[House Hearing, 111 Congress]
[From the U.S. Government Publishing Office]
ONLINE PRIVACY, SOCIAL NETWORKING,
AND CRIME VICTIMIZATION
=======================================================================
HEARING
BEFORE THE
SUBCOMMITTEE ON CRIME, TERRORISM,
AND HOMELAND SECURITY
OF THE
COMMITTEE ON THE JUDICIARY
HOUSE OF REPRESENTATIVES
ONE HUNDRED ELEVENTH CONGRESS
SECOND SESSION
__________
JULY 28, 2010
__________
Serial No. 111-144
__________
Printed for the use of the Committee on the Judiciary
Available via the World Wide Web: http://judiciary.house.gov
U.S. GOVERNMENT PRINTING OFFICE
57-673 WASHINGTON : 2010
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, [email protected].
COMMITTEE ON THE JUDICIARY
JOHN CONYERS, Jr., Michigan, Chairman
HOWARD L. BERMAN, California LAMAR SMITH, Texas
RICK BOUCHER, Virginia F. JAMES SENSENBRENNER, Jr.,
JERROLD NADLER, New York Wisconsin
ROBERT C. ``BOBBY'' SCOTT, Virginia HOWARD COBLE, North Carolina
MELVIN L. WATT, North Carolina ELTON GALLEGLY, California
ZOE LOFGREN, California BOB GOODLATTE, Virginia
SHEILA JACKSON LEE, Texas DANIEL E. LUNGREN, California
MAXINE WATERS, California DARRELL E. ISSA, California
WILLIAM D. DELAHUNT, Massachusetts J. RANDY FORBES, Virginia
STEVE COHEN, Tennessee STEVE KING, Iowa
HENRY C. ``HANK'' JOHNSON, Jr., TRENT FRANKS, Arizona
Georgia LOUIE GOHMERT, Texas
PEDRO PIERLUISI, Puerto Rico JIM JORDAN, Ohio
MIKE QUIGLEY, Illinois TED POE, Texas
JUDY CHU, California JASON CHAFFETZ, Utah
TED DEUTCH, Florida TOM ROONEY, Florida
LUIS V. GUTIERREZ, Illinois GREGG HARPER, Mississippi
TAMMY BALDWIN, Wisconsin
CHARLES A. GONZALEZ, Texas
ANTHONY D. WEINER, New York
ADAM B. SCHIFF, California
LINDA T. SANCHEZ, California
DANIEL MAFFEI, New York
JARED POLIS, Colorado
Perry Apelbaum, Staff Director and Chief Counsel
Sean McLaughlin, Minority Chief of Staff and General Counsel
------
Subcommittee on Crime, Terrorism, and Homeland Security
ROBERT C. ``BOBBY'' SCOTT, Virginia, Chairman
PEDRO PIERLUISI, Puerto Rico LOUIE GOHMERT, Texas
JERROLD NADLER, New York TED POE, Texas
ZOE LOFGREN, California BOB GOODLATTE, Virginia
SHEILA JACKSON LEE, Texas DANIEL E. LUNGREN, California
MAXINE WATERS, California J. RANDY FORBES, Virginia
STEVE COHEN, Tennessee TOM ROONEY, Florida
ANTHONY D. WEINER, New York
MIKE QUIGLEY, Illinois
TED DEUTCH, Florida
Bobby Vassar, Chief Counsel
Caroline Lynch, Minority Counsel
C O N T E N T S
----------
JULY 28, 2010
Page
OPENING STATEMENTS
The Honorable Robert C. ``Bobby'' Scott, a Representative in
Congress from the State of Virginia, and Chairman, Subcommittee
on Crime, Terrorism, and Homeland Security..................... 1
The Honorable Louie Gohmert, a Representative in Congress from
the State of Texas, and Ranking Member, Subcommittee on Crime,
Terrorism, and Homeland Security............................... 2
The Honorable Bob Goodlatte, a Representative in Congress from
the State of Virginia, and Member, Subcommittee on Crime,
Terrorism, and Homeland Security............................... 4
WITNESSES
Mr. Gordon M. Snow, Assistant Director, Federal Bureau of
Investigation, United States Department of Justice, Washington,
DC
Oral Testimony................................................. 5
Prepared Statement............................................. 8
Mr. Michael P. Merritt, Assistant Director, United States Secret
Service, United States Department of Homeland Security,
Washington, DC
Oral Testimony................................................. 13
Prepared Statement............................................. 15
Mr. Joe Sullivan, Chief Security Officer (CSO), Facebook, Inc.,
Palo Alto, CA
Oral Testimony................................................. 23
Prepared Statement............................................. 26
Mr. Marc Rotenberg, Executive Director, Electronic Privacy
Information Center (EPIC), Washington, DC
Oral Testimony................................................. 40
Prepared Statement............................................. 42
Mr. Joe Pasqua, Vice President for Research, Symantec, Inc.,
Washington, DC
Oral Testimony................................................. 54
Prepared Statement............................................. 56
APPENDIX
Material Submitted for the Hearing Record........................ 77
ONLINE PRIVACY, SOCIAL NETWORKING,
AND CRIME VICTIMIZATION
----------
WEDNESDAY, JULY 28, 2010
House of Representatives,
Subcommittee on Crime, Terrorism,
and Homeland Security
Committee on the Judiciary,
Washington, DC.
The Subcommittee met, pursuant to notice, at 2:19 p.m., in
room 2141, Rayburn House Office Building, the Honorable Robert
C. ``Bobby'' Scott (Chairman of the Subcommittee) presiding.
Present: Representatives Scott, Lofgren, Quigley, Deutch,
Gohmert, Goodlatte, and Lungren.
Staff present: (Majority) Bobby Vassar, Subcommittee Chief
Counsel; Jesselyn McCurdy, Counsel; Ron LeGrand, Counsel; Joe
Graupensperger, Counsel; Liliana Coronado, (Fellow) Federal
Public Defender's Office Detailee; Veronica Eligan,
Professional Staff Member; (Minority) Caroline Lynch, Counsel;
Kimani Little, Counsel; Art Baker, FBI Detailee; and Kelsey
Whitlock, Legislative Assistant.
Mr. Scott. Subcommittee will now come to order. And I want
to apologize for starting late. We had a Judiciary Committee
bill on the floor, and the rules prohibit us having a bill on
the floor and meeting at the same time, so I am glad that that
bill didn't take very long.
I am pleased to welcome you today to this hearing before
the Subcommittee on Crime, Terrorism and Homeland Security
about Internet Privacy, Social Networking and Crime
Victimization.
The Internet presents individuals, in their personal and
professional capacities, numerous opportunities to share
personal information. Some of the information disclosed by
individuals is done so incidental to the use of the Internet.
So for example, in order to use various online accounts for
services such as e-mail, shopping and messaging, consumers also
must establish passwords, reveal credit card numbers, and
divulge other personally identifiable information.
In other circumstances, the sharing of information is
central to a particular use of the Internet. For example, some
Internet users actively share information, much of it extremely
personal, through social networking sites.
Both categories of information present unique privacy
challenges. This hearing will examine these issues and risks of
criminal victimization.
Of course, we know that criminals are constantly devising
new ways to infect the computers of Internet users with various
types of malware. Much of this malware is intended to capture
the private information of individuals and report it back to
the criminal to be used in the next step to the scheme, often
involving some form of identity theft.
We have Federal and state laws prohibiting this type of
crime, but it is important that consumers know what they can do
to protect themselves and that we demand that the Internet
companies take appropriate steps to ensure the security of this
information.
This is part of what we will focus on today, but we also
want to pay particular attention to the special risk to
victimizations based on participation in social networking.
Based on the widespread popularity of social networking
sites, such as Facebook, there is no doubt that these sites
provide an enjoyable and unique experience to their users.
Those who use these sites are able to share information with
their friends, find old friends, and establish new friendships.
And in so doing, they share and broadcast some of the most
sensitive and intimate details of their lives.
Unfortunately, there are those who seek out and exploit the
details to perpetrate criminal acts. For example, personal
details shared on these sites may allow criminals to guess a
user's forgotten password clues for various online accounts.
Burglars have targeted people's homes based on information
found on Facebook pages that the resident is on vacation and
not at home. And based on fears about possible victimization of
young people by Internet predators, Facebook has agreed to
install a panic button on user pages hosted on its U.K. Web
site so suspicious behavior can be reported to the authorities
immediately.
One scheme that has proliferated involves hijacking of a
Facebooker's user's account by a criminal who sends a financial
distress call to the user's friends on that Facebook page,
asking them to wire money to an account which is, unbeknownst
to them, actually that of the criminal.
To discuss all these types of issues, we have a panel of
witnesses representing a broad spectrum of experience and
various Internet privacy issues from perspectives of law
enforcement, industry, and privacy advocacy.
Before we proceed with their testimony, it is my pleasure
to recognize the Ranking Member of the Subcommittee, my
colleague from Texas, Judge Gohmert.
Mr. Gohmert. Thank you, Mr. Chairman. I do appreciate you
holding this hearing on a very important topic, privacy, social
networking and crime victimization have become competing
interests as the Internet continues to revolutionize the way we
conduct commerce, seek employment, keep up with family and
friends, make new friends, and communicate in general.
The Internet's impact on communication and on society is
often compared to the impact that the invention of the printing
press had on the literary market. We are in the midst of a
technology evolution like never seen before.
Every year, or even more frequently, there is some new
gadget that is faster and smaller than its predecessor, or
capable of doing something that was never thought possible.
This has certainly been true in all aspects of personal
computing and the development and access to the Internet.
The Internet has not only facilitated communication, but
other aspects of everyday life, as well. We no longer have to
go to the post office to pay a bill. We can buy books, food,
furniture, just about every other thing without going to a
store. We can now look for a new home or a new car at any hour
of the day simply by logging on.
Unfortunately, with these benefits and conveniences come
new ways to commit crimes and new ways to exploit our personal
information. The conveniences generally seem to outweigh the
risk. But by educating ourselves about the potential risk and
vulnerabilities created by these conveniences, Internet users
can help prevent the spread of identity theft and other crimes
on the Web.
Identity thieves who hack into your personal computer or a
merchant computer, steal your personal information, have
received considerable attention by the media and Congress.
People have become aware of identity theft, interchanging their
habits to prevent becoming a victim.
You don't have to look any further than the popularity of
personal shredding machines to realize that habits do often
change when there is awareness of the risk.
But there are new schemes and new variations of old schemes
employed by criminals to defeat the security measures and
actions taken by a concerned public. For instance, within the
last few months, staff of this Committee received e-mails
supposedly from a former staffer asking that money be wired
immediately to a certain account as a sender claimed to be the
victim of a robbery while touring London.
When the sender could not answer basic questions, the
communications stopped. Later, it was learned the former
staffer's Internet address book had been compromised, and
everyone in it received the same plea for help. This scam has
also apparently been attempted using social networking sites.
The dramatic increase in the popularity of social
networking sites has perhaps overshadowed some of the risk of
sharing too much information in those forums. Unlike the
sensitive but relatively limited information needed to make an
online purchase, these social networking sites provide the
opportunity and the temptation to incrementally put more and
more personal information into cyberspace.
Most users who have no real sense of who can see this
information, or what can be done with it or what steps can be
taken to prevent it from being exploited, and all of this
information is a potential treasure trove for identity thieves
and for the facilitation of other crimes. Some in the
information industry refer to personal information as ``The new
currency of crime.''
According to a recent national survey of 2,000 online
households conducted by the Consumer Reports National Research
Center, two out of three online U.S. households use social
networks, nearly twice as many as a year ago. But millions who
use these services put themselves and their families at risk by
exposing very sensitive personal information. If a picture is
really worth 1,000 words, some of the visuals that are posted
on these sites say way too much, and in all likelihood can
assist a predator in choosing their prey.
Again, I want to thank the Chairman for holding this
hearing. I firmly believe that making the public aware of some
of the new dangers associated with the ever-expanding Internet
is an important tool for Internet users, particularly teenagers
and children, to protect themselves.
This is particularly true here in Congress, where we have
software and hardware that is so secure that only we and the
Chinese have access to all our secrets.
With that, I yield back, and thank you for the time,
Chairman.
Mr. Scott. Thank you. And we have one panel of witnesses
with us. Excuse me, does the gentleman from Virginia have a
comment?
Mr. Goodlatte. Just briefly, Mr. Chairman, I want to thank
you for holding this hearing. As the co-chairman of the
bipartisan Congressional Internet Caucus and chairman of the
House Republican High-Tech Working Group, this is a very, very
important discussion about how to prevent crime and keep people
safe on the Internet.
It is a rapidly evolving technology, and we have got to
make sure that the Internet does not become the wild, Wild West
of the 21st century. But there are a lot of exciting new
developments going on not only to make new services available
to people, but also to empower them to, in many ways, get a
better handle on controlling their access to the Internet in
terms of the information that they provide and that they can
determine how to provide it.
In addition, social networking technologies like Facebook--
and Facebook, quite frankly, has been a leader in this regard--
have done a great service to the Internet by making greater
transparency for the people who are legitimately and honestly
using the Internet. If you go on a technology like Facebook,
you have got to disclose who you are, and therefore you can
see, as you participate, who you are and decide for yourself
who you want to share that information with.
But it also is a move away from people thinking that they
can anonymously undertake activities on the Internet to perform
various types of criminal activities. The more we promote that
type of activity, the fact that you identify yourself and who
you are, and you decide for yourself what information you are
going to share, I think the greater progress we will make in
being able to crack down on the people who want to think that
they are operating in the shadows of the Internet and
conducting crime.
Now, there are lots that people have to learn about that as
they do it so that they can understand how they best can
protect themselves, and the technologies need to evolve further
to root out people who would conduct criminal activity on the
Internet.
But I think that is what we should be learning about today
and encouraging today so that the Internet can continue to grow
and continue to be the educational tool, the tool for commerce,
the tool for entertainment that it has become and is enjoyed by
hundreds of millions of Americans and billions of people around
the world. So I look forward to hearing from our witnesses
today.
Thank you, Mr. Chairman.
Mr. Scott. Thank you. And I would like to thank you for
your hard work on a lot of the technology issues that many of
us have trouble understanding. You and our other colleague from
Virginia, Mr. Boucher, have done a lot of work in a bipartisan
way in cooperation, which is very helpful to the Committee. So
we want to thank you for your leadership.
Our first witness today will be Gordon Snow, who is
assistant director of FBI's cyber division. He has had a
distinguished career with the FBI, including positions as a
section chief in cyber national security section and the
director, the National Cyber Investigative Joint Task Force.
Our second witness will be Michael Merritt, who is
assistant director of the Secret Service's Office of
Investigations. He oversees the Secret Service's criminal
investigations, including those of electronic and financial
crimes.
Our third witness will be Joe Sullivan, who is the chief
security officer for Facebook. He is a former assistant U.S.
attorney and has the daily responsibility for overseeing
Facebook's security policies.
Our fourth witness will be Mark Rotenberg, who is the
executive director of the Electronic Privacy Information
Center. His organization is one of the leading advocates of
online privacy rights and has taken a special interest in these
interests as they relate to social networking.
Our fifth and final witness will be Joe Pasqua, who is the
vice president of research for Symantec Corporation. He has led
the efforts in that corporation in areas such as online safety,
reputation-based security and data protection.
Each of our witnesses' written statements will be entered
into the record in its entirety. We ask our witnesses to
summarize his or her testimony in 5 minutes or less. And to
help stay within the time, there is a timing device at the
table which will begin green, and when 1 minute is left, it
will turn to yellow, and turn red when 5 minutes have expired.
Also want to recognize our colleague from Florida, Mr.
Deutch. Did you have a comment? Okay. Thank you very much.
So we will begin with Assistant Director Snow.
TESTIMONY OF GORDON M. SNOW, ASSISTANT DIRECTOR, FEDERAL BUREAU
OF INVESTIGATION, UNITED STATES DEPARTMENT OF JUSTICE,
WASHINGTON, DC
Mr. Snow. Good afternoon, Chairman Scott, Ranking Member
Gohmert and Members of the Subcommittee. I appreciate the
opportunity to testify before you today regarding the FBI's
efforts to combat cybercrime as it relates to social networking
sites.
Regardless of which social networking is used, online----
Mr. Scott. Mr. Snow, could you bring your mic a little
closer to you?
Mr. Snow. Regardless of which social networking site is
used, online users continue to be fooled by persons claiming to
be somebody else. Individuals can misrepresent everything about
themselves while they communicate online, their names and
business affiliations, and also their gender, age and location,
identifiers that are far more difficult to fake in person.
Years ago, we called these type of people ``confidence
men,'' or con men. Today, we refer to them as being engaged in
social engineering.
There are a variety of Internet fraud schemes being used by
cyber criminals at any given time. By way of example, a recent
fraud scheme involves a cyber criminal gaining access to an
unsuspecting users' e-mail account or social networking
account, claiming to be the account holder and sending messages
to many of the users' friends.
In the message, the con man states that he is on travel and
has been robbed of his credit cards, passport, money and cell
phone. He also states the need for money is immediate. Without
realizing the message is from a criminal, the victims of the
fraud account holder contacts often wires money to an overseas
account without validating the claim.
Another tool used by criminals to exploit social networking
sites is a technique called phishing. Phishing schemes attempt
to make Internet users believe that they are receiving messages
from a trusted source.
Phishing attacks on members come in various formats,
including messages within the social networking site, either
from strangers or from compromised friends' accounts, links or
videos within a social networking profile leading to something
harmful, or e-mails sent to users claiming to be from the
social network site itself.
Users fall victim to the schemes due to higher level of
trust typically displayed while using social networking sites.
Users often accept into their private sites people they do not
actually know, or they sometimes fail to set privacy settings
on their profile which might help avoid these attacks.
Cyber-thieves also used data mining techniques on social
networking sites to extract sensitive information about the
victims. For example, a ``Getting To Know You'' quiz sent to a
large list of social networking site users, while not appearing
malicious, may mimic the same questions that are asked by
financial institutions or e-mail account providers when the
individual has forgotten their password. An e-mail address in
the answer to the quiz questions can provide the cyber-criminal
with the tools to enter your bank account, your e-mail account
or credit card in order to transfer money or siphon off your
savings and investments.
The potential for considerable profits in this realm is
enticing young criminals and resulted in the creation of a
large economy known as the cyber-underground. The underground
is governed by rules and logic that closely mimic those of the
legitimate business world, including a unique language, a set
of expectations about its members' conduct, and a system of
stratification based on knowledge and skill, activities and
reputation.
Beyond cyber-crime, valuable national security information
can also be inadvertently exposed by military or government
personnel via their social networking site profile. In a
recently publicized case, an individual created a fake profile
on multiple social networking sites posing as an attractive
female intelligence analyst and extended friend requests to
government contractors, military and other government
personnel. Many of the friend requests were accepted. According
to press accounts, the deception provided its creator with
access to a fair amount of sensitive data, including a picture
from a soldier taken on patrol in Afghanistan that contained
embedded data identifying his exact location.
Mr. Chairman, the Department of Justice and the FBI, in
collaboration with our inter-agency partners, have been working
closely with the new cyber-security office at the White House
to address the President's national efforts to investigate and
prosecute cyber-crime. To this end, we have established cyber-
squads in each of our 56 field offices around the country, with
more than 1,000 specially trained agents, analysts and digital
forensic experts.
Still, we cannot combat this threat alone. Some of the best
tools in the FBI's arsenal are our longstanding partnerships
with federal, state, local and international law enforcement
agencies, as well as with private sector and academia.
These relationships include our partnerships with the
National White Collar Crime Center at the Internet Crime
Complaint Center, the National Cyber Forensic and Training
Alliance, and the InfraGard program. We also partner with the
Information Sharing and Analysis Centers and the National
Center for the Missing and Exploited Children.
Chairman Scott, Ranking Member Gohmert and Members of the
Subcommittee, in the interest of time today, I have touched
upon some of the more pervasive methods of criminal activity
via social networking. I would be more than happy to further
expand upon any of these issues during questioning, and I
appreciate the opportunity to come before you today and share
the work with FBI is doing to address the threat posed by
cyber-criminals in this country and around the world.
[The prepared statement of Mr. Snow follows:]
Prepared Statement of Gordon M. Snow
__________
Mr. Scott. Thank you, Mr. Snow.
We have been joined by the gentlelady from California, Ms.
Lofgren, who has taken a strong interest in this issue, and
thank you for coming.
Mr. Merritt?
TESTIMONY OF MICHAEL P. MERRITT, ASSISTANT DIRECTOR, UNITED
STATES SECRET SERVICE, UNITED STATES DEPARTMENT OF HOMELAND
SECURITY, WASHINGTON, DC
Mr. Merritt. Good afternoon, Chairman Scott, Ranking Member
Gohmert and other distinguished Members of the Committee. Thank
you for the opportunity to testify on the Secret Service's role
investigating cyber and computer-related crimes.
As the original guardian of the Nation's financial
infrastructure, the Secret Service has a long, distinguished
history of protecting American consumers and financial
institutions from fraud. Over the last 145 years, our criminal
investigators have confronted all types of financial fraud,
from paper to plastic to computer-based attacks targeting our
financial payment schemes.
In recent years, our investigations have revealed a
significant increase in the quantity and complexity of cyber
cases involving various computer networks in the United States.
Broader access to advanced computer technologies and the
widespread use of the Internet have fostered the growth of
transnational cyber criminals, which has resulted in a marked
increase in computer-related crimes targeting our Nation's
financial infrastructure.
Current trends show an increase in network intrusions,
hacking attacks, malicious software, and account takeovers,
resulting in data breaches affecting every sector of the
American economy. In addition, social networking sites have
become prime targets for cyber-criminals to expand their
prospects for facilitating malicious or fraudulent activity.
As documented in the 2010 Secret Service Verizon data
breach investigative report, the use of social engineering
tactics to obtain personally identifiable information has
increased. While cyber-criminals operate anonymously in a world
without borders, the law enforcement community is limited by
jurisdictional boundaries. Thus, the international scope of
these cyber-crime cases has increased the time and resources
required for successful investigation and adjudication.
In addition, the level of collaboration among these
transnational cyber-criminals has raised the complexity of
these cases and the potential for greater harm.
To address the emerging threats posed by these
transnational groups, the Secret Service has adopted a
multifaceted approach to investigating these crimes while
working to prevent future attacks. A central component of our
approach is the training provided through our electronic crime
special agent program. Today, roughly 1,300, or more than half
of our field office special agents, have received training in
forensic identification and the preservation and retrieval of
electronically stored evidence.
In addition, since 2008, the Secret Service, through the
National Computer Forensics Institute, has provided computer
forensics training to 836 state and local law enforcement
officials representing over 300 agencies from all 50 states and
two territories. As cyber-crimes continue to increase in size,
scope and depth, the Secret Service is committed to sharing
information and best practices with our law enforcement
partners, academia, and the private sector.
To accomplish this, we have established 29 electronic crime
task forces, including the first international task force,
based in Rome, Italy.
Currently, membership in our ECTFs includes approximately
5,500 partners from law enforcement and the private sector and
academia. These partners have access to the resources provided
through our international network of ECTFs. To coordinate these
investigations at the headquarters level, the Secret Service
has enhanced our cyber-intelligence section to focus on
generating new leads in support of our cyber-investigations.
The men and women who work in this section have been
instrumental in our success in infiltrating online cyber-
criminal networks around the world. These successful
investigations include two of the largest known network
intrusion cases to date, TGX and the Heartland Payment Systems
case. These intrusions resulted in the compromise of
approximately 40 million accounts and 130 million accounts
respectively and the indictment of dozens of suspects.
As detailed in my written statement, the Secret Service has
implemented a number of initiatives to combat the scourge of
cyber and computer-related crimes. Today, social networking
sites provide yet another target-rich environment for cyber-
criminals to exploit personal identifiable information.
Responding to the growth in these types of crimes and the
level of sophistication these criminals employ will demand an
increase in resources and greater collaboration between law
enforcement and the private sector. Accordingly, the Secret
Service will focus its resources on increasing public awareness
through education, providing training for our local law
enforcement partners, and adjusting our investigative
techniques to stay ahead of the criminal trends.
The Secret Service is committed to our mission of
safeguarding our Nation's critical financial infrastructure and
will continue to aggressively investigate cyber and computer-
related crimes to protect American consumers and financial
institutions from harm.
Chairman Scott, Ranking Member Gohmert and distinguished
Members of the Committee, this concludes my prepared statement.
Thank you again for this opportunity to testify on behalf of
the Secret Service. I will be pleased to answer any questions
at your convenience.
Thank you.
[The prepared statement of Mr. Merritt follows:]
Prepared Statement of Michael P. Merritt
__________
Mr. Scott. Thank you, Mr. Merritt.
Mr. Sullivan, I believe you came off a vacation to be with
us today. We certainly appreciate that. We certainly notice
that, and thank you for being with us.
Mr. Sullivan?
TESTIMONY OF JOE SULLIVAN, CHIEF SECURITY OFFICER (CSO),
FACEBOOK, INC., PALO ALTO, CA
Mr. Sullivan. Certainly. It is my pleasure to be here. So
thank you, Chairman Scott, Ranking Member Gohmert and
Subcommittee Members for this opportunity.
As Facebook's chief security officer, and as a former
Federal prosecutor who specialized in high-tech crime in
Silicon Valley, this topic has special meaning for me. At
Facebook, I work every day on developing high product security
standards, engaging people outside the company, such as
educators, parents, students and other Internet users, to learn
about and promote safe Internet practices. And I also work
closely with law enforcement around the world to help ensure
that those who are responsible for online abuse are held
accountable.
While the Internet now connects nearly two billion people,
until recently, it was a useful but very passive repository of
information. But in just a few years, it is really evolved to
an interactive social experience defined by your connections,
interests, and your communities.
These developments enlist people not just as passive
viewers but also as creators of online content, frequently in a
framework that is social and involves forums or communities
defined by people themselves. And since its creation, Facebook
has been at the forefront of this change, growing from a
network of students at a handful of universities to a worldwide
community.
Today, Facebook and other social technologies have the
power to enrich people's lives in ways that were unimagined
even 5 years ago. Facebook's become an invaluable communication
tool, allowing individuals to connect for myriad purposes, to
communicate with family near and far, for charitable causes, in
the political realm for grassroots organizing and for local
community-building.
In the same way that Facebook has brought innovation to
communication, on the security team and across the company, we
try and bring innovation to Internet security. We are
constantly working to enhance online safety and address new and
emerging security threats.
And because those efforts are frequently behind the scenes,
I particularly appreciate the opportunity to highlight a few of
them for you today. We believe that our proactive efforts and
innovations in security are the key to providing a positive
online experience.
In my written testimony, I focus on a number of different
areas. One of those important areas is key partnerships. As a
company, we reach out to law enforcement and Internet privacy,
safety and security experts everywhere to learn about best
practices and to build on them.
For example, last year we created a Safety Advisory Board
consisting of representatives from five of the leading online
safety organizations. And we have regular meetings with them
and almost daily feedback from them on things that we can do in
particular in the area of teen safety.
The Board has been a great resource. One example has been
their contributions to the improved safety and security
messaging that we have launched in the last few months.
I am also proud of the strong relationships with the law
enforcement agencies here at the table today. The FBI has long
been a leader in cyber-crime investigation, and we are working
closely with the FBI on several large, multi-jurisdictional
cases right now against malware distributors and spammers who
have attempted to take advantage of the scale of social
networking sites. We have also worked with them on child safety
cases.
And the Secret Service is resourceful and innovative not
only on the Internet threat cases that they prioritize, but
also on other types of electronic crime investigations where we
have turned to them for assistance.
Following up on the comments of Congressman Goodlatte,
before Facebook, I think the common wisdom was that the
Internet was a place where people should avoid using their real
names or sharing information. Facebook was the first major web
service that required people to build their profiles and
networks using real names, while at the same time giving them
privacy controls so that they can limit who accesses their
information.
This was an important policy and technical architecture
choice which both allowed people using Facebook to become more
connected and made the service safer. In a culture of authentic
identity, your actions are observed by your real-world friends,
and it makes Facebook less attractive to predators and other
bad actors. And to be honest, those people, they stand out like
sore thumbs on our site.
We also make it easier for people to control what they want
to share, with whom and when. In my written testimony, I give
several examples, both in the context of privacy and in
security, where we give people controls over who sees what and
how they manage the security of their account.
On the back end, we are also very proactive. So, for
example, we became a level one PCI-compliant company, meeting
heightened data security standards even though, as a business,
we don't even meet the standard of those requirements being
necessary for our business.
We will also develop proprietary technologies that allow us
to continuously improve on our online safety efforts. We
generally don't discuss the back-end algorithms and things that
we use in that context, but these technologies allow us to
perform ongoing authentication checks and also to engage our
users in types of community verification.
Our technology has also helped us to obtain and take legal
action against people who try to do things that they shouldn't.
Congress enacted the CAN-SPAM Act, and I am proud to say that
Facebook is responsible for the two largest judgments in the
history of that Act, $873 million against Adam Guerbuez and
$711 million against the notorious spammer, Sanford Wallace.
I see that my time is up, so I would just like to maybe go
on a little bit and mention that, as we come here today, I
think that security requires vigilance, and Congress has been
vigilant in enacting targeted statutes to address Internet
security problems. It is an ongoing chess match, and there is
more to be done.
A couple of examples of things where we hope to continue to
work closely with the government are building out that national
database of convicted sex offenders that was called for in the
KIDS Act that Congress passed a couple years ago. We need
access to that national database today. And if we had access to
it, we would use it.
We need continued investment in cyber-literacy in
particular for teens and parents. An example, to get really in
the weeds, is we need broader access to the hashes of known
images of exploitation of children. With these hashes, we would
be able to run that list against our site and identify any
known image of child pornography and make sure that it was not
on our service. Facebook is the largest photo-sharing Web site
on the Internet, and that type of technology would be very
helpful.
We also need, I think law enforcement to receive more
resources for training. They need better technology in the
office, and they need better training on how to, in particular,
work on the international cases.
Unfortunately, the vast majority of the significant cyber-
crime that is going on today is cross-jurisdictional, and it
brings up new challenges that law enforcement have not had to
deal with on a day-in, day-out basis. For example, collection
of electronic data can involve service of legal process in
multiple countries and numerous jurisdictions across the United
States. As a result, these cases move too slowly, and many
international cases never get prosecuted at all.
In conclusion, I would just like to say that Facebook has
always sought to provide a safer environment than was generally
available, and we will continue to innovate in order to enhance
the safety and security of our community of users.
And on behalf of Facebook, I thank the Subcommittee for its
leadership and dedication to Internet innovation and safety.
[The prepared statement of Mr. Sullivan follows:]
Prepared Statement of Joe Sullivan
__________
Mr. Scott. Thank you very much.
Mr. Rotenberg?
TESTIMONY OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC
PRIVACY INFORMATION CENTER (EPIC), WASHINGTON, DC
Mr. Rotenberg. Thank you, Chairman Scott, Ranking Member
Gohmert, Members of the Subcommittee. I appreciate the
opportunity to be here this afternoon.
My name is Mark Rotenberg. I am the executive director of
EPIC, and we are a leading privacy organization. We are
particularly concerned about the privacy issues related to
Facebook.
As you know, Facebook has become enormously influential on
the Internet. It has more than 500 million members. Someone
pointed out recently that, if it were a country, it would be
larger than the United States, Japan, and Germany combined. So
it is a very big player on the Internet.
At the same time, Facebook also has an enormous impact by
what it chooses to do or not do on the privacy of Internet
users. And when Facebook has changed its privacy policies and
the privacy settings of Internet users, it is raised real
privacy concerns.
In fact, my organization, EPIC, has filed two complaints at
the Federal Trade Commission resulting from these changes in
privacy settings because we believe they significantly
disadvantaged Internet users and created new risks to privacy.
Now, to be clear, the service is very useful. In fact, in
preparing for this hearing, I actually posted on my own
Facebook wall a question to Facebook users. I said, ``What
concerns do you have that I should share with Committee
Members?''
And many people responded, some who I know well, some who I
don't know particularly well, but the comments were helpful.
And I incorporated them in my prepared statement for you today
to give you some sense of the concerns that Facebook users
have.
And this point about changing the privacy settings came
back again and again and again. And I bring this to your
attention today, because I know in this discussion about the
risk of online victimization, which is a real threat,
oftentimes people talk about the need to better educate users,
to warn users about what they should or should not post.
And while I agree in some circumstances that is helpful,
user education can only go so far if a user has made a
determination not to disclose certain types of information to
certain organizations and the company in possession of that
information chooses to change the rules of the game.
User might say, for example, ``I don't want this
information to be widely available or searchable through an
Internet search engine. I only want these photos to be
available to my friends or family members,'' and then the
company says, ``Well, we have a transition now in the privacy
settings, and we are going to change those defaults a bit. And
if you want to change them back, you are always free to do
so.''
The point that I am trying to make is that these changes in
the privacy settings create risks for users that they really
cannot control. This is the reason that we went to the Federal
Trade Commission and urged the FTC to enforce the agreement
that users had with Facebook and other Internet firms to
respect their privacy settings.
Now, I am bringing attention to this FTC complaint because
I think it has some specific implications for what this
Committee might be able to do to address user concerns about
online privacy in the social network space.
Because the FTC has not acted on this complaint, it means
that the companies are able to continue to make these changes,
and that there is no recourse for users. And what I am
proposing, therefore, is that the Federal law that regulates
the disclosure of information by companies such as Facebook,
the Electronic Communications Privacy Act, be amended so that
these disclosures to third parties could not occur without
clear and affirmative consent.
In other words, if a person has chosen not to disclose
personal information to an application developer that is a
business partner, a Facebook or an Internet Web site that is
also a business partner of Facebook, that preference should be
respected. And if it is not respected, then I think it is
creating a significant risk to the privacy of users online.
Looking ahead, this is going to continue to be an important
concern for Internet users until we have comprehensive
legislation protecting people online.
Thank you very much for the opportunity to testify. I would
be pleased to answer your questions.
[The prepared statement of Mr. Rotenberg follows:]
Prepared Statement of Marc Rotenberg
__________
Mr. Scott. Thank you.
We have been joined by the gentleman from Illinois, Mr.
Quigley, so thank you for being with us.
Mr. Pasqua?
TESTIMONY OF JOE PASQUA, VICE PRESIDENT FOR RESEARCH, SYMANTEC,
INC., WASHINGTON, DC
Mr. Pasqua. Mr. Chairman, Ranking Member Gohmert and
Members of the Subcommittee, thank you for the opportunity to
appear here today and discuss this important topic. As a global
information security leader, Symantec welcomes the opportunity
to provide the Committee with our insights on how to keep
social network users safe online.
While social networking has provided many new benefits, it
has also opened new doorways for cyber-crime. It has expanded
online opportunities for the underground economy, which has
discovered that social networking pays.
The infiltration of communities and the spreading of spam
or malware have become a part of everyday life within social
networks, and that trend is increasing. The potential abuses
cyber-criminals have conceived are highly varied and range from
targeted spying, spam and phishing mail distribution to
exploitation of security holes within particular social
networking platforms.
Attacks against both social networking sites themselves, as
well as individual users of those sites, have now become
standard practice for criminals. Part of the reason for this is
that these sites combine two factors that make for an ideal
target for online criminal activity: a massive number of users
and a high level of trust among the users.
Social networks also provide a rich repository of
information cyber-criminals can use to refined their phishing
attacks. Many Internet users today are too blase about the
information they post on the web. Social network users should
always be cautious about the information they post online and
how it can be used.
In a rush to embrace the advantages of sharing information
on the Internet, many young people in particular have created
online data sets, or ``tattoos,'' that, much like the real
thing, are difficult to remove. Posting personal information
online can also leave them vulnerable to identity theft.
Details such as postal codes, birthdates, mother's maiden
names, can all be used by cyber-criminals to crack passwords,
hijack accounts, send out spam, and distribute malware.
In addition to the direct insertion of malware or the
distribution of mass mailings, cyber-criminals use social
networks to lure users to primed Web sites where they can steal
personal data so that they can sell it for profit. There has
been a marked increase in crimeware, or software used to
conduct cyber-crime, on social networks and elsewhere.
In 2009, Symantec created over 2.5 million new virus
signatures and discovered more than 210 million distinct
malware variants. That is a 56 and 75 percent increase,
respectively, over the same period in 2008.
And to put this in perspective, Symantec created more
malware signatures in the past 15 months than in the previous
18 years combined. So it is a massive, massive increase.
Attackers are now going directly after the end user and
attempting to trick them into downloading malware or divulging
sensitive information under the auspice that they are doing
something perfectly innocent. Social engineering's popularity
is at least in part spurred by the fact that the operating
system that a user is using or a browser is largely irrelevant.
It is the actual user that is being targeted, not necessarily
vulnerabilities in the machine.
To their credit, social network sites squash most threats
quickly, but it is not just targeted attacks you should be
worried about. It is adapted attacks. Adapted attacks occur
when bad guys take existing threats and use social networks to
increase the effectiveness of the attack through social
engineering. There is nothing like being surrounded by friends
to get you to lower your guard, and that is what they make you
think they are doing.
Given the potential for monetary gain from compromised
corporate intellectual property, cyber-criminals have also
turned their attention toward enterprises. Attackers are
leveraging the abundance of personal information openly
available on social networking sites to synthesize socially
engineered attacks on key individuals within targeted
companies. This can take into account position within the
company, colleagues, hobbies, places they have been, pictures,
etcetera.
I am just going to skip ahead a little bit and wrap up
because I see I am running low on time. But I will mention
that, according to a recent Symantec enterprise security
survey, most organizations do not have social networking policy
in place despite giving employees unfettered access to these
popular Web sites. Our survey also found that 84 percent of
CIOs and CISOs consider social networking sites to be a serious
threat to their security.
In closing, I have provided in my written testimony to the
Committee a number of useful precautions that all users of
social networks should consider in their use of this new
medium, and we all call this to the Committee's attention.
Mr. Chairman and Members of the Committee, Symantec
appreciates the opportunity to provide our input on combating
cyber-crime on social networks and protecting online privacy so
the Internet can reach its full potential. We look forward to
continuing to work with the Committee as it considers future
legislation in this area.
Thank you.
[The prepared statement of Mr. Pasqua follows:]
Prepared Statement of Joseph Pasqua
__________
Mr. Scott. Thank you. And I want to thank all of our
witnesses for their testimony. And we will now have questions,
and I will recognize myself first.
Are there laws in other countries that do not apply here in
terms of protecting people's privacy? Mr. Rotenberg?
Mr. Rotenberg. Maybe I should take this.
Mr. Chairman, part of our work at EPIC is looking at
different approaches to privacy protection. And I think it is
fairly well known that the Europeans have I guess we could say
a more comprehensive approach to privacy protection in that
companies that collect data on users have presumptive
obligations to protect the privacy of that information.
Here in the United States, we tend to do it on a sectoral
basis. We would legislate for a particular industry, for
example, like medical records, electronic health records.
I think what is important about this approach is that it
means that when companies like Facebook gather information on
users in other countries, they have to be more careful about
disclosure to other parties because they do run some risk of
stepping over the line on those more comprehensive privacy
laws.
Mr. Scott. I think, Mr. Rotenberg, you mentioned changing
security settings.
Mr. Rotenberg. Yes, the privacy settings.
Mr. Scott. And what allegation were you making there?
Mr. Rotenberg. Well, essentially that, for a person in the
United States who wants to protect their privacy on Facebook,
they have to go to a series of screens provided by Facebook and
make some choices. Do they want their photographs, for example,
to be available to everyone, or to their friends, or friends of
friends, or just a small group? And you make a lot of these
decisions about a lot of different information that you put
online.
Our objection is that, when the user makes those decisions,
and then Facebook comes along later on and says, ``Well, we
want to change our approach to privacy, and maybe you had your
photographs available only for family members but we are going
to change that setting to everyone,'' that is where the problem
arises. And that is actually the basis of most of the concerns
we think today that Facebook users have about privacy. It is
the changes in those settings.
Mr. Scott. Mr. Sullivan, did you want to respond to that?
Mr. Sullivan. Thank you, Chairman.
Our position on privacy hasn't changed. It is our belief
that people who use Facebook own their information, and they
have the right to share their information in the way that they
want to share it. And it is our responsibility to respect their
wishes.
On the subject of U.S. versus international laws, we
attempt to treat all of our users by one very high standard. We
don't differentiate between U.S. users and other users in terms
of presenting different standards to them or treat their
information with different levels of care.
Our approach has been to try and improve over time.
Facebook is a relatively new technology. As a company and a
product, we are 6 years old. And we are growing and learning
every day.
And the number one way that we learn is through feedback
from our users, and we are constantly innovating and trying to
learn from our users, and every innovation that we do is driven
by user feedback.
And in addition to innovating, the other thing we try and
pride ourselves on is responding quickly. So when we get
feedback that something isn't working right, we try and fix it
very quickly.
With regard to our privacy settings, we have spent a
considerable time and effort in the last year trying to make
them better and trying to make them easier to understand. I
feel very good about where our privacy settings are today, and
would love the opportunity to walk anyone through how those
settings work today.
We have a one-page that has all of your privacy settings on
it right now. We try and break it into three simple buckets--
your directory information, how you share information, and how
you share information with applications.
With regard to how you share information, it is literally a
one-click process, where you can go on the site right now and
say, ``I am not sure what my settings were for each different
thing that I posted, but right now I would like to make
everything I have ever put on the site friends-only.'' One
click, you can do that.
In addition, we know that people want flexibility, so we
have tried to build contextual messaging into our product so
that, at the time you make decisions about sharing, you can
customize the setting for that particular piece of information.
So if I want to share information about being in front of this
Committee today, I might want to share that only at work, or
maybe I want to share it with all of my friends. I have the
ability, one status update at a time, to change the setting to
direct it to different audiences.
Mr. Scott. I mean--I think, because sometimes people make
those choices, and Facebook comes behind and changes the
settings. Is that accurate?
Mr. Sullivan. No, that is not accurate.
Mr. Scott. Mr. Marc, do you want to make your statement?
Mr. Rotenberg. I am kind of astounded by Mr. Sullivan's
answer to your question. I mean, we have documented this in 50
pages to the Federal Trade commission, and it is discussed by
hundreds of thousands of Facebook users across the Facebook
platform. So maybe Mr. Sullivan would like to rethink how he
answered your question.
In fact, I think he should also rethink what he said
earlier in response to your question about the ability of users
to selectively disclose what information to make available
online. Facebook has an increasingly broad category of what it
considers to be publicly available information. That is the
information that the user really has no control over, even the
users who would like the highest level of privacy settings.
And it is clear to just about everyone what direction that
category is heading, which is to say that Facebook will simply
continue to make more user information available. So I think
maybe Mr. Sullivan would like to rethink that answer also.
Mr. Scott. Do you want to respond, Mr. Sullivan?
Mr. Sullivan. I am not interested in changing my answer. I
stand by it.
Mr. Scott. Gentleman from Texas.
Mr. Gohmert. Thank you, Mr. Chairman.
And appreciate all the witnesses being here and for the
testimony.
I am curious, Mr. Sullivan, what information would you
recommend not sharing on Facebook specifically?
Mr. Sullivan. Personally and as a company, we want people
to make those decisions for themselves.
Mr. Gohmert. Well, but I am asking you personally rather
than Facebook.
Mr. Sullivan. Well, personally, I choose to share quite a
bit of information through Facebook, and I put different levels
of visibility on different types of information.
My contact information I make available to my friends on
Facebook, so my friends can go on Facebook and see my e-mail
address, my phone numbers, my Instant Messaging identifiers and
things like that. The pages that I am a fan of, I am happy to
share that with other people because I like to interact with
people who are fans of the same sports teams that I am fans of,
etcetera. My--information--I am sorry.
Mr. Gohmert. Let me ask you, since our time is so limited,
what problems has China indicated that they have with Facebook
that would prevent them from allowing Facebook to be
accessible, that is?
Mr. Sullivan. To be honest, I don't think we have----
Mr. Gohmert. Well, I would prefer you be honest. Thank you.
Mr. Sullivan. I don't think we have received a clear answer
on that. My understanding is that it relates to our refusal to
moderate speech.
Mr. Gohmert. To moderate speech? So if somebody said
something unkind about China, they would want that moderated.
Is that correct?
Mr. Sullivan. It is a very sensitive issue that we spend a
good deal of time trying to make sure that we as a company
respect free speech rights of our users.
Mr. Gohmert. I will take that as a yes. Thank you.
Mr. Pasqua, I appreciate your being here. And I hadn't
bought a Symantec or Norton product in probably 10 or 15 years.
But there is a perception that, once information is put
into a social networking site, that it is there forever, and
there is just really not anything that can be done. Since you
have been in the security business with the software, is there
anything that can be done to actually pull stuff out once it is
in there?
Mr. Pasqua. The fact of the matter is, there really are a
lot of different sites out there, and they have different
capabilities. Obviously, Facebook is a major important one, but
there are certain types of information on certain sites that
you can remove. There are other types of information in other
sites where you really have very little control over pulling
back information once you have created that content.
So if you, for example, have a comment on a blog that is
controlled by someone else, you can't necessarily control
whether you can delete that comment, or change it or amend what
you have said. It is really up to the owner of that Web site.
Mr. Gohmert. Okay. Let me ask our Federal entities
representatives.
Mr. Snow, how easy is it to pass information about
questionable Internet activity to other Federal entities,
whether the NSA, CIA, Secret Service? How easy is it within the
FBI to do that?
Mr. Snow. Sir, from the FBI's position, it is very easy for
us to pass----
Mr. Gohmert. Well, I understand that is your position, but
from a factual standpoint, how easy is it?
Mr. Snow. Yes, sir. We right now--and the Chairman
originally discussed it somewhat--we have the National Cyber
Investigative Joint Task Force that has been designated by the
White House and----
Mr. Gohmert. No, no, I understand all that, but, you know,
I have enough friends that are Federal agents in all different
sectors, and I keep hearing about difficulty, even since we had
the big umbrella of Homeland Security, in communicating. In
fact, some say that it is even created more problems in getting
information from one to the other, because now it goes up
before it comes down and goes lateral.
So that is what I am asking, really from a practical
standpoint, how easy is it? If you see a problem, can you just
send that out to friends at Secret Service, or what do you have
to go through to get that done?
Mr. Snow. Absolutely, sir. Anything that I have, I can
pass, almost in real-time, depending on which systems are
linked or not linked. So at----
Mr. Gohmert. Do you need approval from anyone to do that?
Mr. Snow. Sir, I am the approving entity and individual in
the cyber division, so anything cyber-related would go through
me. But I also take a very strong approach, a proactive
approach, on pushing those approval processes down to my
workers and my operators out at the National Cyber
Investigative Joint Task Force.
Mr. Gohmert. Great.
Mr. Merritt, how easy is the flow, from your experience?
Mr. Merritt. Very easy, sir. I mentioned the cyber-
intelligence section within our criminal investigative
division.
Mr. Gohmert. Right.
Mr. Merritt. These are extremely talented, both agents and
contractors with superior computer and linguistic capabilities
who monitor, real-time, these codding portals we have talked
about, the codding Web sites.
And when, in fact, an anomaly appears or a malware, for
example, based on our electronic crimes task forces, we
distribute that information real-time to our members. In turn,
they channel it down their flow chains. To include, we have a
representative on each FBI joint task force, along with our
national Joint Terrorism Task Force, and we do have a member at
their NCIJTF.
So the big benefit of this, sir, would be the private
sector who are not seeing this. Some corporations are better
suited, with their analysts, to identifying anomalies and
intrusions more so than others, especially the medium to small
size companies. But we do have that ability, and we do do that.
Mr. Gohmert. Thank you.
Mr. Merritt. Thank you.
Mr. Gohmert. Mr. Pasqua, I didn't mean to be cryptic, but
it is been back when I was a judge in the 1990's, I personally
bought some Norton securityware. I had examined the boxes, all
of the properties. Norton seemed to have good qualities, but
they had a $20 rebate if you sent the original receipt. And I
did, kept all the copies of everything I sent, said wait 6
weeks.
I waited about 10 weeks, called, and the lady said, ``If
you don't have proof that we received it, then you have got
nothing.'' And I said, ``Well, I didn't send it certified
because that would have eaten up the $20.'' And I said, ``But I
have got copies of everything.'' She said, ``Too bad. We don't
take copies. It said that in the rebate. We got the original.''
So I have cost Symantec, because people know I am somewhat
literate in the area, lots more than $20, and it is too late to
send me my $20 now that I am in Congress. But anyway, that is
the reason I haven't bought anything from Symantec in years,
but I appreciate the time, and I yield back.
Mr. Quigley [Presiding]. The gentleman yields back.
The gentlewoman from California is recognized.
Ms. Lofgren. Thank you very much. And first, let me offer
my regrets for not being here at the beginning of the hearing,
because I would have liked to have given a word of welcome to
two of the witnesses who represent companies located in Silicon
Valley, which I represent in the House. And that is both the
Facebook witness and, of course, Symantec, both companies that
employ many of my constituents. So, welcome here.
As I think about the risks involved in use of technology, I
think of them in at least two categories. One, there is really
nothing the government can do about.
I mean, if you decide to post your home address on Facebook
and not limit who sees it, and then say, ``Oh, by the way, I am
on vacation for a month,'' it is like saying, ``Please come
burglarize me.'' So that is really an education issue that the
government, and I really think the companies, are not
responsible for. It is a matter of Americans understanding what
they are doing.
There is a second issue, which is really a technology
issue, which is allowing people the opportunity to have their
rights respected. And I wanted to address, really, two
questions, probably three questions, to Mr. Sullivan.
It has been mentioned here by EPIC, certainly a very well
regarded organization that I have supported for years, that the
settings are too tough and maybe not fully implemented. And I
have actually complained, most recently a few months ago, not
that you couldn't do it, but that it was too complicated.
And I suggested to the Facebook people I met with that you
need not the Geek Squad but the Granny Squad. I mean, design it
for, you know, a grandma in the Midwest so she can understand
it and make it do what she wants with very simple clicks.
Do you think you have accomplished that yet? I realize this
is really still a startup. I mean, even though you are at half
a billion, you know, it is 6 years, and you are still growing.
Mr. Sullivan. Thank you very much for that question. And I
think that it is something that we spend time thinking about
every day, because I think your goals and our goals are aligned
on this issue. We want people to understand and be able to use
the controls because they will feel good about our service. And
I think that the controls that we have in place now are the
best we have ever had.
And as I mentioned earlier, the controls that we launched
as a result of the feedback that we received from people like
you, we think that we have dramatically simplified so that
you--you know, as you know, before, you had to go to five or
six different screens to cover all the different types of
sharing that you could do, and now you can manage all of that
on a single page.
Ms. Lofgren. And maybe that you are not at liberty, and
this may not be a fair question, but if EPIC had some further
suggestions for you to consider to simplify this, would you
welcome those suggestions?
Mr. Sullivan. We certainly would. In fact, I would like to
mention that both before the large rollout that we did last
fall of trying to engage users on new privacy settings, and
during the spring we did reach out to a large number of
organizations outside the company that asked for feedback, and
we received feedback from a number of highly regarded
organizations across the nonprofit and public and private
sector.
Ms. Lofgren. Let me ask you two other questions, and this
is one really having to do with people who decide that Facebook
is too much trouble and they wanted to delete their account.
I mean, if you post somewhere else, I realize that is on
somebody else's Facebook and you can't necessarily get rid of
that. But if you close your own account, is every whisper of
information that you have lodged with Facebook erased with
that?
Mr. Sullivan. Yes.
Ms. Lofgren. And finally, I would like to make a
suggestion, unless this has already been implemented. There are
times when things go wrong.
For example, somebody has failed to take appropriate steps
to safeguard their Facebook account, and it gets hijacked.
There is nobody to call. I mean, you can send an e-mail, but it
takes a long time to be sorted out. Are there plans in place to
have kind of a rapid response when things of that nature occur?
Mr. Sullivan. Yes. It is another area where we are
continuing to innovate. What we have done is we have placed
``Report'' buttons across our site, and you should be able to
find them on basically every single page. And we have put those
buttons in places where we think that you are most likely to
run into a problem and would want to report something. And the
``Report'' button opens up a dialogue.
And like you said, I think in the old days of the Internet,
companies would have a single e-mail address, and all of the
issues would come into one big bucket, and then you have to
have someone sort it. The way we do it now is, during the
report process, we have some very easy drop-downs where a user
can specify what the specific issue is. And that directs it
into a prioritization queue.
And so, for example, the most serious issues we try and get
to within, you know, hours, most frequent----
Ms. Lofgren. What would a serious issue be, for example?
Mr. Sullivan. So, an identity theft or cyber-bullying, or a
threat to life or a potential suicide discussion, or something
like that.
Ms. Lofgren. Okay. Well, that is more serious than
hijacking a Facebook page. Where would that fall in your
priority list? How long would it take to respond to that, do
you think?
Mr. Sullivan. I think probably within 24 hours, but----
Ms. Lofgren. If I told you it was 3 weeks, would you be
willing to look into it?
Mr. Sullivan. I certainly would like to look into it.
Ms. Lofgren. I would appreciate that.
I realize my time is just about over, but before I did, I
just want to, since the Chairman didn't get his rebate, I would
like to say I just bought a Symantec product that I have
installed on my home computer, and it is protecting me from
viruses and malware, and I appreciate it very much, and love
your products.
And I yield back.
Mr. Pasqua. Thank you.
And Member Gohmert, I am sorry we lost you as a customer. I
hope we can win you back. But most importantly, I hope you are
using some sort of protection on your machine.
Mr. Quigley. The gentlewoman's time has expired.
Mr. Goodlatte from Virginia is recognized.
Mr. Goodlatte. Thank you, Mr. Chairman.
Folks, welcome. I missed most of your testimony because I
had to go deal with another Committee and some legislation I
had there. I apologize for that.
But I did want to ask Mr. Snow, with the many Federal
agencies involved in some aspect of identity theft or related
cyber-crimes, is there ever confusion on the part of the
private industry sector as to what agency they should call for
assistance or to report a breach? Do you have some kind of a
clearinghouse, or----
Mr. Snow. Yes, sir. Our most powerful clearinghouse is the
agent and investigators that are in the field. So all the
different agencies, federal, state and local, and our
international partners are out pushing the outreach programs.
We have three very strong outreach programs--the Internet
Crime Complaint Center, which is a public-private partnership;
our InfraGard program, and then our computer education and
development unit, which go out, along with our domain entities,
as to other Federal agencies and state and local partners to
let people know, if you have crime or you have crime reporting,
to come and talk to us.
The clearinghouse actually takes place back in the
investigative agencies along with where the different
jurisdictional lines reside. So for instance, if you had a
problem, an Internet breach, you could Google it. You would
come up with probably about five or six places to go report.
If you were directed to the FBI Web site, FBI.gov, you
would be directed back to the Internet Crime Complaint Center.
It would talk to you about what that crime complaint center
does, what it can provide you, and how to report. It would have
a very accessible link there.
The Internet Crime Complaint Center, if you started there,
would have the same issue and reporting mechanism. And then, we
have an educational partnership that is called www-
lookstoogoodtobetrue, and you would be able to go there, also.
An important part of the education, and I know we have
talked about the education, is that all three of these sites,
individuals that are suspecting that they may be subjects, or
potential subjects, which everybody is, of Internet fraud or
computer hacking, can sign up for informational alerts that
will come to whatever piece that you have.
Mr. Goodlatte. Thank you.
Mr. Sullivan, let me follow up on the question from Ms.
Lofgren regarding the privacy issues there. Can you explain
Facebook's privacy transition tool? How does this process
ensure that users are considering privacy issues in evaluating
their own security settings?
Mr. Sullivan. Certainly. So, last December, we took on I
think what was probably an unprecedented event in the history
of the Internet, and that is that we tried to engage every
single one of our users and make them think about privacy.
And so, what we did was we put that wizard, which was a
page that talked about privacy and laid out your settings and
what we were recommending as settings, in front of every single
user, and we simply wouldn't let you use the service again
until you walked through these pages and said, ``I want to do
it this way.''
And so, that was quite a massive undertaking, and it got
quite a bit of attention, and we were pleased in both regards
because we saw that users engaged with this wizard, that they
made decisions, that they talked about privacy, they thought
about privacy, they thought about what they put on the site
before. And they have continued to use the privacy settings
after that day even more than they ever did.
Mr. Goodlatte. What is instant personalization? I know that
Facebook has become a platform upon which you have invited
other vendors to build various tools that they can utilize as
members of Facebook. What assurances do you have that partner
sites in this program have sufficient protection to safeguard
Facebook users?
Mr. Sullivan. Sir, from the security standpoint, we focus
on a number of different things. This is a beta program that--
only used on a very limited number of carefully selected
partner sites at the moment.
And we have done a couple of different things. We have done
some external auditing of their security measures. I manage an
information security team that has investigative experts who
understand the different types of vulnerabilities the Web sites
have. We have made suggestions. We have had dialogue with their
internal experts.
And then, we also on the security side, we make suggestions
for requirements to put into the written contracts about the
standards that we expect those sites to live up to. So as I
mentioned earlier, we are PCI level one compliant, and there
are other security standards and acronyms that I won't share
today, but are the types of things that we would look for.
Mr. Goodlatte. One last thing. You indicated in your
testimony that you will use legal means to go after people that
are behind specific scams. Can you elaborate on this? Is it
civil actions that you will pursue, or do you assist law
enforcement authorities in pursuit of criminal charges, or
both? What are you talking about there?
Mr. Sullivan. So our goal is always to prevent something
bad from happening. But if it does happen our second goal is to
be incredibly aggressive.
And so, I mentioned in my written testimony in a bit
earlier a couple of the CAN-SPAM cases that we have brought.
And so, in these two cases that have received a decent amount
of attention in the mainstream press, they have actually
received even more attention in the forums where the bad guys
meet.
And we spend a lot of time on my team in those forums. Like
the folks at Symantec do, we spend a lot of time trying to
understand what the bad guys are interested in, what they are
focused on, which companies they are targeting, what their
newest techniques are.
And it has been fascinating for us to take back and share
with the company the impact of these spam cases. You know, we
certainly aren't going to collect $700 million from Mr.
Guerbuez or, you know, $800 million from Sanford Wallace, but
we are going to be pursuing them for the rest of their life,
and that is a heavy judgment hanging over their heads.
And you see people talking in these forums, saying, ``Don't
go after Facebook. That is a bad idea.'' So we do see a
deterrent effect in that type of civil action.
Likewise, on the criminal side, we have brought a number of
cases to both the FBI and the Secret Service over the last
couple of years where we have identified individuals or groups
that are attempting to target our users, whether through
distribution of malware or through spam or other types of
problems like that.
Mr. Goodlatte. Thank you.
My time has expired. Thank you, Mr. Chairman.
Mr. Quigley. Thank you.
Mr. Deutch is recognized.
Mr. Deutch. Thank you, Mr. Chairman.
Gentlemen, I think we need to do a better job of raising
awareness among Internet users, particularly children. While
most social networking activities are harmless, the fact is
there are people who are out there who are going to tell a lie
and hurt you.
And whether it is someone seeking easy money or a child
predator, when it comes to social networking, these criminals
know the game, and they are going to play it. I am deeply
concerned about the risks that the predators pose to children,
and I believe we need to do more to minimize the risks to
children online.
Education is a critical component of crime prevention. As a
parent, I am no stranger to the need to talk to children early
and often about online predators. Parents must play a critical
role to make them understand the risks that are out there.
Now, I applaud the efforts of the FBI, Secret Service and
other law enforcement agencies to protect children, but I think
everyone would agree, if even one child is victimized, we as a
government need to do more. And while we can't promise our
children that we are never going to let them down, we can at
least commit to not deserting them and focus on what additional
tools might be helpful.
To that end, as a Member of the Foreign Affairs Committee,
I am particularly interested in the international component of
this problem. Criminals thrive in areas where the government is
too blind to see. And while this is true of traditional
criminal activities, it is particularly true of Internet-based
crimes.
So how do we go after criminals who know the rules and
purposely set up shop in lawless areas or countries that are
willing to turn a blind eye to these activities? I guess, Mr.
Merritt and Mr. Snow, I would turn to you for this.
Mr. Merritt. Sir, I think somebody referenced it earlier,
some of the challenges when these crimes originate overseas and
they target either U.S. citizens or corporations, and then the
financial infrastructure. In addition to some countries that
don't have legislation that makes this necessarily a crime in
their country, there are other challenges, as well.
I mean, I think law enforcement here in the United States
has been able to dispel the myth of anonymity that the computer
and the Internet provide to the criminals because we have been
successful in many investigations identifying these people.
But you get into lack of legislation, countries that don't
have an extradition treaty with the states, the official
channels that we normally go through for MLATs and letters
rogatory are very cumbersome and time-consuming.
So a lot of it develops--and I will let Gordon speak for
himself, but it develops on the relationship that you have with
your foreign law enforcement counterparts and what you are able
to successfully do with them, because we obviously have limited
jurisdiction overseas.
Mr. Snow. Yes, sir. I will--the comments of Mr. Merritt.
The relationship internationally is just completely critical,
and in legislation development, which, you know, we don't speak
to but Department of Justice does, is also critical, the MLAT,
the letter rogatories, the officer-to-officer contact that we
have.
And then the private-public partnerships that develop when
you talk about child exploitation is critical also. So the
National Center for Missing and Exploited Children are really
doing some fantastic things in their public-private
partnership, along with the International Center for Missing
and Exploited Children.
Mr. Deutch. Thank you.
Mr. Sullivan, I am looking at the statement of rights and
responsibilities on Facebook, which says, very clearly, you
will not use Facebook if you are under 13. I would suggest to
you that there are more 60-, 70-and 80-year-old grandparents,
widows and widowers, with full, rich life histories who are, in
fact, 10, 11 and 12 years old on Facebook than you could even
imagine.
And I wonder, since Facebook very clearly says it should
not be used unless you are 13, what should we be doing? Do we
pretend that the younger kids aren't doing it? Is there
something Facebook can be doing to make it safer for those
younger kids, which is, I think, the approach that makes the
most sense to me? And have you tried to track the number of
pre-teens who are actually using Facebook, since the numbers
must be astounding?
Mr. Sullivan. Sir, you are right that our policy is very
clear, that we don't want people under the age of 13 to use our
service. And we have taken a multi-tiered approach to trying to
make that happen. And to the extent that you are aware, or if
you become aware of someone under the age of 13, or you know
their parents, I would ask that you put them in touch with me
or advise them not to use the service until they turn 13.
It is a topic that has received a lot of attention in
recent years, how do we address teens and youth online. And the
approach we have taken is kind of a three-tiered approach. I
think that we do focus on policy and we focus on education, and
then we build tools to try and prevent those under 13 from
using our site.
Mr. Deutch. I guess just if I may, Mr. Chairman, the last
question is there are two approaches. You can devote
considerable energy to trying to prevent 11-and 12-year-old
kids from using Facebook, or you can acknowledge that there are
thousands and thousands of 11 and 12 and 10, and I don't even
know how young, kids who are using Facebook, and ratchet up the
privacy levels or create a separate area for them. And is that
even part of your thinking, or is the focus entirely on keeping
them off?
Mr. Sullivan. Our focus right now is on keeping them off of
Facebook and on making Facebook as safe as possible for that 13
to 18 group that is on the site. And so, I mentioned earlier
that we don't have different rules for people in different
jurisdictions around the world. We do treat people differently
who are under the age of 18 in terms of what we would even
allow them to do on the site or the type of information that is
even made visible to them.
Mr. Deutch. Last question, Mr. Chairman. Do you deny access
to anyone--do you scan your members to find those who are
clearly describing life experiences in one way on their
biography, and then have pictures of little kids, lots and lots
of pictures of 10, 11 year olds on their site?
Mr. Sullivan. We do have some back-end tools and algorithms
that we use. We also rely on a considerably passionate user
community who is very happy to report other people to us. And
finally, we do use technology to, you know, try and identify
and make sure that those people aren't on our site.
Mr. Deutch. Okay. I think, finally, there is an obligation
also, as you work to address all of the concerns, if you know
that there are thousands of kids out there that, while the goal
may be to keep them off, we should be trying, and you should be
trying, to keep them safe, as well.
Mr. Sullivan. That is right.
Mr. Quigley. Gentleman's time has expired.
I would like to thank the witnesses for their testimony
today. Members may have additional written questions, which we
will forward to you and ask that you answer as promptly as you
can so that they may be made part of the hearing record. The
record will remain open for 1 week for submission of additional
material.
Without objection, the Subcommittee stands adjourned.
[Whereupon, at 3:35 p.m., the Subcommittee was adjourned.]
A P P E N D I X
----------
Material Submitted for the Hearing Record