    [House Hearing, 113 Congress]
    [From the U.S. Government Publishing Office]

    CYBER SIDE-EFFECTS: HOW SECURE IS THE PERSONAL INFORMATION ENTERED INTO
                           THE FLAWED HEALTHCARE.GOV?

    =======================================================================

                                    HEARING

                                   before the

                         COMMITTEE ON HOMELAND SECURITY
                            HOUSE OF REPRESENTATIVES

                        ONE HUNDRED THIRTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                               NOVEMBER 13, 2013

                                   __________

                               Serial No. 113-41

                                   __________

           Printed for the use of the Committee on Homeland Security

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

          Available via the World Wide Web: http://www.gpo.gov/fdsys/

                                   __________

                       U.S. GOVERNMENT PRINTING OFFICE

    87-371 PDF                WASHINGTON : 2014
    ______________________________________________________________________
    For sale by the Superintendent of Documents, U.S. Government Printing
    Office Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800;
    DC area (202) 512-1800 Fax: (202) 512-2250  Mail: Stop SSOP,
    Washington, DC 20402-0001

                         COMMITTEE ON HOMELAND SECURITY

                       Michael T. McCaul, Texas, Chairman
    Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
    Peter T. King, New York              Loretta Sanchez, California
    Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
    Paul C. Broun, Georgia               Yvette D. Clarke, New York
    Candice S. Miller, Michigan, Vice    Brian Higgins, New York
        Chair                            Cedric L. Richmond, Louisiana
    Patrick Meehan, Pennsylvania         William R. Keating, Massachusetts
    Jeff Duncan, South Carolina          Ron Barber, Arizona
    Tom Marino, Pennsylvania             Dondald M. Payne, Jr., New Jersey
    Jason Chaffetz, Utah                 Beto O'Rourke, Texas
    Steven M. Palazzo, Mississippi       Tulsi Gabbard, Hawaii
    Lou Barletta, Pennsylvania           Filemon Vela, Texas
    Chris Stewart, Utah                  Steven A. Horsford, Nevada
    Richard Hudson, North Carolina       Eric Swalwell, California
    Steve Daines, Montana
    Susan W. Brooks, Indiana
    Scott Perry, Pennsylvania
    Mark Sanford, South Carolina
                           Greg Hill, Chief of Staff
              Michael Geffroy, Deputy Chief of Staff/Chief Counsel
                        Michael S. Twinchek, Chief Clerk
                    I. Lanier Avant, Minority Staff Director

                                C O N T E N T S

                                  ----------
                                                                       Page

                                   STATEMENTS

    The Honorable Michael T. McCaul, a Representative in Congress
      From the State of Texas, and Chairman, Committee on Homeland
      Security.......................................................     1
    The Honorable Bennie G. Thompson, a Representative in Congress
      From the State of Mississippi, and Ranking Member, Committee on
      Homeland Security:
      Oral Statement.................................................     4
      Prepared Statement.............................................     5
    The Honorable Sheila Jackson Lee, a Representative in Congress
      From the State of Texas:
      Prepared Statement.............................................     7

                                   WITNESSES
                                    Panel I

    Ms. Roberta ``Bobby'' Stempfley, Acting Assistant Secretary,
      Office of Cybersecurity and Communications, U.S. Department of
      Homeland Security:
      Oral Statement.................................................    11
      Prepared Statement.............................................    13
    Ms. Soraya Correa, Associate Director, Enterprise Services
      Directorate, U.S. Citizenship and Immigration Services, U.S.
      Department of Homeland Security:
      Oral Statement.................................................    15
      Prepared Statement.............................................    17

                                    Panel II

    Mr. Luke Chung, President, FMS, Inc.:
      Oral Statement.................................................    60
      Prepared Statement.............................................    61
    Mr. Waylon W. Krush, Chief Executive Officer, Lunarline, Inc.:
      Oral Statement.................................................    73
      Prepared Statement.............................................    75

                                 FOR THE RECORD

    The Honorable Jeff Duncan, a Representative in Congress From the
      State of South Carolina:
      Memo...........................................................    27
      Article, ``Midlands Man Has Personal Information Compromised on
        healthcare.gov''.............................................    38

    CYBER SIDE-EFFECTS: HOW SECURE IS THE PERSONAL INFORMATION ENTERED INTO
                           THE FLAWED HEALTHCARE.GOV?

                                  ----------

                          Wednesday, November 13, 2013

                 U.S. House of Representatives,
                        Committee on Homeland Security,
                                                        Washington, DC.
        The committee met, pursuant to call, at 10:11 a.m., in Room
    311, Cannon House Office Building, Hon. Michael T. McCaul
    [Chairman of the committee] presiding.
        Present: Representatives McCaul, Miller, Meehan, Duncan,
    Barletta, Stewart, Hudson, Daines, Brooks, Perry, Sanford,
    Thompson, Sanchez, Jackson Lee, Clarke, Richmond, Barber,
    Payne, O'Rourke, and Horsford.
        Chairman McCaul. The Committee on Homeland Security will
    come to order. The committee is meeting today to examine the
    security of HealthCare.gov and the protection of private
    information of the American people. I now recognize myself for
    an opening statement.
        This hearing is part of our on-going oversight of the roll-
    out of the Patient Protection and Affordable Care Act, also
    known as Obamacare. Today's hearing follows two subcommittee
    hearings held by my good friend, Chairman Pat Meehan on the
    security of the data hub and health care exchanges. I would
    note that in those two hearings the Centers for Medicare and
    Medicaid Services, or CMS, repeatedly assured this committee
    that the systems would be both functional and secure. Those
    assurances ring hollow in light of the disastrous roll-out of
    HealthCare.gov.
        We are concerned that the security of the system is as
    flawed as its functionality. The Department of Homeland
    Security has two roles in the implementation of Obamacare. The
    first is to verify the immigration status of applicants. We
    look forward to hearing more about how the system works from
    Ms. Correa of USCIS, who is with us here today. The second role
    DHS plays in Obamacare is overseeing the security of Federal
    civilian networks. We will have some slides up to demonstrate
    that.
        [The information follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Chairman McCaul. According to the Department's website, DHS
    is responsible for overseeing the protection of the dot.gov
    domain. That being the case, I think it would surprise many
    Americans to know that DHS had effectively no input into the
    security of HealthCare.gov, despite it being, arguably, the
    most significant Federal Government website ever created. To be
    clear, DHS has not participated in any meaningful way in
    developing, monitoring, or ensuring the security of
    HealthCare.gov, the health exchanges, or the Federal Data
    Services Hub. The only contact between DHS and CMS consisted of
    two e-mails and one phone call.
        Departments and agencies are responsible for setting up
    their own cybersecurity systems. But because of statutory
    limitations, DHS can only recommend policies and offer
    assistance on a voluntary basis. In this case, CMS never asked
    DHS for advice, technical assistance, or even a threat
    briefing. It is with this limited oversight that the same
    people at CMS who told us the system would work are telling us
    now that it is secure. The reason this concerns me is that if
    customers are able to log on to HealthCare.gov they are
    required to enter vast amounts of personal identifiable
    information about themselves and their family members.
        This information includes their name, addresses, date of
    birth, Social Security number, citizenship, immigration status,
    employer information, veteran status, household income,
    requests for a religious exemption, current health status such
    as whether or not the applicant is pregnant or has a
    disability, among other things. While the administration and
    some of my colleagues across the aisle point out that the Data
    Services Hub does not store this information, it is important
    to note that the State exchanges and the Federal exchange
    servicing 34 States store and keep that information for up to
    10 years.
        All this information is a tempting target for hackers,
    identity thieves, and other malicious actors. We already have
    reported cases of hacks, fraudulent websites, and documented
    security vulnerabilities in the system. We are also concerned
    that the so-called ``navigators,'' charged with helping people
    enroll in Obamacare are not subjected to background checks.
    This will undoubtedly result in cases of fraud and identity
    theft, most of which we won't even know about for months.
        In fact, just yesterday we received reports of navigators
    in my home State of Texas encouraging applicants to lie in
    order to get information--or to get higher insurance subsidies.
    Even if a system worked properly, the centralization of so much
    personal data would create security concerns. But in this case,
    HealthCare.gov is so flawed these concerns are even greater.
    Mr. Luke Chung will testify to shed some light on the technical
    problems with HealthCare.gov and how those affect security, and
    I look forward to his testimony.
        Moving forward, we believe it is vital for the Federal
    Government to use every asset it has, including DHS, to secure
    its networks and ensure the security of Americans' most
    sensitive personal data. As such, DHS needs to have not just
    the responsibility but, more importantly, the tools and
    authorities it needs to secure the dot.gov domain. Our
    committee is currently working on legislation to address this
    by codifying the DHS cyber mission. We look forward to working
    with the Ranking Member and other Members of the committee as
    we move that bill through the legislative process.
        With that, the Chairman now recognizes the Ranking Member,
    the gentleman from Mississippi, Mr. Thompson, for any statement
    he may have.
        Mr. Thompson. Thank you very much, Mr. Chairman. Thank you
    for holding today's hearing. I also want to thank the witnesses
    for also appearing today.
        Understand that this hearing will discuss the Department of
    Homeland Security's role in the Affordable Care Act. The role
    played by DHS is two-fold. First, the Department is responsible
    for verifying that anyone who applies for benefits under the
    ACA is a citizen or legal resident. This function required by
    the ACA is very similar to the information required under E-
    Verify. The Department performs this function thousands of
    times each day, and transmits the information to any Government
    agency or employer that needs it.
        I am sure we all remember the beginning of the E-Verify
    program. Just a few years ago, my friends on the other side of
    the aisle sought to expand E-Verify. At that time, many critics
    believed E-Verify was a deeply-flawed program that relied on
    inaccurate Government databases and added unnecessary costs to
    businesses. We called attention to flaws in the computer
    systems and databases that E-Verify relied upon. The
    deficiencies in those systems were fixed.
        Today, E-Verify has become an ordinary part of the
    verification process used by businesses and governments to
    assure that people are eligible to work in the United States. I
    do not recall efforts to repeal E-Verify because of its faults.
    The ``save'' system used in the ACA functions is much the same
    way as E-Verify. It seems that my colleagues have expressed
    concerns about the other role DHS plays in the implementation
    of ACA. Those concerns have been examined at two subcommittee
    hearings in this committee.
        Based on those hearings, we know that DHS did not have any
    role in the planning or implementing the HealthCare.gov
    website. Some of my colleagues have indicated that DHS should
    assure the safety and security of the personal information
    placed on HealthCare.gov. While this is an interesting
    proposition, there is no law requiring that DHS play such a
    role. DHS has few responsibilities in the cyber area. First,
    DHS is responsible for observing, reporting, and acting upon
    threats to the Federal computer network system.
        Second, DHS is responsible for assuring that all fellow
    agencies are in compliance with FISMA, the Federal law that
    establishes benchmarks and standards for computer system
    security within the Federal Government. In sum, DHS is
    responsible for assuring that HHS followed the correct
    protocols in establishing the system. DHS would be ready to
    respond if the system were hacked. But DHS does not have an on-
    going role with the security of the HealthCare.gov system.
        If my colleagues believed DHS oversight would be beneficial
    in assuring the privacy and security of the information
    contained in the HealthCare.gov system, I would suggest that we
    explore that option. But I am not aware of any law that
    suggests that the role for DHS, and I do not believe that
    consideration of such a role is a purpose of today's hearing.
    It seems that the purpose of today's hearing is to raise
    concern about the protection of the privacy and security of
    personal information.
        Several committees in the House of Representatives have had
    hearings on this same topic. Although it is my understanding
    that DHS has a very small role in assuring the privacy and
    security of a website established by another agency, I look
    forward to hearing from the witnesses called here today.
    Finally, Mr. Chairman, I do not think that the discussion today
    can ignore the fact that this website was put together using
    over 50 contractors.
        As we know from the committee's recent mark-up of a bill on
    the Cybersecurity Workforce, the Federal Government is woefully
    deficient in hiring and retaining cyber professionals. The
    oversight conducted by this committee over several years has
    found one IT system after another that has failed to perform or
    failed to be completed after millions of dollars have been
    spent. The list of computer failures is as long, and stretches
    through a few administrations.
        The list include SBInet, Emerge, Ramp, and several other IT
    solutions that did not have names and did not work, but did
    cost a great deal of money. I am not here to point the finger
    at DHS. I am certain that DHS is not the only Federal entity
    that has been plagued by the failure of computer contracts to
    deliver as promised. So, Mr. Chairman, while I look forward to
    the discussion today I hope that at some point we can light a
    candle instead of continuing to curse the darkness.
        Those of us in Congress need to come to grips with the
    notion that computers are not going away, and we must take
    proactive steps to assure that some office or agency is the
    repository of cyber expertise and knowledge. That agency must
    be able to advise other agencies on everything from drafting a
    solicitation for a computer system to oversight of the
    installation of the system. It must be the Federal IT help desk
    and information library. We need to think about new approaches
    that will save money and work for the American people.
        Or we can keep doing what we have been doing: Spending
    money, making mistakes, wondering what went wrong, and trying
    to figure out who to blame. Mr. Chairman, the people deserve a
    Government that stays open, works together, solves problems,
    and spends money wisely. I think this is the perfect time to
    show that we are that Government.
        With that, I yield back.
        [The statement of Ranking Member Thompson follows:]
                 Statement of Ranking Member Bennie G. Thompson
                               November 13, 2013
        I understand that this hearing will discuss the Department of
    Homeland Security's role in the Affordable Care Act. The role played by
    DHS is two-fold. First, the Department is responsible for verifying
    that anyone who applies for benefits under the ACA is a citizen or
    legal resident. This function, required by the ACA, is very similar to
    the information required under E-Verify. The Department performs this
    function thousands of times each day and transmits the information to
    any Government agency or employer that needs it.
        I am sure we all remember the beginning of the E-Verify program.
    Just a few years ago, my friends on the other side of the aisle sought
    to expand E-Verify. At that time, many critics believed E-Verify was a
    deeply-flawed program that relied on inaccurate Government databases
    and added unnecessary costs to businesses. We called attention to flaws
    in the computer systems and databases that E-Verify relied upon. The
    deficiencies in those systems were fixed.
        Today, E-Verify has become an ordinary part of the verification
    process used by businesses and governments to assure that people are
    eligible to work in the United States. I do not recall efforts to
    repeal E-Verify because of its faults.
        The SAVE system, used in the ACA, functions in much the same way as
    E-Verify. It seems that my colleagues have expressed concerns about the
    other role DHS plays in the implementation of the ACA. Those concerns
    have been examined at two subcommittee hearings in this committee.
    Based on those hearings, we know that DHS did not have any role in the
    planning or implementing the HealthCare.gov website.
        Some of my colleagues have indicated that DHS should assure the
    safety and security of the personal information placed on
    HealthCare.gov. While this is an interesting proposition, there is no
    law requiring that DHS play such a role. DHS has a few responsibilities
    in the cyber area. First, DHS is responsible for observing, reporting,
    and acting upon threats to the Federal computer network system.
        Second, DHS is responsible for assuring that all Federal agencies
    are in compliance with FISMA--the Federal law that establishes
    benchmarks and standards for computer system security within the
    Federal Government. In sum, DHS is responsible for assuring that HHS
    followed the correct protocols in establishing the system and DHS would
    be ready to respond if the system were hacked.
        But DHS does not have an on-going role with the security of the
    HealthCare.gov system.
        If my colleagues believe DHS oversight would be beneficial in
    assuring the privacy and security of the information contained in the
    HealthCare.gov system, I would suggest that we explore that option.
        But I am not aware of any law that suggests that role for DHS, and
    I do not believe the consideration of such a role is the purpose of
    today's hearing. It seems that the purpose of today's hearing is to
    raise concerns about the protection of the privacy and security of
    personal information. Several committees in the House of
    Representatives have had hearings on this same topic.
        Although it is my understanding that DHS has a very small role in
    assuring the privacy and security of a website established by another
    agency, I look forward to hearing from the witnesses called here today.
        Finally, Mr. Chairman, I do not think that the discussion today can
    ignore the fact that this website was put together using over 50
    contractors. As we know from this committee's recent mark-up of a bill
    on the cybersecurity workforce, the Federal Government is woefully
    deficient in hiring and retaining cyber professionals. The oversight
    conducted by this committee over several years has found one IT system
    after another that has failed to perform or failed to be completed
    after millions of dollars have been spent.
        The list of computer failures is long and stretches through a few
    administrations. The list includes--SBI, Emerge, RAMP--and several
    other IT solutions that did not have names, did not work, but did cost
    a great deal of money. I am not here to point a finger at DHS. I am
    certain that DHS is not the only Federal entity that has been plagued
    by the failure of computer contracts to deliver what was promised.
        So Mr. Chairman, while I look forward to the discussion today, I
    hope that at some point we can light a candle instead of continuing to
    curse the darkness. Those of us in Congress need to come to grips with
    the notion that computers are not going away and we must take proactive
    steps to assure that some office or agency is the repository of cyber
    expertise and knowledge.
        That agency must be able to advise other agencies on everything
    from drafting a solicitation for a computer system to oversight of the
    installation of the system. It must be the Federal IT help desk and
    information library.
        We need to think about a new approach that will save money and work
    for the American people. Or we can keep doing what we have been doing--
    spending money, making mistakes, wondering what went wrong, and trying
    to figure out who to blame. Mr. Chairman, the people deserve a
    Government that stays open, works together, solves problems, and spends
    money wisely. I think this is the perfect time to show that we are that
    Government.

        Chairman McCaul. I thank the Ranking Member. I also want to
    thank the Ranking Member for his cooperation in holding this
    important hearing, as well. Other Members of the committee are
    reminded that opening statements may be submitted for the
    record.
        [The statement of Hon. Jackson Lee follows:]
                      Statement of Hon. Sheila Jackson Lee
                               November 13, 2013
        Chairman McCaul, and Ranking Member Thompson, I thank you for this
    opportunity to take testimony on cybersecurity as it relates to Federal
    health insurance exchange.
        I welcome today's witnesses:
       Ms. Roberta Stempfley, acting assistant secretary, Office of
            Cybersecurity and Communications, U.S. Department of Homeland
            Security;
       Ms. Soraya Correa, associate director, Enterprise Services
            Directorate, U.S. Citizenship and Immigration Services, U.S.
            Department of Homeland Security;
       Mr. Luke Chung, president, FMS, Inc. and
       Mr. Waylon Krush, chief executive officer, Lunarline, Inc.
        I thank the witnesses for their contribution to committee's
    understanding regarding the nature of cybersecurity as it relates to
    personal information.
        Today, the House Committee on Homeland Security is holding a
    hearing to learn about privacy threats regarding the security of
    personal information provided by visitors to the Federal Health
    Exchange Marketplace HealthCare.gov.
        As a senior member of the House Judiciary Committee, privacy
    protection has been a prominent concern in the protection of women's
    rights, voting rights, and labor rights.
        Today a number of voting rights are under threat because of abusive
    requirements that undermine privacy rights of voters by requiring that
    they produce documents proving citizenship, identity, and residency
    regardless of whether they have an established history of voting or are
    first-time voters.
        Privacy is central to the health and strength of many other rights
    that we enjoy. Specifically, the First, Fourth, and Fifth Amendments to
    the Constitution rests on a foundation of privacy protection that allow
    us to speak as we wish, associate with other, and hold our own beliefs
    free of fear or threats.
        So the topic of today's hearing is of great concern to me. There
    cannot be privacy without security, although we can have security
    without privacy. The digital information age requires that Federal
    agencies must have cybersecurity for any system that collects, retains,
    or uses personal information.
        Privacy protection and cybersecurity are linked in the work I have
    done on the topic of privacy. The ability to control who, when, why,
    and how someone else can gain access to personal information requires
    security. For this reason attention to this issue is central to my
    strong support for the Federal Health Insurance Market Place found at
    HealthCare.gov.
        In May 2006, the Department of Veterans Affairs had a real privacy
    medical information data breach when a contract worker took home
    medical information for 26.5 million people.
        We are not here today to talk about a data breach of the affordable
    care website, because they are not storing medical information nor are
    they storing the information registered on forms. I know this for a
    fact and not for dramatic effect--I went in search of the facts
    regarding the website and what problems it was experiencing. I found
    that there was not a problem with security of the website. There was a
    problem with capacity and usability of the website and these issues
    became more complex after launch because the site could not be down
    more than a few hours each day.
        There would be real problems if the Obamacare web registration site
    collected sensitive personal information on people registering for
    health care, but it does not collect sensitive personal information.
        Sensitive personal information is the type found in taxpayer
    histories collected over the life time of a person by the IRS. A
    conversation with a doctor in the examination room is an exchange of
    highly sensitive personal information. There are no records other than
    the doctor's notes and that information is not sent to the Federal
    Government to be stored and maintained for the entire life of a person
    nor should it be. Most Americans who have take the time to visit the
    site and look at the information requested know that there is no highly
    sensitive or sensitive information collected for registering for health
    insurance.
        The real irony of today's hearing is why the registration process
    for health insurance seeks any personal information. If my friends on
    the other side of the aisle had not been so over concerned about the
    verification of income or proof of citizenship then the need to collect
    a social security number, date of birth, income, place of employment
    could have been eliminated. The whole process would have worked like
    every other thing you get a tax exemption for annually. A tax break for
    mortgage or student loan interest only requires a letter being sent to
    you for tax records to be sent to tax preparers and in the event of a
    the rear request for proof of deduction qualification.
        I hope that my colleagues on my right will take note that when they
    insist that a voter must prove citizenship and residency it requires
    the provision of more personal information which should concern them as
    much as what is being done at their behest to those seeking health
    insurance.
        When I look at the level of concern you would think that they have
    held 45 votes to do away with the Affordable Care Act and not one vote
    to make changes that would address issues that would make it easier to
    get health insurance. In fact, we are scheduled to have the 46th vote
    later this week--no help from the Majority just another effort to peck
    away at the law that they could not end by any other means.
        I would offer that if there was no political effort to make
    something out of the website roll-out there would be an effort to focus
    negative attention on the toll-free number and if there was nothing
    negative to say about that aspect of the new law then they would find
    fault with the application assistance centers.
        We are in the midst of a search for a problem that will justify all
    of the political and financial effort put into stopping a law that the
    public needs and as people register and share their experience will
    turn all of this into familiar ground.
        The years following the passage of Medicare Part D were rough,
    because of problems that were fixed with the passage of Obamacare.
        There is little if any threat to privacy by cyber threats because
    of the data practices implemented by the Department of Health and Human
    Services.
        This system is not storing highly sensitive or even sensitive
    personal information and the personal information it is collecting is
    not stored. What is being collected is personal information of the type
    found on a credit application to purchase any product e.g. date of
    birth, place of work, social security number, income level, and marital
    status. The information is checked as required by my colleagues on the
    other side of the aisle and is then discarded.
        First, the most important rule for cybersecurity is following the
    example of the professionals who work in this fast-paced area: Truth
    comes before beauty. The truth is that there is no computer system that
    is 100% secure from hostile cyber attacks, natural disasters,
    structural failures, or human errors.
        Second, the internet is a rough neighborhood--the best we can do is
    to design the best systems possible, provide the resources necessary to
    follow through on good designs, and ignore the politics of the moment.
    The most dangerous threats to cybersecurity care very little about
    anyone's political party. They may care very much about your nation of
    origin.
        Third, cybersecurity is not about the 14-year-old with a laptop,
    but the botnet attack from a coordinated effort that brings to the
    discussion significant threats to networks. There is no evidence that
    nothing occurred that would suggest that the website experienced
    anything of this nature.
        I understand that the interest of many Members in this hearing
    regarding the health information exchanges may focus on the name of the
    system, but it is important to note that regardless of the Federal
    system it is the personal information collected, stored, or used that
    should be our focus.
        Digital records management was of such grave concern to Members of
    Congress following investigations into the disclosures that then-
    President Nixon had used his high office to seek out means to cause
    harm to careers, reputations, and political enemies that the Church
    Committee conducted extensive hearings on the abuse of power that had
    occurred.
        Due to the revelations of the Church Committee a series of laws
    were passed by Congress to protect the privacy of Americans and a
    number of reviews looked specifically at Federal Government use of
    computers to manage the personal information of citizens.
        In 1973, a report ``Records, Computers, and the Rights of
    Citizens'' was produced by the former Federal Department of Health
    Education and Welfare (HEW), which today exists as two agencies--one of
    which is the Department of Health and Human Services (HHS).
        This fact is significant for the topic of today's hearing because
    Health and Human Services is chiefly responsible for why the United
    States became the first nation in the world to draft a Federal privacy
    statute. The agency's role in drafting the world's first Code of Fair
    Information practice for automated personal data systems places them at
    the forefront of identifying the important role that computing would
    play in meeting the needs of a fast-growing Nation, while also
    recognizing the potential for technology's threat to privacy.
        The Code of Fair Information Practices adopted by HEW is based on
    five principles:
       There must be no personal data record-keeping systems whose
            very existence is secret.
       There must be a way for a person to find out what
            information about the person is in a record and how it is used.
       There must be a way for a person to prevent information
            about the person that was obtained for one purpose from being
            used or made available for other purposes without the person's
            consent.
       There must be a way for a person to correct or amend a
            record of identifiable information about the person.
       Any organization creating, maintaining, using, or
            disseminating records of identifiable personal data must assure
            the reliability of the data for their intended use and must
            take precautions to prevent misuses of the data.
        This ground-breaking work informs and guides our hearing today and
    I want to acknowledge the hard work of the Federal employees at the
    Department of Health and Human Services who were given little in the
    way of support or encouragement by the majority of the House in
    accomplishing a task that was monumental and historic.
        Privacy is defined by law. The definition of privacy can be
    captured under five categories: Physical intrusion, e.g. entering into
    personal space without permission like someone's home; information
    intrusion, e.g. accessing documents or information without permission;
    proprietary intrusion, e.g. using someone's image or name for
    advertising purposes; associational intrusion, e.g. NAACP v. Alabama
    where the Alabama sought the State NAACP membership list; and
    decisional intrusions, e.g. someone interfering with a woman's personal
    medical decision making or deciding who can and cannot be married.
        The issue of cybersecurity and the Federal and State health
    insurance exchanges are important and for this reason it is important
    to provide the American public with accurate and reliable information.
        The most important information regarding the Federal health
    insurance exchange is that it does not violate any of the Code of Fair
    Information Principles that is central to privacy. There is no secret
    database; actually there is no database at all. There is a data
    collection requirement to meet the demands of the House Majority that
    no person who is not a citizen could gain insurance through the
    exchange and the second condition that anyone receiving assistance be
    proven to qualify for that assistance prior to it being provided.
        To be honest, if the Majority had not been so insistent on these
    two conditions the number of questions on the registration form could
    have been greatly reduced. The form used for registration does not
    collect sensitive personal information--it collects personal
    information. Sensitive personal information would be of the type found
    on individual taxes, which are by law held in secret by the IRS, no
    matter what someone may say publically about their taxes and the
    agency--true or not true the agency can never disclose the tax records
    of taxpayers.
        So when we speak of the types and degrees of personal information
    it is important to know that personal information, sensitive personal
    information, and highly sensitive personal information are degrees that
    should be recognized. The health exchanges were only intended and the
    Federal exchange designed to collect personal information of the nature
    required by Congress to meet the obligations under the law.
        Highly-sensitive personal information would be the type exchanged
    between a doctor and patient none of which would ever be in this
    system. This is not to say that cybersecurity is not an issue, any time
    personal information on citizens is collected by the Federal Government
    it is an issue that Congress should address by making sure that only
    what is needed is collected and only retained as long as necessary for
    a specific purpose.
        HHS only collected what was necessary, used it for the purpose of
    the collection, and promptly discarded that data so no database or
    system of records was created. This is the most privacy-centric system
    this committee may have the pleasure of discussing in a cybersecurity-
    focused hearing. The data practices should be adopted by other agencies
    that may collect too much, keep more than they need, and use
    information far outside the scope of the original collection.
        The Federal Health Exchange data is only used to do a ``handshake''
    with data in other networks that can authenticate or verify the
    accuracy of the information provided. This is done in such a way that
    no data is exchanged with the agency providing the input that the
    information is accurate. In computing a checksum a mathematical
    equation is applied to data which produces an answer that will match
    the same information found in another system. This is just one way of
    checking information without knowing what the data is and this is the
    school of thought that informed HHS in developing this system.
        The Centers for Medicare and Medicaid Management found within HHS
    could provide a more detailed reply on the topic of data security in
    the Federal health information exchange. I ask that the Chairman and
    Ranking Members both write to the committee of jurisdiction and seek
    information they may better inform our committee on the details
    regarding security and the Federal Exchange.
        I appreciate the human factors and usability issues with the
    website, which are being addressed as we meet today. I would suggest
    that with the new-found interest of the Majority in the customer and
    user experience that they would focus on redirecting the funding that
    has be appropriated that would have gone to the States that opted out
    of the Medicaid expansion be redirected to the Federal.
        I am particularly interested in hearing the testimony of the
    witnesses before the committee who have background and training to
    speak on the topic of cybersecurity.
        Federal cybersecurity is guided by the Federal Information Security
    Management Act (FISMA). The National Institute of Standards and
    Technology develop the guidance on FISMA and the Office of Management
    and Budget provides oversight to assure agencies are meeting the
    objectives.
        Our Nation must continue to improve in the area of cybersecurity
    and the best approach is build it with the best knowledge we have and
    provide continuous monitoring.
        President Reagan said it best following the Challenger disaster--
    the shuttle program is one of the Nation's most significant engineering
    marvels--that after 25 years of space flight, the Nation had grown so
    used to it that we forgot how recent the Nation had begun to explore
    space through human missions. He said that the future does not belong
    to the fainthearted; it belongs to the brave.
        He said something that is very important that I will always
    remember: ``We don't keep secrets and cover things up. We do it all up
    front and in public. That's the way freedom is, and we wouldn't change
    it for a minute.''
        This was a very public event, but we will get through it and for
    the rough start we will learn more than we would have without it and be
    the better for it.
        The first U.S. space station slid out of orbit and broke apart upon
    reentry into the atmosphere. It failed, but its failure meant that the
    next time we built a space station is a better space station.
        The Swine Flu vaccine miscalculation during the Ford
    administration, which led to the vaccination of thousands of elderly
    people for a flu that did not arrive meant that more people died from
    the vaccine than Swine Flu that year.
        The lack of enough Flu vaccine during the George W. Bush
    administration meant that while nations around the globe had sufficient
    vaccine for that flu season, we had not ordered enough to meet our
    Nation's needs.
        Like anything in life, there will be rough starts, mistakes, and
    outright deceptions about the facts. Our strength is in not giving in
    to the naysayers or negative message peddlers. This may not be in the
    playbook, but if we lose our edge for taking on the hardest challenges
    because they are too hard then we have lost something that is truly
    uniquely American.
        I am looking forward to today's discussion and hearing from our
    witnesses. Thank you.

        Chairman McCaul. We are pleased to have two panels of
    distinguished witnesses with us today to discuss this important
    topic. I will introduce the first panel. Ms. Roberta Stempfley
    is the acting assistant secretary of the Office of
    Cybersecurity and Communications at the Department of Homeland
    Security. In this role, she plays a leading role developing the
    strategic direction for CS&C and its five divisions. She
    previously served as the deputy assistant secretary to CS&C and
    as director of the National Cybersecurity Division. We thank
    you for being here today.
        Next we have Ms. Correa. She is the associate director of
    the Enterprise Services Directorate at U.S. Citizenship and
    Immigration Services. She has over 30 years of experience in
    procurement, Federal assistance, and program management. Before
    serving in her current role she was deputy associate director
    for the management directorate, and was responsible for
    delivering key management and infrastructure structure services
    to support the USCIS mission. We thank you for being here, as
    well.
        I would like to point out, though, that at this time
    neither of our witnesses submitted written testimony to the
    committee before their appearance today, apparently due to
    their inability to get testimony cleared by the White House.
    The administration had nearly 2 weeks to provide this
    testimony, and has been in the habit of providing their
    testimony after the deadline. Frankly, I expect better, and
    look forward to receiving testimony on a timely basis as we
    move forward in this committee.
        I ask that the witnesses provide their full written
    statement as soon as it is available so it will appear in the
    record. My understanding is that Ms. Stempfley has an oral
    statement she would like to give, so the Chairman now
    recognizes her for 5 minutes.

      STATEMENT OF ROBERTA ``BOBBY'' STEMPFLEY, ACTING ASSISTANT
      SECRETARY, OFFICE OF CYBERSECURITY AND COMMUNICATIONS, U.S.
                    DEPARTMENT OF HOMELAND SECURITY

        Ms. Stempfley. Thank you, sir. I truly appreciate the
    opportunity to provide this opening statement, oral statement.
    Chairman McCaul, Ranking Member Thompson, and Members of the
    committee, I appreciate the opportunity to discuss the
    Department of Homeland Security's efforts to improve
    cybersecurity posture and capabilities of civilian Federal
    agencies.
        DHS is the lead for securing and defining Federal civilian
    unclassified information technology systems and networks
    against cyber intrusions or disruptions and enhancing
    cybersecurity among critical infrastructure partners. To this
    end, DHS ensures maximum coordination and partnership with
    Federal and private stakeholders, while keeping a steady focus
    on safeguarding the public's privacy, confidentiality, civil
    rights, and civil liberties.
        Within DHS's National Protection and Programs Directorate,
    the Office of Cybersecurity and Communications focuses on
    managing risk to the communications and information technology
    infrastructures and the sectors that depend on them, as well as
    enabling timely response and recovery to incidents affecting
    critical infrastructure including Government systems.
    Additionally, DHS is in the process of setting up critical
    programs Federal-wide in order to be able to detect and respond
    to incidents and vulnerabilities, and consolidate traffic,
    reducing the surface area of possible threat vectors.
        With the committee and Congress' support in passing FISMA
    authorities, DHS and the dot.gov can help to ensure our
    civilian infrastructure is secured while, at the same time,
    reducing cost and increasing efficiency with which we are able
    to work with our agency partners.
        CS&C executes its mission by supporting 24/7 information
    sharing, analysis, and incident response, as well as
    facilitating interoperable emergency communications, advancing
    technology solutions for private- and public-sector partners,
    providing tools and capabilities to ensure the security of
    Federal civilian Executive branch networks, and engaging in
    strategic-level coordination for the Department with private-
    sector organizations on cybersecurity and communications
    issues.
        While DHS leads this National effort under the Federal
    Information Security Management Act regulations, agency heads
    are responsible for providing information security protections
    commensurate with the risk and magnitude of harm resulting from
    unauthorized access, use, disclosure, disruption, modification,
    or destruction of information or information systems within
    their agencies or operated on behalf of their agency by a
    contracted entity.
        Agency heads are provided the flexibility and authority to
    delegate those responsibilities to the agency chief investment
    officer in order to ensure compliance with requirements
    outlined in FISMA and the associated memoranda and directives.
    These authorities are inclusive of programs to assess, inform,
    and report on agency status and capabilities relative to FISMA
    guidance.
        While each Federal department and agency retains primary
    responsibility for securing and defining its own networks and
    critical information infrastructure, DHS leads efforts in
    planning and implementing strategic management of information
    security practices across the Federal enterprise.
        The Department provides assistance by collecting and
    reporting information regarding cyber posture and risks,
    disseminating cyber alert and warning information to promote
    protection against cyber threats and the resolution of
    vulnerabilities, coordinating with partners and customers to
    attain shared cyber situational awareness, and providing
    response and recovery support to agencies upon their request.
    Traditionally, due to current authorities, DHS must be asked by
    Federal departments and agencies to provide this direct support
    of independent department and agency responsibilities.
        Constantly evolving and sophisticated cyber threats
    challenge the cybersecurity of the Nation's critical
    infrastructure and its civilian government system. DHS'
    responsibility in the breadth of cybersecurity activities and
    our statutory authorities have not kept up with the rapidly-
    evolving changes in the cyber environment. While DHS works
    diligently with our partner agencies and organizations to
    provide for a secure cyber environment, this often hinders the
    Department's ability to execute this mission.
        The administration has requested legislation to clarify
    authority, to deploy capabilities such as EINSTEIN across the
    Federal civilian networks, and to provide operational
    assistance under OMB's oversight of Federal information
    technology network security efforts under FISMA, among other
    things.
        We thank this committee for this focus on these important
    areas. DHS is committed to reducing increasingly sophisticated
    and damaging risks to Federal departments and agencies and
    critical infrastructure.
        We continue to leverage our partnerships inside and outside
    Government to enhance security and resilience of our Federal
    networks while incorporating the privacy and civil liberty
    safeguards into all aspects of what we do at the Department.
        Thank you, sir.
        [The prepared statement of Ms. Stempfley follows:]
               Prepared Statement of Roberta ``Bobby'' Stempfley
                               November 13, 2013
                                  introduction
    Overview of the Mission
        Chairman McCaul, Ranking Member Thompson, and Members of the
    committee, I appreciate the opportunity to discuss the Department of
    Homeland Security's (DHS's) efforts to improve the cybersecurity
    posture and capabilities of civilian Federal agencies. Government
    computer networks and systems contain information on National security,
    law enforcement, and other sensitive data. It is paramount that the
    Government protects all information from theft and protects networks
    and systems from attacks while continually providing essential services
    to the public.
        DHS is the lead for securing and defending Federal civilian
    unclassified information technology systems and networks against cyber
    intrusions or disruptions and enhancing cybersecurity among critical
    infrastructure partners. To this end, DHS ensures maximum coordination
    and partnership with Federal and private-sector stakeholders while
    keeping a steady focus on safeguarding the public's privacy,
    confidentiality, civil rights, and civil liberties. Within DHS's
    National Protection and Programs Directorate (NPPD), the Office of
    Cybersecurity and Communications (CS&C) focuses on managing risk to the
    communications and information technology infrastructures and the
    sectors that depend upon them, as well as enabling timely response and
    recovery to incidents affecting critical infrastructure, including
    Government systems.
        CS&C executes its mission by supporting 247 information sharing,
    analysis, and incident response as well as facilitating interoperable
    emergency communications and advancing technology solutions for
    private- and public-sector partners. We also provide tools and
    capabilities to ensure the security of Federal civilian Executive
    branch networks and engaging in strategic-level coordination for the
    Department with private-sector organizations on cybersecurity and
    communications issues.
    Roles and Responsibilities
        While DHS leads the National effort to secure Federal civilian
    networks, agency heads are responsible for providing information
    security protections commensurate with the risk and magnitude of the
    harm resulting from unauthorized access, use, disclosure, disruption,
    modification, or destruction of information and information systems
    within their agency or operated on behalf of their agency by a
    contracted entity in accordance with Federal Information Security
    Management Act (FISMA) regulations. Agency heads are provided the
    flexibility and authority to delegate those responsibilities to the
    agency's Chief Information Officer (CIO) in order to ensure compliance
    with the requirements outlined within FISMA and the associated
    memoranda and directives. These authorities are inclusive of programs
    to assess, inform, and report on the agencies' status and capabilities
    relative to FISMA guidance.
        Although each Federal department and agency retains primary
    responsibility for securing and defending its own networks and critical
    information infrastructure, DHS leads efforts in planning and
    implementing strategic management of information security practices
    across the Federal departments and agencies. The Department provides
    assistance to departments and agencies by collecting and reporting
    agency information regarding cybersecurity posture and risks,
    disseminating cyber alert and warning information to promote protection
    against cyber threats and the resolution of vulnerabilities,
    coordinating with partners and customers to attain shared cyber
    situational awareness, and providing response and recovery support to
    agencies upon their request. Pursuant to current authorities, DHS must
    be asked by the Federal departments and agencies to provide the
    aforementioned direct support. The Department focuses its support to
    Federal networks through the following activities:
       FISMA.--The Office of Management and Budget (OMB) has
            delegated operational responsibilities for Federal civilian
            cybersecurity to DHS, which established the Department as the
            lead in promoting and reporting on the cybersecurity posture of
            Federal civilian Executive branch networks. FISMA requires
            program officials, and the head of each agency, to mitigate
            cybersecurity risks based upon its particular requirements. The
            Department monitors and reports agency status in ensuring the
            effective implementation of this guidance.
       Continuous Diagnostics and Mitigation (CDM).--The CDM
            program focuses FISMA security metrics on those having a direct
            impact on Federal civilian departments' and agencies'
            cybersecurity. By empowering Federal civilian agency CIOs and
            Chief Information Security Officers (CISO) with situational
            awareness into their risk posture and with on-going insight
            into the effectiveness of security controls, CDM will provide
            these partners with resources necessary to identify and fix the
            worst cybersecurity problems first. While this program is in
            its early stages, we are working in conjunction with Congress
            to clarify authorities and make CDM fully operational with
            increased proactive protection of the websites in the .gov
            domain.
       National Cybersecurity Protection System.--Operationally
            known as EINSTEIN, this program protects Federal civilian
            Executive branch networks by providing improved situational
            awareness of cyber threats as well as identification and
            prevention of malicious cyber activity. While the Department of
            Health and Human Services (HHS) recently signed a Memorandum of
            Agreement (MOA) for all EINSTEIN services, HHS is only covered
            at this point by EINSTEIN 1. EINSTEIN 1, facilitates
            identification and response to cyber threats and attacks which
            further enables improvements to network cybersecurity. DHS
            continues to engage HHS on deployment of other cybersecurity
            measures based on discussions regarding statutory prohibitions
            on certain disclosures.
    DHS Services
        DHS offers additional capabilities and services to assist Federal
    agencies and stakeholders based upon their cybersecurity status and
    requirements. The Department engages agency CIOs and CISOs through a
    variety of mechanisms including information-sharing forums as well as
    directly through the National Cybersecurity and Communications
    Integration Center (NCCIC) \1\ in response to a specific problem/issue
    or identified threat. These include:

        \1\ The NCCIC, a 247 cyber situational awareness, incident
    response, and management center, is a National nexus of cyber and
    communications integration for the Federal Government, intelligence
    community, and law enforcement.
    ---------------------------------------------------------------------------
       Assessing security posture and recommending improvements.--
            Upon agency request, DHS conducts Risk and Vulnerability
            Assessments to identify potential risks in specific operational
            networks systems or applications and recommends mitigations.
       Providing technical assistance.--DHS may provide direct
            technical assistance to agencies. For example, by assessing
            agency compliance and progress in aggregating agencies' network
            traffic into Trusted Internet Connections, DHS limits access
            and protects the perimeter of agency networks.
       Incident response.--During or following a cybersecurity
            incident, DHS may provide response capabilities that can aid in
            mitigation and recovery. Through the NCCIC, DHS further
            disseminates information on potential or active cybersecurity
            threats and vulnerabilities analysis to public- and private-
            sector partners. When requested by an affected agency, DHS
            provides incident response through the United States Computer
            Emergency Readiness Team or the Industrial Control Systems-
            Cyber Emergency Response Team.
    DHS Interactions With HHS
        DHS works to inform, educate, and increase the cybersecurity
    capacity of all civilian Federal departments and agencies and has
    interacted with HHS in the same manner as with all other Federal
    entities by making available its portfolio of capabilities and
    services. Although still in the acquisition process, DHS and HHS have
    entered into a MOA for CDM program while working diligently on the
    implementation of additional EINSTEIN capabilities. MOA's are a common
    step taken by DHS as we work to support the cybersecurity needs of our
    Federal partners, and this MOA is only the latest out of many that have
    been previously agreed to.
        On August 28, 2013 the Deputy Chief Security Officer of HHS's
    Center for Medicare and Medicaid Services (CMS) initiated a discussion
    with DHS regarding services that DHS might be able to provide in
    relation to Affordable Care Act (ACA) systems. Consistent with DHS
    practice, and similar to actions taken to support a number of other
    agencies, the Department entered into a general conversation with CMS
    to refine the request and determine what might be appropriate to meet
    its needs. Based upon the outcomes of that conversation, further
    discussions were held and, to date, as DHS does for all Federal
    partners, DHS has provided descriptions of specific capabilities and
    services to CMS for its consideration. CS&C has not yet received a
    specific request from CMS relative to the ACA systems, and has not
    provided technical assistance to CMS relative to ACA Systems.
                                   conclusion
        Constantly evolving and sophisticated cyber threats challenge the
    cybersecurity of the Nation's critical infrastructure and its civilian
    government systems. DHS is responsible for a large breadth of
    cybersecurity activities, yet lacks explicit statutory authority to
    perform these duties. While DHS works diligently with our partner
    agencies and organizations to provide for a secure cyber environment,
    this often hinders the Department's ability to fulfill its mission. The
    administration has requested legislation to clarify its authority to
    deploy EINSTEIN across Federal civilian networks and to provide
    operational assistance to OMB's oversight of Federal information
    technology network security efforts under FISMA, among other things.
        Despite this statutory ambiguity, DHS is committed to reducing
    risks to Federal departments and agencies and critical infrastructure.
    We will continue to leverage our partnerships inside and outside of
    Government to enhance the security and resilience of our Federal
    networks while incorporating privacy and civil liberties safeguards
    into all aspects of what we do. Thank you again for the opportunity to
    provide this information and I look forward to your questions.

        Chairman McCaul. Thank you for your testimony.
        The Chairman now recognizes Ms. Correa for 5 minutes for an
    opening statement.

      STATEMENT OF SORAYA CORREA, ASSOCIATE DIRECTOR, ENTERPRISE
        SERVICES DIRECTORATE, U.S. CITIZENSHIP AND IMMIGRATION
             SERVICES, U.S. DEPARTMENT OF HOMELAND SECURITY

        Ms. Correa. Good morning. Chairman McCaul, Ranking Member
    Thompson, and Members of the committee, I appreciate the
    opportunity to discuss our shared goals of supporting
    Government agencies to ensure that only authorized applicants
    receive public benefits. As the associate director for the
    Enterprise Services Directorate of the U.S. Citizenship and
    Immigration Services, I am responsible for overseeing the
    agency's verification programs. The Patient Protection and
    Affordable Care Act of 2010, or the ACA, limits eligibility to
    enroll in a qualified health plan to citizens, nationals, or
    those otherwise lawfully present in the United States.
        The law directs the Department of Health and Human Services
    to check applicant eligibility against the Department of
    Homeland Security data if the applicant does not attest that he
    or she is a U.S. citizen or if the Social Security
    Administration cannot verify the applicant's claim of U.S.
    citizenship. The Systematic Alien Verification for Entitlements
    Program, or SAVE, responds to queries it receives through the
    hub, a system established by the Centers for Medicare and
    Medicaid services to help process ACA applications.
        SAVE provides the HHS hub with immigration status
    information and information on naturalized and derived citizens
    on behalf of DHS. SAVE is a service that helps Federal, State,
    and local benefit-issuing agencies, institutions, and licensing
    agencies to determine the immigration status of benefit
    applicants so that only those applicants entitled to benefits
    receive them. SAVE does not determine whether applicants are
    eligible for a specific benefit or license. The benefit-
    granting agency makes that determination.
        SAVE uses an on-line system that checks a benefit
    applicant's immigration status information against over 100
    million Federal records. Agencies that do not have access to an
    automated system may submit a paper verification request form.
    SAVE is available in all 50 States. It has been providing
    immigration status information to public benefit-granting
    agencies for over 25 years. SAVE has more than 1,060 customer
    agencies, including the Social Security Administration and most
    States' departments of motor vehicles.
        In fiscal year 2013, the SAVE program received over 14
    million queries in our system. Before accessing SAVE, user
    agencies must sign an agreement with USCIS that details the
    terms and conditions of their use of SAVE. The SAVE
    verification process requires up to three steps: Initial
    verification, additional verify, and third-step verification.
    For initial verification, a user agency submits a status
    verification request and the system provides the applicant's
    immigration status information. If SAVE is not able to verify
    an individual's immigration status on initial verification, the
    benefit-granting agency is prompted to submit the query to the
    additional verification step.
        When initiating additional verification, a user agency may
    also submit additional information to USCIS using the SAVE
    system. Because this additional verification requires a manual
    review of available databases the SAVE response time ranges
    from 3 to 5 Federal working days. If SAVE is not able to verify
    an individual's immigration status at this stage the agency is
    prompted to submit the query for third-step verification. To
    accomplish the third-step verification the user agency must
    provide USCIS with legible photocopies of both sides of the
    applicant's immigration documentation.
        Registered agencies may submit this information
    electronically or manually. SAVE response time for the third-
    step verification is generally 10 to 20 Federal working days.
    If immigration status still cannot be confirmed, benefit-
    granting agencies may refer applicants to a local USCIS office
    to correct or update their records. USCIS and HHS entered into
    a computer-matching agreement for ACA verifications and tested
    the web service's connection between SAVE and the HHS hub,
    including testing of case-specific queries and overall
    functionality.
        After all testing was successfully completed, HHS was
    granted access to SAVE to meet the October 1 implementation
    date. SAVE is responding to all properly-submitted queries. As
    of November 10, 2013 there have been 91,011 hug-generated
    queries, with an average of 1.31 seconds for initial
    verification responses. It is important to note that this
    figure is not a proxy for the number of individuals about whom
    HHS has submitted queries to SAVE because there are often
    multiple queries per applicant.
        Moreover, this figure is not a proxy for the number of
    people who have applied for health care coverage under the ACA
    because only a small percentage of such applicants require the
    submission of queries to SAVE. To help facilitate immigration
    status verification for HHS and other agencies under the ACA,
    USCIS introduced several program enhancements which are not
    available to all customer agencies. Registered agencies may not
    receive grant date and sponsorship information for select
    statuses on initial second- and third-step verification.
    Previously, agencies has to submit manual forms to request that
    data.
        USCIS also introduced an optional auto second-step feature
    which allows SAVE to automatically send queries to additional
    verification if the initial step is unable to verify the
    applicant's immigration status. This eases burden on the user
    agencies, and makes the case resolution process more efficient.
    Additionally, in April 2013 we launched a scan-and-upload
    feature that enables agencies to electronically attach scanned
    copies of immigration documents to queries. Since the inception
    of the SAVE program, USCIS has provided benefit-granting
    Government agencies a reliable method to verify an applicant's
    immigration status and to ensure that only authorized
    applicants receive public benefits.
        On behalf of all of my colleagues at USCIS, I am grateful
    for the opportunity to speak to you today about the SAVE
    program.
        [The prepared statement of Ms. Correa follows:]
                      Prepared Statement of Soraya Correa
                               November 13, 2013
                                  introduction
        Chairman McCaul, Ranking Member Thompson, and Members of the
    committee, I appreciate the opportunity to discuss our shared goals of
    supporting Government agencies to ensure that only authorized
    applicants receive public benefits. My name is Soraya Correa, associate
    director for the Enterprise Services Directorate. I am responsible for
    overseeing verification programs at U.S. Citizenship and Immigration
    Services (USCIS). The Patient Protection and Affordable Care Act of
    2010 (ACA) limits eligibility to enroll in a qualified health plan
    through the State and Federal exchanges established under the ACA to
    citizens, nationals, or those otherwise ``lawfully present'' in the
    United States. The law directs the Department of Health and Human
    Services (HHS) to check applicant eligibility against Department of
    Homeland Security (DHS) data if the applicant does not attest that he
    or she is a U.S. Citizen, or if the Social Security Administration
    (SSA) cannot verify the applicant's claim of U.S. Citizenship. The
    Systematic Alien Verification for Entitlements (SAVE) Program\1\
    responds to queries and provides HHS, through the ``Hub'' established
    by the Centers for Medicare and Medicaid Services, with immigration
    status information as well as information regarding naturalized and
    derived citizens on behalf of DHS.
    ---------------------------------------------------------------------------
        \1\ SAVE is a service that helps Federal, State, and local benefit-
    issuing agencies, institutions, and licensing agencies determine the
    immigration status of benefit applicants so only those applicants
    entitled to benefits receive them. SAVE does not determine whether
    applicants are eligible for a specific benefit or license; the benefit-
    granting agency makes that determination. SAVE uses an on-line system
    that checks a benefit applicant's immigration status information
    against over 100 million Federal records. Agencies that do not have
    access to an automated system may submit a paper verification request.
    SAVE is available in all 50 States. It has been providing immigration
    status information to public benefit granting agencies for over 25
    years. SAVE has more than 1,060 customer agencies, including the Social
    Security Administration and most State departments of motor vehicles.
    The SAVE Program received over 14 million verification requests in
    fiscal year 2013.
    ---------------------------------------------------------------------------
    SAVE Access and Verification Process
        Before accessing SAVE, user agencies must sign a Memorandum of
    Agreement (MOA) or a Computer Matching Agreement (CMA) with USCIS that
    details the terms and conditions of their use of SAVE. The SAVE
    verification process requires up to three steps: (1) Initial
    Verification, (2) Additional Verification, and (3) Third-Step
    Verification. For initial verification, a user agency submits a status
    verification request and the system provides the applicant's
    immigration status information. If SAVE is not able to verify an
    individual's immigration status on initial verification, the benefit
    granting agency is prompted to submit the query to the additional
    verification step.
        During additional verification, a user agency may also submit
    additional information, such as a maiden name or additional immigration
    document numbers, to USCIS using the SAVE system. SAVE response time
    for additional verification, which includes manual review of available
    databases, ranges from 3-5 Federal working days. If SAVE is not able to
    verify an individual's immigration status at this stage, the agency is
    prompted to submit the query for third-step verification. The user
    agency must forward a completed Document Verification Request form,
    with legible photocopies of both sides of the applicant's immigration
    documentation to USCIS for third-step verification. Registered agencies
    may submit this information electronically or manually. SAVE response
    times for third-step verification is generally 10-20 Federal working
    days. If immigration status still cannot be confirmed, benefit-granting
    agencies may refer applicants to a local USCIS office to correct or
    update their record.
                              preparations for aca
        USCIS and HHS entered into a CMA to authorize HHS to use the SAVE
    program for ACA verification. In preparation for the ACA open
    enrollment period, USCIS and HHS tested the web services connection
    between SAVE and the HHS ``Hub'' that the Exchanges uses to submit
    queries to SAVE and other partner agencies. The testing included checks
    on both case-specific queries and overall functionality.
        After all testing was successfully completed in the weeks leading
    up to open enrollment, HHS was granted access to SAVE to meet the
    October 1 ACA exchanges implementation date. As of November 10, 2013,
    there have been 91,011 Hub-generated initial queries with an average of
    1.31 seconds for initial electronic SAVE responses. It is important to
    note that this figure is not a proxy for the number of individuals
    about whom HHS has submitted queries to SAVE because there are often
    multiple SAVE queries per applicant. Moreover, this figure is not a
    proxy for the number of people who have applied for health care
    coverage under the ACA because only a small percentage of such
    applications require the submission of queries to SAVE. SAVE is
    responding to all properly-submitted queries.
    Program Enhancements
        To help facilitate immigration status verification for HHS and
    other agencies under the ACA, USCIS designated more than 30 additional
    staff to ACA cases and has introduced several program enhancements.
    Authorized agencies may now receive grant date and sponsorship
    information for select statuses on initial, second, and third-step
    verification. Previously, agencies had to submit multiple forms to
    determine when an applicant was granted status, and sponsorship
    information was not available on initial verification.
        USCIS also recently introduced an ``auto second step'' feature,
    which allows SAVE to automatically send cases to additional
    verification if the initial step requests additional verification. This
    enhancement decreases agency user burden, ensures that additional
    verification cases are referred to the second step, and makes the case
    resolution process more efficient. Additionally, in April 2013, the
    SAVE Program launched a scan-and-upload feature that enables agencies
    to electronically attach scanned copies of immigration documents to
    cases. Cases with a scanned copy of the immigration document do not
    require submission of a paper form.
                                   conclusion
        Since the inception of the SAVE Program, USCIS has provided
    benefit-granting Government agencies a reliable method to verify an
    applicant's immigration status to ensure that only authorized
    applicants receive public benefits. On behalf of all of my colleagues
    at USCIS, I am grateful for the opportunity to speak to you today about
    the SAVE program.

        Chairman McCaul. Thank you, Ms. Correa. The Chairman now
    recognizes himself for 5 minutes for questions.
        Let me just say at the outset, there have been many Members
    of Congress on both sides of the aisle who have called for a
    delay in the implementation of Obamacare for many reasons. But
    I would think, first and foremost, we have a website that
    doesn't work. It seems to me it ought to be delayed until that
    website is functional. But more importantly to me and, I think,
    many Americans, it should be delayed until we can receive
    assurances from this administration that these websites are
    secure because of the personal data that is being put into
    them, into the exchanges.
        We are talking about Social Security numbers, names,
    addresses, e-mail addresses. You know, we are talking about
    health information, which is perhaps the most private of all
    information; certainly information that no American wants a
    hacker to get access to, to exploit for other purposes. I am
    personally concerned about the security of this website, and I
    haven't had the assurances that it is secure. Imagine a hacker
    getting this personal identifying information and exploiting it
    for personal gain.
        We see identity theft happen all the time, and yet we have
    this information being plugged into this exchange that I
    believe is not secure. I believe the American people deserve
    better. So my first question is to Ms. Stempfley. How many
    cyber attacks have there been on the HealthCare.gov system?
        Ms. Stempfley. So thank you for the question. As I
    commented in my opening statement, the awareness DHS has of
    cyber attacks that are on-going comes from a multitude of
    sources. One is Department and agency reports specifically of
    things that they have identified. We have had a handful of
    reports from the Department of Health & Human Services--a
    number of about 16, as my memory recalls. But I will get a
    specific number for you. As well as identification of threat
    information either provided to us from intelligence sources or
    from other mechanisms.
        We are aware of one open-source action attempting to
    perpetrate a denial-of-service attack against a HealthCare.gov
    site that has been successful.
        Chairman McCaul. So there has been a denial-of-service
    attack on health care.
        Ms. Stempfley. There was the attempt of one.
        Chairman McCaul. Attempt.
        Ms. Stempfley. But it has not been successful.
        Chairman McCaul. Of course, a denial-of-service attack has
    the capability to shut down websites.
        Ms. Stempfley. The goal of a denial-of-service attack, sir,
    would, yes, be to deny the access to that information.
        Chairman McCaul. You know, on the Homeland Security web
    page it talks about one of your primary missions. That is to
    oversee the security of the dot.gov domain. Did anyone at HHS--
    did Secretary Sibelius or anyone at HHS--ever--and involved in
    this website, and in this roll-out--ever contact DHS about the
    security of HealthCare.gov?
        Ms. Stempfley. Again, as I mentioned, the roles and
    responsibilities between DHS and departments and agencies are
    split. Departments and agency leadership has principle
    responsibility for building, operating, and securing their
    capabilities. The HHS CIO is a member of the CIO Council. Their
    SISO is a member of the SISO exchanges. We regularly
    communicate about threat in those forums. We were approached--
    we regularly communicate about threat and engagement and
    capabilities in those forums, and we have had limited exchange,
    specifically with HHS on this.
        Chairman McCaul. Well, the extent of the conversations that
    I have seen between HHS and the Department of Homeland Security
    are two e-mails and one phone call regarding the security of
    this website. Is that correct?
        Ms. Stempfley. It is not typical for a Department or
    agency, as they are building a specific application, to involve
    DHS as they build any specific application. So that is an
    unusual activity at that level. We regularly engage at the
    Department level.
        Chairman McCaul. So is the Department essentially
    defaulting to HHS and Secretary Sibelius for the security of
    the HealthCare.gov website?
        Ms. Stempfley. As indicated, sir, under FISMA and current
    guidance, Department and agency leadership are responsible for
    securing specific applications under the broad guidance
    provided by DHS.
        Chairman McCaul. I believe the oversight of this
    committee--that you should play a greater role. As your mission
    statement, you know, accurately says, correctly states that you
    have the primary responsibility. Do you know what the
    compliance rate is of HHS with respect to Government
    cybersecurity standards?
        Ms. Stempfley. We have engaged with HHS around compliance
    against the trusted internet connection activity, and we are in
    the process of collecting the figures for fiscal year 2013 for
    FISMA. The FISMA report is traditionally provided to the Hill
    in February.
        Chairman McCaul. Well, perhaps I can educate you. It is 50
    percent. It is a 50 percent compliance rate. Their score card
    is 50 percent, and we are defaulting our cybersecurity--the
    security of Americans' most personal, private data to the
    Secretary of HHS. I find that unacceptable. Do you realize that
    50 percent is the second-lowest score in the Federal Government
    when it comes to a report card on cybersecurity in the Federal
    Government?
        Ms. Stempfley. I believe, sir, that the scores you are
    speaking of are the FISMA report from fiscal year 2012 that
    came forward. Yes, you are accurately representing the scores
    of HHS in that situation. One of the things you will also see
    is that HHS has one of the top scores in the implementation of
    PIV cards, the two-factor authentication. So what is normal for
    a department is that they will have a range of reporting in
    that situation. In some instances they will be above average,
    and in other instances they will be----
        Chairman McCaul. But do you find it acceptable that you are
    defaulting to HHS for cybersecurity, when they have a 50
    percent compliance record that is the second-lowest in the
    Federal Government?
        Ms. Stempfley. Sir, as your opening statement indicated, we
    are operating under the current set of authorities and----
        Chairman McCaul. Well, I hope the Ranking Member will work
    with me to change that. Because I think you are the department
    with this expertise, not HHS. I believe you are the one with
    the--again, the background to fix this. I will just close with
    this. There was a letter from the CMS administrator to the
    Ranking Member that basically assured him that they would be
    following industry best practices and that this website would
    be secure. I believe that that did not happen.
        With that, the Chairman now recognizes the Ranking Member.
        Mr. Thompson. Thank you very much, Mr. Chairman.
        Ms. Correa, in verifying whether or not people who want to
    participate in the Affordable Care Act are legal or illegal,
    has that posed a problem for your agency?
        Ms. Correa. Thank you for the question. No, we have not
    encountered any issues. As I indicated in my opening statement,
    we establish the connection between the hub and our SAVE
    system. We tested that functionality and it is working as
    expected.
        Mr. Thompson. So those 91,000 queries to ACA have been met
    without any problem.
        Ms. Correa. They have processed in the manner that they are
    supposed to process through the SAVE system.
        Mr. Thompson. Thank----
        Ms. Correa. So in other words, they will come through for
    initial verification. If we, for some reason, cannot confirm
    that immigration status, then we prompt them to refer to second
    step, and so on. So it is functioning as expected.
        Mr. Thompson. Thank you.
        Ms. Stempfley, with respect to the potential for hacking or
    whatever, do you have any knowledge about the number of
    attempts that are made daily on the Federal system?
        Ms. Stempfley. Sir, just to give you an order of magnitude,
    in fiscal year 2013 we processed more than 13,800--138,000,
    excuse me, 138,000 reports to U.S. sort-of attempts against
    both Federal Government and critical infrastructure systems. So
    the multitude is fairly substantial.
        Mr. Thompson. So 138,000 attempts is a big number.
        Ms. Stempfley. It is, sir.
        Mr. Thompson. To your knowledge, have we met the defense
    requirement to not allow those attempts to be successful? Do we
    have any kind of----
        Ms. Stempfley. I am happy to provide for you, sir, as a
    response for the record the number of successful compromises
    that may have occurred. I don't have that number in my brain at
    the moment.
        Mr. Thompson. Please provide that to the committee, if you
    would. With respect to the dot.gov domain and its
    responsibilities that you have, are you presently carrying that
    dot.gov domain oversight out?
        Ms. Stempfley. Yes, sir.
        Mr. Thompson. Now, with respect to the HealthCare.gov
    domain, can you, for the committee, share the difference in
    oversight on that?
        Ms. Stempfley. If I understand your question, sir, we
    provide for example, for FISMA, we provide details to
    departments and agencies about how to report their compliance
    with FISMA both in terms of how to specifically answer the
    FISMA questions and measures, and how frequently to provide
    those updates so that we can produce the annual report and
    assessment that is delivered to the Hill in February.
        Mr. Thompson. Explain to the committee the FISMA
    requirement; what FISMA is and what is required.
        Ms. Stempfley. Certainly. So FISMA lays out a broad set of
    requirements for departments and agencies to secure their
    applications and systems. It empowers Department leadership to
    make local risk decisions about when something may--when a
    decision about what may need to be--what may be appropriate for
    a system or application needs to be looked at. You take into
    account the risk environment that the system operates in. Is it
    operating inside the department, or is it a heavily-connected
    system.
        Is it containing, for example, intellectual property
    information or something of that sort. So you are empowered--
    the departments and agencies are empowered to make those local
    risk decisions. It requires things such as training of all of
    your workforce against cybersecurity activity, assurance of
    accreditation decisions made, and number of systems and
    applications operating under a range of accreditation
    decisions.
        Mr. Thompson. To your knowledge, in the HealthCare.gov
    review, have you provided that training to the individuals with
    the responsibility for looking at that?
        Ms. Stempfley. Again, sir, each department and agency is
    responsible for providing that training, for ensuring that
    training is received in there. Then that is reported through
    the annual report to the Department of Homeland Security, the
    compliance measures associated with that. So it isn't a--it is
    not typical for the Department of Homeland Security to provide
    specific training to a department.
        Mr. Thompson. But they report the training to you.
        Ms. Stempfley. They do. They----
        Mr. Thompson. You put it in a report.
        Ms. Stempfley. We do. At the end of the year, we are--as I
    indicated, we are in the midst of collecting the fiscal year
    2013 data, and the FISMA report is traditionally handed to the
    Hill in February.
        Mr. Thompson. Thank you.
        Ms. Stempfley. You are welcome.
        Mr. Thompson. I yield back.
        Chairman McCaul. I thank the Ranking Member.
        The Chairman will recognize other Members for 5 minutes for
    questions, in accordance with out committee rules. I plan to
    recognize Members who were present at the start of the hearing
    by seniority on the committee. Those coming in after the
    hearing will be recognized in order of arrival.
        The Chairman now recognizes the Chairman of the
    Subcommittee on Cybersecurity, Infrastructure Protection, and
    Security Technologies, who has held two previous hearings on
    this issue, Mr. Meehan.
        Mr. Meehan. I thank you, Mr. Chairman. I thank you,
    Secretary Stempfley, for your continued work in this area. You
    know, I am just gonna follow on the question with regard to
    your being consulted, and giving to the agencies the ability
    for them to outline the security for their systems. Now, I
    would suggest to you--and would you not agree--that this is
    perhaps some of the most important information that is being
    collected by the Government today: The private identifying
    information on Americans who are applying, oftentimes giving
    intimate details about their families, and otherwise to the
    Government?
        Ms. Stempfley. So the--certainly, the Federal Government,
    through a range of departments, has information about----
        Mr. Meehan. Well, I mean, the PII is significant
    information, is it not, Ms. Stempfley?
        Ms. Stempfley. PII is certainly important, sir.
        Mr. Meehan. The Department itself lays out the
    qualifications. So here I hold in my hand what was created by
    HHS for the health insurance marketplace, the navigators'
    standard operating procedures manual. To the best of our
    review, the only security information developed is to make sure
    that you don't leave copies of things out on copiers. But under
    this manual, as was stated by the Secretary herself, it is
    possible that a felon may be a navigator.
        Should there have been guidelines to do security checks on
    the backgrounds of people who will be in privity of
    communication with the very applicants? Some of those
    navigators, under the Secretary's own admission, may be felons?
        Ms. Stempfley. Sir, respectfully, I believe that question
    is best addressed to the Department of Health & Human Services.
    I am in an area outside----
        Mr. Meehan. I would like to ask but we don't get them in
    front of us. I am grateful for your--the--I want to follow up
    on this other issue, as well, with regard to the compliance
    with FISMA. Now, we have had quite a go-around, as the Chairman
    has stated, with representatives before us from HHS. The
    requirement under FISMA to do the appropriate testing, then to
    then make sure that they correct any problems that they see.
    Then, ultimately, give an authorization.
        As you know, the inspector general themselves, the
    Department of Inspector General, released a report in late
    summer suggesting that there was no window. That the only
    certification, according to their schedule, was going to happen
    the day before the operation of the website. Then suddenly,
    voila! In the middle of the summer, HHS purportedly made these
    huge leaps, in which they were able to suddenly certify the
    security of the system.
        Now, how is it that they would have been able to go from
    the period in which they were being--the IG was concerned they
    weren't even going to be able to meet the deadline until the
    day before, and suddenly there was tremendous security steps
    taken by an agency that hadn't done anything for 3 years?
        Ms. Stempfley. Sir, the Department of Homeland Security is
    not generally engaged as a specific application is built or
    operated. You are asking me a question that I couldn't possibly
    know the answer to.
        Mr. Meehan. Okay. Well, one of the things, as the HHS
    inspector general's report itself says, that the security
    controls and security testing notwithstanding, they may--the
    authorizing official may grant security authorization with the
    knowledge that there are still risks that have not been fully
    addressed at the time of authorization. Is it possible that
    this was granted with the recognition that there were still
    risks, significant risks, that had not been addressed at the
    time of the authorization?
        Ms. Stempfley. The terms of FISMA enable Department
    leadership to delegate the responsibility for risk assessment
    and risk acceptance to lower levels. So it is certainly
    feasible that in that delegation that is----
        Mr. Meehan. So who is making the determination, then, on
    the most significant information, the biggest collection of
    privately-identifying information, that will be collected by
    the Government anywhere in its history? That is not my words;
    that is the testimony of others. This is being delegated to
    people we don't even know?
        Ms. Stempfley. Sir, I don't--one of the things that FISMA
    does not require is awareness of who the accrediting officials
    are to the Department of Homeland Security. So I am not aware
    of who the accrediting----
        Mr. Meehan. So who made the decisions, in other words? We
    don't know who is making the decisions to authorize the ability
    to suggest that they have complied with FISMA, when the
    inspector general themselves said it was going to be unlikely
    that they could before the start?
        Ms. Stempfley. Again, respectfully, sir, that question is
    best addressed to the Department of Health & Human Services.
        Mr. Meehan. I think my time is expired. Thank you, Mr.
    Chairman.
        Chairman McCaul. I thank the gentleman. I appreciate the
    point that these ``navigators,'' that navigate people, the
    American people, through this system, this website, don't
    undergo a background check. So the idea that convicted felons
    could be responsible for this is just unconscionable.
        With that, the Chairman now recognizes Ms. Sanchez, from
    California.
        Ms. Sanchez. Thank you, Mr. Chairman. Thank you, ladies,
    for being before us today and trying to shed some light on what
    I believe is an important topic. We need to ensure that we
    safeguard the information of Americans. So I appreciate the
    work that you do. When I look at everything that is under your
    directorates, et cetera it is pretty amazing.
        So I have a question. I am trying to come from a more
    general standpoint because, in a lot of ways, I am a layperson
    to the technical issues of securing somebody's identity, et
    cetera. But can you tell us, in general, across the Government
    networks that we have, what type of operational,
    administrative, technical, and physical safeguards are
    implemented to ensure confidentiality, integrity, and
    availability of PII and to prevent unauthorized or
    inappropriate access, use, or disclosure of PII?
        How does that compare to, for example, HIPAA security
    standards in place that protect the electronic health
    information that we have from a medical standpoint?
        Ms. Stempfley. Thank you. I appreciate the opportunity. I
    am personally not familiar with HIPAA in great detail, so I
    will----
        Ms. Sanchez. Well, it is one of our standards that we try,
    supposedly, to uphold so that people don't figure out----
        Ms. Stempfley. Absolutely.
        Ms. Sanchez [continuing]. What has been going on with----
        Ms. Stempfley. I am happy to talk about the kinds of
    administrative procedurals and technical controls that are part
    of the Federal enterprise security----
        Ms. Sanchez. Super. In layman's terms, please.
        Ms. Stempfley. I will do my best. So one of the most
    foundational things that is necessary for a viable security
    program is a set of operational processes and operational
    responsibility assignments and policy activities. Including
    things such as ensuring that all users receive annual training
    for their individual security awareness as a part of their
    receiving their log-in. That log-ins and passwords are
    effective. For example, we are in the process of migrating to
    two-factor authentication, that is a PIV card for log-in.
        So it is something more than just your password. You have
    to have something and know something in order to gain access.
    As well as the employment of procedures for understanding where
    your system--what systems you have, where they are, what assets
    are--what pieces of software are running on them. Then we have
    been on a long engagement under the Comprehensive National
    Cyber Security Initiative to create defendable boundaries
    around the Federal enterprise and to put in place a series of
    capabilities at those boundaries for better protection and
    defense.
        If you think about it in terms of a community, it is
    becoming a gated community and one that is focused on securing.
    You have a set of activities that have to happen for the
    individuals in the homes, for the homes themselves, and then
    for the community as a whole. That is a good allegory for
    laymen, you know, in layman's terms for the kinds of efforts
    that departments and agencies have to undertake in order to
    secure their systems and the broad networks that all these
    activities operate on.
        It includes--and I am actually very grateful to this
    committee and the Members on it for their commitment to
    capabilities such as the continuous diagnostics and mitigation
    effort, which we began more than a year ago and are in the
    process of releasing the contract for providing specific tools
    and capabilities for departments and agencies to put on their
    systems and assets. HHS has agreed to be an early adopter of
    such a capability to include intrusion detection and preventing
    capabilities that are provided at that boundary level.
        Ms. Sanchez. Great. I guess I would just say, you know, I
    always figure, on this committee, when we are looking at
    cybersecurity in particular, that the weakest link is an
    individual. So we can protect as much as we want, but, you
    know, it is what is going on. I remember a few years ago, when
    our system here within the House was being hacked. It turned
    out that it was because Members were taking their personal
    devices overseas and they were being hacked.
        So one of the rules we put in was that you either don't
    take your personal device, you switch out to a dumb device to
    get some of your e-mails. Or when you land you take out your
    battery, you know, from your thing, et cetera. Of course, my
    staff had dumbed me down on my device when I landed, but I saw
    all my other colleagues turning on their devices. I said, ``Oh,
    do you have a dumb device?'' They didn't even understand the
    policy.
        I looked at them, and I said, ``You guys, you know the new
    policy is take out your battery and you can't use your
    BlackBerry here because, you know, they are getting into our
    system here.'' They all looked at me and said, ``Oh,'' they
    said, ``we weren't aware of that policy.'' I said, ``Well, yes,
    it is a policy because Frank Wolf and others have, you know,
    they have gotten into our system.'' To which case they all
    turned around and started looking at their e-mails.
        Chairman McCaul. [Off mike.]
        Ms. Sanchez. So--no, it is true, Mr. Chairman. The other
    day I was flying back to California. I am on a plane, a
    colleague--for some reason, my PDA dropped someplace. One of my
    colleagues picked it up. She said to me, ``Oh, you know, I was
    gonna take a look.'' I said, ``Well, I am password-protected.''
    She looked at me, and I said, ``Well, aren't you password-
    protected on your device?'' She looked at me and she goes,
    ``No, it would slow me down.''
        So we can, you know, we try, and do try. Thank you for the
    work that you do is, I guess, what I am saying.
        Thank you, Mr. Chairman.
        Chairman McCaul. Thank you.
        The Chairman now recognizes the gentleman from South
    Carolina, Mr. Duncan.
        Mr. Duncan. Thank you, Mr. Chairman. I am proud to
    participate in No Shave November to raise awareness of men's
    health, specifically prostate cancer and cancer in general. I
    do so in honor and memory of the late South Carolina State
    representative, my good friend, David Umphlett, who passed away
    in 2011.
        Mr. Chairman, it is crystal clear to me that the Obama
    administration has put politics over the security of Americans'
    personal information. President Obama and Secretary Sibelius
    and other senior officials accepted an excessive amount of risk
    to Americans' information, all so this flawed website could go
    forward to meet the Democrats' political agenda.
        I have a memo from September 3, 2013, less than a month
    before the launch of the HealthCare.gov website from chief
    information officer of the Center of Medicare and Medicaid
    Services, Tony Trenkle. I would like to enter this into the
    record.
        Chairman McCaul. Without objection, so ordered.
        [The information follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Duncan. Thank you. Approving authorization to operate
    the system underlying the Obamacare health exchanges. Trenkle
    states the risk to CMS information systems resulting from the
    operation of the FFM, or Obamacare--FFM stands for Federal
    Facilitated Marketplaces--information systems is acceptable.
    But the memo then goes on to say page after page, describing
    enormous risk to Americans' personal information. Page 2
    discusses, ``malicious macros, the threat and risk potential is
    limitless.''
        Page 3: ``No evidence of functional testing processes and
    procedures being adequate to identify functional problems
    resulting in non-functional code being deployed.'' Page 4:
    ``Many FFM controls documented in the security controls section
    of CFACS have an effectiveness of not satisfied. Security
    controls are not documented as being fully implemented.'' It
    goes on: ``Ineffective controls do not appropriately protect
    the confidentiality, integrity, and availability of data, and
    present a risk to the CMS enterprise.''
        These show serious concerns in the security of the
    Obamacare exchanges. It makes clear that Obamacare represents a
    clear and present danger to Americans' personal information.
    How could anyone with a technology background assess that with
    all this that the risk was acceptable to move forward? Which
    they did, and launched a website October 1. Why weren't
    security officials in DHS and HHS and others sounding the alarm
    about the concerns raised by Mr. Trenkle? Is it in any way
    conceivable that these issues could be solved by the end of
    this month?
        That is a rhetorical question. We may get back with any
    conclusion. Mr. Chairman, I find it quite convenient that, in 2
    days, Mr. Trenkle has decided to cut and run from HHS and go
    into the private sector; not to be accountable to the oversight
    functions of Congress anymore. The American people deserve
    accountability for the threat this administration has allowed
    to our personal information.
        I would like to also share an article from South Carolina,
    a Columbia, South Carolina gentleman, an attorney. Went onto
    the HealthCare.gov website to browse for cheaper insurance for
    him and his wife. He entered in his information, just as you
    would normally do. A few days later, he had someone call him
    from North Carolina. He says, ``I believe, somehow, the ACA
    health care website has sent me your information. That is what
    it looks like to me,'' Mr. Judson Hadley said, a North Carolina
    resident, who could access Tom's information on HealthCare.gov.
        I think there is a problem with the wrong information going
    to the wrong place. Now, the article goes on to say that Mr.
    Hadley just entered into the website to try to shop for
    insurance for himself and he was sent this gentleman from South
    Carolina's personal information. He actually went to another
    link and clicked on it, and actually had a PDF that he could
    print out on his computer of all of this gentleman's
    information. These are serious flaws.
        This wasn't a hacker, this wasn't someone trying to
    intentionally access Americans' private information. This was
    information sent to a third party by HealthCare.gov. This
    website has serious problems. Americans are relying on this
    Government to get it right. So I go back to the question that I
    had asked rhetorically a minute ago: Is it any way conceivable
    these issues could be solved, Ms. Stempfley, by the end of this
    month?
        Ms. Stempfley. Again, sir, I respectfully submit that that
    question is best asked to the Department of Health & Human
    Services.
        Mr. Duncan. Are you aware of Mr. Trenkle's memo? Have you
    seen that?
        Ms. Stempfley. I believe I saw that this morning, sir.
        Mr. Duncan. Okay. Well, it will be entered into the record.
        Mr. Chairman, thank you for having this hearing. Americans
    expect us to get it right. If not, let's delay Obamacare
    implementation until the Government can assure Americans that
    their private information will not be stolen by a third party
    and their identity be taken that could cause serious financial
    harm to them and their families.
        With that, I yield back.
        Chairman McCaul. I thank the gentleman for his insight.
        The Chairman now recognizes the gentleman from New Jersey,
    Mr. Payne.
        Mr. Payne. Thank you, Mr. Chairman. Ms. Stempfley and Ms.
    Correa, I appreciate your being here today and your testimony.
    From my understanding, the Federal data service hub is not a
    database or a repository for personally identifying information
    or for health care records in general. Is that correct?
        Ms. Stempfley. Sir, I am not personally familiar with the
    architecture of HealthCare.gov.
        Mr. Payne. Ms. Correa.
        Ms. Correa. I am not familiar with their--I don't know
    exactly what their architecture is. My understanding, it is
    not. It is just a conduit for passing information.
        Mr. Payne. That is my understanding, as well. I think that
    needs to be clarified. You know, again, from my understanding,
    this hub will just be used to determine someone's eligibility
    to participate in the exchange, enroll in a plan, receive a tax
    credit, and determine whether someone is entitled to an
    exemption only. Is that your understanding?
        Ms. Correa. From the accounts that I have read, yes, that
    is my understanding. That it is a help to process information.
        Mr. Payne. Okay. Let's see. Can you describe how the
    Federal agencies like HHS, DHS, the IRS, and Social Security
    Administration are coordinating with one another and with
    insurance carriers to share information, and how is that
    information being protected?
        Ms. Correa. I can speak to the agreements that we enter
    into--``we,'' as in USCIS enter into--with our partner agencies
    who have the databases that we go out and look at. We enter
    into some form of an agreement, either a memorandum of
    agreement or a computer matching agreement--that is the
    agreement that we entered into with HHS--and we also have what
    are called ``service-level'' agreements. Service-level
    agreements typically talk about performance in terms of when we
    go out and query a database what kind of response times we can
    expect.
        So those are the kinds of agreements that we enter into.
    Again, I do want to emphasize that our SAVE program doesn't
    download information from those databases. We merely go out,
    ping those databases for information, obtain the immigration
    status and the class of admission, and provide that information
    back to the inquiring agency.
        Mr. Payne. Okay. It is--you know, it--do Federal agencies
    often share personal identifiable information for the purposes
    like processing Social Security claims? How is that information
    protected? You know, is the same approach being used for those
    enrolling in these exchanges?
        Ms. Stempfley. Sir, unfortunately, it is atypical for the
    Department to engage at a system level in that perspective.
    Although one of the requirements under--for example, under
    FISMA, is an interconnection agreement which is put in place
    between two systems that are--articulates the security
    requirements that both parties must be subject to.
        Mr. Payne. Okay. One last question. You know, as you ladies
    know, the changes are being made to HealthCare.gov to make it
    run better. What steps are being taken in coordination with
    these changes to ensure that personally identifiable
    information is still protected?
        Ms. Stempfley. Sir, again, I think, respectfully, that
    question is best directed to the Department of Health & Human
    Services.
        Mr. Payne. Okay. Well, with that, Mr. Chairman, I will
    yield back.
        Chairman McCaul. The Chairman will now recognize the
    gentleman from Pennsylvania, Mr. Perry.
        Mr. Perry. Thank you, Mr. Chairman. Thank you, ladies, for
    being here. Just looking for your overall assessment, because I
    think we--at least I, as a Member, and I think many of my
    constituents, members of Citizens of America--are concerned,
    wondering who is responsible. So I am looking for your broad
    knowledge of the system. To where does an American whose
    information has been compromised, to whom does that person seek
    redress?
        Is there an individual, is there an agency? What is the
    mechanism to be made whole once your information is compromised
    and who knows what it is used for? If there someone that you
    know of, is there any agency? Where do Americans go when it
    goes bad, if it goes bad?
        Ms. Stempfley. As a normal--sort of in the normal course of
    events across the Federal enterprise, if a citizen experiences
    an issue with a Federal application, typically the first place
    they go is that application's support desk or support function.
    That is generally escalated to security operation centers
    inside the organization, and then further escalated to the
    Department of Homeland Security for visibility and for response
    functions.
        Mr. Perry. So it would be the Homeland Security--it would
    be the----
        Ms. Stempfley. Department of Health & Human Services.
    Generally, it is the support function for whatever that
    application might be.
        Mr. Perry. Would they be able to seek financial
    remuneration for, you know, some kind of grievance? Or if their
    identity was taken and their accounts were emptied and their
    lives were destroyed from a digital standpoint would they be--
    is that where they would go?
        Ms. Stempfley. I am sorry, sir, that is not an area of
    expertise of mine about--in the redress areas. I will be happy
    to take the question----
        Mr. Perry. Okay, appreciate it. Ms. Correa, do you know?
    Okay.
        Ms. Correa. I do not.
        Mr. Perry. Ms. Correa, I appreciate you being here. It
    provides a unique opportunity. If you can explain CIS's role in
    identifying somebody who comes here illegally to access our
    services and tries to sign up on the exchange, what is the role
    there of CIS in identifying that person? What is the process?
        Ms. Correa. Thank you for your question and the opportunity
    to clarify how the process works. The benefit-granting agency
    is the organization that determines the eligibility of whether
    an individual is eligible for a particular benefit. They come
    to us through the--in this case, the Affordable Care Act,
    through the hub. They come to us, they provide us with
    information such as their alien number, their I-94 number,
    their name, their date of birth, et cetera. That is the data
    that we use to go out and verify the immigration status of the
    individual.
        The SAVE responds with the immigration status information
    as well as the class of administration--if it is able to
    confirm the immigration status based on the information
    presented. However, any decision on the eligibility for
    benefits is made at the benefit-granting agency level. In other
    words, USCIS does not make that determination.
        Mr. Perry. Okay. Do you know, if you can tell me, how long
    that process takes? I am looking, just so you understand, in
    the context of the administration has on numerous occasions
    said that the process should take about 25 minutes to sign up.
    So all that, in my mind, has to occur, right, before you can
    sign up? This is all in the span of 25 minutes. Is that--do you
    have any idea of the time that that process takes?
        Ms. Correa. I would like to clarify that the sign-up
    process is happening outside of this SAVE process. That sign-up
    process is before the exchange comes through the hub, to us,
    for a SAVE query. So I wouldn't know how long that process
    would take. What I can share with you is our response times, as
    I mentioned, in our testimony. From the moment we receive a
    query, either in the initial verification step or in the
    subsequent steps, how long that takes. But I couldn't talk
    about how long does it really take to sign up.
        Mr. Perry. Just for the record, again, what is your time
    frame?
        Ms. Correa. Sure. Our average response time in the initial
    query is about 3 to 5 seconds. On the ACA, right now, the
    queries that we are getting through we are seeing about 1.31
    seconds response times.
        Mr. Perry. Okay.
        Ms. Correa. For the second step, it takes about 3 to 5
    Federal working days. For the third step, which is the more
    complex steps, it takes about 10 to 20 Federal working days.
        Mr. Perry. Okay. So is that--am I to take it to mean as far
    as you can tell that somebody that is here illegally that maybe
    came just to sign up for benefits could do that, and be
    involved in--could go through the exchange and sign up for
    benefits, and receive a plan, before they could be identified
    as being here illegally?
        Ms. Correa. Let me clarify that someone who is here
    illegally, who is undocumented----
        Mr. Perry. Right.
        Ms. Correa [continuing]. Is not likely to be able to come
    through the hub with a query. Because the benefit-granting
    agency, when an individual attests that they are either not a
    U.S. citizen or--if an individual attests that they are not a
    U.S. citizen they have to present their documentation as to
    what their status is.
        Mr. Perry. Right.
        Ms. Correa. That is the information that the benefit-
    granting agency would enter into the system--or the individual
    would have to enter that information if they are entering
    directly--to come through for a query. So an undocumented
    individual wouldn't have that information and wouldn't be able
    to be the subject of a query.
        Mr. Perry. Thank you. I see my time is expired, and I yield
    back.
        Chairman McCaul. I thank the gentleman.
        Mr. Duncan referred to an article during his questioning
    that he would like to make part of the record. I would like to
    ask unanimous consent that it be made a part of the record.
        Ms. Jackson Lee. Will the gentleman yield?
        Chairman McCaul. The Chairman yields to the gentlelady.
        Ms. Jackson Lee. I am sorry. I did not hear what the
    document was. Would you just repeat for the record what the
    document was?
        Chairman McCaul. It had to deal with a gentleman from, I
    believe, North Carolina that tried to sign up for Obamacare and
    got information back regarding another gentleman from South
    Carolina, very personal information, that has been widely
    reported.
        Ms. Jackson Lee. So it is a newspaper article?
        Chairman McCaul. Correct.
        Ms. Jackson Lee. I thank the gentleman. I yield.
        Chairman McCaul. Okay. Without objection, so ordered.
        [The information follows:]
              Article Submitted For the Record by Hon. Jeff Duncan
      midlands man has personal information compromised on healthcare.gov
    Posted: Nov 03, 2013 6:22 PM EST
    Updated: Nov 04, 2013 4:04 PM EST
    By Meaghan Norman
        COLUMBIA, SC (WIS).--About a month ago, attorney Tom Dougall logged
    on to healthcare.gov to browse for cheaper insurance for him and his
    wife.
        On Friday, the last thing he expected to hear on his voicemail was
    a man from North Carolina who says he can access all of Tom's personal
    information.
        Dougall says he thought it was a scam until he realized his privacy
    had been breached.
        ``I believe somehow the ACA, the Healthcare website has sent me
    your information, is what it looks like,'' said Justin Hadley, a North
    Carolina resident who could access Tom's information on healthcare.gov.
    ``I think there's a problem with the wrong information getting to the
    wrong people.''
        In a telephone interview, Hadley said he simply put in his username
    and password when Dougall's information appeared.
        ``The next page that came up was a page that prompted that I have a
    marketplace eligibility information to download. And that's when I
    clicked download and Mr. Dougall's information came up in a PDF
    document,'' said Hadley.
        At first, Dougall didn't know what to think.
        ``We received a phone call from a gentleman named Justin in North
    Carolina who informed me that he had gone on the healthcare.gov website
    and when he logged in under his log in and password, he received a
    document of all of my and my wife's personal information,'' Dougall
    said.
        Dougall said he thought it was a ploy.
        ``Initially I was concerned because I didn't know if this was some
    guy who was scamming me or if in fact this was a guy who really had my
    personal information,'' he said.
        Hadley even provided proof, documents containing Tom's personal
    information and screen shots of the website.
        ``And you can see that he's actually signed in as Justin and it
    tells him he has notices about his marketplace eligibility and to
    download those and when he downloads it, the next screen shot shows him
    my personal information,'' Dougall said.
        Dougall said now Hadley cannot sign up for the coverage he needs
    because he's been blocked by Tom's personal information.
        ``I'm assuming I'm going to have to pay the penalty or tax or
    whatever they're calling it now for not having health insurance next
    year,'' said Hadley.
        ``We're told constantly that it's a secure system and it's not,
    obviously,'' Dougall said.
        Having lived through one security breach in the State of South
    Carolina with the Department of Revenue, Dougall wonders what would
    happen if a professional hacker tried to log on.
        ``I tried to call healthcare.gov last night and they have no
    procedure whatsoever to handle security breaches,'' he said. ``All they
    can do is try to sell you a policy.''
        Dougall has also contacted his Congressmen. He says he's calling
    the Department of Health and Human Services directly on Monday.
        ``They're so concerned with trying to fix the problems they
    currently have that they refuse to acknowledge or won't acknowledge
    that there's been a major breach,'' Dougall said.
        In the mean time, Dougall does not know how to secure his
    information.
        ``I think there's a problem with the wrong information getting to
    the wrong people,'' Dougall said.
        We reached out the U.S. Department of Health and Human Services,
    they responded via email Sunday afternoon asking for more information
    about what happened to Tom and Justin.
        Late Sunday, an HHS official said a security team is working to fix
    the issue. ``We are aware of this issue and it is on our punch list of
    fixes, scheduled to be addressed in the very near future.''
        They added consumers can call the toll-free number or access the
    on-line chat tool that is available 24/7.

        Chairman McCaul. The Chairman now recognizes the gentleman
    from Texas, Mr. O'Rourke.
        Mr. O'Rourke. Thank you, Mr. Chairman. Thank you for
    holding this hearing.
        The implementation of the Affordable Care Act, thus far,
    has been deeply disappointing. Most obviously, the roll-out of
    the website has been a disaster. I want to work to make sure
    that we fix those problems that we have identified. I want to
    make sure that we make this law work. It is, after all, the law
    of the land. It has been tested several times, and tested at
    the level of the Supreme Court. The Government was effectively
    shut down, in part, in dispute and debate over this.
        I think politically, legislatively, that has been resolved.
    Now we need to make sure that it works. Again, the
    implementation so far has been disappointing. But I want to
    work with Members from both sides to fix those problems that we
    have identified, and there are many, and make this work.
        I think about the 200,000 El Pasoans that I represent who
    are currently uninsured. Who, because of their lack of
    insurance, are gonna have worse health outcomes than they
    otherwise would. Who, because they don't have insurance, when
    they do get care, the rest of us are subsidizing that care in a
    very ineffective, inefficient, and costly manner.
        So I want to make sure that this law works. I think its
    goals and intentions are noble. I think it is perfectable. So I
    want to make sure that we are focused on that. In today's
    hearing, we are looking at cybersecurity threats and problems.
    Some of the questions resolved around--or revolved around a tax
    on HealthCare.gov. Denial of service attacks, hacking attempts,
    attempts to gain access, or entry, illegally.
        I am assuming, and correct me if I am wrong, that every
    single Government web asset is attacked, perhaps on a daily or
    a minute-by-minute basis. Is that correct?
        Ms. Stempfley. Certainly, sir. The internet itself, where
    we operate in this environment, is one that contains a
    multitude of threats. The Federal Government websites and
    Federal Government systems are subject to the same environment
    and these same threats.
        Mr. O'Rourke. So the existence of threats, proof that
    attacks have taken place, do not prove the system is
    vulnerable. Or, from your answer to the previous question from
    the Chairman, do not establish that you have concerns about the
    security of that system. Is that correct?
        Ms. Stempfley. Certainly, sir. The existence of threats
    does not increase the vulnerability that the systems might be--
    --
        Mr. O'Rourke. Have you seen anything, thus far--you know, a
    month-and-a-half in--that would give you concern about threats
    that might be realized, or vulnerabilities that might be
    exploited that have not been addressed so far by the
    administration or HHS?
        Ms. Stempfley. The position that the Department of Homeland
    Security exists is in both awareness and in reporting has only
    provided limited information, at this point. As I said earlier,
    we received about 16 reports from HHS that are under
    investigation, and one open-source report about a denial of
    service.
        Mr. O'Rourke. In thinking about the VA, and the fact that
    the VA is trying to move to a much more web- and digital-based
    sharing of service records and medical records for former
    servicemembers, anything that we can learn from the success or
    failures in those VA programs that are sharing very sensitive
    information? In some case, I realize that information has been
    compromised. Anything we can learn, or what lessons have we
    learned, that we are able to apply to what we are doing now
    with HealthCare.gov?
        Ms. Stempfley. So I believe I mentioned that the HHS CIO as
    well as the VA CIO are members of the CIO council and of the
    CISO forums. Those are--the CISO forum specifically is one that
    we in DHS run to ensure that we have an avenue for that sharing
    of current activity and lessons learned in engagement. There is
    a series of best practice documents and actions that are
    published by DHS that are an amalgamation of all of that
    learning and that are available.
        Mr. O'Rourke. Do you know, specifically, if the VA has
    shared that information from their best practices and what they
    have learned from failures within that system?
        Ms. Stempfley. I could not speak to a VA-to-HHS-specific
    conversation. But we have the aggregation of all of those in a
    published format so the departments and agencies can gain
    access to that around the clock.
        Mr. O'Rourke. Ms. Correa, let me ask you a question. In El
    Paso, there are bound to be many mixed-status families amongst
    those 200,000 uninsured people that I represent in our
    community. Walk me through what happens when you have a U.S.
    citizen child to a parent who has undocumented status
    currently. How will they use that system? How will you use that
    information if you learn that that parent is here in an
    undocumented fashion?
        Ms. Correa. As I mentioned before--thank you for your
    question, but as I mentioned before, what we would see is the
    information about that child that they are applying for a
    particular benefit. So the benefit-granting agency would be
    entering that information. That is the only information that we
    would be processing through the query. If the undocumented
    parent were trying to apply for a benefit, if they don't have
    documentation, then we wouldn't see that query because there
    would be no information to enter into the system.
        Mr. O'Rourke. With the Chairman's indulgence, if I could
    just ask a quick question.
        Ms. Correa. Sure----
        Mr. O'Rourke. If you somehow through this system,
    HealthCare.gov, learn that the parent is here illegally, would
    you act on that information, and how would you act on that
    information?
        Ms. Correa. I would like to confirm my answer on this, but
    we do not rely on that information. Because, again, we only see
    a fragment of data. So there is nothing that we would do with
    that information at this time.
        Mr. O'Rourke. Okay, thank you.
        Thank you, Mr. Chairman.
        Chairman McCaul. Gentleman.
        The gentlelady from Michigan, Mrs. Miller, is recognized.
        Mrs. Miller. Thank you, Mr. Chairman. I certainly thank you
    for calling this very important hearing on this issue.
        My question to the two of you--and I appreciate your
    attendance here today--as I have listened to the questions from
    my other colleagues, it is certainly clear from your answers
    and your testimony that the Department of Homeland Security has
    not been intimately involved in protecting the security of the
    most personal and most private information of American citizens
    through the HealthCare.gov website. That that responsibility
    rests, as you kept testifying, solely--at this point, solely
    with the Department of Health & Human Services. Many times, you
    said that question should be asked of them, not of you.
        So my question to you, then, would be: Do you play a role
    in determining acceptable risk when the Department of Homeland
    Security--not the other departments or the Department of HHS,
    but the Department of Homeland Security--do you play a role in
    determining what is acceptable risk when the Department of
    Homeland Security launches--when you launch, that--your
    department launches a new website within the Department? Mr.
    Duncan was reading off a list of serious risks that the HHS had
    identified before the launch of the HealthCare.gov.
        If the Department of Homeland Security would have
    identified those kinds of risks, similar risks, before you
    launched a website for the DHS--not one of the other
    departments, your department--would you have found that risk
    acceptable, and would you have advocated the launch of that
    website?
        Ms. Stempfley. In the Department of Homeland Security, the
    right principle risk acceptance official is the chief
    information officer, and that is an organization roughly
    parallel to mine. We have a strong engagement with the chief
    information officer through a series of information exchanges.
    It is not typical, even in the Department of Homeland Security,
    for that risk official to reach out to us on specific systems
    or applications as they go forward. We engage with them through
    the same broad conversations as we go forward.
        For the information technology systems that we operate as I
    pointed out, things like the continuous diagnostics and
    mitigation program and the intrusion detection programs like
    EINSTEIN, which I am grateful to this committee for its support
    of--we are responsive to the CIO in detailing the compliance
    actions forward and ensuring compliance with security standards
    that are set. So there is a----
        Mrs. Miller. But would you have raised any question at all?
    I mean, I understand you don't want to answer any questions
    about HHS. But now you can't even answer a question about your
    own Department. Although you say typically you talk back and
    forth, typically----
        Ms. Stempfley. For----
        Mrs. Miller. I mean, typically you can't even raise a red
    flag?
        Ms. Stempfley. For the magnitude of the numbers of
    applications that we are talking about, ma'am, are substantial.
    For example, in HHS, in their FISMA 2012 report, they reported
    10,648 individual applications. So within any specific one it
    is difficult to go in great detail. For the application----
        Mrs. Miller. So typically, since I have a limited amount of
    time--typically you can't even raise those questions, right?
    Typically?
        Ms. Stempfley. Typically, under the current authority and
    landscape, that is a true statement.
        Mrs. Miller. Okay. Well, that is an interesting answer. I
    appreciate your candor. You can't raise a question if you have
    those kinds of problems. Could you, then--shifting gears just
    for a moment, I wanted to pick on something the Chairman
    mentioned at the outset. Typically, the Congress has oversight
    responsibilities. Typically, when we have hearings like this,
    typically--for hundreds of years, typically we get testimony
    from the witnesses typically at a deadline.
        Now in this case, for whatever reason, we did not get--
    whether you were unwilling or unable to give us your testimony.
    I mean, as a Member of Congress, trying to typically do my job,
    I am trying to read the information the day before, the night
    before, whatever so that I can be prepared, typically. But in
    this case, we couldn't get your testimony before the hearing.
    Now, I don't know if that is typical for you or your Department
    not to respond on the deadline. Usually we do get it.
        The Chairman mentioned perhaps it is because the White
    House wouldn't allow you, in this case, to give us the
    information. Could you expand for me, at least, why that was--
    you were not able, you were unable or unwilling, to give us
    your testimony to meet the deadline which is a typical
    situation?
        Ms. Stempfley. It certainly is--I am a believer of being
    prepared myself, and so it is certainly a goal of all of ours
    to ensure that we provide information in as rapid a manner as
    possible to individuals. In my office we work very hard to
    ensure that we are responsive and within the controls and
    constraints that we operate under. So I am pleased that you
    were willing to have us here to speak, even though the
    testimony did not arrive to you in time. So thank you for that.
        I am not familiar with all of the steps between here and
    arriving on your door to speak to this specific event. I am
    happy to go back and get you an answer.
        Mrs. Miller. Thank you. Mr. Chairman, we are apparently not
    going to get any answers out of these witnesses, so I
    appreciate that. Appreciate the time. Thank you.
        Chairman McCaul. I appreciate the gentlelady's questioning.
    I--as the Chairman of this committee, I would like to know, did
    you prepare an opening statement?
        Ms. Stempfley. Yes, sir.
        Chairman McCaul. That opening statement was not delivered
    to this committee. Is that correct?
        Ms. Stempfley. I believe I--you mean an oral statement or a
    written statement?
        Chairman McCaul. We--well, we did not have your written
    opening statement.
        Ms. Stempfley. I believe that----
        Chairman McCaul. Until 9 o'clock this morning.
        Ms. Stempfley. Yes, until this morning. I believe that is a
    true statement--5 copies----
        Chairman McCaul. So it was held up by somebody, correct?
        Ms. Stempfley. Again, sir, I----
        Chairman McCaul. I see you have to refer to counsel. But
    can you tell the Chairman?
        Ms. Stempfley. There is a process for----
        Chairman McCaul. Of course there is. But when did you
    finish your draft of your opening statement?
        Ms. Stempfley. Thursday? Thursday?
        Chairman McCaul. So Thursday, and here we are today----
        Ms. Stempfley. Yes, sir.
        Chairman McCaul [continuing]. You know, many days later.
    Who approved your statement?
        Ms. Stempfley. Who approved my statement?
        Chairman McCaul. Correct.
        Ms. Stempfley. It goes through a series of--the gentleman
    who understands the process better than I do. I submit it to
    the Department, and the Department submits it forward.
        Chairman McCaul. Okay.
        Ms. Stempfley. I am not sure--I don't have a name of who
    approved it.
        Chairman McCaul. You do not know who held up your
    statement.
        Ms. Stempfley. I don't know, sir.
        Chairman McCaul. Okay. I would like to know who did, and
    why. Because as Mrs. Miller stated, this is not typical.
        Ms. Stempfley. I understand.
        Chairman McCaul. In fact, extraordinary. I personally think
    it is due to the sensitivity of this issue. I would like to
    know whether the White House did hold this statement up.
        With that, the Chairman now recognizes the gentleman from
    Nevada, Mr. Horsford.
        Mr. Horsford. Thank you, Mr. Chairman. I will try to be
    brief.
        I want to fist associate myself with the comments of the
    Ranking Member and several other Members of the committee who,
    like myself listening to my constituents, am concerned about
    where things stand with the roll-out of the Affordable Care Act
    website and the ability for my constituents and constituents
    across the country to effectively access and shop for plans
    that are available. Fortunately, in the State of Nevada, our
    Governor, despite being opposed to the law, worked with the
    legislature to implement a State exchange.
        So we are better off than many States that have--continuing
    to oppose the implementation of the laws, as required. I am a
    bit perplexed by some of the comments that have been made this
    morning by my colleagues on the other side that are so outraged
    by the glitches and the fact that there are security concerns
    with HealthCare.gov. Particularly because, as a Member of the
    Subcommittee on Cybersecurity, Infrastructure Protection, and
    Security Technologies, we have had many, many, many hearings
    about the vulnerabilities of personal identifiable information
    in the private sector, as well.
        There are financial institutions, there are private health
    care companies that do not do a good job of protecting that
    information in the private sector. So if we could just work
    together, the two sides, to identify those challenges, and work
    towards solving them in both the public and private sector,
    then I think the public would be better off. But unfortunately,
    we have things like the House Republican playbook that helped
    to disseminate information for how people shouldn't navigate
    the system effectively and, instead, just bring the negative
    information forward.
        So I want to just ask our panel a couple of questions.
    First, Ms. Stempfley, thank you very much for being here. I
    know you have testified several times before the Subcommittee
    on Cybersecurity, Infrastructure Protection, and Security
    Technologies before. To the best of your knowledge, are the
    HIPAA privacy and security standards applicable to the
    exchanges and the data service hub?
        Ms. Stempfley. Sir, as I believe I said, I am not a HIPAA
    expert. So I would be happy to find one to answer that question
    for you, but you are certainly on the edges of my personal
    knowledge.
        Mr. Horsford. From my understanding, obviously the HIPAA
    rules as established set Federal standards to protect
    individually identifiable health information. That is a Federal
    requirement.
        Ms. Stempfley. Yes.
        Mr. Horsford. Correct?
        Ms. Stempfley. Yes.
        Mr. Horsford. The Department of Homeland Security is
    required to meet those Federal privacy and security standards,
    correct?
        Ms. Stempfley. As with HHSB, yes, sir.
        Mr. Horsford. So how do you go about doing that within your
    Department?
        Ms. Stempfley. Forgive me, sir. Can you ask the question
    one more time?
        Mr. Horsford. How does the Department of Homeland Security
    go about ensuring Federal privacy and security standards apply
    under HIPAA?
        Ms. Stempfley. Thank you. Great, thank you. So I--in my
    office in DHS, we don't actually operate systems who contain
    that kind of information. So I can speak in general terms about
    the kinds of requirements we would operate under, and assume
    that the HIPAA requirements would be similar in that situation.
    So we are required to submit forward a package of evidence
    demonstrating our compliance with each of these requirements to
    the accrediting official.
        Then the accrediting official reviews that package of
    evidence to determine that--to demonstrate that we have, in
    fact, provided that compliance as they are making their
    accrediting decision.
        Mr. Horsford. Does the same apply for immigration?
        Ms. Correa. Yes, sir, that is correct. From a system-owner
    standpoint, that is the process that we follow. We submit the
    package of information. It goes to the accreditation official,
    which normally resides within the chief information officer's
    office, and they do the accrediting of the system.
        Mr. Horsford. One last question in my concluding time
    allowed. The issue around the breach procedures. When there is
    a breach, what is the requirement in Federal law for the
    notification of the individual and States if the breach reached
    a certain number of individuals?
        Ms. Stempfley. So, certainly, one of the things that we
    have been talking about with the subcommittee, sir, is that
    there is not a single Federal breach require--Federal law
    associated with data breach requirements. That there is a
    multitude of State laws that are out there. So I appreciate
    your raising this issue that I know we have spoken of. When it
    comes to Federal systems, if personally identifiable
    information is, in fact--there has been a breach of personally
    identifiable information, Department and agency leadership are
    responsible for making a determination of the scope of that
    breach and for reporting that to the Department of Homeland
    Security. We also through the annual report forwarded both to
    OMB and to--and in the FISMA report.
        Mr. Horsford. Thank you, Mr. Chairman.
        Chairman McCaul. The Chairman recognizes the gentleman from
    Utah, Mr. Stewart.
        Mr. Stewart. Thank you, Mr. Chairman. I am gonna go
    quickly. There is a lot I want to cover.
        I want to come back to a couple comments that have been
    made previous, and then--to the witnesses. To Mr. Horsford, I
    appreciate your comments about trying to work together. I would
    remind the committee that that is what we were trying to do.
    That is why we asked the administration for a delay. But the
    President assured us again and again and again, he promised the
    American people we are ready. That is why he refused to work
    with us on any kind of a delay. Of course, we found out now
    that that is not the case.
        I want to come back to--just very quickly, about your
    opening--not your opening comment, but your opening statements.
    Did anyone ever advise either of you that they were not going
    to submit those statements to the committee?
        Ms. Stempfley. No, sir. I believe it was the 5th of
    November when I was asked to speak in front of this committee,
    and no one has advised that they weren't gonna be provided.
        Mr. Stewart. So----
        Ms. Stempfley. It was just a number of days between the 5th
    of November and the----
        Mr. Stewart. Okay. So last Thursday you prepared your
    opening statements. You passed those up the line. No one ever
    asked you to revise them, no one ever indicated any problems
    with them. They just disappeared and no one ever saw them,
    including the committee, until this morning. Is that right?
        Ms. Stempfley. Sir, a number of grammatical errors were
    identified and corrected----
        Mr. Stewart. But nothing substantial.
        Ms. Stempfley [continuing]. In the course of it. But no,
    there was no----
        Mr. Stewart. They didn't come to you say this is
    unacceptable, we can't submit this the way it is.
        Ms. Stempfley. There was--I am trying to remember what it
    started and what it looked like when I got it back. But it was
    effectively--it was written and it was sort of choppy and
    smoothed out. But there were no changes.
        Mr. Stewart. Okay. So as far as you know, your opening
    statements were acceptable. Okay. But, apparently, someone
    concluded they were not because they were not submitted to the
    committee.
        Ms. Stempfley. Sir, I would not--respectfully, sir, I
    believe it was just a matter of between the 5th of November and
    the 13th of November----
        Mr. Stewart. Okay.
        Ms. Stempfley [continuing]. Going through the set of
    processes. It wasn't a----
        Mr. Stewart. Well, perhaps. Although I think there may be
    others who would say that it was more than just that. But let
    me move on, if I could.
        You are both Federal employees, and you both will stay on
    the Federal Employee Health Benefits program. Is that right?
    Yes. You are not gonna move to the exchanges. Of course, both
    of you realize that I will, Members of the committee will, all
    of our staff will. In fact, tens of millions of Americans are
    gonna be forced to move onto the exchanges beginning, you know,
    January 1, where they will be forced, in order to do that, to
    provide very, very private information.
        The President won't move onto the exchanges, will he? No.
    No, of course he won't. Neither will any of his Cabinet,
    neither will Kathleen Sibelius, Secretary of HHS. Knowing that,
    do you understand and can you help the American people
    understand why we are more concerned, apparently, about the
    security of our private information? I am speaking now not for
    myself or my staff. I am speaking for tens of millions of
    Americans. What would you say to them who are concerned about
    their security, knowing that they have to do something that the
    administration and the Cabinet and the Secretary will not have
    to do? That is, join the exchanges and provide this type of
    private information.
        What could you say to them to make them feel better about
    that?
        Ms. Stempfley. Sir, I have 20 years in the Federal
    Government, and much of that focused on ensuring that
    cybersecurity is important to the American public and important
    to the people who build and operate applications, whether it be
    in critical infrastructure or in the Federal Government. It has
    been a passion of mine for a number of years. It is one of the
    reasons why I am in the job I am in.
        Mr. Stewart. Yes. Knowing your background there, and
    knowing it is your passion and that you have 20 years' of
    experience, it must be incredibly concerning to you to see some
    of the failures that--and some of the inherent weaknesses that
    are apparent within this website. Does that--is that true? Does
    that bother you, knowing that it is not as secure as it should
    be?
        Ms. Stempfley. I believe the environment that we all
    operate in today and the dependence on information technology
    and our critical infrastructure and in other places, it is
    certainly an area of focus and concern. I am not personally
    familiar with all of the specifics in health care--in this HHS
    application. So I am, unfortunately, not in a position to----
        Mr. Stewart. Let me ask--let me finish with this last
    thing. DHS, 99 percent compliant with the FISMA standards, with
    the Federal Information and Secretary Management Act--99
    percent. HHS, 50 percent compliant. Yet HHS did not seek out
    any council and expertise, any briefings or guidance from DHS
    in implementing and designing the security around their web
    page. Any explanation for why they wouldn't seek guidance from
    DHS, knowing that they were experts on this and that HHS was
    not?
        Ms. Stempfley. As I believe I said--that as we make
    departments and agencies aware of the capabilities that the
    Department has it is incumbent upon them to pick the best time
    in the operational life cycle of their systems and applications
    for the engagement. I----
        Mr. Stewart. Okay. I wish they had done that previous to
    the portals being open, and not after the fact. But I am out of
    time, and Mr. Chairman thank you for the hearing.
        I yield back.
        Chairman McCaul. I thank the gentleman.
        The gentleman from Arizona, Mr. Barber, is recognized.
        Mr. Barber. Thank you, Mr. Chairman. I thank you for having
    this hearing. Also, thank you to the witnesses for your work as
    well as for being here today.
        I think it has been said, but I certainly agree that the
    roll-out of the Affordable Care Act has been--the website, in
    particular, has been just a disaster. I think all of us find it
    totally unacceptable that we would be in this position. While
    the ACA offers many benefits to millions of Americans, I have
    repeatedly said that there are provisions that need to be
    fixed, there are unintended consequences that need to be dealt
    with. We need to move on that, I think, in a bipartisan manner
    in this Congress.
        Now we come to a potential new problem. We don't know the
    magnitude of it because it is early days. Obviously, since so
    many people have not been able to get on the website we really
    don't know yet how much personal information might be at risk.
    Americans are putting data in, in order to even begin the
    process, that is very sensitive information. I do share the
    Chairman's concern that the Department of Health & Human
    Services has a very poor record of cybersecurity, generally
    speaking. Now, of course, more information than ever before is
    gonna be available through their system.
        I think the American people, generally speaking, are very
    concerned about their privacy on a number of levels. I mean, we
    can go into other areas--we won't today--but this is a new area
    of concern. So having said that, I really believe that unless
    we can give some assurances that the privacy of information in
    HealthCare.gov is adequately protected it will undermine the
    American people's confidence in that system and they may choose
    not even to explore their benefits that are available on that
    website, when it gets fixed.
        So having said that, Mr. Stempfley, your office is
    responsible for maintaining the security, reliability, and
    resilience of our Nation's cyber and communications
    infrastructure. This oversight and general maintenance
    obviously pertains to our critical infrastructure. But it also
    pertains to the security of Federal Governments' cyber
    networks, which interface with the private sector and with
    individual users to access Federal Government websites.
        I would agree--I hope you would agree, we must be vigilant
    in monitoring and upgrading our systems, and design them to be
    as ironclad and as impenetrable as possible, particularly those
    systems that house sensitive user data such as HealthCare.gov.
    Now, having said that, Ms. Stempfley, could you talk, in very
    specific ways, about the steps that your office has taken to
    ensure that data that is inputted by American people into the
    HealthCare.gov network, how it has been protected or will be
    protected, and how have your actions been informed by the
    attempted incursions that you talked about earlier?
        Ms. Stempfley. Sir, the Department of Homeland Security's
    engagement with the Department of Health & Human Services has
    been about general threat information provision of best
    practices and a requirement of compliance reporting. We have
    provided a verification that Health and Human Services has
    complied with as domain name security. That is a set of
    technologies that translate internet addresses, the machine-
    readable information, to human-readable; so when you type
    www.google.com the internet knows how to translate that.
        So we have been able to assure--provide verification that
    have complied with that level of security in their environment,
    as well. However, we have not been in a specific architectural
    conversation with the Department of Health & Human Services on
    this application.
        Mr. Barber. Have you had any discussions with Health and
    Human Services subsequent to identifying, as you said, perhaps
    16 incursions, actual or attempted?
        Ms. Stempfley. We have had an operational conversation
    between their security operation center and our US-CERT about
    these particular activities. As I pointed out, these are under
    investigation. These reports came in in the November 6, 7, and
    8 time frame. So there is a period of time where we have to go
    through a verification and determination.
        Mr. Barber. Yes, I appreciate that you have to check in to
    make sure that you have some--you can verify what is really
    going on. But I would urge you, obviously, to speed up that
    process. Because if and when the website is fully operational--
    and we are told it will be operational by December--I would
    expect we will see many more and we need to be prepared for
    that. I guess my final question is: What plans do you have for
    on-going monitoring of the security of the website?
        Ms. Stempfley. I appreciate the question, sir. A set of
    capabilities that the Department provides, including one you
    may know of, is EINSTEIN intrusion detection capabilities, the
    Center for Medicare and Medicaid Services will be moving its
    applications behind in the second quarter of calendar year
    2013. HHS has been active in attempting to get behind this
    capability, but had to work through some specific statutory
    language that was in their statutes. Given that I know this
    committee has been supportive of, we have been trying to work
    to get some positive authorization language for these CHS
    programs that would have shortened that time frame.
        Additionally, they have agreed to be an early adopter of
    the continuous diagnostics and mitigation capability. So we are
    anxious to get that provided to them. The contract is due to be
    released today or tomorrow for the acquisition of those
    capabilities.
        Mr. Barber. Thank you for the extra time, Mr. Chairman.
        I yield back.
        Chairman McCaul. Yes, let me thank the gentleman for
    raising one issue. That is, you know, EINSTEIN has been around
    for awhile. It seems to me that it should have been applied to
    this website and to HHS. I think anything we can do to expedite
    that would certainly be in the best interest of the United
    States.
        So with that, the Chairman now recognizes the gentleman
    from Montana, Mr. Daines.
        Mr. Daines. Thank you, Mr. Chairman. I spent 20 years in
    the private sector prior to coming up to Congress. In fact, the
    last 12 years, an executive with a cloud computing company.
    Publicly-traded; we took the company public, Oracle acquired
    us. So the point is, I have worked in the enterprise space with
    very, very large organizations from around the world and
    understand the importance, certainly, of privacy as well as
    reliability.
        As a taxpayer, I think it is outrageous as I have seen what
    has happened here, where we have taken $500 million--by some
    estimates--to what this project costs--taken out of the pockets
    of hard-working taxpayers into a system that has failed. The
    numbers are astounding from the benchmarking. Facebook--
    Facebook was operational for 6 years and didn't hit the $500
    million mark. Twitter, operational for 5 years, $360 million
    operational investment. Instagram, $57 million investment.
        LinkedIn and Spotify didn't even get to the $300 million
    mark in operational. So there will be a lot of questions,
    certainly, about the cost and benefits, and value for the
    taxpayer. That is not why we are here, but I want to pivot over
    here to the issue of security. CBS News reported Monday evening
    that Mr. Chao, who was the chief project manager of
    HealthCare.gov, testified last week for 9 hours. CBS is
    reporting that there was a memo that went out 27 days prior to
    the launch of the website, on September 3, that said--and this
    was given to senior officials at CMS--there were two high-risk
    issues that were redacted for security reasons.
        The memo--I see counsel here is giving advice--the memo
    said the threat and the risk potential is limitless. Sir, I
    want to make sure she hears the question. The risk and the risk
    potential, the threat is limitless. It said CMS said the
    deadlines to fix these were around mid-2014 and early 2015 to
    address them. In fact, Mr. Chao testified to these security
    gaps. By the way, when they said ``high-risk,'' what high-risk
    means is, according to Federal guidelines--``the vulnerability
    could be expected to have a severe or catastrophic adverse
    effect on organizational operations, assets, or individuals.''
        Mr. Chao testified that security gaps, as reported by CBS
    here, could lead to identity theft, unauthorized access, and
    misrouted data. As somebody who had to serve large
    organizations, people would have been fired, the company would
    have gone under--our company--had we launched a website with
    these kinds of errors. I understand about risk management and
    so forth. But it seems that we leaned in to launch--the Federal
    Government did--knowing that there were high-risk security
    issues.
        Now, as you mentioned in your written testimony, the DHS is
    the lead for securing and defining Federal civilian
    unclassified information technology systems and networks
    against attacks. First, what, if anything, did you recommend as
    far as policies to CMS and the folks who are running the
    project here for the HealthCare.gov?
        Ms. Stempfley. As we engage with chief information officers
    in the SISOs, we provide a range of information; from general
    threat briefings, which we provide to the CIO council on a
    regular basis, to best-practice activities as well as
    information about FISMA compliance as they go forward. We
    provide this at a Department level and to participants in the
    CIO forum and SISO forum. There has not been a specific
    interaction about--focused on this particular site.
        Mr. Daines. So if, indeed, what CBS reported here and Mr.
    Chao's testimony last week before a committee--if, indeed,
    there was limitless potential, as I quote the report, for
    security risks, knowing this would you have rolled out the
    HealthCare.gov site on October 1, 2013?
        Ms. Stempfley. Sir, I am not aware of all of the
    information that goes into that went into that.
        Mr. Daines. But my question is, if you knew that. As
    somebody who has the lead here of 20 years' experience, and if
    I quote your written testimony here, you have the lead for
    securing and defining Federal and civilian unclassified
    information, knowing there was limitless potential for security
    risks, as reported, would you have rolled out, would you have
    pushed the button to say ``go'' on October 1, 2013?
        Ms. Stempfley. Respectfully, sir, I have been an
    accrediting official before. These are very difficult decisions
    that you make as a part of it, and I couldn't speak to a----
        Mr. Daines. But with all due respect, you are the assistant
    secretary----
        Ms. Stempfley. I am----
        Mr. Daines. Leadership is about the buck has to stop
    somewhere. Would you have made that decision, knowing there
    were limitless risks, if the report is correct?
        Ms. Stempfley. Respectfully, sir, I can't answer a
    theoretical in this situation. There is a multitude of
    information that goes into it. The amount of risk that a
    particular site operates under is certainly one vector or one
    input point.
        Mr. Daines. All right. Well, I will conclude. The irony,
    perhaps, in this is that the failure of the website launch on
    Obamacare may indeed have been the best safeguard for the
    American people to protect their personal privacy, given the
    risks now that are being identified in this launch. That is the
    irony. Because if the American people were prohibited to have,
    what, six people sign up the first day perhaps that is
    protecting the American people because they didn't have a
    chance to enter it in the first place.
        Yield back.
        Chairman McCaul. I thank the gentleman. The gentleman
    from--Mr. Richmond is recruited, from Louisiana.
        Mr. Richmond. Mr. Chairman, I guess this hearing is
    appropriate, and I guess the title is appropriate. It reminds
    me of the same show, same one-trick pony, that we keep hearing
    over and over again. The question or concern that I have is
    that, you know, this is a self-fulfilling prophecy. We keep
    talking about how bad Obamacare is. We talk about the fact
    that--discourage everyone that it is not safe. When they don't
    enroll, some of us will declare victory and take glee in the
    fact that people don't have health insurance.
        At the same time, we run around proclaiming ourselves to be
    the Christian Right. So I guess my frustration is that there
    are many things that we could come together and do. We tried
    last year to come together and pass a cybersecurity bill that
    was bipartisan. What happened when it was time to mark up that
    bill and pass it to the floor? The Republican leadership came
    back and said it went too far, and Republicans had to sit in
    the room and gut their own cybersecurity bill. Which never made
    it to the floor, which we never passed.
        We sit here today to talk about cybersecurity and how much
    confidence we should have in HealthCare.gov, when we lack
    confidence in many areas of cybersecurity, which we have done
    nothing about, we have not passed a bill.
        Chairman McCaul. Will the gentleman yield?
        Mr. Richmond. I certainly will.
        Chairman McCaul. We have conducted over 300 meetings with
    the private sector. You are referring to last Congress, before
    I assumed the Chairmanship. I am fully committed to marking up
    a cybersecurity bill. It is obviously very complex. I want to
    do it the right way. I appreciate the work that Ms. Stempfley
    does in terms of cybersecurity. So know that that is just--as
    the border security passed in a bipartisan way, I am fully
    committed to doing that work in a bipartisan way.
        I yield back.
        Mr. Richmond. Mr. Chairman, I believe you. I believe that
    Chairman King wanted to do it also. But it was--and we marked
    it up in a bipartisan way, and the Republican leadership gutted
    it. It still didn't make it to the floor. I just say that in
    the fact that I think that we should all have one purpose. That
    should be to try to make this a success. Whether you agreed
    with it or not, it is the law of the land. Let's try to get
    people health care, get people healthier, and all of those
    things. Because that is what my interpretation of what we
    should be doing.
        See, and I am not defending the launch. The launch was
    deplorable. However, what real leadership does is acknowledge
    that it is deplorable, and fix it. So the question would become
    when we feel that the website is safer are we going to have
    another meeting to let the people know that we feel it is safe
    and encourage them to enroll? I would suggest that the answer
    would be no because we want to keep that fear out there to
    reduce the number of people that enroll.
        So my question would be, to Ms. Stempfley and to Ms.
    Correa, basically the title of the committee, which I hope you
    can give a short answer, but: Just how secure is the
    information? Do you have faith in the security of the
    information that people input into the website?
        Ms. Correa. I will give Ms. Stempfley a short break. Thank
    you for your question. I really couldn't answer that question.
    Because, as I have indicated from our discussion, what we see
    is the information that is submitted through the hub to ask for
    the immigration status of a particular applicant. So I couldn't
    really talk to the front end of the process. Thank you.
        Ms. Stempfley. The America public gives the Government its
    information in a variety of places and sources. Certainly, in
    my experience with SISOs, the information security officers
    throughout the Federal enterprise, they are committed to the
    obligation that they have in securing these systems and
    applications. I am not familiar with the specific security
    features of the 10,000 applications that HHS operates, for
    example, nor am I familiar with the specific security features
    of the tens of thousands and hundreds of thousands of
    applications across the Federal enterprise.
        But I do know that in the Department of Homeland Security
    and with the SISOs that I work on a regular basis they are
    all--feel passionately about their obligation to protect this
    information that the America public gives the Government.
        Mr. Richmond. With the knowledge and expertise that you
    have in this arena--and you do it every day, and subject-matter
    expertise--two-part question: Would you enter your information
    into the exchange, the web portal? If not, would you do it at
    the end of the month? At what point do you feel it is ready for
    you to input your information?
        Ms. Stempfley. So I, like all of us, put our information in
    a variety of systems and applications, whether it be my bank,
    whether it be HHS. I have family information in the HHS system
    because I am also a taxpayer. I do that, recognizing that
    whenever I give my information to someone else, under any
    circumstances, there is a--you know, there is a potential of it
    being at risk. Whether it be, again, my bank or my electric
    company or a Federal enterprise. But I do it because I believe
    the benefit of doing so outweighs whatever that risk might be.
        Mr. Richmond. Thank you, Mr. Chairman. I yield back.
        Chairman McCaul. I thank the gentleman.
        The Chairman recognizes Mr. Hudson, from North Carolina.
        Mr. Hudson. Thank you, Mr. Chairman. I want to thank you
    for having this hearing today on this very important topic. You
    know, I go home every weekend, I travel my district, I talk to
    my constituents as much as possible. I have been inundated with
    calls and mail from my constituents who are deeply concerned
    about the implementation of the Affordable Care Act. Lately,
    the news reports about this implementation have focused on the
    website.
        As my colleague said, it has been a disaster. A lot of
    attention has been focused on the premium increases. North
    Carolina has been hit harder than most States. Women in our
    State can expect their rates to triple; men can expect them to
    quadruple, on average. So a lot of attention has been given to
    that problem. Then we have heard a lot about loss of coverage.
    I was talking to a husband in Rockingham the other day whose
    wife has an acute illness. Their doctors told them that under
    the Affordable Care Act he is no longer gonna offer them care.
        So these are huge problems. But I think what has been lost
    in all this are these issues, this important issue, of security
    of our private information. I mean, we have an unprecedented
    collection of data that the Government is undertaking now of
    personal information. It is unprecedented that the Government
    will be collecting these types of information through one
    process. So it is important that we talk about this and we
    examine the issues here.
        I am disappointed that our--I appreciate your all being
    here, I appreciate the job you do. It is disappointing, though,
    that DHS doesn't--isn't able to answer questions about this
    website. That DHS doesn't have a working understanding of how
    the security parameters of this website were set up. It is
    deeply troubling to me that HHS, CMS hasn't asked the folks who
    are the experts in this--Secretary Stempfley's organization--to
    help with this implementation.
        Why wouldn't you go to the experts when you have got a huge
    problem? Especially when one of the architects of this website
    said, ``that there is limitless potential for security risks.''
    These are the folks building the website, have said this is a
    huge problem. Yet they are not asking people who are experts at
    this how to help them. So I appreciate you being here, Ms.
    Stempfley, and I am--again, I appreciate the work you do. I am
    just sorry you weren't more involved in this because the
    American people deserve every effort we have as a Government to
    protect them.
        So I will focus my questions on a different topic related
    to this: Ms. Correa, one of our colleagues earlier asked the
    question what happens if we run a query about someone's
    citizenship, and we determine that they are here illegally, or
    an undocumented person. Would you tell me what happens at that
    point? Is any action taken, any enforcement action on that
    individual?
        Ms. Correa. Thank you for your question, sir. Again, as I
    mentioned before, the way the process works is, an individual
    who presents themselves to a benefit agency, a benefit-granting
    agency, has to present the information, documentation, on their
    status. Whether they are a citizenship or they attest, if you
    will, in their application as to whether or not they are a
    citizen. If they are not a citizen, then the information is
    processed as a query.
        Mr. Hudson. If I can interrupt real quick. So it is up to
    their own word as to whether they are a citizen or not? Self--
    --
        Ms. Correa. They are--when they apply for a benefit, they
    are filling out a form. On that form they typically attest what
    their status is, whether----
        Mr. Hudson. So if they choose to mislead and say they are,
    there is no----
        Ms. Correa. If the agency, the benefit-granting agency,
    would then, if they attest that they are not a citizen or the
    Social Security Administration cannot confirm that they are a
    citizen, would then request their information and process a
    query through SAVE. SAVE would then go out and ping our
    databases to identify what the immigration status of that
    individual is. Typically, our response is either to give what
    the immigration status is, or if we cannot confirm the
    immigration status, then we prompt the agency to go through the
    additional verification steps.
        As I described, the second step they could provide
    additional information, other documentation, or other names
    that the individual may have used.
        Mr. Hudson. So at the end of the process, if you determine
    you can't verify they are a citizen, what happens then?
        Ms. Correa. At that point, what we notify the agency to do
    is to tell this applicant to schedule an appointment with
    USCIS. We give them the pertinent information to come in and
    see us. Because there could still be an error in their record.
    So what we do is try to have an appointment with them, come
    visit one of our adjudication officers who would then look at
    their data and look up their information in the records
    database.
        From a SAVE standpoint, we don't take any further action.
    In other words, we cannot change an individual's record. We do
    not tamper with the record at all whatsoever. We refer them to
    one of our adjudications officers, who would then look at the
    information.
        Mr. Hudson. So as my time is running out--so if someone--
    you can't verify they are a citizen, they don't come in to see
    you, that is it. We don't follow up, we don't enforce any
    immigration law on this illegal person.
        Ms. Correa. Not that I am aware of, sir, but I could
    confirm that for you.
        Mr. Hudson. If you wouldn't mind, I would appreciate that.
        Mr. Chairman, my time has expired. I will yield back.
        Chairman McCaul. I thank the gentleman.
        The gentlelady from Texas, Ms. Jackson Lee, is recognized.
        Ms. Jackson Lee. Mr. Chairman, let me thank you, as well,
    and Mr. Thompson for this hearing. I always believe that the
    exercise of our oversight is crucial and important. I think
    this is the first hearing that I have been in since the loss of
    Mr. Gerardo Hernandez, and I want to publicly offer my deepest
    sympathy to him and his family. That is the transportation
    security officer killed in the line of duty, which reinforces
    that the U.S. Department of Homeland Security is on the front
    line, all of your staff and personnel. Would you offer to all
    of them my deepest sympathy, and to his family.
        I wanted to pursue a line of questioning that I think may
    be helpful to us. First of all, I think it is important to note
    that this committee invited DHS on November 5, which gives less
    than 8 days, because of an intervening holiday. So let me thank
    you for getting your testimony in as quickly as possible. I am
    not at the agencies, but I do know that there is a layer of
    review. Although you may be an eloquent writer, you may be a
    poet laureate, I know that they have to review your work. So I
    am grateful that you got it in.
        One of the things that is happening all over the Congress
    today, we have got sequester issues, budget issues. But we are
    dealing with the Affordable Care Act and oversight and homeland
    security and small business. Certainly, I think it is important
    to emphasize that the Affordable Care Act is here and it deals
    with health care. It deals with having the ability to have
    insurance if you have a preexisting disease. You can stay on
    your family's insurance to age 26; preventive care and wellcare
    examples. It is a solid piece of legislation, and I am grateful
    that it is here.
        Like my colleagues, I am dogged about fixing the technology
    and, as well, dealing with our privacy and the protection of
    the privacy of the American people. They should know that. That
    collectively, as Republicans and Democrats, we will not yield
    any moment, any minute, any second to protecting their private
    data. In fact I have joined on to legislation by my colleague,
    Jim Sensenbrenner, to, in essence, protect American citizens
    with any reach of privacy beyond what is required for security
    under the National Security Agency. I take no back seat to
    that.
        So in making that point, I want to just emphasize what I
    think your work is. Let me go to Ms. Correa, and indicate--and
    let me just make the point. There is always a representation
    that Republicans had nothing to do with the Affordable Care
    Act. Well, it was the Republicans' amendments that required the
    checking of citizenship and income. That was their language. I
    am surprised that every time we see a Republican, my friends,
    they are talking about ending the Affordable Care Act. We never
    got any amendments in. They got eons of amendments in to this
    bill.
        That was one of them, which requires this simplistic data
    collection, which is simply that. So I want to ask the
    question. This is data collection that is basically information
    on income and citizenship. These fields of data are checked
    with the records of accuracy. Is that what you do, Mr. Correa?
    When it comes in, you check the accuracy on citizenship issues?
        Ms. Correa. That is correct.
        Ms. Jackson Lee. All right. Once it is checked, is this
    information kept or discarded? The inquiry and the information?
        Ms. Correa. We retain the transaction information because
    we go back and do quality control checks to make sure we are
    giving accurate information. But we do not download the actual
    record. Only the immigration status and the----
        Ms. Jackson Lee. So what do you specifically keep?
        Ms. Correa. That information--the immigration status, the--
    --
        Ms. Jackson Lee. When you have an inquiry from HHS.
        Ms. Correa. We retain the inquiry information that was
    received. The individual's name, their alien registration or I-
    94 number.
        Ms. Jackson Lee. That you received an inquiry from HHS. How
    long do you keep it?
        Ms. Correa. I would have to confirm how long.
        Ms. Jackson Lee. Well, you need to get an answer about how
    long you keep it. Is it protected information?
        Ms. Correa. Yes, it is.
        Ms. Jackson Lee. Have you been hacked?
        Ms. Correa. I am not aware that we have been hacked. I will
    confirm that for you, but I am not aware that we have been
    hacked.
        Ms. Jackson Lee. So what is your measure of securing it?
        Ms. Correa. Our system is accredited and certified by our
    chief information officer.
        Ms. Jackson Lee. Do you do regular checks?
        Ms. Correa. Yes, we do.
        Ms. Jackson Lee. Is it your highest responsibility to
    protect this information of the American people?
        Ms. Correa. Yes, it is.
        Ms. Jackson Lee. You only get--you get information. Suppose
    someone is calling for Mr. Garcia, who is a citizen. Are you
    keeping that inquiry, as well?
        Ms. Correa. In the SAVE program, no. If the individual has
    attested they are a citizen----
        Ms. Jackson Lee. Yes.
        Ms. Correa [continuing]. And Social Security has been able
    to confirm, then we would never receive that query.
        Ms. Jackson Lee. All right. So therefore, it is only
    individuals that may be in question.
        Ms. Correa. Correct.
        Ms. Jackson Lee. You are checking this every day.
        Ms. Correa. Yes, as query----
        Ms. Jackson Lee. Or a regular basis.
        Ms. Correa [continuing]. As queries are received, yes.
        Ms. Jackson Lee. Let me go to Ms. Stempfley. You are the
    lead agency that coordinates on the cybersecurity for other
    agencies in the United States. The other--you sort of lead, but
    you have the point that the other agencies also have
    responsibility for their cybersecurity. Is that correct?
        Ms. Stempfley. Yes, ma'am.
        Ms. Jackson Lee. But as your Department, or your subset
    Department, DHS, do you feel that there are competencies under
    your jurisdiction that are attentive to protecting information
    and preventing hacking through the DHS agency and in
    coordinating with the other agencies?
        Ms. Stempfley. Yes, ma'am, we are very focused on that. My
    part in the Office of Cybersecurity and Communication, and
    there are competencies in the data operation centers through
    the Federal enterprise.
        Ms. Jackson Lee. So what--if we were to keep this system in
    place, based upon Republican amendments, into the ACA--checking
    income and immigration status, and that was being held--you
    deal with cybersecurity, you deal with the potential of hacking
    or information going in a different direction that it should
    not go. What is your level of confidence and your level of
    competence that you are working in a coordinated fashion, but
    have the level of technology that can assure, as much as
    possible, the protection of this information?
        Ms. Stempfley. So I am very grateful both for the question
    and for this committee's continued support of DHS authorities
    and support of important programs that will improve both the
    competence and confidence in this area. As we have been talking
    about the continuous diagnostic and mitigation activity and the
    FISMA reform efforts that will both increase the awareness
    across the Federal enterprise of the operational risks that
    systems are operating under on a daily basis, and enable
    accrediting officials to take that into account in something
    more often than annual or every 3-year accreditation processes.
    As well as I believe I----
        Ms. Jackson Lee. But are you confident in your present
    structure in your oversight on cybersecurity? That is,
    information is being gathered; you don't compare this to the
    Veterans Administration loss of 24 million records under the
    Bush administration. We are not at that----
        Ms. Stempfley. We are not at that----
        Ms. Jackson Lee. We are not at that point. So are you
    confident, as this huge process is going forward, that we have
    a system in place to protect that information?
        Ms. Stempfley. Yes, ma'am.
        Ms. Jackson Lee. I thank you very much for your answers.
        Mr. Chairman, I hope that we can rid ourselves of
    sequestration so we can invest more in the work that is being
    done by Ms. Stempfley and Ms. Correa. I yield back, thank you.
        Chairman McCaul. I thank the gentlelady. Also, the
    gentlelady is correct that we did put provisions in to assure
    that only those legally in the country received this--that were
    eligible under this law. Also, we both agreed that if you have
    a preexisting condition you cannot be denied coverage, as well.
        I will just add lastly that we did make a request for the
    statement, the opening statements, on August 31, and that is
    almost 2 weeks. I am sorry, October 31, nearly 2 weeks.
        So with that, the Chairman now recognizes the gentleman
    from Pennsylvania, Mr. Barletta.
        Ms. Jackson Lee. Well, Mr. Chairman, I thank you. We
    recognize the pounding of work on these various hard-working
    public servants. As you well know, we were in the middle of a
    Government shutdown, and so I appreciate timely responses, Mr.
    Chairman. I hope that they will work to get timely responses.
        I yield back, Mr. Chairman. Thank you.
        Chairman McCaul. Yes, right. The Chairman recognizes Mr.
    Barletta.
        Mr. Barletta. Thank you, Mr. Chairman. Ms. Stempfley, I
    would like to continue on and follow up on some questions that
    Mr. Meehan had brought up earlier. Secretary Sibelius admitted
    that convicted felons could be hired as exchange navigators
    because there was no background checks system in place for
    these individuals. Why aren't we conducting background checks?
        Ms. Stempfley. Respectfully, sir, my area of expertise is
    cybersecurity. Physical security and personal security are
    outside of that area. I am happy to take the question, but I
    could only speculate and that seems inappropriate.
        Mr. Barletta. Okay. With your expertise in cybersecurity,
    do you think it would be a good idea to do background checks on
    these navigators?
        Ms. Stempfley. I believe one of the things that we
    certainly focus on is assuring the protection against----
        Mr. Barletta. I am just asking: Do you think it would be a
    good idea to do background checks on the navigators?
        Ms. Stempfley. I am happy--again, sir, I would be----
        Mr. Barletta. No. Do you think it would be a good idea?
    That is all I am asking, real simple. Do you think it would be
    a good idea to do background checks on navigators?
        Ms. Stempfley. I believe that all individuals should be
    vetted----
        Mr. Barletta. Good idea, bad idea?
        Ms. Stempfley [continuing]. Prior to access to the
    information that they provided.
        Mr. Barletta. Good idea, bad idea?
        Ms. Stempfley. I am not trying to evade, sir. I believe
    that all individuals should be vetted prior to access.
        Mr. Barletta. I am not gonna get an answer. Ms. Correa, my
    time--I was mayor for quite some time. I remember one
    individual. He was in the country illegally. It took our
    detectives 5 hours to determine who he was. He had five Social
    Security cards, five different identities. You suggested a
    little earlier that illegal immigrants won't try to go through
    the system, and because you are using the SAVE system. I am
    gonna disagree with you.
        That is simply not true. We know, for a fact--is the SAVE
    system used for the SNAP program, do you know?
        Ms. Correa. Not that I am aware of. Sir, may I clarify? I
    wasn't trying to imply that an illegal alien wouldn't try. What
    I was trying to make clear was that they would have to have
    some form of documentation----
        Mr. Barletta. Do you think that they can get through the
    system?
        Ms. Correa. It is hard to say. It would depend on the
    documentation that they present.
        Mr. Barletta. Well, we know for a fact that illegal
    immigrants are able to access many Federal benefits through
    fraudulent documentations. We know that for a fact. That is--
    you know, so I don't believe this Government program will
    really be any different. There is nothing that indicates that
    it will. So if you determine an applicant is in the country
    illegally, am I correct, there is no enforcement action taken?
        Ms. Correa. The SAVE program isn't making a determination
    whether that individual is here illegally, or not. What the
    SAVE program is doing is based on the information that was
    presented to us. We are going out and checking the Federal----
        Mr. Barletta. Well, it does tell if they are a lawful
    citizen.
        Ms. Correa. Whether they are here as----
        Mr. Barletta. Right. So, you determine that this individual
    is not lawfully here, there is no enforcement action taken?
        Ms. Correa. As I explained earlier, the determination that
    we make is whether we can confirm that individual's immigration
    status and provide that information----
        Mr. Barletta. Okay, so you determine that individual's
    status, that that person is not legally present in the United
    States. Is there any enforcement action taken?
        Ms. Correa. We don't determine whether the person is here
    legally or not because we are not seeing the individual. All we
    are seeing is the information that comes through the query.
        Mr. Barletta. So if the information that is presented is
    fraudulent, what happens?
        Ms. Correa. We don't have a way of determining if that
    information is fraudulent.
        Mr. Barletta. So we don't know.
        Ms. Correa. As it is presented.
        Mr. Barletta. So it doesn't seem like there is really any
    guard for illegal immigrants to access this program as they
    have been able to access many Government programs. We know
    there is fraud in so many Government programs. How can we
    assure the American people that this time we got it? This time
    we are not gonna let people illegally get into a program that
    they are not rightfully entitled to.
        Ms. Correa. Sir, if I may explain. I appreciate your
    question. The benefit-granting agency is the organization that
    is receiving the information from the individual and is privy
    to that information. They submit a query to us, where we go
    back and confirm----
        Mr. Barletta. But if the information is fraudulent.
        Ms. Correa. What we do is, the only way we could ever
    determine that is if somebody actually sees the documents and
    compares them to the individuals. That is why if we cannot
    confirm immigration status we do ask them to set up an--to
    refer the individual----
        Mr. Barletta. I am not real confident that we are gonna be
    able to stop it. I just want to close, Mr. Chairman. I am a
    huge baseball fan, huge baseball fan. Now that the Affordable
    Care Act has been rolled out, we find that the website doesn't
    work, that Americans' personal information is at risk, that
    felons could be navigators. This is only the first inning. The
    Obamacare batting average is not so good.
        If the Affordable Care Act was a baseball player, and I was
    the manager, I would bench him. Thank you.
        Chairman McCaul. I thank the gentleman for his analogy.
        With that, I want to thank the members of the first panel
    for their valuable testimony here today. With that, this panel
    is dismissed, and the clerk will prepare for the witness table
    for a second panel.
        I am pleased to welcome the second panel to today's
    hearing. Mr. Luke Chung is the president at FMS, Incorporated,
    a company he founded in 1986. In addition to being a primary
    author and designer of many FMS commercial products, Mr. Chung
    has personally provided consulting services to a wide range of
    clients. A recognized database expert, highly-regarded
    authority in the Microsoft Access developer community, Mr.
    Chung was featured by Microsoft as an Access hero during
    Access' 10-year anniversary celebration. Mr. Chung, really good
    to have you here.
        Our second witness, Mr. Waylon Krush is the chief executive
    officer of Lunar, Incorporated. He served over 15 years of
    experience in critical infrastructure protection, information
    operation, signal intelligence, system and telecommunications
    exploitation, and certification and accreditation. Prior to
    becoming CEO, Mr. Krush was a senior InfoSec engineer in AT&T's
    advanced systems division and chief of the information
    assurance group with the GRC/TSC.
        The witnesses' full written statements will appear in the
    record. I now recognize Mr. Chung for 5 minutes for his opening
    statement.

             STATEMENT OF LUKE CHUNG, PRESIDENT, FMS, INC.

        Mr. Chung. Well, thank you very much for having me. I am
    the president and founder of FMS, Inc., a privately-held
    software development firm located in Vienna, Virginia. For 27
    years, we have offered commercial software products and
    services. We have tens of thousands of customers in over 100
    countries, including 90 of the Fortune 100. In response to 9/
    11, we created a product, Sentinel Visualizer, a link analysis
    solution for the counterterrorism, defense, and law enforcement
    communities.
        That work led to our only outside investor, InQTel, the
    CIA's venture capital arm. We also have a professional
    solutions group that creates custom software. An example is a
    humanitarian relief logistics system we built for the Pan-
    American Health Organization and United Nations. It is deployed
    around the world, and I presume it is in heavy use right now in
    the Philippines. I am a graduate of Harvard College, with a
    bachelor's degree in engineering and a masters in physical
    oceanography.
        On October 1, I visited the HealthCare.gov website, eager
    to see what it offered. As a small business owner, I am faced
    with the challenge of purchasing health insurance for my
    company and family. Unfortunately, my shopping experience
    failed due to technical problems with the website. It was not
    designed to be customer-friendly, appeared to be developed by
    amateurs, and seemed to be untested. I sensed the site would
    not work for one person, much less a National enterprise
    quality solution that was needed.
        I wrote a blog post that day providing a nonpartisan
    technical assessment entitled ``HealthCare.gov is a Technical
    Disaster.'' I warned that the problems were far deeper than too
    many users, and concluded this would be a huge public relations
    problem that could doom the Affordable Care Act. That is what I
    saw on Day 1. My blog post went viral. After a week, I was
    quoted in the New York Times and have been on many radio and
    National TV news shows, which led to my appearance before you
    today.
        I would like to say that my firm is not involved with the
    development of HealthCare.gov, we did not bid on any portion of
    the project, and I am here to provide my perspective as a small
    business owner, someone experienced with database web
    development and familiar with the Government contracting
    process. Since I don't like being a critic without offering
    solutions, on October 14 I wrote another blog post outlining
    how HealthCare.gov could be built properly; a site that would
    match the customer buying process, be quicker to develop,
    easier to test, be more robust, support more users, and be more
    secure.
        It is not that complicated. This website does not provide
    health care. It does not even provide health insurance. It is
    supposed to let consumers shop and choose among health
    insurance plans, and then apply for a subsidy. It is
    essentially the automation of a paper form. So how did we get
    here? Originally, I thought the design decisions of
    HealthCare.gov were created by amateurs who didn't know what
    they were doing. Now I see the design decisions can be
    explained by considering what the contractors would choose to
    maximize profitability at every step of the way.
        The current Government contracting system discourages
    technically-qualified companies like mine. The big Government
    contractors are great at winning contracts, protesting lost
    awards, and generating change orders. They are not known for
    their technical expertise and would unlikely survive in the
    private sector. This is a complete breakdown in managing
    technology investments. Policymakers and politicians do not
    understand if a project should cost a million dollars or $200
    million, or the decisions they make that impact price.
        For instance, $200 million, at a generous $200 per-hours,
    is 1 million man-hours. That is 500 man-years. Forget the
    money. What could these contractors have possibly been doing
    with all that time? I propose that the Government needs to
    create a nonpartisan technology accountability office, TAO,
    similar to the GAO that is capable of assessing and managing
    Government technology projects. The TAO also needs to be
    empowered to enforce accountability.
        Bad performance does not seem to prevent contractors from
    winning new contracts. Multi-year and permanent bans should
    target underperforming vendors and their owners and the
    managers. Get refunds. In the private sector, vendors that fail
    like this would rarely be allowed back in an organization. In
    conclusion, I have provided written testimony with additional
    examples, information, and recommendations on investigating how
    so much money was spent for so little. This is a scandal beyond
    HealthCare.gov.
        Unfortunately, the Federal Government has paid for even
    larger software projects that were never deployed. Without
    changing the processes, there will be more technology disasters
    in our future. Just so you know, while I was able to complete
    my HealthCare.gov application on October 1, it remains in
    progress as of last night. Thank you for inviting me. I look
    forward to your questions.
        [The prepared statement of Mr. Chung follows:]
                        Prepared Statement of Luke Chung
                               November 13, 2013
                                    summary
    About Me and FMS, Inc.
        I'm the president and founder of FMS, Inc., a privately-held
    software development firm in Vienna, Virginia. For 27 years, we've
    created database solutions with a combination of commercial products
    and services. In response to 9/11, our Advanced Systems Group created
    Sentinel Visualizer, a product for the counter-terrorism, defense, and
    law enforcement communities that led to our only outside investor,
    InQTel, the CIA's venture capital arm. We have tens of thousands of
    customers in over 100 countries, including 90 of the Fortune 100. Our
    Professional Solutions Group has created a wide range of custom
    solutions, some which are more complex than Healthcare.gov, but never
    more expensive. I'm a graduate of Harvard College with a bachelor's in
    engineering and a master's in physical oceanography.
    My Experience with Healthcare.gov
        On October 1, I visited Healthcare.gov to get an insurance quote
    for my family. The experience was so terrible that I documented the
    technical problems I encountered and wrote a blog post about it. I
    could tell immediately from the nature of the crashed I encountered
    that the site was not ready by prime time. It had a terrible design
    that was not consumer-friendly, seemed to be coded by amateurs, and
    wasn't tested. I could tell the site would not work for one person much
    less the expected load.
        The blog post I wrote on October 1 went viral as people began to
    understand the problems were deeper than too many users. That led to
    being quoted in the New York Times and appearing on radio and news
    shows such as CBS, CNN, Fox, MSNBC, NBC, Hannity, Greta, Al Jazeera,
    Geraldo, etc. Throughout the period, I've learned more about the
    website and its many problems both political and technical.
    Healthcare.gov Overview
        This website should not be that difficult to build. It doesn't
    provide health care. It doesn't even provide health insurance. It's
    comparing plans and applying for a subsidy. It's the automation of a
    paper form.
    Security Implications
        Security is considered at the beginning of a project, not at the
    end. Avoiding the collection of unnecessary personal information is the
    first step to reducing security issues. Separating the user experience
    from back-end legacy systems is another. The pressure to make a
    software solution ``work'' is not conducive to good security. There are
    ways to improve the user experience, scalability, and security.
    Contractor Abuse of Taxpayers
        Healthcare.gov is just one example of a software project gone awry
    that Government contractors profited at the expense of taxpayers. I
    originally thought the website was created by people who didn't know
    what they were doing; that they were trying to do too much in an
    unnecessarily complicated and thorough manner. My thoughts have evolved
    and I now feel that it's designed quite cleverly to maximize taxpayer
    expense. This is a scandal that needs to be investigated. Follow the
    money and I believe you'll see design decisions that led to increased
    costs. There are ways to improve governance to fix this.
                                   background
        Thank you for inviting me to your hearing.
    About FMS, Inc.
        I'm Luke Chung; the president and founder of FMS, Inc., a
    privately-held software development firm located in Vienna, Virginia.
    Since 1986, FMS has provided software products and development services
    to commercial and Government agencies. Over 27 years, we've created a
    wide range of database solutions helping organizations make better
    decisions based on data. These important decisions include delivering
    services, managing operations, understanding finances, increasing
    accuracy, improving customer service, making fewer errors, targeting
    criminals, making more money, and increasing efficiency. We have tens
    of thousands of customers in over 100 countries.
        In the 1990s, we became the world's leading provider of commercial
    products for Microsoft Access with 12 solutions to help people better
    analyze data, automate e-mail blasts, create better solutions,
    eliminate errors, and provide system administration.
        In response to 9/11, we created the FMS Advanced Systems Group to
    use link analysis and social network analysis (SNA) to find hidden
    relationships among people, places, and events. That led to the
    creation of our Sentinel Visualizer product that helps analysts in the
    counter-terrorism, defense, and law enforcement communities, both in
    the United States and abroad. Sentinel Visualizer led to our only
    outside investor, InQTel, the CIA's venture capital arm.
        In addition to our commercial off-the-shelf products, the FMS
    Professional Solutions Group has created custom database applications
    for a wide range of customers. Examples include the Logistics Support
    System for the Pan American Health Organization sponsored by six U.N.
    agencies. It coordinates humanitarian relief logistics for disaster
    zones and is deployed with language localization features in over 100
    countries, including the Philippines. FMS also created a course
    management system for the Defense Acquisition University, which
    provides non-military training to all branches of the DoD. FMS has also
    created custom solutions for event management, e-commerce, logistics,
    education, health care, public works, nonprofits, and businesses.
    About Me
        I'm originally from New York, grew up in Orlando and Sarasota,
    Florida, and am a graduate of Harvard College. I have a bachelor's
    degree in engineering, and a master's degree in Physical Oceanography.
    Prior to founding FMS, I worked as a management consultant at Strategic
    Planning Associates/Mercer.
       Current member and past president of the Washington, DC
            Chapter of the Entrepreneurs Organization.
       Serve on the Business and Community Advisory Council to the
            Fairfax County Virginia Public School Superintendent.
       Serve on the Information Technology Policy Advisory
            Committee to assist the Fairfax County Board of Supervisors
            oversee county technology investments. The committee exists
            because the supervisors recognized years ago they were unable
            to provide the proper governance over their technology
            investments.
    Caveats
        My testimony is based on my personal experiences and opinions. I am
    an observer to the Healthcare.gov website and am not personally
    involved with its design and development. Any suggestions of
    incompetence or wrongdoing are comments intended for further
    investigation by the committee.
    My Perspective
        I am providing my testimony from a non-partisan perspective focused
    on my decades of experience creating database solutions, the challenges
    of running a small business, and having observed how the Government
    contracting world works.
        In 27 years running FMS, I've experienced multiple Government
    administrations, economic cycles, and changes with technology. I run a
    small business and have responsibilities to my clients, firm,
    employees, and family. These obligations include buying health
    insurance.
                  experience with healthcare.gov on october 1
        On October 1, I visited the Healthcare.gov website to get an
    insurance quote for my family. I wanted to see what policies were
    available and how they compared in features and price to what my small
    business is currently purchasing in our group plan.
        What started as a simple shopping experience turned into a venture
    inside the technically worst website I've ever visited. It was so bad
    that I started documenting the bugs I encountered. I was shocked
    because the mistakes were so amateurish that it seemed the website was
    created by people who had never been paid to write commercial software.
    Based on my experience, I realized that if those types of bugs existed,
    the website had huge problems way beyond the number of users. I sensed
    that it would not support one user, much less the millions expected.
        The shocking part is that this website should be very simple:
       It does not provide health care;
       It does not even provide health insurance;
       It's supposed to let consumers compare and choose among
            insurance plans;
       It's supposed to generate a subsidy, if any, to buy
            insurance;
       It is essentially the automation of a 12-page paper form.
        I shared my findings in a company blog post entitled Healthcare.gov
    is a Technological Disaster (http://blog.fmsinc.com/healthcare-gov-is-
    a-technological-disas-
    ter/)--See Appendix A. It includes screenshots of the crashes and
    suggested that I was embarrassed for my profession for delivering such
    junk. It looked like the developers never used or tested it. I
    concluded that the quality of the work wouldn't pass a computer science
    class and that there would be huge Public Relations problems that could
    doom the entire Affordable Care Act. That's what I saw on Day 1.
    Response to My Blog Post
        While the contractors and administration tried to spin the problems
    as the result of too many users, my blog post--which provided a non-
    partisan, technical evaluation of Healthcare.gov--started getting
    picked up by multiple websites. And through the power of social media,
    it went viral.
        Within a week, I was quoted in a New York Times article which was
    followed by interviews with radio and National TV news channels
    including CBS, CNN, Fox, MSNBC, NBC, Sean Hannity, Al Jazeera, Greta
    van Susteren, Geraldo Rivera, etc. It has led to this testimony.
    Offering Solutions
        Since I don't like being a critic without offering possible
    solutions, on October 14, I wrote another blog post outlining how
    Healthcare.gov can be properly built: Creating a Healthcare.gov Web
    Site that Works (http://blog.fmsinc.com/creating-a-healthcare-gov-web-
    site-that-works/) see Appendix B.
        My suggestions would a website that would better address the needs
    of the customer, be simpler to develop, easier to test, more robust,
    support more simultaneous users, and be more secure. It would separate
    the shopping experience and an estimate of a subsidy from the actual
    application to receive a subsidy (the part that needs to be secure).
    The marketplace would be the central site where it would be easy to
    compare insurance plans before worrying about pricing and subsidies.
    The site would be hosted on commercial cloud providers that could scale
    to support huge numbers of simultaneous users. It would use commercial
    business software that would significantly reduce the amount of code
    that needs to be written and tested, which would also reduce the
    security risk.
    Healthcare.gov Observations
        Here are my observations about the technical issues I encountered
    on the Healthcare.gov website:
       It's poorly designed. It doesn't address the needs of a
            consumer trying to shop for something, nor is it designed to
            support lots of users or high security.
       It's poorly developed. The site has such amateurish errors
            that it appears to be created by inexperienced developers.
       It's not tested, or if it was tested, the test plan was
            woefully inadequate.
       In my experience, encountering that many bugs in such a
            short period of time indicates that was only the tip of the
            iceberg with many more bugs below the surface. As bugs are
            fixed, more bugs will be found since those sections were never
            adequately tested before.
       The management team and contractors seemed to think the site
            was production quality on October 1. It clearly wasn't, which
            would indicate that those people don't understand what
            production quality means. They shouldn't be involved with the
            project since we've experienced what they consider shipping
            quality. I do not consider what was delivered to be beta (test)
            quality.
                             security implications
        Lack of competent technical oversight not only leads to waste, but
    to potentially devastating security vulnerabilities if complex systems
    that millions of people depend on are undermined or brought to their
    knees by attackers. Technology alone cannot deliver security, and the
    more complex a system is, the harder it is to secure against known
    threats, much less unknown ones which are sure to emerge in the future.
    When developers operate under deadline pressure, they tend to cut
    corners to ``just get it to work'', generating fresh security
    vulnerabilities and bugs.
       Nothing is ever perfectly secure.
       Security has to be considered at the beginning of the
            project, not at the end.
       The most important part of security is to NOT collect secure
            information unnecessarily.
       The next step is to minimize the places where security is
            necessary. The sections in which users shop for insurance
            policies, get an estimate of the subsidy, and buy a policy
            without a subsidy should not require any security.
       Another design consideration is to create as few places of
            vulnerability as possible. That means fewer screens, fewer
            places where data changes hands, and running secure processes
            off-line separate from the user interface.
       The skills to build a secure web database application are
            far more advanced than the skills the existing developers
            failed to exhibit. A chain is only as strong as its weakest
            link.
                             contractor incentives
        Originally, I thought the design decisions of the Healthcare.gov
    site were done by amateurs who didn't know what they were doing. I'm
    now moving away from that conclusion.
        Instead, I'm seeing how the design decisions may have been made to
    maximize taxpayer expense and vendor profitability.
    Government Contractors
        The current Government contracting system excludes technically-
    qualified companies by making it difficult for them to bid and work on
    Government projects. The companies that specialize in Government
    contracts are good at winning Government contracts, protesting lost
    awards, and creating change orders. They are not known for their
    technical expertise. Their strategies and operations would not be
    competitive in the private sector.
        Currently there is no downside for failure to deliver on a
    Government contract. There is nothing to prevent failed vendors from
    bidding on future projects or being suspended from existing projects.
    Abusing Taxpayers
        I don't know how the decisions were made, but if I look at it from
    the contractors' perspective with the knowledge that the budget was
    essentially unlimited, it would explain how choices were made to add
    complexity, increase billable hours, purchase more hardware and
    bandwidth, and maximize profits.
        Of course, the big mistake was not delivering a quality solution.
    Unlike many other IT projects that have failed in the Federal
    Government, this one let the public experience the quality of the
    deliverables.
        Examples of areas that maximize profits:
       Performing an identity check for each visitor. Is the credit
            agency paid for each check?
       Creating a user login in three screens rather than one? Was
            the contractor paid per screen? Was there consideration that
            more screens use more resources? Why ask for secret questions?
       The email confirmation process requires almost immediate
            confirmation. My 30-minute delay in responding canceled my
            account and required creating a new login. Why does this
            feature exist?
       Why are the screens to fill out the application one question
            per screen? Why not put all the questions on one screen to
            minimize the complexity, data exchanges, and improve
            scalability and security? Were contractors paid based on the
            number of questions and screens?
       Why ask optional questions such as race that are not part of
            the subsidy process?
    Addressing Contractor Complaints
        From what I can see, the contractors are trying their best to
    deflect blame:
       There are claims the Government was changing the design at
            the last minute and there wasn't enough time for testing. On
            every project I've worked on, designs are always changing and
            there has never been too much time for testing. It's the
            responsibility of the contractor to provide the guidance and
            services to ensure success.
       There are claims that individual portions were working but
            the overall system was not. Based on what I observed, the
            website wasn't working even if the overall system wasn't
            tested. My belief is that both the individual portions AND the
            integrated system were not working.
    Where Did the Money Go?
        I don't understand how the contractors could have charged the
    taxpayers so much money. At $200 million at a generous $200 per hour,
    that's 1,000,000 man hours. That's 500 man-years. Now the numbers are
    even larger. Where did all that time go?
                     technology management recommendations
        This is a complete breakdown in managing technology investments.
    People do not understand when a project should cost $1 million vs. $100
    million. In the private sector, a $1 million budget to build a website
    is huge. The Government needs to remember that buying from companies
    that specialize in Government contracting is not the same as vendors
    who are competitive in the private sector.
    Create a Technology Assessment Office
        A Technology Assessment Office (TAO), a non-partisan entity similar
    to the GAO that is capable of assessing and managing Government
    technology projects. Policy makers, politicians, and bureaucrats do not
    possess the technology skills to keep up with the rapidly-changing
    technology options. They also don't understand what technology should
    cost or the implications their decisions have on cost, security, and
    other options. My serving on the Fairfax County Technology Policy
    Advisory Committee is an example of this type of governance.
    Enforce Accountability
        Past performance is considered an important part of winning
    Government contracts but it doesn't seem to prevent contractors
    involved with failed projects to continue winning new contracts. If
    qualifications matter for selecting contractors, when do contractors
    ever get permanently banned? Multi-year or permanent bans should target
    underperforming vendors to prevent them from bidding on new contracts
    and removed from existing ones.
        In the private sector, vendors that fail would rarely be allowed
    back. Do we have a too-big-to-exclude policy?
                         audit and investigation needed
        An exhaustive investigation and audit of the Healthcare.gov project
    would help determine the various points of systemic failure in order to
    ensure that a debacle of this magnitude never happens again.
    Experience of the Development Team
        The experience of the vendor is important, but what's most
    important is the experience of the people actually doing the work.
    Given my sense that the developers were quite junior, it would be
    interesting to learn their previous experience building commercial
    database websites, what they were being paid, and what the taxpayers
    were charged. Make sure people involved with the entire life of the
    project are questioned, and not just the ones remaining today.
    Development Management and Environment
       How were the deliverables designed, scheduled, and
            delivered?
       How were the teams managed?
       What code reviews were held, and by whom?
       What development, testing, and staging environments were
            employed?
       Was there a test plan? If so, what were the results of the
            test plan before October 1? What bugs were considered
            acceptable for deployment?
       How did the test plan change and who was paid for the
            October 1 that was so bad?
       Is load testing and balancing in place?
       What kind of security reviews, threat analyses, and
            mitigation strategies were undertaken?
       What kinds of security vulnerabilities were detected, and
            when are they scheduled to be addressed? How are security
            issues addressed on an on-going basis?
    Technology Selections
       Why did they take such a strong stand on using open-source
            ``free'' software rather than commercial business software that
            would require less customization (and therefore cost less with
            fewer security vulnerabilities)? (TheAtlantic.com, June 28,
            2013, Healthcare.gov: Code Developed by the People and for the
            People, Released Back to the People)
       Why did they create their own cloud rather than using better
            and cheaper commercial cloud providers? Especially when large
            portions of this site do not need any security.
    Design Flaws and Bugs
        Secretary Sebelius and HHS have announced that they've fixed
    hundreds of bugs, which indicates that there are likely hundreds more
    yet to be found. No matter how many bugs are fixed, the unintended
    consequence is that more will inevitably crop up elsewhere in the code
    base. Is the current website being redesigned to make it work properly
    for consumers, or are they instead trying to make the existing flawed
    design functional? Poorly-designed systems are nearly impossible to
    rescue, and inevitably lead to further support costs down the road.
    When a complex system is created by multiple vendors with no technical
    managerial oversight, it is inevitable that systemic flaws will lead
    only to finger-pointing and recrimination, not to solid, functioning
    software.
    Number of Concurrent Users
        The heaviest demand day was not October 1, but will be the day of
    the deadline to sign up. It's the equivalent of April 15 for the IRS.
    How are they preparing for that? How many simultaneous users can they
    support, and what happens if the number of users exceeds that? Is load
    balancing in place? Are we buying lots of equipment for that one day
    that will sit idle afterwards? Totally unnecessary if a commercial
    cloud provider is used.
        There are policy implications if the system crashes and people are
    shut out before the deadline.
    What Are They Thinking?
       How could they have possibly thought the site was ready to
            go on October 1? There was a seminar scheduled on HowTo.gov to
            showcase how the contractors created this great website but it
            was postponed due to the Government shutdown and later
            canceled.
       Are they redesigning the website to make it work properly
            for consumers or are they trying to make the existing bad
            design work?
    A More Open Policy
       Many companies could have created the Healthcare.gov website
            or similar database websites. Why is it so difficult for
            technically-qualified companies to bid and work on Government
            projects?
       Why isn't the data on the insurance policies, pricing, and
            formulas for subsidies opened in a manner that the private
            sector can create their own website marketplaces?
                                  conclusions
        Overall, I'm embarrassed as an American to watch my President and
    Cabinet Secretary talk about website design, development, and testing,
    and promoting 800 numbers. They should be focused on policy and things
    like Iran and North Korea. Websites should be taken care of at a much
    lower level and certainly no higher than the CTO.
        The underlying problem of Healthcare.gov lies in the way that
    Government contracts are awarded. Our way of life is becoming more, not
    less, dependent on technology every day, yet there is no one at the
    highest levels of Government capable of determining when the Government
    is being ripped off.
        Taxpayers made a significant investment with the contractors to
    expect a functional Healthcare.gov website. While there may be some
    excuse for complexity with connecting to legacy databases in various
    agencies, I don't see any reasonable excuse why the user experience
    would be so defective or the costs so high.
        This is a scandal beyond Healthcare.gov and touches on the entire
    way the Government purchases software solutions. Unfortunately, the
    Federal Government has paid for even larger software projects that were
    never functional.
        The need for a bi-partisan Technology Accountability Office to
    investigate and regulate technology at the Federal level is urgent and
    immediate; not only to stem the hemorrhage of taxpayer dollars, but to
    ensure the security and viability of the essential systems millions of
    Americans depend on.
        Taxpayers paid Super Bowl ticket prices and were delivered a high
    school football game. Follow the money.
                                  Attachments
       appendix 1.--blog post: healthcare.gov is a technological disaster
        This was the blog post I wrote on October 1 providing a non-
    partisan technical review of the Healthcare.gov website.
    Finally Here
        October 1, the Affordable Care Act (Obamacare) website
    Healthcare.gov finally went live today.
        I was eager to personally review what was being offered and cut
    through the hoopla and criticism. I had previously written FMS Receives
    Health Insurance Premium Refund from the Affordable Care Act, so my
    expectations were high.
        From the previously published rates for Virginia, the cost of
    insurance premiums for individuals and families was considerably lower
    than what FMS currently pays for our group plan. Business plans aren't
    available yet, but the individual plans should be a good indicator. I
    wasn't interested in the subsidies; I simply wanted to know the prices
    for the different plan options.
    Applying for Coverage
        So I went on-line to Healthcare.gov around 5:30 A.M. to apply for
    my family and see what it would cost. As expected, you create a log-in
    with email confirmation, and fill out a Wizard to select the options.
    It's similar to many other instances I've applied on-line for credit
    cards and other forms of insurance. How tough could it be? Technically,
    it's a very simple data entry application that should generate a quote
    at the end.
    What a Mess!
        Unfortunately, what should be a simple process is a complete
    software technology disaster. The logical flow of the application to
    register, log-in, and fill out the data for a family was horrendously
    inefficient. It seemed like the person who designed it, had never used
    it. Or maybe didn't have a family which required filling out the same
    information for each member of the family.
        Just the initial process of creating a log-in required multiple
    secret questions and other unnecessary data for getting a quote. Sure
    that may be necessary for the final acceptance, but it's a complete
    waste of time and web resources initially. The system should expedite
    the process as much as possible to get people a quote without
    subsidies, then ask for more information to calculate the subsidies if
    desired. Since I later discovered it never generates a quote, it may
    not really matter anyway. What were the designers thinking?
    Overly Complex Data Entry
        As for my family, I not only had to identify my spouse, my two
    kids, their relationship to me, but also their relationship to my wife,
    and even their relationship to each other! What? Given the prior
    information, obvious defaults could be offered. The selection of race
    was also more complicated than it should be. Here's an idea that may
    not have occurred to the designers: Maybe the kids should default to
    inherit their parents' races. That's how inheritance works. And does
    race impact pricing? If not, why ask?
        The system crashed several times for me and had problems when I
    logged back in. It seemed like the system wasn't even tested. Here are
    some screenshots:

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        What the hell is that? How could that get through testing much less
    production?

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Having error handling to catch unexpected crashes is a Best
    Practice in application development. It should tell the user what went
    wrong, what to do next, and gracefully exit the system. This page does
    none of that. The error message and error number are blank. Who knows
    what went wrong? Useless and amateurish. They do have a Live Chat
    button. I wonder what I would chat with them about with this crash.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        In this screenshot a series of errors appear to be triggered
    without meaningful explanation. Embarrassing.
    Logging Back in and Repeating
        If anything, I'm persistent. I not only had my original goal to see
    the premium prices, I was now intrigued to discover how poorly
    designed, developed, and tested this application was. Eventually, I was
    able to finish. Took about an hour.
        However, rather than receiving a quote immediately, it's now being
    ``processed''. For what? It shouldn't be held up for pre-existing
    conditions which ACA eliminates. I would expect it to be some
    mathematical, logical formula that would generate the results. I
    presume it's because that part of the application isn't built yet.
    Although my application is submitted, given the crashes, I'm not sure
    what data it has. We'll see.
    Authors of Healthcare.gov
        A few months ago, I read this article about how the site was being
    built and was impressed: Healthcare.gov: Code Developed by the People
    and for the People, Released Back to the People.
        In hindsight, it appears the authors have a philosophical bias
    toward Open Source and ``people power.'' That's all fine and dandy if
    it works, but this site doesn't. To deliver such low quality results
    requires multiple process breakdowns. It just proves you can create bad
    solutions independent of the choice of technology.
    Technical Software Conclusions
        What should clearly be an enterprise-quality, highly-scalable
    software application, felt like it wouldn't pass a basic code review.
    It appears the people who built the site don't know what they're doing,
    never used it, and didn't test it.
        I actually experienced many more problems than the screenshots I
    captured. Had I known I was performing a Quality Assurance assignment,
    I would have kept better documentation of typos, unclear directions,
    bad grammar, poorly-designed screens, and other crashes. My bad!
        It makes me wonder if this is the first paid application created by
    these developers. How much did the contractor receive for creating this
    awful solution? Was it awarded to the lowest price bidder? As a
    taxpayer, I hope we didn't pay a premium for this because it needs to
    be rebuilt. And fixing, testing, and redeploying a live application
    like this is non-trivial. The managers who approved this system before
    it went live should be held accountable, along with the people who
    selected them.
                        fms professional services group
        Our Professional Solutions Group has created many mission-critical,
    custom software applications where scalability, reliability, and
    quality are paramount. For instance, we built the Logistics Support
    System for International Humanitarian Relief for the United Nations
    where lives are dependent on accurate, timely data on a global scale.
                              sentinel visualizer
        We've also created a database link analysis program for the
    intelligence and law enforcement communities.
        I know what's involved in creating great software, and this ain't
    it. Healthcare.gov is simply an insurance quote system. As a software
    developer, I'm embarrassed for my profession. If FMS ever delivered
    such crap, I'd be personally inconsolable. This couldn't pass an
    introductory computer science class.
    Overall Conclusions
        This is going to be a huge public relations mess that could doom
    the whole initiative. Maybe they can blame the problems on too many
    users even if that weren't the real cause, but it's not going to be
    fixed with a few weekend tweaks and throwing more hardware at this. The
    application process asks too many unnecessary questions and repeatedly
    crashes. Since 9 A.M. and as of this evening, the site no longer lets
    you apply. I presume it got overloaded or someone finally discovered
    how broken it is and pulled the plug. Given what I experienced, it
    needs to be off-line until it's corrected. Meanwhile, I'd be highly
    concerned about the security of the data people enter given all the
    crashes I encountered.
        Of course, software problems with the application process are not
    the reason to abandon health care reform. As a small business owner, we
    face the highest premiums for the lowest coverage. I applaud the
    efforts to reform health insurance and look forward to working in a
    constructive, rather than destructive, manner to improve this. I
    presume once these issues are resolved, I'll have more options for my
    company and employees than I did before. In the big picture, this
    website is much easier to fix than health insurance. We'll see.
      appendix 2: blog post: creating a healthcare.gov website that works
    Healthcare.gov Suggestions for Improvement
        Since I don't like to just complain without offering solutions, on
    October 14, I wrote a new blog post outlining a solution that would be
    better for consumers, easier to develop, quicker to test, more
    scalable, and more secure. Entitled Creating a Healthcare.gov Web Site
    that Works (http://blog.fmsinc.com/creating-a-healthcare-gov-web-site-
    that-works/), it offers suggestions:
    Understanding the Buying Process for Health Insurance
        It's important to understand what the website should do. The
    primary mistake the designers of the system made was assuming that
    people would visit the website, step through the process, see their
    subsidy, review the options, and select ``buy'' a policy. That is NOT
    how the buying process works. It's not the way people use Amazon.com, a
    bank mortgage site, or other insurance pricing sites for life, auto, or
    homeowner policies. People want to know their options and prices before
    making a purchase decision, often want to discuss it with others, and
    take days to be comfortable making a decision. Especially when the
    deadline is months away. What's the rush?
        The existing process acts as if a retail website asked for your
    credit card number before showing what you could buy and their prices.
    Almost all sites let you browse without creating a user name. Retailers
    want you to see what's available as quickly and easily as possible.
    People often visit multiple times before buying. Only after making a
    purchase decision should personal information be collected to complete
    the transaction.
        The website needs to reflect this and support a more common buying
    process.
    Conceptual Overview
        Here's an overview showing three distinct processes that flow into
    each other (or people buy a policy at their step and leave the system).
    A critical part is offering a comparison matrix at each level so
    consumers can quickly see the differences between the insurance
    policies.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        1. The first one gives policy options and non-subsidized quotes.
            People can click to purchase the policy from the insurance
            company. If so, they leave Healthcare.gov and the Government is
            no longer involved.

        2. The second provides a subsidy estimate and uses the same display
            as the first but with and without subsidized prices. People can
            also click to buy the policy without a subsidy and leave the
            system, or they can officially apply for a subsidy.

        3. The third is the actual application for the subsidy and the only
            path which collects Personally Identifiable Information (PII).
            Higher security is necessary for this.

        The first two do not require PII and would not require high
    security. That means a commercial cloud service such as Microsoft Azure
    could be used to host the site and adjust to high traffic loads. It
    would support people shopping and browsing multiple times before buying
    without the need to invest in hardware or bandwidth.
        With this improved design, only a small portion of the site's
    traffic would be in the final subsidy application portion. That can be
    isolated with high security and for much lower volumes of users since
    people would only apply once. Hassling people at this stage with lots
    of personal questions is acceptable since people are serious about
    purchasing.
    User Experience Goals
        These are some objectives for creating a great user experience:
       Quickly get the unsubsidized insurance rate quotes and
            policies (no login required);
       Easily compare among insurance policies based on features
            and price;
       Easily select and subscribe with an insurance company
            without a subsidy;
       Quickly receive an estimate of a subsidy without having to
            provide personally identifiable, confidential information;
       Easily compare among insurance policies based on features
            and subsidized prices;
       Formally apply for the subsidy (log-in and personal
            information required);
       Select a subsidized policy and pass the appropriate
            information so the insurance company can validate the
            subscriber's information and receive the subsidy;
       Once policy options are offered, allow users to create a
            log-in to save their inputs, and get back into the system to
            recover their work-in-progress. This would be required with the
            formal subsidy application but not necessary for the other
            options.
    Technical ``Back Office'' Goals
       Performance.--The system should move people through the
            process as quickly as possible.
       Collecting Information.--It should not ask for any
            information that's not required for generating the policy
            options and prices.
       Fewer Screens.--Rather than having one screen per question,
            multiple questions should be asked in as few screens as
            possible. People know how to scroll. Extra screens should only
            be added if they depend on answers from previous screens.
       Data Security.--The first part of data security is to NOT
            collect sensitive information. Sensitive information should
            only be collected from people actually applying for the
            subsidy.
       Data Integrity.--All database changes need to be in
            transactions with commitments and rollback on failure.
            Situations where accounts are partially created with a valid
            user name and no account details should never occur.
       No Other Connections During Data Entry.--The system should
            not be connecting to other data sources while the user is
            entering data. Just collect the data.
       Off-line Processing.--Once the user enters all their data
            for a subsidy quote, a separate system processes the
            applications and interfaces with the other systems to validate
            the data and calculate the subsidy. By separating this process
            from the user's on-line experience, problems with connections
            to other systems do not impact the user.
       Email Notification.--Once a subsidy is calculated, an email
            is sent to the user inviting them to log into the system to see
            their options.
       Notification to Insurers.--Web pages and web services to
            allow real-time views of the status of applications selecting
            the insurer's policies.
       Commercial Cloud Hosting.--Using a commercial cloud platform
            would provide automatic scalability to meet fluctuating levels
            of users without having to make hardware purchases. By
            eliminating the need to collect and store sensitive user data
            for most of the website, commercial cloud hosting and its
            benefits are available without security concerns.
    Oversight Goals
        Management and interested parties should have system dashboards:
       Real-time Displays.--Monitor user progress with summary
            tables and graphs showing the status of people moving through
            different stages of the system.
       Basic Business Intelligence.--Summary and drill-down details
            by State, date, hour, etc.
       System Transparency.--Provide a public view of some data in
            a cached mode (updated daily or hourly, but not real-time).
    Design Overview
        Here is how the goals could be implemented for the Healthcare.gov
    website:

        (1) The initial form asks people to select their State. If the
            visitor is in a State that has their own system, ship them to
            those sites, otherwise proceed with the next step in the
            Federal system.

        (2) Collect the information necessary to create the unsubsidized
            options. I was told there were five or so pieces of information
            necessary to generate the unsubsidized rates (e.g. gender, year
            of birth, family status, smoking status, etc.).

        (3) Display the available plans with options to compare and filter
            them easily based on plan level (gold, silver, bronze, etc.),
            provider, price, etc. Should be similar to retail websites like
            Best Buy or Staples showing different products and their
            features in a matrix comparison, with buttons to get more
            details and a button to select one to buy. One would expect
            users to come to this site multiple times over multiple days to
            learn about their options before making a purchase.

        (4) An option to save the inputs. This would be the first time to
            create a simple account to collect user information (which does
            not include things like social security numbers, birthdates, or
            names). A simple user name (e-mail address) and password, with
            a standard e-mail confirmation that doesn't have a time limit.
            This would allow users to get back to the previous screen
            without re-entering their data.

        (5) An option to get a subsidized price estimate. If the person
            chooses this option, they create a simple account because
            highly sensitive information will not be collected. The account
            is simply to retrieve the user's entries. The user provides the
            information necessary to calculate the prices without having to
            look up data from Government sources. The user can enter their
            values for income and whatever other factors impact generating
            a subsidy estimate. Just like bank websites let you enter basic
            information to get a mortgage or car loan rate before you
            apply, Healthcare.gov should do the same. This would allow the
            site to create quotes quickly without having to bog down or
            wait for the other sites such as the IRS, Experian, etc. This
            minimizes the impact of too many users. Once the estimated
            subsidies are calculated, a display similar to No. 3 above
            would show the options.

        (6) Finally, applying for the subsidy. Once someone decides they
            want a particular policy, they can officially apply for a
            subsidy. This is the first time personal data needs to be
            entered. The system should collect the data as quickly as
            possible without having to validate the information while the
            user is entering it. Once all the data is collected, the user
            is informed via email when the subsidy calculation is ready.

        (7) A separate background process calculates the subsidy requests
            and looks up the necessary data from the different sources. If
            any of those linked systems is unavailable, it's no big deal
            since it doesn't impact the user on the website. The user is
            already gone and waiting for an e-mail. Once the calculation is
            generated (or if it couldn't be generated), the user is
            notified via e-mail and they can view the results by logging
            back into their account.

        For management, there should be dashboards with tables and graphs
    showing what's happening. No more excuses of not knowing how many
    people are in each phase of the process, how many have received quotes
    or enrolled, etc. For transparency, some of this information should be
    publicly available updated at least daily.
                                  conclusions
        I'm not sure whether the people designing and developing the site
    will find these suggestions helpful. There's obviously lots of details
    not included in my proposal, but I'm confident my basic design is a
    significant improvement over the original site. It would provide a
    better user experience, be much easier and faster to develop, easier to
    test, and more scalable and secure. Was it that tough to envision
    earlier?
        Let's remember, this website remains the automation of a paper
    form. It's not as hard as providing health care.

        Chairman McCaul. Thank you, Mr. Chung. I appreciate your
    testimony.
        Mr. Krush is now recognized for 5 minutes.

        STATEMENT OF WAYLON W. KRUSH, CHIEF EXECUTIVE OFFICER,
                            LUNARLINE, INC.

        Mr. Krush. Chairman McCaul, Ranking Member Thompson, and
    the Members of the committee, thank you for this opportunity to
    testify today on the important topic of cybersecurity as it
    relates to HealthCare.gov. I am Waylon Krush, founder and CEO
    of Lunarline, Inc. We are a leading provider of cybersecurity
    products, services, and training for the Federal Government and
    also the commercial sector. I am also a founding member of the
    Warrior to Cyber Warrior program.
        The Warrior to Cyber Warrior program provides, at no cost,
    a 6-month boot camp for returning veterans. This program equips
    veterans or their--if a veteran is unable to participate
    because of service-related injuries, their spouses--with the
    skills, training, and certifications they need to thrive in the
    cybersecurity world. I have been asked to speak today on the
    topic of cybersecurity as it relates to the recent events
    surrounding the HealthCare.gov website and related systems.
        I want to make clear that I am not here to weigh on the
    political debate surrounding the Patient Protection and
    Affordable Act. This is above my pay grade. Instead, I am here
    in my capacity as a cybersecurity professional, one who has
    contributed to the defense of our Nation's IT infrastructure,
    both as a soldier in uniform and as a leader of one of our
    country's fastest-growing cybersecurity firms. I was recently
    asked by the press if I would, as a cybersecurity professional,
    trust my own personal data to HealthCare.gov.
        I said yes that I would, and I stand by that statement.
    This is not because I believe HealthCare.gov is 100 percent
    secure. There is no IT system, Federal or otherwise, that can
    make this claim. Instead, my confidence in HealthCare.gov is
    based on my hands-on experience with the rigorous process the
    Federal Government has instituted to effectively manage--not
    eliminate, but manage--cybersecurity risk.
        Now, I realize it is a bit odd for a cybersecurity
    professional to come before Congress and preach the confidence
    in our Government's cybersecurity posture. We cybersecurity
    folks are usually better known for peddling cyber doom and
    gloom. However, the truth is there is plenty of cause for
    confidence, particularly when we--it comes to Federal
    cybersecurity. To explain why I feel this way, I would like to
    focus my testimony today on the risk management framework and
    how it relates to some of the concerns recently brought up in
    the on-going media coverage of HealthCare.gov.
        Now, I have been given just 5 minutes to briefly describe
    this extensive cybersecurity process and regulations that
    provide the foundation for the U.S. Government's systems
    security. To put this task into context, a few years ago a
    colleague and I wrote a book entitled, ``The Definitive Guide
    to the C&A Transformation.'' In this book, we did our best to
    scope down thousands upon thousands of pages of Federal
    cybersecurity and privacy regulations into 600 pages of easy
    reading.
        The easy reading part is a joke, but the level of depth and
    rigor in this process is not. Here today, I will try to distill
    these processes even further into just 5 minutes of testimony.
    During these 5 minutes, I will do my best to describe how the
    6-step risk management framework supports the Federal
    Information Security Management Act. Excuse me.
        This, in turn, should provide a baseline understanding for
    the security processes governing HealthCare.gov and, in
    reality, any Government IT system. I hope that from my
    testimony this will help folks interpret how now-famous
    decision memo originally intended for Marilyn Tavenner that
    describes some of the known security risks faced by
    HealthCare.gov. The RMF is a 6-step process. It includes
    categorization, security control selection, implementation,
    assessment, authorization, and continuous monitoring.
        I will briefly describe each one of these steps, and
    provide some insight into how each one relates to the security
    of HealthCare.gov. I will, however, caution the committee that
    any internal vulnerabilities related to HealthCare.gov should
    absolutely not be publicly released until HHS or CMS has time
    to mitigate or remediate these issues. The first step is
    categorization. We look at all of the data types that are
    actually in the Federal information system.
        We have two publications, NIST Special Publication 860,
    Volume 1 and Volume 2. So we have to find out what type of data
    this system consists of. The next step governs the selection of
    the security controls. This is a process where we automatically
    assign a set of baseline security controls, whether it is low,
    moderate, or high. And enhancements, if need be, based on the
    protection requirements of the system. In step 3, this is where
    we actually implement the security controls.
        These are hundreds upon hundreds of controls, including
    enhancements and tailoring guidance that goes into every
    Federal information system. In step 4, we actually have
    assessment. These are on-going assessments, these are
    assessments before the authorization decision is made. These
    are annual assessments. These are what we call assessments that
    go with the updates of code that we are gonna see during this
    process of updating HealthCare.gov. There is one thing that we
    need to know; there is no such thing as a clean assessment.
        An assessment of any system, Federal or otherwise, will
    always reveal some security risk. It is not possible to have a
    completely secure system. In conclusion, I hate to tell
    everyone but at this point in time there is no cybersecurity
    bullet, silver bullet. If there were I would be selling them,
    lots of them. A secure system requires the right people,
    process, and technology to work together harder, smarter, and
    faster than the adversary.
        [The prepared statement of Mr. Krush follows:]
                     Prepared Statement of Waylon W. Krush
                               November 13, 2013
        Chairman McCaul, Ranking Member Thompson, and Members of the
    committee: Thank you for this opportunity to testify today on the
    important topic of cybersecurity as it relates to Healthcare.gov. I am
    Waylon Krush, founder and CEO of Lunarline, a leading provider of
    cybersecurity products, services, and training to both Federal and
    commercial clients.
        I am also a founding member of the Warrior to Cyber Warrior
    program. Warrior to Cyber Warrior provides, at no-cost, a 6-month
    cybersecurity boot camp for returning Veterans. This program equips
    Veterans, or if a Veteran is unable to participate because of service-
    related injuries, their spouses, with the skills, training, and
    certifications they need to thrive in the cybersecurity world.
        I have been asked to speak today on the topic of cybersecurity as
    it relates to the recent events surrounding the Healthcare.gov website
    and related systems. I want to make clear that I am not here to weigh
    in on the political debate surrounding the Patient Protection and
    Affordable Care Act. That is above my pay grade. Instead, I am here in
    my capacity as a cybersecurity professional, one who has contributed to
    the defense of our Nation's IT infrastructure, both as a soldier in
    uniform and as a leader of one of our country's fastest-growing
    cybersecurity companies.
        I was recently asked by the press if I would, as a cybersecurity
    professional, trust my own personal data to Healthcare.gov. I said yes,
    that I would. I stand by that statement.
        This is not because I believe that Healthcare.gov is 100% secure.
    There is no IT system, Federal or otherwise, that can make this claim.
    Instead my confidence in Healthcare.gov is based on my hands-on
    experience with the rigorous processes the Federal Government has
    instituted to effectively manage--not eliminate, but manage--
    cybersecurity risk.
        Now I realize it is a bit odd for a cybersecurity professional to
    come before Congress and preach confidence in our Government's security
    posture. We cybersecurity folks are usually better known for pedaling
    cyber doom and gloom. However, the truth is, there is plenty of cause
    for confidence, particularly when it comes to Federal cybersecurity.
        To explain why I feel this way, I would like to focus my testimony
    today on the Risk Management Framework and how it relates to some of
    the concerns recently brought up in the on-going media coverage of
    Healthcare.gov.
        Now, I have been given just 5 minutes to very briefly describe the
    extensive cybersecurity processes and regulations that provide the
    foundation for U.S. Government system security. To put this task in
    context, a few years ago a colleague and I wrote a book entitled The
    Definitive Guide to the C&A Transformation. In this book we did our
    best to scope down thousands upon thousands of pages of Federal
    cybersecurity and privacy regulations into just 600 pages of easy
    reading.
        The easy reading part is a joke, but the level of depth and rigor
    in the process is not. Here today, I will try to distill these
    processes even further, into just 5 minutes of testimony. During these
    5 minutes I will do my best to inform everyone on how the 6-step
    Federal Risk Management Framework (RMF) supports the Federal
    Information Security Management Act (FISMA).
        This, in turn, should provide a baseline for understanding the
    security processes governing Healthcare.gov, and in reality any
    Government IT system. I also hope that my testimony will help folks
    interpret the now-famous ``decision memo''--originally intended for
    Marilyn Tavenner--that describes some of the known security risks faced
    by Healthcare.gov.
        The RMF is a 6-step process that governs the categorization,
    security control selection, control implementation, control assessment,
    authorization, and continuous monitoring of all Federal IT systems. I
    will briefly describe each step and provide some insight into how each
    one relates to the security of Healthcare.gov. I will however caution
    the committee that any internal vulnerabilities related to
    Healthcare.gov should absolutely not be publicly released until HHS or
    CMS has time to mitigate or remediate these issues.
        The first step, Step 1, is called categorization. During system
    categorization we analyze all the information stored, processed, or
    transmitted by any component of the system. We classify all data by
    data type and sensitivity, and set the protection level as ``Low,''
    ``Moderate,'' or ``High'' to meet the requirements of the most
    sensitive system data. Based on what I have read publicly thus far,
    Healthcare.gov is most likely categorized as a Moderate system.
        The second step, Step 2, governs the selection of security controls
    to meet the protection requirements defined in Step 1. As a
    ``Moderate'' level system, Healthcare.gov is required to implement, at
    minimum, several hundred security controls. Additional controls may be
    selected based on any unique system security requirements, such as the
    presence of personally identifiable information (PII).
        In Step 3, we take the controls identified in Step 2 and implement
    them. This is where the rubber hits the road. HHS and CMS have both
    authored comprehensive information security policies that govern their
    approach to cybersecurity. These policies are backed by significant
    investments in enterprise detection and protection capabilities,
    including security operations centers, enterprise end-point
    technologies, border and gateway filtering, incident response teams,
    and enterprise continuous monitoring capabilities. For Healthcare.gov,
    these enterprise-level controls are combined with system specific ones
    to support the implementation and maintenance of an effective security
    posture.
        After selecting and implementing controls, Step 4 of the RMF
    mandates frequent security control assessments. These are tests that
    are conducted to determine whether or not to allow a system to continue
    operation. However, let me be clear: There is no such thing as a clean
    assessment. An assessment, of any system, Federal or otherwise, will
    always reveal some security risks. It is not possible to have a
    completely secure system.
        At this point, everyone here is probably familiar with the
    ``Tavenner memo'' I discussed previously. This memo described some
    components of the ``Federally Facilitated Marketplace'' that had not
    yet undergone thorough re-testing due to continued system development.
    It was determined that this uncertainty represented a ``high risk.''
        Now, there is no denying that this does indeed represent a
    significant system risk. Had the memo ended with that finding we would
    have every right to be deeply concerned. However, the memo continues to
    outline a comprehensive mitigation strategy designed to mitigate this
    risk. This includes the establishment of a dedicated security team to
    monitor the system, weekly testing of all border and web-facing assets,
    daily/weekly scans using continuous monitoring tools, and a promise to
    conduct a full Security Control Assessment within 90 days.
        While Healthcare.gov's political sensitivity has cast a spotlight
    on this process, these types of risk analyses are common place across
    the Federal Government. Again, security assessments always reveal
    risks, no matter what system is being assessed. How those risks are
    managed ultimately determine whether or not a system can be labeled
    ``secure.'' There is a reason it's called the ``Risk Management
    Framework,'' rather than the ``No Risk Framework.'' It is designed to
    ensure that Risk Executives conduct precisely these types of trade-off
    analyses.
        The Tavenner memo is also an example of Step 5, called System
    Authorization. Simply put, this step requires a management decision on
    how, when, and under what conditions a Federal system may be authorized
    to operate. Like Healthcare.gov, most Federal systems are authorized
    with conditions and pending the implementation of an effective
    mitigation strategy. This is exactly what you are reading in the
    Tavenner memo.
        Finally, during Step 6 we continuously monitor security posture
    throughout the entire system life cycle. This is the most important
    step in the process. This is why I have publicly stated that I would
    trust my own personal data to Healthcare.gov. I know as well as anyone
    that as soon as a system is developed you are in a race against time to
    find and mitigate vulnerabilities. This is particularly true for high-
    value targets such as Government IT assets.
        That being said, if HHS follows through with their on-going daily
    and weekly scanning and more importantly--quickly remediates and
    mitigates security issues as they are discovered, we can be assured our
    data is safe as possible.
        In conclusion, I hate to tell everyone this, but at this point and
    time there is no cybersecurity silver bullet. If there were, I would be
    selling them--lots of them. A secure system requires the right people,
    process, and technology to work together, harder, smarter, and faster
    than the adversary.

        Chairman McCaul. I thank Mr. Krush for your testimony. Yes,
    I have emphasized before this is probably one of the most
    significant websites ever created by the Federal Government. In
    this exchange, the most personal, private data is put into
    this--Social Security numbers, addresses, e-mails, personal-
    private health information. I can't think of anything more
    private than health information. What the American people want,
    I think, is not only a system that works and that is
    functional--which, clearly, this is not. As Mr. Chung said, it
    was amateurish.
        But they also want some assurance that it is secure. They
    do not want this data breached and obtained by hackers, or
    identify theft perpetrators who can then exploit that
    information. To that point, the CMS administrator wrote a
    letter to our committee and, specifically, to the Ranking
    Member, Mr. Thompson, because of his concerns about security of
    this website. The assurance was given at that time, when that
    letter was written, that it would be both secure and follow
    industry best practices.
        We have since found out that a September 3 memo came out
    from a senior official at CMS stating that it found two high-
    risk issues and said the threat and risk potential is
    limitless. According to Federal guidelines, high-risk means
    vulnerability could be expected to have a severe or
    catastrophic adverse effect on organizational operations,
    assets or, most importantly, individuals; individuals being the
    American people. We have advocated for a delay in the
    implementation of this law for many reasons.
        But certainly, when you have a dysfunctional website and a
    security risk to the American people's most personally
    identifiable information, I think that delay, that argument, is
    certainly even stronger. Mr. Chung, do you agree that we should
    delay implementation?
        Mr. Chung. Delaying that would be a policy question. With
    regard to my knowledge, it would be on the technical side. My
    expectation would be that when we pay this kind of money to
    these contractors they would build something that would be
    secure. It is like buying a car that has tires on it. You would
    assume that for hundreds of millions of dollars it would be a
    secure site.
        The other part of this would--you know, the first step in
    security and privacy is to not ask for information that needs
    to be secured. So going through the process of asking all those
    personal pieces of information, when people are just shopping,
    without even buying or requesting a subsidy, is an outrage. I
    don't know if the identity verification company is getting paid
    for every person that they verify, but I think if you follow
    the money it would be very easy to see how those decisions were
    made.
        Chairman McCaul. In your opinion here, did CMS actually
    follow industry best practices in setting up this website?
        Mr. Chung. I was not involved directly on the project so I
    am not exactly sure what they did or didn't do. I just know
    from a taxpayer's perspective we paid enough money to demand,
    and expect, a fully functional website. It is huge how much we
    have paid. It is over, what, $300 million? I think you can get
    a 747 and crash it into the ground for less. So it is
    unbelievable what we have spent for essentially the automation
    of a paper form.
        Chairman McCaul. So I guess the question is, I mean: How
    did this come to be? I mean, we spent, you know, all this money
    for what you called an amateur website. How did that happen?
        Mr. Chung. I think that we have an environment where
    Government contractors are incentivized, especially when they
    know a customer has an open pocketbook, to create opportunities
    to bill more hours, to put in more features, to add more
    complexity, get more change orders, and get the next contract.
    That is the product that they are really going after. It is not
    necessarily creating a solution that works. They got caught
    this time because the general public actually use software that
    they created. But there are a lot of projects in the Government
    where Government contractors deliver things that the public
    never sees.
        Chairman McCaul. So in other words, you have a Government-
    run program that the contractors exploited for their own profit
    at the expense of the American taxpayer.
        Mr. Chung. Absolutely. I think that is very clear.
        Chairman McCaul. I am personally stunned that DHS, that has
    primary responsibility over the dot.gov space--Federal-civilian
    networks within the Government--the extent of communication
    with the Secretary and with HHS was two e-mails and one phone
    call. When I asked a question about how does HHS rank in its
    scorecard, if you will, for cybersecurity they get a 50 percent
    compliance record and they rank No. 2 at the bottom.
        They are the second-worst Federal agency when it comes to
    security of their networks. Mr. Krush, don't you believe that
    the Department of Homeland Security should play a greater role
    in trying to secure this website?
        Mr. Krush. I believe they should play a greater role. I
    will say, however, the process that was followed is the process
    that is followed with all Government systems. Meaning that a
    risk-based decision was made by an executive that was put in
    charge of the site. They were provided the information about
    what type of vulnerabilities, what things need to be mitigated.
    You know, this goes on throughout the entire Government.
        You know, there is not a system out there that is perfect
    in nature, by any means, from a cybersecurity perspective.
        Chairman McCaul. No, this was certainly not perfect. Mr.
    Chung, if you have a business and you are pushing a product,
    and your website not only is dysfunctional but it crashes,
    would you take a time out and try to fix it first? Or would you
    still go forward with that program?
        Mr. Chung. I guess it depends how desperate I was. But, you
    know, being concerned about the experiences of my customers,
    no, I would not be able to deliver a product that didn't work.
    That was what was so shocking when I experienced it on the
    first day. Because I wasn't there to do a quality assessment of
    that HealthCare.gov website. I went there to get a price. It
    was by accident that I find myself in this situation, after
    experiencing what can truly be considered one of the worst
    pieces of software I have ever used.
        Chairman McCaul. In addition to a bad piece of software,
    though, you have the security risk to Americans' most private
    information.
        Mr. Chung. Absolutely. When you have an environment where
    the developers can barely get the website functional, security
    is way down on the list of things to take care of, right?
    Security needs to be built in at the very beginning, not added
    at the end. When you have an inexperienced developer--people
    don't--that can't even build a website properly or spell or do
    grammar, I mean, the skill set that is necessary to create a
    secure website are far higher than what I could see was the
    skills of the people that were put on creating that website.
        Chairman McCaul. So I guess it comes as no surprise that
    under 50,000 Americans have actually signed up for the
    exchanges, given the fact that, No. 1, the website is flawed.
    No. 2, the security risks are so great, if people--if the
    administration was really interested in getting more people to
    sign up you think they would take a time-out, fix this, and
    also fix it from the security standpoint.
        The thing that also bothers me tremendously is that it has
    been reported to me that there are about--there are over 700
    fake websites out there that purport to be an exchange, purport
    to be part of this Obamacare program. HealthCare.gov is the
    official, but there are over 700 fake websites out there that
    are preying on victims for their personal identifying
    information so they can exploit that. Does that trouble either
    one of you? Mr. Krush.
        Mr. Chung. That happens all the time on every website. That
    is not unusual.
        Mr. Krush. Yes, that is not abnormal. One of the things
    that were brought up earlier by DHS was that they ensured that
    HHS actually implemented DNS security. So that if you go to
    HealthCare.gov you are arriving at HealthCare.gov. That doesn't
    take away the process that when you go out to go to Google.com
    and you actually put a ``P'' in front of it, or a ``G'' or
    something, you are gonna sent to a site that looks like Google
    but I wouldn't be using that search engine.
        Chairman McCaul. Well, I think it demonstrates--I mean,
    perhaps a better public education process to demonstrate that
    there are fake websites out there, and here is the official
    one. Again, I will close by saying I am troubled that the
    Department of Homeland Security, that has the primary
    responsibility for securing the dot.gov space, is defaulting to
    an agency, a department, HHS, which has one of the worst
    scorecards when it comes to cybersecurity.
        With that, it is lunchtime. A lot of the Members have left.
    But I do want to give the witnesses, since you have taken so
    much time to prepare and come here today, perhaps give you the
    last word. I will start with Mr. Chung.
        Mr. Chung. Well, thank you very much. I mean, I can tell
    you that as a small business owner I am facing the need to buy
    insurance for myself and my employees. I have to follow the
    law. I don't get to choose the laws that I follow. I was really
    hoping that this would be an opportunity for me to be able to
    buy health insurance that would be more competitive. Health
    insurance is a big problem for small businesses. We pay the
    highest premiums for the worst coverage.
        We are competing against companies like CGI and these other
    Government contractors that are much bigger and can probably
    get lower-priced insurance than we can. So I hope that
    throughout this whole process we do keep in mind that getting
    health insurance for companies is important to small businesses
    for us to remain competitive.
        Chairman McCaul. Thank you.
        Mr. Krush.
        Mr. Krush. I would just like to say that, you know, the
    processes that we have in place in the Federal Government are
    some of the most rigorous processes of any type of auditing you
    would perform on any type of information system. I am very
    familiar with the type of commercial auditing that goes on. I
    am very familiar with the Federal auditing that goes on. So,
    you know, the depth and rigor in the implementation of
    cybersecurity and privacy requirements that we do build into
    the systems--whether, you know, they are always working
    properly, or not--is some of the best out there.
        I mean, there is just really no comparison. All of the
    previous speakers brought up HIPAA, they brought up different
    compliance requirements that are out there. I will tell you, if
    you are gonna deploy a Federal information system you must not
    only implement those controls, but the control catalogue itself
    that we are required to implement throughout each one of the
    components; whether that be starting at the hardware layer, the
    hypervisor, the operating system, and all the applications to
    sit on top of that is the most rigorous cybersecurity of any
    Nation in the world. Also, just of any organization, whether it
    be Government or not.
        Chairman McCaul. Well, with all due respect, I would
    submit, in this case, it was an abysmal failure. We don't like
    to see that as Americans, and hope we can move forward in a
    more productive way.
        With that, I want to thank the witnesses for your
    testimony. Members are advised if they have additional
    questions they can submit that within 10 days. I would ask you
    to respond in writing to that. Without objection, the committee
    stands adjourned.
        [Whereupon, at 12:45 p.m., the committee was adjourned.]