[House Hearing, 117 Congress]
[From the U.S. Government Publishing Office]



 
      COMBATING RANSOMWARE: FROM OUR SMALL TOWNS IN MICHIGAN TO DC

=======================================================================

                             FIELD HEARING

                               before the

                            SUBCOMMITTEE ON
                            INTELLIGENCE AND
                            COUNTERTERRORISM

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED SEVENTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             JUNE 28, 2022

                               __________

                           Serial No. 117-64

                               __________

       Printed for the use of the Committee on Homeland Security
       
       
       
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]                                     



                                     

        Available via the World Wide Web: http://www.govinfo.gov

                               __________                               
                               
             U.S. GOVERNMENT PUBLISHING OFFICE              
 48-963PDF            WASHINGTON : 2022 
                             
                               
                               
                               

                     COMMITTEE ON HOMELAND SECURITY

               Bennie G. Thompson, Mississippi, Chairman
Sheila Jackson Lee, Texas            John Katko, New York
James R. Langevin, Rhode Island      Michael T. McCaul, Texas
Donald M. Payne, Jr., New Jersey     Clay Higgins, Louisiana
J. Luis Correa, California           Michael Guest, Mississippi
Elissa Slotkin, Michigan             Dan Bishop, North Carolina
Emanuel Cleaver, Missouri            Jefferson Van Drew, New Jersey
Al Green, Texas                      Mariannette Miller-Meeks, Iowa
Yvette D. Clarke, New York           Diana Harshbarger, Tennessee
Eric Swalwell, California            Andrew S. Clyde, Georgia
Dina Titus, Nevada                   Carlos A. Gimenez, Florida
Bonnie Watson Coleman, New Jersey    Jake LaTurner, Kansas
Kathleen M. Rice, New York           Peter Meijer, Michigan
Val Butler Demings, Florida          Kat Cammack, Florida
Nanette Diaz Barragan, California    August Pfluger, Texas
Josh Gottheimer, New Jersey          Andrew R. Garbarino, New York
Elaine G. Luria, Virginia            Mayra Flores, Texas
Tom Malinowski, New Jersey
Ritchie Torres, New York
                       Hope Goins, Staff Director
                 Daniel Kroese, Minority Staff Director
                     Natalie Nixon, Committee Clerk
                                 ------                                

           SUBCOMMITTEE ON INTELLIGENCE AND COUNTERTERRORISM

                  Elissa Slotkin, Michigan, Chairwoman
Sheila Jackson Lee, Texas            August Pfluger, Texas, Ranking 
James R. Langevin, Rhode Island          Member
Eric Swalwell, California            Michael Guest, Mississippi
Josh Gottheimer, New Jersey          Jefferson Van Drew, New Jersey
Tom Malinowski, New Jersey           Jake LaTurner, Kansas
Bennie G. Thompson, Mississippi (ex  Peter Meijer, Michigan
    officio)                         John Katko, New York (ex officio)
               Brittany Carr, Subcommittee Staff Director
          Adrienne Spero, Minority Subcommittee Staff Director
                      Joy Zieh, Subcommittee Clerk
                      
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               STATEMENTS

The Honorable Elissa Slotkin, a Representative in Congress From 
  the State of Michigan, and Chairwoman, Subcommittee on 
  Intelligence and Counterterrorism:
  Oral Statement.................................................     1
  Prepared Statement.............................................     4
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Chairman, Committee on 
  Homeland Security:
  Prepared Statement.............................................     7

                               WITNESSES
                                Panel I

Mr. Iranga Kahangama, Assistant Secretary for Cyber, 
  Infrastructure, Risk, and Resilience, Office of Strategy, 
  Policy, and Plans, U.S. Department of Homeland Security:
  Oral Statement.................................................     8
  Joint Prepared Statement.......................................    10
Mr. Matt Hartman, Deputy Executive Assistant Director for 
  Cybersecurity, Cybersecurity and Infrastructure Security 
  Agency, U.S. Department of Homeland Security:
  Oral Statement.................................................    14
  Joint Prepared Statement.......................................    10

                                Panel II

Ms. Laura Clark, Chief Information Officer, Department of 
  Technology, Management & Budget, State of Michigan:
  Prepared Statement.............................................    29
Mr. James C. Ellis, Detective First Lieutenant and Cyber Section 
  Commander, Michigan Cyber Command Center, Michigan State 
  Police:
  Oral Statement.................................................    32
  Prepared Statement.............................................    34

                             FOR THE RECORD

The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas:
  Article, TechNewsWorld, June 14, 2016..........................    18
  Article, Channel 13 Eyewitness News, April 15, 2021............    20
  Article, CNET, November 15, 2021...............................    38


      COMBATING RANSOMWARE: FROM OUR SMALL TOWNS IN MICHIGAN TO DC

                              ----------                              


                         Tuesday, June 28, 2022

             U.S. House of Representatives,
                    Committee on Homeland Security,
                              Subcommittee on Intelligence 
                                      and Counterterrorism,
                                                       Lansing, MI.
    The subcommittee met, pursuant to notice, at 11:01 a.m., at 
MSU Federal Credit Union, 3777 West Road, East Lansing, 
Michigan, Hon. Elissa Slotkin [Chairwoman of the Committee] 
presiding.
    Present: Representatives Slotkin, Jackson Lee, and Demings.
    Chairwoman Slotkin. The Subcommittee on Intelligence and 
Counterterrorism will come to order.
    The subcommittee is meeting today on ``Combatting 
Ransomware: From Our Small Towns in Michigan to Washington, 
DC''.
    Without objection, the Chair is authorized to declare the 
subcommittee in recess at any point.
    Good morning, everybody. Thank you for joining us. I am 
happy to be here in my Congressional district in East Lansing, 
Michigan bringing Congress and the subcommittee that I chair to 
the people that I serve. The purpose of today's hearing is to 
bring some of the District of Columbia's best minds on 
cybersecurity to my district to detail the critical work that 
they are doing to keep ordinary Americans, like Michiganders, 
safe from an increasingly disruptive threat, and that threat is 
ransomware. Ransomware is a National security threat that has a 
direct impact on the lives of Michiganders.
    Before I get into the details here, I just want to say we 
are live streaming. If you are behind our witnesses you are on 
camera. So let us keep your funny faces and pointing to a 
minimum since that will be recorded for posterity. We will have 
a number of Members from my subcommittee appearing virtually 
from their home districts, and I just really appreciate the 
opportunity to hold this here in Michigan and thank our leaders 
from Washington for flying in and doing this event.
    So just a couple of definitions so we are all on the same 
page. A ransomware attack is defined as a digital form of 
traditional ransom, whereby computer systems, data, and 
electronic devices are held hostage by a criminal or group 
seeking a ransom payment in order for an organization to regain 
access to their own systems. They are often carried out by a 
criminal or criminal groups with the support or tacit approval 
of a state government, known as a state actor. Think about 
criminals who are acting out of places like Russia and China. 
We have seen state actors and adversaries, Russia and China, 
but also North Korea and Iran, permissible territories. Other 
times these attacks are carried out by criminals purely for 
their own behalf. These are called non-state actors. According 
to a 2022 Cyber Threat Report by SonicWall, an internet 
cybersecurity company, ransomware attacks in the United States 
rose by 98 percent last year to record-high levels. I think in 
the State of Michigan we have heard from the State officials in 
our last hour that ransomware attacks in the State have doubled 
since last year. A separate report by the CyberEdge Group found 
that nearly two-thirds of ransomware victims actually went 
ahead and paid their ransom in order to regain access to their 
own systems and their own data. Often it is cheaper for a small 
or medium-size business or organization to pay the ransom than 
to pay an IT and cybersecurity company to regain all that 
access that they lost.
    In Michigan alone we have heard from the State's chief 
information officer that hackers have tried more than 90 
million times a day to get into the State servers. Let me say 
that again, that is 90 million times a day. Ransomware has 
become a kitchen-table issue for Michiganders. Often these are 
automated, right. It is not 90 million individuals, it is an 
automated process. But that is the number of times that there 
has been attempted infiltrations to our State every single day. 
Every Michigander in this room has their data held by the 
State. So that is our data.
    Ransomware has become very much a kitchen table issue for 
us. It affects the people and organizations we rely on 
everyday, our schools, particularly our K-12 schools, our small 
businesses, our hospitals and third-party vendors that work 
with our hospitals, and other organizations, like our farmers, 
have been threatened and have even fallen victim to ransomware 
attacks.
    I was really taken by this issue when I began as a Member 
of Congress. I was sworn in 2019 and I started making the 
rounds with our town supervisors, our mayors, our 
superintendents, folks who are in many cases very small rural 
communities and I expected--you know, I just said, what are you 
worried about, what are you concerned about, and I expected it 
to be about money and fixing the roads and some very concrete 
things. All of these folks started raising with me how 
concerned people were about cybersecurity for the 1,200 
residents that they were responsible for.
    It is an issue that I think I really--like lives in this 
Venn Diagram of National security issues and local issues. It 
is something that people are obviously rightly concerned about. 
We just came from a panel where we heard from town supervisors 
responsible for 1,200 people's data who were ransomed based on 
a phishing email for $40,000. A small community does not have 
$40,000 to just throw at this problem.
    As a Nation, you might remember two high-profile kind-of 
newsworthy ransomware attacks last year. One was the Colonial 
Pipeline and one on the JBS Meat Company. These events really 
showed Americans how vulnerable we are, how our critical 
infrastructure is vulnerable to these attacks, and then how 
damaging the consequences can be. Many ransomware attacks have 
been much more hyper-local though than these kind of high-
profile events.
    In Michigan's 8th district, which I represent, we have had 
a significant--as I said, a significant uptick in these 
attacks, which is why I have pulled together this field 
hearing. We have seen entire cities and townships targeted in 
these new attacks. Local governments have had to create 
entirely new websites, create new email addresses, buy new 
software to resolve these attacks, all at great cost and time 
and resources.
    In a February Detroit Free Press article, Sgt. Matt 
McLalin, who investigates cyber attacks in the State Police's 
cyber command center, which is not far from here in Dimondale, 
Michigan, said local and county governments make up the 
majority of the center's victims. Every single week, he said, 
we are getting multiple reports of local governments that have 
been affected--every week. When an entire local government can 
be taken off-line by a cyber criminal operating across the 
world, we have a significant issue we need to address.
    As I said, it is not just governments. Last fall I hosted 
the superintendents from my district. The K-12 superintendents 
came to Washington and I just sort-of on a whim said raise your 
hand if you have ever been a victim of a ransomware attack, and 
every single school superintendents hand went up. Some paid, 
some didn't. There they are trying to get the kids' identities, 
the kids' data.
    We have seen schools come under direct attack in Walled 
Lake, Michigan; Monroe, Richmond, Michigan; and across the 
State. Last month, people may remember that classes at Kellogg 
Community College were canceled for 2 days as school officials 
noticed some issues with the computer systems related to a 
ransomware attack. Two years ago, Michigan State University, 
very close to here, was targeted by this increasingly prevalent 
type of attack, and it cost the university more than $1 million 
to recover.
    Cyber criminals operate in permissive environments, like 
Russia and China, as we said. The governments at best turn a 
blind eye to these actors operating on their soil, at worst 
they know what they are doing and don't do anything about it. 
They have launched attacks, particularly for our kids, on their 
school records. These are useful for future hostage situations, 
ransomware situations because they presume that schools and 
parents will pay virtually any cost to shield their children 
from educational disruption.
    As we have talked about, ransomware attacks have also 
disrupted hospital systems. The uptick on ransomware attacks 
during COVID was significant on our hospitals, but also on 
third-party vendors that do a lot of work with our hospitals. 
In addition, our gas pipelines, and, as the workers at JBS 
processing plant in Plainwell know, it has threatened literally 
our Nation's food supply and our farmers' livelihoods.
    Further endangering our food supply, we have seen 
ransomware attacks directly targeting the manufacturers of 
agricultural equipment and the data they collect. Ransomware 
attacks are a threat to people from the smallest family farm to 
the biggest Fortune 500 companies, but it is the ordinary 
American, the farmer, the schoolteacher, the business owner, 
the parent, who bear the brunt of these attacks.
    Just this past weekend, I heard from constituents in 
Brighton, Michigan, not far from here, that were fundraising 
for the owners of a local bookstore in Detroit which was hit by 
a cyber attack and was forced to personally cover over $35,000 
in losses. That business, still fragile from COVID and the 
pandemic, is now facing the prospect of imminent closure as a 
result of this attack.
    We know that our computer systems are complex, we know that 
small and medium-sized businesses, small and medium-sized 
governments are already stretched thin. They don't have the 
ability to hire fancy security firms to take care of everything 
for them. Not everyone can afford cybersecurity insurance, 
which is something I encourage all leaders to look into, and 
many are not able to hire a cyber specialist, an IT specialist 
on payroll to respond.
    So this is why our hearing is so important today. We have 
designed the hearing to connect the average person with experts 
who can help them protect themselves. To our witnesses, people 
want to know where do they go when they are the victim of a 
ransomware attack. Literally, what is the 9-1-1 number that 
they call? Do they call the FBI? Do they call the State Police? 
Where should people turn the minute that they realize someone 
is trying to steal their data. We know that we have an 
increasing number of people who are just coming in for a normal 
day of work, they realize that their computer or their cash 
register is physically locked to them by hackers demanding 
large sums of money. We know that they are now--this is no 
longer sort-of asking that you drop a bag of cash at a 
designated location, the use of cryptocurrencies has been 
significantly on the rise. I have heard from constituents 
across the district that they feel like they are on the front 
lines of this threat and they do not know what their Government 
is doing to protect to them.
    [The statement of Chairwoman Slotkin follows:]
                 Statement of Chairwoman Elissa Slotkin
                             June 28, 2022
    I am happy to be here in my Congressional district in East Lansing, 
Michigan--bringing Congress and the subcommittee I chair to the people 
I serve. The purpose of today's hearing is to bring some of the 
District of Columbia's best minds on cybersecurity to my district to 
detail the critical work they are doing to keep ordinary Americans, 
like Michiganders, safe from an increasingly disruptive threat: 
Ransomware. Ransomware is a National security threat that has a direct 
impact on the lives of Michiganders.
    First, some definitions: A ransomware attack is defined as a 
digital form of traditional ransom, whereby computer systems, data, and 
electronic devices are held hostage by a criminal or group seeking a 
ransom payment in order for an organization to regain access to its 
systems. They are often carried out by a criminal or criminal group 
operating with the support or tacit approval of a state government, 
known as a state actor. We have seen these state actors in adversaries 
like Russia, China, North Korea, and Iran. Other times they are carried 
out by criminals operating purely on their own behalf, known as non-
state actors.
    According to a 2022 Cyber Threat Report by SonicWall, an internet 
cybersecurity company, ransomware attacks in the United States rose by 
98 percent last year to record-high levels. And a separate report by 
the CyberEdge group found that nearly two-thirds of ransomware victims 
paid the ransom to regain access to their systems and data. In Michigan 
alone, we have heard from the State's chief information officer that 
hackers try more than 90 million times a day to get into the State's 
servers. Let me say that again: 90 million times a day.
    Ransomware has become a kitchen-table issue for Michiganders. It 
affects the people and organizations we rely on every day--as our 
schools, small businesses, hospitals, and other organizations have been 
threatened by--and have even fallen victim to--ransomware attacks. When 
I first started as a Member of Congress, town supervisors, mayors, and 
local officials all surprised me by raising protecting data as 
something they were deeply concerned about. They were right to be 
concerned. From my first day as your Congresswoman, we have seen 
significant ransomware attacks against our critical infrastructure, 
local governments, entire hospital systems and school districts, all 
the way down to local mom-and-pop small businesses.
    As a Nation, two high-profile ransomware attacks last year, one on 
the Colonial Pipeline and one on the JBS Meat Company, showed Americans 
how vulnerable our critical infrastructure can be to these attacks, and 
how damaging the consequences can be. But many ransomware attacks have 
been much more hyper-local to Michigan's 8th district, and that is why 
I am hosting this hearing here in East Lansing as opposed to in 
Washington. We have seen entire cities and townships targeted in these 
attacks. Local governments have had to create entire new websites, new 
email addresses, and new software to resolve the attack. All things 
which cost time and resources.
    In a February Detroit Free Press article, Sgt. Matt McLalin, who 
investigates cyber attacks in the State Police's cyber command center, 
said local and county governments make up a lot of the center's 
victims. ``Every single week we are getting multiple reports of local 
governments who have been affected,'' McLalin said. When an entire 
local government can be taken off-line by a cyber criminal operating 
across the world, we have a significant issue that needs to be 
addressed. It's not just governmental entities that have been affected, 
either.
    Last fall, I met with school superintendents from across my 
Congressional district in my office in the District of Columbia. I 
asked them to raise their hands if they or their students had been hit 
by a ransomware attack--and every single hand in the room went up. We 
have seen schools come under attack in Walled Lake, Monroe, Richmond, 
and across the State. Just last month, classes at Kellogg Community 
College were canceled for 2 days as school officials noticed some 
issues with the computer systems related to a ransomware attack.
    Two years ago, Michigan State University was targeted by this 
increasingly prevalent type of cyber attack, which cost the university 
more than $1 million to recover from. Cyber criminals operating in 
permissive environments like Russia and China have launched attacks 
aimed at holding our kids' educations, their school records, and their 
futures hostage because they presume that schools and parents will pay 
virtually any cost to shield children from educational disruptions.
    As I alluded to earlier, it is not just our schools and our kids 
who are threatened. Ransomware attacks have disrupted hospital systems, 
gas pipelines, and--as the workers at JBS's processing plant in 
Plainwell know, it has threatened our Nation's food supply and our 
farmers' livelihoods. Further endangering our Nation's food supply, we 
have seen ransomware attacks targeting the manufacturers of 
agricultural equipment and the data they collect. Ransomware attacks 
are a threat to people from the smallest family farm to the biggest 
Fortune 500 company, but it is the ordinary American, the farmer, 
schoolteacher, and small business owner, who bears the brunt of these 
attacks.
    Just this past weekend, I heard from constituents in Brighton that 
they were fundraising for the owners of a local bookstore in Detroit, 
which was hit by a cyber attack and was forced to personally cover over 
$35,000 in losses. That business, still fragile from the impacts of the 
pandemic, is now facing the prospect of imminent closure as a result of 
the attack. Computer systems are complex. Small businesses and local 
governments are already stretched thin, and not everyone can afford to 
have cyber insurance or an IT and/or cyber specialist on the payroll to 
respond.
    That is why today's hearing is so important. We designed this 
hearing to help connect the average person with experts who can help 
them protect themselves. People want to know where to go when they are 
the victim of a ransomware attack. Do they call 9-1-1? Do they call the 
FBI? Do they call the State Police? Where should people turn when they 
realize someone is trying to steal data that they are responsible for 
protecting? People want to know what to do when they turn on their 
computer or cash register only to find out they are locked out by 
hackers demanding large sums of money, often in the form of 
cryptocurrencies, that they can't afford.
    I have heard from constituents across many different industries 
about how concerned they are about the threat of ransomware. They feel 
like it's their business, their data, that is on the front lines facing 
this threat. They are especially concerned because they don't know what 
their Government is doing to protect them. I don't just want to draw 
attention to the problem: I want to use this hearing to discuss the 
ways that we are keeping Americans on the front lines of the ransomware 
threat and their data safe.
    I am pleased to welcome witnesses who I know are working hard to 
combat ransomware and other cyber attacks every day, and who are eager 
to help us answer these questions. Visiting us from Washington are two 
representatives from the Department of Homeland Security (DHS)--Mr. 
Iranga Kahangama and Mr. Matt Hartman. Mr. Kahangama--who was integral 
to the Federal Government's response to the ransomware attacks on 
Colonial Pipeline and JBS Foods--is responsible for cyber and 
infrastructure protection strategic planning and analysis at DHS. At 
DHS's Cybersecurity and Infrastructure Security Agency or CISA, Mr. 
Hartman works on the front lines with partners at the State and local 
levels, as well as in the private sector, to defend against today's 
cyber threats and build security and resiliency.
    On our second panel we will be hearing from one of our State's best 
cybersecurity experts--Mr. James C. Ellis, commander of Michigan State 
Police's Cyber Command Center. I look forward to hearing from our 
witnesses on the critical work they are doing to defend our local 
communities, our State, and our country, from the rising threat of 
ransomware and how they are partnering with the private sector to build 
resilience to ransomware attacks before they occur, because we know 
that the best way to defend against a ransomware attack is to take 
steps to protect yourself before an attack occurs.

    Chairwoman Slotkin. So, with that, I am pleased to welcome 
our witnesses, who are working very hard on this threat and 
other cyber attacks and threats every day. We are eager to get 
to questions--I know we have members on screen visiting us from 
Washington.
    Our two representatives from the Department of Homeland 
Security, Mr. Iranga Kahangama--can you say it for me so I say 
it right?
    Mr. Kahangama. Thank you. Kahangama.
    Chairwoman Slotkin. Kahangama. And Mr. Matt Hartman. The 
former was integral to the Federal Government's response to the 
ransomware attacks on both Colonial Pipeline and JBS Foods. He 
is responsible for cyber and infrastructure protection 
strategic planning and analysis at the Department of Homeland 
Security.
    Mr. Hartman, he is DHS's cybersecurity and infrastructure 
security--he is working on the front lines of CISA, which is 
the Cybersecurity and Infrastructure Security Agency. He 
partners with State and local officials, as well as in the 
private sector, to defend against today's cyber threats.
    In our second panel, which will take place just after this, 
we will be hearing from one of our State's best cybersecurity 
experts, Mr. James Ellis, commander of Michigan State Police's 
Cyber Command Center.
    I look forward to hearing from our witnesses on their 
critical work and what they are doing to defend our State and 
local officials, because we know that the best way to protect 
against a ransomware attack is to take steps to protect 
yourself before the attack actually occurs.
    Before I formally welcome our panel of witnesses, Members 
on screen are reminded that the subcommittee will operate 
according go the guidelines laid out by the Chairman and 
Ranking Member of the full committee in their February 3, 2021 
colloquy regarding remote procedures. Other Member statements 
may be submitted for the record.
    [The statement of Chairman Thompson follows:]
                Statement of Chairman Bennie G. Thompson
                             June 28, 2022
    I am pleased that Intelligence and Counterterrorism Subcommittee 
Chairwoman Slotkin is holding this hearing on such a pressing issue, in 
her district with her constituents.
    It is so important for communities to be heard, and hearings like 
these are a part of the Committee on Homeland Security's process to 
safeguard the American people and the Homeland from all threats, 
including cyber threats.
    Cybersecurity is a topic that Chairwoman Slotkin has championed 
since she came to Congress, and she has worked tirelessly to keep the 
people of Michigan safe from cyber crime.
    Given her extensive background in National security, she knows the 
threats we face whether at home, abroad, or in cyber space.
    Her leadership led to new legislation that would provide cyber 
forensics training for State and local law enforcement and create an 
program to help ensure the Government is prepared for a major cyber 
attack.
    Her work leading this subcommittee and as a Member of the 
Subcommittee on Cybersecurity, Infrastructure Protection, and 
Innovation has focused on emerging digital security issues that affect 
all of us--from the way we use our banks to the safety of our 
children's schools to how we can protect ourselves from criminals' 
latest techniques.
    The internet is wired into nearly every part of our life--our 
homes, our cars, our schools, our businesses. It has become as 
important a utility as water, gas, and electricity.
    But it has also become perhaps the greatest tool for criminal 
mischief and theft in history.
    In what we call ransomware attacks, cyber criminals seize computer 
systems, data, and electronic devices with the expectation that victims 
will be willing to pay a ransom to regain access to their electronic 
systems.
    Ransomware attacks have surged both in frequency and in the amount 
demanded by hackers. In 2020, an estimated 2,400 governments, 
hospitals, and school districts in the United States were victims of 
ransomware attacks, and the average payment was $312,493.
    According to data from the Cybersecurity and Infrastructure 
Security Agency (CISA), reported losses continued to increase last 
year.
    As ransomware tactics and techniques continue to evolve, we can 
expect more incidents and more losses unless we do something to address 
the root causes of the issue--both in Government and the private 
sector.
    Thanks to the Biden administration, we have a National cyber 
director working to coordinate all of the Executive branch's work in 
cyber space.
    The administration has also ensured that CISA is working across 
Government agencies to improve our collective defense and with the 
private sector to ensure it has the tools to detect, disrupt, and 
investigate cyber criminals.
    In Congress, the Committee on Homeland Security has championed 
several critical pieces of legislation to combat the ransomware threat, 
including bills that:
   provide $1 billion in grants to State, local, Tribal, and 
        territorial governments over the next 4 years to enhance their 
        cybersecurity preparedness;
   make cyber incident reporting mandatory including the 
        disclosure to CISA of ransom payments within 24 hours;
   direct CISA to conduct a study on K-12 cybersecurity and 
        provide cybersecurity recommendations to K-12 educational 
        institutions, which have faced numerous ransomware attacks in 
        recent years; and
   authorize the Secret Service to continue training local, 
        State, Tribal, and territorial law enforcement on cybersecurity 
        investigations and responding to cyber incidents, including 
        ransomware.
    I am grateful for Chairwoman Slotkin's leadership and that of her 
committee colleagues on these important measures.
    Although the Federal Government has made great strides in 
bolstering our defenses, as the threat of ransomware continues to 
disrupt many aspects of our daily lives, we must make sure that 
Americans know what resources are available to them--at both the 
Federal and State level.
    It is imperative that the public knows how to keep themselves safe 
from ransomware attacks, and if they do fall victim to an attack, who 
they can reach out to for help.
    If your car is stolen or your home is broken into, people know to 
call the police or 9-1-1--but when it comes to cyber theft, that common 
knowledge of who to call for help is not broadly known.
    Today's witnesses--representatives from DHS and its cyber-focused 
component CISA, and the State of Michigan--are in a position to help us 
understand ransomware prevention best practices, and what to do and who 
to call when catastrophe strikes.
    Again, I thank Subcommittee Chairwoman Slotkin for convening this 
hearing and for her leadership on this critical issue.

    Chairwoman Slotkin. Without objection, Members not on the 
subcommittee shall be permitted to sit and question the 
witnesses.
    Sorry for my Michiganders. This is a bunch of procedural 
things that are important in Congress.
    All right. I now welcome our first panel of witnesses.
    Without objection, the full witnesses' statements will be 
inserted into the record.
    I now ask each witness to summarize his statement for 5 
minutes, beginning, sir, with Mr. Kahangama. Please go ahead.

 STATEMENT OF IRANGA KAHANGAMA, ASSISTANT SECRETARY FOR CYBER, 
   INFRASTRUCTURE, RISK, AND RESILIENCE, OFFICE OF STRATEGY, 
    POLICY, AND PLANS, U.S. DEPARTMENT OF HOMELAND SECURITY

    Mr. Kahangama. Thank you. Madam Chairwoman Slotkin, 
distinguished Members of the subcommittee, and other Members of 
Congress joining us today. Thank you for inviting me to testify 
about the Department of Homeland Security's efforts to combat 
ransomware.
    On a personal note, this is my first time testifying. As 
the son of immigrants from Shri Lanka, it is an honor to be in 
front of you today.
    With that, I recently passed the 1-month mark serving as 
the assistant secretary for cyber infrastructure, risk, and 
resilience at the Department of Homeland Security. My title, 
while long, is reflective of the holistic approach that the 
Department takes to ransomware and cybersecurity writ large. We 
are focused on critical infrastructure. We want to minimize the 
risk posed from cyber attacks, and we want to ensure the 
resilience of critical services that are provided to this 
country.
    Today I will talk about the multi-pronged approach we are 
taking to combat ransomware and apply this framework to 
cybersecurity. As you mentioned, Chairwoman, ransomware 
attackers lock up our critical computer systems and then demand 
payment in order to regain access. They do not discriminate, 
they target large and small targets, whether it is large 
corporations, small and medium enterprises, hospitals, local 
governments, or schools. As you mentioned as well, often the 
cost of cleaning up an attack can be more expensive than paying 
the ransom itself, or to provide mitigating services 
beforehand.
    I also want to acknowledge the downstream real-world impact 
that these have on our everyday services. As you mentioned, 
this happened with Colonial Pipeline where we had gas 
shortages, this happened to our food production when JBS was 
also attacked last year, and as you mentioned, a slew of 
attacks on Michigan itself.
    These are real issues and I want to make clear that the 
Department recognizes these.
    So today I want to talk a little bit about what the 
Department does before, during, and after a ransomware attacks.
    So before an attack, the Cybersecurity and Infrastructure 
Security Agency, CISA, helps businesses and small business and 
critical infrastructure owners increase their ability to 
prevent a ransomware by rapidly sharing threat information and 
sharing cybersecurity best practices. I am honored to be here 
today with Matt, who will further provide information about 
CISA's role.
    Last year Secretary Mayorkas conducted a 60-day sprint on 
combatting ransomware to shore up the Department's efforts on 
this case. As a result, we now have stopransomware.gov, which 
is a one-stop, holistic, centralized repository with all 
information that you need before and during an attack to help 
mitigate against ransomware incidents.
    During an attack I want to highlight quickly the Department 
of Homeland Security's investigative agencies, which include 
the U.S. Secret Service and Homeland Security Investigations. 
These agencies work side-by-side with victims, international 
law enforcement, and domestic law enforcement to investigate 
and mitigate the threat posed by ransomware actors.
    I appreciate your mention of cryptocurrency as the 
Department is rapidly increasing our ability to investigate 
cryptocurrency because it is the preferred payment method for 
ransomware actors. We are actively getting tools and learning 
how to track and trace cryptocurrencies so we can better 
disrupt and potentially claw back some of this money.
    Of course, the Department also works in concert with the 
Department of Justice to arrest and indict these individuals 
when we can.
    As you mentioned, Chairwoman, these actors are often in 
permissive environments that do not cooperate with us, 
including Russia. But that does not stop us from working with 
international partners to seize and track these funds and 
otherwise disrupt their criminal activity.
    Finally, I want to hit on after an attack. I am excited to 
mention that DHS is now standing up the Cyber Safety Review 
Board, which is a unique combination of public-sector and 
private-sector individuals charged with reviewing major cyber 
attacks, including ransomware attacks, to provide 
recommendations of how to better our cybersecurity.
    DHS remains committed to improving our Nation's 
cybersecurity, shoring up our defenses, improving the 
resiliency, and then holding actors accountable.
    Chairwoman Slotkin, by holding these types of hearings, it 
is clear to us that you are committed to this issue. I also 
want to thank you for passing legislation such as the K-12 
Cybersecurity Act. It is evident that you are a partner with us 
and we commend you for this. We look forward to working with 
you.
    With that, I would like to thank the committee and I look 
forward to taking your questions.
    [The joint prepared statement of Mr. Kahangama and Mr. 
Hartman follows:]
     Joint Prepared Statement of Iranga Kahangama and Matt Hartman
                             June 28, 2022
                              introduction
    Chairwoman Slotkin, Ranking Member Pfluger, and distinguished 
Members of the subcommittee, thank you for inviting us to testify today 
regarding the continued threat of malicious cyber activities, 
specifically ransomware, and the constant risks posed to Americans, as 
well as to our businesses and other institutions. Our testimony today 
highlights the Department of Homeland Security's (DHS) efforts to 
counter these risks. These efforts are made in coordination with the 
Biden-Harris administration's counter ransomware initiatives, and our 
partners in Federal, State, local, Tribal, and territorial governments 
(SLTT), the private sector, and internationally.
    Since Under Secretary Silvers and Executive Director Wales 
testified before your subcommittee last November, DHS has continued to 
combat the non-stop threat of cyber crime with several notable 
successes. However, these cyber threats continue to evolve, and we must 
therefore continue to evolve the methods that we use to investigate 
cyber-criminal activity and increase our Nation's resilience against 
future attacks. Our joint testimony today reinforces that our approach 
to cyber crime must be multi-pronged. We must pursue a comprehensive 
strategic approach that prioritizes close partnerships with law 
enforcement, both domestic and foreign, as well as the private sector, 
and combines our efforts to:
   disrupt cyber-criminal activity;
   increase resilience of entities and individuals to 
        ransomware incidents;
   target those virtual currency exchanges and on-line dark 
        marketplaces that enable the ransomware threat through 
        obfuscation of illicit payments;
   investigate transnational cyber crime and organized criminal 
        groups; and
   strengthen foreign law enforcement partner capacity through 
        training and technical assistance.
    Most cyber crime is transnational, including ransomware, with 
criminal activity moving seamlessly across borders. These crimes impact 
Americans in all 50 States, including Michigan's 8th Congressional 
district. For example, in 2016, the Lansing Board of Water and Light's 
administrative services were taken over by hackers as a result of a 
ransomware attack. Furthermore, in 2020, Michigan State University was 
a victim of a ransomware attack over Memorial Day. More broadly, DHS 
does successfully investigate cyber crimes in Michigan. Recently, U.S. 
Secret Service (Secret Service) agents from the Detroit Field Office 
successfully investigated a business email compromise case where they 
were able to return almost $5 million to the victim company.
    DHS, in close partnership with the Federal Bureau of Investigation 
(FBI) and other law enforcement partners, prioritizes investigating 
cyber crimes, arresting those responsible, and seizing illicit funds 
and returning them to the victims. In addition, the Department engages 
the private and public sectors on how to increase their cyber 
resilience to fend off these attacks.
   the biden-harris administration's approach to fighting ransomware
    Ransomware threat actors' motives are clear--their goal is profit. 
These opportunistic criminals go after a wide array of victims--
individuals, businesses, hospitals, police departments, and even 
municipal governments. These criminals encrypt valuable data in an 
attempt to force their victims to pay ransoms using virtual currencies, 
with no guarantee the criminal actors will provide a decryption key to 
restore the victims' files once the ransom is paid. Victims who choose 
not to pay are saddled with the cost- and labor-intensive burden of 
restoring their systems from backups and, increasingly, threatened with 
the public release of their stolen data by the criminal actors. The 
administration will not allow criminals to hold innocent American 
citizens and businesses hostage for ransom, or to extort victims with 
stolen private information, such as health records, without 
consequence.
    The landscape of ransomware actors has undergone several shifts 
since the subcommittee's November 2021 hearing, driven in part by the 
Russian-Ukraine conflict. We observed some ransomware groups adopting 
political stances, such as the Conti ransomware group's initial pledge 
of support to Russia at the outset of the invasion of Ukraine. We also 
witnessed Conti become increasingly emboldened in their demands. For 
example, in May, Conti threatened to overthrow the Costa Rican 
government if ransoms were not paid, according to published reports. 
These criminal actors are resilient and resourceful. When victims stop 
agreeing to pay ransom, or a ransomware operation is the subject of a 
law enforcement action, the actors move on to different victims and 
stand-up new ransomware groups.
    Therefore, the Department must be equally resilient and 
resourceful, utilizing a whole-of-government counter-ransomware 
initiative with domestic and international partners to go after 
criminals while simultaneously promoting cybersecurity resilience 
across our critical infrastructure and American businesses. DHS's 
strategy is multi-pronged: Target and dismantle criminal ransomware 
organizations; target the digital asset ecosystem that criminals use to 
transfer illicit funds; and increase resilience in our Nation's 
critical infrastructure and public sector, through education and 
information sharing.
    These partnerships continue to pay off in the fight against 
ransomware as demonstrated in March when an Estonian national was 
sentenced to 66 months in prison and $36 million in restitution for his 
role in exploiting stolen financial account information and use of 
ransomware.\1\ The arrest and subsequent indictment were the result of 
the international partnership between the Secret Service, Latvian State 
Police, and Estonian Police.
---------------------------------------------------------------------------
    \1\ See, ``Cybercriminal Connected to Multimillion Dollar 
Ransomware Attacks Sentenced for Online Fraud Schemes'' at, https://
www.justice.gov/usao-edva/pr/cybercriminal-connected-multimillion-
dollar-ransomware-attacks-sentenced-online-fraud.
---------------------------------------------------------------------------
    Last year Secretary Mayorkas commenced a 60-day sprint as a call 
for action to tackle ransomware.\2\ As a result, DHS, along with 
colleagues across the U.S. Government, launched 
``StopRansomware.gov,''\3\ our official central website for resources 
from across the Federal Government community to tackle ransomware more 
effectively. The purpose of this website is to help public and private 
organizations defend against the rise in ransomware attacks by 
providing guidance on protection, detection, and response all on a 
single website. As of June 2022, StopRansomware.gov received over 
280,000 visits.
---------------------------------------------------------------------------
    \2\ See Secretary Mayorkas Outlines His Vision for Cybersecurity 
Resilience (March 31, 2021), available at https://www.dhs.gov/news/
2021/03/31/secretary-mayorkas-outlines-his-vision-cybersecurity-
resilience.
    \3\ See New StopRansomware.gov Website--The U.S. Government's One-
Stop Location to Stop Ransomware (July 15, 2021), available at https://
us-cert.cisa.gov/ncas/current-activity/2021/07/15/new-
stopransomwaregov-website-us-governments-one-stop-location.
---------------------------------------------------------------------------
    the cybersecurity and infrastructure security agency efforts on 
                               ransomware
    One of the Cybersecurity and Infrastructure Security Agency's 
(CISA) core functions is to foster resilience. It played a leading role 
for DHS in launching ``StopRansomware.gov.'' In January 2021, CISA 
launched a ``Reduce the Risk of Ransomware'' awareness campaign.\4\ 
This campaign promoted resources and best practices to mitigate the 
risk of ransomware and focused on supporting COVID-19 response 
organizations and K-12 institutions. Further, CISA expanded its 
publicly available information to include a ransomware guide, fact 
sheets, tool kits, on-line training resources, and educational 
webinars.
---------------------------------------------------------------------------
    \4\ See CISA Launches Campaign to Reduce the Risk of Ransomware 
(Feb. 16, 2021), available at https://www.cisa.gov/news/2021/01/21/
cisa-launches-campaign-reduce-risk-ransomware.
---------------------------------------------------------------------------
    CISA continues to take many proactive steps to prevent ransomware. 
These efforts include hundreds of engagements focused on cybersecurity 
and combatting ransomware. CISA routinely engages with SLTT partners, 
including events specifically for Governors and county leaders, as well 
as the private sector. In addition, CISA continues to release cyber 
alerts containing technical details and mitigation measures. These 
alerts, often issued jointly with interagency partners and increasingly 
with foreign partners, provide timely information about current 
security issues, vulnerabilities, and exploits. Several recent examples 
include information on BlackMatter ransomware, Conti ransomware, and 
on-going cyber threats to water and wastewater systems. Effective 
confrontation of the ransomware threat relies on visibility and 
awareness, which CISA provides through email and other subscription 
services.
    Visibility and awareness also require information sharing and 
collaboration. In August 2021, CISA launched the Joint Cyber Defense 
Collaborative (JCDC) to lead the proactive development of the Nation's 
cyber defense plans, which outline activities to reduce the prevalence 
and the impact of cyber intrusions, such as ransomware. JCDC promotes 
National resilience by coordinating actions to identify, protect 
against, detect, and respond to the malicious cyber activity targeting 
U.S. critical infrastructure or National interests. Building on the 
authorities included in the fiscal year 2021 National Defense 
Authorization Act, the JCDC includes the joint cyber planning office, 
but recognizes that that there is a full suite of capabilities 
necessary to truly make a difference for our Nation's cybersecurity 
posture. The JCDC brings together leading technology, communications, 
and incident response companies, as well as all relevant Federal 
agencies, to unify and integrate prevention and response planning. The 
JCDC establishes a unique entity that can proactively provide 
visibility into a common operating picture of the threat environment 
through close partnership with the private sector and the Federal cyber 
ecosystem.
    The Nation's security and resilience in the face of the ransomware 
threat relies on a collective, unified approach across the Federal 
Government that combines the full suite of relevant interagency 
authorities and capabilities. As designated in the Cyber Incident 
Reporting for Critical Infrastructure Act of 2022 (CIRCIA), CISA will 
establish a Joint Ransomware Task Force to coordinate an on-going 
Nation-wide campaign against ransomware attacks. CISA and the FBI will 
serve as co-chairs of this Federal task force, which will organize and 
orchestrate the spectrum of U.S. Government activities to address the 
ransomware threat, from protection and mitigation to intelligence 
prioritization and disruption.
            dhs investigative efforts to combat cyber crime
    The world's economy is rapidly changing and becoming more 
digitized. In partnership with international law enforcement partners, 
the Secret Service has achieved notable successes in combatting cyber-
enabled financial crimes, including dismantling two early centralized 
virtual currency providers that supported extensive criminal activity: 
e-Gold Ltd.\5\ and Liberty Reserve.\6\ Additionally, in 2020, the 
Secret Service, with domestic and international partners, successfully 
investigated a Russia-based criminal scheme.\7\ The investigation led 
to the seizure of millions in cryptocurrency and indictments of two 
Russian nationals.
---------------------------------------------------------------------------
    \5\ See, U.S. Department of Justice: ``Over $56.6 Million Forfeited 
In E-Gold Accounts Involved In Criminal Offenses,'' https://
www.justice.gov/usao-md/pr/over-566-million-forfeited-e-gold-accounts-
involved-criminal-offenses; Digital Currency Business E-Gold Indicted 
for Money Laundering and Illegal Money Transmitting, https://
www.justice.gov/archive/opa/pr/2007/April/07_crm_301.html.
    \6\ See, U.S. Department of Justice press releases: ``Founder of 
Liberty Reserve Pleads Guilty to Laundering More Than $250 Million 
Through His Digital Currency Business,'' https://www.justice.gov/opa/
pr/founder-liberty-reserve-pleads-guilty-laundering-more-250-million-
through-his-digital; ``Manhattan U.S. Attorney Announces Charges 
Against Liberty Reserve, One of World's Largest Digital Currency 
Companies, and Seven of Its Principals and Employees for Allegedly 
Running A $6 Billion Money Laundering Scheme,'' https://
www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-charges-
against-liberty-reserve-one-world-s-largest.
    \7\ See, ``Russian Nationals Indicted for Conspiracy to Defraud 
Multiple Cryptocurrency Exchanges and Their Customers,'' https://
www.justice.gov/usao-ndca/pr/russian-nationals-indicted-conspiracy-
defraud-multiple-cryptocurrency-exchanges-and; ``Treasury Sanctions 
Russian Cyber Actors for Virtual Currency Theft,'' https://
home.treasury.gov/news/press-releases/sm1123.
---------------------------------------------------------------------------
    Central to these successes is the global network of 44 Secret 
Service-led Cyber Fraud Task Forces (CFTFs). The mission of these CFTFs 
is to partner with SLTT and foreign law enforcement agencies, private 
and public sectors, and academia for information sharing and conducting 
joint investigations. The Secret Service also operates 19 international 
attache offices around the world, partnering with the global law 
enforcement community to combat transnational financial crimes.
    Participation in these task forces is bolstered through Secret 
Service-led law enforcement training programs at the National Computer 
Forensics Institute (NCFI). At NCFI, the Secret Service trains SLTT law 
enforcement personnel, prosecutors, and judges on preventing, 
mitigating, and responding to malicious cyber activities, including 
ransomware. Personnel who receive training serve as force multipliers 
complementing Secret Service CFTFs. Currently the NCFI's authorizing 
legislation (6 U.S.C.  383) limits NCFI to training SLTT law 
enforcement officers. Congress is currently considering legislation to 
re-authorize NCFI, which could incorporate an authorization to train 
foreign partners.\8\ In addition, Homeland Security Investigations 
(HSI) and Secret Service agents regularly participate in capacity-
building workshops delivered through the U.S. Transnational and High-
Tech Crime Global Law Enforcement Network (GLEN), a U.S. State 
Department Bureau for International Narcotics and Law Enforcement 
Affairs (INL)-funded initiative where digital forensics experts and 
long-term Federal agents deliver training and technical assistance to 
foreign partners that enables them to better cooperate with U.S. 
authorities, including on ransomware and criminal misuse of 
cryptocurrency investigations.
---------------------------------------------------------------------------
    \8\ H.R. 7174--National Computer Forensics Institute 
Reauthorization Act of 2022. Available at: https://www.congress.gov/
bill/117th-congress/house-bill/7174.
---------------------------------------------------------------------------
    Today, the Secret Service coordinates, integrates, and shares 
information on ransomware cases through the FBI-led National Cyber 
Investigative Joint Task Force (NCIJTF), where a Secret Service agent 
leads the Criminal Mission Center. Through the NCIJTF, the Secret 
Service works hand-in-hand with partners from the Departments of 
Justice, including the FBI, State, Treasury, and other domestic and 
foreign partners. The Illicit Virtual Asset Information Notification 
system, a joint effort between multiple agencies, operates from the 
NCIJTF and, once fully operational, will enable increased partnership 
between Federal law enforcement and the private sector to detect and 
disrupt ransomware and other illicit virtual currency payment flows.
    U.S. Immigration and Customs Enforcement's (ICE) Homeland Security 
Investigations (HSI) has 80 offices in over 50 countries and works to 
combat cyber crime, including ransomware, through its Cyber Financial 
Section of the Financial Crimes Unit, which provides training to 
international partners and analytical assistance in tracing digital 
assets. In addition, HSI's Cyber Crimes Center (C3) has led numerous 
cyber-related trainings with foreign law enforcement partners. In 2020, 
HSI, working with the Departments of Justice and the Treasury, 
dismantled three terrorist financing cyber-enabled campaigns--involving 
al-Qaeda, Hamas's al-Qassam Brigades, and ISIS.\9\ Since January 2020, 
HSI C3 conducted in-person and virtual training covering on-line 
investigations, dark web, and cryptocurrency investigations for law 
enforcement partners in over 20 countries. Some of this training was 
conducted in coordination with the HSI Financial Crimes Unit. For 
example, in May 2022, HSI C3 provided network intrusion investigations 
training to law enforcement officials in Panama.
---------------------------------------------------------------------------
    \9\ See, ``Global disruption of 3 terror finance cyber-enabled 
campaigns,'' Global disruption of 3 terror finance cyber-enabled 
campaigns/ICE.
---------------------------------------------------------------------------
    Additionally, HSI initiated Operation Cyber Centurion, a cyber 
threat intelligence initiative that proactively detects vulnerabilities 
in critical infrastructure and works with victims to remediate the 
vulnerabilities before they are exploited. These vulnerabilities are 
often used to enable the theft of sensitive data or the disruption of a 
functioning system and are commonly used in ransomware attacks. Cyber 
Centurion is designed to significantly disrupt adversary plans to 
exploit the internet to subvert U.S. laws and threaten the economic 
integrity, public safety, and National security of the United States. 
The initiative is in alignment with CISA's priorities for the 
protection of critical infrastructure.
    DHS is committed to strengthening the law enforcement capabilities 
of Secret Service, HSI, and other law enforcement partners to 
investigate all forms of cyber crime within our authorities and arrest 
those responsible.
                       international partnerships
    Cyber criminals and nation-state actors will continue to view 
ransomware as an effective means to fund themselves and cause 
disruptive effects in critical infrastructure. It will take a global 
effort to stop them. To combat transnational cyber crime, including 
ransomware, both the Secret Service and HSI maintain close partnerships 
with a wide array of foreign law enforcement agencies. The Secret 
Service is the first U.S. law enforcement agency to have permanent 
representation at Europol with an attache assigned to the Joint Cyber 
Crime Action Taskforce at Europol's European Cyber Crime Centre.
    In March, DHS hosted the Cross-Border Crime Forum with our Canadian 
partners to make our nations safer and committed to working together to 
combat ransomware, strengthen security and resilience of critical 
infrastructure against these threats, as well as increase reporting of 
ransomware incidents. In May, DHS leadership attended the Ottawa 5 
meeting in London, where discussions focused on combatting ransomware.
    Last fall, the United States hosted a Counter-Ransomware Initiative 
meeting with international partners from more than 30 countries. 
Delegates discussed common challenges, approaches, and opportunities to 
advance international cooperation to achieve shared goals. DHS serves 
as the lead for the United States on the sub-group focused on 
resilience. DHS, together with the Departments of Justice, State, and 
Treasury, also recently participated in the initial meeting of the 
U.S.-E.U. Ransomware Working Group.
    The Department continues to work together with like-minded foreign 
partners to target, identify, and prosecute cyber criminals, disrupt 
their malicious IT infrastructure, and shut down financial networks 
used to launder illicit proceeds. In April 2022, the Secret Service 
announced that an international operation, organized by Europol and 
conducted in partnership with the FBI, resulted in the seizure of the 
RaidForums website--a popular marketplace for cyber criminals to 
purchase and sell hacked data. This successful outcome was the result 
of combined efforts between the Secret Service, other Federal agencies, 
as well as international partners, including the United Kingdom's 
National Crime Agency.\10\
---------------------------------------------------------------------------
    \10\ See, ``U.S. Leads Seizure of One of the World's Largest Hacker 
Forums and Arrests Administrator,'' https://www.justice.gov/usao-edva/
pr/us-leads-seizure-one-world-s-largest-hacker-forums-and-arrests-
administrator.
---------------------------------------------------------------------------
                               conclusion
    The Department commends Congress for passing the fiscal year 2022 
Omnibus Appropriations bill, which passed in March and included the 
language from CIRCIA. In addition, we greatly appreciate Congress' 
continued support for the cyber training of SLLT law enforcement. 
Centers such as the NCFI provide critical cyber investigation skills 
and tools to our partners needed to prevent, mitigate, and respond to 
cyber incidents.
    DHS is committed to countering the cyber crimes targeting our 
country, our citizens, and our partners around the world. We are 
grateful for the continued support of Congress and to our fellow 
departments and agencies for their support in this effort. Together we 
can ensure the success of DHS's multi-pronged mission to increase cyber 
resilience, disrupt the ransomware ecosystem, and hold accountable 
those who commit these crimes. Thank you again for the opportunity to 
testify and we look forward to your questions.

    Chairwoman Slotkin. Thank you for your testimony.
    I now recognize Mr. Hartman to summarize his statement for 
5 minutes.

STATEMENT OF MATT HARTMAN, DEPUTY EXECUTIVE ASSISTANT DIRECTOR 
 FOR CYBERSECURITY, CYBERSECURITY AND INFRASTRUCTURE SECURITY 
          AGENCY, U.S. DEPARTMENT OF HOMELAND SECURITY

    Mr. Hartman. Excellent. Thank you. Chairwoman Slotkin and 
Members of the committee, thank you for the opportunity to 
testify today on behalf of the Cybersecurity and Infrastructure 
Security Agency, or CISA, to discuss our efforts to elevate 
America's security and resilience against ransomware attacks.
    As the Nation's cyber defense agency, CISA leads the 
National effort to understand, manage, and reduce risk to the 
digital and physical infrastructure that Americans rely on 
every hour of every day.
    Here in Michigan, and in every State across the country, 
ransomware and the threat of cyber attack are top-of-mind 
concerns to schools, to hospitals, to businesses large and 
small, and to so many other organizations. That is why it is 
important that we empower organizations and Americans to help 
us raise the cybersecurity baseline.
    The administration's approach to countering ransomware is 
focused on bolstering resilience. Strengthening resilience to 
withstand ransomware attacks is arguably the most difficult 
element of our collective efforts. I am pleased to testify 
today on CISA's efforts to help tackle this problem.
    Building resilience requires a long-term investment in 
people, processes, and technology. Every organization that 
wants to avoid being the victim of ransomware must continuously 
invest in the practices that will keep their customers, their 
systems, and their data secured.
    The question that we need to ask ourselves is what can we 
do right now to truly have an impact. I will point to two 
things. First, we must give organizations tools and guidance to 
increase their security and resilience. This is why CISA works 
every day to raise awareness and to promote basic cyber hygiene 
across tens of thousands of businesses and government agencies 
throughout our country. Organizations need to raise their 
cybersecurity standards and the guidance that CISA provides is 
meant to provide real-time actionable information to help them 
do so. For you, that means regularly update your software, 
think before you click, avoid suspicious links and phishing 
emails, use strong passwords, and, most importantly, implement 
multi-factor authentication. Adding a second factor for log-in 
makes you 99 percent less likely to be hacked.
    Second, we need to partner with the American people, 
organizations in both the public and private sectors to 
identify threats and vulnerabilities, to develop guidance, to 
conduct outreach, and to ensure that everyone has the 
information that they need to make educated cyber risk 
management decisions.
    CISA is uniquely positioned to build and strengthen 
partnerships with the private sector and with State, local, 
Tribal, and territorial government organizations. A central 
element of our ability to partner with you here in Michigan and 
across the country is CISA's growing presence outside of 
Washington, DC. CISA has cybersecurity advisors now in nearly 
every State, including two here in Michigan, to provide boots 
on the ground help to organizations of all sizes to address the 
growing threat of cyber attack. Additionally, CISA's Joint 
Cyber Defense Collaborative, or JCDC, was launched to drive 
partnership between the Federal Government and private-sector 
companies who possess tremendous visibility into domestic 
networks to help us identify emerging threats and to provide 
timely and actionable cybersecurity guidance to reduce the risk 
of attack for everyone.
    A great example of this guidance is CISA's Shields Up 
messaging campaign which we launched in the lead-up to the 
Russian invasion of Ukraine. Through more than 100 engagements 
with different critical infrastructure sectors and 
organizations, we showed organizations, regardless of size, how 
to strengthen their cybersecurity and resilience. With 
information from the intelligence community and the private 
sector, we use CISA.gov/shields-up to provide evolving threat 
information to serve as the hub for up-to-date technical 
guidance to reduce risk. To date, this is one of CISA's most 
visited pages on CISA.gov.
    Additionally, last summer we launched stopransomware.gov, a 
collaborative U.S. Government resource to help public and 
private organizations tackle ransomware. The web page has had 
more than 830,000 views and the ransomware readiness assessment 
tool that has been downloaded and is available on that site has 
been downloaded roughly 15,000 times. Please help us get the 
message out that this tool is there for organizations across 
America.
    We are working closely with Federal partners to stand up 
the Joint Ransomware Task Force, a new tool Congress gave us, 
which is the governing body to combat ransomware attacks from 
mitigation and protection to intelligence prioritization and 
disruption. CISA is proud to serve as co-chair of the Task 
Force, along with the FBI.
    CISA has been leading this whole-of-Nation effort with 
partners across the Government and private sector, but now more 
than ever we need everyone, including the business and 
government right here in Michigan to work with us to reduce 
this threat because it impacts us all.
    Thank you again for the opportunity to appear before you. I 
look forward to your questions.
    Chairwoman Slotkin. Thank you for your testimony.
    I thank all the witnesses.
    I will remind the subcommittee that we will each have 5 
minute for questions to question the panel.
    I now recognize myself for questions.
    Thank you for your testimony. You know, Mr. Kahangama, we 
have, as I look around the room, some farmers in the room and I 
know that you responded to both the attacks on the Colonial 
Pipeline and the JBS meat processing facility. Can you describe 
some of the specific lessons learned? I mean these are big 
organizations who, you know--we certainly had the head of 
Colonial Pipeline come and testify in front of us and talk 
about some of the security vulnerabilities that they had in a 
very large organization, but if you are a farmer in the State 
of Michigan, you are dependent on some of these large 
organizations to get your product out to market. Can you talk 
about some of the lessons learned from those attacks?
    Mr. Kahangama. Thank you for the question, Chairwoman. 
Absolutely.
    I think one of the lessons learned is that no matter how 
big an organization you are, the smallest cyber vulnerability 
can be quite damaging. I think it is also important to 
understand the connection between regular systems that you may 
use for H.R. or doing paychecks versus all the operational 
components. I think in both of those instances with Colonial 
and JBS we saw relatively small attacks that targeted like a 
payroll system and then out of an abundance of caution the 
entire enterprise shut down. So I think we are all susceptible 
to the lowest common denominator of cybersecurity that is 
provided.
    The other thing that I want to mention is that ransomware 
attackers are quite vigilant and they are looking for 
businesses and services that they know will want to pay. I 
believe the FBI put out an advisory in the wake of JBS not just 
mentioning that vulnerabilities exist, but that ransomware 
actors can and will look for opportune times in cyclical 
seasons, right. With the agricultural and food process and 
grain production for instance, there are certain times of year 
where crops may be more valuable and you would be more likely 
to pay because you need to plan the seed or grow the crops and 
things like that.
    So ransomware actors are actively looking at your business 
time line and looking to target you at opportune times when 
they know you may be more willing to pay.
    So I think being vigilant 24/7 365 days a year, including 
patching those vulnerabilities, were some of the big takeaways 
I took from that.
    Chairwoman Slotkin. Great. Thank you for that.
    Mr. Hartman, a few years ago one of our local 
infrastructure authorities ended up paying $25,000 in ransom to 
unlock their internal communications systems. Responding to 
that attack, in addition, cost them $2.4 million. Luckily the 
attack did not disrupt our--literally our power grid or our 
water distribution networks as they had insurance and provided 
protection against network disruption. There are many 
organizations who do not have that insurance, who do not have 
that cushion. We heard in our previous roundtable from a local 
town supervisor who represents I think less than 2,000 
residents where the ransomware was $40,000, right. It is just--
and luckily they had insurance, or else that would have been 
borne by a local government that just cannot afford it.
    So how can you help--you know, the JBS and the Colonial 
Pipeline, they are very wealthy companies that can hire their 
own IT folks. Tell us what you can do for our smallest 
businesses and who do they call the minute they walk into work 
and there is a problem?
    Mr. Hartman. Thank you for the question, Chairwoman.
    You know, there are four things that I will point to that 
every organization, large or small, should consider. This is as 
applicable to farmers and schools as it is to the Colonial 
Pipelines and the JBS Foods.
    The first I touched on in my opening remarks, which is 
implement multi-factor authentication. This is something that 
every person, every organization should do. A password as a 
sole identifier is no longer sufficient. But implementing a 
second layer, whether that is a fingerprint, facial 
recognition, a text message, email, again, you are reducing 
your risk of being a victim of ransomware by 99 percent.
    To your point, Chairwoman, with 90 million attempts a day 
targeting state systems, we know that this is broad 
indiscriminate and opportunistic scanning and targeting of all 
of our domestic critical infrastructure.
    The second piece is extraordinarily important. To your 
point about not having the resources to pay, it is critical to 
maintain off-line encrypted back-ups and to periodically and 
regularly test that you are able to recover to these back-ups 
so if your data is encrypted you are not forced with the 
decision of whether to pay or not.
    Third, all organizations should develop an instant response 
plan; they should test this plan frequently. It is absolutely 
paramount that cybersecurity starts at the top of the 
organization, at the board level, at the CEO level. These plans 
need to exist. I can speak from experience that organizations 
who are working to develop incident response plans on the fly 
are generally not particularly successful.
    Finally, and to your last question, report your incidents 
to CISA. This is important for two reasons. First, if we do not 
know, we can't help. Secondarily, if we do not know the tactics 
that are being used, if we do not know the infrastructure that 
is being used, we cannot share that information in anonymized 
fashion more broadly to protect the community. So get to know 
your local cybersecurity advisors from CISA, get to know your 
FBI field offices. The real important thing is that you contact 
one of us and then on the back end we will work within the 
Department of Homeland Security, with our peers at the FBI, to 
make sure that we can provide all of the assistance of the 
Federal Government.
    Chairwoman Slotkin. Thank you for that.
    The Chair will now recognize other Members for questions 
they may wish to ask the witnesses.
    In accordance with the guidelines laid out by the Chairman 
and Ranking Member on their February 3, 2021 colloquy, I will 
recognize Members in order of seniority, alternating between 
Majority and Minority where possible. Members participating 
virtually are also reminded to unmute themselves when 
recognized for questioning.
    The Chair recognizes for 5 minutes the gentlewoman from 
Texas, Ms. Jackson Lee.
    Ms. Jackson Lee. Madam Chair, thank you so very much for 
having me this--having this hearing in particular. Again, thank 
you for your enormous leadership. As I have served on this 
committee, it is clear that the importance of both the Homeland 
Security Committee and the Department of Homeland Security, and 
what you have done in this particular committee is to bring 
this knowledge both to our local communities, but as well as to 
listen to them.
    Today we have the opportunity to listen in Michigan and 
understand the growing cyber threats that impact businesses, 
local communities, and of course school and other 
organizations.
    This is crucial and I am looking forward to the continued 
testimony about the pay. ``Ransomware bosses make $90,000 
annually.'' Just to read it, ``If crime doesn't pay, Russian 
ransomware bosses wouldn't know it. The average Russian 
ransomware boss makes $90,000 a year, or 13 times the average 
income for citizens in the country.'' I ask unanimous consent 
to introduce that into the record.
    Chairwoman Slotkin. So ordered.
    [The information follows:]

                         spotlight on security
            Crime Pays: Ransomware Bosses Make $90K Annually
http://www.technewsworld.com/story/83603.html, By John P. Mello Jr., 
        June 14, 2016 5 o'clock AM PT
    If crime doesn't pay, Russian ransomware bosses wouldn't know it.
    The average Russian ransomware boss makes US$90,000 a year--or 13 
times the average income for citizens in the country who stick to the 
``straight and narrow,'' according to a recent Flashpoint study.
    What does a ransomware honcho do for those rubles? Basically, the 
job calls for supporting and maintaining the malware.
    ``The software has to be constantly updated so that antivirus 
systems won't recognize it as malware,'' explained Vitali Kremez, a 
cybercrime intelligence analyst with Flashpoint.
    ``It's not a situation where you provide the malware and sit back 
on a couch waiting for your payments. You have to work on it on a daily 
basis,'' he told TechNewsWorld. ``The boss controls the source code for 
the malware.''
Ransomware as a Service
    The malware model is evolving, according to the Flashpoint study, 
which focuses on the Russian ransomware scene.
    ``A new form of ransomware has been developed that is in effect 
`Ransomware as a Service' (RaaS),'' notes the report. It ``enables 
`affiliates' to obtain a piece of ransomware from a crime boss and 
distribute it to victims as these affiliates wish.''
    That's a departure from the past, when ransomware was available 
only to criminals willing to make a hefty upfront payment for the 
malware--$2,000 to rent or $5,000 to buy. That began to change last 
November, Kremez noted.
    ``We started to see developers considering giving their malware 
free of charge to criminals and keeping 40 to 50 percent of each 
ransomware payment made,'' he said.
    The new business model has lowered the barriers to getting into the 
business. It is not particularly hard for newcomers to start spreading 
ransomware quickly. They can attack corporations and individuals 
through botnet installs, email and social media phishing campaigns, 
compromised dedicated servers and file-sharing websites.
    ``It used to be a one-on-one business,'' Kremez said. ``At this 
stage, it's all automated. We see marketplaces. We see services on the 
dark web where you deposit your money and buy what you have to buy 
without any direct communication with the seller.''
Malicious Infrastructure Growing
    More evidence of the popularity of ransomware is evident in 
Infoblox's latest quarterly report on malicious infrastructure building 
globally.
    To measure that kind of activity world-wide, Infoblox has created a 
threat index. Upon its launch in the first quarter of 2013, the threat 
index was 76. During this year's first quarter, the index reached it's 
highest point ever: 137.
    Activity related to ransomware has fueled the index's rise.
    ``While exploit kits remain a major threat, this latest jump was 
driven in large part by a 35X increase in creation of domains for 
ransom ware over the previous quarter, which in turn drove an increase 
of 290 percent in the overall malware category,'' the report states.
    The activity of malware kit developers is another indicator of 
ransomware's attractiveness to criminals. Kits are used to infect 
devices with a variety of malware programs.
    ``A number of exploit kits and threat actor gangs behind them have 
started adding ransomware to their repertoire over the last few 
months,'' said Sean Tierney, director of cyber intelligence at 
Infoblox.
    ``These are gangs that were using their kits to deliver other kinds 
of malware,'' he told TechNewsWorld, that ``have either started 
including or switched entirely to ransomware.''
    It's likely that the ransomware market will level off as security 
software makers get better at detecting it and consumers get smarter 
about avoiding it, suggested Tierney.
    ``Then the market will become saturated,'' he said, ``and the 
return won't be able to support the amount of activity going on.
Expanding 2FA
    Two-factor authentication, which requires both something you have 
and something you know in order to access an account, has proven to be 
a good way to thwart data thieves. One problem with the technology, 
though, is that it isn't easy for many rank-and-file developers to 
deploy. One authentication company aims to change that with a recently 
launched program.
    Centrify actually goes beyond 2FA to include single sign-in--which 
allows the use of a single set of credentials to log into multiple 
accounts--along with password reset and access control of a device. 
Under the program, developers can plug into those features through 
Centrify system APis.
    ``Developers who are building an application from a great idea 
aren't necessarily expert in security,'' said Chris Webber, security 
strategist at Centrify.
    ``We can give that to them,'' he told TechNews World.
    ``They can take advantage of all the user management and 
multifactor authentication that Centrify's built, so they don't have to 
learn about that world and can concentrate on their great idea,'' 
Webber pointed out. ``It's more and more critical that we need to 
figure out how to put two-factor auth everywhere, because passwords 
alone are just not a great way to do authentication anymore.''
Breach Diary
   May 30. Troy Hunt, who maintains the data breach awareness 
        portal Have I Been Pwned, advises his subscribers that 
        information on 65 million Tumblr accounts is being offered for 
        sale on the dark web.
   May 30. Twitter account of Katy Perry breached and her 89 
        million followers sent tweets filled with profanity and slurs, 
        TechCrunch reports.
   May 31. MySpace announces it has reset the passwords of all 
        accounts created prior to June 11, 2014, due to a data breach.
   May 31. A Federal district court in Pheonix, Arizona, rules 
        that insurance provider Chubb does not have to reimburse P.F. 
        Chang under a cybersecurity policy for payments to credit card 
        processors connected to a 2014 data breach.
   June 1. U.S. Federal Reserve detected more than 50 breaches 
        between 2011 and 2015, including several incidents described in 
        internal documents as espionage, Reuters reports.
   June 1. Medical information of thousands of NFL players is 
        at risk after backback [sic] containing the data was stolen 
        from an athletic trainer's car, Deadspin reports.
   June 1. FBI alerts public that extortion attempts are being 
        made against victims whose personal information has been 
        compromised in recent large data breaches. Extortionists are 
        threatening to make victim's personal informtion public if not 
        paid two to five bitcoins.
   June 1. TeamViewer reports it experienced a service outage 
        due to a DDoS attack, but its systems were not breached by 
        hackers.
   June 2. Medical records of some 40,491 customers of the 
        Stamford Podiatry Group in Connecticut impacted due to a system 
        intrusion, HealthIT Security reports.
   June 2. 2015 payroll tax data of employees of Verify Health 
        Systems in California at risk after an employee was duped by a 
        phishing scam, SC Magazine reports.

    Ms. Jackson Lee. In addition, ``Houston Rockets targeted in 
ransomware attack'', and the idea of it is their network is 
attacked, a sports organization.
    [The information follows:]

       Houston Rockets targeted in ransomware attack, reports say
Channel 13 Eyewitness News, Thursday, April 15, 2021
https://abc13.com/houston-rockets-cyberattack-nba-ransomware-who-cyber-
        attacked-attack-against-team/10517049/
    HOUSTON, Texas (KTRK).--The Houston Rockets insist a recent 
ransomware attack against their network has not impacted the NBA team's 
operations, even though the party claiming responsibility says the 
club's internal business data was stolen, according to reports.
    As reported by Bloomberg News and Reuters on Wednesday, a Rockets 
spokesperson said ``it appears that the unknown actors attempted to 
install ransomware on certain internal systems . . . our internal 
security tools prevented ransomware from being installed except for a 
few systems that have not impacted our operations.''
    Bloomberg reports the hacking group called ``Babuk'' claims on its 
dark web page to have stolen 500 gigabytes of the team's data, 
including contracts, non-disclosure agreements and financial data. 
Babuk is reportedly threatening to publish that information if the team 
declines to pay.
    The Rockets spokesperson acknowledged the claims but wouldn't 
comment further.
    The team added the attack hasn't affected its ability to ``take 
care of our fans, employees, and players.''
    Still, it appears the Rockets are among many businesses rolled into 
a recent spike in ransomware attacks. Check Point Research reports a 50 
percent increase in the daily average of ransomware attack attempts in 
the second half of 2020 compared to the first half.
    In Houston, significant entities including Memorial Hermann and 
Texas Children's Hospital have reported previous breaches.

    Ms. Jackson Lee. So to Mr. Hartman and Mr. Kahangama, let 
me ask you these questions please, and if both of you would 
answer.
    We understand that Michigan, along with other State laws, 
does not require attorneys general to be notified of data 
breaches and they may in fact receive their information by 
media. I would be interested in CISA's status of publishing 
rules about mandatory incident reporting.
    Many of you know that I have introduced legislation on 
zero-day activities and it is important that we protect our 
local communities from that.
    Finally, let me understand more on the work that has been 
done by the administration, the hard work, to prevent 
ransomware attacks from Russia and to find out whether or not 
we have been able to see a decrease or what has happened with 
respect to the ransomware attacks from Russia, particularly as 
they intrude into local communities.
    If you would start first, assistant secretary of policy, 
and then CISA. Both of you can answer in the time that I have 
left.
    Mr. Kahangama. Thank you, Congresswoman. Happy to answer 
those questions.
    I will start with the last one first and speak a little bit 
about the Russian engagement.
    The U.S. Government, you know, did engage with the Russians 
early last year to address the threat of ransomware. President 
Biden has acknowledged it as a National security threat. While 
we did see some arrests occur, the Russian invasion of Ukraine 
has changed the calculus. We have seen some ransomware actors 
declare loyalties or sympathies with the Russian government. We 
have also seen them in Costa Rica target specifically 
governments. I think whether or not the Russians take action, 
we are willing to unilaterally continue the fight against these 
actors. I think you have seen that through the administration's 
approach, which has evolved to not just indictments and 
arrests, but taking back money, disrupting the financial say of 
the cryptocurrency ecosystem as well as using Treasury 
sanctions to disrupt cryptocurrency services that are 
essentially laundering a lot of these funds. We are going to 
continue to take that fight to them, including law enforcement 
actions, along with inter-agency partners.
    Then to the Congresswoman's first question, I want to turn 
it over to CISA.
    Mr. Hartman. Thanks, Iranga, and thank you, Congresswoman.
    Ms. Jackson Lee. Thank you. And your rules, potential 
timing that they may be coming out.
    Thank you.
    Mr. Hartman. Absolutely. Thank you, Congresswoman.
    With respect to the Cyber Incident Reporting for Critical 
Infrastructure Act that was recently passed by Congress, thank 
you. This is going to be monumental in terms of the Federal 
Government being able to understand what is happening from a 
ransomware and a broader cybersecurity perspective and cyber 
incident perspective, as well as take action as a U.S. 
Government to deter future attacks.
    With respect to the implementation of the legislation, we 
are in the process of a very thorough and rigorous rulemaking 
process. We intend to really find the sweet spot in 
implementation between, you know, defining the types of 
incidents that need to be reported to the Federal Government 
and when to allow victim organizations to focus on restoring 
their systems and data, but also in sufficient time providing 
the information to the Federal Government so we can limit the 
impact of a potential campaign and help the broader community.
    Within 24 months we intend to have--be complete with 
rulemaking and work with our partners at the Federal Bureau of 
Investigation to make sure that when CISA receives information 
about ransomware or other cybersecurity incidents from all 
sectors, that we are quickly sharing that information back with 
the FBI, with the Sector Risk Management Agency from any of the 
16 sectors, and with appropriate State and local authorities so 
that we as a community can take action to combat this problem.
    Ms. Jackson Lee. Thank you.
    I yield back.
    Chairwoman Slotkin. Great. Thank you.
    The Chair recognizes for 5 minutes, the gentlewoman from 
Florida, Mrs. Demings.
    Mrs. Demings. Yes, good morning, everyone. Chairwoman 
Slotkin, thank you so very much for this very important and 
timely hearing. Regardless of what part of the country we are 
in, this is a topic that is certainly important to all of us. 
We all represent larger cities and smaller cities and towns and 
rural areas, so thank you so very much for this.
    I do not want to just slaughter the witness' name. I will 
take a stab at it. Mr. Kahangama--if that is wrong, please 
forgive me--you talked earlier about the cost of sometimes 
cleaning up the attack can be less than the--paying the ransom 
itself. As we try to get different organizations to, you know, 
take steps to fight against cyber crimes, establish plans and 
programs, do you find that that in and of itself is just a 
major deterrent to actually developing plans? Or is that 
something that you have, you know, actually looked into?
    Mr. Kahangama. Thank you for the question, Congresswoman.
    I think the more preventative measures that are taken in 
the front end, the cheaper your overall experience is going to 
be within cybersecurity. I think it is always going to be a 
little bit more expensive to deal with the long tail of issues 
that your organization needs to deal with afterwards. You have 
to constantly----
    Mrs. Demings. Do you find that organizations are open to 
that though? That they understand that as opposed to just 
wanting to move on quickly, pay the ransom, let us move on 
quickly? Or are they really open to what you were saying and 
practicing that policy?
    Mr. Kahangama. Thank you.
    I think they are open. I think it is a matter of us 
educating them. I want to also bring in my colleague from CISA, 
who is on the ground with a lot of these companies as well. But 
I do think they are open and unfortunately a lot of them 
discover after it is a little too late.
    But I want to defer to Matt as well.
    Mrs. Demings. Thank you.
    Mr. Hartman. Absolutely. Thank you for the question, 
Congresswoman.
    To my colleague's point, I think that organizations do 
understand and they are increasingly open to that concept. But 
to his other point, they may not know where to begin. This is 
where it is increasingly important that the Federal Government, 
that CISA really help organizations prioritize their scarce 
resources and prioritize their scarce time.
    I will start by flagging that perhaps the most important 
element of what we can do as CISA is our regional cybersecurity 
forces. So for folks in Michigan, for folks across the country, 
if you do not know your CISA regional cybersecurity expert, get 
to know them. They can help you understand the services that we 
have to offer, they can help you prioritize where to begin. One 
service that we offer for free is a ransomware readiness 
assessment that all organizations can use and our CSAs across 
the 50 States can help organizations exercise these plans. We 
also have a suite of services that we call our ``cyber hygiene 
services'' that are scalable and available to all organizations 
in the country. These focus on the most common vectors of 
ransomware. So we have remote phishing campaign assessments, we 
have web application scanning, vulnerability scanning. You can 
sign up for this service for free, you can come to 
stopransomware.gov or CISA.gov, you can contact your local 
advisor and you will be emailed in an automated report every 
week illustrating the biggest challenges that you have and 
really helping your organization, no matter how small or how 
large, begin to prioritize vulnerabilities that you are 
closing, an investment that you are making in cybersecurity.
    Mrs. Demings. Sounds like you have certainly taken the 
steps to make sure that you have the resources and services 
available to organizations. But I guess I am more interested in 
are they taking advantage of it? What steps have you taken to 
make sure they are aware of it?
    You talked earlier about all organizations should have an 
incident response plan. From a regional standpoint--and you can 
pick any region that you want to--have you seen great success 
with organizations developing that response plan? Or is there 
still a lot more work to do?
    Mr. Hartman. Good question, Congresswoman.
    We are seeing increased success by the day, but there 
remains work to do. There are so many organizations in this 
country, many of which, the vast majority of which are owned 
and operated by the private sector that are vital to our 
Nation's critical infrastructure, to our National critical 
functions. We are out there every day, we are increasing our 
field presence every day, we are increasing our resources every 
day. But it is through hearings like this, it is through every 
opportunity that we can to come to the local jurisdictions, 
come to States to talk about what we are doing every day to 
educate on the resources that are available that will really 
begin to, you know, make a big difference across the country.
    Mrs. Demings. Thank you so much.
    Madam Chair, I yield back.
    Thank you.
    Chairwoman Slotkin. Thank you.
    I just want to pile on to Congresswoman Demings' question 
because I think even for the businesses and organizations here 
in Michigan in the room, they did not know that they could go 
to their local CISA representatives and basically get--I mean 
we won't call it an audit, but an assessment of their cyber 
health. I just can't make it any more clear how important I 
think that is, that if you wait until the moment when you have 
an attack and you are not prepared, you have already kind-of 
lost half the battle. I think one of the things that is most 
useful is, one, getting that assessment and then testing it a 
little bit. You know, and I always repeat the story that we did 
at the Pentagon. When I was at the Pentagon they realized that 
they had some vulnerabilities with phishing, right, with like 
even senior three- and four-star generals clicking on a 
phishing link that we got into our email system. So we did our 
own fake phishing email and you could identify exactly which 
individuals in your organization clicked on that link and 
created a vulnerability. Surprise, surprise, it tended to be 
some of our most senior folks. So they took it a lot more 
seriously.
    So I think getting sort-of an assessment of your 
organization is--it is free, it is the most valuable thing that 
CISA can do and they are here based in Michigan. Your 
counterparts are here based in Michigan.
    We will now move to a second round.
    Mr. Kahangama, earlier this month I chaired a hearing on 
cryptocurrencies and I think a lot of people are just--it is a 
really new field for a lot of people. They don't understand how 
cryptocurrency works. We know that terrorist and criminal 
organizations can exploit these products and services to 
advance their plots. Just last week, in response to the large 
number of criminal acts involving cryptocurrency, an 
organization called Chainalysis announced a new service focused 
on crypto incident response to help their clients' response 
when they have been asked to pay in cryptocurrencies.
    Can you just, for the lay person, explain how this works 
and kind-of the frequency with which cryptocurrency is now like 
the currency of choice for these attacks?
    Mr. Kahangama. Thank you for the question, Chairwoman.
    Wholeheartedly agree. It is almost exclusively 
cryptocurrency at this point. These are digital assets, digital 
tokens that are created and then transacted on-line. The issue 
that we are having with them is that they exist in ungoverned 
space, right, whereas when you are taking cash or your paycheck 
to the bank and depositing it, those institutions are required 
to have Know Your Customer laws and identify who you are, 
identify where the money is going. There are laws that if your 
transactions are over a certain amount of money, that that gets 
flagged to the Federal Government for suspicious activity 
reporting. All these types of checks and balances are on those 
transactions. Those don't exist with cryptocurrency. They are 
generated through a number of technical means and then operate 
in an unregulated environment.
    From a law enforcement perspective, from our Secret Service 
and other investigators, it can be difficult because on top of 
the anonymity that exists with the cryptocurrency, there are 
additional services that can mix up all those transactions and 
obfuscate them further, so it becomes even more difficult to 
track and trace. So without kind-of proper regulation and 
oversight of a lot of these cryptocurrencies, we are going to 
continue to be challenged by them.
    Chairwoman Slotkin. So we heard from a local official in 
our first roundtable this morning who talked about how, you 
know, after the attack they went back and this malicious actor 
had like gone in for a minute and tested their systems, then a 
couple of weeks later went in for 12 minutes, tested the 
system, and then was able to access it and ransom for $40,000, 
asking the local officials to translate regular cash into 
cryptocurrency in sending that over. The criminals did it as a 
matter of course and they sort-of used volume as the way to get 
as much money as possible.
    So it is not that there is a live human being I guess on 
the other end of that attack, that they are just like farming 
out all these attacks at the same time.
    Can you explain that a little bit, about how these like 
ransomware farms are working in places, particularly overseas?
    Mr. Kahangama. Sure. Thank you for the question, 
Chairwoman.
    I think it is appropriate to liken a ransomware 
organization almost to a modern-day mob or mafia. It is very 
large structures. There is something called ransomware as a 
service, which you break up a ransomware attack into different 
parts, right. There is initial access, there is deploying 
malware, there is getting the money. These are kits that you 
can literally buy on-line. As a result, anyone with very basic 
technical knowledge can become a ransomware operator 
unfortunately.
    So with this lowest common denominator environment you have 
a proliferation of individuals who are seeking to conduct these 
attacks. The fact is that they like to do onesies and twosies 
in very small increments in order to not go on the radar, 
right, to be undercover a little bit.
    So I think you have ransomware actors growing in terms of 
their sophistication, but at the same time the tools they have 
are becoming quite basic. So you have very low-level people 
conducting these attacks at a much higher frequency with a wide 
availability of these tools. So it is a growing issue.
    Chairwoman Slotkin. Yes. We heard that these bad actors, 
are sort-of cuing their ransom dollar amounts to the size of 
the organization and what they think they can produce and even 
sort-of looking at the revenue of a business, looking at, you 
know, for our schools who have to be transparent about the 
amount of money that they handle, that that helps them gauge 
what to charge in a ransomware attack. I thought that was 
disturbing that they sort-of know their victim and key the cost 
of something that they could reasonably or of some form afford 
so that they actually pay it.
    Mr. Kahangama. That is a real reality. These people kind-of 
want anything they can get. They will do their market research 
on victims, who can afford it, they will look at people who 
have cyber insurance to see if they are more susceptible to 
paying it. They also look to opportune times when they know 
they can't--they lock your system up and it is a week to 
graduation, so someone may be more interested in paying, and 
things like that. I wholeheartedly agree.
    Chairwoman Slotkin. Thank you.
    The Chair recognizes for 5 minutes the gentlewoman from 
Texas, Ms. Jackson Lee.
    Ms. Jackson Lee. Let me again emphasize my appreciation for 
this hearing.
    I can't emphasize enough the cruciality of the question of 
local governments, local businesses. I would like both 
witnesses to really focus on, one, the importance of that 
individual assessment, but more importantly to say to local 
entities, you are not immune from international ransomware 
attacks. That is why this is such an important hearing. 
Frankly, we should probably work to do this across the Nation 
of the many Members' districts where people really think that 
they may be immune.
    How often should a small government, a tax office, a small 
business, do their own self-analysis or their self-audit, as 
the theme has been, frankly? As you are beginning, Mr. Hartman, 
under our new legislation to develop the process for mandatory 
incident reporting, there needs to be some interim way that our 
local communities can be heard or that our State governments 
can be notified. What would be--first question is the 
importance of recognizing that no entity, no hamlet is immune, 
no village, no city, no sports organization, no school 
district. Then, second, what should they be doing in the 
interim as you are proposing? Both can answer this question. 
The protocols for mandatory incident reporting. Many of us have 
had these large entities in our districts and we are reminded 
of the Pipeline incident.
    But I would appreciate you responding to those two 
questions.
    Mr. Hartman. Thank you very much for the questions, 
Congresswoman.
    First, to absolutely reiterate your point, no organization 
in this country is immune from cyber attack emanating from 
foreign nations. With that said, no organization in this 
country should feel that they have to take on this challenge 
alone. That is why we are here as CISA, to work together, to 
work collaboratively every day, to make sure that all 
organizations have the information that they need to make 
educated risk management decisions and to strengthen their own 
cybersecurity and their own resilience.
    With respect to your second question on the frequency of 
how organizations should continue to self-evaluate or self-
assess their cybersecurity, again, it really depends. There are 
many elements of the cybersecurity program, like knowing your 
exposed vulnerabilities that are externally facing, so that are 
available to--that are facing the internet and can be accessed 
by anyone across the world. Knowing your prevalence of 
external-facing known vulnerabilities, particularly those that 
we know our adversaries are exploiting. CISA recently developed 
a catalog of known exploited vulnerabilities that is available 
to all organizations to help them prioritize their 
vulnerability management programs.
    With respect to what organizations should do in the 
interim, it is very simple. While there is no rule in place 
today, organizations can voluntarily report cyber incidents to 
[email protected]. You can also report it to your field advisor 
or to the FBI. It is extremely important, again, that all 
organizations are aware of the services that the field support 
from CISA offers, from assessments to evaluations of your own 
organization's cybersecurity risk to education and 
encouragement of best practices to building cybersecurity 
communities of interest to quite frankly listening to our 
stakeholders' concerns, to their challenges, and to their 
requirements so we can work with Congress to increase the 
services that we provide to all.
    Thank you.
    Mr. Kahangama. Congresswoman, I would just add in the 
remaining time that we also have cyber fraud task forces 
through the Secret Service. There are 44 of them globally. I 
believe there is one in Houston, Texas as well. These are joint 
task forces with local and State officials, as well as Federal 
law enforcement, who work together to share information rapidly 
and are also a resource for sharing information to and with the 
public on ransomware attacks.
    Ms. Jackson Lee. Well, let me conclude, in the time--my 
clock has gotten away from me--but let me just simply say that 
this is a frightening experience when you experience a 
ransomware attack. From our experience with Colonial Pipeline, 
I want to emphasize through this hearing, do not accept this 
attack alone. There are resources. Do not I think engage in 
ransom without engaging the government that is here and ready 
to serve and to help you.
    So I hope as we proceed we will see a new protocol, but 
more importantly, don't experience or suffer the impact alone. 
I hope this hearing evidences that, that we are here to provide 
the assistance necessary.
    Madam Chair, thank you so very much.
    With that, I yield back.
    Chairwoman Slotkin. Thank you, Congresswoman.
    I just want to again foot stomp that for our local 
businesses, our superintendents, our school officials, our 
farmers, making an appointment to speak with our local 
officials who do cybersecurity in the State of Michigan ahead 
of need is always better than having that first call be an 
emergency. I think what is not always known is that groups can 
just--you know, if you are from a chamber of commerce and you 
get together with your group and you want to have a meeting 
with these folks, if they are available, they want to meet with 
the public. So folks should avail themselves of that.
    With that, the Chair recognizes for 5 minutes the 
gentlewoman from Florida, Mrs. Demings.
    Mrs. Demings. Again, thank you so much, Chairwoman Slotkin.
    Just again, and I know we have spent a considerable amount 
of time on this, but it is so very critical, having grown up in 
a rural part of Florida, I just think about the unique 
challenges that our smaller cities or smaller towns, our rural 
areas have, No. 1, in receiving the information, but then also 
if they receive the information, really being able to implement 
recommendations due to lack of resources. So, you know, any 
additional steps or assistance that we can give as Members of 
Congress to make sure that the information is passed on, you 
know, from the largest of municipalities down to the smallest, 
please, to both of our witnesses, let us know how we can be of 
greater assistance there. We have to be proactive as opposed to 
reactive, as has been said numerous times, to these type of 
attacks.
    I would like to hear from both of our witnesses about--and 
if you want to respond to that at all, that is fine--but some 
of the challenges in recruiting a ready-for-the-moment work 
force. We know that many of our Federal agencies are 
experiencing challenges in recruitment and development. I also 
know that the advisory committee's recommendation was to 
prioritize, you know, our work force issues so that we could be 
more competitive with the private sector.
    So if both of our witnesses would just speak for just a 
moment on how are we doing with our work force.
    Mr. Kahangama. Thank you for the question, Congresswoman.
    We agree there is a cyber work force shortage in this 
country. It is an issue that the Government faces, the private 
sector, State and local communities writ large. I think it is 
important that we focus, you know, not just on traditional 
educational pathways as well. Having a diverse background in 
terms of what you may or may not have experienced, what kind of 
certifications you have are important.
    For our secretary, Secretary Mayorkas, this is a high 
priority as well. He conducted a sprint on cybersecurity work 
force hiring last year as well. Happy to report on that front 
that we had a 60-day sprint last summer. I believe at least 500 
job offers were given out in cybersecurity for the Department. 
That was the largest single hiring event we had so far and we 
have at least 300 of those on-board so far. But I also want to 
share with Matt because I know that CISA is doing a lot of 
great work in this space.
    Mr. Hartman. Thanks, Iranga, and thank you very much for 
the question, Chairwoman.
    Up front, you know, this is a challenge for all of our 
organizations. It is a challenge in the Federal Government. We 
understand it is a challenge in State, local, Tribal, and 
territorial governments, and it is a challenge in the private 
sector right now to fill critical cybersecurity jobs.
    Within CISA we are taking this extraordinarily seriously. 
Similar to the Secretary, Director Easterly has really gone on 
record to say that we need to not only rapidly close our own 
cybersecurity work force gaps at CISA so we can better serve 
our communities, but we need to use this opportunity to close a 
significant diversity gap within our own organization. Director 
Easterly has gone on record stating that by 2030 we need to 
make sure that at CISA 50 percent of our cybersecurity jobs are 
occupied by women. That would be up from about 25 percent 
today. So that is a very strong goal and we are taking that 
signal and we understand that we really need to use this 
opportunity where we have a handful--a number of vacancies at 
CISA due to rapid growth in recent years, to make sure that our 
work force of tomorrow represents the diversity of our Nation.
    With respect to specific actions, we are leveraging all of 
the tools at our disposal, including the Cyber Talent 
Management System, which we appreciate the support for. We have 
a hiring event tomorrow actually, a virtual hiring even where 
we are looking to bring in at least--I am targeting about 100 
candidates tomorrow to be selected for the vacancies within my 
organization within CISA so we can really continue to do better 
for all of you, so we can provide the guidance that all 
organizations can leverage.
    Back to your initial question, Congresswoman, the faster 
that we hire, the more diversity that we bring into our thought 
at CISA, the better the guidance that we can bring out to our 
diverse communities, to our diverse States.
    Mrs. Demings. Great. Well, again, thank you so very much to 
both of you for the work that you are doing.
    Madam Chair, I yield back.
    Thank you.
    Chairwoman Slotkin. Thank you, Congresswoman.
    I want to thank our panel for appearing today. Our 
witnesses flew out in order to join us here. Thank you for 
answering our questions and bringing the Federal perspective 
here to Michigan.
    In just a second we are going to transition to our second 
panel. Mr. James Ellis, he's the cyber section commander at the 
Michigan Cyber Command Center at Michigan State Police 
Headquarters, and brings this sort-of into an even more local 
perspective.
    Without objection, the subcommittee will recess for 5 
minutes so that we can change the panel and folks can take a 
quick break. For our live-stream folks, we will be back after a 
brief break and come back and hear our second panel.
    Thank you very much to our witnesses for making the effort 
to come out here.
    Have a good one.
    [Recess.]
    Chairwoman Slotkin. Welcome back, everyone. Thank you for 
sticking with us and for those on the live stream, we will now 
continue to the second portion of our panel today.
    Our witness today is Mr. James C. Ellis. He is detective 
first lieutenant and cyber section commander at the Michigan 
Cyber Command Center for the Michigan State Police. That is in 
Dimondale, Michigan.
    Mr. Ellis leads a cyber team of over 100 Michigan State 
Police members located throughout Michigan and oversees the 
Michigan Cyber Command Center, or MC3, Computer Crimes Unit, 
and the Michigan Region of the Internet Crimes Against Children 
Task Force.
    Mr. Ellis' team at the Michigan State Police Cyber 
specializes in high-tech criminal investigations of all types, 
proactive cyber investigations involving the on-line 
exploitation of children, and evidential forensic data recovery 
services.
    Detective First Lieutenant Ellis is a 28-year member of the 
Michigan State Police and holds multiple cybersecurity industry 
certifications in addition to his Bachelor of Science degree.
    I also want to note that we had planned for a second 
witness, but due to COVID unfortunately our second witness was 
unable to make it today. We wish her well.
    Without objection, the written testimony of Ms. Laura 
Clark, chief information officer of Michigan's Department of 
Technology, Management, and Budget, will be inserted officially 
into the record.
    [The prepared statement of Ms. Clark follows:]
                   Prepared Statement of Laura Clark
                             June 28, 2022
    Thank you, Congresswoman Slotkin, for inviting me to speak today on 
the subject of cybersecurity. As the chief information officer and 
chief security officer for the State of Michigan, I appreciate the 
opportunity for me to discuss with the Members of this committee the 
steps we are taking to secure our State.
                 cybersecurity in the state of michigan
    In the State of Michigan, information technology (IT) and 
cybersecurity are centralized under the Department of Technology, 
Management, and Budget (DTMB). Several years ago, both cybersecurity 
and physical security were consolidated into one area within DTMB known 
as Cybersecurity and Infrastructure Protection (CIP), which serves to 
secure the State and ensure the safety of the Executive branch. Within 
CIP, there are several groups that provide external outreach to keep 
those within Michigan safe, further strengthening the cyber 
environment:
   Michigan Cyber Security (MCS) manages information security 
        for the State of Michigan. The Michigan Security Operations 
        Center has several advanced security capabilities including 
        threat hunting, incident response, digital forensics, and 
        vulnerability management. The Risk, Compliance, and Delivery 
        division assumes responsibility for the process, tool, and 
        governance of security process plans and security awareness 
        campaigns, and developing and enforcing security policies, 
        standards, and procedures for the enterprise to follow. 
        Security architects establish the target security and 
        infrastructure architecture for security platforms, 
        implementing frameworks and solutions to keep the enterprise 
        secure.
   Michigan Cyber Civilian Corps capitalizes on the 
        cybersecurity talent within Michigan to allow qualified 
        technical cybersecurity professionals and experts to volunteer 
        to respond to cybersecurity events and incidents on behalf of 
        the State. By participating in the MiC3, members receive 
        training to further increase their knowledge and skills and can 
        participate in State-wide exercises, encouraging outreach 
        between cybersecurity-minded individuals.
   Michigan Cyber Partners is a collaboration between divisions 
        at the State of Michigan, local public entities across the 
        State, Federal agencies, and National non-profits to work to 
        strengthen and improve cybersecurity. Michigan Cyber Partners 
        offers members the ability to share information and threat 
        intelligence with one another, participate in State-wide 
        exercises and formal annual training offered to local 
        government and K-12, and offers program oversight for risk 
        assessments and Federal grant programs.
   Michigan Secure is a first-of-its-kind, free State-wide 
        mobile protection app for residents. Michigan Secure protects 
        users from cyber criminals and potential dangers encountered in 
        the digital mobile world. The app was designed with security 
        and privacy at the forefront, collecting no user data or 
        identifying information.
   Resident Tooling is an effort to elevate the existing State 
        of Michigan cybersecurity website and provide various 
        cybersecurity information and resources to equip residents with 
        the knowledge they need to stay safe in the on-line world.
    Additionally, organizations that DTMB partners with who have a 
critical role in maintaining a safe cyber environment across the State:
   Michigan Cyber Command Center (MC3) is housed within the 
        Michigan State Police and coordinates cybersecurity-related 
        activities as they pertain to emergencies and computer-based 
        crimes, extending beyond government information to reach all of 
        Michigan.
   National Guard has both Air and Army National Guard Units 
        with cybersecurity capabilities, in which the State of Michigan 
        works closely with the Guard to formalize the process of 
        working together in the event of a cyber emergency.
    To aid in the distribution of roles and responsibilities between 
MCS, MC3, and the National Guard, the State of Michigan has developed 
the Michigan Cyber Disruption Response Plan (CDRP). The CDRP details 
chain of command, responsibilities, and processes for escalation, 
serving as a plan to weaken the unknown and panic that often coincides 
with major incidents. To guarantee the effectiveness of the CDRP, 
involved agencies and partners participate in workshops to review the 
CDRP and relative responsibilities and engage in functional exercises 
that simulate various scenarios and incidents that advance in severity. 
In completing workshops and exercises, we can ensure that proper action 
and best course of action is taken in the event of a cyber incident.
    The Cyber Disruption Response Team (CDRT) is currently being 
utilized as a result of on-going geopolitical situations, with several 
meetings to share the latest information occurring throughout the week 
that allows for the consolidation of information sharing and the 
streamlining of sources while offering efficiency in the consumption of 
information. The frequent communications have established clear 
triggers for the escalation of an incident and the implementation of 
primary and alternative communications plans through various platforms, 
including Microsoft Teams and HSIN.
                    federal assistance to the state
    Consistent working relationships within the State of Michigan 
between MCS, MC3, and the National Guard are crucial to defend the 
State's digital landscape, and the relationships we have with our 
Federal partners is also highly valuable. The Department of Homeland 
Security's (DHS) Cyber and Infrastructure Security Agency (CISA) has 
brought forth several resources to assist in securing Michigan's 
landscape. Through our CISA cybersecurity liaison, we have a direct 
line of communication with DHS who offers the Federal perspective to 
assist in the decision-making process. We also have contact with the 
Federal Bureau of Investigations (FBI), which shares valuable 
information on cybersecurity events and topics to ensure we protect the 
State.
    Additionally, the Infrastructure Investment and Jobs Act (IIJA) 
will be a major asset to cybersecurity efforts across the State to 
further secure the digital environment. With an estimated $24 million 
being allotted to Michigan over the course of 4 years, Michigan's 
digital landscape has the ability to be transformed. The State of 
Michigan has developed a cybersecurity planning committee comprised of 
cybersecurity experts in various fields and locations to assist in 
determining how the distribution and use of the allocation of funds 
would best strengthen the digital ecosystem across the State while 
securing the State and local governments, schools, and entities. 
Federal partners have been directly engaged in the information sharing 
surrounding IIJA, participating the meetings and communications plans 
to provide key insight on the funding and state of cybersecurity.
            beyond the state: securing the digital ecosystem
    The transformation of the digital environment has resulted in 
Federal, State, and local governments being intertwined and relying 
upon with information sharing to help secure the ecosystem. Levels of 
government interact daily to improve the digital security of various 
environments while encountering challenges faced by human and financial 
resource shortages. The diversity in resources within these levels of 
government needs to be considered when addressing improvements to 
Michigan's digital landscape. For example, Michigan has 83 counties, 
276 cities, 257 villages, and 1,240 townships. The population and 
available resources vary between these areas, resulting in an array of 
differing needs, improvements, and focuses across each level.
    To assist in addressing the needs of local public entities and 
further secure Michigan's digital ecosystem, the State of Michigan, 
through the Michigan Cyber Partners program, offers the ability to 
contract for an independent cybersecurity risk assessment. The multiple 
pre-qualified vendors offered by the State were selected through a 
competitive request for proposal process, allowing entities to work 
with a vendor to complete assessment, planning, and coaching services 
to further strengthen their digital environments.
    The findings of the risk assessments will assist in establishing a 
baseline for Michigan's plan for IIJA cyber implementation, indicating 
which improvements should be made with the funding to enhance security 
levels. Recommendations of transitioning to .gov domains for county and 
local governments, implementing multi-factor authentication across 
entities, and offering security awareness programs are being considered 
to further secure the State's digital environment. These items, among 
other options, are associated with the funds appropriated through IIJA, 
offering opportunities for entities beyond what they may typically have 
the funds to support. This reveals the need for sustainable funding 
post IIJA, as recipients may select a short-term benefit rather than 
long-term due to lack of budgetary funds. Securing the ecosystem needs 
to be a continuous effort, not a short-term solution.
    The State of Michigan's external outreach programs also assist in 
securing the ecosystem. The MiC3 and Michigan Cyber Partners programs 
encourage discussion among cyber professionals, government entities, 
and educators, equipping them with the community and information needed 
to further secure the digital environment. The Michigan Secure app 
ensures that residents are kept safe on their mobile devices, and the 
elevation of the external cybersecurity website provides residents with 
additional resources to keep them safe on-line. The Michigan Cyber 
Summit, an annual cybersecurity conference available to the public, 
also offers valuable information sharing through its speakers and 
panels, providing insight on current cybersecurity topics from various 
perspectives.
    The digital ecosystem is dependent upon governments, entities, and 
citizens working together to maintain and secure a safe environment. I 
would like to thank the Legislature and Governor Whitmer for their 
bipartisan support and recognition of the importance of cybersecurity, 
as well as the members of our Michigan Congressional delegation who 
continue to make cybersecurity a priority, especially those who voted 
for IIJA and its funding support. With new threats emerging each day, 
it is crucial that we strive to protect our State. The State of 
Michigan greatly appreciates the Members of this committee highlighting 
the importance of the digital ecosystem, and we look forward to 
continuing to work with you to secure it and protect residents.

    Mr. Ellis, I would ask you to first kind-of lay the 
framework. We are now getting to the portion of our hearing 
that is really focused on our Michigan viewers, our Michigan 
businesses, our Michigan organizations and how they 
specifically can be helped within the State. We heard from the 
Federal level and I would ask you to now to summarize your 
statement for 5 minutes please.

  STATEMENT OF JAMES C. ELLIS, DETECTIVE FIRST LIEUTENANT AND 
    CYBER SECTION COMMANDER, MICHIGAN CYBER COMMAND CENTER, 
                     MICHIGAN STATE POLICE

    Mr. Ellis. Thank you subcommittee Chairwoman Slotkin and 
the Members of the committee for gathering us here today, or in 
this case just myself at this point in time, on the issue that 
is of crucial importance to the State of Michigan and the 
Nation.
    My name is Detective First Lieutenant Jim Ellis and I am 
the cyber commander of the Michigan State Police, Michigan 
Cyber Command Center, or MC3, as we call it.
    The first thing I want to do is establish a foundation of 
how the MSP fits into cybersecurity as a State Police law 
enforcement organization with Michigan critical infrastructure, 
the public, and our close partners. MSP Cyber is a full-service 
criminal investigation section. Members are in the field 
pursuing active investigations from initiation to prosecution, 
arrest, and court testimony. MSP Cyber supports all MSP 
troopers and field members, along with the other 580+ law 
enforcement agencies in the State and others nationally 
requiring investigative assistance as cyber crime has no State 
line boundaries.
    It is becoming very difficult to name a crime that does not 
involve technology of some kind that may contain digital 
evidence supporting that crime. Some of the services, just to 
give you an example, that we perform, obviously criminal 
investigations. Thousands of cases per year. Last year alone we 
assisted over 340 police agencies in Michigan. This includes 
network intrusions, breaches of Michigan businesses, the 
forensic recovery of digital evidence used for prosecution or 
acquittal, hundreds of search warrants annually, receiving and 
seizing thousands of devices typically per month that require 
forensic examination, provide community outreach and 
presentations covering cyber security, provide law enforcement 
with education and training regarding cybersecurity, 
collaborate with critical infrastructure regarding information 
sharing and best practices. We conduct cyber assessments for 
public and private industry businesses as well.
    MSP Cyber, as you stated, is comprised of over 100 highly 
specialized members consisting of uniformed and civilian 
investigators. Cyber analysts, members from within the Michigan 
Department of Corrections, Michigan National Guard as full-time 
positions, and we all have members on the FBI Cyber Task Force, 
Homeland Security Investigations, Dark Web Task Force, and I 
can't leave out our two cyber-trained canine dogs, and many 
other support staff.
    MSP overall consists of three units. We have the Computer 
Crimes Unit, known as CCU, which was created by necessity in 
1999 when computer technology was being used in the commission 
of crimes and the internet was thought to be a fad. The CCU 
investigates high-technology crimes and provides digital 
forensics data recovery, as stated.
    The Internet Crimes Against Children Task Force. The ICAC, 
as we call it, is a collection of State, local, and Federal 
partners concentrating on child sexually abusive material, 
known as CSAM, and exploitation crimes, including child 
trafficking and investigations.
    The third unit is the Michigan Cyber Command Center, which 
has been established to coordinate cyber crime incident 
response and investigative network information system-based 
crimes affecting Michigan. The MC3 is a leading resource for 
cybersecurity, cyber crime awareness and prevention, and 
network-related investigations. Investigations do include 
network intrusions, breaches, unlawful access, hacking, theft, 
and exfiltration of data, extortion and cyber terrorism, as is 
surrounding this today with cryptocurrency and other forms of 
malware. We also do malware identification, research, and 
analysis. Information sharing of breach notification, 
development, and dissemination of various intelligence products 
are also pushed out by the MC3 for Michigan businesses and 
citizens.
    Including in our State partnerships within the State of 
Michigan government ecosystem, MSP Cyber, DTMB's Michigan Cyber 
Security, Michigan Air and Army National Guard, and others have 
a long-standing collaborative partnership with the purpose of 
ensuring the cybersecurity posture through prevention and 
response within the State of Michigan. Together we have been a 
role model for many other States and major cities across the 
United States who hope to replicate what we have done to assist 
in better securing the State. Michigan is one of the first 
States to create a State-level cyber disruption and response 
plan that has been used across the Nation as a template. 
Together we have partnered to develop and fuel many 
initiatives. That includes the Michigan Cyber Civilian Corps, 
know as the MiC3, Michigan Secure App that you can put on your 
mobile devices, the Cyber Partners Group, the Chief Security 
Officer Cabinet Meetings, and many others bringing everyone 
together simply to discuss cyber best practices and to 
reinforce information sharing.
    We participate together in multiple cyber exercises, 
workshops, and presentations every year and involve Federal 
partners, critical infrastructure, and Government to assist in 
ensuring the cybersecurity of our water treatment plants, 
energy-producing facilities, financial institutions, academia, 
election systems, and other. On almost a daily basis we are 
sharing cyber-related information among the many partnerships 
that have been developed to ensure the best possible 
cybersecurity protections are in place.
    Thank you for your time and this opportunity to share our 
experiences in Michigan and I look forward to addressing any 
questions you may have for me.
    [The prepared statement of Mr. Ellis follows:]
                  Prepared Statement of James C. Ellis
                             June 28, 2022
    Thank you, Subcommittee Chairwoman Slotkin, Congresswoman Jackson 
Lee, and the Members of this committee for gathering us here today to 
discuss this issue of crucial importance to the State of Michigan and 
the Nation. My name is Detective First Lieutenant James Ellis, and I am 
the commander of the Michigan Command Center within the Michigan State 
Police.
                  michigan state police--cyber section
    The Michigan State Police (MSP) Cyber Section, referred to as ``MSP 
Cyber'', is within the Intelligence Operations Division of the MSP and 
works in conjunction with the Michigan Intelligence Operations Center. 
Let me establish a foundation of how the MSP fits into cybersecurity as 
a State police law enforcement organization, with Michigan critical 
infrastructure, the public, and our close partners, the Department of 
Technology Management and Budget (DTMB) and the Michigan National 
Guard.
    MSP Cyber is a full-service criminal investigation section 
responsible for investigations spanning the entire criminal file class 
hierarchy. MSP Cyber members are in the field pursuing active 
investigations from initiation and investigation to prosecution, 
arrest, and court testimony. MSP Cyber supports all MSP troopers and 
field members along with the other 580+ law enforcement agencies in the 
State and others nationally requiring cyber-related investigative 
assistance, as cyber crime has no State line boundaries. As our case 
load continues to increase year after year, it is becoming very 
difficult to name a crime that does not involve technology of some kind 
that may contain digital evidence supporting that crime.
    Services performed by MSP Cyber include but are not limited to:
   Criminal investigations both originating and assisting in an 
        undercover capacity--over 4,000 cases per year, assisting over 
        340 police agencies last year in Michigan
   The forensic recovery of digital evidence used for 
        prosecution or acquittal
   Street-level and electronic surveillance
   Search warrants--over 400 hundred per year; both 
        administrative and on-scene with physical device and digital 
        evidence seizures
   Often receiving and seizing over 1,000 devices per month for 
        forensic examination and recovery of digital evidence
   Provide expert courtroom testimony
   Provide community outreach and presentations covering all 
        cyber/computer-related topics from prevention and awareness to 
        incident response and cybersecurity best practices
   Provide law enforcement with cyber, computer crime, and 
        digital evidence-related education and training
   Collaborate with critical infrastructure regarding 
        information sharing and incident response
   Conduct cyber assessments for public and private industry/
        businesses
   Conduct criminal investigations involving the sexual 
        exploitation and trafficking of children including the rescuing 
        of children from sexual predators
   Investigate hundreds of cybersecurity-related network 
        intrusions and breaches of Michigan businesses annually
   Sourcing new initiatives for the MSP and the State of 
        Michigan related to data security, privacy, policy, and 
        compliance
   Develop and submit legislative language and provide 
        testimony for new and modified Michigan laws regarding 
        cybersecurity.
    We work collaboratively with all other law enforcement, public/
private sectors, critical infrastructure, small/medium/large 
businesses, local, State, and national government organizations, local 
community groups, and citizens.
    MSP Cyber is comprised of over 100 highly-trained and specialized 
members consisting of both uniformed detective troopers and sergeants, 
officers, cyber analysts, dark web analysts, digital forensic analysts, 
incident response teams, an FBI Cyber Task Force member, a Homeland 
Security Investigations (HSI) Dark Web Task Force member, Michigan 
Department of Corrections staff members, National Guard members, two 
cyber-trained K9 dogs, and many other support staff.
                     msp cyber organizational units
    MSP Cyber consists of three organizational units that work in 
collaboration and provide overlapping services that include the 
Computer Crimes Unit (CCU), the Internet Crimes Against Children (ICAC) 
Task Force, and the Michigan Cyber Command Center (MC3).
Computer Crimes Unit (CCU)
    Created by necessity in 1999 when computer technology was being 
used in the commission of crimes and the internet was thought by some 
to be a fad. The CCU is the premier State-wide leader in responding to 
and investigating high-technology crimes and providing digital forensic 
evidentiary data recovery assistance to local, county, and State law 
enforcement agencies. The CCU operates multiple digital forensic 
offices throughout Michigan for the purposes of digital forensic 
examination and analysis.
Internet Crimes Against Children Task Force (ICAC)
    The ICAC Task Force is a collection of State, local, and Federal 
partners concentrating on child sexually abusive material (CSAM) and 
child sexual exploitation and trafficking investigations. MSP Cyber has 
the responsibility to train local law enforcement in the proper 
acquisition and examination of digital forensic evidence. Currently, 
over 50 Federal, State, and local law enforcement agencies supply 
dedicated officers to investigate ICAC cases, with most of them working 
directly out of MSP Cyber offices. MSP Cyber also receives all Michigan 
cyber tip investigations that are reported by the National Center for 
Missing and Exploited Children (NCMEC) located in Washington, DC. In 
2021, the MSP Cyber received 11,416 cyber tips, averaging almost 1,000 
investigations per month.
Michigan Cyber Command Center (MC3)
    Established in 2013 by necessity to coordinate cyber crime incident 
response and investigate the proliferation of networked information 
system-based crimes affecting Michigan. The MC3 is a leading resource 
for cybersecurity, cyber crime awareness and prevention, and cyber-
related network intrusion criminal investigations for critical 
infrastructure; Federal, State, and local government entities; other 
public and private sectors, and citizens of the State of Michigan.
   Primary investigations include:
     Network intrusions and breaches; unlawful access, hacking, 
            theft, and exfiltration of data
     Extortion and Cyberterrorism
     Dark Web and Cryptocurrency.
   Malware identification, research, analysis, origin, 
        indicators of compromise for awareness/prevention
   Provide cybersecurity assessments, industry best practices, 
        and recommendations
   Information sharing; breach notifications, development, and 
        dissemination of various intelligence products; podcasts, 
        presentations, media events, news releases
   Partnerships and collaborations--national, State, and local; 
        FBI, HSI, USSS, DHS, and others.
                   michigan cyber--state partnerships
    MSP Cyber, DTMB's Michigan Cyber Security (MCS), Michigan Air and 
Army National Guard, and many others along the way have had a long-
standing collaborative partnership of almost 10 years with the purpose 
of ensuring the cybersecurity posture through prevention and response 
within the State of Michigan. Together we have been a role model for 
many other States and major cities across the United States, who hope 
to replicate what we have done as a State when it comes to securing the 
State through prevention and response, not only within State 
government, but in addition to the many relationships we have created 
within our public and private partnerships across Michigan.
    Michigan was one of the first States to create a State-level Cyber 
Disruption and Response Plan that contains the framework and details 
related to responsibilities and roles that covers how to manage a 
State-level cyber disruption, that has been used across the Nation as a 
template, since the original version was finalized almost a decade ago. 
We have partnered to develop and fuel many initiatives that include the 
Michigan Cyber Civilian Corps (MiC3), Michigan Secure App, Cyber 
Partners Group, chief security officer (CSO) cabinet meetings, and many 
more, bringing everyone together to discuss cyber and reinforce 
information sharing, creating multiple plans, exercising those plans, 
education, awareness, prevention, compliance, knowing who to contact.
    We participate together in multiple cyber exercises, workshops, 
symposiums, and presentations, every year and involve Federal partners 
DHS, FBI, others within Michigan from critical infrastructure sectors 
including health care, finance, energy, water, education, and 
Government to assist in ensuring the cybersecurity of our water 
treatment plants, energy-producing facilities, financial institutions, 
academia information systems, election systems, and others. On almost a 
daily basis we are sharing cyber threat detection, prevention, 
awareness, and recovery information among the many partnerships that 
have been developed to ensure the best possible cybersecurity 
protections are in place.
    Thank you for your time and this opportunity to share our 
experiences in Michigan, and I look forward to addressing any questions 
you may have for me.

    Chairwoman Slotkin. Great. I thank the witness for his 
testimony.
    I will remind the subcommittee that we will each have 5 
minutes to question the panel.
    I now recognize myself for questions.
    So tell me, Mr. Ellis, you know I think one of the things 
we talked about earlier this morning was kind-of that moment, 
that moment that a superintendent or a business owner or a 
local elected walks into his or her office and realizes that 
they have been completely locked out of their data, that they 
are a victim, and they have that moment of panic, right. They 
are being ransomed, they are being threatened. If they are 
seated in the State of Michigan, what should they do? Quite 
literally, what is the--how do they figure out who to call and 
then walk us through what the process will be like once they 
call.
    Mr. Ellis. Sure. The most important thing is to call. They 
can certainly call the Michigan Cyber Command Center at the 
Michigan State Police. They can call DHS. But that is probably 
the No. 1 question we get is, who do we call? Really it comes 
down to call whoever you are comfortable with on the law 
enforcement side because when it comes to the investigation in 
law enforcement your case is going to get to the agency that it 
needs to get to.
    Within the State Police, obviously, as I mentioned, we have 
liaisons with Federal partners, including FBI, Secret Service, 
Homeland Security. So they are going to be involved regardless. 
But quite frankly they need to make a call. It really doesn't 
matter which agency they call. Obviously we tell them to call 
us.
    Once they do, we will attempt to understand what has 
occurred at their location, how many devices, what they think 
they are seeing, whether it is malware, ransomware, or the type 
of malware, if they have back-ups, that type of thing. We will 
kind-of do an evaluation or an assessment on the phone. We will 
get other partners involved if we need to. What is crucial for 
us is we will typically instruct them how they can best provide 
evidence to us, whether that is us coming on scene if we need 
to image a system. Because one of the things we want to do, 
even though we are talking cyber and we cannot always prosecute 
on cyber crime because actors are in other places or they are 
anonymous, is we want to get those indicators of compromise of 
how this started on their systems so we can take that, research 
it, and then push it back out for prevention and awareness to 
all the other businesses to help them establish protections so 
they don't have to go through the same thing this business just 
went through.
    Chairwoman Slotkin. Yes, I think that is something that 
when I have talked to local businesses they are like, look, I 
sort-of handled it myself. I said, you know, the trends and the 
similarities between these attacks can help, you know, another 
business from having to go through the same thing and that if 
law enforcement isn't aware of what has gone on in your case, 
they can't help another business, they can't identify those 
bigger trends.
    Then are you--what--how do you handle when someone says 
they are asking me for a $40,000 ransom payment, should I pay 
it, what should I do? How do you advise individuals and 
companies how to respond?
    Mr. Ellis. Yes. We typically will tell them not to pay 
because it simply empowers or emboldens the bad actors to 
continue with their ransomware. You know, we will obviously 
prepare them to help establish if they are able to restore 
data, if they have come to the point where they actually have 
an encrypted data. A lot of times we will get calls when they 
see some instances of ransomware before encryption. But, you 
know, that is a call they have to make. We kind-of evaluate if 
they have cyber insurance or not and we kind-of walk them 
through those steps. But we try not to have them pay, but 
obviously some businesses do because if they don't they may not 
be back in business simply for the fact that they are going to 
be down for an extended period of time or they cannot restore 
their systems back to where they should be.
    Chairwoman Slotkin. Right. But you certainly from the 
Michigan State Police perspective are not going to do anything 
punitive against an organization that decides to pay ransom, 
because you can understand no one likes that idea, we don't 
like to give money to bad guys and embolden them, but you can 
certainly understand from a small local government's 
perspective, a business perspective, if it is going to cost 
$40,000 to pay a ransom versus $400,000 to recover your data, 
you know, for your students who are a week from graduating, you 
can understand how these awful choices, you know, this devil's 
bargain that you have to make.
    Mr. Ellis. Absolutely. They oftentimes do pay just for 
those circumstances because that is--timing is what they weigh 
and often times, like you stated in your example, if they can 
be up and running in a short amount of time by paying the 
ransom, they will do that.
    Chairwoman Slotkin. Great.
    The Chair will now recognize other Members for questions 
they may wish to ask the witnesses.
    The Chair recognizes for 5 minutes the gentlewoman from 
Texas, Ms. Jackson Lee.
    Ms. Jackson Lee. Thank you so very much. Again, let me 
emphasize the importance of the information this is being 
generated and should frankly be emphasized as we interact with 
local communities throughout the Nation.
    So let me start. My questions will be to both the 
gentleman, Mr. Ellis, First Lieutenant, and the chief 
information officer, Ms. Clark.
    I would be interested in--and I guess it is reaffirming 
some of the points that you made earlier about the current 
barriers that exist for small businesses and local communities 
in the way of sufficient cyber fortification and what role 
would educational initiatives and training play.
    As you do that, let me ask, Madam Chair, to introduce into 
the record a time line of the biggest ransomware attacks 
dated--bitcoin and other cryptocurrencies have been a key tool 
in on-line crime and I just, before the witnesses answer, 
mention Colonial Pipeline--these are large entities--paid $4.4 
million, CNN financial paid $40 million. So we know that the 
big companies are paying dollars, we know that this is 
difficult for smaller entities.
    [The information follows:]
              a timeline of the biggest ransomware attacks
            Bitcoin and other cryptocurrencies have become a key tool 
                    in online crime.
CNET, Julian Dossett, Nov. 15, 2021 12:45 p.m. PT
    The history of technology is riddled with unintended consequences. 
As William Gibson wrote in Burning Chrome, `` . . . the street finds 
its own uses for things.'' Though Bitcoin may not have been originally 
conceived as a medium for ransom payments, it's quickly become a 
central tool for online criminals.
    Ransomware, a category of ``malware,'' blocks access to a computer 
or network until a ransom is paid. Despite the evolving efforts of 
governments to regulate cryptocurrency and mitigate its role in 
ransomware payments, the attacks keep coming.
    Cryptocurrency ransomware payments totaled roughly $350 million in 
2020, according to Chainanalysis--an annual increase of over 300 
percent from 2019. And because U.S. companies are legally required to 
report cyberattacks only if customers' personal information is 
compromised, that estimate may be far too conservative.
    Below, we tally up the damage of some of the highest-profile 
episodes.
Kaseya (2021)
    On July 2, 2021, Kaseya announced its systems had been infiltrated. 
Kaseya provides IT solutions for other companies--an ideal target 
which, in a domino effect, ended up impacting approximately 1,500 
organizations in multiple countries. REvil, a cybercriminal outfit, 
claimed responsibility for the attack and demanded ransoms ranging from 
a few thousand dollars to multiple millions, according to a Reuters 
report.
    It's unclear how many individual businesses paid up, but REvil 
demanded $70 million in bitcoin from Kaseya. Kaseya declined to pay, 
opting to cooperate with the FBI and the U.S. Cybersecurity and 
Infrastructure Agency. On July 21, 2021, Kaseya obtained a universal 
decryptor key and distributed it to organizations impacted by the 
attack.
JBS (2021)
    On May 31, 2021, JBS USA, one of the largest meat suppliers in the 
U.S., disclosed a hack that caused it to temporarily halt operations at 
its five largest U.S.-based plants. The ransomware attack also 
disrupted the company's Australia and UK operations. JBS paid the 
hackers an $11 million ransom in Bitcoin to prevent further disruption 
and limit the impact on grocery stores and restaurants. The FBI 
attributed the hack to REvil, a sophisticated criminal ring well-known 
in ransomware attacks.
Colonial Pipeline (2021)
    On May 7, 2021, America's largest ``refined products'' pipeline 
went off-line after a hacking group called Darkside infiltrated it with 
ransomware. Colonial Pipeline covers over 5,500 miles and transports 
more than 100 million gallons of fuel daily. The impact of the attack 
was significant: In the days that followed, the average price of a 
gallon of gas in the U.S. increased to more than $3 for the first time 
in 7 years as drivers rushed to the pumps.
    The pipeline operator said it paid the hackers $4.4 million in 
cryptocurrency. On June 7, 2021, the DOJ announced it had recovered 
part of the ransom. U.S. law enforcement officials were able to track 
the payment and take back $2.3 million using a private key for a 
cryptocurrency wallet.
Brenntag (2021)
    On April 28, 2021, German chemical distributor Brenntag learned it 
was the target of a cyber attack by Darkside, which stole 150GB of data 
that it threatened to leak if ransom demands weren't met. After 
negotiating with the criminals, Brenntag ended up negotiating the 
original ransom of $7.5 million down to $4.4 million, which it paid on 
May 11.
CNA Financial (2021)
    On March 23, 2021, CNA Financial, the seventh largest commercial 
insurer in the U.S., disclosed it had ``sustained a sophisticated 
cybersecurity attack.'' The attack was carried out by a group called 
Phoenix, which used ransomware known as Phoenix Locker. CNA Financial 
eventually paid $40 million in May to get the data back. While CNA has 
been tight-lipped on the details of the negotiation and transaction, 
but says all of its systems have since been fully restored.
CWT (2020)
    On July 31, 2020, U.S. business travel management firm CWT 
disclosed it had been impacted by a ransomware attack that infected its 
systems--and that it had paid the ransom. Using ransomware called 
Ragnar Locker, the assailants claimed to have stolen sensitive 
corporate files and knocked 30,000 company computers offline.
    As a service provider to one-third of S&P 500 companies, the data 
release could have been disastrous for CWT's business. As such, the 
company paid the hackers about $4.5 million on July 28, a few days 
before Reuters reported the incident.
University of California at San Francisco (2020)
    On June 3, 2020, the University of California at San Francisco 
disclosed that the UCSF School of Medicine's IT systems had been 
compromised by a hacking collective called Netwalker on June 1. The 
medical research institution had been working on a cure for COVID.
    Apparently, Netwalker had researched UCFS, hoping to gain insights 
into its finances. Citing the billions of dollars UCFS reports in 
annual revenue, Netwalker demanded a $3 million ransom payment. After 
negotiations, UCSF paid Netwalker the bitcoin equivalent of $1,140,895 
to resolve the cyberattack. According to the BBC, Netwalker was also 
identified as the culprit in at least two other 2020 ransomware attacks 
targeting universities.
Travelex (2019)
    On New Year's Eve 2019, London-based foreign currency exchange 
Travelex was infiltrated by a ransomware group called Sodinokibi (aka 
REvil). The attackers made off with 5GB of customer data, including 
dates of birth, credit card information, and insurance details. 
Travelex took down its website in 30 countries in an attempt to contain 
the virus.
    In the wake of the ransomware attack, Travelex struggled with 
customer services. Sodinokibi initially demanded a payment of $6 
million (4.6 million). After negotiations, Travelex paid 
the cybercriminals $2.3 million (285 BTC at the time, roughly 
1.6 million) to get its data back.
WannaCry (2017)
    In May 2017, a ransomware called WannaCry infected computers across 
the globe by exploiting a vulnerability in Windows PCs. The WannaCry 
vulnerability was revealed during a massive leak of NSA documents and 
hacking tools engineered by a group called Shadow Brokers in April 
2017.
    Though the exact number of WannaCry victims remains unknown, more 
than 200,000 computers around the world were infected. Victims included 
Spanish telecommunications company Telefonica and thousands of 
hospitals in the U.K. Computer systems in 150 countries were affected 
by the attack, with a total estimated loss of around $4 billion 
globally.
    The attackers initially demanded $300 in bitcoin to unlock infected 
computer systems. The demand was later increased to $600 in bitcoin. 
However, some researchers claim that no one got their data back, even 
if they met the demands.
    WannaCry attacks continue to this day. In February 2021, the DOJ 
indicted three North Korean computer programmers for their alleged role 
in the WannaCry outbreak.
Locky (2016)
    Discovered in February 2016, Locky is notable due to the incredibly 
high number of infection attempts it's made on computer networks. 
Attacks typically come in the form of an email with an invoice attached 
from someone claiming to be a company employee. On February 16, 2016 
analysis from Check Point identified more than 50,000 Locky attacks in 
1 day.
    Locky has many variants, but the goal is largely the same: Lock 
computer files to entice owners to pay a ransom in cryptocurrency in 
exchange for a decryption tool, which would allow users to regain 
access to their locked files. The majority of Locky victims have been 
in the U.S., and especially among health care companies, but Canada and 
France experienced significant infection rates as well.
TeslaCrypt (2015)
    Modeled on an earlier program called CryptoLocker, the earliest 
TeslaCrypt samples were circulated in November 2014 but the ransomware 
was not widely distributed until March of the following year.
    TeslaCrypt initially targeted gamers. After infecting a computer, a 
pop-up would direct a user to pay a $500 ransom in bitcoin for a 
decryption key to unlock the infected system. Other sources report the 
requested ransoms ranged from $250 to $1,000 in Bitcoin. In May 2016, 
the developers of Tesla Crypt released a master decryption key for 
affected users to unlock their computers.
CryptoWall (2014)
    Widespread reports of computer systems infected from the CryptoWall 
ransomware emerged in 2014. Infected computers were unable to access 
files--unless the owner paid for access to a decryption program. Crypto 
Wall impacted systems across the globe. The attackers demanded payment 
in the form of prepaid cards or bitcoin. CryptoWall caused roughly $18 
million in damages, according to Help Net Security. Multiple versions 
of CryptoWall were released, with each version making the ransomware 
more difficult to trace and combat.
CryptoLocker (2013)
    The first time much of the world heard the term ``ransomware'' was 
during 2013's CcyptoLocker outbreak. Discovered early in September 
2013, CryptoLocker would cripple more than 250,000 computer systems 
during the following 4 months. Victims were instructed to send payments 
in cryptocurrency or money cards to regain access. The ransomware 
delivered at least $3 million to its perpetrators.
    A multinational law enforcement effort in 2014 succeeded in taking 
down the Gameover Zeus botnet, which was a primary distribution method 
for CryptoLocker. The DOJ indicted Russian hacker Evgeniy Mikhailovich 
Bogachev, as the botnet's ringleader. Bogachev is still at large--and 
the FBI is currently offering a reward of up to $3 million for 
information leading to his arrest and/ or conviction.
AIDS Trojan/PC Cyborg (1989)
    Widely considered the template for all subsequent attacks, the AIDS 
Trojan (aka PC Cyborg) is the first known instance of a ransomware 
attack. In 1989, more than a decade before the creation of bitcoin, a 
biologist named Joseph Popp distributed 20,000 floppy disks at the 
World Health Organization AIDS conference in Stockholm. The floppy 
disks were labeled ``AIDS Information--Introductory Diskettes'' and 
contained a trojan virus that installed itself on MS-DOS systems.
    Once the virus was on a computer, it counted the times the computer 
booted up. Once the computer booted up 90 times, the virus hid all 
directories and encrypted filenames. An image on the screen from the 
`PC Cyborg Corporation' directed users to mail $189 to a P.O. address 
in Panama. The decryption process was relatively simple, however, and 
security researchers released a free tool to help victims.

    Ms. Jackson Lee. Would you be able to answer that question 
about the barriers that may exist?
    Mr. Ellis. Yes. Some of the barriers--thank you for the 
question--some of the barriers that do exist are, you know, 
lack of education and training, which we try to provide to many 
businesses, to be more cybersecurity-aware, thinking a little 
more along the lines of defensiveness when it comes to 
cybersecurity. Try to get them into security awareness 
training. We will go through best practices of which, you know, 
looking at defense-in-depth, looking at two-factor 
authentication, having a validated off-line back-up that they 
can restore data, have a remediation plan or continuity plan so 
they are able to get back up and running. Basically just 
looking at it from that point on as they move forward. You 
know, if this incident does occur or occurs again, what exactly 
will they do, who will they call, can their business survive, 
what best practices can they initiate being off-line? Just some 
of those things. We always look at best practices to try to get 
them back up and running again, but will also advise on 
potential resources that may get them back up and running.
    Education and awareness is obviously paramount for some of 
the smaller and medium businesses in Michigan.
    Ms. Jackson Lee. Ms. Clark.
    Chairwoman Slotkin. Sorry, ma'am, she is suffering from 
COVID and wasn't able to join us today.
    Ms. Jackson Lee. All right. Thank you. I am sorry, I 
thought I heard--let me then follow up with Mr. Ellis in 
particular about the work of MC3, including the Michigan 
Internet Crimes Against Children Task Force. That collaborates 
with Federal, State, and local partners to investigate 
offenders who use the internet on-line communication systems.
    How does the ICAC Task Force work to educate children, 
parents, and schools on internet safety in the face of cyber 
predators?
    Mr. Ellis. Thank you for the question.
    We educate parents, schools, our young adults in school by 
doing presentations, outreach. We will run through case 
scenarios with them so they understand, you know, what the 
potential is of them posting pictures on-line, which many kids 
do now, as you know. You know, sextortion is one of the big 
crimes or potential crimes that are going on, depending on how 
far it goes. That is affecting our young kids now. Again, a lot 
of it is education of our young people just to know that 
because they are so involved in social media, they are posting 
their lives on-line, what exactly that can mean to somebody 
that is potentially seeking them out as a potential victim.
    Ms. Jackson Lee. Can the Federal Government do more with 
respect to legislation to help you? Help that task force or 
help task forces across the country?
    Mr. Ellis. As far as legislation, you know, that is a great 
question. Anything that would allow for additional funding to 
allow for education. Maybe mandatory cybersecurity education in 
schools as part of the curriculum would be paramount so they 
get it at a young age. That would be--you know, that would also 
draw an interest in other areas, just so they can see and 
become acquainted with cybersecurity best practices.
    Ms. Jackson Lee. Thank you so very much.
    I think my time has expired and----
    Chairwoman Slotkin. Thank you, Congresswoman.
    I would just say that there is a real interest on our 
committee on how to deal--I had never heard the term you 
mentioned for exploiting kids and sensitive pictures on-line. 
Can you repeat the term?
    Mr. Ellis. Sextortion.
    Chairwoman Slotkin. Sextortion. I was not familiar with 
that term, but our committee has passed a bunch of legislation 
on K-12 resources and money basically for our K-12 schools to 
be able to learn and educate themselves and protect our kids' 
data, as well as digital literacy. Like how do we start 
teaching digital literacy to our kids at a very young age since 
they are the ones who are digital natives?
    The Chair will now recognize for 5 minutes the gentlewoman 
from Florida, Mrs. Demings.
    Mrs. Demings. Well, thank you so much again, Chairwoman 
Slotkin, and thank you to Detective First Lieutenant Ellis for 
being with us today. Thank you for your very impressive record 
of service with the Michigan State Police. As a former law 
enforcement officer, you know, we said 30 years ago that we 
could not fight today's battles with yesterday's weapons. My 
goodness, when we look at how the landscape has changed, that 
certainly rings true today. It is certainly not the same old 
Economic Crimes Unit or the Crimes Against Children Unit.
    You know, so, Detective, I would love for you to just talk 
just a little bit about how policing has changed in this space, 
how the work force has had to change the level of training, the 
level of cooperation between you and other jurisdictions. You 
said that cyber crimes have no State-wide boundaries, and boy 
is that true. But how has the level of cooperation changed or 
what challenges have occurred because of those no State-wide 
boundaries that you face?
    Mr. Ellis. Thank you for the question.
    Yes, we have seen within Michigan the fact that we are the 
Michigan State Police and we act as resource for those other 
580 law enforcement agencies in Michigan and others around the 
Nation, we see a lack of trained officers in the realm of the 
recovery of digital evidence, or even what devices may contain 
digital evidence that may be a part of a crime. You know, 
everybody typically knows a mobile device or their phone 
contains a lot of evidence or someone's patterns of life, but 
with some of the other devices, that it comes to our 
automobiles, obviously our computer systems, smart TVs, 
personal assistant devices. If you think of all the things we 
interact with that could be a potential part of a crime, those 
officers need to be trained when they are responding to an 
incident what potentially could contain evidence.
    So we are trying to educate them the best we can through a 
lot of education opportunities. When have our recruit schools 
for new troopers we have a segment training them on scenarios. 
So the biggest thing we can do is continue our training and 
education. We bring local officers into our office as pseudo 
full-time members working as affiliates to investigate digital 
crime. Once their department sees how valuable they are and an 
asset to their agency, it is good for us because we can keep 
them and the police organizations typically want them involved 
to get training.
    There is a lot of industry standard training that can be 
taken just regarding evidence recovery and knowing 
cybersecurity in general--if I can put it that way. But a lot 
of our younger people are more apt to the devices and the 
capabilities because they grew up with it in their hands. So 
some of our younger folks are easily more trained than maybe 
some of us were a few years ago.
    Mrs. Demings. Of course that is not just a challenge for 
Michigan. You know, in Florida, and really across the Nation, 
really making sure that your work force keeps up with the 
challenges and the technology of the day.
    How would you say the Federal Government could assist in 
this area more? Is that through CISA making resources more 
available for training opportunities?
    Mr. Ellis. Thank you for the question.
    We are always up for additional training and assistance. 
DHS CISA is an excellent partner in Michigan of ours. We 
collaborate on a lot of different initiatives and take 
advantage of training. It is like I tell all my folks in the 
Michigan Cyber Command Center, the more training, the better, 
along with our affiliates, and even our analysts that are on 
board. In these days the general officer on the road should be 
taking some type of cybersecurity-related training to help them 
with their investigations, without a doubt.
    Mrs. Demings. Well, again, thank you so much for your 
service. We are working on some legislation that involves the 
digital technology area, including training for law enforcement 
officers. So I am hoping that we will be able to move that 
through very, very quickly.
    Thank you.
    Madam Chair, I yield back.
    Chairwoman Slotkin. Thank you. Those sounded like good 
questions from a former police chief of a major city. That 
sounded about right.
    So let me just ask for the Michiganders in the room and 
watching, help us understand what an average ransomware attack 
looks like in the State of Michigan. Maybe go through--you can 
pick one that is representative of a closed investigation. You 
don't have to give any identifiable information. But walk us 
through what that looks like.
    Then same thing on sexploitation. You have a whole unit 
that is worried about this. Help us understand in detail what 
those cases look like so parents and business owners understand 
what they are looking for.
    Mr. Ellis. Sure. Typically in a ransomware event--and I 
can, you know, look as far back as yesterday morning. This is 
not really any different than any other ransomware case that is 
local to a business in Michigan. They will notice that their 
files are encrypted. As most users, once files are encrypted it 
is obvious because you can't access your files. They get 
messages on the screens, wallpapers change on your desktop, 
that kind of thing.
    They will call, we will go through an evaluation with them. 
We typically bring on more partners sometimes, depending on the 
business. We often times will include our Federal partners in 
the discussion just to walk through the steps and look at where 
they are at, are they able to recover. Oftentimes they may have 
cyber insurance and that initially limits us from getting 
potential evidence, at least initially, depending if legal is 
involved. But otherwise our first avenue is to try to obtain 
evidence and, you know, if their IT staff or if we can get an 
image of a device to try and locate those indicators of 
compromise, we will do that and help them understand what 
happened on their network and, like I said earlier, take that 
information back to push it back out to everybody else for 
prevention and awareness.
    Oftentimes they will look for resources for those small-to-
medium businesses that don't have a plan, aren't sure what to 
do. We will help guide them in that respect. Within Michigan we 
also have the Michigan Cyber Civilian Corps. If they have 
several work stations that they need assistance with or they 
are not sure how maybe the incident happened or need, you know, 
hands on keyboards, the Michigan Cyber Civilian Corps, or MiC3, 
is a group of volunteers that have been vetted that work in 
Michigan businesses----
    Chairwoman Slotkin. You all would connect them to the----
    Mr. Ellis. We would connect them, they become indemnified 
as State employees and they can assist with the recovery of an 
incident.
    Chairwoman Slotkin. This incident that you were 
investigating yesterday morning, what are they asking for, how 
much money? Like give us a little bit of a flavor of the 
threat.
    Mr. Ellis. Yes, in this case, you know, I can tell you end-
point-wise they have 100 end-points----
    Chairwoman Slotkin. What is an end-point?
    Mr. Ellis. A device that a user sits at. A keyboard that 
somebody uses. They may have--I don't know that they announced 
their ransom yet because we went to that site--they are getting 
creative where they will tell you they will provide you a link 
to go to and this site was down all day yesterday. So lack of 
planning on their end to be able to obtain their ransom. But 
typically, depending on the small-to-medium business, it can be 
anywhere from $20,000 to $100,000 depending on what is at 
stake. Typically the bad actors know what data they have, what 
they have access to obviously, and, you know, the prime data 
goes for a bigger price.
    Chairwoman Slotkin. Is it fair to say that some of these 
organizations, these bad actors, have done research, they have 
looked on social media, they have looked on public transparency 
websites? Like they have done their homework on an organization 
before they decide to ransom them?
    Mr. Ellis. Absolutely. They know price points, they know 
the budget, they know if a school is being remodeled over the 
summer based on the RFP, who won the bid. I mean they are going 
in there with knowledge and have chosen a target that they 
think they can succeed at.
    Chairwoman Slotkin. Then, again, explain the threat, or 
just a recent example on the sexploitation. Sort-of how do they 
use children's data or how do they ransom it or use it to make 
money?
    Mr. Ellis. Yes. Sextortion is typically pictures are taken 
or relationships are built through chat on same old device or 
Snapchat or any other messaging platform. They will gain the 
user's confidence--usually this is big with students right now, 
younger people--and get them to send a provocative picture. 
Oftentimes they are misrepresenting themselves as maybe--if 
they are chatting with a male they may represent themselves as 
a young female, attractive, sending pictures--normal pictures, 
not anything provocative--and eliciting pictures back. Once 
they finally do send a picture back, they will then demand that 
they pay a ransom or a payment, otherwise they will publish the 
photo publicly. As you can imagine, being at that age, when 
your identity is everything, social media is everything, that 
is, you know, not something you would want among your peers.
    Just recently we have had a case where this happened and 
our young gentleman paid the fee that was being asked. The 
person had indicated prior they would remove any pictures that 
they had possession of, but then again came back and asked for 
more. Unfortunately this student committed suicide over this. 
This all occurred within a 6-hour period in Michigan.
    Chairwoman Slotkin. Oh.
    Mr. Ellis. So it has devastating effects and it is one of 
the fastest-growing incidents that we are seeing among young 
people right now.
    Chairwoman Slotkin. Oh, gosh. OK. Well, I have much more to 
ask about that. But we are on to a second round of questions.
    Ready for recognition? Oh, OK. Sorry, I was supposed to 
recognize myself.
    So let me just ask, can a young person under 18--is there 
any rules around whether they are able to pay? I mean did this 
young person handle it themselves? What are the protections for 
people under 18 that are maybe different from an adult?
    Mr. Ellis. They can handle it themselves. In this case, and 
several cases, they do because they do not want anybody to 
know.
    Typically in these type of cases, the people, younger 
people, our kids, don't want anything to know about--they don't 
want their parents to know about it or their relatives or their 
friends. So those that typically should be closest to them, 
they are most embarrassed over. We are finding that--as far as 
age, you know, we do have some that go to their parents and 
request payment and that starts another whole investigation.
    I will say on the investigation that I did just mention, 
thanks to our Federal partners, we have located somebody that 
we are confident we will be able to take action against.
    Chairwoman Slotkin. Great. So are the folks who are 
ransoming our young people for, you know, these explicit 
pictures, do they have a different threat profile than some of 
the ransomware folks? Is it still folks who are coming from 
overseas or is it much more local? Kind-of what is the intent 
other than to ransom folks? Are they then going on and using 
it, you know, for pornography on-line? Just like help us 
understand what might be different from--you know, are they 
more local basically?
    Mr. Ellis. Yes. The majority of cases we see they are not 
local. The person I am referring to that is a suspect was in 
Nigeria.
    Chairwoman Slotkin. Oh.
    Mr. Ellis. So they are looking at kids, they are looking at 
social media pages. I mean they are portraying a friend that 
gets accepted into their friend community and learn everything 
they can about them, establish a relationship, and, you know, 
the student has no idea who they are talking to. So it is very 
unfortunate.
    But, yes, the motivation is a little bit different. They 
know they are not going to get a lot of money out of a younger 
person and, you know, compared to a ransomware where they may 
hit a business that has deeper pockets potentially. But again 
they can go after several students, gain these relationships 
over time. A lot of the suspects we are seeing are younger, so 
we are still in the research phase of are they going to be 
moving on to bigger and better things, are they a quick-hit 
opportunity to get a few hundred dollars, or a little bit more.
    So, yes, there is a lot of research going on into that 
right now.
    Chairwoman Slotkin. So, again, just to give people a sense 
of the threat, this young person who was ransomed and then 
ended up, you know, terribly committing suicide over the 
potential exposure, how much money are we talking about? What 
was the request for ransom?
    Mr. Ellis. Less than $1,000.
    Chairwoman Slotkin. Then just for the young people, if you 
have got a 16- or a 17-year-old, who of course is deeply 
embarrassed in front of their community to admit that they sent 
these photos, if they contact law enforcement will their 
parents be contacted?
    Mr. Ellis. Depending on the circumstance and their age--
depending. I will say the circumstances can be different. 
Typically we will notify a parent. Obviously if they are over 
17, that doesn't always happen just because of their age in 
Michigan and legal requirements. But, yes, I mean we will 
notify a parent, a trusted guardian, or if they have a relative 
we can start there. But typically we will talk them into why 
they need to contact a parent or let them know that, you know, 
it is going to be OK and why we need to contact their parent.
    Chairwoman Slotkin. Yes.
    Mr. Ellis. Just because of the potential outcome.
    Chairwoman Slotkin. I think the thing that ties the issue 
of sexploitation and just ransomware in general for businesses 
and local officials is how these bad actors pull threads from 
publicly-available information, right. As a former CIA officer 
and Pentagon official, we are taught--just it is--we are beaten 
over the head on you shouldn't put out personally identifiable 
information, talk about where you are going on vacation, 
talking about that new deck that you are building on that 
house. That kind of stuff can be pieced together so that people 
can basically breed familiarity so that they--it seems like 
they know you really well, they are someone who is in your 
kind-of community or that just they have figured out you are 
spending money on things, the things that you value in your 
life and what you would be willing to pay to protect.
    So, you know, for folks who are not in law enforcement or 
come from an intelligence background, talk about personally 
identifiable information. Particularly we talked in the last 
session about how that helps people figure out passwords and 
answers to security questions. Just talk about how those bad 
actors piece the stories together.
    Mr. Ellis. Sure. I mean if you think about--good question, 
and thank you.
    If you think about the average social media account, 
depending how active anyone in this room may be, there are some 
people that are very active and they post everything from 
pictures of their home, their vehicles, what they eat--I mean 
you name it, every activity of their day is on-line. Oftentimes 
you can build a tremendous profile and get to know a pattern of 
life of somebody from their address, based on photos, where 
they are going to be playing ball that night, where dance 
practice is going to be. They think they are just taking 
pictures of their friends, but if you start looking in the 
background you can piece all this together.
    So it is very important to parents to know what their 
children are doing, know what their young adults are doing. Pay 
attention, ask questions, look on their accounts. They will be 
glad you did in the long run. You can kind-of see if you can 
put a pattern of life together based on what they are posting.
    Chairwoman Slotkin. Thank you for that.
    The Chair now recognizes for 5 minutes the gentlewoman from 
Texas, Ms. Jackson Lee.
    Ms. Jackson Lee. Thank you, again, Madam Chair, for this 
hearing. I want to express my appreciation for the witnesses on 
the first panel from the Department of Homeland Security and I 
hope it exposed to the Nation, to the great resources that we 
have in the Federal Government, and also the work, legislative 
work that has been done by this committee, by the full 
committee and Chairman Thompson, and the work that I have done 
regarding zero-day incidences in trying to ensure that major 
attacks against much of our infrastructure does not bring 
America to a point of disaster.
    Working with local communities is certainly an important 
moment and it is an important moment because it provides 
education.
    So I would be interested, and if said before I ask you to 
say it again, as I have taken note of the attacks from the 
medical center in Yuma, Arizona in April, Texas Tech in my 
State announced that the ECL ransomware attack in December 
potentially affected 1.29 million of their patients. This can 
be a deep dive into the personal lives of individuals and 
private information.
    So I would be interested, again, if you would State if you 
put in policies that provide a wall of infrastructure around 
potential cyber ransomware attacks.
    Also should we--I think I heard a discussion about 
insurance--should there be a mechanism to compensate those who 
have been harmed--this is a crime, but it is also in the civil 
sphere as well--by the loss of their data? I think it is really 
something that is a new phenomenon. Children are hurt, families 
are hurt, patients are hurt, small businesses are hurt. I think 
we need to emphasize this as a larger question than sometimes 
what it may be predicted.
    So with your years of law enforcement experience, I am sure 
you have had to solve cases, you have seen crime victims, what 
would be your viewpoint on how we address the elements that I 
have said, the loss of data, the impact on an individual or 
business, and the kind of infrastructure we should stand up to 
be much safer.
    Lieutenant Ellis.
    Mr. Ellis. Thank you for the question.
    You know, it comes down to security and it is--your 
question would actually solve a lot of things if we knew what 
that answer was as far as infrastructure. Because one of the 
things we face, even with those in cybersecurity that are 
putting all the protections in place with firewalls, IDS, IPS, 
all the security devices, user awareness training, there is 
always something new coming out based on new software, new 
technologies. I feel like we would always be chasing down new 
solutions.
    There are solutions out there that will protect data itself 
versus the infrastructure that the data resides on or 
traverses. They are expensive solutions, they are typically at 
the Federal level and just coming into play now. We are hoping 
to see more of this. Essentially what that is is--I have just 
seen samples of this where you can pretty much put any kind of 
data in the worst environment and it really cannot be used in 
any way, even if they exfiltrated it. It is impervious to 
malware. There are solutions out there. They are expensive. You 
know, that is one solution when some people find out or 
entities and businesses find out about this, the common 
question is why doesn't everybody use these solutions?
    It typically comes down to price, unfortunately. But that 
is just one way that you could help combat this. But I feel 
like there is no one solution that is going to solve all of 
this immediately with how we do things today when it comes to 
cyber.
    Ms. Jackson Lee. Let me thank you so very much.
    Madam Chair, as I yield back let me thank you for this 
hearing that has been enormously informative. I think Mr. Ellis 
has left us with next steps in particularly how we can assist 
States across America. Focusing on Michigan and the local needs 
and the local insights I think has been vital for this full 
committee.
    I look forward to working with you back in Washington to be 
sure we take this very vital information and incorporate it 
into solutions to some of the issues being raised here by these 
representatives from your State and of course those from the 
Department of Homeland Security.
    Thank you so very much. Again, thank you for your 
leadership and I am yielding back.
    Thank you.
    Chairwoman Slotkin. Thank you, Congresswoman.
    With that, I thank the witness for his valuable time and 
testimony and the Members for their questions. Thanks for the 
opportunity to just pulse you one-on-one on how our Michigan 
organizations can protect themselves.
    I urge again all of our businesses, our farmers, our K-12 
schools, our local electeds to get to know Mr. Ellis and his 
team before you have a problem. Take all your friends in the 
sector that you come from, ask for a meeting.
    I know that him and his team are very responsive and you 
can understand how to protect yourself. Have a relationship, 
have a business card before you have a major incident, since we 
know that chances are folks in the room are going to be on the 
wrong end of a ransomware attack at some point in their careers 
unfortunately.
    Members of the subcommittee may have additional questions 
for all of our witnesses. We ask that you respond expeditiously 
in writing to those questions. The Chair reminds Members of the 
subcommittee that the record will remain open for 10 business 
days.
    Without objection, the subcommittee stands adjourned.
    [Whereupon, at 12:54 p.m., the subcommittee was adjourned.]