    [House Hearing, 106 Congress]
    [From the U.S. Government Publishing Office]

                         COMPUTER SECURITY REPORT CARD

    =======================================================================

                                    HEARING

                                   before the

                     SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
                          INFORMATION, AND TECHNOLOGY

                                     of the

                                  COMMITTEE ON
                               GOVERNMENT REFORM

                            HOUSE OF REPRESENTATIVES

                           ONE HUNDRED SIXTH CONGRESS

                                 SECOND SESSION

                                   __________

                               SEPTEMBER 11, 2000

                                   __________

                               Serial No. 106-260

                                   __________

           Printed for the use of the Committee on Government Reform

      Available via the World Wide Web: http://www.gpo.gov/congress/house
                          http://www.house.gov/reform

                       U.S. GOVERNMENT PRINTING OFFICE
    74-495                     WASHINGTON : 2001

    _______________________________________________________________________
     For sale by the Superintendent of Documents, U.S. Government Printing
                                     Office
    Internet: bookstore.gpo.gov  Phone: (202) 512-1800  Fax: (202) 512-2250
                   Mail: Stop SSOP, Washington, DC 20402-0001

                         COMMITTEE ON GOVERNMENT REFORM

                         DAN BURTON, Indiana, Chairman
    BENJAMIN A. GILMAN, New York         HENRY A. WAXMAN, California
    CONSTANCE A. MORELLA, Maryland       TOM LANTOS, California
    CHRISTOPHER SHAYS, Connecticut       ROBERT E. WISE, Jr., West Virginia
    ILEANA ROS-LEHTINEN, Florida         MAJOR R. OWENS, New York
    JOHN M. McHUGH, New York             EDOLPHUS TOWNS, New York
    STEPHEN HORN, California             PAUL E. KANJORSKI, Pennsylvania
    JOHN L. MICA, Florida                PATSY T. MINK, Hawaii
    THOMAS M. DAVIS, Virginia            CAROLYN B. MALONEY, New York
    DAVID M. McINTOSH, Indiana           ELEANOR HOLMES NORTON, Washington,
    MARK E. SOUDER, Indiana                  DC
    JOE SCARBOROUGH, Florida             CHAKA FATTAH, Pennsylvania
    STEVEN C. LaTOURETTE, Ohio           ELIJAH E. CUMMINGS, Maryland
    MARSHALL ``MARK'' SANFORD, South     DENNIS J. KUCINICH, Ohio
        Carolina                         ROD R. BLAGOJEVICH, Illinois
    BOB BARR, Georgia                    DANNY K. DAVIS, Illinois
    DAN MILLER, Florida                  JOHN F. TIERNEY, Massachusetts
    ASA HUTCHINSON, Arkansas             JIM TURNER, Texas
    LEE TERRY, Nebraska                  THOMAS H. ALLEN, Maine
    JUDY BIGGERT, Illinois               HAROLD E. FORD, Jr., Tennessee
    GREG WALDEN, Oregon                  JANICE D. SCHAKOWSKY, Illinois
    DOUG OSE, California                             ------
    PAUL RYAN, Wisconsin                 BERNARD SANDERS, Vermont
    HELEN CHENOWETH-HAGE, Idaho              (Independent)
    DAVID VITTER, Louisiana

                          Kevin Binger, Staff Director
                     Daniel R. Moll, Deputy Staff Director
                         James C. Wilson, Chief Counsel
                            Robert A. Briggs, Clerk
                     Phil Schiliro, Minority Staff Director
                                     ------

       Subcommittee on Government Management, Information, and Technology

                       STEPHEN HORN, California, Chairman
    JUDY BIGGERT, Illinois               JIM TURNER, Texas
    THOMAS M. DAVIS, Virginia            PAUL E. KANJORSKI, Pennsylvania
    GREG WALDEN, Oregon                  MAJOR R. OWENS, New York
    DOUG OSE, California                 PATSY T. MINK, Hawaii
    PAUL RYAN, Wisconsin                 CAROLYN B. MALONEY, New York

                                   Ex Officio

    DAN BURTON, Indiana                  HENRY A. WAXMAN, California
              J. Russell George, Staff Director and Chief Counsel
                      Ben Ritt, Professional Staff Member
                               Bryan Sisk, Clerk
                        Trey Henderson, Minority Counsel

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on September 11, 2000...............................     1
    Statement of:
        Dyer, John R., Chief Information Officer, Social Security
          Administration.............................................   142
        Gilligan, John, Chief Information Officer, Department of
          Energy, cochair, security, privacy and critical
          infrastructure committee, Chief Information Officers
          Council....................................................   116
        Hobbs, Ira L., Deputy Chief Information Officer, Department
          of Agriculture.............................................   184
        Hugler, Edward, Deputy Assistant Secretary for Administration
          and Management, Department of Labor........................   179
        Singleton, Solveig, director of information studies for the
          CATO Institute.............................................   201
        Spotila, John T., Administrator, Office of Information and
          Regulatory Affairs, Office of Management and Budget........    27
        Tanner, Mark A., Information Resources Manager, Federal
          Bureau of Investigation, Department of Justice.............   193
        White, Daryl W., Chief Information Officer, Department of the
          Interior...................................................   155
        Willemssen, Joel, Director, Accounting and Information
          Management Division, U.S. General Accounting Office,
          accompanied by Robert Dayce, Director for Computer Security
          Issues, General Accounting Office..........................    95
    Letters, statements, etc., submitted for the record by:
        Dyer, John R., Chief Information Officer, Social Security
          Administration, prepared statement of......................   145
        Gilligan, John, Chief Information Officer, Department of
          Energy, cochair, security, privacy and critical
          infrastructure committee, Chief Information Officers
          Council, prepared statement of.............................   120
        Hobbs, Ira L., Deputy Chief Information Officer, Department
          of Agriculture, prepared statement of......................   186
        Horn, Hon. Stephen, a Representative in Congress from the
          State of California:
            Letter dated July 27, 2000...............................    46
            Prepared statement of....................................     4
        Hugler, Edward, Deputy Assistant Secretary for Administration
          and Management, Department of Labor, prepared statement of.   181
        Singleton, Solveig, director of information studies for the
          CATO Institute, prepared statement of......................   204
        Spotila, John T., Administrator, Office of Information and
          Regulatory Affairs, Office of Management and Budget,
          prepared statement of......................................    31
        Tanner, Mark A., Information Resources Manager, Federal
          Bureau of Investigation, Department of Justice, prepared
          statement of...............................................   196
        Turner, Hon. Jim, a Representative in Congress from the State
          of Texas, prepared statement of............................    25
        White, Daryl W., Chief Information Officer, Department of the
          Interior, prepared statement of............................   157
        Willemssen, Joel, Director, Accounting and Information
          Management Division, U.S. General Accounting Office,
          prepared statement of......................................    97

                         COMPUTER SECURITY REPORT CARD

                                  ----------

                           MONDAY, SEPTEMBER 11, 2000

                      House of Representatives,
    Subcommittee on Government Management, Information,
                                        and Technology,
                                Committee on Government Reform,
                                                        Washington, DC.
        The subcommittee met, pursuant to notice, at 10 a.m., in
    room 2154, Rayburn House Office Building, Hon. Stephen Horn
    (chairman of the subcommittee) presiding.
        Present: Representatives Horn and Turner.
        Staff present: J. Russell George, staff director and chief
    counsel; Randy Kaplan, counsel; Ben Ritt, professional staff
    member; Bonnie Heald, director of communications; Bryan Sisk,
    clerk; Elizabeth Seong, staff assistant; George Fraser, intern;
    Michelle Ash and Trey Henderson, minority counsels; and Jean
    Gosa, minority assistant clerk.
        Mr. Horn. The quorum being present, this hearing of the
    Subcommittee on Government Management, Information, and
    Technology will come to order.
        We're here today to discuss one of the Federal Government's
    most important and ongoing challenges, the security of
    government computers. Computers and the Internet are
    revolutionizing the way we do business, conduct research and
    communicate with friends and associates. The benefits are
    enormous as vast amounts of information flow instantly from
    business to business and individual to individual, but
    widespread access to computers and the Internet also carries
    the significant risk that personal, financial or business
    information can fall into the hands of computer hackers or
    others with more malicious intent.
        Similarly, as the Federal Government becomes increasingly
    dependent on computers and the Internet, the computer systems
    and the sensitivity of information they contain come under an
    increasing number of attacks. Unlike the year 2000 or Y2K
    computer challenge, this threat has no deadline. Rather it is a
    day-to-day challenge created by an increasingly sophisticated
    technology. In order to guarantee the integrity of the Federal
    programs and to protect the personal privacy of all Americans,
    government leaders must focus their attention on the security
    of their vital computer systems.
        Today the subcommittee is releasing its first report card
    on the status of the computer security at executive branch
    departments and agencies. These grades are based on self-
    reported evaluation of agency information, in addition to the
    results of audits conducted by the General Accounting Office
    and the various agency inspectors general. This is the first
    time such governmentwide information has ever been compiled.
        As you can see, only two agencies have made progress toward
    protecting their computers against invasion. Although auditors
    found some significant weaknesses at the Social Security
    Administration and National Science Foundation, both agencies
    received Bs, the highest grade awarded. But the rest of the
    picture is very dismal. Overall the government earned an
    average grade of D minus. More than one-quarter of the 24 major
    Federal agencies received a failing F; the Department of Labor,
    charged with maintaining vital employment statistics, an F; the
    Department of the Interior, which manages the Nation's public
    lands, an F; the Department of Health and Human Services that
    holds personal information on every citizen who receives
    Medicare, another F; Agriculture and Justice, the Small
    Business Administration, the Office of Personnel Management,
    the personnel office for the entire executive branch of the
    Federal Governments, all Fs.
        Six other vital agencies nearly failed. The Department of
    Defense, whose computers carry some of the Nation's most
    sensitive secrets, earned only a D plus for its computer
    security program; Veterans Affairs and Treasury, along with the
    Environmental Protection Agency, General Services
    Administration and National Aeronautics and Space
    Administration, more Ds.
        Four other government agencies received grades of
    incomplete. These vital agencies oversee key elements of the
    Nation's infrastructure and emergency services. They are the
    Departments of Energy and Transportation, the Nuclear
    Regulatory Commission and the Federal Emergency Management
    Agency [FEMA]. These agencies could not receive a grade because
    there has been insufficient auditor resources and scrutiny to
    validate the agencies' self-evaluations.
        Obviously there is a great deal of work ahead. Regardless
    of grade, each agency must recognize that the daily challenges
    to their computer systems will continue to grow in number and
    sophistication. They must take the necessary steps to mitigate
    those threats. There is no room for complacency, for the stakes
    are simply too high.
        We have with us today witnesses representing six of the
    agencies that were graded. They will discuss their agency's
    progress and plans to develop acceptable computer security
    procedures.
        Mr. John Gilligan from the Department of Energy will also
    testify on behalf of the Chief Information Officers Council. In
    addition, we have the Honorable John Spotila from the Office of
    Management and Budget, which is charged with overseeing the
    agency's computer security efforts; and Mr. Joel Willemssen
    from the General Accounting Office, which works for the
    legislative branch, headed the Comptroller General of the
    United States. And I want to thank Comptroller General Walker
    and the staff for their excellent help in regard to the grades
    and everything else. I take the responsibility for the grades,
    but they sat for hours with us on making sure that we've been
    fair.
        We have the ability, the government has the ability, to
    protect the integrity of the vital computer systems. As I look
    back, this is sort of where we were on Y2K in April 1996. There
    are a lot of Fs, a lot of Ds, but the executive branch came
    through on midnight January 1 where it counted, and I am
    confident that the executive branch will do the same thing this
    time.
        We welcome all of our witnesses, and we look forward to
    their testimony.
        I now yield to the ranking member for an opening statement,
    the gentleman from Texas Mr. Turner.
        [The prepared statement of Hon. Stephen Horn follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.001

        [GRAPHIC] [TIFF OMITTED] T4495.002

        [GRAPHIC] [TIFF OMITTED] T4495.003

        [GRAPHIC] [TIFF OMITTED] T4495.004

        [GRAPHIC] [TIFF OMITTED] T4495.005

        [GRAPHIC] [TIFF OMITTED] T4495.006

        [GRAPHIC] [TIFF OMITTED] T4495.007

        [GRAPHIC] [TIFF OMITTED] T4495.008

        [GRAPHIC] [TIFF OMITTED] T4495.009

        [GRAPHIC] [TIFF OMITTED] T4495.010

        [GRAPHIC] [TIFF OMITTED] T4495.011

        [GRAPHIC] [TIFF OMITTED] T4495.012

        [GRAPHIC] [TIFF OMITTED] T4495.013

        [GRAPHIC] [TIFF OMITTED] T4495.014

        [GRAPHIC] [TIFF OMITTED] T4495.015

        [GRAPHIC] [TIFF OMITTED] T4495.016

        [GRAPHIC] [TIFF OMITTED] T4495.017

        [GRAPHIC] [TIFF OMITTED] T4495.018

        [GRAPHIC] [TIFF OMITTED] T4495.019

        [GRAPHIC] [TIFF OMITTED] T4495.020

        Mr. Turner. Thank you, Mr. Chairman.
        As we all understand, our Federal agencies rely on
    computers and electronic data to perform functions that are
    essential to our national welfare and directly affect the lives
    of millions of Americans.
        This technology greatly benefits Federal operations through
    the speed and accessibility it provides, but it also creates
    vulnerability to attack. Individuals, organizations and
    virtually anyone today with a computer and a modem has the
    potential to interrupt and to eavesdrop on government
    operations around the world. Many experts are predicting that
    future wars will be in the form of cyberattacks and fought out
    over a computer grid rather than a battlefield.
        I want to commend the chairman for his interest and his
    work on this important issue. Computer security is without a
    doubt one of the most critical and difficult technical
    challenges facing our government. Like Y2K, this subcommittee
    has an important oversight role in holding our Federal agencies
    accountable for implementing computer security efforts, and
    while I commend the chairman's efforts to reduce the task to a
    simple report card grade, I also realize that improving
    computer security is a very complicated, timely and costly
    process.
        Additionally, I do understand that the subjective format of
    our grading system could in some cases unfairly portray the
    significant efforts an agency has made to take corrective
    actions. I realize that some agency computer systems are
    critical to national security, while others may not be. I also
    realize that this Congress has an obligation to provide
    adequate funding to agencies so that they might meet the
    requirement that we have imposed on them.
        While I want to commend the agencies that are moving
    forward, it is clear that the Federal Government has a long way
    to go before an effective, comprehensive Federal computer
    security system is in place. It is my hope that as a result of
    these hearings, we will be closer to achieving our mutual goal.
    We want to make sure that the Federal managers have the tools
    and the funds in place to be accountable for the protection of
    agency infrastructures.
        Again, I thank the chairman for calling this hearing. I
    appreciate the good work that the committee and the staff has
    done, and I look forward to hearing from each of our witnesses.
        Thank you, Mr. Chairman.
        [The prepared statement of Hon. Jim Turner follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.021

        [GRAPHIC] [TIFF OMITTED] T4495.022

        Mr. Horn. Well, we thank you, and I agree with you. We need
    to be talking to the authorizers and the appropriators to make
    sure that what is needed will be there. So I imagine the next
    round we should have some improvement.
        We will now start with the witnesses, and along the agenda
    the Honorable John Spotila is the Administrator, Office of
    Information and Regulatory Affairs, Office of Management and
    Budget, part of the President's Executive Office of the
    President, and he is speaking on behalf of OMB today.
        So, Mr. Spotila.

        STATEMENT OF JOHN T. SPOTILA, ADMINISTRATOR, OFFICE OF
     INFORMATION AND REGULATORY AFFAIRS, OFFICE OF MANAGEMENT AND
                                 BUDGET

        Mr. Spotila. Good morning, Mr. Chairman and members of the
    committee. Thank you for inviting me here to discuss OMB's
    efforts in the vital area of computer security.
        OMB policies build on a statutory framework requiring that
    Federal agencies adopt a set of risk-based management controls
    for all Federal computer systems. The agencies must
    periodically review their security controls to ensure continued
    effectiveness.
        In an effort to identify strengths and weaknesses in agency
    security programs, OMB sought updated information from the
    agencies in June 1999 on their risk management processes. We
    are now focusing on the security posture of 43 high-impact
    government programs where good security is particularly
    important. These programs include Medicare, Medicaid, the air
    traffic control system, Social Security and Student Aid. In
    late May of this year, we asked the agencies to send us
    specific information regarding the management, operational and
    technical controls in place for each application or general
    support system sustaining these programs.
        Our preliminary findings are illuminating. We have made
    significant progress, but can still do better. Agencies are
    working to integrate security into their capital planning and
    investment control processes. We have made this a high
    priority. Many agencies have completed a security review of
    their systems and have updated their security plans within the
    last 2 years. Many agencies develop and share their security
    plans with their partner organizations and other agencies. This
    promotes a comprehensive understanding of the interconnections
    prevalent in a shared risk environment.
        Due to their extensive Y2K work, most agencies have tested
    their continuity of operations plans within the last 2 years.
    Most agencies have provided users and system administrators
    with IT security training within the last year. Most agencies
    update their virus detection and elimination software on an
    ongoing basis and have successfully implemented processes to
    confirm the testing and installation of software patches in a
    timely manner.
        Nearly all agencies have documented incident handling
    procedures and have a formal incident response capability in
    place. More agencies need to install firewalls at external
    entry points to exclude unauthorized users and within their
    networks to ensure that authorized users do not exceed
    authorization.
        Agencies can better protect the confidentiality of
    sensitive material through increased use of encryption for
    password files and personal information. Agencies should
    improve their intrusion detection capabilities and procedures.
    This should include increased involvement of agency privacy
    officers and legal counsel in reviewing the monitoring
    activities.
        More agencies should ensure that agency managers
    specifically authorize the processing of each new or updated
    system before actual operations begin. More agencies should
    have independent review of their security plans.
        We are working with the agencies on all of these areas. The
    President, his chief of staff and the Director of OMB have all
    taken a personal interest in enhancing security for our
    interconnected systems. This has gone a long way to establish
    senior management support at the agencies.
        In February, OMB issued important guidance to the agencies
    on incorporating security and privacy requirements in each of
    their fiscal year 2002 information technology budget
    submissions.
        A well-known computer security expert, Robert Courtney,
    once said, ``Good security is the ultimate non-event.'' In that
    phrase, he summarized the difficulty of measuring effective
    security. We face a significant challenge. We must devise a
    method to assess security for the whole of government, its
    thousands of vastly diverse systems and millions of desktop
    computers. No other organization faces demands in this area
    that are as broad as those the government confronts.
        Since last fall, OMB has worked with the CIO Council, NIST,
    GAO and the agencies to develop security performance measures
    against which agencies can assess their security programs. As
    you know, CIO Council and NIST representatives have met with
    your staff to discuss this effort. We have made great progress
    in a relatively short period of time, but, not surprisingly,
    there is more to be done. Even the private sector is struggling
    with this challenge.
        Mr. Chairman, clearly you are focused on the need to assess
    agency security programs. While we appreciate your serious
    interest in security and your belief that grades will help the
    agencies improve their performance, we do have some concerns
    with this approach. We look forward to working closely with you
    to develop better ways of measuring progress in this area. We
    learned much from our collegial efforts with the committee, GAO
    and the agencies in developing good Y2K measurements. Ideally,
    we should work together to develop a similar workable set of
    measurements for assessing agency security programs.
        Measuring agency security effectiveness is at least as
    complex as the Y2K measurement effort. We must assess programs
    and implementation at three different levels: the relatively
    uniform agency management or executive level; the expansive mix
    of individual programs where agency business operations take
    place; and at each of the thousands of government information
    systems that support actual agency program operations.
        Cursory measurements can be misleading. A well-documented
    security program without the periodic evaluation of control
    effectiveness can give a false sense of security. A weak
    central organization can obscure highly effective component,
    program or system-level security. We must take a comprehensive
    approach to evaluating security if we are to generate
    meaningful results.
        Our assessment approach begins with the premise that all
    agency programs and systems must include a continuing cycle of
    risk management, appropriate methods to evaluate and measure
    performance, and the ability to anticipate or quickly react to
    changes in the risk environment.
        We are putting great emphasis on agency self-assessment.
    This fall all agencies will use a NIST-prepared questionnaire
    that focuses on overall agency programs as well as on specific
    management, operational and technical controls applied to each
    system or group of systems. Assessing the effectiveness of the
    program and the individual controls, not simply their
    existence, is vital to achieving and maintaining adequate
    security.
        The NIST questionnaire will help agencies identify whether
    the program and controls are properly documented, implemented
    and continuously tested and reviewed. We can then determine a
    security level for an individual system, an agency or
    component, or an aggregated form, an entire agency.
        Self-assessments improve security. They are less costly and
    can be performed more frequently than compliance inspections
    and audits. They can be performed by system users, thereby
    helping to promote buy-in and greater compliance. They promote
    openness and cooperation among all participants. They can also
    give us good information on a timely basis.
        In seeking to measure security effectiveness, we should not
    equate it to our Y2K experience. While Y2K was a complex
    management challenge, it was a relatively straightforward
    technical one, and we could measure progress toward a known
    event. Security challenges, on the other hand, are
    unpredictable, ongoing, ever-changing and multidimensional.
    Security threats often arise from malicious parties who probe
    for vulnerabilities and risks. These threats can strike at the
    confidentiality of our information, the integrity of our
    systems and data, and our ability to ensure that information in
    systems will be ready for use when needed. These threats are
    ever-changing and our approach to security must be equally
    dynamic.
        While a general progress report at an agency level can be
    valuable when used in the proper context, it is but a snapshot
    taken at a point in time. It may or may not even be a clear
    picture. Because a security program comprises physical,
    personnel, technical and other controls, accurately assessing a
    program is an extremely complex undertaking. In our view, the
    differences between the two call for different responses. Just
    as we must resist the simplicity of a one-size-fits-all
    security program for the wide variety of agency systems, we
    must also avoid a one-size-fits-all approach to measuring
    successes and shortfalls.
        If we are to improve the government's approach to
    information security, we need to work together. We very much
    appreciate the committee's interest in this important area and
    look forward to continuing our close cooperation with you. We
    value our partnership with you and hope that this hearing will
    mark a further strengthening of our joint efforts on behalf of
    the American people. Thank you.
        Mr. Horn. We thank you. And in courtesy to the executive
    branch, we let you go beyond the 5-minute rule.
        Mr. Spotila. Thank you.
        [The prepared statement of Mr. Spotila follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.023

        [GRAPHIC] [TIFF OMITTED] T4495.024

        [GRAPHIC] [TIFF OMITTED] T4495.025

        [GRAPHIC] [TIFF OMITTED] T4495.026

        [GRAPHIC] [TIFF OMITTED] T4495.027

        [GRAPHIC] [TIFF OMITTED] T4495.028

        [GRAPHIC] [TIFF OMITTED] T4495.029

        [GRAPHIC] [TIFF OMITTED] T4495.030

        [GRAPHIC] [TIFF OMITTED] T4495.031

        [GRAPHIC] [TIFF OMITTED] T4495.032

        [GRAPHIC] [TIFF OMITTED] T4495.033

        [GRAPHIC] [TIFF OMITTED] T4495.034

        [GRAPHIC] [TIFF OMITTED] T4495.035

        [GRAPHIC] [TIFF OMITTED] T4495.036

        Mr. Horn. I will say for all the other witnesses after Mr.
    Willemssen, who speaks for the General Accounting Office of the
    legislative branch, that we would like you to summarize, and we
    will bring the gavel down every 5 minutes now or we're not
    going to be out of here, and we want to be out of here by
    roughly 11:45. I know a number of you have commitments.
        What I would like to put in the record at this point for
    the hearing record--and tell me if there's anything else that
    ought to go into it, or some of these are classified, just to
    redact them, as the saying goes--Presidential Directive 63;
    OMB-A130, the Budget Director Mr. Lew's guidance, to agencies;
    the appendix 3 and associated NIST--what was once the Bureau of
    Standards and Security--guidance. And I would like these simply
    as appendices to your testimony, and if there's a problem, work
    it out with staff.
        Mr. Spotila. That's fine.
        [The information referred to follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.037

        [GRAPHIC] [TIFF OMITTED] T4495.038

        [GRAPHIC] [TIFF OMITTED] T4495.039

        [GRAPHIC] [TIFF OMITTED] T4495.040

        [GRAPHIC] [TIFF OMITTED] T4495.041

        [GRAPHIC] [TIFF OMITTED] T4495.042

        [GRAPHIC] [TIFF OMITTED] T4495.043

        [GRAPHIC] [TIFF OMITTED] T4495.044

        [GRAPHIC] [TIFF OMITTED] T4495.045

        [GRAPHIC] [TIFF OMITTED] T4495.046

        [GRAPHIC] [TIFF OMITTED] T4495.047

        [GRAPHIC] [TIFF OMITTED] T4495.048

        [GRAPHIC] [TIFF OMITTED] T4495.049

        [GRAPHIC] [TIFF OMITTED] T4495.050

        [GRAPHIC] [TIFF OMITTED] T4495.051

        [GRAPHIC] [TIFF OMITTED] T4495.052

        [GRAPHIC] [TIFF OMITTED] T4495.053

        [GRAPHIC] [TIFF OMITTED] T4495.054

        [GRAPHIC] [TIFF OMITTED] T4495.055

        [GRAPHIC] [TIFF OMITTED] T4495.056

        [GRAPHIC] [TIFF OMITTED] T4495.057

        [GRAPHIC] [TIFF OMITTED] T4495.058

        [GRAPHIC] [TIFF OMITTED] T4495.059

        [GRAPHIC] [TIFF OMITTED] T4495.060

        [GRAPHIC] [TIFF OMITTED] T4495.061

        [GRAPHIC] [TIFF OMITTED] T4495.062

        [GRAPHIC] [TIFF OMITTED] T4495.063

        [GRAPHIC] [TIFF OMITTED] T4495.064

        [GRAPHIC] [TIFF OMITTED] T4495.065

        [GRAPHIC] [TIFF OMITTED] T4495.066

        [GRAPHIC] [TIFF OMITTED] T4495.067

        [GRAPHIC] [TIFF OMITTED] T4495.068

        [GRAPHIC] [TIFF OMITTED] T4495.069

        [GRAPHIC] [TIFF OMITTED] T4495.070

        [GRAPHIC] [TIFF OMITTED] T4495.071

        [GRAPHIC] [TIFF OMITTED] T4495.072

        [GRAPHIC] [TIFF OMITTED] T4495.073

        [GRAPHIC] [TIFF OMITTED] T4495.074

        [GRAPHIC] [TIFF OMITTED] T4495.075

        [GRAPHIC] [TIFF OMITTED] T4495.076

        [GRAPHIC] [TIFF OMITTED] T4495.077

        [GRAPHIC] [TIFF OMITTED] T4495.078

        [GRAPHIC] [TIFF OMITTED] T4495.079

        [GRAPHIC] [TIFF OMITTED] T4495.080

        [GRAPHIC] [TIFF OMITTED] T4495.081

        [GRAPHIC] [TIFF OMITTED] T4495.082

        [GRAPHIC] [TIFF OMITTED] T4495.083

        [GRAPHIC] [TIFF OMITTED] T4495.084

        [GRAPHIC] [TIFF OMITTED] T4495.085

        Mr. Horn. So we will now move to have the oath since I
    didn't begin it that way. If you will all stand.
        [Witnesses sworn.]
        Mr. Horn. The clerk will note all the witnesses affirmed.
        And we now go to the agent of the Comptroller General of
    the United States, which is Joel Willemssen, Director,
    Accounting and Information Management Division, U.S. General
    Accounting Office.
        Mr. Willemssen.

        STATEMENT OF JOEL WILLEMSSEN, DIRECTOR, ACCOUNTING AND
       INFORMATION MANAGEMENT DIVISION, U.S. GENERAL ACCOUNTING
      OFFICE, ACCOMPANIED BY ROBERT DAYCE, DIRECTOR FOR COMPUTER
               SECURITY ISSUES, GENERAL ACCOUNTING OFFICE

        Mr. Willemssen. Thank you, Mr. Chairman, Ranking Member
    Turner. Thank you for inviting us to testify today.
    Accompanying me is Robert Dayce, GAO's Director for Computer
    Security Issues, and as requested I'll briefly summarize our
    statement.
        Overall GAO and inspector general reviews done over the
    past year continue to show that Federal agencies have serious
    and widespread computer security weaknesses. Our analysis of
    recently issued GAO and inspector general reports revealed
    significant weaknesses at each of the 24 major Federal
    agencies. As displayed on the board, these weaknesses were
    reported in all six major areas of general computer security
    controls.
        For example, in the area of security program management,
    weaknesses were identified at 21 agencies. Security program
    management is fundamental to the appropriate selection and
    effectiveness of the other categories of controls shown on the
    board. This area covers a range of activities related to
    understanding risks, selecting and implementing controls
    appropriate with risk levels, and ensuring the controls, once
    implemented, continue to operate effectively.
        Another critical area where weaknesses have been found at
    each of the 24 agencies is access controls. Weak controls over
    access to sensitive data and systems make it possible for a
    person to inappropriately modify, destroy or disclose data or
    computer programs. For the other highlighted areas of security
    controls, we've also found significant weaknesses at most of
    the agencies in which audit work has been done.
        I think it's noteworthy to point out that since our last
    analysis of issued reports in 1998, the scope of audit work
    performed has expanded to more fully cover all six major
    control areas at each agency. Not surprisingly, this has led to
    the identification of additional areas of weakness. However,
    this does not necessarily mean that security is getting worse,
    although it is clear that serious pervasive weaknesses persist.
    These serious weaknesses present substantial risk to Federal
    operations, assets and confidentiality.
        Because virtually all Federal operations are supported by
    automated systems and electronic data, the risks are very high,
    and the breadth of the potential impact is very wide. The risks
    cover areas as diverse as taxpayer records, law enforcement,
    national defense, and a wide range of benefit programs.
        While a number of factors have distributed to weak Federal
    information security, I want to emphasize that we believe the
    key underlying problem is ineffective security program
    management. With that in mind, we have issued two executive
    guides that discuss practices that leading organizations have
    employed to strengthen the effectiveness of their security
    programs.
        In conclusion, the expanded body of audit evidence that has
    become available shows that important operations at every major
    Federal agency continue to be at risk as a result of weak
    controls. Reducing these risks will require agencies to
    implement fundamental improvements in managing computer
    security.
        Thank you, Mr. Chairman, and I would be pleased to address
    any questions that you may have.
        Mr. Horn. Well, thank you very much. We will have the
    questions after all the witnesses have made their presentation.
        [The prepared statement of Mr. Willemssen follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.086

        [GRAPHIC] [TIFF OMITTED] T4495.087

        [GRAPHIC] [TIFF OMITTED] T4495.088

        [GRAPHIC] [TIFF OMITTED] T4495.089

        [GRAPHIC] [TIFF OMITTED] T4495.090

        [GRAPHIC] [TIFF OMITTED] T4495.091

        [GRAPHIC] [TIFF OMITTED] T4495.092

        [GRAPHIC] [TIFF OMITTED] T4495.093

        [GRAPHIC] [TIFF OMITTED] T4495.094

        [GRAPHIC] [TIFF OMITTED] T4495.095

        [GRAPHIC] [TIFF OMITTED] T4495.096

        [GRAPHIC] [TIFF OMITTED] T4495.097

        [GRAPHIC] [TIFF OMITTED] T4495.098

        [GRAPHIC] [TIFF OMITTED] T4495.099

        [GRAPHIC] [TIFF OMITTED] T4495.100

        [GRAPHIC] [TIFF OMITTED] T4495.101

        [GRAPHIC] [TIFF OMITTED] T4495.102

        [GRAPHIC] [TIFF OMITTED] T4495.103

        [GRAPHIC] [TIFF OMITTED] T4495.104

        Mr. Horn. The next witness is John Gilligan, the Chief
    Information Officer for the Department of Energy, the cochair
    for Security, Privacy and Critical Infrastructure Committee of
    the Chief Information Officers Council. I will give you another
    minute besides the 5 because you're speaking for the Chief
    Information Officers Council. Mr. Gilligan, you've prepared a
    very thorough statement, but we can't obviously get over 25
    pages into the record at this point, but it is in the record,
    but not having been spoken.
        So if Mr. Gilligan will proceed.

        STATEMENT OF JOHN GILLIGAN, CHIEF INFORMATION OFFICER,
     DEPARTMENT OF ENERGY, COCHAIR, SECURITY, PRIVACY AND CRITICAL
      INFRASTRUCTURE COMMITTEE, CHIEF INFORMATION OFFICERS COUNCIL

        Mr. Gilligan. Thank you, Chairman Horn and Ranking Member
    Turner. I want to thank you for the opportunity to appear
    before this subcommittee to address the very important issue of
    improving security of our Federal information systems. My
    remarks today will focus on my perspectives as cochair of the
    CIO Council's Security, Privacy and Critical Infrastructure
    Committee.
        Federal CIOs share the concerns that have been expressed by
    Members of Congress, senior members in the administration, and
    the public, that we need to improve the security of our
    government information systems. Federal CIOs take their
    responsibility to oversee agency efforts in cybersecurity very
    seriously. We share the frustration of members of this
    committee that progress in securing government systems has not
    been more rapid. Let me assure you that Federal CIOs are not
    asleep at the wheel. Rather, they are laboring hard to get a
    handle on one of the Nation's most complex technological and
    management problems.
        Perhaps it is useful to put the difficulty of cybersecurity
    into perspective. I recall an exchange I had with a military
    four-star general a few years ago. We were discussing his
    frustration with the slow progress on an information technology
    project. This very successful commander with hundreds of
    thousands of troops under his command was clearly exasperated.
    He commented to me after we had discussed the project status,
    ``John, after all, this is not rocket science.'' As I later
    examined his comment, it became clear that he was right. The
    problem could not correctly be compared to rocket science where
    we have literally hundreds of years of experience, including a
    well-defined set of engineering principles.
        Due to the rapid pace of evolution of information
    technology, we are typically faced with applying information
    technology solutions that have been in existence for months or,
    at best, a few years. I submit that the situation is acute for
    cybersecurity. It is not rocket science. No, many aspects of
    cybersecurity are indeed much more difficult than rocket
    science.
        When I addressed this committee in March of this year, I
    stated that the single biggest challenge that I saw for CIOs in
    cybersecurity was making line management aware that
    cybersecurity is not just a complex technological issue. At the
    core cybersecurity is also a complex risk management issue.
        Another challenge that I see facing CIOs is helping line
    management answer the question, ``what is adequate security?''
    Security experts tell us that no system is impenetrable if
    network access is provided. However, the collective
    inexperience of government and industry in applying security to
    a range of functions including public Web sites, financial data
    bases, procurement-sensitive data, citizen benefits and
    corporate-sensitive or government-sensitive research, makes
    this a hard problem.
        The primary focus of the CIO Council efforts in this area
    has been to help Federal organizations address the question of
    what is adequate security. The CIO Council has sponsored a Web-
    based repository for sharing best practices. This repository
    can be found at http://bsp.cio.gov.
        We have developed sample security policies for use by
    agencies in intrusion reporting and procuring security
    projects. We have worked to improve governmentwide processes
    for reporting security incidents and distributing warnings in a
    rapid fashion. An ongoing effort is to develop a set of
    benchmark security practices for electronic services.
        The Council has also sponsored a number of training and
    education forums addressing privacy and critical infrastructure
    protection.
        The CIO Council is also leading efforts to establish a
    governmentwide encryption infrastructure using public key
    technology called a public key infrastructure [PKI].
        An additional CIO Council effort that is particularly
    relevant to today's hearing is the development of an
    Information Technology Security Assessment Framework. This
    effort was initiated about 10 months ago to provide a tool to
    help guide security efforts within Federal agencies. This
    framework has been developed largely with the leadership of the
    National Institute of Standards and Technology and built upon
    existing policy and guidance from the Office of Management and
    Budget, the General Accounting Office, and the National
    Institutes of Standards and Technology.
        The framework provides a road map for Federal organizations
    to guide them in focusing and prioritizing their efforts to
    improve security. For each of five levels in the framework, a
    set of activities is defined that should be undertaken to
    assure a sound and effective security program. The framework
    reinforces the importance of a solid foundation for an
    organization security program and is based on sound policy,
    clearly defined management responsibility, and organizationwide
    coverage.
        The CIO Council has completed a final draft of version one
    of the Information Technology Security Assessment Framework and
    hopes to publish this version in October. Following the example
    of similar efforts by Carnegie Mellon University to develop
    security frameworks for software and other disciplines, we plan
    to continue to refine the framework over the upcoming months.
    With advice and input from GAO, we have started working on
    enhancements to the framework that would permit organizations
    to better assess the effectiveness of the security programs
    that have been documented and implemented.
        The final area that I would like to address is the need for
    stronger funding support from Congress for a small set of
    cross-government security initiatives that serve as the
    foundation for governmentwide improvements in cybersecurity.
    The cochairs of the Security, Privacy and Critical Committee of
    the CIO Council recently sent a letter to all Members of
    Congress that highlighted our concern in this area. The letter
    points out that while there is almost $2 billion identified in
    the administration's fiscal year 2001 budget request for
    cybersecurity-related items, only a very small portion of this
    request totaling less than $50 million is requested for these
    essential governmentwide foundation programs. The efforts of
    this group include the Federal Computer Incident Response
    Capability [FEDCIRC], which is managed by GSA and provides
    alerts and warnings of virus attacks to all Federal agencies.
        It has become clear to the CIO Council that these necessary
    foundation efforts to improve cybersecurity governmentwide are
    being hampered by a patchwork of funding and oversight
    structures in both the executive and legislative branches. We
    cannot hope to achieve robust governmentwide security without
    these programs. We urge the respective congressional committees
    who have jurisdiction over these efforts not to view them as
    politically driven projects, but as essential elements of a
    governmentwide foundation for cybersecurity. Moreover, we
    believe that a $50 million investment for these efforts is a
    very small investment in view of the great leverage that these
    efforts will provide.
        I would like to enter into the record a copy of the letter
    entitled ``Essential Programs for Ensuring Security of the
    Federal Cyber Infrastructure.''
        Mr. Horn. Without objection, it will be in the record at
    this point in your testimony.
        Mr. Gilligan. It is clear to Federal CIOs that the lack of
    a single integrated budget for cybersecurity items--these
    foundation cybersecurity items--keeps these efforts from
    getting the proper attention that they deserve and makes
    progress and governmentwide efforts more difficult.
        In similar fashion, the efforts of the CIO Council Security
    Committee and other CIO Council committees continue to be
    hampered by lack of effective methods to fund these cross-
    government initiatives that we undertake. The synergistic
    benefit and opportunity for savings across the government are
    enormous. However, due to the use of pass-the-hat funding
    approaches for the CIO Council, for example, funding for the
    best security practices efforts that was mentioned earlier had
    to be limited to $200,000 and was received 9 months into the
    fiscal year. We will not be able to continue to operate and
    expand this site or undertake other projects with operational
    demands without an adequate level of funding.
        I would suggest that this committee, working with the
    administration, should examine ways to provide better methods
    to fund and manage cross-government initiatives in the
    information technology area. As a taxpayer, I am dismayed by
    the difficulty of funding these efforts which have the ability
    to yield tremendous efficiencies. It is an area where our
    executive and legislative branches are truly failing, unable to
    leverage the potential of information technology.
        In my written testimony, I've included descriptions of
    efforts within the Department of Energy to improve the security
    of our many security systems.
        In summary, let me again express my appreciation for the
    opportunity to share my views on the important subject and
    encourage the committee to continue to support the CIO Council-
    sponsored efforts, especially the Information Technology
    Security Assessment Framework.
        While our joint challenge to improve cybersecurity may be
    more difficult than building rockets, chief information
    officers are committed to rapidly improving the protection
    afforded to information systems managed by the Federal
    Government.
        This concludes my remarks. Thank you.
        [The prepared statement of Mr. Gilligan follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.105

        [GRAPHIC] [TIFF OMITTED] T4495.106

        [GRAPHIC] [TIFF OMITTED] T4495.107

        [GRAPHIC] [TIFF OMITTED] T4495.108

        [GRAPHIC] [TIFF OMITTED] T4495.109

        [GRAPHIC] [TIFF OMITTED] T4495.110

        [GRAPHIC] [TIFF OMITTED] T4495.111

        [GRAPHIC] [TIFF OMITTED] T4495.112

        [GRAPHIC] [TIFF OMITTED] T4495.113

        [GRAPHIC] [TIFF OMITTED] T4495.114

        [GRAPHIC] [TIFF OMITTED] T4495.115

        [GRAPHIC] [TIFF OMITTED] T4495.116

        [GRAPHIC] [TIFF OMITTED] T4495.117

        [GRAPHIC] [TIFF OMITTED] T4495.118

        [GRAPHIC] [TIFF OMITTED] T4495.119

        [GRAPHIC] [TIFF OMITTED] T4495.120

        [GRAPHIC] [TIFF OMITTED] T4495.121

        [GRAPHIC] [TIFF OMITTED] T4495.122

        [GRAPHIC] [TIFF OMITTED] T4495.123

        [GRAPHIC] [TIFF OMITTED] T4495.124

        [GRAPHIC] [TIFF OMITTED] T4495.125

        [GRAPHIC] [TIFF OMITTED] T4495.126

        Mr. Horn. Well, thank you very much. And I would hope that
    when there is some budget negotiations going on toward the end,
    that the President's list will include this, and we hope that
    the Speaker will include it.
        The next witness is John R. Dyer, the Chief Information
    Officer for the Social Security Administration.
        Mr. Dyer.

     STATEMENT OF JOHN R. DYER, CHIEF INFORMATION OFFICER, SOCIAL
                        SECURITY ADMINISTRATION

        Mr. Dyer. Good morning, Mr. Chair, Mr. Turner. Thank you
    very much for inviting us to testify.
        We, too, as this committee, consider security to be an
    actual vital concern, particularly in this day as we move more
    into the systems world.
        At the onset let me emphasize that the Social Security
    Administration has always taken the responsibility to protect
    the privacy of personal information in agency files very
    seriously. The Social Security Board's first regulation
    published in 1937 dealt with the confidentiality of SSA
    records. For 65 years SSA has honored its commitment to the
    American people to maintain the confidentiality of the records
    in our possession. We understand in order to address privacy
    concerns, we need a strong computer security program in place.
    Today I would like to discuss where we are with computer
    security, what improvements we're making.
        SSA approaches computer security on an entitywide basis. By
    doing so we address all aspects of the SSA enterprise. Overall
    the Chief Information Officer, who reports directly to the
    Commissioner and Deputy Commissioner, is responsible for
    information system security. In my role as CIO, I assure that
    our security initiatives are enterprisewide in scope. At the
    Deputy Commissioner level, Social Security's Chief Financial
    Officer assures that all new systems have the required
    financial controls to maintain sound stewardship over the
    moneys entrusted to our care. We have also placed our system
    security policy function with this Deputy Commissioner.
        In order to meet the challenges of data security in today's
    highly technological environment, this agency has adopted an
    enterprisewide approach to system security, financial
    information, data integrity and prevention of fraud, waste and
    abuse. We have full-time staff devoted to system security
    stationed throughout the agency, in all regions and in the
    central office. We have established centers for security and
    integrity in each Social Security region. They provide day-to-
    day oversight control over our computer software. In addition,
    we have a Deputy Commissioner-level Office of Systems which
    supports the operating system, develops new software and the
    related controls, and, in general, assures that Social Security
    is taking advantage of the latest in effective systems
    technology.
        SSA has been certifying its sensitive systems since the
    original OMB requirement was published in 1991. Our process
    requires Deputy Commissioners responsible for those systems to
    accredit them. SSA's planning and certification activity is now
    in full compliance with NIST 800-18 guidance.
        SSA sensitive systems include all programmatic systems
    needed to support programs administered by the agency as well
    as critical personnel functions. They also include the network
    and the system used to monitor Social Security's data center
    operations.
        As an independent agency we have our own inspector general
    who can focus his efforts on the agency needs and concerns. The
    IG is also very active working with other Federal, State and
    local law enforcement agencies to assure all avenues for
    investigation and prosecution are being pursued, especially for
    systems security-related issues.
        In summary, we have in place the right authorities, the
    right personnel, the right software controls to prevent
    penetration of our systems and to address systems security
    issues as they surface.
        As I mentioned, SSA has maintained an information security
    program for many years. Key components, such as deploying new
    security technology, integrating security into the business
    process, and performing self-assessment of our security
    infrastructure, to name a few, describe the goals and
    objectives that will touch every SSA employee.
        Of particular importance this year are the activities
    related to the Presidential Decision Directive PDD-63 on
    cyberterrorism and infrastructure protection and continuity of
    operations. We have recently completed an evaluation of all
    critical SSA assets. I am pleased to note that SSA was one of
    the first agencies to do so.
        Originally, SSA was not a tier I agency, but given the
    importance of our ongoing monthly payments, we were elevated to
    this level by the Critical Infrastructure Assurance Office. As
    part of this effort we have completed an inventory of all
    critical assets and implemented an incidence response process
    for computer incidents. We have also revised our physical
    security plans to assure our facilities are properly secured.
        An independent auditor, Pricewaterhouse Coopers, has
    evaluated our security program over the last 4 years working
    with the IG. They have given us many recommendations to
    strengthen our security program, and we have implemented 77
    percent of their recommendations. We are addressing the
    remainder at this time. Most of the ones that will take us to
    finish up over the next fiscal year are facility-related, and
    that's what takes a little bit of time.
        In addition, we have ongoing site reviews, corrective
    actions, and we also have another independent contractor,
    Deloitte and Touche, reviewing our systems and overall
    management.
        In the contingency area this year, we actually tested all
    of our sites at one time, which was an area of recommendation
    that Pricewaterhouse Coopers had recommended for us. And so we
    believe that when we get the next report from PwC, it will
    indicate that we have made substantial progress.
        In terms of the new increasing technology, and as we're
    moving toward Internet, we are putting in place all the latest
    security features from firewalls to filters to head off
    specific attacks.
        So I would like to say in conclusion, Mr. Chairman, the
    Social Security Administration has a longstanding tradition of
    assuring the public that their personal records are secure.
    Both the Commissioner and the Deputy Commissioner give system
    security their highest priority. We all recognize this is not a
    one-time task to be accomplished, but rather it's an ongoing
    mission that we can never lose sight of. We know we cannot rest
    on past practice. We must be vigilant every way we can to
    assure that these records remain secure and that the public
    confidence in Social Security is maintained.
        I want to thank the committee for the opportunity to
    testify at this hearing, and I will be glad to answer any
    questions you might have.
        Mr. Horn. Thank you very much, Mr. Dyer.
        [The prepared statement of Mr. Dyer follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.153

        [GRAPHIC] [TIFF OMITTED] T4495.154

        [GRAPHIC] [TIFF OMITTED] T4495.155

        [GRAPHIC] [TIFF OMITTED] T4495.156

        [GRAPHIC] [TIFF OMITTED] T4495.157

        [GRAPHIC] [TIFF OMITTED] T4495.158

        [GRAPHIC] [TIFF OMITTED] T4495.159

        [GRAPHIC] [TIFF OMITTED] T4495.160

        [GRAPHIC] [TIFF OMITTED] T4495.161

        [GRAPHIC] [TIFF OMITTED] T4495.162

        Mr. Horn. As usual, Social Security is at the top of the
    heap even though it's a B. So we're used to you getting As
    under the Y2K situation, and we look forward to you keeping
    ahead of the pack, shall we say. Thank you very much for
    coming. Thanks to your colleagues that led to a B grade.
        We now go to Daryl W. White, the Chief Information Officer
    of the Department of the Interior, who has presented us with
    quite a full platter of documentation. We appreciate that. It's
    all in the record, and now you have 5 minutes to summarize it.

        STATEMENT OF DARYL W. WHITE, CHIEF INFORMATION OFFICER,
                       DEPARTMENT OF THE INTERIOR

        Mr. White. Good morning, Mr. Chairman and Mr. Turner. Thank
    you for the opportunity to appear before you today to discuss
    the status of computer security at the Department of the
    Interior. The Department of the Interior appreciates being
    afforded the opportunity to complete the recent computer
    security questionnaire. We are pleased to report that we are
    making substantive progress to improve our computer security
    posture.
        The Department of the Interior recognizes that computer
    security is of agencywide importance and is actively working to
    implement a well-structured program to protect our information
    assets. It is anticipated that the vast majority of issues
    identified in the questionnaire will be adequately addressed
    through implementations of our program.
        Let me summarize the steps that Interior has taken over the
    past 14 months to improve our computer security posture. During
    1999, Interior performed extensive work in Y2K readiness for
    mission-critical systems and major data centers. As a result of
    Y2K preparation, policies and guidance for contingency planning
    and physical security were issued and several implemented.
        In September 1999, we acquired limited funding for
    contractor services to perform automated vulnerability scanning
    of our most critical systems. Based on the results of the
    scanning, remediation was performed where needed.
        January 2000, Interior accomplished priority filling of the
    Department Information Technology Security Manager position
    with a well-qualified and experienced individual. We were
    fortunate to have obtained Steve Schmidt from the State
    Department's Bureau of Diplomatic Security. Mr. Schmidt has
    brought a wealth of experience and practical knowledge to
    Interior. It is through his leadership and direction that we
    have seen a revitalizing of the Department IT Security Working
    Group.
        Also in January 2000, $175,000 was allocated for computer
    security program development. Funding was obtained through an
    internal competitive process whereby senior Department managers
    clearly chose computer security as a high priority issue in
    competition with other equally important issues. This funding
    was obligated to obtain contractor computer security services
    in program development and limited as-needed vulnerability
    scanning.
        February 2000, Interior was successful in including in the
    fiscal year 2001 President's budget request $175,000 for
    electronic data security. The House and Senate omitted this
    funding from their versions of the fiscal year 2001
    appropriations bill. Interior continues to clarify the urgent
    need for the funding to the Appropriations Committee.
        In May 2000, the Departmental Information Technology
    Security Manager issued the Interior Information Technology
    Security Plan, fully specifying the National Institute of
    Standards and Technology [NIST], published generally accepted
    principles and practices for securing Federal computer systems.
    This plan provides the basis for ensuring a computer security
    program that meets or exceeds the minimum Federal requirements
    as required by public laws, Federal regulations and executive
    branch directions.
        July 2000, the Department issued agencywide budget guidance
    that further supported Office of Management and Budget
    instructions on incorporating computer security funding in all
    information technology projects. This guidance advised that
    computer security spending should average 5 percent of the
    total budget for information technology spending and placed a
    high priority on increasing resources for security.
        August 2000, a contract was awarded by the General Services
    Administration under the SafeGuard program to Science
    Applications International Corp. to provide computer security
    program development services to the Department. This is
    significant to our approach to computer security, and I wish to
    elaborate further.
        One of the primary means to improve IT security across the
    Department of the Interior is to establish proven structured
    and self-documenting methodologies for working through the
    security life-cycle process. I am pleased to report that
    realizing this goal has begun through the award of the
    mentioned contract. The associated statement of work divides
    the task into two phases. The first phase tasks will provide
    Interior with the technical and administrative assistance to
    put in place proven structured methodologies for information
    technology security development. The second phase will produce
    minimum requirements for risk mitigation in the form of
    policies for agencywide information technology security issues.
    From here we will develop technology and product-specific
    implementation guides. Dependent upon the availability of
    resources, we will then implement operating capabilities.
        In August 2000, an additional $240,000 was obtained for
    computer security program development. This funding will be
    used to accomplish the development and implementation of
    selected security practices.
        In closing, it must be noted that our ability to completely
    implement an adequate computer security program is strongly
    dependent upon the availability of necessary resources.
        This concludes my statement. I will be happy to respond to
    any questions that you or any members of the committee may
    have.
        Mr. Horn. Well, we thank you very much, Mr. White.
        [The prepared statement of Mr. White follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.163

        [GRAPHIC] [TIFF OMITTED] T4495.164

        [GRAPHIC] [TIFF OMITTED] T4495.165

        [GRAPHIC] [TIFF OMITTED] T4495.166

        [GRAPHIC] [TIFF OMITTED] T4495.167

        [GRAPHIC] [TIFF OMITTED] T4495.168

        [GRAPHIC] [TIFF OMITTED] T4495.169

        [GRAPHIC] [TIFF OMITTED] T4495.170

        [GRAPHIC] [TIFF OMITTED] T4495.171

        [GRAPHIC] [TIFF OMITTED] T4495.172

        [GRAPHIC] [TIFF OMITTED] T4495.173

        [GRAPHIC] [TIFF OMITTED] T4495.174

        [GRAPHIC] [TIFF OMITTED] T4495.175

        [GRAPHIC] [TIFF OMITTED] T4495.176

        [GRAPHIC] [TIFF OMITTED] T4495.177

        [GRAPHIC] [TIFF OMITTED] T4495.178

        [GRAPHIC] [TIFF OMITTED] T4495.179

        [GRAPHIC] [TIFF OMITTED] T4495.180

        [GRAPHIC] [TIFF OMITTED] T4495.181

        [GRAPHIC] [TIFF OMITTED] T4495.182

        [GRAPHIC] [TIFF OMITTED] T4495.183

        [GRAPHIC] [TIFF OMITTED] T4495.184

        Mr. Horn. Our next presentation is from Edward Hugler, the
    Deputy Assistant Secretary for Administration and Management,
    Department of Labor.

      STATEMENT OF EDWARD HUGLER, DEPUTY ASSISTANT SECRETARY FOR
           ADMINISTRATION AND MANAGEMENT, DEPARTMENT OF LABOR

        Mr. Hugler. Thank you, Mr. Chairman and Ranking Member
    Turner. I will be brief, as you requested.
        We share your view that computer security is a high
    priority, a priority that the Department of Labor takes very
    seriously at the highest levels. Quite frankly, I am
    disappointed at the grade we received today, and in some small
    measure dismayed by it.
        Following a successful transition or the century date
    change, we have directed significant attention to enhancing our
    security program and strengthening our security perimeter to
    defend against its attack. While this surely is an ongoing and
    very complex task, I am pleased to report that we have made
    solid progress to date and are continuing to improve our
    ability to defend against cyber attacks.
        As we began the fiscal year, we had a number of security-
    related issues identified by our Office of the Inspector
    General in their audit of our financial statement. The issues
    encompassed work to done in six areas of Department-wide
    security program planning and management structure. The good
    news is, because computer security is a high priority, we had
    already identified areas that needed attention and had plans
    under way for corrective action. This proactive posture was
    acknowledged by the OIG in their audit findings.
        At this stage we have resolved all of the audit report
    issues at the departmental level and are working toward closing
    out the remaining issues with specific agency systems.
        In addition to dealing with immediate day-to-day issues,
    such as continued attempts to gain unauthorized access to our
    systems and responding to malicious codes such as the I Love
    You virus, we have invested substantial effort in planning
    ahead. Led by the Department's Chief Information Officer, our
    strategy in this undertaking has been twofold: First, align our
    information technology investments with legislative mandates
    and other direction; and second, bring a departmental focus to
    our information technology investments where a unified approach
    and economies of scale are advantageous.
        Information technology approaches that are common across
    the Department, such as the implementation of a common
    architecture and needed improvements in the infrastructure,
    lend themselves to a common cross-cutting strategy. The use of
    a common strategy then enables us to effectively leverage the
    use of individuals' expertise and other scarce resources for
    the good of all at the Department of Labor.
        Utilizing this approach for fiscal year 2001, the
    Department identified three cross-cutting areas for investment,
    one of which is computer security. The computer security cross-
    cut represents approximately 18 percent of the Department's
    information technology cross-cutting investment portfolio for
    fiscal year 2001. It includes plans to ensure that the
    information security policies, procedures and practices of the
    Department are adequate, as well as reflect the first step
    toward implementing a multiyear plan for protecting our
    critical infrastructure. Notably this will be a separate budget
    activity, and the funds will be administered by the
    Department's Chief Information Officer to ensure an organized,
    disciplined approach to implementing a stronger security
    program.
        Mr. Chairman, our plans for next year should not, however,
    overshadow what we've accomplished this year, 2000. I would
    like to submit a brief highlight of those accomplishments for
    the record, if I may.
        Mr. Horn. Without objection, it will be in the record at
    this point.
        Mr. Hugler. Thank you, Mr. Chairman.
        Mr. Chairman, we concur with the need to assess the overall
    state of the Federal Government's computer security
    environment, and we welcome the opportunity to work with you
    and the subcommittee to devise an instrument that will provide
    the flexibility necessary to accurately assess agencies'
    progress. We also recognize that work remains to be done at the
    Department of Labor to further improve our computer security.
        I share with you your confidence that we will come through
    as we did with the year 2000 challenge. I am confident as well
    that we have sound plans for making these improvements and the
    skill on hand to do so. However, the key to our success, as has
    been mentioned by other witnesses at the table this morning,
    will be making the necessary funding available.
        Thank you, Mr. Chairman. I appreciate the opportunity to be
    here, and I will be happy to take your questions.
        Mr. Horn. Well, thank you very much.
        [The prepared statement of Mr. Hugler follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.185

        [GRAPHIC] [TIFF OMITTED] T4495.186

        [GRAPHIC] [TIFF OMITTED] T4495.187

        Mr. Horn. And our next presenter is Ira L. Hobbs, the
    Deputy Chief Information Officer for the Department of
    Agriculture.
        Mr. Hobbs.

     STATEMENT OF IRA L. HOBBS, DEPUTY CHIEF INFORMATION OFFICER,
                       DEPARTMENT OF AGRICULTURE

        Mr. Hobbs. Thank you, Mr. Chairman. Good morning, Mr.
    Chairman and Ranking Member Turner.
        I am pleased to appear before the committee this morning to
    update you on the status of the computer security program of
    the U.S. Department of Agriculture. With your permission, I
    will make a few brief comments and submit my written testimony
    for the record.
        USDA's programs touch the lives of every American every
    day. We manage a diverse portfolio of over 200 Federal programs
    throughout the Nation and the world at a cost of about $60
    billion annually.
        The information we manage, which includes Federal payroll
    data, market-sensitive data, geographical data, information on
    food stamps and food safety, proprietary research data, is
    among USDA's greatest assets.
        The Department is committed to protecting its information
    assets as well as the privacy of its customers and its
    employees. Audit reports conducted by both USDA's own Office of
    the Inspector General and the General Accounting Office have
    identified significant weaknesses in our overall computer
    security program, which we are working hard to correct. As an
    example, the Department is acquiring and installing necessary
    equipment to upgrade security at our highest priority Internet
    access points, and we are strengthening our intrusion detection
    capabilities. We are working diligently to correct all of the
    deficiencies that have been identified by the reports and hope
    to be able give you a much more expanded impact in terms of the
    changes that we have made.
        Reports such as those cited above, as well as internal
    security reviews mandated by the Secretary of Agriculture in
    July 1999, made it clear that the Department requires an
    overall coordinated and corporate approach to cybersecurity if
    it is to succeed.
        The USDA agencies include some security funding in their
    respective budgets. Departmental funding is critical to
    ensuring the creation of a standard security infrastructure,
    and departmental leadership is required to ensure that we have
    a comprehensive set of policies and guidelines.
        The Secretary's security review also resulted in a
    multiyear action plan to strengthen USDA's information
    security, which addresses program organization, staffing needs,
    policy and program operations, and security and
    telecommunications technical infrastructure. When fully enacted
    our plan will align USDA security practices with those of
    leading organizations.
        Our recent focus primarily has been upon building upon the
    competency and skill of our security staff. We are extremely
    fortunate working with the Secretary to establish the first
    Associate Chief Information Officer for Cybersecurity at the
    Department of Agriculture and able to select a senior level
    executive, Mr. William Hadesty, formerly with the Internal
    Revenue Service, as our first CIO for Cybersecurity. With the
    recent addition of Mr. Hadesty, we have already started to
    implement the priority actions in our action plan.
        The Congress provided a $500,000 budget increase for the
    Office of the Chief Information Officer for security in fiscal
    year 2000. With these funds and existing resources, we are
    assembling a well-qualified staff of security experts to lead
    the Department's efforts.
        Since joining with us in February 2000, the Associate CIO
    for Cybersecurity has carefully analyzed and made adjustments
    to our ongoing program. In addition, our most critical
    information resources, including the National Information
    Technology Center in Kansas City and the National Finance
    Center in New Orleans, have been or are now undergoing critical
    review. We recognize, though, that we still have a long way to
    go.
        The Office of the Chief Information Officer's fiscal year
    2001 budget request included an increase in funding for
    cybersecurity of approximately $6.5 million. If enacted as
    requested, our security budget will provide the resources to
    complete the development of a USDA risk management program,
    continue to expand our cybersecurity office, increase our
    capacity to conduct onsite reviews, and provide training and
    hands-on assistance to augment the skills of our agency's
    security staff. Additionally our project plans call for a major
    effort in 2001 to further define requirements for a security
    architecture and begin its redesign and implementation.
        In fiscal year 2002, we will continue to develop and
    implement our USDA-wide computer security program. The
    information survivability program and the sensitive systems
    certification program we plan to establish will complete USDA's
    computer security umbrella.
        Mr. Chairman, we believe that fulfillment of our
    cybersecurity action plan will position the Department to
    comply with Federal computer security guidelines and best
    management practices. The reality is, though, that until our
    computer security program is fully funded, we will remain much
    too vulnerable.
        I appreciate the opportunity to speak to the committee. I
    look forward to being able to answer any questions you may
    have.
        Mr. Horn. Thank you very much, Mr. Hobbs.
        [The prepared statement of Mr. Hobbs follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.188

        [GRAPHIC] [TIFF OMITTED] T4495.189

        [GRAPHIC] [TIFF OMITTED] T4495.190

        [GRAPHIC] [TIFF OMITTED] T4495.191

        [GRAPHIC] [TIFF OMITTED] T4495.192

        [GRAPHIC] [TIFF OMITTED] T4495.193

        [GRAPHIC] [TIFF OMITTED] T4495.194

        Mr. Horn. Our next presenter is Mark A. Tanner, Information
    Resources Manager, Federal Bureau of Investigation, Department
    of Justice.
        Mr. Tanner.

      STATEMENT OF MARK A. TANNER, INFORMATION RESOURCES MANAGER,
         FEDERAL BUREAU OF INVESTIGATION, DEPARTMENT OF JUSTICE

        Mr. Tanner. Good morning, Mr. Chairman, Mr. Turner and
    other members of the audience. I thank you for inviting us here
    to discuss computer security at the FBI. The FBI shares your
    conviction that computer security is a vital concern. That
    concern is manifested in a variety of levels: First, the
    concern within the FBI as to how the FBI collects and handles
    sensitive personal information; the concern as a member of the
    U.S. intelligence community where there is a growing awareness
    and desire to achieve a collaborative sharing of intelligence
    information while at the same time securing highly sensitive
    and classified sources and techniques; the concern as a member
    of the law enforcement community often called upon to
    investigate, identify and apprehend those responsible for
    hacking into government systems and critical infrastructures of
    this Nation; and the concern as a Federal law enforcement
    agency called upon to investigate computer and computer-related
    crimes as diverse as a pedophile seeking to prey on a
    youngster, Internet fraud crimes which victimize all elements
    of our society, including persons and businesses, and those who
    would seek to enrich themselves by manipulating stock prices.
        The FBI's internal computer policies and practices present
    a somewhat unusual picture as far as Federal agencies are
    concerned. The FBI is, as I have stated, an agency charged with
    investigating many computer-related crimes and it is charged
    with the conduct of all counterintelligence activities in the
    United States.
        In addition, the FBI operates several systems on which
    State and local law enforcement agencies have come to rely as a
    necessity. As such, the FBI must operate both classified and
    unclassified systems, and many of those unclassified systems
    have strong requirements for the protection of personal data
    about American citizens as well as a need to maintain instant
    availability.
        In addition, the nature of some of these, some of these
    systems presents special requirements in that the data
    represents information gathered through a variety of methods,
    each requiring its own specialized method of handling and
    protecting the information. These methods includes Federal
    grand jury subpoenas which are subject to the requirements of
    rule 6(e) of the Federal Rules of Criminal Procedure, material
    identified as Federal taxpayer information, and thus, subject
    to specialized handling and disclosure requirements, as well as
    other many other specialized requirements. Of course, the
    specific requirements of classified information such as that
    obtained as a result of title 50, the Foreign Intelligence
    Surveillance Act, activities or by other intelligence community
    agencies, which must be respected.
        To accomplish these tasks, the FBI operates 35 general
    support systems and 12 major applications; 24 of the 35 general
    support systems are classified and 6 of the 12 major
    applications are classified. In other words, the FBI operates
    30 national security systems. It should be noted that the vast
    majority of the FBI's classified systems are currently internal
    systems and thus do not have external connections to nonsecure
    or unclassified systems.
        The FBI's information systems security policy is codified
    in our Manual of Investigative Operations, section 35. A copy
    of this policy has previously been provided to this
    subcommittee. The policy is a compilation of requirements which
    are outlined in section 35-11 of this policy. In general, let
    me state that because of the variety of types of systems used
    by the FBI, our practice, where practical, involves using a
    hierarchical approach to any requirement from these sources
    based on the selective system's criticality and risks. This is
    to avoid any possible confusion as to whether or not a system
    should follow this or that set of rules and regulations. To
    choose any other course of action would be folly.
        The FBI's policy is coordinated with the Information
    Systems Security Unit which is a part of our National Security
    Division. The security unit works closely with the Department
    of Justice entities which oversee classified and unclassified
    computer systems. In addition, they maintain a good working
    relationship with the national entities responsible for
    computer security policy, such as the NSTISSC and NIST and the
    Security Policy Board to ensure that the latest information is
    available.
        There are many challenges which face the FBI in today's
    computerized world. One of the biggest challenges involves the
    rapidly changing environment and the rapidly changing world in
    which we all live. New technologies are moving into the
    marketplace at a frenetic pace; old technologies are undergoing
    metamorphosis. Each of these new products presents particular
    problems and a careful and thoughtful analysis to ensure that
    the FBI continues to maintain a policy which recognizes the
    business needs of the computerized world and still providing
    meaningful security practice.
        The FBI is practicing risk management approach in its
    certification and accreditation of all computer system
    security. As I previously noted, most systems are internal and
    not connected to nonsecure unclassified systems. This isolation
    provides some sense of comfort in that these systems are not
    connected to the outside and far less vulnerable to compromise
    and attack. In this manner, our approach has been to identify
    both systems which pose the largest risk in terms of their data
    and sensitivity of the data. These systems are approached
    before systems which play a lesser role in either their data or
    sensitivity. The FBI is currently engaged in a series of
    activities which will hopefully lead to the speedy completion
    of the certification and accreditations. Resources have been on
    loan from the Department of Justice as well as other
    intelligence community under the ICAP program.
        The FBI has undertaken a--an effort to make system owners
    cognizant of system security requirements in their initial and
    life-cycle development of plans for systems, in that way
    ensuring that systems security is built into all systems and
    that the continuing costs are specifically identified as a
    separate line in each proposal.
        In conclusion, let me just reiterate that the FBI
    appreciates the interest of this subcommittee, indeed the
    interests of all parts of Congress in this area where we share
    your interests and concern. Our efforts will continue to ensure
    that all systems, including those of the FBI, meet the
    expectations of the American public to appropriately protect
    that information which must be protected. The FBI respects the
    trust placed in it by the American public and the Congress and
    will do the utmost to maintain that trust.
        Thank you.
        [The prepared statement of Mr. Tanner follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.195

        [GRAPHIC] [TIFF OMITTED] T4495.196

        [GRAPHIC] [TIFF OMITTED] T4495.197

        [GRAPHIC] [TIFF OMITTED] T4495.198

        [GRAPHIC] [TIFF OMITTED] T4495.199

        Mr. Horn. Well, thank you Mr. Tanner. We appreciate very
    much what the FBI has done in tracking down a lot of these
    hackers, and some I believe are in Federal prison now. So we
    thank you for that effort, and I think you were very on top of
    the situation in the Philippines when that occurred.
        Our last presenter before questions is Solveig Singleton,
    Director of Information Studies for the CATO Institute. Am I
    correct to say the CATO Institute would be called a
    libertarian-based institute?
        Ms. Singleton. Yes.
        Mr. Horn. OK. Ms. Singleton, it's all yours for 5 minutes.

    STATEMENT OF SOLVEIG SINGLETON, DIRECTOR OF INFORMATION STUDIES
                         FOR THE CATO INSTITUTE

        Ms. Singleton. Thank you, Mr. Chairman. My testimony today
    is going to offer examples of some of the types of data bases
    maintained by Federal agencies and offer a big-picture
    perspective on the significance of any security problems within
    those data bases.
        With the power to command, powers of arrest, police, courts
    and armies, the government has powers that the private sector
    lacks. You can hang up on an annoying telemarketer but it's
    hard to hang up on the IRS. Recognizing that in the
    Constitution we have the fourth amendment which limits the
    means by which government may collect information and we also
    had the idea originally of a government of relatively limited
    powers, and inherently a government of more limited power has
    less need for hundreds and hundreds of data bases than a
    government of broader powers.
        Now, for better or for worse, we have drifted away from
    this concept of limited government, and there's a natural
    consequence. The amount of detailed information about private
    citizens in Federal files has grown by leaps and bounds.
        To underscore the importance of keeping this information
    secure, I will offer an overview of the types of information
    that are held by Federal agencies.
        Essentially, Federal agencies collect an enormous array of
    information. The Federal Government will inexorably record,
    obviously, your name, your address, your income, but also your
    race, details of how you spend your money, your employer,
    updated quarterly, whether you've asked for information from
    government agencies, student records, whether your banker
    thinks you've engaged in any suspicious activities like making
    an unusually large withdrawal or deposit, and finally, of
    course, a surprising number of agencies hold different types of
    medical records and not simply Health and Human Services.
        I am going to run down some of the departments that we
    looked at very quickly and offer a very small number of
    examples of the type of information that they hold. Let me
    start with the Commerce Department.
        One file maintained by this Department keeps individual and
    household statistical surveys which include individual's names,
    age, birth date, place of birth, sex, race, home business phone
    and address, family size and composition, patterns of product
    use, drug sensitivity data, medical, dental, and physical
    history and other information as they consider necessary.
        The Department of Education has the national student loan
    data system and, among other items, a registry of deaf-blind
    children nationwide.
        The Department of Energy maintains, among some very
    sensitive counterintelligence data bases, records of human
    radiation experiments.
        The Federal Bureau of Investigation, obviously, is home to
    the FBI central records system, alien address reports, witness
    security files and information on debt collection and parole
    records.
        The Department of Health and Human Services has massive
    quantities of medical record information, filling hundreds of
    data bases. Some of these data bases include the personal
    Medicaid data system and the national claims history billing
    and collection master records system.
        Next comes the Department of Housing and Urban Development.
    Now, this agency is perhaps best known among privacy advocates
    over the last few years, urging that residents of Federal
    housing agree to warrantless searches of their apartments in
    their lease agreements. This agency holds data such as single
    family research files, income certification evaluation data,
    and tenant eligibility verification files.
        The Department of Labor has a lot of data bases including a
    data base with information on applicant race and national
    origin, records from the workers' compensation system and
    records from the national longitudinal survey of youth, which
    is a longterm study of certain individuals as they grew up over
    the past few decades.
        Obviously the Social Security information collects
    information on lifetime earnings, as well as information
    related to insurance and health care and census data. What may
    be less well known is the extent to which they share and match
    information with Health and Human Services, the IRS, and other
    agencies. So, for example, one data base at the Social Security
    Administration is--matches Internal Revenue Service and Social
    Security Administration data with census survey data and
    records of Cuban and Indo-Chinese refugees.
        The Department of Treasury, last but not least, holds a
    financing data base which contains millions of reports of
    banking activities of privately named U.S. citizens. They have
    also got the national data base of new hires, which holds
    records of the income and employment of every working American,
    updated quarterly.
        Now, to sum up, I don't want to suggest that all this data
    is part of some kind of sinister plot and we should all go
    around wearing tinfoil hats on our head, nor do I want to
    denigrate the well-intentioned efforts that have been made to
    make many of these data bases more secure, but what I would
    like to point out is that the growth of these data bases makes
    security and the need for internal controls against
    unauthorized use by government employees a systemic problem
    rather than an occasional problem, and it generally--the growth
    of these data bases threatens to shift the balance of power
    between individuals and the Federal Government. So this really
    is a systemic issue and it will be become more and more acute
    as we move away from a vision of limited government and want
    the government to be involved more and more in our day-to-day
    lives.
        Thank you.
        [The prepared statement of Ms. Singleton follows:]

        [GRAPHIC] [TIFF OMITTED] T4495.200

        [GRAPHIC] [TIFF OMITTED] T4495.201

        [GRAPHIC] [TIFF OMITTED] T4495.202

        [GRAPHIC] [TIFF OMITTED] T4495.203

        [GRAPHIC] [TIFF OMITTED] T4495.204

        [GRAPHIC] [TIFF OMITTED] T4495.205

        [GRAPHIC] [TIFF OMITTED] T4495.206

        [GRAPHIC] [TIFF OMITTED] T4495.207

        [GRAPHIC] [TIFF OMITTED] T4495.208

        [GRAPHIC] [TIFF OMITTED] T4495.209

        Mr. Horn. We thank you and now begin the questioning. What
    we'll do is alternate the questioning, 5 minutes for myself and
    5 minutes for the ranking member and back and forth until we
    get the questions out of our system.
        I'm going to start with the Department of Agriculture. As I
    recall in your statement, Agriculture repelled 250 hacker
    attacks. Were any of these successful attacks, Mr. Hobbs, and
    if so what kind of damage was done?
        Mr. Hobbs. In some instances, Mr. Chairman, the attacks
    were successful. They resulted in things like changes to Web
    pages. We report all of our intrusions. Some of them like
    changes to Web pages. We were able to identify where people had
    been able to access systems, but in no instance were there any
    major or significant damages done. In most instances we've
    taken the necessary steps to shut down what we consider to be
    backdoor ways that people were getting into the systems, and
    are trying to be more vigilant in our monitoring and tracking
    of those activities and those kinds of concerns.
        Mr. Horn. On the Agriculture, you completed the security
    questionnaire and it states the Department doesn't really feel
    that the system accreditation is important. A lot of other
    agencies feel the system accreditation, where possible, is
    important. Why isn't accreditation that important to the
    Department of Agriculture?
        Mr. Hobbs. I don't think that we said that it was not
    important. I believe that what we are doing is we have a
    prioritized program that we are working toward completion of,
    with systems accreditation being a part of that. So I don't
    think we said it was unimportant. I think what we said is we
    have a prioritized effect--direction in terms of which we're
    trying to proceed, and that we're moving with deliberate speed
    in that sense of looking at all aspects and all phases of our
    security program.
        Mr. Horn. Well let me ask Mr. Willemssen, on behalf of the
    General Accounting Office, as I understand, system
    accreditation is a formal management process to test and accept
    the adequacy of the system's security before putting it into
    operations. So how important is it to an agency's security
    computer programs that they're accredited; and could you
    explain that process and why most of the Departments are doing
    that where they can?
        Mr. Willemssen. We believe system accreditation is
    especially critical, and it represents management's judgment
    that they have gone in, made an assessment of the risk of a
    particular system and the associated data; that given the risk
    associated with the system and data, appropriate controls have
    been put in place to fend off any attacks that may occur, and
    that management is therefore making a declaration that the
    appropriate controls are there to deflect or at least be aware
    of any such attacks that may happen. We think it's especially
    important. Most agencies agree. We do see at times differences
    in nomenclature. Some agencies may actually be doing something
    similar to accreditation but may call it something else.
        Mr. Horn. Moving to the Department of Labor, Mr. Hugler, as
    I looked at the information, the computer security
    questionnaire indicated weaknesses in all six general control
    areas and the weaknesses were confirmed by the Inspector
    General's audit results. So I'm curious, what does the
    Department consider to be its most critical weaknesses?
        Mr. Hugler. Well, Mr. Chairman, I think you're correct to
    state what the Inspector General found last year and they did
    find weaknesses in all six areas. I think what's important to
    recognize is that we have now addressed all of those issues,
    and in fact the Inspector General's audit findings, as I
    recall, acknowledged that if we did two important things, one
    is put out the rules for the Department's computer security and
    put out the rules for the Department, in terms of systems
    development and life-cycle criterion rules, if we did those two
    things, that we would have addressed all six of the categories
    with which they found issues.
        We have done that and, more importantly I think, we have
    gone ahead aggressively with implementing those rules. And the
    example, I would cite to you, is our experience with the I-
    love-you virus. We have incident response procedures now in
    place at the Department. We had some 33,000 attacks from that
    virus. A small number of computers, 243 as I recall, were
    infected. I think the most--the best measure of our response,
    however, was the fact that we notified our employees of that
    virus and what to do with it 3 hours in advance of the official
    Federal notification.
        So I would commend your attention to that as an example of
    the kind of things we've been able to do over the last year. So
    really the OIG's findings from last year are just that, a year
    old, and we have improved dramatically since then.
        Mr. Horn. And so you would say the corrective action for
    these has been completed?
        Mr. Hugler. Yes, sir. At the Department level we have done
    that and I am very comfortable with that.
        Mr. Horn. I now yield 5 minutes to the gentleman from
    Texas, Mr. Turner.
        Mr. Turner. Thank you, Mr. Chairman. As I listen to each of
    you who come from your respective agencies, it causes me to
    come back to a comment Mr. Gilligan made about the importance
    of cross-government initiatives. As many of you know, I have
    been an advocate of having a Federal CIO, a chief CIO for the
    Nation, someone who had the expertise, the competence, the
    leadership role, as well as the budgetary support necessary to
    be sure that we can have stronger cross-government initiatives
    in the area of information technology and certainly in the area
    of computer security.
        And I think I'd like to ask you, Mr. Gilligan, to expand
    upon your assessment of the need for these cross-government
    initiatives, and I would be interested in your insight on it,
    because not having nearly the expertise in the area that you do
    nor the experience in the area, I still am left, after hearing
    all this testimony, with the conviction that the area of
    information technology certainly provides the potential for the
    expenditure of vast sums of Federal dollars in a very
    inefficient way. And I would be interested in your comments on
    the idea of more emphasis on cross-governmental initiatives and
    what kind of leadership might be necessary to ensure that
    happens.
        Mr. Gilligan. Mr. Turner, I'd be happy to comment. What I
    have found in my activities in the CIO Council is that the
    potential that you allude to for enormous sufficiencies as a
    result of cross-government IT efforts is there, but that
    potential is difficult to realize because our fundamental
    government structures in the executive branch and in the
    legislative branch tend to be stovepipe-oriented on particular
    agencies and particular missions, and in fact, what I have
    found is the most difficult efforts to get support for are
    cross-government initiatives. And relatively small sums of
    money that would have enormous benefits often fall through the
    cracks because there is no clear forum for advocacy. And
    individual committees, whether they be in the executive or the
    legislative branch, tend to be very narrowly focused on that
    portfolio to which they're assigned responsibility.
        In my testimony, I noted our best security practices
    effort. This is an effort that is enormously compelling. The
    objective is to pull together best security practices from
    across the Federal Government, provide a Web repository where
    they can be accessed easily, and to share this wealth of
    experience that we have across the government.
        We have found that getting small sums, hundreds of
    thousands of dollars for this initiative, is very difficult,
    and it's not that the effort is not supported. It is supported.
    And when I talk to members in the administration and Members of
    Congress, it is supported. But the question is, ``who should
    pay for it and where should that funding come from?''
        The Federal incident response capability, FedCIRC, which is
    our government's central point for disseminating information on
    viruses and patch updates, is funded through a set of
    committees. It is sponsored by Department of Defense, the FBI
    and GSA. We have found in the recent remarks that the report
    has not been strong, and again I don't think it's because the
    merits of this effort are not supported in general. It's that
    there is no central focus that helps bring this together and to
    help identify that these individual, relatively small dollar
    items in individual budgets, are in fact of far greater
    importance than their small dollars would indicate.
        And so I think as you suggest, this is an area where we
    desperately need to focus attention. I think not only in the
    security area will it help us improve security, but we can far
    better leverage the enormous resources that we do have in
    attacking a whole range of information technology issues.
        Mr. Turner. Thank you.
        Mr. Spotila, I know you have worked in this area, and one
    of your duties at OMB is to try to be sure that we move toward
    the kind of things Mr. Gilligan is talking about. I know there
    is a Presidential directive that established two tiers of
    agencies. It strikes me, and you might want to explain that a
    little bit, but it strikes me that it is certainly appropriate
    to acknowledge that the importance of computer security may
    vary from agency to agency, and that when we try to focus our
    resources, perhaps we should choose certain agencies over
    another. If we did that, we would expect to see different
    grades from the agencies because we would have made a choice
    regarding where to place the initial dollars to improve
    security. But describe for us a little bit that Presidential
    directive that established those first, those two tiers.
        Mr. Spotila. Yes, Mr. Turner. First of all, let me just
    mention that OMB has been very supportive, as I've testified to
    the committee before, of these cross-cutting initiatives. We
    share Mr. Gilligan's belief that these are very important, that
    they would make a great deal of difference, and that they do
    need support.
        The President, in May 1998, put out a Presidential Decision
    Directive aimed at critical infrastructure protection. It was
    at that time that he designated Mr. Richard Clark as his
    adviser on counterterrorism. He's worked with the committee and
    has been very active. The Critical Infrastructure Assurance
    Office was then established.
        What we have tried to do in the administration is to
    prioritize in this area. I mentioned in my testimony that OMB's
    focus has been on the same 43 high-impact programs that we
    focused on during the Y2K effort. We have more than 26,000
    systems in the government. If we're going to enhance our
    ability to serve the American people by promoting effective
    information security, we need to prioritize. We need to start
    with the areas that have the greatest impact, whether they be
    agency by agency, or, more accurately, within agencies, program
    by program, system by system.
        The Critical Infrastructure Assurance Office has tried to
    zero in on those areas, those agencies, and those aspects
    within agencies that have the greatest importance and perhaps
    would be at risk the most. We've tried to work at OMB at
    focusing on the programs that we think have the greatest impact
    on the American people; as I'd mentioned, Medicare, Medicaid
    and the like. We think that we have to begin with the most
    important things. That's where we're going to have the most
    significant improvement and have the most significant benefit,
    which is not to say that we ignore all the other areas. We put
    out general guidance. We're working with the agencies. We're
    relying on the agencies to try to improve their efforts in this
    regard across the board.
        But in terms of White House attention, we're obviously
    starting with the things that matter the most.
        Mr. Turner. Thank you.
        Mr. Horn. Let me add to that the following. This is the
    last month of a fiscal year. This is the time Cabinet officers,
    deputy secretaries, assistant secretaries, all of them sit
    around and say, what can we do with the surplus we have in our
    budget? And having been in administration, I know exactly what
    they do, and this is the time, if they're serious about this,
    to reprogram some of that money into what everybody's saying,
    oh, we've got to have new money. That isn't the way we started
    with Y2K. We started when I urged a lot of the people to start
    reprogramming.
        When Dr. Raines came in as budget director, he said, You're
    absolutely right, and that's what I'm going to tell them. And
    he did, and that's how we got the job done. We also made sure
    Congress provided the money. But if they're serious in these
    various executive branch agencies, this is the time to get a
    few million here and there.
        And then besides that, let's just talk about a few simple
    steps such as policies requiring regular changing of passwords,
    safeguarding equipment, turning off computers. That doesn't
    cost a thing. That just costs doing it, if any. And I guess I
    would ask, because energy has certainly been in the papers for
    the last 2 years on this, but I'd ask, is there in OMB the
    concern about policies to just get those basic areas done?
        Mr. Spotila. Let me respond in a couple of respects.
        First of all, I agree with you, Mr. Chairman, that some
    agencies are going to have discretionary funds available this
    September. We would certainly hope that they would apply them
    to this area. I know that the various CIOs at this table and
    others around government are going to do all they can to try to
    impress that upon their agency heads. So I think that we do
    need to be serious; just as all of us need to be serious, the
    executive and the legislative branch, because this is a really
    important area.
        We have a lot of policy out there, even things that you
    mentioned about passwords, changing passwords and the like. The
    key is getting people to implement and follow the policy that
    may be out there. One of the things I emphasized in my
    testimony today and in my written testimony is that, in order
    to have effective security, it is essential that nonsecurity
    people buy in, that they participate, that they understand the
    significance and that they buy into it. Because we can have all
    the policies in the world and we can have all the centralized
    supervision in the world, but if that person at the desk
    doesn't follow it, it doesn't do any good.
        You know, we tell the story about having very complex
    passwords that people write on little yellow sticky notes and
    paste to their computer screen. You can't have effective
    security without cooperation at all levels, and it's a message
    that we're trying to impart throughout the government. I think
    it will be an ongoing challenge to continue to do that.
        Mr. Horn. I thank you very much.
        Let me ask Mr. Dyer, who's got the B grade, the social
    security system, there is--apparently you're farther along than
    most other agencies now. Do you have a best practices that
    others might implement and what are they?
        Mr. Dyer. Mr. Chair, I think it's just like when we
    approached Y2K. Early on we saw it coming, and we
    institutionalized the process, the resources to deal with it.
    And we've done the same thing with security. It's part of our
    life cycle with our programs. Anytime we think about bringing
    up a new system, we look at the security aspects. Any
    modification to any system, we check the security all the way
    through and how it could roll over into other security systems.
        I pick up on what GAO said and what John Spotila said. The
    biggest challenge we're finding is managing it. You can have
    good procedures, policies, rules in place, but you constantly
    have to be working with your managers, your employees that they
    follow them, and that's where we've been putting a tremendous
    amount of our effort.
        We've had conferences across the country. We've set up
    centers so that we're able to make sure that we have people in
    place that are doing the dogging and checking it. We change
    passwords every month now. We found that it just didn't happen
    the way it should. So we have instituted it. We're going
    through. We found out that they change the passwords to
    something they could remember. We now have software to check to
    see if it's dates of birth or names of family members or
    whatnot so you can start to screen those things out.
        So, to me, it's a constant management challenge. You can do
    the systems, but you've got be there, right there on top of it
    all the time.
        Mr. Horn. In my 26 seconds remaining, Mr. Willemssen,
    anything you want to add to that as to what might be done that
    isn't being done?
        Mr. Willemssen. One thing that I would add, Mr. Chairman--
    and it somewhat extending off of Mr. Spotila's comment--and
    that is, it's one thing for agencies to have the policies and
    procedures which I think in many cases they do. It's quite
    another to see whether the accompanying practices have actually
    been put in place.
        That's been particularly the case when we and Inspectors
    General go out and we test whether these policies and
    procedures are actually being implemented. They often have not
    been. And that really is a key distinction I think often
    between what the agencies believe is going on and what may
    actually be happening, although I think there is clearly many
    of the agencies are on the road for improvement in that
    direction, also.
        Mr. Horn. I now yield 5 minutes to the gentleman from
    Texas, Mr. Turner.
        Mr. Turner. Thank you, Mr. Chairman.
        The designation of the Presidential directive--is it tier
    1, tier 2, phase 1, phase 2, whatever it's called--I'm curious
    as to what kind of impact that has and how is that designation
    significant; and I'd like, Mr. Hugler, if you would, to comment
    on that because I know Department of Labor is a tier 2
    designation.
        Mr. Hugler. Yes, sir. Thank you, Mr. Turner.
        It is an important distinction, because it is important to
    recognize that some agencies handle more sensitive information
    and have more sensitive systems than others do. We certainly
    believe that our mission is important to American workers, but,
    frankly, we do not have critical information that directly
    implicates national security. So, as such, if we are going to
    prioritize funding and implementation priorities, I think it is
    appropriate for the Department of Labor to be a phase 2 agency
    or tier 2 agency.
        I think it's also important to note, though, that we take
    those responsibilities as a tier 2 agency as important and that
    we meet them and we are on target to meet all the milestones
    for which we are accountable.
        Mr. Turner. Mr. Spotila, when you think about funding for
    these various agencies to be sure they move forward in the area
    of computer security, do you make budgetary recommendations
    based on this phase 1, phase 2 designation?
        Mr. Spotila. What we do in the first instance is to
    actually have the agencies themselves come to OMB with their
    own determinations as to what they'd like to accomplish and
    what they feel they need in the information security area. They
    do so within their overall budget submissions when they go
    through the OMB review process.
        With the guidance that OMB put out earlier this year,
    focusing on the next budget year, we've made it very clear that
    information security needs to be part of that agency initial
    analysis. It needs to be integrated within the entire area of
    information technology planning for budget purposes because we
    don't believe that doing it as an add-on is effective at all.
        Within the budget review process, obviously if an agency is
    a higher priority, if the need is greater, that will be
    recognized in the process. Very often, the budget issues turn
    more on whether or not the proposal has been well thought out,
    whether it is likely to be a good use of money and a good
    expenditure of money and one that is likely to contribute not
    only to increased security but the agency's performance of its
    mission. Those are the kinds of factors that OMB takes into
    account, just as later on the Congress will take that into
    account.
        And your comment earlier about the risk, that money could
    be wasted in this area, is also something that we take very
    seriously. You can't just fund a proposal because it sounds
    good or because the agency is an important agency or the area
    is an important area. You have to make certain that the
    proposal will work, that it will contribute something that will
    add value and will involve money well spent. And so this
    analysis is actually a very comprehensive and thorough one.
        We think in the next budget cycle we're going to get better
    submissions from the agencies. We've been working with the
    agencies directly one on one to get them to understand the
    change. We're expecting that in the IT area we are going to
    receive budget submissions that are better thought out and that
    will have better justifications.
        Mr. Turner. Mr. Gilligan made a strong case for greater
    emphasis on cross-agency initiatives. What has OMB done to
    promote greater cross-agency efforts?
        Mr. Spotila. We've actually been doing a variety of things.
    We've worked closely with the CIO council, which I've chaired
    since last year until their DDM was confirmed. We've worked
    closely with John and his committee in that regard trying to
    identify areas. We've worked closely with Dick Clark and the
    Critical Infrastructure Assurance Office and the national
    security community and with others throughout OMB and the
    agencies trying to identify areas where crosscutting
    initiatives would help.
        John mentioned public infrastructure which would enable us
    to authenticate signatures. We think that's an important area.
    We know we need better intrusion detection capability. We think
    we need expert review teams that can get out onsite in the
    various agencies and help them not only assess security but try
    to improve their efforts in security. We think we need more
    efforts in the R&D area. We need scholarships for people to
    start learning this area so that the Federal Government can get
    the kind of personnel it needs with the kind of experience and
    educational background it needs to work in this area over the
    long term.
        So we have tried to identify areas of need, working closely
    with all these other parties, and then within the budget
    process we've actually given it a huge amount of support to try
    to help develop proposals that make sense, that will have
    credibility with the Congress, that will work once implemented.
        I think that the reality is we do start with a stovepipe
    approach. We all need to think outside of the box. We need to
    make certain that, as we do crosscutting initiatives, that they
    work so that we can buildup credibility and support for further
    efforts in the future. That's something we take very seriously,
    and I think that will be an ever-growing need in the future.
        Mr. Turner. How many dollars have you expended on cross-
    agency initiatives and how many of them have been accomplished?
        Mr. Spotila. Well, I think the reality is that in the past,
    as John has said, when there have been efforts like
    crosscutting initiatives, for example, support of the CIO
    Council and its efforts, we've done that by what John indicates
    is passing the hat. Under the Clinger-Cohen Act, we have some
    ability to do that, to have agencies contribute toward support
    of crosscutting measures.
        The President's budget, as I outlined in my testimony, not
    only includes an increase for computer security in general, but
    it highlights crosscutting initiatives that we think are very
    important. John mentioned that for $50 million an awful lot can
    be accomplished. I think the President's request is actually
    greater than that in this area because we're also focusing on
    research and development and on cyberscholarships and the like.
    Still, we're looking at a relatively small amount of money.
    $150 million would make a huge impact in this area. The key is
    to get it appropriated.
        And so when we talk about past crosscutting initiatives
    it's hard to track because we haven't had the kind of
    appropriations in large numbers that we're talking about here.
    We have used relatively small amounts of money to support the
    CIO Council and some other developmental areas along these
    lines. The GITS Board, for example, worked on the PKI--public
    key infrastructure-- issue for some time. The Board has now
    been rolled into the CIO Council. We've identified a need to do
    much more of this going forward. I think the key now will be to
    see what happens in the appropriations process this fall.
        Mr. Turner. You've requested how many dollars for cross-
    agency initiatives?
        Mr. Spotila. We have a list in my testimony that I can just
    mention, highlight real quickly.
        Mr. Turner. Where would that be found?
        Mr. Spotila. In my written testimony?
        Mr. Turner. I mean in the budget itself. Is it
    appropriations in OMB? Is that where the money would reside
    currently?
        Mr. Spotila. No. Actually, although these are crosscutting
    initiatives in the budget, they appear in the departmental
    submissions. So, for example, the Department of Commerce is
    seeking $5 million for NIST to establish an expert security
    review team that can then go to agencies, to a number of
    different agencies outside of Commerce. That's an example. When
    we talk about crosscutting initiatives, because of the nature
    of the appropriations process, it needs to appear in an
    individual agency's budget. Part of the difficulty is--not to
    single out Commerce--if that particular appropriations
    committee or subcommittee doesn't think it a priority, that an
    expert security review team at Commerce will be helping 25
    other agencies, they might give it less support. That's where
    the difficulty comes in the budget process.
        So all of these so-called crosscutting initiatives still
    appear in individual agency budget submissions.
        Mr. Turner. I think that's one of the things that I have
    concern about, that perhaps we need some central location, some
    leadership for this that would flow through our Federal CIOs to
    be sure that these things happen. Because I think what you're
    left with, even after you secure the appropriations agency by
    agency, you're still in the pass-the-hat mode, which I think is
    one of the problems that we perhaps face in the area that we
    are discussing.
        Thank you, Mr. Chairman. I know my time's expired.
        Mr. Horn. Thank you.
        Let me followup on that again. There's obviously a concern
    when you have these cross--the boundaries, if you will,
    initiatives. Now, can--on reprogramming, you know, $5 million,
    that's chicken feed to any agency. They have got the--they can
    reprogram that.
        So you don't really need to worry too much. But you're
    right. If they're trying to help four or five other agencies,
    the appropriations and authorizers here might say, hey, not on
    my beat, put them somewhere else. So--but, hopefully, that's
    why OMB is there, to sort of help straighten it out.
        I am not going to embarrass any of the CIOs here, the chief
    information officers, but have the secretaries and heads of the
    agencies within the executive branch been responsive to the
    efforts to strengthen computer security? And I just--perhaps
    Mr. Gilligan on behalf of the CIO Council, Chief Information
    Council, do you get a feeling in those meetings that some of
    them just--these are not, obviously, here. They're other
    places. But do you get a feeling that they're not getting good
    backing from the top executives in the agency?
        Mr. Gilligan. It's my clear sense that the senior
    executives across the agencies are getting the message. It's a
    complex issue, and I think the difficulty, as I addressed in my
    testimony, is understanding both that cybersecurity is
    important, and understanding what to do about it are two
    different things, and I think that's, in many cases, where
    agencies are stuck. It is not an issue that can be delegated
    down. It has to be undertaken and aggressive leadership has to
    be provided by senior management, as we found with Y2K.
        So I reiterate, I think the actions of the senior levels of
    the administration, and of this committee and others are going
    to be important in helping to get that message across. While
    there are complex technical issues that equate to rocket
    science, there is a foundation that must be built that is just
    good sound management practice that requires aggressive
    involvement at the senior levels.
        Mr. Horn. Let me move to another question, that when we had
    this discussion a few minutes ago on the libertarian
    suggestions, what message do the grades that we have given you
    send to the American people regarding the security of the
    citizens' personal information? Should we have a special
    category in that as to how that's dealt with in an agency and
    on those files that such as the census and others are the
    obvious one over in Commerce? Should we have a category as to
    how high in the agenda and hierarchy of things to be done that
    you first protect the information of the American citizen from
    getting out for people making use of those data and, therefore,
    perhaps as we've seen what's happened in credit card operations
    is some of these idiots take exactly the whole name and number
    and all the rest of it, and the result is that those poor souls
    can never get a loan again because somebody's running around
    the country with their credit card. Well, isn't that also true
    in some of the agencies here? What do you think, Mr. Spotila?
        Mr. Spotila. Well, let me start by saying that we take very
    seriously the importance of preserving the confidentiality of
    information that the government holds. As we've been discussing
    throughout this morning, we recognize that, although a lot of
    progress has been made, we are not done. We cannot afford to be
    complacent because the challenge in this area is a dynamic one.
    The threat changes; new technology, new threats can appear. And
    so, on a day-by-day basis, we need to continue to do the best
    we can and to improve our efforts.
        Without getting into the grades themselves, we all agree
    here that there is room for improvement. I'm perhaps more
    sanguine in the sense that I think that the information that
    we're talking about here is not at great risk. I think the
    agencies are very careful about protecting that information, as
    John Dyer indicated at Social Security. They take it very
    seriously and realize the importance of it. This is not to say
    that we're complacent. A new threat could emerge tomorrow that
    hasn't been anticipated, and a part of what you need in the
    security area is the ability to detect intrusions and to react
    to them and to correct problems when they surface.
        So I would say to the American people that we take security
    very seriously and that we all need to work together on behalf
    of the American people in this area.
        Mr. Horn. Mr. Willemssen, you've looked at a lot of
    agencies over the years. What is your answer to that question
    and how worried should the American people be about this
    situation?
        Mr. Willemssen. Well, I think--point one, Mr. Chairman, I
    think it's imperative to point out that absolute protection is
    not possible, and so we've got to look at this from a risk
    perspective. And in doing those risk assessments, the higher
    the sensitivity of systems and data, then the more rigid and
    tight the controls need to be and agencies need to make that
    up-front judgment on how much risk for particular systems and
    data they're willing to accept and, given that acceptance of
    risk, then put in the appropriate controls.
        And I think in many cases we still have agencies who
    haven't done the in-depth risk assessments of systems and data
    in order to come to those judgments because not all systems and
    data are created equal. There has to be some judgments up front
    on what we absolutely have to protect as best as possible,
    again recognizing that there is no absolute as it pertains to
    protection but that we can narrow the margin significantly.
        Mr. Horn. Ms. Singleton, would you like to get your licks
    in, shall we say?
        Ms. Singleton. I'd like to offer one additional comment
    along those lines, which is to say that part of the problem
    that I think the American people might perceive with this
    system as a whole is that in the private sector if you leak a
    document--say you work in a law firm and you leak a document
    about a client. The law firm stands a good chance of losing its
    client and you stand a good chance of losing your job. But
    there's a greater perception I think on the part of the
    American people--and partly it's correct that, in a Federal
    Government agency, if there's a leak or a mistake or an error,
    that there will be relatively lesser consequences for the
    agency as a whole and for the employee of that agency than
    there would be in the private sector.
        For example, if somebody in the agency does lose your file
    or give it to the wrong person, you still have to deal with
    that agency. You can't go to say another Department of
    Agriculture or another Department of Labor and find a, you
    know, better security practice there. So I think that also goes
    to the issue of some of the expense involved, is that it would
    be very helpful for the perception of the American people to
    have an understanding that if these policies are violated that
    there will be real consequences for the agency and for the
    employees involved.
        Mr. Horn. Well, we thank you on that.
        I'm going to have a few closing words, and I want to thank
    the staff and tell you what we're doing tomorrow here.
        It's clear that a great deal of attention must be focused
    on this vital issue. There's a lot of computer security policy
    out there, but it isn't necessarily being followed by some
    agencies and others. And when we look at all of the State
    governments you've got another matter there in terms of
    privacy. What does it take, legislation? You can be assured if
    it does we will continue to monitor the government's progress
    in this area.
        This report card sets a baseline for the future oversight.
    It also is a wake-up call for Federal departments and agencies
    to begin taking the necessary steps to ensure that the
    sensitive information contained in the computers will be
    protected.
        Tomorrow at 10 a.m. the subcommittee will hold a related
    hearing to examine two proposals that would establish the
    position of a Federal chief information officer. The gentleman
    from Texas has proposed that. Among other responsibilities,
    this governmentwide position would be responsible for the
    government's computer security efforts, and that's one
    approach, and that's in essence what we asked the President to
    do in the summer of 1997, was get somebody to put them in
    charge.
        Now, they didn't move for about a year, but when they did
    move that was exactly what was needed to get the coordination,
    somebody to be assistant to the President as Mr. Constant was
    when he was brought back into government, and he did a very
    fine job of pulling all the pieces together. Because I would
    ask, has the President brought this up at a Cabinet meeting?
        And, Mr. Spotila, I don't know if you know the answer to
    that, but in the Eisenhower administration, that thing would
    have been up there 10 years before. That's what Social Security
    was under the Y2K. They were on their own. There was no
    administration. They went through three of them in that period
    that didn't really face up to it until the bells were really
    ringing.
        So that's one of our concerns. But I think the next round
    we'll have a better feel for how accurately and diligently the
    agencies are doing it.
        I want to thank each of these witnesses today, and I want
    to thank the staff on both the minority and majority: J.
    Russell George, staff director, chief counsel of the
    subcommittee; Randy Kaplan, counsel; on my left, your right,
    Ben Ritt, professional staff member on loan from the GAO and
    the one that has had a lot of effort on putting this particular
    hearing together; Bonnie Heald, director of communications;
    Bryan Sisk, clerk; Elizabeth Seong, staff assistant; Earl
    Pierce, also a professional staff member; and George Fraser,
    intern.
        On Mr. Turner's side, Trey Henderson, minority counsel; and
    Jean Gosa, minority clerk.
        Court reporters, Colleen Lynch and Melinda Walker.
        May I say that we're now going to end this, and I know the
    media have wanted to have some questions, and those of you that
    would like to stay, please, gentlemen, and Ms. Singleton,
    you're welcome to stay. You're the experts in a lot of these,
    and I'm sure they'd like to ask you a few questions, but we
    won't do it in a formal hearing, and we--I don't know how the
    oath spreads over to a press conference, but we're in recess
    here. So--till tomorrow anyhow.
        [Whereupon, at 11:50 a.m., the subcommittee was adjourned.]