    [Senate Hearing 112-167]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 112-167

     CYBER SECURITY: RESPONDING TO THE THREAT OF CYBER CRIME AND TERRORISM

    =======================================================================

                                    HEARING

                                   before the

                      SUBCOMMITTEE ON CRIME AND TERRORISM

                                     of the

                           COMMITTEE ON THE JUDICIARY
                              UNITED STATES SENATE

                          ONE HUNDRED TWELFTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 APRIL 12, 2011

                                   __________

                              Serial No. J-112-16

                                   __________

             Printed for the use of the Committee on the Judiciary

                                    _____

                      U.S. GOVERNMENT PRINTING OFFICE
    71-412 PDF                WASHINGTON : 2011
    -----------------------------------------------------------------------
    For sale by the Superintendent of Documents, U.S. Government Printing
    Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC
    area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC
    20402-0001

                           COMMITTEE ON THE JUDICIARY

                      PATRICK J. LEAHY, Vermont, Chairman
    HERB KOHL, Wisconsin                 CHUCK GRASSLEY, Iowa
    DIANNE FEINSTEIN, California         ORRIN G. HATCH, Utah
    CHUCK SCHUMER, New York              JON KYL, Arizona
    DICK DURBIN, Illinois                JEFF SESSIONS, Alabama
    SHELDON WHITEHOUSE, Rhode Island     LINDSEY GRAHAM, South Carolina
    AMY KLOBUCHAR, Minnesota             JOHN CORNYN, Texas
    AL FRANKEN, Minnesota                MICHAEL S. LEE, Utah
    CHRISTOPHER A. COONS, Delaware       TOM COBURN, Oklahoma
    RICHARD BLUMENTHAL, Connecticut
                Bruce A. Cohen, Chief Counsel and Staff Director
            Kolan Davis, Republican Chief Counsel and Staff Director
                                     ------

                      Subcommittee on Crime and Terrorism

                   SHELDON WHITEHOUSE, Rhode Island, Chairman
    HERB KOHL, Wisconsin                 JON KYL, Arizona
    DIANNE FEINSTEIN, California         ORRIN G. HATCH, Utah
    DICK DURBIN, Illinois                JEFF SESSIONS, Alabama
    AMY KLOBUCHAR, Minnesota             LINDSEY GRAHAM, South Carolina
    CHRISTOPHER A. COONS, Delaware
                    Stephen Lilley, Democratic Chief Counsel
                   Stephen Higgins, Republican Chief Counsel

                                C O N T E N T S

                                  ----------

                        STATEMENTS OF COMMITTEE MEMBERS

                                                                       Page

    Kyl, Hon. Jon, a U.S. Senator from the State of Arizona..........     3
    Whitehouse, Hon. Sheldon, a U.S. Senator from the State of Rhode
      Island.........................................................     1

                                   WITNESSES

    Baker, Stewart A., Partner, Steptoe & Johnson, LLP, Washington,
      DC.............................................................    29
    Martinez, Pablo A., Deputy Special Agent In Charge, Criminal
      Investigation Division, U.S. Secret Service....................     8
    Savage, John E., Professor of Computer Science, Brown University,
      Providence, Rhode Island.......................................    27
    Schneck, Phyllis, vice President and Chief Technology Officer,
      Global Public Sector, McAfee Inc., Reston, Virginia............    24
    Snow, Gordon M., Assistant Director, Cyber Division, Federal
      Bureau of Investigation........................................     6
    Weinstein, Jason, Deputy Assistant Attorney General, Criminal
      Division, U.S. Department of Justice...........................     4

                             QUESTIONS AND ANSWERS

    Responses of Stewart A. Baker to questions submitted by Senator
      Hatch..........................................................    38
    Responses of Pablo A. Martinez to questions submitted by Senators
      Whitehouse and Feinstein.......................................    39
    Responses of Pablo A. Martinez and Gordon M. Snow to questions
      submitted by Senators Hatch and Klobuchar......................    41
    Responses of Gordon M. Snow to questions submitted by Senators
      Feinstein, Whitehouse, Klobuchar and Hatch.....................    46
    Responses of John E. Savage to questions submitted by Senator
      Hatch..........................................................    56
    Responses of Phyllis Schneck to questions submitted by Senator
      Hatch..........................................................    59
    Responses of Jason Weinstein to questions submitted by Senators
      Hatch and Whitehouse...........................................    61

                           SUBMISSIONS FOR THE RECORD

    Baker, Stewart A., Partner, Steptoe & Johnson, LLP, Washington,
      DC.............................................................    63
    Global Energy Cyberattacks: ``Night Dragon'', McAfee Foundstone,
      February 10, 2011, report......................................    70
    Martinez, Pablo A., Deputy Special Agent In Charge, Criminal
      Investigation Division, U.S. Secret Service....................    89
    Savage, John E., Professor of Computer Science, Brown University,
      Providence, Rhode Island.......................................    98
    Schneck, Phyllis, Vice President and Chief Technology Officer,
      Global Public Sector, McAfee Inc., Reston, Virginia............   106
    Snow, Gordon M., Assistant Director, Cyber Division, Federal
      Bureau of Investigation........................................   120
    Weinstein, Jason, Deputy Assistant Attorney General, Criminal
      Division, U.S. Department of Justice...........................   130

     CYBER SECURITY: RESPONDING TO THE THREAT OF CYBER CRIME AND TERRORISM

                                  ----------

                            TUESDAY, APRIL 12, 2011

                                           U.S. Senate,
                           Subcommittee on Crime and Terrorism,
                                    Committee on the Judiciary,
                                                        Washington, DC.
        The Committee met, pursuant to notice, at 2:38 p.m. in room
    SD-226, Dirksen Senate Office Building, Hon. Sheldon
    Whitehouse, Chairman of the Subcommittee, presiding.
        Present: Senators Whitehouse, Feinstein, Klobuchar, Coons,
    Blumenthal, Kyl, and Hatch.

     OPENING STATEMENT OF HON. SHELDON WHITEHOUSE, A U.S. SENATOR
                     FROM THE STATE OF RHODE ISLAND

        Chairman Whitehouse. Good afternoon, everyone. Thank you
    all for being here. Today's hearing takes on a topic of vital
    importance: Cyber Security: Responding to the Threat of Cyber
    Crime and Terrorism.
        We live in the most connected and technologically advanced
    country in the world. Our electrical engineers, computer
    scientists, and technology companies have changed the way that
    the world does business, made our daily lives safer and more
    enjoyable, empowered free speech in repressive states, and
    brought the world closer together. These remarkable innovations
    unfortunately also have given criminals, terrorists, and
    hostile states new opportunities to steal American property,
    disrupt our way of life, and compromise our National security.
        American consumers are now subject to endless swindles
    achieved by spear phishing e-mails, malware that turns their
    computers into unwitting bots sending out malicious spam, or
    the many varieties of identity theft cooked up by cyber crooks
    to steal hard-working Americans' privacy and money.
        Our country's businesses likewise are under assault by
    foreign agents who seek to steal American intellectual
    property, a crime that has reportedly led to the loss of over
    $1 trillion of value to date; and by criminal hackers who seek
    to empty out corporate accounts or to blackmail companies by
    threatening to release stolen trade secrets. These crimes hurt
    companies' bottom lines and they rob us of American jobs,
    shuttering small businesses by stealing their core intellectual
    property, making a new product line unprofitable by letting a
    foreign company reap the benefit of American research and
    development, or even preventing the next great American company
    from bringing the next great innovation to market.
        Key elements of our Nation's critical infrastructure such
    as our electrical grid, financial services system, and
    telecommunications networks have been probed by malicious
    actors and in some cases compromised, with the possibility that
    hostile state actors have buried latent attacks that they can
    trigger when it would hurt us most. Even our Government,
    civilian, and military networks are under constant and
    successful attack.
        We need to do more to defeat the massive and worsening
    cyber threat. I am not alone in this belief. The Majority
    Leader has recognized that the Senate should act on cyber
    security legislation. The Commerce, Homeland Security,
    Intelligence, and Armed Services Committees have been hard at
    work. This Committee, under Chairman Leahy's leadership, has
    reported data breach legislation and last week held a hearing
    that has considered reform of the Electronic Communications
    Privacy Act. And we hope and expect the administration to weigh
    in shortly with its proposals to improve our Nation's cyber
    security.
        The Senate has important work ahead. It may be hard and
    complicated work, but I believe that we can accomplish this
    task in a bipartisan and well-considered fashion. I
    particularly look forward to working on this vital national
    issue with the Ranking Member of this Committee, Senator Jon
    Kyl.
        I know that this is a topic of serious interest and prior
    work for you, Senator Kyl, and I believe we will make a lot of
    progress together.
        I am very happy, for example, to be working with you to
    improve public awareness of the cyber security threats facing
    our Nation on a bill that I hope we can file shortly, and to go
    on to work on legislation to provide a safe space for joint
    defense by our private industries to take place.
        Today's hearing will explore the nature, scale, source, and
    sophistication of cyber attacks against consumers, Government
    agencies, and businesses and industries and compare that to the
    resources that our Government currently brings to bear on these
    attacks, as well as investigative and prosecutorial successes
    and limitations. And it will consider the ways in which the
    private sector is able to collaborate with law enforcement to
    defend against and respond to cyber attacks.
        We are lucky to have two very strong panels of expert
    witnesses from inside and outside the administration, including
    a distinguished professor from Brown University in my home
    State of Rhode Island, which I am happy to note is already at
    the forefront of the cyber security field. I thank all of the
    witnesses for being here today.
        Before I turn to Senator Kyl, let me flag my serious
    concern that our prosecutorial and investigative resources are
    not appropriately scaled to the threat we face. Even in this
    time of budget cutting, given the enormous stakes, the cyber
    threat is simply too dangerous to leave underresourced.
        Again, I thank the witnesses for being here and now turn to
    the Ranking Member, Senator Kyl, for his opening statement.
    Senator Kyl.

      STATEMENT OF HON. JON KYL, A U.S. SENATOR FROM THE STATE OF
                                ARIZONA

        Senator Kyl. Thank you, Mr. Chairman, not only for holding
    this hearing today but for the remarks that you just made.
        As one former member of the Intelligence Committee to
    another, I have been deeply impressed by your commitment to
    cyber security and your command of the associated issues and
    look forward to what will be the first of many hearings on this
    subject before this Subcommittee.
        I am also pleased to have been able to work with you to
    draft the forthcoming legislation that you mentioned regarding
    cyber security awareness. While this bill may be considered
    chiefly a place holder for things to come, I think it is an
    important step because of the multitude of topics that it
    covers, and that multitude speaks to a larger point and
    problem.
        I know of your frustration that Congress has waited for so
    long to get cyber security legislative proposals from the White
    House. This delay has complicated the Congress' task of passing
    comprehensive cyber security legislation. By my count, there
    are more than seven full committees on the Senate side alone,
    including the Judiciary Committee, that will be involved in
    drafting a comprehensive bill. This will take time, and we are
    long overdue for the President to share his proposals for cyber
    security legislation so that we can get started.
        I am eager to hear from our expert witnesses about how they
    think Congress should differentiate cyber crime and cyber
    warfare directed by a state or terrorist group, especially
    since, I would argue, it does not much matter if a crippling
    attack on our electric grid, banking system, or other critical
    infrastructure, or the wholesale theft of billions of dollars
    of U.S. intellectual property, defense related or purely
    commercial, is being directed by a cyber mafia or a cyber army.
    It is the responsibility of this Government to stop the attack
    either way. If we are just focusing on prosecuting these
    attacks of cyber crime, then I would say we have failed.
        So I look forward to the testimony of our witnesses, Mr.
    Chairman, and I hope there will be stimulating and informative
    rounds of questions thereafter. Thank you.
        Chairman Whitehouse. Thank you, Senator Kyl.
        If I could ask the witnesses to stand for the oath. Do you
    affirm that the testimony you are about to give before this
    Committee will be the truth, the whole truth, and nothing but
    the truth, so help you God?
        Mr. Weinstein. I do.
        Mr. Snow. I do.
        Mr. Martinez. I do.
        Chairman Whitehouse. Thank you very much. Please be seated.
        We will just go right across the table with the witnesses,
    beginning with Jason Weinstein. Jason Weinstein currently
    serves as Deputy Assistant Attorney General in the Department
    of Justice's Criminal Division where he oversees the Division's
    efforts to combat computer crime and intellectual property
    crime, as well as anti-gang and violent crime efforts and human
    rights and human-smuggling programs.
        Before joining the Criminal Division, Mr. Weinstein served
    as chief of the Violent Crimes Section of the U.S. Attorney's
    Office in Baltimore and before that as an Assistant United
    States Attorney in the U.S. Attorney's Office for the Southern
    District--the Sovereign District--of New York. We are delighted
    that he is here, and your full statement will be a matter of
    record, so if you could please make whatever statement you
    would like to make orally within the allotted time, I would
    appreciate that.

        STATEMENT OF JASON WEINSTEIN, DEPUTY ASSISTANT ATTORNEY
         GENERAL, CRIMINAL DIVISION, U.S. DEPARTMENT OF JUSTICE

        Mr. Weinstein. Thank you, Mr. Chairman. The Sovereign
    District of New York jokes got a lot funnier after I moved to
    Baltimore.
        Good afternoon, Chairman Whitehouse, Ranking Member Kyl,
    and other members of the Subcommittee, and I thank you for the
    opportunity to appear before you today.
        As we all know, the explosive growth of the Internet and
    other modern forms of communication has revolutionized nearly
    every aspect of our daily lives. But at the same time, it has
    also revolutionized crime, and increasingly the Internet has
    being exploited by criminals throughout the world to commit a
    staggering array of crimes.
        From around the corner or around the globe, skilled hackers
    work every single day, and many times every day, to access the
    computer systems of Government agencies, of universities,
    banks, merchants, and credit card companies to steal large
    volumes of personal information and to perpetrate large-scale
    data breaches that leave tens of millions of Americans at risk
    of identity theft.
        Our information infrastructure is under constant attack
    from these criminals as well as from terrorists and nation
    states that seek to exploit our dependency on information
    technology to threaten both our economic and our National
    security.
        So for these reasons, now more than ever cyber security has
    to be a national priority. This administration is committed to
    implementing a comprehensive framework that will allow us to
    bring all appropriate tools, criminal and otherwise, to bear
    against cyber criminals, terrorists, and other malicious
    actors. And the Department of Justice plays a critical role in
    that effort.
        The Justice Department works closely with our partners
    throughout the Government to support the Nation's efforts to
    support cyberspace, including by providing legal support and
    helping to ensure that we vigorously protect privacy and civil
    liberties. The Department also plays a leading role in
    counterintelligence and national security investigations that
    uncover threats to our computer networks from terrorists and
    state actors.
        But perhaps one of the Department's most important
    contributions to the Nation's overall cyber security is the
    investigation and prosecution of cyber criminals as we seek to
    incapacitate and punish the cyber criminals of today and to
    deter the cyber criminals of tomorrow. And in that important
    work, our prosecutors from the Criminal Division, from the
    National Security Division, and from the U.S. Attorney's
    Offices enjoy very strong relationships with our law
    enforcement agency partners, and in particular with the other
    two agencies represented on the panel with me today--the FBI
    and the Secret Service.
        Those strong relationships and the dedication and skill of
    our prosecutors and our agents have led to a number of major
    enforcement successes, including the following:
        In August of 2008, the Department, working with the Secret
    Service, announced one of the largest hacking and identity
    theft cases ever prosecuted, in which charges were brought by
    the U.S. Attorney's Offices in three different districts--
    Massachusetts, Southern California, and Eastern New York--
    against 11 members of an international ring responsible for the
    theft and sale of more than 40 million credit and debit card
    numbers that had been stolen from major retailers.
        The defendants were from all over the world--from the U.S.,
    from Estonia, Ukraine, China, and Belarus--and they included
    one of the world's top hackers, Albert Gonzalez. Gonzalez pled
    guilty to the charges and was sentenced to 20 years in prison,
    which is one of the longest sentences ever imposed in a hacking
    case.
        In November 2009, following a year-long investigation led
    by the FBI, the Department announced the indictment in the
    Northern District of Georgia of a hacking ring responsible for
    executing a global fraud scheme involving defendants from
    Estonia, Russia, and Moldova. The defendants were charged with
    hacking into a network operated by the credit card processing
    company RBS WorldPay, compromising its data encryption and then
    providing a network of cashers throughout the world with
    counterfeit payroll debit cards. Those cashers used those cards
    to withdraw over $9 million from more than 2,100 ATM machines
    in at least 280 cities worldwide, and they conducted that
    coordinated global cashing operation in less than 12 hours.
        Those cases as well as the others referred to in my written
    testimony illustrate the scope of the Department's efforts to
    pursue cyber criminals. But, significantly, they also reveal
    the global nature and the global reach that cyber criminals can
    have.
        The criminals responsible for those and other large-scale
    intrusions often live in and operate from foreign
    jurisdictions. It is often literally impossible to identify,
    arrest, and prosecute the offenders or to obtain critical
    evidence that we need to prosecute the offenders without the
    assistance of foreign law enforcement. And for that reason, our
    work does not stop at our shores.
        Due to the transnational nature of most cyber security
    incidents, continued close coordination and cooperation with
    our foreign partners is critical to our success. And in that
    connection, we rely on the International Convention on Cyber
    Crime to provide a framework for efficient cooperation among
    nations involving electronic crime.
        The Department is proud of these cases and all of our cyber
    security efforts, but there should be no doubt, as the Chairman
    and the Ranking Member said, that the cyber threats to our
    Nation are growing and evolving, and we must remain vigilant
    and prepared to confront them, and we will continue to work
    with our Government and private sector partners and the
    Congress to meet that challenge.
        Thank you for the opportunity to be here today to discuss
    this issue with you, and I would be pleased to answer your
    questions.
        [The prepared statement of Mr. Weinstein appears as a
    submission for the record.]
        Chairman Whitehouse. Thank you very much. We are delighted
    to have you with us.
        We will go on next to Gordon Snow, who is the Assistant
    Director of the Cyber Division at the Federal Bureau of
    Investigation. He was named section chief of the Bureau's Cyber
    Division on January 2008 and now leads the Division's Cyber
    National Security Section and the National Cyber Investigative
    Joint Task Force. From January 2008 to January 2009, he was
    detailed to the Director of National Intelligence on the
    National Counterintelligence Executive. During that assignment,
    he led the effort in drafting the goverment-wide Cyber
    Counterintelligence Plan under the Comprehensive National Cyber
    Initiative.
        Prior to that, Mr. Snow's work with the FBI took him to
    Afghanistan as the FBI's on-scene commander for the
    Counterterrorism Division, to Silicon Valley working on the
    High Value Computer Crimes Task Force, and to Yemen and East
    Africa.
        Thank you, Mr. Snow. Glad to have you with us.

        STATEMENT OF GORDON M. SNOW, ASSISTANT DIRECTOR, CYBER
               DIVISION, FEDERAL BUREAU OF INVESTIGATION

        Mr. Snow. Good afternoon, Chairman Whitehouse, Ranking
    Member Kyl, and members of the Subcommittee. I am pleased to
    appear before you today to discuss the cyber threats facing our
    Nation and how the FBI and our partners are working together to
    respond to the threat of cyber crime and terrorism.
        As the Committee is aware, cyber attacks have increased
    over the past 5 years and are expected to grow. We have reached
    the point that, given enough time and motivation and funding, a
    determined adversary will likely be able to penetrate any
    system that is accessible directly from the Internet. The FBI
    has identified the most significant cyber threats to our Nation
    as those with high intent and high capability to inflict damage
    or death in the U.S., to illegally obtain sensitive or
    classified information, or to illicitly acquire assets.
        I would like to focus my remarks today on a few of the many
    threats facing the private sector, including threats against
    infrastructure, intellectual property, individual businesses,
    and our partnerships to address these threats.
        U.S. critical infrastructure faces a growing cyber threat
    due to the advancements in the availability and sophistication
    of malicious software tools. The recent security breach by
    unauthorized intruders into the parent company of NASDAQ is an
    example of the kind of breaches directed against important
    financial infrastructure.
        Industrial control systems, which operate the physical
    processes of the Nation's pipelines, railroads, and other
    critical infrastructures, are at great risk of cyber
    exploitation.
        Similarly, new ``smart grid'' and ``smart home'' products
    could also be exploited by cyber criminals, nation states, and
    terrorists. These systems need to be developed and implemented
    in ways that will provide protection from unauthorized use.
        Intellectual property rights violations, including theft of
    trade secrets, digital piracy, and trafficking in counterfeit
    goods, also represent high cyber criminal threats, resulting in
    losses of billions of dollars in profits annually. These
    threats pose significant risk to U.S. public health and safety
    via counterfeit pharmaceuticals, electrical components,
    aircraft parts, and automobile parts.
        Cyber criminals are forming private, trusted, and organized
    groups to conduct cyber crime. The adoption of specialized
    skill sets and professionalized business practices by these
    criminals is steadily increasing the complexity of cyber crime.
        One facet of this are botnets, or networks of compromised
    computers controlled remotely by an attacker. Criminals use
    botnets to facilitate online schemes that steal funds or data,
    to anonymize online activities, and to deny access by others to
    online resources. The botnets run by criminals could be used by
    cyber terrorists or nation states to steal sensitive data,
    raise funds, limit attribution of cyber attacks, or disrupt
    access to critical national infrastructure.
        The potential economic consequences are severe. Often
    businesses are unable to recover their losses, and it may be
    impossible to estimate the damage. Many companies prefer not to
    disclose that their systems have been compromised, making it
    impossible to accurately quantify. Consequently, these damages
    estimates have ranged from millions to hundreds of billions.
        Thanks to Congress and the administration, the FBI is
    devoting significant resources to this threat. Our partnerships
    with industry, academia, and across all of government have led
    to a dramatic improvement in our ability to combat this threat.
        The FBI's statutory authority, expertise, and ability to
    combine resources across multiple programs make it uniquely
    situated to investigate, collect, and disseminate intelligence
    about and counter cyber threats from criminals, nation states,
    and terrorists.
        The FBI has cyber squads in each of its 56 field offices,
    with more than 1,000 advanced cyber-trained FBI agents,
    analysts, and forensic examiners.
        However, the FBI cannot combat the threat alone. Through
    the FBI-led National Cyber Investigative Joint Task Force, we
    coordinate our efforts with over a dozen Federal partners
    throughout the intelligence community and the Department of
    Defense. We also partner through NCIJTF with other Federal law
    enforcement agencies to include most prominently the United
    States Secret Service. The FBI has also embedded cyber staff in
    other intelligence community agencies through joint duty and
    detailee assignments.
        In addition to our 61 legal attaches overseas, we currently
    have FBI agents embedded full-time in five foreign police
    agencies to assist with cyber investigations. These cyber
    agents have identified organized crime groups, supported FBI
    investigations, and trained foreign law enforcement officers
    for more than 40 nations.
        InfraGard is a prime example of the success of public-
    private partnerships. Under this initiative, private industry
    leaders work with the FBI to ward off attacks against critical
    infrastructure. Over the last 15 years, this initiative has
    grown from a single chapter to more than 86 chapters in 56
    field offices with 42,000 members.
        In addition to InfraGard, the FBI partners with the
    National White Collar Crime Center and the Internet Crime
    Complaint Center and the National Cyber Forensic and Training
    Alliance. We also partner with the information-sharing and
    analysis centers through the Department of Homeland Security
    and the National Center for Missing and Exploited Children.
        Chairman Whitehouse, Ranking Member Kyl, and members of the
    Subcommittee, in the interest of time today, I have touched
    upon a few of the more significant cyber threats facing our
    Nation. I appreciate the opportunity to come before you and
    share the work the FBI and our partners in the community are
    doing to address the cyber threat in this country and am happy
    to answer any questions you may have.
        [The prepared statement of Mr. Snow appears as a submission
    for the record.]
        Chairman Whitehouse. Thank you, Assistant Director Snow.
        Our next witness, Pablo Martinez, is Deputy Special Agent
    in Charge of the Criminal Investigation Division, Cyber Crime
    Operations, at the United States Secret Service. In this
    capacity, he develops and implements policy for all cyber
    investigations conducted by the Secret Service. Mr. Martinez
    began his career at the Service in 1991, and in 1999 was
    transferred to the Presidential Protective Division. In 2003,
    Mr. Martinez was promoted to the supervisory ranks of the
    Criminal Investigative Division, where he was tasked with
    expanding the Service's Electronic Crimes Task Force. During
    that time, he oversaw the first major cyber operation conducted
    by the Secret Service, Operation Firewall, in which over 30
    online criminals were apprehended worldwide in a simultaneous
    round-up.
        Glad to have you with us, Agent Martinez.

    STATEMENT OF PABLO A. MARTINEZ, DEPUTY SPECIAL AGENT IN CHARGE,
          CRIMINAL INVESTIGATION DIVISION, U.S. SECRET SERVICE

        Mr. Martinez. Good afternoon, Chairman Whitehouse, Ranking
    Member Kyl, and distinguished members of the Subcommittee.
    Thank you for the opportunity to testify on the role of the
    Secret Service in cyber investigations.
        On February 1, 2010, the Department of Homeland Security
    delivered the Quadrennial Homeland Security Review, which
    established a framework for homeland security missions and
    goals. I would like to share just a few sentences from the QHSR
    because it underscores the need for a safe and secure
    cyberspace:
        ``As we migrate more of our economic and societal
    transactions to cyberspace, these benefits come with increasing
    risk. We face a variety of adversaries who are working day and
    night to use our dependence on cyberspace against us.
    Sophisticated cyber criminals pose great cost and risk both to
    our economy and national security. They exploit vulnerabilities
    in cyberspace to steal money and information, and to destroy,
    disrupt, or threaten the delivery of critical services.''
        In order to maintain a safe and secure cyberspace, we have
    to disrupt the criminal organizations and other malicious
    actors engaged in high consequence or wide-scale cyber crime.
        To address the threats posed by these transnational cyber
    criminals, the Secret Service has adopted a multi-faceted
    approach to investigate these crimes while working to prevent
    future attacks. A central component of our approach is the
    training provided through our Electronic Crimes Special Agent
    Program, which gives our special agents the tools they need to
    conduct computer forensic examinations on electronic evidence
    obtained from computers, personal data assistants, and other
    electronic devices. To date, more than 1,400 special agents are
    ECSAP trained. In fact, the Secret Service values this training
    so highly that the basic level is now incorporated as a part of
    the curriculum that all special agent trainees receive at our
    James J. Rowley Training Center.
        In addition, since 2008, the Secret Service has provided
    similar training to 932 State and local law enforcement
    officials, prosecutors, and judges, through the National
    Computer Forensics Institute, located in Hoover, Alabama. The
    Secret Service's commitment to sharing information and best
    practices with our partners, the private sector, and academia
    is perhaps best reflected through the work of our 31 Electronic
    Crime Task Forces, including two located overseas in Rome,
    Italy, and London, England.
        To coordinate these complex investigations at the
    headquarters level, the Secret Service has enhanced our cyber
    intelligence section to identify transnational cyber criminals
    involved in network intrusions, identity theft, credit card
    fraud, bank fraud, and other computer-related crimes. In the
    past 2 years, CIS has directly contributed to the arrest of 41
    transnational cyber criminals who were responsible for the
    largest network intrusion cases ever prosecuted in the United
    States. These intrusions resulted in the theft of hundreds of
    millions of credit card numbers and the financial loss of
    approximately $600 million to financial and retail
    institutions.
        As an example, the partnerships developed through our
    ECTFs, the support provided by our CIS, the liaison established
    by our overseas offices, and the training provided to our
    special agents via ECSAP were all instrumental to the Secret
    Service's successful investigation into the network intrusion
    of Heartland Payment Systems. The August 2009 indictment
    alleged that a transnational organized criminal group used
    various network intrusion techniques to breach security,
    navigate the credit card processing environment, and plant a
    collection device to capture payment transaction data.
        Our investigation revealed data from more than 130 million
    credit card accounts were at risk of being compromised and
    exfiltrated to a command and control server operated by an
    international group. Furthermore, the Secret Service uncovered
    that this international group committed other intrusions into
    multiple corporate networks to steal credit and debit card
    data.
        As a result of our investigation, the three suspects in the
    case were indicted for various computer-related crimes. The
    lead defendant in the indictment pled guilty and was sentenced
    to 20 years in Federal prison. This investigation is ongoing
    with over 100 additional victim companies identified. The
    Secret Service is working with its law enforcement partners
    both domestically and overseas to apprehend the two defendants
    who are still at large.
        Chairman Whitehouse, Ranking Member Kyl, and distinguished
    members of the Subcommittee, the Secret Service is committed to
    our mission of safeguarding the Nation's cyber infrastructure
    and will continue to aggressively investigate cyber and
    computer-related crimes to protect American consumers and
    institutions from harm.
        This concludes my prepared statement. Thank you again for
    this opportunity to testify on behalf of the Secret Service.
        [The prepared statement of Mr. Martinez appears as a
    submission for the record.]
        Chairman Whitehouse. Thank you, Agent Martinez. I
    appreciate having you here.
        One of the purposes of this hearing is to look into the
    comparison between the size of the threat and the resource that
    is dedicated to it, and if I may, Mr. Weinstein, let me ask--I
    have some numbers here about Criminal Division deployment at
    the Department of Justice. And just by way of comparison, we
    have looked at OCDETF, the Organized Crime Drug Enforcement
    Task Force program; we have looked at the Organized Crime Task
    Force, dedicated to traditional Mafia organized crime; and we
    have looked at the cyber staff. And the numbers that I have are
    that there are just under 90 attorneys in the Criminal Division
    dedicated to traditional organized crime. There are 13
    attorneys in the Criminal Division dedicated to the OCDETF
    program, but the OCDETF program is very much a field-based
    program, and so they are sort of the local touch point for over
    1,000 staff out in the field, including more than 550 attorneys
    out in the field. So it is a pretty robust field program behind
    those 13 attorneys at Main Justice.
        In the context of that range, we have been told that there
    are 40 attorneys in the Criminal Division who are dedicated to
    computer intrusions and other hacking cases. There are
    additional attorneys who are dedicated to child exploitation,
    to appellate cases, to other crimes that may have a computer
    component but are not the direct hacking cases.
        It strikes me that if the numbers are correct that there is
    as much as $1 trillion, I contend that we are on the losing end
    of the biggest transfer of wealth in the history of humankind
    through theft and piracy in this country right now, that it is
    being done through cyber crime, and that it is a very, very
    significant national security and economic challenge.
        Senator Feinstein and Senator Kyl and I all have also
    served on the Intelligence Committee, and while much of what we
    know from that Committee is classified, in the public hearing
    the Director of National Intelligence Jim Clapper listed the
    national security threats that he felt he was obliged to
    address as the new DNI, and he put cyber security No. 1 above
    everything else.
        And so that was kind of noteworthy, and in that context it
    strikes me that having fewer attorneys dedicated to computer
    intrusions at Main Justice than are dedicated to old-fashioned,
    traditional organized crime is a sign that we here in Congress
    need to provide you with more resources to focus on the cyber
    threat.
        What is your sense of that?
        Mr. Weinstein. Let me, before I answer your question, put
    those numbers in a little bit of context.
        You are right in observing that the OCDETF program is
    mostly a field-based program, so it is not unexpected that that
    is a relatively low number dedicated to that.
        The organized crime number which you quoted, which is about
    89 attorneys, actually it was organized crime broadly defined.
    That is to say, it is traditional organized crime like LCN,
    Mafia-type cases; it is gang cases; it is drug-related
    organized crime like drug cartel cases, which are pursued as
    enterprises; and it includes international organized crime. And
    in that sense, especially with international organized crime,
    there is some overlap with our cyber security and cyber crime
    efforts.
        I actually also, along with another Deputy AG, oversee the
    organized crime program, and increasingly the priority of our
    international organized crime program is to go after
    transnational crime groups that involve cyber threats. So there
    is some overlap.
        The other thing I would add is that the 40 attorneys that
    you quoted that are cyber specific, those are the attorneys who
    are in the Computer Crime and IP Section, which I have had the
    honor to supervise. There are a substantial number of other
    attorneys, like in the Fraud Section, who also in the course of
    their fraud work focus on fraud cases that have a cyber
    component.
        Having said all that, it is really undeniable that the
    scope of the problem, which is growing every day, far outpaces
    the resources that are available to pursue it currently. And so
    I think that this is the kind of problem that takes a dedicated
    stream of resources, but it also takes dedicated training and
    expertise so we can keep pace with the methods that our cyber
    actors are using.
        I would add that in the President's 2011 budget, which I
    think now is a collector's item, there was a request for four
    additional cyber attorneys. In the 2012, there is actually a
    request for six, and those six attorneys are CHIP prosecutors,
    computer hacking and IP prosecutors. But for the first time,
    they will be CHIP prosecutors who are placed overseas, I think
    to reflect the recognition that fighting this problem requires
    going beyond our borders to do it.
        The President's proposal, the President's budget proposal,
    would put six of these CHIPs, who we would call ICHIPs,
    international CHIPs, in regions throughout the world that have
    a high concentration of cyber crime and IP theft activity so
    that they can not only help American prosecutors at home on
    their cases but also help those contractors beef up their own
    capacity to pursue cyber criminals in their own borders.
        Chairman Whitehouse. My time has expired, but let me ask
    just one more question before I turn to Senator Kyl because
    there is also field staff, attorneys out in the U.S. Attorneys'
    Offices, who are dedicated to this. But it is my understanding
    that the--if you could confirm this, it is my understanding
    that the AUSAs who are your cyber designees are obliged to
    participate in conferences on cyber, be a point of contact for
    the office on cyber; if there are conference calls, they are
    the person for the office who would participate, but they need
    not direct their prosecutive attention to cyber cases. They are
    to be deployed as the U.S. Attorney and the first assistant and
    the head of the Criminal Division see fit, and in that sense it
    is something of an overcount to describe them as full-time--it
    would be something of an overcount to describe them as full-
    time cyber prosecutors, would it not?
        Mr. Weinstein. I think, Senator, it depends on where--Mr.
    Chairman, it depends on where they are. In some districts,
    especially districts with very active FBI or Secret Service
    cyber squads in them, and with a heavy concentration of these
    cases, the CHIP prosecutors work exclusively on those cases.
        Chairman Whitehouse. But in some they may not----
        Mr. Weinstein. Some districts they may not. And the role
    really has three or four aspects to it. One is to work on this
    case----
        Chairman Whitehouse. Well, since I am over my time----
        Mr. Weinstein. OK.
        Chairman Whitehouse [continuing]. And since I have my
    Ranking Member waiting, let me--we can pursue that in the----
        Mr. Weinstein. OK.
        Chairman Whitehouse [continuing]. Later discussion.
        Senator Kyl.
        Senator Kyl. Well, thank you, Mr. Chairman. These are all
    right-on questions, and in a related area, it is not only
    resources but also authority.
        Agent Martinez, I would like to ask you a question about
    comments you made in your testimony in which you referred to
    going dark, the going-dark problem, whereby there is a gap
    between the legal authority that you have to intercept
    electronic communications and the provider's practical ability
    to intercept those communications. And you quoted and endorsed
    the statement by the FBI Chief Counsel, who had testified in
    the House of Representatives, that there is--excuse me. She
    said, ``There are significant law enforcement challenges in
    light of the pace of technological advancements.''
        Are there specific tools that you think Congress could
    provide you and your counterparts in domestic law enforcement
    and intelligence to better mitigate this problem? Can you share
    them with us today? If not, could I ask all three of you really
    to provide to this Committee your proposals for improving the
    authorities that all of you need to tackle the problems that
    you have identified here today?
        Mr. Martinez. Yes, Senator Kyl, we did endorse Chief
    Counsel's statements on that. We believe that cyber criminals
    are at the tip of the spear when it comes to exploiting
    technology. The types of communications that cyber criminals
    use or have been using for many years are now just starting to
    come into the forefront of crimes being committed by
    traditional criminals. So cyber criminals have been using
    instant message, have been using VOIP systems, have been
    communicating via the computer for many, many years, and we
    believe as technology continues to develop you are going to
    continue to see cyber criminals exploiting that capability
    because they seem to have the most knowledge when it comes to
    utilizing devices like that.
        I believe right now there are several working groups that
    have been established, you know, at the request of the
    administration, both at the legislative level and at the
    technical working group level. The Secret Service participates
    in a technical working group being led by the FBI, and we are
    in the process right now of finalizing some of our
    recommendations that I believe the administration is looking to
    put forward.
        Senator Kyl. Great. We will appreciate that, hearing from
    FBI, Justice Department, and Secret Service, whomever, to
    assist us in giving you the authority you need.
        Assistant Director Snow, I would like to ask you, could you
    explain the FBI's role in the so-called Team Telecom? And then
    I've got a couple specific questions about what I understand
    that team is engaged in, the advisory role to the Federal
    Communications Commission by the FBI. Is that not a term you
    are familiar with?
        Mr. Snow. Sir, I apologize. It is not a term I am familiar
    with. It usually runs out of our Operational Technology
    Division, which would, along with our Office of General
    Counsel----
        Senator Kyl. OK. Well, let me just ask you to generally
    describe concerns that you all have about telecommunications
    computers that have links to foreign governments or foreign
    militaries providing telecommunications equipment, software,
    network management services and the like here in the United
    States.
        Mr. Snow. Sir, I guess the best way to answer that is in
    another forum we could probably go more in-depth, and I would
    be more than willing to provide you the personnel and myself
    and availability to address those questions.
        Senator Kyl. Well, is it fair to say that there is a
    significant concern about this and that you do play a role,
    that the FBI does play a role along with other intelligence
    services in advising our Government departments with respect to
    these threats?
        Mr. Snow. Yes, sir, absolutely. Always a concern from any
    facet, a country adversary that comes in and that would either
    manipulate or use our supply chain to our disadvantage. So if
    so many things in the supply chain, whether it is a counterfeit
    part, a counterfeit CHIP, something that could be implanted, an
    executable piece of malware, a piece of additional code that
    would be in our telecom system.
        Senator Kyl. When you review the offer of such a company to
    open themselves up to third-party or independent review to deal
    with those supply chain kinds of problems, is it possible for
    you to go through millions of lines of software code to make
    100 percent certain that there is not anything malicious built
    in that is capable of being activated at a moment of a cyber
    criminal's or cyber warrior's choosing?
        Mr. Snow. I do not think, sir, that we have that capability
    right now in the U.S. Government to go through millions of
    lines of code. It is very work intensive. I think we know that
    code now is cobbled together from many pieces. I think
    sometimes even the programmers and people that design that code
    are not even sure what is in that code. They will use other
    pieces, freely available pieces on the outside to assemble that
    program. And we do provide under the CFIUS process counsel,
    guidance, direction, and information to the decisionmakers
    across the Government in order to make those decisions, along
    with the Department of Justice that runs the CFIUS program.
        Senator Kyl. I appreciate it. Thank you.
        Chairman Whitehouse. Senator Coons.
        Senator Coons. Thank you, Senator, and thank you to both
    Senator Whitehouse and Senator Kyl for convening this hearing
    today, and to our panel.
        You have all testified to the different ways in which your
    respective agencies are working together with State and local
    law enforcement, and to some extent, the private sector, the
    intelligence agencies, and our armed forces to combat cyber
    crimes, and I am just interested initially in your opinion
    whether States and local law enforcement have the right
    resources, have the right training, have the right capabilities
    to buildup their investigative capabilities as well as their
    defensive capabilities.
        You made reference, Agent Martinez, in your testimony to
    the National Computer Forensics Institute and where the 900
    folks have been trained. I think that is a great start. There
    was also a reference, I think by Mr. Snow, to 42,000 members of
    the FBI's InfraGard.
        If you could, in order to speak to the training standards
    we are trying to hit, the resources State and local law
    enforcement and Government have, and what additional resources
    do we need in order to be able to develop a nationwide
    professional cadre of folks in law enforcement, in the
    intelligence community, and, frankly, in the private sector?
    Please.
        Mr. Martinez. Thank you, Senator. From our perspective in
    law enforcement, what we have basically done is taken our ECSAP
    model--that is a three-tier model, BICEP, NITRO, and computer
    forensics--and we have mirrored that curriculum at the National
    Computer Forensics Institute where we not only teach law
    enforcement but also prosecutors and judges. We are firm
    believers that you not only have to train the agents or the law
    enforcement officers, but you have to make sure that they can
    explain or they can articulate in a layman's term the case to a
    prosecutor who can then also explain the facts in layman
    fashion to a judge who you are going to have to get the
    warrants signed to. So that is why it has been--it is important
    for us to train all three aspects.
        So far, like I stated in my statement, we are over 900. We
    are looking to try to expand the amount of law enforcement
    personnel that we train. What we try to focus on, since we have
    the 31 Electronic Crime Task Forces, we try to focus on
    individuals who are members not only of our task force, but
    potentially a State and local cyber task force or an FBI task
    force because they are in the most need of having this
    specialized training. We believe that by doing that we are
    multiplying our resources, and we can force multiply and work
    investigations not only at the Federal level but at the State
    and local level.
        And like I said, we continue to work with these partners at
    the State and local level to try to get them a better
    understanding of some of the issues with cyber crime and some
    of the ways to tackle the problem.
        Senator Coons. Mr. Snow.
        Mr. Snow. Sir, as Mr. Martinez talked about, the good news
    portion of the story is that we are making progress on trying
    to help assist and train those personnel. I think inwardly,
    though, if we are more reflective, it is a difficult task to
    make sure that all our personnel are trained, not only that
    they are trained but what is the process that we used in order
    to make sure that we keep them current and how we retain those
    personnel.
        So I would not want to classify all State and local law
    enforcement officers as being in the position we were in about
    10 years ago. We talked recently about the going-dark issue,
    and we also talk about how difficult it is to bring those
    people up to speed. But I would say--because I know we have
    very talented individuals from State and local entities that
    are in our regional computer forensic labs that are run
    nationally across the country.
        However, many of those departments and agencies, you know,
    hundreds of thousands of sworn law enforcement officers across
    the country, have a difficult time coming up with that money,
    that training, the availability of their personnel as they try
    just to meet hiring and payrolls.
        Senator Coons. And if I could, just a follow-on question to
    the Deputy Assistant Attorney General, Mr. Weinstein. One of
    the areas I am most concerned about is intellectual property
    theft, particularly trade secrets. American companies are some
    of the most innovative in the world. In your written testimony,
    there was an example of a successful theft from Dow Chemical
    that had significant long-term consequences for them.
        Where are we in terms of providing coordination, resources,
    and standards for training that will help the private sector
    understand how to defend against these threats and then the
    prosecutorial resources to, as you put it, once these better
    locks are broken, actually then capture the CMS who have broken
    them?
        Mr. Weinstein. Well, Senator, perhaps in IP crime, unlike
    any other type of crime, we rely heavily on the victim
    companies to report the crimes to us and to be able to
    recognize them when they occur, then to provide us with access
    to the information we need to successfully investigate and
    prosecute them.
        One of the things that CCIPS does in conjunction with the
    CHIP prosecutors throughout the country is conduct extensive
    outreach with potential victim companies in various regions. In
    the Pacific Northwest it might be Microsoft, or computer
    companies in Delaware and other States, it may be, you know,
    companies that are the significant industries in those States.
    And what we try to do is explain to them where the risks are,
    how to recognize when there is a potential trade secret theft
    or other IP crime, and then how to make a referral to us,
    either to us directly or to the FBI or to the IPR Rights
    Center, which is jointly operated by ICE and by the FBI.
        So we do that nationally, and we do that regionally. We go
    region by region throughout the country to try to make sure
    that companies that are at the greatest risk are aware of what
    is going on out there and how to protect themselves from it;
    and then if they are violated, how to report it to us so we can
    pursue it.
        Senator Coons. Thank you.
        Chairman Whitehouse. Senator Hatch.
        Senator Hatch. Well, thank you, Mr. Chairman, Chairman
    Whitehouse. I thank you and applaud you for your efforts in
    this area.
        The distinguished witnesses represent a balance of all
    those affected by cyber criminal and terrorism--Government, the
    private sector, and, of course, academia. For successful cyber
    security policy, we must encourage partnerships among many
    sectors. This cannot be solely a Government-led initiative.
        Now, Mr. Snow, China is directing the single largest, most
    intensive foreign intelligence gathering effort since the cold
    war against the United States. Methods for conducting
    informational warfare to advance the goals of a nation state
    might also involve secretly sponsoring terrorists.
        Now, China is often cited as providing Government support
    to computer hackers, and as Richard Clarke, a former White
    House adviser for infrastructure protection and
    counterterrorism, discusses in his book, ``Cyber War,'' the
    Chinese military has placed a new emphasis on information
    warfare methods. Specifically, they have proposed to attack
    enemy financial markets, civilian electricity networks, and
    telecommunication networks by way of computer viruses and, of
    course, hacker detachments.
        Now, it remains very difficult to determine the true
    identity, purpose, or sponsor of a cyber attacker. Can you tell
    me, does the FBI have sufficient capability to identify an
    attack that is state sponsored versus a criminal enterprise?
        Mr. Snow. Senator, obviously, once again, in a different
    forum we can go more in-depth to your question, but let me
    answer it in a form that I can today.
        Senator Hatch. Sure.
        Mr. Snow. Through the National Cyber Investigative Joint
    Task Force, which I mentioned in my opening statement, we have
    18 intelligence community agencies and others there. We use a
    concept that is called the threat focus cell concept where we
    bring all individuals from the community that would address a
    threat. The successes that we have had have been many. The
    problem with it is that there are still some very high profile
    cases that we have seen just by looking through the Wall Street
    Journal and any other media outlet we have out there where we
    still do not know to this day who the attacker is, what state
    we can attribute it to, or who that person behind the keyboard
    was, who that human person was that actually controlled that
    attack or directed that attack.
        Senator Hatch. Mr. Martinez, several months ago, as
    Chairman of the Senate Republican High-Tech Task Force, I
    requested that the Secret Service provide an extensive briefing
    on transnational organized crime and international cyber
    investigations. I thought that briefing was pretty helpful.
    Now, while that briefing was not classified, it certainly was
    law enforcement sensitive and provided the task force members a
    fantastic overview of the transnational crime groups, primarily
    located in Russia and Eastern Europe.
        During that briefing Secret Service officials profiled a
    particular hacker known as ``BadB,'' who was an accomplished
    hacker in Russian cyber crime circles. Fortunately, he was
    arrested overseas based on the investigative work of the Secret
    Service.
        Now, I want to take this opportunity to applaud you and the
    Secret Service for its work in that case and others, including
    the Nation's largest identity theft case that occurred at TJX
    and Heartland Systems. That case had an extensive international
    cyber crime connection.
        Now, No. 1, what presence does the Secret Service have
    overseas in countries such as China and Russia? And, No. 2,
    what other mechanisms does the Secret Service have in place to
    identify countries with the potential for cyber crime?
        Mr. Martinez. Thank you, Senator Hatch. Yes, the Secret
    Service has, I believe--and it is in my written statement. I
    believe it is 22 overseas offices. And in countries where we do
    not have an office, we take a regional approach where we have
    agents that are specifically assigned to those countries. We do
    have an office in Russia, and I am glad to announce that 2
    weeks ago we got our long-term visa to open up our office in
    Beijing, so we are very happy about that.
        In addition to that, though, we rely a lot on our foreign
    law enforcement partners, and as I stated earlier, we have two
    foreign electronic crime task forces. So what we have done is
    we have taken the concept of the domestic Electronic Crime Task
    Force that Congress enacted back in 2002, and we have used that
    same approach to our overseas offices. In doing so, we
    collaborate a lot with our foreign law enforcement partners.
    Just like the FBI does, we have agents embedded into cyber
    crime units, and specifically agencies in specific hot spots
    around the world.
        We believe it has been very successful, and we have
    capitalized on the relationships and partnerships with these
    law enforcement organizations in order to apprehend some of
    these high-value targets.
        But in addition to that, one of the things we have recently
    done, as we did last year, we did what is called the Verizon/
    Secret Service 2010 Data Breach Investigative Report, where we
    take information for our investigations and we publish that out
    to the private sector. Well, the 2011 study that is about to
    come out in 2 months not only includes data from Secret Service
    and Verizon investigations, but it also includes information
    from the National High-Tech Crimes Unit in Holland.
        So, once again, there we are leveraging the resources and
    the abilities of our foreign law enforcement partners, and the
    lessons learned, the best practices, and the information that
    we have obtained through our criminal investigations, we are
    pushing that out to the private sector through things such as
    the DBI Report.
        Senator Hatch. Mr. Chairman, could I just make a short set
    of remarks?
        Chairman Whitehouse. Of course, Senator.
        Senator Hatch. Thank you very much, both of you. I did not
    have time to ask you any questions, Mr. Weinstein, but I
    appreciate the work you are doing.
        There is no doubt that we need to have a coordinated effort
    between Government and the private sector to address cyber
    crime abroad, and that is why last Congress I introduced, with
    my colleague Senator Gillibrand, an international cyber crime
    bill.
        Now, our common-sense approach was widely supported amongst
    those who are affected by these crimes on a daily basis. In the
    coming weeks we plan to introduce this bill which will improve
    and strengthen the Government's response to international cyber
    crime. I would like you to look at that and tell us where we
    can make it better and what your suggestions are for us so
    that, when we introduce it, it will be truly something that
    will be bipartisan and everybody can support.
        Thank you, Mr. Chairman. I appreciate it.
        Chairman Whitehouse. Of course, Senator.
        Our next questioner is not only a distinguished member of
    this Committee but also the Chairman of the Intelligence
    Committee. Senator Feinstein.
        Senator Feinstein. Thank you very much. I want to thank
    you, Senator Whitehouse for your work in this area. As Chair of
    Intel, I asked you to head a cyber task force, along with
    Senator Mikulski and Senator Snowe, and I want everybody to
    know that the three of you did a wonderful job, and our
    information is much fuller and richer because of it. So thank
    you for the work.
        One of the things that apparently you accomplished was the
    declassification of a lot of material of some of the robberies
    that had taken place going back to 2008 that we on Intel knew
    about--excuse me, I have a cold--but could not talk about. And
    on January 3rd of this year, the Director of National
    Intelligence wrote you a letter essentially saying that we have
    compiled unclassified and in some cases declassified material
    designed to explain the variety of cyber threats and to provide
    real-world examples of damage in non-technical terms.
        This was provided to the Congress and other elements of the
    executive branch. I want to go over some of it which has now
    been declassified.
        In 2008, the Royal Bank of Scotland lost almost $10 million
    withdrawn from ATMs in 49 cities worldwide.
        Citibank, a cyber theft scheme resulted in over $10 million
    in losses. Now, that is according to news reports.
        Nationwide retailer T.J. Maxx, 45 million credit and debit
    cards stolen in 2007.
        Heartland Payment Systems, tens of millions of credit card
    numbers compromised in 2009. And it goes on and on and on.
        Mr. Snow, I believe in your testimony you indicated that in
    2010 you arrested 202 individuals for criminal intrusions, up
    from 159 in 2009, and obtained a record level of financial
    judgments for cases amounting to $115 million compared to $85
    million in 2009.
        Now, we have looked at some of this and seen a lot of
    attacks coming from Russia, from criminal elements in Russia,
    from China, and from other countries, but I think those were
    the two big ones.
        I would like to ask this question: Where do you see the
    majority of major attacks emanating from? And what is being
    done to stop this?
        Mr. Snow. Senator, right now we see on the criminal side a
    majority of attacks coming from the individuals that are
    located in Russia, obviously different from the Russian state,
    and Eastern European countries. We see a very strong network of
    a cyber underground, very closely associated with almost an
    eBay or an Amazon type system where, you know, once you receive
    a service from one of these cyber criminals, which are able to
    just combine together in chat rooms in this cyber underground,
    which are allowed to buy different pieces that they need to
    carry out the attack, to execute the attack, to have the
    cashers, the mules to receive the funds from the attack. They
    are all graded and rated.
        So we see that very large part of the world that is
    extremely connected being an area where a lot of the threat is
    coming from on the criminal side right now.
        Senator Feinstein. How many arrests have been made? And how
    do they get made? And how do individuals get prosecuted?
        Mr. Snow. They get prosecuted--and I will refer back to DOJ
    after I finish my statement, but they get prosecuted in
    different realms. Some countries, depending on what the MLAT or
    the extradition treaty is, will either agree to extradite an
    individual if we have provided the information for them. As Mr.
    Martinez talked about, with the collaboration that we are
    working with these other countries, some will abide by the
    extradition treaties that we have and bring the people back
    here to the United States.
        Senator Feinstein. Are the Russians cooperative in that
    regard?
        Mr. Snow. We have not had the Russians--they have been
    cooperative in the joint prosecution arena.
        Senator Feinstein. Have any Russian Mafia people been
    arrested and prosecuted?
        Mr. Snow. I would defer the Mafia side, but are you talking
    cyber organized crime?
        Senator Feinstein. Yes.
        Mr. Snow. Yes, ma'am.
        Senator Feinstein. And has Russia cooperated with the
    United States in going after them?
        Mr. Snow. Russia has helped in large part in many of the
    cases that we have been involved in. We have exchanged
    information with the Russian individuals that work cyber crime,
    and we are still working on those types of relationships with
    them.
        Senator Feinstein. Thank you very much. Thank you. I am
    glad to hear that.
        Thanks, Mr. Chairman.
        Chairman Whitehouse. Thank you, Chairman Feinstein.
        Next is Senator Klobuchar, then Senator Blumenthal.
        Senator Klobuchar. Well, thank you very much, Chairman
    Whitehouse, for holding this hearing, and I truly believe that
    protecting our Nation's cyber infrastructure is critical as we
    increasingly depend on it for everything from paying our
    utility bills to our financial services.
        The innovation surrounding a free and transparent Internet
    has been great for our economy, but we have also opened
    ourselves up to risks, and those are risks that, unfortunately,
    criminals try to exploit.
        I am working with Senator Hatch on a cloud computing bill,
    and we hope to introduce it soon. And I really do see that
    cloud computing has the potential to alleviate some of the
    concerns in the cyber security field, particularly by
    introducing economies of scale and making sophisticated
    protection available to all users on the cloud. However, it
    also raises some unique diplomatic issues because data is being
    stored in multiple countries.
        Could you talk, maybe Mr. Weinstein, about issues of
    international jurisdiction faced by your agencies when
    investigating cyber crime or, Deputy Director Snow, involving
    cloud computing? And would better international agreements be
    helpful to enforce the rules?
        Mr. Weinstein. We flipped and I won.
        Senator Klobuchar. I noticed that, yes.
        Mr. Weinstein. Senator, I cannot speak specifically to
    international issues involving cloud computing. It is a
    relatively new phenomenon, at least known by that name. But I
    can say that, as a general matter, it is increasingly important
    that we have strong agreements, international agreements,
    either multilateral or bilateral agreements, with our foreign
    law enforcement partners because so often the targets or the
    instrumentalities of the crime are located overseas, even if
    the data is not overseas.
        For example, in the cases that Senator Feinstein just
    mentioned, in the TJX intrusion, the servers that the data was
    stored on, the primary hacker was located in Florida. But the
    data was stored in Latvia and Ukraine.
        Senator Klobuchar. Right.
        Mr. Weinstein. In the Heartland case that Senator Feinstein
    mentioned, some of the servers were--there were three servers
    in the United States, or in three States of the United States;
    but servers were also in Latvia, Ukraine, and the Netherlands.
    In the RBS case, some of the targets and evidence was in eight
    different countries.
        What makes the RBS case useful, I think, as an example,
    though, is that the intrusion was reported to us by the victim
    company in December of 2008, and the indictment was brought in
    November 2009. So in less than 11 months, the FBI, working very
    closely with foreign law enforcement, managed to get the
    evidence we needed, even though it was across our borders,
    identify the targets, put fingers at the keyboard, and actually
    bring charges. And, in fact, BadB, the hacker that Senator
    Hatch made reference to, is now indicted in that case and is
    pending extradition.
        So when we have got those agreements in place and when the
    foreign country we are working with has the will, the capacity
    and the will--because you have got to have both--we can be very
    effective. Too often the countries have the will but not the
    capacity, and that we can deal with because we can devote
    resources, as we do, to training them and to helping them
    strengthen their own criminal laws and then to developing
    international agreements in which they work with us. If they do
    not have the will, there is a limit to how much we can do.
        One thing we do do throughout the world is try to get as
    many countries as possible to accede to the Convention on Cyber
    Crime, which we think is a very useful international framework,
    one that provides a very strong foundation for international
    cooperation in these cases.
        Senator Klobuchar. Now, I know a lot of my colleagues have
    asked you about resources and how that would be helpful. How
    about legal changes? Are there changes that we could make to
    current law? What would you have on your top list of things
    that would be helpful as we battle this new-found crime?
        Mr. Weinstein. Well, I can say that we have got some ideas
    about some potential changes to 1030 that we are discussing and
    working on, and as soon as they are done, we will be pleased to
    bring them to your attention and to work with you on them, as
    well as any other ideas that you have.
        Obviously, we are watching and very eager to be engaged on
    the ECPA debate. I know you had a hearing on that where Mr.
    Baker and others testified last week because changes in ECPA
    actually--if standards are increased in such a way that puts
    information out of the reach of law enforcement, it makes it
    very difficult for us to investigate and prosecute cases
    against cyber criminals who threaten Americans' privacy. So we
    are very eager to engage in that debate.
        And as you may know, there is an interagency process that
    is moving at a fever pitch to develop some cyber security
    legislation. I would not say it has been at a fever pitch
    throughout its life, but I can tell you that in the last 6
    weeks it has.
        Senator Klobuchar. When did it start, Mr. Weinstein?
        Mr. Weinstein. It started a while ago.
        Senator Klobuchar. OK.
        Mr. Weinstein. The fever pitch started more recently.
        Senator Klobuchar. OK.
        Mr. Weinstein. But, you know, we have got people who are
    literally working around the clock, judging by the time at
    which they are e-mailing me in the middle of the night to try
    to get proposals ready to present to you, and so I think that
    will happen very soon.
        Senator Klobuchar. Are you satisfied with the criminal
    penalties in place for engaging in cyber crime?
        Mr. Weinstein. Well, one of the ideas we do have involves
    some streamlining and strengthening some of the penalties that
    are provided in 1030. As I said, that proposal is still baking,
    and when it is fully cooked, we will be pleased to bring it to
    you and talk to you about it further.
        Senator Klobuchar. OK. I am out of time here, and I will
    just ask in writing Assistant Director Snow questions about the
    work with the private sector. Minnesota is home to Target and
    Best Buy and several major companies that deal with this all
    the time, and so I am interested in that issue. I actually
    visited McAfee, their offices in Minnesota, and the work that
    is being done there.
        And then I also will, for the record, Mr. Martinez, follow
    up on some questions with you as well.
        Mr. Martinez. Absolutely.
        [The questions of Senator Klobuchar appears under questions
    and answers.]
        Senator Klobuchar. Thank you very much.
        Chairman Whitehouse. Senator Blumenthal.
        Senator Blumenthal. Thank you, Mr. Chairman.
        I would like to join in thanking Senator Whitehouse for
    holding this hearing and for his interest and effective action
    in this area.
        You know, we have been talking a lot about enforcement and
    about potential changes in the law, and if I have time, I would
    like to return to that subject. But I was very interested in an
    observation made by one of the people who is going to follow
    you in talking to us today, John Savage, who is a professor at
    Brown, who says in his testimony, and I am going to quote,
    ``Computer industry insiders have solutions to many cyber
    security problems, but the incentives to adopt them are weak,
    primarily because security is expensive and there is no
    requirement they be adopted until disaster strikes.''
        Now, I have been involved in enforcement relating to this
    issue, and I do not mean to minimize your efforts. In fact, I
    think they have been heroic and remarkably effective, both at
    the Federal level where you work and often at the State level.
    But don't the holders of this information--and I am thinking of
    Epsilon, for example, most recently the supposed victim of a
    major breach--have a greater obligation to do more to safeguard
    this information? And how do we create those incentives that
    Professor Savage mentions to make your job more effective? I
    will not say ``easier'' because nothing can make your job
    easier, and I have great admiration for what you do. But how do
    we create those incentives so that private companies are more
    partners of yours in this enforcement effort? And I ask that of
    all three of you, and I will let you go in whatever order you
    would like.
        Mr. Martinez. I will take it. Senator----
        Senator Blumenthal. And, by the way, you may disagree with
    Professor Savage, too. I am not assuming that you will
    necessarily agree.
        Mr. Martinez. Senator, I believe also Mr. Weinstein spoke
    about a proposed package that is forthcoming here to Congress
    regarding a comprehensive number of cyber bills that all three
    organizations sitting at this table have been involved in the
    crafting.
        One of those proposals involves data breach legislation,
    and I think it is important for us to create a national data
    breach bill so that we do not continue to have this myriad of--
    I believe right now there are 47 individual State data breach
    requirements, all of which are unique and all of which have
    different reporting requirements. So I think it is important
    that we do have a national data breach bill.
        As part of that national breach bill, I think it is
    incumbent and it should be required that if companies do have
    an intrusion, they not only notify the consumers or the victims
    whose information might have potentially been stolen, but that
    they also notify the Government and that the Government be
    notified of the fact that there has been an intrusion.
        To the point of the professor's, the other part that I
    think is important in the legislation--and I think the
    administration is going to be addressing that--is that there
    also be a safe harbor for those computers that have protected
    the information in a proper way. So even though they have an
    intrusion but the information is protected, that they
    themselves be protected via some type of safe harbor so that
    civil action might not be taken.
        I think in the package of legislation that the
    administration is finalizing, you are going to see all three
    aspects of that in that legislation.
        Mr. Snow. And, Senator, I would just add that I would echo
    Mr. Martinez's comments, and I would also say that I do not
    think anything in the professor's statement is wrong. I think
    the professor is exactly right. But a little bit closer
    scrutiny of this statement would say something that is really
    important, and that is that many of these people have many of
    the solutions for many of the problems and understand that it
    is a multi-layered, multi-faceted problem. To throw a few
    solutions at some of the problems does not solve all the
    problems. So we have to understand.
        Right now I do not think there is any secure system out
    there. I think it takes a defense in-depth layering, and I
    think that is something that we have to work on.
        On his point of weak incentives, I think he is exactly on
    point. You know, I will go back to the bank robbery days that
    the FBI was going from place to place. Just getting somebody to
    put in a new VCR was extremely difficult because that was 60-
    odd-some dollars at the time, and that did not do anything but
    take away from the security budget.
        I think that is the same thing we see in businesses right
    now. That security that we layer that we think is essential is
    not really put in place until there is a tragic incident, an
    embarrassing incident, an incident that costs them close to a
    huge concern about them being a continuing entity or a going
    concern.
        Senator Blumenthal. Mr. Weinstein.
        Mr. Weinstein. I do not have anything to add to what Mr.
    Martinez and Assistant Director Snow said other than to
    emphasize that it has to be both incentives for companies to
    protect themselves against breaches--and I do think that most
    companies, especially those that operate in good faith and care
    about their business reputations, do want to protect
    themselves--but also, as Mr. Martinez said, to report the
    breaches when they do happen.
        I anticipate, although the shape of our package of
    proposals is still being formed, but I do anticipate there will
    be something about data breach reporting in that package, and
    we look forward to working with you on that.
        Senator Blumenthal. Well, I would be eager to work with. As
    you may know, Connecticut is one of those States that has a
    reporting requirement. I have asked for Epsilon to provide
    credit reporting services as well as identity theft insurance,
    which has been standard in what Connecticut at least has asked
    the companies that had this information that may have been
    breached to do in the past and has also sought penalties. So I
    might just suggest, without commenting on Epsilon or any other
    particular instance, that providing these incentives for
    adoption of this technology is something that is worth your
    very serious and positive scrutiny.
        Thank you.
        Chairman Whitehouse. We will go very shortly to the next
    group of witnesses, and I will excuse this panel. I do have a
    question for the record that I would like each of you to take
    with you and answer for me, and I think Senator Kyl will do his
    in writing.
        Assistant Director Snow mentioned the high level of
    activity of the sort of eBay type situation of the Russian-
    based hackers and criminals who are working on this, and I am
    reminded of the lawsuit that was brought by Microsoft against
    the Waledac botnet, which was able to obtain a court order
    involving the legitimate Internet world--the domain providers,
    the ISPs and so forth--to cut off service from the command-and-
    control nodes of that botnet so that it no longer was
    operative. And it strikes me that without actually doing
    criminal prosecutions of folks, we could be very aggressively
    hunting down these criminals and these attackers on the Web and
    disabling them with civil injunctive measures that require the
    ISPs, the domain registers, and so forth to stop providing
    service in certain components or to certain addresses or to
    certain types of transmissions from addresses. And because
    virtually all of this flows through the United States at some
    point, jurisdiction should be fairly easy to get compared to an
    unknown hacker who is working through a server in Estonia that
    links to a server in the Ukraine that links to a server
    somewhere else before it even gets here.
        So I would like to hear from each of you as to what extent
    your organization's cyber resources are empowered to support an
    active criminal defense that uses civil law to shut down some
    of these activities by authorizing the service providers to
    engage with court permission, protected from liability because
    of that, in a way that disables this. OK. Clear?
        [The information appears as a submission for the record.]
        Chairman Whitehouse. And Senator Kyl will do his for the
    record.
        [The questions of Senator Kyl appear under questions and
    answers.]
        Chairman Whitehouse. So with gratitude for your service and
    for your focus on this very significant problem, I will excuse
    this panel, and we will take a 2-minute recess while the next
    panel convenes. Gentlemen, thank you all very much.
        [Pause.]
        Chairman Whitehouse. Let me call the new panel to order,
    and thank you all for being here. Let me first ask that you
    stand and be sworn. Do you affirm that the testimony you will
    give in this Committee will be the truth, the whole truth, and
    nothing but the truth, so help you God?
        Ms. Schneck. I do.
        Mr. Savage. I do.
        Mr. Baker. I do.
        Chairman Whitehouse. Thank you. Please be seated.
        Welcome. We will begin with Phyllis Schneck, who comes to
    us from McAfee, where she is vice president and chief
    technology officer for their global public sector operations.
    Previously, she was vice president for threat intelligence for
    McAfee. She served as a commissioner and a working group co-
    chair on the public-private partnership for the CSIS Commission
    to Advise the 44th President on Cyber Security, which I am
    proud to say was a report co-authored by my colleague in the
    Rhode Island delegation, Congressman Jim Langevin. Ms. Schneck
    also served--Dr. Schneck, I should say, also served for eight
    years as Chairman of the National Board of Directors of the
    FBI's InfraGard program, which has already been mentioned
    today, and vice president of research integration at Secure
    Computing. She has a Ph.D. in computer science from Georgia
    Tech.
        Ms. Schneck.

     STATEMENT OF PHYLLIS SCHNECK, PH.D., VICE PRESIDENT AND CHIEF
    TECHNOLOGY OFFICER, GLOBAL PUBLIC SECTOR, MCAFEE INC., RESTON,
                                VIRGINIA

        Ms. Schneck. Chairman Whitehouse, Ranking Member Kyl, and
    other distinguished members of the Subcommittee, thank you for
    requesting McAfee's views on responding to the threat of cyber
    crime and cyber terrorism. Your Subcommittee is playing a vital
    role in cyber security, helping to investigate sophisticated
    syndicates of criminals and terrorists who deploy cyber attacks
    to finance their operations and undermine the security of our
    country. Thank you for your commitment.
        My testimony will focus on the following three areas: the
    evolution of the cyber security threat landscape, as that has
    changed over the past few decades; two major cyber security
    attacks--Operation Aurora and Night Dragon--McAfee's technical
    response to the cyber crime challenge and the implications for
    national security from those attacks and others that look just
    like it as we look at the future of our cyber security and
    resilience in this country; McAfee's commitment to partnering
    with law enforcement and the law enforcement community; and
    policy recommendations to support law enforcement and improved
    public-private collaboration and information sharing that is so
    vital to give the Government the capabilities that it needs to
    respond to this modern cyber security challenge.
        First, a rollback on McAfee and our definition of cyber
    crime for this testimony. McAfee protects businesses,
    consumers, and the public sector worldwide from cyber threat.
    Headquartered in Santa Clara, California; Plano, Texas; and a
    large operation in Minnesota, McAfee is the world's largest
    pure dedicated cyber security company, and McAfee is a wholly
    owned subsidiary of Intel Corporation.
        Today we use the term ``cyber crime'' to cover the act of
    using electronic means to gain unauthorized access. As we heard
    in the last hearing, cyber crime covers the spectrum, from
    simply gaining notoriety to pooling funds, for organized crime,
    now to intellectual property, and destruction--destruction of
    critical infrastructure--with the very far end of the spectrum
    some are calling ``cyber terrorism.''
        Our overall key challenge is that the profit model benefits
    the cyber adversary: very low barrier to entry, this stuff is
    easy for them; and very, very strong reward, often large
    amounts of money; often destruction; very, very little
    attribution.
        This adversary is fast. This adversary works faster than we
    do. They build relationships, they build trust. As was
    mentioned in the last hearing, the cyber underground, they know
    how to share information. They have no intellectual property
    boundaries, no legal boundaries, very often funded fully by
    their government. No problems to execution.
        As we have evolved in the cyber security threat landscape,
    the traditional model of defeating malware, which is basically
    an instruction that commands a machine to do now whatever the
    adversary desires, and whenever, and send back whatever the
    adversary desires, our traditional signature model does not
    work.
        For the past decade, the industry has looked at
    understanding what could come in, recognizing what is wrong,
    and blocking it, just like a vaccine would block a cold from
    your body or a disease.
        So we look at 50,000 new pieces of malware every day in
    McAfee labs. We have seen many of the sites that were described
    earlier in the cyber underground. We track the criminals. We
    see this adversary, and we propose two key technologies that we
    believe are the future to cyber security technology on the
    technical side, understanding that this is half a people
    problem, half a technology problem. These key technologies are:
        Whitelisting, which is very simply closing the door. If you
    are not an approved instruction, you do not run. It no longer
    matters how many bad-guy instructions are on a machine. If you
    are not known to be good, you simply do not run.
        The second one being global threat intelligence, behavioral
    understanding to build the cyber immune system, just like your
    body fights off a cold or disease without knowing its name
    automatically, we believe our networks should be a lot smarter
    and pull data from our companies and others across the
    financial field and the energy sector, across the critical
    infrastructure to block bad things from coming into networks.
        Two major attacks this year that McAfee led for
    investigation: Operation Aurora and Night Dragon. In January
    2010, Operation Aurora was exposed for having compromised
    Google and 30 other companies. This year, Night Dragon.
        In Operation Aurora, the adversary was looking for
    intellectual property. Very large stores of IP and software,
    and they identified exactly who in those companies would have
    it, and they got it by social engineering their way in and
    getting those people to answer an instant message.
        In Night Dragon, they targeted the oil and gas industry
    across the world looking for architectural documents,
    pipelines, and looking at where the new oil exploration would
    occur.
        McAfee is fully committed to partnering with law
    enforcement. We have a long history, my own having run the
    FBI's InfraGard program nationally on the private sector side
    for 8 years. I also chair the National Cyber Forensics and
    Training Alliance. My colleagues, thousands of them working in
    partnership with law enforcement every day at the Federal,
    state, and local levels, assisting with investigations, working
    closely with the intelligence community, also building strong
    relationships with the FBI and Secret Service across our
    partners.
        We recommend in policy more budget to fund our law
    enforcement colleagues, greater situational awareness in this
    data, and stronger global partnerships, protect the private
    sector so that we can release data very quickly without
    worrying about material benefits for shareholders.
        Thank you again for the opportunity to be a part of the
    process in fighting cyber crime with law enforcement and
    Government relationships. I look forward to your questions and
    continued discussion.
        [The prepared statement of Ms. Schneck appears as a
    submission for the record.]
        Chairman Whitehouse. Thank you, Dr. Schneck.
        Before I go on to Dr. Savage, since you referenced the
    Night Dragon report, I would, first of all, like to compliment
    it. It is the clearest, most trenchant, accessible document I
    have yet read in a lot of reading that I have done about cyber
    security. Anybody who is watching this or listening to this and
    has not had a look at that, it is a really, really good
    document, both in terms of the overlay, the sort of
    contextualization of this as a rapidly emerging threat with
    rapidly increasing sophistication and multiplication of
    incidents, but also as a quite clear layman's description of
    how the attack takes place right down to showing the screens on
    the computer that you would see as you go through the attack.
        So what I will ask is unanimous consent that that report be
    made a matter of record for this Committee hearing, and we can
    provide a copy because I have got it. But I do applaud that. I
    think that is a very, very clear, useful document, and thank
    you very much for preparing that.
        [The report appears as a submission for the record.]
        Chairman Whitehouse. Also, unlike most of the stuff that is
    put out here, it was unclassified and not kept proprietary. One
    of the real problems in this area is that we know so little
    about it because if it is the Government it is classified, if
    it is the private sector it is held proprietary, and the public
    is kept, unfortunately, ignorant of the actual threat. So I
    think you did a real service with that, and I thank you.
        Ms. Schneck. Thank you, Chairman Whitehouse. Would it be
    out of line for me to point out that report was written by my
    colleague, Dmitri Alperovich, in the row behind me.
        Chairman Whitehouse. No, it would not be. It would be very
    appropriate, and I am glad that he is here for this. I guess I
    lucked out by saying nice things about it instead of bad
    things.
        [Laughter.]
        Chairman Whitehouse. And now from the great State of Rhode
    Island, from a university we are very proud of, Brown
    University. I am delighted to have the chance to introduce Dr.
    Savage. He is a professor in the Department of Computer Science
    at Brown, currently conducting research on cyber security,
    computational nanotechnology, the performance of multi-core
    chips, and reliable computing with unreliable elements.
        It sounds like something we try to do here in Congress.
        Dr. Savage served as a Jefferson Science Fellow in the U.S.
    Department of State during the 2009-10 academic year. He earned
    his Ph.D. in electrical engineering at MIT, after which he
    joined Bell Labs and then the faculty at Brown where he co-
    founded the Department of Computer Science in 1979. He has
    multiple clearances and knows a lot about this.
        Dr. Savage, thank you. Please proceed.

      STATEMENT OF JOHN E. SAVAGE, PROFESSOR OF COMPUTER SCIENCE,
               BROWN UNIVERSITY, PROVIDENCE, RHODE ISLAND

        Mr. Savage. Thank you, Chairman Whitehouse and Ranking
    Member Kyl and members of the Subcommittee.
        As you have heard, the Internet which is so important to
    our economy, also exposes us to great risks. I have a few
    statistics that highlight this, fact. Last year it was reported
    that more than half of all the computers worldwide were
    compromised. This means that each of these computers is not
    only capable of being used to steal personal, corporate, or
    Government data; they can also be marshalled into botnets and
    used for nefarious purposes.
        For example, the Mariposa botnet is reported to have
    controlled a remarkable 12.7 million computers, distributed
    across 190 countries, before it was silenced in early 2010. If
    a botnet of this size were used to launch a denial-of-service
    attack, it could wreak havoc on the Internet. More importantly,
    if deployed to disrupt Internet routing tables using a
    technique discovered and announced in early February, experts
    say that routing on the Internet could be severely disrupted.
        I cite these examples to illustrate some of the damage that
    could be done via the Internet. If we add to the mix that some
    important control systems, such as those used for electrical
    power generation, can also be attacked, destroyed, or disabled
    by the Internet, we see that hazards lurk here that were
    unanticipated when the Internet was designed. The Internet,
    which has contributed so much to our economic strength, allows
    us to more tightly integrate segments of our economy; thus,
    attacking the Internet is a way to attack large portions of our
    economy.
        Because cyber crime and terrorism are international in
    nature, they both require a domestic and international
    response. We must elevate our domestic security standards in
    our hardware and software networks. We cannot tolerate having
    several times more botnets than any other nation, nor large
    numbers of compromised computers. We also need to better
    control the supply chain as well as strike international
    agreements to curb abuses that originate at foreign sites.
        So we ask: What steps can we take as a Nation?
        First, we should create the incentives and, if necessary,
    regulations to design and improve computer security. Any
    proposed regulations should be developed through a consultative
    process involving those being regulated.
        Second, the private sector and individual citizens need to
    be educated to the need to keep their systems current with
    security standards.
        Third, steps should be taken to make the domain name system
    more robust by accelerating the adoption of the domain name
    system security extensions.
        Fourth, understanding that our Nation faces a serious
    deficit, we must nevertheless maintain strategic and targeted
    funding for cyber R&D. In the policy dimension, we should
    engage in a national conversation on the types of international
    agreements that will best serve our cyber security interests.
    Many interesting ideas have been proposed that should be
    debated. Leading thinkers have said that the U.S. is not
    sufficiently engaged in international negotiations to our
    detriment.
        Some may ask: Can we manage these problems? Are these
    problems manageable? My answer is yes. I liken our computers to
    our homes. A determined attacker can easily break into them. So
    why aren't most of our homes invaded more often? Apparently
    because the locks are good enough, the neighbors sufficiently
    vigilant, uniformed police officers are sufficiently visible,
    and the punishment if caught and convicted sufficiently onerous
    to deter attackers. We need to arrive at a similar state in
    cyberspace.
        Many of us are struggling to understand, from both policy
    and technological points of view, these issues. There are few
    technologists conversant with policy and few policymaker
    sufficiently knowledgeable about technology. Thus, there is an
    opportunity here to bring the two camps together.
        In the early days of the cold war, strategy development is
    said to have lacked sophistication. However, once the
    insightful analysts studied the issues, a more mature approach
    to policy emerged. The same must be done for cyber security
    policy.
        In closing, let me say that cyber security research is very
    young. While some profoundly interesting results have been
    developed, many challenges remain. Since cyber security plays a
    central role in our economy and is an important branch of
    national security, it deserves to be given priority for
    strategic, targeted research funding in both the technological
    and policy realms.
        Thanks, and I am happy to answer your questions.
        [The prepared statement of Mr. Savage appears as a
    submission for the record.]
        Chairman Whitehouse. Thank you, Dr. Savage.
        Our final witness is Stewart Baker, a partner in the law
    firm of Steptoe & Johnson, where his practice covers national
    and homeland security, cyber security, electronic surveillance,
    law enforcement, export control, encryption, and related
    technology issues. From 2005 to 2009, Mr. Baker served as the
    first Assistant Secretary for Policy at the Department of
    Homeland Security, where he oversaw the office responsible for
    department-wide policy analysis, international affairs,
    strategic planning, and relationships with the private sector.
    From 1992 to 1994, Mr. Baker was General Counsel of the
    National Security Agency.
        Thank you for being with us.

    STATEMENT OF STEWART A. BAKER, PARTNER, STEPTOE & JOHNSON, LLP,
                            WASHINGTON, D.C.

        Mr. Baker. Thank you, Mr. Chairman, Ranking Member Kyl,
    Senator Blumenthal.
        I should say the one other credential that was left off of
    my biography is that I am Brown Class of 1969.
        Chairman Whitehouse. Very important credential to the
    Chairman. Thank you.
        Mr. Baker. I would like to spend a little time on--I talked
    in my testimony about how bad this problem is. It is worse even
    than we have heard today because there really are very few
    barriers to a substantial increase in cyber attacks and cyber
    crime. I laid out in my testimony the many things that we had
    hoped will save us that will not.
        Blaming Microsoft is not going to save us because almost
    all of the software that is being used today has similar flaws.
    Trying to use tokens, which many of us believe would save us
    instead of passwords, increasingly have been compromised by
    hacking attacks and by realtime exfiltration of those token
    credentials.
        We are not even going to be able to save ourselves if we
    call people up and say, ``Did you really send me this e-mail?
    '' Because that kind of out-of-band confirmation of the sort
    you get with your credit card is increasingly at risk as we
    move to IP telephony, which will have all of the problems that
    ordinarily computers have as well.
        Disconnecting from the Internet, which we also are not
    going to do, is not going to solve this problem because the
    agencies that have tried doing that--the Defense Department,
    the Iranian Natanz centrifuge plant--have, nonetheless, been
    compromised by attacks that use thumb drives and other media as
    a way of transporting the compromising software.
        What many of us hope to rely on, the anonymity that nobody
    is really particularly looking for me, is also not going to
    save us because, increasingly, it is possible to essentially
    infect the world and then ask your malware to run in the
    background until you do something that the crooks think is
    interesting, like log on to a particular account with a private
    equity fund, which indicates you have enough money to be worth
    stealing from, at which point they will start stealing from
    you.
        All of those things are solutions that will not actually
    work. And perhaps most important for this Committee and this
    hearing, law enforcement is, in my view, almost entirely
    helpless at this point. Six more prosecutors are not going to
    address this issue in any significant way, and the principal
    reason for that is that--I thought Professor Savage got it
    right. We do feel safe in our houses, but it is not because the
    locks are perfect. The locks on our houses are much worse than
    the locks that are already on our computers. What is different
    is that there is a realistic possibility of being caught
    committing a crime if you try to break into somebody's house
    and almost no possibility that you will be caught and
    prosecuted if you commit a cyber crime.
        I have suggested a bunch of rather tentative approaches to
    solutions in my testimony, but I would like to just focus on
    one, which is we really need to do a much better job of
    building in attribution and minimizing anonymity on the
    Internet, making it much more difficult for people to do
    business, send e-mails, transmit packets and the like, and be
    confident that they cannot be tracked back to their actual
    identity.
        This is a very difficult task. It is an architectural
    problem that is quite significant. But, in my view, we will not
    solve this problem if we cannot realistically threaten to
    punish the people who are carrying these attacks out. We will
    simply see more and more sophisticated, more and more
    elaborate, and more and more damaging attacks until we begin
    structuring the Internet and structuring the relationship that
    ISPs have with each other and with their customers so that it
    is much more difficult for people to avoid being identified
    when they commit these crimes.
        I will stop there.
        [The prepared statement of Mr. Baker appears as a
    submission for the record.]
        Chairman Whitehouse. Thank you very much.
        We had General Alexander, who I think is a really
    remarkable individual, come to the University of Rhode Island
    yesterday. He came at the invitation of Congressman Langevin,
    who has a very significant role in this area on the House side,
    and Jim Langevin and I talk frequently about this issue because
    I have an interest on our side as well.
        During the course of the discussion, General Alexander said
    that we could--right now our stock markets, our financial
    markets could be taken down, our power grid could be taken
    down. If our power grid were taken down, it would not come up
    quickly. It would not be just like the branch fell on the wire
    outside your house, but do not worry, when the truck comes, the
    power will be back on. It would be much more persistent and
    prolonged than that. He said that the entire financial sector
    is vulnerable and could be compromised, communications
    networks, and that they could interlock. So the scale of how
    bad this could be, if it really gets to the level of full-blown
    cyber war, is really very, very dramatic.
        I am interested--since we have private sector folks here,
    this may seem like a hypothetical question, but I would love to
    get your take on it.
        If you imagine that there is a universe of cyber threats
    out there and within that universe of cyber threats there is a
    group of them about which the Government has awareness--Mr.
    Baker, your old shop has pretty wide awareness, probably wider
    than anybody else in the world, into the criminal ecosystem of
    the cyber world. Within that larger awareness, there is an
    awareness that the private sector has at its best level, at the
    level of McAfee, at the level of Symantec, RSA, and so forth.
        I would love, starting with you, Dr. Schneck, to get your
    sense of what portion of the awareness that NSA has of the
    cyber threat you think the private sector has. Clearly, it is
    going to be a subset. But is it a tiny subset, or is it a
    significant portion? What is your guess on how much visibility
    McAfee and Symantec and the rest of the private sector
    defenders of our private sector corporations have compared to
    the NSA and to the overall picture?
        Ms. Schneck. Thank you, Chairman Whitehouse. I will steal
    some words from AD Snow earlier and ask that we could continue
    part of this answer in a different forum. So clearly there will
    be an overlap between what any Government entity, whether it is
    intelligence, community law enforcement, DHS--would know and
    what the private sector knows. I think we get our intelligence
    differently in some cases. We gets ours from protecting
    customers, so first and foremost, whether the threat is just to
    get a little money or whether it is to destroy the electric
    grid, we block that threat. We stand in front of the target; we
    make sure the threat does not get there. That is our first
    move. That is the in-line, speed-of-light work.
        The second line is the human work. The reason that is so
    hard is because we see all this data come together, and it
    paints a picture. This happened in Night Dragon. And as that
    picture came together, you realize that it is targeting the oil
    and gas sector. At what point can we in the private sector
    share that picture with the intelligence community, with the
    FBI and the Secret Service?
        Chairman Whitehouse. Let me try to focus back on my
    question, and before I give the other two witnesses a chance to
    answer it, would you at least concede that the awareness that
    the cyber defense private sector community has of the threat is
    significantly smaller than the awareness that NSA has of the
    threat?
        Ms. Schneck. So it is hard to answer that question in this
    forum. I think the awareness is different. I do believe there
    is an overlap. I think there is a lot of data in the private
    sector that, if we were able to share that more readily with
    some legal protection, we would protect our country better.
        Senator Whitehouse. Do you understand my question, Dr.
    Savage----
        Ms. Schneck. I do, and I believe----
        Chairman Whitehouse. No, no. I am sorry. I am going on to
    the next witness.
        Ms. Schneck. OK.
        Mr. Savage. I do understand your question, and I cannot
    answer it either because I do not represent either the private
    industry or the intelligence community.
        However, what I will say is I would not be surprised if the
    private sector had access to perhaps more data than the
    National Security Agency simply by virtue of the fact that have
    sold, they sell products to customers worldwide, monitor the
    state of computers worldwide. Although before I do not know for
    sure, I expect that the National Security Agency has a
    different focus.
        So I would not be surprised if the private sector had a
    great deal of very useful information.
        Chairman Whitehouse. And, Mr. Baker, what is your take?
        Mr. Baker. I would divide the problem into three possible
    kinds of attacks: there are attacks to steal money, there are
    attacks to steal secrets, and there are attacks to sabotage a
    system.
        When it is a question of stealing money, I would say the
    private sector is better informed and better protected than the
    U.S. Government or Government agencies generally. It affects
    the bottom line. They know how much to spend. They want to
    spend enough to stop losses that are equivalent to what they
    have spent. And they do a better job than the U.S. Government
    protecting themselves from that kind of an attack.
        Stealing secrets, I would say the U.S. Government has a
    better awareness and, by and large, I get more calls from
    people in the private sector who are alerted to their losses by
    the U.S. Government than the other way around. And there is a
    tendency, if you do not steal secrets for a living, as
    intelligence agencies do, not to believe that people are really
    doing that to you, and the private sector falls prey to that
    illusion.
        And then there is sabotage where I think the private sector
    is utterly clueless. They do not want to think about the
    possibility of sabotage because they have no idea what to do
    about that. They will end up spending money and getting nothing
    obvious back because they are running now--they have not been
    sabotaged yet, so all they get is a sense that maybe they would
    withstand an attack, but they do not even know that.
        And so they are reluctant to spend money or even to hear
    the message in the private sector, the electrical grid, or the
    pipeline companies and the like. The reluctance to hear that
    message is profound.
        Chairman Whitehouse. Senator Kyl.
        Senator Kyl. Thank you, Mr. Chairman.
        First, Mr. Baker, two questions for you. You discussed the
    supply chain vulnerabilities, including the new smart grid
    infrastructure. What is being done to ensure that the smart
    grid does not become in essence an electronic Trojan horse?
        Mr. Baker. Well, some things are being done on paper. There
    are security standards being developed. Whether they are really
    sufficient is open to question. But even if they were
    sufficient, there is not an obvious enforcement mechanism. The
    mechanisms for regulating power companies are deeply local and
    State, and both the power companies and the State PUCs like it
    that way, and they do not want the Federal Government to step
    in and start telling them anything about their business. And so
    while the Federal Government can recommend some security
    standards, the PUCs who have to enforce them, in my
    understanding, are not really doing much.
        Senator Kyl. So we have still got a big problem there.
        Mr. Baker. Yes.
        Senator Kyl. Now, I think you are aware that last year
    Congress gave the Department of Defense some new powers to
    protect its information systems, and I wonder--regarding the
    supply chain, again. I am just wondering whether you think
    maybe Congress should use that kind of authority as a template
    for other agencies in the Federal Government.
        Mr. Baker. Well, certainly other agencies beyond the
    Defense Department have to worry about the possibility that the
    supply chain will compromise them, and indeed, you know,
    anything that we think is a worry for the Defense Department is
    probably a worry for the New York Stock Exchange or Citibank,
    and we should not be encouraging them or allowing them, without
    knowing about the risk, to continue to rely on insecure
    material.
        Senator Kyl. So we might take a look at that template in
    dealing with other agencies that have important issues like
    that.
        Mr. Baker. Yes.
        Senator Kyl. Now, for all of you, there is a sense here
    that there is no silver bullet except better enforcement, but
    better enforcement is really hard to do, well, primarily from a
    resource standpoint, but also a capability standpoint. So I
    presume that incremental changes, including creating
    incentives, is one of the answers here. And in terms of
    changing behavior, my question is with the private sector--in
    particular business but also individuals--whether a greater use
    of the concept of insurance as providing incentives would help
    the private sector develop better protections. Maybe we will
    start with you, Mr. Savage, and then Phyllis.
        Mr. Savage. I agree. Cyber insurance to protect against
    fraud, theft, interruption of service, things of that sort
    would be very valuable, because I recall many years ago
    learning about workers' compensation insurance where an
    insurance company would issue a policy but they would also
    provide experts to come into your place of business to help you
    improve it so that they could reduce the number of injuries
    and, therefore, the number of charges.
        When I was in the State Department, I sat on a NITRD panel
    that put together a set of recommendations, one of which was a
    cyber economics recommendation for funding in fiscal year 2012s
    budget, and the idea there being that if you offer insurance,
    you can invite companies who are going to purchase the
    insurance to provide you with incident information, which you
    can then collect and use to create actuarial tables reducing
    their costs, but also pooling these resources with other
    insurance companies.
        The good news is that when I was in the State Department, I
    received a call from a Brown grad who had seen I was a
    Jefferson Science Fellow. She works for an insurance company in
    the Hartford area that sells insurance of this kind, but they
    were at a little bit at sea because they could not really find
    the others and work with the others to do this kind of thing
    that I described.
        Senator Kyl. Especially ways to help resolve that problem
    and whether the Government should be involved in this, Dr.
    Schneck?
        Ms. Schneck. So, thank you. We have looked at the insurance
    model for about 11 years that I remember. The key road block to
    that was the lack of the actuarial data, to Professor Savage's
    point on the need for that data. So in the startup, we have
    plenty of data we can look back on in driving habits and other
    areas where things are insured, but in this arena so little is
    reported that we know what we know because we are out there
    protecting, but to Mr. Baker's point, most of the private
    sector does not have this kind of knowledge. So that actuarial
    data to make the model work on the insurance would be
    exceedingly difficult.
        That is not to say it would not be a great idea to
    incentive, but we would have to make sure of two things: one is
    that the data is there so that nobody gets burnt, so the model
    fits; and the other is to ensure that we are not encouraging
    companies to be compliant, they have to be secure. There is a
    very big difference. Do not just check the box, but
    comprehensively protect your infrastructure.
        Senator Kyl. Mr. Baker, any other thoughts?
        Mr. Baker. Yes, very briefly. For insurance to work, people
    have to either expect a harm, an identifiable harm, or
    identifiable liability. The likelihood of liability in this
    area has so far been pretty minimal just because of the
    difficulty of tracking the attacks. And if all they steal is
    secrets, you are not going to be able to identify a harm that
    an insurance company will be comfortable reimbursing you for.
        So it is part of the solution, but it is not as good a
    solution as I would like.
        Senator Kyl. Thank you.
        Chairman Whitehouse. Senator Blumenthal.
        Senator Blumenthal. Thank you. I would like to pursue that
    line of questioning, but first thank you, all three of you, for
    your very enlightening and useful testimony, and I would like
    to pursue some of the questions here outside the time that I
    have.
        But in terms of liability, that is something that
    corporations understand. If we talk about incentives, which is
    where I was going with the last panel--treble damages--we know
    how to impose liability, we know how to penalize. The courts do
    it all the time. They have to put estimates on that harm. It
    may be difficult to calculate, but, you know, we do it with
    pain and suffering. If we can do it with pain and suffering,
    then we can do it with the kind of commercial damage that
    people suffer, which is much easier in many respects to
    quantify.
        So for all of you--but it is a question raised by Dr.
    Savage's testimony, and I am quoting again: ``.  .  .  the
    incentives to adopt them are weak''--referring to the solutions
    to these cyber security problems--``primarily because security
    is expensive and there is no requirement they be adopted until
    disaster strikes.''
        What can we require--and I invite you to supplement your
    answers here perhaps after you think about it some more. What
    can we require, whether it is liability or Senator Kyl
    mentioned insurance--and I agree with you about all the
    difficulties raised by the insurance model. What can we do to
    really grow your business, Dr. Schneck? And I do not mean that
    altogether facetiously, I mean not just grow your business, but
    grow the interest and incentive to do the kinds of things that
    you advise your clients to do.
        Ms. Schneck. Thank you. I think the first might be to
    incentivize some innovation. So we have grown by finding ways
    around this adversary. We get them by going at the speed of
    light. That was a focus of necessity. That was market driven.
        If we can change our culture a bit to have companies
    incented to innovate around security and find models that work,
    find ways that make them money by being more secure--and the
    insurance models is a subset of that--I think that is one area.
        The other might be some tax incentives, and, again, not
    just being compliant but in doing it right and having that--
    again, the decade-old discussion but the top-down policy, the
    culture of security in the company.
        Senator Blumenthal. But we want to measure results, not
    just that they put a better fence around the home----
        Ms. Schneck. Correct.
        Senator Blumenthal.--or a better fire alarm--which, by the
    way, insurance companies do reward so the insurance model does
    work--or other kinds of alarms on homes.
        Professor Savage or Mr. Baker.
        Mr. Savage. I will say quickly, I continue to be troubled
    by end-user licensing agreements which state that the company
    selling me the software has no responsibility for it once it is
    in my hands. I cannot fix any bugs that exist or any security
    hazards that exist in that software myself. I cannot even keep
    it up to date quickly enough because, as we know, as we have
    heard, half of all the malware goes undetected.
        It is said that last year PandaLabs reported that half of
    the malware lived for 1 day. I am not sure to what extent that
    statement is correct, but that is what I read.
        Coming back to a point you made earlier, you asked about
    the technologies that could be incorporated, well, there are--
    you know, research is being done all the time, and it takes
    time, of course, for these results to appear in products. But
    there are ways to detect botnets. There are ways to defeat
    denial-of-service attacks and things of that sort. And if there
    were the right incentives--and I do not know what they are--
    maybe some of our companies would be more ready to adopt them.
        Now, having said that, there has been a lot of work done by
    a number of companies both in the software sector and financial
    services sector to introduce security techniques to teach their
    engineers to write code that is less easily attacked. And I
    think many of those efforts are actually terrific, and you can
    see it, I think, in the reporting rates of errors.
        So I want to applaud the industry for doing that. At the
    same time, I think they need to take responsibility for this
    issue. And as I say, many are, but not all.
        Senator Blumenthal. Thank you.
        Mr. Baker. If I could just--I know you are deeply familiar
    with the data breach laws and the penalties for that, and I
    have good news and bad news about those laws.
        The good news is they have made a big difference in
    corporate behavior. The companies do not want to have to
    disclose that they have released a large amount of personal
    information about consumers, and they will take steps to
    prevent that from happening.
        The bad news is that that is where the security budgets
    have, by and large, gone. They are spending a lot of money to
    make sure that their hard drives are encrypted so that if they
    leave the computer, the laptop, at the airport, they do not
    have to disclose a breach. They are not, by and large, treating
    some of these more sophisticated attacks with the same kind of
    attention because they do not tend to produce a verifiable
    personal information breach.
        And so if you are going to go down that road, I would urge
    you to try to find an agency with a broader picture of the
    kinds of attacks that can adjust the incentives so people are
    actually responding to the worst kinds of attacks, the ones
    that are most dangerous to us as a country.
        Senator Blumenthal. Thank you.
        Thank you, Mr. Chairman.
        Chairman Whitehouse. Mr. Baker, as the lawyer on the panel,
    let me ask you two questions.
        One, in response to what Dr. Savage said, should we be
    concerned that significant players in this area are purporting,
    at least, in their contractual arrangements to relieve
    themselves of any liability, given that liability is often a
    motivating factor in human behavior?
        And, second, to follow up on my question to the earlier
    panel, I was very impressed by Microsoft's lawsuit. I asked
    them to send me the complaint. I thought it was very well done.
    And they did not really have a hostile defendant. The
    defendant, the provider who was at stake, was perfectly happy
    to comply as long as they had a court order that gave them a
    reason to do it and protected them from any liability for what
    they did. And I am a little bit surprised that there does not
    seem to be more activity in that arena, somebody knows that
    there is a bot out there that they can disable, somebody knows
    that there is a worm out there, somebody knows that there is a
    piece of--a website that is--you know, whatever it is that they
    know about their risk posture, it seems very rare that somebody
    actually goes to a court and says, oh, by the way, let us bring
    in--again, the domain registrar, their ISP, or whoever--and say
    we want you, because of the threat to our welfare here, to make
    this change in your programming so that our threat is
    diminished. And then everybody sits around and says yes, the
    judge hits the gavel, everybody is happy. It seems to me to
    be--the Microsoft thing does not seem to be repeating itself as
    often as I would have expected. I am aware of a couple of
    others, but that seems to be the breakthrough one, and it does
    not seem to have created the sort of torrent I expected of
    people going out to the courts, to the ISPs, to the domain
    registrars, to help them clean up the environment.
        Mr. Baker. Microsoft is in the unique position of seeing
    attacks around the world on their software and having the
    resources to pursue creative solutions. And I agree with you,
    that was a very creative and constructive approach.
        I do think that it is worth exploring what could be done to
    allow companies that have an interest in doing more but need
    some reassurance that what they are doing is not going to
    result in liability. One of the great values of a civil
    injunction and a civil order is that you know that the people
    that you are going after are not going to turn around and file
    lawsuits against you, because you have already gotten prior
    approval. And finding ways to relieve ISPs, other companies, of
    their fear that doing the right thing will result in liability
    is worth looking at. I think that is a constructive approach.
        By and large, using the tort system to improve security is
    a pretty backward-looking approach; that is to say, by the time
    you get a judgment, you are 6 years past the problem, and it is
    probably----
        Chairman Whitehouse. You are back to my first question.
        Mr. Baker. Yes, I am coming back to your first----
        Chairman Whitehouse. Yes, I am not sure it is the best
    way----
        Mr. Baker. So I----
        Chairman Whitehouse. I am also not sure that allowing a
    company to completely relieve itself of liability contractually
    is very helpful in this space either, because it takes their
    mind off it and they go on to other projects.
        Mr. Baker. I do not disagree with you on that, and I
    support the idea of having at least agencies that understand
    what good security practices are, start to define those for
    companies, including software companies, to make sure that they
    are actually doing the things that they need to do. And if they
    say you need to do this and then the company does not do it, I
    do not think those contractual clauses are going to save them
    from liability.
        Chairman Whitehouse. Senator Kyl?
        Senator Kyl. Thank you very much.
        Chairman Whitehouse. Anything further?
        Senator Blumenthal. No. Thank you.
        Chairman Whitehouse. All right. We will conclude this
    hearing. I thank all of the witnesses, and once again I very
    much appreciate the Night Dragon report that McAfee did.
        The hearing will stay open, the docket of the hearing will
    stay open for an additional week, and we will, of course, ask
    all of the witnesses to comply with the questions for the
    record that you will get in writing.
        Again, thank you very much. This has been instructive and
    helpful.
        The hearing is adjourned.
        [Whereupon, at 4:33 p.m., the Subcommittee was adjourned.]
        [Questions and answers and submissions for the record
    follow.]