[Senate Hearing 107-258]
[From the U.S. Government Publishing Office]
S. Hrg. 107-258
CRITICAL INFRASTRUCTURE PROTECTION: WHO'S IN CHARGE?
=======================================================================
HEARING
before the
COMMITTEE ON
GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
ONE HUNDRED SEVENTH CONGRESS
FIRST SESSION
__________
OCTOBER 4, 2001
__________
Printed for the use of the Committee on Governmental Affairs
U.S. GOVERNMENT PRINTING OFFICE
77-434 WASHINGTON : 2002
________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512-1800
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON GOVERNMENTAL AFFAIRS
JOSEPH I. LIEBERMAN, Connecticut, Chairman
CARL LEVIN, Michigan FRED THOMPSON, Tennessee
DANIEL K. AKAKA, Hawaii TED STEVENS, Alaska
RICHARD J. DURBIN, Illinois SUSAN M. COLLINS, Maine
ROBERT G. TORRICELLI, New Jersey GEORGE V. VOINOVICH, Ohio
MAX CLELAND, Georgia PETE V. DOMENICI, New Mexico
THOMAS R. CARPER, Delaware THAD COCHRAN, Mississippi
JEAN CARNAHAN, Missouri ROBERT F. BENNETT, Utah
MARK DAYTON, Minnesota JIM BUNNING, Kentucky
Joyce A. Rechtschaffen, Staff Director and Counsel
Kiersten Todt Coon, Professional Staff Member
Hannah S. Sistare, Minority Staff Director and Counsel
Ellen B. Brown, Minority Senior Counsel
Robert J. Shea, Minority Counsel
Morgan P. Muchnick, Minority Professional Staff Member
Darla D. Cassell, Chief Clerk
C O N T E N T S
------
Opening statements:
Page
Senator Cleland.............................................. 1
Senator Thompson............................................. 2
Senator Carnahan............................................. 4
Senator Collins.............................................. 5
Senator Bennett.............................................. 6
Senator Voinovich............................................ 7
Senator Domenici............................................. 21
Prepared statement:
Senator Bunning.............................................. 41
WITNESSES
Thursday, October 4, 2001
John S. Tritak, Director, Critical Infrastructure Assurance
Office, Bureau of Export Administration, U.S. Department of
Commerce....................................................... 9
Ronald L. Dick, Director, National Infrastructure Protection
Center, Federal Bureau of Investigation........................ 11
Sallie McDonald, Assistant Commissioner, Office of Information
Assurance and Critical Infrastructure Protection, U.S. General
Services Administration........................................ 13
Jamie S. Gorelick, Vice Chair, Fannie Mae........................ 23
Joseph P. Nacchio, Chairman and Chief Executive Officer, Qwest
Communications International, Inc.............................. 25
Frank J. Cilluffo, Co-chairman, Cyber Threats Task Force,
Homeland Defense Project, Center for Strategic and
International Studies.......................................... 27
Kenneth C. Watson, President, Partnership for Critical
Infrastructure Security (PCIS)................................. 30
Alphabetical List of Witnesses
Cilluffo, Frank J.:
Testimony.................................................... 27
Prepared statement........................................... 83
Dick, Ronald L.:
Testimony.................................................... 11
Prepared statement........................................... 52
Gorelick, Jamie S.:
Testimony.................................................... 23
Prepared statement........................................... 70
McDonald, Sallie:
Testimony.................................................... 13
Prepared statement........................................... 61
Nacchio, Joseph P.:
Testimony.................................................... 25
Prepared statement........................................... 76
Tritak, John S.:
Testimony.................................................... 9
Prepared statement........................................... 42
Watson, Kenneth C.:
Testimony.................................................... 30
Prepared statement with attachments.......................... 98
CRITICAL INFRASTRUCTURE PROTECTION: WHO'S IN CHARGE?
----------
THURSDAY, OCTOBER 4, 2001
U.S. Senate,
Committee on Governmental Affairs,
Washington, DC.
The Committee met, pursuant to notice, at 9:35 a.m., in
room SD-342, Dirksen Senate Office Building, Hon. Max Cleland,
presiding.
Members present: Senators Cleland, Carnahan, Thompson,
Collins, Bennett, Voinovich, and Dominici.
OPENING STATEMENT OF SENATOR CLELAND
Senator Cleland [presiding]. At the request of Senator
Lieberman, who must be out of town today to attend a funeral, I
am chairing today's hearing on critical infrastructure
protection. I appreciate this opportunity to examine who in the
public and private sector is responsible for ensuring the
protection of our Nation's infrastructure. This is the second
hearing held by Senator Lieberman and the Committee in our
continuing series on the security of our Nation's critical
infrastructure and the vulnerability of the country's
financial, transportation, and communications networks, also
our utilities, our public health system, law enforcement, and
emergency systems, and others. As you can tell infrastructure
covers just about everything of value in our country.
Prior to the September 11 terrorist attacks the
Governmental Affairs Committee has been actually diligent in
its examination of the responsibilities of Federal agency heads
for developing and implementing security programs. In fact, the
computer security law, enacted during the 106th Congress,
requires Federal agencies to upgrade their practices and
procedures in order to protect government information systems
from cyber attack. However, since the attacks on Washington and
New York City, we have learned that there is still much to be
done to protect the Nation's critical infrastructure.
The terrorist attacks provide evidence that physical
assaults can cause severe disruptions in the service and
delivery of goods and products, triggering ripple effects
throughout the Nation's economy, and more importantly damaging
the faith of the people in the viability of the day-to-day
functioning of the country. Nothing affects Americans more than
the disruption of the Nation's transportation, communications,
banking, finance, and utilities systems. The country's critical
infrastructures are growing increasingly complex, relying on
computers and computer networks to operate efficiently and
reliably.
The growing complexity and the interconnectedness resulting
from networking means that a disruption in one win may lead to
disruptions in others. Therefore, President Clinton established
the President's Commission on Critical Infrastructure
Protection in July 1996. In 1997, this organization released
its report and recommended that greater cooperation and
communication between the private sector and the public sector
is needed in order to decrease the vulnerability of the
Nation's infrastructures, which led to their President's
release of Presidential Decision Directive 63.
In May 1998, President Clinton released this directive,
which sets up groups within the Federal Government to develop
and implement plans that would protect government-operated
infrastructures and calls for a dialogue between government and
the private sector to develop a national infrastructure
assurance plan that would protect the Nation's critical
infrastructures by the year 2003. This Presidential decision
memorandum identified 12 areas critical to the functioning of
the country: Information and communications; banking and
finance; water supply; transportation; emergency law
enforcement; emergency fire service; emergency medicine;
electric power; oil and gas supply and distribution; law
enforcement and internal security; intelligence; foreign
affairs; and national defense, just about everything you can
think of.
The directive required each Federal agency to secure its
own critical infrastructure and to identify a chief officer to
assume that responsibility. The directive also established
several new offices to oversee and coordinate critical
infrastructure protection. One was a national coordinator
designated to ensure that a national plan was developed. The
coordinator would be supported by a critical infrastructure
assurance office, to be located in the Export Administration of
the Department of Commerce.
The directive also created a joint FBI and private sector
office, the National Infrastructure Protection Center, which
serves as a focal point for Federal threat assessment,
vulnerability analysis, early-warning capability, law-
enforcement investigations and response coordination. NIPC is
also the private sector point of contact for information
sharing. Finally, the directive recommended that we have the
capacity and the capability to detect and respond to cyber
attacks while they are in progress. The Federal Computer
Incident Response Center gives agencies the tools to detect and
respond to such attacks, and it coordinates response and
detection information.
We are fortunate today to have several witnesses who will
present their views on the status of the Nation's critical
infrastructures, and offer their recommendations on protecting
public and private systems from outside attacks.
Senator Thompson, would you like to make any opening
remarks.
OPENING STATEMENT OF SENATOR THOMPSON
Senator Thompson. Thank you, Mr. Chairman, just very
briefly. I think this is certainly a timely hearing. I think we
all appreciate now the vulnerability that we have had for a
long time, and one that we have discussed in this Committee and
others on very many occasions, certainly including cyber
security and the problems we have with computer security, and
so forth. Of course, that was the background for Senator
Lieberman and I introducing the Government Information Security
Act.
I think that we are now looking at all these threats
through different glasses. Today we are probably going to
emphasize, perhaps, one particular issue a little more than
others, and that is the cyber threat. Now we are all familiar,
all of a sudden, with the threats of biological elements,
chemical, certainly nuclear, certainly conventional
combinations of all the above, and in addition to that is the
cyber threat, which many people think would precede any major
conflict that we had with a major power.
Of course, we now know that in this modern age of
technology, you do not need to have a major nation-state or a
national power in order to create grave problems for us. So now
that we have our attention focused after all this time, we are
thinking about rearranging the boxes again and creating new
laws and new offices, and trying to fit all the stuff that is
out there together. Of course, Governor Ridge's appointment, I
think, is a good step. But within his bailiwick, as I
understand it, will be an Office of Cyber Security.
You have Presidential Decision Directive 63, which
addressed the same general problem of cyber security. The GAO
has indicated that has not done very well, in terms of what it
was designed to do and the offices that it set up. Now we have
a new proposed executive order that is not with us yet that
will address all of this. We have got the question of what is
OMB's role going to be in all of this, since they have
responsibility for computer security, and then we have got to
ask ourselves how does all this relate to the private sector,
as Senator Bennett spent a lot of time on and has legislation
on, because we know that most of our critical infrastructure is
basically in private hands.
So we have got real big organizational issues on the table
to deal with. To me, I think it gets down to a pretty simple
proposition, it is going to require leadership, authority at
the top, and leadership, and accountability. Maybe we can learn
from our past experience with other government agencies and
other crises and things of that nature, and not make the same
mistakes as we go about trying to rearrange these boxes and
decide who reports to who and who has what authority.
Maybe we will take the lessons we learned from our other
management problems. In particular, the government basically
cannot manage large projects very well. We are told time and
time and time again by GAO, by the inspectors general, all the
reports that we have seen in terms of our problems with regard
to financial management. For example, billions and billions of
dollars in waste, fraud, and abuse.
We are told that we cannot manage large information
systems. We have spent billions and billions of dollars, money
down the drain basically, in trying to get computers to talk to
one another. This is a government-wide problem and we think
that we are going to come in here and efficiently set this
particular thing up and it is going to work well, when nothing
else--well, that is an overstatement, of course--but so many
things are producing billions of dollars of waste, fraud, and
abuse every year. The same agencies come before us every year
on the high-risk list, subject to waste, fraud, and abuse, for
a decade, but we are going to pull this out and set the boxes
right, and then go on about our business the way we did before;
we have solved that problem. Well, it isn't going to happen
that way unless we have what we have been lacking for years and
years and years, and that is leadership from the top on these
issues, with the right person having the right authority, and
accountability when it does not work.
We are very good at setting up plans and goals, and
terrible at implementing them. So I do not want to start out
this optimistic exercise on a sour note, but I think it is
important to understand that we have got a bigger job than
probably what we realize in trying to cut through this morass
that we always find ourselves in when we try to solve a
problem. And it is especially important here because of the
nature of the problem. So, hopefully, today we can get some
ideas as to who ought to do what, where the responsibility
lies.
I defy anybody to tell us today where the responsibility
lies for any of this, but maybe we can talk about where it
should lie and where we should go, the direction we should go
in, and I think for that reason it will be a useful exercise.
Thank you, Mr. Chairman.
Senator Cleland. Thank you, Senator Thompson. We will allow
everyone to make an opening statement, if they wish.
Senator Carnahan, would you like to make an opening
statement?
OPENING STATEMENT OF SENATOR CARNAHAN
Senator Carnahan. Thank you, Mr. Chairman. Terrorists did
not want to bring down just our buildings. They wanted to bring
down our economy. They wanted to bring down our military and
our financial and political infrastructure as well. Our losses
are incalculable and far-reaching. Still we must face a stark
reality: It could have been worse. Now this Congress, alongside
the President, must take the lead to ensure we are prepared for
the future. I applaud the Chairman for addressing these issues
with this series of hearings. When we talk about critical
infrastructure, we are talking about American families and
their ability to have a quality life.
This means freedom to travel; it means freedom to make a
living; and it means freedom to conduct business without fear
of terrorism. It means having the peace of mind that your
government is doing all that it can to protect you and your
children. Grim experience has taught us that terrorist attacks
know no boundaries. The ripple effect is extensive. The
emotional trauma is long-lasting, and the economic impact is
real and widespread. We are all affected, and all of us must be
part of the Nation's defense against further attacks.
As the witnesses will discuss today, there are difficulties
in creating a unified system to protect our national
infrastructure, because control of the different components
rests with different entities. On the most basic level, there
is a division between what the government owns and operates
versus what the private sector owns and operates, but the issue
is really much more complex. We live in a global, computerized,
and interconnected world. Technological changes have led to
great opportunities for human progress, but they have also
created vulnerabilities that did not exist even 5 years ago.
Securing our critical infrastructure from cyber attacks,
which could be launched from anywhere, is a tremendous
challenge for both government and industry. I look forward to
hearing from the witnesses today and learning from their
expertise. I want to hear their suggestions on what more needs
to be done. The question being raised today, who is in charge
of protecting our national infrastructure, needs to be answered
as soon as possible. We cannot afford to wait for another
attack.
Thank you, Mr. Chairman.
Senator Cleland. Thank you, Senator Carnahan. Senator
Collins.
OPENING STATEMENT OF SENATOR COLLINS
Senator Collins. Thank you very much, Mr. Chairman, for
convening this important hearing. It would be hard to imagine a
more current topic for a hearing than the one that we have
before us today on the question of who is in charge of
protecting the critical infrastructure of our Nation. Until the
terrorist attacks of September 11, in fact, most Americans
probably never fully realized the importance of this issue.
Tragically, however our eyes are all too open now.
As I have talked with my constituents throughout Maine
during the past 2\1/2\ weeks, the question of our vulnerability
to attack--to various kinds of attacks--and who is in charge
and who is coordinating it all has come up repeatedly. This
morning, I did early morning radio, back in Maine, and one of
the questions was who is coordinating if we have a biological
or chemical attack? Another constituent asked me what about our
ports? What about if we have a big tanker that is full of
liquefied gas coming in? What about the computer systems that
are so critical to our commerce and to our government?
The answer to the question of who is in charge seems to be,
``Nobody is quite sure.'' Less than 2 weeks ago, this Committee
heard compelling testimony from the distinguished chairmen of
two commissions appointed to study this Nation's security,
former Senators Gary Hart and Warren Rudman, and Governor James
Gilmore of Virginia eloquently expressed their unanimous, but
unfortunate, conclusion that, as a Nation, we are simply not
properly prepared to defend our critical resources.
If we were poorly prepared for the challenges we thought we
faced before the terrible events of September 11, we must
surely realize that we are woefully unready now. It seems clear
that the protection of our critical infrastructure still
consists largely of a smorgasbord of independently-run and
poorly-coordinated programs across the breadth of the Federal
system. President Bush took an important step when he took
office in focusing the National Security Council upon terrorism
issues and appointing Vice President Cheney to head a task
force to develop better ways to respond to catastrophic
disasters.
As the Hart-Rudman Commission and the Gilmore Commission
made clear, however, and as recent events have so tragically
underlined, it is necessary to do even more. We, in America,
have long been blessed by being spared most of the traumas of
terrorist attacks that became far too familiar to Europeans in
the 1970's, and have been a tragic part of Israeli life for
decades. It should be clear, however, that we can no longer
afford to attempt to protect our critical infrastructures
without clear lines of authority and accountability, and
without being able to answer readily and precisely the question
of who is in charge.
The difficult, but crucial question now, of course, is who
should be in charge and of what? In other words, we must ask
who should be in charge at what level, with what specific
responsibilities and resources, and with what means of ensuring
accountability? And that is why I believe this series of
hearings is such an important contribution to the national
dialogue of protecting our infrastructure and of winning the
battle against terrorism. I am very eager to hear the testimony
of our witnesses today, and I want to thank the Chairman and
the Ranking Member for their leadership on this issue. Thank
you, Mr. Chairman.
Senator Cleland. Thank you very much, Senator Collins.
Senator Bennett.
OPENING STATEMENT OF SENATOR BENNETT
Senator Bennett. Thank you, Mr. Chairman. I appreciate the
hearing and I appreciate the opportunity for us to examine
these issues, and the point I want to make with respect to the
challenge that we face is that it is seamless. The networks do
not begin and end at any particularly defined place. But the
efficiency that comes out of the information revolution that we
live in has brought with it an increased vulnerability, and the
two are two sides of the same coin.
If you go back in American history to George Washington's
time, there was little or no connection, let us say, between
Charleston and Boston, between Virginia and Massachusetts, or
New York, whatever. It was a 7-day journey to travel from one
major metropolitan area, if you could call it that, to another.
Today, we go around the world with information, money, deals,
negotiations, etc., literately with the speed of light. There
are no boundaries in today's economy. The borderless economy is
a reality, and those who want to take down the Americans who
are the best at playing this particular game have
vulnerabilities virtually everywhere in the system.
The seamlessness is part of our efficiency. It is also part
of our vulnerability, and I got introduced to this whole thing
when we got into the Y2K issue and discovered that
seamlessness, for me, for the first time. I am interested that
the emergency people in New York, who handled all the
difficulties after the World Trade Center was hit, have said to
Senator Dodd, who has repeated it to me, we could not have
handled this emergency if we had not done the remediation
required with respect to Y2K.
Prior to the Y2K remediation, they were in the stovepipe
mentality, a computer here, a computer there, a system
someplace else. Y2K caused them to look at it in horizontal
terms, and they praised Senator Dodd for his work, I think
appropriately, on Y2K awareness and remediation, because it
addressed this problem. We are now, in the terrorist world,
simply looking at a situation where this same vulnerability
that we identified with Y2K, if the computer should fail by
accident, now what do we do if the computers fail on purpose,
not our purpose, but somebody else's purpose who wants to break
into this infrastructure and cripple us?
So we need to do what we did with respect to Y2K, address
the stovepipes, look at this in a strategic manner and say how
is the entire system to be protected? As Senator Thompson has
said, the majority of the ownership of the entire system is in
private hands, not government hands, which is why I have
introduced a bill to increase the flow of information between
the government and the private sector, back and forth, so that
each one can understand in this seamless situation what is
going on in their particular part of the world.
So I think homeland security and critical infrastructure
protection can come down to two words: Interagency
coordination. Now, if that sounds too bureaucratic, think of
interagency as including private agencies, but coordination of
information, coordination of protection activities,
coordination of understanding so that we do not go around with
the attitude, ``Well, there is no hole in my end of the boat,
so I do not need to worry about sinking.'' With this boat, a
hole anywhere hurts us all, and this is an issue that is going
to be with us for a long, long time. We are just beginning to
understand it. That is why this hearing and others like it are
very worthwhile, because it adds to this continually-building
layer of understanding, awareness, and, we hope, solutions to
this problem.
We cannot go back. We cannot say, ``Let us leave the
computer age and go back to paper and dial telephones.'' We are
in the Internet age. We are in the electronic age, whether we
want to be or not, and we simply have to learn to live with
that new vulnerability. Thank you, Mr. Chairman.
Senator Cleland. Thank you, Senator Bennett. Senator
Voinovich.
OPENING STATEMENT OF SENATOR VOINOVICH
Senator Voinovich. Thank you, Mr. Chairman. I thank
Chairman Lieberman for calling this hearing this morning, and
although he is not able to be with us, we are in good hands
with our Chairman pro tem. Today's hearing focuses on the
protection of our Nation's infrastructure, an aspect of our
society that most Americans tend to take for granted. America's
water and sewer systems, computer, roads and bridges, and
banking networks, they are all things that most Americans use
on a daily basis, but rarely give more than a passing thought.
The events of September 11, however, have changed our way
of thinking forever. Americans are now actually aware of how
vulnerable our infrastructure systems and physical surroundings
can be. That is why it is so critical that we work to protect
that infrastructure. This hearing will give us an opportunity
to examine how we allocate the responsibility of getting the
job done. I would like to just say at this time, Mr. Chairman,
that we are having all of these hearings about the various
threats we face, but we are not discussing the human capital
crisis confronting the Federal Government, which is also a
threat. Our witnesses will be talking to us today about all
kinds of things that need to be done, but the real issue is, do
you have the people in your respective agencies with the
qualifications that you need to get the job done?
From my observation of studying this human capital crisis
for the last 2 years, we are in very bad shape today. Many
people are unaware of the fact that by 2005, about 80 percent
of our Senior Executive Service can retire. Van Harp, a senior
FBI agent here in Washington who used to live and work in
Cleveland told me that, ``I'm running my shop with people that
are ready to go out the door.'' And so as we talk about all of
these things that need to be undertaken, Mr. Chairman, we had
better be aware of the fact that our No. 1 threat is the crisis
that we have in our human capital.
As a former Mayor and Governor, I am very much aware of the
water, sewers, and other infrastructure that we have in this
country. I have to say that even without terrorists, our sewer
and water systems in this country are vulnerable because of
aging. With the new mandates coming out of Washington today, in
my State, for example, sewer rates, and water rates are going
up 100 percent. If we are going to do some of the things that
we are talking about to protect them, it is going to be costly.
And it seems to me, Mr. Chairman, that one of the things that
is missing here in Washington today is that we are not
prioritizing the expenditure of dollars.
Some of the things that I think are high on people's agenda
in terms of spending are much less important than some of the
infrastructure needs that we confront here in our Nation.
So I will be very interested to hear from you in terms of
the cyber problem. I would say this: I remember how worried we
were about Y2K. Do you remember? And we were wringing our hands
and we were worried, could we get the job done and is
everything going to fall apart? Senator Bennett, who is very
familiar with this area, was very much involved in that, but we
got the job done, didn't we? But we did not get it done without
making it a major priority in terms of personnel and the
expenditure of money, and that is what it is going to take if
we are going to protect our infrastructure from this new threat
of terrorism.
Thank you, Mr. Chairman.
Senator Cleland. Thank you, Senator Voinovich. Wonderful
comments by all the Members of the Committee here. Thank you
very much for your participation. I will say as a member of the
Armed Services Committee, 1 week before the attacks, as we were
marking up the defense authorization bill, I personally asked
Senator Pat Roberts, who had been the Chairman of the Emerging
Threat Subcommittee, and Senator Mary Landrieu, who is now the
Chairman of the Emerging Threat Subcommittee, what they thought
was the most probable attack on the United States, where we
were most vulnerable. Both agreed that No. 1--a terrorist
attack below the radar screen, stealth in nature, either
biological or chemical, primarily biological and then cyber
attack.
So on the Armed Services Committee, we have been gathering
data and information for at least a couple of years now that
certainly point to a cyber attack as one of the top two or
three attacks that could come via terrorist means on this
country.
We would like to welcome all of you. Today's first panel
consists of public sector witnesses who represent three of the
primary offices created by the Presidential directive. The
Committee will hear from John Tritak, Director of the Critical
Infrastructure Assurance Office in the Bureau of Export
Administration at the U.S. Department of Commerce; Ronald Dick,
Director of the National Infrastructure Protection Center; and
Sallie McDonald, Director of the Federal Computer Incident
Response Center.
Thank you all for joining us here. Before you begin, just
some rules of the road here. Just let me mention to you that
your full statement will be entered into the hearing record.
You can have an opportunity to make a short statement and you
will be subject to a time limit, according to Committee rules.
Once the light turns from green to yellow, you will have about
a minute to wrap up before the red light appears. If you do not
stop then, we will make you an air marshal out at National.
Thank you for coming.
Tell us a little bit about youselves, and what you do, and
some of your thoughts on the subject. But, before I turn you
loose, let me just say I have been here in the Senate almost a
full term now and on this Committee for well over 5 years. I
had no idea you all existed. So please tell us who you are and
where you came from and what you do.
Mr. Tritak, do you want to start off?
TESTIMONY OF JOHN S. TRITAK,\1\ DIRECTOR, CRITICAL
INFRASTRUCTURE ASSURANCE OFFICE, BUREAU OF EXPORT
ADMINISTRATION, U.S. DEPARTMENT OF COMMERCE
Mr. Tritak. Thank you, Senator, Chairman, and Members of
the Committee. I welcome this opportunity, truly, to be here
before you. We generally feel obligated to say that we applaud
your leadership on various issues. It is almost a canonical
thing you need to say, but, in this case it is absolutely true.
I want to add to the remark that was made earlier that this
hearing, in fact, was supposed to happen before the attack--it
was scheduled before the attack, and underscores the fact that
this Committee recognizes there is a real need to address the
challenges to our critical infrastructures.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Tritak appears in the Appendix on
page 42.
---------------------------------------------------------------------------
As was indicated in the opening remarks by a number of
Senators, we basically have been guided by PDD 63 for about 3
years, and that Directive was created based on recommendations
of an interagency group as well as a Presidential commission.
Jamie Gorelick, who will be appearing in the next panel, was
actually leading that interagency process. So this goes back to
the mid-1990's, in terms of the concerns. It created, as you
indicated, three organizations, a number of organizations;
myself at CIAO, Ron Dick over at the FBI, and Sallie McDonald
over at FedCIRC. Needless to say, after 3 years, we were ripe
for review, a thorough review in terms of the policies that
were established under PDD 63, and frankly, to take a look at
the organizational setup of the Federal Government to determine
where fixes and improvements could be made.
After 3 years of experience and being in the trenches, if
we could not come up with improvements, we really are not doing
our job. And President Bush said as much in May of this year,
in which he directed that the critical infrastructure policy be
thoroughly reviewed with a view towards figuring out ways to
improve the organization of the Federal Government to better
deal with and address the concerns of this issue, which are
extremely complex, as you have all indicated.
He also announced that he wanted, under the directorship of
my office, the Critical Infrastructure Assurance Office, to
begin to prepare a national plan or strategy to be developed
with industry, to develop a consensus in this country, through
a document that would be used to inform and make aware and
educate on what the problems of critical infrastructure are and
what the respective roles and responsibilities of government
and industry are in addressing the problem. We all speak about
this as a critical infrastructure protection program. If I had
it my way, I would strike the word ``protection'' and say it is
critical infrastructure ``assurance''--for the simple reason
that what we are really worried about here is the assured
delivery of vital services over our Nation's critical
infrastructures. Those services are provided by both physical-
and cyber-based assets.
Increasingly, those infrastructures are being restructured
and are increasingly dependent upon information systems and
networks--not just to support their business, but to operate
their assets. They are also becoming more interdependent, so
that disruptions in one sector can actually affect other
sectors, as well. What we learned about September 11, if
nothing else, is now there are at least some groups whose
purpose and goal is to undermine our way of life. They will
exploit vulnerabilities wherever they can find them. We had
some horrific examples of that back on September 11. I suspect
they are not going to stop there.
If they can find and exploit the vulnerabilities of
cyberspace, they are going to do so. So it is incumbent upon
our government to deal with that problem and work closely with
private industry in order to do it. As indicated before,
President Bush had inaugurated a thorough review of government
structure and government policy, and frankly, we were very
close to completing that. In fact, at the time that the
original hearing was going to take place we were close to
finishing that review. Then the horrific events of September 11
intervened--and what we are working on now, and I expect that
the review will be completed fairly soon, is recognition that
this is not just about infrastructure protection, it is about
homeland security, of which the infrastructures themselves are
but a component part.
So what we are trying to do now is identify how and in what
ways we can improve, both organizationally and in policy, to
address the new issues when, in fact--and I will be quite
candid, since one of the roles of my office is to raise
awareness, to draw the various sectors together and identify
common problems across those sectors to involve other sectors
of the economy, like the risk management community, the
insurers, the auditing community, the people who influence the
corporate leaders--is that we had to emphasize the business
case as a way of moving forward. The national security case, in
many cases, but not all, but many cases, is simply not self-
executing in the market.
It seemed too remote to affect day-to-day business
decisions and investments in security. That is not to say
people did not take it seriously, but they had to be able to
justify those kinds of expenditures against their bottom line--
and shareholders and investors who have a whole lot of other
things on their minds. Well, September 11 has just frankly
changed all of that. I do not think anyone doubts anymore what
the needs and importance of investing in infrastructure
security, and particularly taking into account now what needs
to be done that was not done before September 11 when we got
our wake-up call.
So I would say that one of our jobs at the CIAO is to work
toward developing a national strategy, working with Ron Dick,
who is the operational side of PDD 63--with my organization
learning more about the policy-support side--is to address
those issues. And what I expect to happen in the fairly near
term is for the President to be able to provide a much more
comprehensive statement about how homeland security will be
prosecuted and how the critical infrastructure dimension of
that fits into this overall effort.
Thank you for the opportunity to appear here today,
Senator, and I look forward to your comments.
Senator Cleland. Thank you, Mr. Tritak.
Mr. Dick, tell us a little bit about youself, and what you
do.
TESTIMONY OF RONALD L. DICK,\1\ DIRECTOR, NATIONAL
INFRASTRUCTURE PROTECTION CENTER, FEDERAL BUREAU OF
INVESTIGATION
Mr. Dick. Good morning, Senator Cleland and other Members
of the Committee. Thank you for this opportunity to discuss our
government's important and continuing challenges with respect
to critical infrastructure protection. In my written statement
I address our role in protecting the Nation's critical
infrastructures and how we coordinate with other organizations,
both public and private. Last week, while appearing before a
subcommittee of House Government Reform, I heard compelling
testimony from Mark Seton, who is the vice president with the
New York Mercantile Exchange and an eyewitness to the attacks
on the World Trade Center.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Dick appears in the Appendix on
page 52.
---------------------------------------------------------------------------
Although the computer systems and records of the exchange
survived the attack, their communications, transportation, and
power systems were devastated. Working through contacts in
their emergency plans, the exchange opened 3 days after the
attack, helping to stabilize energy markets both here and
abroad. In this case, diesel generators provided the power,
boats provided the transportation, law-enforcement officials
and first-responders provided the secure environment. The
telephone company provided new lines. His experience proves
three things: How our Nation's various infrastructures are
interdependent and vulnerable; how an entity that organizes for
an emergency and plans for redundancy can operationally survive
a major attack; and how the private sector, working with
Federal, State and local agencies, can succeed in mitigating
the damage in a time of crisis.
The mission of the NIPC is to deter and prevent malicious
acts by detecting, warning of, responding to, and investigating
threats to our critical infrastructures. It is the only
organization in the Federal Government with such a
comprehensive national infrastructure protection mission. The
NIPC gathers together under one roof representatives from,
among others, the law enforcement, intelligence and defense
communities, which collectively provide a unique analytical
deterrent and response perspective to threat and incident
information obtained from investigations, intelligence
collection, foreign liaison, and private sector cooperation.
This perspective ensures that no single community addresses
threats to critical infrastructures in a vacuum; rather all
information is examined from a multidisciplinary perspective
for potential impact as a security, defense,
counterintelligence, terrorist, or law-enforcement manner, and
an appropriate response that reflects these issues is
coordinated by decisionmakers. While developing our
infrastructure protection capabilities, the NIPC has held firm
to two basic tenets that grew from the extensive study of the
President's Commission on Critical Infrastructure Protection.
First, the government can only respond effectively to
threats by focusing on protecting assets against attack while
simultaneously identifying and responding to those who
nonetheless would attempt or succeed in launching those
attacks; and second, the government can only help protect the
Nation's most critical infrastructures by building and
promoting a coalition of trust; one, amongst all government
agencies; two, between the government and the private sector;
three, amongst the different business interests within the
private sector itself; and, four, in concert with the greater
international community.
Therefore, the NIPC has focused on developing its capacity
to warn, prevent, respond to, investigate, and build
partnerships all at the same time. As our techniques continue
to mature and our trusted partnerships gel, we will continue to
experience ever-better results. Presidential Decision Directive
63 commanded the National Infrastructure Protection Center to
``provide a national focal point for gathering information on
threats to the infrastructures.'' Additionally, pursuant to
this 1998 Directive, the NIPC provides ``the principle means of
facilitating and coordinating the Federal Government's response
to an incident, mitigating attacks, investigating threats, and
monitoring reconstitution efforts.'' In the 3 years since that
mandate, the NIPC has established an unprecedented level of
cooperation among various Federal and local agencies in the
private sector.
This cooperation was achieved because we have seen the
success of joint multi-agency operations when all members of
the intelligence, defense, law enforcement, and other critical
infrastructure agencies, as well as our private sector
counterparts, combine their widely-varied skills and
specialties toward a single goal. The eight infrastructures set
forth in PDD 63 have recognized that although they are
independent, they are also interdependent and that they must
work together in order to reduce or eliminate their own
vulnerabilities, and the impact one infrastructure may have on
another.
The center has full-time representation from the defense
agencies, numerous other Federal agencies, and the Critical
Infrastructure Assurance Office. We work closely with the
Federal Computer Incident Response Center, as well as the Joint
Task Force for Computer Network Operations at Department of
Defense, and other entities which respond to critical
infrastructure events. Beyond this and moreover, we recognize
the need for a military public-private sector partnership
similar to that in the days of World War II.
We in the National Infrastructure Protection Center
continue to partner with and support lead agencies, such as the
FBI and the Department of Defense. We continue to provide
timely and credible warning information to law enforcement,
counterintelligence, and counterterrorism, and support to all
of our partners in order to fully perform this vital mission.
The center is proud to work with your Committee and the
Executive Branch to ensure that freedom continues to ring
across this Nation.
Thank you very much.
Senator Cleland. Thank you very much, Mr. Dick. Ms.
McDonald.
TESTIMONY OF SALLIE McDONALD,\1\ ASSISTANT COMMISSIONER, OFFICE
OF INFORMATION ASSURANCE AND CRITICAL INFRASTRUCTURE
PROTECTION, U.S. GENERAL SERVICES ADMINISTRATION
Ms. McDonald. Thank you and good morning, Mr. Chairman and
Members of the Committee. On behalf of the Federal Technology
Service of the General Services Administration, let me thank
you for this opportunity to appear before you to discuss our
role in critical infrastructure protection. FedCIRC is a
component of GSA's Federal Technology Service and it is the
central coordination facility for dealing with computer
security-related incidents within the civilian agencies of the
U.S. Government. Our role is to assist those agencies with the
containment of security incidents and to aid them with the
recovery process. This directly supports a critical
infrastructure protection mission because the Federal
Government's agencies depend upon their computer systems, not
only to conduct government operations, but also to provide
final connectivity to the owners and operators of the Nation's
critical infrastructures.
---------------------------------------------------------------------------
\1\ The prepared statement of Ms. McDonald appears in the Appendix
on page 61.
---------------------------------------------------------------------------
Incidents involving new vulnerabilities or previously
unseen exploits require in-depth analysis. Effective incident
analysis is a collaborative effort. Data is collected from
multiple sources, then verified, correlated and analyzed to
determine the potential for proliferation and damage. This
collaborative effort has resulted in the development of an
incident response community that includes FedCIRC, the NIPC,
the National Security Agency, the Department of Defense, the
intelligence community, industry, academia, and individual
incident response components within Federal agencies.
Though the respective missions of these organizations vary
in scope and responsibility, this virtual network enables the
Federal Government to capitalize on each organization's
strategic positioning within the national infrastructure, and
on each organization's unique access to a variety of
information sources. Each entity has a different but mutually
supportive mission and focus, which enables the critical
infrastructure protection community to simultaneously obtain
information from and provide assistance to the private sector,
Federal agencies, the intelligence community, the law-
enforcement community, the Department of Defense, and to
academia.
The unified response to recent threats to the cyber
infrastructure, including the Code Red worm and the Nimbda
worm, clearly demonstrate how these collaborative relationships
work and how each participant's contributions help to assess
and mitigate potential damage. In both instances, industry
alerted the incident response community to the new exploit.
During a previous event, a collaborative communication network
had been established among numerous government agencies
including FedCIRC, the NIPC and the Critical Infrastructure
Assurance Office, in addition to academia, industry, software
vendors, antivirus engineers and security professionals.
This network enabled participants to share details as they
performed analyses and developed remediation processes and
consensus for protection strategies. In the case of Code Red,
through the collaboration of the above-named groups, the
collective team concluded that this worm had the potential to
pose a threat to the Internet's ability to function. An
unprecedented public awareness campaign ensued concurrent with
efforts to ensure that all vulnerable servers were protected.
Statistical information provided by software vendors indicated
an unprecedented rush by users to obtain security patches and
software updates addressing the vulnerabilities. As a result,
the impact of Code Red and its variants was significantly
mitigated and serious impact to Internet performance was
avoided.
Mr. Chairman, the information presented today highlights
the critical and effective relationship that exists between
FedCIRC and other members of the critical infrastructure
community. Though each contributes individually to critical
infrastructure protection, our strength in protecting
information systems government-wide lies in our collaborative
and coordinated efforts. I trust that you will derive from my
remarks an understanding of the cyber threat and response
issues, and also an appreciation for the joint commitment to
infrastructure protection of FedCIRC and the other members of
the critical infrastructure community.
We appreciate your leadership and that of the Committee for
helping us achieve our goals and allowing us to share
information that we feel is crucial to the protection of our
Nation's technology resources. Thank you.
Senator Cleland. Thank you very much, Ms. McDonald. We will
open it up in a minute for a round of questions. Each Senator
will have 8 minutes in order to delve into some of these
questions that plague our country. One of the things that
occurs to me on this particular point of vulnerability to cyber
warfare is a question that I ask myself about the intelligence
community, but what comes to mind is that line by a humorist in
Georgia, now deceased, Lewis Grizzard, who once said that life
is like a dog sled team. If you ain't the lead dog, the scenery
never changes. I am looking for the lead dog. Who is the lead
dog among you here? Is there one? And is that a problem?
In other words, it is interesting, Mr. Dick, you are
director of the National Infrastructure Protection Center, FBI.
Mr. Tritak, you are the director of the Critical Infrastructure
Assurance Office, U.S. Department of Commerce. Ms. McDonald,
you are over in the Federal Computer Incident Response Center,
GSA.
Do we have a lead dog in the Federal Government that runs
the war against cyber terrorism, Mr. Tritak?
Mr. Tritak. Senator, under PDD 63, the lead person for
coordinating government policy on critical infrastructure
protection and assurance issues is the National Coordinator for
Security, Infrastructure Protection, and Counterterrorism at
the National Security Council, and that is Richard Clarke. What
they did is create two basically parallel offices; one for
operational threat assessment and warning and the like. It is
an interagency office that happens to be housed at the FBI.
That is Ron Dick's.
The other was a policy, planning and support group with an
emphasis on dealing with some of the cross-cutting issues of
private industry. So if you ask under the PDD 63 rubric, the
person that has front-line responsibility in oversight is
Richard Clarke over at the National Security Council. As I
tried to indicate before, all this is under review, and what is
being considered now is how to not only accomplish what Senator
Thompson had indicated, which was to establish the lines of
authority, accountability, but, frankly, also what are our
policy priorities. If you have the best organizational chart in
the world, things won't get done unless the matter is a
priority with the backing of the highest guy in the land--the
President of the United States.
I think there is no question under the current
circumstances--and I do not think it was a question before the
circumstances of September 11--that critical infrastructure
protection is going to be a priority for this President. But,
as things are, the policy review process is ongoing, but being
wrapped up and, unfortunately, many of the people who are
involved in finalizing the policy review are also very busy
actually dealing with the terrorist problem we are confronting
at the moment. So if you ask me today: To what extent is PDD 63
still in play? I would say that it is for the interim, but I
would also tell you that is going to change very soon.
Senator Cleland. Mr. Dick, any comments?
Mr. Dick. No, I completely agree with John's comments as to
who is in charge--that is according to the guidelines under
which we exist today and which are under review. I would like
to make one quick comment in agreement with Senator Bennett. No
matter who is in charge, the key to success that we have found
is the building of interagency cooperation to include the
private sector. We in the center, as I said, have been in
existence for about 3 years. We have had a number of
initiatives. One is called InfraGuard, a grassroots effort with
security professionals in both cyber and the physical world, to
share information.
We currently have about 2,000 members throughout the
country. We have chapters in every one of our 56 field offices
at the FBI and even a few more cities across the Nation. We are
working very closely with the information sharing and analysis
centers that are formed within the private sector for banking
and finance and electrical power and water, and we are working
very closely, obviously, with our partners in the Federal
Government to share information, and succeeding in getting
cooperation in that. But the key to that interagency
cooperation is the building of one word, as I said in my
statement, trust.
Trust takes time, but trust is evolving. I think the things
we have seen that Sallie alluded to, with the Leaves virus,
Nimbda, where you saw a combining of law enforcement,
intelligence community, private sector individuals coming
together, really experts in this field, determining what is the
issue, what is the resolution to it and providing to the public
a means by which to mitigate and solve the problem, was truly
successful. And I think that across all infrastructure
protection, as well as homeland security, that is the issue--is
what Mr. Bennett alluded to, is the cooperation between all of
the agencies.
Senator Cleland. Can I just underscore that? It does seem,
and I hate to inflict another comment on you, but I was
thinking about Casey Stengal's great line when he was coach of
the Yankees. He said that it is easy to find the players, but
it is tough to get them to play together. It does seem to me
that the challenge here is the coordination of the existing
assets, I mean, step one, and we are all human beings. We all
have our offices. We all have our departments. We all have our
allegiances. Trusting someone outside that department, outside
the framework is the challenge. In other words, building a team
may be tougher than just putting some names on an
organizational chart.
Mr. Dick. And you are absolutely right and let me, if I
may, give you another, what I think, is a very good example. My
experience in being involved with the center for over 3 years
and being the director for the last 6 months, is that the
people I have dealt with in the other agencies, people I have
dealt with in the private sector, are all trying to do the
right thing. There are no agendas here going on in my opinion.
These are people that are legitimately trying to do the right
thing and figure that out.
One of the things, I think, is a success from our
standpoint is the relationship the center has built up with the
Joint Task Force for Computer Network Operations under General
Bryant in the Department of Defense. General Bryant and I are
in complete agreement about one thing, that I cannot do my job
without JTFCNO and the Department of Defense as an integral
partner. And General Bryant agrees with that same statement. So
we have built, what I think and I think General Bryant does
too, a very good working relationship that is built upon trust
and sharing information, and that information not being used in
a wrongful manner. But that takes time.
Senator Cleland. Mr. Dick, I would like to observe, too,
that we are all trying to do the right thing here, too. If some
person on the National Security Council is the lead dog or the
top coordinator or the ultimate person to which this
information is followed up, that person is not confirmed by the
Congress and it is tough for the Congress to be part of the
team. In other words, I do not think we have the authority to
call up Mr. Clarke and ask him how the war against cyber
terrorism is going? I mean, he is on the National Security
Council. So that is just a challenge for us here as we try to
plug ourselves into our oversight responsibilities.
Ms. McDonald. Well, I certainly agree with both John and
Ron's statements. We have come together as a team, because I
think this community, probably more than others, has recognized
the vulnerabilities in the cyber area, and recognized, as Dick
Clarke frequently says, that there will be an electronic Pearl
Harbor. None of us were expecting the events of September 11,
and we in the cyber community are hoping not to see anything of
that magnitude in this area. But if we do not all come
together, if we do not devote resources, if we do not correct
the human capital situation that Senator Voinovich addressed,
we have a tough job ahead of us and many challenges.
Senator Cleland. Amen. Well said. Senator Carnahan, any
questions?
Senator Carnahan. Certainly, all of us would agree that we
are going to have to be looking into the types of attacks that
we are likely to face, and whether or not we are prepared for
them in the public or private sector. The attacks in New York
and Washington were targeted attacks. Is our infrastructure
equipped to withstand a larger geographical attack on a larger
geographical area? I would address that question to Mr. Dick,
and also, could you explain how NIPC is preparing for such a
scenario, and what steps you are taking to help the private
sector prepare for something of that nature?
Mr. Dick. Thank you. Obviously, whether we are prepared for
a particular attack depends on how big. Obviously, you can make
a threat scenario so large that you eventually lead to--well,
everything is shut down, but in taking what would normally be
perceived by the intelligence community and us as reasonable
threats that are out there, that are potential, that could
occur--I think the private sector and the U.S. Government
entities, as well as State and locals, are preparing
themselves. Are they adequately prepared? No. Like the events
of September 11, no one could have predicted, I think, with any
great certainty that those things could have occurred.
What has happened, though, in the last few years is a
raising of the awareness, if you will, of the need for the
contingency plans that I talked about in my statement by Mr.
Seton, and with the Mercantile Exchange in New York. Because of
those efforts, this particular company took a lot of time and
effort to build these contingency plans. Has North American
Electrical Liability Council and all the electrical power
companies done the kind of contingency planning and
consideration of redundancy issues that they should have?
Probably not, but I think with heightened awareness and
coordinated planning, as Mr. Bennett was talking about, in
cooperation with each other, we can achieve a very robust
ability to respond and survive almost any kind of attack.
Senator Carnahan. Do you feel like you need additional
resources or tools to be able to make NIPC more effective in
this regard?
Mr. Dick. Well, absolutely. We are moving forward right
now. We have submitted a supplemental proposal and we are
working it through the Department of Justice and OMB as we
speak, to address many of those issues to reach what we are
calling full capacity to address these issues as they occur,
and it will be through a phased-in approach. But we have made
that request already. What I think is another issue here, and
it is not just a matter of funding to the NIPC or funding to
the FBI--it is a matter of being able to get the experts in
this area, whether it be in the cyber, whether it be in WMD
issues, in the private sector, at the table with the government
to share what those vulnerabilities are and how those fixes are
occurring. So it is not just a personnel issue for governmental
entities. It is much broader than that.
Senator Carnahan. One final question, Mr. Tritak. Certainly
a key component of our country's ability to recover from a
terrorist attack is the government's ability to continue
functioning. I was wondering if you could discuss what steps
are being taken to ensure that the Federal agencies have the
capability to continue functioning in the event of an attack,
and with whom does this responsibility fall?
Mr. Tritak. Well, Senator, actually, there is one piece of
this I can answer and there is another bit of it that, I think,
probably would be better discussed in another environment about
the continuity of government and how we ensure you have a fully
functioning government under all circumstances. But one thing
we are doing under my mandate, under PDD 63, is to assist
agencies in identifying the key critical services they provide,
identifying the systems that support those service deliveries
as a way of mapping potential dependencies and vulnerabilities
that they have to address and safeguard.
So for example, and I use this in my written testimony, I
think everyone would agree, for example, that a timely warning
of a hurricane would be a vital service the government needs to
provide. Ensuring that service is deliverable--it is not
sufficient simply to make sure that the Tropical Prediction
Center in Miami, Florida works. The fact of the matter is, a
number of inputs from other government agencies and private
sector entities feed into that system. Some of those, if
disrupted for even brief periods of time, could actually impair
the delivery of vital information that warned of hurricanes
with the result in loss of life if it is not brought up
quickly.
So one of the things we are all doing in accelerating, and
this is, in fact, something that is fully supportive of the
efforts that were passed under the Lieberman-Thompson bill of
last year, is to accelerate that mapping process within each of
the civilian agencies, where we focus on the civilian agencies,
because, frankly, the Defense Department, they do this as a
matter of course. So in that respect, what we are looking at is
ensuring critical government services. In some of those cases
they rely on private sector infrastructure service providers to
help. We have given these agencies a way of identifying what
they have to prioritize and pay attention to to ensure that
those services, whether they are Social Security checks,
hurricane warnings, or mobilization of U.S. forces to project
power overseas can be done.
Senator Carnahan. Thank you.
Ms. McDonald. Senator Carnahan, if I could add, the General
Services Administration is also charged with continuity of
government operations. As you probably know, we not only have
the Federal Technology Service, which provides long-distance
telecommunications service and information technology service,
but we also have the Federal Supply Service that has been
instrumental in providing supplies both to New York and the
Pentagon, and we have the Public Building Service where we
provide office space, etc. So we do have contingency plans to
reconstitute government as far as buildings, technology, and
supplies are concerned.
Senator Carnahan. Thank you.
Senator Cleland. Thank you very much. Senator Bennett.
Senator Bennett. Thank you, Mr. Chairman. Mr. Dick, can you
tell us how many people are actually doing analysis in your
information sharing unit?
Mr. Dick. I think there are 10 or 12 that are FBI
employees. I would have to confirm those numbers. From an
interagency standpoint, we probably have another four or five.
Now, that is just doing analysis. Within the center, we have a
total of approximately 90 FBI and 20 interagency folks.
Senator Bennett. I understand that in November 2000 the FBI
director wrote to Sandy Berger complaining that the other
Federal agencies did not recognize NIPC's mission, and he said
NIPC would not be able to provide analysis and warning, if the
NSC did not, in fact, assist NIPC in obtaining personnel. Are
you aware of that letter or of that concern and do you share
that concern?
Mr. Dick. I am aware of the letter and I share that
concern. As I spoke a moment ago, to one of the key factors of
the success of being able to provide strategic analysis, is the
interagency nature of being able to get many people from
different disciplines to look at the same data, and to
determine if the vulnerability in the banking and finance
sector is applicable to the electrical power sector. And that
is one of the findings that was referenced by Mr. Thompson in
the GAO report. In fact, my reading of the GAO report was that
it said we did investigations pretty well and we did outreach
pretty well, because of InfraGuard and some other things, key
asset initiatives. It said we did training pretty well. So we
did a number of things pretty well.
But what it said we did not do very well was strategic
analysis. They said we did not do strategic analysis very well,
meaning predictive analysis, because we did not have the
resources, both from an FBI standpoint, but more importantly,
from an interagency standpoint. And it has been my public
position that GAO was right. You know, their conclusion was
absolutely correct, but----
Senator Bennett. It always bothers you when that happens.
Mr. Dick. Yes, it does, but I try to get over it. We have
been working very diligently with other partners, and there has
been some response from many of the agencies in providing us
resources.
Senator Bennett. That was going to be my next question.
Have things gotten any better since November 2000?
Mr. Dick. They have gotten better. The CIA has provided a
senior officer to head the analysis and warning section, and it
made a commitment for multiple years for that person to be
engaged there. He is an excellent person. Behind me here, the
Department of Defense has sent over a two-star Rear Admiral
from the Navy to be my deputy director for the center, Admiral
Plehal. He is working very diligently with the other Department
of Defense agencies to fill those gaps that we have talked
about before. The National Security Agency has sent over a
senior analyst to head up the analysis and information sharing
unit.
So there have been a number of issues that we have made
progress on. Are there still gaps? Yes, sir, there still are
gaps, but I am seeing greater cooperation, and I think since
the events of September 11, there has been an even heightened
awareness of the need for participation and sharing of
information within the center.
Senator Bennett. Well, let me ask all of you, you have
referred to this collaborative analysis, who has the ultimate
responsibility?
Mr. Dick. For production of products?
Senator Bennett. Yes.
Mr. Dick. Generally, the center is the one that assists in
the production of that and coordinates the production of that,
along with others, particularly in the private sector, and then
pushes those products out. One of the things that you have to
keep in mind, a lot of the solutions are not necessarily
government solutions.
Senator Bennett. Oh, I understand that. I am just talking
about the analysis here, and you are saying it is focused in
the NIPC and the FBI.
Mr. Dick. But it is a collaborative effort, where like--as
Sallie was talking about on the Code Red worm, we bring the
unique skills that each of us possessed together to look at a
particular problem or issue, and then come up with mitigation
or a solution. So it is not us in the center alone. It is a
partnership with the others, a big partner, private sector, the
antivirus community, and the other software vendors.
Senator Bennett. Yes, and that is what my legislation is
trying to address, to increase that partnership with the
private sector, but if the Chairman can quote baseball, if I
were advising Tom Clancy on his next novel, who would be the
official who would go running to the Oval Office and say, ``Mr.
President, an attack is coming,'' and our analysis shows this
from the private sector creates a pattern that we discover that
holds with the Defense Department, and the CIA tells us and so
on. Our analysis shows that there is going to be a major
incident coming, on the Tom Clancy mode, would that be Dick
Clarke who would go forward with that? Would that be the
director of the FBI? Would the director of the FBI tell the
Attorney General? Who? Who ultimately is the one in whose mind
that the alarm bell should go off that, ``Hey, this pattern of
analysis shows we have a major, major vulnerability here, and
it looks like somebody is getting ready to exploit it?''
Mr. Dick. Yes, I think it would be a collaborative effort.
Obviously, we are in direct contact with Mr. Clarke and the
National Security Council almost on a daily basis because of
the events of today. So when you are saying who is going to run
and brief the President, those briefings that occur every day
with the Attorney General, the director of the FBI, and
representatives from the National Security Council. In the kind
of event that you are talking about, there are sensors out
within the private sector, but also within CIA, NSA, DOD, the
FBI, and all of that intelligence is churned together to make
those briefings. So I do not know that there is a person that
would be running up to the President.
Senator Bennett. Do you have any expectation, and I realize
this is speculation, but let's speculate--do you have any
expectation that Governor Ridge will become that person?
Mr. Dick. I have not seen the final--or I have seen a draft
of the executive order, but I do not know how that is all going
to flesh out.
Senator Bennett. Either of the other two? Do you have any--
Mr. Tritak. I will venture a speculation, which hopefully I
will not pay for. [Laughter.]
Senator Bennett. We will protect you.
Mr. Tritak. I think it is fair to say that just based on
administration statements recently, there is going to be
someone who will be responsible for this--recognizing there are
channels of constant communication on intelligence matters with
the FBI and everybody else--there will be somebody who will, in
addition, have a responsibility for reporting those sorts of
things to the Cabinet and therefore the President. It is a
question of who and under what circumstances, and I think that
is what is actually being worked out.
I think what is informing your question is the recognized
need to ensure is that there is someone with sufficient
authority, accountability, and has the ear of the President who
is going to be able to communicate these concerns in a timely
manner, and I think that there is every effort from what I can
tell, just in the various reviews that have been going on at an
accelerated pace, that the answer will be yes, there will be
someone responsible. What we cannot tell you now is who, for
sure.
Senator Bennett. If I may, Mr. Chairman, I am asking these
questions of the administration. If someone were to turn the
tables and say who in the Senate would be the one to alert
Leader Daschle, we would not have an answer to that on this
side of the dais. Thank you very much for your testimony and
for your service in this area.
Senator Cleland. Thank you very much, Senator Bennett.
Senator Domenici.
OPENING STATEMENT OF SENATOR DOMENICI
Senator Domenici. Thank you, Mr. Chairman. I apologize for
being late and I am sorry I did not get to hear whatever you
had to say before I arrived.
I just want to make two observations, Mr. Chairman. It
would be good to have before us how many meetings we have had
of this type, talking about better coordination among the
important aspects of the government and the people, so that
they know what is happening and what might beset them and their
families. Most of those hearings would be drab and dull, and
maybe if the Committee had not reported so many bills during
the year, it might report one on the subject of coordination,
so that we would not just add to another tall list of
coordination requirements.
I will not say people in the government will not follow
them, but I would suggest there would not be a great deal of
urgency about getting them operative, solving problems within
the legislation that requires meeting for this and meeting with
this leader or that person. I would hope that has ended, and I
would hope that you, Mr. Chairman, and the Chairman of the
Committee, would consider the subject matter of this hearing
something serious enough that within a very reasonable time, it
should be achieved.
We should have legislation that does something with
reference to this area of infrastructure, organizationally
speaking, so as to preserve it and make sure we know what we
are doing and others can rely upon what we know. I happen to
have a bill that is before us, S. 1407, the Critical
Infrastructure Protection Act. It follows in tandem with what
we understand the President's proposals are going to be, by way
of executive order. I am hopeful that soon, whatever other
bills are going to be introduced and considered, that our
Chairman will proceed with dispatch to mark up this kind of
bill, unless to be effective, we need to do a lot of other
bills.
I have not passed judgment on that yet myself, but
obviously a very big vacuum existed in terms of communicating
to someone about a problem that was going to fall upon our
people on that now infamous day, September 11. I compliment you
and this Committee, because I think this is not normally very
exciting work. But we ought to do something with the smartest
people we have and the equipment we are capable of buying and
putting in place if we think the problem is serious enough. We
surely can do much better than we have done, and we can have in
place within a year something much better than we have by way
of infrastructure safety, cooperation, and information
exchange.
Thank you for what you all do. I am going to wear my other
hat, which I am a little bit better known for, the budgeting
part, and I am going to go talk about the stimulus. I have
already chatted with you, so I kind of know what you think.
Maybe we can get something done on that quickly, too, let's
hope.
Thank you, Mr. Chairman.
Senator Cleland. Thank you, Senator Domenici. Thank you for
stimulating and underlining the need for increased coordination
and cooperation on this vital issue of security, in terms of
our cyber world, both public and private, and just to point out
and underscore the Senators concern if we cannot get together
public entities, private entities, Legislative and Executive
Branches--if we cannot get together now, under these
circumstances, when will we ever get together? So that is our
charge.
We would like to thank the panelists for your time and
attention. Thank you very much. We would now like to call the
second panel.
We thank you all very much for coming today, and we would
like to welcome Frank Cilluffo. He is the senior policy analyst
and deputy director for the Global Organized Crime Project,
from the well-known and well-respected Center for Strategic and
International Studies, which I understand the board of trustees
is chaired by my friend, Senator Sam Nunn, from Georgia. You
are a senior policy analyst and recently chaired two homeland
defense committee hearings on counterterrorism and cyber
threats and information security at CSIS. We welcome you today.
Jamie Gorelick, the Vice Chair of Fannie Mae, who, as you
know, is a private shareholder-owned company that works to make
sure mortgage money is available for people in communities all
across America. We welcome you today.
Joseph Nacchio, Chairman and CEO, Qwest Communications, and
Vice Chairman of the National Security Telecommunications
Advisory Committee. We would like to learn more about that.
Qwest Communications offers local and long distance telephone,
wireless, and Internet web hosting services over a state-of-
the-art network to homes, businesses and government agencies in
the United States and around the world.
Kenneth Watson, President, Partnership for Critical
Infrastructure Protection Security, who is very much involved
in dealing with these threats and vulnerabilities,
countermeasures and best practices within and between
industries. We are delighted to welcome all of you here.
May I just throw out a couple of questions here that you
can respond to, please? The President has put forward the
notion of an Office of Homeland Defense. It is interesting that
it has cabinet-level status, and it needs it, and the office
will report directly to the President, and I think that is very
much needed. However, interestingly enough, the Rudman-Hart
Commission that looked for 2 years at the question of American
defense focused more and more, because of the testimony they
received, on a terrorist attack and concluded that--a year ago,
in their report--that it was not a question of whether a
terrorist attack would come on this country, but when, and
therefore recommended a full-blown agency of homeland defense,
in effect with a budget of its own and, in effect, infantry,
troops, people at its command, Border Patrol and so forth, the
Coast Guard and the like, that could be put into operation in
terms of homeland defense.
We just want to let you know that is something that is on
my mind as you now have an opportunity to give an opening
statement, and we will start off with Ms. Gorelick.
TESTIMONY OF JAMIE S. GORELICK,\1\ VICE CHAIR, FANNIE MAE
Ms. Gorelick. Thank you very much, Senator Cleland, and I
very much appreciate the opportunity to be here. I testified on
this subject, I think, the first time before this Committee in
July 1996, and I said at the time that I hope we would not have
to see the electronic equivalent of Pearl Harbor before we did
something substantial. We have not had an electronic Pearl
Harbor, but we have had a Pearl Harbor, and it, I think, puts
what we are doing as a country in a different perspective.
---------------------------------------------------------------------------
\1\ The prepared statement of Ms. Gorelick appears in the Appendix
on page 70.
---------------------------------------------------------------------------
As Senator Thompson said just a little while ago, we are
seeing things through different glasses. I have a long interest
in this issue. I came to the Department of Justice from the
Department of Defense. At the Department of Justice, where I
served as deputy, I was in a position--not unique, but there
are not very many people who see both domestic and foreign
intelligence on a daily basis--that caused me to be very
concerned about our national infrastructure and the lack of
responsibility for protecting it, particularly in the area of
cyber security (but also our entire national infrastructure).
We started a Working Group which resulted in a Presidential
Commission, which resulted in PDD 63. I have been long
interested in these issues. I currently serve on the Director
of Central Intelligence National Security Advisory Panel and on
President Bush's National Intelligence Review Panel. So I have
kept an interest in these things. I am here as Vice Chairman of
Fannie Mae, to comment on the readiness of the financial
services sector of our economy, but also with this background.
So let me make a couple of comments and see if I can come
back to the question that you posed, Senator Cleland. We have
realized as a country, for now 5 or 6 years, that we need to
have a hardened-against-attack private and public
infrastructure. We need to have the comprehensive ability to
detect intrusions. We need to have comprehensive planning,
warning, and operational response capabilities.
The two original actions that emerged from the Presidential
Commission did, as we just heard from the last panel, create
two efforts, a law-enforcement effort and an effort to get
industry to where it needed to be. There has been progress, but
frankly it has not been enough. The events of September 11
serve, if nothing else, as a wake-up call. From the point of
view of industry, the original concept was that industry should
be encouraged, if you will, to work together to form such
things as the Partnership for Critical Infrastructure Security,
and various information sharing analytic centers, to work
together.
That made sense, because industry asked the Commission not
to put in place government command-and-control of industry
infrastructure. And there was, as you have heard from the
previous panel, a decided lack of trust between industry and
government. So the first step was to build trust and each
industry was to be encouraged to work together. Various of
these information sharing and analysis centers have, in fact,
been stood up. I would say to you--and I have submitted my
testimony in greater length on this subject--that there is an
uneven range of results, uneven participation, uneven
robustness of capacity. And in some industries, the effort is
still nascent.
These ISACS, by and large, have no funding, no permanent
staffing, no real operational capability. So when you point
out, Senator, as you have quite appropriately, that 90-plus
percent of the information infrastructure on which this
country's security rests belong in the private sector, that
private sector's organizations to deal with this issue are not,
I think, where they need to be. I think now, perhaps with the
greater sense of urgency, there will be a greater willingness
on the part of industry to step up to the plate and also to
accept help from the government.
I think we need a more realistic approach, one in which the
government does more to bring industry together for the sharing
of information. We need a new legal rubric, and I commend
Senator Bennett for addressing the Freedom of Information Act
issue and the antitrust issue, both of which will bring greater
coordination to and greater flow of information from the
private sector to the government. And we need greater clarity
on chain of command, if you will, within the governmental
structure.
I would say one word about law enforcement. The NIPC is to
be commended for the work that it has done. To the question
that all of you have asked, the FBI is in charge, under PDD 63;
it is very clearly the lead agency. But if you look at the
resources that the FBI in general has had to fight terrorism,
compared to the resources that a CINC would have to protect the
national interest, say, in the Pacific, it is absolutely
dwarfed. There is no relationship between the job and the
resources.
The worry that I have about a coordinator in the White
House is that we will not get to the point of real homeland
security and defense, the way the Defense Department would step
up to it if it had that job. I do not know what the thinking is
in that regard, since I am not in the government. But I would
say to you, having served in both places, there is no one in
the government with the operational capacities and the
wherewithal of our Defense Department. And unless you get to
that level of scale and capacity to protect our national
infrastructure, we will, I am afraid, remain at risk.
There is no one currently doing the kind of planning we
need done, and there is no capacity, for example, that I am
aware of for a military response to a cyber attack on the
private sector.
Thank you.
Senator Cleland. Fascinating testimony, Ms. Gorelick. Thank
you very much. Powerful. Mr. Nacchio.
TESTIMONY OF JOSEPH P. NACCHIO,\1\ CHAIRMAN AND CHIEF EXECUTIVE
OFFICER, QWEST COMMUNICATIONS INTERNATIONAL, INC.
Mr. Nacchio. Thank you, Mr. Chairman and Members of the
Committee for inviting us. It is an honor to be here this
morning. Let me begin by first introducing who we are. We are
not as well-known as most other big companies. We are a 5-year-
old Fortune 100 company. We have 66,000 employees and revenues
of about $20 billion. We provide local, long distance,
Internet, broadband, and wireless services across the United
States and Western Europe, and we own the incumbent local
telephone company in 14 Western States. We also provide
services to agencies of the U.S. Government, notably the
Departments of Defense, Energy, and Treasury.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Nacchio appears in the Appendix
on page 76.
---------------------------------------------------------------------------
I am also testifying today, as you noted earlier, in
addition to my capacity as Chairman and CEO of Qwest, as the
Vice Chairman of the National Security Telecommunication
Advisory Committee (NSTAC), and I bring to that organization
all of my experience in the industry, about 30 years, and a
deep concern on this issue, an issue we have been addressing
for the better part of the last 3 years. In cyberspace, we have
been at war for 3 years. It is now just catching up to the
general consciousness of the country.
We are constantly hit with viruses and almost ironically,
the success that the telecommunications industry has had over
the last 30 years in defending against physical attacks and
nuclear war, has now made us vulnerable in cyberspace. Although
we have moved much of the physical layer out of danger,
although there is still some danger, we now have cyber defense
as one of our biggest issues.
I would tell you though, that instead of focusing just on
vulnerability, we should also look at resiliency. And, as the
President reassured the Nation 2 weeks ago that the state of
the Union is strong, I would tell you this morning and assure
you that the telecommunications infrastructure of this country
is strong.
Our infrastructure and telecommunications is the best in
the world. Our engineers, technicians and workers maintain it
second to none, and we saw that proof on September 11, because
despite the horrific damage at the World Trade Center and at
the Pentagon, most of the Nation's telecommunications and
Internet infrastructure worked flawlessly at a time of
increased demand.
The problems were isolated to the end links in the network.
We had wireless overlays in play. It was far better than most
people, I think, would have imagined. At ground zero in New
York, telecommunications companies put aside their everyday
marketplace rivalries, including ourselves. For example, we
diverted a multimillion dollar shipment of equipment that was
supposed to come to us in the West directly to Verizon, so that
we could restore those central offices down on West Street. We
worked with FEMA to provide communications between the two
critical locations in lower Manhattan the day after the attack,
and we provided Internet connections and services to all who
had lost them.
Similar efforts were made by other telecom companies. We
have a collaborative industry, and in this case, it was praised
by FCC Chairman Michael Powell, who quoted it as a heroic act,
ensuring the world's premier communications network has
continued to be available in times of tragedy. So we should
look at both the vulnerabilities and the resiliency of our
infrastructure, and understand how resiliency came to pass: It
has been through collaborative efforts that have occurred over
the last 20 or 30 years.
The telecom industry understands that our networks are
quite literally the conduits that connect the world and the
essential sectors of the economy, and keeping both our internal
and external networks safe is something that the companies in
our industry do every day and will continue to do. Let me give
you two examples that make this real from our own experience.
First, to defend our internal Qwest physical network from
physical and cyber attack we have implemented a comprehensive
information network security program which includes
classification of the network assets, the implementation of a
complete set of security policies and procedures, extensive
employee training and a plan for disaster recovery and reacting
to disasters.
The NSTAC leadership has broadly circulated the Qwest
program, encouraging the other members of NSTAC to implement a
similar program.
Second, to protect our external networks, just last month
we dedicated 1,000 technical experts to assist our customers
affected by the global Code Red computer virus, which
penetrated our firewalls and took down our customer networks.
Such a quick and comprehensive response is what is necessary
across all networks. But doing it in our own networks is not
enough. Doing it inside the telecommunications infrastructure
is not enough. Other industries need to take similar steps
because we are all interconnected in cyberspace.
It is no longer important to just protect your physical
layer. You have to protect the software layer. We are all
connected. Each company must therefore protect its own network,
assets and people, and all companies must coordinate those
actions. I have some very specific proposals that I think
address this.
First, NSTAC and the National Security Council should
immediately initiate a project to develop benchmarks and
requirements for information security best practices for the
telecommunications industry and its users, because again we are
interconnected. Either NSTAC or another public organization,
such as the National Infrastructure Simulation and Analysis
Center, proposed by Senator Domenici, should be given the
responsibility to extend these clearinghouse and coordination
functions to other industries and other agencies, as well.
Second, I think Congress should remove the perceived
barriers to information sharing. Your legislation, Senator
Bennett, with Senator Kyl, is critical to allow us to share
information safe and secure, so that the information we are
sharing with the government does not fall into the hands of the
perpetrators to begin with, under the Freedom of Information
Act, and we can collaborate without the threat of antitrust,
based upon the national security needs.
Third, and this is very important to us who are fighting
this every day, we need legislation increasing the penalties
for cyber attacks. This is not a humorous subject for hackers.
It has to be a serious subject. It costs money. It costs time.
It puts people in vulnerable circumstances when they lose their
communications infrastructure. We need to give law enforcement
greater latitude to investigate and to prosecute these attacks.
Let me conclude by saying that the telecommunication
infrastructure is strong. There is more work to be done, but it
can and must be made stronger, and I know that we at Qwest and
my colleagues in the communication industry will do whatever is
necessary to help this Committee, the Congress and the
administration to ensure the continued strength of America's
telecommunications infrastructure.
Senator Cleland. Thank you very much, sir, for that very
strong testimony. Mr. Cilluffo.
TESTIMONY OF FRANK J. CILLUFFO,\1\ CO-CHAIRMAN, CYBER THREATS
TASK FORCE, HOMELAND DEFENSE PROJECT, CENTER FOR STRATEGIC AND
INTERNATIONAL STUDIES
Mr. Cilluffo. Mr. Chairman, Senator Bennett, it is a
privilege to appear before you today to discuss this important
matter. In the wake of the terrorist attacks on the World Trade
Center and the Pentagon, the United States is confronted with
harsh realities.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Cilluffo appears in the Appendix
on page 83.
---------------------------------------------------------------------------
Our homeland is vulnerable to physical attack and gone is
the sense that two oceans that have historically protected our
country can continue to protect Americans. The terrorists
attack highly visible symbols, not only of military strength,
but also of our economic prowess. Though exceedingly well-
planned, coordinated and executed, the comparatively low-tech
means employed by the terrorists raises the possibility of a
cyber strike or perhaps a more inclusive, more sophisticated
assault combining both physical and virtual means on one or
several critical infrastructures.
As we will never be able to protect everything, everywhere,
all the time, from every adversary and every modality of
attack, now is clearly the time for clearheaded prioritization
of policies and resources. Unless we examine this issue in its
totality, we may simply be displacing risk from one
infrastructure to another. We need to approach the issue
holistically and examine the dangers posed to our critical
infrastructures from both physical attack, a well-placed bomb,
and cyber attack, and perhaps most important where the two
converge.
Infrastructures have long provided popular terrorist
targets. Telecommunications, electric power systems, oil and
gas, finance and banking, transportation, water supply systems,
and emergency services have been frequent targets to terrorist
attacks, and I listed a bunch in my prepared remarks. The
destruction or incapacitation could have a debilitating effect
on U.S. national or economic security, clearly the reason for
this hearing and others.
One should state that bits and bytes or bugs and gas, for
that matter, will never replace bullets and bombs as the
terrorist weapon of choice. Al Qaeda, in particular, chooses
vulnerable targets and varies its modus operandi accordingly.
They become more lethal and more innovative with every attack.
While bin Laden may have his finger on the trigger, his
grandchildren may have their fingers on the computer mouse.
Moreover, cyber attacks need not originate directly from Al
Qaeda, but from those with sympathetic views, and given the
anonymity of cyberspace, it is very difficult to discern who is
really behind the clickety-clack of the keyboard.
For too long, our cyber security efforts have focused on
the beep and squeak issues, and it focused on the individual
virus or hacker du jour in the news, often to the neglect of
the bigger picture. It is now time to identify gaps and
shortfalls in our current policies, programs and procedures,
begin to take significant steps forward and pave the way for
the future by laying down the outlines of a solid course of
action that will remedy these existing shortcomings.
Along these lines, there have already been a series of
actions taken, some prior to September 11, some post. In
particular, I do applaud the creation of the new cabinet-level
Office of Homeland Security, directed by Governor Ridge. It is
my understanding that a comprehensive review will be completed
by next week, which will set out the office's roles, missions,
and responsibilities. We will then have a better sense of the
explicit roles and responsibilities pertaining to homeland
security and how they directly impact critical infrastructure
protection, and as was mentioned earlier, there was already an
executive order in the works, about to be signed, on cyber
security. So this is clearly something the President has been
engaged in, in advancing our cyber defenses, for quite some
time.
To get to the point you have brought up earlier, Mr.
Chairman, this attack was a transforming event. Many have
claimed that the Office of Homeland Security may not have the
authority to succeed. Well, I disagree. One cannot look to
history alone to identify what organizational model will be
most effective. Because this is the highest priority facing our
Nation today, organizational charts, titles, and line items,
boxes, historic emblems of bureaucratic power, fade to the
background. Governor Ridge will have the ammunition required to
carry out his responsibilities because he and his mission have
the full confidence of the President of the United States.
But even an undertaking of this importance takes time to
move from concepts to capabilities. Once the immediacy of the
problem has settled into routine, perhaps several months from
now, we should consider codifying and institutionalizing its
mission with congressional legislation and additional statutory
authority if needed, but I think we have to crawl before we
run. As both the Executive Branch and the Congress consider how
best to proceed in this area, we should not be afraid to wipe
the slate clean and review the matter with fresh eyes.
We need to be willing to press fundamental assumptions of
national security. Critical infrastructure protection and
information assurance are cross-cutting issues, but our
government is still organized along vertical lines in their
respective stovepipes. When we do this review, we should do it
with a critical eye, not only one that appreciates how far we
have to go, but also where we have come, and there have been
some centers of excellence, both in government and the private
sector, that we should leverage and build upon.
Ultimately, it is essential that any strategy encompasses
prevention, preparedness and incident response, vis-a-vis the
public and private sectors and the interface between them. What
we need is a strategy that would generate synergies and result
in the whole amounting to more than simply the sum of its
parts, which is currently the case.
Information technology's impact on society has been
profound and touches everyone, whether we examine our economy,
our quality of life, or our national security. Unfortunately,
our ability to network has far outpaced our ability to protect
networks. Though the myth persisted that the United States had
not been invaded since 1812, invasion through cyberspace has
been a near-daily occurrence, a marked counterpoint to
September 11 attacks.
Fortunately, however, we have yet to see the coupling of
capabilities and intent, aside from foreign intelligence
collection, where the really bad guys exploit the really good
stuff and become technosavvy. We have not seen that marriage,
but in my eyes that is a matter of time. Let me jump very
briefly--I have laid out a number of recommendations that I
thought we should be looking to in terms of building this
partnership. As to who is responsible, it is a shared
responsibility.
The government must, however, lead by example. Only by
leading by example and getting its own house in order can they
expect the private sector to commit the resources in both time
and effort to get the job done, and we need to clarify
accountability. We need to clarify roles and missions. Right
now, there really is no one held accountable, and clearly that
is going to be something that will be examined with all the new
executive orders.
Let me skip through the rest and close with a couple of
initiatives that can be taken to incentivize the private
sector. First, from the government perspective, by improving
the resilience of our economic infrastructure we improve the
government's readiness, because so many of these critical
functions are owned and operated by the private sector. But,
second, we also improve our economic security, which cannot be
seen as black or white. These are now blurred.
We need to encourage standards to incentivize the private
sector. We need to improve information sharing, and I
wholeheartedly applaud Senator Bennett's initiative in this
area, because FOIA has been a significant obstacle to sharing
information between the public and private sector. We can also
look at liability relief. Government could provide
extraordinary liability relief to the private sector in the
case of cyber warfare, similar to the indemnification authority
set up in the case of destruction of commercial assets during
conventional warfare. So these are some of the areas we can
look to.
Mr. Chairman, I know I am over my time. I have rarely had
an unspoken thought. Forgive me, but not to digress, but I
would like to close by saying thank you. We have all done some
soul-searching in the last couple of weeks. I, for one, have
never been so proud to be an American, proud of our President,
proud of our Congress, and proud of the millions of Americans
that make this country great. I believe we have all emerged
from this with a stronger sense of purpose and appreciation of
our Republic and its institutions.
This is precisely what our forefathers had in mind. We were
put to the test. We will prevail. They will fail. And critical
infrastructure protection is clearly an important element to
improving our Nation's security.
Thank you, Mr. Chairman.
Senator Cleland. Thank you, Mr. Cilluffo. Wonderful, strong
statement. We are proud of you, too, and all of you.
Mr. Watson.
TESTIMONY OF KENNETH C. WATSON,\1\ PRESIDENT, PARTNERSHIP FOR
CRITICAL INFRASTRUCTURE SECURITY (PCIS)
Mr. Watson. Good morning, Mr. Chairman and Senator Bennett,
I am honored to be here today on behalf of the more than 70
companies and organizations from all the critical
infrastructure sectors that comprise the Partnership for
Critical Infrastructure Security, or the PCIS. The question:
``Critical infrastructure protection: Who is in charge?'' is
timely, but may not have a quick and easy answer, as we have
heard many times today.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Watson appears in the Appendix on
page 98.
---------------------------------------------------------------------------
We would all like to be able to turn to a single government
or industry executive or agency with the authority and
responsibility to assure the continued delivery of vital
services to our citizens in the face of these new and emerging
threats. The truth is that the infrastructure architecture
requires a distributed leadership, cooperation, and partnership
to accomplish that goal, exactly what Senator Bennett said
earlier.
I would like to describe for you the environment of the
critical infrastructures, explain what we were doing before the
horrendous attacks 3 weeks ago, and what has changed since
then. I will also make a few recommendations.
Over the last 10 to 20 years, the network of networks has
truly changed the way we live and work. There is no turning the
clock back. This has brought about unprecedented levels of
productivity and profitability; however, each industry is now
more dependent on every other than before, and all have come to
depend on computer networks for core operations, not just as a
business enhancing tool.
The Federal Government cannot function without services
provided by the private sector infrastructure owners and
operators. Most of these are multinational corporations with an
interlaced network of suppliers, partners and customers, many
of whom are outside the United States. The Internet itself
relies on key name servers and routers located around the world
with no central ownership or authority. Therefore, the health
of the global economy is directly related to America's national
and economic security.
Just as the Internet is open, borderless, international and
unregulated, responsibility for protecting critical
infrastructures is distributed among companies and government
organizations. Form follows function. This applies not only to
architecture, but also to how we organize to protect our
critical infrastructures. Even with the best of intentions and
the most modern tools, the Defense Department could not defend
against a cyber attack on the information systems of a power
plant in Omaha. That power plant must have the technologies and
teams to defend itself and to prevent cascading effects beyond
its own perimeter, and it must be connected to a distributed
indications and warning system in order to be able to respond
quickly and proactively.
Also, since every unsecured computer connected to the
Internet could be used as a zombie in a distributed denial-of-
service attack, these tools, teams and warnings must become
part of every business' standard networking procedures.
Activities that an enterprise can take: Conducting
vulnerability and risk assessments; deploying security
technologies; investing in research and development; resourcing
and enabling incident response teams must now be distributed
and coordinated.
Many in industry and government have been focusing on how
to accomplish this coordination for at least the last 5 years.
The President's National Security Telecommunications Advisory
Committee, or NSTAC, has been providing advice on national
security and emergency preparedness issues in the
telecommunications sector since 1982. The NSTAC is still
extremely relevant, even more today, conducting studies and
holding network security information exchanges on current
issues.
The President's Commission--as has been mentioned several
times--on Critical Infrastructure Protection, reported in
October 1997, recognizing the need for close public-private
coordination, that applies to all the infrastructure sectors.
Industry responded to the government's invitation to a dialogue
by launching the Partnership for Critical Infrastructure
Security at the World Trade Center in December 1999. Since its
formation, the PCIS has become a model for cross-sector
coordination and public-private cooperation.
Last year, the PCIS identified barriers to information
sharing with government, and now Senator Bennett's bill and
others in Congress are working through legislation based on our
findings. During the response to the Code Red worm, government
and industry turned to the PCIS to represent industry alongside
the NIPC and security experts as we made the public service
announcement that ultimately blunted the impact of that
infestation. Inthe coming year, the administration will publish
a public-private national plan for critical infrastructure
protection, with industry sections coordinated by the PCIS.
This is not just an American problem. Several countries are
establishing similar partnerships. The PCIS is forming close
relationships with them and we are collaborating several areas.
We are currently working with critical infrastructure
protection organizations in Canada and the United Kingdom, and
we are following similar activity in Switzerland. The United
States and Australia conducted a bilateral meeting in August, 2
months ago, where we agreed to cooperate on security standards
and in other areas.
One of the keys to success is the timely sharing of
information about threats, vulnerabilities, countermeasures and
best practices within and between industries and between the
public and private sectors. Information Sharing Analysis
Centers, or ISACs, are proving their value as both computer
defense centers and awareness vehicles. There are currently
five ISACs in operation: Financial services;
telecommunications; information technology; electrical power;
and oil and natural gas.
These ISACs have shared information on threats to members
and helped their sectors prevent damage and disruption from
threats like the Code Red and Nimda software worms. The telecom
ISAC is able to share vital information from the government to
industry that has been proved both valuable and timely. Four
additional ISACs are in various stages of development:
Railroads; aviation; water; and information service providers,
or ISPs. One of this year's top goals for the PCIS is to
establish a cross-sector and public-private information sharing
architecture.
With the same goal, the existing ISACs, under the
leadership of the National Communications System, met last week
to work out a cross-sector operational information exchange
capability. This meeting greatly accelerated the progress we
have made in this area and the procedures they develop will
form the foundation for the overall cross-sector architecture.
What has changed since September 11? The terrorist attacks
on the World Trade Center and the Pentagon did not change the
architecture of the new economy or our interdependency, or the
interlinked nature of the economy's national security in the
nations of the world. What those attacks did was create a sense
of urgency and an increase in security awareness. Just as the
administration carefully and deliberately seeks out those that
conducted and supported these barbaric acts and learns about
this new battlefield environment, I urge everyone involved to
take the time to understand the infrastructure environment and
not to move too quickly to try to solve the infrastructure
protection problem.
So what can we do to protect our critical infrastructures?
We need to raise the security bar worldwide, by streamlining
communication and coordination, accelerating research and
development, practicing good network security, and by not
abandoning our values. I have four recommendations: First,
support the administration initiatives to streamline
coordination within the Federal Government. We will continue to
work closely with the Critical Infrastructure Assurance Office,
the National Infrastructure Protection Center, and the national
coordinator, as the government organizes itself to manage
homeland security, counterterrorism, and critical
infrastructure protection.
Second, support initiatives that will secure the next
generation's network of networks, as well as patches and fixes
we are applying today, by providing resources to government
agencies with increased responsibilities in this area and
providing funding for research. To assist in this effort, the
PCIS is developing a research and development roadmap that will
include a gap analysis of current industry, academic and
government programs, and recommendations for focusing resources
to meet sector and cross-sector needs.
Third, encourage government organizations, businesses and
individuals to practice sound information security, starting by
adequately funding network security programs in all Federal
departments and agencies; updating passwords, disallowing
unauthorized accounts and unneeded services and installing
firewalls and intrusion detection are no longer just common
sense, but a matter of cyber civil defense.
And, last, carefully consider the impact of any new
legislation on the freedoms Americans cherish: Individual
privacy; freedom of expression; and freedom of
entrepreneurship. We all understand that without security there
is no privacy, but we must always strive for balance. My
colleagues of the PCIS and I welcome any invitation to discuss
our activities with you at any time. We believe a dialogue
where we can hear your insight and you can hear our concerns
will be healthy and fruitful.
We are all in this together: Industry, academia, the
administration, the Congress, the American people, and we need
all points of view to ensure that our critical infrastructures
continue to meet the needs of every citizen by ensuring the
continued delivery of vital services and enabling the economy
that underpins our security and our way of life.
Thank you very much, and I am happy to answer any
questions.
Senator Cleland. Thank you very much, Mr. Watson. You are
right. We are all in this together.
Mr. Cilluffo, I was fascinated by a comment. If you would
go back in your testimony, if you could find that section where
you said something about the terrorist will not do something--
and ultimately will not give up bombs and bullets. Can you say
that section again? Since you seemed to say that maybe bombs
and bullets, in bin Laden's case, was maybe generational, and
his offspring may have their finger on a mouse or something.
Talk about that section again.
Mr. Cilluffo. If we look at the threat, we need to look at
a full spectrum of threats. If we are focusing on Al Qaeda
specifically, this is an organization that understands the
lethality, has demonstrated the capability, and bombs and
bullets are the effective weapon of choice, and he will
continue to accelerate the capability. If you look at it, even
Al Qaeda, if you go back to Kobar Towers, you saw car bombs,
then you had truck bombs at the African embassies. The U.S.S.
Cole, you had boats as bombs. Now, unfortunately, you have
planes as bombs. So it is more innovative every time, more
lethal every time, he is not, and his followers in Al Qaeda and
this loosely affiliated network of radicals, because what they
really do is they pool resources. There is no monolithic
organization. He is the chief financial officer of this loosely
affiliated organization that brings groups together.
He is not going to be turning to cyber means. They use it,
cyber, for tradecraft, to communicate. Whether they use
stegonography, as some media have said, I do not know, to hide
code messages inside, or whether they use simple code words,
where ``Go walk the dog,'' could mean something very different,
and seemingly innocuous could mean something very different if
they have communications beforehand, and he has demonstrated
the ability to mix very high-tech and very rudimentary low-tech
means of tradecraft, to include communications.
And so I think that it is important to say that when we
look at the terrorist threat today, we need to look at it
holistically. We need to recognize that Al Qaeda is not all
terrorism. You are going to see some that are turning to cyber
means. There is only one official terrorist use of offense
information warfare, and that was the Tamil Tigers of LTTE, who
disabled embassy communications in Ottawa, Seoul, and
Washington. But that is going to change.
What we see mostly are nations--and they are in the
stealing secret business. They are not going to crash systems.
They would be compromising such a valuable method and technique
to steal America's secrets. So we just need to look at it
holistically.
Senator Cleland. Thank you.
Mr. Nacchio, thank you for your testimony. When I saw the
Pentagon smoking and I looked at the Capitol and realized that
the Capitol might be the next target, it was a strange feeling.
So I tried to get on a cell phone. Of course, by now the whole
system was clogged, and my immediate thought, though, was that
we are also under a cyber attack. In other words, they have
jammed our communications. As an old Army signal officer, I
guess that was the first thing that came to my mind. Actually,
I later realized the whole system was overloaded.
Also, you mentioned the reliability of the system. Again,
in my training, the first week I was on active duty I had an
old colonel tell me that, ``Cleland, the secret to reliability
is redundancy.'' Have you learned anything about this, in
effect, instant overload, when the country is attacked or some
spectacular thing happens, have you learned anything in your
world that you are going to do differently? Are you going to
program in more redundancy for a peak usage for a few hours, so
that average citizens can communicate by the millions, which is
what they wanted to do, and I just wondered if you had a
comment on that?
Mr. Nacchio. Well, yes, it is a very pertinent point, and
it really relates to a question you asked an earlier panel that
said how do you protect against a massive attack? The
communication networks are best designed, of course, for a
massive attack. There are many of them, multiple paths,
physical redundancy, multiple fiber paths that you can travel.
What happened in New York and the Pentagon, specifically New
York, is when the towers were on fire, West Street central
office of Verizon went out, so all of southern Manhattan, at
the end point, was taken out. The rest of the nationwide
infrastructure worked well, but you could not get in and out of
southern New York, and similarly the wireless networks and
points did not work if you were going in and out of New York or
in and out of northern Virginia.
But the rest of the Nation, communicating about it, worked
well. So you still have physical points of vulnerability. What
we learned here is that what we used to protect for a nuclear
attack, the same thing could happen with an airplane attack or
if we had a massive fiber cut or if a bridge across the
Mississippi River went down. These infrastructures need to be
protected. So we are not invulnerable to physical attacks, and
that is what was demonstrated, but it is very isolated.
The bigger danger is what my colleague here on the left has
said; it is only a question of time, only a question of time
that what nation-states can do to attack the fiber
infrastructure, terrorists will learn how to do, and you will
see a massive shutdown, and that is what I know national
security has worried about in the past and what we have tried
to assist on, a massive cyber attack that disables nationwide
communications, not just a pair of points, say in New York or
Washington.
Senator Cleland. Then do we in the Federal Government and
many in the private sector need to think about redundancy, some
kind of redundant capability?
Mr. Nacchio. Right.
Senator Cleland. Certain leaders were moved to, in effect,
a redundant headquarters outside of Washington. In the case of,
shall we say, a national emergency in our telecommunications
world, in our cyber world, do we need to be able to have some
kind of built-in redundancy?
Mr. Nacchio. Absolutely, and I think for most of the
infrastructure in this country, you have redundancy. There are
still critical points and there is a limit at the last mile, so
to speak, at some point you are not going to have redundancy,
and that is what we have to be careful of.
Senator Cleland. Thank you.
Mr. Watson, do you have any feeling about your own view
about whether an Office of Homeland Defense is going to be
adequate, or do you feel a cabinet-level agency with budget and
with troops in the field and so forth, massing their assets, is
something we ought to seriously think about? Have you come to a
conclusion on that?
Mr. Watson. There are many agencies and organizations in
the Federal Government that are currently contributing to the
critical infrastructure protection effort. There certainly
needs to be some streamlining. I am in no position to tell the
government how to organize itself, but simply the fact that the
pending executive order seems to indicate that there will be
someone to coordinate critical infrastructure protection, we
believe, is a very positive step, and we look at that as a
parallel effort to what we have at the PCIS, coordinating all
the infrastructure sectors.
Senator Cleland. Mr. Cilluffo, I see your head nodding. Do
you want to come in on that?
Mr. Cilluffo. Oh, no, I pretty much agree. What we will
have to work out are the details, of course. There are a number
of potential executive orders out there, a number of great
ideas and a number of commissions that have come out with
different ideas. What I think you are seeing now is the
amalgamation of the best of the best. There is no right answer.
Whatever answer they choose, though, is in some ways the right
answers, because they are the ones who are going to have to
implement and execute.
So what I say here is let's not rush to judgment. Let's see
where this goes. Six months from now, maybe we are going to see
there is a need for additional statutory authority or very
specific legislative proposals or even access to troops. But I
think let's focus now on the short-term needs requirements,
backfill those threats to be able to withstand, prevent and
preempt an incident, make sure that we are looking at this from
not just the top-down, but the bottom-up; that our emergency
responders and the public health community, for a bio event,
are ready. So I do not disagree, but I think now let's focus on
the short-term and then look to long-term capacity building.
Senator Cleland. Ms. Gorelick, any ideas?
Ms. Gorelick. As I said earlier, I think we do need some
streamlining from the point of view of business to know who is
doing what, operationally. I would make a comment about NSTAC
in that regard. The reason that NSTAC is as robust as it is and
has the capacity that it does, compared to the other ISACs that
are more nascent, is that it was actually stood up by the
government. The CEOs of the industry were, in 1982, named to
the panel. They were given clearances. They get briefings.
There is an extant staff. Industry is not told what to do by
the government, but there is an infrastructure provided.
There are many willing partners in the private sector, and
we have a lot of technical expertise. We understand, from our
own business perspective, the need to have business continuity.
We understand, from our own business perspective, the need for
our partners to have business continuity, but we are in
business, we are unused to collective or collaborative action
of the sort that is really called for here. If you could have
the NSTAC model in each of the other industries, you would have
a much more robust capacity on the part of industry doing the
sorts of things that Mr. Watson is talking about. Other
industries would get caught up to where communications is.
The financial services sector did very well, considering
what happened to it. It does have a lot of individual
redundancy. We have backup centers and we have done a lot of
thinking about hardening those resources. But if we are going
to get where we need to be as industries responsible for this
national infrastructure, I think we need, as I suggest in my
written testimony, more adequate support on an industry by
industry basis. I think we would be all helped by that. I do
not think it is tremendously expensive, and it would
dramatically increase the way that industry and government
communicate with each other, and that industry communicates
across itself.
Senator Cleland. Mr. Nacchio.
Mr. Nacchio. Mr. Chairman, let me just build on that--a
couple of quick thoughts. Something that we do in the private
sector, I think, applies here. If you want to get something
done, define it clearly, focus and align resources, and keep it
simple. Today, when we have a problem on our networks, we are
required under the law to report it within 30 minutes to the
FCC, as Verizon did to Chairman Powell when they had the
outage. If we, NSTAC members, are faced with a cyber attack,
will report it to NSTAC so it can be shared. But just to be
clear, we take care of ourselves. NSTAC does not direct what we
do. We are together.
I have a fiduciary responsibility to make sure my network
does not go down no matter who is attacking. I have my own guys
who protect it. We hire ex-FBI, ex-anybody we can. We are kind
of a nation-state in defending our physical and our cyber
infrastructure. We are happy to share that as long--under the
Freedom of Information Act--as it not get passed out to the bad
guys, so to speak.
So what NSTAC is really good at, which I think was touched
here and why I am involved, is that my biggest job as the vice-
chair is not necessarily working with national security, it is
working with all my colleagues in industry as best I can to
encourage them, based upon what we learned, because we are all
responsible for this, not just the government. But if you can
keep it focused and keep it simple, your pertinent question
about what do you do about homeland defense--I could not tell
you how to organize the government--but I would say keep it
simple.
There are at least a dozen agencies, if something really
bad is happening, we have to call, and that is all good,
including the FBI, the local police, and the FCC. We generally
get on it ourselves to start with. So, I recommend that you can
keep it focused, streamlined, with clear accountability, and,
of course, dedicate the resources.
Ms. Gorelick. I would second that.
Senator Cleland. Thank you. Senator Bennett.
Senator Bennett. Thank you, Mr. Chairman.
Mr. Nacchio, they taught me in high school that nature
abhors a vacuum. Government abhors simplicity. [Laughter.]
Senator Bennett. And may I, as a former customer of US
West, and now one who writes a check to you every month, thank
you for the improvement in service that has come since you took
over. We are grateful that you have put the kind of resources
you have into increasing customer service, and it is not
unnoticed and not unappreciated.
Mr. Nacchio. Thank you.
Senator Bennett. Mr. Nacchio has told us what they did at
September 11. I would be interested, Ms. Gorelick, what Fannie
Mae did with respect to September 11.
Ms. Gorelick. We stayed in business.
Senator Bennett. What kind of challenges did you face?
Ms. Gorelick. We were open for business. Our challenges
were communication with sources of funding. The capital
markets, as you know, were not really operating. We were able
to establish communication with the Fed. We were able to
maintain our communications with our customers.
Basically, what we do, as you know, is fund those who are
making mortgage loans around the country, and, by and large,
the other outlets were, at least for the period of September 11
and for some period after that, not able to function.
Fortunately, for us, we were able to. We have a very robust
system. Like Mr. Nacchio, we try to hire the best. Our head of
security is out of DISA. We have spent a lot of time thinking
about cyber security.
So we were able to function and I think we were able to
perform a real service to those who needed the capital markets
to function. Eventually, those markets came back, but it took
awhile, and I think if you look at what some of the learnings
are, I think a lot of financial services companies have learned
what makes their backup systems work. If you have your backup
system right down the street from your main system, that may
not work. If your backup system is reliant on the same
communications grid, even if it may be in Brooklyn rather than
lower Manhattan, it may not work.
If you have a backup system that relies on the same people
and the people cannot get there, it may not work. Fannie Mae
did not experience any of those problems, and that is partly
good planning and partly good luck, but I think there are a lot
of learnings for the financial services sector coming out of
this event.
Senator Bennett. Thank you.
Mr. Cilluffo, you made reference to the motivations of Al
Qaeda, and I will share with you and put into this record
information that came from a hearing we held in the Joint
Economic Committee on this issue less than 60 days ago, where I
asked one of the witnesses from the CIA if, in fact, the next
terrorist attack would not come in the form of a cyber attack,
because I said, as I said before, if I were someone who wished
this country ill--back to your world, Ms. Gorelick--I would
want to shut down the Fed wire and break into the computer
system that keeps that going. If you could do that, you would
produce long-term devastation.
Ms. Gorelick. If I might suggest, Senator Bennett--I am
sorry to interrupt--but I would actually think it useful to
inquire as to what occurred, because that is a very vulnerable
node, and we saw----
Senator Bennett. We have done that on the Banking
Committee. I sit on the Banking Committee, and I have asked
Alan Greenspan directly about that issue and have had my staff
down at the Fed looking at it for exactly the reason that you
are underscoring. The answer I got from the witness was very
interesting, and, in view of what has now happened, prophetic.
He said, ``Senator, that is because you think the way you
think. To the terrorist, shutting down the Fed wire does not
give him what he wants, which is television footage that can be
broadcast around the world to inflame people,'' and one of the
analysts after September 11 who spoke to us said, ``In a sense,
this attack by Al Qaeda backfired and failed, because what they
wanted to produce was such a reaction out of America as to
create a war of civilizations that would then polarize the
Muslim world on their side. It backfired in that it caused such
revulsion among good Muslims, who said this is not what they
teach in the Koran, that it has driven moderate Arab States and
Muslim States to our side in this confrontation.'' So cutting
down the Fed wire does not give them any footage at all on
international television, and therefore was not a notion that
he looked at.
But we go to the issue of hostile nation-states, and the
ability to shut down the Fed wire would be something that a
dictator in a hostile nation-state could hold this country
hostage, a phone call or a hotline to the President of the
United States, saying, ``Mr. President, we want the following
things done in the international scene, and if they are not,
within 20 minutes,'' or they would probably give him less time
than that, ``the Fed wire will be shut down and the American
economy will come to a screeching halt.''
If we think in strategic terms, isn't that the kind of
long-term protection that we have got to deal with, in addition
to the immediate challenge of terrorists that want to use
kinetic weapons--isn't this the long-term strategic
vulnerability that we have?
Mr. Cilluffo. Absolutely, Mr. Chairman--Senator Bennett.
Senator Bennett. I will take that, but the Senate probably
would not concur. [Laughter.]
Mr. Cilluffo. But let me build on what I thought was such
an important point. The single common denominator of all
terrorism is that it is a psychological weapon intended to
erode trust and undermine confidence in a government, its
institutions, its elected officials, its policies in a region
or, more generally, its values, and on and on and on and on.
This did backfire. It united our country and it united--we
united at home and we built a united front abroad. In the back
of the minds, I think, of the administration, they have done a
wonderful job of keeping this to fighting the really radical
radicals. This is not about Islam. It is about radical Islamic
fundamentalism, which Islam abhors, and we need to keep it that
way.
But, to the cyber question, I do not think there is an easy
answer. Since the end of the Cold War, threat forecasting has
arguably made astrology look respectable, and I do not have a
crystal ball, but I would say that one thing we do want to
think about in terms of conventional terrorist organizations
are combined attacks, where perhaps you detonate your
conventional explosive, big, large, whatever it may be, and you
disrupt emergency 911, so the first responders cannot get to
the scene, or something similar--and we do not want to
advertise too many possibilities.
But you are right. In terms of nations, that is where we
have seen capabilities. There is no question that nations are
doing surveillance, the cyber equivalence of intelligence
preparation of the battlefield, on our networks. And those same
tools to steal secrets can automatically be turned on to deny
service, to attack. So this is something we need to be looking
at, absolutely, and we need to be looking at it in a many-
pronged lens. We need to improve our own computer network,
exploit the ability to steal cyber secrets of others, as well
as good old espionage.
Senator Bennett. If I could just make one quick comment,
Mr. Chairman, before we wind it up. One of the vulnerabilities
that we have to deal with, with the Defense Department, is the
potential ability of an enemy to break into that communications
system and then send the wrong instructions to the CINCs, and
even if they do not, the mere fact that there is the
possibility that they have will cause the CINC not to act on
real instructions until he can be absolutely sure, through
redundancy, that this order did come from the CINC, and in that
process, time is lost, efficiency is lost, and the combination
that Mr. Cilluffo was talking about of a kinetic weapon attack
and then a scrambling of our command and control system or a
threatening of our command and control system that slows down
our response is an additional tool of warfare that we need to
deal with as we are thinking about this in strategic long-
term----
Mr. Watson. Senator Bennett, if I may make an additional
comment to piggyback on that, I spent 23 years in the Marine
Corps, the last eight of which were devoted to what became
information warfare, and we were very much concerned with the
combination of things like electronic warfare, military
deception, psychological operations, destructive capabilities.
But our feeling now in the private sector--and there are many
of us that believe that the center of gravity for this country
has moved to the private sector, because everyone is dependent
on the private sector for the services that the infrastructures
provide, we understand that we are on the front lines of
defense, and I think it is impressive that the board of
directors of the PCIS is all volunteer, and they all represent
presidents and executives from companies like Bank of America,
BellSouth, Consolidated Edison, Union Pacific, Conaco,
Microsoft, and Merrill Lynch. You name the industry association
and they are on the board. We get it, and we are ready to
cooperate and help.
Senator Bennett. Thank you. Thank you, Mr. Chairman.
Senator Cleland. Thank you, Senator Bennett, and thank our
panelists today, wonderful testimony.
In conclusion, talking about the unity that has been
brought about here, I have been often asked about the
historical impact of the attack on September 11, and I quote
Admiral Yamamoto, who planned and executed the attack on Pearl
Harbor, that afterwards he felt he had only awakened a sleeping
giant, and in so many ways that is exactly what has happened.
Thank you all very much. The hearing is adjourned.
[Whereupon, at 11:59 a.m., the Committee was adjourned.]
A P P E N D I X
----------
PREPARED STATEMENT OF SENATOR BUNNING
Thank you, Mr. Chairman.
This is the second hearing on critical infrastructure protection
the Committee has held this year, and I am pleased we are looking at
this issue again.
The first hearing the Committee held was on September 12, the day
after the terrorist bombing. The importance of our security has never
been more evident, as the reality of terrorism on America's soil was
sadly brought home.
Protecting critical infrastructure is a responsibility of all
levels of government and the private sector.
This will require businesses and government to share information
and form alliances in ways they have traditionally not done.
I am hopeful that we can make some good progress in protecting our
critical infrastructure from future attacks over the next couple of
months.
However, we have a long way to go.
In fact, during the September 12 hearing we discussed that too
often in the Federal Government our critical infrastructure is weakened
because simple, common-sense steps are not taken.
This includes not changing passwords routinely or closing accounts
for former employees or contractors.
This leaves us vulnerable to future attacks. We must do better.
I want to thank our witnesses for being here today, and look
forward to hearing more about what else we need to do to protect our
critical infrastructure.
[GRAPHIC] [TIFF OMITTED] T7434.001
[GRAPHIC] [TIFF OMITTED] T7434.002
[GRAPHIC] [TIFF OMITTED] T7434.003
[GRAPHIC] [TIFF OMITTED] T7434.004
[GRAPHIC] [TIFF OMITTED] T7434.005
[GRAPHIC] [TIFF OMITTED] T7434.006
[GRAPHIC] [TIFF OMITTED] T7434.007
[GRAPHIC] [TIFF OMITTED] T7434.008
[GRAPHIC] [TIFF OMITTED] T7434.009
[GRAPHIC] [TIFF OMITTED] T7434.010
[GRAPHIC] [TIFF OMITTED] T7434.011
[GRAPHIC] [TIFF OMITTED] T7434.012
[GRAPHIC] [TIFF OMITTED] T7434.013
[GRAPHIC] [TIFF OMITTED] T7434.014
[GRAPHIC] [TIFF OMITTED] T7434.015
[GRAPHIC] [TIFF OMITTED] T7434.016
[GRAPHIC] [TIFF OMITTED] T7434.017
[GRAPHIC] [TIFF OMITTED] T7434.018
[GRAPHIC] [TIFF OMITTED] T7434.019
[GRAPHIC] [TIFF OMITTED] T7434.020
[GRAPHIC] [TIFF OMITTED] T7434.021
[GRAPHIC] [TIFF OMITTED] T7434.022
[GRAPHIC] [TIFF OMITTED] T7434.023
[GRAPHIC] [TIFF OMITTED] T7434.024
[GRAPHIC] [TIFF OMITTED] T7434.025
[GRAPHIC] [TIFF OMITTED] T7434.026
[GRAPHIC] [TIFF OMITTED] T7434.027
[GRAPHIC] [TIFF OMITTED] T7434.028
[GRAPHIC] [TIFF OMITTED] T7434.029
[GRAPHIC] [TIFF OMITTED] T7434.030
[GRAPHIC] [TIFF OMITTED] T7434.031
[GRAPHIC] [TIFF OMITTED] T7434.032
[GRAPHIC] [TIFF OMITTED] T7434.033
[GRAPHIC] [TIFF OMITTED] T7434.034
[GRAPHIC] [TIFF OMITTED] T7434.035
[GRAPHIC] [TIFF OMITTED] T7434.036
[GRAPHIC] [TIFF OMITTED] T7434.037
[GRAPHIC] [TIFF OMITTED] T7434.038
[GRAPHIC] [TIFF OMITTED] T7434.039
[GRAPHIC] [TIFF OMITTED] T7434.040
[GRAPHIC] [TIFF OMITTED] T7434.041
[GRAPHIC] [TIFF OMITTED] T7434.042
[GRAPHIC] [TIFF OMITTED] T7434.043
[GRAPHIC] [TIFF OMITTED] T7434.044
[GRAPHIC] [TIFF OMITTED] T7434.045
[GRAPHIC] [TIFF OMITTED] T7434.046
[GRAPHIC] [TIFF OMITTED] T7434.047
[GRAPHIC] [TIFF OMITTED] T7434.048
[GRAPHIC] [TIFF OMITTED] T7434.049
[GRAPHIC] [TIFF OMITTED] T7434.050
[GRAPHIC] [TIFF OMITTED] T7434.051
[GRAPHIC] [TIFF OMITTED] T7434.052
[GRAPHIC] [TIFF OMITTED] T7434.053
[GRAPHIC] [TIFF OMITTED] T7434.054
[GRAPHIC] [TIFF OMITTED] T7434.055
[GRAPHIC] [TIFF OMITTED] T7434.056
[GRAPHIC] [TIFF OMITTED] T7434.057
[GRAPHIC] [TIFF OMITTED] T7434.058
[GRAPHIC] [TIFF OMITTED] T7434.059
[GRAPHIC] [TIFF OMITTED] T7434.060
[GRAPHIC] [TIFF OMITTED] T7434.061
[GRAPHIC] [TIFF OMITTED] T7434.062
[GRAPHIC] [TIFF OMITTED] T7434.063
[GRAPHIC] [TIFF OMITTED] T7434.064
-