[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]



 
    CYBER ATTACKS: AN UNPRECEDENTED THREAT TO U.S. NATIONAL SECURITY

=======================================================================

                                HEARING

                               BEFORE THE

         SUBCOMMITTEE ON EUROPE, EURASIA, AND EMERGING THREATS

                                 OF THE

                      COMMITTEE ON FOREIGN AFFAIRS
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED THIRTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             MARCH 21, 2013

                               __________

                            Serial No. 113-8

                               __________

        Printed for the use of the Committee on Foreign Affairs


Available via the World Wide Web: http://www.foreignaffairs.house.gov/ 
                                  or 
                       http://www.gpo.gov/fdsys/




                  U.S. GOVERNMENT PRINTING OFFICE
80-123                    WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, [email protected]  

                                 ______

                      COMMITTEE ON FOREIGN AFFAIRS

                 EDWARD R. ROYCE, California, Chairman
CHRISTOPHER H. SMITH, New Jersey     ELIOT L. ENGEL, New York
ILEANA ROS-LEHTINEN, Florida         ENI F.H. FALEOMAVAEGA, American 
DANA ROHRABACHER, California             Samoa
STEVE CHABOT, Ohio                   BRAD SHERMAN, California
JOE WILSON, South Carolina           GREGORY W. MEEKS, New York
MICHAEL T. McCAUL, Texas             ALBIO SIRES, New Jersey
TED POE, Texas                       GERALD E. CONNOLLY, Virginia
MATT SALMON, Arizona                 THEODORE E. DEUTCH, Florida
TOM MARINO, Pennsylvania             BRIAN HIGGINS, New York
JEFF DUNCAN, South Carolina          KAREN BASS, California
ADAM KINZINGER, Illinois             WILLIAM KEATING, Massachusetts
MO BROOKS, Alabama                   DAVID CICILLINE, Rhode Island
TOM COTTON, Arkansas                 ALAN GRAYSON, Florida
PAUL COOK, California                JUAN VARGAS, California
GEORGE HOLDING, North Carolina       BRADLEY S. SCHNEIDER, Illinois
RANDY K. WEBER SR., Texas            JOSEPH P. KENNEDY III, 
SCOTT PERRY, Pennsylvania                Massachusetts
STEVE STOCKMAN, Texas                AMI BERA, California
RON DeSANTIS, Florida                ALAN S. LOWENTHAL, California
TREY RADEL, Florida                  GRACE MENG, New York
DOUG COLLINS, Georgia                LOIS FRANKEL, Florida
MARK MEADOWS, North Carolina         TULSI GABBARD, Hawaii
TED S. YOHO, Florida                 JOAQUIN CASTRO, Texas
LUKE MESSER, Indiana

     Amy Porter, Chief of Staff      Thomas Sheehy, Staff Director

               Jason Steinbaum, Democratic Staff Director
                                 ------                                

         Subcommittee on Europe, Eurasia, and Emerging Threats

                 DANA ROHRABACHER, California, Chairman
TED POE, Texas                       WILLIAM KEATING, Massachusetts
TOM MARINO, Pennsylvania             GREGORY W. MEEKS, New York
JEFF DUNCAN, South Carolina          ALBIO SIRES, New Jersey
PAUL COOK, California                BRIAN HIGGINS, New York
GEORGE HOLDING, North Carolina       ALAN S. LOWENTHAL, California
STEVE STOCKMAN, Texas


                            C O N T E N T S

                              ----------                              
                                                                   Page

                               WITNESSES

Mr. Christopher Painter, Coordinator, Office of the Coordinator 
  for Cyber Issues, U.S. Department of State.....................     7
Mr. Richard Bejtlich, chief security officer and security 
  services architect, Mandiant Corporation.......................    26
Mr. Greg Autry, senior economist, Coalition for a Prosperous 
  America........................................................    36
Mr. Michael Mazza, research fellow, American Enterprise Institute    46
Martin C. Libicki, Ph.D., senior management scientist, RAND 
  Corporation....................................................    55

          LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING

The Honorable Dana Rohrabacher, a Representative in Congress from 
  the State of California, and chairman, Subcommittee on Europe, 
  Eurasia, and Emerging Threats: Prepared statement..............     3
Mr. Christopher Painter: Prepared statement......................     9
Mr. Richard Bejtlich: Prepared statement.........................    29
Mr. Greg Autry: Prepared statement...............................    38
Mr. Michael Mazza: Prepared statement............................    48
Martin C. Libicki, Ph.D.: Prepared statement.....................    57

                                APPENDIX

Hearing notice...................................................    70
Hearing minutes..................................................    71


    CYBER ATTACKS: AN UNPRECEDENTED THREAT TO U.S. NATIONAL SECURITY

                              ----------                              


                        THURSDAY, MARCH 21, 2013

                       House of Representatives,

         Subcommittee on Europe, Eurasia, and Emerging Threats,

                     Committee on Foreign Affairs,

                            Washington, DC.

    The subcommittee met, pursuant to notice, at 9 o'clock 
a.m., in room 2172 Rayburn House Office Building, Hon. Dana 
Rohrabacher (chairman of the subcommittee) presiding.
    Mr. Rohrabacher. There it is. It is called to order and the 
mic is on. And let me just note that when you are speaking 
through a microphone, you are utilizing the energy that is 
produced some way by someone at some cost. So I call this 
meeting to order. And today's topic is Cyber Attacks: An 
Unprecedented Threat to National Security.
    After the ranking member and I each take 5 minutes to make 
opening remarks, each member present will have 1 minute to make 
their opening remarks, alternating between the majority and 
minority. And without objection, all members may have 5 days to 
submit statements, questions, and extraneous material for the 
record, and hearing no objections, so ordered.
    There have been several congressional hearings on cyber 
warfare, but most have concentrated on the technology involved 
and how we can devise defenses to block hackers from breaking 
into our Government and business computers. The greatest danger 
to our nation, the greatest dangers, however, are not really 
about technology. It is about international relations, foreign 
governments that employ cyber warriors to attack other 
countries, or which allow hackers to attack other countries in 
their behalf.
    And what is it we are we talking about? We are talking 
about something that should be considered as a hostile 
government action against another act. It is as if the 
government was supporting terrorism if they support the same 
type of aggression, cyber aggression. These acts, which put our 
country in severe jeopardy, must be met with the same national 
security and diplomatic measures that we use to meet other 
external threats.
    The type of targets hackers assault are often placed in two 
categories. Strategic targets are those which would be attacked 
by military means in a war. For example, transportation 
systems, power grids, defense industries, communications, and 
government centers. And China, Iran, North Korea, and Russia 
have all used cyber attacks aimed at strategic infrastructure 
targets. Targets that would be attacked in another way if there 
was a war.
    In January, Iran conducted probing attacks on U.S. banks. 
Such potential damaging and brazen attacks on the United States 
should provoke a much more aggressive and powerful response 
than we are currently exercising. We should deter, not just to 
try to block, but we should deter cyber attacks and perhaps 
counterattack. More insidious, however, is the ongoing attacks 
on our economy by the Chinese, among others. This second form 
of attack is in the form of commercial warfare. The scale upon 
which it is being conducted is beyond anything we have 
experienced and far exceeds traditional espionage.
    The Mandiant report which came out last month identified a 
unit of the Chinese People's Liberation Army that has been 
conducting commercial warfare since 2006. A military unit 
hacking business and industry targets, and then we have a 
situation where these targets play a central role in the 
economy of one nation and has a lot to do with the balance of 
power between the nations. So you have a Chinese People's 
Liberation Army involved in an attack that has a lot to do with 
the power between our countries, and is a cyber attack.
    The commander of U.S. Cyber Command, Keith Alexander, 
estimated last year that computer hacking from overseas costs 
the American economy $250 billion a year. He called it the 
greatest transfer of wealth in history. The Mandiant study 
found that the targets ``match industries that China has 
identified as strategic for their growth, including four of the 
seven strategic emerging industries that China has identified 
as part of its 12th 5-year plan.''
    The Chinese firms that compete in these industries are 
dominated by state-owned enterprise which ties Communist Party 
officials and their families to this crime against the United 
States and others throughout the world. It is a matrix that not 
only serves to grow the wealth and power of China but also the 
personal fortunes of its leaders. Yet, even this is only the 
tip of the iceberg. The transfer of wealth by the theft of 
technology and other information vital to the development of 
industry is then used to gain a competitive advantage in world 
trade, which brings even more wealth to China.
    Over the last 10 years, that is 2003 to 2012, the United 
States trade deficit in goods with China totaled over $2.4 
trillion. Entire industries have been moved across the Pacific 
to create what we see as the rise of China. Well, we cannot 
just rely on technology to defend against these type of 
attacks. We must use diplomacy to deter them by telling Beijing 
and others in clear terms that we will not allow their hacking 
to continue without retaliation. We should sanction states that 
support hacking just as we sanction states that support 
terrorism or engage in other hostile actions. This war will not 
just be waged in cyberspace, but across every front and using 
every lever of American power to defeat an aggressor and to 
take the profit out of attacking our businesses, our defenses, 
and yes, our country.
    [The prepared statement of Mr. Rohrabacher follows:]

    
    
    
    
                              ----------                              

    Mr. Rohrabacher. With that I would turn to Mr. Keating for 
his opening remarks.
    Mr. Keating. Well, thank you, Mr. Chairman, and thank you 
for holding today's hearing.
    During the highly publicized Benghazi hearing earlier this 
year, Secretary Clinton warned this committee that cyber 
threats would be at the top of our agenda in the coming months 
and she certainly was correct in that prediction. With the 
number of cyber threats escalating worldwide, the need for 
comprehensive security analysis, assessment, and actions has 
never been greater.
    Although cyber attacks and instances of cyber espionage are 
receiving a great degree of media attention and are undoubtedly 
increasing and really evolving at a highly rapid rate, cyber 
threats are not a new phenomenon. The GAO designated Federal 
information security as a high-risk area in 1997, and in 2003 
expanded this area to include protecting our nation's critical 
infrastructure.
    Ten years later, just this February, it was President Obama 
that signed an executive order to facilitate information 
sharing about emerging threats and solicit new, voluntary 
cybersecurity standards for the nation's power grid, financial 
sector, and other key institutions, yet the price of 
cybersecurity is certainly not cheap. Government agencies would 
need to boost cybersecurity spending more than seven times to 
block 95 percent of hacker attacks according to Bloomberg 
Government study.
    This translates into an annual average spending of $190.3 
million per agency, up from the current $26 million, according 
to the study, based on interviews with officials of 48 Federal, 
State, and municipal agencies. The current combined financial 
impact on public and private sector cyber attacks is unknown 
but estimates are in the billions.
    As we add up the dollars and weigh the risks, we must not 
forget that the greatest attack of all will be on the 
confidence of the American people if even one large-scale cyber 
attack scenario were to materialize. As a former district 
attorney, I believe that our country's efforts toward deterence 
and response to a known cyber attack do matter, even if we are 
not always sure who the aggressor is, their motive is, or where 
they might be. While the issuance of the executive order is a 
welcome development, it will take responsible, legislative 
action to fully address cyber threats and vulnerabilities to 
critical infrastructure, and time is of the essence.
    Further, the Internet is an open, international domain, and 
cyber crimes clearly go beyond traditional law enforcement 
models. For this reason, national policies are incomplete 
without firm international cybersecurity standards and norms 
between like-minded allies.
    The U.S. recently played an incredibly constructive role 
during the World Conference on International 
Telecommunications, and beat back proposals by Russia, China, 
Saudi Arabia, and others that sought to explicitly extend 
International Telecommunications Regulations jurisdiction over 
the Internet. Unfortunately, the U.S. also does not participate 
in many of the concrete initiatives put forth by the 
International Telecommunications Union, the ITU, and other 
international organizations. However, these efforts further the 
connectivity and the interoperability of the world's 
telecommunication networks which, in turn, enhance America's 
defense and intelligence communication capabilities.
    Also just this week, NATO Secretary General Rasmussen was 
in Estonia. As most of us here know, Estonia has experienced 
devastating cyber attacks directed from Russia at its 
Parliament, ministries, banking systems, newspapers, and 
broadcasters, in 2007. This week's NATO meeting alluded to 
these attacks. It highlighted the importance of moving on to an 
interoperability paradigm between like-minded allies. It is 
interesting with Estonia as well, I was informed this week that 
they are going to have the model that the EU is adopting. And 
even in Estonia it is interesting to note as well, they are 
teaching cybersecurity in the first grade.
    I am thankful for the participation of our witnesses here 
today, and look forward to hearing their thoughts on our 
current cyber state of affairs as well as ongoing cyber 
espionage efforts and attacks stemming from China, Russia, 
Iran, and others. And before I close, I would like to note that 
this hearing is taking place at a time when the effects of 
across-the-board spending cuts are just beginning to be 
realized. And I look forward to hearing from you, Mr. Painter, 
about how the sequester and the perpetual uncertainty around 
budgeting impacts might affect our nation's cybersecurity 
efforts. With that I go back to my chairman and yield back 
time, all 5 seconds.
    Mr. Rohrabacher. Thank you very much. You were noting what 
was going on in Estonia, and yesterday, several banks and 
broadcast outlets in South Korea were attacked, and apparently 
the assumption was that the cyber attacks were from North 
Korea. However, the news this morning is that South Korea is 
claiming that these attacks were located, the attacker was 
located in China. And the story is still developing, but it 
raises questions as to whether China and North Korea are 
cooperating in cyber warfare against people that they think are 
their enemies.
    But with that Mr. Duncan has an opening statement, I 
understand.
    Mr. Duncan of South Carolina. Thank you, Mr. Chairman. I 
think that the hearing today is very, very timely, especially 
in light of the director of National Intelligence on 12 March, 
James Clapper, said this, ``We judge that there is a remote 
chance of a major cyber attack against U.S. critical 
infrastructure systems during the next 2 years that will result 
in a long-term, wide-scale disruption of services such as 
regional power outage.''
    So I appreciate you having this hearing. As a member of the 
House Committee on Homeland Security, we are taking cyber 
threats very, very seriously. I know Chairman McCaul is very 
interested in the cyber threats of this country in his role as 
chairman of the House Homeland Security Committee. So I 
appreciate the committee hearing, and I look forward to the 
testimony of the witnesses. Thank you, I yield back.
    Mr. Rohrabacher. Thank you very much. And if the 
microphones go off and the lights go off, we will know someone 
is watching. We are under attack. All right, Mr. Stockman, I 
understand, has an opening statement as well.
    Mr. Stockman. Yes, I was just going to comment that this 
morning--you stole my thunder a little bit. I was going to 
discuss the South Koreans. In fact, the IP address was that of 
China, and now there is some discussion over that. But I think 
it is a critical time that you do this hearing and I appreciate 
it. But also I know our Chinese friends are probably watching. 
I don't think that we should engage in this warfare, but if it 
is started I am sure that the chairman would lead us through a 
victorious end, because this is really alarming to many of us 
in this country. Thank you.
    Mr. Rohrabacher. Thank you very much. Our first panel is a 
single witness. Christopher Painter is Coordinator for Cyber 
Issues at the U.S. Department of State. Mr. Painter has served 
in the White House as senior director for Cybersecurity Policy 
in National Security Staff, and this is on the National 
Security Council, is that correct? Okay. During his 2 years in 
the White House, Mr. Painter conducted the President's Cyber 
Policy Review, and subsequently served as acting cybersecurity 
coordinator.
    Mr. Painter began his Federal career as Assistant U.S. 
Attorney in Los Angeles where he led some of the most high 
profile and significant cyber crime prosecutions that took 
place in our country, then moved onto Computer Crime and 
Intellectual Property Section of the U.S. Department of Justice 
and served there for a short time as deputy assistant director 
of the FBI Cyber Division. He has worked with dozens of foreign 
governments on these issues, and he is a graduate of Stanford 
Law School and Cornell University.
    Mr. Painter, you may proceed.

 STATEMENT OF MR. CHRISTOPHER PAINTER, COORDINATOR, OFFICE OF 
   THE COORDINATOR FOR CYBER ISSUES, U.S. DEPARTMENT OF STATE

    Mr. Painter. Chairman Rohrabacher and Ranking Member 
Keating and members of the subcommittee, thank you for the 
opportunity to testify on the State Department's role in 
countering cyber threats. I commend the subcommittee for 
focusing on this foreign policy imperative, and for your 
support promoting diplomacy as a tool for improving our 
nation's cybersecurity, and by extension, our national security 
and economic interests.
    The State Department plays a leading role in diplomatic 
efforts to stabilize cyberspace and to advance the vision of an 
open, interoperable, secure and reliable Internet articulated 
in the President's 2011 International Strategy for Cyberspace. 
We currently face several kinds of threats in cyberspace. 
First, there are the operational threats, which you just 
described, to our cyber networks that can potentially harm both 
our security and our economic interests, like the recent 
Distributed Denial of Service attacks against our financial 
sector.
    The State Department has worked closely in that instance 
with our Department of Homeland Security and other agencies to 
help share technical data that can then help mitigate the 
threat, and the sharing has been with both our international 
partners in countries and with industry. This kind of 
information sharing not only helps counter the immediate 
threat, but promotes a practice of international cooperation 
that will help prevent future attacks. It creates a norm of 
cooperation, if you will.
    Another kind of threat that has been making the news lately 
is obviously the large-scale wholesale theft, cyber theft of 
intellectual property and trade secrets from the private 
sector. The State Department has consistently raised our 
concerns about these cyber intrusions with senior Chinese 
officials, and we will continue to do so. I welcome recent 
Chinese official statements that suggest a willingness to 
engage in a more sustained dialogue and discussion on this 
important issue.
    It is critical that we continue to emphasize cyber issues 
in all of our international engagements to promote global 
cooperation, to ensure that states take threats seriously, to 
build consensus on norms of responsible conduct in cyberspace 
that enhance international cybersecurity, and to address the 
kinds of malicious activity that have recently received such 
extensive media coverage. Cyber policy issues are on the agenda 
in every major international forum, and in those forums some 
states seem to view the dynamism and innovation of the Internet 
as a threat to the stability of their regimes. They reject the 
successful multi-stakeholder model of Internet governance that 
includes a role for states, for civil society, and for industry 
in favor of top-down intergovernmental control that enables 
both state control and regulation of content.
    The U.S. strongly promotes an alternative vision. We 
believe that a cyberspace that rewards innovation, empowers 
individuals, develops communities, safeguards human rights, and 
enhances personal privacy will build better governments and 
strengthen national and international security. We promote this 
vision by working not only with our closest partners and 
allies, but also with states that are emerging as global 
leaders in this area, and with developing nations looking for 
ways to play a role in the cyber world and even with states 
with whom we do not always see eye-to-eye. The U.S. engages on 
cyber issues with a multitude of states bilaterally, regional 
groups such as the European Union, and NATO.
    In the last year alone we, my office, has launched 
dedicated cyber, whole of government, meaning not just my 
office but all the different agencies in our Government and the 
counterpart governments, senior policy dialogues with India, 
Brazil, South Africa, South Korea, Japan, and Germany in order 
to share perspectives and build a consensus view of the future 
of cyberspace. We continue to seek deeper engagement with 
countries like Russia and China who clearly have a different 
world view and with whom we have challenges but we need to find 
ways to develop a stronger relationship.
    The State Department will continue to focus on both the 
kinds of operational threats that you have identified here 
today, and on the long-term policy efforts that will help 
mitigate them in the long run. In his confirmation hearing, 
Secretary Kerry, then Senator Kerry, cited the importance of 
``cyber diplomacy and cyber negotiations,'' stressing the need 
to affirm `` `rules of the road' that help us be able to cope 
with challenges in cyberspace.'' State is doing just that. We 
are working with other nations on efforts that will not only 
contribute to greater security and stability in cyberspace, but 
will protect freedom of expression, ensure opportunities to 
innovate, and promote economic growth around the world.
    Thank you, Mr. Chairman and Ranking Member Keating, and I 
look forward to your questions.
    [The prepared statement of Mr. Painter follows:]

    
    
    
    
    
    
    
    
    
    
    
    
                              ----------                              

    Mr. Rohrabacher. Well, thank you very much. We also have 
Congressman Lowenthal who has joined us. Thank you very much 
for joining us this morning. Let us just figure out how serious 
people are taking this. Have we gotten beyond the let-us-sit-
down-and-discuss-it phase with other countries, or do we have 
an action plan that if we discover cyber attacks going on that 
there will be some type of retaliation against the criminal 
element or the government itself that is engaged in this cyber 
crime?
    Mr. Painter. So we face a wide range of threats in 
cyberspace from nation states to transnationally organized 
criminal groups. And how we respond to those different threats 
depends on what the threat is. And one of the problems, of 
course, is that attribution is difficult in this area and you 
don't know, often, exactly which group is doing what activity. 
However, speaking first from the cyber crime side, we are 
promoting around the world what is called the Budapest 
Convention on Cyber Crime so that every country will have 
strong laws in this area. They will have the capability to 
actually prosecute those laws, there will be better 
international cooperation. We have something----
    Mr. Rohrabacher. How many people have been prosecuted in 
China for cyber crimes?
    Mr. Painter. I would have to get back to you about it, sir. 
I don't know.
    [The information referred to follows:]

  Written Response Received from Mr. Christopher Painter to Question 
       Asked During the Hearing by the Honorable Dana Rohrabacher

    The lack of reliable or transparent statistical information on 
prosecutions renders it impossible to say exactly how many persons in 
China have been prosecuted for activities that we would consider to be 
cybercrimes. When the U.S. discusses cybercrime, we speak in terms of 
specific conduct criminalized in U.S. criminal laws, such as Title 18 
U.S.C. Section 1030, the Computer Fraud and Abuse Act. China, however, 
takes a very different approach and speaks in terms of ``criminal and 
terrorist activities that use information and communications 
technologies,'' as reflected in the Code of Conduct for Information 
Security that they jointly authored with Russia. The Chinese government 
considers cybercrime to include online speech that it views as 
undermining ``political, economic and social stability,'' categories of 
expression that would in almost all instances be protected in the 
United States by our Constitution's First Amendment, and that is 
protected by the right to freedom of expression in international human 
rights instruments.
    Addressing challenges in cyberspace, including combating 
cybercrime, is a priority for the United States, and we engage 
routinely with other nations to enhance international cooperation in 
these areas. Of note, the U.S.-China Cybercrime Working Group, led by 
the Department of Justice, is working to improve cooperation with China 
on cybercrime cases.

    Mr. Rohrabacher. Can you tell me any country in the world 
where we have had the prosecutions and what they have composed 
of?
    Mr. Painter. We have had many prosecutions in the United 
States.
    Mr. Rohrabacher. No, no, not the United States, the other 
countries of the world.
    Mr. Painter. There have been prosecutions, and many of our 
close allies in Australia and England, in Germany and France, 
there have been prosecutions.
    Mr. Rohrabacher. And what happens to someone in Australia 
or----
    Mr. Painter. It depends on their particular legal system. 
Of course, in the United States we have pretty substantial 
penalties based on financial harm for cyber crime. Other 
countries have similar regimes. And what is important about 
this Budapest Convention, this convention that is really the 
only existing instrument and the best instrument for cyber 
crime, is that it creates certain kinds of offenses that didn't 
exist before.
    So you may remember years ago when there was the ``I love 
you'' virus, and they thought they found the perpetrator, and 
the country where they found him didn't have any law that 
criminalized that issue. So the Budapest Convention allows 
countries to modernize their laws so there won't be safe havens 
for this conduct and you can prosecute.
    Mr. Rohrabacher. What would you suggest that we do, for 
example, if we come to the conclusion that a cyber attack both 
in terms of a criminal cyber attack and also strategic cyber 
attacks are actually being blessed, if not perpetuated and 
actually involved in the government of that country?
    Mr. Painter. I think we have to look at all the tools that 
we have at our disposal as a national government. But from my 
perspective, obviously the tools that we employ are the 
diplomatic tools. And those tools, I think, are important to 
make clear to a government that conduct this is a concern.
    Mr. Rohrabacher. And what are those tools, I mean 
diplomatic tools?
    Mr. Painter. Those diplomatic tools, I think, are two-fold. 
One is engaging directly with that government and saying to 
them that this conduct is something that we find unacceptable.
    Mr. Rohrabacher. Well, I am sure that will upset them a 
lot.
    Mr. Painter. Well, but I think you have to look at their 
overall relationship. With a lot of these countries we have 
many different types of relationships--economic relationships, 
other relationships.
    Mr. Rohrabacher. Have we done any of that?
    Mr. Painter. Yes. In fact, just recently the President has 
made clear in his call with the new----
    Mr. Rohrabacher. No, what actual sanctions have we put on 
any country? For example, it is clear that China has been 
deeply involved in this. Everybody knows it, supposedly. What 
have we done to say, okay, here is your deadline and this is 
exactly what is going to happen. You are no longer going to be 
able to purchase certain things from the United States, or be 
able to export to the United States, or whatever retaliation we 
would have.
    Mr. Painter. Sir, I would speak from my perspective and 
what we are doing diplomatically. I would say one thing though. 
I think with any of these threats we would have to be careful 
of looking at this in terms of retaliation, if it is a 
retaliation in terms of in-kind retaliation. We want to make 
sure that we are addressing the problem and addressing it in 
the larger context of any country we are dealing with. But what 
I would say is if----
    Mr. Rohrabacher. We have to accuse the right people, right?
    Mr. Painter. Right. And I do think that if you look at the 
statements just in the last couple of weeks, and let me go back 
a ways. We have engaged the Chinese in a strategic security 
dialogue on sensitive issues. We have only had two meetings of 
that group, last year and the year before. We raised cyber at 
both of those meetings. Secretary Clinton, last year, said that 
the theft of intellectual property and trade secrets was one of 
the greatest concerns of the United States, and we have had 
very frank discussions. And I can't really get into our 
bilateral private discussions in this setting, but I would be 
happy to follow up later on.
    And then recently, of course, you have heard Tom Donilon, 
the National Security Advisor, talk about the great concern 
that this poses for us and say three things. One, we want China 
to understand the scope and seriousness of this problem of this 
activity emanating from China. Two, that we want to make sure 
that it stops. That they actually take some action to 
investigate and stop this activity. And three, that we need a 
sustained dialogue with the Chinese. And we have some dialogue, 
but we don't have a sustained dialogue. And the President said 
that----
    Mr. Rohrabacher. Well, I am sure threatening to have a 
sustained dialogue is really going to deter these fellows along 
with proclamations of great concern. All I know is that I just 
asked you a specific question about specific actions and all I 
got was a list of words that had been spoken. And I am sure 
that words coming out of the mouth of officials of the United 
States is terribly frightening to the Chinese.
    Let me turn to Mr. Keating now.
    Mr. Keating. Thank you, Mr. Chairman. I mentioned in my 
opening remarks, in 2007 our NATO ally Estonia was subject to a 
series of cyber attacks directed at their Parliament, their 
ministries, their banking systems, newspapers, and 
broadcasters. NATO subsequently established the NATO 
Cooperative Cyber Defence Centre of Excellence in Estonia to 
enhance the capability, cooperation, and information sharing 
among NATO and its partners in cyber defense.
    Now does the State Department have any evaluation of the 
effectiveness of that initiative? And furthermore, some of our 
NATO allies have looked to the U.S. to lead on cyber 
initiatives in NATO-member countries. What sort of role has the 
U.S. had in this initiative going forward, and what kind of 
role is it willing to play? What implications does this 
initiative have on information sharing between all of the NATO 
countries?
    Mr. Painter. So a couple of things. The NATO Centre of 
Excellence in Estonia, the U.S. is supporting that effort and 
actually has personnel stationed there, and I think it is an 
important effort to look at some of the larger issues involving 
cyberspace. With respect to NATO, generally, as you know back 
in the Lisbon Summit, for the first time, and this was a 
proposal of the U.S., we made cyber a key part of NATO 
strategic concept. And first and foremost in that concept was 
making sure that NATO's own networks were secure, and that is 
something they have been working on in the last couple of 
years. They have also been promoting information sharing 
between members of NATO.
    Now NATO is not the only way we approach this. We deal 
obviously with the EU who just released an international--well, 
they released a strategy document for cyberspace. And it was 
remarkable because three parts of the EU, the External Action 
Service, the DG Connect as it is called, and their home 
ministry got together and collaborated on this strategy. And 
the strategy, the international part, is very similar to the 
U.S. strategy. It is very consistent with our strategy around 
the world, particularly in terms of promoting norms, and the 
existence and applicability of international law, existing 
international law, including the law of armed conflict to 
cyberspace. Those are critical things.
    So we are working with the EU. We are also working with key 
member states. We are working with the U.K. We are working with 
Germany. We are working closely with France. We are working 
closely with the Netherlands, and many others in that context. 
And we work through other forms, like the G8, for instance, and 
the OECD, and other forms like that. So there has been a lot of 
activity that we have been doing. There has also been our 
Defense Department who works with our allies in making sure 
that they have better defenses and building those defenses.
    And finally, our Homeland Security Department has been 
working with a number of countries and exchanging information 
with their computer emergency response teams. One thing, I 
think, that is a great development not just in Europe but 
around the world is that countries are developing national 
strategies for dealing with cyber. We have one here, and many 
other countries now have them, but in Latin America and other 
places those are being developed.
    The one other thing I would say just to reflect on the last 
question before yours, I do think it is important that we are 
raising this issue at a very high level. I think it makes a 
difference when the President raises this level, when Tom 
Donilon raises this level. And we are also doing things to 
protect us at home, like what DHS is doing to share information 
with the private sector and help harden the targets, make sure 
our defenses are better.
    Mr. Keating. Yes, I am on the Cybersecurity Subcommittee in 
Homeland Security as well. But how well are these other 
countries doing, working with the private sector side? Because 
governments can work all they want, but if we are not having a 
dynamic approach dealing with the private side as well we are 
not going to be successful in this. Are any of the other 
countries you are familiar with, are they doing a better job 
getting that kind of cooperation?
    Mr. Painter. I think we are all trying to make sure that is 
an effective partnership. I think it is extraordinarily 
important because the private sector not only owns most of the 
infrastructure but, frankly, government doesn't have all the 
answers. We have to engage with the private sector and others 
to make sure we go forward.
    When I started this office, a little less than about 2 
years ago now, one of the first things I did was start meeting 
with various private sector groups. Because they may see 
opportunities or dangers that perhaps we don't see in 
government, and it is important to make sure that they 
communicate with us on that, and they often go to some of these 
international meetings.
    Mr. Keating. Well, we are trying to balance here whether or 
not we go through regulations, and government is telling the 
private sector what they have to do. We are trying to balance 
off that to a more cooperative way to see if we could do--what 
are the approaches in some of these countries? Do we have 
countries that you are aware of where they are just having 
their own regulations on the private side and----
    Mr. Painter. I think there are countries that are more 
regulatory in nature, just by their nature. What we try to 
argue when we have our dialogues with other countries is that 
it is important for them to talk to the private sector. Some 
countries, frankly, don't have a history or a culture of 
talking to the private sector the way we do here. I think we 
made great strides in that here. For instance, even building 
our National Incident Response plan with the private sector 
from the ground up, something I don't think we have ever done 
before, and that was just in the last couple of years.
    But one of the things we do is when we do, for instance, 
capacity building, one of the great efforts of our office not 
only to help build capacity, but to try to convince the 
developing world that our way of looking at cyberspace is the 
correct one and will help them, we bring private sector along 
with us. We try to tell those governments, dealing with the 
private sector is critical in actually securing your networks 
in securing cyberspace.
    And I think obviously the executive order is very 
important, it is just the down payment on what we need. We 
still need legislation, as you know, and we still need 
legislation that we have talked about last year and talking 
about this year, and we hope we get it, that allows that both 
voluntary but very important connection between the private 
sector and government.
    Mr. Keating. I yield back, Mr. Chairman.
    Mr. Rohrabacher. Mr. Marino?
    Mr. Marino. Thank you, Chairman. Good morning, Mr. Painter. 
I am sure that you participate in classified meetings 
concerning intelligence that we accumulate and share with our 
allies, and you are between the devil and the deep blue sea 
here with what you can tell us and what you can't tell us. So I 
am just going to assume that that is the case. But I am a 
member of the NATO Parliamentary Assembly, and on a recent trip 
from a NATO meeting in Belgium it did not appear to me that 
this subject of cyber warfare was a top priority.
    Can you give me a suggestion as to what the administration 
is doing to make this a top priority, and are our allies behind 
us or beside in this and will it have an impact on Russia and 
China?
    Mr. Painter. Okay. So first, just in terminology, rather 
than use cyber warfare I just say the cyber threat and how we 
deal with the cyber threat. And I would say that as I mentioned 
before the fact that cyber is now part of NATO's operating 
concept when it never was before is a key consideration. And it 
is no small task for NATO to actually get its networks to the 
shape that--this is a foundational thing. If you have your 
networks, your own networks, NATO networks, and the member 
states' networks secured, you can build on top of that.
    I just met with Ambassador Iklody, yesterday, from NATO, 
who is their cyber person, and they are doing a lot of activity 
in this area making sure that they are having better security 
of their networks, and they are sharing information between 
member states, and I think that is the most important part.
    Mr. Marino. I understand that. But do you really think we 
are going to--let us get down in the weeds here. If the NATO 
members get together and implement severe sanctions, do you 
really think China and Russia are going to listen to us? I was 
in China and Russia not too long ago and I brought up the issue 
with them. They didn't like it. Actually, China acted like it 
wasn't happening, and Russia simply said so what.
    So let me give you a scenario here. Assume we have an 
attack on Wall Street, the stock exchange, it crashes, and we 
know from where it came. Have you worked out any scenarios as 
to what will happen from that point forward on behalf of the 
United States and some of its allies?
    Mr. Painter. Yes, to the extent that we have actually, just 
recently in the National Level Exercise that was conducted last 
year, for the first time that focused on cyber. So we were 
looking at very catastrophic events in the context of cyber in 
that exercise. And that both exercised how we were going to 
work together, but also we had some of our close allies 
participating in that exercise.
    And as with any other threat, and we lay this out in the 
international strategy, we use every tool at our disposal 
whether it be economic, diplomatic, I think we say 
informational, or even military. Military is a last resort and 
only after we have exhausted other options in law enforcement 
of course too. But we have the full suite of tools and we have 
close allies with whom we are discussing this with all the 
time, and----
    Mr. Marino. I do not mean to be facetious about this, but 
do you think that this has been working to any extent at all? I 
do not see any actual repercussions being implemented or any 
scenarios that would cause the Chinese or the Russians to stop 
it or curtail it at least.
    Mr. Painter. Well, first of all, I would say that we have 
certainly raised the pressure about how serious this issue is 
for us recently, as you have seen from the President's 
statement, from Tom Donilon's statement, et cetera. Other 
countries, I think, are also looking at this issue and how they 
are going to deal with this issue. We have made tremendous 
progress even in the last 2 years in treating this issue as 
much more, not just a technical issue but an economic issue, a 
national security issue, and a foreign policy issue. Other 
governments are doing that too but they are at different 
stages, and we are dealing with them and talking with them. 
Again, I really can't talk about our private conversations as 
you know.
    Mr. Marino. I understand. I have less than 20 seconds now. 
And I am also involved on the Intellectual Property 
Subcommittee, and it is a big issue with me, and we are losing 
billions of dollars and tens of thousands, maybe hundreds of 
thousands of jobs. But I have, maybe a little tongue-in-cheek 
sarcasm remedy is since we owe China so much money for our 
debt, why don't we deduct what they are stealing from us and 
take it away from the debt? I yield back. Thank you.
    Mr. Rohrabacher. Well, then they might have grave concerns 
as well if we did something like that.
    Mr. Duncan, you may proceed.
    Mr. Duncan of South Carolina. Thank you, Mr. Chairman. 
First off, I will just say America needs to realize that this 
is a real threat. And we talk about cybersecurity a lot, and it 
is not just some hacker stealing iTunes downloads or small-
scale intellectual property theft. This is on a grand scale. It 
is not only on grand scale with intellectual property with 
private corporations, but it is also the theft of military 
hardware plans such as some of our fighter aircraft.
    And so it is not just China. It is Iran. It is the 
Russians. It is a lot of different groups, organized crime and 
others that are pinging away at the United States trying to 
find a chink in our cyber armor. And I think it is important 
that we also realize that the electrical grid and a lot of the 
components that keep America operating are also in the sights 
of the cyber criminals and other entities. So I am concerned 
about that. And the reason I brought Mr. Clapper's comments up 
this morning is he also recognizes that this is an imminent 
threat and concern to the United States.
    And so I was reading about a Chinese operative, a scientist 
who was allowed to work with NASA and Langley through a 
contract, and was arrested by the FBI as he boarded an airplane 
carrying hard drives, flashdrives, and computers that most 
likely contained sensitive data that he downloaded. You can 
carry a tremendous amount of information on a thumb drive or a 
computer hard drive. But I think that pales in comparison to 
what can be downloaded through hacking. And something that is 
operating behind the scenes 24/7 without an actual person 
sitting there downloading into a thumb drive, it is going on by 
behind-the-scenes computers.
    And so at what point, in my opinion, does the 
administration consider that type theft, espionage, and damage 
to the U.S. computer systems an act of war?
    Mr. Painter. So again, what an act of war means and what an 
act of war would trigger, I think, is, as I look at the 
threats, as DNI Clapper articulated the threats, we have two 
kinds of conduct. We have the fear of the threat of cyber 
warfare, which is attacks on infrastructure that could be 
crippling, which he said as of this point, is remote, but we 
have to be worried about it, and then we have what we see every 
day which is the large-scale, unacceptable theft of 
intellectual property, and that is a real concern. It is a real 
concern, for me it is a real concern. Throughout our Government 
we are taking actions to try to both prevent that theft by 
making sure we have better security. That is why the executive 
order is there. That is why we are asking for legislation.
    We are talking to countries that we believe are involved in 
this activity. We are talking to our allies about this. We are 
also considering other actions more generally. But I think it 
is not that that is cyber warfare, but that is, I think, 
something that is clearly damaging to the American economy. It 
is the life's blood of these companies. It is taking away our 
future innovation. So we are taking it incredibly seriously, 
and I, certainly, even if I didn't have this job, as a former 
prosecutor who prosecuted intellectual property cases, I think 
this is a really important issue and it has gotten a lot of 
attention, as it should, recently.
    And so our part of this is trying to do a couple of things. 
In the short term, we are working to help mitigate these 
issues, working with DHS, working with other interagency 
partners, and in our diplomatic efforts both bilaterally and 
multi-laterally with other governments. In the long term, we 
are trying to make clear that the norm in cyberspace, the norm 
we are trying to promote is that this kind of theft of 
intellectual property and trade secrets is simply unacceptable, 
and countries that are outside of that core will get 
marginalized much as we did with money laundering back in the 
'70s. So this is something I think is both a short-term and 
long-term effort and we are taking actions on both of those----
    Mr. Duncan of South Carolina. And I appreciate your 
willingness to say that because it is not only damaging our 
economy and our abilities, it is taking our edge away 
militarily, our advantage. If they are stealing the plans of an 
F-35 and so we have to send F-35s against a comparable 
aircraft, that is taking some of that competitive advantage 
away that we have militarily to protect this country. And it is 
taking our economic advantage away with cyber crime that is 
taking intellectual property.
    And so at some point in time I would love for this 
administration to say no more. We are going to hold someone 
accountable. We are going to hold someone accountable for the 
theft. We are going to hold the host countries where the 
operatives are using the cyber attacks, whether it is China or 
Russia, we need to hold those host countries responsible to 
some degree for what is going on within their borders. I think 
we would do that to ourselves. I think the United States ought 
to be responsible for what is going on within our borders with 
regard to cyber crime, and I think we are.
    And so I think at some point in time we need to make sure 
that just a very clear line is drawn and a very clear 
understanding within the international community of what is 
acceptable and what is not acceptable with regard to cyber 
crimes, prosecution, and going forward. So Mr. Chairman, I am 
out of time, so with what I will yield back.
    Mr. Rohrabacher. Yes. What is acceptable and not acceptable 
and what the consequences are, because they don't care what is 
acceptable or not acceptable. They have to know what the 
consequences are, and so far we----
    Mr. Duncan of South Carolina. You are saying it a little 
more eloquently than I did, and I appreciate it.
    Mr. Rohrabacher. No, it has been clear the consequences are 
statements of great concern and statements of something that 
will be sustained. And we will give you a chance to answer that 
one after Mr. Stockman, who is one of our more timid members of 
the committee, also known as being a ferocious patriot, Mr. 
Stockman, you have 5 minutes.
    Mr. Stockman. I just have a concern. My district 
encompasses everything from NASA to petrochemical plants. And 
we were touring some of the plants, and they were stating that 
they were getting very little cooperation from the government 
on helping deter some of the cyber attacks. And they were 
mentioning that it could cripple our nation. Just by turning 
off a few valves it could blow up a plant. And this is 
something that is very serious.
    This reminds me of 9/11 when we knew about the Philippines. 
We picked up documents which showed that they wanted to use 
planes as weapons, yet we ignored all the signs. I feel like we 
are ignoring all the signs. And I have on the ground, plant 
managers telling me their concerns and yet they don't feel we 
are getting any help from the government. And I am asking you, 
is there any kind of game plan to help critical infrastructure? 
Have you identified it and said hey, we are going to talk to 
you guys? Because one plant alone in my district produces about 
600,000 barrels a day. If that were to be taken off the market 
you would see a quick crisis occur. And if you took off several 
plants it would shut down the United States.
    Mr. Painter. So my DHS colleagues deal with this all the 
time and, in fact, there have been designations of critical 
infrastructures and ways set up to deal with those industries 
and talk to those industries about cyber, not just about all 
the other issues they face and all the other challenges, but 
about cyber in particular. And certainly it is our goal to make 
sure that those companies understand both the scope of the 
problem, which is often a problem. Many companies don't 
understand, really, what the threat they are facing is, and 
that has been a problem we have had for the last 10 years, but 
they understand that the government does care about this and 
wants to work with them.
    And there have been a lot of activities recently in terms 
of sharing signature information, et cetera, with companies and 
with ISPs and with other providers to better protect that 
critical infrastructure. If you look at the executive order and 
the proposed legislation, that is targeted, again, at critical 
infrastructure. Narrowly defined but critical, because if 
something happens to it, as you say, it could really bring us 
to our knees. And that is extraordinarily important.
    And I would say this also, other countries around the world 
are focusing on critical infrastructure too. Certainly the U.K. 
and Germany or others are looking at this and say, what is it 
that we really need? What are the threats we are facing from 
cyberspace, what can they do to us, and how can we build better 
defenses? Part of it is building better defenses. Part of any 
strategy, any deterrence has to be building better defenses, 
and part of it, and my part of it has to be what we are going 
to do diplomatically.
    But that is only one part. This is a whole-of-government 
effort that includes DHS, it includes DoD, it includes the 
Commerce Department and Justice and the FBI in the full range 
of our activities, but they have to work together. And it is 
important that we have the foreign policy element, but that is 
one of the many elements in our tool kit that has to be 
integrated.
    Mr. Stockman. Can I just do a follow-up question there? Can 
you see from the plant manager's concern if you step in his 
shoes, and this is recent, the frustration he has that he feels 
like he is in a vulnerable situation and he is going to be held 
accountable, but he is not getting any kind of feedback from 
the administration or, quite frankly, anybody in the 
governmental body? He is sounding the alarms and then it is 
falling on deaf ears, so there is a great deal of frustration 
from his viewpoint.
    And I feel like maybe all of us in this committee and maybe 
in Congress are ignoring his concerns. It is a legitimate 
concern. As you know there is clips of things that were done 
remotely that were very devastating, and I will just ask that 
you somehow follow through on your plan to work with the 
critical infrastructure of this nation.
    Mr. Painter. I would just say that that is something that 
has been a priority now for a few years in our Department of 
Homeland Security, and other parts of our Government have been 
working strongly to do that. Before I came to the State 
Department in 2009, the cyberspace policy review we wrote talks 
about this issue exactly, raising awareness and addressing some 
of these concerns with the critical infrastructure.
    And if that plant manager is feeling that way that is 
certainly unfortunate, but we have to make sure that we are 
working with him, and I think we are. And the other thing I 
would say is that compared to even a few years ago the 
awareness level and the coordination among government agencies 
and the priority of this issue is higher than it has ever been.
    Mr. Stockman. Thank you. And I yield back the balance of my 
time, Mr. Chairman.
    Mr. Rohrabacher. Thank you very much. I want to thank the 
witness. And let us just note that we have a huge number of 
targets in our country that can be attacked via this mechanism, 
the cyber attack. And we cannot defend. It would be impossible 
for us to defend all these targets. Thus, the only way that we 
can defend ourselves is if those who are committing crimes 
against us face serious consequences and thus will refrain from 
those attacks.
    At this point, from your testimony--and let me just say you 
are a wonderful person and you take your job seriously. You are 
a former prosecutor, and I am sure that you put people in jail 
for committing crimes against other people and crimes against 
our society, but we can't put in jail the people who threaten 
us today and could do us great harm.
    And people have got to know overseas whether or not there 
is going to be a serious consequence, not just raising the 
words at a discussion between heads of state, but a serious 
consequence if they are found guilty here of being an 
accomplice to a major crime. A crime of shutting down maybe 
that oil refinery in order to give them leverage on some oil 
deals someplace else in the world that they are trying to make, 
or maybe even putting our air traffic control system out of 
whack for a day. There is too many targets to defend, and right 
now those people who could possibly commit these acts don't 
know what those serious consequences are. And that lack of 
definition that we have of what you are going to face if you do 
this, I believe, could cause serious consequences to our 
people. To our people, rather than the people committing the 
crime.
    So as you move forward in your job we wish you well this 
year. This committee is here to work with you in trying to--
because we are supposed to handle emerging threats, and if 
there ever was an emerging threat that is what we are talking 
about. But as a prosecutor, as a tough guy that deals with 
criminals, let us make sure that we are just as tough dealing 
with these cyber threats to our well being.
    And Mr. Keating, do you have a 1-minute summary would you 
like to make?
    Mr. Keating. Well, I think there is a lot of activity 
going. One of the things that we didn't get into that is worth 
mentioning is, as some countries move forward on these areas to 
try and do it under the guise of getting control over cyber 
threats, we have countries that are going to try and inhibit 
communication, social media, the kind of communication that is 
healthy in a democratic country. And so there is a balancing 
act to be made in that respect, and I think it is worth 
mentioning that that makes it difficult.
    But I would just say this. That I hope that this Congress 
can come forward with legislation this year. We will be 
reacting quickly if, indeed, one of our five top financial 
groups is hacked into for any extended period of time. It is 
conceivable they could go bankrupt. And if you compare that 
with what happened with the mortgage crisis, this would have 
far more devastating impact.
    And I do agree, just following up on what the chairman 
said, internationally with our allies, I think we should have 
more concrete sanctions and a ratcheting up once we have 
accountability. Because I think that will indeed help as a 
deterrence as well so people and countries will know what they 
are facing as a result. But I thank you for your testimony and 
your hard work in this area.
    Mr. Rohrabacher. Let us give the witness the courtesy of 
giving him the last comment, but not more than 1 minute.
    Mr. Painter. Not long.
    Mr. Rohrabacher. Not more than 1 minute.
    Mr. Painter. I appreciate that very, very much, Mr. 
Chairman. I would say that look, I am heartened that this has 
gotten so much priority and so much interest. Having spent time 
in this area now for over 20 years, the fact that over the last 
few years it has now become not just a technical issue but a 
real foreign policy priority, a real national priority, and a 
real international priority. It is a huge step, and that is 
something that we need to build on.
    I would also say that taking out of the context of any 
particular actor, even our international strategy, which by 
itself--we were the first country to put together an 
international strategy. We are the first country to create an 
office like mine, and many other countries have now have 
followed suit and that is important too. In international 
strategy we have a deterrent policy there. We say we will use 
all tools that we have. Diplomatic is one of them. It is just 
one of them. Diplomatic, economic, law enforcement, military, 
the full suite of tools in appropriate circumstances given the 
circumstances that are there.
    I think we are making a huge, it is a hugely complex issue. 
We are dealing with the Internet freedom issues. We are dealing 
with governance issues and keeping this a multi-stakeholder 
governments' process. We are dealing with the international 
security issue, the applicability of international law, 
building confidence between countries so things don't escalate 
out of control, so we can actually get some transparency to 
other governments, and we are working on cyber crime. So all 
these are important. It is a big lift over the next few years 
but something, I think, we are really prepared to do. So thank 
you.
    Mr. Rohrabacher. Well, thank you. Life wasn't so 
complicated before, was it? Thank you very much.
    We have a second panel who will be joining us now. So we 
have a very distinguished panel for our second panel. And 
first, what we will do is I will introduce all of you and then 
we will proceed with your statements and then we will go into 
questions after that. And if you gentlemen could make your 
statements around 5 minutes so that we have a little time for 
questions. There are votes coming up in the next hour at least, 
so we will have to adjourn at that point. So we will move 
forward as soon as we can.
    We will start with Mr. Richard Bejtlich is chief security 
officer at--pronounce that for me.
    Mr. Libicki. Mandiant.
    Mr. Rohrabacher. Okay, I am blacking out on that 
pronunciation. He was previously director of Incident Response 
for General Electric. Prior to GE he operated the TaoSecurity 
LLC as an independent consultant, where among other things he 
protected national security interests for Mantech Corporation's 
Computer Forensic and Intrusive Analysis Division. He began his 
digital security career as a military intelligence officer 
working for the Air Force Information Warfare Center and Air 
Intelligence Agency. He graduated from Harvard University, and 
the United States Air Force Academy.
    We have Michael Mazza, a research fellow at the American 
Enterprise Institute, and program manager for AEI's annual 
Executive Program on National Security Policy and Strategy. 
Michael Mazza has studied and lived in China and writes 
regularly on U.S. strategy in Asia and on Taiwanese defense 
strategies. He has a Masters degree in International Relations, 
Strategic Studies and International Economics from the Paul H. 
Nitze School of Advanced International Studies at Johns Hopkins 
University, and a B.A. from Cornell. The second Cornell man we 
have had today with us.
    Greg Autry is a senior economist for the Coalition for a 
Prosperous America. He is the co-author with Peter Navarro of 
the book, ``Death by China,'' and I might add it is a great 
book and a great movie. Considering how many times I was quoted 
in it that is what makes it even better. And Greg holds a B.A. 
in History from Cal Poly Pomona, and an M.B.A. from Merage 
School of Management at UC Irvine.
    And finally, Libicki. I am really bad at making these 
pronunciations. With a name like Rohrabacher you are going to 
have to--anybody can mispronounce my name, and we will make a 
deal. A senior management scientist at Rand Corporation, he is 
the author of Rand's study, ``Cyber Deterrence and Cyber War.'' 
Prior to joining Rand he spent 12 years at the National Defense 
University, 3 years on the Navy staff as program sponsor for 
industrial preparedness, and 3 years as a policy analyst for 
the General Accounting Office's Energy and Mineral Division. He 
has received a Ph.D. in Economics from the University of 
California at Berkeley.
    We will start with you.

 STATEMENT OF MR. RICHARD BEJTLICH, CHIEF SECURITY OFFICER AND 
       SECURITY SERVICES ARCHITECT, MANDIANT CORPORATION

    Mr. Bejtlich. Thank you, Mr. Chairman. Thank you, Ranking 
Member Keating, distinguished members of the committee.
    My name is Richard Bejtlich and I am the chief security 
officer at Mandiant. Mandiant is a computer security company 
that has one mission and that is to detect and respond to 
advanced intruders. We have been doing that for 9 years. We are 
unique in that respect that we were founded on the idea that 
you can't stop determined attackers, and there needs to be 
someplace for the private sector, or even in some cases, 
government agencies to call for help. And that is what we do. 
As I am sitting here today, we have teams out at somewhere 
between 12 and 15 customers, helping them recover from 
intrusions. Our software is helping dozens of other companies, 
hundreds of others, actually, at this point. And that is what 
we do as a company.
    So who is APT 1? Who is this group that we outed in our 
report? It is important to realize that APT 1--and APT stands 
for Advanced Persistent Threat. It is a term that was invented 
by an Air Force colonel in 2006 to tie back to Chinese threat 
actors. APT 1 is one of two dozen groups that our company 
tracks. APT 1 is the most prolific of these groups in terms of 
the number of industries that are affected. We estimate there 
is about 20 that we have personally witnessed including 141 
companies, 115 of which are in the United States.
    But there are other groups that we just did not decide to 
document in our report. APT 1 is actually Unit 61398. This is a 
unit of the People's Liberation Army. It is the second bureau 
of the third department. And the third department in the PLA 
General Staff does signals intelligence. So it makes sense. You 
take a signals intelligence unit and you turn them into a 
computer network operations unit. They operate primarily out of 
a headquarters outside of Shanghai that was built in 2007, 
130,000 square feet. And there has been TV coverage recently 
where reporters from CNN tried to take some footage. They were 
chased by soldiers and the footage was temporarily confiscated.
    Why did we release this report? We released the report 
because we wanted to move the discussion about this topic 
forward. As you probably heard, there has been talk of Chinese 
hackers. You couldn't tell if it was someone in his mother's 
basement. You couldn't tell if it was an organized crime group 
or such. We felt that we had been tracking this group for so 
long, for 7 years, and using a combination of technical 
indicators and non-technical indicators we were able to trace 
it back, right to the doorstep of this building, and figure out 
that this was this military unit.
    We wanted to speak for victims. We help hundreds of 
companies and they are all frustrated. They want something to 
be done but they don't want to come forward and say something 
about it. Very infrequently that happens. We have seen that now 
with the New York Times, Google, RSA, U.S. Chamber of Commerce. 
Outside of that no one talks about this. We also felt that the 
time was right. We felt that the time for watching the 
fireworks had passed, and our sense was that the government 
wanted to talk about this and we had the evidence to talk about 
it.
    And the report is completely based on our work, completely 
unclassified, not corroborated with government information. It 
just shows you what a dedicated group of, in this case our 
company is former military, former law enforcement, former 
Intelligence Community, and then just very motivated, highly 
skilled computer security people. This is what you can do if 
you devote yourself to this project. We also felt that if we 
provided the indicators of compromise, that data that talks 
about who these guys are, what they do to Western companies, 
and how they operate that people could defend themselves. And 
that has been fairly gratifying over the last several weeks 
since we released the report.
    People are finding these groups inside their companies and 
they are doing something about it. And it gives you an example 
of what could be done, I think, if the government were more 
forthcoming in sharing what the government knows about these 
actors. It is also important to realize, what are you supposed 
to do with this information? What I would say is, every company 
in the United States that cares about security needs to be able 
to take a report like ours, digest the information in it and 
look for intruders in your company.
    If you look at our report--and it is free. We are not 
charging for it. You download it from the Internet. If you look 
at this report and you can't do that, you can't figure out how 
to find intruders in your company, that is probably job one. 
You need to be able to do that. And secondly, you need to be 
able to see over time how this affects you. We find too many 
companies don't treat this as a business process. They treat it 
as something that engineers and technicians need to deal with. 
You need to realize that dealing with intruders is a fact of 
life in the business world and it needs to be a continuous 
business process that you deal with. I thank you for the 
opportunity to testify today, and I look forward to your 
questions.
    [The prepared statement of Mr. Bejtlich follows:]

    
    
    
    
    
    
    
    
    
    
    
    
    
    
                              ----------                              

    Mr. Rohrabacher. Thank you very much. And let us just note 
that we do rely on the police to protect us, but also 
throughout our country we know that there are companies and 
individuals that seek private protection with security 
services, and they have guards at their gate and such as that. 
And so in this case with this particular threat, we of course 
need to all work together and it will encompass private sector 
investment as well as government action.
    Mr. Autry, you may proceed.

STATEMENT OF MR. GREG AUTRY, SENIOR ECONOMIST, COALITION FOR A 
                       PROSPEROUS AMERICA

    Mr. Autry. Thank you, Chairman Rohrabacher, Mr. Keating, 
and members. I wanted to particularly thank Mr. Marino for your 
strong comments with the earlier panelist.
    Mandiant Corporation's brilliant report has made obvious to 
everyone what we have known all along in that there is a giant 
sucking sound in our economy and it is coming from China. The 
military origin, the billions of dollars in damages, the 
infrastructure, and the focus on technology make it clear that 
this is a 21st century act of war. This is not some petty crime 
happening by a bunch of Internet trolls in China. China 
controls the Internet better than any country on earth. I know 
that from strong personal experience. I guarantee you that if 
they can find my emails to dissidents they can certainly track 
down a giant organized cyber attack happening in their own 
territory.
    China does not view the U.S. as a valued trading partner 
and a model for progress. We have got to give up on this naive 
perception that China is doing everything they can to move 
forward to become the United States. They are not. They view us 
as a ideological adversary who they see as weak and foolish and 
something that needs to be controlled.
    The Internet was developed by the United States Government 
at United States taxpayer expense. We in the United States and 
in the U.S. military have every right to expect special 
privileges in the Internet, and we need to make sure that it is 
not debased by either hoodlums or nations who do not appreciate 
the rule of law. It shouldn't be used by tyrants to repress 
their citizens, and we shouldn't allow those same tyrants to 
attack our corporations and our infrastructure. The Chinese 
Government can't think of enough things to do with the money 
that they have been earning from the economic warfare that they 
have been executing against the United States.
    While we are frustrated over a 2-percent cut, the Chinese 
are launching moon missions, building maglev trains, launching 
the biggest military buildup that we have seen since the 1930s. 
Meanwhile, these cyber attacks against the United States are in 
the same financial class as the 9/11 attacks. They are costing 
clearly, billions, and I believe, hundreds of billions of 
dollars, and this translates to real effect on American 
individual workers, and this results in loss of life to 
Americans as well.
    And so I ask, why does China get a pass on this scurrilous 
behavior and every other form of scurrilous behavior that they 
engage in from economic abuse to human rights? I believe that 
if Unit 61398 were a segment of the Iranian Republican Guard 
located in Tehran that that building would be a smoldering pile 
of rubble before I got a chance to testify, yet there seems to 
be something going on with China.
    And I think that the problem is, frankly, that a lot of 
American corporations are co-opted by the Chinese regime. They 
have such a huge interest in the production capabilities and 
the ability to exploit Chinese labor and the Chinese 
environment to lower their costs, and they are chasing the 
delusional promise of this giant market that they are someday 
actually going to be given access to that they don't dare 
offend their Chinese host.
    They are like the abused partner in an abusive spousal 
relationship. They are not going to call the cops on the 
Chinese, and they are really not going to do it when they know 
that the cops don't show up and that the cops don't have any 
guns, which is the situation that we are in now.
    This is not a technical challenge, it is a military one. No 
amount of locks or alarms could protect your home if there was 
no belief that the police would show up or that the prosecutors 
would do anything if you had burglars working in broad daylight 
against whatever security you had put in place.
    We need to do some serious actions. And I strongly 
recommend, first of all, that we have a tariff on Chinese 
technology that accounts for our governmental cost in 
cybersecurity to defend against the Chinese, and for the 
damages that we estimate against our corporations, until there 
are no further signs of this sort of activity. We should have a 
ban on the import of any Chinese networking hardware, and 
specifically I mean Huawei. We need to stop the revolving door 
at the State, Treasury, and Commerce Departments where 
officials from those Departments come directly from doing 
business with China or look forward to doing business with the 
Chinese as soon as they get out of government service.
    Finally, we need to stop educating our adversary. Our 
computer science departments and engineering departments are 
full of mainland Chinese students, the majority of whom return 
to mainland China. Why are we educating these students of a 
country who are using that technology that we are handing them 
to oppose our interests? Thank you.
    [The prepared statement of Mr. Autry follows:]

    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
                              ----------                              

    Mr. Rohrabacher. Thank you very much.
    Now we have 10 minutes before the vote is actually taking 
place. What we could do is we will have the testimony from Mr. 
Mazza. We will then recess. As soon as the votes are over we 
will come back and have a few questions for the panel, if that 
is all right. We apologize, but we don't have the control over 
when the votes come.
    Mr. Mazza, you have 5 minutes, and then we will have 5 more 
minutes to get to the floor.
    Go right ahead.

   STATEMENT OF MR. MICHAEL MAZZA, RESEARCH FELLOW, AMERICAN 
                      ENTERPRISE INSTITUTE

    Mr. Mazza. Chairman Rohrabacher, Ranking Member Keating, 
members of the subcommittee, thank you for the opportunity to 
testify before you today on China's use of cyber capabilities.
    China, I argue, sees cyber capabilities as a tool of 
statecraft, and like any such tool, it can and should be put to 
use in the pursuit of national interests. What are those 
interests? In brief, the primary goal of the Chinese Communist 
Party, or CCP, is to stay in power. No longer securing its 
legitimacy on a foundation of Marxist ideology, the Party now 
relies on delivering economic prosperity and on its claim to a 
nationalist mantle to ensure its continued rule.
    And in my remarks here I am going to focus on the more 
traditional aspects of security implications rather than 
economics. China's continued rise is crucial if the CCP is to 
validate its claim that it and it alone can lead the country 
back to what it sees as its traditional and rightful place atop 
the Asian hierarchy. And to do so, Beijing must restore 
sovereignty over territory supposedly wrongly taken from it. 
Doing so would not only allow Beijing to complete what it sees 
as an historic mission, but to enhance its own security. 
Controlling islands in the East and South China Seas would 
grant China greater strategic depth, allow it to more easily 
safeguard or control sea lanes, and permit it to more easily 
access the Pacific and Indian Oceans.
    But of course, these waters are also home to U.S. treaty 
allies, long-standing security partners, and new friends. And 
it is in these littoral regions where tensions have been 
running high, where conflict is most likely to break out, and 
where U.S. and Chinese interests clash. Differing visions of 
what Asian and perhaps global order should like have led China 
and the United States into what is shaping up to be a long-term 
strategic competition. For China, cyber capabilities are tools 
to be used in waging this competition and in securing its 
interest in the Asia Pacific. And in particular, I hear that 
China uses cyber capabilities for three related but different 
purposes.
    First, Chinese hackers will engage in espionage activities 
in the pursuit of both strategic and tactical intelligence. 
Such activity is unwelcome but shouldn't be unexpected. The 
United States and China are going to spy on each other. Second, 
the People's Liberation Army, or PLA, will use cyber warfare as 
part of its suite of anti-access/area denial capabilities, or 
A2/AD. The PLA has been developing systems aimed at keeping 
U.S. forces distant from Chinese shores, complicating in 
particular the U.S. Navy's ability to operate freely in the 
Asia-Pacific Theater and thus making U.S. intervention in the 
Taiwan Strait or other conflict more difficult. In the event of 
a conflict, PLA cyber forces would likely aim to disrupt U.S. 
military command and communications networks, essentially 
trying to blind, deafen, and silence U.S. forces.
    Third, and in my opinion, most worrisome is China's 
development of what might be called strategic cyber weapons. 
Recent revelations of Chinese cyber intrusions into U.S. 
critical infrastructure are especially troubling. That an 
attacker a half a world away could threaten our electrical grid 
or transportation security is of course a frightening thought, 
but in my opinion, even more concerning is that China's 
development of these capabilities is potentially destabilizing. 
Because the weapons lack the ugliness of nuclear arms, Beijing 
may come to see them as more usable than nuclear weapons. And 
with such weapons likely to be seen as adding an intermediate 
step on the escalation ladder, Beijing may come to see armed 
conflict as less dangerous than it otherwise would have.
    Fortunately there are steps the United States can take to 
arrest China's use of cyber capabilities and ensure American 
national security going forward. These steps fall into three 
broad categories--legal, diplomatic, and military and that they 
all be suggestions that require further thought, certainly. In 
the legal realm there may be need for new legislation. My 
colleague Dan Blumenthal has recently argued that Congress 
should adopt a cyber attack exception to the Foreign Sovereign 
Immunities Act to allow for civil suits against foreign 
governments acting illegally in the cyber realm. This is 
something that we have done in the realm of terrorism.
    Diplomatically, there are several paths to take. Ideally, 
of course, China will be willing to join in some broad based 
international effort to establish norms and rules of the road 
in the cyber realm, but as you have pointed out, China will 
need incentive to do so. The Obama administration has suggested 
that cyber threats will threaten the overall U.S.-China 
relationship, but it needs to start elucidating just what that 
means. What are the risks? Potential options include limiting 
access to the U.S. market for Chinese state-owned enterprises 
or pursuing action at the WTO.
    In the military sphere the United States should be clear 
about how we will respond to the use of strategic weapons on 
American soil. The Department of Defense should explore whether 
it is possible to conduct cyber exercises that will effectively 
demonstrate U.S. capabilities, much as conventional exercises 
are used, for example, to deter North Korea. If the United 
States limits itself to just playing defense in cyberspace, it 
is likely to find itself on the losing end in a competition 
with China. Playing offense, not just militarily but in the 
legal and diplomatic fields as well, will allow Washington to 
impose costs on Beijing when necessary and enhance national 
security. Thank you.
    [The prepared statement of Mr. Mazza follows:]

    
    
    
    
    
    
    
    
    
    
    
    
    
    
                              ----------                              

    Mr. Rohrabacher. Thank you very much.
    Now we have 4 minutes to go down and vote. And Dr. Libicki, 
I am sorry that we are going to--or are you going to be able to 
hold off? It will be about a half an hour by the time we get 
back here.
    Mr. Libicki. Certainly.
    Mr. Rohrabacher. Thank you very much. So what we will do is 
I will recess the hearing for 30 minutes, and so we should be 
back in a half an hour. And let us just note for the record as 
we recess that we are talking about here a--Mr. Keating, we 
have heard testimony indicating that the cyber attack has been 
traced directly back to a unit of the Chinese army, and this is 
phenomenal that we can actually have evidence of an army of 
another country involved in this type of criminal activity 
aimed at Americans and others.
    We have also heard testimony about the United States, 
through our Chinese student graduate program have perhaps 
educated some of the people in that Chinese army unit, who then 
took the knowledge back that they gained in the United States, 
to attack us. And so we will have some questions for our panel 
along these lines when we come back, and Dr. Libicki will have 
his testimony. So this hearing is now in recess for 30 minutes.
    [Recess.]
    Mr. Rohrabacher. Okay, this hearing is now called to order, 
and we had a 30-minute break. We will now proceed with the rest 
with the final witness, and then we will proceed to have some 
questions, and hopefully we will be adjourned in about a half 
an hour from now.
    Dr. Libicki?

   STATEMENT OF MARTIN C. LIBICKI, PH.D., SENIOR MANAGEMENT 
                  SCIENTIST, RAND CORPORATION

    Mr. Libicki. Good morning, Chairman Rohrabacher, Ranking 
Chairman Keating, and other----
    Mr. Rohrabacher. Someone has tampered with the electronics 
and you are not coming through on that phone, or maybe you just 
need to put it over here.
    Mr. Libicki. Good morning, Chairman Rohrabacher----
    Mr. Rohrabacher. There is a lesson to be learned in that.
    Mr. Libicki [continuing]. Ranking Member Keating, and other 
distinguished members of the subcommittee. Thank you for the 
opportunity to testify today on cyber attacks, an unprecedented 
threat to U.S. national security.
    On September 11th, 2001, terrorists attacked the United 
States. Three thousand people died and the physical damage was 
upwards of $200 billion. On September 12th, the country 
responded. The United States strengthened its homeland 
security. We went to war twice. Over the next dozen years the 
United States lost 6,000 in combat, 10,000 to 20,000 were 
seriously injured. Total additional expenditures exceeded $1 
trillion.
    I point this out not to criticize the policies that 
followed but to indicate that even though an attack on the 
United States may be damaging the cycle of response and 
counterresponse may be far more consequential. Accordingly, 
even though a cyber 9/11 may be costly, it would be short-
sighted to evaluate the threat in terms of immediate damage 
without considering how the United States would manage such a 
crisis in order to yield an outcome that works best for the 
American people.
    We are right to be worried about a 9/11 in cyberspace, but 
we also ought to worry about what a 9/12 in cyberspace would 
look like. Indeed, one of the best reasons for working hard to 
avoid a 9/11 in cyberspace is precisely to avoid having to deal 
with a 9/12 in cyberspace. That noted, because a cyber 9/11 or 
what looks like a cyber 9/11 might happen, it is worthwhile to 
think about what we do the day after.
    The issue of how the United States should manage crisis and 
escalation in cyberspace is addressed in a recently published 
Rand document of the same name. I now want to take the 
opportunity to summarize some of the salient points in the 
document. The first point is to understand that the answer to 
the question, is this cyber attack an act of war?--is not a 
conclusion but a decision. Cyber wars are wars of choice. A 
country struck from cyberspace has the opportunity to ask, what 
would be the most cost effective way of minimizing such future 
suffering? Depending on circumstances it might be to go off to 
war. Alternatively, it might not be.
    The second is to take the time to think things through. 
Computers may work in nanoseconds, but the target of any 
response is not the computer, in large part because even if a 
computer is taken out a substitute may be close at hand. The 
true target of response is those who command cyber warriors, 
that is, people. But people do not work in nanoseconds. 
Persuasion and dissuasion of people are work at roughly the 
same speed whether or not these people command cyber war or 
command another form of war.
    Third is to understand what is at stake before you react, 
which is to say, what you hope to gain by making the attackers 
cease their efforts. This goes for both responding to cyber 
attack and to responding to what may be deemed intolerable 
levels of cyber espionage. Fourth is to not take possession of 
the crisis unnecessarily, or if you do take possession at least 
do so only on your own terms. That is, do not back yourself 
into a corner where you always have to respond whether doing so 
is wise or not.
    Fifth is to craft a narrative that facilitates taking the 
crisis where you want to take it. In some cases, the narrative 
has to allow the attacker to back down gracefully, which is to 
say cease what they are doing. Sixth is to figure out what are 
the norms of conduct in cyberspace, if any, work best for the 
United States. It may be encouraging that last week both the 
United States and China agreed to carry out high level talks on 
cyber norms, but there are a lot of questions to work through. 
Where, for instance, does one draw the many lines among cyber 
war, cyber crime, cyber espionage, and violations of 
international trade law?
    Seventh is to manage the cyber escalation wisely. This not 
only means remembering that the other side will likely react to 
what you do, but understanding what a crude tool tit-for-tat 
counterescalation is when it comes time to influencing the 
behavior of the other side. In sum, while I believe it is 
certainly a worthwhile effort to prevent the future 9/11 in 
cyberspace, similar levels of care and thought need to be given 
to how to manage a potential 9/12 in cyberspace. If not, we may 
find as with the historical 9/11 that the consequences of the 
reaction and counterreaction are far more serious than the 
consequences of the original action itself. Thank you very 
much.
    [The prepared statement of Mr. Libicki follows:]

    
    
    
    
    
    
    
    
    
    
    
    
                              ----------                              

    Mr. Rohrabacher. Thank you very much.
    Now we have heard some very thought-provoking testimony 
today, and the complications that you just outlined and the 
different levels that we have to consider and the timing of 
consideration, as I said earlier that when we had our first 
witness from the administration, things are a lot more 
complicated now than they used to be basically in terms of 
providing security for our country, but also providing a 
methodology of dealing with criminal behavior on an 
international and global scale.
    We have heard today about especially when we were talking 
originally about the Chinese military itself is engaged in 
cyber espionage and perhaps cyber attacks. Let us note that 
this is different than just having the Chinese army engaged in 
some act of aggression against an enemy or against an adversary 
of China. In this case the Chinese military is engaged in 
activity that has security implications but also economic 
implications, mainly for the leadership of China which is an 
oppressive dictatorship, a cliquism. They may be utilizing this 
apparatus to enrich themselves as well as their clique.
    We also know that this what we are talking about is cyber 
attacks, we are also talking about cyber oppression. That in 
China you have so many people who are engaged in cyber 
operations at the direction of their government, but those 
directions may not be an attack on the United States or on a 
competitor, but they also may be aimed at their own people in 
oppressing their ability to utilize the Internet for a free 
type of communication.
    So we have all of these factors coming to play. Perhaps 
what ties them all together is the fact that the United States 
has been the enabler of all of this. Whether it is positive or 
negative we have enabled this. The Internet is an invention of 
the United States of America. It has been put in place 
basically by our technologists. And on top of that, we have 
trained and continue to train people to have expertise in this 
new arena of human behavior.
    So we have a relatively new arena, the cyber arena, and we 
have indiscriminately, whether or not the people that we are 
training are representing a positive force in the world or a 
negative force in the world, we have been training them at our 
universities and educating them at the highest level of 
graduate studies into these type of scientific endeavors that 
utilize the Internet. We have been training people to go home 
and use them. For example, when we talk about Chinese military 
unit, now are we suggesting that that Chinese unit is just a 
bunch of corporals and privates, or do they have Ph.D.s in that 
unit that you have tracked down? Are there Ph.D. students that 
perhaps were trained in American universities?
    Mr. Bejtlich. Sir, we don't have any specific information 
about that sort of activity. What I will say is that we have 
seen, and this is all through open source again, documents, 
submissions to conferences by Ph.D.s who say their job is 
working for 61398. And when they submit these papers they 
didn't realize that by saying 61398 someone could later on tie 
them to that Chinese military unit. In other words, that was a 
code name that they never thought would be penetrated. So you 
can find documents on the Internet talking about different ways 
to conduct computer security, different ways to write software 
where the authors will say, I am 61398.
    Now I don't know of any case where you have tied that back 
to say well, where did this person study? Did they study at Cal 
Tech or something like that? I don't know of anyone who has 
done that sort of analysis. But clearly you have very well 
trained people. This unit was very focused on hiring English 
speakers. That was the goal of this unit. You had to speak 
English. You had to know computer security, computer science, 
and as a result they were able to take that expertise and 
target English-speaking companies.
    Mr. Rohrabacher. I would suggest, and Mr. Autry, I would 
like your opinion because you are the one who first brought up 
this issue of actual educated individuals. If you provide a 
person with the education in this arena of high technology type 
understandings of physics, et cetera, we are actually arming 
those people to do good things or bad things. And yet we are 
not paying any attention as to whether or not those students 
who we are educating in these graduate level classes, 
especially the Chinese students, are going to go back to China 
and participate in oppressing their fellow Chinese or 
threatening the well being of other countries that are 
considered adversaries by the Chinese Government. And maybe you 
could expand upon that thought.
    Mr. Autry. Yes, thank you, Chairman Rohrabacher. As a 
lecturer and a Ph.D. student at the University of California 
Irvine, I have noticed the ever-increasing predominance of 
Chinese mainland nationals in our classrooms. In the business 
school it is not unusual for the Ph.D. cohort to be fully 50 
percent mainland Chinese students. In the M.B.A. programs I 
often see a quarter of the classes mainland Chinese students. 
My understanding is that in computer science and engineering, 
classrooms with 40 percent mainland Chinese students is perhaps 
the norm.
    This should be of great concern to a nation who prides 
itself on its technological development to drive its economy 
and to make its defense second to none in the world. It is a 
great thing when we open up our schools to students from around 
the world who wish to embrace American values and learn from us 
and take them home and emulate what we have done, but I have to 
say of the Chinese cohort that I work with on a regular basis 
many of them are at best apolitical. They certainly are not 
here to embrace our ideological values, and many of them are 
openly hostile to American ideological values and see any 
criticism of the Chinese Government to be inappropriate and 
something that they don't want to see happening.
    I believe that limiting visas for students in computer 
science to countries that do not engage in cyber attacks 
against the United States is a very realistic option we should 
consider. Thank you.
    Mr. Rohrabacher. I have been aware of this problem for 
awhile, and when I have spoken to presidents of major 
universities like Stanford University, for example, I just get 
the answer that well, that is for the government to worry about 
but not for us, not in academics. Security issues should be 
handled by the Federal Government not by academics.
    I would suggest that this is, what we are talking about 
today is the equivalent of equipping a hostile power, let us 
say, 50, 60, 70 years ago, but helping to equip a hostile power 
with the ability to build a nuclear weapon. I mean if you have 
students from Germany and you say, well, we can't really make a 
decision about the nature of the regime that controls Germany, 
or Stalinist Russia, and then we equip graduate students with 
the knowledge of how to put together a nuclear weapon, that is 
an insane, suicidal, national suicidal policy, and would have 
been then and our people certainly recognize that.
    I guess it is hard today when China is presenting itself as 
our adversary wherever they can, allying themselves with the 
rotten regimes in the world and trying to make hostile 
territorial claims as well as of course their economic, what I 
consider to be economic aggression. But as we just heard that 
the cost of 9/11 was $200 billion. Is that what----
    Mr. Libicki. Yes, correct, the cost of 9/11, roughly, in 
property damage. Somewhere between----
    Mr. Rohrabacher. So the cost of 9/11 is $200 billion, but 
we also heard earlier that your report suggested that there was 
about $250 billion a year lost to cyber attacks of some kind or 
another. So what we have here is a huge issue of security that 
should consider even our major universities as to what kind of 
knowledge that they are permitting to be provided to people who 
might do us harm. And I would think and I would suggest that we 
are not now paying attention to that.
    And again, every time you hear about we are going to bring 
people in, foreign students, and it is all done in the name of 
taming a potential adversary. But if you are bringing these 
people in and they are only taking science classes or 
mathematics classes at the highest level, you are not taming 
them at all. You are just providing them with technical 
knowledge and technical know-how. Perhaps we should insist that 
we do have exchange students coming in from every country 
including China, but they have to be social science majors, and 
they have to be aimed at understanding freedom of thought and 
intersocial interaction and perhaps even economics instead of 
how to make bombs and how to destroy people through the cyber 
system.
    Let me see, some of the other questions that I had here for 
us today. So let me just say, I would like to make this 
statement for if the Chinese people are listening. I would like 
to say something directly to the Chinese people and the Chinese 
cyber intelligence personnel. Intelligence gathering among 
nations has been going on for thousands of years, and I 
understand that and everybody on this panel understands that.
    But what differs with what governments did in the past and 
what they are doing and what is being done now by the leaders 
of China and other countries, is they are using the nation's 
intelligence apparatus to enrich themselves. You have an elite 
in China using the intelligence system including the cyber 
potential to enrich themselves, yes, to to give their country 
leverage, but for the first time we see the enemy has a 
personal motive in committing this aggression and having the 
ability to do so. The elites' use of China's intelligence 
agency is like having a private corporate detective, and 
basically you can have a private detective working for you if 
you have a company, but if you are using it for a personal 
reason you are cheating your company.
    The people of China are being cheated in that the apparatus 
that has been set up to protect them is being used to enrich 
the elite, and at the same time put China into a hostile 
relationship with the United States and other free countries of 
the world. And on top of that, the elite in China are using 
this not to protect China, not to make it more prosperous, but 
also to repress their own people. And do people that work for 
the Chinese Government, do they want to be a cog in a system 
that is designed to destroy the potential for freedom of all of 
their fellow Chinese?
    The elite in China, their vanity and their desire for more 
wealth and power has led China down a wrong path, and I would 
urge those people in China, which is the vast majority, the 
people of goodwill there, to push this elite that is running 
their country that is raping their country and putting us on a 
path to conflict, to push them out of power and to reach out to 
the United States with a hand of friendship as we would reach 
out and want to reach out to them. In the cyber field this is 
vitally important.
    And what I will do is give the witnesses each 1 minute more 
to comment and then we will probably close the hearing. We will 
start at this end because you had to wait for a long time to 
start, so go right ahead.
    Mr. Libicki. I think we need a better understanding of the 
impact of Chinese economically motivated cyber espionage on the 
United States' economy. We hear a lot of numbers being thrown 
around. We don't really know how they are derived or how 
consistent they are with how we know economics works.
    We are fairly confident that terabytes of data go from the 
United States and end up in China. We have very little 
visibility about what happens when they go to China and 
supposedly go to people who can make use of them. So I would 
suggest, in fact, that it is an important issue, because just 
to throw random numbers around here, if it is a trillion-dollar 
problem we treat it one way, if it is a billion-dollar problem 
we treat it another way. Our relationship with China is 
extremely complicated, has many facets, and it is useful for us 
to get our priorities correct, and that kind of information 
will help do so.
    Mr. Rohrabacher. Mr. Mazza?
    Mr. Mazza. Thank you, Mr. Chairman. In my remarks today and 
others have cited this as well, that what is really needed is 
sort of a, I guess a whole-of-government approach you could 
call it, really using all of the arms of American power to 
achieve our ends. But I think it can't be understated how 
important the U.S. military is in this effort. As we heard, the 
PLA is playing a very direct role both in the commercial 
espionage as well as the more traditional in military 
activities, and a military response is needed. We need to 
consider whether or not that needs to be purely cyber in the 
future or not, and what options we will have in the event of 
conflict to put a stop to cyber activities emanating from 
China.
    Mr. Rohrabacher. Mr. Autry?
    Mr. Autry. I concur that it would be great to know more 
about this, but I think that we know enough already in that 
there is hundreds of billions of dollars in damage, which means 
thousands if not millions of American jobs, and consequently, 
American lives lost in this issue. It is not our burden of 
responsibility to prove exactly what the damages is, but it is 
our responsibility to stop this hostile and overt action by the 
Chinese military against the United States of America.
    Mr. Rohrabacher. Mr. Bejtlich?
    Mr. Bejtlich. One of the key elements of our report was the 
finding that this particular group was, on average, present 
inside Western companies for a year before anyone was able to 
find them. There are some cases that stretch up to 5 years. I 
would encourage, when Congress is considering legislation, to 
go beyond just the idea of continuous monitoring. That is a 
term that means essentially checking baselines, looking for 
configuration flaws, and instead go to a more operational model 
where you are looking for intruders on your network.
    You need to have teams of people equipped with the sort of 
privacy-friendly intelligence that is in the Mandiant report, 
using that information, looking for intruders on the network 
and then dealing with them once you find them. It is not enough 
to just be patching your flaws, to have good software. The 
intruders will find a way in. You have to be out there looking 
for them in order to succeed. Thank you.
    Mr. Rohrabacher. And so let me finish it off with it is not 
enough to know that we are willing to go out and find those 
people who are hacking the system, whether it is an organized 
group out of China that represents a government aggression upon 
the other nations and other people or whether it is just 
individual hackers or criminals around the world who are 
engaged in trying to get into people's bank accounts and take 
money or in some way to mess with the system.
    So it is all of these elements, but identifying them is not 
just, we have to also understand what we are going to do in 
response. And I will have to say that so far especially from 
our first witness who is not here to make a further comment 
although I would give him that opportunity now, but I am sure 
that he is doing his job but I don't believe that the United 
States Government is doing its job in making sure that we are 
prepared to deal with a threat as expansive as this threat, 
which is going to get even worse and worse as we become more 
and more dependent on this cyber world for us to remain an 
effective society and a safe society. But at this point I have 
not heard what we will do once we find out all of that 
information.
    Now we know there is a building and we know there is 
People's Liberation Army people in the building and we know 
that that is the source of cyber attacks or cyber oppression 
coming out of that building, so what are we going to do about 
it? Well, I think it has got to be more than well, we are just 
going to--what was the wording we had earlier about raising, 
basically raising the level of rhetoric. And I would suggest 
that raising the level of rhetoric does not mean anything to 
bullies and gangsters. And if you are dealing with bullies and 
gangsters there has got to be some form of retaliation. And we 
have not had any examples of what we can actually do, except 
Mr. Autry, I think, explained something about we can determine 
what the price tag is and maybe put a tariff on goods coming in 
from China or other countries.
    But remember what happened today. What happened today was 
we thought that South Korea, which has been attacked, their 
banking system and other parts of their economy have been 
attacked, today identified not North Korea but China as the 
aggressor in this situation. So you may have China hiding 
behind North Korea, which it has done in many cases, or various 
groups hiding and portraying themselves actually as these 
attacks are coming from someone else.
    Well, we need to know. It is getting more complicated. It 
is not going to get less complicated. But one thing is for 
sure, our Government is not prepared to deal with this threat. 
We are unprepared. And when something happens, if it is of a 
huge magnitude or someone fiddles with the air traffic control 
system or the grid, as Steve Stockman mentioned, even the oil 
industry now they could hack into that and screw up our entire 
production of energy, of oil and gas. If something big like 
this happens and if it is a well thought out plan, if a small 
group of fanatics can organize an effort that caused $200 
billion of damage on 9/11, one can imagine that a country run 
by a criminal element could do even more damage.
    So we are not prepared to meet this threat. We need to have 
more discussions like this. I want to make sure that all of you 
that we keep in touch, because we will have another hearing 
like this probably in about 6 months to 1 year to see if we 
have made any progress in that 6 months. And I will be asking 
you to tell me what you have seen if, there has been any 
progress made.
    With that said I would like to thank the witnesses and 
thank my staff. I appreciate that Mr. Keating, the ranking 
member, had an Appropriations hearing that he had to go to, but 
his participation earlier was much appreciated. So thank you 
all very much and this hearing is adjourned.
    [Whereupon, at 11:37 a.m, the subcommittee was adjourned.]
                                     

                                     

                            A P P E N D I X

                              ----------                              


     Material Submitted for the Hearing RecordNotice deg.




               \\ts\