[Senate Hearing 106-889]
[From the U.S. Government Publishing Office]
S. Hrg. 106-889
CYBER ATTACKS: THE NATIONAL PROTECTION PLAN AND ITS PRIVACY
IMPLICATIONS
=======================================================================
HEARING
before the
SUBCOMMITTEE ON TECHNOLOGY, TERRORISM,
AND GOVERNMENT INFORMATION
of the
COMMITTEE ON THE JUDICIARY
UNITED STATES SENATE
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
on
EXAMINING THE VULNERABILITY OF U.S. SYSTEMS TO CYBER ATTACK, FOCUSING
ON THE ADMINISTRATION'S NATIONAL PLAN FOR INFORMATION SYSTEMS
PROTECTION AND ITS IMPLICATIONS REGARDING PRIVACY
__________
FEBRUARY 1, 2000
__________
Serial No. J-106-62
__________
Printed for the use of the Committee on the Judiciary
U.S. GOVERNMENT PRINTING OFFICE
68-776 CC WASHINGTON : 2001
COMMITTEE ON THE JUDICIARY
ORRIN G. HATCH, Utah, Chairman
STROM THURMOND, South Carolina PATRICK J. LEAHY, Vermont
CHARLES E. GRASSLEY, Iowa EDWARD M. KENNEDY, Massachusetts
ARLEN SPECTER, Pennsylvania JOSEPH R. BIDEN, Jr., Delaware
JON KYL, Arizona HERBERT KOHL, Wisconsin
MIKE DeWINE, Ohio DIANNE FEINSTEIN, California
JOHN ASHCROFT, Missouri RUSSELL D. FEINGOLD, Wisconsin
SPENCER ABRAHAM, Michigan ROBERT G. TORRICELLI, New Jersey
JEFF SESSIONS, Alabama CHARLES E. SCHUMER, New York
BOB SMITH, New Hampshire
Manus Cooney, Chief Counsel and Staff Director
Bruce A. Cohen, Minority Chief Counsel
______
Subcommittee on Technology, Terrorism, and Government Information
JON KYL, Arizona, Chairman
ORRIN G. HATCH, Utah DIANNE FEINSTEIN, California
CHARLES E. GRASSLEY, Iowa JOSEPH R. BIDEN, Jr., Delaware
MIKE DeWINE, Ohio HERBERT KOHL, Wisconsin
Stephen Higgins, Chief Counsel
Neil Quinter, Minority Chief Counsel and Staff Director
(ii)
C O N T E N T S
----------
STATEMENTS OF COMMITTEE MEMBERS
Page
Kyl, Hon. Jon, U.S. Senator from the State of Arizona............ 1
Feinstein, Hon. Dianne, U.S. Senator from the State of California 18
CHRONOLOGICAL LIST OF WITNESSES
Statement of John S. Tritak, Director, Critical Infrastructure
Assurance Office, Washington, DC............................... 20
Panel consisting of Marc Rotenberg, Executive Director,
Electronic Privacy Information Center, Washington, DC; and
Frank J. Cilluffo, senior policy analyst, Center for Strategic
and International Studies, Washington, DC...................... 46
ALPHABETICAL LIST AND MATERIAL SUBMITTED
Cilluffo, Frank J.:
Testimony.................................................... 53
Prepared statement........................................... 57
Kyl, Hon. Jon: Prepared statement of Jack L. Brock, Jr., Director
Governmentwide and Defense Information Systems, Accounting and
Information Management Division................................ 4
Rotenberg, Marc:
Testimony.................................................... 46
Prepared statement........................................... 49
Tritak, John S.:
Testimony.................................................... 20
Prepared statement........................................... 39
APPENDIX
Questions and Answers
Responses of John Tritak to Questions from Senators:
Kyl.......................................................... 69
Biden........................................................ 76
Feinstein.................................................... 77
CYBER ATTACK: THE NATIONAL PROTECTION PLAN AND ITS PRIVACY IMPLICATIONS
----------
TUESDAY, FEBRUARY 1, 2000
U.S. Senate,
Subcommittee on Technology, Terrorism,
and Government Information,
Committee on the Judiciary,
Washington, DC.
The subcommittee met, pursuant to notice, at 10 a.m., in
room SD-226, Dirksen Senate Office Building, Hon. Jon Kyl
(chairman of the subcommittee) presiding.
Also present: Senators Feinstein and Bennett [ex officio.]
OPENING STATEMENT OF HON. JON KYL, A U.S. SENATOR FROM THE
STATE OF ARIZONA
Senator Kyl. The subcommittee will please come to order.
Let me first welcome everyone to this hearing of the
Subcommittee on Technology, Terrorism, and Government
Information. Today, we will examine the National Plan for
Information Systems Protection, released by the President on
January 7, and its implications regarding privacy. This is the
fifth public hearing we have held on cyber protection in the
last 2 years, and the first where we can finally review the
long overdue National Plan mandated by the 1996 Defense
Authorization Act.
The United States, of course, is the most technologically
sophisticated country in the world. Today, virtually every key
service in our society is dependent on computer technology--
electric power grids, air traffic control, nuclear warning,
banking, just to name a few examples. Highly interdependent
information systems control these infrastructures.
With the benefits of technological advances comes a new set
of vulnerabilities that can be exploited by individuals,
terrorists, and foreign nations. Our enemies don't need to risk
confronting our powerful military if they can attack
vulnerabilities in our critical information infrastructure.
According to the National Security Agency, more than 100
nations are working on information warfare tactics. There have
already been a disturbing number of attacks on U.S. information
systems, exposing our Achilles heel to any potential adversary.
At our last hearing, Michael Vatis, from the FBI, described
how Russia conducted a ``series of widespread intrusions into
Defense Department, other Federal Government agencies, and
private sector computer networks.'' Additionally, China is
reportedly considering forming an entirely new branch of the
military for information warriors.
A recent article in the Chinese Liberation Army Daily
assessed that the integration of Web warfare with ground combat
will be essential to winning future conflicts. Moreover a
recent book titled ``Unrestricted Warfare,'' written by two
Chinese Army colonels, proposes tactics for developing
countries like China to use to compensate for their military
inferiority versus the United States. One scenario described in
the book envisions a situation where the attacking country
causes panic through cyber attacks on civilian electricity,
telecommunications, and financial markets. These examples
underscore the severity of the threat facing the United States.
In light of these concerns, I authored an amendment to the
1996 Defense Authorization Act directing the President to
submit a report to Congress ``setting forth the results of a
review of the national policy on protecting the national
information infrastructure against strategic attacks.'' This
ultimately culminated in the National Plan before us today,
which is more than a year overdue.
I am pleased that the Plan calls for specific milestones
with timetables for securing our Nation's information systems,
although its goals are modest and merely a first step. I hope
the administration considers the Plan a living document that
must be reviewed and revised with new technological advances
and discovered vulnerabilities. This will be a complicated and
expensive process, but it is vital to protect our national
security and way of life. To support the effort, I am
encouraged that news reports indicate the President's budget
will include a $160 million increase in spending on cyber
security initiatives.
In securing the critical infrastructures that provide our
way of life, we must be careful that it doesn't occur at the
expense of civil liberties. We need to update our current legal
framework to reflect the revolution in information technology,
to strike the right balance between security and civil
liberties.
The reality is that doing nothing to enhance our cyber
security, in fact, erodes the privacy and civil liberties of
Americans by making public information accessible to any hacker
with a computer and a modem. Let me repeat that. The reality is
that doing nothing to enhance our cyber security, in fact,
erodes privacy and civil liberties of Americans by making
information accessible to any hacker with a computer and a
modem. The National Plan's implementation must consider the
reasonable privacy issues that must be discussed and
appropriately balance them with security interests.
Our witnesses are well-suited to address these issues. Mr.
John Tritak, Director of the Critical Infrastructure Assurance
Office, is responsible for the development of the National
Plan. He will summarize the Plan and speak to the privacy
issues it raises.
Our second panel--Mr. Frank Cilluffo, senior policy analyst
at the Center for Strategic and International Studies, and Mr.
Rotenberg, Executive Director of the Electronic Privacy
Information Center--will testify about the balance between
security and civil liberties in implementing the Plan. Please
note that Mr. Barry Steinhardt, from the ACLU, was also invited
to testify, but respectfully declined.
I also want to acknowledge excellent testimony that I am
going to put in the record from the General Accounting Office.
Jack Brock, who is the Director of the Governmentwide and
Defense Information Systems Accounting and Information
Management Division, is here today, and I very much appreciate
the fine testimony that he presented on critical information
and infrastructure protection which will be put in the record
here.
[The prepared statement of Mr. Brock follows:]
[GRAPHIC] [TIFF OMITTED] T8776.001
[GRAPHIC] [TIFF OMITTED] T8776.002
[GRAPHIC] [TIFF OMITTED] T8776.003
[GRAPHIC] [TIFF OMITTED] T8776.004
[GRAPHIC] [TIFF OMITTED] T8776.005
[GRAPHIC] [TIFF OMITTED] T8776.006
[GRAPHIC] [TIFF OMITTED] T8776.007
[GRAPHIC] [TIFF OMITTED] T8776.008
[GRAPHIC] [TIFF OMITTED] T8776.009
[GRAPHIC] [TIFF OMITTED] T8776.010
[GRAPHIC] [TIFF OMITTED] T8776.011
[GRAPHIC] [TIFF OMITTED] T8776.012
[GRAPHIC] [TIFF OMITTED] T8776.013
[GRAPHIC] [TIFF OMITTED] T8776.014
Senator Kyl. Senator Feinstein, would you like to make your
opening statement?
STATEMENT OF HON. DIANNE FEINSTEIN, A U.S. SENATOR FROM THE
STATE OF CALIFORNIA
Senator Feinstein. Thanks very much, Mr. Chairman, and
thank you for your leadership. As always, it is a pleasure to
work with you.
The subject today we discuss is, I think, one of the most
important we face. In my view, the security of information and
networks will be the biggest national security issue of the
decade and one that I think deserves the close oversight of
this committee.
I think the events of the last few weeks alone remind us of
the importance of information security. Just a few days ago,
the National Security Agency publicly admitted what may be the
biggest single intelligence failure in its 48-year history.
From Monday until late Thursday of last week, NSA's computers
were unable to process the millions of communications
intercepts flowing in from around the world from U.S. spy
satellites. The system that was down is the same one used to
track terrorists such as Osama Bin Laden.
And just a month ago, on New Year's Eve no less, another
critical United States spy satellite system crashed. This was
the same day that numerous terrorist attacks were planned
against American citizens, but fortunately prevented. And this
crash occurred after the satellite system had been extensively
tested for Y2K bugs.
These recent failures of some of our most important and
sensitive computer systems have jeopardized our national
security and the safety of our citizens. They remind us that
our critical infrastructures are governed by computer networks
and systems, and that if these networks and systems are
disrupted or disabled, American citizens will be left
vulnerable to economic disruption, to possible injury, and to
possibly death.
Of course, computers not only process signals intelligence,
but are responsible for the delivery to virtually every
American of electric power, oil and gas, communications,
transportation services, banking and financial services, and
other vital needs. These computers present a tempting target to
hackers, to terrorists, and hostile nations because, given our
military supremacy, few adversaries would wish to fight the
United States in a conventional war on a traditional
battlefield.
Moreover, because so many of our computers are
interconnected often through the open architecture of the
Internet, there may be less reason for a hostile party to try
to terrorize us with bombs, tanks, or planes. With a few
keystrokes on a computer keyboard half a world away, such a
party could wreck colossal damage. And every single day,
someone tries to cause such damage.
In fact, the computers controlling our critical
infrastructure are under practically continuous assault.
Everyday, assailants make hundreds of unauthorized attempts to
gain access to crucial computers. For example, last year there
were some 20,000 reported cyber attacks on Department of
Defense networks and systems alone, an almost four-fold
increase from the previous year. And many attacks go
undetected, which means that the numbers are almost certainly
higher than reported.
I think Americans like to think that the United States has
not been invaded since the War of 1812. But, in fact, we are
invaded everyday. A foreign army once burned the White House
and the Capitol in this very city. But now an intruder could
cause even greater damage to our Government without even
setting foot in the country.
As U.S. Deputy Secretary of Defense John Hamre has said,
``We are at war right now, we are in a cyber war.'' This war is
largely invisible unless, of course, a cyber attack succeeds,
and that has meant that every American is not as aware of the
threat of cyber attacks as they should be. Indeed, it is hard
to visualize a cyber attack.
Moreover, even if an attack is detected, it is difficult to
determine who is making it and where it is coming from. Through
the magic of the Internet, an attack from next door can seem to
come from the other side of the world. It is much easier to
think of a person or persons physically attacking sites such as
Pearl Harbor, the World Trade Center, the Khubar Towers in
Saudi Arabia, or the Murrah Building in Oklahoma City than
mounting an electronic assault on a computer.
But it is a great mistake to think that terrorists nowadays
will only, or even primarily, target government installations
or military bases. In fact, 90 percent of critical
infrastructure is owned or operated by the private sector.
Thus, the battlefield has shifted to public and private
computer networks, and society itself has become more, not
less, vulnerable to terrorist threats.
While cyber threats seem invisible, they can have serious
effects when they succeed, and in recent years there have been
a number of incidents of that. In 1999, hackers in China and
Taiwan engaged in a cyber war. One expert suggests that Taiwan
computers suffered 72,000 cyber attacks in August 1999 alone,
while two Taiwanese attacks on China damaged 360,000 computers
and caused $120 million in damage.
In 1998, two California high school kids were among a group
suspected of penetrating and compromising at least 11 sensitive
computer systems in U.S. military installations and dozens of
systems at other government facilities, including Federal
laboratories that perform nuclear weapons research.
In 1998, a Swedish man launched a cyber attack on the 911
emergency system in southern Florida, disabling part of it. In
1998, a disgruntled New Jersey man cyber bombed his employer's
computers, destroying files and corrupting backup tapes. He
caused $10 million in damages. In 1997, a teenager used his
computer to cripple an FAA control tower in Massachusetts. And
even where assailants do not succeed, cyber attacks raise
important issues about information security and information
warfare.
In 1999, individuals who may have had ties to Russian
intelligence--Senator Kyl just spoke about this--carried out a
series of massive cyber attacks, targeting the computer systems
of the Department of Defense, the Department of Energy,
military contractors, and various universities.
In 1999, just days after NATO began bombing missions over
the former Republic of Yugoslavia, hackers began trying to
crash NATO's e-mail communications system. Experts suspect a
terrorist secret society known as Black Hand.
In 1997, a Joint Chiefs of Staff exercise proved that a 35-
man team who were instructed not to use any classified tools or
break any U.S. law could, in fact, disable parts of the U.S.
electric power grid and cripple portions of our military
command and control systems in the Pacific and emergency 911
systems in the United States.
We have just begun to address the threat of cyber attacks.
Presidential Decision Directive 63, issued in 1998, makes
critical infrastructure protection a national security priority
and commits us to protecting effectively our critical
infrastructures within 5 years.
PDD-63 calls for a comprehensive National Plan for
protection of our critical infrastructure within 6 months of
the issuance of the directive. We now have that Plan, albeit 14
months late. I hope and am eager to examine how that Plan will
work, what changes should be made to it, and how we can assist
the Government in realizing the Plan's promise.
I believe very strongly that we have an obligation to
protect this Nation from the threat of cyber terrorism and
information warfare in a way that maintains and strengthens
America's privacy and civil liberties. They may or may not
conflict at certain points. That is what we are here to
explore. But I think the point I want to make is the
overwhelming importance of the mission. There is no question
that that mission is going to grow greater in the days to come.
Thank you, Mr. Chairman.
Senator Kyl. Thank you very much for an excellent
statement, Senator Feinstein.
Our first witness is Mr. John Tritak, director of the
Critical Infrastructure Assurance Office. He is the principal
administration official responsible for the formulation of the
National Plan.
Mr. Tritak, we will place your full written statement in
the record and invite you to make any summary remarks you would
like to at this time.
STATEMENT OF JOHN S. TRITAK, DIRECTOR, CRITICAL INFRASTRUCTURE
ASSURANCE OFFICE, WASHINGTON, DC
Mr. Tritak. Thank you very much, Mr. Chairman, Madam
Ranking Member. It is truly an honor to be here and finally to
be able to discuss the National Plan. I am going to keep my
remarks very brief because I think really the purpose of this
hearing and other hearings is to engage in a dialog.
You will notice that the National Plan, the very cover of
the National Plan says a number of things which I think bear
emphasizing at this point. First and foremost, this is Version
1.0. This is not meant to be a complete document. Final
solutions have not been presented.
One of the things that became very clear since taking over
the CIAO and bearing responsibility for pulling this effort
together is just how complex the undertaking really is. I think
the PDD which calls for a plan to be presented within 6 months
was overly optimistic. I think it was well-intended at the
time, but frankly as we got into it and saw what was entailed,
it took much longer than expected.
Putting aside the fact that whenever you have to coordinate
the efforts of 22 agencies, that in itself is a time-consuming
process, there were really fundamental issues that had to be
addressed and wrestled with. And I can say happily that what we
are presenting in the Plan is, I think, a good, solid first
step toward achieving the goal the President set forth in PDD-
63 for developing a capacity to defend the Nation's
infrastructures.
As I indicated, the goals are rather ambitious. It is
calling for nothing short of an ability for the United States
to be able to defend itself against deliberate attacks against
its infrastructures. In order to do so, we are talking about
actions that not only need to be undertaken by the Federal
Government, but also State and local government and private
industry.
I have said in previous testimony that this issue of
critical infrastructure protection is perhaps the first
national security challenge this country has ever had where the
Federal Government alone cannot solve the problem. It is not a
question of simply allocating resources, procuring equipment,
and solving the problem. Since 90 percent of these
infrastructures are owned and operated within private industry,
it calls for a very new and unprecedented relationship with
private industry in order to achieve a national goal.
I want to emphasize, under this goal, one of the things I
add here is the importance of upholding civil liberties and
privacy. After all, the whole point of this exercise in
defending our Nation's infrastructures is to protect our way of
life and the values that we cherish. It would do very little to
serve that interest if we undermined those civil liberties and
privacy rights that we enjoy today.
The challenge is not whether or not to trade off privacy
and civil liberties and security, but how we protect civil
liberties and privacy in the information age. When this country
was formed, it began as an agrarian economy. It then moved to
an industrial economy that presented those challenges to civil
liberties and privacy, and we dealt with them.
We are now moving into an information age. That, too,
presents new challenges. But I am confident that engaging in a
dialog, which we hope will begin today and continue, will be to
ensure that whatever policies and proposals are set forth by
the Federal Government and whatever actions are taken to assure
the delivery of critical services over our Nation's
infrastructures that we continue to protect and uphold the
civil liberties and privacy rights of American citizens.
By now, I hope you have both the executive summary of the
National Plan as well as the full report. I will not obviously
go into any great detail about the National Plan, but what I
would like to do is at least provide an overview of the
structure.
In order to meet the ultimate goal of defending the
Nation's infrastructures by 2003, the Plan is organized around
three objectives. The first is to prevent such attacks from
occurring and, should they occur, to minimize the effect those
attacks may have on the delivery of critical services.
One of the first and important steps in doing so is to
evaluate what the critical assets that perform these critical
services and deliver these services are; having done so,
identify both the interdependencies with private industry as
well as the interdependencies between government agencies,
identify those vulnerabilities and develop plans for addressing
them.
Second is to develop an ability to detect, analyze, and
evaluate intrusions and attacks against our Nation's
infrastructures, and develop plans for responding and
reconstituting those systems. Under this objective, we have
four broad programs.
One is to develop a multitiered detection, intrusion, and
warning system that will enable government agencies to
determine whether or not an attack is underway and to be able
to deal with that information in a way that contains the
problem and doesn't spread to other agencies and affect
delivery of critical services.
Second is to develop the intelligence and law enforcement
capabilities with a view toward focusing on critical
infrastructure protection; three, to encourage information-
sharing both between government agencies, within private
industry, and between government and private industry. Fourth
is to build on the lessons of Y2K and to begin to explore ways
in which the Government can facilitate response,
reconstitution, and recovery.
Finally, objective three, Senators, is really what
undergirds the achievement of objectives one and two. It
involves coordinating research and development among Federal
agencies to ensure that there is not unnecessary duplication.
It involves training and employing IT security experts.
Today, there is, in fact, a shortfall in this capability.
We need not only to ensure that those who are already
responsible for this mission have state-of-the-art training,
but also to encourage the recruitment of new expertise into the
Federal Government, as well as in private industry.
Three, raise cyber security awareness. I think it is fair
to say that one of the biggest challenges to this effort
overall is awareness and appreciation of what we are talking
about. This need for awareness is not only at the Federal
Government level; it also requires raising awareness within
private industry about how this is different from the
challenges that they faced in the past, and, finally, to raise
awareness with the American public itself.
Fourth is to develop and explore legislative and legal
reforms that may improve information-sharing. One of the
important ways in which this country can defend its
infrastructures is to share information within the Government
and between government and industry. We need to look at ways in
which we can encourage that without those that are sharing the
information incurring unnecessary liabilities. And, finally, to
repeat yet again, all this has to be done within the context of
protecting civil liberties and privacy rights.
In the rollout of the National Plan, President Clinton
mentioned briefly his budget overview for critical
infrastructure protection. As this chart indicates, the request
will be for $2 billion, which will be a 15-percent increase
over last year, with 85 percent of that budget being used to
actually protect the infrastructures of the respective Federal
Government agencies, with the remaining 15 percent being used
for outreach programs with private industry.
Seventy-two percent of the total will be requested for the
national security agencies. They bear a very special
responsibility in this critical infrastructure area, so it is
appropriate that they would at this stage get the lion's share
of the budget. Also, the national security agencies have the
most mature programs, and one of the goals of this Plan is to
begin to rectify that balance by bringing up to speed the
civilian agencies. And then, finally, a 31-percent increase in
research and development in programs designed to address
specific challenges of critical infrastructure protection.
Finally, Senators, I would just like to highlight very
briefly some of the key initiatives, the goal of which is
really two-fold. One is to establish the Federal Government as
a model for information security. Recognizing that we are
asking private industry to bear an increasing responsibility
for the defense of the Nation's infrastructures, it is
important that the Federal Government itself be a model of
information security and computer protection.
We have laid out a number of initiatives designed to do
that. First and foremost is to develop the personnel within the
Federal Government to do this. As I have indicated before,
there is, in fact, a shortage of information security
expertise, not only within the Government but within private
industry. The ability of the Federal Government to draw that
expertise, given the enormous market pull for people coming
right out of college to go to private industry--we are
exploring a number of ways in which we can recruit and retain
some of these people to build a cadre of information technology
expertise within the Federal Government.
One of the principal programs in that regard is a ROTC-like
program called the Service for Scholarship Program which is
designed to assist undergraduates and graduate students through
their education, with the understanding that upon graduation
they would serve a certain period of service within the Federal
Government.
FIDNet, of course, I have a feeling we are going to be
talking about in some detail, so I will come back to that when
we have our discussion.
Senator Kyl. I wish you would discuss it now, if you would.
Mr. Tritak. Oh, absolutely. Senator, the Federal Intrusion
Detection Network is intended to serve, in essence, like a
Federal burglar alarm for civilian government computer systems.
It is designed to allow Federal agencies to protect those
critical computer systems that the public relies on for
delivery of important services. This system is only government
civilian systems. It does not connect in any way to private
sector computer systems.
The Department of Justice has actually undertaken a
preliminary review of the FIDNet concept and has determined
that it is compliant with existing Federal laws under ECPA. The
key issue here, Senator, is to recognize that daily, as you
have indicated in your testimony, and as Senator Feinstein has
indicated in her testimony, Federal Government agency computer
systems are, in fact, being attacked. Some of the information
out of those computer systems is actually vital to the privacy
rights of American citizens.
This problem is not going to go away. The question is how
we are going to deal with it. The current proposal for the
FIDNet is for a pilot program. The concept as it is right now,
we believe, is consistent with all privacy statutes and civil
liberties statutes. As it goes on through development, at each
stage it is going to have to be reviewed to ensure that
compliance is adhered to.
At each stage, we will be discussing with you, the private
sector community, and others how this is being implemented so
that there is an understanding and there is an acceptance of
what we are doing from the get-go. Of course, at this point
some of the legalities of this matter actually turn on very
technical details and design features. That is why it is
impossible at this stage in the concept to say how it will work
and what it will do and what will remain compliant. What I can
assure you is that whatever architecture is actually developed
for the FIDNet program, it will be consistent. If those
architectures are not consistent, they will not be adopted.
I would like to now turn, Senators, very quickly to the
need for building public-private partnerships. The President
announced in his rollout address the establishment of an
Institute for Information Infrastructure Protection. The
purpose of this institute is not to create a new building, a
new establishment to duplicate ongoing efforts in
infrastructure protection. The goal here is to really fill gaps
in what may exist in critical infrastructure protection.
As you know, with the President announcing CIP as a
national priority, agencies do have ongoing efforts to address
their own needs in this area. However, since much of what is
needed for infrastructure protection lies within private
industry itself, it is important to have a mechanism by which
government and private industry can work together to identify
potential gaps where the market itself does not permit a
solution and to ensure that monies from the Federal Government
can be inserted back into private industry to develop high-
risk, high-payoff technologies which will benefit not only
private industry but, by extension, the American people.
Finally, Senator, I would just like to touch briefly on the
Partnership for Critical Infrastructure Security. This is an
area I am particularly proud of because what it is trying to do
is bring together all the communities that are necessary to
resolve this issue.
Today, we have lead agencies interacting with their private
sector counterparts to address sector-specific concerns of
critical infrastructure protection. What we are trying to do in
this effort is to draw those efforts together and to include a
broader community of business interests, to include the risk
management community which is going to be responsible for
assessing, creating metrics, and holding accountable companies
to first adopt and then enforce security measures on their
computer systems. It will also include the broader business
community who actually depends on these critical
infrastructures in order for them to do their business.
We envision as this partnership evolves that we also will
include the privacy community and others who have a stake in
this outcome. I can tell you the first meeting was held in
December. Over 90 companies attended. It was chaired by
Secretary Daley. We are now moving to the first working group
session later this month, in which industry is actually taking
the lead on identifying those issues of concern with regard to
critical infrastructure protection. So what we are really
trying to do here is to develop a real partnership where
hopefully we will discover market solutions, allow the market
to come up with solutions as to how to deal with these problems
and not regulation.
Senator I think at this point I will conclude my remarks,
and I welcome any questions.
Senator Kyl. Thank you very much, and I am sure that
overview at least indicates the breadth of the effort that is
being undertaken here. While both Senator Feinstein and I have
been critical of the administration for not acting with enough
speed in this matter, we both recognize, I am sure, that it is
a complicated and ongoing challenge that will require, as I
said, a continuing evolution in your program. And that is fine,
but it is important to start and we are at least appreciative
of this report on that effort.
One of the interfaces with this program that the Judiciary
Committee will have, of course, is determining whether there
are any legal changes that will be necessary in our laws to
help implement this or to ensure that as it proceeds it can, A,
be effective, and, B, not improperly infringe on any
constitutional rights of Americans.
I made the point, and I tried to stress the point in my
opening statement that if we do nothing, Americans' privacy
will, in fact, suffer. I mean, the whole point of providing
protection to our infrastructure is to prevent unauthorized
entry into these systems in a way that can compromise people
and government and businesses' private information. So the
whole point of this is to protect the American public.
There are those, on the other hand, who view the effort in
some respects as potentially damaging to civil liberties. And I
would like to focus on that because of all the areas in which
this subcommittee will be working with this critical
infrastructure issue which has ramifications that apply to many
other committees here in the Congress--the Government
Operations Committee, the Intelligence Committee, the Armed
Services Committee, and so on--our committee's jurisdiction
will surely impact this privacy issue. And so I wanted to focus
in on that and that is why I asked you to talk a little bit
more about FIDNet.
Now, what I would like to do as a prelude to asking you
some specific questions is to describe with a little bit more
particularity the kinds of information that you anticipate will
be collected and analyzed on the FIDNet program, and if you
could also describe the degree of maturity of the program. As I
understand it, you are basically just getting this off the
ground right now.
So could you address that briefly and then talk about the
kinds of things--in other words, how you envision this working.
You might want to even use an example. Let's say we find that
there has been a particular kind of incident. How would we be
reacting to that, at least hypothetically?
Mr. Tritak. Certainly, Senator, I would be happy to. First,
to underscore the remark that you made in closing your
question, and that is that we really are just getting off the
ground. What we have done so far----
Senator Kyl. By the way, may I interrupt you and
acknowledge the presence of Bob Bennett, the Senator from Utah,
who chaired the very successful Y2K--we just call it the Y2K
Committee. But while Senator Bennett probably would not
personally want to brag about this, I figure that the whole
reason we didn't have any problems with Y2K is because of the
work of his committee. Of course, I served on the committee.
Senator Feinstein. You are humble.
Senator Kyl. That is right.
But since Senator Bennett is not a member of the Judiciary
Committee, I wanted to acknowledge his presence here before you
gave your answer and indicate we will, of course, offer him an
opportunity to make some observations and ask questions here as
well, and we appreciate him being here.
I am sorry to have interrupted you.
Mr. Tritak. Senator Bennett, it is good seeing you again.
On FIDNet, Senator Kyl, first let's step back a little bit
and let's clarify what FIDNet is and what it is not. It has
been characterized as many things, including being a big
brother system, or a slippery slope to it. It is nothing of the
kind.
To begin with, as I have indicated, what we are talking
about here is a civilian computer intrusion detection system
within the Federal Government. Currently, today, an agency can
install intrusion detection systems at critical computer sites.
It can monitor the flow of traffic coming in, with a view
toward identifying potentially anomalous activity going on, a
virus, for example. When anomalous activity is done, systems
admin. today can review that information to determine what is
going on and what needs to be done. That authority exists
today.
What FIDNet is proposing--well, let me say one more thing
about that. Of course, given the nature of certain types of
attacks, what you will generally see are mappings that an
attacker will use at different agencies to try to develop an
overall plan before they actually attack a specific system.
They are not going to telegraph their intentions too clearly.
So what could be happening at one agency may only be a
small bit of what, in fact, is going on around, which could
actually be amounting to something very serious. No agency
alone is going to be able to make that determination or
ascertain what is, in fact, going on. So what the FIDNet is
proposing to do is in instances where anomalous activity has
been detected, the information about that anomalous activity
will be provided to the FEDSIRC, which is at GSA, for further
analysis, and to correlate other data of anomalous activities
occurring around Federal agencies to determine what that
anomalous activity means.
In the event that that anomalous activity appears
suspicious or even indicative of crime, that information would
then be further provided to the NIPC for analysis and if, in
fact, they determine that there is evidence of criminal
activity under Federal law enforcement.
There are several tiers going on here to ensure the
protection of privacy. Right now, if a systems administrator
detected anomalous activity and concluded that there was
evidence of criminal activity, they are obligated under law to
provide that information directly to Federal law enforcement.
Some anomalous activity is, in fact, ambiguous; it is not
clear what it means. You wouldn't want to send that to Federal
law enforcement, and that is not what is intended here. What is
intended here is to be able to make sense--drawing on activity
going around Federal agencies, to make sense of what that
anomalous activity means for that agency as well as for the
Government writ large, because in some instances that may be
our first indication that something is up.
If something is up, as I have said, and it suggests
malicious intent or even potential criminal activity, there is
a mechanism for providing that information on to the NIPC for
Mr. Vatis and his team to evaluate. At this point, Senator,
this is where the concept of FIDNet lies. Now, there are a lot
of details as to how that information is processed, how it will
be moved on to the FEDSIRC. And that is why I said that beyond
a threshold assessment, a preliminary assessment, we need to
further develop the FIDNet program with specific technical
options.
There will be RFP's issued, assuming that there is some
seed funding for it, and then those technologies and
capabilities will be assessed within the broader architecture
to ensure compliance with existing privacy laws. I say ensure
continued, as opposed to moving forward in the hopes that it
will fit privacy or, in fact, requesting that privacy laws be
changed in order to accommodate the system.
Senator Kyl. What kind of data will be collected by the
FIDNet program?
Mr. Tritak. The information that is monitored on an
intrusion detection system is really looking--basically, it is
set up to look for anomalous patterns. That information, if the
alarm would go off, would be extracted and that information
would then be provided to the FEDSIRC for further analysis.
Now, the details of what is contained in that packet, what
would be kept at the agency where it is allowed to be kept and
what would be moved on further for further analysis, is
something that really is a technical detail that I am not in a
position to answer right now because I don't know the answer.
Senator Kyl. OK; now, what is the potential then for
integrating the private sector--let's say the commercial
banking computer system--into this overall program and
interfacing with FIDNet to provide the burglar alarm for a
private sector computer network as we have with the Government
network?
Mr. Tritak. In short, none.
Senator Kyl. So the FIDNet program is designed to detect
intrusions into the Government interconnection of computers,
detect the nature of the activity, and if it is potentially in
violation of law, refer the appropriate information to the FBI?
Mr. Tritak. That is correct, sir.
Senator Kyl. One of the subsequent witnesses, Mr.
Rotenberg, says that there are--and I am quoting now--there are
other indications contained in materials that they received
under the Freedom of Information Act that the CIAO, which you
lead, intends to make use of credit card records and telephone
toll records as part of its intrusion detection system, and
suggests that that raises problems under U.S. law. Is that
correct?
Mr. Tritak. Senator, I have to be honest with you. I don't
know where that comes from. I think, in fairness, what it may
be referred to is that telephone companies have developed
technologies that look for certain patterns to suggest that
someone may be using a credit card that isn't theirs, you know,
activities which are beyond the normal patterns of activity
that the person who owns that credit card would do.
Under those circumstances, there is an alert and those
people are actually contacted to find out is this purchase--did
you intend this purchase, is this your purchase, and it is
really a service actually to the customers.
Senator Kyl. As a matter of fact, I can tell you one of my
employees had a cell telephone, got a bill with, I think, $600-
and some worth of telephone calls to Mexico. And about a day
later, she got a call from the company saying this doesn't look
like an expenditure that is consistent with your past use of
your telephone. She said, it is not; she said, I didn't make
those calls. They said, we didn't think so, don't worry about
it.
And this is part of the basis for the bill which came out
of this subcommittee a couple of years ago on cell phone
cloning to try to make it easier to prosecute people who do
that. So this was a use of information to help a consumer, a
customer who clearly was being taken advantage of by someone.
Is that the kind of information that you are talking about
here?
Mr. Tritak. Actually, I want to be very clear. It is not so
much the information. It is the technology that helps identify
certain patterns of behavior. First of all, I am not a
technologist, so I am doubly handicapped. But one of the
problems is that when you actually talk about how you identify
certain types of patterns that are suggestive of anomalous
behavior, we are talking about levels of detail and technical
gradients that are very difficult to communicate in normal
language.
What I think was referred to in Mr. Rotenberg's statement--
I obviously don't want to speak for him, but my understanding
to the extent that that ever came up was the fact is right now
there is a capability that can identify anomalous patterns. In
this case, it happens to be use of credit cards, or it could be
the use of the telephone.
It is the underlying technology that led to the creation of
that capability which is what I believe was one thing that was
raised as something to explore, not so much because we are
looking at collecting that sort of information or information
about a person or anything else that would be used in an
intrusion detection system.
Senator Kyl. And this is one of the reasons why you said
that you would be careful as you went on to ensure that any use
of that technology would not invade privacy.
Mr. Tritak. That is correct, sir.
Senator Kyl. And I will, of course, give Mr. Rotenberg a
full opportunity to explore his views on this later, but he
also says that based on a March 1999 memo from the Justice
Department to CIAO, FIDNet is a violation of the spirit of the
Federal wiretap statute, also the plain language of the Federal
Privacy Act and contrary to the fourth amendment.
What is your view on that?
Mr. Tritak. Well, I have to try to remember law school, but
I recall that wiretapping has to do with voice communications,
and we are not looking at that there. We are talking about
traffic that is coming in mainly e-mail.
Senator Feinstein. Say that again.
Mr. Tritak. I am sorry. My initial reaction, having not had
an opportunity to think through this as fully as perhaps I need
to, is that wiretapping refers to voice communications. We are
not looking at monitoring voice communications through an
intrusion detection system. The intrusion detection system is
designed to identify incoming e-mail traffic that may contain
anomalous malicious code or something, which may then actually
go into a computer system and cause damage. So we are really
monitoring different things.
Senator Kyl. One thing I would like to ask you to do is to
consider carefully the testimony of the second panel and to
perhaps respond to any points that you think are worth--I
shouldn't say worth responding to, but need response to ensure
that there is a complete understanding of the FIDNet program
from your point of view. And we would leave the record open for
sufficient time for you to respond to any comments that you
think require response.
I realize that we are catching you a bit unprepared on
these matters today, and perhaps at a subsequent hearing we can
have the people who really are the experts either in the law or
in the technology to further explore these issues.
Mr. Tritak. Senator, let me also add that in terms of some
of the things that you raise and Mr. Rotenberg will be raising
in his testimony, I think we need to take all that seriously.
All concerns about privacy should be taken seriously and we
ought to address them front-on.
I gave you answer about the wiretap law. I am not even sure
if it is correct. What I will do, though, is once it is raised,
to the extent I can respond to it today, I will. To the extent
I cannot, we will provide written answers specifically to
those.
Senator Kyl. Great, and I have some additional questions
which I will submit to you.
[The questions of Senator Kyl are located in the appendix.]
Senator Kyl. I would like to turn to Senator Feinstein now.
Senator Bennett, by the way, said he would be able to be back.
Senator Feinstein. Thanks very much, Mr. Chairman.
Mr. Tritak, just a quickie. On page 29 of the report, in
the chart it mentions that Federal departments and agencies
will submit a multiyear vulnerability remediation plan with
their fiscal year 2001 budget submissions to OMB, and then
annually afterwards. The ERT will work with the departments on
implementation. That is due to be completed in June 2000. Are
you going to make that date?
Mr. Tritak. Yes; let me make sure I--page 29, you said?
Senator Feinstein. Page 29, third one down, Federal
Department Initiatives to Strengthen Cyber Security.
Mr. Tritak. OK, and that would be----
Senator Feinstein. 1.3.
Mr. Tritak. Yes; well, each of the agencies, in fact, will
have contained in their budget plans for dealing with their
vulnerabilities and remediating----
Senator Feinstein. So that will be on time and this
subcommittee can expect it?
Mr. Tritak. Yes; that is not to say it is going to be
complete, and I will tell you that one of the things we are
actually undertaking at the CIAO is to assist agencies in sort
of focusing very clearly on what it is that they need to do in
order to fulfill the missions of PDD-63, and that is to
actually go into their agencies and identify those assets that
support national critical services, either in national defense,
promoting of economic security, or delivery of vital human
services, and having identified those assets to back into it to
identify with the nodes and networks that support those and
then conduct a vulnerability assessment.
With the institutionalization of the ERT, they will then go
in and say, OK, let's take a look at those nodes and determine
to what extent they are vulnerable and what do we need to do to
address them.
Senator Feinstein. I just view that as an important step.
Mr. Tritak. Very important, ma'am.
Senator Feinstein. And I just wanted to see if it was going
to get done on time.
Now, let me just read you a couple of sentences out of the
GAO draft report on critical infrastructure protection.
In particular, we believe the Plan should place more
emphasis on providing agencies the incentives and tools
to implement the management controls necessary to
assure comprehensive computer security programs, as
opposed to its current strong emphasis on implementing
intrusion detection capabilities.
Then it says,
In addition, the Plan relies heavily on legislation
and requirements already in place that, as a whole, are
outmoded and inadequate, as well as poorly implemented
by the agencies.
Could you define for us the outmoded and inadequate
legislation so that we might do something about it?
Mr. Tritak. Well, I believe that what may be referred to
may be certain aspects of the Computer Security Act. I have not
done, in fact, an analysis or studied closely what GAO has said
in this regard. I would rather take that question and get back
to you than to simply talk off the top of my head.
Senator Feinstein. Would you, please?
Mr. Tritak. I would be happy to.
Senator Feinstein. This is directly within our jurisdiction
to update whatever legislation is outmoded and inadequate. So
if we could get that with specificity in the next week, if
possible?
Mr. Tritak. Yes, ma'am.
Senator Feinstein. Great. Thank you very much.
Just a couple of quick questions on your burglar alarm,
FIDNet. What is the legal authority for FIDNet?
Mr. Tritak. Well, the legal authority for FIDNet--I guess I
would sort of address it slightly differently. Is FIDNet
consistent with existing legal authority? One of the initial
analyses that had to be done was whether it was consistent with
ECPA, the Electronic Communications and Privacy Act. I usually
only refer to it by its acronym.
That makes very clear and puts very severe restrictions on
the monitoring of content in electronic communications.
However, it does also have some significant exceptions in order
to protect Federal Government information systems.
Senator Feinstein. But you are saying the legal authority
is within that Electronic Communications and Privacy Act?
Mr. Tritak. Right.
Senator Feinstein. OK.
Mr. Tritak. Now, it also needs to be consistent with other
laws, but that is one which we did as an initial matter. And
there was a preliminary, and I emphasize preliminary,
examination by the Department of Justice which found it to be
consistent.
Senator Feinstein. Now, Senator Kyl mentioned the wiretap
law. Do you agree with Justice that FIDNet must operate under
the Federal wiretap law?
Mr. Tritak. Senator, I am going to be honest with you. I am
going to need to take that question. I am not prepared to
answer the specific legal authorities with respect to FIDNet
and the wiretap law, and I think they deserve a thorough review
and response than what I can give you at this time.
Senator Feinstein. I appreciate it.
Mr. Tritak. I have a few tasks now to get back to you very
quickly on, and that will be one of them.
Senator Feinstein. Thanks. Do you see any legal problems
with GSA acting as a centralized authority with regard to
protection against network intrusions for the entire Federal
Government?
Mr. Tritak. I do not. I understand that there is the view,
although there has not been a formal legal opinion issued at
this time on this, that the GSA can serve as sort of a super
systems administrator in connection with the FIDNet program,
meaning that since it has authority to oversee all government
agency information and computer systems----
Senator Feinstein. That includes Defense, of course?
Mr. Tritak. Yes, although in this case the--yes, but in
this case the Defense Department has its own system entirely
and the FIDNet is not actually going to be tied into that.
Senator Feinstein. So FIDNet would not relate to----
Mr. Tritak. No; in fact, I am glad you said that. Right
now, there is an intrusion detection system at the Department
of Defense and that system has been up for a while. In fact, as
we proceed in developing FIDNet, obviously we want to benefit
from the experiences and lessons learned that the Department of
Defense has made in proceeding there. But this is only for non-
DOD Federal civilian government agencies. It is not networked
into the Department of Defense.
Senator Feinstein. Under the current version of FIDNet,
there would be a large new intrusions operations center at GSA.
Does this duplicate the mission of the National Infrastructure
Protection Center?
Mr. Tritak. I do not believe it does. The way FIDNet was
designed, first of all, it is very clear in ECPA that the
systems administrator cannot be an agent of law enforcement.
Now, I am not saying here that the NIPC is, in fact, an agent
of law enforcement because it is not. It is, in fact, an agency
designed to deal with indications of warning and analysis.
But the decision was made, in an abundance of caution, to
locate the FIDNet analysis center, if you like, or what
actually would be located at FEDSIRC--is to provide a place
where correlation can be done and an assessment of what
anomalous activity means. And only in cases where that
anomalous activity rises to the level of suspicion and perhaps
indicative of criminal activity would it then further sent to
the NIPC for analysis and they would make the final
determination of sending it to law enforcement based on their
own expertise and experience that they believe it needs to
move.
Senator Feinstein. A final question. The GAO report points
out that its audits have found repeatedly serious deficiencies
in the most basic controls over access to Federal systems. It
points out that managers often provided overly broad access
privileges to very large groups of users, and that affords more
individuals than necessary the ability to browse and modify or
delete sensitive or critical information.
What are you going to do about that?
Mr. Tritak. Well, as you have indicated earlier, and I
think it bears repeating here, critical infrastructure
protection is not going to be solved by technology alone. It is
only as good as the personnel, the technology, and the
processes that are put in place to do it. Your best intrusion
detection system, your best technology for combating cyber
terrorism goes out the window if it is not employed properly.
There is, in fact, an effort underway, and it is
contemplated in the National Plan to develop more uniform
standards across the Federal Government and to raise awareness
with government employees on the importance and need for
observing proper practices and standards for information
security.
I agree that right now the Government is not the model of
that. More works needs to be done. By the way, it is also not
wholly observed within private industry, and I think you would
find--and I think this is something you would really need to
talk to Mr. Vatis about, but probably many instances where
there have been problems, only some of them are because of
technological flaws. Some of them are because people were not
observing common security practices which, had they been
observed, they may have avoided the problem.
And this a big issue for the information technology
community because to simply say something is vulnerable is
suggestive that the vulnerability lies squarely with the
technologies, when, in fact, the vulnerability is systemic and
it requires dealing with all three.
Senator Feinstein. You mentioned earlier that you are going
to begin recruiting students and training students, et cetera,
to come into this. In our classified briefing, Senator Kyl and
I heard about this, and my concern has been that that is going
to take a very long time. And I wondered if, particularly with
respect to this security aspect, you had considered recruiting
from the private sector for a small period of time, say 6
months to 1 year, the outstanding security experts that we can
throughout America to really, in essence, do a kind of audit of
our departments, our management and security functions, and
make some specific recommendations.
Mr. Tritak. Well, first of all, Senator, let me say that I
think that is an excellent idea.
Senator Feinstein. But will it die an early death?
Mr. Tritak. Not necessarily. I think the only problem is
that industry itself is finding a shortage. I mean, they are
desperately trying to fill these positions themselves. That
said----
Senator Feinstein. I talked to one company that is in the
lead in this direction. I would be happy to tell you
afterwards.
Mr. Tritak. I would love to hear who that is. That would be
great. In fact, I would say even when we get the scholarship
program going, if all goes well and if we get full funding, we
envision that the first graduating class having been trained
through these programs would be May 2002. So we are trying to
put this on a fast track as much as possible.
But I think even if we did get this program going, there
needs to be some kind of ongoing interaction between private
industry and the Federal Government in this because, first of
all, I think industry actually has an interest in the Federal
Government having secure computer systems. They, in fact,
depend on some of these systems for their own businesses.
And, second, the experiences that are gained in the Federal
Government are likely to be different in some respects from the
kinds of experiences they have in private industry. Since
government in some cases is one of the front lines of attack
against hostile forces, that kind of experience in how to deal
with it and respond to it would be extremely valuable to
private industry.
So I think that is a very good idea, and I would actually
like to speak to you afterwards about the companies who have
indicated a willingness to volunteer to support Federal
Government programs.
Senator Feinstein. Thank you very much. I appreciate it.
Mr. Tritak. Thank you, Senator.
Senator Kyl. Senator Bennett.
Senator Bennett. Thank you, Mr. Chairman. I very much
appreciate your indulgence in letting me participate in this
way, and I apologize for going in and out. We were in the
process of trying to gather a quorum up in the Banking
Committee so we could report out Alan Greenspan. We have
successfully done that and so I am here now.
I want to express my appreciation to you for your hearings
not only now, but previously. I think, as I have said
previously, that this issue is one that is going to be with us
a long, long time. It is only going to increase in its
intensity and its importance and we are just at the threshold
of beginning to understand it.
I have brought along a little visual aid this morning, Mr.
Chairman, and you can't see it too well from where you are. I
wish it were on a white background instead of a black
background, but that is a map of the world. Some people think
it is an abstract painting. Maybe someone could hold it up and
show it to the audience as well.
That is a map of the world, only it is a map of the
Internet. The most outstanding thing about that when you look
at it as a map of the world is that there are no oceans and
there are no continents. And when you start talking about
either national security threats or commerce in a world in
which there are no oceans and no continents, you realize that
we are not talking about a new tool to use in commerce or a new
weapon to use in war. We are talking about a whole new place.
We are talking about a whole new universe that is different
from any that we have structured our Government to defend or
our economy to market in in the past. That is why these
hearings are so important and the issues that we are addressing
are so important, and they are going to go on and on.
Now, in May 1998 President Clinton signed PDD-63, calling
for the development of a detailed Federal Plan, and we are
having the hearings now on the first cut of that Plan. It was
finally released this month. Unfortunately, it is over a year
late from the date that was set in PDD-63. It is an invitation
to a dialog, as the Plan itself says, and this hearing is going
to be part of that dialog.
Now, in my opinion, Mr. Chairman, there are two main
problems with the Plan. I don't mean to start out being
critical because I start out being grateful that we have it,
that we have something to talk about. But here is my reaction
to it.
First, the architecture of the Plan is flawed, the
structure is wrong. The FBI is given the coordination function,
which immediately raises suspicions on the part of industry and
questions about the role of the Department of Defense. The
greatest area of expertise in this challenge lies with the
Department of Defense and the National Security Agency, and
they are under the coordination of the FBI. That is one of the
reasons why you are holding this hearing, Mr. Chairman, because
the FBI is under the jurisdiction of the Judiciary Committee.
But the question about the FBI's expertise as opposed to that
contained within the DOD and the NSA is a structural question
that immediately comes to mind.
The second part of the first problem--the first problem is
the structure and now I am giving subtopics under that. The
second subtopic is that the Plan seems to me to focus primarily
on the hacker threat. I listened very carefully to the
President during the State of the Union message when he raised
this, and again I applaud him for raising it, and he too
stressed the hacker threat, the threat of irresponsible
hackers.
I think the broader threat that we face long term is going
to come from terrorist groups and eventually, if not
immediately, from hostile nation states that have the staying
power both financially and technologically far beyond that of a
teenage hacker operating out of his bedroom. And I wish the
Plan had focused on the broader threat of information warfare
and not the more narrow threat of a rogue hacker.
The third subpart of the flawed architecture is that the
Plan does not yet articulate a strategy for reconstitution and
recovery if an attack occurs. We had the experience in the Y2K
Committee of talking about contingency plans, and one of the
reasons that Y2K went so smoothly is that in many areas
contingency plans simply took over flawlessly and seamlessly.
And people said, gee, there was no Y2K failure, when, in
fact, there was, but there was no suspension of service because
the contingency plan was working. That is an analogy for the
focus on reconstitution and recovery, and there is nothing in
this Plan that focuses on that.
And the final aspect of the architecture that--well, I have
already talked about it; that is, that the role of DOD and NSA
is unclear, and those are the two agencies that have the most
expertise.
The second major problem with the Plan--this is parochial,
in a sense, because it looks at it from the standpoint of the
Congress. The Plan makes it almost impossible to follow the
money. Approximately nine committees in the Congress have some
kind of critical infrastructure protection oversight
responsibility. There is in the President's budget $2.04
billion spread over 15 agencies, and it becomes very difficult
to follow the money, very difficult for Congress to provide its
appropriate oversight responsibility when things are fractured
that much.
I would note that in the 2001 budget tagged for critical
infrastructure protection, $276 million is new funding. That is
more than a 10-percent increase, closer to a 12- to 15-percent
increase. I don't object to that increase. I think the issue is
serious enough that it justifies that increase, but it becomes
very hard to focus when the thing is spread so wide.
So, Mr. Chairman, I give the President and the
administration high marks for proceeding. I am glad the
National Plan is finally before us, even at this late date. I
know how devilishly difficult it must have been to put
together, and so I don't fault the administration too much for
being a year late. But I have to lay down my immediate concerns
in these two areas, and very much appreciate the opportunity to
share that with you this morning.
Thank you.
Senator Kyl. Thank you very much, Senator Bennett. As a
matter of fact, Senator Feinstein and I were just talking about
the criticisms which you leveled. These were criticisms that
were raised in earlier hearings that we had, as a matter of
fact, prior to the actual development of the Plan when we asked
whether or not it wouldn't be more appropriate to have a larger
role for the Defense Department, given the fact that our
national security is implicated when there is attack on other
government agencies than the Department of Defense. That
remains an ongoing concern that we have. We continue to
evaluate that and look into it with your assistance, as well.
Senator Bennett. Mr. Chairman, if I could raise an example
that I use sometimes when I give speeches on this subject--and
I will be giving another one around noon--we have in Utah a
steel mill, a very unusual place to put a steel mill in the
middle of Utah, next to Utah Lake. It was put there in 1942 for
strategic reasons.
The Government was afraid that a steel mill built in
Senator Feinstein's State might be subject to attack from the
Japanese. They wanted to put it far enough inland that a
Japanese bomber wouldn't be able to get to it. Steel mills, as
you know, require a fairly large body of water, and there is a
lake in Utah that was big enough. So this mill, which is known
as the Geneva Steel Mill, because they thought Utah Lake looked
a little like Lake Geneva in Switzerland--U.S. Steel built the
Geneva Steel Works on the borders of Utah Lake in 1942 as a
defense initiative. We needed more steel for our defense
purpose and we wanted to protect it.
Now, if the Japanese were to decide that that steel mill
was essential to our war effort and that they had to take it
out at almost any cost and launched a bomber from a carrier off
the coast of San Francisco to fly to Provo, UT, to try to
destroy the Geneva Steel Works, the responsibility of defending
that steel mill would obviously fall to the Department of
Defense, or in that case the War Department. We didn't have a
Department of Defense in 1942.
The responsibility of shooting down that bomber would lie
with the Army Air Corps, very clear lines of jurisdiction. And
if something happened to the steel mill, the War Production
Board would be responsible for trying to get it rebuilt, or
that capability rebuilt.
Today, if a hostile nation were to decide that an
installation somewhere in the United States was critical to
America's defense effort and they were to decide they were
going to take it down by a cyber attack, whose responsibility
is it to defend that facility? It is nowhere near as clear-cut
as the old paradigm, and that underscores what I am trying to
say.
We are in a whole new place now. Does the FBI have to
defend that critical segment of our economy against foreign
attack? Does the National Security Agency have a defense role
or is it strictly informational? Who is responsible for
reconstitution?
And I would ask you, Mr. Tritak, if I am allowed, do we
need an EFEMA? We have spent a lot of time in Y2K talking about
FEMA and reconstitution, as I have said. Do we need an EFEMA?
Does that need to be part of the Plan? These are the kinds of
issues that are much easier to raise than they are to solve.
But I put in terms of the analogy of the steel mill to
indicate how differently the world operates now and how the old
compartments of responsibilities no longer apply. And your
responsibility down at CIAO is to give us all the answers to
these terrible problems.
Senator Feinstein. Mr. Chairman, before Mr. Tritak
responds, would you add the example you just gave me on the oil
because I think it is relevant?
Senator Kyl. Sure. There are so many different examples.
The point is that while the defense and related national
security groups are in charge of their own security, as Senator
Bennett points out, there are innumerable implications to
national security from attacks on other agency computers.
We were just talking about, for example, the computers that
may keep track of world oil shipments and the like. What if
those are infiltrated for purposes designed to harm U.S.
national security? You know, the Commerce Department computers
may not be under the jurisdiction of the Department of Defense,
but does GSA or FBI or Commerce have the ability to do the
kinds of things that Senator Bennett talked about? No; the
Defense Department is the one that ought to be involved in
that.
That is why, as I say, these questions were raised earlier
on, and maybe you could provide an answer to some of the
questions that Senator Bennett has raised as to why the
Department of Defense wasn't more closely integrated into this
overall Plan.
Mr. Tritak. Well, let me say that the issue you have raised
about the information age knows no boundaries, whether
national, bureaucratic, private, public, is probably one of the
most significant implications and is going to require us to
really look very closely at what do we even mean by national
security anymore.
It was very clear when the threats were from a foreign
intruder that had to cross a boundary or our air space what
needed to be done. That wasn't the question. It is a lot more
difficult now. Obviously, no one wants a solution where we
create a veritable police state and the Nation's infrastructure
needs to be posted with guards or net force-type capabilities
on every computer system that may bear some effect on the
national economy. On the other hand, as you have pointed out,
the way our bureaucracies are currently organized, there are
clear lines of responsibility that don't really reflect the new
demands that are being posed by the information age.
I don't want to be in a position to define for the Defense
Department what they view their mission is. I believe, however,
it is fair to say that one of the missions they do have is to
ensure that the infrastructures of this country that are
necessary for the projection of power overseas or to mobilize
war is, in fact, a concern of theirs and they have, in fact,
been working on it.
So it wouldn't be true to say that they don't do
infrastructure protection within the United States, but it is
with a very clear focus on the Defense Department's missions.
And when you go beyond that to talk about the defense of the
Nation's infrastructures that are necessary for economic
security and delivery of human services, we get into a much
more complicated set of circumstances.
I am sad to say I don't have the answer to your question
right at the moment. But what I will say, though, is going back
to something that you raised actually in my first hearing when
I was on the job about 2 weeks, and you raised to me a question
that has over time really struck me as really at the core of
what we need to be turning to next, having gone through the Y2K
experience, and that is we accept the fact that the Nation's
infrastructures are mainly privately owned and that the
industry itself and the market should bear most of the
responsibility for reconstituting those systems should they
fail.
That was clearly the goal of Y2K and, in fact, they did a
very good job. Owners and operators of infrastructures have had
to deal with disruptions, whatever the cause, for at least 100
years. And this new information age is going to complicate that
because as more and more of their business operations go online
or become part of computer-controlled networks, they may become
more susceptible to deliberate disruption.
So we recognize that perhaps the first way to deal with
this is to raise the awareness with industry that this is a
problem that is emerging and what the threats are. There are
programs underway for the NIPC to brief industry on what is
actually going on to try to raise that level of awareness. We
are also as part of this partnership trying to raise this as
basically a case for action, that regardless of the source of
the disruption, they can't afford to have their systems go
down.
And the hope there is that the market itself will go a long
way to dealing with this problem, and then when there is a
shortfall between the two, that is really where government and
private industry need to work together to solve it.
Senator Kyl. If I could just interject and then we do need
to turn to our other panel, the problem is that industry is
working with cross-tensions here. In a competitive age, in a
deregulatory environment, it is not very cost-effective for
Energy to build in robust backup kinds of systems. And the net
result is that a lot of the systems are more fragile than they
used to be when you had monopolies and the Government was
ensuring that they had the money available to build this
robustness into the systems.
And I think particularly of communications and the Defense
Department and the national security Agencies and the other
parts of our Government relying to a significant extent on
literally commercial satellites which are very vulnerable. Our
communications, our transportation system, and certainly our
energy grid all serve both defense and nondefense needs. And in
all three of these areas, there are vulnerabilities that didn't
exist before that do exist now that are the business of the
United States from a defense point of view, and this is a point
that both Senator Bennett and Senator Feinstein have made.
I think there will need to be more analysis of how the
Defense Department and the NSA and other agencies can interface
with the system that is being developed here. Placing it where
it has been placed has been a conscious decision. I am inclined
to try to provide some significant oversight over the process,
but see how it evolves. And I think we are going to have to
have some additional discussion on this point as we go on.
I want to make it clear for those who are here, and perhaps
here for the first time that we tended not--except in the very
fine brief summary in Senator Feinstein's opening statement, we
haven't revisited what brought us here, the significant threat
to our way of life and to the national security of the United
States. We have gone into that at some length before and we
have even talked about some of the assumptions of this basic
Plan.
As I said in the beginning, this is the fifth hearing of
this subcommittee, and what I wanted to do today was to focus
on a specific issue which I will get to in the next panel which
has to do with privacy concerns, because I would note that our
ability to move forward as a government in this area is
dependent upon the approval of the citizens of the United
States to allow us to move forward. And if they have concerns
about a privacy issue, for example, we need to deal with those
up front or we are not going to be able to address these more
fundamental questions.
But I think it is good that Senator Bennett has reminded us
of one of the critical assumptions underlying the structure
that you have set up here and the fact that that assumption may
not be necessarily a valid one, that we may need to turn more
to the national security side of our Government to help us to
protect the critical infrastructure, and we will have to
evaluate that as time goes on.
Mr. Tritak. Senator, if I can make just one quick point in
answer actually to what I was actually leading up to, Senator,
and that is one of the things that struck me about a question
you asked fairly early in the Y2K Committee was when, whether,
and under what circumstances may the Federal Government play a
role in reconstituting privately-owned infrastructures.
Recognizing that we want the market to lead, what happens
if that fails, for whatever reason, and it is beginning to have
a deleterious effect on national security, economic security,
or delivery of vital services? That, to me, is the fundamental
question and, in fact, that is what we are beginning to turn to
now because I think it really is at the core of what you mean
by an EFEMA versus other things.
But we have begun to look at authorities. One place you
start is actually looking at existing authorities and where are
the shortfalls for those, and then developing clear ideas about
what contingencies might arise and to assure we can plan
against those contingencies. We don't know yet for sure what
contingencies would apply, but I think the question and the
issue is a valid one and you raised it in the Y2K context. I
think it is critical to CIP and part of what the Government's
responsibility is to defend the Nation in the event of an
attack, particularly if it comes from overseas.
Senator Kyl. Thank you very much. Well, obviously we will
have more questions for you. We will submit some for the
record. What we also I think would appreciate is an ongoing
communication from you as things evolve. Don't wait for a
hearing to come up and talk to us. Feel free to communicate
with us on an ongoing basis as the situation evolves so that we
will be up to speed with what you are doing.
Thank you again for being here today. Obviously, we could
spend all day on some of these issues.
[The prepared statement of Mr. Tritak follows:]
Prepared Statement of John S. Tritak
Mr. Chairman, it is an honor to appear before you here today to
talk with you about the National Plan for Information Systems
Protection, Version 1.0. This Subcommittee has shown exceptional
leadership on the matter of critical infrastructure assurance. I am
grateful for the opportunity to discuss the Administration's efforts to
achieve President Clinton's goal of establishing a full operational
capability to defend the critical infrastructures of the United States
by 2003 against deliberate attacks aimed at significantly disrupting
the delivery of services vital to our nation's defense, economic
security, and the health and safety of its people. This cannot be done
without the support and participation of the Congress.
1. INTRODUCTION
The Information Age has fundamentally altered the nature and extent
of our dependency on these infrastructures. Increasingly, our
Government, economy, and society are being connected into an ever
expanding and interdependent digital nervous system of computers and
information systems. With This interdependence comes new
vulnerabilities. One person with a computer, a modem, and a telephone
line anywhere in the world can potentially break into sensitive
Government files, shut down an airport's air traffic control system, or
disrupt 911 services for an entire community.
The threats posed to our critical infrastructures by hackers,
terrorists, criminal organizations and foreign Governments are real and
growing. The need to assure delivery, of critical services over our
infrastructures is not only a concern for the national security and
federal law enforcement communities, it is also a growing concern for
the business community, since the security of information
infrastracture is a vital element of E-commerce. Drawing on the full
breadth of expertise of the federal government and the private sector
is therefore essential to addressing this matter effectively.
President Clinton has increased funding on critical infrastructure
substantially during the past three years, including a 15 percent
increase in the fiscal year 2001 budget proposal to $2.0 billion. He
has also developed and funded new initiatives to defend the nation's
computer systems from cuber attack.
In the 18 months since the President signed Presidential Decision
Directive 63, we have made significant progress in protecting our
critical infrastructures. In response to the President's call for a
national plan to serve as a blueprint for establishing a critical
infrastructure protection (CIP) capability, the National Plan for
Information Systems Protection was released last month. It represents
the first attempt by any national Government to design a way to protect
those infrastructured essential to the delivery of electric power, oil
and gas, communications, transportation services, banking and financial
services, and vital human services. Increasingly, these infrastructures
are being operated and controlled through the use of computers and
computer networks.
The current version of the Plan focuses mainly on the domestic
efforts being undertaken by the Federal Government to protect the
Nation's critical cyber-based infrastructures. Later versions will
focus on the efforts of the infrastructure owners and operators, as
well as the risk management and broader business community. Subsequent
versions will also reflect to a greater degree the interests and
concerns expressed by Congress and the general public based on their
feedback. that is why the Plan is designated Version 1.0 and subtitled
An Invitation to a Dialogue--to indicate that it is still a work in
progress and that a broader range of perspective must be taken into
account if the Plan is truly to be ``national;'' in scope and
treatment.
THE PLAN: OVERVIEW AND HIGHLIGHTS
President Clinton directed the development of this Plan to chart
the way toward the attainment of a national capability to defend our
critical infrastructures by the end of 2003. To meet this ambitious
goal, the Plan establishes 10 programs for achieving three broad
objectives. They are:
Objective 1: Prepare and Prevent: Undertake those steps necessary to
minimize the possibility of a significant and successful attack on
our critical information networks, and build an infrastructure that
remains effective in the face of such attacks.
Program 1 calls for the Government and the private sector to
identify significant assets, interdependencies, and
vulnerabilities of critical information networks from attacks,
and to develop and implement realistic programs to remedy the
vulnerabilities, while continuously updating assessment and
remediation efforts.
Objective 2: Detect and Respond: Develop the means required to
identify and assess attacks in a timely way, contain such attacks,
recover quickly from them, and reconstitute those systems affected.
Program 2 will install multi-layered protection on sensitive
computer systems, including advanced firewalls, intrusion
detection monitors, anomalous behavior identifiers, enterprise-
wide management systems, and malicious code scanners. To
protect critical federal systems, computer security operations
centers will receive warnings from these detection devices, as
well as Computer Emergency Response teams (CERTs) and other
means, in order to analyze the attacks, and assist sites in
defeating attacks.
Program 3 will develop robust intelligence and law
enforcement capabilities to protect critical information
systems, consistent with the law. It will assist, transform,
and strengthen U.S. law enforcement and intelligence Agencies
to be able to deal with a new kind of threat and a new kind of
criminal--one that acts against computer networks.
Program 4 calls for a more effective nationwide system to
share attack warnings and information in a timely manner. This
includes improving information sharing within the Federal
Government and encouraging private industry, as well as state
and local Governments, to create Information Sharing and
Analysis Centers (ISACs), which would share information from
the Federal Government. Program 4 additionally calls for
removal of existing legal barriers to information sharing.
Program 5 will create capabilities for response,
reconstitution, and recovery to limit an attack while it is
underway and to build into corporate and Agency continuity and
recovery plans the ability to deal with information attacks.
The goal for Government and the recommendation for industry is
that every critical information system have a recovery plan in
place that includes provisions for rapidly employing additional
defensive measures (e.g., more stringent firewall
instructions), cutting off or shutting down parts of the
network under certain predetermined circumstances (through
enterprise-wide management systems), shifting minimal essential
operations to ``clean'' systems, and to quickly reconstitute
affected systems.
Objective 3: Build Strong Foundations: Take all actions necessary to
create and support the Nation's commitment to Prepare and Prevent
and to Detect and Respond to attacks on our critical information
networks.
Program 6 will systematically establish research requirements
and priorities needed to implement the Plan, ensure funding,
and create a system to ensure that our information security
technology stays abreast with changes in the threat
environment.
Program 7 will survey the numbers of people and the skills
required for information security specialists within the
Federal Government and the private sector, and takes action to
train current Federal IT workers and recruit and educate
additional personnel to meet shortfalls.
Program 8 will explain publicly the need to act now, before a
catastrophic event, to improve our ability to defend against
deliberate cyber-based attacks.
Program 9 will develop the legislative framework necessary to
support initiatives proposed in other programs. This action
requires intense cooperation within the Federal Government,
including Congress, and between the Government and private
industry.
Program 10 builds mechanisms to highlight and address privacy
issues in the development of each and every program.
Infrastructure assurance goals must be accomplished in a manner
that maintains, and even strengthens, American's privacy and
civil liberties. The Plan outlines nine specific solutions,
which include consulting with various communities; focusing on
and highlighting the impact of programs on personal
information; committing to fair information practices and other
solutions developed by various working groups in multiple
industries; and working closely with Congress to ensure that
each program meets standards established in existing
Congressional protections.
I would like to highlight a few of the programs in the remainder of
my testimony. In these programs, the Administration seeks to accomplish
two broad aims of the Plan--the establishment of the U.S. Government as
a model of infrastructure protection, and the development of a public-
private partnership to defend our national infrastructures.
A. The Federal Government as a model of information security
We often say that more than 90 percent of our critical
infrastructures are neither owned nor operated by the Federal
Government. Partnerships with the private sector and state and local
governments are therefore not just needed, but are the fundamental
aspect of critical infrastructure protection. Yet, The President
rightly challenged the Federal Government in PDD-63 to serve as a model
for critical infrastructure protection--to put our own house in order
first. Given the complexity of this issue, we need to take advantage of
the breadth of expertise within the Federal Government to ensure that
we enlist those Agencies with special capabilities and relationships
with private industry to the fullest measure in pursuit of our common
goal.
To this end, the President has developed and provided full or pilot
funding for the following key initiatives designed to protect the
federal Government's computer systems:
Federal Computer Security Requirements and Government
Infrastructure Dependencies. One component of this effort supports
aggressive, Government-wide implementation of federal computer security
requirements and analysis of vulnerabilities. Thus, in support of the
release of the National Plan, the President announced his intent to
create a permanent Expert Review Team (ERT) at the Department of
Commerce's National Institute of Standards and Technology (NIST). The
ERT will be responsible for helping Agencies identify vulnerabilities,
plan secure systems, and implement Critical Infrastructure Protection
Plans. Pursuant to existing Congressional authorities and
administrative requirements, the Director of the team would consult
with the Office of Management and Budget and the National Security
Council on the team's plan to protect and enhance computer security for
Federal Agencies. The President's Budget for fiscal year 2001 will
propose $5 million for the ERT.
Under PDD-63, the President directed the CIAO to coordinate
analyses of the U.S. Government's own dependencies on critical
infrastructures. Many of the critical infrastructures that support our
nation's defense and security are shared by a number of Agencies. Even
within Government, critical infrastructure outages may cascade and
unduly impair delivery of critical services. The CIAO is coordinating
an interagency effort to develop a more sophisticated identification of
critical nodes and system, and to understand their impact on national
security, national economic security, and public health and safety
Government-wide. These efforts support the work of the ERT in
identifying vulnerabilities of the Government's information
infrastructures, and provide valuable input to Agencies for planning
secure computer systems and implementing computer security plans. This
research, when complete, will permit the Federal Government to identify
and redress its most significant critical infrastructure
vulnerabilities first and provide the necessary framework for well
informed critical infrastructure protection policy making and budget
decisions.
Federal Intrusion Detection Network (FIDNet). PDD-63 marshals
Federal Government resources to improve interagency cooperation in
detecting and responding to significant computer intrusions into
civilian Government critical infrastructure nodes. The program--much
like a centralized burglar alarm system--would operate within long-
standing, well-established legal requirements and Government policies
covering privacy and civil liberties. FIDNet is intended to protect
information on critical, civilian Government computer systems,
including that provided by private citizens. It will not monitor or be
wired into private sector computers. All aspects of the FIDNet will be
fully consistent with all laws protecting the civil liberties and
privacy rights of Americans.
To support this effort, the Administration will propose funding in
the President's fiscal year 2001 Budget ($10 million) to create a
centralized intrusion detection and response capability at the General
Services Administration (GSA). This capability will function in consort
with GSA's Federal Computer Incident Response Capability, and assist
Federal Agencies to:
detect and analyze computer attacks and unauthorized
intrusions;
share attack warnings and related information across
Agencies; and
respond to attacks in accordance with existing procedures
and mechanisms.
FIDNet is intended to promote confidence in users of Federal
civilian computer systems. It is important to recognize that FIDNet has
a graduated system for response and reporting attack and intrusion
information would be gathered and analyzed by home-Agency experts. Only
data on system anomalies would be forwarded to GSA for further
analysis. Thus, intrusion detection would not become a pass-through for
all information to The Federal Bureau of Investigation or other law
enforcement entities. Law enforcement would receive information about
computer attacks and intrusions only under long-standing legal rules--
no new authorities are implied or envisioned by the FIDNet program.
One additional benefit of Government-wide intrusion detection is to
improve computer intrusion reporting and the sharing of incident
information consistent with existing government computer security
policy. Various authorities require Agencies to report criminal
intrusions to appropriate law enforcement personnel, which include the
National Infrastructure Protection Center.
FIDNet will support law enforcement's responsibilities where cyber-
attacks are of a criminal nature or threaten national security.
In short, FIDNet will:
be run by the GSA, not the FBI;
not monitor any private network traffic;
confer no new authorities on any Government Agency; and
be fully consistent with privacy law and practice.
Federal Cyber Services (FCS). One of the nation's strategic
shortcomings in protecting our critical infrastructures is a shortage
of skilled information technology (IT) personnel. Within IT, the
shortage of information systems security personnel is acute, The
Federal Government's shortfall of skilled information systems security
personnel amounts to a crisis. This shortfall reflects a scarcity of
university graduate and undergraduate information security programs and
the inability of the Government to provide the salary and benefit
packages necessary to compete with the private sector for these highly
skilled workers. In attacking this problem through the Federal Cyber
Services initiative described below, we are leveraging the initial
efforts made by the Defense Department, National Security Agency, and
some other Federal Agencies. The President's Budget for fiscal year
2001 will propose $25 million for this effort.
The Federal Cyber Services training and education initiative,
highlighted by the President at the Plan's release, introduces five
programs to help solve the Federal IT security personnel problem.
a study by the Office of Personnel Management to identify
and develop competencies for federal information technology
(IT) security positions, and the associated training and
certification requirements.
the development of Centers of IT Excellence to establish
competencies and certify current Federal IT workers and
maintain their information security skill levels throughout
their careers.
The creation of a Scholarship for Service (SFS) program to
recruit and educate the next generation of Federal IT managers
by awarding scholarships for the study of information security,
in return for a commitment to work for a specified time for the
Federal Government. This program will also support the
development of information security faculty.
The development of a high school outreach and awareness
program that will provide a curriculum for computer security
awareness classes and encourage careers in IT fields.
The development and implementation of a Federal Information
Security awareness curriculum aimed at ensuring computer
security literacy throughout the entire Federal workforce.
Research and Development. A key component to our ability to protect
our critical infrastructures now and in the future is a robust research
and development plan. As part of the structure established by PDD-63,
the interagency Critical Infrastructure Coordination Group (CICG)
created a process to identify technology requirements in support of the
Plan. Chaired by the Office of Science and Technology Policy (OSTP),
the Research and Development Sub-Group works, with Agencies and the
private sector to:
gain agreement on requirements and priorities for
information security research and development;
coordinate among Federal Departments and Agencies to ensure
the requirements are met within departmental research budgets
and to prevent waste or duplication among departmental efforts;
communicate with private sector and academic researchers to
prevent Federally funded R&D from duplicating prior, ongoing,
or planned programs in the private sector or academia; and
identify areas where market forces are not creating
sufficient or adequate research efforts in information security
technology.
That process, begun in 1998, has helped focus efforts on
coordinated cross-government critical infrastructure protection
research. Among the priorities identified by the process are:
technology to support large-scale networks of intrusion
detection monitors;
artificial intelligence and other methods to identify
malicious code (trap doors) in operating system code;
methodologies to contain, stop, or eject intruders, and to
mitigate damage or restore information-processing services in
the event of an attack or disaster,
technologies to increase network reliability, system
survivability, and the robustness of critical infrastructure
components and systems, as well as the critical infrastructures
themselves; and
technologies to model infrastructure responses to attacks or
failures; identify interdependencies and their implications;
and locate key vulnerable nodes, components, or systems.
The President's Budget for fiscal year 2001 will propose $606
million across all Agencies for critical infrastructure related R&D
investment.
The need exists, however, to coordinate R&D efforts not just across
the federal Government, but between the public and private sectors as
well. A fundamentally important initiative that has the ability to pull
disparate pieces of the national R&D community into closer
relationships is the Institute for Information Infrastructure
Protection (I3P), an organization created to identify and
fund research and technology development to protect America's
cyberspace from attack or other failures. I will discuss this in detail
when I address Public-Private Partnership issues.
Public Key Infrastructure. Protecting critical infrastructures in
the Federal Government and private sectors requires development of an
interoperable public key infrastructure (PKI). A PKI enables data
integrity, user identification and authentication, user non-
repudiation, and data confidentiality through public key cryptography
by distributing digital certificates (essentially electronic
credentials) containing public keys, in a secure, scalable, and
reliable manner. The potential of PKI has inspired numerous projects
and pilots throughout the Federal Government and private sectors. The
Federal Government has actively promoted the development of PKI
technology and has developed a strategy to integrate these efforts into
a fully functional Federal PKI. The President's Budget for fiscal year
2001 will propose $7 million to ensure development of an interoperable
Federal PKI.
To achieve the goal of an integrated Federal PKI, and protect oar
critical infrastructures, the Federal Government is working with
industry to implement the following program of activities:
Connect Agency-wide PKIs into a Federal PKI. DoD, NASA, and
other Government Agencies, are actively implementing Agency-
wide PKIs to protect their internal critical infrastructures.
While a positive step, these isolated PKIs do not protect
infrastructures that cross Agency boundaries. Full protection
requires an integrated, fully functional PKI.
Connect the Federal PKI with Private Sector PKI: Private
sector groups are actively developing their own PKIs as well.
While a positive step, these isolated PKIs do not protect
infrastructures that cross Government or industry sector
boundaries.
Encouraging Development of Interoperable Commercial Off-the-
Shelf (COTS) PKI Products: Limitation to a single vendor's
solution can be a Serious impediment, as most organizations
have a heterogeneous computing environment. Consumers must be
able to choose COTS PKI components that suit their needs.
Validating the Security of Critical PKI Components:
Protecting critical infrastructures require sound
implementation. The strength of the security services provided
to the critical infrastructures depends upon the security of
the PKI components. Validation of the security of PKI
components is needed to ensure that critical infrastructures
are adequately protected. NIST is pursuing a validation program
for PKI components.
Encouraging Development of PKI-Aware Applications: To
encourage development of PKI-aware applications, the Government
is working with vendors in key application areas. One example
is the secure electronic mail projects that have been performed
jointly with industry.
B. Public-Private partnership
The security of information flowing over the information highway is
a critical element of E-commerce, as well as to our national security.
It is a necessary part of building trust in the accuracy and integrity
of transactions made over the information infrastructure. There is a
growing awareness that America's information infrastructure--the basis
of E-Commerce--is becoming an increasingly attractive target for
deliberate attack or sabotage. A strategy of cooperation and
partnership between the private sector and the U.S. Government to
protect the Nation's infrastructure is the linchpin of this effort. The
President is committed to building partnerships with the private sector
to protect our computer networks through the following initiatives:
Institute for Information Infrastructure Protection
(I3P). The Institute would identify and address serious R&D
gaps that neither the private sector nor the Government's national
security community would otherwise address, but that are necessary to
ensure the robust, reliable operation of the national information
infrastructure. The President announced he would propose initial
funding of $50 million for the Institute in his fiscal year 2001
Budget. Funding would be provided through the Commerce Department's
National Institute of Standards and Technology (NIST) to this
organization. The Institute was first proposed by the scientists and
corporate officials who served on the President's Committee of Advisors
on Science and Technology, and supported by leading corporate Chief
Technology Officers.
The Institute will work directly with private sector information
technology suppliers and consumers to define research priorities and
engage the country's finest technical experts to address the priorities
identified. Research work will be performed at existing institutions
including private corporations, universities, and non-profit research
institutes. The Institute will also make provisions to accept private
sector support for some research activities.
Partnership for Critical Infrastructure Security. Last December,
Commerce Secretary Daley met with senior representatives from over 90
major corporations, most fortune 500, representing owners and operators
of critical infrastructures, their suppliers, and their customers, to
discuss the building a Partnership for Critical Infrastructure
Security. Industry has taken the lead on this effort and organized a
meeting at the U.S. Chamber of Commerce far later this month to give
substance and purpose to the Partnership.
The Partnership will explore ways in which industry and Government
can work together to address the risks to the nation's critical
infrastructures. Federal Lead Agencies are currently building
partnerships with individual infrastructure sectors in private
industry, including communications, banking and finance,
transportation, and energy. The Partnership will serve as a forum in
which to draw these individual efforts together to facilitate a
dialogue on cross-sector interdependencies, explore common approaches
and experiences, and engage other key professional and business
communities that have an interest in infrastructure assurance. By doing
so, the Partnership hopes to raise awareness and understanding of, and
to serve, when appropriate, as a catalyst for action among, the owners
and operators of critical infrastructures, the risk management and
investment communities, other members of the business community, and
state and local Governments.
National Infrastructure Assurance Council (NIAC). President Clinton
established the NIAC by Executive Order 13130 on July 14, 1999. When
fully constituted, it will consist of up to 30 leaders in industry,
academia? the privacy community, and state and local Government. The
NIAC will provide advise and counsel to the President on a range of
policy matters relating to critical infrastructure assurance, including
the enhancement of public-private partnerships, generally.
III. CONCLUSION
In conclusion, the National Plan is an important step forward. My
staff and I are committed to building on this promising beginning,
coordinating the Governments efforts into an integrated program for
critical infrastructure protection in support of the National
Coordinator for Security, Infrastructure Protection, and Counter-
Terrorism, and the Federal Government, generally. We have much work
left to do, and I hope to work with the members of this committee,
indeed with the Congress as a whole, as we wrestle with this developing
field. I look forward to your questions.
Senator Kyl. I would like to bring our next panel forward
now to look specifically at the National Plan and privacy
issues associated with it. We will have two witnesses. The
first witness is Mr. Marc Rotenberg, executive director of the
Electronic Privacy Information Center, EPIC. Mr. Rotenberg also
teaches on information privacy at Georgetown Law School. He has
testified before Congress, advocating strong privacy protection
in the Internet age.
He has also followed the work of this subcommittee quite
closely, stating in a 1998 study entitled ``Critical
Infrastructure and the Endangerment of Civil Liberties'' that
in the fight for diminishing resources--I am going to quote
now, Senator Feinstein--
the intelligence community and the Pentagon also
ensured a body of congressional champions of
information warfare advocates and supporters. Chief
among them are Senator Jon Kyl--
thank you--
whose Subcommittee on Technology, Terrorism, and
Government Information has held numerous hearings
featuring doom-and-gloom witnesses complaining that the
Nation is on the verge of an electronic Pearl Harbor,
and even more distastefully, an electronic Oklahoma
City.
In any event, thank you for appearing and following our
hearings, Mr. Rotenberg. We will place your full statement in
the record and in a moment ask you to provide a summary of
that.
The other witness in this panel is Frank Cilluffo, senior
policy analyst at the Center for Strategic and International
Studies. He directs seven task forces on a range of topics,
including information warfare and information assurance,
terrorism, and financial crimes. These task forces comprise
over 175 senior officials and experts from the academic,
defense, intelligence, law enforcement, and corporate
communities. We will place your full statement in the record as
well and ask both of you to summarize your comments.
So, first, Mr. Rotenberg.
PANEL CONSISTING OF MARC ROTENBERG, EXECUTIVE DIRECTOR,
ELECTRONIC PRIVACY INFORMATION CENTER, WASHINGTON, DC; AND
FRANK J. CILLUFFO, SENIOR POLICY ANALYST, CENTER FOR STRATEGIC
AND INTERNATIONAL STUDIES, WASHINGTON, DC
STATEMENT OF MARC ROTENBERG
Mr. Rotenberg. Thank you, Mr. Chairman and Senator
Feinstein. I am grateful to be here with the opportunity to
talk about privacy. I should say at the outset that there is
really no disagreement about the need to keep the Nation's
computer network secure and safe from attack. Outages cause
disruption for industry. They cause disruption for users, and
certainly they pose questions of public safety and national
security.
At the same time, I would like to suggest to you in
reviewing the Plan that it is very important to keep in mind
the history of the growth of the Internet, as well as our
country's recent experience with computer security policy to
ensure that the plan that is followed through on actually is
the best way to protect this underlying interest. In my
testimony, I outline some of this history. I would like to
briefly highlight a couple of points and then focus in on the
FIDNet proposal.
The first point I would like to make is regarding the
nature of the Internet itself. This is a very robust
communication infrastructure that was designed with the
understanding that a foreign adversary may well cause an attack
that could have taken out a traditional channel switch network,
like a telephone network, for example. And in this old style of
networking, if you take out one of the points along the line,
the whole line goes down and you cannot get information
through.
The Internet relied on a different architecture. It was
decentralized, it used multiple nodes. It used a type of
switching technology called packet switching which made it
possible to move information from one point to another, even if
some of the points in between along the way had been taken out,
and this made it very robust. It also interestingly made it
equally secure against attack from a foreign adversary, as well
as a natural disaster or even a winter storm.
Now, I don't mean to suggest to you that there aren't real
risks to the Internet today. There are, and I think the
subcommittee has done a good job of documenting these risks.
But at the same time, I would like to suggest to you that the
architects of this infrastructure, the designers, were very
much aware from the outset of the need to create a
communications network that could withstand attack and that
could continue to operate. And this is important to understand
what security is about.
The second point I would like to say is that, frankly,
during the past decade the Federal Government's record in the
area of promoting computer security has been quite mixed. And
as you are no doubt aware, the private sector user
organizations, privacy organizations, have expressed a lot of
concern that many of these proposals that seek at the outset to
promote computer security in the end create a lot of computer
surveillance, and that whereas a private organization might try
to make a system more robust or more difficult to attack or
take down, the Government invariably comes up with proposals
that make it easier to monitor and to spy on.
Nowhere was this problem more clearly demonstrated than in
the difficulty of developing an encryption policy that would
work for the Government and for the private sector. Now, I am
not going to go through all that history, but I do want to
provide for you one very simple example of the difficulties
that the Federal Government's computer security policy over the
last decade created for computer users and for private
industry, and it has to do with the online transactions
involving credit card purchases.
When people went online last Christmas to buy books or CD's
or gifts for their families, many of them were typing in credit
card numbers, and what secured those credit card numbers so
that they could not be stolen by thieves or anybody else was a
little bit of encryption built into the software that they were
using. They weren't even aware of it, but it scrambled the
credit card number so that it would go from their computer to
the Web site where they were buying this product online and
protected that information.
Now, you can design that encryption so that it is very
strong, so that it is difficult to break. But the Federal
Government was very reluctant to make that type of strong
encryption widely available because they said if we make that
available for American consumers, it could also fall into the
wrong hands. So what they tried to do instead is they said we
are going to create two levels of encryption, one level the
strong kind that will let American consumers use it if they
prove that they are U.S. citizens, and another a weak kind that
will let U.S. companies market to foreign users because they
are going to need some encryption, but it is not going to be as
strong.
Well, the result of that policy, as I describe in my
testimony, was that this past Christmas season when U.S.
consumers were buying products from U.S. businesses in the
United States, they were invariably using the weak encryption
because of a government policy that was trying to keep strong
encryption out of the hands of foreign users. This is a
reoccurring problem in the computer security field. I think the
Plan as currently described is going to recreate this problem
and I want to bring it to your attention today. It is a very
real problem.
Now, I am going to focus now on FIDNet. A couple of things
were said by Mr. Tritak during the last panel, and I hope you
will ask me a couple of questions about this, but I have to say
at the outset what disturbed me most about Mr. Tritak's
presentation--in some ways it is not surprising--is having said
on the one hand that the Government is very much aware of
privacy issues and privacy laws, and intends to respond to
these concerns because they are widely shared by the American
public, Mr. Tritak was unaware that the type of government
monitoring that is proposed in the Plan as described in FIDNet
would fall under the legal rules set out in our Communications
Privacy Act, passed in 1986 with strong bipartisan support.
He seemed to think that because this wasn't voice
communication, it wasn't subject to any legal rules. That is
simply not correct. But it was even more disturbing, as I
described in my testimony, that in a memo that was prepared by
the Department of Justice by Mr. Ron Lee to Mr. Tritak's
predecessor, Mr. Hunker, who is the Director of the CIAO, Mr.
Lee outlined the problem. He said, you have got a real issue
here. The type of network monitoring which one agency like the
DOD would be permitted to do on its own computer networks which
you are now proposing under the Plan to do across all
government computer networks clearly would fall under the
Communications Privacy Act. And if you want to do this, advised
Mr. Lee, you are going to have to notify all people using
government computer networks, not just Federal employees but
also U.S. citizens, that they will have no right of privacy
using the network.
Now, that is frankly the suggestion that is put forward by
Mr. Lee and the Department of Justice that could, in effect,
make the privacy issue go away. But it is a solution that I
think privacy organizations across the political spectrum would
have a great deal of difficulty with. And as I have tried to
suggest in the testimony, I think for the Government to say, in
effect, you have no legal rights of privacy when you are using
the Government computer system would be contrary not only to
the Federal wiretap statute, but also our Privacy Act, passed
in 1974, and our whole fourth amendment tradition which
basically says, yes, the Government has the right to search and
protect public safety, but it has to be done in a way that
recognizes the balance of power within our Government; that the
executive branch, the Federal agencies may conduct these
activities, but they have to be reviewed by the judicial
branch.
The other point which I would like to briefly say, Mr.
Chairman, is that there was in my testimony a reference to the
use of credit card information and telephone toll record
information. And you asked a question which I certainly thought
was very appropriate, and that is what type of information
would be collected in trying to assess system anomalies because
this, of course, is the basis for the search that the
Government agencies will conduct.
Now, I don't know exactly what the plan is, and I think Mr.
Tritak is correct to say that this is still a Plan in
development. But I do have here and am pleased to provide for
the subcommittee a memo from Mr. Hunker outlining the National
Plan and, ``how we get industry buy-in.'' And contained in this
Plan is one slide titled ``Profiling System Anomalies.'' The
first bullet point is ``Systematic Identification of Suspicious
and Anomalous Behavior Based on Algorithms to Analyze
Similarities and Match Behavioral Patterns.''
And then there are three lines. The first line, which
frankly I don't understand, says ``Traditional Psycho-
Linguistics.'' The second line is ``Credit Card Profiling,''
and the third line is ``Toll Fraud Profiling.'' And this is
from a memo that was prepared by Mr. Hunker describing how
system anomalization might be identified.
And I should say, in fairness, Mr. Chairman, that this is a
big, complex area. I wouldn't expect Mr. Tritak to be familiar
with all the details, but I think if we are to take seriously
the commitment to privacy protection, we need a clear
understanding about the application of U.S. privacy laws, and
we clearly need more information about what type of information
will be collected from U.S. citizens.
You see, when you set up intrusion detection, it is not
just the bad guys and the people who are intent on causing us
harm that you are going to be tracking and monitoring. You are
going to be tracking U.S. employees working for U.S. firms in
London and Tokyo, U.S. trade officials in Geneva and Paris,
U.S. computer researchers in Dublin and Tel Aviv, and U.S.
citizens within the United States. All of these people will
become subject to the monitoring scheme that is outlined in the
FIDNet proposal.
So I would be pleased to answer your questions and I thank
you again for the chance to be here.
Senator Kyl. Thank you.
[The prepared statement of Mr. Rotenberg follows:]
Prepared Statement of Marc Rotenberg
Mr. Chairman, members of the Subcommittee, thank you for the
opportunity to testify today regarding the privacy implications of the
Administration's proposed National Plan for Information Systems
Protection. My name is Marc Rotenberg and I am the executive director
of the Electronic Privacy Information Center, a research and advocacy
organization, located here in Washington, DC. EPIC has a general
interest in privacy protection and a particular interest in ensuring
that efforts to promote computer security do not undermine basic
American liberties. For over a decade we have reviewed proposals for
information system security in the federal government, made
recommendations for changes, and pursued litigation where appropriate.
I should say at the outset that we are all aware that our nation
has become increasingly dependent on the hi-tech infrastructure for
everything from power and communications to transportation and national
defense. Moreover, it is quite likely that others who intend to do us
harm would target this infrastructure in an effort to disable or
disrupt essential communications resources.
Nonetheless our fear of attack and our need to protect public
safety should not lead us to take actions that are wasteful, misguided,
or ultimately undermine the values that we seek to defend. We should be
particularly careful that the solutions that are pursued reflect the
full range of risks to our nation's communications network. The plan
presumes that threats to the nation's infrastructure are from
adversaries intent on causing harm to the United States and that
therefore steps must be taken to ``defend our federal cyber systems.''
Security standards that treat all risks as simply defending against
foreign threats will ultimately not serve us well.\1\
---------------------------------------------------------------------------
\1\ The developers of the Plan are aware of this as well, but they
often obscure the problem. On the very first page of the report, the
writers describe several genuine security problems with the nation's
computer systems but then say, ``All of these events have occurred--not
on the same day, and not all the result of deliberate action by
America's adversaries--but all within the last 36 months.'' The message
should be stated more clearly: not all threats to the nation's computer
systems will be malicious attacks from overseas.
---------------------------------------------------------------------------
In this spirit, I would like to remind the Committee that the
winter storm that hit Washington, DC last week did far more damage to
the operation of government, the use of our transportation systems, and
our supply networks than the widely touted Y2K bug which has consumed
so much attention in the federal government. Defending America's
cyberspace may require preparation against winter ice storms as well as
malicious hackers in foreign countries.
To assess the National Plan for Information System Protection, you
must first recall that the Internet, which has emerged from the
ARPANet, was designed to continue operation even after an attack from a
foreign government. Robustness was key to the design. Protecting the
Internet from attack is hardly a new problem; it was the basis of its
creation.
The key to the Internet's resilience, and what distinguished it
from the channel-switched communications networks that proceeded it, is
a decentralized architecture that allows multiple-routings for,
messages sent between the same two points. If, for example, a person
wished to send a message from Pittsburgh to Flagstaff in the old
telephone network, an outage at the main switch in Phoenix could
prevent a call from ever getting through. But in the packet-switched
network, where messages could be broken up into small pieces, sent
through different channels and then put back together, the disruption
at one node would not prevent communications from going through.
In designing the Internet, the engineers recognized that a
traditional top-down command and control structure would be vulnerable
to attack and that a different way to move information would be
necessary. History has shown that the design was well conceived. Over
the last thirty years there have been only two incidents that really
took down the Internet--and both resulted from software glitches.
It is important also to understand that the Internet really doesn't
care whether a node is down because of a military attack or a winter
storm--it is equally resistant to both purposeful assault and natural
disaster.
Work on Internet security today continues largely in the open among
researchers and experts all around the world. Critical to the future of
network security is the open exchange of information among security
experts, the opportunity to publish findings in the open literature,
and the chance to challenge, even attack, another programmer's work.
This process which relies on cooperation and the exchange of ideas is
the best way to identify security flaws and encourage trust among
users.
This work is not done simply by US citizens or US companies.
Computer researchers around the world have all played an important role
in developing the protocols and promoting the architecture that secures
the Internet in the United States and around the world. Indeed the
cryptographic techniques that help protect computers in this country
were developed by researchers in Japan, Israel and elsewhere.
Unfortunately, the National Plan ignores much of this history. It
draws sharp boundaries based on national interests. It treats threats
to network reliability as primarily threats from abroad and downplays
the risk of software glitches and winter storms. The plan urges the
development of computer security experts charged with defending the
nation's infrastructure. This view of computer scientists, as soldiers
with keyboards, misses the critical point that computer security is an
international enterprise.
Ultimately the Plan views the Internet as a domestic communications
structure that must be secured from above from foreign threats. But the
original architects of the network knew better. A communications
network that can be secured from above can also be taken out from
above.
ADMINISTRATION HAS CREATED SECURITY PROBLEMS
My second point is that the federal government's recent efforts to
promote computer security in the private sector have created more
problems than they have solved. For the past decade the federal
government was largely responsible for preventing the widespread
availability of encryption and security tools that would have made the
nation's computer systems more secure and less vulnerable to attack.
It is only in the past few months, after heavy lobbying by
industry, pressure from Congress, and the continued voice of privacy
organizations, that the administration has begun to back off the
complex and short-sighted export control regime that has not only
prevented the development and sale of good security products but also
the implementation of better security systems in our country.
The problem is that the federal government has two very distinct
views of computer security: one commonly called COMSEC, refers to
Communications Security, the other SIGINT, refers to Signals
Intelligence. In the COMSEC view of the world there is general
agreement about the need to promote security and to make systems more
difficult to attack. But in the SIGINT view of the world, the
government seeks to get into computers, to intercept communications and
to gather information that may be useful to protect the nation's
security.
In no agency are the two notions more at odds than the National
Security Agency. The NSA simultaneously attempts to promote strong
security standards for the nation's computer systems and at the same
time to develop the methods to crack codes, break into networks, and
seize valuable intelligence. (And even with the resources at the NSA to
promote computer security, problems remain. The newspapers reported
last week that there was a significant failure at the NSA that took
down key systems for several days.)
The Administration said that with many of its early encryption
proposals it was trying to balance these competing interests, but the
SIGINT interests were clearly undermining the COMSEC efforts. As a
result, deeply flawed technical standards, such as the escrowed
encryption standard, were put forward and the nation's computer systems
remained vulnerable to attack. Also, tens of millions, possibly
hundreds of millions of dollars were wasted trying to make these
proposals designed by experts in SIGINT work.
The Administration also claimed that: the export controls rules
that limited the development of encryption products were only intended
to control the availability of strong encryption outside of the United
States. But in practice the rules kept strong encryption away from
American users. For example, there are encryption protocols in software
that protect credit card purchases on the Internet. But because of the
government's export policy, US manufacturers were required to provide
two versions--a strong 128-bit version for US citizens, and a weaker
40-bit version for non-US citizens. Because of the additional paperwork
required for US citizens to download the 128-bit version, many users
simply left the 40-bit version in place. As a result US consumers
buying products from US companies in the United States were using a
weak version of encryption because of a policy that was intended to
prevent strong encryption from being made available overseas. This is
exactly the kind of problem that will be replayed under the National
Infrastructure Protection Plan unless its proponents take a much
broader view of the problems in computer security.
Much will be done in the next few years to improve network security
in the private sector and across the federal agencies if the federal
government simply stays out of the way. Institutions have a clear
interest in safeguarding the security of their systems, but the federal
government's interests are more divided. Until trust is reestablished
in the security field, it would be better for the federal government to
follow rather than lead.
PRIVACY SAFEGUARDS IN PLAN ARE INSUFFICIENT
Largely in response to concerns raised by privacy organizations and
members of Congress about the original plan for Critical Infrastructure
Protection, the new Information Systems Security Plan discusses the
privacy issue at some length. There is much said about the need to
protect privacy and uphold privacy laws. But in the end the
recommendations on privacy fall short when compared with the enormous
surveillance authority that will be given to the federal government.
The Plan sets out a series of ``solutions'' to address privacy
concerns. It requests input from the privacy community, but establishes
no formal process to incorporate recommendations. The plan proposes a
legal review of elements of the plan, but most of the plan, including
specific mission objectives and milestones, has already been
established. The privacy section describes the need to review various
privacy issues, but then focuses on such concepts as ``consent'' and
``disclosure'' that are clearly intended to facilitate government data
collection and monitoring. The Plan's authors propose an annual
conference and some consideration of privacy issues by the National
Infrastructure Advisory Council, which is also tasked with a wide range
of other responsibilities. And if the private sector membership of this
Council is required to hold government security clearances, as is so
often the case with similar bodies, it will limit the ability of
citizens and independent experts to provide meaningful input as the
proposal goes forward.
The section on privacy stands in sharp contrast to the other
sections of the plan where the drafters outline ambitious, expensive
and far-reaching proposals for government agencies. Nowhere does the
Plan answer such questions as what formal reporting requirements will
be established, what independent review will be conducted, and what
mechanisms for public accountability and government oversight will be
put in place. The federal wiretap law, for example, contains an annual
reporting requirement so that the Congress and the public can review
the use of wiretap authority by the federal government. The Computer
Security Act established a Computer System Security and Privacy
Advisory Board that has held frequent meetings, issued reports and
adopted resolutions on privacy and security matters for almost a
decade. Where is the same institutional commitment in the Security Plan
to ensure oversight and accountability?
It is also clear that the absence of a privacy agency in the
federal government with the staff, expertise and resources to review
the Information Protection plan and other similar proposals remains a
critical problem. Having announced a commitment to ensure the
protection of civil liberties, it seems clear that some institutional
balance must be established to ensure that these proposals receive
adequate review. Isn't it possible that in this vast budget to erect
all of these elaborate surveillance techniques that Congress could set
aside 3 percent to establish a federal privacy agency that could
actually help safeguard the rights of Americans? This would be a small
investment in what many Americans consider their number one concern
about our nation's communications infrastructure--the protection of
personal privacy.
PROBLEMS WITH FIDNET
While it remains unclear whether the proposed Plan will in fact
promote network security, one point is clear: the plan will
dramatically expand the ability of the federal government to monitor
the activities of Americans all across the country. The plan recommends
the development of a Federal Intrusion Detection Network (``FIDNET''),
an open-ended monitoring authority that essentially gives a single
federal agency the authority to track communications across all federal
computer networks. According to the New York Times, ``networks of
thousands of software monitoring programs would constantly track
computer activities, looking for indications of computer network
intrusions and other illegal acts.''
This is an extraordinary surveillance authority, unlike any
capability that currently exists in the federal government. Last year
civil liberties organizations warned that this proposal would create
dramatic new government authority to monitor American citizens. The
drafters of the Plan are aware of this criticism and believe they have
addressed this problem. I tell you today that the problems with FIDNET
remain.
I would like to draw your attention to a March 8, 1999 memo from
Mr. Ronald D. Lee, Associate Deputy Attorney General, to Mr. Jeffrey
Hunker, Director of the Critical Infrastructure Assurance Office. (This
memo was obtained by EPIC under a Freedom of Information Act request
and is attached to this testimony.)
Mr. Lee says at the outset it is important to ``precisely identify
under what legal authority the FIDNET program is to be conducted.
Because monitoring ongoing communications is a wiretap within the
meaning of 18 U.S.C. Sec. 2511, it can only be authorized pursuant to a
wiretap order, or some relevant exemption to the statute.''
Mr. Lee goes on to say that while an individual federal agency
would have the right to monitor its own network to ``protect against
network intrusions, this does not mean that the GSA is a 'service
provider' within the meaning of the statute for the entire federal
government.''
Mr. Lee concludes that the only way that the GSA could conduct the
type of monitoring contemplated in the FIDNET proposal would be if the
federal government would notify all users of federal computer systems
that they would be subject to monitoring. Such a policy would cover not
only federal employees but all Americans who make use of a federal
computer system.
While Mr. Lee indicates that the Justice Department favors this
type of government-wide ``no privacy'' warning notice, I want to make
very clear that privacy organizations across the political spectrum
would oppose such a proposal as a violation of the spirit of the
federal wiretap statute, the plain language of the federal Privacy Act,
and contrary to the Fourth Amendment. US law simply does not give the
government the right to conduct such general purpose searches. The
history of the Fourth Amendment reveals a clear intent to require the
government to set out the specific circumstances for a search to occur.
There is no ``cyber threat'' exception to the Fourth Amendment. The
fact that the government announces that a warrantless search may occur
is hardly a sufficient legal basis to permit such searches to take
place.
There are other indications, contained in materials that we
received under the FOIA, that the CIAO intends to make use of credit
card records and telephone toll records as part of its intrusions
detection system. Access to these records raises specific problem under
US law.
The FIDNET proposal, as currently conceived, must simply be
withdrawn. It is impermissible in the United States to give a federal
agency such extensive surveillance authority.
RECOMMENDATIONS
As the White House plan currently stands, it raises far-reaching
privacy problems. The designers of the plan are trying to apply
twentieth century notions of national defense to twenty-first century
problems of communications security. Such an approach will leave our
networks ill-prepared to face the challenges of tomorrow.
In too many places the Plan relies too heavily on monitoring and
surveillance and not enough on integrity and redundancy. To give a
simple example, there are public telephones all across this country
filled with money. One way to implement security would be to install
cameras and recording devices inside each phone booth to monitor each
person's use of the phone to ensure that it is appropriate and to
determine whether any efforts are being made to steal the money stored
inside the phone. Another approach would simply be to make the phones
more secure and the money more difficult to steal. The phone companies
have wisely chosen the second approach. The federal government still
seems interested in the first.
Everyone wants to ensure that the computer networks that our
country relies on remain secure, safe and free from disruption. On this
point there is no disagreement. However, there is disagreement as to
whether an intrusive, government-directed initiative that views
computer security as almost solely defending ``our cyberspace'' from
foreign assault is the right way to go.
I urge you to proceed very cautiously. The government is just now
digging itself out of the many mistakes that were made over the past
decade with computer security policy. This is not the best time to be
pushing an outdated approach to network security, fraught with privacy
problems, on a fast-moving industry that is itself racing to develop
good security solutions.
In 1975, Senator Frank Church, who conducted a Senate investigation
of intelligence abuses, said of the NSA technology: ``That capability
at any time could be turned around on the American people, and no
American would have any privacy left, such is the capability to monitor
everything * * * there will be no place to hide.''
This Committee should keep Senator Church's warning in mind as it
reviews this proposal to create a vast new surveillance authority
across the federal government.
REFERENCES
White House ``National Plan for Information Systems Protection''
(January 7, 2000) http://www.ciao.ncr.gov/National-Plan/
national%20plan%20final.pdf
Executive Summary of ``National Plan for Information Systems
Protection'' (January 7, 2000) [http://www.whitehouse.gov/WH/EOP/NSC/
html/documents/npisp-execsummary-000105.pdf]
Bruce Schneier and David Banisar, Electronic Privacy Papers:
Documents on the Battle for Privacy in the Age of Surveillance (Wiley
1997)
Whitfield Diffie and Susan Landau, Privacy on the Line (MIT Press
1998)
Katie Hafner and Matthew Lyon, Where Wizards Stay Up Late: The
Origins of the Internet (Touchstone Books 1998)
National Resource Council, CRISIS Report (1996)
Peter G. Neumann, Computer-Related Risks (Addison Wesley 1995)
``Critical Infrastructure Protection and the Endangerment of Civil
Liberties: An Assessment of the Report of the President's Commission on
Critical Infrastructure Protection'' (EPIC 1998) [http://
www.amazon.com/exec/obidos/ISBNI=1893044017/electronicprivacA]
EPIC, Critical Infrastructure Protection Resources [http://
www.epic.org/security/infowar/resources.html]
Letter from Simon Liu, Acting Director, Information Management and
Security Staff, Department of Justice to Mr. Wayne Madsen, Senior
Fellow, Electronic Privacy Information Center, January 20, 2000
responding to Freedom of Information Act request of July 20, 2000 for
``all agency records, including memorandum, letters, and minutes of
meetings, dealing with any liaison between the Department of Justice
and the Critical Infrastructure Assurance Office.''
Senator Kyl. Mr. Cilluffo.
STATEMENT OF FRANK J. CILLUFFO
Mr. Cilluffo. Thank you, Mr. Chairman. Mr. Chairman,
Senator Feinstein, I appreciate the opportunity to appear
before you today with respect to the recently released National
Plan and the challenge of simultaneously assuring the security
of our Nation's critical infrastructures while preserving
personal privacy.
I also commend you for your leadership on these issues and
the recognition that they extend far beyond the Nation's
Capital. Indeed, they must be brought before the American
people. Many of these issues are misunderstood and give rise to
skepticism, distrust, and confusion between individuals,
organizations, and government, the initial media account of the
proposed FIDNet program being one case in example.
One of the advantages of working at a think tank is that I
don't have to stand where I sit, so I can be a little more
blunt. Another is that we are simply in the ideas business and
are not responsible or held accountable for implementing these
ideas. With that in mind, I would like to take a few moments
and make a few brief observations on, first, the cyber threat
in general; second, the need to strike the appropriate balance
between privacy and security; and, third, the National Plan for
Information Systems Protection.
The reason we have to understand the threat, I think, is to
be able to do the appropriate balance, we need to know exactly
what we are dealing with. And we are all aware of the many
benefits of information technology, and this revolution's
impact on society has been profound and touches everyone,
whether we are examining our economy, our national security, or
our quality of life.
Unfortunately, as we touched on earlier, there is a dark
side, and along with these new rewards come new risks and
unintended consequences which need to be better understood and
managed by our corporate and government leaders, and I mention
corporate first. These risks--and we discussed some of them--
range from the national security issues, strategic information
warfare and information operations, the vulnerabilities and
threats to our infrastructures, to protecting our personal
information, such as medical records and the like.
I think that I have a disagreement with Mr. Rotenberg on
the robustness of our infrastructures. I think that the ability
to network has far outpaced our ability to protect networks. In
some cases, systems are being integrated on top of one another,
and hence a failsafe on one day becomes a loophole the next,
since you can't beta-test all these networks as a whole.
Moreover, many of our highly advanced systems are based on
insecure foundations. ARPANet, while it may have been quiet,
was not intended to be secure. It was actually intended to
share information between and among scientists, and then it
expanded to academe and then it expanded to where it is today.
It was not intended to be secure.
Yet, many in public life and among our citizenry remain
skeptical or even downright dismissive of any potential
dangers. And again I look to Senator Feinstein, and I agree
with you. It is difficult to visualize these cyber threats. It
is not like Nazi forces moving across Europe, it is not like
the effects of Pearl Harbor, or even the Soviet missiles on
parade in Red Square. This is something that is difficult to
see.
Yet, our real assets today are stored electronically and
not in Fort Knox, and the target increasingly is not the
military at all, but rather our Government and corporate
information systems. Information warfare inherently extends the
battlefield to incorporate all of society. As you mentioned,
the myth persists that the U.S. hasn't been invaded since 1812.
Invasion through cyber space is now a daily occurrence.
The threat spectrum ranges from the so-called ankle biters
on one end to foreign nations on the other, and one of the
greatest challenges of these cyber threats is its anonymity.
Who is behind the clickety-clack of the keyboard breaking into
my system? Is it a young adult, is it a foreign intelligence
service, is it an economic competitor, is it someone doing the
bidding for someone else, or perhaps even someone masquerading,
cloaking the perpetrator's true identity leading you to go in
the wrong direction?
Additionally, smoking keyboards are hard to find, as an
assailant can loop and weave from country to country in a
matter of nanoseconds, all while law enforcement is forced to
stop at jurisdictional boundaries defined by the physical
world, which have little to no meaning in cyber space. In
essence, we have created the global village without a police
department, and I thought Senator Bennett's slide was excellent
along those lines.
According to a recent report by the Department of Defense,
the NCS in particular, currently at least 10 countries--an
unclassified report--possess offensive information warfare
capabilities somewhat akin to our own. As you mentioned
earlier, Mr. Chairman, of unique interest are the current
Chinese discussions regarding the possible creation of a fourth
branch of the armed services within the PLA devoted entirely to
information warfare.
Bits and bytes will never replace bullets and bombs. Yet,
one area that I think does require some further examination is
the synergy of where the physical and the virtual come
together. For example, you have detonated a conventional
explosive and then you follow that up with an attack on our E
911 systems. As we heard earlier, a young man in Toborg,
Sweden, was able to do it many thousands of miles away. And my
Swedish colleagues tell me that that young man is now in an
insane asylum, and I guess we can call him a crackpot who hit
the jackpot. But he still demonstrates these vulnerabilities
that can be exploited by those with more nefarious intent.
And we are also aware of our vulnerabilities due to
exercises such as Eligible Receiver and subsequent exercises
which we can't get into--squirrels taking down major networks,
backhoes, NSA systems being down last week. We are well aware
of our vulnerabilities. We have seen demonstrated capabilities,
whether it is E 911 systems or whether it is air traffic
control.
What we haven't seen yet, though, is the marriage of the
true, the real hostile, where the intent and the capability
come together. In my eyes, though, that is only a matter of
time before this convergence occurs, and I call it where the
real bad guys exploit the real good stuff and become more
techno-savvy.
As we contemplate methods of dealing with these threats, it
is important to remember that our national security community
and law enforcement institutions were designed and establish to
protect our freedoms, our liberties, and our way of life.
With this in mind, I think it is possible to ensure the
security of our Nation's critical infrastructures without
compromising civil liberties and personal privacy or by locking
down the Internet. Throughout history, the first obligation of
any State has been to protect its citizens. Today is no
exception. Yet, we must be careful and avoid placing our
national security community in a position where they could
trample on our liberties in order to preserve them.
Moreover, policies in response to threats of any kind,
especially in cyber space, must not stifle the engines of
innovation that drive our economy and enhance our lives. We
cannot afford to overreact and put up too many virtual or
physical walls. If we do, the adversary wins by default because
our way of life has been lost, and I look back to the weeks
before ushering in the new millennium as a number of lessons
that should be learned there.
Too often, the debate is framed as if security and privacy
are mutually exclusive. This is simply not true. It is wrong to
think of these issues as an either/or. We must rather think of
the need to incorporate both, and in order to preserve the twin
goals of security and privacy, we must begin with the notion of
a true partnership, and I think we are seeing some very good
steps in that direction.
For a number of years, many, myself included, have
criticized the current administration for being long on nouns
and short on verbs, a lot of talk, not a whole lot of action
with respect to critical infrastructure protection and
policies, a concern I know you share, Mr. Chairman, given your
1996 amendment to the Defense Authorization Act. And I think
that the President was required to answer those questions
within 120 days. Well, 4 years later, we do have a 200-page
document that begins to address some of your concerns.
Overall, I think the Plan does an excellent job of
identifying gaps and shortfalls within the Federal Government
and charting an initial course of action to address them. My
major concern is that it does not do enough. We must be willing
to commit real money to tackling the problem. After all, policy
without resources is rhetoric.
While the President's proposed budget for fiscal year 2001
is a good start, a vast majority of those resources have
already been earmarked and allocated in previous budgets. I
also personally believe that more funds should be devoted to
governmentwide programs and measures aimed at prevention and
protection. Moreover, only through leading by example can the
Government realistically hope for the private sector to commit
the sort of resources expected of them.
There were also concerns, legitimate ones in my eyes, that
the Plan was developed behind closed doors, without public
input, including the Congress and many of the owners and
operators of these critical infrastructures, and their views
were not solicited. Nevertheless, I do think it is encouraging
that the administration seems amenable to accept input at this
point, a process I encourage be enhanced.
With respect to infrastructure assurance, we must continue
to work toward and build on a true National Plan with full
representation from industry and all interested parties. We
need to forge a genuine partnership between the public and
private sector. It can no longer be merely a case of the
Government leading and the private sector following. In other
words, Silicon Valley and the Beltway, where the so-called wing
tip meets the sandal, must stand side by side on equal footing
to address these issues.
No offense, Senator Feinstein, to Silicon Valley.
I think that the Partnership for Critical Infrastructure
Security referenced earlier by John Tritak is one that is
particularly encouraging.
In closing, New York Yankee great Yogi Berra once said the
future ain't what it used to be. The best way to predict the
future is to help build it. We should not have to choose
between security and privacy. With a lot of hard work we can,
and arguably must, have both.
Thank you for your time and I would be pleased to try to
answer any questions you may have.
[The prepared statement of Mr. Cilluffo follows:]
Prepared Statement of Frank J. Cilluffo
Mr. Chairman, Senator Feinstein, distinguished Members of the
Committee, I appreciate the opportunity to appear before you today to
discuss some of the policy implications with respect to the recently
released ``National Plan for Information Systems Protection.'' I would
also like to address the difficult challenge of simultaneously ensuring
the security of our nation's critical infrastructures while preserving
personal privacy.
I commend you for your leadership on these issues and the
recognition that they extend far beyond the nation's capital. Indeed,
they must be brought before the American people--and soon. Many of
these issues are misunderstood and give rise to skepticism, distrust
and confusion between individuals, industry and the government--the
initial media accounts of the proposed Federal Intrusion Detection
Network (FIDNET) to cite one example. We must encourage any initiatives
aimed at advancing a meaningful dialogue between our citizens,
industry, and government.
One of the advantages of working for a think tank is that we don't
have to stand where we sit, a rare luxury for someone inside the
Beltway. Another is that we are simply in the ideas business and are
not responsible or held accountable for implementing our ideas.
With that in mind, I would like to make a few brief observations
on:
Cyber threats in general;
The need to strike an appropriate balance between privacy
and security; and
The ``National Plan for Information Systems Protection.''
The information technology revolution has given us an unrivalled,
perhaps unsurpassable, lead over the rest of the world in virtually
every facet of modern life. Information technology's impact on society
has been profound and touches everyone, whether we examine our economy,
our quality of life, or our national security. Unfortunately there is a
``dark side'' to this revolution. Along with the clear rewards come new
risks and a litany of unintended consequences that need to be better
understood and managed by our industry and government leaders. These
risks range from the national security considerations involving threats
to, and vulnerabilities of, our critical infrastructures from cyber
attacks and information operations, to protecting the confidentiality
and integrity of our personal information such as medical records,
credit histories, or even our identities, from unauthorized use. If we
do not understand these potential consequences, widespread cyber
threats--once the domain of science fiction--will become a reality for
us all.
Our highly complex and inter-networked environment is based on
insecure foundations. It is not widely understood that the Internet's
predecessor, ARPANET, was never intended to be ``secure.'' In fact its
very design schematic was based on openness--to facilitate the sharing
of information between scientists and researchers.
It is also problematic that the ability to network has far outpaced
the ability to protect networks. In some cases, new systems are being
integrated on top of one another--hence a fail-safe system on one day
becomes a loophole the next. The established cliche about the ``weakest
link in the chain'' has never been more acute or applicable.
Additionally, according the Final Report of the President's Commission
on Critical Infrastructure Protection (PCCIP), it is estimated that by
2002, a worldwide population of approximately 19 million will have the
skills to mount a cyber attack.
All of this interconnection leads to the origins of our problem.
Modern societies are dependent upon critical infrastructures such as
telecommunications, electric power, health services, banking and
finance, transportation, and defense systems, to provide us with a
comfortable standard of living. These systems are increasingly
interdependent on one another and damage to one can potentially cascade
and impact others--with single point failures being of greatest
concern. To compound the problem, military and law enforcement
authorities report that every month assailants make thousands of
unauthorized attempts to gain access to these systems, amounting to a
nearly continuous assault.
And yet, many in public life and among our citizenry remain
skeptical or downright dismissive of any potential dangers. After all,
it is difficult to visualize a cyber threat in the same way that we saw
film clips of Hitler's legions marching across Europe, the results of
Japan's attack on Pearl Harbor, or Soviet missiles on parade in Red
Square. There are other problems with getting people to take these
threats seriously. For example, how can you ``see'' a cyber threat
developing? While it may be scary in the abstract, it does not easily
lend itself to images of fear, making it difficult to personalize for
most Americans.
Today our real assets are stored electronically, not in Fort Knox
and the targets are increasingly not government and military
installations, but rather public and private computer network systems.
Information warfare extends the battlefield to incorporate all of
society. The myth persists that the United States has not been invaded
since 1812, but invasion through cyberspace is now a daily occurrence.
We can no longer afford to rely on the two oceans that have
historically protected our country: instead we must develop the means
to mitigate risk in an electronic environment that knows no borders.
The threat spectrum ranges from ``ankle biters'' \1\ to nations,
with currently no readily available means to discern who is committing
the attack. Additionally, ``smoking keyboards'' are hard to find as an
assailant can loop and weave from country to country in a matter of
nanoseconds. Thus, an attack initiated a couple of blocks away can be
made to appear to come from halfway around the world. All of this
happens while law enforcement is forced to stop at jurisdictional
boundaries, defined by the physical world which have no meaning in
cyberspace. In essence, we have created a global village without a
police department.
---------------------------------------------------------------------------
\1\ As defined by the NSA Glossary of Terms Used in Security and
Intrusion Detection, an ankle-biter is ``A person who aspires to be a
hacker/cracker but has very limited knowledge related to Automated
Information Systems. Usually associated with young adults who collect
and use malicious programs obtained from the Internet.''
---------------------------------------------------------------------------
According to a recent public report by the Department of Defense
(the National Communications System), currently at least ten countries
possess offensive information warfare capabilities comparable to our
own. Moreover, a 1996 Government Accounting Office (GAO) report
references that approximately 120 nations have some sort of computer
attack capability. The reality of this potential threat was illustrated
in an article published this fall in the Liberation Army Daily; the
official newspaper of the Chinese People's Liberation Army (PLA) titled
``Bringing Internet Warfare into the Military System is of Equal
Significance with Land, Sea, and Air Power.'' In this article, the
authors discuss Chinese preparations to carry out high-technology
warfare over the Internet and advocate the creation of a fourth branch
of the armed services within the PLA devoted to information warfare.
Bits and bytes will never replace bullets and bombs. Conventional
terrorist organizations, for example, will never abandon car bombs or
pipe bombs, which have already proven highly effective, relatively low
in cost and risk and still generate headline news. As a force
multiplier, however, information warfare increases the lethality of the
terrorist when used in concert with other more conventional means. For
example, one scenario we created at CSIS involved a malcontent first
detonating a conventional explosive followed up by denial of service
cyber attacks on the same city's emergency communications network,
thereby preventing the first responders and authorities from
responding. The consequences were two-fold; it led to an increase in
the number of potential casualties and sowed further psychological
fear.Is this really far-fetched? Two years ago a young man sitting
behind his desktop computer thousands of miles away in Toborg, Sweden,
disabled portions of the Emergency 911 system in Southern Florida.
Another example of a significant infrastructure disruption occurred in
1997, when a Massachusetts teenager was charged with disabling the
Federal Airline Aviation control tower for six hours at Worcester
Regional Airport.
It is only a matter of time before there is a convergence between
those with hostile intent and techno-savvy, where the real bad guys
exploit the real good stuff.
As we contemplate methods of dealing with these threats it is
important to remember that our national security community and law
enforcement institutions were designed and established to protect our
freedom, our civil liberties and our way of life. We expect the
national law enforcement agencies to protect us from criminal elements
within our borders. We expect the Defense Department and the Armed
Forces to protect us from external threats. We expect the nation's
intelligence agencies to provide insight into the intentions and
capabilities of our adversaries and to provide advance early warning of
threats to us.
It would be a mistake to place our national security and law
enforcement institutions in a position where they would have to
compromise our precious hard-won rights or infringe upon our privacy in
order to protect us. The worst possible victory granted cyber attackers
would be one that destroyed these values whereby we would become less
open, less tolerant and less free.
Concomitantly, we must recognize the many benefits of information
technology and understand that these benefits far outweigh any risks.
Thus, our policies in response to threats of any kind must not stifle
the engines of innovation that drive our economy and enhance our lives.
We cannot afford to over react or put up too many ``virtual'' or
``physical walls.'' If we do, the adversary wins by default because our
way of life has been lost.
It is possible to ensure the security of our nation's critical
infrastructures without compromising civil liberties and personal
privacy or locking down the Internet. Throughout history, the first
obligation of the state has been to protect its citizens. Today is no
exception. Information technology, while providing us many comforts and
conveniences has also created for us new kinds of vulnerabilities that
can be exploited. These vulnerabilities must be addressed and balanced
with the civil liberties we have worked so hard to earn as a nation. It
makes no sense to trample on civil liberties in order to preserve them.
Too often, the debate is framed as if security and privacy are
mutually exclusive. This is simply not true. It is wrong to think of
the issue as ``either'' ``or''. We must rather think of the need to
incorporate both. In order to preserve the twin goals of security and
privacy, we must begin with the notion of a true partnership.
For a number of years many, myself included, have criticized the
current Administration for being ``long on nouns and short on verbs''--
a lot of talk, not a lot of action--with respect to critical
infrastructure protection and related policies. A concern I know you
share Mr. Chairman, especially given your amendment to the 1996 Defense
Authorization Act, wherein ``the President shall submit to Congress a
report setting forth the results of a review of the national policy on
protecting the national information infrastructure against strategic
attacks.'' Four years later, we have a 200-page document (``the Plan'')
that begins to address some of your concerns. To their credit, the
President and his team have done some good work with the Critical
Infrastructure Working Group (CIWG), Executive Order 13010, the
President's Commission on Critical Infrastructure Protection (PCCIP),
Presidential Decision Directive 62, and Presidential Decision Directive
63, albeit most of these initiatives do not adequately address high-end
national security threats to our information infrastructures, including
strategic information warfare.
Overall, I think the Plan does an excellent job identifying gaps
and shortfalls within the Federal government, and charting an initial
course of action to address them. My major concern is that it does not
do enough.
We must be willing to commit real money to tackling the problem--
after all policy without resources is rhetoric. While the President's
proposed budget for fiscal year 2001 is a good start, a vast majority
of the resources have already been earmarked and allocated in previous
budgets. I personally believe that more money should be devoted to
government-wide programs (i.e. a more robust and complete PKI
infrastructure) and measures aimed at prevention and protection. While
there are no protective measures that are completely effective, the 80
percent solution will be sufficient to deter most attackers by
increasing the risk of detection or failure. In essence, by raising the
bar higher, we would then improve our ``signal to noise'' ratio and be
better positioned to address the more significant threats. Moreover,
only through leading by example can the government realistically hope
for the private sector to commit the sort of resources expected of
them.
There have also been concerns that the Plan was developed behind
closed doors, and that public input was not solicited through the
Federal Register and other means. Many individuals and organizations,
including the Congress and the owners and operators of many of the
critical infrastructures within industry, could have offered valuable
counsel and prevented some of the adverse publicity surrounding the
Plan last summer. Nevertheless, it is encouraging that the
Administration seems amenable to accept input at this point, a process
that needs to be enhanced and encouraged.
With respect to infrastructure assurance, we must continue to work
toward and build upon a true national plan with full representation
from industry and all interested parties. We need to forge a genuine
partnership between the public and private sectors. The public actions
of the Critical Infrastructure Assurance Office (CIAO) are very
encouraging in this respect. Specifically, the recently announced
Partnership for Critical Infrastructure Security, which has brought
together approximately ninety leading corporations and various federal
agencies to address the problems of infrastructure assurance, is a good
example of a step in the right direction.
We also need a true national debate on infrastructure assurance and
we need to re-think national security strategy accordingly. It can no
longer be a case of the government leading and the private sector
following. In other words, Silicon Valley and the Beltway, where the
sandal meets the wingtip, must stand side by side and on equal footing
in addressing these issues and formulating responses.
Philosopher and New York Yankee great, Yogi Berra, once said, ``The
future ain't what it used to be.'' The best way to predict the future
is to help build it. We should not have to choose between security and
privacy. With a lot of hard work, we can and must, have both.
Thank you for your time. I would be pleased to try to answer any
questions you may have.
Senator Kyl. Thank you, Mr. Cilluffo. I think the last
comment you made summarizes my view, and that is that this
doesn't have to be a zero-sum game. We have got to be concerned
about both issues, both the protection of American interests,
which include privacy interests, and on the other hand doing it
in a way that doesn't inhibit people's civil liberties. That is
an age-old issue. This is merely one of the latest iterations
of it. You could write the history of this country and every
decade would have a chapter dealing with some iteration of this
particular problem. But it has got a new feature now and a more
complicated one, and I think a constructive dialog is
important.
I think the questions that Mr. Rotenberg raises are
important questions and I think the Government needs to pay
more attention to those questions. There needs to be more
public discussion of them. There needs to be a lot of serious
questioning with respect to the protection of privacy.
But I also think that the people who raise those questions
would be more credible in doing so if they didn't denigrate the
nature of the challenge that we are trying to deal with here,
which I think, Mr. Rotenberg, with all due respect, you do. And
I think the very legitimate questions you raised would be
enhanced by an acknowledgement right up front that this was not
some invention of the Defense Department in order to get more
money, which is what you have said, but rather a response to a
legitimate concern.
Senator Sam Nunn and I had the first hearings on this. I
don't think you would criticize him as somebody that is a
mouthpiece for getting more money for the Defense Department.
As a matter of fact, I think it is arguably true that we had to
drag them kicking and screaming to this problem because they
saw it coming out of their budget. And I think if you asked the
people downtown, they would say one of the reasons why this was
so slow in coming is that nobody wanted to put their arm around
this baby because they knew that it was going to be hard and it
was going to cost a lot of money and they didn't want it to
come out of their budget.
So when you say things, Mr. Rotenberg, like the DOD and its
secretive component, the NSA, were driving forces behind
critical infrastructure protection--``For the Pentagon and the
intel community, info warfare offered a new vista in an era of
post-Cold War diminishing military budgets, paucity of
conventional threats, base closures, and reductions in force,
both military and civilian''--I think you are just dead wrong.
That isn't how this all came about. It came about because a lot
of serious people understood there was a significant threat and
they wanted to do something about it.
And I really believe that in raising the questions you have
raised, which I again acknowledge are legitimate questions and
have not, I would add, been adequately answered by Mr. Tritak
today, I think that the discussion needs to begin from a
different point.
I would ask you this question. Having been critical, can
you offer some suggestions as to how we might better balance
the concerns for our protection from this cyber terrorism, on
the one hand, and the very legitimate concerns you raised about
personal privacy protection on the other? In other words,
rather than just saying there is a huge problem here, the
Government is trying to get into everybody's lives, how would
you deal with the nature of this challenge? What kind of
structure would you set up to provide the kind or protection
that you are interested in?
Mr. Rotenberg. Let me just say at the outset, Senator, I
take your criticism. I know that you are referring to a report
that we published last year. I should say that the words that
you are quoting aren't actually my words. I mean, they were
written by someone else. I did write the preface to the report,
which I suspect you would probably agree with much of it
because, as people know, I tend to be fairly balanced in my
assessment of these issues, as I was in my statement for the
subcommittee today. But I take your criticism and I think it is
a fair one. I think these are real problems.
At the same time, I hope you would appreciate that for
people who are concerned about privacy issues and civil
liberties issues, there is a sense, as there is this morning,
that these very elaborate programs are put together that have
enormous civil liberties implications and sort of after the
fact people say, and now we want to address privacy concerns,
so that you will have to decide, for example, about whether to
go forward with a FIDNet proposal that I believe, and even the
Department of Justice believes, could be contrary to U.S. law.
I think we have a good basis for our criticism.
But you asked me how do we resolve these two issues, and I
have tried to suggest in my statement this morning that key to
a successful answer is a successful and accurate description of
the problem. We are not just defending U.S. borders anymore. I
mean, the very interesting thing about Senator Bennett's
picture is that this is a worldwide network, and the security
solutions and the reliability solutions are being developed by
researchers all around the world. U.S. firms, U.S. scientists,
U.S. Federal agencies are benefiting today from work that is
being done across the globe.
And I think we run some serious risk, if we are intent on
trying to protect this network, by now erecting national
borders in a world and in an environment where those national
borders are just harder to control. Now, in saying this I am
not trying to diminish the importance of national security or
public safety. In fact, I think I am actually underscoring it.
I am simply trying to say that the problems that we face in
the 21st century to protect these communication networks on
which we depend are very different from the types of problems
we confronted in the 20th century when we could follow
airplanes moving in our air space, across our borders, destined
for an attack.
Senator Kyl. Conceded. We all make that point. We all
agree. My question was, so how do you then deal with the issue,
and I will ask Mr. Cilluffo to answer the same question. Just
get specific for a minute, and we really need to specifically
direct your answer to the question.
Mr. Rotenberg. Fair enough. My first answer is I think we
need a proposal that complies with U.S. privacy law. I don't
think you can put forward a proposal that says we are concerned
about privacy and at the same time ignore the relevant law that
this Congress has passed which says that when the Government
conducts electronic surveillance, it has to comply with certain
fourth amendment standards. That seems to me a fairly
reasonable request to make.
I think a second point to make is that when you are
creating within government a great surveillance capability, it
is appropriate to have some mechanism for oversight and
accountability. Now, I think this is an area, in fact, where
Mr. Tritak has given a lot of thought. There is obviously an
effort to work with the committees and to incorporate public
comments, but that has to be done on a much more formal basis.
I mean, the Department of Justice has annual reporting
requirements. The Computer Security Act has a formal committee
that conducts hearings, issues reports. We need the types of
institutional safeguards vested with the responsibility to
protect privacy and civil liberties to counterbalance this very
great surveillance authority that is going to be created.
And I should say, by the way, this hearing is really
focusing on a small part of the Plan. I think there are large
parts of the Plan where there is really no dispute. I mean,
what we are really talking about today is whether, to protect
computer security, the Federal Government should have openended
authority to conduct computer surveillance.
Senator Kyl. That is not true, that is just fundamentally
not true. Nobody argues that the U.S. Government should have
that authority, and if you would like to cite anybody that you
can think of that comes at it from that point of view, I invite
you to do so right now. You see, I think that is an
exaggeration and it is the kind of statement that doesn't help
us get to a constructive solution.
Senator Feinstein was saying just a moment ago that we
start from the premise that the U.S. Constitution governs here.
We have got to protect the liberties that are guaranteed in
that document. The question is, with a brand new kind of
technology here that we have all acknowledged eliminates the
kind of formal barriers that used to instruct us on how to deal
with these issues, we have got to come up with structures that,
while they solve the problem, don't impinge upon constitutional
liberties.
Just to give you one little illustration that is by analogy
only--it is not directly applicable here--we have a bill that
has passed the Senate unanimously dealing with Internet
gambling. The 1961 Telephone and Wire Act prohibits sports
gambling, but some defendants in a case said, well, wait a
minute, to the U.S. attorney, you can't prove that that bet was
transmitted over wire; it could have been through fiber optic
cable or satellite microwave transmission.
The point is sometimes you have got to bring the law
current with even the terminology of new technology, let alone
the application of that technology. And it may be that some of
these laws need to be brought up to date so that they enable us
both to protect our security and protect the rights of the
citizens. But don't start from the premise that it is zero-sum
game and that the people that want to protect our security do
not want to protect our privacy. It is just not true.
Mr. Rotenberg. That is not my view, and it is not my view
that it is a zero-sum game.
Senator Kyl. Well, perhaps I misunderstood the comment you
made.
Let me ask Mr. Cilluffo if he has some specific,
constructive suggestions on how we square this circle, the
challenge that Mr. Rotenberg has laid down.
Mr. Cilluffo. Well, I think clearly the notion of
partnerships, genuine partnerships that provide input from all
different parties, is absolutely critical here. This is an
issue that touches absolutely everyone, the civil liberties
issues as well as the national security issues, and corporate
issues such as intangible intellectual property rights and
economic and industrial espionage.
There are a whole bunch of issues here that need to be
brought to the table, and the only way you can begin doing that
is by having this dialog. This table is much bigger than most
traditional national security tables have been. It requires the
input of so many new parties and so many different communities
that I actually give the administration a lot of credit for
adding that line to the Plan, an invitation to a dialog,
because that is what we need; we need a dialog.
And while I agree that there are some very legitimate civil
liberty issues that need to be addressed at that table, that is
not the only issue that needs to be addressed, and I really
don't see it as an either/or. I would accept nothing less than
a plan that both protects our privacy and ensures our security.
So the dialog, I think, is an important step. There are a
number of initiatives within that, such as the information-
sharing analysis centers where industry starts getting together
doing some of the initiatives. We have parallel programs inside
the Government, but the dialog is crucial.
Senator Kyl. Well, let me say this and then I will turn to
Senator Feinstein. I think before this is actually implemented,
we will have additional hearings in which we will ask legal
experts as well as technical experts to sit at this table and
walk us through precisely how they envision it being done so
that, for example, where they see--well, first of all, where
they have the legal authority to look for these anomalies, what
do they have the legal right to look for? What gives them that
legal right? What kind of potential civil rights problems are
there in looking for those anomalies?
Then what can they next do with that information? What is
the next filter? Mr. Tritak envisions three or four layers or
filters of analysis, as he pointed out. So when it gets to that
next level, is there any further challenge to the civil
liberties issues and what protections pertain there, all the
way down to the hand-off to the FBI, the law enforcement
agency, when they have reason to believe a crime might be being
committed here, and therefore what the FBI must work--what
strictures govern the FBI's actions here. I am sure those will
be fairly standard law enforcement kinds of strictures.
But it is that initial broad-based analysis of anomalous
information or incidents that probably raises the real
questions because once you get to the FBI, I don't see a whole
lot changing. I mean, they are going to be stuck with what they
are stuck with the way we have got it pretty much written now.
On the other hand, there may be some new techniques that they
would wish to employ based on new technology, and if that
implicates privacy laws, then we will have to view it in that
context.
So I think the challenge, Mr. Rotenberg, that you lay out
is an appropriate challenge. I think we need to have people
come and testify specifically about exactly what they are going
to do because unless there is an acceptance of this by the
American people, we are not going to be able to protect
ourselves. And someday we will wish that we had tried to figure
it out better in advance, and I appreciate your approach to
that, Mr. Cilluffo.
Mr. Cilluffo. Mr. Chairman, if I could add one point, too
often the debate also focuses entirely on concerns of big
brother. Well, the Government also has a responsibility to
protect its citizens from little brothers. The thing that makes
this threat so unique is that you don't need to be the United
States, you don't need a major budget, you don't need to be the
former Soviet Union or the People's Republic of China. Anyone
can have a rudimentary capability, and we have a responsibility
to protect our citizens.
Just imagine if we could not get our Social Security checks
next month. I think people would be in the streets, arguably
for good reason. Whether it is air traffic control and the
like, I think that there are some very legitimate concerns that
we need to look at it from the inverse perspective as well, not
to mention that we are stuck prosecuting 21st century crimes
with 20th century laws. I agree with Mr. Rotenberg's point, but
it also has a flip side that needs to be on the table as well.
Senator Kyl. Senator Feinstein.
Senator Feinstein. Thanks very much, Mr. Chairman. You
know, I think that we are both on the same line here. I think
we both believe that this is the frontier of a huge problem. I
think we both believe that the technology is advancing so
rapidly, so much quicker than our laws, our philosophy, our
ability to really deal with it in any way.
At the same time, it is a whole new worldwide phenomenon
and those that produce the phenomenon say, leave us alone, we
don't want government interference. And it is very difficult to
weigh the balance. On the one hand, you have commercially where
people find their Social Security numbers being used without
their permission, their drivers' licenses used without their
permission, their medical information, their financial
information. On one level, that sets up a huge level of privacy
concern, and I think you and I will address it in a piece of
legislation.
On the other level, you have this situation where a plane
or planes go down in a cyber attack. Then what right does the
Government have to infiltrate an encrypted computer system to
try to get at the perpetrator? So it becomes two different sets
of things we are looking at. At the same time, you have pointed
out, and I think correctly, the technology is advancing so
rapidly that by the time we get there, it is at the next stage.
It is a very hard challenge in front of us. I think we
believe we have to do everything we can within protection of
privacy to also protect our Nation and our people against
attacks that we know as sure as the sun is coming up tomorrow
morning are going to happen, and it is hard to get equipped to
do so.
Now, let me ask a couple of questions, if I could, that are
specific. Mr. Cilluffo, you mention that Congress should
appropriate money for a governmentwide information security
program such as encryption--and we have had a lot of debates
over encryption--that is, a national public key infrastructure.
Why do you believe that public key infrastructure is a good
solution?
Mr. Cilluffo. Well, it is not necessarily the encryption
piece; it is the public key infrastructure writ large. I
believe that that would raise the bar throughout our Federal
systems to a level where you have the so-called 80-percent
solution. Then the additional 20 percent that still could
circumvent all these new protective measures that are put in
place--we could focus on those specific threats which I think
are the most critical to our national security.
From there, we can hone in our indications and warning
capabilities and the like to deal with the more significant
threats and keep out the 80 percent, the so-called ankle
biters, that really are not significant national security
issues.
Senator Feinstein. Explain what you mean by public key.
Mr. Cilluffo. It is heavily based on encryption means, but
it goes beyond to incorporate other token key infrastructures.
And to me, encryption is an important piece to protecting
ourselves, but it doesn't do a whole lot to protect from denial
of service attacks. What good is protecting the confidentiality
and integrity of the information if you can't get a dial tone?
But the PKI infrastructure does incorporate to add in some of
the denial of service protection measures.
Senator Feinstein. Thank you.
Mr. Rotenberg, you noted that many people used credit cards
over this past holiday over the Internet, and that weaker
encryption was freely available, I think you said due
indirectly to the administration's old encryption control
regulations. You then suggested that the National Plan will
replicate the problem. I didn't understand what you meant.
Could you explain it as to what exactly you mean?
Mr. Rotenberg. Yes, Senator. What I was trying to describe
was the problem that results from a Plan, you know, well-
intended basically to keep these strong security tools away
from people which could cause harm to the country, which is
what the export control system does in part, had the practical
consequence of keeping the same strong tools away from American
consumers.
As computer security policies are implemented, there are
all sorts of other effects that can be difficult to control,
and it is a very good example, particularly with people using
the Internet at Christmastime and making themselves vulnerable
with credit card purchases. And I agree with you, by the way. I
think that is also a very big part of the privacy issue. There
are a lot of things happening obviously in the private sector
that may require some government legislation to protect privacy
and I would certainly support that.
But here you see sometimes a policy even well-intended that
says we have got to try to keep good encryption away from the
bad guys has the practical problem of keeping those same tools
away from the good guys and leaving the good guys more
vulnerable, and that is what I think we need to avoid
duplicating.
Senator Feinstein. Well, let me go back to the incident of
the computer in Manila where the airline information was in it
and this individual was going to bring down, if he could, a
whole flock of commercial airliners. Fortunately, you could get
into his computer and the information was there.
What is wrong with using the same procedure that one would
use with a telephone? In other words, a wire tap; you go before
a judge, you get a court order. You have to provide information
to a judge, an independent third party, a reasonable cause to
believe, et cetera. What is wrong with that procedure?
Mr. Rotenberg. Actually, I think it is the right procedure.
Senator Feinstein. I do, too.
Mr. Rotenberg. And throughout the debate on encryption, you
know, we really never argued about the Government's right to
conduct a wiretap, with lawful authority, with a warrant. We
said we understand that.
What we are really discussing is what kind of technological
design, what kind of architecture for this evolving
communication network is best likely to promote security and
privacy. I agree with you, Senator Kyl. I think both goals are
critical and we should not face a tradeoff where we are giving
up one for the other.
And I guess the sense we have today after going through
this long debate on encryption is that there really is a risk
that if we focus solely on security, then privacy gets pushed
off the table. It becomes sort of an after-the-fact
consideration. And so we have to think at the very beginning
when we are proposing, for example, public key infrastructure
which could be very good to promote network security across
Federal agencies--people filing tax returns, for example, make
sure those aren't misappropriated. But we have to make sure at
the beginning that privacy really becomes part of the design
requirement so that we don't face the tradeoffs, and I think
that is what I am saying.
Senator Feinstein. Well, let me give you a challenge.
Mr. Rotenberg. Yes.
Senator Feinstein. I used to say when I was mayor to my
staff--they would come in the door at the end of the day with a
problem and I would say, don't come in with a problem unless
you have got the solution, too. So let me give you that
challenge. It is one thing to point out the problem, it is
another thing to come up with a solution, and so I would like
to challenge you to present us with some solutions.
Mr. Rotenberg. Senator, I would be pleased to do that. In
fact, I would offer to the subcommittee that there are groups
of security experts. The American Association for Computing
Machinery has been working in this area for a long time. I
think we could put together a study group and maybe produce a
report in a short period of time to try to answer this question
for you. How do we do privacy and security so that both
interests are protected as we go forward?
Senator Feinstein. If I understood your opening comments,
you would agree that there is a problem out there.
Mr. Rotenberg. Yes.
Senator Feinstein. So then all of us together, the privacy
community as well as the governmental and the private sector,
really ought to come together to come up with the solution
because we have to do that.
Mr. Rotenberg. Yes, I agree.
Senator Feinstein. Thanks, Mr. Chairman.
Senator Kyl. Thank you very much. Well put. I was just
thinking, just to close this off and put it in context,
yesterday when I came through the security mechanism at the
airport I was reminded again that just a little tiny bit of my
civil liberties have been taken from me for a larger cause.
Fortunately, I didn't have anything metal in my pockets to set
the machine off, but if I had and I couldn't take it out of my
pocket, then I get this routine which frequently happens to me.
And I am standing there and somebody runs a little wand all
over me.
Senator Feinstein. Yes, me, too.
Senator Kyl. Well, I don't care. It is a little bit of an
inhibition on my freedom to come and go as I please, but the
larger good of ensuring that I don't have some kind of
terrorist device gives all of the people on the airplane I get
on a sense of assurance that it is going to be OK. I think that
is the kind of thing we are looking at here.
What kind of legitimate limitations are we willing to
impose on ourselves in order to ensure that the entire Nation
is not subject to this kind of terrorism or specific attack,
and what kind of assurances can our Government provide its
citizens that it has done only that which is necessary and no
more? I think that is the nature of the challenge before us.
I will take you up on your offer, Mr. Rotenberg, and what I
would like to do is ask both of you to come back or to provide
testimony to the committee. I think that what this hearing has
demonstrated is that in addition to a wide variety of other
kinds of questions, we need to ask Mr. Tritak and others from
the administration to be prepared to discuss specifics in the
area that I think is most relevant to this subcommittee's
jurisdiction which we will probably be dealing with in
legislative form at a later date.
So I appreciate both of you being here to testify and we
will leave the record open for any further comments you would
like to make. In addition, we may have some other written
questions that we would like to pose to you.
Thank you, Senator Feinstein. If there is nothing further,
then we will adjourn this meeting, and I guarantee you we will
have another hearing on this subject in the not too distant
future.
Thank you very much. This hearing is adjourned.
[Whereupon, at 12:11 p.m., the subcommittee was adjourned.]
A P P E N D I X
----------
Questions and Answers
----------
Responses of John Tritak to Questions From Senator Jon Kyl
Question 1. In his written testimony for the Subcommittee's
February 1, 2000 hearing on critical infrastructure protection, Marc
Rotenberg, Executive Director of the Electronic Privacy Information
Center, noted that, based on a March 1999 memo from the Justice
Department to the CIAO, FIDNet is a ``violation of the spirit of the
federal wiretap statute, the plain language of the federal Privacy Act,
and contrary to the Fourth Amendment.'' During the hearing, questions
about legal authority for FIDNet were raised at the hearing, you
testified that FIDNet is consistent with all ``privacy laws'', yet
stated you were unfamiliar with whether Federal wiretap statutes
applied to FIDNet. For the record, please explain in detail the current
laws that apply to FIDNet, and specifically how FIDNet in its current
conception is not in violation of each of those laws. Include, at a
minimum, the Privacy Act, the Electronic Communications Privacy Act,
the Computer Security Act, and wiretap statutes.
Answer 1. At the outset and before we can respond to your question
fully, we need to make two observations as a backdrop for the
discussion. First, the Federal Intrusion Detection Network (the
``FIDNet'') proposal was and continues to be a work in progress. Since
the release of PDD-63 in May 1998, the Administration has worked
carefully to identify the full range of possible security options that
incorporate intrusion detection technology. The proposal as described
in the earliest drafts of the National Plan has evolved considerably,
and continues to evolve.
The second point to be made is that, as underscored in the National
Plan, the FIDNet proposal will be implemented in a manner consistent
with all relevant laws, including privacy laws. Our legal analysis of
the proposal--and our ongoing consultation with the Department of
Justice--continues as part of a comprehensive interagency process and
in tandem with the evolution of the FIDNet to assure its adherence to
the spirit and letter of law.
FIDNet has been carefully tailored to vest authority and control in
the Federal civilian agencies, consistent with the Computer Security
Act of 1987, Clinger-Cohen Act, and Executive Order 13011, which
implement Congressional policies. Under current practices, federal
agency computer system administrators (as well as system administrators
in most companies in the private sector) already analyze data flowing
over their systems, based on strategic placement of intrusion detection
technology in accordance with the needs of the organization. Under the
FIDNet proposal as currently formulated:
The agencies will decide what data on system anomalies to
forward to the GSA for further review;
The GSA will use data on anomalies exclusively to warn
agencies about system anomalies; and
Law enforcement would receive information about computer
attacks and intrusions only under long-standing legal rules
(i.e., when there is evidence of a crime). No new authorities
are implied or envisioned by the FIDNet program.
FIDNet is intended to be a multi-level system. At the first level,
each agency's own security-protection software will scan for harmful
traffic entering that agency's system. (The key to understanding
intrusion detection is the concept of a ``firewall,'' which by
definition and design is meant to scan incoming transmissions for
hostile files and programs.) In fact, this is already being done at
federal agencies, not to mention most private companies. The National
Plan contemplates that the implementation and operation of such
protective measures will continue to be the responsibility of the
individual agencies. The objective of FIDNet is not to send the
resulting information to law enforcement officials. Instead, the goal
is to improve overall federal system security through improved
information sharing among systems administrators and information
security officials.
Contrary to Mr. Rotenberg's suggestion, the March 1999 Justice
Department memorandum does not state at any point that FIDNet--even in
the preliminary form then under analysis--would violate federal privacy
law. On the contrary, the memorandum identifies the legal bases on
which protective monitoring of government computer systems can be
lawfully conducted.
In fact, the current FIDNet proposal is structured to comply fully
with the Electronic Communications Privacy Act (``ECPA''), 18 U.S.C.
Sec. 2510 et seq., which incorporates federal wiretap law.
Specifically, while ECPA generally prohibits the interception of
electronic communications, it contains two relevant exceptions to that
general prohibition: (1) consent of a party and (2) system protection
monitoring activities. As to the first of these, the federal agencies
participating in FIDNet will, in appropriate instances, establish
consent to monitoring by using login ``banners'' displayed to each
network's users.
FIDNet will also rely on the separate exception applicable to
systems protection. Under this exception, ECPA expressly authorizes a
system owner or his agent to monitor network traffic on the system to
the extent necessary to protect the ``rights or property'' of the
system owner.
In addition, the FIDNet concept is compatible with the Privacy Act.
The Privacy Act, designed to protect personal privacy from unwarranted
invasions by federal agencies, regulates the collection, maintenance,
use, and dissemination of personal information by federal government
agencies. It forbids the disclosure of personal information by federal
agencies except under certain circumstances, and, subject to enumerated
exceptions, gives individuals access to information maintained on them.
FIDNet will be fully consistent with the Privacy Act's requirement
that physical security and information management practices be designed
to ensure individual privacy. As properly and legally formulated,
FIDNet will increase the level of privacy and security afforded to
information about individuals on government computers.
Question 2. Is there a need for legislation to bring any of those
laws up to date to reflect the current state of information technology?
If so, please make specific suggestions?
Answer 2. No. No new authorities are implied or envisioned by the
FIDNet program.
Question 3. If, in your view, any of those laws need to he updated,
do your suggested changes erode privacy and civil liberties in any way?
Answer 3. As previously noted, no new authorities are implied or
envisioned by the FIDNet program. In addition, our legal analysis of
the proposal--and our ongoing consultation with the Department of
Justice--continues as part of a comprehensive interagency process and
in tandem with the evolution of the FIDNet to assure its adherence to
the spirit and letter of law.
Starting from this point of seeking to protect privacy and civil
liberties, we additionally remember your admonition that privacy and
liberty are also endangered if we do nothing at all and leave the
information on the government systems subject to attack and theft. I
firmly believe that FIDNet will not erode privacy and civil liberties;
indeed, by protecting citizen information communicated to government
agencies from theft or improper release, and securing government
systems from attacks by hackers, criminals and terrorists, FIDNet will
ultimately serve to enhance privacy and liberty.
Question 4. In his written testimony for the Subcommittee's
February 1, 2000 hearing on critical infrastructure protection, Marc
Rotenberg, Executive Director of the Electronic Privacy Information
Center, stated ``There are other indications, contained in materials
that we received under the Freedom of Information Act, the CIAO intends
to make use of credit card records and telephone toll records as part
of its intrusions detection system, ``and notes this raises problems
under U.S. law. Does the CIAO intend to use credit card records and
telephone toll records as part of its intrusion detection system?
Answer 4. There is not, nor has there ever been any intent to use
credit card records and telephone toll records as part of an intrusion
detection system. Mr. Rotenberg may be misconstruing and
misinterpreting comments made about the technology used to detect
anomalies in the use of telephone and credit cards.
In the early stages of the FIDNet process, the Administration
considered, among others, the technology that telephone companies use
to find abnormalities in behavior patterns--in their case for use of
telephone phone credit cards--to see if that technology could be used
to identify abnormal behaviors patterns on government networks. This
was an examination of the underlying technology only, and had nothing
to do with using actual phone number or credit card records.
Question 5. Mr. Rotenberg submitted the attached memo for the
record at the hearing. The memo includes a chart referring to credit
card and toll fraud profiling. Please explain the meaning of that
slide.
Answer 5. Consistent with the response to the previous question,
the only references to credit card and telephone toll records dealt
with consideration of the underlying technology models and not with any
specific credit card and telephone information. Since release of PDD-63
in May 1998, the Administration has reviewed carefully the full range
of available technologies that may be applied to intrusion detection
systems. The slide at issue relates to technology options discussed for
the FIDNet. That is, the credit card and toll-fraud detection were only
offered as an example of a type of detection technology currently in
use.
Specifically, what was then being considered was the technology
that telephone companies use to find abnormalities in behavior
patterns--in their case for telephone of phone credit cards use--to see
if it could be used to identify abnormal behaviors patterns on our
networks. This was an examination of the underlying technology only,
and had nothing to do with using actual phone number or credit card
records.
Question 6. Please provide an outline of FIDNet in its current
stage of development.
Answer 6. At present, FIDNet remains entirely on the drawing board.
The program plan for fiscal year 2000-2001 relies upon the experience
and expertise of the vendor community to actually develop the technical
architecture(s) for FIDNet.
An initial Request for Proposal (RFP) from the General Services
Administration (GSA) will solicit such architectures from the corporate
sector. The expectation is that these architectures will come from
those companies that already provide intrusion detection products and
services both to industry and government. While the RFP will document
all known legal constraints upon the Network, the program plan still
calls for yet another legal review of each of the vendors' submissions
by the Department of Justice. Depending upon the build costs of the
remaining vendor proposal's (those proposed architectures which pass
legal muster with the Department of Justice) and the amount of
available funding, the GSA Program Office will then fund development of
between two and five FIDNet prototypes. The prototypes must then prove
the technical, operational and practical viability of their
architectures while continuing to steer clear of any new legal/privacy
constraints that Justice may have identified. The extent to which the
prototypes prove they actually meet all system requirements: technical,
legal, privacy-related, operational and fiscal (i.e., best value for
the Government) will determine the winner in final Source Selection.
Question 6a. Describe which practices of surveillance and
monitoring already take place in individual agencies.
Answer 6a. Because the Program Office is just getting under way,
GSA has not yet had the opportunity to begin a comprehensive survey of
government agency intrusion detection practices, which products they
may have purchased from which vendors, and how the agencies actually
employ the intrusion detection systems they have already purchased.
We will keep the Subcommittee informed about the development of the
FIDNet proposal and about the information that GSA assembles concerning
intrusion detection practices in various agencies.
Question 7. Using the model of FIDNet, explain what type of
monitoring would apply to a citizen, in his home who logs on to a
government web site. What types of activities would that citizen have
to do to ``set off a typical intrusion detection system (understanding
that different government agencies have varying IDSs)?
Answer 7. Merely accessing a public government web site over the
Internet would not be the kind of activity that would trigger an
intrusion detection system. That activity is not only exceedingly
common, but is entirely expected and encouraged. After all, government
agencies' web pages are posted so that they may be accessed and read by
the general public.
It is safe to assume, however, that sending e-mail infected with a
virus or worm to a government office would certainly activate the
agency's anti-virus software and thus ``set off'' the intrusion
detection system of a given agency. Participation in distributed Denial
of Service (DDOS) attacks, such as those that recently shut down Yahoo!
, e-Bay and other popular commercial web pages,
would most likely also trigger an alert.
Please be aware that it will be the systems administrators in the
individual agencies who will determine for each critical computer
system what type of activity sets off their alarm(s), and what data
(within legal constraints) will be sent via FIDNet to the Federal
Computer Incident Response Capability (FedCIRC) at GSA when
unauthorized activity is suspected. Given the sorts of intrusion
detection systems on the market today, agencies' traffic monitoring
typically notices anomalous activity that may indicate an unlawful
intrusion into a significant information system--such as attempts to
enter a government computer system at an unusual port of entry or the
delivery/execution of certain types of files that are typically used as
vehicles for hostile code, e.g., Trojan horses.
Question 8. While much of the national plan deals with protection
against cyber attack, milestone 1.7 calls for all agencies to cooperate
in the construction of a program to protect critical infrastructures
against physical attack, by terrorists or others. This part of the plan
is scheduled to be complete by June 2000. Could you please elaborate on
what this part of the plan will consist of?
Answer 8. The National Plan for Critical Physical Infrastructure
Protection (NPCPIP) will strengthen our economic and national security
through the identification and remediation of critical physical
infrastructure vulnerabilities. The plan involves asset identification,
process and procedure integration, risk mitigation, remediation,
incident reports, response, and interdependency understanding.
The Information Technology revolution that has taken place in
America during the 1990s, and the dependence on information systems it
has created, makes a national level program for information systems
security and defense essential. Given the urgent need for an
information systems security and defense plan, and because of the
breadth of this topic, the National Plan for Information Systems
Protection, released by the President on January 7, 2000, focuses on
protection of critical information infrastructures from both cyber and
physical attack. It excludes consideration of other critical physical
infrastructures and security issues related to them.
America depends on both the physical and cyber portions of her
critical infrastructures for economic and national security. A cyber
event can cause a disruption of a physical infrastructure (e.g., power
overload leads to a transformer or substation problem); a physical
event/incident can disrupt a cyber infrastructure (e.g., a
communications substation or electric transformer problem negatively
impacts/degrades Secure Supervisory Control and Data Acquisition
(SCADA) or communications systems).
A physical infrastructure plan will integrate the cyber and
physical aspects of critical infrastructure protection. All
infrastructures consist of both cyber and physical elements and it is
important not to separate them, specifically when one considers
business continuity and target opportunities. However, for purposes of
this plan, we must view the physical infrastructures from a national
lens, and thus, we will define critical physical infrastructures to be
those that would have broad reaching consequences, e.g. those that
would impact on major geographical, economical, regional, or national
security levels, if their services or operations were disrupted.
Therefore, to address the physical vulnerabilities of non-cyber
infrastructures, a new Critical Physical Infrastructure Protection Plan
is being developed to identify the necessary initiatives and programs
for ensuring protection of these infrastructures. The CIAO will lead
this effort and will work with an inter-agency Task Group which will
include DoD, FBI, and other agencies. These elements along with reviews
of existing critical physical infrastructure security programs will
lead to The National Plan for Critical Physical Infrastructure
Protection (NPCPIP) to be issued in 2000.
Participating Agencies in NPCPIP Task Group.
Chair/Lead: CIAO*
Sector Liaison Agencies:
Information & Communications--DOC
Banking & Finance--Treasury*
Transportation--DOT*
Energy--DOE*
Emergency Fire Service/Continuity of Government--FEMA*
Public Health--HHS
Water Supply--EPA*
Lead Agencies for Special Functions:
Intelligence--CIA
Foreign Affairs--State
Law Enforcement--DOJ/FBI*
National Defense--DoD*
Federal Government (Non-DoD)--GSA*
Others:
NSC
Local Law Enforcement--Sheriff, Arapaho Co, Colorado
NSTAC (National Security Telecommunications Advisory Council)--(in
a consultant status)
OMB
USDA (Agriculture)
DOI (Interior)
HHS (Health & Human Services)
*}Mandatory--will form the core-writing contingent for
the physical plan, other organizations including the NSTAC will be used
in a reviewer/consultant role.
Question 8a. Do each of the agencies involved have the expertise to
accomplish this study, or are some agencies, such as the FBI and
Defense Department being called on to assist other agencies?
Answer 8a. As described above, an interagency task force is
developing the NPCPIP. No single agency, alone, has the knowledge base
to complete the effort. It should be noted that this plan will not take
the form of an agency-by-agency plan, but a cross-sectoral approach.
Question 9. The Plan states that ``Federal Agencies aad Departments
should have assessed information systems vulnerabilities, adopted a
multi-year funding plan to remedy them, and created a system for
continuously updating. Private sector companies of every critical
sector could do the same. 7 (Milestone 1.21). Is there a need for
legislation to ensure that private sector owners and operators do this?
Answer 9. We do not envision the need now for new legislation.
Individual companies already address security to varying levels. The
degree depends on their level of awareness and understanding of how
critical information systems are to their business operations and to
their ability to assure reliable services and delivery of products to
their customers and the communities they serve. An industry awareness
initiative will create market forces that will inevitably elevate the
level of attention and investment by industry, an example of which we
saw with the Year 2000 conversion experience. At some point, we may
recognize a gap between what national security needs for critical
infrastructure security and what companies believe their customers and
communities are willing to pay for. At that time, additional incentives
may be needed for industry to step up to additional levels of
investment beyond what the market supports.
Information security, unlike the Year 2000 conversion, has no end
point. Consequently, it will require an on-going commitment and
institutionalization of controls into core business processes.
Technology also continues to change very quickly, requiring continuing
attention and investment from those who would benefit from it.
Obtaining buy-in from industry in their own business interests will
more effectively address this issue in a timely and creative manner.
Question 9a. Other than legislation requiring private companies to
undertake this sort of planning, are there other incentives we could
use to encourage firms in key sectors to be more pro-active in making
their computer networks more secure?
Answer 9a. The most effective incentive for corporations to take
action is for the government to articulate its concern in business
terms. The government's real focus is on predictable delivery of
critical services that enable the government to satisfy its national
security responsibilities and foster a competitive economy. Private
industry succeeds by providing most of these services. If the
government is successful in conveying its message, industry will take
action based on sound business management practices.
Question 10. What is the status of the development of Information
Sharing and Analysis Center (ISACs), which are intended to bring
together companies in key sectors like banking and telecommunications
to facilitate the sharing of information about cyber threats and best
practices for addressing vulnerabilities?
Answer 10. Building the public-private partnership to ensure action
is at the core of the National Plan. Without the full participation of
the private sector, federal actions to protect critical infrastructures
will not be fully effective. PDD-63 suggests that the private sector,
in cooperation with the Federal government, establish Information
Sharing and Analysis Centers (ISACs) to facilitate public-private
information sharing on vulnerabilities, threats intrusions, and
anomalies. It should be noted, however, that ISACs are only one of the
many information-sharing mechanisms now employed by the private sector.
Last October, Banking and Finance publicly announced the creation
of the Financial Services Information and Analysis Center (FS-ISAC).
This is the first center that is operational and it is currently
recruiting members from the entire financial industry.
The National Coordinating Center (NCC) for Telecommunications,
established in 1984, already performs many of the functions of an ISAC
for the telecommunications industry.
The electric power industry, through the North American Electric
Reliability Council (NERC), has developed a reporting process and
specific data elements on incidents to be shared with the National
Infrastructure Protection Center (NIPC). This reporting process was
built on a reporting structure and process that already exists within
the electric industry to support the reliability, availability, and
integrity of the nation's electric grid.
There are other information sharing vehicles in private industry,
created for paying members. Many of the large consulting and technology
firms provide similar or equivalent services to their customers. Many
of these share relevant information with the government.
The government is also engaged in a dialogue with the Partnership
for Critical Infrastructure Security to explore the value and
feasibility of cross-sector information sharing regarding common
threats, experiences, and best practices.
Question 11. Pages 24 and 25 of the executive summary of the Plan
describe deterrents and obstacles to companies who wish to share
information on cyber-threats with the government. How can we remove
these obstacles to encourage companies to share such information with
the government? Do you need help from Congress to address these
impediments?
Answer 11. Many owners and operators of critical infrastructures
and industry officials have expressed reluctance to share information
about threats and vulnerabilities with the government. The degree of
reluctance varies according to infrastructure, but is present in each.
Only 17 percent of respondents who experienced an attack during the
previous year reported it to law enforcement, according to the
President's Commission on Critical Infrastructure Protection, which
published its findings in October 1997.
In a recent meeting with industry officials they have suggested
that they would be reluctant to share such proprietary information or
to participate in information sharing programs for a number of reasons.
They fear information provided to the government may be made public and
thereby damage their reputations, expose them to liability, or weaken
their competitive position. In addition, potential contributors from
the private sector are reluctant to share specific threat and
vulnerability information because of impediments they perceive to arise
from antitrust and unfair-business laws.
With this dilemma in mind, an interagency group was formed in
August 1999 to consider a non-disclosure provision that would allow
Federal agencies to accept voluntary contributions of certain security-
related information outside the operation of the Freedom of Information
Act (FOIA). The information in question would not be of the type
normally disclosed either to the Federal government or to the public.
In the near future, the group plans to address antitrust and liability
issues.
In each of these cases, we will need to work closely with Congress
and the privacy community in developing effective solutions and
removing these obstacles.
Question 12. The Plan refers to the Partnership for Critical
Infrastructure Security. Furthermore, milestone 8.2 states that this
partnership will be created this month. What is it and how will it be
created?
Answer 12. The Partnership for Critical Infrastructure Security was
created on February 22, 2000 at an organizational meeting held at the
U.S. Chamber of Commerce. Over 120 companies attended (with more on the
waiting list that could not be accommodated, but who want to join the
partnership).
The Partnership is intended to be a collaborative effort of
industry and government to assure the delivery of essential services
over the nation's critical infrastructures. These infrastructures,
identified in Presidential Decision Directive 63 (PDD-63), include:
Energy
Financial Services
Transportation
Communications and Information Services
Vital Human Services, including Health, Safety, and Water
Private sector membership in the Partnership is open to
infrastructure owners and operators, providers of infrastructure
hardware, software, and services, risk management and investment
professionals, and other members of the business community. Government
representation will include state and local governments, as well as
Federal agencies and departments responsible for working with the
critical infrastructure sectors and for providing functional support
for the protection of those infrastructures.
The Partnership recognizes that the nation's critical services
depend increasingly on commercial information technologies. The new
threats and vulnerabilities that come with greater dependency on these
technologies, combined with the growing interdependencies among the
nation's critical infrastructures, require urgent attention not only in
the government but also in the business community.
The Partnership recognizes that in addition to protecting these
infrastructures, attention must be given to the range of actions
necessary to assure the delivery of critical services--including
mitigation, response, and reconstitution.
Since the vast majority of the critical infrastructures of the
United States are owned and operated by private industry, the
Partnership recognizes and acknowledges that the Federal government
alone cannot protect these infrastructures or assure the delivery of
services over them. While most of the challenges to assuring critical
services are best handled by industry itself, the Partnership is based
on the premise that some of these challenges are better handled by
industry and government working together.
The Partnership will explore ways in which industry and government
can work together to address the risks to the nation's critical
infrastructures. Federal Lead Agencies are currently building
partnerships with individual infrastructure sectors in private
industry, and state and local governments. The Partnership will provide
a forum in which to draw these individual efforts together to
facilitate a dialogue on cross-sector interdependencies, explore common
approaches and experiences, and engage other key professional and
business communities that have an interest in infrastructure assurance.
By doing so, the Partnership hopes to raise awareness and understanding
of, and to serve, when appropriate, as a catalyst for action among, the
owners and operators of critical infrastructures, the risk management
and investment communities, other members of the business community,
and state and local governments.
How the Partnership conducts itself--how it is organized, and how
it manages its on-going operations--will largely be determined by its
industry members. For its part, the Federal Government is prepared to
sponsor on behalf of the Partnership a series of conferences, meetings,
and working groups with industry and government executives to:
Exchanges views on issues of mutual interest to the
government and members of industry, including, but not limited
to:
Interdependencies, including cross-sector
information sharing arrangements and the appropriate safeguards
for protecting the confidentiality of such information;
Evolving threats to critical infrastructures;
Education, training and workforce development;
Standards and Best Practices;
Technology and R&D;
Risk Management: prevention, mitigation, response,
and reconstitution, including incident response management and
consequence management; and,
Legal and regulatory matters.
Facilitate the participation of members of industry in the
ongoing development of the national plan for critical
infrastructure protection; and,
Facilitate contributions by members of industry to the work
of the National Infrastructure Assurance Council.\1\
---------------------------------------------------------------------------
\1\ President Clinton established the National Infrastructure
Assurance Council (NIAC) by Executive Order 13130 on July 14, 1999. The
Council will consist of up to 30 leaders in industry and state and
local government. Its mandate is to advise and counsel the President on
a range of policy matters relating to critical infrastructure
assurance, including the enhancement of public-private partnerships,
generally. The Partnership for Critical Infrastructure Security could
serve as one important channel of communication to the NIAC, ensuring
that Council members have the full benefit of a wide cross-section of
industry views.
---------------------------------------------------------------------------
______
Responses of John Tritak to Questions From Senator Joseph R. Biden, Jr.
Question 1. Mr. Tritak in light of privacy advocates' criticism of
the Federal Intrusion Detection Network (FIDNet) program, how can you
guarantee that civil liberties are protected and that FIDNet will not
violate current privacy protection, wiretap and 4th amendment law?
At the outset and before we can respond to your question fully, we
need to make two observations as a backdrop for the discussion. First,
the Federal Intrusion Detection Network (the ``FIDNet'') proposal was
and continues to be a work in progress. Since the release of PDD-63 in
May 1998, the Administration has worked carefully to identify the full
range of possible security options that incorporate intrusion detection
technology. The proposal as described in the earliest drafts of the
National Plan has evolved considerably, and continues to evolve.
The second point to be made is that, as underscored in the National
Plan, the FIDNet proposal will be implemented in a manner consistent
with all relevant laws, including privacy laws. Our legal analysis of
the proposal--and our ongoing consultation with the Department of
Justice--continues as part of a comprehensive interagency process and
in tandem with the evolution of the FIDNet to assure its adherence to
the spirit and letter of law.
FIDNet has been carefully tailored to vest authority and control in
the Federal civilian agencies, consistent with the Computer Security
Act of 1987, Clinger-Cohen Act, and Executive Order 13011, which
implement Congressional policies. Under current practices, federal
agency computer system administrators (as well as system administrators
in most companies in the private sector) already analyze data flowing
over their systems, based on strategic placement of intrusion detection
technology in accordance with the needs of the organization. Under the
FIDNet proposal as currently formulated:
The agencies will decide what data on system anomalies to
forward to the GSA for further review;
The GSA will use data on anomalies exclusively to warn
agencies about system anomalies; and
Law enforcement would receive information about computer
attacks and intrusions only under long-standing legal rules
(i.e., when there is evidence of a crime). No new authorities
are implied or envisioned by the FIDNet program.
FIDNet is intended to be a multi-level system. At the first level,
each agency's own security-protection software will scan for harmful
traffic entering that agency's system. (The key to understanding
intrusion detection is the concept of a ``firewall,'' which by
definition and design is meant to scan incoming transmissions for
hostile files and programs.) In fact, this is already being done at
federal agencies, not to mention most private companies. The National
Plan contemplates that the implementation and operation of such
protective measures will continue to be the responsibility of the
individual agencies. The objective of FIDNet is not to send the
resulting information to law enforcement officials. Instead, the goal
is to improve overall federal system security through improved
information sharing among systems administrators and information
security officials.
Contrary to Mr. Rotenberg's suggestion, the March 1999 Justice
Department memorandum does not state at any point that FIDNet--even in
the preliminary form then under analysis--would violate federal privacy
law. On the contrary, the memorandum identifies the legal bases on
which protective monitoring of government computer systems can be
lawfully conducted.
In fact, the current FIDNet proposal is structured to comply fully
with the Electronic Communications Privacy Act (``ECPA''), 18 U.S.C.
Sec. 2510 et seq., which incorporates federal wiretap law.
Specifically, while ECPA generally prohibits the interception of
electronic communications, it contains two relevant exceptions to that
general prohibition: (1) consent of a party and (2) system protection
monitoring activities. As to the first of these, the federal agencies
participating in FIDNet will, in appropriate instances, establish
consent to monitoring by using login ``banners'' displayed to each
network's users.
FIDNet will also rely on the separate exception applicable to
systems protection. Under this exception, ECPA expressly authorizes a
system owner or his agent to monitor network traffic on the system to
the extent necessary to protect the ``rights or property'' of the
system owner.
In addition, the FIDNet concept is compatible with the Privacy Act.
The Privacy Act, designed to protect personal privacy from unwarranted
invasions by federal agencies, regulates the collection, maintenance,
use, and dissemination of personal information by federal government
agencies. It forbids the disclosure of personal information by federal
agencies except under certain circumstances, and, subject to enumerated
exceptions, gives individuals access to information maintained on them.
FIDNet will be fully consistent with the Privacy Act's requirement
that physical security and information management practices be designed
to ensure individual privacy. As properly and legally formulated,
FIDNet will increase the level of privacy and security afforded to
information about individuals on government computers.
Question 2. What type of data will be collected by FIDNet and how
long will the Government Services Administration retain the data?
Answer 2. FIDNet will not deploy collectors or sensors on any
government agencies or other entity network. This is the job of the
agency systems administrators and their intrusion detection systems.
Instead, the FIDNet will receive from the agencies, under processes
established by the agency systems administrators, only those alarm
indications that the agency internal intrusion detection systems
identify as anomalous and that the agency systems administrators
forward to FIDNet.
Intrusion detection system alarm data typically have a short shelf-
life and GSA does not envision a need to retain this data. However,
legal requirements relating to government records may mandate that
certain records be retained or archived in accordance with schedules
established in accordance with law. This issue is currently being
reviewed. Of course, GSA will continue to adhere to existing laws with
respect to records involving law enforcement matters.
______
Responses of John Tritak to Questions From Senator Dianne Feinstein
Question 1. Does FIDNet comply with the Wire Tap Laws?
Answer 1. Yes, FIDNet complies with the wiretap laws.
At the outset and before we can respond to your question fully, we
need to make two observations as a backdrop for the discussion. first,
the Federal Intrusion Detection Network (the ``FIDNet'') proposal was
and continues to be a work in progress. Since the release of PDD-63 in
May 1998, the Administration has worked carefully to identify the full
range of possible security options that incorporate intrusion detection
technology. The proposal as described in the earliest drafts of the
National Plan has evolved considerably, and continues to evolve.
The second point to be made is that, as underscored in the National
Plan, the FIDNet proposal will be implemented in a manner consistent
with all relevant laws, including privacy laws. Our legal analysis of
the proposal--and our ongoing consultation with the Department of
Justice--continues as part of a comprehensive interagency process and
in tandem with the evolution of the FIDNet to assure its adherence to
the spirit and letter of law.
FIDNet has been carefully tailored to vest authority and control in
the Federal civilian agencies, consistent with the Computer Security
Act of 1987, Clinger-Cohen Act, and Executive Order 13011, which
implement Congressional policies. Under current practices, federal
agency computer system administrators (as well as system administrators
in most companies in the private sector) already analyze data flowing
over their systems, based on strategic placement of intrusion detection
technology in accordance with the needs of the organization. Under the
FIDNet proposal as currently formulated:
The agencies will decide what data on system anomalies to
forward to the GSA for further review;
The GSA will use data on anomalies exclusively to warn
agencies about system anomalies; and
Law enforcement would receive information about computer
attacks and intrusions only under long-standing legal rules
(i.e., when there is evidence of a crime). No new authorities
are implied or envisioned by the FIDNet program.
FIDNet is intended to be a multi-level system. At the first level,
each agency's own security-protection software will scan for harmful
traffic entering that agency's system. (The key to understanding
intrusion detection is the concept of a ``firewall,'' which by
definition and design is meant to scan incoming transmissions for
hostile files and programs.) In fact, this is already being done at
federal agencies, not to mention most private companies. The National
Plan contemplates that the implementation and operation of such
protective measures will continue to be the responsibility of the
individual agencies. The objective of FIDNet is not to send the
resulting information to law enforcement officials. Instead, the goal
is to improve overall federal system security through improved
information sharing among systems administrators and information
security officials.
Contrary to Mr. Rotenberg's suggestion, the March 1999 Justice
Department memorandum does not state at any point that FIDNet--even in
the preliminary form then under analysis--would violate federal privacy
law. On the contrary, the memorandum identifies the legal bases on
which protective monitoring of government computer systems can be
lawfully conducted.
In fact, the current FIDNet proposal is structured to comply fully
with the Electronic Communications Privacy Act (``ECPA''), 18 U.S.C.
Sec. 2510 et seq., which incorporates federal wiretap law.
Specifically, while ECPA generally prohibits the interception of
electronic communications, it contains two relevant exceptions to that
general prohibition: (1) consent of a party and (2) system protection
monitoring activities. As to the first of these, the federal agencies
participating in FIDNet will, in appropriate instances, establish
consent to monitoring by using login ``banners'' displayed to each
network's users.
FIDNet will also rely on the separate exception applicable to
systems protection. Under this exception, ECPA expressly authorizes a
system owner or his agent to monitor network traffic on the system to
the extent necessary to protect the ``rights or property'' of the
system owner.
In addition, the FIDNet concept is compatible with the Privacy Act.
The Privacy Act, designed to protect personal privacy from unwarranted
invasions by federal agencies, regulates the collection, maintenance,
use, and dissemination of personal information by federal government
agencies. It forbids the disclosure of personal information by federal
agencies except under certain circumstances, and, subject to enumerated
exceptions, gives individuals access to information maintained on them.
FIDNet will be fully consistent with the Privacy Act's requirement
that physical security and information management practices be designed
to ensure individual privacy. As properly and legally formulated,
FIDNet will increase the level of privacy and security afforded to
information about individuals on government computers.
Question 2. Under what legal authority does FIDNet function?
Answer 2. The Administration is committed to structuring the FIDNet
concept in strict adherence to exiting protections under the law,
including ECPA (Wiretap Statutes), the Privacy Act, and other laws.
Please refer to Question 1 above for more details.
Question 3. How are FIDNet and the NIPC redundant?
Answer 3. They are not. FIDNet, when operational, will be a service
offered by the GSA to the civilian departments and agencies to help
them improve information sharing within the Federal civilian government
amongst systems administrators. This information sharing covers the
efficiency and reliability of intrusion detection systems which some
agencies already employ in accordance with OMB Circular A-130. In
short, the FIDNet is a centrally managed operational structure that
permits GSA to look at and draw conclusions about anomalous cyber
activity across the federal civilian government in a way that no single
agency could do for itself.
In contrast, the NIPC serves as the national focal point for threat
assessment, warning, investigation, and response to attacks on the
critical infrastructures. A significant part of its mission involves
establishing mechanisms to increase the sharing of vulnerability and
threat information between the government and private industry. It also
provides invaluable input and capabilities to federal law enforcement
and defense cyber operations.
Question 4. Give your opinion on the GAO's assertion that the
current laws governing IT Security are outdated.
Answer 4. The management of information security in the Federal
government is an issue that is currently being debated in the Congress
and the Administration, including in legislation such as S. 1993.
Accordingly, the only observation I would make at this time is that we
should rely on the existing legal framework, to the extent we can
continue to assure ourselves that the system is working, is effective,
and is providing the appropriate level of protection for the full range
of proprietary, personal, and other sensitive information.
Question 5. Is there a need to tailor infosec standards to certain
types of information, and if so how?
Answer 5. As discussed above, the only observation I would offer on
this subject is that information technology is developing rapidly and
that critical infrastructure protection needs to be an essential part
of that development, if we are to build secure infrastructures. We
should rely on the existing legal framework, to the extent we can
assure ourselves that the system is working, is effective, and is
providing the appropriate level of protection for proprietary, personal
and other sensitive information.
Question 6. Should Congress approve more money for PKI?
Answer 6. Public Key Infrastructure (PKI) maximizes our capability
to implement needed security services including confidentiality,
integrity, authentication, non-repudiation and access control. PKI
facilitates the secure exchange of information electronically. It is a
key element for gaining increasing trust and confidence in the use of
this medium for commercial applications.
Today, cryptography is the most viable means of protecting
information in cyberspace. As mentioned, public key cryptography, based
on a PKI, maximizes our capability to implement needed security
services including confidentiality, integrity, authentication, non-
repudiation and access control. Appropriate combinations of these
services allow us to protect information stored and transmitted over
the Internet from our lap-top and desk-top computers. The PKI also
allows us to configure firewalls and other Internet components to
protect the internal domain name services and routing table
information. These PKI security services enable secure e-commerce, e-
mail and a myriad of important large distributed applications including
those that provide Government services.
Appropriated monies for PKI would be well spent in the following
areas:
PKI Standards, Testing and Product Certification--As industry
responds to a growing customer base for PKI products, innovative and
enterprising solutions are finding their way into large international
markets. Of critical importance to the Government is the
interoperability of a Government PKI with those of the public and
private sectors and other sovereign governments. It is unlikely that
these industry PKI solutions will meet all the unique Government PKI
requirements. Appropriate testing and high confidence certifications
for Government PKIs often go well beyond the interoperability and
testing requirements of other PKIs. Additional government activities in
interoperability standards development and in testing and certification
are needed.
PKI Research and Development--The Next Generation Internet (NGI)
holds the promise of extremely high bandwidth, rich connectivity and
extremely efficient large distributed applications. It is prudent to
plan now for the security services that will likely be required for the
NGI. Three interagency working groups are coordinating expertise to
begin the process: The Large Scale Networking Next Generation Internet
(LSN/NGI), the High Confidence Systems (HCSS) and the Critical
Infrastructure Protection (CIP) communities have expressed interest in
a Public Key Infrastructure for the Next Generation Internet.
Additional government activities in defining the transition strategy
from current PKI for the Internet to a PKI for the NGI is rightfully a
research and development idea with low risk and high potential payoff
for both our nations next generation critical infrastructures and our
governments next generation needs and requirements.
Our models for secure e-commerce and e-mail have been tested with
prototype implementations; but, not stressed. We need real experiences
with a Government PKI that provisions security in large, scalable high-
speed dynamic group communications similar to those used by our
emergency response communications and messaging systems and other
critical government systems. We know little about integrating PKI into
large legacy applications used by the Government to provision services
for the public. We know even less about integrating PKI into new, as
yet untested, major applications that serve the public.
Operational Critical Systems--While PKI technology by itself cannot
completely protect critical operational systems, PKI is considered a
necessary component when cryptography is deployed. Biometric techniques
used in conjunction with PKI can provide high-grade authentication of
people accessing critical assets. In addition, digital signature
techniques based on PKI can provide integrity and non-repudiation of
information and transactions--a key element in audit trail techniques.
The monies necessary to upgrade legacy systems with PKI technology
often come out of agency security budget lines. Monies specifically
approved for PKI by the Congress would have the immediate effect of
forming the critical mass necessary to jump-start the Government's PKI.