic Security,
      U.S. Department of State.......................................    17

                                    APPENDIX

    Prepared statements:

    The Honorable Benjamin A. Gilman, a Representative in Congress
      from New York and Chairman, Committee on International
      Relations......................................................    40
    Fernando Burbano.................................................    43
    Jack L. Brock....................................................    88
    Mark T. Maybury, Ph.D............................................   108

        OVERSIGHT OF THE STATE DEPARTMENT: TECHNOLOGY MODERNIZATION AND
                               COMPUTER SECURITY

                                  ----------

                            THURSDAY, JUNE 22, 2000

                              House of Representatives,
                          Committee on International Relations,
                                                        Washington, DC.
        The Committee met, pursuant to notice, at 10:12 a.m. in
    room 2200, Rayburn House Office Building, Hon. Benjamin A.
    Gilman (Chairman of the Committee) presiding.
        Chairman Gilman. This meeting will come to order. I want to
    thank our panelists for joining us this morning and thank our
    colleagues for being here.
        I am pleased to convene this hearing on Oversight of the
    State Department, Technology, Modernization and Computer
    Security. This is the fourth in a series of oversight hearings
    that this Committee will conduct relating to the Overseas
    Presence Advisory Panel, the OPAP.
        We began these hearings back in February when we heard from
    the panel's members. At that time, and today, I believe the
    panel highlighted some very important issues. This Committee
    supports many of the recommendations made as a basis of
    maintaining a more effective and efficient State Department.
        We are asking our panelists to provide the Committee with a
    comprehensive review of the condition of the State Department's
    information technology program, the safeguarding of its
    information and prospects of developing a common platform to
    facilitate communication among the agencies at posts. Along
    with the efficiencies of high tech systems comes a breadth of
    possible vulnerabilities. These systems demand continual
    security evaluations and resources that should be dedicated to
    this activity.
        Personnel at the State Department must have the capacity to
    communicate quickly and precisely with a variety of people. The
    Overseas Presence Advisory Panel observed that the Department's
    current infrastructure does not provide the means either to
    acquire information from a full range of sources or to
    disseminate it to a full range of audiences.
        Inefficient information systems leave the Department
    impotent in the conduct of foreign affairs. The Department and
    other agencies sharing the overseas platform have taken steps
    to bring their systems up to private sector standards, but much
    more is needed to be successful on an interagency basis. Our
    private sector panelist, Mr. Maybury, will address the problems
    associated with that issue.
        An overriding concern as modernization proceeds is to make
    certain that appropriate, usable systems are procured and that
    security elements are addressed up front. The taxpayer is
    providing an enormous amount of money over time for the
    worldwide upgrades, and this Committee needs to be assured that
    the right decisions and cost effective procurements are being
    made.
        With recent cyber attacks against web sites in both Federal
    and congressional computer systems, serious questions arise
    about computer systems' vulnerabilities. Investigation of
    hacker assaults revealed that the techniques used over the past
    months were fundamentally very simple. In May 1998, GAO
    reported that State's computer systems were very susceptible to
    hackers and to unauthorized individuals.
        Given the important data bases that the Department
    possesses, it would be a disaster if hacker penetration were to
    occur in the State Department; to name just a few, the passport
    system, the visa system, class systems. If a hacker were to
    succeed, it would have a devastating effect on the functioning
    of these items, not to mention the effect on commerce. The
    Department takes in an enormous amount of revenue per day on
    the issuance of those items.
        I believe that in creating a modern infrastructure,
    utilizing a common platform and spending the nation's money
    wisely are certainly critical elements on the road to
    successful information technology management. We will find out
    today if our State Department is on the right road or if they
    have hit a dead end.
        Now I would like to turn to our other colleagues, the Vice-
    Chairman of our Committee, the gentleman from Nebraska, Mr.
    Bereuter.
        [The prepared statement of Chairman Gilman appears in the
    appendix.]
        Mr. Bereuter. Thank you, Mr. Chairman. I have no comment. I
    look forward to the testimony.
        Chairman Gilman. Judge Hastings.
        Mr. Hastings. Mr. Chairman, I have no opening statement at
    this time.
        Chairman Gilman. Thank you.
        Mr. Rohrabacher.
        Mr. Rohrabacher. Just a very short statement for the
    record. I am very concerned, Mr. Chairman, over reports that
    the Chin Wa news agency, a Chinese agency that has ties to the
    Communist Chinese government in Beijing--in fact, it is known
    as having an intelligence connection with the government in
    Beijing--has purchased a building in Arlington with the State
    Department--at least with no protest from the State Department,
    overlooking the Pentagon. This building is a 12 story building
    that has very serious implications to electronic intelligence
    operations, especially in relationship to a direct overview of
    the Pentagon.
        I understand the State Department had no objection to this,
    raised no objections to the Chinese taking over this building,
    and I just think that there is--I do not know if this panel is
    the one who could explain it. Probably not, but for the record
    I would like to say that this is very unsettling news.
        It seems to me that somebody has got to have the
    responsibility when things like this happen, and having an
    intelligence arm of the Beijing government setting up a spy
    nest, an electronic spy nest, you know, just in this position
    overseeing the Pentagon is something that deserves our
    attention. I thought I would put that on the record.
        Chairman Gilman. Thank you very much, Mr. Rohrabacher. I
    hope some panelists will comment on it as we proceed.
        Today we welcome Mr. Fernando Burbano, the chief
    information officer of the State Department. Mr. Burbano
    assumed the position in May 1998, is responsible for the
    Department's information technology policy and operations. He
    oversees a budget of more than $500 million and the activities
    of more than 2,000 employees who are engaged in information
    management. He holds advanced degrees from the American
    University and Syracuse University.
        Our second witness, Mr. Jack Brock, is director of the
    government wide and defense information systems in the issue
    area at the General Accounting Office. He is responsible for
    information management, evaluations and reviews of computer
    security issues for several agencies, including State, and he
    has testified several times on these issues.
        The General Accounting Office [GAO] has developed guidance
    for improving responses to computer security threats. Thank you
    for putting our system back in operation. He holds advanced
    degrees from the University of Texas and Harvard. Welcome.
        Our third witness is Dr. Mark Maybury. Welcome, Mr.
    Maybury, of is it MITRE Corporation?
        Mr. Maybury. MITRE.
        Chairman Gilman. MITRE Corporation. Dr. Maybury comes to us
    highly recommended because of his experience in the field of
    worldwide system upgrades. He is the director of MITRE's
    information technology division responsible for the advanced
    research and development of intelligence and defense systems
    supporting several government agencies.
        Dr. Maybury has taken a look at what it takes to build a
    common platform, collaborative computing and knowledge
    management within the foreign affairs community. He holds
    several advanced degrees, including a Ph.D. from Cambridge in
    artificial intelligence. We certainly appreciate his
    willingness to come down from Massachusetts and educate us in
    this highly technical field.
        We appreciate all of our witnesses being here today, and we
    ask you to proceed with a summary of your statements. Without
    objection, your full statements will be made part of our
    record.
        I also want to welcome Mr. Wayne Rychak, a Deputy Assistant
    Secretary in the Diplomatic Security Bureau at the State
    Department. He is a member of the Senior Foreign Service, and
    his positions with Diplomatic Security have included being
    regional security officer in Islamabad and Pakistan.
        Mr. Rychak is here to respond to questions regarding
    information security.
        Please proceed, Mr. Burbano.

    STATEMENT OF FERNANDO BURBANO, CHIEF INFORMATION OFFICER, U.S.
                          DEPARTMENT OF STATE

        Mr. Burbano. Thank you, Mr. Chairman. Good morning, Mr.
    Chairman and distinguished Members of the Committee on
    International Relations.
        As the CIO for the State Department, I am pleased to report
    significant progress managing the Department's information
    technology resources. This morning I will focus on actions we
    have taken to, first, strengthen our computer security; second,
    improve the integrity and quality of our IT strategic planning,
    our IT capital planning and our management of IT resources;
    and, third, to achieve compliance with the Overseas Presence
    Advisory Panel, OPAP, recommendations.
        Since my testimony is limited to 5 minutes, I have provided
    a more detailed written report for the record.
        Computer security. In the past 2 years since I was
    appointed CIO, the State Department has taken significant steps
    in strengthening our computer security and the security of our
    global communications networks. For example, we now have in
    place a corporate information system security officer and
    computer security incident response teams.
        Our systems are protected with an extensive array of
    electronic firewalls, intrusion detection systems and a
    comprehensive anti-virus program. We increased system security
    training, conducted extensive independent network penetration
    testing and installed a web based geographic information system
    to collect cyber threat information.
        As additional examples of the Department's commitment to
    computer security awareness, I have hosted the CIO Council
    Security Awareness Day, Critical Infrastructure Protection Day
    and a hacker briefing presented by an industry expert. All of
    these are open to the entire Federal IT community.
        With our improved security posture, we have successfully
    withstood numerous cyber attacks such as those that have
    damaged other agencies and private sector web sites. For
    example, we were successful in defending against an attack
    after the NATO bombing of the Chinese Embassy in Belgrade when
    we were bombarded with over 10,000 messages an hour for several
    weeks.
        However, despite significant improvements in our cyber
    security, we realize that the cyber underworld continues to
    improve its weapons. We routinely assess our presence on the
    internet, and so far we have been successful in adjusting our
    protection measures to meet the continuing and ever changing
    challenges.
        I also established a security infrastructure working group
    known as SIWG to proactively oversee our enterprise
    infrastructure and coordinate an integrated, department wide
    security response. The SIWG is chaired by the Deputy CIO for
    Operations and has representation from Diplomatic Security and
    other bureaus.
        Let me briefly highlight our accomplishments in our IT
    security over the last 2 years. We achieved 100 percent
    completion of the 72 technical findings and the eight
    management recommendations identified in the 1998 GAO computer
    security audit. We achieved closure on Federal Managers
    Financial Integrity Act, FMFIA, issues open since 1984.
        We revised the foreign affairs manual to include security
    related policies. We globally deployed a computer security
    self-assessment software tool known as Kane Security Analyst.
    We conducted vulnerability assessments on our classified,
    sensitive but unclassified and internet networks.
        In a joint effort with the NSA, we have begun a pilot
    program using public key infrastructure to implement strong
    identification and authentication processes. We are
    implementing the risk management cycle as recommended in best
    practices published by GAO and OMB and are implementing a
    robust certification and accreditation program incorporating
    the recently released national information assurance
    certification and accreditation process known as NIACAP. My
    written testimony describes these achievements in more detail.
        Now turning to Overseas Presence Advisory Panel
    recommendations, particularly the actions we have taken to
    address the challenges to obtain interagency coordination and
    cooperation and to insure quality and cost effective program
    management. To insure that all foreign affairs agencies are
    partners in developing solutions to the OPAP recommendations,
    we have convened the OPAP interagency technology subcommittee.
    This subcommittee, which I chair as the representative of the
    lead agency, consists of the CIOs of the principal foreign
    affairs agencies.
        To date, the cooperation between all of the foreign affairs
    agencies in developing solutions to the OPAP report
    recommendations has been outstanding. This reflects the fact
    that over the past 2 years, through the CIO Council and its
    various subcommittees, the CIOs had already established strong
    relationships and had worked collaboratively on issues of
    common concern.
        Specifically, we are progressing in our plans to deploy an
    interoperable infrastructure accessible to all agencies to
    improve communication and collaboration. Our OPAP architecture
    approach emphasizes interagency connectivity and collaboration,
    minimizing technical risk and leveraging internet and web
    technologies.
        The intent is to build a browser based environment such
    that agencies need not change their architectures to connect to
    and use the OPAP facilities, and a range of connection options
    will be accommodated. To provide the right information to the
    right people at the right time, we are designing a knowledge
    management system to share information across agency
    boundaries. Security of the infrastructure will be addressed
    through the use of technologies such as public key
    infrastructure, data encryption and use of firewalls.
        In order to insure quality and cost effective program
    management and avoid excessive cost overruns, we are following
    a disciplined, standard project management methodology which we
    have used successfully in our Y2K worldwide remediation
    program, IT modernization program known as ALMA and the global
    emergency radio deployment program. I should point out that
    this methodology includes regular interagency project review
    and approval points, such as control gates and check points,
    and prototype and pilot tests and assessments.
        Accordingly, in fiscal year 2001, conditional on the
    availability of timely and adequate resources, we plan to
    implement a pilot program at two posts to test the interagency
    developed solutions to the OPAP unclassified technology
    recommendations. Mexico and New Delhi are being considered as
    the pilot posts. Our goals and the effective participation of
    other Federal agencies are achievable only with your support in
    providing us the resources to continue.
        Turning to IT management and planning, the last section, in
    the time remaining I will address our progress in responding to
    the 1998 GAO report which raised issues about our modernization
    program being at risk absent implementation of best practices.
    We have made significant improvements in the management,
    policy, planning and governance of our IT resources as we
    demonstrated in our success at turning our Y2K program from an
    F to an A, closing FMFIA issues and completing of a large
    scale, global IL modernization project.
        Demonstrating the Department's compliance with the GAO's
    management improvements recommendations, we have adopted an
    enhanced capital planning process that involves all the key
    stakeholders, including the CFO and other senior management,
    Assistant Secretaries, to comply with the mandates of Clinger
    Cohen and OMB Circular A-11;
        Created the Configuration Control Board, whose role will be
    expanded to further strengthen the interrelationship with the
    capital planning process; established the enterprise IT
    architecture that is modeled after guidance issued by the
    Federal CIO Council; included output and outcome measures in
    our IT tactical plan linking the relationship of those measures
    to mission effectiveness and efficiency;
        Instituted a disciplined life cycle management process
    known as Managing State Projects to help insure a consistent
    approach to all aspects of project manager; and, last, we
    continued to focus on well articulated goals that are presented
    in our new IT strategic plan published in January of this year.
        Mr. Chairman and distinguished Committee Members, I would
    like to conclude my testimony here today by assuring you that
    the State Department, including senior management, is committed
    to confronting the continuing challenges, including those which
    will cogently be addressed by GAO today.
        We will work in partnership with your Committee, the GAO
    and other agencies and other bureaus in the Department,
    including Diplomatic Security, to provide exceptional IT
    support to American diplomatic activities in the twenty-first
    century.
        Thank you, and I would be pleased to answer any questions.
        [The prepared statement of Mr. Burbano appears in the
    appendix.]
        Chairman Gilman. Thank you, Mr. Burbano.
        Mr. Brock, GAO.

      STATEMENT OF JACK L. BROCK, JR., DIRECTOR OF GOVERNMENT AND
            DEFENSE SYSTEMS, U.S. GENERAL ACCOUNTING OFFICE

        Mr. Brock. Thank you, Mr. Chairman. Thank you very much for
    inviting us here today.
        We first met with your staff several months ago about the
    Overseas Presence Advisory Panel [OPAP]. The main concern was
    we do not want to have a hearing in 2 or 3 years and find out
    that the Department has wasted $300 million or $400 million. We
    want a return on investment. We want to make sure that the
    goals and the objectives that were set out in the OPAP report
    are in fact and that they are met efficiently.
        I think a concern that the staff had was based on a couple
    of GAO reports on the IT environment at the State Department
    and on the poor computer security, this concern was well
    founded. Could in fact the Department spend the money wisely?
    Could in fact the Department bring about the common platform
    that is needed to support OPAP?
        Our work in computer security showed that the State
    Department was highly vulnerable to both inside and outside
    threats. We were able to pretty much walk around the
    Department. There was generally a lack of oversight at the
    management level.
        Chairman Gilman. Let me interrupt. You say there is a lack
    of oversight in management at State?
        Mr. Brock. Oh, absolutely. Yes.
        Chairman Gilman. Thank you. We are curious about that
    because we are working on the possibility of creating a new
    management office. Thank you.
        Mr. Brock. The same thing on looking at major investments,
    IT investments in the Department. There were a lack of
    management controls and a lack of management processes.
        Both of those reports were done in 1998, and since then the
    Department has made impressive strides in establishing good
    management processes that should allow them, if implemented
    correctly, to control their investments, to control their
    computer security. I am a firm believer that good results come
    from good processes. If you do not have good processes, good
    results may or may not follow, but they are pretty much
    sporadic.
        The Department has now laid a foundation for having a
    better opportunity for achieving good results, and in fact when
    we are looking at the OPAP project, which the early planning
    stages are still underway, they in fact have a disciplined
    process that they are following in determining what the
    requirements of the platform will be, how much it should cost,
    what sort of technology should be in place, etc. They are doing
    a number of things that make sense, and they are pretty much on
    target by the end of this fiscal year to have a detailed
    implementation plan.
        While the Department I believe is well situated to move
    forward into a planning process, we believe they also face I
    think reasonably significant challenges in moving forward. I
    would like to just spend a few moments discussing those
    challenges.
        First of all, they have to work with eight or nine agencies
    on this common platform, and that is difficult to do. I mean,
    on paper they have the agencies in place. They all meet
    together. They have regular meetings. Nevertheless, they have
    different objectives. They have different needs, and in order
    to optimize the common platform some of the individual needs of
    various agencies might have to be suboptimized.
        It is this process that is difficult to negotiate and
    achieve. We think that it is likely that many agencies may want
    to continue operating their own technology, particularly if
    they have systems that were recently acquired or upgraded.
        Second, no one agency by itself has the authority or the
    ability to dictate a solution to insure the implementation of a
    mutually developed solution. Third, although negotiations are
    ongoing, details are still being worked out as to who will
    manage and administer the new collaborative network.
        These challenges are answerable. They are doable, but,
    nevertheless, they are challenges that have to face the
    Department. This really has nothing to do with the Department's
    status now in terms of good information over technology, but I
    think a challenge that any organization would face trying to
    bring together eight other organizations.
        The second challenge is on the matter of an architecture.
    Right now the State Department has a level of architecture, but
    it does not have a detailed architecture.
        If I could just briefly describe an architecture in more
    common terms, if you have a Rand McNally atlas and you open up
    the front page and you see the map of the United States, it
    shows the major interstates going from the east coast to the
    west coast and from the Gulf of Mexico to Canada. Well, you
    sort of know how to get there and where you are going, but it
    is only until you turn to the detailed maps inside the atlas
    that you really know the best route to take from state to state
    to state.
        I think right now the State Department has a pretty good
    overview map, but they do not have those detailed maps that are
    really necessary to dictate where the State Department wants to
    go in terms of matching business solutions with technology. The
    danger of not having an architecture in place is that sometimes
    you in fact let technology dictate business needs, or you let
    business needs dictate the wrong kind of technology, so you
    really need to merge those two things.
        The danger of continuing or the risk of continuing in the
    OPAP project while the architecture is still underway is that
    there is a risk that the eventual OPAP architecture could
    influence the State Department's final architecture in a way
    that may not be optimal. Now, this is a risk I think they are
    aware of and something that they need to follow throughout the
    development of both the architecture and the project.
        The last challenge that the State Department faces is
    computer security. This is a challenge that we found every
    agency faces. Our recent reports have indicated that the 22
    major Federal agencies all have significant computer security
    problems. The findings that we had at State Department a couple
    years ago, they are not unique to the State Department. They
    are true everywhere on a government wide basis.
        The State Department has implemented our recommendations.
    They have changed their management structure. They are in a
    better position to deal with these problems. One of the things
    that they have done at our recommendation is to begin to do
    vulnerability assessments at key places. These vulnerability
    assessments continue to find problems.
        I think a difference now is the State Department is finding
    these problems, and they are fixing them, but I think it is
    indicative that computer security is an ongoing concern. You
    are going to have a new network, a new platform, new
    opportunities for intrusion, and I think that the diligence and
    the level of effort that the State Department will have to
    exercise to this is going to be considerable, so that is a
    significant challenge.
        The advantage is that you have now as an oversight body and
    in fact an advantage that is also shared by the State
    Department and the other agencies that are participating in the
    OPAP project is that the planning for this is just now
    seriously getting underway, and you have many excellent
    oversight opportunities over the coming year.
        First of all, the State Department is developing a detailed
    project plan, and they are going to be testing the concept at a
    couple of pilot locations. This is a good opportunity to take a
    look at the detailed project plan, to take a look at the
    results of the pilot projects and say is this an investment
    that is going to pay off? Does it show promise? Is it something
    we want to pay for? Is it something that is showing results in
    a couple of limited locations? Does it show promise?
        Second, the development of a detailed project plan also
    allows the performance measures to be developed so that in fact
    you will be able to say OK, here is where you said you would
    be. Here is where you are. What is the gap? What do we need to
    do to close the gap? Are you still on target--and gives the
    State Department, the other agencies, as well as you as an
    oversight entity, an opportunity to take corrective actions.
        The State Department is well positioned to develop a plan,
    and I think that again this Committee is well positioned to use
    this plan as a vehicle for monitoring the development of the
    platform over the next couple of years.
        Mr. Chairman, that concludes my statement.
        [The prepared statement of Mr. Brock appears in the
    appendix.]
        Chairman Gilman. Thank you very much, Mr. Brock. You have
    given us a lot of food for thought.
        Mr. Maybury.

     STATEMENT OF MARK T. MAYBURY, EXECUTIVE DIRECTOR, INFORMATION
               TECHNOLOGY DIVISION, THE MITRE CORPORATION

        Mr. Maybury. Thank you, Mr. Chairman, distinguished Members
    of the Committee.
        As executive director for the Miter Corporation, I oversee
    all collaboration computing activities at the corporation, and
    for the past 5 years I have served and worked with the
    Department of Defense very closely to develop a common
    operating environment specifically responsible for the
    collaboration and multimedia elements thereof.
        I will summarize my prepared statement, but I have provided
    a lot of details that I would like to make part of the formal
    record.
        Chairman Gilman. Without objection, it will be made part of
    the record.
        Please proceed.
        Mr. Maybury. Thank you.
        Just a comment on the requirements for, the impediments to,
    the costs of and the lessons learned from using collaboration
    computing in knowledge management and other activities across
    the government. I have attempted to address each of these
    issues in detail, but I would summarize my statements.
        The first point I would like to make is that to create a
    common operating platform for the Department of State and the
    other agencies is a challenge, but it has great potential. By
    common platform, I mean those infrastructure and applications
    that are basic to long distance and cross agency collaboration,
    things like directories, electronic mail, file sharing, desktop
    video teleconferencing, skills or expert data bases and shared
    applications.
        I believe secure collaboration and knowledge management
    solutions have promised to directly address some of the
    fundamental problems outlined in the November, 1999, OPAP
    report, including increased global complexity, dealing with
    reduced overseas staffs, the need for increased global
    engagement and influence.
        For example, if we take a look at the intelligence
    community and the Intelink, classified internet, which MITRE
    helped engineer, it has become the primary method for
    intelligence distribution throughout the intelligence
    community.
        Another example. In my written statement I detail how
    collaborative technologies have fundamentally changed the way
    the Air Force operates by creating virtual air operations
    centers. Another example. The Navy and the Joint Forces have
    been able to put Tomahawk cruise missiles on target faster and
    more accurately during war.
        At the MITRE Corporation, as I have also submitted in my
    materials, there are several CIO magazine articles outlining
    our internal internet which has been used to share knowledge
    globally. These systems have improved the timeliness and
    quality of operational processes. For example, in a major
    exercise last year, the Air Force was able to improve their
    efficiency of operations by 50 percent. With focused effort,
    the foreign affairs community can enjoy these same benefits.
        My second point is that the success of the common platform
    for the Department of State will require both knowledge
    management and collaboration technologies. I will not detail
    these, but, in short, collaboration technologies are those that
    allow people to share information across time in both different
    times, as well as across different places.
        For example, if you want to support a team working at a
    different time and a different place, you could use electronic
    mail, or if they are working at the same time, but in different
    places, you could use technologies like instant messaging,
    technologies like desktop video conferencing.
        In contrast, knowledge management can be enabled by
    collaboration, but it is distinct, and it refers to processes
    that allow us to find experts, to map the knowledge in an
    enterprise or across enterprises, to integrate knowledge and to
    disseminate knowledge.
        My third point. Because of the difficulty of predicting how
    people and organizations will use collaboration tools and the
    rapidly changing underlying communications, networking and
    computing infrastructure, it is essential that the creation of
    these systems be done in what is called an incremental spiral
    acquisition process.
        This is in contrast to the traditional waterfall approach
    where development of a system follows a strict sequential
    process from requirements to design to implementation to
    testing and in contrast is more of an iterative process in
    which these things are done in parallel.
        Accordingly, the government needs to depart from its normal
    lengthy purchasing process to build a little, test a little,
    learn from mistakes and be willing to adapt to change. Planned
    obsolescence is part of this process, and these systems can be
    very costly. In fact, when you cost these systems you must look
    at full life cycle costs to include the cost to acquire the
    system, the cost to implement it, steady state costs, as well
    as indirect costs, including intangibles such as down time and
    user satisfaction.
        Incidentally, I have included in these articles the cost
    analysis that MITRE has utilized that was highlighted in the
    February CIO article where we invested $7 million and were able
    to show over $50 million in return on investment.
        While a spiral development process does not guarantee an
    inexpensive solution, it does minimize the risk that money will
    be wasted. Success in creating a secure common platform for the
    Department of State and other agencies requires clarity of
    vision, buy in from the foreign affairs community, explicit and
    measurable business outcomes, but flexibility in technology,
    schedule, budget and specifications.
        Mr. Chairman, I have a few more points. I do not know if
    you would like me to stop or finish.
        Chairman Gilman. Well, we are going to be called for a
    vote. Why do we not dig into the questions, if you would?
        Mr. Maybury. That is fine. Thank you.
        [The prepared statement of Mr. Maybury appears in the
    appendix.]
        Chairman Gilman. I want to thank all of you for being
    concise is your presentations.
        We will continue right on through the vote with the
    questioning. I am going to ask my colleagues if they would want
    to go, and we will continue so we will not have a delay.
        First of all, Mr. Burbano, last week Undersecretary Cohen
    stated that various technology systems were still out of date,
    even though the Department has replaced all of its Wang
    systems. When can we expect the needed reorganization to be
    achieved that is so sorely needed? Which systems are top
    priority, and do we have the appropriations that are needed to
    do what you are seeking?
        Mr. Burbano. Mr. Chairman, the answer to that question I
    think goes right to the heart. It is the funding. We do not
    have the funding to completely overhaul the systems.
        The majority of the unclassified systems have been
    modernized. The classified system is where we still have a
    lot----
        Chairman Gilman. How much will be needed, Mr. Burbano?
        Mr. Burbano. Approximately close to $200 million.
        Chairman Gilman. I understood from my staff that there is
    $500 million available for information technology. Is that fund
    available to you?
        Mr. Burbano. We are using it. I mean, it is not a fund that
    is available for things we have not used it for. Believe me, we
    are making use. Our budget is, you know, as stated earlier,
    $500 million.
        Chairman Gilman. So you are limited in the appropriations
    available to you?
        Mr. Burbano. Yes. Absolutely.
        Chairman Gilman. And what is the shortage?
        Mr. Burbano. For the classified systems, close to $200
    million.
        Chairman Gilman. You need another $200 million?
        Mr. Burbano. Yes.
        Chairman Gilman. Mr. Brock, your statement noted the State
    Department networks remain highly vulnerable to exploitation of
    unauthorized access. That is based on four computer security
    evaluations of its unclassified networks.
        What do these findings suggest for efforts to develop a
    common platform? Both Mr. Brock and Mr. Burbano, has any
    corrective action been taken? Have such risk assessments been
    made on the classified system? I direct that to both of you.
    Mr. Brock?
        Mr. Brock. First, I do not think that it is unusual that
    every time you do one of these vulnerability tests that you
    continue to find holes. One of the reasons that we advocate a
    continuing of vulnerability assessment is in fact to find holes
    because they always creep up. If you are not constantly
    vigilant, you will end up with a serious mess on your hands.
        We did not go in and evaluate the repairs that the State
    Department made. We did note that they did take corrective
    action in the four reports that we examined. The fact that
    reports, though, continue to show vulnerabilities, which again
    I do not find particularly surprising, indicates that there is
    still a need for constant vigilance.
        The thing the Department has done differently since our
    original report, though, is put in more centralized management
    and in fact established a control. Before our initial report
    they never did their own vulnerability studies. At least now
    they have the capability of determining on their own where they
    have weaknesses and then being able to take corrective action
    on a more timely basis.
        But again, that just points out that when you are putting
    in a new platform, as I mentioned in my oral statement, that in
    fact you are assuming a certain risk. You need to determine
    what that risk is. You need to determine the appropriate
    controls that should be in place to minimize that risk, and
    those controls are going to cost you some money. That has to be
    factored into the life cycle cost of the overall project.
        Chairman Gilman. Mr. Brock, you noted that the panel
    reported the condition of U.S. post submissions abroad as
    unacceptable, and the panel found the facilities overseas had
    deteriorated, human resource management practices are outdated
    and inefficient, and there is no interagency mechanism to
    coordinate overseas activities or manage their size and shape.
    What is your recommendation to correct that?
        Mr. Brock. Well, we did not specifically go over and
    evaluate those conditions, so we have made a general assumption
    based on other material that those conditions were reasonably
    and accurately reported.
        In fact, the process that the State Department is leading
    now is supposed to address those conditions and make
    improvements, which is one of the challenges that we mentioned.
    In fact, to get all eight or nine agencies to agree to make
    certain changes is going to be a difficult task.
        Chairman Gilman. I am going to reserve my questions. Mr.
    Bereuter has another engagement. I am going to pass the time to
    Mr. Bereuter.
        Mr. Bereuter [presiding]. Thank you, Mr. Chairman. I
    appreciate that courtesy.
        One of the difficulties for some of us is that you
    gentlemen use terminology which is not always clear to us, and
    I am sure we do the same, but, as I understand it, you are
    preparing or are you updating information architecture, a plan
    for information architecture for the State Department.
        Is it an update would you say realistically, or is it the
    first time you are comprehensively attempting to look at and
    develop an architecture? Mr. Burbano.
        Mr. Burbano. We have developed already, as in a written
    testimony in April 1999. We put out our first high level, as
    Mr. Brock stated. It is high level architecture that brings the
    State Department into the modern age, and we are developing
    right now the details of that IT architecture, so we came out
    with the first published IT architecture.
        There was a default one, you know, because you always
    operate with one, but it was not necessarily a formally
    published architecture prior to that one.
        Mr. Bereuter. Mr. Burbano, you heard the analogy used by
    Mr. Brock about the Rand McNally overall front page map, and he
    suggested that what is lacking to some extent----
        Mr. Burbano. Is the details.
        Mr. Bereuter [continuing]. Are the details within that
    overall framework.
        You have a good framework in place, as I understand your
    comment, Mr. Brock.
        How far do you intend to go in Mexico City, and where is
    the other pilot?
        Mr. Burbano. New Delhi.
        Mr. Bereuter. New Delhi. Are these picked because you think
    that they will be good models for you to work with, to make an
    assessment on?
        Mr. Burbano. Yes. In fact, you know, those models were
    picked with the whole interagency group; not just the IT
    interagency group, but the interagency group for OPAP that is
    overlooking the right sizing and the buildings/ facilities and
    the IT portion, the three groups underneath that. They are the
    ones that decided along with the three groups underneath that
    those were the best sites.
        The reason they are the best sites is because of the
    representation there from the other agencies, which is what you
    want to do for the collaboration.
        Mr. Bereuter. Now, what I am looking for is some
    reassurance that the plan that you are developing or refining
    for the information technology for the State Department will
    survive changes in technology.
        Mr. Burbano. Yes, it will, and that is one of the key
    points. It is a refresh. We are doing that right now with our
    very successful ALMA program, which is another logical
    modernization program that we have that replaced all these
    Wangs on the unclassified system. That was very successful.
        We have a refresh program, which is part of our Managing
    State Project management system that Mr. Brock spoke about that
    has been successful, and that includes a refresh to make sure
    we stay up to date. We are doing that right now with the ALMA
    system, and we did that also with the very successful Y2K
    system and also with the global overseas radio program.
        Mr. Bereuter. Thank you very much.
        Mr. Brock, I want to have some assurance that what is being
    developed in fact will survive upgraded technological changes
    that are brought to bear in terms of new equipment, new
    software, things that perhaps we do not even anticipate at this
    point.
        I want to understand that this plan is going to be
    survivable, that it will be credible, that it will reach beyond
    the current technology and that we will not find ourselves
    having to start all over picking up the pieces as a result of
    changes in technology.
        Do you have anything you can say to me about the plan as
    being developed?
        Mr. Brock. Well, I cannot offer you those assurances
    because the plan is not complete, but what you have really done
    is laid out a very basic expectation that is true of any
    architecture. That is one of the very first things that you
    need to do is to use this to provide some assurance that the
    dollars you are going to be spending are in fact not going to
    be wasted.
        The disadvantage of not having an architecture is that
    every investment that you make may or may not fit into the
    overall structure, so you have incompatible systems. You have--
    in other words, they do not talk to each other. You know, you
    buy Macs one place and PCs another place, and you cannot
    exchange software.
        We have numerous examples of where a lack of a defined
    architecture has caused agencies billions of dollars in wasted
    money, so I think the answer to your question, and I apologize
    for going on, is that right now I cannot provide you that
    assurance. I can provide you an assurance that they do have a
    high level architecture that makes sense.
        They are developing the necessary artifacts, the individual
    Rand McNally pieces, and those need to be examined as we go
    through the process to see if in fact they will provide that
    richness that you are asking for.
        Mr. Bereuter. I will just make one more statement really
    before I turn it over to Mr. Rohrabacher as I go to vote.
        I understand how difficult--I think I understand in part
    how difficult this interagency process might be to develop an
    agreement as to what is appropriate in taking secondary levels
    of benefits perhaps in order for the uniform effort to move
    ahead.
        I believe I understand that the intelligence community and
    the State Department have just basically decided they cannot be
    as compatible as the Congress had hoped they would be and that
    there is something in an appropriation bill, in an intelligence
    authorization bill, which suggests that that is the case, so I
    hope perhaps you might be able to address that in your comments
    for the record here. If I have given you enough information to
    proceed, I am asking any of you after I leave.
        Mr. Rohrabacher, are you ready to take over?
        Mr. Rohrabacher [presiding]. Thank you.
        Mr. Bereuter. Thank you.
        Mr. Rohrabacher. Oh-oh. I am in charge now.
        Doug, you left a question on the table?
        Mr. Bereuter. If they care to address it.
        Mr. Rohrabacher. Please feel free.
        Mr. Maybury. Yes. I would like to address that. The
    intelligence community is part of my IT subcommittee,
    interagency subcommittee. John Dams, who is the IC CIO for all
    the intelligence community, is a member, and he also has
    representation in the other groups.
        As far as I have seen directly, along with my other two
    subgroups, there has been excellent cooperation. There is buy
    in. The only statements that I have personally heard and also
    my group leaders has been that, you know, you have to make sure
    that we do not lower our security standards, which I totally
    agree, and nobody has said that we are going to lower them.
        In fact, the opposite. We are upping our security
    requirements because we know that the internet, you know, has
    holes like Swiss cheese, so we want to make sure that we
    strengthen our security. We are doing that, as I stated in my
    oral and written statements.
        You know, we are going to be using industrial strength
    firewalls, PKI, digital certificate and signatures and also
    encryption, anti-viruses, every available tool that is out
    there to properly do and transact business on the internet in a
    secure manner.
        As far as my relationships, and I am also a member, by the
    way, of the intelligence community CIO Council. I sit on the
    executive council. I work closely with John Dams, and as far as
    I know the intelligence community is, you know, on board with
    us. I have talked to John. As I mentioned, he is the
    representative for the intelligence community, and he is on
    board.
        Mr. Rychak. May I add to that?
        Mr. Rohrabacher. Yes. Sure.
        Mr. Rychak. I think it is also important that we make the
    distinction between our classified systems and the
    interconnectivity, the proposal to interconnect classified, and
    what is being done right now, and that is looking at our
    unclassified systems and interconnecting with the other
    agencies.
        Certainly the classified interconnectivity is a goal, but
    that is much longer term, and indeed there are some strong
    opinions as to how that could be done securely in the long run
    bringing in agencies that have very different backgrounds and
    sensitivities as it relates to information. The effort, though,
    that is ongoing right now deals with unclassified systems.
        Mr. Maybury. If I could make a comment? Two comments. One
    on the architecture point and one on the interoperability
    point.
        In my written statement with respect to the Department of
    Defense, we have been working for the past 5 years with many
    architectures, and I would strongly urge that there not be one
    architecture; there be several architectures that are tightly
    coupled.
        Just as you would not use the same map for a pilot as you
    would for somebody who is driving a truck as you would for
    somebody who is walking through a historic district in a city,
    you similarly will not use the same architecture in an
    information system for people who have different tasks or who
    are looking at different levels.
        To be specific, it is important to have a functional
    architecture, what you want to do with the system; a systems
    architecture, what are the components, what are the
    connections; and a technical architecture, that is one that
    specifies the standards, if you will, the rules of the road
    that show how these systems are going to work with one another.
    If you only have one of those, you have an incomplete
    architecture.
        With respect to technical standards, I have included in my
    written testimony the standards we use, which are international
    standards. They are not government standards. They are
    standards such as the International Telephony Union, such as
    the Engineering Task Force. These are standards bodies that
    build or, if you will, that specify the building codes to which
    commercial tools are created.
        It is essential that we have standards in interoperability
    that comes from those because if we want to protect ourselves
    from our investment and to insure interoperability in the
    future, those kinds of, if you will, building codes will help
    us do that.
        Mr. Burbano. If I can, I would like to add a point to that
    since the architecture is a very key point.
        To show you how committed and a firm believer I am in the
    architecture, we have actually gone beyond the Clinger Cohen
    requirements for IT architecture. We have also developed a
    business architecture and a security architecture, which will
    be a requirement in the near future, which is not a requirement
    right now, and we have those in draft. We are working with GAO
    on that.
        In terms of the collaboration, I would just like to say,
    because that was an issue that was brought out also in an
    earlier question. As I stated, because of Clinger Cohen I think
    that the OPAP implementation is going to be a lot easier than
    prior to Clinger Cohen because there is now a CIO Council, and
    the CIOs of the top 24 and also the other 50 CIOs or so of the
    small and medium agencies get together on a monthly/quarterly
    basis.
        That has produced a very strong collaboration that will
    spill over and is spilling over to the OPAP. That would not
    have existed prior to the Clinger Cohen, so I think we have
    excellent collaboration.
        Mr. Rohrabacher. Thank you very much.
        The Chairman is back, but I will, with the Chairman's
    permission, proceed with my 5 minutes.
        Chairman Gilman [presiding]. Please. Please.
        Mr. Rohrabacher. Which I have not had yet.
        Chairman Gilman. By all means.
        Mr. Rohrabacher. Let me just say, first of all, I stated
    something for the record at the beginning, and I just want to
    followup on that 1 minute, but let me just say that from my
    perspective it seems like we are starting this effort that you
    are talking about really late in the game here. This is near
    the end of this Administration, and all of a sudden we are
    talking about security.
        Quite frankly, Mr. Chairman, this Administration does not
    have a very good track record in terms of security in the
    operations of our Federal agencies. One need only look at the
    ongoing crisis, for lack of a better word, surrounding Los
    Alamos and what has been going on there for what appears to
    have been going on for years and years and years. I realize you
    folks are not responsible for that. Maybe you will have some
    responsibility for that or parts of that. I do not know.
        Then we hear stories about missing laptops. Now, where does
    this missing--I mean, I understand there is at least one
    missing laptop that dealt with top secret security information.
    Where does that fit into what you are doing here?

       STATEMENT OF WAYNE RYCHAK, DEPUTY ASSISTANT SECRETARY FOR
             DIPLOMATIC SECURITY, U.S. DEPARTMENT OF STATE

        Mr. Rychak. Sir, to answer your first question, security is
    not a new issue. The comments that Mr. Brock made regarding the
    improvements, and there have been substantial improvements
    within the information and security program at the State
    Department. Those have been occurring over the course of the
    last 3 years.
        When the GAO issued their report in the fall of 1998,
    frankly it was a wake up call for many of us that are in the
    operational side. We have focused great effort and attention in
    enhancing processes, as Mr. Brock has pointed out; processes
    such as security awareness training, vulnerability and risk
    assessments, evaluations, audits, network monitoring.
        Mr. Rohrabacher. Let me interrupt you for one moment.
        Mr. Rychak. Yes.
        Mr. Rohrabacher. And I respect all the procedural things
    and the descriptions of the type of--I mean, you are going
    through this in a systematic way and saying how can we make
    things better in relationship to a GAO report.
        It is difficult for me to understand how to instill a
    security consciousness among professionals like we have at the
    State Department who work for the government when we have an
    administration that is claiming that America's most severe
    potential enemy, America's worst potential enemy, is a
    strategic partner.
        I mean, for 2 years, for 3 years, we had the State
    Department over here, of course, doing what they were told to
    do because the President of the United States was making the
    policy that the Communist Chinese should be referred to and the
    operating words were strategic partner.
        It is difficult for me, frankly, to sit and to listen to a
    very serious discussion, which you are having here, about your
    procedures when it is done under an umbrella of or an
    atmosphere that is being created by an administration insisting
    on calling our worst potential enemy a partner, and not only
    just a partner, but a strategic partner.
        Now, I am not going to ask you to attack the Administration
    because you would not be diplomats if you did, but I just
    wanted to note that for the record.
        Let's go back. Let me go back to that first issue that I
    raised in my opening statement. Here we have, and I think
    rational people have to--I think rational people all along
    understood that Communist China was not our strategic partner,
    but was instead a potential enemy. I am not saying that they
    are an enemy, but at least our worst potential adversary.
        Here we have what almost everyone recognizes as our most
    dangerous potential adversary buying a building right across
    from the Pentagon with obvious electronic capability, spying
    capabilities. Has there been any discussion? There was no
    apparent objection from the State Department, which would have
    had some say in this.
        Have there been discussions with the Defense Department or
    the CIA concerning this potential security problem?
        Mr. Rychak. Sir, when you first raised this question you
    surmised that there would probably be no one on this panel that
    could directly answer, and you are correct.
        I will tell you that the Department's Office of Foreign
    Missions would be the entity that would normally deal with
    these types of issues, any acquisitions by foreign governments
    of property. I am sure that this office was involved.
        I cannot speak of any of the details. I learned of this, as
    you did, this morning on the news. We would have to get back to
    you on your question.
        Mr. Rohrabacher. But would it be the FBI would then be in
    touch with the State Department, who would then do something
    official in terms of looking into that to see if the charges
    that this was an arm of Chinese intelligence and if it was to
    make the appropriate moves to prevent this from happening?
        Mr. Rychak. It is normally----
        Mr. Rohrabacher. Is that the way it would work?
        Mr. Rychak [continuing]. FBI, State Department and then the
    intelligence community. It is normally a coordinated effort to
    look at the potential hazards and threats that could be posed
    by a foreign government's presence anywhere in the United
    States.
        Again, I cannot speak to any of the details, though, on
    this particular issue.
        Mr. Rohrabacher. And your role that we were talking about
    earlier is that when the agencies get together and they want to
    communicate via their computer system that you are just trying
    to see now that the computer system--someone does not hack into
    that or that that is a protected communications apparatus? Is
    that right?
        Mr. Rychak. Yes. Certainly one of my roles is to do what is
    necessary to put into place a comprehensive and effective
    security program to protect that information. Yes.
        Mr. Maybury. If I could make a comment on that?
        Mr. Rohrabacher. Sure. Go right ahead.
        Mr. Maybury. With respect to there are a whole set of
    vulnerabilities that I know the State Department is aware of
    and they have been actively addressing via a variety of
    mechanisms, such as access by unauthorized users, denial of
    service and so on.
        I think that it is important to note particularly when we
    talk about distributed collaboration systems that there are new
    classes of vulnerability that are inserted or potentially
    there. In fact, we are actively working with, and I cannot
    speak to this in this open session, but with government
    agencies to develop new technologies to apply to essentially
    protect some of these systems.
        For example, one might want to have if you are
    communicating instead of over a phone using a computer to
    communicate, you may want to encrypt that kind of audio, for
    example. These are new functions that will be made available in
    the future, but we do not have them yet. There are new
    vulnerabilities that we do not yet have protection for that we
    need to either invest in or create.
        Mr. Rohrabacher. Well, I am pleased to see that we have
    some people who understand all of this computer. We were just
    discussing this. Congressman Hastings and I were discussing
    that we are not experts, unlike Ben, who understands all of the
    new computer system and the new technology. We are very happy
    that we have some real professionals who are involved in this,
    and we thank you, Mr. Maybury, and you gentlemen for spending
    your time and your professional expertise in this.
        Just again for the record, I would like to say just again I
    am not doing this to be political, Al, but I just think the
    record of this Administration in this area has been--I worked
    for the White House for 7 years, and I remember what it was
    like, the atmosphere in the Reagan Administration concerning
    security issues, and the record of this Administration when you
    consider Los Alamos and some of these other things that we know
    about has just been abysmal.
        This Administration should hang its head in shame in terms
    of the national security interests of our country in terms of
    this area. I am pleased, however, at this part of the game and
    that some professional attention is being spent in this area.
        Thank you very much, Mr. Chairman.
        Chairman Gilman. Thank you, Mr. Rohrabacher.
        Judge Hastings.
        Mr. Hastings. Mr. Chairman, thank you so very much. My dear
    and good friend from California would not dare do anything
    political, nor would I.
        Under the circumstances, I remind him that when he worked
    at the White House in the Reagan Administration a call on a
    cell would have been from a jail. The IBM machine was
    considered something forward thinking, and everybody thought
    they had arrived. Indeed, most of what you were doing was using
    dictating machines.
        The problem that I have is that it seems that the
    technology is overwhelming, and I see that as problematical for
    not only our governmental agencies, but for all of us until we
    reach whatever the optimum condition is that it is likely to
    reach, and the way it is spiraling that is hard to envision
    taking place at some point in the not too distant future.
        I would like to ask two quick questions, and then I would
    like to just, if I could, give you an overview of what I just
    said with more specifics in mind.
        Mr. Burbano or Mr. Rychak, has the Diplomatic
    Telecommunications Services, which you know is an interagency
    common platform for secure communications, been a wise and
    effective investment from an electronic communications
    perspective, and how crucial do you feel the continued
    operation of DTS-PO as an interagency run common system to be
    for the success of a common computer system? Either of you.
        Mr. Burbano. OK. I will take first a first stab at it. DTS-
    PO, which you are speaking to, I think is important, and I
    think the collaboration among the agencies in the support of it
    is important.
        I think the problems have definitely been there due to not
    the organization, but funding. Frankly, it has been severely
    underfunded, and what has resulted, the biggest problem is the
    lack of band width to support the overseas community. That is
    funds, so it is a funding problem, but we need to maintain the
    organization, and it needs to be, you know, collaboration
    between parent companies.
        Mr. Hastings. All right. Thank you. Some years ago I had
    the good experience of visiting Australia for the first time,
    and I use this as just a metaphor, so to speak, for what I am
    about to suggest or ask.
        I did not know the fierce rivalry between Melbourne and
    Sydney. Apparently at one point they disliked each other so
    intensively that when they were building their rail systems,
    they built them in a manner that when they came together they
    did not fit.
        I am curious from your perspective whether or not we are
    involving enough people when we talk about collaborative
    networks, collaborative technology, interagency connectivity,
    and by that I meant this. I served in the judiciary, and we
    always were last to get stuff that was needed, yet we were
    involved in matters of security far beyond some of the things
    that I see here in the legislative branch.
        My concern is that at some point there has to be not just
    for the State Department or the CIA or the FBI or the Defense
    Department, but there has to be some collaboration with all of
    them, including the legislative, executive and judicial
    branches of our government, and calling upon experts from each
    of those areas to work with the people that are developing it.
    In other words, the State Department may fool around and
    develop the best, and GAO may not have that. We have seen that
    happen over and over again.
        Do any of you have that concern, or if I am talking about
    breadth as it pertains to security including all of government
    is that too much to ask?
        Mr. Brock. No, it is not. It gets back to a question Mr.
    Rohrabacher was going into.
        We have testified many times over the past year. The
    government has overall very poor computer security. There is no
    central leadership or management or limited central leadership
    and management. Some of the things that you are talking about
    such as the building overlooking the Pentagon going to threat
    assessment, the United States is not well equipped to do threat
    assessment. Information is not shared freely among agencies.
        The ``I LOVE YOU'' virus, which the State Department was
    internally successful at resisting, was not successfully
    resisted by many other agencies. The National Infrastructure
    Protection Agency at FBI did a very poor job of sharing
    information on the virus and coming up with relevant
    information.
        Earlier this year, the President released the national plan
    to protect the critical infrastructure. The key element of that
    plan was to say that the government will be a model so that the
    private sector will want to participate, and they acknowledge
    in that that the government is not a model; that there is a
    long way to go.
        So the issues you are talking about are much broader than
    the State Department.
        Mr. Hastings. Right.
        Mr. Brock. They do encompass other agencies, and they need
    to be looked at as part of a whole cloth.
        Mr. Hastings. Right. The other thing, Mr. Chairman, that I
    raise, and this will be my final question on this round, has to
    do with what I think is just good sense, and that is that, for
    example, on the criminal side of matters totally unrelated to
    the State Department.
        When a 17-year-old hacker is discovered that is brilliant
    and they take him to court, a lot of times they give him a
    job--do you understand what I am saying--so they can decide to
    use this kid. Now, that raises the question that I have.
        I listened to you all this morning, and just generally
    everyone that I have heard, from encryption all the way back
    across to all of the agencies that I have been faced with in my
    responsibilities as a policymaker, I have heard over and over
    and over from extraordinarily competent individuals like
    yourselves, and I do not mean that patronizingly. I do not know
    what either of you make. I suspect from my point of view you
    are underpaid by comparison to what happens in Silicon Valley
    and other places.
        I guess, Mr. Burbano, since you have the highest budget as
    I heard the Chair announce, do you feel that in an effort to
    accomplish just inside your agency the things that you need to
    accomplish that you would--a special category of funding to
    give to exceptional individuals to keep them on board or to
    bring in bright people? Would that be helpful?
        In other words, you have a GS whatever--I never have known;
    GS-14, GS-15--when you need to be paying somebody $200,000 to
    do what needs to be done. Am I off the mark here?
        Mr. Burbano. No. No. You are right on target. In fact, one
    of the things that I addressed besides computer security and
    Y2K was the work force issue was a priority of mine, and that
    was in fact what you were saying. Not only to recruit, but also
    train and also retain----
        Mr. Hastings. Retain.
        Mr. Burbano [continuing]. IT workers in security and all
    the other areas.
        What we in fact have done as a first step--I call it a
    first step because we need long term steps. We created the
    first agency in the Federal Government to create both a
    recruitment and retention allowance and bonus program, so for
    recruitment we have up to 25 percent recruitment bonus, and
    also we worked out with OPM so we can bring them in at higher
    grades and steps than normal, so that is on the recruitment
    end.
        On the training, we have added up to around $4 million
    extra to train our new employees, and to retain them we were
    certainly the first agency to come up with what we call
    retention allowance based on certifications like Microsoft,
    Oracle, Sysco, and also on, you know, whether you have a
    Bachelor's in Electronic Engineering or Master's in Computer
    Science and so forth. You can get up to 15 percent in retention
    pay, so we can keep those employees and not just bring them in
    the pipeline.
        We have done that. What still needs to be done, though, for
    the long term is we are still working with the ceiling, so you
    are very right. What we need to do, and the CIO Council and the
    State Department is working with the CIO Council to try to
    create a new IT pay scale across the whole Federal Government,
    not just State Department, that will be competitive with
    private industry.
        The National Academy for Public Administration [NAPA], has
    actually been chartered to do that study, which as you well
    know was chartered by Congress and is independent of the
    executive branch, is doing a study at the request of CIO
    Council and working with the CIO Council and OPM to look at the
    IT pay scale.
        Mr. Hastings. Well, I thank you all, and I thank you, Mr.
    Chairman.
        Mr. Maybury. Could I add a comment to that if it were
    useful? Just some facts for the record again in industry
    perspective.
        Seven out of the top ten fastest growth, according to the
    Department of Labor statistics, job categories are information
    technology job categories. Several years ago that was only
    about two or three. The average annual attrition rate of IT
    professionals in this country is roughly 14\1/2\ percent.
        Mr. Hastings. Would you say that again?
        Mr. Maybury. Fourteen and a half percent is roughly the
    average turnover rate nationally in terms of----
        Mr. Rohrabacher. Per year?
        Mr. Maybury. Per year. That means if you have 10 employees,
    all right, 1.4 of them will leave every year.
        Fifty thousand new graduates, both undergraduate and
    graduates, according to Education's statistics, will graduate
    every year. The annual growth rate in the IT industry is about
    130,000 jobs added every year. So you do the math, and, yes,
    there are the disciplines that people can come from, but there
    are not that many. You do the math, and there is a huge
    shortfall.
        We have been tracking this actually very closely in Defense
    obviously in the private sector, and I strongly concur with the
    activities that State and others have been doing in this area,
    and it will only get worse.
        Mr. Hastings. Thank you very much.
        Chairman Gilman. Thank you, Judge Hastings.
        Gentlemen, I have a few questions. Mr. Rohrabacher, if you
    have any additional questions.
        Dr. Maybury.
        Mr. Maybury. Yes, sir?
        Chairman Gilman. Your statement addresses the
    recommendation that State and the embassies have greater
    internet access, acknowledging the expansion of the internet
    can provide more pathways for intruders.
        How does one balance the need for a safe and secure system
    and yet greater access to the internet?
        Mr. Maybury. Well, I think one needs to do a business case
    analysis and to sort of have a managed approach to security.
    One needs to understand the risks and the vulnerabilities
    within those systems and then come up with a very specific
    understanding of what the costs, either those that are
    financial, national security or potential human life loss if it
    is a rather serious set of information, and one has to measure
    the associated reactions or preparations one can engage in to
    respond to those.
        In my testimony I give some specific examples of particular
    approaches, some of which State has already employed, to
    address those vulnerabilities.
        Chairman Gilman. So what you are saying is you can make any
    system secure. It is just how much you are willing to pay for
    it. Is that right?
        Mr. Maybury. Well, I want to be careful because, you know,
    there is no absolute security. Security includes personnel
    security, physical security, as well as electronic digital
    security.
        There are areas where we simply today do not have answers
    because, as I mentioned before, there are new technologies, new
    functions, including new vulnerabilities that are introduced
    into the infrastructure every day.
        What that means is if the risk is constantly changing, you
    have to be vigilant. You have to have a process that
    continually looks at those literally on a daily basis and comes
    up with corrective technologies, procedures, policies to
    address them.
        Chairman Gilman. Mr. Brock, in examining security aspects
    of all of this, is State Department doing something about
    making security a priority amongst its personnel?
        Mr. Brock. I think the State Department has made it a
    priority, but I think, as Dr. Maybury was alluding to, it has
    to be ongoing. It has to be constant.
        If I could just add a bit to his response? Most of the
    problems that we see on computer security when you are doing
    the tradeoffs between security and how much you want to spend
    is based on the absence of any sort of risk assessment; that
    you should not establish controls until you know what your risk
    is, and risk is a function of the threat and of the
    vulnerability of the system. So if you had a system with very
    limited threat and not very vulnerable, you do not need to
    spend much on control.
        Chairman Gilman. Who at State has the authority or the
    oversight on risk assessment?
        Mr. Brock. That would be Mr. Burbano.
        Chairman Gilman. Mr. Burbano, is someone doing the risk
    assessment?
        Mr. Burbano. Yes. In fact, it is a joint effort with my
    colleague, Wayne, in Diplomatic Security.
        We have established a very strong program. As an example,
    when I first came on board I worked with the Assistant
    Secretary for Diplomatic Security to bring in the first outside
    penetration testing, Lawrence Livermore, NR systems or
    unclassified systems.
        Since then we have done about three or four other
    penetration tests on not only the unclassified, but the
    sensitive but unclassified, classified systems. DS has done
    those.
        We also brought in Secure Computing Corporation to do
    penetration tests prior to the Y2K rollover when it was
    predicted there were going to be hundreds and thousands of
    hackers out there. We did that in November.
        We not only do the penetration vulnerable assessments and
    the risk management, but, more importantly, we do the
    remediations and make sure that whatever was found as holes
    that they are plugged up. As was stated earlier, you are always
    going to find holes, but we keep on plugging them. I feel we
    have done an excellent job of that.
        Not only have we done penetration tests, but we have also,
    as Mr. Rychak has stated, we have done an excellent outreach
    training program to make sure that the employees are cognizant
    of that such as I stated earlier with the Security Awareness
    Day, Critical Infrastructure Day, Hacker Day and individual
    training sections.
        You cannot log on to the internet without getting some DS
    training. You have to be certified to get that training for the
    internet in order to log on to our RICH internet access system.
    We have implemented the intrusion detection boxes, anti-
    viruses. You know, I can go on and on.
        Chairman Gilman. I am trying to understand, gentlemen, the
    division responsibility for computer security matters between
    DS and the CIO shop. Can you explain the division and why it
    makes sense?
        Mr. Rychak, do you have any special concerns about the
    splintering of responsibilities between the Diplomatic Security
    office and the chief information officer?
        Mr. Rychak. Sir, I would be happy to give you a background
    as it relates to the split of responsibilities.
        There are--there have been--overlapping authorities. The
    Diplomatic Security Act, going back to 1985, vested the Bureau
    of Diplomatic Security with a broad range of responsibilities.
    The Clinger Cohen Act and other Acts vest the CIO also with a
    broad range of security responsibilities as it relates to
    information and computer systems.
        Beginning about 2 years ago, the CIO's office, NDS, worked
    to identify the strengths and the operational capabilities of
    each of our organizations so that we could put together a clear
    delineation of roles, of responsibilities.
        Chairman Gilman. Are you satisfied with that delineation
    today?
        Mr. Rychak. The delineation I think is working well. Mr.
    Burbano and I may have some differences in opinions ultimately
    in perhaps who should be the senior lead authority, but let me
    say that that decision has been made. Our Undersecretary for
    Management has made the decision that the CIO is the lead
    authority for that.
        You are aware that the Secretary has proposed the creation
    of an Undersecretary for Security in an effort to further
    consolidate and establish senior level accountability for
    security.
        Computer security/information security I think will be
    reviewed in that context, and I do not know how that will come
    out, but I have to say that the system is working I think quite
    well, and it is collegial. It has been a partnership
    arrangement between the CIO and DS.
        Chairman Gilman. Let me interrupt you a moment.
        Mr. Rychak. Yes.
        Chairman Gilman. Between the two of you, who is responsible
    for the maintenance and computer security at the overseas posts
    and at main State office? Can you tell us? Between the two
    shops, how much money does State spend for security, and is
    there money dedicated to security for the information
    technology fund?
        Mr. Rychak. I can speak for my side. For the programs that
    DS administers, we are expending roughly $11.2 million this
    fiscal year for computer security related programs, and that
    deals with security awareness and training and vulnerability
    assessments, intrusion detection capabilities, and this is a
    program, frankly, we are very excited about that we are in the
    process of implementing on a global perspective.
        That is one piece of the puzzle. There are other programs
    that the CIO and IRM administer, and I am sure Fernando would
    like to address it, everything from virus protection to
    implementing these policies, etc.
        Mr. Burbano. Yes. I think one easy way at a high level to
    differentiate DS and IRM is DS is involved in the development
    of policy and also in the evaluations, assessments and so
    forth. IRM is involved, the CIO, in the implementation of that
    policy and so, I mean, that is one high level way of looking at
    that.
        Chairman Gilman. Are you pretty much both working
    collaboratively in main State and overseas?
        Mr. Burbano. Yes. Absolutely. I would like to reinforce
    what Mr. Rychak said. We have an excellent relationship. We
    work together. We created the matrix, and ever since we have
    had that I think things have gone very smoothly, and in fact we
    understand each other's areas, and we collaborate on all
    decisions.
        Chairman Gilman. Mr. Burbano, Mr. Brock's report at GAO
    pointed out that computer security lacks a focal point within
    State to oversee and to coordinate its security activities.
        Do you have the expertise available in your shop to manage
    the responsibility for computer security?
        Mr. Burbano. Yes, and in fact I think that was May, 1998.
    We are in 2000, and that has changed over the last year so that
    is no longer--I think Mr. Brock stated that that in fact was
    true when they did the assessment, but that was 2 years ago.
    That is not----
        Chairman Gilman. You have dedicated security----
        Mr. Burbano. Yes. Absolutely.
        Chairman Gilman [continuing]. Personnel.
        Mr. Burbano. We have computer incident response teams just
    like DS has that works around the clock, 7 by 24, in not only
    monitoring, but also in----
        Chairman Gilman. So it is not left up to non-professionals?
        Mr. Burbano. No. No. These are computers that carry
    specialists that are dedicated and trained in the field just
    like DS. DS and IRM and the CIO both have computer security
    staffs that are professionals.
        Chairman Gilman. Mr. Burbano, I understand Diplomatic
    Security sends out teams to audit security of computer systems
    at the various posts overseas, and they produce reports and
    recommendations.
        Who is responsible for seeing that any recommendations are
    carried out? Does Washington followup on those reports or
    supply technical experts if a post requests assistance to make
    a proper review?
        Mr. Burbano. Yes. IRM is responsible, along with the post
    and the bureaus, in implementing those changes because the
    posts are underneath the bureaus. So it is a joint effort, but
    the responsibility for implementing those recommendations do
    fall to IRM and the bureaus and the posts, and we do implement
    the changes.
        We work very closely together on these teams. In fact, we
    send out IRM computer security specialists along with DS on
    some of these assessments.
        Chairman Gilman. Mr. Brock, how would you characterize the
    effectiveness and the improvements that State has made in their
    computer security program today as compared to 2 years ago? Do
    you have any plans to reexamine the Department's security
    program?
        Mr. Brock. We believe that the organizational changes that
    have been made are very positive, and one of the key concerns
    that we had was the bifurcation of computer security
    responsibilities throughout the Department.
        When we have gone out and done our best practices work,
    even in highly decentralized organizations computer security
    was centralized. I think it is appropriate in an organization
    like State that you may have multiple entities carry out tasks,
    but it is clear that one person or one organization needs to be
    overall responsible, and that is something that we would like
    to continue to examine within the State Department.
        Chairman Gilman. Do you have any recommendations with
    regard to that?
        Mr. Brock. Well, at the present time, no. We currently are
    engaged in a number of agency reviews, and we do not have a
    request, if this is what you are moving toward. We have not had
    a request to go back in and do a thorough computer security
    review of the State Department.
        Chairman Gilman. Mr. Rychak or Mr. Burbano, who is
    responsible for investigating computer security violations, and
    who resolves the intrusions or attacks in the Department? Who
    conducts the followup?
        Mr. Rychak. I can address that. The response to an incident
    actually takes two different forms. DS has what is called a
    CIRT, a computer incident response team. It is a 24 hour
    operation of personnel, largely investigative, that would
    respond from an investigative standpoint.
        In sync with that, the CIO has a CERT, a computer emergency
    response team, that deals with the operational issues relating
    to mitigating any problems that would develop in our system.
        Chairman Gilman. Are they able to react very promptly to
    those?
        Mr. Rychak. Yes. Actually, those terms work together and
    often do it jointly.
        Mr. Burbano. If I can add, during the Y2K rollover we had
    our two teams sitting together in the same room sharing the
    monitors, sharing the times and everything, and it worked
    extremely well. We were not hacked during the Y2K rollover.
        Chairman Gilman. Mr. Burbano, is computer security training
    mandatory at State----
        Mr. Burbano. Yes, it is mandatory.
        Chairman Gilman [continuing]. For all State employees?
        Mr. Burbano. For all State employees, and that is not just
    recent. As I mentioned earlier, in order to connect to the RICH
    internet access system you have to have DS, you know, training,
    and you have to get certified first before you can log on.
        Chairman Gilman. How long a period of training is there?
    How extensive is it?
        Mr. Burbano. We have various levels. Since DS does them, I
    will let Wayne talk about it.
        Mr. Rychak. Well, the internet training is a briefing that
    would last maybe an hour, an hour and a half. It presumes that
    the employee already has the background of security procedures
    and requirements.
        There is a new training program that was begun about 18
    months ago that was the result of the GAO audit that I would
    just like to comment on, and that was training for our
    information systems security officers. We did not have a
    program in place prior to 18 months ago to train the people who
    worked on a day to day basis to insure that computer security
    policies were being carried out.
        We did put that program into effect. We have trained
    hundreds and hundreds of personnel. It has gotten excellent
    reviews. We have more senior level training that also is
    available to these personnel, and----
        Chairman Gilman. Mr. Rychak, are you satisfied that all of
    the important employees that use secure computers have been
    properly trained now?
        Mr. Rychak. No, I cannot say that I am completely
    satisfied. You may recall that the Secretary of State announced
    a directive following the discovery of the laptop computer that
    it would be mandatory for all employees of the Department of
    State, all cleared employees, to annually receive a briefing.
        We are in the process of a very intensive effort to do just
    that, and every day that goes by we have formal briefing
    sessions that are ongoing in our auditoriums at the Department.
        Chairman Gilman. How extensive has this program been, and
    how many have been brought in at this point? What percentage of
    the employees?
        Mr. Rychak. Sir, I think we are somewhere in the
    neighborhood of 8,000. Now, that is not addressing our overseas
    operations, which are being done individually by our
    professional regional security officers.
        Chairman Gilman. So what percentage of people who should be
    brought in have already been brought into your briefing
    session?
        Mr. Rychak. On the latest exercise since the Secretary's
    directive, I would say we are probably at about 30 or 40
    percent with the goal of completing this by the end of August
    or first of September. In other words, 100 percent.
        We are taking a role and roster of everyone that receives
    the briefings, and we will be able to identify anyone that has
    not. It is again a firm directive of the Secretary that this be
    done.
        Chairman Gilman. Dr. Maybury and Mr. Brock, does the
    Federal Government need a Federal chief information officer?
        Mr. Brock. Yes. When the Clinger Cohen bill was first
    introduced, it really established the framework for management
    of information technology from the agencies. At that time we
    testified that a national CIO was needed to in fact identify
    both opportunities and challenges across government that needed
    to be explored in a collegial manner, and we still support that
    position.
        Chairman Gilman. Have there been any steps undertaken to do
    just that?
        Mr. Brock. Yesterday I read an article that apparently both
    Mr. Gore and Mr. Bush support a national CIO, and one of your
    colleagues, Mr. Turner, has introduced legislation calling for
    a national CIO.
        Chairman Gilman. Mr. Burbano or Mr. Rychak, have you seen
    any progress made with regard to that proposal?
        Mr. Burbano. Other than what Mr. Brock just mentioned, no,
    but I would like to say that my personal opinion is I agree
    that one needs to be done, and I think one model could be right
    across the river here.
        In the State of Virginia, the Governor has created, you
    know, a Secretary of Technology to look both within the state
    government, but also outside for IT management. That is one
    model you might want to take a look at.
        Mr. Maybury. If I could suggest one other model would be a
    cross agency CIO would be the intelligence community CIO, Mr.
    John Dams' office.
        Chairman Gilman. Dr. Maybury points out that the success of
    instituting a collaborative system requires clear objectives
    that can drive change. Mr. Burbano, has the interagency working
    group identified such objectives?
        Mr. Burbano. At the high level, as Mr. Brock mentioned. We
    are getting down to the detail level, but for right now it is
    at the high level. Those were submitted in the written
    testimony both for the IT common platform and the knowledge
    management system. Some other detailed documents have been
    delivered to GAO and the Committee.
        Chairman Gilman. Dr. Maybury says one of the values of a
    collaborative environment is it can reduce the number of
    forward deployed personnel. That is, jobs can be done back
    home.
        Mr. Burbano, are you examining that kind of a prospect, and
    do you think that technology will in fact allow for fewer
    personnel to have to be stationed overseas, and would those
    jobs be mostly administrative?
        Mr. Burbano. The answer to the first part I would say is
    that the right sizing committee is the committee that is
    actually examining that. That is the right sizing committee.
        My committee, the IT, will support that effort, but, you
    know, will not be, you know, making the recommendations or the
    decisions on actually, you know, reducing or shifting staff.
    That is the right sizing committee.
        Yes, IT will support the right sizing efforts fully and
    can, but there are other issues other than technology when you
    are trying to make decisions. Right sizing does not
    automatically mean reduction of staff. It means shifting to,
    you know, proper support where you need that staff.
        Chairman Gilman. Dr. Maybury, the Committee is concerned
    about the risks involved in developing an overseas common
    information technology platform and whether State Department is
    positioned to lead that kind of a project.
        In your view, what can our Committee do to effectively
    oversee that kind of a project as it enters development and
    requires additional funding?
        Mr. Maybury. Well, I think, Mr. Chairman, regular oversight
    expectations have explicit objectives. I know in my testimony
    that the organization that does this needs to have a set of key
    characteristics that include excellence in acquisition, systems
    engineering experience, technical expertise in not only
    security, but in collaboration, knowledge management, cleared
    staff, especially if we are talking about secure and unsecure
    systems, domain knowledge of overseas activities, perhaps
    personnel overseas.
        That is another risk is do you have the IT talent or the
    infrastructure overseas, and do you have a strong contractor
    base or contractor oversight. I think having explicit plans,
    these blueprints or these maps we talked about before, these
    architectures, at various levels of detail and monitoring those
    activities, monitoring the investments and looking for actual
    outcomes, looking for specific measurable impact, business
    outcomes, of the investments.
        Chairman Gilman. Have you had an opportunity to discuss
    those proposals with Mrs. Cohen, Assistant Secretary for
    Management?
        Mr. Maybury. No, sir, I have not.
        Chairman Gilman. I hope you might take advantage of trying
    to do just that so that she would have the benefit of your
    thinking.
        One last question before I call on Mr. Sherman. Mr.
    Burbano, several U.S. Government agencies with global
    operations are seeking funding for separate communications
    systems. Different agencies want their own system.
        What are we doing to persuade those agencies that a single
    connected system designed on an interagency basis is probably
    much more preferable?
        Mr. Burbano. What we are doing is with the OPAP I think
    that gets down to the heart of this because those agencies are
    represented on the various OPAP committees. Also with the CIO
    Council we have an interoperability committee that works with
    the various CIOs of the various agencies, and then you have the
    IC, intelligence community, as was just stated earlier by Dr.
    Maybury, and I also sit on that, on the executive committee for
    the intelligence CIO committee, so we are all sitting in each
    others' committees and so we are well aware of all the things
    that are going on.
        I think OPAP is bringing to the forefront because the
    President's mandate and OMB and also the congressional
    leadership of wanting to implement OPAP that for the first time
    we actually have more than just, you know, intentions, but we
    actually have a mandate to implement these government wide
    systems.
        These are the same agencies that you are talking about, and
    there is a lot of collaboration going on, and I think it is
    beginning to take an effect. As we stated, first we are working
    on the unclassified first in the first 18 months, and then
    after that we work on the classified systems.
        Chairman Gilman. Well, we hope you can convince all of
    these competing agencies to work together. I think it is
    extremely important.
        Mr. Sherman.
        Mr. Sherman. Thank you, Mr. Chairman.
        I think we are all concerned with security of our
    information. Some recent problems experienced by another
    Federal department have highlighted that recently. I want to
    commend the Chairman for holding these hearings, which I think
    focus on information security, but I think others will ask
    questions about our national security information, and I want
    to focus my questions on the visa process.
        This is a process that has flabbergasted me because I did
    not think that governments could be this inefficient, and it
    takes really bad computers and bad management to achieve some
    of the problems that we have experienced in this area, and yet
    my hope is that the information technology system as it gets
    better will begin to solve some of those problems.
        One of the many areas of problems are difficulties in
    communicating via computer between the INS and the State
    Department. Have those been worked out?
        Mr. Burbano. I think we have worked some of them out,
    especially during the Y2K rollover. We had to make sure the
    systems, you know, communicated. There are other issues, and,
    you know, those--Consular Affairs, CA. You know, if you got to
    particulars I guess we could address them with Consular
    Affairs.
        Mr. Sherman. Well, I mean, first the Y2K thing. There are a
    number of countries in the world that thought the whole Y2K
    thing was a crock, invested nothing and tried to solve it and
    did just fine.
        We in Congress provided billions to try to improve our
    computer systems and deal with Y2K. I am glad the sky did not
    fall, but we paid an awful lot of money to keep the sky from
    falling, and it did not fall elsewhere.
        As to particular problems, when I hear from my district
    that a fiance visa is taking 2 years in some places and 2 days
    in other places and that the State Department will not
    reallocate resources to be fair to Americans, one who decides
    to marry a Filipino and another who decides to marry and
    English woman, that is bad management.
        When I am told that we do not have any records on whether a
    particular visa officer by visa officer as to their success
    rate--which visa officers are rejecting 30, 40, 50 percent of
    the requests? Which visa officers are seeing over stays or
    violations of U.S. immigration laws in 5 or 10 or 15 percent of
    the visas they grant?
        The problem with information technology is that you would
    provide accountability and require good judgment or spotlight
    bad judgment. When I have suggested various actions that would
    privatize these decisions by allowing people to get bail bonds,
    you know, we have the same--virtually an analogous issue on
    whether somebody will over stay in the United States and
    whether somebody will over stay their period of freedom before
    their trial.
        In the private area, in the domestic area, we have turned
    to bail bondsmen who privatize that decision and put their
    money where their mouth is. We refuse to do that in the State
    area because total capricious power unaccountable through any
    technology system seems to be the goal.
        I have been told that this continues only because it does
    not affect American citizens. Once the DMV in California was
    about 10 percent as bad, and the whole state demanded that it
    get better. It never reached these levels.
        What information technology do we have with regard to how
    long it takes from application to grant in visa matters in the
    various consulates and embassies around the world? Do we have
    that information?
        Mr. Burbano. No, but I can get it for you because that is
    in the Consular Affairs Office, in that bureau, and they have
    that.
        Mr. Sherman. Have you spent much time looking at their
    information system?
        Mr. Burbano. I would not say a tremendous amount of time
    because I have been dealing with the security and all these
    other elements, and they----
        Mr. Sherman. I cannot tell you that it is more important
    than national security, but----
        Mr. Burbano. Right.
        Mr. Sherman [continuing]. If you have some time, that is
    where you ought to deploy it because it is a bad system, and
    all the questions I have asked have come back, and just basic
    questions we ought to have.
        No accountability by person. The accountability works two
    ways. What I am worried about is that every visa officer will
    strangle our tourism industry if they feel oh, we will be held
    accountable for how many over stays. We ought to hold visa
    officers accountable for under grants and for excessive
    rejections, but we cannot because we do not have a system that
    will tell us.
        I do not know if you have anybody on the panel who is
    familiar with these issues. I see people shaking their heads.
        Chairman Gilman. We do not have people here from Consular
    Affairs. Do you have anything, Wayne?
        Mr. Rychak. No.
        Mr. Sherman. It surprises me to have a hearing on
    information technology, to have a distinguished panel of four
    and a back up group of several more and not to have anybody
    familiar with information technology in this area, but that
    shows that this is kind of a stepchild.
        We recently did receive a report. It was produced at my
    request. We have not been able to review it thoroughly, but it
    provides averages that I know are false because I have talked
    to people out in the field. When I complained that it took 2
    years to unify an American family I was told gee, that is
    standard. That is kind of what we do here in the Philippines.
    Then I get a report that says the average is 20 days, 30 days.
    I know it is not accurate.
        I realize none of you have come prepared to talk about
    these subjects. I hope that we would develop a visa system and
    perhaps, Mr. Burbano, you could let me know whether we are on
    the way,
        Mr. Burbano. Yes. I would be happy to get back to you.
        Mr. Sherman. That would keep track of how long things last,
    if things are lasting too long why, whether there have been
    congressional inquiries and how those have been resolved.
        I mean, I am dealing with a part of the State Department
    where I have been told that congressional involvement is
    detested and will also result in intentional delays, so this is
    an area where we need a good information system and appreciate
    your attention to it.
        Mr. Burbano. Yes. We will get back to you.
        Chairman Gilman. Thank you.
        Mr. Sherman. Thank you, Mr. Chairman.
        Chairman Gilman. Gentlemen? Dr. Cooksey? Gentlemen, I am
    going to have to go to another meeting, and I am going to ask
    Dr. Cooksey if he would lead further discussion in our
    subcommittee.
        I want to thank our panelists for your excellent testimony.
    You have given us a great deal of food for thought of what we
    arguably should be doing in our oversight capacity and even
    suggested some legislation that we will take a good, hard look
    at.
        We wish you continued success in what you are doing. Thank
    you very much.
        Mr. Cooksey [presiding]. Thank you, Mr. Chairman.
        It is great to be here. It is great to be here with people
    of your educational background. There are too many politicians
    in this city, and there are not enough scientists and computer
    experts.
        I do not have but about 35 questions. We should be through
    by 5 or 6 o'clock. Dr. is it Maybury?
        Mr. Maybury. Yes, sir.
        Mr. Cooksey. Yes. We have been together in a committee, and
    I forget which one. You have a Ph.D. in artificial intelligence
    I understand. Is that correct?
        Mr. Maybury. Yes, sir.
        Mr. Cooksey. What do you think about Kakoos' book, Visions?
    Have you seen the book? He is a theoretical physics professor
    in New York.
        Mr. Maybury. I have not seen the book, sir.
        Mr. Cooksey. It is really a good book, but he says we have
    a ways to go in artificial intelligence and robots, but it is
    fascinating some of the things that he proposes.
        Mr. Maybury. I would agree with that statement.
        Mr. Cooksey. Yes. He is very well documented. He talks
    about who is doing the good research and who is doing the other
    research.
        Along those lines, what do you think about change in the
    biometric system? I am a physician. I am an ophthalmologist.
    Change the password system from whatever you use now to a
    biometric system; for example, retinal patterns?
        Mr. Maybury. In fact, actually I referred in my oral
    testimony that there are a couple of technologies like
    fingerprint detection, like biometrics that, of course, can
    enhance security specifically for authentication. One could
    think even if you wanted to go so far as DNA testing to
    determine that you actually had the individual that you knew
    was accessing the system.
        I think authentication is an important area. I think that--
    I am not a biometric expert, but certainly those technologies
    have been used in secure facilities to control access.
        Mr. Cooksey. And they work?
        Mr. Maybury. Unfortunately, I cannot speak specifically to
    the performance. Obviously there are both probably precision
    and recall measures, technical measures, in terms of their
    performance. Perhaps others can.
        Mr. Rychak. Sir, I can address part of that.
        Mr. Cooksey. Yes?
        Mr. Rychak. There is a tremendous amount of research that
    is going on in the whole biomedical/biometric area. I think
    what you will find throughout the government and throughout the
    private sector is that no one countermeasure by itself is
    adequate, but used in combination and layered with other things
    you do--you can end up with a high level of security.
        We have a pilot program, for example, in the State
    Department right now of looking at combining biometrics with
    SMART card technology--you are probably familiar with SMART
    card and its capability--and combining those two to allow
    access into highly restricted areas to include highly
    restricted information systems.
        We really think that that probably is the future here, as
    opposed to simply relying on a password that obviously can be
    easily duplicated or in some cases found out about, you know.
        Mr. Cooksey. The passwords that we have used since the
    1970's.
        I helped a company in Boston design electronic medical
    records from ophthalmology. We have updated a lot of my
    technology, but still some of the passwords are old. It is very
    old technology.
        Yes, Mr. Burbano?
        Mr. Burbano. Yes. I wanted to add a comment. I agree. I
    think the biometrics systems are excellent, but it is a
    question of funding. That is the problem, you know. These
    systems are----
        Mr. Cooksey. Do you mean Congress will not give you enough
    money?
        Mr. Burbano. Well, that, but more importantly, the system,
    wherever the money comes from. What I am saying is it is very
    expensive compared to the password, so it is always a question
    of funding, to be honest with you. I mean, I think there are
    good systems, but you have to have the money to do them.
        As Mr. Rychak said, you know, we look at other
    alternatives. SMART card, you know, does not have the--
    necessarily. Somebody else could pick up the SMART card, PIN
    number or whatever, but you cannot pick up your eye, but it is
    a lot cheaper than that system, so it is a question of funding.
        Mr. Maybury. If I could say something? It is also obviously
    a question of technology. We at MITRE Corporation and many
    other companies have for years been using SMART cards with PINs
    to control and to authenticate users.
        In the future we can expect, among other things, for
    example, video cameras to be built into laptops, for example,
    so the opportunity to do facial ID, which is another area,
    also, potentially retinal scans cheaply is something that
    certainly, I cannot predict or give you a year, but it is
    certainly going to be cheaper in the future than it is
    presently.
        Mr. Cooksey. Kakoos says that computer chips will cost
    between 1 and 5 cents apiece. He says they will be in the
    drapes, and----
        Mr. Maybury. Right.
        Mr. Cooksey [continuing]. They will be able to sense
    weather changes, body temperature changes.
        Mr. Maybury. They will be built into your clothing.
        Mr. Cooksey. Clothing. Right.
        Mr. Maybury. Sure.
        Mr. Cooksey. He also said that they will use DNA instead of
    computer chips. That is a fascinating concept to think about.
    There is research being done on that.
        Mr. Maybury. Yes. In fact, we have some research on micro
    electronics. DARPA has a large program and specifically atonic
    level storage devices, computing devices and the like, so that
    is actually----
        Mr. Cooksey. That is an ongoing research.
        Mr. Maybury [continuing]. A new wave of computing
    technology.
        Mr. Cooksey. Well, it is exciting to think about, and that
    is the reason, that when you design an information system you
    have to think about the future and be able to move to it.
        Mr. Burbano, you had indicated in your testimony that your
    systems are protected with intrusion detection systems, that
    you will know if someone has intruded into the State Department
    system.
        Now, Mr. Brock said in his testimony that the State
    Department's automated intrusion detection system does not
    cover all of the domestic and overseas posts. Who is right?
        Mr. Rychak, you get to referee.
        Mr. Burbano. Actually, he is the one.
        Mr. Rychak. I probably can answer it.
        Mr. Burbano. Yes. He should answer it. I just wanted to
    make an initial statement and then I will turn it over, and
    that is that we are in the midst of implementing it so, I mean,
    he is right. We are not finished implementing it.
        Mr. Cooksey. Because your testimony basically--you
    contradicted each other.
        Mr. Burbano. No. I do not think so. It is a matter of
    implementation.
        Mr. Cooksey. You are not finished.
        Mr. Burbano. I will let Mr. Rychak give you the status of
    that.
        Mr. Rychak. Yes. We started the intrusion network program
    in December of this past year. Our goal is to have it completed
    by the second quarter of next fiscal year. Essentially what it
    encompasses is installing hardware/ software on every system at
    every embassy around the world to include our domestic
    facilities.
        As we speak, we have it in place at about 60 locations. The
    majority of our domestic sensitive but unclassified systems
    have coverage. Our financial centers overseas have coverage.
    The majority of our posts in South America have coverage, and
    we are systematically going through it in terms of the
    implementation.
        We do have a 24 hour by 7 monitoring operation that is
    fully in place, but, as Fernando says, we are not there yet. We
    are aggressively implementing this, but given the scope of what
    we are trying to do it just takes time to do it right.
        Mr. Burbano. Also the funding.
        Mr. Rychak. And the funding, although the funding for the
    first----
        Mr. Cooksey. Another appropriations matter.
        Mr. Rychak. Well, that is a good point because the funding
    for the first phase is covered. In other words, we have enough
    funding to continue the installation of the systems on our
    unclassified but sensitive systems.
        The second phase is to put identical protection for our
    classified systems. That is important. It has not been as
    critical in terms of our priority because the State
    Department's classified systems were not as interconnected as
    our unclassified systems. Frankly, we benefited from the fact
    that we had and continue to have a fair amount of antiquated
    technology out there.
        The unclassified systems were becoming increasingly
    vulnerable as we got into internet and as we became much more
    interconnected, so that became our first priority.
        Mr. Cooksey. Mr. Brock.
        Mr. Brock. One of the issues that has come up at other
    agencies where we have looked at automated intrusion protection
    programs is, first of all, this technology is fairly new. It is
    not very mature, and lots of advances are being made.
        You get an incredible amount of information. In some
    organizations it has literally overwhelmed the organization's
    capability to do the analysis, and as a result we have gone
    into some agencies where they made a good faith attempt
    initially to handle the information coming in, but then
    ultimately it began to stack up and pile up in back rooms and
    was not looked at, so a tool that is turned on but not used is
    pretty useless.
        I think a challenge that the State Department has in
    rolling this out is to make a decision or series of decisions
    on what kind of information they really want and how are they
    going to do the analysis because it is fairly people oriented.
    Even though the tools are automated, a lot of the analysis is
    not and does require trained personnel.
        Mr. Cooksey. Needless to say, that is a potential problem.
    Of course, you get into the issue of one big system that serves
    all needs. The IRS did not do very well. I think they spent $3
    billion or $4 billion and gave up. I think CSC has a contract
    now to do the IRS' work.
        Mr. Brock. Yes.
        Mr. Cooksey. Another question. I understand that the
    State--this is for you, Mr. Burbano. Does the State Department
    use a bulk e-mail system whereby the e-mails are held up until
    enough are collected, and then they are sent in bulk to reduce
    cost?
        Mr. Burbano. To reduce cost?
        Mr. Cooksey. Do you do bulk mailing of e-mail? If I sent an
    e-mail or let's say you sent an e-mail from Foggy Bottom to
    Bangkok and then there are ten other people on your staff that
    send e-mails there, are they all sent at one time in bulk, or
    are they sent--do they each go individually?
        Mr. Burbano. My understanding is that they go as they go.
    They have to go through Washington for the most part, but, I
    mean, they do not get bulked or anything.
        Wayne, do you have anything to add to that?
        Mr. Rychak. Yes. I am sorry. I cannot. I do not know.
        Mr. Burbano. I can look into it, but, I mean, the e-mail
    does not sit there. In fact, we have made a lot of improvements
    in our e-mail system in the last 6 months not only for
    security, but for speed wise where we have actually improved
    response time tremendously as a result of getting rid of a lot
    of the overhead that these e-mail systems have by implementing
    X.500, that type of technologies, directory type systems.
        Mr. Cooksey. Well, today I would like to ask everyone who
    is not here representing the PRC or Russia to stay and have all
    the rest of you leave, but I am afraid we still would not know
    who was here.
        I just assume. Every time I come to one of these meetings,
    I assume that there is someone here from some of our potential
    adversaries that I hope will become allies, but, you know, that
    is part of the intelligence game. They are here, and we have a
    democracy.
        Hopefully those countries will move to--until we have this
    perfect world where we trust all of our former adversaries and
    they trust us, intelligence is going to be necessary. We are
    going to spy on them, and they will spy on us.
        I just think it is absolutely mandatory that you maintain
    your diligence in having security in the information systems
    because people's lives are at stake, and there are people's
    lives probably that have already been lost or compromised just
    because of some less than perfect security measures in this
    country.
        You can look at what has been going on in New Mexico. I
    think it is really terrible that that has happened. I am still
    a clinical professor, and I got the feeling that there was an
    attitude of these professors that were involved, that were
    running that laboratory, that they were above having to go
    through all the security measures, and that is part of the
    reason things were lax.
        I think that there was some reason to believe that there
    was some active information gathering by some of our
    adversaries, and yet we have to be diligent to make sure that
    we have good countermeasures and make sure that they do not get
    information.
        I appreciate your coming. I think there are some real
    professionals over at the State Department. I do not always
    agree with the political decisions that are made there. The
    biggest problem we have in this city is you have too many
    career politicians that instead of voting first what is best
    for the Nation and then their state and then their district,
    they do what is best for their political career.
        I feel that the people that are permanent in the State
    Department do not make those decisions, and I think some of the
    worst mistakes that have been made in Republican
    administrations, and probably they are getting ready to gavel
    me down. I am getting out of line. And in Democratic
    administrations is because people do not have their priorities
    right, and it causes problems.
        I think that one of the most disgraceful things going on
    right now is what is going on in Africa. This Administration
    and this Congress have been so Euro centered and so centered on
    the Middle East. They have just totally ignored the fact that a
    million people were killed in Rwanda and Burundi and Ethiopia
    and Eritrea and Sierra Leone.
        It is cowardess on the part of the executive branch and
    callousness on the part of the legislative branch, which is my
    party that is in control, and the net result is that a lot of
    people have lost their lives that did not need to lose their
    lives.
        I hope you have courage of your convictions and continue to
    function in a very professional manner. It will be better for
    the nation, and what is better for our national will be better
    for the world.
        Thank you.
        [Whereupon, at 12:06 p.m. the Committee was adjourned.]

    =======================================================================

                                A P P E N D I X

                                 June 22, 2000

    =======================================================================

        [GRAPHIC] [TIFF OMITTED] T8288.001

        [GRAPHIC] [TIFF OMITTED] T8288.002

        [GRAPHIC] [TIFF OMITTED] T8288.003

        [GRAPHIC] [TIFF OMITTED] T8288.004

        [GRAPHIC] [TIFF OMITTED] T8288.005

        [GRAPHIC] [TIFF OMITTED] T8288.006

        [GRAPHIC] [TIFF OMITTED] T8288.007

        [GRAPHIC] [TIFF OMITTED] T8288.008

        [GRAPHIC] [TIFF OMITTED] T8288.009

        [GRAPHIC] [TIFF OMITTED] T8288.010

        [GRAPHIC] [TIFF OMITTED] T8288.011

        [GRAPHIC] [TIFF OMITTED] T8288.012

        [GRAPHIC] [TIFF OMITTED] T8288.013

        [GRAPHIC] [TIFF OMITTED] T8288.014

        [GRAPHIC] [TIFF OMITTED] T8288.015

        [GRAPHIC] [TIFF OMITTED] T8288.016

        [GRAPHIC] [TIFF OMITTED] T8288.017

        [GRAPHIC] [TIFF OMITTED] T8288.018

        [GRAPHIC] [TIFF OMITTED] T8288.019

        [GRAPHIC] [TIFF OMITTED] T8288.020

        [GRAPHIC] [TIFF OMITTED] T8288.021

        [GRAPHIC] [TIFF OMITTED] T8288.022

        [GRAPHIC] [TIFF OMITTED] T8288.023

        [GRAPHIC] [TIFF OMITTED] T8288.024

        [GRAPHIC] [TIFF OMITTED] T8288.025

        [GRAPHIC] [TIFF OMITTED] T8288.026

        [GRAPHIC] [TIFF OMITTED] T8288.027

        [GRAPHIC] [TIFF OMITTED] T8288.028

        [GRAPHIC] [TIFF OMITTED] T8288.029

        [GRAPHIC] [TIFF OMITTED] T8288.030

        [GRAPHIC] [TIFF OMITTED] T8288.031

        [GRAPHIC] [TIFF OMITTED] T8288.032

        [GRAPHIC] [TIFF OMITTED] T8288.033

        [GRAPHIC] [TIFF OMITTED] T8288.034

        [GRAPHIC] [TIFF OMITTED] T8288.035

        [GRAPHIC] [TIFF OMITTED] T8288.036

        [GRAPHIC] [TIFF OMITTED] T8288.037

        [GRAPHIC] [TIFF OMITTED] T8288.038

        [GRAPHIC] [TIFF OMITTED] T8288.039

        [GRAPHIC] [TIFF OMITTED] T8288.040

        [GRAPHIC] [TIFF OMITTED] T8288.041

        [GRAPHIC] [TIFF OMITTED] T8288.042

        [GRAPHIC] [TIFF OMITTED] T8288.043

        [GRAPHIC] [TIFF OMITTED] T8288.044

        [GRAPHIC] [TIFF OMITTED] T8288.045

        [GRAPHIC] [TIFF OMITTED] T8288.046

        [GRAPHIC] [TIFF OMITTED] T8288.047

        [GRAPHIC] [TIFF OMITTED] T8288.048

        [GRAPHIC] [TIFF OMITTED] T8288.049

        [GRAPHIC] [TIFF OMITTED] T8288.050

        [GRAPHIC] [TIFF OMITTED] T8288.051

        [GRAPHIC] [TIFF OMITTED] T8288.052

        [GRAPHIC] [TIFF OMITTED] T8288.053

        [GRAPHIC] [TIFF OMITTED] T8288.054

        [GRAPHIC] [TIFF OMITTED] T8288.055

        [GRAPHIC] [TIFF OMITTED] T8288.056

        [GRAPHIC] [TIFF OMITTED] T8288.057

        [GRAPHIC] [TIFF OMITTED] T8288.058

        [GRAPHIC] [TIFF OMITTED] T8288.059

        [GRAPHIC] [TIFF OMITTED] T8288.060

        [GRAPHIC] [TIFF OMITTED] T8288.061

        [GRAPHIC] [TIFF OMITTED] T8288.062

        [GRAPHIC] [TIFF OMITTED] T8288.063

        [GRAPHIC] [TIFF OMITTED] T8288.064

        [GRAPHIC] [TIFF OMITTED] T8288.065

        [GRAPHIC] [TIFF OMITTED] T8288.066

        [GRAPHIC] [TIFF OMITTED] T8288.067

        [GRAPHIC] [TIFF OMITTED] T8288.068

        [GRAPHIC] [TIFF OMITTED] T8288.069

        [GRAPHIC] [TIFF OMITTED] T8288.070

        [GRAPHIC] [TIFF OMITTED] T8288.071

        [GRAPHIC] [TIFF OMITTED] T8288.072

        [GRAPHIC] [TIFF OMITTED] T8288.073

        [GRAPHIC] [TIFF OMITTED] T8288.074

        [GRAPHIC] [TIFF OMITTED] T8288.075

        [GRAPHIC] [TIFF OMITTED] T8288.076

        [GRAPHIC] [TIFF OMITTED] T8288.077

        [GRAPHIC] [TIFF OMITTED] T8288.078

        [GRAPHIC] [TIFF OMITTED] T8288.079

        [GRAPHIC] [TIFF OMITTED] T8288.080

        [GRAPHIC] [TIFF OMITTED] T8288.081

        [GRAPHIC] [TIFF OMITTED] T8288.082

        [GRAPHIC] [TIFF OMITTED] T8288.083

        [GRAPHIC] [TIFF OMITTED] T8288.084

        [GRAPHIC] [TIFF OMITTED] T8288.085

        [GRAPHIC] [TIFF OMITTED] T8288.086

        [GRAPHIC] [TIFF OMITTED] T8288.087

        [GRAPHIC] [TIFF OMITTED] T8288.088

        [GRAPHIC] [TIFF OMITTED] T8288.089