[House Hearing, 111 Congress]
[From the U.S. Government Publishing Office]
DO THE PAYMENT CARD INDUSTRY DATA STANDARDS REDUCE CYBERCRIME?
=======================================================================
HEARING
before the
SUBCOMMITTEE ON EMERGING
THREATS, CYBERSECURITY,
AND SCIENCE AND TECHNOLOGY
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED ELEVENTH CONGRESS
FIRST SESSION
__________
MARCH 31, 2009
__________
Serial No. 111-14
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
__________
U.S. GOVERNMENT PRINTING OFFICE
52-239 PDF WASHINGTON : 2010
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC
area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, Washington, DC
20402-0001
COMMITTEE ON HOMELAND SECURITY
Bennie G. Thompson, Mississippi, Chairman
Loretta Sanchez, California Peter T. King, New York
Jane Harman, California Lamar Smith, Texas
Peter A. DeFazio, Oregon Mark E. Souder, Indiana
Eleanor Holmes Norton, District of Daniel E. Lungren, California
Columbia Mike Rogers, Alabama
Zoe Lofgren, California Michael T. McCaul, Texas
Sheila Jackson Lee, Texas Charles W. Dent, Pennsylvania
Henry Cuellar, Texas Gus M. Bilirakis, Florida
Christopher P. Carney, Pennsylvania Paul C. Broun, Georgia
Yvette D. Clarke, New York Candice S. Miller, Michigan
Laura Richardson, California Pete Olson, Texas
Ann Kirkpatrick, Arizona Anh ``Joseph'' Cao, Louisiana
Ben Ray Lujan, New Mexico Steve Austria, Ohio
Bill Pascrell, Jr., New Jersey
Emanuel Cleaver, Missouri
Al Green, Texas
James A. Himes, Connecticut
Mary Jo Kilroy, Ohio
Eric J.J. Massa, New York
Dina Titus, Nevada
Vacancy
I. Lanier Avant, Staff Director
Rosaline Cohen, Chief Counsel
Michael Twinchek, Chief Clerk
Robert O'Connor, Minority Staff Director
------
SUBCOMMITTEE ON EMERGING THREATS, CYBERSECURITY, AND SCIENCE AND
TECHNOLOGY
Yvette D. Clarke, New York, Chairwoman
Loretta Sanchez, California Daniel E. Lungren, California
Laura Richardson, California Paul C. Broun, Georgia
Ben Ray Lujan, New Mexico Steve Austria, Ohio
Mary Jo Kilroy, Ohio Peter T. King, New York (Ex
Bennie G. Thompson, Mississippi (Ex Officio)
Officio)
Jacob Olcott, Staff Director
Dr. Chris Beck, Senior Advisor for Science and Technology
Carla Zamudio-Dolan, Clerk
Coley O'Brien, Minority Subcommittee Lead
C O N T E N T S
----------
Page
Statements
The Honorable Yvette D. Clark, a Representative in Congress From
the State of New York, and Chairwoman, Subcommittee on Emerging
Threats, Cybersecurity, and Science and Technology............. 1
The Honorable Daniel E. Lungren, a Representative in Congress
From the State of California, and Ranking Member, Subcommittee
on Emerging Threats, Cybersecurity, and Science and Technology. 4
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Chairman, Committee on
Homeland Security.............................................. 6
Witnesses
Ms. Rita M. Glavin, Acting Assistant Attorney General, Criminal
Division, Department of Justice:
Oral Statement................................................. 7
Prepared Statement............................................. 9
Mr. Robert Russo, Director, Payment Card Industry Data Security
Standards Council:
Oral Statement................................................. 24
Prepared Statement............................................. 26
Mr. W. Joseph Majka, Head of Fraud Control and Investigations,
Global Enterprise Risk, Visa, Inc.:
Oral Statement................................................. 30
Prepared Statement............................................. 32
Mr. Michael Jones, Senior Vice President and Chief Information
Officer, Michaels Stores, Inc.:
Oral Statement................................................. 35
Prepared Statement............................................. 37
Mr. David Hogan, Senior Vice President, Retail Operations, and
Chief Information Officer, National Retail Federation:
Oral Statement................................................. 40
Prepared Statement............................................. 42
For The Record
Submitted for the Record by Chairwoman Yvette D. Clarke:
Statement of Andrew R. Cochran, Founder and Co-editor, The
Counterterrorism Blog........................................ 18
Statement of Kirsten Trusko, on Behalf of the Network Branded
Prepaid Card Association..................................... 20
Appendix
Questions Submitted by Chairwoman Yvette D. Clarke............... 51
DO THE PAYMENT CARD INDUSTRY DATA STANDARDS REDUCE CYBERCRIME?
----------
Tuesday, March 31, 2009
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Emerging Threats, Cybersecurity, and
Science and Technology,
Washington, DC.
The subcommittee met, pursuant to call, at 2:11 p.m., in
Room 311, Cannon House Office Building, Hon. Yvette D. Clarke
[Chairwoman of the subcommittee], presiding.
Present: Representatives Clarke, Richardson, Lujan,
Thompson [ex officio], and Lungren.
Ms. Clarke. The subcommittee will come to order. The
subcommittee is meeting today to receive testimony on whether
the payment card industry data standards reduce cybercrime.
Good afternoon. In recent years, a number of well-known
companies have experienced massive data breaches in their
internal computer networks, resulting in the compromise of
sensitive customer data. The criminals who perpetrated these
intrusions targeted the credit and debit card account
information held by merchants or third-party data processors as
the result of retail transactions.
With a thriving black market that rapidly packages and
sells stolen cardholder data, the information compromised
during these breaches may ultimately aid a number of criminal
organizations. We know that some percentage of the fraudulent
charges and illicit businesses from these activities is used to
fund terrorist activity throughout the world.
In his 2002 autobiography, the Bali nightclub bomber
specifically referred to on-line credit card fraud and carding
as a means to fund terrorist activities and encouraged his
followers to use this method to obtain financing.
More recently, a British case involving three jihadis,
alleged that the men used stolen credit card numbers obtained
through fishing scams and Trojan horses to make more than 3.5
million in fraudulent charges. The jihadis reportedly used the
numbers at hundreds of on-line stores to purchase equipment and
other items, including prepaid cell phones and airline tickets,
in order to aid jihadi groups in the field.
The subcommittee is holding this hearing today to voice our
concern about the growing number of data breaches and to
understand what is being done to curb this activity and to
suggest that both merchants and the pay card industry have
significant work ahead to meet our expectations. The payment
card industry--Visa, MasterCard, Discover, American Express,
and JCB--requires every business that stores, processes, or
transmits computer data to comply with specific data security
standards. The intent of these standards is to reduce the
likelihood of successful data security breaches. On an annual
basis, these merchants must certify that they are compliant
with the payment card industry data security standards known as
PCI standards.
The PCI standards contain a number of security controls
that businesses must implement. The PCI standards allow smaller
businesses to self-certify compliance, while larger merchants
must be validated by a qualified security assessor. Enforcement
comes through the card companies themselves who can levy fines
and/or prohibit noncompliant merchants from using their
services.
To be clear, the PCI standards are not Government
regulations and are not enforced by the Government. This
committee supports industry-created and -managed security
standards as long as they are strong and effective.
In light of the rising number of publicly reported data
breaches, Chairman Thompson launched an investigation to
determine whether the PCI standards have been effective in
reducing cybercrime. The results of this investigation suggest
that the PCI standards are of questionable strength and
effectiveness.
The effort to become PCI-compliant is a daunting challenge
for merchants whose core competency is the selling of
merchandise rather than expertise in security. The cost for the
largest merchants can be as high as $18 million a year. Many
believe that if they complete this arduous task, they will be
rewarded with a secure system. But the committee's
investigation confirms what many analysts have known for years.
In the words of one credit card company, full compliance with
the PCI standard does not guarantee that the merchant or vendor
will not be the victim of a data breach.
Take last year's data breach of Hannaford Brothers Company,
for example. Hackers installed malicious code on servers to
every one of the grocery stores in the Hannaford chain. The
malware intercepted the data stored on the magnetic stripe of
payment cards as customers used them at the checkout counter.
Hannaford received certification that they were PCI-compliant
on February 28, 2008. But on February 27, 2008, according to
the documents obtained by the committee, Hannaford was notified
that a number of the credit card numbers from its network were
stolen and being used on the black market. In other words,
Hannaford was being certified as PCI-compliant while an illegal
intrusion into its network was in progress.
I do not believe that PCI standards are worthless. In the
absence of other requirements they do serve some purpose, but I
do want to dispel the myth, once and for all, that PCI
compliance is enough to keep a company secure. It is not. The
credit card companies acknowledge that.
The bottom line is that if we care about keeping money out
of the hands of terrorists and organized criminals, we have to
do more, and we have to do it now. Specifically, we must
improve our policies and our technology.
First, the standards have to be better because they are
inadequate to protect against the methods being used by modern
hackers and attackers. Despite what the credit card companies
say, for millions of small and large businesses out there, the
PCI standards are the ceiling and not the floor. The bar must
be raised. In this dynamic threat environment, attackers are
constantly ahead of defenders, and yet the PCI standards are
updated only by unanimous consent every 2 years.
But part of the problem is that the standards do not
require more frequent penetration testing. The only way to
reduce breaches is by continuously testing and attacking a
system through penetration testing and timely mitigation.
Second, the payment card industry and issuing banks need to
commit to investing in infrastructure upgrades here in the
United States. In a response to the committee's investigation,
one breached company noted that the effectiveness of data
security standards is inherently limited by the technology base
of U.S. credit and signature debit card processing networks.
Credit and signature debit transactions are not protected by
encrypted PINs. Implementation of encrypted PINs for all debit
and credit transactions could be useful.
Countries in Europe and Asia are deploying new technologies
like Chip and PIN to fight fraud that could lead to organized
crime and terrorism and it is working. According to the U.K.
Payments Association, 3 years after beginning the migration to
chip-card technology, losses on transactions had reduced by 67
percent, from 219 million pounds in 2004 to 73 million pounds
in 2007. However, despite card fraud dropping 32 percent
domestically between 2006 and 2007, overall counterfeit card
fraud affecting U.K. customers was up 46 percent.
Why? The cards were being used by malicious actors in
countries that had not yet implemented the technology. The
United States is being blown away by security investments
overseas and our 1950s-era system is making us a weak link in
the security chain.
Magnetic stripe-based technology is outmoded and inherently
less secure when compared to smart cards or other developing
technologies. While I am deeply concerned about our security,
the payment card industry and issuing banks should be ashamed
about the current state of play and doing everything possible
to immediately institute improvements in infrastructure.
I know that our witnesses care about keeping financial
information out of the hands of terrorists and other organized
crime elements and I know that the payment card industry cares.
I know that the merchant community cares. But the time for
waiting is over. The time for shifting risk is over. Today, the
responsibility is yours to make this situation better.
This is the first step in the committee's review of the
payment card industry's efforts, a review that I believe the
Chairman plans to continue. We look forward to hearing about
your plans to improve America's cybersecurity posture and
working with you in all the weeks and months ahead.
The Chairwoman now recognizes the Ranking Member of the
subcommittee, the gentleman from California, Mr. Lungren, for
an opening statement.
Mr. Lungren. Thank you very much, Madam Chairwoman. I want
to compliment you for scheduling this important data security
hearing. It is an issue that most people are aware of, but few
seem to understand the full extent of this threat or the
remedies required to eliminate it as much as possible.
The new Information Age created by computers, the internet,
and instant communication offers many benefits to the Nation,
particularly our economy. Transacting business on the internet
is one of the key benefits of the Information Age.
Utilizing, obviously, credit cards today is the way people
normally transact business. It is the new currency of our age.
A lot of people don't even carry cash around anymore. In fact,
sometimes you try to pay with cash and people look at you,
trying figure out what scam you have going on.
I was at one place where I actually had a 50-cent piece
that I was trying to utilize and the woman would not recognize
it as an American currency. I was trying to explain to her the
image on the surface, and she just evidently missed that
history lesson about that President.
The internet has acted as a powerful economic engine for
the U.S. economy. Unfortunately, these new business
opportunities carried via the internet have also transformed
the landscape for the criminal, making available a wider array
of new methods that identity thieves can use to access and
exploit the personal and financial information of others.
Today's skilled computer hackers are capable of
perpetrating large-scale data breaches that leave tens of
millions of individuals at risk of identity theft. I recall my
wife and I were at dinner one night, I gave the card to the
waiter. After 5 minutes, the waiter came back kind of
embarrassed and said, well, Mr. Lungren, this card doesn't seem
to be working. So I turned to my wife and said, Why don't you
give them the card? She gave them the card with the same
account. They came back later and said it is not working.
Luckily my wife had another card.
If I had been in Chicago, changing planes, and needed to
stay overnight there, I would have been up the creek without a
paddle, as we say. I went home that night, called in to the
credit card company and they informed us there had been a
credit card compromise. Our account had been compromised. They
would tell us nothing more than that. My wife went on-line to
see what our account was at that point in time. There was no
such account. It was as if it had vanished.
The point I am making is we were never notified by the
credit card company. We have a number of automatic payments
that are made against the card and we tried to track every one
of them, and missed one of them and got a notice that we had
not paid that month for something.
So we are putting a tremendous obligation on the entire
industry in this case. One is to try and secure things. The
other one is when there is a breach, what is your requirement
to notify people? Under what circumstances do you notify
people? If you are not giving that information to those of us
who are the consumer, is that information being given to law
enforcement to follow up in all circumstances? Those are just
some of the questions.
The key to this internet economic engine running smoothly
is data security. There is no doubt about it. If we are unable
to secure our on-line financial transactions from financial
criminals, even those not involved in terrorism, then our
economic growth will be jeopardized, and actually we have
fulfilled the terrorist dreams of pulling down our country
through an economic attack. Customers will reject on-line
purchases if they can't be assured that their payment card
transactions are protected. Without consumer or customer
confidence in the safety of the payment card transaction,
internet commerce would dry up and we could have problems with
people just using the card when they are actually at brick-and-
mortar stores.
We know it was a huge problem in the early days of the
internet when it was an unknown frontier. Unchecked criminal
activity will bring back those wild west days, undermine
customer confidence, and cripple internet commerce. I applaud
the payment card industry for investing their resources and
personnel to develop and promote a universal data security
standard. As was mentioned, it is voluntary. We understand
that. A lot of work has gone into it. We understand that there
is always the challenge. It is easy for those of us in
Government to say we can do a better job. Thank God we haven't
had any security breaches on the part--excuse me--I guess we
have had a couple of them here and there. All that points out
is it is a real challenge to stay ahead of the bad guys.
I mean, you have got mischievous hackers, you have got
individual criminal hackers, you have got criminal enterprise
hackers, you have got transnational organization hackers, you
have got nation-state hackers and, frankly, you have got to try
to protect against all of that.
The PCI Security Standards Council that includes all of the
major card brands has at least understood that there is a need
for a set of comprehensive requirements for enhancing payment
account security. One of the questions I would ask: Is there
any place for the retailers to be involved in discussion of
those standards and part of that? Another question I would ask
is: I know you have some flexibility within the standards as
they exist now. But is it still too much of one size fits all?
In other words, I know you have a demarcation between mom-and-
pop stores and the big retailer, but in between does it make
sense? Are the standards flexible enough to be effective on the
one hand and at the same time allow for different business
models to operate in a reasonable fashion for them?
So I realize that the first standard was developed in 2006
to improve the standard security in the payment card industry.
It has improved the situation. More needs to be done. We are
trying to identify those areas that need to be done. We have
trying to make sure all the parties are brought to bear on the
question. We are looking to see if Government regulation is
needed.
The last thing I would say is this. The challenge for us in
Government is to try to ensure that we don't interfere with the
ingenuity of the private sector in being able to put the fixes
into the security system that are necessary. If you can help us
in that regard, not only will you benefit, we will benefit as
well. Thank you very much, Madam Chairwoman.
Ms. Clarke. The Chairwoman now recognizes the Chairman of
the full committee on Homeland Security, the gentleman from
Mississippi, Mr. Thompson, for an opening statement.
Mr. Thompson. Good afternoon. Thank you, Madam Chair, for
holding this very critical hearing on the effectiveness of the
PCI standards.
From our personal computers to Government networks to our
critical infrastructure, the United States is under attack in
cyberspace. This adversary ranges in skill from unsophisticated
to highly capable, from loan hackers to organized crime and
nation-states. Their intent ranges from nuisance and disruption
to theft, espionage, and warfare. Their successes are varied.
From every hacker that we have caught and prosecuted,
thousands continue to work unabated. In December 2008, the
Center for Strategic and International Studies concluded that
the battle for cyberspace is one that we are not winning.
Willy Sutton was rumored to have said he robbed banks
because that is where the money is. In today's world of payment
card transactions, the money is now located on computer
networks. On any given day, billions of dollars float back and
forth between merchants and payment card networks which process
credit card numbers for transactions in an area that is ripe
for hackers to exploit, and they are taking advantage of
weaknesses in the system.
We are here today to learn about the private sector's
efforts to combat data breaches and cybercrime and to assess
the quality of the payment card industry data security
standards. The standards have been around for several years,
but massive on-going data breaches at some of America's largest
merchants suggest that the standards are inadequate to prevent
breaches.
The essential flaw with the PCI standards is that it allows
companies to check boxes, but not necessarily be secure.
Checking boxes makes it easier to assess compliance with the
standard, but compliance does not equal security. We have to
get beyond check-box security. It provides a false sense of
security for everyone involved, and it is ineffective in
reducing the real threats. Companies need to understand that
even if 100 percent compliance with PCI standards is achieved,
hackers will continue to develop techniques to exploit the
computer systems of companies holding cardholder data. You are
not safe unless you continually test your systems.
Today we are calling for change. I call on the payment card
industry, and the thousands of merchants and vendors who have
to comply with the standards, to rededicate themselves to the
goal of securing their networks. For the payment card industry
and the issuing banks, this is going to mean significant
investment in the infrastructure upgrades. As the Chairwoman
has pointed out, these investments are already on-going
overseas.
I am puzzled and disappointed that we are not seeing
similar upgrades here domestically, and I hope our witnesses
can explain why the card industry appears not to be moving
quickly to address these issues. I am also deeply troubled by
the testimony that suggests credit card companies are less
interested in substantially improving their product and
procedures than they are in reallocating their fraud costs. The
payment card industry's efforts to shift risk appears to have
contributed to our current state of insecurity, and I am
concerned that as long as the card industry is writing the
standards, we will never see a more secure system.
We in Congress must seriously consider whether we can
continue to rely on industry-created and -enforced standards,
particularly if they are inadequate to address the on-going
threats.
I look forward to working with my colleagues on both sides
of the aisle and across committee lines to further explore
whether Government action is necessary to protect against these
threats. One thing is certain: The current system is not
working.
Madam Chairwoman, I thank you for your work in this area,
and I look forward to the testimony of both panels.
Ms. Clarke. Thank you very much, Mr. Chairman. Other
Members of the subcommittee are reminded that under the
committee rules, opening statements may be submitted for the
record.
We are going to take a break right now for votes. They have
come up and we are scheduled for three votes, which puts us at
about 25 minutes. Well, now it is less than 25 minutes, maybe
about 15. So please excuse us as we go and recess for votes.
[Recess.]
Ms. Clarke. I welcome our only panelist on the Federal
panel, Ms. Rita Glavin, Acting Assistant Attorney General,
Criminal Division, Department of Justice. In June 2008, Ms.
Glavin joined the Criminal Division as the Acting Principal
Deputy Assistant Attorney General. Ms. Glavin began her service
to the Department in 1998 through the Department's honors
program as a trial attorney in the public integrity section
where she worked until 2003. Since 2003, Ms. Glavin has been an
assistant U.S. attorney with the United States Attorneys Office
for the Southern District of New York.
Without objection, this witness' full statement will be
inserted into the record. I now ask you to introduce yourself
and summarize your testimony for 5 minutes.
STATEMENT OF RITA M. GLAVIN, ACTING ASSISTANT ATTORNEY GENERAL,
CRIMINAL DIVISION, DEPARTMENT OF JUSTICE
Ms. Glavin. Good afternoon, Chairwoman Clarke, and thank
you for the invitation to address the subcommittee. As you
know, identity theft is not a new problem. However, in recent
years, identity thieves have begun to capitalize on a variety
of new methods to access and exploit the personal information
of others. Skilled hackers are now capable of perpetrating
large-scale data breaches that leave hundreds of thousands of
individuals and, in some cases, millions of individuals at risk
of identity theft.
The Department of Justice, along with our law enforcement
partners, has been aggressively investigating and prosecuting
these data breaches and other criminal activity associated with
them. We are committed to continuing our efforts. We have
historically had tremendous success in identifying,
investigating, and prosecuting the perpetrators of these acts.
But as always, we can and we will do more.
To that end, the continued and improving coordination with
our partners in the international community and in the private
sector will be critical to ensuring our success. We are glad to
have this opportunity to discuss these issues with your
subcommittee.
The Department has responsibility for the investigation and
prosecution of a wide range of cybercrime cases. But large-
scale breaches are of significant concern to us because their
effects can be amplified exponentially when criminals use the
internet to quickly and widely distribute vast quantities of
information stolen during these breaches.
The threat we face is wide and it is varied, ranging from
very sophisticated individual hackers to international criminal
organizations. The resulting losses, as you know, can be
devastating and the criminals perpetrating these acts may be
motivated by any number of factors, including personal
financial gain and the desire to use this illegal activity to
fund and facilitate other dangerous crimes.
The Department's benchmark prosecutions of large-scale data
breaches and the criminal activity that results from such
breaches highlight the range of our efforts that we have been
using to address the growing problem. I want to give you a
couple of examples. Most recently, the FBI announced the
results of a 2-year undercover operation that targeted members
of the on-line carding forum known as Dark Market. At its peak,
the Dark Market Web site had over 2,500 registered members
around the world. This operation has resulted in 60 arrests
worldwide and it has prevented what we estimate to be
approximately $70 million in economic loss.
In another example, in August 2008, the Department
announced the largest hacking and identity theft case ever
prosecuted, in which charges were brought against 11 members of
an international hacking ring. Now, these various defendants
who were from the United States, Estonia, the Ukraine, Peoples
Republic of China, Belarus, were charged with, among other
things, the theft and sale of more than 40 million credit and
debit card numbers obtained from various retailers.
Another example, in 2004 the U.S. Secret Service and
several components of the Justice Department coordinated the
search and arrest of more than 28 members of the Shadow Crew, a
criminal organization located in eight States in the United
States and six foreign countries. Members of the group were
later charged in a 62-count indictment with trafficking in at
least 1.5 million stolen credit and bank card numbers that
resulted in losses in excess of $4 million. The Shadow Crew Web
site was disabled, which we believe prevented hundreds of
millions of dollars in additional losses to the credit card
industry. This was known as Operation Firewall, and this early
effort paved the way for our more recent successes in this
area.
Now, while investigation and prosecution are important,
prevention and detection are key elements in the fight against
this criminal activity. Keeping credit, debit, and other
financial account information out of the hands of criminals in
the first place is an essential step in reducing the frequency
and minimizing the impact of large-scale data compromises. We
suggest that all entities that store, process, or transmit
credit, debit, and other financial account information should
take steps, including complying with the payment card industry
data security standards, to improve the security of their
computer systems and to decrease the vulnerability of the
information they handle.
Of course, even 100 percent compliance with the PCI DSS, if
that were achieved, it is likely that hackers will continue to
develop techniques to exploit the computer system of companies
holding cardholder data. For instance, in those instances where
the hackers have succeeded, efforts by the Department and
efforts by investigative agencies to look into and prosecute
and punish those hackers and carders have been critical to
deterring future criminals.
For us to have continued success on this front, it is
imperative that, No. 1, victim companies embrace new measures
to swiftly detect data breaches and system compromises. No. 2,
that the victim companies immediately and consistently report
detected data breaches to law enforcement. Finally, that the
United States builds on its existing relationships with our
international partners to strengthen law enforcement
cooperation channels internationally. Thank you.
Ms. Chairwoman, I am prepared to answer your questions.
Ms. Clarke. I thank you for your testimony.
[The statement of Ms. Glavin follows:]
Prepared Statement of Rita M. Glavin
March 31, 2009
Good morning, Chairwoman Clarke and Ranking Member Lungren. Thank
you for your invitation to address the committee. The Department of
Justice welcomes this opportunity to testify about our commitment to
combating large-scale data breaches and the payment card fraud that
results from such breaches.
As you know, identity theft is not a new problem. However, in
recent years, the information age has transformed the landscape in
which criminals operate, making available a wide array of new methods
that identity thieves can use to access and exploit the personal
information of others. Criminals have capitalized on these new and far-
ranging opportunities. Skilled hackers are now capable of perpetrating
large-scale data breaches that leave hundreds of thousands--and in many
cases, tens of millions--of individuals at risk of identity theft.
Today's criminals now have the opportunity to remotely access the
computer systems of Government agencies, universities, merchants,
financial institutions, credit card companies, and data processors, to
steal large volumes of personal information, including individuals'
financial information, made available simply by virtue of everyday acts
like making credit and debit card retail transactions. Reflecting this
trend, there are currently over 2,000 active cases related to identity
theft pending in the U.S. Attorney's Offices (USAOs), and there has
been a 138.2% increase in identity theft convictions by USAOs between
fiscal year 2004 and fiscal year 2008. The Department of Justice,
through its Criminal Division, the Federal Bureau of Investigation
(FBI), the USAOs, and other components, along with our partners at the
U.S. Secret Service (USSS) and the U.S. Postal Inspection Service, has
been aggressively investigating and prosecuting these data breaches and
other criminal activity associated with them, and we are committed to
continuing our efforts. Historically, the Department has had tremendous
success in identifying, investigating, and prosecuting the perpetrators
of these acts. But as always, we can and will do more. To that end, the
continued and improved coordination with our partners in the
international community and the private sector will be critical to
ensuring our success, and we are glad to have this opportunity to
discuss these issues in particular with you.
the ``carder'' threat
The Department has responsibility for the investigation and
prosecution of a wide range of cyber crime cases, but large-scale
breaches are of significant concern to us because their fallout can be
amplified exponentially when criminals harness the power of the
internet to quickly and widely distribute for future fraudulent use the
vast quantities of information stolen during these breaches. For
example, international organized crime is currently one of the fastest-
growing threats in the computer intrusion arena, and these groups--who
are continuing to expand and become more sophisticated--along with
hosts of other cyber criminals, have made large-scale data breaches one
powerful part of their profile.
Through activity known as ``carding,'' large volumes of data are
stolen, resold, and ultimately used by criminals to commit fraud. In
recent years, the problem of ``carding'' has grown. ``Carding'' means
not only the unauthorized use of credit and debit card account
information to fraudulently purchase goods and services, but also a
growing assortment of related activities including computer hacking,
phishing, cashing out stolen account numbers, re-shipping schemes, and
internet auction fraud. I will describe some of these schemes in more
detail in a moment.
The internet provides a unique venue in which ``carders'' can
advertise and sell stolen data to the highest bidder and self-organize
to facilitate their activities. For example, carders often become
members of Web site forums designed to provide an active marketplace
for the sale of, among other contraband, stolen credit and debit card
numbers; compromised personally-identifiable information, including an
individual's address, phone number, social security number, personal
identification numbers (PINs), credit history report, and mother's
maiden name; and false identification documents.
Once stolen identity information is sold, the purchasers frequently
engage in fraudulent activity including, among other things, the use of
stolen credit card information to make purchases on-line and in person,
and ``cashing,'' which refers to the act of obtaining money--rather
than retail goods and services--with the unauthorized use of stolen
financial information. In recent years, criminal carding organizations
engaged in what is known as ``PIN cashing'' have developed
sophisticated ``cash-out networks'' in which stolen financial
information is immediately disseminated to designated groups of
criminals who withdraw money from ATMs all over the world within a
short time period. In one example, PIN cashers made 9,000 withdrawals
worldwide totaling $5 million in less than 48 hours from four
compromised prepaid debit card accounts.
the link between carding and other crimes
In addition to the financial fraud perpetrated by carders, the
Department focuses on criminals who engage in carding activities with a
motivation other than personal financial gain. We know, for example,
that drug traffickers engage in identity theft for the purpose of
financing their activities.
Similarly, there is a well-documented connection between identity
theft--in particular as it relates to obtaining fraudulent
identification documents, but also as it may relate to credit card
fraud--and terrorism. As one example, a convicted terrorist in
Indonesia, Imam Samudra, wrote about the use of credit card fraud and
carding as a means to fund terrorist activities in his 280-page
autobiography. Samudra sought to fund the 2002 Bali nightclub bombings,
of which he was convicted, in part through on-line credit card fraud.
Also illustrative of the connection between terrorism and credit
card fraud, three British men were convicted in 2007 of inciting
terrorist murder via the internet under the United Kingdom's Terrorism
Act of 2000. Younes Tsouli, Waseem Mughal, and Tariq Al-Daour were
participants in a network of extremist Web sites and communication
forums through which al Qaeda statements were issued and which
disseminated videos of beheadings, suicide bombings in Iraq, and other
jihadi propaganda. The three men also pleaded guilty to conspiracy to
defraud banks and credit card companies. Tsouli was sentenced to 16
years in prison, Mughal was sentenced to 12 years in prison, and Al
Daour was sentenced to 10 years in prison. Al-Daour and his associates
used stolen credit card numbers obtained through phishing scams to make
more than $3.5 million in fraudulent charges in order to purchase
equipment, prepaid cell phones, airline tickets, and other items, to
support jihadi groups in the field. Tsouli and Mughal also used stolen
credit card numbers to set up and host jihadi Web sites. Significantly,
the investigation revealed that these individuals were members of
carding organizations.
the department's investigations and prosecutions
The Department of Justice plays a critical role in combating
payment card breaches and the fraud and other criminal activity that
results. United States Attorney's offices throughout the country
actively prosecute these cases. Within the Criminal Division, the
Computer Crime and Intellectual Property Section (CCIPS) also
investigates and prosecutes large-scale data breaches and coordinates
prosecutions that involve multiple USAOs and foreign countries. In
addition, the Fraud Section of the Criminal Division recently
established the Payments Fraud Working Group (PFWG), which it co-chairs
with the Board of Governors of the Federal Reserve System. The PFWG is
an inter-agency cooperative effort between law enforcement and the bank
regulatory agencies designed to examine issues related to various
payments systems and establish initiatives to protect payments systems
against fraud and other misuse. The Department also helped to lead the
Identity Theft Task Force, which also addressed many of these issues.
Finally, the Office of International Affairs in the Criminal Division
supports international cooperation efforts by implementing mutual legal
assistance treaties (MLATs) and international conventions that have
yielded significant evidence for use in U.S. and foreign prosecutions
and by marshaling efforts to extradite international fugitives.
The combined force of all of these efforts, along with the efforts
of the FBI and the Department's other law enforcement partners, has
resulted in a number of benchmark prosecutions that highlight the range
of the Department's efforts to address the growing problem of large-
scale data breaches and associated criminal activity.
Recent Successes
The Department, in coordination with its various USAOs, has worked
with investigative agencies including the USSS, the FBI, and the United
States Postal Inspection Service to combat carding and associated
crimes, with great success:
Dark Market carding forum.--Most recently, on October 16,
2008, the FBI announced the results of a 2-year undercover
operation, conducted in conjunction with CCIPS, targeting
members of the on-line carding forum known as Dark Market. At
its peak, the Dark Market Web site had over 2,500 registered
members around the world. This operation has resulted in 60
arrests worldwide and prevented an estimated $70 million in
economic loss.
International hacking ring.--In August 2008, the Department
announced the largest hacking and identity theft case ever
prosecuted, in which charges were brought by the USAOs in the
District of Massachusetts, the Southern District of California,
and the Eastern District of New York against 11 members of an
international hacking ring, including Maksik, discussed later.
The various defendants--who were from the United States,
Estonia, Ukraine, the People's Republic of China, and Belarus--
were charged with, among other things, the theft and sale of
more than 40 million credit and debit card numbers obtained
from various retailers including TJX Companies, BJ's Wholesale
Club, OfficeMax, Boston Market, Barnes & Noble, Sports
Authority, Forever 21, Dave & Buster's, and DSW.
Operation CardKeeper.--Operation CardKeeper, led by the FBI
and the USAO for the Eastern District of Virginia, resulted in
the arrests of 13 individuals in Poland and eight in the United
States. International cooperation was required to execute
search warrants in the United States and in Romania.
Significantly, Operation CardKeeper resulted in the U.S.
conviction of an individual known on-line as ``John
Dillinger.'' This defendant was sentenced in 2007 to 94 months
in Federal prison for his carding activity, including
aggravated identity theft, access device fraud, and conspiracy
to commit bank fraud. Computers seized from him revealed more
than 4,300 compromised account numbers and full identity
information for over 1,600 individual victims.
``Iceman''.--In late 2007, a major supplier of tens of
thousands of credit card accounts to carding forums was
indicted for wire fraud and identity fraud; he is currently
awaiting trial. Max Ray Butler, known on-line as ``Iceman,''
was the co-founder and administrator of the carding forum
Cardersmarket. This case is being prosecuted by the United
States Attorney's Office for the Western District of
Pennsylvania.
``Maksik'' and ``Lord Kaisersose''.--Maksym Yastremskiy,
known on-line as ``Maksik,'' believed to be one of the top
traffickers in stolen account information, was arrested for his
carding activity in Turkey in 2007. He was also indicted in
several U.S. districts as the result of the Department's
prosecution of the international hacking ring I discussed
earlier. Maksik allegedly sold hundreds of thousands of credit
and debit card numbers. One of his customers, an infamous
carder known on-line as ``Lord Kaisersose,'' was previously
searched and arrested in France as the result of a joint
investigation conducted by the USSS and the French National
Police. He is currently awaiting sentencing.
``Operation Firewall''
Much of this successful investigative work has its roots in some of
the Department's early efforts to dismantle highly-organized carding
enterprises. As just one example, in 2004, as part of an undercover
investigation known as Operation Firewall, the U.S. Secret Service
(USSS) and several components of the Department of Justice coordinated
the search and arrest of more than 28 members of the ``Shadowcrew''
criminal organization, located in eight States in the United States and
six foreign countries. Members of the group were later charged in a 62-
count indictment with trafficking in at least 1.5 million stolen credit
and bank card numbers that resulted in losses in excess of $4 million.
As part of this takedown, the USSS disabled the Shadowcrew Web site. We
believe that had the organization not been interrupted, the credit card
industry could have faced hundreds of millions of dollars in additional
losses. Instead, the Shadowcrew criminal organization's activity
stopped, and to date, with the exception of two fugitives, all of the
domestic Shadowcrew defendants have pleaded guilty and received
sentences of up to 90 months in prison. This prosecution was the first
of its kind--by prosecuting top-tier members of the organization for
conspiracy, it held individuals responsible for the criminal offenses
facilitated through the carding forum by virtue of their leadership
role in a criminal organization that operated solely on-line. Operation
Firewall enabled many of our more recent successes. In addition, the
investigation into the Shadowcrew organization also revealed that the
defendants were conspiring internationally to commit specific carding-
related crimes, including bank fraud, and enabled us to successfully
prosecute individuals for that conduct separately.
Operation Firewall, like many of the examples I have mentioned
today, also illustrates how we can effectively respond to the
increasingly global nature of carding organizations. With the
cooperation of law enforcement agencies in the United Kingdom, Canada,
Bulgaria, Belarus, Poland, Sweden, the Netherlands, and Ukraine,
foreign searches and arrests went smoothly, and foreign individuals
were successfully indicted in the United States. In addition, the
United Kingdom pursued a separate domestic prosecution of Shadowcrew
members, which has led to a number of guilty pleas.
prevention, detection, and response
Keeping credit, debit, and other financial account information out
of the hands of criminals in the first place is an essential first step
in reducing the frequency, and minimizing the impact, of large-scale
data compromises. Merchants and processors who hold individuals'
sensitive financial information are prime targets for hackers and
carders. To address this vulnerability, the credit card associations
developed a set of security standards, known as the Payment Card
Industry Data Security Standards (PCI DSS), for merchants and third-
party processors. We suggest that all entities that store, process, or
transmit credit, debit, and other financial account information should
ensure that they comply with all requirements of the PCI DSS in order
to improve the security of their computer systems.
As is well understood throughout the security community, however,
perfect security is impossible. Therefore, even if 100% compliance with
PCI DSS were achieved, it is likely that hackers will continue to
develop techniques to exploit the computer systems of companies holding
cardholder data. For instances in which those hackers succeed, efforts
by the Department and investigative agencies to investigate, prosecute,
and punish hackers and carders are critical to deterring future
carders, learning more about the nature of these crimes, and punishing
offenders. For continued success on these fronts, it is imperative
that: (1) Victim companies embrace measures to swiftly detect data
breaches and system compromises; (2) victim companies report data
breaches to law enforcement; and (3) the United States builds upon its
existing relationships with international partners to strengthen law
enforcement cooperation channels internationally.
Early Detection
Early detection plays two important roles in efforts to combat
carding activity. First, it can assist in mitigation of potential
damage. When victim companies are notified by law enforcement, credit
card companies, or other entities about a potential compromise to their
system, they should take all reasonable measures to determine whether a
compromise did indeed occur. Successful detection empowers victim
companies to take steps to address the vulnerability, fortify their
systems, and notify individual victims as necessary. But to date, it
has been our experience that following notification, victim companies
can not and do not always do enough to determine the scope and severity
of data breaches of their computer networks.
Moreover, law enforcement faces continued investigative challenges
as a result of delayed detection and response. Often, victim companies
detect compromises to their system weeks, months, or years after they
occur, and as a result, meaningful investigative leads may have
disappeared by the time the compromise is reported to law enforcement,
if it is reported at all. Private entities must have the capabilities
to identify compromises more quickly. To accomplish this, we recommend
that all entities that store, process, or transmit credit, debit, and
other financial account information implement security mechanisms
designed to detect system breaches, such as tracking and monitoring all
access to network resources and cardholder data.
Breach Reporting
Immediate reporting of incidents to law enforcement is also vital
to law enforcement's ability to investigate large-scale data breaches.
Immediate reporting necessarily relies upon each potential victim
company's capacity to promptly detect an incident, but we know from
experience that prompt detection will not itself result in a report
from the victim company. For a variety of reasons, data breaches are
significantly underreported, and as a result, law enforcement efforts
to bring criminals to justice are significantly hampered. If law
enforcement never learns of the incident, we will not investigate it;
if we hear about it too late, we may be unable to preserve critical
evidence or identify the perpetrators. On the other hand, several
recent successes in tracking down the perpetrators of high-profile data
breaches are the direct result of immediate information from victim
companies on how the hackers entered and exited their systems,
including the specific IP addresses used in the attack. For example, in
the Dave & Busters case, which was a part of the international hacking
ring prosecuted in 2008, when Dave & Busters became aware of
intrusions, they took measures to log access to their computers, block
the intruder's further attempts to collect credit and debit card data,
and identify for law enforcement the intruder's IP address.
While companies like VISA require by policy that all entities that
suspect or have confirmed that a security breach occurred must contact
Federal law enforcement, few laws require the victim company to notify
law enforcement. In its April 2007 Strategic Plan, the Identity Theft
Task Force recommended the establishment of a national standard
requiring entities that maintain sensitive data to provide timely
notice to law enforcement in the event of a breach. Because only a
handful of State laws currently require reporting to law enforcement
and because private sector rules are neither universal nor consistently
enforced across the various companies, we urge Congress to consider
requiring security breach reports to Federal law enforcement using a
mechanism that ensures that the USSS and FBI have access to the
reports.
International Law Enforcement Cooperation
As illustrated by the array of cases I have mentioned, carders
operating in carding forums on the internet reside in different
countries, collaborate freely across borders, and can immediately and
widely distribute stolen identity information around the globe. In
addition, on-line carding forums provide networking opportunities for
criminals interested in joining together to perpetrate other financial
fraud or criminal activity on a global scale. As a result, coordination
and cooperation from foreign law enforcement is vital to the success of
carding investigations and prosecutions. In this regard, the Identity
Theft Task Force's Strategic Plan also recommended that the Department
of Justice and other departments and agencies take specific steps to
improve coordination and evidence sharing with foreign law enforcement
agencies.
We believe that on this front, the United States should continue to
press other nations to accede to the Convention on Cybercrime (2001),
which will improve cooperation between law enforcement agencies. The
Convention, which the United States ratified in 2006, assures that
other countries enact suitable domestic legislation criminalizing
identity theft, in part to facilitate information-sharing under MLATs
and the extradition of criminal defendants. In addition, the United
States should continue to work closely with multilateral organizations
to urge other countries to review their criminal codes and criminalize
identity-related criminal activities where appropriate. This has
historically proven effective. Last month, for example, the G-8 Roma/
Lyon Group approved for further dissemination a paper that examines the
criminal misuse of identification information and identification
documents within the G-8 States and proposes ``essential elements'' of
criminal legislation to address identity-related crime. The Identity
Theft Task Force's Strategic Plan also directs the U.S. Government to
identify countries that are safe havens for identity thieves and to use
appropriate diplomatic and enforcement mechanisms to encourage those
countries to change their practices. The Department of Justice has
begun this process, gathering information from a range of law
enforcement authorities. Finally, only by assisting foreign authorities
can we expect them to reciprocate with critical evidence for our own
investigations. The United States can improve international
cooperation, in certain cases, by ensuring that our legislation
provides U.S. authorities with the tools to assist foreign
investigations effectively.
conclusion
As I have attempted to outline for the subcommittee, the Department
has been at the forefront of groundbreaking and historic efforts to
identify, prosecute, and punish the perpetrators of large-scale data
breaches and the associated identity theft and fraud following from
those breaches. In light of the growing sophistication and global scope
of the threat, we are committed to continuing and improving our efforts
to address this conduct. Thank you for the opportunity to provide the
subcommittee with a brief overview of the Department's role in
combating these crimes and the primary issues we must focus on as we
press ahead.
Madam Chairwoman, this concludes my remarks. I would be pleased to
answer any questions that you or other Members of the subcommittee may
have.
Ms. Clarke. I will remind each Member that he or she will
have 5 minutes to question the panel. I will now recognize
myself for questions.
Are we seeing more massive data breaches today, or is the
media simply reporting more?
Ms. Glavin. I think you have a little bit of both. The
media is reporting on it, but what we have seen over the last
several years and in some of the operations specifically I have
referred to in our testimony, including the Shadow Crew
organization, is hundreds of thousands, if not millions, of
personal financial information and identity thefts occurring.
The Operation Firewall, which was both the Shadow Crew
organization and the Carder Market Forum, should demonstrate
that for a number of years this type of data breach has been
happening and that there are hackers all over the world that
are looking to get into systems and slowly take the information
out. It can be over a course of months, if not over a course of
years.
So, yes, the data breaches are occurring and we know that
because of undercover operations we have done and because of
the publicly reported takedowns that we have done that I
mentioned in my testimony. Yes, the media is reporting on those
breaches.
Ms. Clarke. Ms. Glavin, to what extent does the fact that a
company is PCI-compliant help to mitigate criminal activity?
How effective are PCI standards in lowering the risk of being
breached?
Ms. Glavin. Having any security system and uniform
standards are going to help, all right? It is a floor, and it
is a way to begin the process of preventing breaches. That
said, what we look at in terms of those PCI set standards is
you have got to do continual monitoring and you have to do the
testing, because you may have adopted those standards, but
people may already be in your computer system by the time you
have adopted those standards. It is the monitoring and the
testing that is going to help companies see where they have
been breached. We know that hackers are always coming up with
new ways to get into your system. So it is going to be the
monitoring and the testing.
The second thing that the Department would suggest is that
there should be notification through Federal law enforcement
when breaches occur. I know is that something that has been
under subject of much discussion. But that would be an
effective way of dealing with the data breaches on a number of
levels, because we have a sense from our investigations and
prosecutions around the country as to the means that the
hackers used to do this. If we get early reporting, it helps us
get a sense of what is going on such that we can stop it. We
can stamp out, you know, Web sites that are doing this and help
get in front of the problem.
Ms. Clarke. Ms. Glavin, how successful do you think that
the Department of Justice's efforts to combat credit card fraud
will be in the long run if neither improved standards nor
technology and infrastructure changes are realized and there is
no reduction in the amount of cardholder data being lost or
stolen?
Ms. Glavin. This is going to have to be an on-going
partnership. Law enforcement has been there and we are always
going to be there. It is not just within the prosecution of the
Department of Justice. The FBI is always looking at this. The
Secret Service is always looking at this. We are working with
our international partners around the world to have an
international presence such that we are sharing information. We
can't do that alone, and having help from private industry when
they know there have been breaches and reporting that to us, it
is going to help everybody in the long run.
So we can do what we do in terms of watching the
technology, trying to stay on top of the hackers, continually
looking out for these Web sites and carding forums. But we
can't do everything alone. To the extent we get help from the
private sector to stay on top of that, that is important. I
think that the industry that has adopted the PCI DDS, that is a
laudable effort. The question is: Can they continue to evolve
from there?
Ms. Clarke. Just finally, can you please explain the roles
of the Secret Service, FBI, and ICE in investigating
cybercrime, and what are the distinctions between those
investigative units?
Ms. Glavin. Sure. The Secret Service has always been
involved in looking at financial crimes and hackers. What the
FBI brings to the table in addition to the Secret Service is
that they have your counter-intelligence databases, which the
Secret Service may not have. So they can be also checking, on a
much more international level, what is going on around the
world. They also have a presence through their legal attaches
in other countries. So the Secret Service and the FBI both play
critical roles and they both bring different tools to the law
enforcement effort.
Ms. Clarke. Well, thank you very much. I now recognize one
of our new Members on the committee, new Member to the
Congress, the gentleman from New Mexico, Mr. Lujan, for his
questions at this time.
Mr. Lujan. Thank you very much, Madam Chairwoman. Ms.
Glavin, thank you very much for being with us today.
Ms. Glavin. Thank you.
Mr. Lujan. In your testimony you highlight many instances
where there are projects or programs, recent success,
investigations that the Department of Justice has engaged in,
Dark Market carding forum, international hacking ring,
Operation Card Keeper, Iceman, Operation Firewall.
With that being said and with the level of concern that the
Department of Justice has with the level of crime that is
taking place, in this case cybercrime, what standards exist
today for keeping this data secure?
Ms. Glavin. In terms of private industry, the standards
that are out there are the PCI DSS, plus whatever State laws
there are. I mean, a number of States have consumer
notification laws that require financial entities to report
data breaches. Some have law enforcement notification laws.
In terms of Federal regulation, there is not a lot, other
than you are speaking to someone from the Criminal Division,
and I know we have the Title 18 criminal statutes that we use
to prosecute. But in terms of standards across the industry
Federally, such that people are required by law to comply with
a certain set of standards, that is not out there.
Mr. Lujan. So it sounds like what States have done, they
have a reporting mechanism that when there is a breach in
security and data is compromised, that they are required to
notify the consumer that may have been impacted. But with that
being said, in your opinion, are these standards working the
way they are being put together today?
Ms. Glavin. Which industries?
Mr. Lujan. The industry standards.
Ms. Glavin. In terms of whether or not they are working, we
know what reports we get when there has been data breaches and
when industry chooses to tell us; or sometimes we learn about
it from our own investigations and we choose to tell them.
Whether or not they are working, I think the industry
representatives are in the best position to tell you that.
What I can say from the Department's perspective is that if
we are going to do criminal investigations, there is going to
have to be some cooperation between us and private industry so
we can do those investigations, get a sense of the data
breaches and to have cooperation such that they let us know
what is going on.
We have a sense of how it happened, what is out there, and
who may be responsible. As for whether or not they are working,
I think they are a great bottom line to start with. But you
have to be constantly watching, testing them, checking them to
make sure they work, because the hackers are sophisticated
people and they try to stay one step ahead of the industry. The
industry tries to get one step ahead of them, and it is in
everyone's interest that you keep moving ahead.
Mr. Lujan. Ms. Glavin, did I hear you correctly? Did you
say that sometimes the Department of Justice will notify the
companies that there has been a breach, as opposed to the other
way?
Ms. Glavin. Yes. But sometimes that can happen--you know,
if we get information that they may not have, that we may have
access to through the course of our criminal investigations. It
could be a company that may be PCI-compliant, but there was
always something in the system before they got brought up to
compliance.
But, yes, there have been instances that I know of,
investigations where we have learned about information and that
we have informed the company about, that you may want to check
X, Y, and Z.
Mr. Lujan. Thank you very much, Ms. Glavin.
Madam Chairwoman, I know we had a lot of briefings and
discussions with the committee as a whole and the various
subcommittees on the importance and attention that is needed
when it comes to data breaches, especially with the attacks
that we know that are occurring on a regular basis, national
security, as well as financial institutions.
I think that in the same regard, when we are talking about
what the expectations are of the American public with feeling
secure about the data that could exploit them and expose them
to these types of crime, often times without them ever knowing,
is something that we have to take seriously.
So I thank you very much, Madam Chairwoman and Chairman
Thompson, for bringing this to the attention and allowing us to
have a hearing on this today.
Ms. Clarke. Thank you very much, my colleague. I just want
to correct the record, at least vocally, that my colleague's
name is Mr. Lujan.
Mr. Lujan. Thank you very much.
Ms. Clarke. Very well. Some of your responses to my
colleague's questions were a bit troubling to me. The fact that
it could take some time before there is communication around a
vulnerability that is existing within the system, and in that
amount of time transactions can take place that can lead to
financial support for criminal endeavors is something we should
always be concerned about. Time is of the essence, right? If
you are not getting the level of transparency, for whatever
reasons, from the private side--in other words, maybe someone
is ashamed that they met these PCI standards and now they have
found a vulnerability. As you said, it couldn't have been one
that existed there prior to them coming up to code. It is still
important for that information to be shared, notwithstanding
whatever reasons may inhibit someone from doing so. Because,
again, these transactions take place so quickly.
What would you say could expedite the transfers of
information? What do you think would open up private enterprise
to really working with law enforcement on a much more timely
basis, once something is detected, to address it? Do you think
that perhaps some introspection about the PCI standards would
help put them on a higher platform for detection?
Ms. Glavin. The PCI DSS standards--again, as I said before,
I think one of the key components of those standards is going
to be the regularly monitoring and testing. Sometimes these
breaches aren't readily apparent and are hard to detect.
As I have had it described to me, the breaches can
sometimes occur such that the best analogy could be that the
front door of your house gets open and you don't know it.
Slowly over a period of time, someone may take, piece by piece,
all of your house. It could happen over a course of months, and
an entity may not be aware of it.
So immediate notification could be hard in that type of
instance. But regularly monitoring and testing, we hope, would
be a way that they detect it sooner.
In terms of the information sharing, we support an effort
such that there be some type of notification to Federal law
enforcement. How that is done and what particular entity that
is reported to is something that we are happy to work with this
committee on, such that it can happen faster and it gets to the
law enforcement entities that have been in the forefront of
this, such as the FBI and the Secret Service. But it is
immediate notification when you see the data breach. Yes, that
is something that we would like. But sometimes it is not always
easy that you are going to find that data breach right away.
Ms. Clarke. Ms. Glavin, I want to thank you for sharing
with us your perspective on the PCI standards and the payment
card industry and its relationship to cybercrime. I want to
thank you for sharing your expertise with us. We look forward
to working with you further as we look for ways to strengthen
this part of our concern with regards to the threats that
exist, the vulnerabilities that may exist within the payment
card industry. Thank you very much.
Ms. Glavin. Chairwoman Clarke, thank you very much. We look
forward to working with you.
Ms. Clarke. Thank you. I would like to acknowledge the
work, Ms. Glavin, of your senior counsel, Kim----
Ms. Glavin. Kim Paretti.
Ms. Clarke [continuing]. Kim Paretti in this field, and I
would like to thank her and her colleagues for their service.
Ms. Glavin. They have done excellent work.
Ms. Clarke. We appreciate it.
The Members of the subcommittee may have additional
questions for the witness and we will ask you all to respond in
writing to those questions.
At this time, the first panel is dismissed and the
Chairwoman calls out the next panel.
I welcome the second panel of witnesses. Our first witness
is Robert Russo, Director of the Payment Card Industry Data
Security Standards Council. Welcome.
Our second witness is Joseph Majka, Head of Fraud Control
and Investigation, Global Enterprise Risk for Visa.
Our third witness is Michael Jones, Chief Information
Officer for Michaels Stores.
Our fourth witness is Dave Hogan, Senior Vice President and
Chief Information Officer for the National Retail Federation. I
thank you all for being here today.
Without objection, the witnesses' full statements of Andrew
Cochran, an expert on terrorism financing, and Kirsten Trusko
on behalf of the Network Branded Prepaid Card Association will
be inserted into the record. Hearing no objection, so ordered.
[The information follows:]
Statement for the Record Submitted by Andrew R. Cochran, Founder and
Co-editor, The Counterterrorism Blog
March 31, 2009
Chairwoman Clarke, Ranking Member Lungren, and Members of the
committee, I appreciate the opportunity to submit a written statement
on the subject of terrorists' use of credit cards for this important
hearing. I am the founder and co-editor of The Counterterrorism Blog,
the first multi-expert internet-based center dedicated solely to
reporting and analyzing terrorist attacks and counter-terrorism
policies. Now in its fifth year of operation, The Counterterrorism Blog
is a highly respected source of objective information and analysis in
the counter-terrorism community. Our Contributing Experts work in non-
governmental organizations and private businesses worldwide, and
include over 20 noted experts, including Evan Kohlmann, Douglas Farah,
Dennis Lornel, Walid Phares, Animesh Roul, Farhana Ali, and Matthew
Levitt. In addition to earning the plaudits of law enforcement,
intelligence officials, Members of Congress, and the news media, our
credibility is evidenced by the fact that al Qaeda attacked us by name
on Al-Ekhlaas, one of its central messaging forums, last April.\1\ You
can find us on the internet at http://counterterrorismblog.org/, and
you can e-mail me.
---------------------------------------------------------------------------
\1\ ``Al Qaeda Officially Hates The Counterterrorism Blog,'' April
16, 2008, at http://counterterrorismblog.org/2008/04/
al_qaeda_officially_hates_the.php.
---------------------------------------------------------------------------
Our Contributing Experts have reported often on terrorists' use of
stolen credit card information, and they speak often about the subject.
On February 29, 2008, I chaired a special panel, ``Meta-Terror:
Terrorism and the Virtual World,'' with two Contributing Experts (Evan
Kohlmann and Roderick Jones) and the senior vice president and chief
technology officer of VeriSign.\2\ During that event, our discussion
included how a senior al Qaeda operative financed operations through
the use of stolen credit card information. Dennis Lormel, who founded
and ran the Terrorist Financing Operations Section at the FBI and
investigated the financing of the
9/11 attacks, has several posts on terrorists' use of credit cards.\3\
Matthew Levitt and Contributing Expert Michael Jacobson cited the use
of credit card fraud to finance two deadly attacks in a New Republic
article this year.\4\ I invite the committee to review the cited works
in detail, and I will quote from and/or summarize their main points for
the committee's consideration as follows:
---------------------------------------------------------------------------
\2\ Complete transcript at http://counterterrorismblog.org/2008/03/
event_transcript_and_related_l.php.
\3\ ``Terrorists and Credit Card Fraud . . . a Quiet Epidemic,''
February 29, 2009, at http://counterterrorismblog.org/2008/02/
terrorists_and_credit_card_fra.php, and ``Credit Cards and
Terrorists,'' January 16, 2008, at http://counterterrorismblog.org/
2008/01/credit_cards_and_terrorists.php.
\4\ Summarized in ``Drug Wars,'' Michael Jacobson, January 27,
2009, at http://counterterrorismblog.org/2009/01/drug_wars.php.
---------------------------------------------------------------------------
1. Credit cards are extremely vulnerable to fraud and are used
extensively by terrorists. The internet not only serves as a
learning tool for terrorists but also functions as a mechanism
to steal credit card information through hacking, phishing, and
other means. In many instances, when terrorist operatives are
apprehended, they have multiple identifications and credit
cards in a variety of names in their possession.
2. The terrorists who executed the devastating 2004 Madrid train
bombings, which killed almost 200 people, and who carried out
the deadly July 7, 2005, attacks on the transportation system
in London were self-financed, in part through credit card
fraud.
3. Imam Samudra was a key operative of the al Qaeda-linked
terrorist group Jamaah Islamiah in Indonesia, and was the
mastermind behind the Bali nightclub bombings in 2002 which
killed over 200 people. While in prison in 2004, he wrote a
jailhouse manifesto, with a chapter, entitled ``Hacking, Why
Not.'' In it, he urged fellow Muslim radicals to take holy war
into cyberspace by attacking U.S. computers. Samudra described
America's computer network as being vulnerable to hacking,
credit card fraud, and money laundering. Samudra discussed the
process of scanning for Web sites vulnerable to hacking and
then discussed the basics of on-line credit card fraud and
money laundering. Interestingly, in 2004, Indonesian police
asserted that Indonesia had more on-line credit card fraud than
any country in the world.
4. Younes Tsouli, aka ``Terrorist 007,'' and his two associates,
Waseem Mughal and Tariq al-Daour, used computer viruses and
stolen credit card accounts to set up a network of
communication forums and Web sites that hosted everything from
tutorials on computer hacking and bomb making to videos of
beheadings and suicide bombing attacks in Iraq. They raised
funds through credit card information theft and fraud, which
were used to support the communications, propaganda, and
recruitment for terrorists worldwide, as well as to purchase
equipment for Jihadists in the field. One expert described
their activities as ``operating an on-line dating service for
al Qaeda.'' The three men pled guilty to inciting terrorist
murder via the internet.
Set forth below is a snapshot of the extent of credit card
information theft and fraud they were responsible for:
Stolen credit card numbers and identities were used to buy
Web hosting services. At least 72 stolen credit card accounts
were used to register more than 180 Web site domains at 95
different Web hosting companies in the United States and
Europe.
On one computer seized from al-Daour's apartment, some
37,000 stolen credit card numbers were found. Alongside each
credit card record was other information on the identity theft
victims, such as the account holder's address, date of birth,
credit balances, and limits.
More than $3.5 million in fraudulent charges were made using
credit card accounts stolen via on-line phishing scams and the
distribution of ``Trojan horses.''
The men purchased sophisticated equipment needed by
jihadists in the field and other operational resources,
including hundreds of prepaid cell phones, and more than 250
airline tickets using 110 different credit cards at 46 airlines
and travel agencies.
They laundered money through on-line gambling sites, using
accounts set up with stolen credit card numbers and victims'
identities. The trio conducted 350 transactions at 43 different
on-line wagering sites, using more than 130 compromised credit
card accounts.
The terrorists apparently obtained some stolen data through
contacts with Russian-based criminal gangs, and they traded this
information with criminal syndicates. In the 1990's, al Qaeda would
steal a handbag to get one credit card to raise funds. Now they will
just buy this data on-line and get thousands of credit card details.
Once credit card information winds up in the hands of criminal
syndicates, it can be easily transmitted to terrorists.
5. The Liberation Tigers of Tamil Eelam (LTTE), a.k.a. the ``Tamil
Tigers,'' use credit card fraud as an international means of
financing terrorist activities. Four men, believed to be
associated with the Tigers, were arrested this year in Toronto
on charges of debit and credit card fraud for possessing
numerous gift cards containing bank account and debit
information from individuals in the United Kingdom. Further
investigation found laptop computers and memory sticks
containing bank information for thousands of U.K. bank
customers. A massive credit and debit card fraud case in the
United Kingdom, involving up to 200 British gasoline stations,
is apparently another Tamil Tigers operation. The alleged
subjects obtained credit and debit card information at gasoline
pumps through the use of skimming machines, with the loss was
estimated to be as much as $72,000,000.
I look forward to reviewing the committee's review into the
effectiveness of the PCI standards to reduce data breaches, identity
theft, and the potential funding of terrorism, and I stand ready to
assist the committee in that mission.
______
Statement for the Record Submitted by Kirsten Trusko, on Behalf of the
Network Branded Prepaid Card Association
March 31, 2009
Chairwoman Clarke and Members of the subcommittee, I am Kirsten
Trusko, President and Executive Director of the Network Branded Prepaid
Card Association (``NBPCA'' or Association''). We are a non-profit
trade organization, which seeks to serve consumers, businesses, and
Government through unique applications of network branded prepaid
cards, and in doing so supports the growth and success of network
branded prepaid cards. We represent the common interests of the many
players in this new and rapidly growing payment category. The NBPCA's
members include banks and financial institutions, the major card
networks, processors, program managers, marketing and incentive
companies, card distributors and law firms. For additional information
about our organization, may we suggest you visit our Web site,
www.NBPCA.com. I am delighted to submit factual information that we
hope will help to address your questions on a topic that is of utmost
importance to our members: accurately understanding and mitigating the
potential risks posed by network branded prepaid cards.
This document is designed to outline the following topics, at a
high level. Should you have follow-up questions, please let us know.
1. What is a network branded prepaid card and how does it differ
from other cards?
2. Why is this card type growing and popular (including quotes from
the Federal Reserve and Office of the Comptroller)?
3. What are the facts to correct misperceptions about network
branded prepaid cards?
4. How are NBPCA's members working with legislators, regulators,
and law enforcement to mitigate the potential for misuse of the
cards?
i. what are ``network branded prepaid cards''?
We hope to clarify some misconceptions by being clear about the
facts.
First, there are many types of plastic, magnetic-striped
cards that are all called ``prepaid.'' That is, before one uses
the card to make a purchase, one must pre-pay the funds, which
are held by a bank. The cardholder uses the cards to gain
access to the funds. You cannot spend a $50 gift card, for
example, until the $50 has been paid in advance.
However, not all prepaid cards are ``network branded.''
Network branded cards (sometimes referred to as ``open loop''
or ``open system'' cards) are issued by regulated financial
institutions, carry the brand of a major card network (such as
American Express, Discover, MasterCard or Visa) on the front of
the card, and are generally \1\ usable anywhere that brand is
accepted. Some network branded prepaid cards are also usable at
ATMs to obtain cash for limited daily amounts.
---------------------------------------------------------------------------
\1\ We say ``generally'' because some network branded prepaid cards
have specialized usage which creates some limitations. For example,
``teen cards'' are designed so that they cannot be used in liquor
stores, and health cards may have restrictions to health-only merchants
and/or purchases.
---------------------------------------------------------------------------
Although many network branded prepaid cards display the word
``DEBIT'' on the front of the card, they are not ``debit
cards'' in the classic sense of the word. That is, network
branded prepaid cards are not linked to an individual's
personal checking, savings, or other bank account. Instead, the
funds are held in pooled bank accounts with data that links
each card to the cardholder's funds. This distinction enables
the under-banked population to use these cards to receive child
support, unemployment, and other funds that are essential to
daily life, transaction that are very difficult to administer
on a cash-only basis.
Network branded prepaid cards are also separate and distinct
from ``retailer gift cards'' (sometimes referred to as ``closed
loop'' cards). Retailer gift cards are not issued by a
financial institution and can only be used at one location (or
at one chain of affiliated locations). Retailer gift cards are
issued by a restaurant, store, hotel, or other retail service
provider solely for use to purchase goods or services at the
issuing retailer's establishment.
Attached to this testimony are pictures of some popular
network branded prepaid cards issued by our members.*
---------------------------------------------------------------------------
* The information referred to has been retained in committee files.
---------------------------------------------------------------------------
ii. why have network branded prepaid cards become so popular?
Network branded prepaid cards are a relatively new and growing
product, largely developed in response to market needs not being met by
other card types. They enable electronification of payments and the
supporting data trail, to capture what was previously transacted with
check or cash. They support specific applications by customer need
(e.g. the under-banked consumer as mentioned earlier) and help to
reduce costs and provide a better accounting/data trail for businesses
and Government than when using cash or checks.
The popularity of network branded prepaid cards is attributable to
their unique ability to address cardholder needs in a variety of
situations including health care, disaster relief operations, payroll,
Government benefit payments, and gifting.
The benefits that network branded prepaid cards provide was noted
in an article published by the Philadelphia Federal Reserve Bank's
Payment Card Center:
``The benefits that open-system prepaid cards offer for consumers,
providers, and issuing banks contribute to the increased adoption of
these payment applications. Consumers use these cards to pay bills,
make purchases, and access cash from ATM networks. Prepaid cards can
also be used to secure car rentals and to make hotel and air travel
reservations. At the same time, holders of prepaid cards need not
secure a traditional banking relationship nor gain approval for a
deposit account or revolving credit. Prepaid card providers may be
nonbank third parties, such as employers and payroll processing
companies, that can use prepaid cards as a means to convert paper
disbursements, such as payroll checks, benefit claims forms, travel
checks, gift certificates, and government checks, to less costly
electronic payments. Finally, bank card issuers have an opportunity to
serve a broader set of consumers. By offering prepaid cards, issuing
banks may meet the financial needs of consumers who may not otherwise
qualify for more traditional banking products, and these banks may do
so with a card-based electronic payment application that essentially
eliminates credit risk for the bank. (Cheney and Rhine, Prepaid Cards:
An Important Innovation in Financial Services, Philadelphia Federal
Reserve Bank Payment Center (Originally published in conjunction with
the American Council on Consumer Interests (ACCI) (July 2006)).''
Additionally, the Office of the Comptroller of the Currency, in a
July 2005 report, (http://www.occ.treas.gov/cdd/payrollcards.pdf)
compared the cost of network branded prepaid payroll cards versus the
alternatives available to the under-banked, noting the following
benefits:
Benefits to Employers
Reduced bank processing fees and check handling fees;
Reduced check printing costs;
Reduced likelihood of check fraud;
Reduced check reconciliation costs;
Increased employee productivity (e.g., not needing time off
during work to cash or deposit paycheck);
Reduced lost/stolen check replacement costs.
Benefits to Employees
Reduces or eliminates check cashing fees;
Offers ability to make purchases using credit card networks;
Offers 24-hour access to funds via ATMs; no need to wait in
lines;
Reduces the need to carry a lot of cash;
Makes money transfers more easily available to families;
Provides a pseudo-bank account--funds do not need to be
withdrawn entirely as with using a check casher;
Please refer to Table 5 in the OCC report as it documents
their comparison of consumer costs across Payroll card, Check
Casher, and Basic Bank account, reflecting Payroll card as the
option least costly to the consumer.
iii. misunderstandings/myths about network branded prepaid cards.
Despite the many benefits of network branded prepaid cards, aspects
of these products are misunderstood. This may be because organizations
not typically associated with financial products are sometimes involved
in the creation and distribution of network branded prepaid cards. For
example, some network branded prepaid cards are available through non-
traditional distribution channels such as supermarkets and drug stores.
Misconceptions about network branded prepaid cards, which have gained
currency through repetition, have the potential to affect the industry
negatively--particularly with respect to issues relating to money
laundering risks. My testimony today addresses several major
misconceptions by providing factual information that supports a fair
and accurate assessment of money laundering risks associated with
network branded prepaid cards. Here are some misunderstandings about
network branded prepaid cards:
Myth No. 1: Prepaid cards are unregulated or loosely regulated.--
Every network branded prepaid card (i.e., those carrying the logo of
American Express, Discover, MasterCard, or Visa) is issued by a highly
regulated financial institution or other regulated organization. As
such, network branded prepaid cards are subject to exam, review, and
oversight. For example, the FFIEC BSA/AML Bank Examination Manual (July
2006) sets forth specific requirements for examining banks regarding
their ``electronic cash'' products (which encompasses ``stored value'')
including OFAC screening, transaction testing, and monitoring for
suspicious activity. In addition, many prepaid card program managers,
distributors, and organizations that perform specific functions
relating to processing or distributing network branded prepaid cards,
are regulated by State banking departments as money transmitters or
check sellers. As such, they also are subject to exam, review, and
oversight. State regulators are increasingly requiring money
transmitters to:
(1) Register as Mobs with FinCEN,
(2) Have AML policies that address customer due diligence, OFAC
screenings, and suspicious activity monitoring, and
(3) Have independent reviews of their AML policies.
Altogether, there are over 50 laws/regulations that apply to
network branded prepaid cards. The applicability of these laws/
regulations depends on a number of factors including the charter of the
financial institution issuer.
Myth No. 2: Prepaid cards are ``ideal'' for money laundering.--
Network branded prepaid cards are actually less useful for money
laundering than many other payment products for the following reasons:
The value associated with network branded prepaid cards
issued in the United States consists of funds held in a bank
account in the United States. These funds can--at any time--be
frozen by the card issuer and/or forfeited entirely. Unlike
``bearer instruments'' or chip-based cards, where whoever holds
the product also holds the value, network branded prepaid cards
keep the value separate, making the products less attractive to
criminals.
All network branded prepaid cards are processed through an
on-line system that requires electronic authorization from the
payment network prior to completing a purchase transaction at
the point of sale or obtaining cash from an ATM.
The system enables card issuers to decline an authorization
and/or to cancel the ability to use a prepaid card. The ability
of the card issuer to terminate a card's usefulness, without
requiring possession of the card, is critical--and is a feature
not shared by most traditional payment products. The on-line
system tracks and records every use of every network branded
prepaid card. Unlike paper payment products (such as checks,
travelers checks, money orders, and cash), network branded
prepaid cards leave a traceable trail of use including place,
time, date, amount, and often the nature of the transaction.
This trail has already assisted law enforcement in tracking
illicit activity through use of prepaid cards.
If a network branded prepaid card issuer identifies unusual
or suspicious activity, the card can be blocked from further
use. Card programs routinely monitor card activity and, as
appropriate, file suspicious activity reports (SARs) or notify
law enforcement.
Myth No. 3: Network branded prepaid cards can be both anonymous and
permit ATM access, with liberal load limits or no limits on the amount
of cash that can be accessed.--Today, ``anonymous'' (meaning that no
identifying information is obtained from the purchaser and verified)
network branded prepaid cards are limited to the gift or reward card
category (although many network branded gift/reward cardholders are
identified and verified as well). Such anonymous gift/reward cards have
significant restrictions that minimize risk of misuse such as a
relatively low maximum dollar value, no ability to access cash through
ATMs, and no ability to load additional funds after the initial funds
are depleted. In addition, some issuers restrict usage of anonymous
cards to the United States.
Myth No. 4: Prepaid card issuers do not require Customer
Identification Programs (CIP) nor OFAC screening for individual prepaid
cardholders.--Reloadable, cash-accessible network branded prepaid cards
are not available anonymously. Issuers routinely subject individuals
purchasing such cards to CIP and OFAC screening, to the same extent as
is required for financial institutions opening ``accounts'' under the
Bank Secrecy Act. These verification and screening procedures are
identical to those conducted when any on-line bank account is opened.
Myth No. 5: A consumer can use cash to purchase a high-value,
reloadable network branded prepaid card from a j-hook and use it
anonymously.--When a consumer purchases a reloadable network branded
prepaid card from a j-hook in a retail location, a process called
``activation'' is typically required before the cardholder may use the
card for a purchase or to access cash. In other words, although the
consumer may purchase the card without identity verification, he/she
may not use the card until the identity verification process is
complete. The activation process typically involves the cardholder
telephoning the card issuing financial institution (or a specialized
organization with which the issuer has contracted) and providing
personal identification information. The financial institution then
verifies various elements of customer information including name,
address, Social Security Number, and/or date of birth using a third-
party authentication system such as Experian, Lexis-Nexis, or Equifax--
just as they would a bank account. The issuer also screens customers
against the OFAC Specially Designated Nationals list. If the cardholder
does not ``pass'' this process, the card is either not usable or not
reloadable.
iv. the nbpca's anti-money laundering recommended practices
In February 2008, the NBPCA released its ``Recommended Practices
for Anti-Money Laundering Compliance for U.S.-based Prepaid Card
Programs.'' The document provides recommendations for all network
branded prepaid card industry participants to support compliance with
the U.S. Bank Secrecy Act (BSA) anti-money laundering (AML) program
requirements. It recommends how to implement internal controls, monitor
and manage third parties involved with prepaid card processes and
mitigate risks associated with money laundering.
To ensure the document addresses the questions and concerns of law
enforcement and Government agencies, the NBPCA has and will continue to
maintain an open dialogue with Federal, State, and local regulatory
agencies as well as law enforcement officials. The document address
risks identified through information sharing between the industry and
critical agencies that monitor financial crime. ``Recommended Practices
for Anti-Money Laundering Compliance for U.S.-based Prepaid Card
Programs'' is a practical guide to setting up, implementing, and
auditing a compliance program. It covers the following areas:
1. How to conduct a risk assessment.
2. How to establish a set of internal controls to achieve
compliance with AML program requirements of the BSA.
3. Federal reporting requirements and red flags to look for with
respect to suspicious activity.
4. Adopting and implementing programs to comply with know your
customer requirements.
5. Reducing risk when working with non-financial institutions,
third-party agents, and processors.
6. How to implement independent compliance testing.
7. Training program guidelines for key personnel.
The NBPCA has made ``Recommended Practices for Anti-Money
Laundering Compliance for U.S.-based Prepaid Card Programs'' available
to anyone in the prepaid card industry. The report, which can be
downloaded from the NBPCA Web site at www.nbpca.com, has been widely
praised and was well-received both by Government and private entities.
v. the nbpca's role on the bank secrecy act advisory group (bsaag)
In 2008 the NBPCA was selected for membership in the Bank Secrecy
Act Advisory Group (BSAAG), a group made up of industry
representatives, regulators, and law enforcement, implemented by an act
of Congress. BSAAG's role is to advise the Department of Treasury's
Financial Crimes Enforcement Network (FinCEN) on matters related to
anti-money laundering risks and Bank Secrecy Act compliance. In
addition to its role on BSAAG, the NBPCA co-chairs the Stored Value
Subcommittee, a subcommittee focused on the potential risks presented
by prepaid cards and the ways to mitigate those risks.
vi. risks presented by data security breaches
Data security breaches and the misuse of consumer account
information by criminals and money launderers is an increasing problem
for the U.S. payment system. Because network branded prepaid cards use
the same card payment infrastructure as credit cards, prepaid
cardholders can be victims of such data security breaches. However,
because prepaid cards are not connected to an individual's bank account
or credit card accounts, the risks posed by such data breaches tend to
be far less for prepaid card issuers than they are for credit and debit
card holders. This is one of the reasons consumers who also use credit
and debit cards, are attracted to prepaid card use as any breach of the
card limits access to only the balance available on the card. And of
course, like credit and debit cardholders, most network branded prepaid
card holders are protected against losses from unauthorized use, thanks
to the card brands' ``zero liability'' policies which are incorporated
into the payment network operating regulations governing issuers.
vii. conclusion
Network branded prepaid cards are a new and valuable payment
product for consumers, businesses, and Government. As with any payment
product, network branded prepaid cards can be misused by the criminal
element. Nevertheless, the NBPCA has long encouraged practices that
reduce the opportunities for prepaid cards to be used in illicit
activities. Prepaid cards are vital and important products which serve
a substantial number of people, including those that are under-banked
and would have no other connection to the banking infrastructure so
critical to daily life in the United States. The NBPCA continues to
support national and international efforts to combat money laundering,
terrorist financing, and financial crime. We are also committed to
ensuring that our products are available to help consumers and
businesses maintain access to the payment system, have secure and
protected payment products, and reduce costs and inefficiencies for
consumers, businesses, and government.
Ms. Clarke. I now ask each witness to introduce yourself
and summarize your statement for 5 minutes beginning with Mr.
Russo.
STATEMENT OF ROBERT RUSSO, DIRECTOR, PAYMENT CARD INDUSTRY DATA
SECURITY STANDARDS COUNCIL
Mr. Russo. Thank you, Chairwoman Clarke. Thank you for the
opportunity to testify on the critical issue of payment card
data security. Payment card fraud concerns every American and,
in a global economy, every consumer worldwide. The payment card
system is one that manages billions of transactions
representing trillions of dollars moving across a global
network. Reducing payment card fraud and constantly innovating
to stay ahead of it is a critical challenge.
The PCI Security Standards Council was formed in 2006 just
for that purpose. Our mission is to protect cardholder data
from criminal elements who constantly manufacture new and
inventive ways to compromise security systems.
At the center of our efforts to do this are three
standards. Let me tell you about each.
First, the PCI Data Security Standard, or the DSS, is a set
of 12 security practices based on six core principles. The DSS
covers everything from securing applications, to networks, to
their perimeters, to maintaining an incident response plan.
Second, our payment application data security systems is
designed to ensure that payment applications, which are found
in many retailers, are not storing sensitive payment card data.
Third, the PIN security requirements ensure that the PIN
entry devices, devices that you may see at a checkout line to
enter your PIN number, have been designed to properly encrypt
the customer's PIN and are tamper-proof.
But new threats continue to emerge. That is why development
and review of the PCI standards is a critical process and why
the PCI Security Standards Council takes it seriously. We
engage our community of participating organizations, more than
500 merchants, processors, financial institutions, technology
companies, Government, academia, and trade associations
worldwide to ensure our standards meet the latest threats, and
when new threats emerge we have mechanisms to take swift
action.
These include regular updates to our testing procedures,
monthly Webinars with both assessors and merchants; flash
bulletins on emerging threats; as well as on-going updates to
the standards themselves.
Our goal is simple: To have every organization that stores,
processes or transmits cardholder data do so in accordance with
the PCI standards. I have no doubt that compliance with the PCI
standards is an entity's best line of defense against payment
card data compromise. In fact, we have never found a breached
entity to have been in full compliance with the PCI standards
at the time of a breach.
But we also recognize that the dynamic nature of any
organization can render a validated system noncompliant almost
immediately after a satisfactory compliance report has been
issued. Effective security is not a one-time snapshot, but
really a full-length feature film where the organization is
compliant at each and every frame.
No standard is perfect. But the PCI security standards have
proven to be the most effective means of preventing data
breaches and protecting consumers.
One final point. In order to assist organizations with
maintaining and achieving compliance with our standards, the
Council provides a wide range of resources. For example, the
on-going training, approval and quality assurance of qualified
security assessors; a worldwide network of professionals that
conduct on-site compliance assessment; the validation of a
worldwide network of approved scanning vendors who do remote
scanning of networks, secure them against network threats; and
finally, an education program that includes printed materials,
on-line resources, Webinars and face-to-face training sessions.
Payment card fraud is a serious concern demanding a
serious, continuous and vigorous response. The PCI Security
Standards Council has made its sole mission the securing of
cardholder data.
Thank you and I look forward to answering your questions.
Ms. Clarke. Thank you for your testimony.
[The statement of Mr. Russo follows:]
Prepared Statement of Robert Russo
March 31, 2009
introduction
Chairwoman Clarke, Ranking Member Lungren, Members of the
subcommittee, thank you for the opportunity to testify on the important
issue of payment card data security.
My name is Bob Russo and I am the general manager of the PCI
(Payment Card Industry) Security Standards Council. The Council is an
industry standards body responsible for developing security standards
that merchants (such as retailers, transportation companies, hotels,
etc.) and payment card transaction processors use to protect customers'
payment card data as it is stored, processed, or transmitted from the
point of sale to the card issuer for authorization and subsequent
processing.
Payment card fraud is something that concerns all of us, both
businesses and consumers alike--from the pizza shop down my street to
the country's largest retailers; from a single parent who manages the
household finances to the businesswoman who conducts trade globally.
For the consumer, having one's card data stolen can be an inconvenient
and stressful experience, even though here in the United States the
consumer normally bears no liability for any ensuing fraudulent
transactions. It is also very costly for financial institutions that
have to mitigate the damage associated with a payment card compromise,
and for businesses that can lose customer confidence and suffer damage
to their reputations. Data theft impacts everyone in the payment
stream.
The PCI Security Standards Council was formed with the intent of
providing tools and resources to protect payment card data from all
threats, regardless of motivation. In the less than 3 years since our
formation, we have made tremendous strides toward this goal--and our
efforts continue. We welcome the subcommittee's interest in the topic
of payment card data protection, and appreciate the Government's on-
going commitment to understanding and exploring the initiatives
underway to contain and reduce fraud for consumers and businesses
globally. We look forward to working with the subcommittee to continue
to reduce payment card data compromise and invite the subcommittee to
use the Council as a resource as it develops policies to combat
cybercrime.
My testimony today will cover the background and history of the
Council, how we came about, what we seek to do and with whom we work to
develop and maintain the standards in a dynamic security environment. I
will also detail some of the tools and resources we have made available
to the market to enable businesses to secure payment card data wherever
it is processed, stored, or transmitted.
about the pci security standards council
The PCI Security Standards Council, LLC is a global forum for the
on-going development, enhancement, dissemination, and implementation of
security standards for payment card data protection.
The Council was founded in September 2006 by the five major payment
card brands: American Express, Discover, JCB, MasterCard, and Visa.
Together, these five brands represent the vast majority of payment card
transactions both Nation-wide and globally. In coming together, these
organizations agreed to work together to develop and recognize one set
of data security standards to protect payment card data that is stored,
processed, or transmitted.
Prior to the formation of the Council, each of the payment card
brands developed their own set of requirements to ensure that the data
of those carrying their respective cards was maintained in a secure
fashion. Consequently, retailers and other merchants expressed
frustration at the challenges of securing payment card data in a way
that was not universally recognized by all the payment card brands with
which they did business. Organizations involved in the payment process
also highlighted their desire for a mechanism to contribute to the
payment card data security agenda and to provide input and gain insight
into the security standards they would be using. It is for this reason
that broad participation and transparency are core tenets of the
Council's operating principles.
The Council is but one example of the hundreds of private sector-
based entities that have been formed to develop voluntary consensus
standards across virtually all branches of industry to serve new needs
as they arise, thereby helping to ensure that businesses can conduct
their operations responsibly at home, and competitively around the
globe. This private sector role in standards development was mandated
by Congress in 1995 by its enactment of the National Technology
Transfer and Advancement Act (Pub. L. 104-113) (``the Act''). The Act
requires Government agencies to dramatically decrease the creation and
use of ``Government-unique'' specifications in their procurement
activities, and instead rely on voluntary consensus and private sector
standards whenever possible, as well as to report, via the National
Institute of Standards and Technology, their compliance with this
directive. In 1998, the Office of Management and Budget (OMB) updated
Circular A-119 to provide additional guidance to the Federal agencies
on implementing the Act. Under the Act, Government agencies are
requested to participate in developing voluntary consensus private
sector standards to the extent that their resources allow. Consistent
with this mandate, several governmental entities participate in the PCI
Security Standards development process.
the council's mission
The mission of the PCI Security Standards Council is to enhance
payment card data security by developing and maintaining appropriate
security standards and related tools, and driving education and
awareness of the critical importance of data security. Even though the
Council is a business-focused organization, this mission has at its
heart the protection of consumers. The Council works to provide the
necessary tools and resources that organizations should use to protect
their customers' payment card data successfully.
As discussed below, the Council achieves this end by enabling a
sophisticated, global security infrastructure based upon five highly
specialized and important mechanisms:
1. Standards for implementation by both those that store, process,
and transmit payment card data, as well as those that sell the
devices and other equipment that access and transmit such data.
2. Approval, training, and on-going quality assurance of a
worldwide network of ``Qualified Security Assessors'' (QSAs)
that conduct on-site assessments to determine whether those
with access to payment card data are in compliance with
applicable Council standards.
3. Approval, training, and on-going quality assurance of a
worldwide network of ``Approved Scanning Vendors'' (ASVs) that
conduct remote scanning of networks to determine whether those
networks are secure against most network-based attacks.
4. Training and approval of laboratories that can in turn approve
certain products to be in adherence with applicable Council
standards.
5. Training and education of payment process participants through
classroom sessions, collateral material and webinars, so they
are aware of the importance of protecting payment card data
from emerging threats and can actively participate in
protecting themselves and their customers from attacks.
how the council differs from other parties in the payment chain
As a standards body, the Council is responsible for developing and
maintaining the security standards and other tools necessary to protect
payment card data within the payment process. The Council publishes
these standards for anyone to access but specifically for the payment
card industry's use in security and compliance programs. It is
important to distinguish between this role as standards custodian and
industry body from those organizations that may validate compliance or
enforce compliance through rules, rewards, or actions against parties
not yet compliant with applicable security standards.
The Council does not validate the compliance of any entity or
vendor with its core standard, the PCI Data Security Standard (``PCI
DSS''). Indeed, like any other organization that develops voluntary
consensus standards, it does not have the authority or mechanisms to
enforce compliance to its standards. Consequently, the Council does not
run standards compliance programs. Instead, each payment card brand
maintains its own compliance programs based upon the Council's
standards, adding their own stipulations and requirements for
demonstrating compliance for those businesses that must comply.
Therefore, the Council has no direct business relationships with those
entities that store, process, or transmit payment card data, and does
not have the responsibility or contractual right to validate
compliance, enforce, or levy fines for non-compliance with the security
standards that it publishes. Each of these roles is performed by the
payment card brands.
the council's stakeholders
In order to be certain that the Council's standards are as clear
and comprehensive as possible, we seek input from a wide range of
stakeholders as part of the standards development process. For
instance, the Council's Participating Organization program is open to
any organization involved in the payment chain--merchants, banks,
processors, Government, and academia. To date, more than 500 leading
national, regional, and global players are part of this effort.
Participating Organizations provide the Council with real world
insight and experience in deploying security standards in the field,
and have deep understanding of the challenges and threat vectors that
security standards must address. Together, these Participating
Organizations represent the people who are responsible for securely
handling and defending consumers' payment card data against attack on a
daily basis, and therefore provide a valuable resource in feeding
front-line threat information into the Council.
From among the Participating Organizations, a smaller group of 21
representatives are seated as the Council's Board of Advisors every 2
years through an open election and appointment process. Two-thirds of
the Board of Advisors are elected, with the remainder appointed to
ensure adequate geographical and industry representation. These
organizations act as spokespersons for their respective industries and
regions and ensure that the Council is able to partner with industry at
a very detailed and actionable level in the standards-setting process.
The Board of Advisors is a critical enabler in our mission to secure
businesses' payment processes and consumers' payment card data
globally.
Our current Board of Advisors is composed of leaders in their
respective industries such as Wal-Mart Stores, Inc., Microsoft, PayPal,
First Data Corporation, and British Airways. The Board has worked
tirelessly with the Council over the past 2 years to highlight areas of
need in the market, and to devise educational resources that are of
immediate benefit to organizations looking to improve their security.
I want to recognize here for the record the hard work of our
Participating Organizations and Board of Advisors, all of whom
contribute to the Council's security standards in an entirely voluntary
capacity.
In addition to our Participating Organizations, the Council's QSA
and ASV communities, together numbering more than 250 companies
worldwide, provide valuable insight from the front lines of examining
merchants and processors systems. QSAs and ASVs are able to provide
feedback on where the implementation challenges lay and when common
security vulnerabilities appear. The Council is in constant two-way
communication with this group through webinars, newsletters, and, of
course, the Council's annual QSA and ASV retraining and examination
processes.
the pci security standards
The Council's security standards--the tools it makes available for
use by public and private sector entities to secure payment card data--
are designed to protect specific parts of the payments process. The
Council is constantly looking for new ways to secure the payment
process and maintains a dialogue with its Board of Advisors and other
industry stakeholders to bring new resources to the market to further
protect consumer's payment card data. As a result, since its inception
in 2006, the Council has assumed management responsibility for several
payment security standards in addition to the more-well known PCI DSS,
with the mission of increasing payment card data security. I'd like to
give a brief overview of the standards the Council currently manages
and updates:
PCI Data Security Standard
The PCI Data Security Standard is a set of 12 detailed requirements
designed around six principles fundamental to securing payment card
data. At the heart of this standard is the requirement that
organizations do not store sensitive payment cardholder information
typically contained in the magnetic stripe on the back of the payment
card. This is the information that criminals want to steal to create
counterfeit cards. The fundamental principle of the PCI DSS is that
organizations must not store sensitive data. Where information such as
the Primary Account Number (PAN) or expiration date is stored, it must
be rendered unreadable. This generally means that it must be truncated,
hashed, or encrypted, so that unauthorized access to such data will be
of limited use to a criminal.
Along with these fundamentals, the very detailed requirements of
the PCI DSS cover areas ranging from securing applications, networks,
and perimeters to maintaining up-to-date security patches and anti-
virus software, to things like developing and maintaining an incident
response plan and processes for an organization to follow in the event
of a breach.
The Payment Application Data Security Standard (PA-DSS)
The Council developed this standard after feedback from our
Participating Organizations and member brands indicated that software
applications represented a point of weakness in the payment chain.
These payment applications range from touchscreen applications you
might see used in a restaurant, to point-of-sale software used in
ticketing kiosks in museums and theme parks. Unless otherwise required
by the customer demanding PA-DSS compliance, some of these payment
applications may be designed to store sensitive payment card data
thereby undermining an organization's efforts to comply with the PCI
DSS. The Council introduced a process that enables payment applications
to be tested in laboratories to determine whether they are secure, not
storing payment card data, and whether they are capable of helping,
rather than hindering, an organization's efforts to comply with the PCI
DSS. The Council maintains a list on our Web site of validated payment
applications that have been tested in and approved by laboratories for
merchants to use in assessing their own applications and making
informed purchasing decisions.
The PIN Entry Device Security Requirements
The PIN Entry Device security requirements have the same underlying
principle as the PA-DSS. They are designed to enable organizations to
protect consumer's payment card data and ensure that PIN Entry Devices
have been designed not to store payment card information, thus
jeopardizing organizations' PCI DSS compliance efforts. As a PIN Entry
Device is a physical object, these requirements cover not just ensuring
that a device does not store sensitive data, but also that it is
tamperproof, and that, should the device be compromised, its contents
will self-destruct.
The Council maintains a list at its Web site of approved devices
that have been successfully tested in Council-approved laboratories for
merchants to cross-reference against their own devices and to assist
them in making informed purchasing decisions. The Council is currently
working to expand the scope of this program to include a broader array
of device types, including unattended payment terminals such as ticket
kiosks and self-service machines.
Development and review of the PCI standards is a continuous
process. In the case of the PCI DSS, the Council follows a defined 24-
month life-cycle process that incorporates a feedback period from
stakeholders and allows for periods of review by the Council's Board of
Advisors, Participating Organizations, QSAs, and ASVs.
While a planned life-cycle process is important, it is equally
important that the Council be responsive to emerging threats. As a
result, we have several mechanisms for on-going communications with
assessors (QSAs and ASVs), merchants and other stakeholders to provide
guidance as new threats emerge. These include:
Errata to the DSS itself;
Flash bulletins on emerging threats;
A monthly newsletter to the Assessor community with the
latest threat information & corresponding changes required to
the assessment process;
Regular updates to the ASV test scanning environment to
reflect new threats emerging ``in the wild'';
Monthly Webinars with both assessors and merchants;
Updates to the Council's on-line searchable FAQ and training
materials to ensure they include the latest information on the
threat landscape.
the nature of the compliance challenge and process
Validation of compliance with the PCI Data Security Standard can
only represent a snapshot in time that coincides with information
shared with and interpreted by a QSA during the assessment period.
Unfortunately, the dynamic nature of any organization's systems and
network environments can result in a wide variety of actions or
inactions that can render a validated system noncompliant almost
immediately after a satisfactory compliance report has been issued. As
a result, effective compliance is a full-length feature film where the
organization is ``compliant'' at each and every frame of that film. For
that reason, the Council believes achieving and maintaining compliance
with PCI DSS and continuous vigilance regarding other security
practices is an on-going process that must systematically be integrated
into every organization's development and operational practices and
policies in order to serve as the best line of defense against a data
breach.
The evidence of data breaches demonstrates that criminal elements
continue to manufacture new and inventive ways to compromise security
systems, and we can assume that this will continue to be true. The
Council, its members and others are working diligently to secure
payment card data against increasingly experienced and organized
criminals. In spite of the severity of this continually dynamic threat
landscape, the Council believes achieving and maintaining compliance
with the PCI DSS is the best line of defense against data breaches.
It is important to note that the members of the Council report that
they have never found an entity that has been subject to a data breach
that was also in full compliance with the PCI DSS at the time of the
breach. Nonetheless, there is no such thing as perfect security. An
organization could very well be compliant on the day its QSA wrote its
assessment report, but noncompliant thereafter, at the time of a data
breach. Many things can cause the protection to break down--logging
rules not being followed, delaying installation of software patches,
installing untested software, etc. Any of these examples (and many
more) may cause a previously validated company to no longer be
compliant, and therefore vulnerable to attack. Organizations must not
take solely a checklist approach to security, or rely on periodic
validation on a specific day as their security goal, but must instead
exercise continuous vigilance and maintain a strict security program
that ensures constant and ongoing PCI DSS compliance.
the future of the council's efforts and payment security
To succeed in the fight against cybercriminals who target our
payment systems will require the continued vigilance and work of all
parties involved in the payment chain. No system is perfect, and while
breaches can be expected to continue to occur, through our efforts and
the pervasive adoption of the Council's standards and the best
practices it advocates, the work of these thieves will remain as
difficult as possible.
When breaches do occur, the Council works with its member brands,
forensics investigators and, at times, through direct outreach to seek
information from breached entities, to determine the root causes of the
breach. If a need to strengthen the Standards or the Council's
Assessment programs is identified, we have mechanisms in place for
taking swift action.
conclusion
Once again, I want to thank Chairwoman Clarke, Ranking Member
Lungren and the subcommittee Members for their oversight of this issue
and for providing me the opportunity to testify on the important issue
of payment card data security. We hope that those entities that handle
payment card data take from this hearing the understanding of their
responsibilities to consumers, shareholders, and society at large to
increase focus on their payment security efforts. Using the PCI
Security Standards should act as a baseline for their doing so. We also
hope that many more of them will join us as Participating
Organizations, willing to help shape the future of payment security
standards based on their own experience of defending payment data
against attack on a daily basis.
Ms. Clarke. I now recognize Mr. Majka to summarize his
statement for 5 minutes.
STATEMENT OF W. JOSEPH MAJKA, HEAD OF FRAUD CONTROL AND
INVESTIGATIONS, GLOBAL ENTERPRISE RISK, VISA, INC.
Mr. Majka. Chairwoman Clarke and Members of the committee,
my name is Joe Majka. I am head of Fraud Control and
Investigations for Visa, Inc. I have been with Visa for over 12
years, and I have over 28 years of experience in corporate
security investigations and law enforcement, specializing in
the area of financial crimes.
I want to thank the committee for this opportunity to
appear at today's hearing and to explain who Visa is in our
role as a leader in global data security. It is important to
note that Visa's fundamental role is to facilitate transactions
between millions of consumers and businesses. Visa is not a
bank and we do not issue payment cards. Visa is a network that
connects 1.6 billion global payment cards, 29 million worldwide
merchants, and over 16,000 financial institutions in 170
countries.
Through electronic payment networks like Visa, the entire
economy benefits from a more transparent, cost effective, and
secure commercial activity.
I am pleased to be here to talk with you about data
security and about the payment card industry data security
standard in particular. In our view, the best way to secure
payments is by applying two core principles.
First, security must be a shared responsibility among all
relative parties--law enforcement, payment companies,
regulatory agencies, retailers, and others. Only together can
we protect all parts of our shared system.
Second, we must collectively apply multiple layers of
security to protect the system. That includes measures applied
at the card level such as card verification values or
transaction alerts, and includes measures applied at the point
of sale, such as standards for secure devices and best
practices for data storage, and it includes measures applied at
the network level, including neural networks and fraud
monitoring.
One of the most effective layers we have collectively
applied to date is the PCI Data Security Standard. Visa
acquires all entities that store transmitter Visa card data to
comply with the standards. To our knowledge, no organization
that is fully implemented and maintained compliance with the
standard has been a victim of a data compromise event. We
believe full compliance with the standard is a valuable
component of a comprehensive security program and greatly
reduces the risk of data compromise.
While there have been a few instances where an entity that
previously validated compliance was a victim of a compromise,
in all cases our review concluded gaps in the compromised
entity's PCI DSS controls were major contributors to the
breach.
Approximately 90 percent of the U.S. merchants and 80
percent of third-party processors have validated PCI
compliance. These organizations, like Michaels, deserve credit
to enhancing their security practices to meet the minimum
industry standard and for validating their compliance on at
least an annual basis.
This month in Washington, DC, Visa held our third Global
Security Symposium, a symposium on payment security where Visa
called on system participants for continued industry
investment, collaboration, and innovation to keep the
electronic payment system secure for the future. At this summit
we heard from numerous individuals and organizations who
reaffirmed the importance of on-going compliance with the PCI
standards.
Visa has maintained a long-standing relationship with law
enforcement agencies over the years, supporting efforts to
investigate and prosecute criminals committing payment card
fraud. This relationship continues and is stronger than ever
today as Visa and law enforcement agencies work together to
combat cybercriminals in today's high-tech world.
Visa was a founding member of the U.S. Secret Service
Electronic Crimes Task Force in San Francisco and continues to
actively participate in U.S. Secret Service task force groups.
Visa also works closely with the FBI Cyber Division, U.S.
Postal Inspection Service, State attorneys general, and the
Department of Justice Computer Crime and Intellectual Property
Section.
In 2004, Visa provided investigative support to law
enforcement which resulted in the indictment and extradition of
Roman Vega, one of the most significant high-level
cybercriminals at the time. Visa continues to support high-
profile investigations, including the arrests of criminals
responsible for hacking into Dave and Busters and T.J. Maxx.
Visa values our partnership with law enforcement and is
committed to continuing to work closely with law enforcement to
bring cybercriminals to justice.
Protecting card holders is always a primary goal in
responding to data compromise incidents. After learning of a
data compromise, Visa immediately begins to work with the
compromised entity, law enforcement, and the affected client
financial institutions to prevent card-related fraud.
In closing, securing consumer data within the U.S. economy
is a shared responsibility, and every industry should deploy
focused resources to protect consumer information within its
care. We look forward to working with all participants to
continue to develop tools to minimize the risk and the impact
of data-compromise events.
Thank you for the opportunity to be here today. I would be
happy to answer any questions.
Ms. Clarke. Thank you for your testimony.
[The statement of Mr. Majka follows:]
Prepared Statement of W. Joseph Majka
March 31, 2009
introduction
My name is Joe Majka. I am the head of Fraud Control and
Investigations for Visa Inc. I have been with Visa for over 12 years
and have over 28 years of experience in corporate security,
investigations, and law enforcement, specializing in the area of
financial crimes. I want to thank the committee for this opportunity to
appear at today's hearing and explain who Visa is and our role as a
leader in global data security. Visa plays a unique role in the
financial system, facilitating commerce among millions of consumers and
businesses here and around the globe. It is important to note that
Visa's fundamental role is to facilitate transactions between consumers
and businesses. Visa is not a bank. We do not issue payment cards
(credit, debit, or prepaid), make loans to consumers, or set the
interest rates or fees associated with card usage or acceptance. Visa
is a network that serves as the connection point between 1.6 billion
global payments cards, 29 million worldwide merchants, and 16,600
financial institutions in 170 countries. In making these connections,
Visa helps create significant value for each of the participants in our
system. Consumers receive a more convenient, secure, and widely
accepted way to make payments. Retailers benefit from the speed,
efficiency, security, and reliability that only electronic payments can
provide. They also receive guaranteed payment and can avoid the need to
extend credit directly to their own customers. In fact, the entire
economy benefits from electronic payments through more transparent,
secure, and cost-effective commercial activity. The Visa Payment System
plays a pivotal role in advancing new payment products and
technologies, including initiatives for protecting cardholder
information and preventing fraud.
We're pleased to be here to talk with you about data security in
the payment card industry and about the Payment Card Industry Data
Security Standard in particular. But, I want to put this discussion in
the context of a multi-layered approach to security that includes fraud
control measures from the card, to the terminal, through to the Visa
network. Visa understands that we must protect each link within our
control and work with others to preserve the trust in every Visa
payment. Visa is keenly focused on ensuring that payment products are
not used to perpetrate identity theft or other criminal activity. Our
goal is to protect consumers, merchants, and our client financial
institutions from fraud by preventing fraud from occurring in the first
place. To that end, Visa employs multiple layers of security, of which
the PCI standard is an important one, but only one of many. We have
taken a leading role in promoting cardholder information security
within the payments industry. Visa and our participating financial
institutions also provide solutions to prevent fraud and protect
cardholders in the event of a data compromise. These include real-time
fraud monitoring, identity theft assistance, consumer alerts, and zero
liability for cardholders on fraudulent transactions. Visa provides
sophisticated neural networks that enable our client financial
institutions to block authorization transactions where fraud is
suspected. Thanks to massive investments and innovative solutions,
compromise events rarely result in actual fraud and fraud rates in the
payments industry remain near all-time lows.
The payment card industry, regulatory agencies, and law enforcement
have individually and collectively taken extensive measures to prevent
and mitigate the effects of consumer information compromises. In this
regard, Visa has required all entities that store, transmit, or process
Visa card data to comply with PCI DSS standards, has implemented
incentives to encourage payment participants to make the significant
investments needed to attain compliance, and has taken numerous steps
to minimize the amount of cardholder data stored by system
participants.
payment card industry data security standard
PCI DSS was the first security standard adopted by the PCI SSC, but
it has not been a static standard. The PCI Security Standards Council
is charged with reviewing and updating the standard to ensure that it
remains effective to protect card data, by incorporating input from
stakeholders as well as technological developments in the evolution of
the standard over time. Visa recognizes that no set of standards can
provide an absolute guarantee of security in a changing world, and PCI
DSS is not an exhaustive list of all the security practices that may be
effective to safeguard card data. To our knowledge, however, no
organization that has fully implemented and maintained compliance with
the PCI DSS has been the victim of a data compromise event. Therefore,
we believe that full compliance with the standard is a valuable
component of a comprehensive security program and greatly reduces the
risk of data compromise. We also believe that PCI DSS controls are
highly effective in mitigating the impact of data compromise events.
Validating PCI DSS is a major milestone, but achieving and
maintaining compliance requires companies to make an on-going
commitment to keeping consumers' data safe--24 hours a day, 7 days a
week, 365 days a year. While there have been a few instances where an
entity that previously validated compliance was the victim of a
compromise, in all compromise cases our review concluded that gaps in
the compromised entity's PCI DSS controls were major contributors to
the breach. As such, Visa continues to believe that standards
validation is a valuable process that drives organizations to undertake
the minimum steps necessary to protect cardholder data. While it is
easy to focus on the failures that some entities have had with on-going
compliance, we believe it is likely that many compromises have been
prevented as a result of the strenuous efforts of merchants and
processors to maintain compliance with PCI DSS.
visa security initiatives
Visa leads the payment industry in providing merchants and service
providers with incentives to validate and comply with PCI DSS in order
to ensure that they properly protect cardholder data. In particular,
Visa launched a Compliance Acceleration Program offering $20 million in
incentive payments to promote compliance among the largest U.S.
merchants that account for more than two-thirds of Visa annual
transactions. Visa's combination of incentive payments and potential
fines ultimately drove the vast majority of large U.S. merchants to
validate their initial compliance with PCI DSS and to revalidate
annually thereafter. At this time, approximately 90 percent of large
U.S. merchants have validated PCI DSS compliance. Visa also publishes a
list of service providers that have validated compliance with the PCI
DSS, which has been the principal incentive in driving 80 percent of
U.S. service providers to validate their compliance on an annual basis.
These organizations, like Michaels, deserve credit for enhancing their
security practices to meet the minimum industry standard and for
validating their compliance on at least an annual basis.
Visa has also made considerable strides toward eliminating the
storage by merchants and processors of authorization data, which
criminals covet to perpetrate fraud. This ``prohibited'' data includes
full magnetic stripe information, the CVV2 or ``Card Verification Value
2'' and PIN. Visa has executed a ``drop the data'' campaign over the
past 3 years to encourage merchants to discontinue storage of
prohibited data and reduce overall cardholder data storage.
Additionally, Visa developed security standards for payment application
vendors to support merchants in their security efforts by driving
vendors to reduce data storage and provide more secure payment
application products.
Visa has executed a robust data security educational campaign to
engage payment system participants in the fight to protect cardholder
information. This campaign includes training for financial
institutions, merchants, and service providers. Most large merchants,
including Michaels, have attended one of Visa's security training
seminars. Visa is also committed to educating system participants on
emerging security threats and publishes regular security alerts and
bulletins, and holds seminars focused on data security and fraud
mitigation. Visa has partnered with organizations like the National
Retail Federation to promote data security among its members and
commends the NRF and Michaels for their data security efforts. Visa
outreach also extends to participation in industry forums on data
security, media campaigns, and partnerships with other industry groups
made up of merchants, such as the U.S. Chamber of Commerce. This month
in Washington, DC, Visa held our third Global Security Summit, a
symposium on payment security where Visa called on system participants
for continued industry investment, collaboration, and innovation to
keep the electronic payment system secure for the future. The Global
Security Summit reaffirmed the importance of on-going compliance with
security standards and highlighted opportunities to actively engage
consumers in the process of fraud prevention through Visa's transaction
alerts and notifications service which can not only help consumers
track and manage their accounts, but also provide an early warning of
potentially fraudulent activity.
collaboration with law enforcement
Visa has maintained a long-standing relationship with law
enforcement agencies over the years, supporting efforts to investigate
and prosecute criminals committing payment card fraud. This
relationship continues and is stronger than ever today, as Visa and law
enforcement agencies work together to combat cyber criminals in today's
high-tech world. In 2002, Visa was a founding member of the U.S. Secret
Service San Francisco Electronic Crimes Task Force and continues to
actively participate in U.S. Secret Service task force groups in San
Francisco, New York, and Los Angeles. Visa also works closely with the
Federal Bureau of Investigation's Cyber Division, United States Postal
Inspection Service, State Attorneys General and the Department of
Justice Computer Crime and Intellectual Property Section.
In 2004, Visa provided investigative support to Federal law
enforcement, which resulted in the indictment and subsequent
extradition to the U.S. of Roman Vega, known on-line as ``Boa''. Roman
Vega was allegedly one of the most significant high-level criminals
specializing in the on-line sale of stolen payment card data at the
time. Visa has continued with our investigative support on other high-
profile investigations, including the Federal prosecution of Max Ray
Butler known on-line as the ``Iceman'', arrested by Federal agents in
2007 and the 2008 arrest of Albert Gonzales, Maksym Yastremskiy, and
Aleksandr Suvorov for their scheme in which they hacked into Dave &
Busters, Inc. restaurants. Visa also works closely with local law
enforcement agencies and local retailers in supporting their effort to
investigate and prosecute street level criminals using payment cards to
commit fraud. Visa values our partnership with law enforcement and is
committed to continuing to work closely with law enforcement to bring
cyber criminals to justice.
recent compromise events
After learning of data compromise events, Visa immediately begins
working with the compromised entity, law enforcement, and affected
client financial institutions to prevent card-related fraud. Visa
notifies all potentially affected card-issuing institutions and
provides them with the necessary information so that they can monitor
the accounts and, if necessary, advise customers to check closely all
charges on their statements or cancel or reissue cards to their
customers. Visa card-issuing institutions have the direct
responsibility and relationship with cardholders, and because of Visa's
zero liability policy for cardholders, bear most of the financial loss
if fraud occurs. Visa financial institutions can best determine the
appropriate action for each customer that might have been affected.
Based on Visa's findings following recent compromise events at
Heartland Payment Systems and RBS WorldPay, we have taken the necessary
step of removing both companies from our on-line list of PCI DSS-
compliant service providers. In addition, we are activating our account
data compromise recovery programs, which are in place to protect our
system and help issuers recoup some of their losses from compromise
events. Visa is committed to working with these processors so they can
be reinstated to this list upon successfully revalidating their
compliance and Visa is not penalizing merchants that continue to
utilize these processors. Protecting our cardholders was, and remains,
Visa's primary goal in responding to this incident.
conclusion
In closing, securing consumer data within the U.S. economy is a
shared responsibility, and every industry should deploy focused
resources to protect consumer information within its care. In this
regard, the payment card industry has done more than any other to
provide stakeholders with the tools and guidance that they need to
properly secure the data they are trusted to protect. Visa has led the
industry in protecting cardholder data and stands ready to continue to
support industry participants in our collective fight against the
criminals that perpetrate card fraud. We look forward to working with
all participants to continue to develop tools to minimize and
eventually eliminate the risk of data compromise in our economy. Thank
you for the opportunity to present this testimony today. I would be
happy to answer any questions.
Ms. Clarke. I now recognize Mr. Jones to summarize his
statement for 5 minutes.
STATEMENT OF MICHAEL JONES, SENIOR VICE PRESIDENT AND CHIEF
INFORMATION OFFICER, MICHAELS STORES, INC.
Mr. Jones. Good afternoon, Madam Chairwoman, Members of the
committee.
I have been in retail for 30 years, 20 in retail IT, the
last 4 with Michaels, a $4 billion merchant. I wish I could say
that attempting to follow the PCI mandates made me confident
that credit card data is completely safe, but unfortunately
that is not the case. This is because the mandates have been
developed from the perspective of the card companies rather
than from those who are expected to follow them.
The PCI data and security standards are an extraordinarily
complex set of requirements; they are very expensive to
implement, confusing to comply with, and ultimately subjective
both in their interpretation and in their enforcement. The
program is rife with ambiguity and complexity. As an example,
must every company associate acknowledge the security policy of
a company? All 40,000 of our associates, or just those involved
with credit transactions? This one PCI mandate has been imposed
by compliance vendors differently at retailers all across the
country.
We have been questioned by customers, legislators, and even
the credit card companies themselves, why do you keep credit
card information at all? One reason we keep the information is
related to another credit card company procedure designed to
protect their banks from loss. It is called a chargeback. It
can be initiated by a bank on its own, or it can be initiated
at the request of the bank's customer.
For example, if a customer spots a charge on their credit
statement that they don't recognize, they can initiate a
chargeback by contacting the issuing bank. The retailer is then
charged with retrieving sales media by card number. If the
retailer is unable to produce that sales media, or something on
that sales media does not match, the retail sale is reversed,
and the cost of the transaction is charged back against the
retailer. This is true even if the transaction may have
actually been made. This could have been fairly easily solved
using a unique approval ID for each transaction, thus
eliminating the need for credit card number storage by the
retailer.
PCI states that all credit card data must be encrypted.
There is an exception to this requirement, however; PCI states
that data traveling over a private network need not be
encrypted. While a private network is more secure, I still
would not choose to send credit card numbers through this
number unencrypted. Why? Because it adds unnecessary risk.
However, the credit card companies' financial institutions do
not accept encrypted transactions.
We at Michaels have asked, for the past 3 years, for the
ability to send encrypted information to the bank. To date,
this has not happened. Why is this an issue? One might ask the
consumers affected by the Heartland Payment Systems data
breach, or TJX Corporation, for that matter. It has been
suggested that methods used in those breaches capitalized on
this flaw.
What can be done to improve this situation? First, many of
the PCI requirements are covered by the Sarbanes-Oxley audits.
This causes a lot of duplicative work around proof of
compliance and is, arguably, unnecessary.
Second, the requirements are one-sided against the
merchants. The very financial institutions that impose them are
not subject to the mandates themselves.
Third, the PCI Data Security Standards Council was
allegedly spun off from the credit card companies and set up as
an independent governing body of credit card company, bank, and
merchant representatives. In fact, the council is set up so
that credit card companies and banks retain all power over the
ultimate mandates, fines, and anything else connected to PCI.
It is not an industry standards body.
When a breach occurs, and card data is stolen, clearly the
consumer potentially suffers the most inconvenience.
Fortunately, the law provides that promptly reporting consumers
must be held financially harmless. However, the largest
financial impact is on the retailer, especially if the credit
card company's data--which, by and large, we do not want--is
seized from a retail location. The retailer is in the press,
the retailer is demonized, the retailer is threatened with
damages and sanctions. The retailer pays the cost of the
fraudulent transactions. All of this arises from rules that
initially grew from a card monopolist that we have no choice
but to do business with or risk the loss of a large portion of
our business.
We do not need more laws. The existing, sometimes
misguided, enforcement and the proliferation of State
regulations around these issues have created a difficult, if
not impossible, environment for retailers.
In conclusion, I am proud to report that Michaels has never
had evidence of a breach of consumer data. Regardless of the
outcome here, we will continue to do what is necessary to keep
card data safe, but in the future we would be more secure, and
the risks to us all far lower, were the card companies to take
greater responsibility for the inadequate system of payment
they have created and asked us to use.
Thank you. I am happy to answer any questions.
[The statement of Mr. Jones follows:]
Prepared Statement of Michael Jones
March 31, 2009
Good afternoon, Madam Chairwoman, fellow committee Members, and
distinguished panel members. I am Michael Jones; I serve as the senior
vice president and chief information officer (CIO) for Michaels Stores,
Inc. reporting to the chief executive officer. Thank you for inviting
me to discuss the security aspects of credit cards as they impact
consumers at retail locations and especially at Michaels.
Michaels Stores, Inc. is the largest specialty retailer of arts and
crafts. With more than 1,000 stores in the United States and Canada,
the company carries a wide selection of arts and crafts merchandise.
Michaels also operates specialty stores under different brand names,
including Aaron Brothers and Artistree manufacturing facility. We have
annual revenues approaching $4 billion.
I have been with Michaels Stores in my current role for 4\1/2\
years. I held the CIO position at Hollywood Video prior to Michaels for
over 3 years. Prior to that I spent over 12 years at Kmart, and Kmart-
related companies, in various leadership positions in retail
technology. I have been in the retail and restaurant industry since
graduate school, and indeed, since my sixteenth birthday.
I appreciate the committee's invitation to provide a retailer's
view of the state of credit card security. In addition to my own
experience I often communicate about this issue with my peers at
retailers, restaurants, and other establishments that take credit cards
from consumers as a form of payment. My comments today are informed by
those discussions as well.
At Michaels the customer is at the center of everything we do. Her
loyalty and patronage of our stores is something we can not afford to
lose for any reason. We always want her to feel safe and secure when
she is in our stores, with the products we sell, and with the payment
mechanism she chooses: Whether that be cash, checks, debit cards, gift
cards, travelers checks, or credit cards. For many years we have
implemented security standards and processes to protect our customers
and their important financial information, with our preference always
being to keep the least amount necessary to satisfy the payment
process. Losing the trust of our customers because we can not safeguard
their information is a risk we would not take, regardless of what
mandates are imposed on us by an outside organization.
Michaels Stores, Inc. is a PCI-certified organization and has been
almost since the initial imposition of the standard (i.e., prior to the
date where fines were threatened for non-compliance).
I wish I could say that attempting to follow the PCI mandates made
me confident that one could say customers' credit card data is
completely safe, but unfortunately that is not the case. That is
because the mandates seem to have been developed from the perspective
of the card companies, rather than from that of those who are expected
to follow them.
The PCI Data Security Standards are an extraordinarily complex set
of requirements. They are very expensive to implement, confusing to
comply with, and ultimately subjective, both in their interpretation
and in their enforcement. It is often stated that there are only twelve
``requirements'' for PCI compliance. In fact there are over 220 sub-
requirements; some of which can place an incredible burden on a
retailer and many of which are subject to interpretation.
For example, one of the requirements is that all company associates
must annually acknowledge the company security policy. Michaels has an
average of 40,000 associates at any given time. In any one week we
could have more then 1,000 changes in associates. Well, as you might
expect, many of our associates are getting trained on the range of our
merchandise, the operation of the registers, fire safety protocols, and
other important procedures to assist our customers and protect our
operations. So do we also need to get every associate to learn and sign
a written statement of our understanding of the credit card companies'
security policy? Or do we just need to get associates that may deal
with credit cards to sign? This one little PCI mandate has been imposed
by compliance vendors differently at retailers across the country both
because of its subjective interpretation, and the inability for any
large merchant to meet the standard in its most literal form.
We have often been questioned by customers, legislators, and even
the credit card companies themselves: ``Why do you keep credit card
information at all?'' It would seem with the risk of a breach from the
outside or from within, we would be better served not to keep the data
at all. We agree completely. As a retail CIO, I would like nothing
better than to not store a single credit card number anywhere in our
network of systems.
The reason we must still keep credit card information is related to
the results of another credit card company procedure designed to
protect their banks from loss. It is called a chargeback. It can occur
in a number of different ways. It can be initiated by a bank on its
own, or it can be initiated at the request of a bank's customer. For
example, if a customer spots a charge on his bill that he does not
recognize he might initiate a chargeback by contacting his card issuing
bank. The card-issuing bank asks the merchant's bank to retrieve
documentation proving that the purchase took place. The merchant's bank
then requires the retailer to produce the underlying documentation for
the sale--typically sales media showing the customer's credit card
number, signature, and date of purchase. The merchant's bank forwards
the information back to the card-issuing bank. Often, once the customer
sees the underlying documents he remembers the purchase and the matter
is closed. (Confusion might occur, for example, if the formal name of
the business on the customer's monthly statement--e.g. the XYZ Medical
Complex--is different from the name of the business where the customer
received services--The Offices of Dr. MDA.)
However, if the retailer is unable to produce the sales media, the
sale is reversed and the cost of the transaction is ``charged back''
against the retailer. This is true even if the transaction were
actually made. As I mentioned, banks can also initiate retrieval
requests for documentation on their own--it does not have to be
triggered by a customer. If the retailer cannot produce the underlying
data, the cost of the purchase is taken from the retailer and credited
back to the card-issuing bank.
We have a department in Michaels dedicated to handling chargebacks.
Chargebacks may be for a single transaction or an entire block of
transactions. Card-issuing banks file retrieval requests that come to
us. We must first look up the charge on our systems to match the
transaction and identify the store location where the transaction took
place (this is what we need the credit card number for). We then
initiate a request to the store to ``pull'' the receipt for that
transaction. Since we do not have an electronic signature system we
have to get the paper receipt. We then submit that back to the bank
along with the original request. If the bank/credit card company
determines that the charge was not made by the customer (this is pretty
much at their discretion and we have little effective recourse), then
we are charged back the amount of the transaction, plus a processing
fee.
Thankfully at Michaels, chargebacks are not a very large problem,
but my brethren at big ticket companies are not so lucky, as I know
from my previous work experience. We could choose to take the hit and
just accept the chargebacks as a cost of doing business so we would not
need the credit card number stored but, over time, as word of our
vulnerability spreads among the unscrupulous, this would likely cause
an increase in chargebacks to the point where we could no longer
sustain the losses.
This could have been fairly easily solved and saved retailers
hundreds of millions of dollars by having the credit card companies
send retailers a unique approval ID back for each approval transaction.
We could store that ID and a signature, and if there were a question on
the transaction the unique approval ID would indicate how we locate the
transaction. This would eliminate the need for us to store the credit
card number, but still enable us to respond to retrieval requests. This
method would have required changes for retailers, credit card
companies, and the banks, but the overall expenditure would have been
much less and the consumer data would be much safer.
PCI states that all credit card data must be encrypted. This is a
very important component of any data security standard, and one we use
for sensitive data all across our organization. There is an exception
to this requirement, however. PCI says that data traveling over a
``private network'' need not be encrypted. It does not state that it
can't be, just that it need not be. I have been told that in theory a
private network is ``more secure'' than one that is not private. Well,
there is no question about that. A land-line data communication
connection that is direct between two organizations is certainly more
secure then one that traverses the internet or a wireless network.
Michaels has a private network between our stores and corporate
headquarters. This network is also isolated from our other networks in
the headquarters and the internet. Access is extremely limited. It is
private and secure, and we continually look for ways to make it more
secure; after all this is the network millions of our customers' credit
card numbers traverse every year. The security of this network is
paramount and probably at least two-thirds of the PCI requirements deal
with this very subject.
Yet I would still not choose to send my customers' credit card
numbers through this network unencrypted. Why? They are encrypted at
the pin pad or register by mandate of the standard. It only makes sense
that we would keep this information encrypted through our entire
network.
Unfortunately this is where the system breaks down. The credit card
companies' financial institutions, the very organizations that have
created and are mandating this rigorous and highly complex standard, do
not accept encrypted transactions. We must decrypt the credit card
number at our corporate headquarters prior to sending to the merchant
bank for approval!
The transaction is then returned to us un-encrypted and we then re-
encrypt it to send back to the store. We, at Michaels, have asked for
the past 3 years for the ability to send encrypted information to the
bank. To date, this has not happened. We have heard various ancillary
responses to the request such as, ``It is too expensive to implement'';
``If you (i.e. the retailer) are willing to pay the costs (i.e. the
credit card banks' cost) to implement it we will consider it''; to ``It
would be too difficult to implement a standard encryption routine in
the industry.''
Why is this the case? One might ask all the consumers affected by
the Heartland Payment systems data breach, or TJX Corporation for that
matter. It has been suggested that methods used in those breaches
capitalized on that flaw. The criminals used a ``Trojan Horse'' that
read the credit card data ``in flight.'' This is not the stored data I
spoke of earlier, but rather the numbers that were flowing through the
communication channel for approval. One reason thieves could capture
this data is because it was not encrypted. Had it been encrypted they
would most likely not have been able to read the data.
Now there are several requirements in the PCI standards for
``scanning'' systems that look for these types of Trojan Horses. But
this is not an ordinary virus that is written and sent to millions of
PCs via e-mail. These are incredible technical programs often designed
by organized crime syndicates with technical resources that dwarf those
of the average company. And with just one inside source in a company
they can be made virtually invisible. So why take the chance?
So, are the PCI standards bad? No, however there are some major
issues with both the program and the way in which it is implemented.
First, many of the requirements of PCI are already covered in many
companies' Sarbanes-Oxley audits. This causes a lot of duplicative work
around proof of compliance, and is arguably unnecessary.
Second, the requirements are one-sided against the merchants. The
very financial institutions that impose them are not subject to all the
mandates themselves. The idea that these organizations don't ``need''
to be audited because they are already held to an audited examination
standard is inconsistent with the arguments they make to us (i.e.,
Sarbanes-Oxley).
Third, The PCI Data Security Standards Council was allegedly spun
off from the credit card companies and set up as an independent
governing body of credit card company, bank, and merchant
representatives. In fact, the council is set up so that the credit card
companies and banks retain all power over the ultimate mandates, fines,
and anything else connected to PCI. Because of this, the mandates do
not represent what is the ``best'' security, but rather what is best
for the credit card companies and their financial institution partners.
When a breach occurs and card data is stolen, clearly the consumer
potentially suffers the most inconvenience. Fortunately, the law
provides that promptly reporting consumers must be held financially
harmless.
However, the largest financial impact is on the retailer,
especially if the credit card companies' data (which by and large we
don't want) is seized from a retail location. We are the ones in the
press; we are the ones who are demonized; we are the ones States'
attorneys general and others threaten with damages and sanctions.
Consumers may make decisions not to shop at a breached retailer not
realizing that it was the card company processes that caused the data
to be placed at risk.
The retailers pay the costs of the fraudulent transactions, either
through chargebacks or credit card company-imposed fees and penalties.
All of this arises from rules that initially grew from a card
monopolist that we have no choice but to do business with, or risk the
loss of a large portion of our business. It would be impossible for a
retailer like Michaels to survive without taking Visa. So we, like
other retailers, swallow the tens of millions we have spent to become
PCI-compliant, in many cases unnecessarily spent, which both reduces
profitability and increases the costs of everything we, the merchant,
sells.
Is credit card data any safer now than it was before PCI was put in
place? Yes. Would it be had PCI not been put in place? Probably. Could
the consumers' data be safer then it is right now? Most definitely!
But we do not need more laws. The existing (sometimes) misguided
enforcement and the proliferation of State regulations around these
issues have created a difficult, if not impossible, environment for
retailers to effectively meet the legal requirements imposed on them
should a breach of information occur.
Madam Chairwoman, committee Members, and distinguished panel and
guests, if I can leave you with but one message, it is that the
precepts underlying the massive dissemination of credit card data need
to be rethought. As a CIO, I was informed by one of the top security
officers of a major credit card company that based on their analysis
our company credit card data had been breached. Although I thought this
unlikely, they told me that they had never been wrong. After an
agonizing week of internal research, twice daily ``all hands on deck''
calls, many, many dollars and hours spent, the voice at the other end
of the line went dead. The next day a breach of over 40 million credit
card numbers was announced at a bank processor. Our ``incident''
apparently showed that the card company's analysis at that time had not
counted on breaches of such magnitude, since we were later told that
the data which had triggered all of our activity was more likely a
subset of ``another issue'' they were dealing with.
I am proud to report that Michaels has never had evidence of a
breach of consumer data. Regardless of the outcome here we will
continue to do whatever is necessary and prudent to keep the loyalty of
our customers for, without that, we cease to exist. But the future
would be more secure and the risks to us all far lower were the card
companies to take greater responsibility for the inadequate system of
payment they have created and asked us to use.
Thank you. I am happy to answer any questions you may have.
Ms. Clarke. Thank you for your testimony.
I now recognize Mr. Hogan to summarize his statement for 5
minutes.
STATEMENT OF DAVID HOGAN, SENIOR VICE PRESIDENT, RETAIL
OPERATIONS, AND CHIEF INFORMATION OFFICER, NATIONAL RETAIL
FEDERATION
Mr. Hogan. Thank you, Chairwoman Clarke and Members of the
committee, for this opportunity to appear on behalf of National
Retail Federation, the world's largest retail association. I
have been with the NRF for almost 7 years and have spent my
entire 25-plus-year career in retail information technology.
Whether it be by cash, check, or plastic, the payment
mechanism is really just a means of accomplishing business.
Retailers accept credit cards for payment, in part because they
have been assured by the credit card companies that if they
follow a limited number of steps, they will be given a
guarantee of payment. Most retailers are not in the payment-
acceptance business any more than their customers are in the
payment-delivery business.
There have been two big developments in the last decade or
so that have changed the playing field. The first has been the
rapid proliferation of general purpose credit cards. With over
80 percent of the market share, Visa and MasterCard are two
primary examples, these cards issued broadly by banks in the
hope that each card will generate income for them.
The second change has been society's increased
computerization. Globally there have been numerous instances of
hackers from outside of our borders accessing computer systems,
stealing credit card information, and then using this data to
commit fraud. In several cases these have targeted companies
that process or store credit card data.
As with the growth of on-line shopping fraud, these
developments presented the card industry with a challenge. In
response, they introduced what they call the Payment Card
Industry Data Security Standard, also called PCI.
PCI is an attempt to prevent large stockpiles of credit
card data from getting into the wrong hands. However, the PCI
guidelines are onerous, confusing, and constantly changing.
Indeed, PCI is little more than an elaborate patch.
The premise behind PCI, that millions of retail
establishments will systemically keep pace with ever-evolving
sophistication of today's professional hacker, is just not
realistic. Our industry has spent billions on compliance
programs related to data security. PCI protocols have required
many merchants to scrap good existing data security programs
and replace them with different security programs that meet PCI
rules that aren't necessarily any better. Even companies that
have been certified as PCI-compliant have been compromised.
Unfortunately, the economic incentives for the card
companies to remedy these flaws in their system have been
diminished. It appears to our industry that the credit card
companies are somewhat less interested in improving their
product and procedures than they are in reallocating their
fraud costs. In our view, if you peel back the layers around
PCI, you will see it for what it really is, a tool to shift
risk off the banks and credit cards' balance sheets and place
it on others. It is their payment card system, and retailers,
like consumers, are just users of their system. What is really
ironic here is that merchants are forced to store and protect
credit card data that many don't want to keep anyway. The
credit card companies' own rules around retrieval requests
essentially require merchants to keep credit card data for
extended periods of time.
As I mentioned, all of us, merchants, banks, credit card
companies and our customers, want to eliminate credit card
fraud, but if the goal is to make credit card data less
vulnerable, the ultimate solution is to stop requiring
merchants to store credit card data in the first place. In
fact, we proposed such changes to the PCI Security Standards
Council back in 2007. The card industry dismissed our proposal
without addressing its merits.
There have been numerous suggestions made over the years
that would significantly reduce the chances of major data
breaches, but none of them have been adopted yet. Here are just
a few.
First, go on record and stop requiring merchants to store
credit card data and eliminate any penalties they impose for
not doing so.
Another, change the system and allow consumers to enter in
a pin or personal identification number for credit card
transactions, just like you do with debit card transactions.
Third, quickly develop and roll out the next generation of
credit card and give merchants the hardware and software
necessary to handle these new products.
In conclusion, once the payment system itself becomes a
burden, commerce inevitably suffers. We believe any one of
these recommendations will significantly reduce credit card
fraud.
Thank you for the opportunity for appearing in front of
this committee. I will be happy to answer any of your
questions.
[The statement of Mr. Hogan follows:]
Prepared Statement of David Hogan
March 31, 2009
Thank you Chairwoman Clarke, Members of the committee. My name is
Dave Hogan. I am senior vice president, chief information officer for
the National Retail Federation.
By way of background, the National Retail Federation (NRF) is the
world's largest retail trade association, with membership that
comprises all retail formats and channels of distribution including
department, specialty, discount, catalog, internet, independent stores,
chain restaurants, drug stores, and grocery stores as well as the
industry's key trading partners of retail goods and services. NRF
represents an industry with more than 1.6 million U.S. retail
establishments, more than 24 million employees--about one in five
American workers--and 2008 sales of $4.6 trillion. As the industry
umbrella group, NRF also represents more than 100 State, national, and
international retail associations.
I have been with NRF for almost 7 years and have spent my entire
career in retail information technology. Prior to joining NRF I was a
business unit CIO for The Limited and most recently CIO for
international retailer, Duty Free Americas. During that time I became
familiar with the broad array of issues confronting retail CIOs,
including matters related to data security. Both in my prior positions,
as well as during my time at NRF I have helped design and upgrade the
systems that protect my companies' core records.
Currently, I also work with the NRF's CIO Council. The Council is
made up of more than 50 well-known retailers who meet regularly to
study, share, and discuss best practices and challenges inherent in
ever more sophisticated retail technology programs. As a result of that
work I have become familiar with many of the issues involved with the
Payment Card Industry Data Security Standards.
Credit card security is not, however, a new issue for retail. For
years many retailers managed their own in-house credit programs.
Companies such as Sears and JCPenney offered proprietary retail credit
through cards issued in all 50 States. They were known as proprietary
programs because for most of their history, the cards were owned by the
retailer and used exclusively for the purchase of a retailer's
merchandise. Beyond credit programs, many companies maintain
information about their most valuable customers, often gleaned through
loyalty programs. Those programs are used to encourage our customers to
shop and to serve them better when they do. All of this information was
valuable and proprietary.
For this reason retailers developed programs to secure their data.
Each retailer's program was commensurate with the sensitivity of the
data it sought to keep. Certainly, as to their cards, for example, no
retailer wanted its credit card programs to be appropriated by thieves.
Therefore, we retailers developed systems designed to minimize losses
to us and inconvenience to our customers.
There have been two big developments in the last dozen or so years
that have scrambled the playing field. The first has been the rapid
proliferation of what are known in the industry as third-party, general
purpose credit cards. Visa and MasterCard are two examples. These cards
are not issued by retailers, but rather are issued by independent banks
under a particular card brand's name. Thus you might have a Citibank
MasterCard or a Chase Visa or a Citibank Visa. Consistent with their
internal standards, the banks issue the cards as broadly as possible,
in hopes that each card will generate income for the bank.
The other big change has been increasing computerization and the
related growth of the internet. As you all know computers are now
ubiquitous. And many of our governmental, commercial, and personal
activities are greatly dependent upon access to the Web. Unfortunately,
the same processes that give us access also are available to the
unscrupulous. Scams that would have been difficult to accomplish, or
been limited in scope if they were attempted on a face-to-face,
individual-by-individual basis, such as eliciting banking account
information from individuals, can be much more efficiently accomplished
on-line by ``phishing,'' for example, among those who engage in banking
from their home computers.
In a brick-and-mortar environment, retailers accept a variety of
forms of payment: Cash, checks, credit cards, gift certificates, and
other script. Retailers accepted credit cards for payment, in part,
because they had been assured by the card companies that if the
merchant followed a limited number of steps (e.g., confirming the
card's presence; checking the signature; obtaining an approval; and
keeping a copy of the completed charge media) they would be given a
guarantee of payment. Whether it be by cash, check, or otherwise, the
payment mechanism is really just a means of accomplishing business.
Most retailers are not in the payment acceptance business any more than
their customers are in the payment delivery business. The form of
payment simply facilitates the underlying business to be done. (The
consumer is searching for something to wear; the merchant is seeking to
find and display attractive merchandise that customers desire wearing.)
A few years back, outside of the brick-and-mortar environment, in
the then newly developing world of internet shopping, it soon became
apparent to the credit card companies that they should take additional
steps to minimize losses from the use of their card products for on-
line purchases. Through a combination of rules and new security
requirements the card companies were largely able to achieve that goal.
They adopted special security requirements for on-line merchants
(Visa's program was called CISP: Customer Information Security
Program). They also declared that the then-growing number of internet
merchants who accepted a credit card for payment on-line would be 100%
liable for any losses if charges were challenged, either by the
cardholder or by the bank. As a practical matter, for on-line
merchants, there was little or no payment guarantee.
Over time, however, the card companies realized that the number of
fraudulent purchases was continuing to rise. And this was true not just
on-line. Thieves and others learned that if they could obtain the data
on the credit card companies' cards, they could accomplish a few fake
transactions (on-line) or even create fake cards and accomplish many
fraudulent transactions in a wide variety of brick-and-mortar
locations.
The growth of computerization facilitated these breaches. Globally,
there have been numerous instances of hackers accessing computer
systems, stealing credit card information, and using this data to
commit fraud. It has been reported that many of these hackers are
operating out of Eastern Europe and some of the former Soviet states.
In several cases they have targeted retailers' computer systems that
process or store credit card data. But the thieves are really looking
for the data anywhere they can find it.
As with the growth of on-line shopping fraud, these developments
presented the card industry with a challenge. In response, they
introduced what they call the Payment Card Industry Data Security
Standards, commonly called PCI. Since its inception, PCI has been
plagued by poor execution by Visa, MasterCard and the other credit card
overseers of the program. The PCI guidelines are onerous, confusing,
and are constantly changing. Many retailers say that basic compliance
is like trying to hit a rapidly moving target.
As I mentioned, retailers take data security very seriously.
Indeed, merchants, banks, the major card brands and the vendor
community that supplies our industry with hardware and software all
want to reduce the incidence of credit card fraud. PCI is an attempt to
prevent large stockpiles of credit card data from getting into the
wrong hands. But the premise of PCI, that hundreds of thousands or even
millions of merchants will systematically keep pace with the ever-
evolving sophistication of professional hackers, is unrealistic.
PCI is little more than an elaborate patch. While PCI can reduce
some fraud, at extraordinary cost, it is not nearly as effective as a
redesign of the card processes themselves. Since its inception, our
industry has spent billions on compliance programs and related data
security systems. PCI protocols have required many merchants to scrap
good, existing data security programs and replace them with different
security programs that meet PCI rules but aren't necessarily any
better. Retailers have been required to take extraordinary steps to
ensure that somewhere, somehow, data is not inadvertently being
retained by software. However, what is ironic in this scenario is that
the credit card companies' rules require merchants to store, for
extended periods, credit card data that many retailers do not want to
keep.
To many NRF members, it appears that the credit card companies are
less interested in substantially improving their product and procedures
than they are with reallocating their fraud costs. In our view, if you
peel off all the layers around PCI Data Security Standards, you will
see it for what it is--in significant part, a tool to shift risk off
the banks' and credit card companies' balance sheets and place it on
others. It is their payment card system and retailers--like consumers--
are just users of their system.
As I mentioned, all of us--merchants, banks, credit card companies,
and our customers--want to eliminate credit card fraud. But if the goal
is to make credit card data less vulnerable, the ultimate solution is
to stop requiring merchants to store card data in the first place.
For example, rather than requiring that merchants keep reams of
data--currently required under card company rules in order to satisfy
card company retrieval requests--credit card companies and their banks
should provide merchants with the option of keeping nothing more than
the authorization code provided at the time of sale and a truncated
receipt. The authorization code would provide proof that a valid
transaction had taken place and been approved by the credit card
company, and the signed sales receipt would provide validation for
returns or poof of purchase. Neither would contain the full account
number, and would therefore be of no value to a potential thief. Any
inquiries about a credit transaction would be between the cardholder
and the card-issuing bank.
If all merchants took advantage of this option, credit card
companies and their member banks would be the only ones with large
caches of data on hand, and could keep and protect their card numbers
in whatever manner they wished. The bottom line is that it makes more
sense for credit card companies to protect their data from thieves by
keeping it in a relatively few secure locations than to expect millions
of merchants scattered across the Nation to lock up their data for
them.
In fact, we proposed such changes to the PCI Security Standards
Council in 2007. The card industry dismissed our proposal without
addressing its merits but have yet to offer a viable alternative.
Once the payment system itself becomes a burden, commerce
inevitably suffers. The NRF, with direction from our CIO Council, has
engaged the PCI Security Standards Council directly and highlighted
flaws with the existing ``standard'' and ``governance'' of the PCI
Security Standards Council. There have been numerous suggestions made
over the years that would significantly reduce the chances of major
data breaches, but none have been adopted.
In conclusion, we believe any of our suggestions would be more
effective and efficient approaches to protecting credit card data and
preventing a continuation of the data breaches that have been seen in
recent years.
Thank you for the opportunity to appear before the committee today,
I would be happy to answer any questions.
Ms. Clarke. I thank the witnesses for their testimony.
I will remind each Member that he or she will have 5
minutes to question the panel. I will now recognize myself for
questions.
My first question goes to both Mr. Russo and Mr. Majka.
Since the PCI standards have become mandatory, there has been
no shortage of massive data breaches. Is there any hard
evidence to suggest that the standards have reduced the number
of data breaches or the amount of credit card fraud? What
metrics are in place to judge the effectiveness of these
standards?
Mr. Russo. Chairwoman Clarke, let me answer first.
The council's purview does not include keeping statistics
on breaches, on who is compliant, as we do not have that
relationship with the merchants. I can tell you, as I stated
earlier, that based on what we have seen in forensics and what
we have seen our information has given us by reaching out to
these breached entities, that they were, in fact, not compliant
at the time of the breach. Very similar to Ms. Glavin, who
mentioned locking your doors, you don't lock your doors on
Monday, Wednesday, and Friday and not on Tuesday, Thursday,
Saturday, and Sunday. So it is constant vigilance that must be
there when it comes to protecting this data. It is everyone's
responsibility, including the merchant, including the consumer,
to be looking after their own data.
Mr. Majka. Madam Chairwoman, I would like to say that entry
into these data systems, while the criminal is very complex, we
found that the entry methods have been very simple, and they
would have been addressed by the PCI data security standard in
all cases. Even those entities where they have had validated
compliance, our review of those incidents found that either
they hadn't maintained compliance, and there were significant
gaps that allowed the breach to occur.
I would also like to say that the standard itself has been
improved over the years. One of the success stories of the
standard is the removal of prohibitive data from merchants'
servers. This has led to incidents where we no longer have a
breached entity who has been storing data for 3, 4, or 5 years
that the criminals can access 5 years' worth of data. So those
are things that the standard itself has addressed and has
helped.
I would also like to say that I think that we don't know
how many breaches have been prevented by those entities that
have, in fact, gone as far as implementing and maintaining the
standard properly.
Ms. Clarke. I think that is really at the core of the issue
here is that we can't get some tangible evidence of how
effective this is in actually eliminating the breaches. It is
clear that if people aren't following the protocols, that opens
them up in terms of more vulnerability. But it would seem to me
that as a part of the build-out of the floor of the PCI
standards, that we would develop some sort of metric that gives
us an ability to objectively judge the effectiveness of these
standards. Are you saying that those don't exist right now?
Mr. Russo. No, Madam Chairwoman. They do exist in various
entities, those entities being the acquiring banks, as an
example, which own the relationships with the merchants. They
require PCI compliance, they track PCI compliance, they have
those numbers. Again, the council does not have any input into
that or any view into that because we do not have the
relationships with the merchants. The banks, the acquirers have
the relationship with the merchants. But there are tens of
thousands, hundreds of thousands that are going through
programs every day and validating their compliance on a regular
basis.
Ms. Clarke. Mr. Russo, do you have a relationship with the
banks?
Mr. Russo. The council does not have a relationship with
the banks other than to put its standard out there and make
sure that they are creating awareness among their constituents
that they need to be compliant with the standard.
Ms. Clarke. Thank you.
The next question then is both to you, Mr. Russo, and Mr.
Majka. The PCI standards include requirements for encrypting
data at rest and data that travels over the internet. But the
Heartland breach, for instance, involved data in transit
between terminals and hosts on nonpublic networks.
As Mr. Jones notes in his testimony, there are no PCI
standards for this. Is this a fundamental weakness in the
standards? Why doesn't PCI require end-to-end encryption,
including internal encryption? How are you going to address
this?
Mr. Russo. There are provisions within the standard now
that address this data and address the inside network that
should, in fact, either stop this from happening, or at least
give you a warning that something is happening so that you can
immediately stop it and cut the breach off. We do go out to, as
I mentioned, all of our participating organizations--one of
whom is sitting at the table with me today, the NRF--and we do
ask them for their feedback on the standard and what needs to
be done.
One of the things that we are in the process of doing right
now is that we have issued a proposal to a number of technology
companies to give us an independent study on what we are
calling emerging technologies, one of which is end-to-end
encryption, another of which is tokenization, another of which
is chip and PIN. So we are looking at these technologies and
how they make the standard more robust. But it is important to
the say that there really is no silver bullet here.
Ms. Clarke. I am a bit over my time, but I would like to
get Mr. Jones' and Mr. Hogan's response to this end-to-end
encryption dilemma.
Mr. Jones. First, I think on encrypted, I am not sure I
would call it an emerging technology; it has been around for
some time. Obviously, since it is a requirement for anything
traveling outside the private network, I think that not having
it as part of something that travels on your internal network
was something originally to reduce some of the costs involved
with implementing the standards, because it costs money to
implement encryption end-to-end, and that would have involved a
lot of cost to merchant banks all across the country, as well
as retailers. Every retailer would have had to implement
encryption on their side. But we have already had to do it
from--and most retailers do transact across the internet in one
way or another, so we have had to do that.
So I would separate that out from a chip and PIN discussion
as far as what we should be looking at going forward. As far as
whether it should be in the standard or not, I feel that it
should have been in the standard long ago as part of something
simply because there are things that may have caught the
Heartland Payment thing. But when we talk about very
sophisticated thieves, the Heartland Payment software that was
used was so sophisticated that it was virtually impossible for
highly technical, highly sophisticated people to pick up. Most
of the existing scanning technologies would not have even
picked it up, but had it been encrypted, it wouldn't have
mattered. I think that is the way of looking. So why not lock
your front door? Why leave it open?
Ms. Clarke. Mr. Hogan, do you concur?
Mr. Hogan. Yes, I do concur. I think it is very interesting
that the merchants, universities, doctors' offices, anybody who
accepts credit cards and processes credit card data has to go
through extraordinary hoops to adhere to a PCI standard;
however, when it is convenient, the information is sent open in
the free and clear, when it is transmitted to the banks, so on
and so forth.
So I think you have a double standard going on here where
in one case you have to adhere to a standard, and spend a lot
of time, effort, and money to do it, and then all of a sudden
you send it back out wide open that anybody could potentially
read unencrypted downstream.
Ms. Clarke. Thank you. My time is expired.
Let me now acknowledge the gentleman from New Mexico, Mr.
Lujan.
Mr. Lujan. Thank you, Madam Chairwoman. I know we have some
votes we have to get to, if I am not mistaken, so I will try to
keep this brief.
Mr. Russo, what recommendations of standards have been made
that have not been implemented by those that follow your
standards?
Mr. Russo. Congressman, we have a feedback process in
place, which Chairwoman Clarke mentioned a little earlier--
actually, I am a little perplexed because Mr. Hogan earlier
said that this is constantly changing, yet Chairwoman Clarke
indicated it was a 2-year process that we go through. We go
through two feedback periods where we get feedback from all of
those participating organizations, again, one of which is the
NRF, and we then discuss all of this information at two
community meetings that we have on a yearly basis, one in North
America and one in Europe. That information is then taken back
from what we are getting again at that community meeting and
gone through another feedback period before a new standard is
released.
I might also mention that the difference between the
initial standard that we came out with in 2006 and the 1.2
version, which we came out with in October, was not that
different. There were clarifications, there were documentation
changes, more guidance information was put in to make it easier
to understand the intent and, in fact, comply with it. These
were all recommendations from these participating
organizations, from our board of advisors. There are things
that we put out on a regular basis based on their input. We do
not create this standard in a vacuum. This is something that
the entire group of participating organizations and the
assessment community and our board of advisors advise us on.
Mr. Lujan. Let me narrow the question a little bit.
Mr. Russo, there was some discussion about end-to-end
encryption for its databases. Isn't that a recommendation that
was made by the Heartland Payment Systems CEO?
Mr. Russo. After the breach it absolutely was, after the
breach. We agree that encryption is a good thing--again, not a
silver bullet. Encryption is a good thing. As the gentleman
from Michaels mentioned, encryption is an expensive
proposition. If we make this mandatory in the standard, there
will be a number of merchants who will not be able to afford
this immediately. There are provisions within the standard that
actually affect what happens there. So the need for end-to-end
encryption within the internal network is really not there. If
you are following the standard religiously, the need is not
there. Why put these people through the expense?
That being said, we are now investigating it from an
independent third party, and we will present that information
in the form of feedback to our entire community and get their
feeling on whether or not they actually want this to be part of
the standard.
Mr. Lujan. Mr. Russo, you said something earlier that I
found interesting, that you have never found PCI not to be in
compliance at a time of breach, meaning that at a time of
breach, there may have been some break in compliance. But with
the system that we have today, who is responsible for
monitoring compliance?
Mr. Russo. The merchant himself. Basically what we do is we
take a snapshot--let me give you a brief example, if I have a
minute or so. If you need fire insurance on your house, and you
come to me and ask me as the insurance company to give you fire
insurance, I send an inspector out, and you have everything in
place--smoke detectors that work, fire extinguishers,
sprinklers, and such. Three months later, your house burns
down. I send an inspector out again, only to find out that
there was no pressure on the sprinklers at that time, all of
the batteries weren't working in your smoke detectors, and so
on. This is the responsibility not only of the council to make
sure that you are compliant, but it is your responsibility as a
merchant, your responsibility to the consumers to make sure
that you are doing this on a regular basis.
Mr. Lujan. Mr. Russo, if I could interrupt, I think that
that example is a perfect illustration, because I would ask
that the regulator that was responsible for monitoring the fire
suppressant system, if you come back after there was a fire,
and you found out that my fire suppressant system wasn't
adequate to be able to protect my home or my place of business,
then the regulator wasn't doing their job. But in this case,
there is no one overseeing this. It is, here is a set of rules;
if you want to be able to utilize our product, please follow
them. In the case if there is a breach, we depend on the
Department of Justice to step in, often times informing a group
of people that maybe there was a breach.
Madam Chairwoman, I know that my time is expired, but this
is really interesting to see, when we talk about a set of
standards, to truly see how we can work together to look to see
where the weak points are. But also from a compliance
perspective, I know that there aren't compliance efforts moving
forward to truly work with the retailers if it is their
responsibility to be held in compliance. But it seems to me
that the system that we have today, I think we all agree, from
different sides, that it is not working.
Ms. Clarke. Thank you very much for your observations, Mr.
Lujan. Thank you for your responses.
We are in the process of votes right now, but I would like
to get in one final question for this panel, and this question
is for the entire panel actually.
A large part of the data theft problem is the amount of
valuable data stored in the system. Mr. Hogan and Mr. Jones
testified that the credit card companies are actually requiring
merchants to keep more data than they would otherwise prefer.
Can the panel please explain what requirements exist for
merchants to store credit card data in their systems, and why
did the credit card companies dismiss the suggestion from NRF
that these requirements be changed?
Mr. Majka. Madam Chairwoman, if I may start by answering
that question. Visa does not require merchants to retain card
holder data. We embarked on a campaign about 3 years ago to
educate merchants on what data they absolutely need to
maintain, and the campaign was called Drop the Data. In those
cases, they are not required to retain the account number.
We have found that some merchants do, in fact, retain the
account number, customer name, maybe the expiration date, and
in those cases, should a merchant choose to maintain that data,
they do have to secure it properly. But all merchants have the
ability to work with their acquiring merchant bank to not store
that data, and use whether it is an authorization code or
transaction ID as a reference number to then research a
transaction that may be in question. So from a Visa
perspective, we do not require storage of that data.
Ms. Clarke. Mr. Hogan.
Mr. Hogan. That statement is quite interesting, because we
hear from numerous, numerous merchants, restaurants, hotels
that if they don't keep some credit card data for a period of
time to handle the retrieval or chargeback request process,
they will be fined and penalized. So I would love to have
somebody go on record here from Visa or so on and so forth that
would basically make a statement that, again, retailers and
merchants do not need to store any credit card data at all,
just keep an authorization code, and they will not be penalized
at all in context of the chargeback or retrieval request
process. Maybe that could be a question you could pose back.
Ms. Clarke. I find this discrepancy to be very troubling,
very troubling.
Mr. Jones.
Mr. Jones. I think we have to look at two entities, too. As
the question was being answered, there was Visa does not
require. Then the second part was, we recommend they work with
their acquiring merchant bank to understand what data they need
to keep or don't need to keep.
Visa is not the person that we work with on a day-to-day
basis. We work with our merchant bank. If your merchant bank
cannot provide you back the information for you to look up
among your thousands, tens of thousands, hundreds of thousands,
or millions of transactions which we deal with on a basis to
pull that transaction--and we have to physically pull a receipt
again; we go from the point of we get a piece of paper with a
card number on it, and we have to get to a point where we pull
a receipt within a certain time period, otherwise we lose that
transaction. So it is not a requirement. We could not do that.
We could say that is a cost of doing business. By doing that,
then, we would just automatically lose those dollars.
My brethren in places like Best Buy or Big Ticket, it would
cost them a fortune. Places like Marriott, or a hotel or a car
reservation where you hold a reservation with a credit card
number, or they put a $400 charge on your credit card where it
is being held but not charged yet, they do have to keep that;
otherwise they have no way to charge you after.
So I think we are dealing with which organization is
requiring versus PCI doesn't require you, they are not a credit
card organization. Visa just transports it; the merchant bank
is something else. The retailer is left holding the bag and has
no input or say, but yet is paying the transaction fee, is the
one who pays for the transaction when the customer says that
they are not responsible for it and has no say in it.
There is a solution out there, but there has been no
interaction, there has been no partnership to really develop
that solution, I think.
Ms. Clarke. Well, let me just close by saying that this is
something that we have to fix. Mr. Majka, I look forward to
speaking with you further about this.
To all of you, thank you very much for your testimony
today. This has been very interesting, very enlightening. I
think we have got a lot of work to do, as I said in my opening
statement. Certainly I think some things have come to light
here today that should concern all of us and that we should be
working together as a team to make sure that we address.
I thank the witnesses for their valuable testimony and the
Members for their questions. The Members of the subcommittee
may have additional questions for the witnesses, and we will
ask you to respond expeditiously in writing to those questions.
Hearing no further business, the subcommittee stands
adjourned.
[Whereupon, at 3:15 p.m., the subcommittee was adjourned.]
A P P E N D I X
----------
Questions From Chairwoman Yvette D. Clarke of New York for Rita M.
Glavin, Acting Assistant Attorney General, Criminal Division,
Department of Justice
Question 1. How do you prosecute criminals in cyberspace when it is
virtually impossible to identify and attribute attacks to specific
individuals?
Answer. Response was not received at the time of publication.
Question 2. What attraction does card fraud have for criminals and
terrorists?
Answer. Response was not received at the time of publication.
Question 3. Would you say that card fraud is the financing method
of choice for terrorists?
Answer. Response was not received at the time of publication.
Question 4. How many people and man-hours are devoted to
investigations and prosecutions related to card fraud, including both
data breaches and the criminal activity card fraud underwrites?
Answer. Response was not received at the time of publication.
Question 5. You testified that by disabling Shadow Crew's Web site,
the Department of Justice believed they ``prevented hundreds of
millions of dollars in additional losses to the credit card industry.''
Is it the Department's understanding that the fraudulent charges that
are the result of a data breach are a financial liability to the card
brands, issuing banks, or acquiring banks?
Answer. Response was not received at the time of publication.
Questions From Chairwoman Yvette D. Clarke of New York for Robert
Russo, Director, Payment Card Industry Data Security Standards Council
Question 1. Why aren't penetration tests required on a quarterly
basis? Why don't they conform to NIST standards?
Answer. The PCI DSS requirement for penetration testing is not
based exclusively on time intervals. Tests are also required after any
significant changes to a data system environment that has been
validated as compliant with the PCI DSS--as frequently as that may
occur, which may be more frequently than quarterly. The Council's
information supplement regarding penetration tests is attached as
Exhibit A.* This is in addition to the annual validation of static
controls. It is also important to note that penetration tests are only
a small part of the comprehensive set of controls and layers of
security identified in the PCI DSS.
---------------------------------------------------------------------------
* Attachments referred to have been retained in committee files.
---------------------------------------------------------------------------
Vulnerability assessments, which share many of the characteristics
of penetration tests by identifying the same threats, are required, at
a minimum, quarterly. Penetration tests are additive to, rather than
substitutes for, the standards promulgated by the National Institute of
Standards and Technology (NIST), which are also a critical part of the
process that our Approved Scanning Vendors (ASVs) utilize to identify
vulnerabilities in networks. Indeed, all ASVs rely on the NIST National
Vulnerability Database (http://nvd.nist.gov/), a U.S. Government
repository of standards-based vulnerability management data and each
entity must receive a passing score quarterly to be considered
compliant with the PCI DSS.
Question 2. Given the prevalence of insider attacks (both physical
and virtual), which have grown by 55% according to the intelligence
community, why has two-factor authentication not been required of all
users who access payment data within networks as well as all system
administrators' who have privileged rights?
Answer. The PCI DSS requires two-factor authentication (Requirement
8.3) as a mechanism for external access (internet/remote) into
cardholder data environments. The primary focus of PCI DSS Requirement
8.3 is to prevent unauthorized access from the outside, focusing on
protecting from external intrusion, not internal access.
For internal threats with respect to unauthorized authentication
attempts, the PCI DSS provides a layered security approach that
requires numerous other controls to minimize risks within the internal
network. Two-factor authentication is one method for meeting this
layered approach. Other approaches that address the internal risk of
user account takeover include prohibiting the use of risky protocols
that expose user names and passwords (Telnet and FTP) and requiring
passwords to be encrypted/hashed during transmission and storage within
the internal network. There are also numerous user account management
and password controls (Requirement 8), along with logging and
monitoring requirements (Requirement 10) that address internal controls
to help mitigate internal risks including two-factor authentication.
Question 3. How are Qualified Security Assessors trained?
Answer. Because the quality of PCI DSS validation assessments can
have a tremendous impact on the consistent and proper application of
security measures and controls, the Council's QSA qualification
requirements are exacting and detailed, involving both the security
companies themselves as well as the individual employees involved in
assessments.
In broad terms, prospective QSA companies must:
Apply for qualification in the program;
Provide documentation adhering to the Validation
Requirements for Qualified Security Assessors v. 1.1, a copy of
which is attached as Exhibit B;*
---------------------------------------------------------------------------
* Attachments referred to have been retained in committee files.
---------------------------------------------------------------------------
Qualify individual employees to perform the assessments,
which requires annual training and testing of those employees,
and;
Execute an agreement with the Council governing performance
of validation assessments.
In turn, each individual QSA employee who will be performing and/or
managing on-site PCI DSS assessments:
Must attend annual PCI DSS training provided by the Council,
which includes training in Scoping a PCI DSS Assessment, PCI
DSS v1.2 Requirements, and Compensating Controls;
Must pass all examinations conducted as part of training;
Has access to face-to-face feedback sessions with the
Council every 6 months;
Has access to the numerous fact sheets, information
supplements, frequently asked questions, and webinars that the
Council makes publicly available at its Web site at
www.pcisecuritystandards.org/education.
Our management of QSAs does not end with training. In 2008, the
Council launched a Quality Assurance program to promote consistency of
both services and results provided by the security assessment
community. This program specifies eight guiding principles QSAs must
commit to and outlines a number of criteria QSAs must adhere to in
order to provide a more uniform experience for merchants and other
customers. The criteria include evaluating QSAs based on consistency of
the opinions rendered, competency of the professionals, credibility of
the organizations, and business ethics. To staff this program, the
Council has also invested in a dedicated team responsible for assessor
performance monitoring.
Each assessor is required to use the template report associated
with the PCI DSS (attached as Exhibit C*) as the framework for
reporting validation to the standard. Each requirement contains one or
more testing procedures that must be evaluated by the assessor and
appropriately documented to demonstrate that the control has been
tested by the QSA and is operating correctly. The quality assurance
team reviews these reports to confirm that all testing procedures in
the framework are completed and documented, indicating consistency of
practice in the assessor community.
The Council's quality assurance team evaluates trends among Report
of Compliance documents in an effort to identify common inconsistencies
and reports findings to the Council in order to consider and implement
appropriate curative actions. Any such actions are communicated to the
assessors via training, newsletters, and webinars. This information is
also shared with the Council's Technical Working Group for future
consideration and possible adjustment of the PCI DSS.
Question 4. Mr. Jones of Michaels Stores stated that ``Many of the
PCI requirements are covered by the Sarbanes-Oxley audits.'' Could you
report to the committee on the redundancies between the Sarbanes-Oxley
audits and the PCI Council's own requirements?
Answer. The Sarbanes-Oxley Act of 2002 (``Sarbanes-Oxley'') applies
exclusively to publicly traded companies in the United States,
addresses a host of concerns and is not primarily concerned with data
security. Sarbanes-Oxley instead focuses primarily on addressing
accounting standards and practices. The provisions of Sarbanes-Oxley
are not intended, nor would they be adequate, to enable the marketplace
to achieve and maintain data security, particularly with respect to
payment card data. The Council does not believe there is extensive
overlap between Sarbanes-Oxley and PCI Standards.
The PCI Standards are specifically designed to protect payment card
data. They apply to both public and private companies of all sizes,
both inside and outside the United States. Further, they are far more
detailed and specific in the way they address data security issues: for
example, the PCI DSS has over 225 requirements and 525 testing criteria
specific to data security.
Given the specific nature of the PCI DSS and the absence of similar
specific controls in Sarbanes-Oxley, we are unclear about precisely
what redundancies Mr. Jones is referring to.
Question 5. You testified that the PCI council does not develop or
use metrics to evaluate the effectiveness of the council's standards.
How then does the council weigh proposals to the PCI standards if they
cannot measure the costs and benefits of past and future additions to
the standards?
Answer. There are a number of readily available industry metrics
that the Council uses to track the effectiveness of the standard. For
example, the Nilson Report is a widely used industry publication with
extensive metrics on payment card fraud and a wide range of other data
security issues.
Moreover, the payment card brands regularly receive and assess
forensic information regarding the cause of payment card data breach
incidents. This type of data provides critical information regarding
where the PCI Standards may need to be strengthened or modified. This
guidance is provided by the payment card brands as members of the
Council's technical working group.
Proposed changes to the PCI Standards are shared with our
Participating Organizations, which represent over 500 companies, all of
which have first-hand experience in implementing standards and
protecting payment card data on a daily basis. A formal feedback
process enables the Council to receive robust feedback from this group.
This feedback ensures additions and changes to the PCI Standards are
weighed by those with a front-line perspective on what measures are
most beneficial to protect payment card data.
One example of how this broad industry feedback has directly
resulted in changes to the PCI Standard is in the case of wireless
security. In 2007, forensic investigators indicated that insecure
wireless implementations were at the core of a number of breaches. As a
result of that, the Council started investigating wireless security
with its stakeholder community--making it a key agenda item for
discussion at our first Community Meeting. Feedback from that
discussion led to changes in version 1.2 of the PCI DSS. Finally, in
order to help organizations meet the new requirements, our stakeholders
suggested creating a Wireless Special Interest Group--comprised of
representatives from dozens of our Participating Organizations--to
examine implementation issues. That group is expected to release an
implementation guide on meeting the new wireless requirements in the
coming weeks.
It is broad participation such as this--coupled with the knowledge
that the payment brands bring to the table--that gives us confidence in
our ability to measure the cost and benefits of future additions to the
standard.
Question 6. You stated in your testimony that ``no standard is
perfect. But the PCI security standards have proven to be the most
effective means of preventing data breaches and protecting consumers.''
Given that the Council has not developed or applied any metrics to
measure the effectiveness of the PCI standards or to compare their
resulting security to other payment technologies, how have the PCI
security standards proven to be effective at all?
Answer. Necessarily, evidence demonstrating that a particular
standard is effective in preventing a particular outcome must be
inferential. However, it is noteworthy that with more than 10,000
payment card transactions per second worldwide (Source: American
Bankers Association, March 2009) and the usage of payment cards
steadily increasing, payment card fraud rates are at historic lows. The
Council believes that the PCI Standards have been an integral driver of
this trend, and industry data supports that conclusion.
Question 7. You stated that the council does not have a
relationship with banks ``other than to put the standard out there and
make sure that they are creating awareness among their constituents.''
Since it is the banks which, according to you, monitor compliance and
the effectiveness of the standards, should not they be central to the
drafting process?
Answer. My statement pertained to lack of a direct contractual
business relationship between the Council and the banks. It was not
intended to suggest that banks are not intimately involved in data
security standards. Any suggestion to the contrary was inadvertent.
Banks are a pivotal part of our organization. Over 40 financial
institutions worldwide--including such leading U.S. banks as Bank of
America, Capitol One, and Wells Fargo--have joined the Council as
Participating Organizations. These organizations receive draft copies
of the PCI Standards for comment prior to publication and have the
opportunity to contribute feedback during the drafting process.
Financial institutions also comprise nearly one-quarter of the
Council's elected Board of Advisors.
Question 8. Merchants who have experienced data breaches also face
significant class action lawsuits. What liability exists for the
payment card industry and the assessors if a PCI-compliant company is
breached?
Answer. The PCI Standards do not assign liability to any party in
the event there is a data breach. Any liability from a data breach
would arise from agreements between participants in a network and/or
applicable law.
Consistent with its role as a standards development organization,
as discussed above, the Council does not impose any liability
allocation requirements between assessors and merchants, nor does it
have knowledge of the contractual terms entered into between individual
payment card brands (who are competitors of each other) and their
industry partners. Consequently, the Council does not have special
insight into how any liability for payment card breaches is allocated.
Question 9. In response to the committee, JCB said that they expect
the PCI standards will continue to ``become even more stringent in
future iterations.'' Is this also your expectation? What changes will
the next iteration likely have?
Answer. At this point in our standards lifecycle process, we are
not in a position to predict what specific changes will be included in
the next major iteration of the PCI Standards--our open comment period
for the most recent release starts in July. This comment period is a
pivotal part of a rigorous, end-to-end review undertaken within a 2-
year lifecycle process that includes input and feedback periods for our
Participating Organizations. Any changes introduced to meet new and
evolving threats will be debated with all of our stakeholders before
release.
In order to address interim threats, as previously noted in my
written testimony, the Council maintains on-going two-way
communications with its assessors, merchants, and other stakeholders,
and has the ability to issue errata to the PCI DSS, flash bulletins on
emerging threats, monthly newsletters to the Assessor community,
regular updates to the ASV test scanning environment, monthly webinars
with both assessors and merchants, and updates to the Council's on-line
searchable FAQ and training materials.
Question 10. Currently, requirements of notification of breaches
vary from State to State. Given that the Department of Justice stressed
the importance of notification, both of law enforcement and consumers,
has or will the Council consider mandating notification as part of its
standards? How would or could that be enforced?
Answer. As a standards body, the Council has no direct contractual
power that would enable it to mandate or enforce such notification by
retailers or processors when they suffer a breach. Although we do not
have the power to require notification, each of our members feels
strongly that notification of law enforcement and affected consumers is
an important component in a security breach response plan.
In fact, PCI DSS Requirement 12.9.1(b), which addresses Incident
Response, requires entities to have a communication and contact
strategy in the event of data compromise as well as an analysis of
legal requirements for reporting compromises.
Question 11. You stated in your testimony that ``in fact, we have
never found a breached entity to have been in full compliance with the
PCI standards at the time of a breach.'' Can you please explain the
discrepancy between that statement and the statement of Ellen Richey,
Chief Enterprise Risk Officer at Visa, Inc., that Heartland had
validated PCI compliance ``but it was a lack of ongoing compliance and
ongoing vigilance in maintaining security that left them vulnerable to
attack''. Can you please explain exactly how Heartland was not in full
compliance with the PCI standards?
Answer. These two statements are consistent. As noted in my written
testimony, validation of compliance with the PCI DSS only represents a
snapshot in time that coincides with information shared with and
interpreted by a QSA during the assessment period. No entity that has
custody of customer data can afford to gear up for an assessment, and
then relax its vigilance thereafter. While assessment is a useful tool
to uncover vulnerabilities, stakeholders across the payment chain must
realize that data security, and not passing assessments, is the goal of
an effective compliance program. The 2009 Data Breach Investigations
Report from Verizon Business (attached as Exhibit D*) found that
effective tracking and monitoring of network access was not in place at
95% of breached entities at the time of compromise. This provides a
good example, because the tracking and monitoring requirement is a
security practice that requires on-going compliance to be effective.
Its value is severely limited if it is in place only during validation
of compliance to the PCI DSS.
---------------------------------------------------------------------------
* Attachments referred to have been retained in committee files.
---------------------------------------------------------------------------
Unfortunately, the dynamic nature of any organization's complex
information technology systems and network environments, as well as
turnover of human resources, can require the taking of a wide variety
of actions that, absent appropriate steps to restore system integrity
can render a validated system noncompliant quickly after a satisfactory
compliance report has been issued. To use an analogy, effective
compliance should be viewed as equivalent to a full-length feature film
where an organization must be ``compliant'' at each and every frame of
that film. In contrast, validation of compliance is determined by a QSA
only in a single, specific frame of that film.
Question 12. Mr. Majka of Visa stated in his testimony that
``security must be a shared responsibility among all relative parties--
law enforcement, payment companies, regulatory agencies, retailers and
others.'' How is the financial risk and liability shared between these
parties?
Answer. The Council is not involved in the allocation of risk
within a particular network. This question is better directed to
participants in the respective networks, including the networks
themselves.
Question 13. Mr. Majka of Visa stated that ``we must collectively
apply multiple layers of security to protect the system. That includes
measures applied at the card level such as card verification values.''
It is the committee's understanding that not all issuing banks are
required to support CVVs and not all transactions are required to
include CVVs. Can you explain how the Council develops and enforces
standards for the card brands and issuing and acquiring banks?
Answer. It is important to recall, as noted above, that the Council
manages and develops--but does not enforce--the PCI Standards, nor does
it enforce operational regulations imposed by the payment brands.
Instead, it makes standards available to the market as tools to be used
in order to protect the payment card data of any entity that stores,
transmits, or processes payment card data. Members of the payment chain
then individually decide which industry partners must comply with the
PCI Standards, define required compliance validation mechanisms, and
manage any enforcement programs that may exist.
Requirements that exist between individual card brands and their
issuing and acquiring banks are not within the Council's purview.
Question 14. According to Mr. Jones' testimony, PCI states that all
credit card data must be encrypted, with the exception that it need not
if the data travels over a private network. Nonetheless, Mr. Jones says
in spite of that his company does not send this information over their
own private network unencrypted. Surprisingly, he notes, ``The credit
card companies' financial institutions, the very organizations that
have created and are mandating this rigorous and highly complex
standard, do not accept encrypted transactions. We must decrypt the
credit card number at our corporate headquarters prior to sending to
the merchant bank for approval!'' And Mr. Jones' company has to re-
encrypt this data when it is sent back to its stores. As a result of
his company's strong objection to this policy, it has asked for the
past 3 years for the ability to send encrypted information to the banks
but nothing has happened. One reason given is that it is too expensive
to implement. Mr. Jones has been told if the retailers ``are willing to
pay the costs (i.e., the credit card banks' cost) to implement it, we
will consider it.''
How important is the cost to the credit card banks in your
analysis?
Answer. Cost to all stakeholders, including merchants is one of
many factors that are taken into account in considering changes to the
PCI Standards. Effective data security must be affordable to the
millions of participants in the payment chain that must invest in it or
they cannot be expected to act quickly and effectively enough to meet
on-going threats. Any effective security stance must therefore
realistically take cost into account. For example, our Participating
Organizations, and particularly our merchant Participating
Organizations, have told us that internal encryption would be
extremely--even prohibitively--expensive, and have urged us to pursue
more affordable, alternative ways to make further security advances in
this area.
Question 15. Can you explain your process for evaluating Mr. Jones'
3-year effort to be able to encrypt information to the banks? Also, who
has opposed this suggestion?
Answer. Until our introduction at the hearing, Michaels Stores,
Inc. (``Michaels'') had not presented its opinions regarding this issue
to the Council. Moreover, Michaels is not a Participating Organization
and so to date has not attended any of our community meetings or
feedback sessions in the almost 3 years since the Council's inception.
The Council had therefore not had any prior opportunity to evaluate the
Michaels suggestion, nor is it aware of who may or may not be
supportive of this suggestion. The Council would welcome Michaels as a
Participating Organization so that its views could be heard and debated
among our stakeholder community.
Question 16. A large part of the data theft problem is the amount
of valuable data stored in the system. What requirements exist for
merchants to store credit card data in their systems? Please explain
how the chargeback/retrieval process affects what kinds of data can or
should be stored on a merchant's system.
Answer. The Council is not involved in the assessment of the
chargeback and retrieval process. Those processes are dictated by
participants in the payment network and those participants are
therefore in a better position to respond to the question, and speak to
the necessity of various kinds of data in connection with the
chargeback/retrieval process.
To more broadly answer the question of what data merchants are
required or permitted to retain, the fundamental premise of PCI DSS is
``if you don't need it, don't store it.'' That is why requirement 3.1
of the PCI Data Security Standard stipulates that organizations should
only retain data that is required for business, legal and/or regulatory
purposes. In other words, the PCI DSS does not itself mandate that
merchants retain any specific kind of data. To the extent card data
must be stored for legitimate purpose, it must be stored in a secure
manner.
Question 17. Why do card brands require merchants to retain
cardholder data for the purpose of chargebacks? Since this is such
vulnerability for merchants and cardholders, why not mandate that no
cardholder data be retained and provide transaction IDs for the purpose
of chargebacks?
Answer. As noted above, the Council is not involved in the
chargeback process.
Question 18. Why does the PCI Council not mandate PINs for credit
card transactions?
Answer. What data is presented in a transaction is part of the
authorization format used by the payment systems. Since the Council is
a security standards body, we are focused on providing standards to
secure payment data within the current payment system. The Council has
nothing to do with authorization format requirements or the
authentication of a transaction at the point of sale. The Council does
not run a payment network, nor do we have influence over vendors'
product platforms.
If the system evolves to mandate PINs for all transactions, the
Council will then address the issue of how to best provide the market
with any necessary standards to secure this process. For example, the
Council already maintains a comprehensive standard for PIN Entry
Devices. This standard lists requirements that address physical and
logical requirements for devices that process PIN transactions and
would likely be an integral part of securing PINs if they were to be
used more broadly in authentication.
Question 19. The basic design and security model of credit cards
has not changed since the 1950s. What major investments would be
required for a large scale migration to a different payment technology?
Who would make those investments? For example, if we were move to a
chip and PIN system?
Answer. The design and security model of payment cards has changed
extensively since the 1950s. Advances have included advanced hologram
technologies, on-line authorizations, Card Verification Codes, 3-D
Secure, address verification, real-time heuristic fraud detection
solutions, on-line PIN and off-line chip & PIN. This is just a sample.
However, any migration decisions are driven by the underlying value
proposition, which may differ from market to market and vary by payment
brand. The Council in its role as a standards body does not have
insight into these elements.
Question 20. Your responses to the committee concerning adopting
technological changes to the PCI standards, such as the end-to-end
encryption embraced by other witnesses, seems to be: (1) We have
addressed this issue [``there are provisions within the standard now
that address this data, address the inside network that should, in
fact, . . . stop this from happening . . . '']; or (2) it's unnecessary
to address this issue [``so the need for end-to-end encryption within
the internal network is really not there.'']; or (3) we are considering
addressing this issue [``we have issued a proposal to a number of
technology companies to give us an independent study on what we are
calling emerging technologies, one of which is end-to-end
encryption.'']. Given the skepticism toward Visa and the PCI Security
Standards Council expressed by the other members of the panel, can you
point to specific actions you are taking that will reassure this
committee that you are approaching the adoption of end-to-end
encryption and other security-enhancing solutions with the degree of
urgency and level of seriousness warranted by the current threat?
Answer. The introduction of any new technology--whether it is end-
to-end encryption or other security enhancing solutions such as
virtualization and tokenization--is a matter of utmost importance to
the Council and is treated as a high priority. We are constantly
evaluating the potential uses of new technologies to improve the
security of payment card data. As noted in your question, we have
issued a proposal to a number of technology companies to research and
submit to us an independent study of emerging technologies, one of
which is end-to-end encryption. As discussed further in the response to
Question 21 below, we expect to commission that study in the coming
weeks. The issuing of this technology study demonstrates the Council's
commitment to examining the relevance on an on-going basis of
technologies such as encryption to the PCI Standards.
It is important to note, however, that the message from our
stakeholders regarding end-to-end encryption has been mixed. During the
last feedback period in 2007, we received input from more than 350
organizations. It is noteworthy that not a single organization
requested that end-to-end encryption be mandated or even examined. Our
Board of Advisors has similarly not requested an examination of end-to-
end encryption.
Question 21. What technology companies are providing these
``independent'' studies of emerging technologies? Mr. Jones testified
that end-to-end encryption is not an ``emerging'' technology. If that
is correct, what do these companies need to study with regard to end-
to-end encryption?
Answer. The Council conducted an RFP process for selecting a vendor
to assist in the technology study. We are currently in the negotiation
process with the finalist--one of the major public accounting firms.
Our RFP asked vendors to examine the impact that emerging
technologies--including end-to-end encryption as well as technologies
such as virtualization and tokenization--might have on the PCI
Standards, and how broad adoption of these technologies might serve to
simplify the process of securing payment card data.
To Mr. Jones' point, while encryption itself is not a new
technology, no standard currently exists on how to apply end-to-end
encryption in a comprehensive data security framework.
Question 22. Visa asserts that consumers bear zero legal liability
for fraudulent use of credit cards. How is this policy financed?
Answer. Council members understandably avoid discussing any matters
that might in any way relate to the pricing and financing models of the
individual payment brands, and the Council accordingly does not address
such areas. This question is best directed to Visa, but we do note,
that U.S. Pub. Law 93-495 (commonly referred to as ``Reg E'') protects
a consumer against fraud in excess of $50.
Again, I appreciate the opportunity to assist the committee in this
matter, and support its goal of reducing the number and impact of data
security breaches. The Council remains available to provide the
committee with information to more fully understand and address
cybersecurity concerns as they relate to the PCI DSS and other payment
chain-related standards for which the Council has responsibility.
Questions From Chairwoman Yvette D. Clarke of New York for W. Joseph
Majka, Head of Fraud Control and Investigations, Global Enterprise
Risk, Visa, Inc.
Question 1. The PCI requirements are directed solely at merchants
and retailers. Why shouldn't there be a prescriptive security mandate
for Visa or other payment card brands to secure your own networks?
Answer. The PCI Data Security Standard (PCI DSS) applies to all
entities that store, process, or transmit payment cardholder data,
including financial institutions, processors, third party service
providers, and merchants. Visa, Inc. has validated and maintained on-
going PCI DSS compliance on an annual basis using an independent
qualified security assessor (QSA) since the creation of the PCI DSS in
2006. In addition, Visa, Inc. adheres to more rigorous security
measures to protect the overall Visa payment system. Visa is subject to
oversight by U.S. regulatory bodies under the auspices of the Federal
Financial Institution Examination Council (FFIEC) and undergoes regular
reviews by the FFIEC.
Question 2. Given the central role the card brands play in the
American economy, what responsibilities do you believe they have to
consumers and to the Nation?
Answer. Securing consumer data within the U.S. economy is a shared
responsibility, and every industry should deploy focused resources to
protect consumer information within its care. In this regard, the
payment card industry has done more than any other to provide
stakeholders with the tools and guidance needed to properly secure the
data they are trusted to protect. Visa has led the industry in
protecting cardholder data and stands ready to continue to support
industry participants in our collective fight against the criminals
that perpetrate card fraud. Thanks to massive investments and
innovative solutions, compromise events rarely result in actual fraud
and fraud rates in the payments industry remain near all-time lows.
Question 3. Is a breached company (whether compliant with the PCI
Standards or not) subject to increases in interchange rates?
Answer. Visa does not increase or modify the interchange rate
structure that applies to an entity that is breached. In fact, since
October 1, 2007, to encourage and provide incentives for stronger
protection against data breaches, acquiring financial institutions have
been able to qualify transactions for lower interchange rates under the
``tiered'' interchange rate system by, among other best practices and
volume requirements, ensuring that their merchant customers comply with
the PCI DSS. Acquirers of merchants that have been compromised and are
found not to have been in compliance with the PCI DSS may therefore
lose the benefit of these incentive-based ``tiered'' interchange rates,
until they demonstrate that they have come into compliance.
Question 4. In responses to the committee's investigation, you
stated that ``while there have been a few instances where an entity
with previously validated PCI DSS compliance was the victim of a
compromise, in all compromise cases our review concluded that gaps in
the compromised entity's PCI DSS controls were major contributors to
the breach.'' What gaps are normally found in a victim's security
controls after they have been certified PCI compliant, but later found
to be out of compliance?
Answer. In all compromised cases within Visa's purview, third-party
investigations concluded that gaps in the compromised entity's PCI DSS
controls were major contributors to the breach. Gaps commonly include
failures to secure and monitor non-payment-related systems that are
connected to the payment environment, which are then targeted to gain
access to the network. Corporate Web sites are an example of non-
payment-related systems commonly targeted by criminals through
Structured Query Language (SQL) injection attacks. Another common gap
is insufficient monitoring of logs for firewalls, anti-virus, intrusion
detection systems, as well as monitoring of privileged user accounts.
The PCI DSS requires that not only should there be mechanisms in place
to monitor for intrusions, but also that the organization regularly
monitors the logs generated to identify and investigate anomalous
activity.
Visa works with its acquiring financial institutions, through its
compliance programs to ensure merchants and their service providers
achieve and maintain PCI DSS compliance. It is the responsibility of
the acquiring financial institution, which deals directly with their
merchants and their service providers, to ensure these entities
continue to eliminate unnecessary risk to the overall payment system.
To determine overall success of these measures, Visa actively requests
frequent reporting from its acquiring financial institutions on the
status of the PCI DSS compliance of their merchants and service
providers. In support of these compliance programs, Visa has actively
communicated, since 2006, common vulnerabilities and corresponding
mitigation measures that merchants and service providers mistakenly
leave susceptible to attack on their systems. In addition, Visa
provides other data security alerts, bulletins and webinars to payment
system participants, all publicly available at www.visa.com/cisp.
Validating PCI DSS is a major milestone, but achieving and
maintaining compliance requires companies to make an on-going
commitment to keeping all consumers' data safe, including cardholder
data--24 hours a day, 7 days a week, 365 days a year. For any standard
to be effective, however, organizations must rigorously ensure that
they comply with each of its requirements on an on-going basis. Verizon
Business' 2009 Data Breach Investigations Report affirms similar
findings, ``The majority of breaches still occur because basic controls
were not in place or because those that were present were not
consistently implemented across the organization.'' Further, the report
specifically attributes non-compliance to PCI DSS requirements as major
factors contributing to breaches. Verizon cites PCI DSS Requirements 3
(protect stored cardholder data), 6 (develop and maintain secure
systems and applications), and 10 (track and monitor access to network
resources and cardholder data) as the least compliant across their
caseload, saying, ``This trio of deficiencies factored heavily into
many of the largest breaches investigated by our team over the past
five years.''
Question 5. Mr. Russo of the PCI Council stated in his testimony
that ``in fact, we have never found a breached entity to have been in
full compliance with the PCI standards at the time of a breach.'' Can
you please explain the discrepancy between that statement and the
statement of Ellen Richey, Chief Enterprise Risk Officer at Visa, that
Heartland had validated PCI compliance ``but it was a lack of on-going
compliance and on-going vigilance in maintaining security that left
them vulnerable to attack''. Can you please explain exactly how
Heartland was not in full compliance with the PCI standards?
Answer. In all compromise cases within Visa's purview and as stated
by Mr. Russo, despite any validation that may have been completed by a
QSA, the breached entity was not found to have been in full compliance
at the time of the breach. Based on compromise event findings, Visa
removed Heartland from its list of PCI DSS compliant service providers.
Information related to Heartland's PCI DSS compliance status was
provided to Visa under the obligations of a confidentiality agreement.
As such, Visa suggests contacting Heartland directly for specifics.
Question 6. You stated in your testimony that Visa looks forward to
``working with all participants to continue to develop tools to
minimize the risk and the impact of data-compromise events.'' Does Visa
understand the committee's concern about a fraud prevention strategy
that minimizes fraudulent charges only to the extent that card brands
and issuing banks remain solvent when fraudulent charges finance
criminal activities?
Answer. Visa's goal is to prevent both card data compromises and
the subsequent potential for fraudulent transactions. Visa has been
executing a multi-layered security strategy working with all payment
system participants to prevent data compromises around the world as
well as the fraud that may result there from. Visa invests substantial
resources and leads innovation in the industry with measures to stay
ahead of criminals and prevent them from obtaining financing through
the payment system. This includes, for card-based solutions (e.g., EMV-
chip, contactless), data-based measures (e.g., PCI DSS), and network-
based technologies (e.g., Advanced Authorization, neural networks,
Address Verification Service). In addition, participants in the Visa
system should strictly adhere to the EFT Act and Reg. E, the Truth in
Lending Act and Reg. Z, as well as numerous other Federal regulations
that protect consumers from the consequences of data breaches and
fraud. Additionally, Visa is currently working to empower cardholders
to play a more active role in protecting their information through
innovations such as transaction alerts. Armed with this kind of
information, cardholders can help monitor usage on their accounts and
identify potential fraud. All of these measures are designed to prevent
criminals from obtaining card data, and to prevent them from using it
to commit fraud.
Question 7. Merchants who have experienced data breaches also face
significant class action lawsuits. What liability exists for the
payment card industry and the assessors if a PCI-compliant company is
breached?
Answer. Parties that experience data breaches may be subject to the
liabilities determined through the court system. Visa is aware of a
number of class action lawsuits related to major data breaches in the
United States. However, Visa cannot speculate about facts and outcomes
in potential or pending class action lawsuits. To our knowledge, no
organization that has fully implemented and maintained compliance with
the PCI DSS has been the victim of a data compromise event. These
breaches damage consumer trust in the overall electronic payment
system, including Visa and its brand.
Question 8. In response to the committee, JCB said that they expect
the PCI standards will continue to ``become even more stringent in
future iterations of the PCI standards.'' Is this also your
expectation? What changes will the next iteration likely have?
Answer. The PCI SSC is charged with reviewing and updating the PCI
DSS to ensure that it remains effective to protect card data, by
incorporating input from stakeholders as well as technological
developments in the evolution of the standard over time. Since its
creation, the PCI DSS has been formally updated three times, with
considerable input from over 500 participating organizations, including
merchants, banks, and service providers from around the world, in order
to meet the evolving threats to the system, changing technologies and
the increased sophistication of hackers. The updates introduced in
version 1.1 and 1.2 of the PCI DSS have been relatively minor changes,
most of which served as clarifications to help entities better
understand the intent of a requirement. We expect the standard will
continue to evolve to address new threats as they materialize and add
further specificity where participating organizations, including many
global merchants, provide feedback.
Question 9. Currently, requirements of notification of breaches
vary from State to State. Given that the Department of Justice stressed
the importance of notification, both of law enforcement and consumers,
has or will the Council consider mandating notification as part of its
standards? How would or could that be enforced?
Answer. PCI DSS Requirement 12.9.1 addresses incident response and
requires entities to have a communication and contact strategy in the
event of data compromise. Additionally, in the event of a compromise
Visa advises entities to follow all State and Federal disclosure
requirements. Visa also works closely with the Federal Bureau of
Investigation's Cyber Division, United States Secret Service, United
States Postal Inspection Service, State attorneys general and the
Department of Justice Cybercrime and Intellectual Properties Unit in
criminal cases of data compromises.
Question 10. You stated that ``security must be a shared
responsibility among all relative parties--law enforcement, payment
companies, regulatory agencies, retailers and others.'' How is the
financial risk and liability shared between these parties?
Answer. Financial institutions have the direct responsibility and
relationship with cardholders, and because of Federal law and Visa's
zero liability policy for cardholders, bear most of the financial loss
if fraud occurs. Visa's Account Data Compromise Recovery program allows
issuing financial institutions to receive reimbursement for counterfeit
fraud losses and a portion of their operating expenses incurred as a
result of data compromise events from the financial institution
responsible for the compromised entity in the Visa system.
Question 11. Mr. Jones of Michaels Stores stated in his testimony
that ``credit card companies' financial institutions do not accept
encrypted transaction.'' The committee is concerned that the PCI
Council is not applying the same standards to its members that it
applies to merchants and processors. Is Visa planning to move forward
with securing the communications channel between merchants and
financial institutions?
Answer. Visa accepts encrypted data transmissions from its
processing endpoints and many processors also accept encrypted data
transmissions for merchant transaction submissions. Visa is also
mandating use of stronger encryption for protection of PINs at every
point of sale globally, specifying use of Triple Data Encryption
Standard (TDES) for PIN accepting entities. While the PCI DSS requires
encryption over public networks including the internet, it does not
require the use of encryption over private networks, such as a
merchant's internal network or a private connection between a merchant
and processor. Encrypting cardholder data in-transit over private
networks is encouraged. It should be noted, however, that while
encryption can add an additional layer of security, the data is still
at risk if transactions must be decrypted at any point within the
private network--for example, for transaction processing--and must
still be properly protected. As such, many organizations have
determined that the costs and number of system and software
modifications needed outweigh any incremental security benefit. The
requirements outlined currently in the PCI DSS, when implemented
properly, should effectively prevent a criminal from obtaining access
to a business' private network and detect any unauthorized access.
Question 12. The basic design and security model of credit cards
has not changed since the 1950s. What major investments would be
required for a large-scale migration to a different payment technology?
Who would make those investments? For example, if we were move to a
chip and PIN system?
Answer. In the 50 years since the beginning of the card industry,
Visa has evolved from credit card roots to become one of the world's
leading global retail electronic payments networks. Today, the Visa
network connects cardholders, merchants, and financial institutions
around the world with products and services that are designed to make
payments faster, more convenient, more reliable, and more secure. At
the heart of Visa's business is VisaNet, our centralized processing
platform and one of the world's largest transaction and information
processing networks. Nearly 92 billion authorization, clearing, and
settlement transactions were processed through VisaNet in calendar year
2008. On this platform, Visa has been able to build capabilities that
provide secure, reliable, and scalable processing, including
innovations such as Advanced Authorization to risk-score transactions
in real time. Other examples of technological improvements include the
introduction of magnetic stripe technology, CVV2 (three-digit code on
the back of a Visa card), address verification service and contactless
cards with dynamic data technology. There have also been anti-
counterfeit measures such as holograms, ultra-violet marks, and micro
text, to name a few. Fraud rates today are at historic lows, much lower
than they were decades ago when we did not fully benefit from the power
of the Visa network to be able to analyze and authorize transactions in
real time.
Visa supports chip technologies around the world, including in the
United States where we are beginning to see adoption in mobile and
contactless payments. Chip technology--both contact and contactless--
can add an important security layer, introducing dynamic data into
transactions which can reduce the incidence of fraud. However, we
recognize that there are different needs, threats, and infrastructures
in different parts of the world, and there is no one-size-fits-all chip
solution. In some other countries around the world, the market has
driven the adoption of chip technology based on these factors. To the
extent chip adoption can meet the needs of the payments industry in the
United States, Visa is ready to support migration as it has in other
markets. Where chip technology has been implemented broadly in a
market, it should be noted that migration takes time. The costs have
been shared by all parties--payment networks, financial institutions,
and merchants. Generally, the card brands make investments in the
network upgrades and consistent standards and financial institutions
and merchants typically bear the increased cost of card technology and
the upgraded payment terminals.
Question 13. A large part of the data theft problem is the amount
of valuable data stored in the system. What requirements exist for
merchants to store credit card data in their systems? Please explain
how the chargeback/retrieval process affects what kinds of data can or
should be stored on a merchant's system.
Answer. Visa does not require merchants to store complete card
numbers. To the contrary, Visa encourages merchants to limit retention
to truncated account numbers and has executed a ``drop the data''
educational campaign in partnership with the U.S. Chamber of Commerce
over the past 3 years to encourage merchants to reduce data storage
(www.dropthedata.com). A merchant may work with their acquiring
financial institution to implement the necessary chargeback processes
that do not rely upon the merchant's storage of the account number. For
example, a signed point-of-sale terminal receipt with a truncated
account number and the accompanying authorization log is valid
fulfillment and will remedy a fraud chargeback. As such, a merchant may
mitigate their risk by storing only truncated account numbers. In many
cases, merchants decide to store cardholder data for marketing, loyalty
programs, or customer service purposes. In those instances, Visa
requires that stored data is protected in accordance with the PCI DSS.
Question 14. In responses to the committee, Discover stated that it
is currently making changes to processes to provide merchants with the
option of receiving masked data for disputes (like retrievals and
chargebacks) as well as settlement reports. Is Visa doing something
similar? Would this cut back on the amount of data stored that could be
subject to breach?
Answer. Visa does not require merchants to store complete card
numbers. Visa continues to work with those financial institution
clients that may be requesting card numbers for dispute resolution to
eliminate this practice and adopt the use of truncated account numbers.
While Visa strives to eliminate any practices that may lead to the
storage of cardholder data, there are likely many other reasons
merchants have made a business decision to store this data, including
processing returns and loyalty programs. In addition to our efforts to
limit retention of complete account numbers, Visa has made considerable
strides toward eliminating the storage by merchants and processors of
authorization data, which criminals covet to perpetrate fraud. This
``prohibited'' data includes full magnetic stripe data, the CVV2 or
``Card Verification Value 2'' and PIN.
Question 15. Visa asserts that consumers bear zero legal liability
for fraudulent use of credit cards. How is this policy financed?
Answer. Visa card-issuing financial institutions are responsible
for complying with Federal law and honoring Visa's zero liability
policy for cardholders and, as a result, bear most of the financial
loss if fraud occurs.
In closing, Visa is acutely focused on ensuring that payment
products are not used to perpetrate criminal activity and has taken a
leading role in promoting cardholder information security and
innovation within the payments industry. I appreciate the opportunity
to assist the committee in this matter.
Questions From Chairwoman Yvette D. Clarke of New York for Michael
Jones, Senior Vice President and Chief Information Officer, Michaels
Stores, Inc.
Question 1. How much does it cost you to comply with the PCI
standards, and are they effective in keeping out intruders?
Answer. Response was not received at the time of publication.
Question 2. Are retailers bearing a disproportionate burden of
costs in data security?
Answer. Response was not received at the time of publication.
Question 3. Do you agree that the effectiveness of data security
standards is inherently limited by the technology base of U.S. credit
and signature debit card processing networks? How could this technology
base be improved, and what obstacles exist that would prevent this from
happening?
Answer. Response was not received at the time of publication.
Question 4. Have you ever notified the Council of assessors trying
to sell their own products or services?
Answer. Response was not received at the time of publication.
Question 5. The basic design and security model of credit cards has
not changed since the 1950s. What major investments would be required
for a large-scale migration to a different payment technology? Who
would make those investments? For example, if we were move to a chip
and PIN system?
Answer. Response was not received at the time of publication.
Question 6. A large part of the data theft problem is the amount of
valuable data stored in the system. What requirements exist for
merchants to store credit card data in their systems? Please explain
how the chargeback/retrieval process affects what kinds of data can or
should be stored on a merchant's system.
Answer. Response was not received at the time of publication.
Question 7. Visa asserts that consumers bear zero legal liability
for fraudulent use of credit cards. How is this policy financed?
Answer. Response was not received at the time of publication.
Questions From Chairwoman Yvette D. Clarke of New York for David Hogan,
Senior Vice President, Retail Operations, and Chief Information
Officer, National Retail Federation
Question 1. Are retailers bearing a disproportionate burden of
costs in data security?
Answer. Response was not received at the time of publication.
Question 2. Do you agree that the effectiveness of data security
standards is inherently limited by the technology base of U.S. credit
and signature debit card processing networks? How could this technology
base be improved, and what obstacles exist that would prevent this from
happening?
Answer. Response was not received at the time of publication.
Question 3. Have you ever notified the Council of assessors trying
to sell their own products or services?
Answer. Response was not received at the time of publication.
Question 4. The basic design and security model of credit cards has
not changed since the 1950s. What major investments would be required
for a large-scale migration to a different payment technology? Who
would make those investments? For example, if we were move to a chip
and PIN system?
Answer. Response was not received at the time of publication.
Question 5. A large part of the data theft problem is the amount of
valuable data stored in the system. What requirements exist for
merchants to store credit card data in their systems? Please explain
how the chargeback/retrieval process affects what kinds of data can or
should be stored on a merchant's system.
Answer. Response was not received at the time of publication.
Question 6. Visa asserts that consumers bear zero legal liability
for fraudulent use of credit cards. How is this policy financed?
Answer. Response was not received at the time of publication.