    [House Hearing, 110 Congress]
    [From the U.S. Government Publishing Office]

      CYBERSECURITY: A REVIEW OF PUBLIC AND PRIVATE EFFORTS TO SECURE OUR
                        NATION'S INTERNET INFRASTRUCTURE

    =======================================================================

                                    HEARING

                                   before the

                      SUBCOMMITTEE ON INFORMATION POLICY,
                         CENSUS, AND NATIONAL ARCHIVES

                                     of the

                             COMMITTEE ON OVERSIGHT
                             AND GOVERNMENT REFORM

                            HOUSE OF REPRESENTATIVES

                           ONE HUNDRED TENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                OCTOBER 23, 2007

                                   __________

                               Serial No. 110-59

                                   __________

    Printed for the use of the Committee on Oversight and Government Reform

      Available via the World Wide Web: http://www.gpoaccess.gov/congress/
                                   index.html
                         http://www.oversight.house.gov

                         U.S. GOVERNMENT PRINTING OFFICE
    43-198 PDF                 WASHINGTON DC:  2008
    ---------------------------------------------------------------------
    For Sale by the Superintendent of Documents, U.S. Government Printing Office
    Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800
    Fax: (202) 512�092104 Mail: Stop IDCC, Washington, DC 20402�090001

                  COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

                     HENRY A. WAXMAN, California, Chairman
    TOM LANTOS, California               TOM DAVIS, Virginia
    EDOLPHUS TOWNS, New York             DAN BURTON, Indiana
    PAUL E. KANJORSKI, Pennsylvania      CHRISTOPHER SHAYS, Connecticut
    CAROLYN B. MALONEY, New York         JOHN M. McHUGH, New York
    ELIJAH E. CUMMINGS, Maryland         JOHN L. MICA, Florida
    DENNIS J. KUCINICH, Ohio             MARK E. SOUDER, Indiana
    DANNY K. DAVIS, Illinois             TODD RUSSELL PLATTS, Pennsylvania
    JOHN F. TIERNEY, Massachusetts       CHRIS CANNON, Utah
    WM. LACY CLAY, Missouri              JOHN J. DUNCAN, Jr., Tennessee
    DIANE E. WATSON, California          MICHAEL R. TURNER, Ohio
    STEPHEN F. LYNCH, Massachusetts      DARRELL E. ISSA, California
    BRIAN HIGGINS, New York              KENNY MARCHANT, Texas
    JOHN A. YARMUTH, Kentucky            LYNN A. WESTMORELAND, Georgia
    BRUCE L. BRALEY, Iowa                PATRICK T. McHENRY, North Carolina
    ELEANOR HOLMES NORTON, District of   VIRGINIA FOXX, North Carolina
        Columbia                         BRIAN P. BILBRAY, California
    BETTY McCOLLUM, Minnesota            BILL SALI, Idaho
    JIM COOPER, Tennessee                JIM JORDAN, Ohio
    CHRIS VAN HOLLEN, Maryland
    PAUL W. HODES, New Hampshire
    CHRISTOPHER S. MURPHY, Connecticut
    JOHN P. SARBANES, Maryland
    PETER WELCH, Vermont

                         Phil Schiliro, Chief of Staff
                          Phil Barnett, Staff Director
                           Earley Green, Chief Clerk
                      David Marin, Minority Staff Director

       Subcommittee on Information Policy, Census, and National Archives

                       WM. LACY CLAY, Missouri, Chairman
    PAUL E. KANJORSKI, Pennsylvania      MICHAEL R. TURNER, Ohio
    CAROLYN B. MALONEY, New York         CHRIS CANNON, Utah
    JOHN A. YARMUTH, Kentucky            BILL SALI, Idaho
    PAUL W. HODES, New Hampshire
                          Tony Haywood, Staff Director

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on October 23, 2007.................................     1
    Statement of:
        Garcia, Gregory T., Assistant Secretary for Cyber Security
          and Communications, Department of Homeland Security;
          Gregory C. Wilshusen, Director of Information Security
          Issues, GAO; and Daniel S. Ross, chief information officer,
          State of Missouri..........................................     7
            Garcia, Gregory T........................................     7
            Ross, Daniel S...........................................    43
            Wilshusen, Gregory C.....................................    20
        Sabo, John T., president, Information Technology Information
          Sharing and Analysis Center and director of Global
          Government Relations, CA, Inc.; Larry Clinton, president,
          Information Security Alliance; Ken Silva, chief security
          officer and vice president for networking and information
          security, Verisign; Catherine T. Allen, chairman and CEO,
          the Santa Fe Group; and Kiersten Todt Coon, vice president,
          Good Harbor Consulting.....................................    64
            Allen, Catherine T.......................................    98
            Clinton, Larry...........................................    86
            Sabo, John T.............................................    64
            Silva, Ken...............................................    78
            Todt Coon, Kiersten......................................   118
    Letters, statements, etc., submitted for the record by:
        Allen, Catherine T., chairman and CEO, the Santa Fe Group,
          prepared statement of......................................   100
        Clay, Hon. Wm. Lacy, a Representative in Congress from the
          State of Missouri, prepared statement of...................     3
        Clinton, Larry, president, Information Security Alliance,
          prepared statement of......................................    88
        Garcia, Gregory T., Assistant Secretary for Cyber Security
          and Communications, Department of Homeland Security,
          prepared statement of......................................    10
        Ross, Daniel S., chief information officer, State of
          Missouri, prepared statement of............................    45
        Sabo, John T., president, Information Technology Information
          Sharing and Analysis Center and director of Global
          Government Relations, CA, Inc., prepared statement of......    66
        Silva, Ken, chief security officer and vice president for
          networking and information security, Verisign, prepared
          statement of...............................................    80
        Todt Coon, Kiersten, vice president, Good Harbor Consulting,
          prepared statement of......................................   120
        Wilshusen, Gregory C., Director of Information Security
          Issues, GAO, prepared statement of.........................    22

      CYBERSECURITY: A REVIEW OF PUBLIC AND PRIVATE EFFORTS TO SECURE OUR
                        NATION'S INTERNET INFRASTRUCTURE

                                  ----------

                           TUESDAY, OCTOBER 23, 2007

                      House of Representatives,
       Subcommittee on Information Policy, Census, and
                                     National Archives,
                  Committee on Oversight and Government Reform,
                                                        Washington, DC.
        The subcommittee met, pursuant to notice, at 10:06 a.m. in
    room 2154, Rayburn House Office Building, Hon. Wm. Lacy Clay
    (chairman of the committee) presiding.
        Present: Representatives Clay, Hodes, Yarmuth, and Turner.
        Staff present: Darryl Piggee, staff director/counsel; Jean
    Gosa, clerk; Adam C. Bordes, professional staff member; Nidia
    Salazar, staff assistant; Michelle Mitchell, legislative
    assistant, Office of Wm. Lacy Clay; Charles Phillips, minority
    counsel; Patrick Lyden, minority parliamentarian & member
    services coordinator; and Benjamin Chance, minority clerk.
        Mr. Clay. The subcommittee on Information Policy, Census,
    and National Archives will now come to order. Today's hearing
    will examine how well DHS is fulfilling its role as the leading
    Federal agency charged with coordinating response and recovery
    efforts in the event of a major Internet disruption. In
    addition, we will review the roles and responsibilities of
    private sector stakeholders in the development of Internet
    recovery plans and hear their recommendations for improving our
    current cyber security policy framework.
        Without objection the Chair and ranking minority member
    will have 5 minutes to make opening statements followed by
    opening statements not to exceed 3 minutes by any other Member
    who seeks recognition. And without objection Members and
    witnesses may have 5 legislative days to submit a written
    statement or extraneous materials for the record.
        I will begin with an opening statement and then recognize
    the ranking member. Then we will adjourn after that while we
    vote and then we will come back and take the testimony. Just be
    patient with us, please.
        Securing our Nation's economic and global interests relies
    upon having a resilient Internet infrastructure. A recently
    released study by the Business Roundtable summarized that there
    is a probability of between 10 percent and 20 percent for a
    major Internet breakdown over the next decade. At an estimated
    global cost of approximately $250 billion, an event of this
    magnitude would prove devastating to our domestic industries
    and international trading partners.
        Despite spending millions of dollars, the Department of
    Homeland Security has failed to develop an effective Internet
    recovery plan to rely upon for emergency response and recovery
    efforts.
        Furthermore, their lack of adequate progress in developing
    appropriate models for measuring the levels of risk facing each
    sector has left policymakers unable to determine which sectors
    are most vulnerable to major cyber network disruptions.
        It is my hope that today's witnesses will provide an update
    on DHS' efforts to remedy its deficiencies and provide
    recommendations for strengthening partnerships that will best
    secure our Internet infrastructure.
        That concludes my opening statement and I will recognize
    Mr. Turner of Ohio for his opening statement. Mr. Turner.
        [The prepared statement of Hon. Wm. Lacy Clay follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.001

        [GRAPHIC] [TIFF OMITTED] T3198.002

        [GRAPHIC] [TIFF OMITTED] T3198.003

        Mr. Turner. Thank you, Chairman Clay. I want to thank you
    for holding today's hearing on Cyber Security: A Review of
    Public and Private Efforts to Secure Our Nation's Internet
    Infrastructure.
        The Internet is a key critical infrastructure asset and has
    an enormous impact on communications as well as the economy. It
    is important that this asset is protected, much like other
    critical infrastructure assets. It seems, however, that due to
    a number of factors, the Internet isn't as secure from
    catastrophic events as it could be.
        I look forward to reading the testimony from today's
    witnesses on how DHS can better prepare our Internet
    infrastructure from potential catastrophic events, such as
    national disasters and terrorist attacks.
        I am interested in how DHS plans to address the concerns
    listed in the 2006 GAO report on DHS' efforts to coordinate an
    Internet infrastructure recovery plan. And I am particularly
    interested in learning about the legal barriers that DHS faces
    in providing assistance to private sector entities which own or
    operate Internet infrastructure in the event of disaster.
        Mr. Chairman, I want to thank you again for your leadership
    and your effectiveness in the oversight of the important
    Federal policy issues of information policy. Thank you.
        Mr. Clay. Thank you, Mr. Turner. And at this time, the
    subcommittee will recess and reconvene at the conclusion of the
    three votes that we will take now on the floor. The committee
    stands in recess.
        [Recess.]
        Mr. Clay. If there are no additional opening statements,
    the subcommittee will now reconvene and we will receive
    testimony from the witnesses before us today.
        I want to start by introducing our first panel, which will
    consist of Mr. Greg Garcia, who is the Assistant Secretary for
    Cyber security and Communications at the Department of Homeland
    Security. In his position, Mr. Garcia oversees the operations
    and strategic planning activities of the National Cyber
    Security Division, the Office of Emergency Communications and
    the National Communications System. Prior to joining DHS, he
    represented the information technology on Capitol Hill, and
    before that served as a staff member of the House Science
    Committee.
        We also have joining us Mr. Greg Wilshusen, who is a
    Director of Information Security Issues at GAO. He is a long
    time expert on the topic of information security and has
    testified before this panel numerous times on cyber security
    issues and Federal information security management practices.
        And to round out the panel, Mr. Dan Ross serves as the
    chief information officer for the State of Missouri. And prior
    to his appointment in 2005, Mr. Ross served under then
    Secretary of State Matt Blount in the capacity of executive
    deputy secretary of State. He holds a bachelor's degree in
    industrial relations from Lincoln University and a master's
    degree in public administration from the University of
    Missouri.
        Welcome, Mr. Ross. We know you came further than others.
    And also welcome to the other two witnesses. And thank you all
    for appearing before today's subcommittee.
        And it is the policy of the Committee on Oversight and
    Government Reform to swear in all witnesses before they
    testify. And I would like to ask you all to stand and raise
    your right hands.
        [Witnesses sworn.]
        Mr. Clay. Thank you. You may be seated. Let the record
    reflect that the witnesses answered in the affirmative.
        Mr. Hodes, did you have an opening statement that you would
    like to offer?
        Mr. Hodes. No, I will defer.
        Mr. Clay. OK. Thank you so much. I ask that each of the
    witnesses now give a brief summary of their testimony and to
    keep the summary under 5 minutes. Your complete written
    statement will be included in the hearing.
        Mr. Garcia, we will begin with you. Before you do that, I
    know that you come today to explain how seriously DHS and the
    administration takes its cyber security responsibility. I must
    admit that it is a little disappointing that you waited until
    11:30 this morning to deliver your written testimony for
    members of the subcommittee to adequately prepare.
        With that said, you have 5 minutes to summarize your
    statement.

    STATEMENTS OF GREGORY T. GARCIA, ASSISTANT SECRETARY FOR CYBER
     SECURITY AND COMMUNICATIONS, DEPARTMENT OF HOMELAND SECURITY;
    GREGORY C. WILSHUSEN, DIRECTOR OF INFORMATION SECURITY ISSUES,
     GAO; AND DANIEL S. ROSS, CHIEF INFORMATION OFFICER, STATE OF
                                MISSOURI

                     STATEMENT OF GREGORY T. GARCIA

        Mr. Garcia. Thank you, Mr. Chairman, and members of the
    subcommittee. I appreciate the opportunity to discuss the
    Department of Homeland Security's efforts to promote the
    resilience of America's Internet infrastructure.
        Let me just say at the outset, Mr. Chairman, that I do
    apologize for the lateness of our testimony. It is more than a
    little disappointing to me, as well. It in no way reflects the
    seriousness with which DHS takes the mission of cyber security.
    And it is very much important for you, the members of the
    committee and the staff to have the benefit of advance reading
    of our testimony so that we can have an informed discussion.
    So, please accept my apology for that.
        We are endeavoring, in our process at DHS and interagency,
    to ensure that we bring testimony up to the Congress in a
    timely fashion.
        Mr. Clay. Thank you for that.
        Mr. Garcia. Sir, it is fitting that you are holding this
    hearing during National Cyber Security Awareness Month. It
    helps to raise public consciousness about the importance of
    Internet security to our economy and to our way of life.
        Over 200 million Americans use the Internet at home and in
    the workplace. The Internet facilitates communications, and
    supports Government and business operations. Although the
    Internet has yielded tremendous efficiencies, organizations and
    individuals remain vulnerable to disruptions in service and
    loss of sensitive data.
        Both the private sector and Government play a role in
    securing our Internet infrastructure. The private sector
    builds, owns and operates most of the cyber infrastructure and
    ensures the availability and functionality of the Internet. The
    Federal Government has the responsibility for ensuring the
    continued operation of essential Government functions, securing
    their timely restoration if they fail, and minimizing the
    impact to the Nation.
        As such, it is incumbent upon the Federal Government to
    help protect against Internet disruptions and to ensure a
    coordinated response to incidents. I would like today to
    highlight a few of our efforts in these areas.
        First, we are strengthening our ability to prevent Internet
    disruptions. Under the National Infrastructure Protection Plan
    [NIPP], the availability of the Internet and its associated
    services is identified as a shared key resource of the
    information technology and communications sectors. As the
    sector's specific agency for both, we work with the sectors to
    develop their Sector-Specific Plans [SSP], which were released
    in May of this year.
        The IT SSP defines six critical functions that support the
    sector's ability to produce and provide resilient products and
    services. Of these, two critical sector functions relate
    directly to the Internet.
        Similarly, the communications Sector Specific Plan
    identifies critical architectural elements of the Internet.
    Through implementation of their SSPs, the IT and communications
    sectors are continuing to work together to assess the risk to
    the Internet.
        Although the availability of the Internet is primarily the
    responsibility of the IT and communications sectors, all
    sectors rely on the Internet. And DHS, together with the
    Partnership for Critical Infrastructure Security [PCIS],
    established the Cross Sector Cyber Security Working Group
    [CSCSWG], comprised now of more than 90 Government and private
    sector experts from across the critical infrastructure sectors.
        This group provides a forum to assess, among other things,
    how critical sector operations could be impacted by disruptions
    and to develop appropriate mitigation strategies.
        Improving situational awareness is a critical component of
    preparedness. The U.S. Computer Emergency Readiness Team [U.S.
    CERT], within my organization, coordinates with the private
    sector and Government entities to increase situational
    awareness of network conditions.
        We developed a program called Einstein that provides
    Federal agencies with early cyber incident detection so that
    they can respond more rapidly to mitigate threats. It has
    slashed the time it takes us to gather and share critical data
    on IT security risks from days, as it used to be, to hours.
        The U.S. CERT also engages with private sector Information
    Sharing And Analysis Centers [ISACs], to share information on
    cyber threats, vulnerabilities and incidents. This includes
    collaboration with the IT-ISAC and the Multi-State ISAC to
    raise the level of cyber security readiness in each State.
        Our ability to protect against and prepare for Internet
    disruptions is further enhanced through exercises. We are
    currently planning for the Cyber Storm II Exercise in March
    2008, which will include a focus on Internet disruption and
    recovery and involve Federal, State, local, international and
    private sector entities.
        Second, we are enhancing public and private collaboration
    to ensure effective response capabilities. The National
    Response Framework [NRF], which was recently released for
    public comment, articulates how our Nation will respond to all
    hazard disasters. My office has responsibility for Emergency
    Support Function No. II [ESF-2], the Communications Annex and
    the Cyber Incident Annex. We undertook an in-depth review of
    these components, and incorporated updates to them.
        In support of the NRF, the National Cyber Response
    Coordination Group [NCRCG], serves as the primary Federal
    interagency mechanism for coordinating Cyber Incidents.
    Recently, the NCRCG addressed the denial of service attack
    against the government of Estonia. The NCRCG co-chairs convened
    to discuss the situation and determined that an operational
    response was indeed needed. And we coordinated that through the
    National Coordination Center and U.S. CERT.
        To sum, my office is now implementing a plan to co-locate
    the U.S. CERT and the NCC, the IT and Communications to further
    facilitate collaboration among IT and communications experts.
    We are working side-by-side with them to make it easier to
    obtain situational awareness, to identify threats and
    coordinate response activities.
        To conclude, both Government and the private sector are
    taking proactive measures to address Internet resilience, and
    to prepare for and respond to Internet disruptions. Government
    and business leaders must continue to ensure that sectors,
    organizations and individuals all understand their dependence
    on the Internet, the impact that a disruption could have and
    actions that can be taken to mitigate the consequences.
        Sir, thank you for your time today. I appreciate the
    opportunity to discuss this issue and will be happy to answer
    questions.
        [The prepared statement of Mr. Garcia follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.004

        [GRAPHIC] [TIFF OMITTED] T3198.005

        [GRAPHIC] [TIFF OMITTED] T3198.006

        [GRAPHIC] [TIFF OMITTED] T3198.007

        [GRAPHIC] [TIFF OMITTED] T3198.008

        [GRAPHIC] [TIFF OMITTED] T3198.009

        [GRAPHIC] [TIFF OMITTED] T3198.010

        [GRAPHIC] [TIFF OMITTED] T3198.011

        [GRAPHIC] [TIFF OMITTED] T3198.012

        [GRAPHIC] [TIFF OMITTED] T3198.013

        Mr. Clay. Thank you very much, Mr. Garcia. Mr. Wilshusen,
    you are next.

                   STATEMENT OF GREGORY C. WILSHUSEN

        Mr. Wilshusen. Chairman Clay and members of the
    subcommittee, thank you for the opportunity to testify at
    today's hearing on public and private sector efforts to secure
    our Nation's Internet infrastructure.
        Since the early 1990's, the world community has come to
    rely on the Internet as a critical resource supporting
    commerce, education and communication. While the benefits of
    this technology have been enormous, this widespread inter-
    connectivity poses significant risks to our Government's and
    Nation's computer systems and, more importantly, to the
    critical operations and infrastructures they support.
        Today, I will discuss threats and vulnerabilities of the
    Internet, DHS' efforts in facilitating recovery from Internet
    disruptions and key challenges to such efforts.
        Mr. Chairman, the Internet is vulnerable to disruptions in
    service due to threats of terrorists and other malicious
    attacks, natural disasters and technological problems or a
    combination of these things. Disruptions to Internet service
    can be caused by cyber and physical incidents, both intentional
    and unintentional. For example, over the last few years, fast-
    spreading worms and viruses coordinated denial of service
    against key root servers, 9/11 and Hurricane Katrina have
    caused local or regional disruptions or slowdowns.
        Research organizations have pegged the annual worldwide
    costs of malicious code attacks as averaging about $14 billion
    for the 6-years ending in 2005, highlighting the importance of
    recovery planning. However, these incidents have also shown the
    Internet as a whole to be flexible resilient. Even in severe
    circumstances, the Internet has not yet suffered a catastrophic
    failure.
        Nevertheless, is it possible that a complex attack or
    series of attacks could cause the Internet to fail or to
    undermine users' trust in the Internet, thereby reducing the
    Internet's utility.
        In a June 2006 report, we noted that DHS had begun a
    variety of initiatives to improve the Nation's ability to
    recover from Internet disruptions, including developing an
    integrated public/private plan for Internet recovery,
    establishing working groups to facilitate coordination, and
    conducting exercises in which Government and private industry
    practice responding to cyber events.
        However, these efforts were not complete, comprehensive or
    effectively coordinated. In that report, we also noted key
    challenges that impeded progress. First, it was unclear what
    Government entity was in charge, what the Government's role
    should be, and when it should get involved. For example, DHS'
    National Cyber Security Division and National Communications
    System had overlapping responsibilities. There is also a lack
    of consensus about the role DHS should play. The Government was
    pursuing the big plan approach with the NIPP and the National
    Response Plan while the private sector wanted to more of the
    short-term tactical role from the Government.
        Furthermore, triggers to clarify when the Federal
    Government should be involved were unclear. Another key
    challenge is working in a legal framework that doesn't
    specifically address the Government's roles and
    responsibilities in the event of an Internet disruption. The
    Katrina recovery efforts also showed that the Stafford Act can
    create a roadblock when for-profit companies that own and
    operate critical infrastructures need Federal assistance during
    national emergencies.
        In addition, the private sector was reluctant to share
    information with DHS because it did not always see value in
    sharing information, did not necessarily trust the Government
    and viewed DHS as an organization lacking effective leadership.
        Until these challenges are addressed, DHS will have
    difficulty in achieving results in its role as a focal point in
    this area.
        In our June 2006 report, we suggested that Congress
    consider clarifying the legal framework that guides roles and
    responsibilities for Internet recovery. We also made
    recommendations to improve DHS' ability to facilitate public/
    private efforts and planning for Internet disruptions. The
    Department agreed with our recommendations and since then has
    made progress in addressing many of them.
        Still work remains to be done to ensure that our Nation is
    prepared to effectively respond to a disruption of the Internet
    infrastructure.
        Mr. Chairman, this concludes my statement. I would be happy
    to answer any questions you or members of the subcommittee may
    have.
        [The prepared statement of Mr. Wilshusen follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.014

        [GRAPHIC] [TIFF OMITTED] T3198.015

        [GRAPHIC] [TIFF OMITTED] T3198.016

        [GRAPHIC] [TIFF OMITTED] T3198.017

        [GRAPHIC] [TIFF OMITTED] T3198.018

        [GRAPHIC] [TIFF OMITTED] T3198.019

        [GRAPHIC] [TIFF OMITTED] T3198.020

        [GRAPHIC] [TIFF OMITTED] T3198.021

        [GRAPHIC] [TIFF OMITTED] T3198.022

        [GRAPHIC] [TIFF OMITTED] T3198.023

        [GRAPHIC] [TIFF OMITTED] T3198.024

        [GRAPHIC] [TIFF OMITTED] T3198.025

        [GRAPHIC] [TIFF OMITTED] T3198.026

        [GRAPHIC] [TIFF OMITTED] T3198.027

        [GRAPHIC] [TIFF OMITTED] T3198.028

        [GRAPHIC] [TIFF OMITTED] T3198.029

        [GRAPHIC] [TIFF OMITTED] T3198.030

        [GRAPHIC] [TIFF OMITTED] T3198.031

        [GRAPHIC] [TIFF OMITTED] T3198.032

        [GRAPHIC] [TIFF OMITTED] T3198.033

        [GRAPHIC] [TIFF OMITTED] T3198.034

        Mr. Clay. Thank you very much. Mr. Ross, you may proceed
    for 5 minutes.

                      STATEMENT OF DANIEL S. ROSS

        Mr. Ross. Thank you, Chairman Clay and distinguished
    members of the subcommittee. I thank you for inviting me here
    to day to appear before you in both my role as Missouri State
    chief information officer, and also as a member of NASCIO, the
    National Association of State Chief Information Officers.
    NASCIO is a not-for-profit, non-partisan research and advocacy
    organization, of which I and most State CIOs are members.
        I will briefly offer my perspective on efforts to secure my
    State and our Nation's Internet infrastructure. A lapse or
    shutdown of Internet availability would disable much of State
    government, rendering it unable to communicate, to deliver
    services and collect revenue for an extended period.
        Regional conditions in Missouri illustrate some of the
    challenges natural disasters may pose. A large portion of
    eastern Missouri, including the city of St. Louis, lies in
    close proximity to the New Madrid earthquake fault. Missouri
    experienced over 200 tornadoes last year. In addition, we
    experienced ice storms, thunderstorms and flooding which
    damaged communications infrastructure.
        In addition, the sheer pervasiveness and relentlessness of
    cyber-attacks is staggering. In the past fiscal year alone,
    Missouri's network and data center experienced nearly 5.6
    million cyber-attacks. That's 29,000 per day, about 1,200 an
    hour. And in the few minutes that I am speaking with you today,
    we will experience about 100.
        The evolving nature and sophistication of cyber-attacks is
    worrisome as well. State information technology infrastructure
    is now specifically targeted by criminal elements connected to
    organized crime. In addition, they are also increasingly
    international in origin, which makes apprehension and criminal
    prosecution highly unlikely.
        What are we doing? In response to this, State CIOs are
    forging partnerships with State, Homeland Security, emergency
    management and public safety officials to plan for the
    potential of major disruptions and security breach events. We
    are also trying to secure the funding necessary to maintain our
    intrusion detection, spam filter and other technologies that
    were purchased previously with Homeland Security one-time grant
    funds.
        A current concern State CIOs face is acquiring funding to
    build security and resilience into all new IT projects and to
    hire and retain knowledgeable, trained IT staff.
        Some recommendations to fortify Internet communications
    infrastructure. First, there must be increased
    intergovernmental and private sector coordination. Business
    partners, stakeholders and all levels of government must
    coordinate actions, share best security practices, and plan for
    the potential of a major disruptive event.
        Second, continued State involvement in the National
    Infrastructure Protection Plan and Cyber Security Information
    Technology Sector Specific Plan within it is essential.
        Third, we must identify cyber vulnerabilities and fund
    their mitigation. Cyber security is not a tangible asset, and
    Federal programmatic funding rarely includes specific
    provisions for IT spending to protect Federal programs
    delivered by States. The creation of a funding pool for cyber
    security grants to specifically assist States in achieving a
    proper cyber security posture would be beneficial in raising
    the overall security level of critical IT infrastructure in the
    State government sector.
        Fourth, we must include and address Internet dependent
    critical State functions and continuity of operations and
    recovery plans.
        And finally, we have to partake of information sharing
    initiatives between NASCIO, the Multi-States Information
    Sharing and Analysis Center and Federal agencies.
        In conclusion, Mr. Chairman, technology alone will not
    solve the security challenges that States face while trying to
    protect key information technology systems and information
    given the wide variety of cyber-attacks and security
    vulnerabilities today, it may be only a matter of time before a
    State's information systems and assets are compromised.
    Therefore, it is imperative that an investment in human and
    technology resources be an ongoing, proactive process, and not
    a reactionary response to a security event. The well publicized
    hard costs of security breaches as well as the soft costs of
    losing citizen confidence drive the need for providing
    sufficient resources for securing Government's information and
    infrastructure assets.
        As CIO for Missouri and as a representative for NASCIO, I
    appreciate the work of this subcommittee in addressing this
    national challenge. The National Association of State Chief
    Information Officers stands ready to contribute to this
    subcommittee in a meaningful way as needed.
        Thank you for your time.
        [The prepared statement of Mr. Ross follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.035

        [GRAPHIC] [TIFF OMITTED] T3198.036

        [GRAPHIC] [TIFF OMITTED] T3198.037

        [GRAPHIC] [TIFF OMITTED] T3198.038

        [GRAPHIC] [TIFF OMITTED] T3198.039

        [GRAPHIC] [TIFF OMITTED] T3198.040

        [GRAPHIC] [TIFF OMITTED] T3198.041

        Mr. Clay. Thank you so much for your testimony, Mr. Ross.
        We will start the first round of questions and the
    gentleman from New Hampshire is recognized for 5 minutes. Mr.
    Hodes.
        Mr. Hodes. Thank you, Mr. Chairman. And thank you for
    holding this very, very important hearing. Given the
    Information Age that we are living in, there probably is
    nothing that is more important these days in some way to the
    security of this Nation than the issues that we are discussing
    today. As the use of the Internet and cyberspace blossoms, it
    is becoming ever more important to us.
        Mr. Garcia, I noted with appreciation your sense of regret
    that your testimony wasn't supplied earlier to us, and I take
    that you will be able to take steps in the future so that when
    you come back before us, we will have enough time to review
    your testimony.
        Mr. Garcia. Absolutely, sir. We do strive to give you the
    best quality product we can, as well, which may account for
    some of the delay and the review process.
        Mr. Hodes. I appreciate that. Prior to your appointment,
    Mr. Garcia, the previous Director of the NCSD, Andy Purdy, was
    hobbled because there were conflict of interest questions due
    to his continued employment with his original employer,
    Carnegie Mellon University, which was involved with several
    DHS, cyber-related projects at the time. My understanding is
    that he was actually drawing a salary while working also for
    the NCSD, which created real problems, as you can imagine.
        And it is my understanding that currently, a significant
    amount of the work that is being undertaken by NCSD is being
    carried out by other contractors. Private contractors,
    including Booz-Allen. As a member of the Oversight and
    Government Reform Committee, we have been exercising oversight
    in a number of areas where the Government is making significant
    use of private contractors, most notably in the news in
    connection with the war in Iraq and the flap that has developed
    around Blackwater.
        And I understand the role of contractors in assisting
    agencies with program administration, but I also understand
    that contractors aren't supposed to play any role in inherently
    governmental or policy-focused activities. We recognized that
    as a potential conflict with Mr. Purdy, and we remain concerned
    that there may continue to be conflicts at the NCSD. And I note
    in your testimony, at pages--especially at 4 and 6, where you
    talk about the collaboration that exists in the public/private
    partnership that is ongoing.
        So, there are relationships here, which while important are
    fraught with potential problems. Can you tell us how many full-
    time governmental employees there are within NCSD, NCS, and the
    other DHS units under your authority?
        Mr. Garcia. Sir, I don't have the exact number. We have
    approximately 100 individuals in NCSD and NCS, and about that
    number in contractors. So we do rely on contractors. It gives
    us the resilience we need to respond to urgent initiatives. It
    enables us to surge and to pull back our resources as
    necessary.
        Mr. Hodes. And when you say 100 contractors, do you mean
    100 employees who are the employees of contractors, or 100
    separate different companies?
        Mr. Garcia. I can give you that exact number--I can get
    back with you on that specifically.
        Mr. Hodes. I would appreciate having the documents that
    reflect that. And Mr. Chairman, if I may, request that the
    record stay open long enough to have that information
    submitted.
        Mr. Clay. Without objection, the gentleman will do
    everything to get us those records.
        Mr. Garcia. Absolutely.
        Mr. Hodes. Off the top of your head, who are the largest
    contracting entities who are supplying these contractors to
    those agencies of which you spoke?
        Mr. Garcia. The most number of contractors from any one
    organization, I cannot be certain on that answer, likely to be
    Booz-Allen.
        Mr. Hodes. And what is your sense of the size of Booz-
    Allen's commitment in terms of a percentage of that number of
    approximately 100 who are working?
        Mr. Garcia. I can get that for you, as well.
        Mr. Hodes. You don't have any sense today?
        Mr. Garcia. Not an accurate sense for you. No, sir.
        Mr. Hodes. And what are the roles and responsibilities of
    those contractors at your agency, versus the responsibilities
    of the Government employees?
        Mr. Garcia. None of the contractors are in managerial
    positions. So, they serve in a support role for all of our
    activities.
        Mr. Hodes. And who is supervising them? And who is
    responsible for their day-to-day activities? Is it the
    employees at your agency, or is it the providing companies?
        Mr. Garcia. The Government employees under my organization
    are responsible for supervising the activities that the
    contractors support.
        Mr. Hodes. May I continue with one further question, Mr.
    Chairman? I see my time is up.
        Mr. Clay. The gentleman is recognized for 2 additional
    minutes.
        Mr. Hodes. Thank you. Now, Mr. Garcia, I take it you would
    agree that conflict of interest policies are critical to
    ensuring the integrity of the work done for the Government?
        Mr. Garcia. Yes, sir.
        Mr. Hodes. And are there written conflict of interest
    policies in place at the agencies you supervise to ensure that
    those coming to work for your division remain free from
    decisions that may potentially impact former employers or
    clients? And I am talking about both full-time employees as
    well as consultants working under your direction.
        Mr. Garcia. Yes, sir. I believe there is. And I can get
    back with you on that and supply that with you.
        Mr. Hodes. Similarly, Mr. Chairman, I would ask that the
    record be held open to accept that submission.
        Mr. Clay. Without objection, and we would appreciate it if
    we could have it in 5 legislative days.
        Mr. Hodes. Thank you, Mr. Chairman. And just one final
    quick question. As a former lobbyist for the Information
    Technology Association of America, how have you yourself made
    sure that you are remaining free from any conflicts concerning
    issues of importance to your former employer?
        Mr. Garcia. My mission, Congressman, is in total support
    for the Department of Homeland Security and to the Nation that
    we protect. My former employer was a trade association, and my
    former employer was also the U.S. Congress. So, my mission is
    quite clear and that is to promote the security and resiliency
    and the availability of the Nation's communications and
    information infrastructure.
        Mr. Hodes. I understand that is what your mission is, and
    what have you done with your former employer to make sure that
    you yourself have taken the proper steps to ensure there is no
    conflict of interest?
        Mr. Garcia. We work with them. I have no conflict of
    interest with my former employer. We work with them as we do
    with any other major trade association in information
    technology as a major partner of the Department of Homeland
    Security. We cannot do our work without partnership from
    industry, from IT, from communications, from financial
    services. But they are but one of many, many stakeholders and
    players in this process. And I am focused squarely on our
    mission.
        Mr. Hodes. Thank you. Thank you, Mr. Chairman.
        Mr. Clay. Thank you, Mr. Hodes. Mr. Yarmuth of Kentucky, 5
    minutes.
        Mr. Yarmuth. Thank you, Mr. Chairman. When I listened to
    the testimony, it kind of reminds me of the now infamous words
    of Secretary Rumsfeld when he said, ``There are things we know
    we know, and things we know we don't know, and things we don't
    know that we don't know.''
        It sounds to me like there are a lot of things about the
    threats facing the Internet that we know, and threats that we
    don't know that we know, and we don't know that we don't know.
    And anyone can attack this problem. Is our biggest problem in
    this area threats that we don't even know exist, or are we
    still at the point where we don't know to combat the threats we
    know about?
        Mr. Garcia. I think it is a matter of both, Congressman. We
    over the past couple of years, I believe, have made tremendous
    progress in terms of understanding the threats facing the
    Internet infrastructure. Our visibility into the Internet
    infrastructure is increasing.
        For example, my U.S. CERT collects incident reports from
    private sector and Government entities. Last year, we received
    37,000 reports. The year before that, 24,000 reports. Is that
    because the incidents are increasing or is it because the
    reporting is increasing? It is probably a little bit of both.
        But the threat is still there. So much is happening under
    the radar. There are so many attacks and probes happening
    across our networks that we are not seeing. And so, a big part
    of my mission is to work with the owners and operators of those
    infrastructures, whether it is IT or communications or
    financial services, transportation, electricity, to build
    awareness. And to build investment in the systems and the
    process that will raise the level of visibility into what is
    happening in our networks so that we can take the steps to
    mitigate them.
        Mr. Yarmuth. Is that ultimately the measure of whether you
    are successful or not? Whether the incidents that you know
    about are reported to you are declining? Or is there some other
    metric that you can come up with to allow you and us to know
    whether we are actually making progress?
        Mr. Garcia. Yes, sir. We have many metrics, and none of
    them taken by themselves is going to be sufficient. Increasing
    the number of incident reports. That is a measure of success.
    That means people are paying attention and they are reporting
    it. They are sharing sensitive information.
        The amount of investment is also a measure of success, the
    investment in cyber security and information technology is
    increasing. We are looking at the number of students going into
    information security as a curriculum pursuit in universities.
        So, there are many measures, but we still are not going to
    be able to measure all the attacks that are happening without
    our seeing them. The threat is constantly evolving. The
    adversaries are very sophisticated. And we have to evolve with
    them.
        It is an ongoing technological chess match, if you will,
    except that there is no check mate. So, this is going to be
    ongoing. And we can take one measure at a time, and measure our
    success and hope that we don't take any steps back.
        Mr. Yarmuth. I am curious also, and this may not even be
    related to--well, it relates to a certain extent, to the
    ultimate goal of the hearing. But the issue of motivation. Is
    there any way to gauge whether these--what percentage of the
    attacks are motivated by people who just want to see if they
    can figure it out? Kind of intellectual curiosity or whether
    they actually have evil motives, if you will. Evil intent.
        Mr. Garcia. I will let Mr. Wilshusen elaborate, but I think
    what we--and indeed Mr. Ross, since he is also on the front
    lines--but we do see a variety of motives. It used to be that
    hacking, as it were, was very much a joy ride exercise.
    Teenagers seeing what they can get away with. Motivations
    related to ``hactivists''--those relating to political motives,
    as perhaps what we saw in Estonia.
        But the adversaries are becoming more sophisticated and
    more focused on very specific targets. And that includes the
    desire for information, whether it is from companies or from
    governments. It includes the pursuit of money through cyber
    crime, through financial services networks or through identity
    theft.
        So, they are becoming very sophisticated and very targeted
    with multiple intents.
        Mr. Yarmuth. Mr. Wilshusen.
        Mr. Wilshusen. Yes. And I would just like to add, too--I
    agree with everything that Mr. Garcia just mentioned regarding
    the threats--is that there are criminal activities and criminal
    elements out there that do have a financial motivation.
        In addition, there are also foreign nation-states that also
    have an interest in obtaining intelligence information about
    their potential adversaries, including, of course, the United
    States.
        I would also like to point out, too, that the threat is
    evolving and indeed the vulnerabilities are also increasing.
    Just to give you a statistic, the National Vulnerability Data
    base has identified over 26,000 software flaws or mis-
    configurations that could be exploited to provide an avenue for
    someone to gain unauthorized access. That total, according to
    the National Vulnerability Data base, is increasing by 16 every
    day. The vulnerabilities are legion. The threats are adaptive,
    and they are constantly evolving, and it is quite a challenge
    to be able to protect computer systems against that.
        Mr. Clay. Thank you.
        Mr. Yarmuth. Thank you, Mr. Chairman.
        Mr. Clay. Thank you, Mr. Yarmuth. Mr. Wilshusen, since the
    original GAO Report on Internet Infrastructure and Recovery
    Plans came out last year, can you identify the areas in which
    DHS has demonstrated significant progress? How about the areas
    in which progress is lagging or that have been just totally
    ignored?
        Mr. Wilshusen. Yes, sir. Well, as Mr. Garcia mentioned in
    his opening remarks, some of the areas for progress included
    that DHS released its Sector Specific Plans for the IT and
    Communications Sectors. It also developed and revised its
    National Response Plan or framework to assure and make sure
    that it addresses cyber incidents that require Federal
    response.
        In addition, DHS has also led these private/public
    exercises, Cyber Tempest, Cyber Storm, that examine response
    and coordination mechanisms to simulated cyber events. These
    exercises add value. And the after action reports provide
    useful information on lessons learned during those exercises.
    Of course, the next step though is taking those lessons learned
    and actually implementing them into the plans.
        Now, some areas where DHS is lagging, if you will, is that
    it has not yet developed a private/public plan for Internet
    recovery. Nor has it set a date when that plan would be
    completed.
        In addition, DHS also disbanded the Internet Disruption
    Working Group, and it is not clear exactly how well that
    group's functions and responsibilities will be addressed by
    other groups that DHS is working with.
        And one other thing. As Mr. Garcia mentioned, there are a
    number of working groups addressing this area of Internet
    recovery. However, the interrelationship among these groups is
    not certain.
        Mr. Clay. Have there been appropriate triggers established
    to determine what type of Internet disruption would merit a
    Government response?
        Mr. Wilshusen. Well, there have been efforts, I believe. A
    couple of the working groups have looked at those triggers, but
    as of now, the specific triggers have not yet been fully
    developed or implemented.
        I might also want to point out, too, that one of the key
    aspects in order to make these triggers work is to make sure
    there is an effective analysis and warning capability. And DHS
    does have, for example, U.S. CERT, and as Mr. Garcia mentioned
    earlier, the use of the Einstein network monitoring tool, which
    can help provide information supporting those triggers. But
    Einstein has not yet been implemented across the Government.
        Mr. Clay. Thank you for that. As part of GAO's review of
    DHS' Internet recovery responsibilities, it cited a lack of DHS
    leadership and stability throughout its management ranks. Has
    this improved since the report was released last year?
        Mr. Wilshusen. Well, one area where it has improved is
    indeed the appointment of Mr. Garcia as the Assistant Secretary
    for Office of Cyber Security and Communications, and the
    Assistant Secretary has spelled out some key priorities for the
    Department, including preparing and deterring attacks,
    responding to cyber-attacks of potentially national importance
    or significance, and also building awareness among the various
    different stakeholders in cyber security.
        However, DHS continues to be hampered by its inability to
    retain key officials in the cyber security area. For example,
    the Director of the National Cyber Security Division has
    recently left, as have other key officials related to cyber
    security control systems and officials responsible for cyber-
    related exercises.
        Mr. Clay. Thank you so much for that. Mr. Ross, as the CIO
    from Missouri, has your office sought to prioritize the State
    networks and critical infrastructures that are most critical in
    an emergency incident? And if so, how was it done?
        Mr. Ross. Yes, sir. We are always looking to find that
    single point of failure, which if taken out, will take the
    whole system down. You know, we have identified the essential
    functions Government has to do, which is communicate, pay
    people, pay bills, buy things, provide medical services, direct
    people in emergencies and so, in working with the Department of
    Homeland Security, the State Department of Homeland Security,
    the State emergency management folks, we are putting together a
    plan to do that.
        Now, in my own shop and the IT folks, we have identified
    vulnerabilities in the State network and we are working to
    patch those. We have recently signed a contract with AT&T to
    manage the State-wide network to give us that resiliency and
    that disaster recovery ability because of their large network
    and their redundancy.
        So, that in combination with State assets--which do include
    1,700 miles of fibers that the Highway Department owns, that we
    leverage for them--all come together to give us a resilient
    backbone to keep running in times of emergency.
        We are not there yet because we have just signed the
    agreement with AT&T and are moving into that relationship with
    them. But I look forward to that. That will provide not only
    the tremendous wide highway to operate on, but also the back-up
    and disaster recovery we have been after.
        Mr. Clay. Thank you. What are the greatest strengths and
    weaknesses of the Multi-State ISAC? Are its activities related
    to information sharing and threat analysis of cyber incidents
    providing you with adequate information for decisionmaking?
        Mr. Ross. Mr. Chairman, Missouri is one of the two founding
    States in that organization. We are extremely active in that.
    One of my security officers is co-chair of the Legislative
    Committee and another member of his team is on an Operations
    Committee, I believe.
        So, we are actively engaged with them, in contact with them
    nearly every day. Phone calls and then certainly when an event
    or a vulnerability is identified, that network fires up very
    quickly. So, we depend on and use them very heavily.
        Mr. Clay. OK. Thank you for that. Mr. Hodes, did you have a
    second round of questioning? Please proceed for 5 minutes.
        Mr. Hodes. Thank you, Mr. Chairman. Mr. Wilshusen, I am
    looking through the statement you provided, your testimony
    here. And I note on pages 9 and 10, in dealing with the
    questions of the existing laws and regulations and their
    application to Internet recovery, some issues arise.
        You point out, for instance, that the Stafford Act
    authorizes Federal assistance to States, local governments,
    not-for-profits, in the event of a major disaster or emergency,
    but doesn't apply to for-profits.
        Do you see a revision of that as necessary, desirable?
    Something else, is it absolutely required? Would it provide an
    incentive for some kind of conduct on the part of for-profits,
    which has been problematic up until now? Would you comment?
    Thanks.
        Mr. Wilshusen. Yes, I would be glad to. During this review
    that we conducted last year, we did a number of case studies
    over key Internet cyber events. One of them had to do, of
    course, with Hurricane Katrina. And it was during that event
    where key infrastructure owners needed to gain access to the
    resources or to their facilities and have the ability to have
    basic food, water and other necessities in order to more
    quickly restore service operations--their service capabilities.
        However, the Federal Government was not able to help them
    or to provide the short-term tactical support that was needed
    in order for them to actually gain access to their facilities.
    And so, part of that was due to the Stafford Act, because the
    Federal Government cannot provide assistance to these for-
    profit organizations.
        Mr. Hodes. So, had the Federal Government been able to
    provide that short term tactical assistance, the response of
    those for-profits in coordinating the effort to recover, would
    have been much quicker?
        Mr. Wilshusen. And would have been enhanced. Yes, sir.
        Mr. Hodes. Turning to the Communications Act of 1934, there
    is an implicit suggestion in your written statement that needs
    to be revised to address the new threats, the new concerns,
    that the cyber infrastructure has created since 1934 and
    whatever amendments there have been. Am I correct that you see
    that as something that Congress needs to look at?
        Mr. Wilshusen. Yes, because we see that as a Communications
    Act that does not address specifically the Internet and
    certainly not the roles and responsibilities for Internet
    recovery from disruptions or major disruptions.
        Mr. Hodes. Thank you. Mr. Garcia, it was recently reported
    that one vendor, a major DHS IT vendor, Unisys, had been
    concealing a number of significant cyber security incidents and
    attacks on Department systems, including many that apparently
    exposed the entire DHS enterprise to significant cyber-threats.
    Could you explain your role in responding to the incidents as
    they were reported to DHS leadership?
        Mr. Garcia. Sir, that particular issue, we have a
    separation of responsibilities. The Office of Cyber Security
    and Communications is responsible for a national outreach on
    cyber security policy and implementation, whereas the
    protection of the DHS network itself, that responsibility
    resides within the Office of the Chief Information Officer
    [CIO]. So, neither I nor was my office was directly involved in
    that particular issue.
        Mr. Hodes. So, it is not your job?
        Mr. Garcia. That is correct.
        Mr. Hodes. Did you coordinate at all with the Chief
    Information Officer on what happened?
        Mr. Garcia. Yes. So our role within the U.S. CERT is in
    fact, to treat the DHS networks as we do all of our Federal
    agency customers, if you will, particularly through our
    outreach and information sharing in the Einstein program, we
    work to try to help agencies see what is happening on their
    networks and to exchange information with them and ultimately
    to correlate activities to find trends that are happening
    across the Federal network. And that goes with the CIO's office
    as well.
        So, we are in close contact with the Office of the CIO as
    incidents happen, in the DHS networks or any other Federal
    agency network.
        Mr. Hodes. So, I am assuming that because it is an agency
    with which you are involved and that you must be in touch with
    the CIO about these kinds of incidents, what happened to
    Unisys? What was done? Were they sanctioned? And what steps
    were taken by the CIO to prevent these kinds of incidents from
    happening in the future?
        Mr. Garcia. I certainly would defer to the CIO to answer
    those questions for you, as I was not directly involved in
    that.
        Mr. Hodes. May I just followup for one quick moment?
        Mr. Clay. Please. Go ahead.
        Mr. Hodes. Did you have any conversations with the CIO
    about what was going on with this breach by Unisys and how it
    was being handled and what effect it would have on the agencies
    that you do deal with?
        Mr. Garcia. Our U.S. CERT facility was in contact with his
    office, and I can get back with you as to exactly what the
    interaction was. I personally was not involved. That also deals
    with a contracting matter with the CIO's contract with Unisys.
        Mr. Hodes. So, to the extent there are any documents within
    your purview, control, constructive control, or custody, I
    would like you to provide to this body any and all documents
    reflecting any interaction, discussion or contact you or your
    agency, or anybody in it had with the CIO about the response to
    Unisys over this breach. Will you provide that to us?
        Mr. Garcia. Certainly.
        Mr. Hodes. Mr. Chairman, I request that the record stay
    open so that those documents may be provided.
        Mr. Clay. Without objection, for 5 legislative days.
        Mr. Hodes. Thank you, sir. Thank you, Mr. Garcia.
        Mr. Clay. Mr. Yarmuth.
        Mr. Yarmuth. Just one followup question. And this is mostly
    for my own understanding. I would like to try again to clarify
    the difference between for-profit and the not-for-profit world.
    And also, the difference between the infrastructure world and
    the software world, because presumably most of the software out
    there is produced by for-profit companies and you have a
    security aspect of the software and a security aspect of the
    infrastructure. I am just curious as to where you draw the line
    as to where the Government's interest and responsibility begins
    and where it ends.
        Mr. Garcia. If I understand your question, the way we look
    at it is that 85 percent to 90 percent of the critical
    infrastructure is owned by the private sector. So, they are
    managing the networks and the private sector is developing the
    hardware that runs on and runs those networks. It is our job to
    coordinate with those who are owning and operating and those
    who are using those systems to ensure that we have a proactive
    way of dealing with attacks and vulnerabilities as we find
    them.
        Mr. Yarmuth. What I am trying to understand the difference
    between the relevance of for-profit and not-for-profit where
    the Stafford Act issues arise.
        Mr. Garcia. I am not exactly sure of the answer to that
    question, sir.
        Mr. Yarmuth. OK. Well, I am not sure that I know enough to
    ask any more. Thank you.
        Mr. Clay. OK. The gentleman yields back. Mr. Garcia, Mr.
    Wilshusen pointed out that one of the issues that your
    Department has is retaining key officials in cyber security.
    What do you think is the solution to the revolving door there?
    What are the main issues and why do you lose so many key
    people?
        Mr. Garcia. Thank you, sir. I honestly would not
    characterize it as a revolving door. In fact, some of our more
    recent departures were strictly for personal reasons. Two major
    staff wanted to relocate closer to family across country and
    south of here. And to be honest, the DHS environment and our
    mission is a very high intensity one, and very fast paced and
    long hours. And given that, we make every effort to first
    recruit the best talent we can and then to retain them, and to
    reward them, and to make their experiences and their challenges
    meaningful.
        So, we are acutely aware of the need to have the best
    talent we can and we are actively filling those posts that have
    been vacated.
        Mr. Clay. Are many leaving for private corporate cyber
    security positions?
        Mr. Garcia. I am not sure exactly where they went. Probably
    to the private sector, but more toward a different way of life,
    closer to family.
        Mr. Clay. I see. Let me go another direction. According to
    GAO's 2006 Report on Internet Infrastructure, one of the
    significant obstacles facing DHS is the conflicting or
    overlapping roles of the National Cyber Security Division and
    the National Communications System, which seems to have
    undefined and conflicting roles in response to a major Internet
    disruption or cyber-attack. As the person in charge of both the
    NCSD and NCS, can you explain to us how the roles and
    responsibilities of both units are distinct or different?
        Mr. Garcia. Absolutely. Very good question. The National
    Cyber Security Division is responsible for the security of the
    information infrastructure. The National Communications System
    is responsible for ensuring that the Government, that the
    Nation, has the ability to communicate in times of national
    emergency.
        So you think of the NCS and communications as the pipe, the
    telecommunications pipe, and the NCSD as dealing with the
    software and the technology that controls the operations of
    those pipes and sends information through those pipes. So, NCSD
    and NCS have very complementary roles. Certainly not
    conflicting. Sometimes overlapping, but overlapping for the
    better.
        My role is to try to bring those--by the way, NCS is a 40
    year old organization, and NCSD is a 4-year old organization.
    So they have much different histories, but they work very
    closely together. For example, in the Estonia distributed
    denial-of-service attacks, NCS and NCSD worked very closely.
        Second, I am working to bring together, to co-locate the
    U.S. CERT operations with the NCS operations, which is called
    the NCC, the National Coordinating Center for
    Telecommunications, that is a 24/7 watch operation as well,
    that serves the communications infrastructure involving
    communications companies and Government employees.
        So, we are bringing them together so that the IT and
    Communications can have a more synthesized view of what is
    happening on our information and communications
    infrastructures.
        Mr. Clay. Let me ask you, as voice and data transmission
    networks continue to converge, wouldn't combining NCSD and NCS
    prove to be more efficient for agency operations?
        Mr. Garcia. I think certainly a good number of the
    functions have already converged. That when we look at the
    convergence of communications from the traditional circuit
    switch to packet switch technology, security is going to equal
    availability, and availability is going to equal security. So
    we can't bifurcate those functions.
        There are unique and distinct functions within the National
    Communications System and NCSD that may remain unique, but by
    and large, you are absolutely right, Mr. Chairman, functionally
    NCS and NCSD will over time converge.
        Mr. Clay. Thank you for that response. It is my
    understanding that NCSD recently released a draft of what it
    called the Information Technology Security Central Body of
    Knowledge, competency and functional, A Framework for IT
    Security and Workforce Development. Isn't this the type of work
    usually undertaken by the private standards-setting community,
    such as the ISO standards organization? How is this work unique
    to what has already been developed by the standards community?
        Mr. Garcia. Very good question, and I thank you for that.
    Yes, the Essential Body of Knowledge [EBK], is our attempt to
    bring together actually a number of those security skills,
    training skills standards that have been put out by a number of
    different organizations and really find the common elements
    among all of those. What we can do is provide as a reference
    for academia, for the practitioners, a synthesized set of work
    force skills and training standards to develop curricula or to
    develop training within the enterprise.
        So, in no way is it intended to supplant the other private
    sector-developed security standards. It is instead intended to
    sort of de-conflict among those and provide a much higher level
    reference for those who are trying to distinguish between one
    or the other type of standard that they ought to be using. So
    we are quite enthusiastic about it.
        Mr. Clay. OK. Thank you. Mr. Wilshusen or Mr. Ross, do you
    have anything else to add?
        Mr. Ross. Thank you, Mr. Chairman. I might go back to a
    previous point that Mr. Yarmuth mentioned. And that is the
    evolving nature of threats. We are always having to--what we
    see in Missouri is, we will see low-level threats. Low-level
    probes of our data center and our network. We will see hundreds
    of thousands of these low-level threats and probes but little
    variations on each other, and then at the end of that period,
    we will see a heavy strike on our data center in an attempt to
    bring down servers or communication equipment and the like.
        And to get to your other point, Representative, it is not
    teenagers hacking anymore. It is coming from other countries.
    Our forensic tools can track it down to continents and to
    countries, and it is coming from all over the world. But it is
    very focused. States have extremely valuable information.
    Financial information, health information, driver's license,
    Social Security number-type information and they are after
    that.
        A recent example I heard a presentation about. If you can
    just get hold of a CD copy of all the freshmen coming into the
    University of Missouri, either the law school of the finance
    school or accounting or the like, that is probably worth $2,000
    going in. Then years down the road, when it is actually--when
    they are income-producing people, that information is extremely
    valuable, and that is when they use it. So that type of
    information is what people are after.
        Mr. Clay. Do you ever make any successful apprehensions?
        Mr. Ross. Outside the country? No. Inside the country, we
    do.
        Mr. Clay. OK. Mr. Wilshusen, anything to add?
        Mr. Wilshusen. No.
        Mr. Clay. No? Thank you. I want to thank the entire panel
    for their testimony and answering questions. This panel is
    dismissed. Thank you.
        As soon as this panel is up, we would like the second panel
    to come forward to be sworn in.
        Thank you. On our second panel, we have a distinguished
    group of individuals who are highly qualified to address the
    issues associated with cyber security and Internet architecture
    from a variety of important perspectives.
        Mr. John T. Sabo is the current president of the
    Information Technology Information Sharing and Analysis Center
    [IT-ISAC], as well as the director of Global Government
    Relations for CA, Inc. In addition to IT-ISAC, Mr. Sabo
    represents CA in a number of security and privacy focus
    industry organizations and is an appointed member of the U.S.
    Department of Homeland Security Data Privacy and Integrity
    Advisory Committee. Welcome.
        Mr. Larry Clinton is the president of the Information
    Security Alliance, which has over 500 corporate members on four
    continents representing virtually every major segment of the
    economy. Mr. Clinton is a member of several boards and advisory
    committees, including the National Partnership for Cyber
    security, the Internet Education Foundation and the Advisory
    Board of the U.S. Congressional Internet Caucus, the IT Sector
    Coordinating Council and the DHS Critical Infrastructure
    Protection Advisory Council.
        Prior to coming to IS Alliance, he was a vice president at
    the U.S. Telecom Association, served as a legislative director,
    in the House of Representatives. Welcome back, Mr. Clinton.
        Mr. Ken Silva is the chief security officer of VeriSign.
    VeriSign's chief security officer and VP for Networking and
    Information Security. He oversees the mission critical
    infrastructure for all network security and production IT
    services for VeriSign. He also serves on several boards and
    advisory committees, including Information Technology,
    Information Sharing and Analysis Center. He is the chairman of
    the board of the Internet Security Alliance. Thank you for
    being here.
        Ms. Catherine T. Allen is the chairman and CEO of the Santa
    Fe Group, a strategic consulting firm specializing in
    technology and innovation issues facing the critical
    infrastructure. Ms. Allen has long been recognized as a leading
    expert on technology issues facing the financial services
    sector and other critical infrastructure industry. Prior to her
    current position with Santa Fe, she served as the founding CEO
    of BITS, a technology-focused consortium led by the CEOs and
    CIOs of our Nation's top 100 financial institutions. She is a
    graduate of the University of Missouri, where she also received
    an honorary Doctorate of Humane Letters in 2005.
    Congratulations and welcome.
        Ms. Kiersten Todt Coon is a VP of Good Harbor Consulting,
    where she focuses her efforts on developing risk management
    solutions for IT infrastructure and homeland security clients.
    Prior to joining Good Harbor, Ms. Todt Coon worked as a policy
    advisor to several senior Government and private sector
    leaders, including the Governor of California and former VP Al
    Gore. She also served as a professional staff member on the
    U.S. Senate Committee on Governmental Affairs, where she was
    responsible for drafting the Science and Technology
    Infrastructure Protection and Emergency Preparedness
    Directorate section of the Homeland Security Act of 2002. A
    graduate of both Princeton and Kennedy School of Government at
    Harvard, Ms. Todt Coon currently serves as a term member of the
    Council on Foreign Relations.
        I welcome all of you. It is the policy of the committee to
    swear in all witnesses before you testify. And I would like to
    ask you to stand, please, and raise your right hands.
        [Witnesses sworn.]
        Mr. Clay. Thank you. Let the record reflect that all of the
    witnesses answered in the affirmative. You may be seated. And
    we will start with Mr. Sabo to begin his testimony. And you
    have 5 minutes, and we like summaries.

     STATEMENTS OF JOHN T. SABO, PRESIDENT, INFORMATION TECHNOLOGY
    INFORMATION SHARING AND ANALYSIS CENTER AND DIRECTOR OF GLOBAL
       GOVERNMENT RELATIONS, CA, INC.; LARRY CLINTON, PRESIDENT,
       INFORMATION SECURITY ALLIANCE; KEN SILVA, CHIEF SECURITY
       OFFICER AND VICE PRESIDENT FOR NETWORKING AND INFORMATION
     SECURITY, VERISIGN; CATHERINE T. ALLEN, CHAIRMAN AND CEO, THE
     SANTA FE GROUP; AND KIERSTEN TODT COON, VICE PRESIDENT, GOOD
                           HARBOR CONSULTING

                       STATEMENT OF JOHN T. SABO

        Mr. Sabo. Mr. Chairman, and members of the subcommittee. I
    am John Sabo, director of Global Government Relations for CA.
    It is one of the world's largest software companies. More
    importantly for this hearing, I am a board member and president
    of the Information Technology Information Sharing and Analysis
    Center [IT-ISAC]. I am also a member of the separate IT Sector
    Coordinating Council, and I chair the ISAC Council, which is
    composed of 13 ISACs addressing cross-sector information
    sharing issues.
        I want to thank you and the subcommittee for the
    opportunity to share our views on public/private sector
    responsibilities with respect to preventing and addressing
    Internet disruptions.
        The IT-ISAC is a not-for-profit organization. We were
    founded in 2001. We fund an operation center. We monitor and
    address threats, vulnerabilities and attacks on the IT
    infrastructure and we have processes in place allowing us to
    address these issues collectively across the member companies
    when issues rise to a level requiring joint analysis or action.
        The IT Sector Coordinating Council and DHS formally
    recognize the IT-ISAC as the operational, informational sharing
    mechanism for our sector. The IT-ISAC is financed entirely by
    member companies through our membership dues and represents a
    significant by leading companies in the IT sector who have
    stepped to the call for industry action.
        The GAO and the Business Roundtable have released reports,
    both of which have been referenced, expressing significant
    concerns about the ability of the Nation to respond and recover
    from a significant Internet failure.
        Despite the fact that the Internet has to date proven
    resilient, these reports reinforce the imperative to plan for
    events that exceed our current understanding of threats.
    History often proves us wrong and surprises us with the
    unthinkable. The IT sector strategy to address these challenges
    is outlined in the IT Sector specific plan and at the heart of
    this plan is the need to protect key IT sector functions. And
    this is a very distinct concept from the physical asset focus
    of many other sectors. We are looking at IT functions.
        The plan identifies in great detail a number of areas that
    need to be strengthened and in the statement we have addressed
    a number of them. I only touch on two here.
        The first includes a number of steps that Government can
    take to enhance the public/private operational capability.
        Leveraging the expertise of the IT-ISAC and other fully
    functional ISACs instead of turning to policy councils for
    operational purposes.
        Stabilizing U.S. CERT and providing it with adequate
    funding in scale with its overall national mission, defining
    and clarifying the relationship among the U.S. CERT and other
    DHS analytical and operational components and programs.
        Programmatically encouraging companies to join ISACs as a
    best practice, something which the Roundtable did in its
    report.
        Supporting the cross-sector operational information sharing
    projects initiated by the ISAC Council, with equal energy and
    level of resources with which DHS supports policy and planning
    initiatives. Providing regular classified briefings to ISAC
    operational experts and not just to sector policy
    representatives.
        And finally, in this area, organizing more effectively in
    response to the growing convergence between traditional IT and
    telecommunications. And we welcome the physical co-location of
    the U.S. CERT and the NCC watch that Assistant Secretary Garcia
    mentioned, and in fact appreciate his invitation for the IT-
    ISAC to have representation.
        [The prepared statement of Mr. Sabo follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.042

        [GRAPHIC] [TIFF OMITTED] T3198.043

        [GRAPHIC] [TIFF OMITTED] T3198.044

        [GRAPHIC] [TIFF OMITTED] T3198.045

        [GRAPHIC] [TIFF OMITTED] T3198.046

        [GRAPHIC] [TIFF OMITTED] T3198.047

        [GRAPHIC] [TIFF OMITTED] T3198.048

        [GRAPHIC] [TIFF OMITTED] T3198.049

        [GRAPHIC] [TIFF OMITTED] T3198.050

        [GRAPHIC] [TIFF OMITTED] T3198.051

        [GRAPHIC] [TIFF OMITTED] T3198.052

        [GRAPHIC] [TIFF OMITTED] T3198.053

        Mr. Clay. I am going to ask each remaining witness to
    summarize, if they can, in less than 5 minutes, their opening
    statements. We are going to try to get in all opening
    statements before we recess again.
        Thank you, Mr. Sabo. Mr. Silva.

                         STATEMENT OF KEN SILVA

        Mr. Silva. Thank you, Mr. Chairman. I want to commend and
    thank you for holding this hearing. It is difficult to
    overstate the importance of amplifying and expanding our
    national focus on cyber security.
        Richard Clarke famously warned of the potential of a
    digital Pearl Harbor in which critical components of the
    Nation's increasingly vital electronic infrastructure would be
    brought down by a coordinated electronic attack.
        Since he expressed his concern, nothing really much has
    changed to make this any less dire. If anything, the threat
    grows greater every day. In fact, it has already happened to
    the country of Estonia earlier this year.
        None of us in Government or the private sector can sit
    still on electronic security. Our defenses must always remain
    two steps ahead of potential holes and exploits. If we fail to
    maintain that focus and let it deteriorate, we will be holding
    a very different sort of hearing in the near future, one in
    which we are all called upon to answer the hard question about
    what happened and what could we have done to have prevented it.
        I have been asked to offer a perspective on the efforts
    VeriSign and the Internet industry are taking to ensure that
    such a calamity never occurs. Make no mistake, it would be a
    major catastrophe for the Internet to experience such a
    significant failure.
        Approximately 25 percent of America's economic value moves
    over network connections each day. And it is not just our
    economy that would suffer. Government agencies at every level
    rely on the Internet. Imagine today's Congress trying to
    operate without e-mail or any other network services.
        What could cause such a failure? There are a couple of
    potential scenarios. The first is that we in the Internet
    community simply fail to expand the Internet infrastructure
    enough to meet the mounting demands placed upon it. The second
    potential for failure is that we fall short in adequate
    protection of our critical resources against a host of
    increasingly sophisticated cyber-attacks being directed against
    it.
        Internet crimes are increasingly conducted by sophisticated
    international crime syndicates that reap huge profits by
    targeting the network and its users. Even more frightening is
    the rise of cyber-attackers backed by governments and other
    deep-pocketed enemies of the United States.
        Today's attacks can cause damage 100 times more extensive
    than the attacks just a year ago. This is why investment in the
    infrastructure is so critical. Simply put, if we wait for usage
    to outpace the development or for sophisticated attacks to
    overwhelm our stagnant defenses, we are already too late.
        We learned the cost of complacency as a country when we
    watched the damage done by Hurricane Katrina. By the time
    Katrina hit the Gulf Coast, it was too late to strengthen its
    levees. We should not have to learn that lesson more than once.
    Critical resources should be reinforced long before there is a
    threat to their well-being.
        The Internet continues to grow at dramatic rates, which
    means the infrastructure must scale to meet that demand. No one
    can take security and stability of these networks for granted;
    not VeriSign, not the ISPs or other private sector players, and
    certainly not the Government.
        As the operator of the dot-com and dot-net domain
    registries, as well as a steward for 2 of the 13 root servers,
    VeriSign understands what is at stake. Over the last 8 years,
    VeriSign has operated its infrastructure with 100 percent in
    up-time. In other words, the systems that ensure Internet's
    core infrastructure remain functional have never gone down.
    VeriSign's primary computers that handle the dot-com and dot-
    net traffic are now capable of handling 10,000 the number of
    queries that they could handle in 2000.
        And while the dot-com and dot-net systems currently process
    more than 30 billion queries a day, we will need to build a
    network infrastructure that can support 10 to 100 times that
    level of volume in the next few years.
        That is why earlier this year, VeriSign announced a global
    initiative called Project Titan to expand and diversify its
    Internet infrastructure to those levels by 2010. These upgrades
    are vital to managing the surge in Internet interactions and
    protecting against cyber-attacks.
        VeriSign is well on its way to meeting its goals under
    Project Titan and is already considering how to address this
    set of challenges.
        Thank you.
        [The prepared statement of Mr. Silva follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.054

        [GRAPHIC] [TIFF OMITTED] T3198.055

        [GRAPHIC] [TIFF OMITTED] T3198.056

        [GRAPHIC] [TIFF OMITTED] T3198.057

        [GRAPHIC] [TIFF OMITTED] T3198.058

        [GRAPHIC] [TIFF OMITTED] T3198.059

        Mr. Clay. Thank you.

                       STATEMENT OF LARRY CLINTON

        Mr. Clinton. I want to congratulate you, Mr. Chairman, on
    holding this hearing of the Government Reform Committee,
    because Government reform is clearly what is necessary.
        The June 2, 2006 GAO Report got it exactly right. The
    problem is the inherent characteristics of the Internet. The
    Internet is unlike anything we have ever dealt with before. It
    is international, it is interactive, it is constantly on the
    attack. Consequently, it will require a security system unlike
    anything we have ever designed before.
        We can't simply cut and paste previous government systems
    and put them into Internet security. Even if Congress enacted a
    brilliant statute, it would only go to our national borders.
    Even if a regulator came up with a brilliant solution, it would
    be outdated before you could put it into effect.
        Fortunately, we need other things to attack the Internet.
    The committee has expressed some interest in the instance of
    Katrina, saying that we should model ourselves on that. There
    are major differences between cyber-attack and Katrina.
    Katrina, we could see it coming. Literally. From hundreds of
    miles away. The adequate analogy to Katrina is that the problem
    with Katrina wasn't the event itself. The problem with Katrina
    was that the systems weren't in place to properly handle the
    event.
        Now, fortunately, we actually know a good deal about how to
    mitigate and manage a number of issues dealing with cyber
    security. The largest study ever conducted in this field found
    that the best practices group, people who follow the industry
    recognize best practices were able to have fewer incidents,
    less downtime, less financial loss.
        What we need to do is find a way to get more people to
    follow the best practices that industry is already following.
    Industry is also not waiting for government to get its act
    together. Industry is aggressively moving forward with new
    products and services because, as it has already been pointed
    out, the problem has morphed.
        We are no longer looking at these well publicized instances
    like Blaster and Love Bug that were designed to get publicity.
    Instead, what we are dealing with now are carefully targeted
    designer malware that can sit on a system for an extended
    period of time, cause tremendous damage and we don't even know
    it is there.
        Fortunately, we are developing new systems to attack this.
    But there is a role for the government. And role for the
    government was pointed out in that 2006 GAO Report, where they
    pointed out that in the private sector, competitors were
    working together to deal with these incidents when they see
    that there is a direct business relationship benefit to that.
    And the NIPP, the National Infrastructure Protection Plan, also
    pointed out--and this is the one thing that I choose to read
    for you, Mr. Chairman:

            That the public private partnership called for in the NIPP
            provides for the foundation for effective critical
            infrastructure protection. The success of the partnership
            depends on articulating the mutual benefits to government and
            the private sector partners. While articulating the value to
            the proposition for the government is typically clear, it is
            often difficult to articulate the direct benefits to the
            private sector. In assessing the value proposition for the
            private sector, there is a clear national security interest and
            homeland security interest in ensuring that the collective
            protection of the critical infrastructure goes beyond that of
            the business unit. Government can engage industry to go beyond
            efforts already justified by their corporate business needs and
            assists in a broad-scale critical infrastructure protection by
            creating an environment that supports incentives for companies
            to voluntarily adopt widely held best practices.

        And I conclude my presentation by listing for you 10 steps
    that I would suggest that the committee consider for roles that
    the Government can embrace, which are not your traditional
    regulatory role, but are things like leading by example, using
    your market power instead of your regulatory power; supporting
    research and development that is not going to be undertaken by
    industry; using the market incentives that you have
    traditionally used in other areas; address the lack of cyber
    insurance; raise your aim in terms of awareness to focus on
    senior executives rather than individuals; adopt a coherent
    strategy for dealing with the private sector, something
    discussed before; clarify the roles and procedures for crisis
    management; and rethink your approach to information sharing.
        Thank you, Mr. Chairman.
        [The prepared statement of Mr. Clinton follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.060

        [GRAPHIC] [TIFF OMITTED] T3198.061

        [GRAPHIC] [TIFF OMITTED] T3198.062

        [GRAPHIC] [TIFF OMITTED] T3198.063

        [GRAPHIC] [TIFF OMITTED] T3198.064

        [GRAPHIC] [TIFF OMITTED] T3198.065

        [GRAPHIC] [TIFF OMITTED] T3198.066

        [GRAPHIC] [TIFF OMITTED] T3198.067

        [GRAPHIC] [TIFF OMITTED] T3198.068

        [GRAPHIC] [TIFF OMITTED] T3198.069

        Mr. Clay. Thank you so much, Mr. Clinton. The committee
    will now recess for the duration of these votes on the floor.
    They tell me it will be about half an hour. I am sorry. The
    committee stands in recess.
        [Recess.]
        Mr. Clay. The committee will come to order. Ms. Allen.

                    STATEMENT OF CATHERINE T. ALLEN

        Ms. Allen. Thank you, Chairman Clay and members of the
    subcommittee and committee for the opportunity to submit
    testimony before you today on private and public sector efforts
    to secure our Nation's Internet infrastructure.
        The Santa Fe Group does a lot of work for the industry and
    still for BITS. I am actually going to go directly to the
    recommendations because of the time.
        And what I am suggesting is that the financial services
    industry has done a great deal to strengthen business
    continuity, planning and coordinate prior to and during times
    of crisis. We have business continuity plans which are
    constantly updated. We refine and test them, and this is a
    regulatory requirement, and part of our risk management
    process.
        Most financial institutions, in fact, all that are deemed
    mission critical are required by our regulators to have
    recovery operations in place and back-up in a very narrow
    timeframe. And this requires telecommunications, it requires
    power and it requires dependency upon IT. If any of those are
    not working, we cannot meet our regulatory requirements.
        I would be the first to tell you that we have a long way to
    go as an industry, but there is much of what we do that we
    believe could be copied or modeled for other critical
    infrastructure industries.
        We have a very successful FS-ISAC, Financial Services ISAC,
    and FSSCC, a coordinating council for critical infrastructure
    protection. We work very closely with our regulators through
    the FBIIC and with the Department of Treasury in coordinating
    on everything from Katrina to the power outage after 9/11.
        Most recently, we ran a pandemic exercise which included a
    component that looked at if the Internet was down and we had
    many people working from home, what would that mean.
        And I would say that the two most important things that we
    have done related to Internet recovery are the work that we did
    on business critical telecommunications services, where we
    developed best practices, not only for the financial sector but
    for the telecom sector, upon which we are extremely dependent,
    to make sure that they had the diversity and redundancy that we
    needed.
        We also finished a business critical access to power. We
    did this with the power industry, again to look at best
    practices for alternative power if there was disruption in any
    of the IT industry.
        Last, we worked in managing third-party service providers.
    Much of the Internet is dependent upon third parties, many of
    whom are located in India and China and other places. So,
    looking at how we manage those. Those are all models for other
    industries.
        The recommendations that I have are, recognize that other
    industries may need to share the same level of responsibility
    and liability that we do as an industry, and to look at some of
    our regulatory requirements might not be a bad idea. Second, we
    maintain rapid and reliable communications, and that means
    diverse communications.
        I personally had a number of our CIOs from the financial
    sector in Detroit when we had the power outage, we were all
    using our Blackberries, which were the only thing that still
    worked, because the cell phones ran out and there was no power.
    But that is how we communicated with our regulators, and we
    were able to make sure that it wasn't a terrorist event, that
    it was in fact a power outage. But we needed to have
    alternative channels.
        Recognize the critical infrastructures that are dependent
    upon software and operating systems. The IT industry is the
    backbone for telecommunications, for power, for the user groups
    like financial services and chemical, and if they are down or
    disrupted, we are down.
        So, it is critically important to focus on the Internet,
    the software and operating systems that access the Internet
    because that is the backbone of both economic and
    communications-wise for us.
        We encourage our regulatory agencies and others to look at
    the software vendors. Similar to what our regulators look at,
    third-party service providers, to make sure that they are
    delivering safe and sound practices and security practices
    within those vendors.
        Encourage collaboration and coordination among critical
    infrastructures and the government agencies to enhance the
    diversity and resiliency of the telecommunications
    infrastructure. The NCC, the NCS, used to be an outstanding
    organization. We did a lot of our early work with them. They
    were gutted. They have no budget to be able to do the kind of
    work that we need for them to do.
        Invest in the power grid because of its critical and
    cascading impact on other industries and other critical
    infrastructures.
        And when I talk about invest, I think there are incentives
    that Congress can put in place to have these other industries
    make sure that they maintain a resiliency.
        Improve the coordination procedures across all critical
    infrastructures and with the Federal, State and local
    governments, I don't believe it is working, and I think there
    is much that we need to do, when we do have a major event.
        And last, encourage law enforcement to prosecute cyber
    criminals. And in particular, on a global basis, because much
    of the problems we have are not criminals in the United States,
    they are criminals in the Ukraine or in Asia or in other
    countries that are attacking our systems here today.
        I thank you, Chairman Clay and Members, for this
    opportunity to testify ensuring Internet resiliency and
    security in light of the increased cyber-attacks. It is a
    daunting task, but it is critically important to do so.
        Thank you.
        [The prepared statement of Ms. Allen follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.070

        [GRAPHIC] [TIFF OMITTED] T3198.071

        [GRAPHIC] [TIFF OMITTED] T3198.072

        [GRAPHIC] [TIFF OMITTED] T3198.073

        [GRAPHIC] [TIFF OMITTED] T3198.074

        [GRAPHIC] [TIFF OMITTED] T3198.075

        [GRAPHIC] [TIFF OMITTED] T3198.076

        [GRAPHIC] [TIFF OMITTED] T3198.077

        [GRAPHIC] [TIFF OMITTED] T3198.078

        [GRAPHIC] [TIFF OMITTED] T3198.079

        [GRAPHIC] [TIFF OMITTED] T3198.080

        [GRAPHIC] [TIFF OMITTED] T3198.081

        [GRAPHIC] [TIFF OMITTED] T3198.082

        [GRAPHIC] [TIFF OMITTED] T3198.083

        [GRAPHIC] [TIFF OMITTED] T3198.084

        [GRAPHIC] [TIFF OMITTED] T3198.085

        [GRAPHIC] [TIFF OMITTED] T3198.086

        [GRAPHIC] [TIFF OMITTED] T3198.087

        Mr. Clay. Thank you so much, Ms. Allen, for your testimony.
    Ms. Todt Coon, you may proceed.

                    STATEMENT OF KIERSTEN TODT COON

        Ms. Todt Coon. Good afternoon, Chairman Clay, and thank you
    for the opportunity to testify. As was mentioned in the
    introductions, I am currently a vice president at Good Harbor,
    and of particular relevance to this hearing, served on the
    Senate Committee on Homeland Security and Government Affairs,
    and worked on the Directorate part of the DHS legislation on
    Internet Protection and Emergency Preparedness.
        In the interests of time, I will move pretty quickly to my
    recommendations.
        As the National Strategy to Secure Cyberspace correctly
    stated, cyberspace is the nervous system supporting our
    Nation's critical infrastructure. Yet, despite our recognition
    of this, little has been done and there are several reasons for
    this, including authority and ownership issues, both in the
    public and private sectors.
        Our Internet infrastructure is vulnerable for several
    reasons, and I will tackle two of them regarding infrastructure
    and looking at response capabilities. Regarding infrastructure
    in our end systems, there are two classes of end systems. There
    are home users and enterprise. Access to the servers usually by
    these enterprise users is critical in a time of crisis. If the
    end systems are compromised, then key response personnel will
    not be able to access the information they need to respond to
    an event.
        The current challenge with which we are faced is that all
    information, both critical and non-critical, is transmitted
    over our information networks and treated equally. For example,
    if this Nation is confronted with a pandemic like the avian
    flu, our information networks as they currently exist will
    experience disruptions and outages that will paralyze us and
    prevent us from executing an effective emergency response.
        The second area of weakness I will discuss in this brief
    statement is response capabilities. Our response capability is
    critical because obviously we are not able to guard
    successfully against all threats. We don't have a back-up
    system at this time that can be activated in the event of a
    widespread Internet failure. And we have not developed
    scenarios for potential attacks on our Internet infrastructure.
        Experts disagree on the magnitude of risks and what needs
    to be done. And what is important that we routinely use this
    lack of consensus as an excuse for inaction. Until we reach
    agreement on these issues, we will not be able to prepare for
    imminent attacks.
        So I offer today the following recommendations. The
    Internet was designed for the purpose of openly sharing
    information. The question then with which we are posed is how
    do we impose the secure exchange of information on top of an
    open sharing environment.
        We should create a three-tiered system that allows our
    networks to identify and prioritize in the following order.
    First, critical communications supporting government
    operations, business and first responders. Second, routine
    business information, and third, non-critical information. In a
    time of crisis, we must be able to ensure that critical
    information is being delivered with priority speed and that it
    is not encumbered by non-critical information being sent
    simultaneously.
        We must also develop back-up systems and conduct scenario
    planning. If we experience a life cycle attack, we would need
    to have the ability to reboot the Internet. We should have
    reserve network protocols and we should maintain back-up
    parallel systems that can replace the active systems and bring
    up the critical portion of the Internet in the time of crisis.
        And we should develop a playbook for scenario planning. And
    I assert that this is different than exercise. Scenario
    planning is different than exercises. Scenario planning would
    push us to identify and conceive possible responses to a
    serious attack. We need to think through how appropriate
    players in both the public and private sectors will respond and
    we need to examine our current authority and ownership issues
    within both the government and the private sectors.
        I now submit to you a final recommendation. One of the
    first steps we need to take in preparing ourselves for an
    information infrastructure failure is to set risk standards.
    However, we can't set risk standards if we don't know what the
    risk is.
        I commend this committee on its work with FSMA because I
    think FSMA has done a good job with defining cyber security. I
    also propose a National Cyber Risk Assessment to be conducted
    by a blue ribbon commission of experts who would be responsible
    for defining the risks that exist. The only way we can begin to
    adequately prepare ourselves is to commit to possible
    scenarios. The assessment would inform the scenarios and enable
    us to assign ownership and controls. The Office of Management
    and Budget should provide the resources, the direction and the
    oversight and leadership for this assessment.
        In conclusion, experts and observers postulate that we do
    not have to be worried about hackers taking down the Internet
    because hackers would not intentionally bury their playground.
    But our greatest risk does not come from hackers. It comes, as
    was mentioned before, from foreign governments that can ably
    and quietly use the Internet infrastructure for espionage and
    other nefarious purposes.
        The threat is particular strong from governments that have
    developed their own internal Internets, such as China, and
    would therefore not be severely affected by a worldwide
    disruption.
        Recent events have demonstrated that these scenarios are
    not possibilities, but realities. Our national security, the
    health and well-being of the community, and the daily
    functioning of our society depend on the security and
    resiliency of our infrastructure.
        We have a responsibility to define the Internet
    infrastructure risk that exists and to plan for that risk
    appropriately. And we have a responsibility to act. I assert
    that we must act now.
        Thank you for the opportunity to testify before you today.
        [The prepared statement of Ms. Todt Coon follows:]

        [GRAPHIC] [TIFF OMITTED] T3198.088

        [GRAPHIC] [TIFF OMITTED] T3198.089

        [GRAPHIC] [TIFF OMITTED] T3198.090

        [GRAPHIC] [TIFF OMITTED] T3198.091

        [GRAPHIC] [TIFF OMITTED] T3198.092

        [GRAPHIC] [TIFF OMITTED] T3198.093

        [GRAPHIC] [TIFF OMITTED] T3198.094

        [GRAPHIC] [TIFF OMITTED] T3198.095

        Mr. Clay. Thank you very much. I will ask the panel several
    questions, and I would love to hear responses from the entire
    panel. We will just start at this end of the table with Ms.
    Todt Coon, and go down the line.
        The first issue is, regardless of which sector of the
    economy we focus on, all of them have significant levels of
    dependence on the Internet for their operations. It seems,
    however, that we spend more time focusing on the risk of 17
    different sectors, as opposed to the broad risk associated with
    the disruption of a key critical asset, such as the Internet.
        First, should we begin to move away from establishing
    levels of risk for each specific sector, and move toward
    establishing risk models according to specific assets or
    critical functions, such as telecom, Internet or infrastructure
    resiliency or the security of our power transmission assets?
        Ms. Todt Coon, let's begin with you.
        Ms. Todt Coon. Thank you. That is an excellent question,
    and it is obviously a question that we are confronted with in
    looking at how we have organized our sectors.
        I think some would assert at this point that the sector
    model is sophisticated in a way that is almost too
    sophisticated for us to manage right now, because the reality
    of how we are handling the sector issue is that it is stalling
    us and preventing us from making the progress that we could on
    information infrastructure protection.
        I would reference a report that was recently released by
    the Business Roundtable which talks about public/private
    partnerships. And it talks about the fact that the private
    sector incorrectly believes that government is developing
    response plans and that the Government believes that the
    industry structures will have their recovery response plans.
        We recognize that both the public and the private sector
    have a role but neither is adequately prepared.
        Having said that, I would like to reference, I think, a
    model within the private sector and its coordination with the
    public sector that has worked effectively. And that is the
    FBIIC model, which Ms. Allen has referenced. It is the
    Financial and Banking Information Infrastructure Committee.
        Post 9/11, the financial sector was obviously concerned
    about the anticipation of what could happen to our banking and
    financial markets. Through the committee, the Fed reached out
    to 11 financial institutions--reached out to the banking
    industry, and said we are going to talk to 11 institutions, we
    are not going to tell you who they are. Obviously if we talk to
    you, you will know you are one of them. And if not, you are
    not.
        And they worked with these institutions to create a
    security and resiliency plan. And Ms. Allen, I am sure, can
    talk to this in greater detail. But what this collaboration
    reflected was the clarity of Government purpose, and it also
    reflected industry working within a Government strategy.
        And one of the reasons why I think this was effective, was
    that the Government was able to leverage its institutional
    knowledge. The way that we have currently organized with DHS is
    that we have split the ownership roles across different
    agencies and entities, both on the cyber side, but we see it
    with energy and with other structures.
        And what I would propose is that we look at how the
    Government can institute this integrated approach to industry
    protection in a more collaborative way that doesn't silo this
    protection issue.
        Mr. Clay. Thank you for that response.
        Ms. Allen.
        Ms. Allen. I agree with everything you just said, and I
    would add to it, you can't boil the ocean. And I would pick
    five infrastructure groups to first coordinate and use that as
    a model for the others. And that is, the IT, the Internet, the
    telecom and the power, because they are absolutely
    interdependent.
        Then I would add financial services, because if that is
    down, then you are going to have a major problem with the
    economy and the confidence of the people. Last, first
    responders, so that you are taking care of the first
    responders.
        If you could look at integrated programs across those five
    groups, with the Government, that would be the starting point.
    And I think the FBIIC model, that the financial sector
    developed is the right model.
        Mr. Clay. Should it all be Homeland Security's
    responsibility? [Laughter.]
        Well, maybe Ms. Todt Coon should answer that. You helped
    design----
        Ms. Todt Coon. Well, I don't have a lot of confidence.
    Let's just say that there has been many, many attempts to have
    this happen under DHS and it has been very difficult for it to
    be effective. So I think it is really going to take absolute
    administrative support. I am in support of a blue ribbon
    commission and then maybe DHS responds back to and does
    whatever this commission says it needs to do.
        But I don't think that it is going to come the way that we
    have it structured now.
        Mr. Clay. All right. Mr. Clinton.
        Mr. Clinton. Mr. Chairman, I think that is a very
    thoughtful question. And I have been trying to listen to my
    colleagues to get a good answer for it, while I have been
    thinking of it myself.
        Here is my off-the-cuff view on it. First of all, we at the
    Internet Security Alliance have never embraced the sector
    model. The Internet Security Alliance is built on an entirely
    different model. We are a cross-sectoral organization. We have
    the defense sector, IT, banks, Coca-Cola, food service. Only
    because when you are dealing with the Internet, it is all ones
    and zeroes.
        So we all have the same problem, although, at a sub-
    structural level, there are individual sector orientations
    within. So, the sector model, I think, was entirely the wrong
    way to go, fundamentally. And when I say we ought to rethink
    things, that is one of the places where I would suggest we
    begin.
        The second question, and this kind of gets to your followup
    question a little bit, has to do--when you say, what should we
    be doing. That is a really critical question. Who is the ``we''
    you are talking about, sir? I think it is appropriate for you
    to be thinking, well, should this be DHS? And my answer is no,
    it shouldn't be DHS. It can't be DHS. If we try to shove this
    into DHS, even if we hire Catherine Allen to run DHS, I am
    still not sure that they are going to be able to do it. They
    are a U.S. Federal Government institution trying to deal with
    an inherently international infrastructure that is owned and
    operated 95 percent by the private sector.
        Trying to get this done through DHS or the Internet
    Commission on Wonderfulness is not going to work. We have to
    understand that we are dealing with an entirely different
    model. We have to find a way to work together with the private
    sector. The private sector is constantly--the major players,
    anyway--are constantly doing risk assessments. They are
    constantly upgrading their systems.
        As I said in my testimony, they are not waiting for DHS.
    And we work cooperatively with DHS. I am not going to bash DHS.
    But the system is being run by the private sector. That is
    never going to change. We have to find a way that Government
    understands its role. And its role is not to manage, to
    dictate, to be the parent here. Their role is to be a major
    user who works with all the other major users.
        Now, obviously they have a separate role in terms of
    national defense that we could deal with differently. But my
    suggestion would be that the way to go about this is to harden
    the entire system. Not to identify what the one particular risk
    is because that is a static moment in time.
        This past week we had a major conference at ISA where we
    looked at securing the IT supply chain. Talk about a major
    problem. There is nothing that is not in the IT system that is
    not researched, resourced, developed, assembled, whatever,
    someplace. And some of the places this stuff is made can be a
    little bit scary.
        How do we secure the supply chain? And we looked at all the
    risks. And we said this is the area where we have the greatest
    vulnerability. We looked at it for a minute, and we said, well,
    as soon as we established that as the major risk vector, the
    guys who are attacking this aren't stupid. Move it over to
    here.
        So the risks don't stay static. We need a full systems
    solution that is sustainable on a long term basis and that is
    why we argued for a system of market incentives. We have to
    make the owners and operators realize that it is in their self-
    interest to continually upgrade and build-out the system,
    including the Federal Government's, and that is, we think, the
    answer to the approach that you are suggesting.
        Mr. Clay. Thank you for that response.
        Mr. Silva.
        Mr. Silva. I think that you have brought up a couple of
    interesting questions here, and I thank you for the opportunity
    to respond to them.
        It is interesting, when you really think about throughout
    time, we have kind of decided that we would handle this in a
    sector-specific way and that's just sort of how it worked
    itself out. In fact, the ISACs themselves were created as
    sector-specific to a large degree.
        And there are problems that are sector-specific. For
    instance, financial institutions have a more interesting set of
    threats unrelated to the infrastructure itself, but more around
    IT security and around the practices of being online for a bank
    or other financial institutions.
        But there are a lot of overlapping infrastructures, and
    those infrastructures certainly include the Internet itself,
    which all by itself is very insecure. I mean, the Internet
    itself doesn't offer any security. It really doesn't. Most of
    the security is handled either through appliances or through
    the applications themselves. But the Internet itself was
    designed to be an open system with really zero security
    measures to it at all.
        So I think that we need to look at the Internet
    infrastructure and its resilience and whatever security
    mechanisms we need to put in place to make sure that it
    continues to stay up, and the international aspect of it needs
    to be something that is looked at commonly across all of the
    sectors.
        Now you did ask what we should be doing and, as Mr. Clinton
    pointed out, what we should be doing is dependent upon who
    ``we'' is. Since the private sector is responsible for most of
    the infrastructure on the Internet, it is incumbent upon the
    private sector to take action.
        I think if we beg for too much regulation from the
    Government, we will get exactly what we asked for, and I don't
    think that would be a pleasant situation, either.
        But as Mr. Clinton pointed out, incentives are probably the
    best tactical step that could be taken with long term effects
    that I think would be positive. Unfortunately, when we look at
    building out the infrastructure, say, for the next generation
    of the Internet protocol--which by the way that next generation
    of Internet protocol was developed a decade ago, and still has
    yet to be implemented literally. IP Version 6 has been pretty
    much standardized for a number of years and is the best
    technology yet to come, still.
        But there is no incentive for telecommunications providers
    or Internet service providers to deploy it. There aren't any
    customers and it is a chicken and egg kind of thing. There is
    more secure, more robust protocol, and some would argue that it
    is not necessarily more secure and I might be one of them. But
    it hasn't been deployed because there are no customers for it.
    There are no customers for it because it doesn't exist.
        The Federal Government is a big enough customer that if
    they demanded it as part of their infrastructure, and their
    infrastructure build-out and used their market influence, their
    buying power, then those kinds of protocols and those kinds of
    enhancements would be made, if demanded by the Government as
    part of the procurement process.
        Thank you.
        Mr. Clay. Thank you for that response.
        Mr. Sabo.
        Mr. Sabo. Well, summing up after that, or coming to a
    conclusion, a couple of things I would say with respect to the
    basic question.
        There are risk assessments that can be applied generally to
    what we see as the infrastructure. And some of that work is
    happening now. The IT-ISAC and the Sector Coordinating Council,
    in fact, have work groups of industry experts attempting to
    look at the key functionality provided by the infrastructure
    and the sub-functionality, and attempt to build a risk
    assessment methodology that actually might make some sense.
        If you do a static risk assessment, although I respect the
    idea of bringing in experts and assembling for many months, we
    have had many of those studies. You can look at the literature
    and you can see a number of recommendations made by
    academicians and by industry experts that are sitting on the
    shelves because the Internet and the infrastructure are very
    dynamic. And, as Mr. Silva pointed out in his statement, a
    number of threats to the infrastructure are not on the
    infrastructure, it is on the applications that ride on the
    infrastructure and that impact the utility of the
    infrastructure.
        In the financial sector, a number of attacks are based on
    social engineering. And those attacks open up and expose
    vulnerabilities, the vector of an attack that can be used much
    later to go after the infrastructure.
        In a way, we have a very organic Internet infrastructure.
    The components of it, such as software itself or a domain name
    service resolution or some of the other pieces of it, are all
    components which lead to the vulnerabilities which actors can
    use when they decide to make an attack.
        So a couple of things. One is, work needs to happen cross-
    sector and I agree with that, and it is actually starting, but
    it has not really moved far enough along. Work also has to
    happen by the users of the infrastructure, and that is, the
    major sectors and the major corporations and companies in the
    sector. And to some degree that is addressed by the type of
    regulatory environment in which financial services operates. It
    is not addressed in many other environments and yet the work
    needs to be done.
        So I think it really is a combination of both looking at
    the risks associated with the use of the network
    infrastructure, for example, by control systems, the use of the
    infrastructure by the major corporations, but also by the
    industry that writes the hardware/software and operates
    resolution services and security services for the
    infrastructure.
        You can't look at it, I think, as one simple solution. You
    have to recognize how complex the beast is, and you have to
    let, actually encourage, which was the purpose of my testimony
    for the ISAC, that where industry is stepping forward to
    address these issues, Government's best role is to foster and
    encourage through appropriate incentives. And not all monetary
    incentives. They could be incentives such as saying we
    encourage you and we will support some of these activities, to
    move forward with that.
        And I think to conclude, the Roundtable Report is an eye-
    opener. Because what the Business Roundtable found in its
    report says that we are increasingly and fundamentally and
    almost totally becoming dependent on this IT infrastructure
    which is network based. And in that interdependence, we are
    losing our capacity to go backward. We are losing our ability
    to go back to older systems. We are losing our ability to fall
    back to paper systems. Therefore it is imperative for us as a
    Nation to take the steps to do what you just said; do an active
    risk assessment, put in the types of controls we need, do some
    of the strategic work that is academically based, but have a
    proactive operational plan to move forward.
        If all we are going to do is write more papers, do more
    commissions, do more studies, we are going to hopelessly fall
    behind. And so I think being active, looking at the uniqueness
    of each sector, what the companies are doing, what the
    practices are, as well as looking cross-sector at some of the
    functions, is a combination way to go.
        And then from a congressional perspective, avoiding
    regulation but perhaps looking to measures and to saying to us
    who are in these sectors, what are some performance measures
    that you are using to evaluate your effectiveness. What steps
    are you taking. What outcomes are you offering.
        And to me that would be the most effective short-term
    approach.
        Mr. Clay. Thank you for that response. One more question
    for the panel. Is the extension of the Federal Terrorism
    Reinsurance Backstop program an adequate model for Government
    to provide economic security to the private sector in the event
    of a major Internet disruption? Do we have effective risk
    models to determine the cost and potential exposure to the
    Government for covering this type of incident? We will start
    with Ms. Todt Coon.
        Ms. Todt Coon. I would go back to--I appreciate the
    comments of the panelists, but I continue to assert that we
    have not defined the risk in a way that allows us to create a
    model, in response to your question. By not having this
    accountability and by not defining this risk, we are being
    stalled with inaction.
        And while there has been action in different components, as
    we cited earlier--I think what the financial sector has done is
    exemplary and noteworthy--as a whole, we have not made the
    progress on these issues that we are looking to do.
        And I think at the end of the day, in looking at what the
    public and the private sectors have done, as we cited earlier,
    looking up multiple post-Katrina reports, we recognize that
    neither the public nor the private sector can respond
    individually. They need to work together. And Katrina showed us
    that the ways in which they work together currently aren't
    working properly.
        And so I would encourage us to look at legislation, like
    the Stafford Act, to revise to include for-profit companies and
    also look at the Defense Production Act, which if leveraged
    correctly by DHS could support the work that they are doing.
    And I think that legislation exists out there within which we
    need to work. And that we also need to be assigning the
    ownership and responsibility in a more clear way that allows
    those entities responsible for this to act accordingly.
        Mr. Clay. Thank you for that. And, Ms. Allen, the Terrorism
    Reinsurance Backstop program, is it an adequate model?
        Ms. Allen. It is not adequate. I think it is a good thing,
    but it is not adequate. Again, I agree that there is not an
    appropriate risk model. We don't yet understand the cross-
    sector impact. I think there are other incentives, including
    insurance, the ratings agencies, tax incentives, Government
    procurement, that might be more effective in the short run.
        And that is my answer.
        Mr. Clay. Mr. Clinton.
        Mr. Clinton. I think I would agree that it is a useful
    model, but some important differences have to be realized.
    First of all, cyber insurance is a very different animal than
    traditional insurance. The cyber insurance market has not taken
    off at all. It has been stagnant for 5 or 6 years, about 20
    percent of companies have cyber insurance. And there are things
    that the Government can do to help in that area.
        So, if you are talking about cyber, the model is probably
    worth looking at, but there are other things that need to be
    done. And my colleagues are exactly right with regard to you
    can't assess the risk.
        Let me quickly tell you what the core problem is with cyber
    and then in my written testimony I go into a little bit more
    depth on insurance. I won't bore you with that now.
        But the problem with cyber insurance, it is available. But
    the problem is, nobody buys it. And the reason nobody buys it
    is because it costs too much money. And the reason it costs too
    much money is because since there isn't adequate actuarial
    tables, the businesses that run the cyber insurance naturally
    set the risk at maximum and therefore the prices are at
    maximum.
        The Federal Government could do a tremendous service by
    coming in and working with us so that we get the data
    appropriate so that we could set actuarial tables which would
    bring more providers into the market. Currently one company,
    AIG, has 85 percent of the market. That is not a good thing.
        If we got more providers into the market by providing them
    with the data, which expect the Government does actually have,
    that would then lower the cost. By lowering the cost, now more
    providers will get in. That will increasingly lower the cost,
    which has two major benefits.
        First of all, if you have a cyber Katrina right now, there
    is virtually nobody covered. Which means the insurer of last
    resort is going to be the Federal Government. The Federal
    Government is going to be stuck with a billions and billions
    and billions of dollars bill. It is going to be worse than
    Katrina because at least there was some insurance down there.
    There isn't in a cyber Katrina.
        Second, once we have insurance available and being
    purchased broadly throughout the market place, insurance can
    be, in addition to other incentives, and I would endorse
    Cathy's comments in that regard, but insurance can be a
    tremendous incentive.
        We use insurance all the time to motivate pro-social
    behavior. Good driving behavior, good health behavior. My
    daughter is desperate to get really good grades because it is
    going to lower the insurance on her car. This can drive better
    behavior. And what I have argued in my testimony is, the way to
    have a fully resilient, consistent, consistently up-growing
    system is to have market incentives. Insurance is a great one.
    So that people will constantly want to adopt the best
    practices, get the lower insurance rate and the industry and
    the Government is therefore covered if we have a major event.
        So, it is a good model, but there are a variety of things
    that we have to do to make it work, particular in the cyber
    arena.
        Mr. Clay. Thank you for that response.
        Mr. Silva.
        Mr. Silva. Thank you. I don't know that level of assistance
    is necessarily everything that we need. And there has been a
    lot of discussion about how difficult it is to assess the risk.
    And I don't know about assessing the risk because I think each
    individual element of this could assess what they believe is a
    risk and then somehow we could wrap that up. It is difficult to
    assess now.
        What is even harder to assess is what the level of damage
    is going to be. And it will be more than we can even imagine
    sitting at this table. We couldn't have imagined the damage
    that happened during Katrina and when we sat and tried to plan
    for that ahead of time.
        But the damage that would have happened from even shutting
    down the Internet for a couple of hours in the middle of a
    trading day or the middle of a business would be catastrophic.
    It would be huge. And if something so serious occurred that we
    had to reboot the Internet, so to speak, it would be a
    significant amount before that recovery would actually take
    place. There are so many different players.
        But one of the things that I worry about, in addition to
    those attacks that come from a terrorist act, if you will, or
    some malicious behavior, are those sorts of things that might
    create a self-inflicted wound. In our zeal to try to improve
    the Internet, in many cases, we make it more complicated and in
    fact create new and additional risk that we should think
    through a lot more carefully before we do it.
        One example of that is internationalized domain names.
    There are proposals to create internationalized domain names in
    order to let countries create domain names, the name of Web
    sites, if you will, in Cyrillic or Arabic, etc. The problem is
    that because of a lack of careful action and careful planning
    on this, other countries are on their own racing out to create
    another Internet, if you will, that uses the Internet we are
    used to, but works in a completely different way.
        So the rules and regulations that we would create and the
    policies that we would create as industry sectors and as
    governments wouldn't apply to these people. Therefore, we have
    to take corrective action for whatever the weakest link is
    going to be, and carefully think through some of these
    improvements that we think are improvements, and make sure that
    they are not actually creating more complexity and more
    confusion for users and more confusion for the people who have
    to assess threats and damage.
        Mr. Clay. Thank you for that response.
        Mr. Sabo.
        Mr. Sabo. I think an approach to this is to give a chance
    to the mechanisms that have not been given a chance to work. It
    is a complex environment. We have never been in a situation
    where millions of individuals scattered around the whole United
    States, or for that matter, the world, could literally have an
    impact on a national economy.
        We have never been in a situation where people living--and
    it has been rare--but if you think of a physical event and the
    insurance for terrorism, it might be very applicable to that.
    But we are dealing with a much different animal.
        Mr. Clay. Mr. Sabo, let me interrupt you. Are we too
    dependent on the Internet as a society? As a world? Mr. Clinton
    is saying there is no going back. There is no way to go back to
    the paper or anything else. Does that make us too dependent on
    the Internet?
        Mr. Sabo. We are dependent on it. And it is increasingly
    so. And we can't stop that because the nature of us as human
    beings, the nature of the capitalist society and the
    development of many uses of information and new technologies,
    simply can't be arrested without some dramatic shift back to a
    society of almost the Stone Age. You can't do it.
        Having said that, and knowing the complexity that we do, my
    suggestion is that we give an opportunity for measures to begin
    working slowly to address different aspects of this. So one
    aspect is Internet resilience and some of the things that Ken
    is talking about.
        Another aspect is expectations of companies as noted in the
    Business Roundtable to take steps, good steps, to deal with
    business continuity practices. Another example would be looking
    to industry through the ISACs and so on, to address
    vulnerabilities.
        And by putting this together in combination, you have some
    opportunity to see progress against a set of measures. But if
    you just look at it in terms of--particularly with the
    Internet, as Ken said, a catastrophe so huge that in cyber
    terms it would be the equivalent of a national state of
    emergency that might continue for weeks or months.
        What is that? How can you insure against it? Insurance
    might be good to, say, I have a breach issue and I am insured
    against the risk associated with that. But how do you insure
    against the loss of a whole infrastructure for the whole
    economy?
        So I would say an approach is let each of the measures that
    are best suited for this tier of protection be given a chance
    to operate and be given a chance to demonstrate effectiveness.
        Mr. Clay. Thank you so much for that response. Let me thank
    the panel for their responses and their expertise in this area.
    I am certain that this will not be the last hearing.
        But as you have heard, the bells have rung, and without
    objection, this committee is adjourned.
        Thank you.
        [Whereupon, at 5:50 p.m., the subcommittee was adjourned.]