    [House Hearing, 110 Congress]
    [From the U.S. Government Publishing Office]

                 PRIVACY AND CYBERCRIME ENFORCEMENT ACT OF 2007

    =======================================================================

                                    HEARING

                                   BEFORE THE

                       SUBCOMMITTEE ON CRIME, TERRORISM,
                             AND HOMELAND SECURITY

                                     OF THE

                           COMMITTEE ON THE JUDICIARY
                            HOUSE OF REPRESENTATIVES

                           ONE HUNDRED TENTH CONGRESS

                                 FIRST SESSION

                                       ON

                                   H.R. 4175

                                   __________

                               DECEMBER 18, 2007

                                   __________

                               Serial No. 110-128

                                   __________

             Printed for the use of the Committee on the Judiciary

          Available via the World Wide Web: http://judiciary.house.gov

                         U.S. GOVERNMENT PRINTING OFFICE
    39-708 PDF                 WASHINGTON DC:  2008
    ---------------------------------------------------------------------
    For Sale by the Superintendent of Documents, U.S. Government Printing Office
    Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800
    Fax: (202) 512�092104 Mail: Stop IDCC, Washington, DC 20402�090001

                           COMMITTEE ON THE JUDICIARY

                     JOHN CONYERS, Jr., Michigan, Chairman
    HOWARD L. BERMAN, California         LAMAR SMITH, Texas
    RICK BOUCHER, Virginia               F. JAMES SENSENBRENNER, Jr.,
    JERROLD NADLER, New York                 Wisconsin
    ROBERT C. ``BOBBY'' SCOTT, Virginia  HOWARD COBLE, North Carolina
    MELVIN L. WATT, North Carolina       ELTON GALLEGLY, California
    ZOE LOFGREN, California              BOB GOODLATTE, Virginia
    SHEILA JACKSON LEE, Texas            STEVE CHABOT, Ohio
    MAXINE WATERS, California            DANIEL E. LUNGREN, California
    WILLIAM D. DELAHUNT, Massachusetts   CHRIS CANNON, Utah
    ROBERT WEXLER, Florida               RIC KELLER, Florida
    LINDA T. SANCHEZ, California         DARRELL ISSA, California
    STEVE COHEN, Tennessee               MIKE PENCE, Indiana
    HANK JOHNSON, Georgia                J. RANDY FORBES, Virginia
    BETTY SUTTON, Ohio                   STEVE KING, Iowa
    LUIS V. GUTIERREZ, Illinois          TOM FEENEY, Florida
    BRAD SHERMAN, California             TRENT FRANKS, Arizona
    TAMMY BALDWIN, Wisconsin             LOUIE GOHMERT, Texas
    ANTHONY D. WEINER, New York          JIM JORDAN, Ohio
    ADAM B. SCHIFF, California
    ARTUR DAVIS, Alabama
    DEBBIE WASSERMAN SCHULTZ, Florida
    KEITH ELLISON, Minnesota

                Perry Apelbaum, Staff Director and Chief Counsel
                     Joseph Gibson, Minority Chief Counsel
                                     ------

            Subcommittee on Crime, Terrorism, and Homeland Security

                 ROBERT C. ``BOBBY'' SCOTT, Virginia, Chairman

    MAXINE WATERS, California            LOUIE GOHMERT, Texas
    WILLIAM D. DELAHUNT, Massachusetts   J. RANDY FORGES, Virginia
    JERROLD NADLER, New York             F. JAMES SENSENBRENNER, Jr.,
    HANK JOHNSON, Georgia                Wisconsin
    ANTHONY D. WEINER, New York          HOWARD COBLE, North Carolina
    SHEILA JACKSON LEE, Texas            STEVE CHABOT, Ohio
    ARTUR DAVIS, Alabama                 DANIEL E. LUNGREN, California
    TAMMY BALDWIN, Wisconsin
    BETTY SUTTON, Ohio

                          Bobby Vassar, Chief Counsel

                        Michael Volkov, Minority Counsel

                                C O N T E N T S

                                  ----------

                               DECEMBER 18, 2007

                                                                       Page

                                TEXT OF THE BILL

    H.R. 4175, the ``Privacy and Cybercrime Enforcement Act of 2007''     3

                               OPENING STATEMENT

    The Honorable Robert C. ``Bobby'' Scott, a Representative in
      Congress from the State of Virginia, and Chairman, Subcommittee
      on Crime, Terrorism, and Homeland Security.....................     1
    The Honorable Louie Gohmert, a Representative in Congress from
      the State of Texas, and Ranking Member, Subcommittee on Crime,
      Terrorism, and Homeland Security...............................    13

                                   WITNESSES

    Mr. Andrew Lourie, acting Principal Deputy Assistant Attorney
      General and Chief of Staff to the Criminal Division, U.S.
      Department of Justice, Washington, DC
      Oral Testimony.................................................    20
      Prepared Statement.............................................    22
    Mr. Craig Magaw, Special Agent, Criminal Investigative Division,
      U.S. Secret Service, U.S. Department of Homeland Security,
      Washington, DC
      Oral Testimony.................................................    43
      Prepared Statement.............................................    44
    Mr. Joel Winston, Associate Director, Division of Privacy and
      Identity Protection, Bureau of Consumer Protection, Federal
      Trade Commission, Washington, DC
      Oral Testimony.................................................    48
      Prepared Statement.............................................    50
    Ms. Jaimee Napp, Executive Director, Identity Theft Action
      Council of Nebraska, OMAHA, NE
      Oral Testimony.................................................    71
      Prepared Statement.............................................    72
    Mr. Robert W. Holleyman, II, President and CEO, Business Software
      Alliance, Washington, DC
      Oral Testimony.................................................    76
      Prepared Statement.............................................    79
    Ms. Lillie Coney, Associate Director, Electronic Privacy
      Information Center, Washington, DC
      Oral Testimony.................................................    85
      Prepared Statement.............................................    87

              LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING

    Prepared Statement of the Honorable Louie Gohmert, a
      Representative in Congress from the State of Texas, and Ranking
      Member, Subcommittee on Crime, Terrorism, and Homeland Security    14
    Prepared Statement of the Honorable John Conyers, Jr., a
      Representative in Congress from the State of Michigan, and
      Chairman, Committee on the Judiciary...........................    16

                                    APPENDIX

    Material Submitted for the Hearing Record........................   113

                 PRIVACY AND CYBERCRIME ENFORCEMENT ACT OF 2007

                                  ----------

                           TUESDAY, DECEMBER 18, 2007

                  House of Representatives,
                  Subcommittee on Crime, Terrorism,
                                  and Homeland Security
                                    Committee on the Judiciary,
                                                        Washington, DC.

        The Subcommittee met, pursuant to notice, at 3 p.m., in
    room 2141, Rayburn House Office Building, the Honorable Robert
    C. ``Bobby'' Scott (Chairman of the Subcommittee) presiding.
        Present: Representatives Scott, Jackson Lee, Gohmert,
    Coble, Chabot, Lungren and Conyers (ex officio).
        Staff Present: Bobby Vassar, Subcommittee Chief Counsel;
    Ameer Gopalani, Majority Counsel; Michael Volkov, Minority
    Counsel; and Veronica Eligan, Majority Professional Staff
    Member.
        Mr. Scott. I am pleased to welcome you to the hearing of
    the Subcommittee on Crime, Terrorism, and Homeland Security on
    H.R. 4175, the ``Privacy and Cybercrime Enforcement Act of
    2007.''
        I would like to thank the Chairman of the full Committee,
    Mr. Conyers, for introducing the bill with bipartisan support.
    The bill was introduced at the time by the Chairman and Ranking
    Member of the Committee and the Subcommittee, and I am pleased
    to have been working with Mr. Conyers in drafting it to provide
    effective tools for Federal prosecutors and State and local law
    enforcement agencies to combat identity theft and other
    cybercrimes.
        The Act takes several important steps to protect American
    consumers from the dangers of identity theft. First, our bill
    provides for the victims of identity theft, provides them with
    the ability to seek restitution in Federal court for the loss
    of time and money spent restoring their credit. Under current
    law, restitution to the victims is only available to recover
    the direct financial cost of identity theft offenses, such as
    recovering funds from unauthorized credit card charges.
        But many identity theft victims incur other indirect costs,
    such as loss of wages due to time taken off from work to
    resolve credit disputes. Our bill amends the present law to
    make it clear that restitution orders may include an amount
    equal to the value of the victim's time spent addressing the
    actual or intended harm of the identity theft.
        Second, the bill addresses urgent needs for agencies and
    companies to provide appropriate notification when they
    experience major breaches. The problem of data breaches remains
    a persistent and dangerous threat to Americans' privacy. For
    example, in 2006, there was a disclosure that a company had
    suffered a major computer breach involving up to 45 million
    credit and debit card records. While the company knew about the
    breach, none of its customers were told about it until a month
    later. And we are all aware of the identity theft from 26
    million of our veterans and active duty personnel from the
    Department of Veterans' Affairs last year.
        Although up to 39 States have laws pertaining to data
    breaches, there is no Federal standard or regulation to provide
    notice. Our bill would require rapid notice of breaches to the
    FBI and Secret Service, and this notice is critical to the
    successful investigation and prosecution of any criminal
    activity associated with the breach. The FBI and Secret Service
    would then publish the list of reported breaches in the Federal
    Register so the public would be aware of where and to what
    extent major data breaches are occurring.
        Finally, the bill makes it a crime punishable by up to 5
    years in prison for knowingly failing to report major breaches
    to the appropriate authorities.
        Lastly, this bill provides much needed tools to Federal and
    State law enforcement agents. The bill adds Section 1030 to the
    Computer Fraud and Abuse Act to the RICO statute which will
    provide the Department of Justice with a much-needed tool to
    investigate and prosecute organized crime syndicates which use
    sophisticated cyber schemes to commit criminal acts.
        The bill also authorizes $25 million for each of the fiscal
    years from 2008 to 2010 to establish State grant programs with
    enforcement of cybercrimes. State and local law enforcement
    resources need to be strengthened to attack the low lying
    identity theft that Federal prosecutors fail to go after.
        We heard the last Congress had a Subcommittee hearing about
    the incident involving Senator Dominici where some $800 in
    merchandise was charged to a stolen credit card. We found that
    the crime was not being prosecuted.
        So thieves are left with the knowledge that if they don't
    steal too much, they can do so with impunity. The credit card
    company will cancel the debt, write off the loss, and there
    will be no criminal investigation, and so the thieves can keep
    the bounty of their crimes without worrying about prosecution.
        I believe that the Secret Service working in partnership
    with State law enforcement could quickly reverse this
    expectation that thieves have in this front. H.R. 4175 is a
    comprehensive bill. It not only deals with the need to provide
    law enforcement notice to law enforcement when innocent
    consumers have their data briefed, it also deals with the
    underlying problems of lack of accountability to deter crimes
    from occurring in the first place.
        Our privacy in cybercrimes lag behind both capabilities of
    our technology and the sophistication of identity thieves, and
    this legislation will close that gap.
        [The text of the bill, H.R. 4175, follows:]

    HR 4175 IH  ___________________________________________________

                                                                          I
    110th CONGRESS
        1st Session

                                    H. R. 4175

    To amend title 18, United States Code, with respect to data privacy and
        security, and for other purposes.
                                   __________

                        IN THE HOUSE OF REPRESENTATIVES
                               November 14, 2007
    Mr. Conyers (for himself, Mr. Smith of Texas, Mr. Scott of Virginia,
        Mr. Forbes, Ms. Linda T. Sanchez of California, Mr. Davis of
        Alabama, and Ms. Jackson-Lee of Texas) introduced the following
        bill; which was referred to the Committee on the Judiciary
                                   __________

                                     A BILL

    To amend title 18, United States Code, with respect to data privacy and
        security, and for other purposes.

        Be it enacted by the Senate and House of Representatives of the
    United States of America in Congress assembled,

    SECTION 1. SHORT TITLE.

        (a) Short Title.--This Act may be cited as the ``Privacy and
    Cybercrime Enforcement Act of 2007''.
        (b) Table of Contents.--The title of contents for this Act is as
    follows:

        Sec. 1. Short title.

     TITLE I--ENHANCING PUNISHMENT FOR IDENTITY THEFT AND OTHER VIOLATIONS
                          OF DATA PRIVACY AND SECURITY

        Sec. 101. Organized criminal activity.
        Sec. 102. Failure to provide notice of security breaches involving
    sensitive personally identifiable information.
        Sec. 103. Use of full interstate and foreign commerce power for
    criminal penalties.
        Sec. 104. Cyber-extortion.
        Sec. 105. Conspiracy to commit cyber-crimes.
        Sec. 106. Penalties for section 1030 violations.
        Sec. 107. Additional funding for resources to investigate and
    prosecute criminal activity involving computers.
        Sec. 108. Criminal restitution.
        Sec. 109. Review and amendment of Federal sentencing guidelines
    related to fraudulent access to or misuse of digitized or electronic
    personally identifiable information.

         TITLE II--NON-CRIMINAL PRIVACY ENFORCEMENT AND PRIVACY IMPACT
                                   STATEMENTS

        Sec. 201. Enforcement by Attorney General and State authorities.
        Sec. 202. Coordination of State and Federal efforts.
        Sec. 203. Requirement that agency rulemaking take into
    consideration impacts on individual privacy.

      TITLE III--ASSISTANCE FOR STATE AND LOCAL LAW ENFORCEMENT TO COMBAT
         FRAUDULENT, UNAUTHORIZED, OR OTHER CRIMINAL USE OF PERSONALLY
                            IDENTIFIABLE INFORMATION

        Sec. 301. Grants for State and local law enforcement.
        Sec. 302. Authorization of appropriations.

              TITLE IV--NATIONAL WHITE COLLAR CRIME CENTER GRANTS

        Sec. 401. Authorization and Expansion of National White Collar
    Crime Center.

     TITLE I--ENHANCING PUNISHMENT FOR IDENTITY THEFT AND OTHER VIOLATIONS
                          OF DATA PRIVACY AND SECURITY

    SEC. 101. ORGANIZED CRIMINAL ACTIVITY.

        Section 1961(1) of title 18, United States Code, is amended by
    inserting ``section 1030 (relating to certain frauds and related
    activities in connection with computers)''.

    SEC. 102. FAILURE TO PROVIDE NOTICE OF SECURITY BREACHES INVOLVING
                        SENSITIVE PERSONALLY IDENTIFIABLE INFORMATION.

        (a) In General.--Chapter 47 of title 18, United States Code, is
    amended by adding at the end the following:

    ``Sec. 1040. Failure to provide notice of security breaches involving
                        sensitive personally identifiable information

        ``(a) Whoever, having a covered obligation to provide notice of a
    security breach involving sensitive personally identifiable
    information, knowingly fails to do so, shall be fined under this title
    or imprisoned not more than 5 years, or both.
        ``(b) As used in this section--
                ``(1) the term `covered obligation', with respect to
            providing notice of a security breach, means an obligation
            under Federal law or, if the breach is in or affects interstate
            or foreign commerce, under State law;
                ``(2) the term `sensitive personally identifiable
            information' means any electronic or digital information that
            includes--
                        ``(A) an individual's first and last name, or first
                    initial and last name, or address or phone number in
                    combination with any 1 of the following data elements
                    where the data elements are not protected by a
                    technology protection measure that renders the data
                    element indecipherable--
                                ``(i) a nontruncated social security
                            number, driver's license number, state resident
                            identification number, passport number, or
                            alien registration number;
                                ``(ii) both of the following--
                                        ``(I) mother's maiden name, if
                                    identified as such; and
                                        ``(II) month, day, and year of
                                    birth; and
                                ``(iii) unique biometric data such as a
                            finger print, voice print, a retina or iris
                            image; or
                        ``(B) a financial account number or credit or debit
                    card number in combination with any security code,
                    access code or password that is required for an
                    individual to obtain credit, withdraw funds, or engage
                    in a financial transaction by means of such number;
                ``(3) the term `security breach' means a compromise of the
            security, confidentiality, or integrity of computerized data
            that there is reason to believe has resulted in improper access
            to sensitive personally identifiable information; and
                ``(4) the term `improper access' means access without
            authorization or in excess of authorization.''.
        (b) Clerical Amendment.--The table of sections at the beginning of
    chapter 47 of title 18, United States Code, is amended by adding at the
    end the following:

        ``1040. Concealment of security breaches involving personally
    identifiable information.''.
        (c) Obligation To Report.--
                (1) In general.--A person who owns or possesses data in
            electronic form containing a means of identification and has
            knowledge of a major security breach of the system containing
            such data maintained by such person, must provide prompt notice
            of such breach to the United States Secret Service or Federal
            Bureau of Investigation.
                (2) Publication of list of notifications.--The Secret
            Service and the Federal Bureau of Investigation shall annually
            publish in the Federal Register a list of all notifications
            submitted the previous calendar year and the identity of each
            entity with respect to which the major security breach
            occurred.
                (3) Definition.--In this subsection--
                        (A) the term ``major security breach'' means any
                    security breach involving--
                                (i) means of identification pertaining to
                            10,000 or more individuals is, or is reasonably
                            believed to have been acquired;
                                (ii) databases owned by the Federal
                            Government; or
                                (iii) means of identification of Federal
                            Government employees or contractors involved in
                            national security matters or law enforcement;
                            and
                        (B) the term ``means of identification'' has the
                    meaning given that term in section 1028 of title 18,
                    United States Code.

    SEC. 103. USE OF FULL INTERSTATE AND FOREIGN COMMERCE POWER FOR
                        CRIMINAL PENALTIES.

        (a) Broadening of Scope.--Section 1030(e)(2)(B) of title 18, United
    States Code, is amended by inserting ``or affecting'' after ``which is
    used in''.
        (b) Elimination of Requirement of an Interstate or Foreign
    Communication for Certain Offenses Involving Protected Computers.--
    Section 1030(a)(2)(C) of title 18, United States Code, is amended by
    striking ``if the conduct involved an interstate or foreign
    communication''.

    SEC. 104. CYBER-EXTORTION.

        Section 1030(a)(7) of title 18, United States Code, is amended by
    inserting ``, or to access without authorization or exceed authorized
    access to a protected computer'' after ``cause damage to a protected
    computer''.

    SEC. 105. CONSPIRACY TO COMMIT CYBER-CRIMES.

        Section 1030(b) of title 18, United States Code, is amended by
    inserting ``or conspires'' after ``attempts''.

    SEC. 106. PENALTIES FOR SECTION 1030 VIOLATIONS.

        Subsection (c) of section 1030 of title 18, United States Code, is
    amended to read as follows:
        ``(c)(1) The punishment for an offense under subsection (a) or (b)
    is a fine under this title or imprisonment for not more than 20 years,
    or both, but if the offender in the course of a violation of subsection
    (a)(5)(A)(i) knowingly or recklessly causes or attempts to cause death,
    such offender shall be fined under this title or imprisoned for any
    term of years or for life, or both.
        ``(2) The court, in imposing sentence for an offense under
    subsection (a) or (b), may, in addition to any other sentence imposed
    and irrespective of any provision of State law, order that the person
    forfeit to the United States--
                ``(A) the person's interest in any personal property that
            was used or intended to be used to commit or to facilitate the
            commission of the offense; and
                ``(B) any property, real or personal, constituting or
            derived from, any proceeds the person obtained, directly or
            indirectly, as a result of the offense.''.

    SEC. 107. ADDITIONAL FUNDING FOR RESOURCES TO INVESTIGATE AND PROSECUTE
                        CRIMINAL ACTIVITY INVOLVING COMPUTERS.

        (a) Additional Funding for Resources.--
                (1) Authorization.--In addition to amounts otherwise
            authorized for resources to investigate and prosecute criminal
            activity involving computers, there are authorized to be
            appropriated for each of the fiscal years 2008 through 2012--
                        (A) $10,000,000 to the Director of the United
                    States Secret Service;
                        (B) $10,000,000 to the Attorney General for the
                    Criminal Division of the Department of Justice; and
                        (C) $10,000,000 to the Director of the Federal
                    Bureau of Investigation.
                (2) Availability.--Any amounts appropriated under paragraph
            (1) shall remain available until expended.
        (b) Use of Additional Funding.--Funds made available under
    subsection (a) shall be used by the Director of the United States
    Secret Service, the Director of the Federal Bureau of Investigation,
    and the Attorney General, for the United States Secret Service, the
    Federal Bureau of Investigation, and the criminal division of the
    Department of Justice, respectively, to--
                (1) hire and train law enforcement officers to--
                        (A) investigate crimes committed through the use of
                    computers and other information technology, including
                    through the use of the Internet; and
                        (B) assist in the prosecution of such crimes; and
                (2) procure advanced tools of forensic science to
            investigate, prosecute, and study such crimes.

    SEC. 108. CRIMINAL RESTITUTION.

        Section 3663(b) of title 18, United States Code, is amended--
                (1) by striking ``and'' at the end of paragraph (4);
                (2) by striking the period at the end of paragraph (5) and
            inserting ``; and'' and
                (3) by adding at the end the following:
                ``(6) in the case of an offense under section 1028(a)(7),
            1028A(a), or 1030(a)(2), pay an amount equal to the value of
            the victim's time reasonably spent to remediate actual harm
            resulting from the offense.''.

    SEC. 109. REVIEW AND AMENDMENT OF FEDERAL SENTENCING GUIDELINES RELATED
                        TO FRAUDULENT ACCESS TO OR MISUSE OF DIGITIZED OR
                        ELECTRONIC PERSONALLY IDENTIFIABLE INFORMATION.

        The United States Sentencing Commission, pursuant to its authority
    under section 994 of title 28, United States Code, and in accordance
    with this section, shall review and, if appropriate, amend the Federal
    sentencing guidelines (including its policy statements) applicable to
    persons convicted of using fraud to access, or misuse of, digitized or
    electronic personally identifiable information, including identity
    theft or any offense under--
                (1) sections 1028, 1028A, 1030, 1030A, 2511, and 2701 of
            title 18, United States Code; and
                (2) any other relevant provision.

         TITLE II--NON-CRIMINAL PRIVACY ENFORCEMENT AND PRIVACY IMPACT
                                   STATEMENTS

    SEC. 201. ENFORCEMENT BY ATTORNEY GENERAL AND STATE AUTHORITIES.

        (a) Definition of ``Authorized Entity''.--As used in this section,
    the term ``authorized entity'' means the Attorney General, with respect
    to any conduct constituting a violation of a Federal law enacted after
    the date of the enactment of this Act relating to data security and
    engaged in by a business entity, and a State Attorney General with
    respect to that conduct to the extent the conduct adversely affects an
    interest of the residents of a State.
        (b) Civil Penalty.--
                (1) Generally.--An authorized entity may in a civil action
            obtain a civil penalty of not more than $500,000 from any
            business entity that engages in conduct constituting a
            violation of a Federal law enacted after the date of the
            enactment of this Act relating to data security.
                (2) Special rule for intentional violation.--If the
            violation described in subsection (a) is intentional, the
            maximum civil penalty is $1,000,000.
        (c) Injunctive Relief.--An authorized entity may, in a civil action
    against a business entity that has engaged, or is engaged, in any
    conduct constituting a violation of a Federal law enacted after the
    date of the enactment of this Act relating data security, obtain an
    order--
                (1) enjoining such act or practice; or
                (2) enforcing compliance with that law.
        (d) Other Rights and Remedies.--The rights and remedies available
    under this section do not affect any other rights and remedies
    available under Federal or State law.

    SEC. 202. COORDINATION OF STATE AND FEDERAL EFFORTS.

        (a) Notice.--
                (1) In general.--A State consumer protection attorney may
            not bring an action under section 201, until the attorney
            general of the State involved provides to the Attorney General
            of the United States--
                        (A) written notice of the action; and
                        (B) a copy of the complaint for the action.
                (2) Exception.--Paragraph (1) does not apply with respect
            to the filing of an action by an attorney general of a State
            under this section if the State attorney general determines
            that it is not feasible to provide the notice described in such
            subparagraph before the filing of the action, in such a case
            the State attorney general shall provide notice and a copy of
            the complaint to the Attorney General at the time the State
            attorney general files the action.
        (b) Federal Proceedings.--The Attorney General may--
                (1) move to stay any non Federal action under section 201,
            pending the final disposition of a pending Federal action under
            that section;
                (2) initiate an action in an appropriate United States
            district court and move to consolidate all pending actions
            under section 201, including State actions, in that court; and
                (3) intervene in a State action under section 201.
        (c) Pending Proceedings.--If the Attorney General institutes a
    proceeding or action for a violation of a Federal law enacted after the
    date of the enactment of this Act relating data security, no authority
    of a State may, during the pendency of such proceeding or action, bring
    an action under this section against any defendant named in such
    criminal proceeding or a civil action against any defendant for any
    violation that is alleged in that proceeding or action.
        (d) Definition.--As used in this section, the term ``State consumer
    protection attorney'' means the attorney general of a State or any
    State or local law enforcement agency authorized by the State attorney
    general or by State statute to prosecute violations of consumer
    protection law.

    SEC. 203. REQUIREMENT THAT AGENCY RULEMAKING TAKE INTO CONSIDERATION
                        IMPACTS ON INDIVIDUAL PRIVACY.

        (a) In General.--Title 5, United States Code, is amended by adding
    after section 553 the following new section:

    ``Sec. 553a. Privacy impact assessment in rulemaking

        ``(a) Initial Privacy Impact Assessment.--
                ``(1) In general.--Whenever an agency is required by
            section 553 of this title, or any other law, to publish a
            general notice of proposed rulemaking for a proposed rule, or
            publishes a notice of proposed rulemaking for an interpretative
            rule involving the internal revenue laws of the United States,
            and such rule or proposed rulemaking pertains to the
            collection, maintenance, use, or disclosure of personally
            identifiable information from 10 or more individuals, other
            than agencies, instrumentalities, or employees of the Federal
            government, the agency shall prepare and make available for
            public comment an initial privacy impact assessment that
            describes the impact of the proposed rule on the privacy of
            individuals. Such assessment or a summary thereof shall be
            signed by the senior agency official with primary
            responsibility for privacy policy and be published in the
            Federal Register at the time of the publication of a general
            notice of proposed rulemaking for the rule.
                ``(2) Contents.--Each initial privacy impact assessment
            required under this subsection shall contain the following:
                        ``(A) A description and analysis of the extent to
                    which the proposed rule will impact the privacy
                    interests of individuals, including the extent to which
                    the proposed rule--
                                ``(i) provides notice of the collection of
                            personally identifiable information, and
                            specifies what personally identifiable
                            information is to be collected and how it is to
                            be collected, maintained, used, and disclosed;
                                ``(ii) allows access to such information by
                            the person to whom the personally identifiable
                            information pertains and provides an
                            opportunity to correct inaccuracies;
                                ``(iii) prevents such information, which is
                            collected for one purpose, from being used for
                            another purpose; and
                                ``(iv) provides security for such
                            information, including the provision of written
                            notice to any individual, within 14 days of the
                            date of compromise, whose privacy interests are
                            compromised by the unauthorized release of
                            personally identifiable information as a result
                            of a breach of security at or by the agency.
                        ``(B) A description of any significant alternatives
                    to the proposed rule which accomplish the stated
                    objectives of applicable statutes and which minimize
                    any significant privacy impact of the proposed rule on
                    individuals.
        ``(b) Final Privacy Impact Assessment.--
                ``(1) In general.--Whenever an agency promulgates a final
            rule under section 553 of this title, after being required by
            that section or any other law to publish a general notice of
            proposed rulemaking, or promulgates a final interpretative rule
            involving the internal revenue laws of the United States, and
            such rule or proposed rulemaking pertains to the collection,
            maintenance, use, or disclosure of personally identifiable
            information from 10 or more individuals, other than agencies,
            instrumentalities, or employees of the Federal government, the
            agency shall prepare a final privacy impact assessment, signed
            by the senior agency official with primary responsibility for
            privacy policy.
                ``(2) Contents.--Each final privacy impact assessment
            required under this subsection shall contain the following:
                        ``(A) A description and analysis of the extent to
                    which the final rule will impact the privacy interests
                    of individuals, including the extent to which such
                    rule--
                                ``(i) provides notice of the collection of
                            personally identifiable information, and
                            specifies what personally identifiable
                            information is to be collected and how it is to
                            be collected, maintained, used, and disclosed;
                                ``(ii) allows access to such information by
                            the person to whom the personally identifiable
                            information pertains and provides an
                            opportunity to correct inaccuracies;
                                ``(iii) prevents such information, which is
                            collected for one purpose, from being used for
                            another purpose; and
                                ``(iv) provides security for such
                            information, including the provision of written
                            notice to any individual, within 14 days of the
                            date of compromise, whose privacy interests are
                            compromised by the unauthorized release of
                            personally identifiable information as a result
                            of a breach of security at or by the agency.
                        ``(B) A summary of any significant issues raised by
                    the public comments in response to the initial privacy
                    impact assessment, a summary of the analysis of the
                    agency of such issues, and a statement of any changes
                    made in such rule as a result of such issues.
                        ``(C) A description of the steps the agency has
                    taken to minimize the significant privacy impact on
                    individuals consistent with the stated objectives of
                    applicable statutes, including a statement of the
                    factual, policy, and legal reasons for selecting the
                    alternative adopted in the final rule and why each one
                    of the other significant alternatives to the rule
                    considered by the agency which affect the privacy
                    interests of individuals was rejected.
                ``(3) Availability to public.--The agency shall make copies
            of the final privacy impact assessment available to members of
            the public and shall publish in the Federal Register such
            assessment or a summary thereof.
        ``(c) Waivers.--
                ``(1) Emergencies.--An agency head may waive or delay the
            completion of some or all of the requirements of subsections
            (a) and (b) to the same extent as the agency head may, under
            section 608, waive or delay the completion of some or all of
            the requirements of sections 603 and 604, respectively.
                ``(2) National security.--An agency head may, for national
            security reasons, or to protect from disclosure classified
            information, confidential commercial information, or
            information the disclosure of which may adversely affect a law
            enforcement effort, waive or delay the completion of some or
            all of the following requirements:
                        ``(A) The requirement of subsection (a)(1) to make
                    an assessment available for public comment, provided
                    that such assessment is made available, in classified
                    form, to the Committees on the Judiciary of the House
                    of Representatives and the Senate, in lieu of making
                    such assessment available to the public.
                        ``(B) The requirement of subsection (a)(1) to have
                    an assessment or summary thereof published in the
                    Federal Register, provided that such assessment or
                    summary is made available, in classified form, to the
                    Committees on the Judiciary of the House of
                    Representatives and the Senate, in lieu of publishing
                    such assessment or summary in the Federal Register.
                        ``(C) The requirements of subsection (b)(3),
                    provided that the final privacy impact assessment is
                    made available, in classified form, to the Committees
                    on the Judiciary of the House of Representatives and
                    the Senate, in lieu of making such assessment available
                    to the public and publishing such assessment in the
                    Federal Register.
        ``(d) Procedures for Gathering Comments.--When any rule is
    promulgated which may have a significant privacy impact on individuals,
    or a privacy impact on a substantial number of individuals, the head of
    the agency promulgating the rule or the official of the agency with
    statutory responsibility for the promulgation of the rule shall assure
    that individuals have been given an opportunity to participate in the
    rulemaking for the rule through techniques such as--
                ``(1) the inclusion in an advance notice of proposed
            rulemaking, if issued, of a statement that the proposed rule
            may have a significant privacy impact on individuals, or a
            privacy impact on a substantial number of individuals;
                ``(2) the publication of a general notice of proposed
            rulemaking in publications of national circulation likely to be
            obtained by individuals;
                ``(3) the direct notification of interested individuals;
                ``(4) the conduct of open conferences or public hearings
            concerning the rule for individuals, including soliciting and
            receiving comments over computer networks; and
                ``(5) the adoption or modification of agency procedural
            rules to reduce the cost or complexity of participation in the
            rulemaking by individuals.
        ``(e) Periodic Review of Rules.--
                ``(1) In general.--Each agency shall carry out a periodic
            review of the rules promulgated by the agency that have a
            significant privacy impact on individuals, or a privacy impact
            on a substantial number of individuals. Under such periodic
            review, the agency shall determine, for each such rule, whether
            the rule can be amended or rescinded in a manner that minimizes
            any such impact while remaining in accordance with applicable
            statutes. For each such determination, the agency shall
            consider the following factors:
                        ``(A) The continued need for the rule.
                        ``(B) The nature of complaints or comments received
                    from the public concerning the rule.
                        ``(C) The complexity of the rule.
                        ``(D) The extent to which the rule overlaps,
                    duplicates, or conflicts with other Federal rules, and,
                    to the extent feasible, with State and local
                    governmental rules.
                        ``(E) The length of time since the rule was last
                    reviewed under this subsection.
                        ``(F) The degree to which technology, economic
                    conditions, or other factors have changed in the area
                    affected by the rule since the rule was last reviewed
                    under this subsection.
                ``(2) Plan required.--Each agency shall carry out the
            periodic review required by paragraph (1) in accordance with a
            plan published by such agency in the Federal Register. Each
            such plan shall provide for the review under this subsection of
            each rule promulgated by the agency not later than 10 years
            after the date on which such rule was published as the final
            rule and, thereafter, not later than 10 years after the date on
            which such rule was last reviewed under this subsection. The
            agency may amend such plan at any time by publishing the
            revision in the Federal Register.
                ``(3) Annual publication.--Each year, each agency shall
            publish in the Federal Register a list of the rules to be
            reviewed by such agency under this subsection during the
            following year. The list shall include a brief description of
            each such rule and the need for and legal basis of such rule
            and shall invite public comment upon the determination to be
            made under this subsection with respect to such rule.
        ``(f) Judicial Review.--
                ``(1) In general.--For any rule subject to this section, an
            individual who is adversely affected or aggrieved by final
            agency action is entitled to judicial review of agency
            compliance with the requirements of subsections (b) and (c) in
            accordance with chapter 7. Agency compliance with subsection
            (d) shall be judicially reviewable in connection with judicial
            review of subsection (b).
                ``(2) Jurisdiction.--Each court having jurisdiction to
            review such rule for compliance with section 553, or under any
            other provision of law, shall have jurisdiction to review any
            claims of noncompliance with subsections (b) and (c) in
            accordance with chapter 7. Agency compliance with subsection
            (d) shall be judicially reviewable in connection with judicial
            review of subsection (b).
                ``(3) Limitations.--
                        ``(A) An individual may seek such review during the
                    period beginning on the date of final agency action and
                    ending 1 year later, except that where a provision of
                    law requires that an action challenging a final agency
                    action be commenced before the expiration of 1 year,
                    such lesser period shall apply to an action for
                    judicial review under this subsection.
                        ``(B) In the case where an agency delays the
                    issuance of a final privacy impact assessment pursuant
                    to subsection (c), an action for judicial review under
                    this section shall be filed not later than--
                                ``(i) 1 year after the date the assessment
                            is made available to the public; or
                                ``(ii) where a provision of law requires
                            that an action challenging a final agency
                            regulation be commenced before the expiration
                            of the 1-year period, the number of days
                            specified in such provision of law that is
                            after the date the assessment is made available
                            to the public.
                ``(4) Relief.--In granting any relief in an action under
            this subsection, the court shall order the agency to take
            corrective action consistent with this section and chapter 7,
            and may--
                        ``(A) remand the rule to the agency; and
                        ``(B) defer the enforcement of the rule against
                    individuals, unless the court finds that continued
                    enforcement of the rule is in the public interest.
                ``(5) Rule of construction.--Nothing in this subsection
            limits the authority of any court to stay the effective date of
            any rule or provision thereof under any other provision of law
            or to grant any other relief in addition to the requirements of
            this subsection.
                ``(6) Record of agency action.--In an action for the
            judicial review of a rule, the privacy impact assessment for
            such rule, including an assessment prepared or corrected
            pursuant to paragraph (4), shall constitute part of the entire
            record of agency action in connection with such review.
                ``(7) Exclusivity.--Compliance or noncompliance by an
            agency with the provisions of this section shall be subject to
            judicial review only in accordance with this subsection.
                ``(8) Savings clause.--Nothing in this subsection bars
            judicial review of any other impact statement or similar
            assessment required by any other law if judicial review of such
            statement or assessment is otherwise permitted by law.
        ``(g) Definition.--For purposes of this section, the term
    `personally identifiable information' means information that can be
    used to identify an individual, including such individual's name,
    address, telephone number, photograph, social security number or other
    identifying information. It includes information about such
    individual's medical or financial condition.''.
        (b) Periodic Review Transition Provisions.--
                (1) Initial plan.--For each agency, the plan required by
            subsection (e) of section 553a of title 5, United States Code
            (as added by subsection (a)), shall be published not later than
            180 days after the date of the enactment of this Act.
                (2) Review period.--In the case of a rule promulgated by an
            agency before the date of the enactment of this Act, such plan
            shall provide for the periodic review of such rule before the
            expiration of the 10-year period beginning on the date of the
            enactment of this Act. For any such rule, the head of the
            agency may provide for a 1-year extension of such period if the
            head of the agency, before the expiration of the period,
            certifies in a statement published in the Federal Register that
            reviewing such rule before the expiration of the period is not
            feasible. The head of the agency may provide for additional 1-
            year extensions of the period pursuant to the preceding
            sentence, but in no event may the period exceed 15 years.
        (c) Congressional Review.--Section 801(a)(1)(B) of title 5, United
    States Code, is amended--
                (1) by redesignating clauses (iii) and (iv) as clauses (iv)
            and (v), respectively; and
                (2) by inserting after clause (ii) the following new
            clause:
                ``(iii) the agency's actions relevant to section 553a;''.
        (d) Clerical Amendment.--The table of sections at the beginning of
    chapter 5 of title 5, United States Code, is amended by adding after
    the item relating to section 553 the following new item:

        ``553a. Privacy impact assessment in rulemaking.''.

      TITLE III--ASSISTANCE FOR STATE AND LOCAL LAW ENFORCEMENT TO COMBAT
         FRAUDULENT, UNAUTHORIZED, OR OTHER CRIMINAL USE OF PERSONALLY
                            IDENTIFIABLE INFORMATION

    SEC. 301. GRANTS FOR STATE AND LOCAL LAW ENFORCEMENT.

        (a) In General.--Subject to the availability of amounts provided in
    advance in appropriations Acts, the Assistant Attorney General for the
    Office of Justice Programs of the Department of Justice may award
    grants to States to establish and develop programs to increase and
    enhance enforcement against crimes related to fraudulent, unauthorized,
    or other criminal use of personally identifiable information.
        (b) Application.--To be eligible for a grant under subsection (a),
    a State shall submit an application to the Assistant Attorney General
    for the Office of Justice Programs of the Department of Justice at such
    time, in such manner, and containing such information, including as
    described in subsection (d), as the Assistant Attorney General may
    require.
        (c) Use of Grant Amounts.--A grant awarded to a State under
    subsection (a) shall be used by a State, in conjunction with units of
    local government within that State, State and local courts, other
    States, or combinations thereof, to establish and develop programs to--
                (1) assist State and local law enforcement agencies in
            enforcing State and local criminal laws relating to crimes
            involving the fraudulent, unauthorized, or other criminal use
            of personally identifiable information;
                (2) assist State and local law enforcement agencies in
            educating the public to prevent and identify crimes involving
            the fraudulent, unauthorized, or other criminal use of
            personally identifiable information;
                (3) educate and train State and local law enforcement
            officers and prosecutors to conduct investigations and forensic
            analyses of evidence and prosecutions of crimes involving the
            fraudulent, unauthorized, or other criminal use of personally
            identifiable information;
                (4) assist State and local law enforcement officers and
            prosecutors in acquiring computer and other equipment to
            conduct investigations and forensic analysis of evidence of
            crimes involving the fraudulent, unauthorized, or other
            criminal use of personally identifiable information; and
                (5) facilitate and promote the sharing of Federal law
            enforcement expertise and information about the investigation,
            analysis, and prosecution of crimes involving the fraudulent,
            unauthorized, or other criminal use of personally identifiable
            information with State and local law enforcement officers and
            prosecutors, including the use of multi-jurisdictional task
            forces.
        (d) Assurances and Eligibility.--To be eligible to receive a grant
    under subsection (a), a State shall provide assurances to the Attorney
    General that the State--
                (1) has in effect laws that penalize crimes involving the
            fraudulent, unauthorized, or other criminal use of personally
            identifiable information, such as penal laws prohibiting--
                        (A) fraudulent schemes executed to obtain
                    personally identifiable information;
                        (B) schemes executed to sell or use fraudulently
                    obtained personally identifiable information; and
                        (C) online sales of personally identifiable
                    information obtained fraudulently or by other illegal
                    means;
                (2) will provide an assessment of the resource needs of the
            State and units of local government within that State,
            including criminal justice resources being devoted to the
            investigation and enforcement of laws related to crimes
            involving the fraudulent, unauthorized, or other criminal use
            of personally identifiable information;
                (3) will develop a plan for coordinating the programs
            funded under this section with other federally funded technical
            assistant and training programs, including directly funded
            local programs such as the Local Law Enforcement Block Grant
            program (described under the heading ``Violent Crime Reduction
            Programs, State and Local Law Enforcement Assistance'' of the
            Departments of Commerce, Justice, and State, the Judiciary, and
            Related Agencies Appropriations Act, 1998 (Public Law 105-
            119)); and
                (4) will submit to the Assistant Attorney General for the
            Office of Justice Programs of the Department of Justice
            applicable reports in accordance with subsection (f).
        (e) Matching Funds.--The Federal share of a grant received under
    this section may not exceed 90 percent of the total cost of a program
    or proposal funded under this section unless the Attorney General
    waives, wholly or in part, the requirements of this subsection.
        (f) Reports.--For each year that a State receives a grant under
    subsection (a) for a program, the State shall submit to the Assistant
    Attorney General for the Office of Justice Programs of the Department
    of Justice a report on the results, including the effectiveness, of
    such program during such year.

    SEC. 302. AUTHORIZATION OF APPROPRIATIONS.

        (a) In General.--There is authorized to be appropriated to carry
    out this title $25,000,000 for each of fiscal years 2008 through 2010.
        (b) Limitations.--Of the amount made available to carry out this
    title in any fiscal year not more than 3 percent may be used by the
    Attorney General for salaries and administrative expenses.
        (c) Minimum Amount.--Unless all eligible applications submitted by
    a State or units of local government within a State for a grant under
    this title have been funded, the State, together with grantees within
    the State (other than Indian tribes), shall be allocated in each fiscal
    year under this title not less than 0.75 percent of the total amount
    appropriated in the fiscal year for grants pursuant to this title,
    except that the United States Virgin Islands, American Samoa, Guam, and
    the Northern Mariana Islands each shall be allocated 0.25 percent.
        (d) Grants to Indian Tribes.--Notwithstanding any other provision
    of this title, the Attorney General may use amounts made available
    under this title to make grants to Indian tribes for use in accordance
    with this title.

              TITLE IV--NATIONAL WHITE COLLAR CRIME CENTER GRANTS

    SEC. 401. AUTHORIZATION AND EXPANSION OF NATIONAL WHITE COLLAR CRIME
                        CENTER.

        (a) In General.--Title I of the Omnibus Crime Control and Safe
    Streets Act of 1968 (42 U.S.C. 3711 et seq.) is amended--
                (1) by redesignating part X, as added by section 623 of
            Public Law 109-248, as part JJ; and
                (2) by adding at the end the following new part:

              ``PART KK--NATIONAL WHITE COLLAR CRIME CENTER GRANTS

    ``SEC. 3021. ESTABLISHMENT OF GRANTS PROGRAM.

        ``(a) Authorization.--The Director of the Bureau of Justice
    Assistance is authorized to make grants and enter into contracts with
    State and local criminal justice agencies and nonprofit organizations
    for the purpose of improving the identification, investigation, and
    prosecution of certain criminal activities.
        ``(b) Certain Criminal Activities Defined.--For purposes of this
    part, the term `certain criminal activity' means a criminal conspiracy
    or activity or a terrorist conspiracy or activity that spans
    jurisdictional boundaries, including the following:
                ``(1) Terrorism.
                ``(2) Economic crime.
                ``(3) High-tech crime, also known as cyber crime or
            computer crime, including internet-based crime against children
            and child pornography.
        ``(c) Criminal Justice Agency Defined.--For purposes of this part,
    the term `criminal justice agency', with respect to a State or a unit
    of local government within such State, includes a law enforcement
    agency, a State regulatory body with criminal investigative authority,
    and a State or local prosecution office to the extent that such agency,
    body, or office, respectively, is involved in the prevention,
    investigation, and prosecution of certain criminal activities.

    ``SEC. 3022. AUTHORIZED PROGRAMS.

        ``Grants and contracts awarded under this part may be made only for
    the following programs, with respect to the prevention, investigation,
    and prosecution of certain criminal activities:
                ``(1) Programs to provide a nationwide support system for
            State and local criminal justice agencies.
                ``(2) Programs to assist State and local criminal justice
            agencies to develop, establish, and maintain intelligence-
            focused policing strategies and related information sharing.
                ``(3) Programs to provide training and investigative
            support services to State and local criminal justice agencies
            to provide such agencies with skills and resources needed to
            investigate and prosecute such criminal activities and related
            criminal activities.
                ``(4) Programs to provide research support, to establish
            partnerships, and to provide other resources to aid State and
            local criminal justice agencies to prevent, investigate, and
            prosecute such criminal activities and related problems.
                ``(5) Programs to provide information and research to the
            general public to facilitate the prevention of such criminal
            activities.
                ``(6) Programs to establish National training and research
            centers regionally, including within Virginia, Texas, and
            Michigan, to provide training and research services for State
            and local criminal justice agencies.
                ``(7) Any other programs specified by the Attorney General
            as furthering the purposes of this part.

    ``SEC. 3023. APPLICATION.

        ``To be eligible for an award of a grant or contract under this
    part, an entity shall submit to the Director of the Bureau of Justice
    Assistance an application in such form and manner, and containing such
    information, as required by the Director.

    ``SEC. 3024. RULES AND REGULATIONS.

        ``Not later than 180 days after the date of the enactment of this
    part, the Director of the Bureau of Justice Assistance shall promulgate
    such rules and regulations as are necessary to carry out the this part,
    including rules and regulations for submitting and reviewing
    applications under section 3023.''.
        (b) Authorization of Appropriation.--Section 1001(a) of such Act
    (42 U.S.C. 3793) is amended by adding at the end the following new
    paragraph:
                ``(26) There is authorized to be appropriated to carry out
            part KK--
                        ``(A) $25,000,000 for fiscal year 2008;
                        ``(B) $28,000,000 for fiscal year 2009;
                        ``(C) $31,000,000 for fiscal year 2010;
                        ``(D) $34,000,000 for fiscal year 2011;
                        ``(E) $37,000,000 for fiscal year 2012; and
                        ``(F) $40,000,000 for fiscal year 2013.''.

        Mr. Scott. It is now my pleasure to recognize our new
    Ranking Member of the Subcommittee, the gentleman from Texas,
    Judge Gohmert.
        Mr. Gohmert. Thank you, Chairman Scott. Thank you to the
    witnesses. I stayed until 1:30, when it was apparent we were
    going to be a while, and I ran over to the Capitol, but because
    the hour is so much later, I have an opening statement, but I
    would ask unanimous consent simply to submit it for the record.
    Unless you all want me to read my opening statement, I will.
    But otherwise, we will submit that.
        H.R. 4175 was introduced by Chairman Conyers, Ranking
    Member Smith, Subcommittee Member Scott and then-Ranking Member
    Forbes. A bipartisan proposal, I think, represents a good first
    step in tackling the difficult problem of identity theft and
    cybercrime.
        And so I will look forward to hearing the witnesses and
    working with my colleagues on this important piece of
    legislation.
        And with that, I guess hearing no objection----
        Mr. Scott. Without objection, the statement is entered into
    the record.
        [The prepared statement of Mr. Gohmert follows:]
    Prepared Statement of the Honorable Louie Gohmert, a Representative in
     Congress from the State of Texas, and Ranking Member, Subcommittee on
                    Crime, Terrorism, and Homeland Security

        Mr. Scott. The gentleman from Michigan.
        Mr. Conyers. Thank you. And as the one that is guilty for
    holding you up so long, I won't--I will not give you my
    statement, and I will put it in the record and add that the
    privacy in the Cybercrime Enforcement Act is a strong
    bipartisan measure that I believe will help combat the growing
    threat of identity theft and other cybercrimes. This balanced
    bill protects the privacy rights of consumers, the interest of
    businesses and the legitimate needs of law enforcement.
        And I would like to emphasize that I look forward to the
    passage of a crime law but not at the expense of the
    substantive issues involved, including requiring much needed
    notices for security breaches.
        I am aware of the passage of S. 2168 in the Senate, but our
    bill is more comprehensive, and we need to examine it before
    making hasty decisions that impact consumers for years to come.
        Thank you very much, Mr. Chairman, for your patience and
    forbearance.
        [The prepared statement of Chairman Conyers follows:]

    Prepared Statement of the Honorable John Conyers, Jr., a Representative
    in Congress from the State of Michigan, and Chairman, Committee on the
                                   Judiciary

        Mr. Scott. Thank you, Mr. Chairman.
        The gentleman from North Carolina.
        Mr. Coble. In view of the belated hour, I waive my opening
    statement and join you in welcoming our panel.
        Mr. Scott. And without objection, other Members will be
    allowed to include opening statements in the record at this
    point.
        I want to thank the witnesses for your patience. Sometimes
    because of votes and things, the schedule just goes array, and
    we appreciate your patience in remaining with us.
        We have a distinguished panel of witnesses here today to
    help us consider important issues that are here before us.
        The first witness is Andrew Lourie, who was the acting
    Principal Deputy Assistant Attorney General and chief of staff
    of the Criminal Division at the Department of Justice. He is
    currently serving a detail from the U.S. Attorney's Office from
    the Southern District of Florida where, for the past 5 years,
    he has served as Managing Assistant U.S. Attorney in the West
    Palm Beach office. He served two prior details at the
    Department, both as chief of the Public Integrity Section.
        The next witness is Greg Magaw, a special agent in charge
    of the United States Secret Service. He provides guidance in
    determining the investigative focus of the division which
    provides direction to all Secret Service field offices. He is a
    20-year veteran of the Secret Service, native of Columbus,
    Ohio. He received his Bachelor of Arts degree from the
    University of Maryland and masters degree in the field of
    management from Johns Hopkins.
        Next will be Joel Winton, the associate director of the
    Division of Privacy and Identity Protection at the Federal
    Trade Commission's Bureau of Consumer Protection. That division
    has responsibility over consumer privacy and data security
    issues, identity theft and credit reporting matters. Mr.
    Winston is currently serving on the Federal Government's
    Identity Theft Task Force, which was created by the President
    in March 2006. Mr. Winston received his undergraduate and law
    degrees from the University of Michigan.
        Next will be Jaimee Napp, executive director of the
    Identity Theft Action Council of Nebraska. He founded the
    council in 2006--excuse me, she founded the council in 2006 to
    use her journey as an identity theft victim to help others. The
    council is the first nonprofit organization dedicated solely to
    identity theft issues assisting victims in Nebraska. She
    received her bachelors of journalism from the University of
    Nebraska at Lincoln.
        Next will be Robert Holleyman, president, CEO, of the
    Business Software Alliance. Mr. Holleyman has headed the
    alliance since 1990, overseeing operations in more than 85
    countries. He is widely known for his work on policy related
    issues affecting the technology industry, including
    intellectual property laws, cyber security, international trade
    and electronic commerce. He earned his bachelor of arts degree
    in Political Science at Trinity University in Texas and his
    juris doctorate from Louisiana State University in Baton Rouge.
        Finally, we have Lillie Coney, associate director of the
    Electronic Privacy Information Center in Washington, D.C. She
    serves as the coordinator for the Privacy Coalition. The
    Privacy Coalition has over 40 organizations and affiliates who
    share a commitment to freedom and privacy rights. She has
    testified before the Department of Homeland Security, the
    Department of Homeland Security's Data Privacy and Integrity
    Advisory Committee, on domestic surveillance.
        Now each of our witnesses' written statements will be made
    part of the record and all of those statements in their
    entirety. I would ask each witness to summarize his or her
    testimony in 5 minutes or less. And to help you stay within
    that time, there is a timing device on your table that will
    start green and go to yellow when you have 1 minute left and
    then finally to red when your time has expired.
        We will begin with--and unfortunately, we are expecting a
    vote any minute now so we will go as far as we can, break for a
    vote and then come right back.
        Mr. Lourie.

     TESTIMONY OF ANDREW LOURIE, ACTING PRINCIPAL DEPUTY ASSISTANT
     ATTORNEY GENERAL AND CHIEF OF STAFF TO THE CRIMINAL DIVISION,
               U.S. DEPARTMENT OF JUSTICE, WASHINGTON, DC

        Mr. Lourie. Thank you. Good afternoon, Chairman Scott,
    Ranking Member Gohmert and Members of the Subcommittee.
        It is a pleasure to appear before you today to testify
    about the Department of Justice's commitment to combatting
    computer crime and identity theft, and about the important
    legislation this Subcommittee is considering to address these
    threats.
        As information technology increasingly pervades every
    aspect of our society, the opportunity for criminals to take
    advantage of it was also increased.
        One result has been the rise of identity theft. The
    Department of Justice is dedicated to aggressively pursuing all
    forms of cybercrime and identity theft. However, shortcomings
    in existing law have, at times, inhibited its ability to do so.
    The Privacy and Cyber Crime Act of 2007 would address several
    of these shortcomings and provide important tools to promote
    law enforcement's efforts.
        The act includes many provisions also recommended in the
    strategic plan released earlier this year by the President's
    Identity Theft Task Force. The Department is pleased to see the
    depth of the common ground that we share in these key issues.
    In particular, the Department applauds the amendments in the
    act that would ensure that victims receive fair restitution for
    the time spent to remediate the harm resulting from identity
    theft offenses.
        Similarly, the Department supports the provisions of the
    act that enhance our ability to prosecute the theft of
    sensitive information from computers, close loopholes in the
    cyber extortion statute and enable us to bring computer crime
    charges against criminal conspiracies and organized criminal
    groups.
        In addition to these many positive aspects, the Department
    would like to provide some suggestions that would strengthen
    the bill.
        First, we strongly encourage the Committee to consider
    amending 18 USC, section 1030(a)(5), to close a loophole and
    appropriately penalize the use of malicious spyware, botnets
    and keyloggers. Current law criminalizes actions that cause
    damage to computers by impairing the integrity or ability of
    data or computer systems. Absent special circumstances,
    however, the conduct must cause loss exceeding $5,000 to
    constitute a Federal crime. Many identity thieves obtain
    personal information by installing malicious software on
    numerous individual computers. Whether or not the programs
    succeed in stealing information, they harm the integrity of the
    computer and data. However, it is often difficult or impossible
    to measure the loss to each computer owner or to prove that the
    many small losses together exceed $5,000.
        Two amendments could remedy this situation. First, Congress
    could amend section 1030(a)(5) to make it a misdemeanor offense
    to damage a protected computer and cause less than $5,000 in
    loss. Whether or not the Committee considers that amendment, we
    strongly recommend adding a provision to the act that would
    make it a Federal felony to damage 10 or more protected
    computers regardless of loss.
        Let me turn now to Section 102 of the bill, the provision
    that requires victims of major executive breaches to provide
    notice to law enforcement. The bill defines a major security
    breach as a breach that involves the means of identification
    pertaining to 10,000 or more individuals. This threshold is too
    high. To give the numbers some context, the theft of as few as
    1,000 credit card numbers is, under the current sentencing
    guidelines, presumed to involve a minimum loss of $500,000. We
    therefore recommend that the threshold for major security
    breach be reduced.
        The definition should also be amended to include any breach
    where there may be a threat to national security or risk of
    significant monetary loss without regard to the number of
    records affected.
        I would also like to mention Section 106, which contains a
    useful provision on the forfeiture of the instrumentalities and
    proceeds of cybercrime. We support the addition of a forfeiture
    provision. We suggest, however, that the act explicitly allow
    for both civil and criminal forfeiture and spell out the
    appropriate procedures. Language to accomplish these changes
    and other technical suggestions to improve the forfeiture
    procedures is included with the written testimony I have
    submitted to the Subcommittee.
        In conclusion, the Department would like to emphasize that
    law enforcement can continue to fulfill its role in addressing
    the growing threats of computer crime and identify theft if we
    have the appropriate laws and appropriate resources. The
    Privacy in Cyber Crime Act of 2007 addresses many of those
    needs by closing loopholes in existing cybercrime statutes,
    improving our ability to prosecute criminal groups and
    providing much needed resources. We believe the act will be an
    important tool in the fight against cybercrime.
        Mr. Chairman, this concludes my remarks.
        [The prepared statement of Mr. Lourie follows:]

                      Prepared Statement of Andrew Lourie

        Mr. Scott. Thank you.
        Mr. Magaw.

    TESTIMONY OF CRAIG MAGAW, SPECIAL AGENT, CRIMINAL INVESTIGATIVE
      DIVISION, U.S. SECRET SERVICE, U.S. DEPARTMENT OF HOMELAND
                        SECURITY, WASHINGTON, DC

        Mr. Magaw. Good afternoon, Chairman Scott and distinguished
    Members of the Subcommittee. I would like to thank you for the
    opportunity to address the Subcommittee on the subject of
    identity crime and the roll of the Secret Service in these
    investigations.
        While the Secret Service perhaps is best known for
    protecting our Nation's leaders, we also investigate a wide
    array of financial crimes and work to safeguard our Nation's
    critical financial infrastructure.
        With the passage of legislation in 1984 and 1986, the
    Secret Service was authorized to investigate access device
    fraud, and we were given parallel authority with other law
    enforcement agencies in identity crimes and computer fraud
    cases. Through our financial and electronic crime
    investigations, the Secret Service has developed a particular
    expertise in the area of identity theft, false identification
    fraud, access device fraud, bank fraud and computer fraud.
        In fiscal year 2007, agents of the Secret Service arrested
    over 4,300 suspects for identity theft crimes. These suspects
    were responsible for approximately $690 million in actual fraud
    loss to American consumers and American institutions.
        The Secret Service has observed a marked increase in
    identity theft and cybercrime. Criminals continue to seek new
    methods to compromise victims' personal financial information.
    The recent trend observed by law enforcement is the use of
    computers and the Internet to launch cyber attacks targeting
    citizens and financial institutions.
        Cyber criminals have become proficient at stealing victims'
    personal information through the use of phishing e-mails,
    account takeovers, malicious software, hacking attack and
    network intrusions resulting in data breach.
        This stolen information is often sold in bulk quantities
    through illicit Web sites on the Internet. Criminal groups
    involved in identity theft and cybercrimes routinely operate in
    a multi-jurisdictional environment. By working closely with
    Federal, State, and local law enforcement representatives, as
    well as international police agencies, we are able to provide a
    comprehensive network of intelligence sharing, resource sharing
    and technical expertise that bridge jurisdictional boundaries.
    This partnership approach to law enforcement is vital to our
    criminal investigative mission.
        The Secret Service has established a national network of
    financial crimes task forces and electronic crime task forces
    in cities across the United States. These task forces leverage
    the combined resources of local, State, and Federal law
    enforcement partners as well as technical experts from the
    academic community and private industry in an organized effort
    to combat threats to our financial payment system and critical
    infrastructure.
        Collaboration between law enforcement and private sector is
    critical to our preventative approach to identity theft and
    cybercrime.
        We also build partners with the academic community to
    ensure that law enforcement is on the cutting edge of
    technology by leveraging research and development capabilities
    of teaching institutions and technical colleges. The Secret
    Service appreciates the Subcommittee's work to enhance the
    penalties and broaden investigative jurisdictions associated
    with identity theft and cybercrime.
        H.R. 4175 addresses many of the issues I have discussed
    today concerning these offenses. H.R. 4175 expands the
    definition of cybercrime; requires data or brokers to notify
    law enforcement authorities of major security breaches; and
    increases penalties for identity theft and other violations of
    data privacy and security. The Secret Service looks forward to
    working closely with Congress as they address identity crime
    legislation.
        As I have highlighted in my written statement, the Secret
    Service has implemented a number of initiatives pertaining to
    identity crimes. We have dedicated enormous resources to
    increase public awareness, provide training to law enforcement
    partners and improve investigative techniques. We will continue
    to aggressively investigate identity theft offenders to protect
    consumers. The Secret Service is committed to our mission to
    safeguard the Nation's critical and financial infrastructure.
        This concludes my prepared remarks. Thank you again for the
    opportunity to testify on behalf of the Secret Service.
        [The prepared statement of Mr. Magaw follows:]

                       Prepared Statement of Craig Magaw

        Good afternoon, Chairman Scott, Ranking Member Gohmert and
    distinguished members of the subcommittee. I would like to thank you
    for the opportunity to address this subcommittee on the subject of
    identity crime and the role of the U.S. Secret Service in these
    investigations.
        While the Secret Service is perhaps best known for protecting our
    nation's leaders, we also investigate a wide variety of financial
    crimes. In our role of protecting the nation's critical infrastructure
    and financial payment systems, the Secret Service has a long history of
    protecting American consumers and the financial industry from fraud.
    With the passage of legislation in 1984, the Secret Service was
    provided authority for the investigation of access device fraud,
    including credit and debit card fraud, and parallel authority with
    other law enforcement agencies in identity crime cases. In recent
    years, the combination of the information revolution and the effects of
    globalization have caused the investigative mission of the Secret
    Service to evolve.
        Through our work in the areas of financial and electronic crime,
    the Secret Service has developed particular expertise in the
    investigation of identity theft, false identification fraud, credit
    card fraud, debit card fraud, check fraud, bank fraud, cyber crime, and
    computer intrusions. In Fiscal Year 2007, agents assigned to Secret
    Service offices across the United States arrested over 4,300 suspects
    for identity theft crimes. These suspects were responsible for
    approximately $690 million in actual fraud loss to individuals and
    financial institutions.
        These criminals seek the personal identifiers generally required to
    obtain goods and services on credit, such as Social Security numbers,
    names, and dates of birth. Identity crimes also involve the theft or
    misuse of an individual's financial identifiers such as credit card
    numbers, bank account numbers, and personal identification numbers.
        The Secret Service has observed a marked increase in identity theft
    and access device fraud. Criminals continue to seek new methods of
    compromising victims' personal and financial information. In the 1980's
    and 1990's, criminals obtained stolen personal and financial
    information through traditional means such as, theft of mail, theft of
    trash from businesses or victims, home and vehicle burglaries, and
    theft of a victim's wallet or purse. While these low-tech methods of
    theft remain popular, criminal activity has evolved to new methods of
    obtaining large quantities of stolen information.
        The recent trend observed by law enforcement is the use of
    computers and the Internet to launch cyber attacks targeting citizens
    and financial institutions. Cyber criminals have become adept at
    stealing victims' personal information through the use of phishing
    emails, account takeovers, malicious software, hacking attacks, and
    network intrusions resulting in data breaches.
        The Secret Service continues to see a considerable volume of access
    device fraud, usually in the form of criminal exploitation of stolen
    credit card data. Of particular concern are those incidents in which
    large quantities of credit card and related personal data are stolen
    through electronic intrusions into the networked systems of major
    retailers or the systems of credit card processors. A considerable
    portion of this type of electronic theft appears to be attributable to
    organized groups, many of them based abroad, who pursue both the
    intrusions, as well as the subsequent exploitation of the stolen data.
    Stolen credit card data is often trafficked in units that include more
    than just the card number and expiration date. ``Full-info cards''
    include such additional information as complete name and address
    information of the cardholder, mother's maiden name, date of birth,
    Social Security number, PIN, and other personal information that allows
    additional criminal exploitation of the account. Another marked trend
    observed in 2007, has been the rise in volume of trafficking in card
    track data together with PINs; this data allows a criminal to
    manufacture a fully functional counterfeit card and execute ATM
    withdrawals or other PIN-enabled transactions against the account.
        This stolen information is often sold in bulk quantities on various
    illicit Internet carding portals. These portals, or ``carding
    websites,'' can be likened to online bazaars where the criminal element
    converges to conduct their business. The websites vary in size, from a
    few dozen members, to some of the more popular sites which boast
    memberships of approximately 8,000 users. Within these portals, there
    are separate forums which are moderated by notorious members of the
    carding community. Members can meet online and discuss specific topics
    of interest. Criminal purveyors buy, sell, and trade malicious
    software, spamming services, credit, debit, and ATM card data, personal
    identification data, bank account information, hacking services and
    other contraband.
        In addition to the exploitation of credit and debit card accounts,
    many of the more sophisticated online criminal networks are now
    actively exploiting compromised online financial accounts. Criminals
    who gain access to victim accounts using online systems then execute
    fraudulent electronic banking transfers or sell the information to
    other criminals. The desire to exploit online bank accounts has led to
    the explosive growth of phishing, as well as the recent wave of
    ``malware'' or ``crimeware,'' malicious software designed specifically
    to harvest account login information from the computers of infected
    victims. The technical sophistication of the illicit services readily
    available continues to grow. For example, the online fraud networks are
    increasingly leveraging the technical capabilities of ``botnets'' (i.e.
    networks of thousands of infected computers which can be controlled by
    a criminal from a central location) for financial attacks ranging in
    nature from the hosting of phishing and other malicious websites to the
    launching of widespread attacks against the online authentication
    systems of U.S. financial institutions.
        The information revolution of the 1990's has turned our personal
    and financial information into a valuable commodity, whether it is
    being collected and brokered by a legitimate company or stolen by an
    identity thief. This information is no longer only an instrument used
    to facilitate a financial crime; it is now the primary target of
    criminals. Consequently, private citizens as well as corporations and
    financial institutions must take appropriate measures to secure
    sensitive personally identifiable information. This information is
    particularly vulnerable when it is stored on personal computers or
    disclosed over Internet and email connections. Consumers must adhere to
    comprehensive computer security practices.
        Today, hundreds of companies specialize in data mining, data
    warehousing, and information brokerage. This wealth of available
    personal information creates a target-rich environment for today's
    sophisticated criminals. However, businesses can provide a first line
    of defense against identity crime by safeguarding the information they
    collect. Such efforts can significantly limit the opportunities for
    identity crime. Furthermore, the prompt reporting by data brokers of
    major security breaches involving sensitive personally identifiable
    information to the proper authorities would ensure a thorough
    investigation is conducted.
        Globalization has made commerce easy and convenient for
    corporations and consumers. Financial institutions and systems are
    accessible worldwide. Today's cyber criminals have adapted to this new
    means of global trade and exploit our dependence on information
    technology. With the explosion of Internet accessibility world-wide,
    the criminal element has modified their fraudulent schemes to a new,
    more anonymous and constantly evolving cyber arena. Having been the
    target of many of these crimes, the financial sector has some of the
    most sophisticated security and authentication mechanisms and are
    constantly evolving their practices to counter this criminal activity
    Likewise, the Secret Service has modified its investigative techniques
    to keep pace with emerging technologies.
        Criminal groups involved in identity crimes routinely operate in a
    multi-jurisdictional environment. This creates problems for local law
    enforcement agencies that generally act as the first responders. By
    working closely with other federal, state, and local law enforcement
    representatives, as well as international police agencies, the Secret
    Service is able to provide a comprehensive network of intelligence
    sharing, resource sharing, and technical expertise that bridges
    jurisdictional boundaries. This partnership approach to law enforcement
    is vital to our criminal investigative mission.
        The Secret Service's expertise is enhanced through partnerships and
    identity theft task forces to assist in the national effort to
    safeguard personal and financial information. These partnerships with
    other law enforcement agencies and industry representatives perform a
    crucial role in protecting the financial infrastructure and economic
    stability of the United States by leveraging the technical expertise
    and investigative experience of partner agencies.
        The Secret Service has established unique partnerships with state,
    local, and other federal law enforcement agencies through years of
    collaboration on our investigative and protective endeavors. These
    partnerships enabled the Secret Service to establish a national network
    of Financial Crimes Task Forces (FCTFs) to combine the resources of the
    private sector and other law enforcement agencies in an organized
    effort to combat threats to our financial payment systems and critical
    infrastructures. The Secret Service currently maintains 29 FCTFs
    located in metropolitan regions across the country. While our FCTFs do
    not focus exclusively on identity crime, we recognize that stolen
    identifiers are often a central component of other financial crimes.
    Consequently, our task forces devote considerable time and resources to
    the issue of identity crime.
        The Secret Service has always employed a proactive, rather than
    reactive, approach to combating crime. In 1996, the Secret Service
    established the New York Electronic Crimes Task Force (ECTF) to combine
    the resources of academia, the private sector, and local, state, and
    federal law enforcement agencies to combat computer-based threats to
    our financial payment systems and critical infrastructures. The USA
    PATRIOT Act of 2001, P.L. 107-56, recognized the effectiveness of the
    New York ECTF and mandated that the Secret Service establish a
    nationwide network of ECTFs to prevent, detect, and investigate various
    forms of electronic crimes, including potential terrorist attacks
    against critical infrastructure and financial payment systems.
        ECTFs leverage combined resources in an organized effort to combat
    threats to our financial payment systems and critical infrastructures.
    Partnerships between law enforcement and the private sector are
    critical to the success of the ECTF's ``focus on prevention'' approach.
    Our ECTFs collaborate with private sector technical experts in an
    effort to protect their system networks and critical information by
    encouraging the development of business continuity plans and routine
    risk management assessments of their electronic infrastructure. Greater
    ECTF liaison with the business community provides rapid access to law
    enforcement and vital technical expertise during incidents of malicious
    cyber crimes. The ECTFs also focus on partnerships with academia to
    ensure that law enforcement is on the cutting edge of technology by
    leveraging the research and development capabilities of teaching
    institutions and technical colleges.
        These resources allow ECTFs to identify and address potential cyber
    vulnerabilities before the criminal element exploits them. This
    proactive approach has successfully prevented cyber attacks that
    otherwise would have resulted in large-scale financial losses to U.S.
    based companies or disruptions of critical infrastructures.
        The Secret Service task force models open the lines of
    communication and encourage the unlimited exchange of information
    between federal, state, and local law enforcement. Currently, the
    Secret Service maintains 24 ECTFs in major metropolitan regions across
    the United States.
        Another important goal of the Secret Service is to raise awareness
    of issues related to identity theft and financial crimes, both in the
    law enforcement community and the general public. The Secret Service
    has worked to educate consumers and provide training to law enforcement
    personnel through a variety of programs and initiatives. Agents from
    local field offices routinely provide community outreach seminars and
    public awareness training on the subjects of identity theft and
    computer fraud. Agents often address these topics when speaking to
    school groups, civic organizations, and staff meetings involving
    businesses or financial institutions.
        Additionally, the Secret Service provides recurring identity theft
    training to state and local police departments. This training includes
    formal and informal classes which occur at police roll calls, field
    office sponsored seminars, police academies, and other various
    settings. Currently, the Secret Service provides formal computer
    training to state and local police departments to allow officers to act
    as ``first responders'' in cyber crimes investigations. Officers are
    trained in basic electronic crimes investigations, network intrusion
    investigations, and computer forensics.
        The Secret Service currently participates in a joint effort with
    the Department of Justice, the U.S. Postal Inspection Service, the
    Federal Trade Commission (FTC), the International Association of Chiefs
    of Police (IACP), and the American Association of Motor Vehicle
    Administrators to host identity crime training for law enforcement
    officers. In the last three years, Identity Crime Training Seminars
    have been held in approximately 20 cities nationwide. These training
    seminars are focused on providing local and state law enforcement
    officers with tools and resources that they can immediately put into
    use in their investigations of identity crime.
        The Secret Service has also assigned a special agent to the FTC as
    a liaison to support all aspects of the Commission's program to
    encourage the use of the Identity Theft Data Clearinghouse as a law
    enforcement tool. The FTC has done an excellent job of providing people
    with the information and assistance they need in order to take the
    steps necessary to correct their credit records, as well as undertaking
    a variety of consumer awareness initiatives regarding identity theft.
        Additionally, the Secret Service is committed to providing our law
    enforcement partners with publications and guides to assist them in
    combating identity theft and cyber crime. As criminals increasingly use
    computers and electronic storage devices, these items become important
    pieces of evidence. To ensure proper investigation and successful
    prosecution, officers need specific instructions pertaining to the
    seizure and analysis of electronic evidence. To provide this essential
    knowledge, the Secret Service published the ``Best Practices Guide for
    Seizing Electronic Evidence'' which is designed as a pocket guide for
    the police officers and detectives acting as first responders. This
    guide assists law enforcement officers in recognizing, protecting,
    seizing, and searching electronic devices in accordance with applicable
    statutes and policies. This guide has been updated as appropriate, and
    it is currently issued in its third edition.
        The Secret Service also cooperated with several of our task force
    partners to produce the interactive, computer-based training program
    known as ``Forward Edge.'' Forward Edge is a CD-ROM that provides law
    enforcement and corporate investigative personnel with practical
    training in the recognition and seizure of electronic storage items.
    This year we completed an updated version of this training tool and
    just released ``Forward Edge II.''
        In addition, the Secret Service produced an Identity Crime Video/
    CD-ROM which contains over 50 investigative and victim assistance
    resources that local and state law enforcement officers can use when
    combating identity crime. This CD-ROM also contains a short identity
    crime video that can be shown to police officers at their roll call
    meetings which discusses why identity crime is important, what other
    departments are doing to combat identity crime, and what tools and
    resources are available to officers. The Identity Crime CD-ROM is an
    interactive resource guide that was made in collaboration with the U.S.
    Postal Inspection Service, the FTC and the IACP.
        To date, approximately 50,000 Identity Crime CD-ROMs have been
    distributed to law enforcement departments and agencies across the
    United States. We have distributed over 400,000 Best Practices Guides
    and over 50,000 Forward Edge training CD-ROMs to local and federal law
    enforcement officers nationwide.
        In conclusion, I would like to reiterate that identity theft is an
    evolving threat. Law enforcement agencies must be able to adapt to
    emerging technologies and criminal methods. The Secret Service is
    pleased that Congress is considering legislation that recognizes the
    magnitude of these issues and the constantly changing nature of these
    crimes. To effectively fight this crime, our criminal statutes must be
    amended to safeguard sensitive personally identifiable information and
    to afford law enforcement the appropriate resources to investigate data
    breaches.
        The Secret Service appreciates the Subcommittee's work to enhance
    penalties and broaden investigative jurisdictions associated with
    identity theft and cyber crime. H.R. 4175 addresses many of the issues
    I have discussed in this statement concerning these offenses. H.R. 4175
    expands the definition of cyber crime, requires data brokers to notify
    law enforcement authorities of major security breaches, and increases
    penalties for identity theft and other violations of data privacy and
    security. The Secret Service looks forward to working closely with
    Congress as they address identity crime legislation.
        As I have highlighted in my statement, the Secret Service has
    implemented a number of initiatives pertaining to identity crimes. We
    have dedicated enormous resources to increase awareness, educate the
    public, provide training for law enforcement partners, and improve
    investigative techniques. We will continue to aggressively investigate
    identity theft offenders to protect consumers. The Secret Service is
    committed to our mission of safeguarding the nation's critical
    infrastructure and financial payment systems.
        Chairman Scott, Ranking Member Gohmert, this concludes my prepared
    statement. Thank you again for this opportunity to testify on behalf of
    the Secret Service. I will be pleased to answer any questions at this
    time.

        Mr. Scott. Thank you.
        Mr. Winston.

      TESTIMONY OF JOEL WINSTON, ASSOCIATE DIRECTOR, DIVISION OF
    PRIVACY AND IDENTITY PROTECTION, BUREAU OF CONSUMER PROTECTION,
                FEDERAL TRADE COMMISSION, WASHINGTON, DC

        Mr. Winston. Thank you, Chairman Scott, Ranking Member
    Gohmert and Members of the Subcommittee. I appreciate the
    opportunity to testify today about these critical issues of
    privacy and identity theft.
        As the Federal Trade Commission's recently issued national
    survey shows, identity theft continues to afflict millions of
    Americans every year with losses in the billions of dollars.
    But beyond these real and substantial direct costs, this crime
    harms our economic system by threatening consumer confidence.
    Many polls show that the level of consumer anxiety about
    identity theft is extremely high.
        The FTC plays a lead role in the battle against identity
    theft through its law enforcement efforts; its work on the
    President's task force; its extensive consumer and business
    education; and its assistance to criminal law enforcement
    partners.
        One way to stop identity theft is to keep sensitive
    information out of the hands of thieves by ensuring that
    businesses protect the information they collect. Reports of the
    latest data breaches appear almost daily and continue to shake
    consumer confidence. Of course, not all data breaches lead to
    identity theft, but some do, causing real damage to affected
    consumers.
        The Commission uses its authority under several Federal
    laws to take action against businesses that fail to reasonably
    protect sensitive consumer information. Since 2001, the FTC has
    brought 15 data security cases, including our most recent case
    announced this morning against a mortgage company that threw
    sensitive consumer loan files into publicly accessible
    dumpsters.
        In addition to its enforcement efforts, the Commission has
    played a lead role in the President's Identity Theft Task
    Force. The task force's strategic plan recommended 31
    initiatives to reduce the incidence and impact of identity
    theft. The recommendations focus on, first, prevention, making
    it more difficult for criminals to steal data or to misuse data
    they do manage to steal. Second, victim assistance, helping
    consumers recover from identity theft. And, third, deterrence:
    Strengthening the tools that we have to catch and punish the
    criminals. Most of these 31 recommendations have been or are in
    the process of being implemented.
        With respect to prevention, the FTC has developed and
    distributed highly successful business and consumer guidance on
    data security. Materials include a very popular data security
    guide for businesses, which now comes with an online tutorial.
    And the Commission staff will be holding a series of regional
    data security seminars across the country beginning next year.
        On the consumer side, the Commission launched last year a
    multimedia campaign titled, Deter, Detect, Defend. Here is a
    copy of the package. It includes brochures and training kits.
    And the Commission sponsors a multimedia Web site, OnGuard
    Online, which has information for consumers on basic computer
    security. Since its launch, this Web site has attracted over
    4.3 million visits.
        Despite our best efforts to improve data security, however,
    there is no foolproof way to stop data theft. For that reason,
    it is critical that we do whatever we can to make the data less
    useful for thieves.
        As recommended by the task force, the Commission conducted
    two public workshops this year relating to the issue of
    consumer authentication. By creating better ways to verify
    consumers' identities when they open new accounts or when they
    access existing accounts, we can make it more difficult for
    criminals to use stolen data.
        Regulations recently issued by the FTC and the Federal bank
    regulatory agencies, under the FACT Act, provide another tool
    in the battle to prevent identity theft. These rules require
    all businesses that hold consumer accounts to establish an
    identity theft prevention program.
        With regard to victim assistance, the Commission has
    continued its role as a central repository for identity theft
    information. Between 15,000 and 20,000 consumers contact us
    each week for information on how to guard against identity
    theft, or to obtain help on recovery from it. Consumers who
    contact us receive step-by-step advice. At the same time, the
    information these consumers give us is entered into our
    clearinghouse and is made available to over 1,700 law
    enforcement agencies for use in law enforcement.
        We are also partnering with other agencies to provide
    training for local law enforcement across the country. And we
    have developed and posted a universal police report identity
    theft victims can complete online, print and take to law
    enforcement for verification. With this report, victims have
    access to a number of rights, including the right to place a 7-
    year fraud alert on their credit file.
        To summarize, identity theft is one of the most important
    consumer protection issues of our time and must be attacked
    from every angle. The Commission will continue to place a high
    priority on preventing this crime and helping victims to
    recover.
        We look forward to continuing our work with Congress in
    this effort. I would be happy to answer any questions you may
    have.
        [The prepared statement of Mr. Winston follows:]

                       Prepared Statement of Joel Winston

        Mr. Scott. Thank you.
        We have about 10 minutes before we have to be on the floor.
    So we will take your testimony, and then we will come back as
    soon as we can.
        Ms. Napp.

     TESTIMONY OF JAIMEE NAPP, EXECUTIVE DIRECTOR, IDENTITY THEFT
                 ACTION COUNCIL OF NEBRASKA, OMAHA, NE

        Ms. Napp. Thank you, Chairman Scott and Members of the
    Subcommittee.
        Thank you for this opportunity to share my story today and
    for your leadership and interest in this issue.
        My name is Jaimee Napp, and I am the executive director of
    the Identity Theft Action Council of Nebraska, a proud mother
    of a 7-year-old, and I am also an identity theft victim. Today
    I will speak about my own personal experience and offer support
    for the Privacy and Cybercrime Enforcement Act of 2007 but also
    will provide some additional suggestions on what can be done.
        I have regrets in my life, and one of them was taking a
    particular part-time job and handing over my Social Security
    number to my employer.
        In May 2005, my personal information, including my name,
    birth date and Social Security number were stolen and used to
    apply for four credit cards.
        The perpetrator turned out to be a manager at my former
    employer who stole my information from employee records. She
    was arrested in October of 2005 and charged with criminal
    impersonation, a felony, for stealing my identity. She served 5
    months in county jail only because she couldn't make bail, and
    then she was ordered to go undergo drug treatment for
    methamphetamine addiction.
        My perpetrator pleaded guilty on the felony charge in
    October of 2007 and was ordered to drug court, which is a
    program for nonviolent offenders with substance abuse problems.
    At drug court graduation in January 2008, a total of four
    felonies will be wiped clean from her criminal record like they
    never existed after only a year and a half of drug treatment.
        I have lost more than a nine-digit number from a piece of
    paper. This number happens to be the key to my financial past,
    present and future, even though no one assigns monetary value
    to a Social Security value number.
        When I became a victim of identity theft, I was not
    prepared for the overwhelming feeling of helplessness. And I
    was stunned at how quickly destruction came and how easy it was
    for my perpetrator to open credit cards.
        What I experienced was a deep sense of loss, including the
    sense of who I am, my entire core belief system, friends who
    didn't understand what I was going through and a sense of
    safety.
        The worry and uncertainty caused me to change my physical
    appearance and intensely watch for strange people or cars
    following me.
        In April 2006, the trauma started to affect my personal
    life working for a different employer. Because the original
    theft happened in the workplace, I started to become very
    uncomfortable and wasn't able to function at a normal level
    with my coworkers nor did I feel like I could trust management
    or my employer.
        Shortly thereafter, the stress became too much to hide or
    control. It started showing itself physically through my
    inability to sleep and increased paranoia, cloudy vision and
    forgetfulness. In May 2006, I sought counseling and was
    officially diagnosed with post-traumatic stress disorder. I am
    not a victim of a violent physical crime, but I certainly feel
    like someone who is.
        My reality is that I will never be in total control of how
    and when my Social Security will be used for the rest of my
    life. I must always have my guard up.
        My story does not end with heartache. It ends with hope. I
    had a choice to make. I could either forget, let this crime
    ruin my life, or create change. And the choice was easy.
        I founded a nonprofit organization in 2006 called the
    Identity Theft Action Council of Nebraska, and we educate
    consumers about identity theft and provide victim resources.
        I support tougher penalties and greater victim restitution
    included in this bill but would also like to offer a few
    suggestions.
        Criminal penalties and tools for law enforcement are only
    part of the solution. To more fully address the problem,
    Congress should require mandatory notification when personal
    information is breached and require mandatory data security
    requirements for business and government, and also provide
    consumers with affordable, easy-to-use security freeze rights.
        This is the first time I have spoken publicly about the
    depths of my pain with my crime, and I thank you for this
    opportunity. But my story only represents one person out of the
    millions of Americans who become victims each year.
        I would like to thank you again for this opportunity, and I
    would be happy to answer any questions.
        [The prepared statement of Ms. Napp follows:]

                       Prepared Statement of Jaimee Napp

        Chairman Conyers and members of the Subcommittee, thank you for
    this opportunity to share my story today and for your leadership and
    interest in this important issue. Today I will speak about my own
    personal experience with identity theft, offer support for the Privacy
    and Cybercrime Enforcement Act of 2007 and provide additional
    suggestions on what can be done to prevent identity theft. I hope my
    words will give you a glimpse into what real people--real victims of
    identity theft--are facing today and the depth of their suffering.
        No one actively seeks out opportunities to tell the world about the
    most vulnerable time in his or her life, but I speak today out of
    necessity. It is time for change--for new protections for victims and
    new tools to prevent ID theft--and time for identity theft victims to
    become visible to make that happen.

                            HOW I BECAME VICTIMIZED:

        I have regrets in my life as many people do. One of them was taking
    a part-time job in 2004 and handing over my social security number to
    my employer. It is an experience no one ever dreams could change your
    life in such a drastic way. Unfortunately for my family and me, this
    choice came with consequences for which I will pay for the rest of my
    life. Because of this one innocent exchange of information with my
    employer, I became a victim of identity theft.
        In May 2005 my personal information, including my name, birth date
    and social security number, was stolen and used to apply for four
    credit cards over the Internet. The perpetrator was a manager at my
    former employer who stole my information from employee records. I
    trusted my employer to keep these pieces of information safe and my
    employer had failed me.
        The perpetrator was not working in position that should have had
    access to employee's personal information. But the file cabinet where
    my information and that of twenty-three other employees was not kept
    locked as corporate security policy stated it should be. My employer
    also failed to complete a background check on the perpetrator,
    something also required by corporate policy. A background check would
    have shown my manager's criminal record contained forgery and theft-by-
    deception felony arrests.

        HOW I DISCOVERED THE THEFT AND WHAT HAPPENED TO THE PREPETRATOR:

        I am considered lucky because I was alerted to the crime soon after
    it occurred. One of the credit card companies called me to verify
    information on the application I had submitted. There was just one
    problem. I never submitted an application. After many hours digging for
    clues on my credit reports, I found three other credit cards that had
    been applied for in my name.
        I'm a member of a very small group of identity theft victims who
    have experienced the arrest and prosecution of their perpetrator. My
    perpetrator was arrested in October 2005 and charged with criminal
    impersonation--a felony--for stealing my identity. But the journey from
    investigation, arrest and charges was not an easy road. I had to fight
    everyday for seven months for someone to listen to me, pay attention to
    me and to acknowledge me.
        There wasn't a day that I didn't want to give up and let the
    perpetrator win, but something kept me going. I believe the arrest and
    prosecution of my perpetrator only happened because of my sheer
    determination. Most victims give up because the feeling of helplessness
    is overwhelming. Identity theft victims are largely invisible to law
    enforcement and the judicial system. We are seen as victims of property
    crime and many times not seen as victims at all.
        My imposter served five months in county jail before going to court
    and being ordered to undergo drug treatment for Methamphetamine
    addiction. Then for over a year and a half, I waited.
        Finally in October 2007 the plea hearing for the case was held. My
    perpetrator pleaded guilty to felony criminal impersonation for
    stealing my identity and was ordered to drug court. For the past year
    and a half, my perpetrator was participating in the drug court program
    for three additional felony charges.
        In January 2008, my perpetrator will graduate from drug court and
    all four felonies will be wiped clean from her criminal record, like
    they never existed. As I watch this happen, I stand before the court
    invisible.

                          IMPACT ON ME AND MY FAMILY:

        On that day over two years ago I lost more than a nine-digit number
    from a piece of paper. No one assigns monetary value to a social
    security number even though it is the key to my financial past, present
    and future.
        Identity theft feels a lot like having your home being robbed. A
    burglar goes through all your possessions and belongings and takes
    items you cannot replace. But before they leave, they steal the front
    door. Now what? Do you get a new door, change your locks, increase
    security around your home or move if you don't feel safe? As an
    identity theft victim none of these are options. You are helpless.
    Imagine what it would be like to try to sleep at night without a front
    door protecting your family from the night. It's a scary proposition.
    Your choices would be to either stand guard twenty-four hours a day or
    give up. Most identity theft victims give up.
        I consider myself an educated woman and capable of handling a lot
    of what life throws at me. When I became a victim of identity theft, I
    was not prepared for the overwhelming feeling of helplessness. There
    was literally nothing I could do but watch as my strong credit score,
    the result of years of hard work and sacrifice for my family's future
    hopes and dreams, was destroyed in a matter of moments. I am a young
    person and what flashed before my eyes was my dream house which I
    didn't live in yet, trips of a lifetime I dreamed of taking with my
    family and my eventual retirement. I was stunned at how quickly
    destruction came and how easy it was for my perpetrator to execute.
        What I experienced was a deep sense of loss of:

              A sense of who I am

              How I am portrayed to society

              My core belief system

              My internal intuition

              My love of hobbies

              My ability to express feelings and emotion

              Friends who didn't understand what I was going
            through

              My safety and security

        I had no idea how much information my perpetrator and their friends
    knew about me, but had to assume it was everything contained in my
    initial job application--name, address, social security number,
    education, references, phone numbers, previous work experience, birth
    date and email. The worry and uncertainty caused me to change my
    physical appearance, watch for strange cars around my home, watch for
    people or cars following me. I even went to my local police department
    to request mug shots of my perpetrator's friends so I could identify
    them if I was attacked.
        In April 2006, this trauma started to affect my professional life
    while I was working for a different employer. Because the original
    theft happened at work, I started to become very uncomfortable in the
    workplace. I was not able to function at a normal level with co-workers
    nor could I trust management and my employer.
        Shortly thereafter, the stress became too much to hide or control.
    It started showing itself physically. They included, cloudy vision;
    forgetfulness; increased heart rate; increasing paranoia; agitation;
    and inability to sleep
        In May 2006, I sought counseling and was officially diagnosed with
    Posttraumatic Stress Disorder--a definition adapted from the DSM-IV
    (American Psychiatric Association) as being exposed to a traumatic
    event, re-experiencing the event, persistently avoiding things or
    events, called triggers, associated with the trauma, persistent
    symptoms of physical arousal, symptoms that last more than a month.
    Because of these symptoms, there is significant impairment and distress
    in social, occupational or other important areas of functioning.
        I understand this may be difficult to comprehend. I fought the
    diagnosis, too. I'm not a soldier returning home from war; I'm not an
    assault victim; and I'm not a battered woman. I'm not a victim of
    violent physical crime, but I feel like someone who is. What I've
    learned is that no one can determine how a crime victim responds to the
    trauma of any type of crime.
        For a year I could not sleep through the night. I was awakened by
    every car door I heard in the street, every gust of wind and every
    sound of the night. I had increasing nightmares and became isolated. I
    numbed emotions and was paralyzed with irrational fear.
        My counselor, in collaboration with another psychologist,
    determined that my trauma triggers and crime scene were associated with
    the workplace. Even though my current work place was different, certain
    elements were constant. I was subjected to my trauma everyday, all day
    and it became clear I needed a break.
        My doctors determined I needed to be removed from the situation in
    order to learn how to cope, grieve for what I have lost, and respond to
    feelings in order to return as a productive worker. Their official
    diagnosis stated I needed three months away from work to complete this
    task. Because this time off could not be arranged with my employer, I
    left the job. Since then I have not been employed full-time by any
    company and my family continues to suffer from my lost wages.
        Identity theft is a cycle of victimization that can last for years.
    I do believe I will be victimized again in my lifetime. There's nothing
    stopping my perpetrator from harming me again. There is no protection
    order I can request from law enforcement that will keep me safe. My
    reality is that I will never be in total control over how or when my
    social security number is used for the rest of my life.
        For me, the damage was increased by the deliberateness of the
    perpetrator, whom I knew from a six-month working relationship and the
    indifference of law enforcement, the judicial system, my former
    employer, my current employer, the credit bureaus, and creditors. To be
    clear, I do not place blame on these entities. They appear uneducated
    about the harms they subject consumers to by either using lax security
    or by simply doing nothing at all. As I note below, more must be done
    to ensure that those who hold our financial futures in their hands are
    held accountable for their failure to meet their responsibilities.

                        HOW I TRANSFORMED MY EXPERIENCE:

        My story does not end with heartache. It ends with hope. Early in
    my journey I asked myself a lot of questions. Why isn't someone helping
    me? Why is this so difficult? Why am I constantly being asked to step
    aside, given no answers or hope? I had a choice to make; either forget,
    let this crime ruin my life or create change. The choice was easy and
    actually felt as though it chose me. As I asked myself those questions,
    I quickly realized I couldn't wait for someone else to do something. I
    had to do it myself.
        I founded a nonprofit organization in 2006 called the Identity
    Theft Action Council of Nebraska. Our mission is to educate about
    identity theft, provide victim resources and help shape legislation
    that empowers consumers. Our goals are to create a national model on
    how to tackle identity theft issues and reduce its impact on victims'
    lives.
        On this journey I have done things I have never imagined possible:
    traveled, met with leaders in the field and seen the difference courage
    to speak out can make. I have spoken to local, state and national media
    about identity theft.
        I have testified before the Nebraska legislature and played an
    integral part in the passage of the first consumer-led identity theft
    legislation in the state that gave consumers the right to place a
    security freeze on their credit files--a tool that prevents creditors
    from checking credit files, thus preventing ID thieves from opening new
    accounts.
        In 2007 our organization has educated over 2,000 Nebraskans about
    identity theft.
        We have built relationships with Nebraska Attorney General,
    Nebraska AARP, Consumers Union and other community groups. Our
    organization will continue to bring to the table groups and entities
    that can contribute and facilitate discussions across the state on how
    we can best help consumers and victims.

                     WHAT SHOULD BE DONE ABOUT THE PROBLEM:

        First, provide tougher penalties and greater victim restitution.
        The Privacy and Cybercrime Enforcement Act addresses that aspect of
    the problem by enhancing penalties and making it easier for victims to
    receive restitution for out-of-pocket costs and the value of the time
    spent resolving the problems of ID theft. Because one of the long-term
    impacts of ID theft is credit score damage--the cost of which may only
    later be realized--I'd recommend that the Committee make clear that the
    time spent resolving the problems of ID theft includes time spent
    repairing one's credit score--a process that goes beyond just wiping
    errors off one's credit file. In addition, I urge the committee to
    ensure that the actual and potential higher cost of credit to a victim
    of ID theft is explicitly covered as an out of pocket cost for which
    restitution is available.
        But criminal penalties alone cannot solve the problem of ID theft.*
    Identity theft has been a federal crime for many years, but those
    penalties didn't deter my perpetrator. Thus, criminal penalties and
    tools for law enforcement are only part of the solution. To more fully
    address the problem, Congress should:

              Require business and government to notify consumers
            when they are at risk.* Congress should require mandatory
            consumer notification when the security of sensitive personal
            information held by businesses about their customers and their
            employees is compromised. We need to know when we are at
            heightened risk so we can take steps to protect ourselves. But
            without requirements that we be notified, businesses have every
            incentive to sweep any security breach incident under the
            carpet. Tough penalties for failure to notify should also be
            imposed. Your bill, while not providing for mandatory
            notification, at least imposes penalties on those who do not
            meet existing, albeit largely weak, notification requirements
            under state and federal law.

              Impose duties upon business and government to
            safeguard our data.* Congress should couple mandatory
            notification with mandatory requirements that private
            businesses and government agencies adopt new data security
            procedures and technologies. Doing so creates both strong
            incentives and real obligations for businesses to protect
            sensitive information to prevent any breach from occurring in
            the first place. Tough penalties should be imposed for failure
            to comply. More than likely, I wouldn't be here before you as a
            victim of identity theft if my employer had simply locked a
            file cabinet containing my social security number. Data
            security can be achieved through both common-sense low-tech and
            high-tech means, just as identity thieves use both low-tech and
            high-tech means to perpetrate their crimes.

              Provide consumers with security freeze rights.*
            Congress should also provide consumers with affordable, easy to
            use security freeze rights. Right now, though the rights exist
            in many states, the freeze is still expensive and cumbersome
            (consumers must submit freeze requests via mail and most states
            don't provide for quick thaw allowing consumers to quickly and
            securely lift the freeze when they want to access credit). And
            the voluntary freeze the credit bureaus are making available is
            too expensive, and it is a tool that they could withdraw at any
            time. Plus, they have little incentive to promote its
            availability because, with the freeze in place, it makes their
            for-profit tools, like credit monitoring, irrelevant. Yet the
            security freeze is the only tool we have to stop the cycle of
            victimization of new account theft. It is not a luxury item and
            shouldn't be priced as one.

                                  CONCLUSION:

        Even though I have spoken many times about my victimization over
    the past two years, this is the first time I have spoken about the
    depth of my pain publicly. It was not easy to do. And because ID theft
    is a crime that rarely leaves physical marks, beyond tarnished credit
    records, it is not easy for those who haven't been victims to
    understand how deeply identity theft affects us. So I thank you for
    this opportunity.
        My story represents just one of the approximately ten million
    stories of Americans who were victimized by identity theft in 2005. I
    join a group of roughly fifty million American who have become victims
    of this crime since 2003. Each victim has his or her own unique story
    of loss.
        I applaud the committee again for your interest in the issue and
    urge you to move forward with your legislation. But I also urge
    Congress to do more. Congress must adopt tools that prevent these
    crimes from occurring in the first place by imposing new duties on
    those businesses and government agencies that hold the key to our
    identities in their databases and filing cabinets. Congress should go
    beyond criminal penalties and adopt strong protections without
    interfering with existing state laws regarding notice of breach,
    affordable, easy to use security freeze rights for all Americans and
    obligations for all businesses and government entities to protect
    sensitive data.
        Thank you again for this opportunity to testify.

        Mr. Scott. Thank you very much for your very moving
    testimony.
        We will vote. There are three votes pending, and we will be
    back as soon as we can. It will probably be about 15 minutes.
        [Recess.]
        Mr. Scott. The Subcommittee will come to order.
        The gentleman from California has approved starting off
    without the Ranking Member. So if the Ranking Member comes, he
    can blame it on the gentleman from California.
        Thank you.
        Mr. Holleyman.

       TESTIMONY OF ROBERT W. HOLLEYMAN, II, PRESIDENT AND CEO,
               BUSINESS SOFTWARE ALLIANCE, WASHINGTON, DC

        Mr. Holleyman. Mr. Chairman, Mr. Lungren, Mr. Coble,
    Members of the Subcommittee, I want to thank you for the
    opportunity to testify today. There is an urgent need to update
    our Federal criminal laws. And law enforcement needs new tools
    to find and prosecute cyber criminals.
        Why does the Business Software Alliance care about this
    issue? Several reasons. First, it hurts our member companies'
    businesses. Second, it hurts the development of electronic
    commerce. And third, because it hurts the economy as a whole.
        I want to thank you, Mr. Chairman, for calling this hearing
    and for the leadership you have shown in sponsoring the pending
    legislation, H.R. 4175. I also want to commend Congressmen
    Schiff, Chabot, Mr. Lungren and others for their leadership in
    introducing H.R. 2290 earlier this year.
        Today's hearing could not come at a better time. We are in
    the midst of the holiday season, and Americans will spend
    nearly $30 billion in online shopping activity. They will be
    able to shop at thousands of sites, compare products, services
    and get prices that would have been unavailable just a few
    years ago because of the advances related to geography and
    comparative shopping that are brought about by the Internet.
        At the same time, we know--studies show that many
    individuals are concerned about their safety when doing
    business online, about the risk of criminals who might be
    lurking in cyberspace who want to steal their identity, their
    financial records or more. Unfortunately, these concerns are
    fully justified.
        The reality is that we use our computers at home and the
    office in ways today that were unimaginable the last time there
    were major revisions in the Federal criminal laws. This has led
    to an evolution of cybercrime, and it has changed the type of
    criminals.
        Two big changes have occurred in computing. First is the
    sheer growth of the number of people using computers. The
    second is the fact that computers are now almost always on and
    connected to the Internet. This has given criminals the
    opportunity to create malicious code that can be sent out
    surreptitiously and can compromise thousands or hundreds of
    thousands of computers. This results in the creation of zombie
    computers that the criminal can then remotely control to carry
    out the attacks. The zombies may not themselves suffer monetary
    damage, but they may become an unwitting accomplice in
    attacking other victims of financial crimes or identity theft
    or denial of service.
        We also see that cybercrime today is overwhelmingly fueled
    by profit. Criminals used to write malicious code for the
    bragging rights. Today they do it for the money. And that is a
    change.
        What can Congress do about it? We believe that there is an
    urgent need to update our criminal laws to get law enforcement
    the tools they need to respond to the changing nature of the
    threat and the changing nature of cybercrime. We would suggest
    doing this in five ways.
        First, targe botnets in ways that have been identified
    today by criminalizing cyber attacks on 10 or more computers
    even if they don't suffer more than $5,000 worth of damages.
        Two, address new forms of cyber extortion.
        Three, broaden the coverage of cybercrime laws to include
    computers affecting interstate and foreign commerce.
        Fourth, attack organized cybercrime by creating an explicit
    conspiracy to commit cybercrime as an offense.
        And fifth, strengthen penalties by calling for the
    forfeiture of computers and other equipment that are used to
    conduct crime and by adopting tougher sentencing guidelines.
        Fortunately, there is broad congressional, law enforcement
    and industry support for such legislation. There are a number
    of pending bills, including H.R. 2290, that address these
    issues. Last month, the Senate adopted S. 2168, and finally,
    Mr. Chairman, your bill does that with the exception of the
    provision to target botnets, which we hope will be added to any
    final measure.
        Of course H.R. 4175 has many other provisions, including
    data breach notification and privacy. BSA understands the
    seriousness of the problems data breaches represent. We are
    committed to working with this Committee and with the six other
    Committees who have jurisdiction over this legislation in data
    breach to develop a comprehensive Federal legislation. But we
    are very concerned that the inclusion of data breach or privacy
    in cybercrime legislation will delay or prevent enactment.
        In conclusion, we are eager to work with this Committee. We
    believe the time is now, and we encourage moving forward and
    addressing and closing the loopholes that exist under today's
    cybercrime laws.
        Thank you.
        [The prepared statement of Mr. Holleyman follows:]

                   Prepared Statement of Robert W. Holleyman

        Mr. Scott. Thank you very much.
        Ms. Coney.

       TESTIMONY OF LILLIE CONEY, ASSOCIATE DIRECTOR, ELECTRONIC
               PRIVACY INFORMATION CENTER, WASHINGTON, DC

        Ms. Coney. Thank you, Chairman Scott, Ranking Member
    Gohmert and Members of the Subcommittee for this opportunity to
    testify on the bill H.R. 4175, the ``Privacy and Cybercrime
    Enforcement Act of 2007.''
        My name is Lillie Coney. I am associate director at the
    Electronic Privacy Information Center. EPIC is a nonprofit
    research center based here in Washington, D.C. We focus on
    privacy, civil liberties and constitutional values.
        With me this afternoon is Jonathan David, a student at
    Northeastern Law School who assisted with the preparation of
    our statement. Our thanks go to the sponsor of the bill.
        To a great degree, the lack of transparency on data
    breaches, computer system breaches, anomalies and software
    failures inhibits the ability of the government to proactively
    address computer network vulnerabilities and enforce privacy
    laws. The old saying that what you don't know won't hurt you
    has rarely held true, and when it relates to data breaches, it
    is never true.
        According to the Federal Trade Commission, for the seventh
    year in a row, identity theft is the number one concern of
    American consumers. We also know that 260 million Americans
    have had data breaches impact them. The failings of private
    actors to manage the personally identifiable information
    entrusted to their care justify the passage of H.R. 4175.
        Further, a report from the Samuelson Clinic confirms that
    the private sector is willing and able to act in putting in
    place security measures to protect computer networks that house
    personally identifiable information when that data--when data
    breaches require, under statute, notification to consumers.
        We appreciate that this bill will do what the Privacy Act
    should have done: Include private data networks under the
    requirements to protect personally identifiable information.
    This is a key component for privacy protection afforded by fair
    information practices that are outlined in the Privacy Act.
        The provisions of the bill do not preempt State law but
    rather create an important Federal baseline. As we have
    learned, the States can respond more quickly than the Federal
    Government can to emerging privacy challenges, and it is very
    important that the Federal Government not limit the important
    work of the States in this area.
        The bill creates a great start on defining personally
    identifiable information, but more needs to be done.
        We are now seeing a tremendous increase in the collection
    of personal information in the form of biometrics, behavioral
    targeting and associational information, all of which is
    completely unregulated.
        The challenge for the Committee is to create a definition
    that recognizes the ever-evolving risk data collection poses to
    privacy.
        EPIC endorses the bill language that requires technology
    protection measures that render the data elements
    indecipherable. We note that significant data breaches have
    occurred because of poor security practices or circumvention of
    security measures, such as removal of large quantities of data
    records from office locations on personal portable computer
    devices that were subsequently lost or stolen.
        Regarding the promulgation of the final privacy impact
    assessment, electronic records are illusive things. It may be
    very difficult to enforce the intent of the provisions of this
    statute.
        For example, EPIC recently discovered in the midst of our
    involvement in an agency proceeding before the Federal Trade
    Commission regarding the proposed merger of Google and
    DoubleClick that the chair of the FTC's spouse's law firm,
    Jones Day, represents one of the parties to the merger. Upon
    our making a complaint requesting the recusal of the chair from
    participation in the commission's decision-making role on the
    merger request, the electronic document disappeared from the
    Jones Day Web site.
        This phenomena of the disappearing of electronic documents
    is not limited to non-government Internet communications. It
    has also been observed by EPIC and the actions taken by Federal
    Government agencies when publishing documents online.
        In closing, I would like to thank the Subcommittee for this
    opportunity speak on the record regarding the important
    measures set forth in H.R. 4175 and strongly endorse the
    efforts to address the issue of data breaches involving
    personally identifiable information, and the efforts of the
    sponsors of the bill and the Subcommittee to make more
    transparent the rule-making process related to privacy impact
    assessments.
        Thank you.
        [The prepared statement of Ms. Coney follows:]

                       Prepared Statement of Lillie Coney

        Mr. Scott. Thank you very much.
        We will now have questions from the Members, and I will
    recognize myself for 5 minutes at this time.
        Mr. Lourie, Mr. Magaw, the Identify Theft Penalty
    Enhancement Act included $10 million authorized to track down
    identity thieves. What have you done with the money?
        Mr. Lourie. We have been actively pursuing identity theft
    cases around the country, Chairman Scott. In the last--between
    2005 and 2006, identity theft cases alone increased about 22 or
    23 percent from 1,500 and change to 1,900 and change.
        Many of those were under the aggravated identity fraud
    statute. Those numbers increased from 226 in 2005 to 507 in
    2006.
        In addition, there are--the Secret Service and the FBI have
    been establishing task forces all over the country joining
    together with their Federal colleagues as well as local law
    enforcement and State law enforcement to attack identity crime
    at a local level and to ensure that as few of these cases as
    possible slip through the cracks.
        Mr. Scott. So you are putting the $10 million to good use?
        Mr. Lourie. Yes.
        Mr. Scott. Did you run out of money?
        Mr. Lourie. I don't know if we did, but I can get back to
    you.
        Mr. Scott. Well, if you are tracking down cases with the
    money, do you have enough? When one of the bills, the $10
    million came out of, the original bill had $100 million, and we
    were told by the Administration they didn't need any money so
    we just left it $10 million; $10 million we got left. It seems
    to me that this ought to be a high priority, and I think the
    Committee--maybe, I can't speak for the Committee--but I would
    be willing to put some more authority so that you could track
    down more thieves so that people will get the idea that they
    might get caught.
        Have you used up all of the $10 million so we might
    consider increasing the authorization?
        Mr. Lourie. As I sit here today, I can't tell you whether
    or not we have used up all of the $10 million, and I would be
    happy to work with the Committee and get back to you on that.
        Mr. Scott. If you have limited funds, you have to make
    decisions. You have the $5,000 threshold. Anybody stealing less
    than $5,000 is pretty much home free. What would it--how much
    would it take to get cases under $5,000 also on your target
    list?
        Mr. Lourie. Well, I can't tell you how much it would take
    with respect to money, if that is your question, for
    prosecution offices, U.S. Attorneys' Offices around the country
    to lower their thresholds or if the Department would support
    that.
        I can tell you that we have used the money that we have had
    to create these regional task forces to work together closely
    with the State prosecutors' offices and State law enforcement,
    and train them in the investigation and prosecution of these
    types of crimes.
        Mr. Scott. The problem with these cases, they are, in fact,
    labor intensive because there is a lot of work that needs to be
    done. And the information is there, but some of it might
    include, when you find out that somebody with a stolen credit
    card has it delivered to a post office box, you may have to
    have somebody sit out there until they come and pick it up. You
    have to pay for that. That is an hourly rate.
        So that many of these cases can be solved if you just had
    the resources, and so we will work together to find out what
    resources you may need to lower the threshold, so if somebody
    gets the information, they may feel they have--they are at risk
    of actually getting caught.
        Now if a database is breached, is the mere possession of
    the database a crime?
        Mr. Lourie. It depends if it is knowing. If a database is
    breached and somebody extracts the information, then, yes. If
    it is unauthorized extraction, it is a crime.
        Mr. Scott. Is buying a Social Security number from somebody
    a crime before you actually--without using it----
        Mr. Lourie. I don't have the statutes in front of me, but I
    believe under title 42, the Social Security statute, that that
    possession, if it is with intent to commit fraud, would be a
    crime.
        Mr. Scott. But mere position, if you buy a Social Security
    number and that is all you have got, you don't know what they
    are going to do with it?
        Mr. Lourie. Well, it is fairly easy to prove that somebody
    who buys somebody else's Social Security number intends to
    commit fraud with it.
        But the answer to your question is, yes; if you could not
    prove that element, then you would not be able to satisfy the
    statute.
        Mr. Scott. Is phishing a crime?
        Mr. Lourie. Phishing is a crime if it violates one of the
    statutes set forth in 1030, the elements.
        Mr. Scott. Do we need to make it clear that phishing is in
    fact a crime?
        Mr. Lourie. No, Chairman Scott. I don't think it is
    necessary--it is necessary to change the language of the bill
    the way you have it now to indicate that phishing itself is a
    crime. The language set forth in the bill is adequate to
    capture those types of scams with the suggestions that we have
    set forth here today.
        Mr. Scott. Several people have mentioned whether or not
    just putting a cookie on somebody's computer where you can
    extract information without so-called damaging the computer, is
    that not trespassing or some crime, unauthorized placing of one
    of those cookies in somebody's computer so that you can get
    information? Isn't that some kind of crime?
        Mr. Lourie. Well, what I would like to do is go back and
    get back to the Committee on that question.
        Certainly it sounds like a variation of a botnet the way
    you asked that question. But there are, depending on the way
    you analyzed the statute and the various elements of the
    statute, the intent of the person who puts it there is
    significant.
        Mr. Scott. I have heard the suggestion that it ought to be
    a crime if you do it to 10 computers. Is there any reason why
    if you do it to one computer, why that shouldn't be a crime?
        Mr. Lourie. It may very well be a crime under various State
    statutes. What we are attempting to do is bring more crimes
    within the purview of the Federal statute, not less.
        Mr. Scott. So we will be working together on that.
        The gentleman from Texas.
        Mr. Gohmert. Thank you, Mr. Chairman.
        Appreciate your testimony and appreciate your patience.
        Just so I am clear on the BSA's position,
        does BSA support a new Federal law that would require
    businesses to report or to notify consumers every time a
    security breach occurs?
        Mr. Holleyman. We support the concept of a comprehensive
    Federal data breach bill that would address the issue of
    businesses notifying consumers when there is a significant or
    major breach that occurs.
        Mr. Gohmert. My question is not whether we should have a
    comprehensive bill that addresses that but whether you support
    actually requiring businesses to notify consumers when the
    breaches occur.
        Mr. Holleyman. We support notification to consumers under a
    properly crafted definition of what a significant breach is
    with other key components. For example, as one of my colleagues
    on the panel spoke of, if information is encrypted or redacted
    or otherwise stored in such a fashion that it is not accessible
    when it is breached, there shouldn't be an obligation to
    notify.
        We also believe that there are a number of other important
    provisions in an overall data security bill. That is simply one
    element of a number of provisions we would like to see.
        Mr. Gohmert. Ms. Napp, we appreciate your coming forward.
    Apparently, we may not even know how many people have actually
    been adversely harmed as you have. And you mentioned that the
    perpetrator against you was going to have their record wiped
    clean after a year and a half of drug treatment apparently.
        So let me ask. I know there have been laws, like in Texas
    where people have become so outraged about driving while
    intoxicated or driving under the influence, depending on what
    your State calls it, or negligent infliction of harm through
    driving while intoxicated, and people became outraged enough
    they said, okay, let us have a law. No more deferred
    adjudication. If you commit this, it ought to be on your record
    for good and you can't come out from under it.
        By bringing that up, are you actually urging the
    possibility, at least in the Federal realm as far as we can,
    end deferred adjudication where it has to be on someone's
    record?
        Ms. Napp. I was referring to my case as it stands and what
    is happening to me.
        Mr. Gohmert. But I am asking. You were adversely affected.
    What do you think?
        Ms. Napp. I personally don't think, you know, something
    like this--I think it has to do with identity theft victims in
    general. A lot of the time in the judicial system, we are not
    seen as victims of a crime a lot of times. And in my case, I
    don't believe that I was seen as a victim when the judge at the
    plea hearing--he felt like a restitution hearing wouldn't be
    needed because, how could I possibly have any type of out-of-
    pocket costs, and that comment to me says, I don't see you.
        Mr. Gohmert. Obviously the judge didn't understand the
    crime. But it seems to me that as we contemplate this crime,
    what is a crime, that it brings to mind some of the lessons we
    learned in law school about crimes of moral turpitude, and in
    society, we think those are more serious crimes because they
    involved a mens rea. They involved an intent.
        You brought up intent a lot of times. It seems to me that
    this ought to be one of those crimes that if you break into
    somebody's computer, if you get their private information, then
    regardless of what the intent is, you know, the res ipsa
    loquitur ought to apply; the thing speaks for itself. You have
    the intent and take that intentional aspect out of the proof
    that you have to put on.
        So think about it. It involves lying. It involves fraud. It
    involves theft. In some cases, like when recently a week or so
    ago, it involved burglary to break in and put stuff on a
    computer so you could track what they were doing.
        So I think this hearing is a great thing, and I do think we
    need to make this bill as tough as possible so that America
    understands how serious this crime is.
        I would like to ask. I note, Ms. Napp, you recommended
    requiring mandatory notification when data is breached.
        Let me ask you all. Who among the witnesses has actually
    read this bill that we are here about today? Anybody? Wow. All
    of you.
        Well, I see my red light is on.
        I would like to ask specifically if you could quickly say
    if you have any specific provisions that you would like to see
    changed so we could make note of them and try to improve the
    legislation.
        Mr. Lourie, starting with you. If you have got a long list
    there, I would like to hear the list.
        Mr. Lourie. Thank you, Congressman.
        Our recommendation and request would be to modify Section
    1030(a)5 regarding damage to computers, as we spoke about
    before, to add language that would make it a felony if the
    conduct affected 10 or more computers, and also to make it a
    misdemeanor for damage under $5,000.
        We would recommend modifications to Section 1028 and
    1028(a) to define persons to include corporations so that the
    stealing of identity of a corporation often used in phishing
    schemes would also be a crime under 1028.
        We would also add certain crimes to the list that would be
    predicates for the aggravated felony under 1028(a), and we
    provided those in our papers.
        We would ask for a modification to 1030(a)7, which is the
    extortion statute, to enable that statute to reach threats to
    do--to release--for example, to release information that had
    already been stolen.
        The way that the statute is drafted now, it covers threats
    to do damage but not necessarily threats related to damage
    already done.
        So we believe that the statute needs a little bit of
    tweaking there.
        We have some suggestions for the forfeiture section to
    include real property and to change the language in one of the
    prongs from proceeds to gross proceeds.
        And, finally, and perhaps most significantly, we request
    changes or directives to the sentencing commission to focus not
    just on the sentences in general but certain specifics which
    would include defining a victim as not just somebody who
    suffers monetary loss but somebody who suffers an invasion of
    privacy. And that relates to some of the topics that have
    already been discussed in this hearing today. And in any event,
    it is hard to value information stolen.
        Finally, with respect to the sentencing commission, we
    would request that they be directed to look into the
    aggravating factors that are already there or the enhancements
    that are already in the statute, that they be accumulated
    instead of now, applying whether they are the greatest of, is
    the language that is now used.
        We would also suggest an enhancement that the sentencing
    commission look at whether there should be an enhancement for
    disclosure of information stolen, because it is a separate harm
    and in some senses maybe even a more significant harm once
    information is stolen to disclose it, depending on how many
    people it is disclosed to.
        Thank you for that opportunity.
        Mr. Gohmert. We have got five more, and I don't want to
    exceed my time that much. If I could ask the witnesses if you
    could submit in writing any suggestions for changes to the
    legislation, that would be greatly appreciated. And that would
    include all of you, including, Mr. Lourie, if you think of
    anything else. But thank you so much.
        Mr. Scott. The gentleman from North Carolina.
        Mr. Coble. We appreciate you all being here.
        Mr. Holleyman, you responded to Mr. Gohmert's question
    regarding notifying consumers under a properly crafted statute.
    Would you also require--support the requirement that business
    notify law enforcement?
        Mr. Holleyman. Mr. Coble, I appreciate your follow-up
    question on that.
        The answer is yes. We would support the requirement that
    businesses notify law enforcement when there is a breach, and I
    think there is probably great clarity in terms of our support
    for that.
        Again, it is with the caveat that the requirement it needs
    to define what a significant breach is. It needs to ensure that
    there is not notification if it is unnecessary, but the
    principle is worthwhile. We would hope that is addressed as
    part of a comprehensive breach bill.
        Mr. Coble. Thank you, sir.
        Mr. Winston, what steps does the FTC take to make sure that
    businesses adequately protect personal information from
    identity thefts.
        Mr. Winston. We go about this in several ways, beginning
    with law enforcement. As I mentioned in my testimony, we have
    brought 15 law enforcement cases now against companies that
    failed to reasonably protect consumer data, in most cases
    leading to a data breach.
        And in addition to law enforcement, we also do a lot of
    consumer and business education and outreach. We have published
    educational materials. We are going to be holding regional
    seminars for businesses so that they understand what their
    obligations are and they understand what the consequences are
    if they don't meet their obligations.
        Mr. Coble. Thank you, sir.
        Are laws, Mr. Winston, requiring protection of personal
    information limited to certain industries or certain sectors,
    such as banking or other financial industries?
        Mr. Winston. Yes, that is correct. There are a number of
    data security laws that apply to different kinds of data or
    different kinds of industries. The financial services industry
    is one; the health care industry is another.
        As part of the Identity Theft Task Force recommendations,
    we have supported a national data security law that would apply
    across the board to any business that maintains personal
    information. We think that there should be one rule.
        Mr. Coble. Thank you, sir.
        Ms. Napp, how can we assist in improving restitution for
    identity theft victims?
        Ms. Napp. Thank you, sir, for that question.
        I think what you are doing with allowing victims to count
    their time is very important. I think this is the first time
    that we have actually seen some of that, because time is so
    much of what we deal with.
        Mr. Coble. Now, fortunately I have never been a victim. How
    does one fairly and, if possible, easily restore one's credit
    record after having been a victim?
        Ms. Napp. That one is--each----
        Mr. Coble. It probably can't be done easily.
        Ms. Napp. In my opinion, it is difficult. There are
    barriers and things. And each person's victimization is
    different, but the journey is not an easy one, I can tell you
    that.
        Mr. Coble. Well, again, thank you all for being here.
        Mr. Chairman, note that I am yielding back before the red
    light illuminates.
        Mr. Scott. That is very kind of you, Mr. Coble.
        The gentleman from California, Mr. Lungren.
        Mr. Lungren. Thank you very much, Mr. Chairman. I didn't
    know whether the Ranking Member needed more time for his
    questions.
        Mr. Scott. That is between you and the Ranking Member.
        Mr. Gohmert. Thank you for yielding.
        Mr. Lungren. Well, it must be a Texas thing.
        Representative of the Justice Department and also the
    gentleman representing the FTC, I am concerned about this whole
    area, particularly, of identity theft. And if we enact
    legislation, I would like to ensure that it actually works.
        And one of the things that strikes me on the bill that we
    have before us is that it acts a little differently than some
    other laws that I am aware of, which is that when the Congress
    preempts State law, it then gives the State AGs the authority
    to assist in the enforcement of Federal statutes.
        This bill as drafted, as I understand it, allows that, but
    does no preemption at all. Is that unusual in law, in your
    experience, or is that something that we see somewhere else?
        Mr. Lourie. Well, with respect to our experience, I would
    be happy to get back to the Committee on other areas where we
    have seen this.
        I will note that in the Task Force's strategic report,
    which is cochaired by the Department, they did recommend that
    type of preemption.
        Mr. Lungren. See, my concern is we are creating a lot of
    criminalization of activity on a Federal level, and yet I
    wonder whether we have the resources to follow through with it
    truly. And, therefore, is this really an attempt to create a
    Federal statute of criminal sanctions, but with the expectation
    that it will truly be enforced by the States instead of the
    Feds? And if we are going to do that, we ought to know about
    that.
        But it seems to me a little different than we've done
    before. And maybe I am wrong. Maybe there are other areas of
    the law. Maybe the gentleman from the FTC can help me on this.
        Mr. Winston. As Mr. Lourie said, the Identity Theft Task
    Force, in some of its recommendations, particularly with regard
    to----
        Mr. Lungren. Look, I understand they may have suggestions.
    I am asking, is this a precedent or is this something that we
    have found in other areas of the law? That is what I am trying
    to figure out.
        Mr. Winston. I think there are a number of laws that
    provide for Federal preemption but allow for State attorney
    general enforcement. The Fair Credit Reporting Act is one. So
    that model is, I think, not uncommon.
        Mr. Lungren. Where we have no preemption here, but still
    extending that.
        Mr. Winston. Well, that I am not sure about. I know there
    are----
        Mr. Lungren. Okay. That is what I am trying to figure out.
    If you can help me in looking at that and submitting that for
    the record.
        Title 2 of the legislation authorizes a civil action with
    civil penalties up to $500,000 or a million dollars if it is
    intentional from any business entity that--it says, ``from any
    business entity that engages in conduct that constitutes a
    violation of Federal law relating to data security.''
        If you have had a chance to look at the bill, do you think
    that limits it to for-profit entities only, or would that be
    not-for-profit as well? And how would you look at it from the
    Justice Department standpoint?
        Mr. Lourie. I am appearing here as a member of the Criminal
    Division, so I did not scrub the civil sections of the bill.
    But we would be happy to review that and get back to you on our
    opinions about whether or not it would cover both those types
    of entities.
        Mr. Lungren. Okay. I am trying to sort of figure out where
    we are here. Because I want a statute that works, but I also
    want one that doesn't just sit on the books and we think it is
    going to work. Or, frankly, if we pass Federal laws that are
    primarily being enforced by Federal authorities, to me that is
    extremely important, but it is more difficult for us to have
    oversight if what we are doing is passing Federal laws that are
    going to be absolutely, if not exclusively--or primarily, if
    not exclusively, prosecuted at the State level. And I wonder if
    there are implications with respect to constitutional authority
    in that.
        The way I read the bill--I would ask you if this seems to
    make sense, because we can certainly change it--it looks like
    it provides an across-the-board maximum penalty of 20 years for
    all violations of Section 1030 of title 18.
        Now, unless I missed something, that could be interpreted
    as meaning that failure to notify breaches would carry a
    harsher penalty for the businesses than for the ID thieves
    themselves. To me, that doesn't sound like a proper priority.
    Would you agree with that, or is that something that you think
    makes sense?
        Mr. Lourie. I believe the way the bill was drafted, it
    provides for a 5-year penalty, maximum penalty, for the failure
    to notify.
        Mr. Lungren. So your answer is, that is what you would
    want, rather than the way I thought it was written.
        I have a lot more questions, but I would like to respect my
    time limits and would yield back.
        Mr. Scott. That is a novel concept on this Subcommittee,
    but thank you.
        The gentleman from Ohio.
        Mr. Chabot. I thank the gentleman for yielding.
        Mr. Holleyman, news reports indicate that crimes committed
    via computers are becoming increasingly prevalent, and I know
    that is what we have been discussing today, with as many as 10
    million computers falling victim to hackers. FBI Director
    Mueller is quoted as saying that, quote, ``Botnets are the
    weapon of choice for cyber criminals,'' unquote.
        How urgent is it that we pass cybercrime legislation? And
    can we afford to wait on cybercrime legislation while we
    address other problems with Internet security?
        Mr. Holleyman. Mr. Chabot, thank you for that question.
        I think that it is imperative and urgent to pass cybercrime
    legislation. I think there is broad agreement in both houses of
    Congress and across the aisle in terms of what loopholes need
    to be closed.
        Your question is correct, the growth in botnets is an
    enormous problem. And that is bringing law-abiding citizens
    unwittingly into a process in which their computers are being
    hijacked and used to perpetrate crimes. It may slow down their
    computer, it may be a nuisance for them, but they don't
    otherwise know what is happening. And we should not insist that
    law enforcement be required to show that there is $5,000 worth
    of damage to take action in that case.
        So we believe the problem is immediate, and is growing.
    There is a solution, and we hope the Congress moves quickly on
    this.
        Mr. Chabot. Thank you.
        And are legislative efforts enough? And what can consumers
    and businesses do to protect themselves to minimize the threat
    of cybercrime?
        Mr. Holleyman. Legislation is a key part, but it is not, by
    itself, the sole solution. There are public awareness
    activities that are under way through the FTC and other
    agencies to build awareness of cybercrime. There are private-
    sector efforts to provide checklists to business owners of the
    type of security products they need to deploy and security
    procedures.
        And finally, there are joint partnerships between industry
    and law enforcement. The National Cyber Forensic Training
    Alliance in Pittsburgh is just such an organization. BSA
    supports it, as do many in the industry. They collect data on
    cybercrime, share that information with law enforcement, and
    assist with investigations.
        So it takes a combined effort, of which legislation is only
    one component, but it is an essential component.
        Mr. Chabot. Thank you very much.
        And, Mr. Chairman, as my colleague from North Carolina did,
    I would be happy to yield back my time at this time in the
    interest of the rest of the Committee. I could divide it
    between the gentleman from Texas and the gentleman from
    California here, but I think I will just yield back.
        Mr. Scott. Well, we will see.
        The gentlelady from Texas.
        Mr. Jackson Lee. Thank you very much, Mr. Chairman.
        Let me thank you, Mr. Conyers, and the other cosponsors for
    moving forward on what will continue to grow to be, maybe in
    some eyes, an insurmountable problem as we become more
    technological and the sophistication of the technology that we
    use becomes more finite, certainly, and more broadly utilized.
        It seems that privacy in the midst of innovation is a
    stepchild. And I think that the Congress has a duty to ensure,
    as the ninth amendment instructed us to do, to not forget
    privacy but also the abuse of too much information, identity
    theft and otherwise. With the good comes the bad; with the
    benefit comes the burden.
        And so, Mr. Magaw, as it relates to the potential crime
    that may come about through the misuse of this technology,
    cyber security, my question would be the ability and the need,
    if you will, to ensure coordination between all levels of law
    enforcement, even if you are speaking of, for example, in
    Houston, Texas, what we call layered police work.
        We have, like, a constable that has a jurisdiction, maybe,
    of 750,000 or 800,000. Those are individuals that are closer to
    the constituents. They are the ones who do the eviction work
    and otherwise. But, again, they are right there on the ground.
    And we have sheriffs, we have police officers, of course we
    have the FBI, and of course the U.S. Secret Service, and just a
    number of layers.
        So I would be interested in that.
        I would be interested for Ms. Coney--and welcome--to again
    establish for us how significant a problem is this whole issue
    of the invasion of our privacy. Give us, if you will, the
    broadness of the problem and the depth of the problem, if you
    will.
        And I have another question, but let me yield to Mr. Magaw.
        Mr. Magaw. Thank you very much.
        We partner very well with State and local law enforcement,
    as well as Federal agencies. And we realize the importance of
    sharing information on different cases that we are working.
        Quite frankly, across the country we have 29 different
    financial crimes task forces and 24 electronic crime task
    forces. Those task forces are built on sharing of information,
    not only with law enforcement, with the private sector, as well
    as the academic community. I feel the sharing of the
    information with Federal, State and local law enforcement
    addresses those concerns that you have.
        Mr. Jackson Lee. And let me just expand a little bit more.
    Are you in constant communication with local law enforcement?
    Maybe I have missed it. Are there task forces that are
    addressing this question?
        Mr. Magaw. Yes. On all of our task forces, financial crimes
    task forces, as well as electronic task forces, State and local
    law enforcements are key partners in those task forces.
    Information is disseminated through them back to their
    department, so that we are coordinating our efforts to address
    identity theft.
        Mr. Jackson Lee. Ms. Coney?
        Ms. Coney. Thank you, Congresswoman Jackson Lee.
        This is probably the most significant part of why data
    breach is even being considered by this Committee. Millions of
    records of individuals are online or available through
    electronic transfer. The question is whether it is the victim's
    responsibility or whether it is the data holder's
    responsibility to manage control of that information.
        You have to remember, victims are in damage-control mode.
    They have no idea that they have been attacked until they get
    notice. When they get notice, they can react. Unfortunately,
    the notice is usually coming because they have gotten some
    communication through the mail or looked at their credit report
    and that is when they know that someone has appropriated their
    identity and literally stolen their names.
        It takes hundreds of hours sometimes just to correct that
    information. And the mental anxiety and the stress that comes
    with that is very difficult for people who have not been
    victimized to even understand.
        Those who are in possession of the data have an obligation,
    a moral obligation--and it should be a legal obligation--to
    inform people when these things occur.
        Now, the jurisdiction of this Committee limits what you can
    do in that regard. You can hold data managers--because the data
    owners are really the people whose information they are
    controlling--make them responsible for reporting to a
    Government agency. That agency, in turn, will report through
    the Federal Register a list of those entities who have had
    their data compromised.
        I think this is a reasonable approach. The numbers of
    victims--216 million Americans have been impacted by loss of
    data. It is appropriate and definitely----
        Mr. Jackson Lee. Is that in this legislation, what you have
    just recommended?
        Ms. Coney. Yes, it is. The part that requires those
    entities that suspect that their data has been compromised must
    report to the Secret Service the compromise. And the Secret
    Service, in turn, once a year, will publish in the Federal
    Register a list of those entities.
        Mr. Jackson Lee. Thank you, Mr. Chairman.
        Let me just comment and highlight Section 102 that provides
    criminal penalties for those who don't provide the notice of
    the security breach.
        And, finally, might I say, what we don't have yet, which we
    expect to have in the next couple of years, is electronic
    reporting of medical records. Once we add that large component
    required to the system, putting all medical facilities and
    physicians online, we have an enhanced opportunity for abuse.
    And so I hope this legislation will move through this Committee
    and move to the floor and have the President's signature.
        I yield back.
        Mr. Scott. Thank you.
        And I want to thank all of our witnesses for their
    testimony.
        Members may have additional questions to ask, and we will
    submit those to you in writing, and we would appreciate it if
    you could respond as soon as possible so the answers can be
    part of the record.
        Without objection, the hearing record will remain open for
    1 week for the submission of additional materials.
        The Chairwoman of the Commercial and Administrative Law
    Subcommittee has offered a statement. She has reminded us that
    some of the parts of the bill come under the jurisdiction of
    her Subcommittee, as well as most of it in this Committee, and
    so she has an interest in this legislation.
        The gentleman from Texas.
        Mr. Gohmert. Thank you, Mr. Chairman.
        I was made aware that there may have been a study that
    actually deals with how often businesses notify consumers of
    breach or loss of data. And is that right, Mr. Lourie?
        Mr. Lourie. It is not a Government study, but there has
    been a study done.
        Mr. Gohmert. Okay. Could you direct us to that and the
    information to follow?
        Mr. Lourie. Yes, I will provide that information.
        [The information referred to is available in the Appendix.]
        Mr. Scott. And does that study indicate how often criminal
    activity takes place after a breach?
        Mr. Lourie. I don't know if it does. The only thing I know
    about this study is that--and, again, this is not a Government
    study, and we cannot say with any degree of certainty whether
    it is accurate. But the only thing I know about the study as I
    sit here--and we will provide it to you--is that they estimate
    that approximately 30 percent of breaches are reported by
    victims.
        Mr. Scott. Thank you.
        Without objection, the Committee stands adjourned.
        [Whereupon, at 4:55 p.m., the Subcommittee was adjourned.]

                                A P P E N D I X

                                  ----------

                   Material Submitted for the Hearing Record

           Prepared Statement of the Honorable Sheila Jackson Lee, a
               Representative in Congress from the State of Texas

    Prepared Statement of the Honorable Linda T. Sanchez, a Representative
    in Congress from the State of California, and Chairwoman, Subcommittee
                      on Commercial and Administrative Law

     Prepared Statement of the Honorable Lamar Smith, a Representative in
    Congress from the State of Texas, and Ranking Member, Committee on the
                                   Judiciary