[House Hearing, 117 Congress]
[From the U.S. Government Publishing Office]
STOPPING DIGITAL THIEVES: THE GROWING
THREAT OF RANSOMWARE
=======================================================================
HYBRID HEARING
BEFORE THE
SUBCOMMITTEE ON OVERSIGHT AND
INVESTIGATIONS
OF THE
COMMITTEE ON ENERGY AND COMMERCE
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
__________
JULY 20, 2021
__________
Serial No. 117-44
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Published for the use of the Committee on Energy and Commerce
govinfo.gov/committee/house-energy
energycommerce.house.gov
__________
U.S. GOVERNMENT PUBLISHING OFFICE
52-136 PDF WASHINGTON : 2023
-----------------------------------------------------------------------------------
COMMITTEE ON ENERGY AND COMMERCE
FRANK PALLONE, Jr., New Jersey
Chairman
BOBBY L. RUSH, Illinois CATHY McMORRIS RODGERS, Washington
ANNA G. ESHOO, California Ranking Member
DIANA DeGETTE, Colorado FRED UPTON, Michigan
MIKE DOYLE, Pennsylvania MICHAEL C. BURGESS, Texas
JAN SCHAKOWSKY, Illinois STEVE SCALISE, Louisiana
G. K. BUTTERFIELD, North Carolina ROBERT E. LATTA, Ohio
DORIS O. MATSUI, California BRETT GUTHRIE, Kentucky
KATHY CASTOR, Florida DAVID B. McKINLEY, West Virginia
JOHN P. SARBANES, Maryland ADAM KINZINGER, Illinois
JERRY McNERNEY, California H. MORGAN GRIFFITH, Virginia
PETER WELCH, Vermont GUS M. BILIRAKIS, Florida
PAUL TONKO, New York BILL JOHNSON, Ohio
YVETTE D. CLARKE, New York BILLY LONG, Missouri
KURT SCHRADER, Oregon LARRY BUCSHON, Indiana
TONY CARDENAS, California MARKWAYNE MULLIN, Oklahoma
RAUL RUIZ, California RICHARD HUDSON, North Carolina
SCOTT H. PETERS, California TIM WALBERG, Michigan
DEBBIE DINGELL, Michigan EARL L. ``BUDDY'' CARTER, Georgia
MARC A. VEASEY, Texas JEFF DUNCAN, South Carolina
ANN M. KUSTER, New Hampshire GARY J. PALMER, Alabama
ROBIN L. KELLY, Illinois, Vice NEAL P. DUNN, Florida
Chair JOHN R. CURTIS, Utah
NANETTE DIAZ BARRAGAN, California DEBBBIE LESKO, Arizona
A. DONALD McEACHIN, Virginia GREG PENCE, Indiana
LISA BLUNT ROCHESTER, Delaware DAN CRENSHAW, Texas
DARREN SOTO, Florida JOHN JOYCE, Pennsylvania
TOM O'HALLERAN, Arizona KELLY ARMSTRONG, North Dakota
KATHLEEN M. RICE, New York
ANGIE CRAIG, Minnesota
KIM SCHRIER, Washington
LORI TRAHAN, Massachusetts
LIZZIE FLETCHER, Texas
------
Professional Staff
JEFFREY C. CARROLL, Staff Director
TIFFANY GUARASCIO, Deputy Staff Director
NATE HODSON, Minority Staff Director
Subcommittee on Oversight and Investigations
DIANA DeGETTE, Colorado
Chair
ANN M. KUSTER, New Hampshire H. MORGAN GRIFFITH, Virginia
KATHLEEN M. RICE, New York Ranking Member
JAN SCHAKOWSKY, Illinois MICHAEL C. BURGESS, Texas
PAUL TONKO, New York DAVID B. McKINLEY, West Virginia
RAUL RUIZ, California BILLY LONG, Missouri
SCOTT H. PETERS, California, Vice NEAL P. DUNN, Florida
Chair JOHN JOYCE, Pennsylvania
KIM SCHRIER, Washington GARY J. PALMER, Alabama
LORI TRAHAN, Massachusetts CATHY McMORRIS RODGERS, Washington
TOM O'HALLERAN, Arizona (ex officio)
FRANK PALLONE, Jr., New Jersey (ex
officio)
C O N T E N T S
----------
Page
Hon. Diana DeGette, a Representative in Congress from the State
of Colorado, opening statement................................. 2
Prepared statement........................................... 4
Hon. H. Morgan Griffith, a Representative in Congress from the
Commonwealth of Virginia, opening statement.................... 5
Prepared statement........................................... 7
Hon. Frank Pallone, Jr., a Representative in Congress from the
State of New Jersey, opening statement......................... 8
Prepared statement........................................... 9
Hon. Cathy McMorris Rodgers, a Representative in Congress from
the State of Washington, opening statement..................... 10
Prepared statement........................................... 12
Witnesses
Kemba Walden, Assistant General Counsel, Microsoft Corporation
Digital Crimes Unit............................................ 14
Prepared statement........................................... 17
Answers to submitted questions............................... 121
Robert M. Lee, Chief Executive Officer, Dragos................... 27
Prepared statement........................................... 29
Answers to submitted questions............................... 125
Christian Dameff, M.D., Assistant Professor of Emergency
Medicine, Biomedical Informatics, and Computer Science,
University of California San Diego............................. 34
Prepared statement........................................... 36
Answers to submitted questions............................... 132
Charles Carmakal, Senior Vice President and Chief Technical
Officer, FireEye Mandiant...................................... 39
Prepared statement........................................... 42
Answers to submitted questions............................... 137
Philip James Reiner, Chief Executive Officer, Institute for
Security and Technology........................................ 47
Prepared statement........................................... 49
Answers to submitted questions............................... 144
Submitted Material
Cybersecurity Strategy Report, Majority Staff, Energy and
Commerce Committee, December 7, 2018, submitted by Mr. Griffith 97
STOPPING DIGITAL THIEVES: THE GROWING THREAT OF RANSOMWARE
----------
TUESDAY, JULY 20, 2021
House of Representatives,
Subcommittee on Oversight and Investigations,
Committee on Energy and Commerce,
Washington, DC.
The subcommittee met, pursuant to call, at 10:34 a.m.., in
the John D. Dingell Room 2123, Rayburn House Office Building,
and remotely via Cisco Webex online video conferencing, Hon.
Diana DeGette (Chair of the subcommittee) presiding.
Members present: Representatives DeGette, Kuster, Rice,
Schakowsky, Tonko, Ruiz, Peters, Schrier, Trahan, O'Halleran,
Pallone (ex officio), Griffith (subcommittee ranking member),
Burgess, McKinley, Dunn, Joyce, Palmer, and Rodgers (ex
officio).
Also present: Representative McNerney.
Staff present: Jeffrey C. Carroll, Staff Director; Austin
Flack, Policy Analyst; Waverly Gordon, General Counsel; Tiffany
Guarascio, Deputy Staff Director; Perry Hamilton, Clerk;
Rebekah Jones, Counsel; Zach Kahan, Deputy Director, Outreach
and Member Service; Chris Knauer, Oversight Staff Director;
Kevin McAloon, Professional Staff Member; Will McAuliffe,
Counsel; Jon Monger, Counsel; Kaitlyn Peel, Digital Director;
Kylea Rogers, Staff Assistant; Andrew Souvall, Director of
Communications, Outreach, and Member Services; Benjamin Tabor,
Junior Professional Staff Member; Sarah Burke, Minority Deputy
Staff Director; Marissa Gervasi, Minority Counsel, Oversight
and Investigations; Nate Hodson, Minority Staff Director; Peter
Kielty, Minority General Counsel; Emily King, Minority Member
Services Director; Bijan Koohmaraie, Minority Chief Counsel;
Clare Paoletta, Minority Policy Analyst, Health; Alan Slobodin,
Minority Chief Investigative Counsel, Oversight and
Investigations; Michael Taggart, Minority Policy Director.
Ms. DeGette. The Subcommittee on Oversight and
Investigations hearing will now come to order.
And I must say we are all extremely glad to be back in
person. Welcome back to our in-person Members, and welcome to
our Members who are here remotely.
Today our subcommittee is having a hearing called
``Stopping Digital Thieves: The Growing Threat of Ransomware,''
and the hearing will examine the growing threats posed by
ransomware to U.S. businesses and critical infrastructure, and
we will discuss recommendations for combating those threats.
Due to the COVID-19 public health emergency, as I said,
members can participate either in person or remotely. And if
members are not vaccinated--I think everybody here is, but if
they are not, they must wear a mask and be socially distanced.
They can remove their mask when they are recognized. And again,
anyone else present in this committee room, including press,
must wear a mask and be socially distanced or be vaccinated.
For Members who are participating remotely, your
microphones will be set on mute for the purposes of eliminating
any background noise. Members participating remotely will need
to unmute our microphone each time you wish to speak. Please
note once you unmute your microphone, anything that is said in
Webex will be heard over the loudspeakers in the committee
room, and may--and will be on C-SPAN. So just--we have
experienced that some in the last few weeks, so just be aware.
Because Members are participating from different locations,
all recognition of Members, such as for questions, will be in
the order of subcommittee seniority.
And as always, if at any time during the hearing I am
unable to chair the hearing, the vice chair of the
subcommittee, Mr. Peters, will serve as Chair until I am able
to return.
Documents for the record can be sent to Austin Flack at the
email address we have provided to staff. All documents will be
entered into the record at the conclusion of the hearing.
And the Chair will now recognize herself for the purposes
of making an opening statement.
OPENING STATEMENT OF HON. DIANA DeGETTE, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF COLORADO
Today's hearing tackles a growing threat to our national
security, economic security, and public safety, and that is
ransomware. In short, a ransomware attack occurs when criminals
break into a network, lock it down, steal data, and then extort
everyday Americans into, often, massive ransom payments. These
digital thieves are infiltrating our schools, hospitals, food
suppliers, and critical infrastructure companies.
The seriousness of the issue is hard to overstate. All you
need to do is to look at the front page of the newspaper to see
the problem is getting worse. Earlier this year, the whole
country watched as a single attack on Colonial Pipeline's
information technology system shut down the gas and fuel supply
to the entire eastern seaboard. This attack alone caused
massive gas lines, hoarding--and many stations ran out of fuel.
Last year, more than 560 healthcare organizations, many of
which were already reeling from COVID-19, found themselves
victims of ransomware. Hospital systems had to cancel
appointments and surgeries, reroute ambulances, and delay
critical treatment for cancer patients.
Our food supply was also recently in the crosshairs when, a
few weeks ago, cyber criminals attacked the company JBS, the
largest meat producer in the world, threatening a vital link in
our Nation's food supply.
And these are just the attacks that we know about.
Companies and organizations wanting to save face and maintain
the confidence of the public often meet the ransom demands in
secret--always pay in hard-to-trace cryptocurrency.
Like many--or almost always doing that.
Like many of the issues we have examined in the last year
and a half, like vaccine confidence and the state of our public
health infrastructure, the ransomware challenge is not new, but
it has been exacerbated by the COVID-19 crisis. Cyber criminals
thrive on exploiting vulnerabilities in our networks. The
explosion of remote work and remote school during the pandemic
greatly expanded these vulnerabilities.
For example, experts are projecting our K through 12
schools will face a nearly 90 percent increase in the number of
ransomware attacks just this year. And it is not just the
breadth of targets that is growing. The average size of ransom
payments has also increased, reaching an estimated $312,000 per
organization in 2020.
Simply put, the time to address this crisis is now. To win
the fight, we need not just a whole-of-government approach but,
really, a whole-of-society approach. Both the public and
private sectors have a role to play.
First, the public sector must continue to develop and to
lead a well-coordinated response. This includes coordination
across U.S. Government agencies and private industry, and
working closely with our international partners. With President
Biden's recent actions, we are seeing the outlines of such a
response take place, and the administration is rightfully
treating the issue as a national security threat.
For example, our Nation's first Cyber Director was sworn in
just last week, and our Federal agencies are conducting a
series of collaborations with the private sector to address
ransomware and other critical cyber issues. I applaud the
efforts that the Cybersecurity and Infrastructure Security
Agency announced last week. That agency is working to ensure
that small to medium-sized businesses across our country are--
that are victimized by ransomware attacks have the resources
needed to minimize harm and restart operations.
Internationally, it is imperative that countries no longer
provide safe haven for these criminal organizations. And
President Biden has vowed that America will take any necessary
action to defend its people and its critical infrastructure.
The President already addressed the international part of this
issue head on, both at the G7 summit and in multiple one-on-one
conversations with Russian President Vladimir Putin. And just
yesterday, the U.S., along with our European Union and NATO
allies, condemned China for its state-sponsored cyber
activities, including ransomware attacks.
While the administration's actions are promising, the
public sector cannot defeat ransomware on its own. For example,
following a ransomware attack, too often we hear of lax
cybersecurity requirements or known vulnerabilities that were
ignored. We have had a number of classified briefings where we
heard about that. And it is critical that companies of all
sizes address chronic underinvestment in cyber defenses. Better
cyber hygiene, more cyber expertise, and meaningful information
sharing will address this threat.
And Congress also has an important role to play in this.
Just last week, key government cyber experts indicated that
additional executive authorities may be needed to ensure the
private sector gets to where it needs to be.
As a committee, we must ensure that the executive branch
has the tools and authorities to mandate effective
cybersecurity requirements for vulnerable industries, modernize
our defenses, and ensure that we are postured to compete with
those threats. There is no shortage of policy proposals being
discussed. Those include mandatory reporting of ransomware
attacks, prohibitions on ransom payments, and increased
regulation of critical industries and cybersecurities.
This morning, I want to say, we have a terrific panel of
experts who have spent decades addressing ransomware and other
cyber crimes, and I am really looking forward to hearing from
all of you.
One thing is certain: This problem is not going away. The
problem has grown exponentially over the last decade, and we
must respond in kind. We must do everything we can to fix our
vulnerabilities and to protect our critical industries.
[The prepared statement of Ms. DeGette follows:]
Prepared Statement of Hon. Diana DeGette
Good morning. It is good to see many of you in person,
after being remote for so long.
Today's oversight hearing tackles a growing threat to our
national security, economic security, and public safety, which
is ransomware.
In short, a ransomware attack occurs when criminals break
into a network, lock it down, steal data, and then extort
everyday Americans into often massive ransom payments.
These digital thieves are infiltrating our schools,
hospitals, food suppliers, and critical infrastructure
companies.
The seriousness of the issue is hard to overstate. All you
need to do is look at the front page of the newspaper to see
that the problem is getting worse.
Earlier this year, the country watched as a single attack
on Colonial Pipeline's information technology system shut down
the gas and fuel supply to nearly the entire eastern seaboard.
This attack alone caused massive gas lines, hoarding, and
many stations ran out of fuel.
Last year, more than 560 healthcare organizations--many of
which were already reeling from the COVID-19 pandemic--found
themselves victims of ransomware.
Hospital systems had to cancel appointments and surgeries,
reroute ambulances, and delay critical treatment for cancer
patients.
Our food supply was recently in the crosshairs, too. Just a
few weeks ago, cyber criminals attacked the company JBS, the
largest meat producer in the world, threatening a vital link in
the nation's food supply.
And these are just the attacks we know about.
Companies and organizations wanting to save face and
maintain the confidence of the public often meet the ransom
demands in secret, almost always paying in hard-to-trace
cryptocurrency.
Like many of the issues we have examined in the last year
and a half-such as vaccine confidence and the state of our
public health infrastructure-the ransomware challenge is not
new, but it has been exacerbated by the COVID-19 crisis.
Cybercriminals thrive on exploiting vulnerabilities in our
networks. The explosion of remote work and remote school during
the COVID-19 pandemic greatly expanded those vulnerabilities.
For example, experts are projecting our K 0912 schools will
face a nearly 90 percent increase in the number of ransomware
attacks just this year.
And it is not just the breadth of targets that is growing.
The average size of ransom payments has also increased,
reaching an estimated $312,000 per organization in 2020.
Simply put, the time to address this issue is now.
To win this fight, we need not just a whole-of-government
approach, but a whole-ofsociety approach. Both the public and
private sectors have important roles to play.
First, the public sector must continue to develop and lead
a well-coordinated response.
This includes coordination across US government agencies
and private industry and working closely with our international
partners.
With President Biden's recent actions, we are seeing the
outlines of such a response take shape, and the Administration
is rightfully treating the issue as a national security threat.
For example, our nation's first National Cyber Director was
sworn in just last week. And our federal agencies are
conducting a series of collaborations with the private sector
to address ransomware and other critical cyber issues.
I applaud the efforts that the Cybersecurity and
Infrastructure Security Agency (CISA) announced last week. CISA
is working to ensure that small-to-medium sized businesses
across our country that are victimized by ransomware attacks
have the resources needed to minimize harm and restart
operations.
Internationally, it is imperative that countries no longer
provide safe haven for these criminal organizations, and
President Biden has vowed that America will take any necessary
action to defend its people and its critical infrastructure.
In fact, we have already seen the President address the
international part of this issue head-on, both at the G7 summit
and in multiple one-on-one discussions with Russian President
Vladimir Putin. And, just yesterday, the United States, along
with our European Union and NATO allies, condemned China for
its state-sponsored cyber activities, including ransomware
attacks.
While the Administration's actions are promising, the
public sector cannot defeat ransomware on its own.
For example, following a ransomware attack, we too often
hear of lax cybersecurity requirements or known vulnerabilities
that were ignored.
It is critical that private companies of all sizes address
chronic underinvestment in cyber defenses. Better cyber
hygiene, more cyber expertise, and meaningful information
sharing will be necessary to address this threat.
And Congress has an important role to play in this. In
fact, just last week, key government cyber experts indicated
that additional executive authorities may be needed to ensure
the private sector gets to where it needs to be.
As a Committee, we must ensure the executive branch has the
tools and authorities it needs to mandate effective
cybersecurity requirements for our vulnerable industries,
modernize our defenses, and ensure we are postured to compete
with these threats.
There is no shortage of policy proposals being discussed.
These include mandatory reporting of ransomware attacks,
prohibitions on ransom payments, and increased regulation of
critical industries and cryptocurrencies.
This morning we have a terrific panel of experts who have
spent decades addressing ransomware and other cybercrimes, and
I look forward to hearing from our witnesses on these and other
ideas. One thing is certain: this problem is not going away.
The ransomware threat has grown exponentially over the last
decade, and our response must grow in-kind. We must do
everything we can as a nation to fix our vulnerabilities and
protect our critical industries.
Thank you.
Ms. DeGette. And I want to thank all of you and recognize
our ranking member for 5 minutes for the purposes of an opening
statement.
OPENING STATEMENT OF HON. H. MORGAN GRIFFITH, A REPRESENTATIVE
IN CONGRESS FROM THE COMMONWEALTH OF VIRGINIA
Mr. Griffith. Thank you very much, Chair DeGette, for
holding this hearing, and especially considering the recent
increase in ransomware attacks across our Nation, including
high-profile attacks such as Kaseya, Colonial Pipeline, and
SolarWinds.
I also want to thank the witnesses for taking your time to
join us today.
Cybersecurity is integral to all organizations,and should
be treated as a priority for maintaining the health and
security of an organization as well as any other individuals or
entities that are affiliated with that organization. The need
for more rigorous cybersecurity protections exists across all
industries, including healthcare, oil, gas, water, and
electricity. Any network with vulnerabilities can be subject to
a cyber threat, and the frequency of cyber attacks is
increasing exponentially.
The reach of most recent cyber attacks demonstrates how
serious this issue is. For example, the Colonial Pipeline, one
of the most critical pieces of energy infrastructure, was the
target of a ransomware attack in May. The attack halted all
pipeline operations and caused supply disruption up and down
the East Coast for over a week, which led to higher gas prices
and longer lines. More recently, over the Fourth of July
holiday, the Kaseya supply chain ransomware hack affected
medium and small-sized businesses globally, including in my
district. Both of these attacks appear to be Russia linked,
which is the most recent showing of cyber threat Russia poses
to the United States.
Although the recent attacks appear to be linked to Russia,
adversaries of cyber attacks originate in different foreign
nations, varying in the size of the criminal enterprises. And
their approaches to gaining access to systems range in their
level of sophistication.
However, no one industry or part of our Nation's critical
infrastructure is immune to the threats posed by these
malicious actors. Cyber attacks have the potential to cause
real harm, depending on the severity and the target. In
healthcare in particular, direct harm is almost a certainty.
Any time information in the--in healthcare and public sector is
compromised, it poses a risk to providers, patients, and those
who serve and supply them.
But it is not just data and privacy that are compromised.
Ransomware attacks can have a significant impact on patient
health. For example, in May a ransomware attack hit a San
Diego-based healthcare system, Scripps Health, and the cyber
criminals stole data on close to 150,000 patients. This forced
Scripps Health to not be fully up and running until a month
after the cyber attack--or cyber--ransomware attack. These
types of incidents are detrimental to the care available to the
community and put a major strain on the surrounding healthcare
system and the region. As the ransomware recovery timeframes
increase from days to months, the amount of damages skyrockets.
In a hospital's case, that can mean the difference between life
and death.
The recent ransomware attacks are providing lessons about
the importance of cybersecurity. These systems are fragile.
Although it is impossible for a system to be completely
resilient against any cyber attack, there is much more the
Federal Government, cybersecurity organizations, cyber victim
organizations, and the private sector can do to detect,
respond, and recover from ransomware threats. This is a shared
responsibility, and we need everyone to do their part.
The United States has great cyber experts found in both the
Federal Government and the private sector that supply the key
building blocks to revamping our Nation's cybersecurity. The
Federal Government has strong resources to prevent attacks,
respond to attacks, and hold criminals accountable. We just
need to see more of it, and we need to make better uses of our
resources.
Coupled with the Federal Government resources, we have
private-sector firms that offer cybersecurity consulting for a
range of organizations at different entry points in the
cybersecurity cycles and at different levels of cybersecurity
risk. Moreover, we have experts that focus exclusively on
industrial control systems and operation technology
cybersecurity. We also have nonprofit networks that design
solutions for emerging threats, and private companies with
specialized professionals to disrupt criminal enterprise.
We need to ensure an open line of communication,
coordination, and information sharing in the cyber world and
delineate proper responsibilities for developing cybersecurity
strategies to the appropriate entities.
It is impossible to eliminate all cyber threats to our
Nation. However, we need to do more to better prevent and
detect ransomware attacks so that we can thwart the worst-case
outcomes and scenarios, especially when it comes to critical
infrastructure.
I look forward to hearing from the witnesses here today,
given their expertise and experiences in this space, and I am
eager to learn more about what we can do to help prevent and
detect future ransomware attacks.
I yield back. Thank you, Madam Chair.
[The prepared statement of Mr. Griffith follows:]
Prepared Statement of Hon. H. Morgan Griffith
Thank you, Chair DeGette, for holding this hearing,
especially considering the recent increase in ransomware
attacks across our nation, including high-profile attacks such
as Kaseya, Colonial Pipeline, and SolarWinds. I also want to
thank the witnesses for taking the time to join us today.
Cybersecurity is integral to all organizations and should
be treated as a priority for maintaining the health and
security of an organization, as well as any other individuals
or entities that are affiliated with that organization. The
need for more rigorous cybersecurity protections exists across
all industries, including health care, oil, gas, water, and
electricity. Any network with vulnerabilities can be subject to
a cyber threat, and the frequency of cyberattacks is increasing
exponentially.
The reach of the most recent cyberattacks demonstrates how
serious this issue is. For example, the Colonial Pipeline, one
of the most critical pieces of energy infrastructure, was the
target of a ransomware attack in May. The attack halted all
pipeline operations and caused supply disruption up and down
the East Coast for over a week - which led to higher gas prices
and longer lines. More recently, over the Fourth of July
holiday, the Kaseya supply chain ransomware hack affected
medium and small-sized business globally. Both of these attacks
appear to be Russia-linked, which is the most recent showing of
the cyber threat Russia poses to the U.S.
Although the recent attacks appear to be linked to Russia,
adversaries of cyber-attacks originate in different foreign
nations, vary in the size of the criminal enterprises, and
their approaches to gaining access to systems range in their
level of sophistication. However, no one industry or part of
our nation's critical infrastructure is immune to the threats
posed by these malicious actors. Cyberattacks have the
potential to cause real harm, depending on the severity and
target.
In health care in particular, direct harm is almost a
certainty. Anytime information in the health care and public
health sector is compromised, it poses a risk to providers,
patients, and all those who serve and supply them. But it is
not just data and privacy that are compromised - ransomware
attacks can have a significant impact on patient health.
For example, in May, a ransomware attack hit a San-Diego
based health system, Scripps Health, and the cybercriminals
stole data on close to 150,000 patients. This forced the
Scripps Health system to not be fully up and running until a
month after the ransomware attack. These types of incidents are
detrimental to the care available to the community and put a
major strain on the surrounding health care system in the
region. As the ransomware recovery timeframes increase from
days to months, the amount of damage skyrockets. In a
hospital's case, that can mean a difference between life and
death.
The recent ransomware attacks are providing lessons about
the importance of cybersecurity. These systems are fragile.
Although it is impossible for a system to be completely
resilient against any cyberattack, there is much more the
federal government, cybersecurity organizations, cyber victim
organizations, and the private sector can do to detect,
respond, and recover from ransomware threats. This is a shared
responsibility and we need everyone to do their part.
The United States has great cyber experts found in both the
federal government and the private sector that supply the key
building blocks to revamping our nation's cybersecurity. The
federal government has strong resources to prevent attacks,
respond to attacks, and hold criminals accountable. We just
need to see more of it-and we need to make better use of these
resources.
Coupled with the federal government resources, we have
private sector firms that offer cybersecurity consulting for a
range of organizations at different entry points in their
cybersecurity cycles and at different levels of cybersecurity
risk. Moreover, we have experts that focus exclusively on
industrial control systems (ICS) and operations technology (OT)
cybersecurity. We also have non-profit networks that design
solutions for emerging threats and private companies with
specialized professionals to disrupt criminal enterprises. We
need to ensure an open line of communication, coordination, and
information sharing in the cyberworld and delineate proper
responsibilities for developing cybersecurity strategies to the
appropriate entities.
It is impossible to eliminate all cyber threats to our
nation. However, we need to do more to better prevent and
detect ransomware attacks so that we can thwart worst-case
outcomes, especially when it comes to critical infrastructure.
I look forward to hearing from the witnesses here today given
their expertise and experiences in this space and am eager to
learn more about what we can do to help prevent and detect
future ransomware attacks. I yield back.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes the chairman of the full committee, Mr. Pallone, for
5 minutes.
OPENING STATEMENT OF HON. FRANK PALLONE, Jr., A REPRESENTATIVE
IN CONGRESS FROM THE STATE OF NEW JERSEY
Mr. Pallone. Thank you. Thank you, Chairwoman DeGette.
The Energy and Commerce Committee has a long history of
examining cybersecurity on a bipartisan basis. Over the past
several years, we have held hearings on strengthening
cybersecurity in the healthcare and energy sectors. We have
also been regularly briefed by agencies on a variety of
critical concerns related to both previous and recent
cybersecurity threats and attacks. While we have made progress,
it is clear much more needs to be done to address the ongoing
threats we see nearly every day.
One area of particular and growing concern is ransomware,
the topic of today's hearing. Ransomware is a malicious
cybersecurity attack that paralyzes victim organizations. The
attack freezes computer systems and holds data hostage until a
ransom payment is received. Ransomware used to be considered a
nuisance crime, impacting only an individual computer. But in
recent years it has evolved to affect the entire networks of
organizations and even governments, extorting entities for
enormous sums of money.
Increasingly, criminals deploying ransomware are not just
freezing the data of victim organizations but are also
pilfering sensitive business and consumer data. On top of
locking down computer networks, they also threaten to release
the stolen data as an additional method to leverage a ransom
payment.
Just in the past few months, we have seen a surge of
ransomware attacks that at times have brought aspects of normal
life and commerce to a standstill. The ransomware attack on the
Colonial Pipeline disrupted oil and gas supplies on the eastern
seaboard, causing many gas stations to run out of fuel, prices
to skyrocket, and grounding air traffic. Other recent attacks
have threatened local police departments, including the DC
Metropolitan Police, and victimized schools, local governments,
and hospitals already grappling with the COVID-19 pandemic.
I also want to underscore that the challenges brought on by
these attacks are particularly acute for small businesses, many
of which lack dedicated information technology staff and the
resources and are just trying to keep their businesses
operating. And these victims may have no idea who to turn to if
their data is subject to a ransomware attack. We simply can't
leave victim organizations on their own in figuring out how to
defend against and respond to these cyber criminals.
So given the huge scale and scope of these threats, I am
pleased that President Biden is taking decisive steps to tackle
this challenge. Just last week, the administration announced a
new website, StopRansomware.gov, that is meant to provide a
one-stop hub of ransomware resources for individuals and
businesses. The website outlines the simple steps small
businesses can take to protect their networks and provides
guidance to these organizations on how to respond to ransomware
incidents.
The President is also leading a whole-of-government effort
to disrupt ransomware campaigns and go after the criminals who
launch them. The administration's strategy announced last week
builds on an effort launched by the White House in May that
will make it more difficult for criminals to transfer funds
using cryptocurrency, helping make U.S. institutions more
resistant to hacking, and urge international cooperation.
But the Biden administration can't address this enormous
challenge on its own. Congress must also take action, and that
is why this oversight hearing is so important today. I look
forward to hearing from our witnesses who have dedicated their
careers to cybersecurity. They are uniquely positioned to make
recommendations on the types of policies needed to defend
against future attacks, and I am interested in their ideas as
we explore potential solutions that will help further protect
our Nation's critical infrastructure networks, businesses, and
consumers.
So with that, I thank the chairwoman for holding this
hearing. I yield back, Madam Chair.
[The prepared statement of Mr. Pallone follows:]
Prepared Statement of Hon. Frank Pallone, Jr.
The Energy and Commerce Committee has a long history of
examining cybersecurity on a bipartisan basis. Over the past
several years, we have held hearings on strengthening
cybersecurity in the health care and energy sectors. We have
also been regularly briefed by agencies on a variety of
critical concerns related to both previous and recent
cybersecurity threats and attacks.
While we have made progress, it is clear much more needs to
be done to address the ongoing threats we see nearly every day.
One area of particular and growing concern is ransomware,
the topic of today's hearing. Ransomware is a malicious
cybersecurity attack that paralyzes victim organizations. The
attack freezes computer systems and holds data hostage until a
ransom payment is received.
Ransomware used to be considered a nuisance crime impacting
only an individual computer. In recent years, however, it has
evolved to affect the entire networks of organizations and even
governments, extorting entities for enormous sums of money.
Increasingly, criminals deploying ransomware are not just
freezing the data of victim organizations but are also
pilfering sensitive business and consumer data. On top of
locking down computer networks, they also threaten to release
the stolen data as an additional method to leverage a ransom
payment.
In just the past few months, we have seen a surge of
ransomware attacks that at times have brought aspects of normal
life and commerce to a standstill.
The ransomware attack on the Colonial Pipeline disrupted
oil and gas supplies on the eastern seaboard, causing many gas
stations to run out of fuel, prices to skyrocket, and grounding
air traffic.
Other recent attacks have threatened local police
departments, including the DC Metropolitan Police, and
victimized schools, local governments, and hospitals already
grappling with the COVID-19 pandemic.
I also want to underscore that the challenges brought on by
these attacks are particularly acute for small businesses, many
of which lack dedicated information technology staff and
resources and are just trying to keep their businesses
operating. These victims may have no idea who to turn to if
their data is subject to a ransomware attack. We simply cannot
leave victim organizations on their own when figuring out how
to defend against and respond to these cyber criminals.
Given the huge scale and scope of these threats, I am
pleased that President Biden is taking decisive steps to tackle
this challenge. Just last week the Administration announced a
new website, StopRansomware.gov, that is meant to provide a
one-stop hub of ransomware resources for individuals and
businesses. The website outlines the simple steps small
businesses can take to protect their networks and provides
guidance to these organizations on how to respond to ransomware
incidents.
The President is also leading a whole-of-government effort
to disrupt ransomware campaigns and go after the criminals who
launch them.
The Administration's strategy announced last week builds on
an effort launched by the White House in May. It will make it
more difficult for criminals to transfer funds using
cryptocurrency, help make U.S. institutions more resistant to
hacking, and urge international cooperation.
But the Administration cannot address this enormous
challenge on its own. Congress must also take action, and
that's why this oversight hearing is so important today. I look
forward to hearing from our witnesses who have dedicated their
careers to cybersecurity. They are uniquely positioned to make
recommendations on the types of policies needed to defend
against future attacks. I am interested in their ideas as we
explore potential solutions that will help further protect our
nation's critical infrastructure networks, businesses, and
consumers.
With that, I thank the Chair for holding this hearing and I
yield back.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes the ranking member of the full committee, Mrs.
Rodgers, for 5 minutes for an opening statement.
OPENING STATEMENT OF HON. CATHY McMORRIS RODGERS, A
REPRESENTATIVE IN CONGRESS FROM THE STATE OF WASHINGTON
Mrs. Rodgers. Thank you, Madam Chair. In recent months we
have seen a significant increase in the ransomware attacks
coming from Russia. In May, DarkSide, a ransomware group
operating out of Russia, attacked the Colonial Pipeline, which
accounts for about 45 percent of the East Coast's fuel. In
June, REvil, another ransomware group operating in Russia,
attacked GBS USA, which temporarily knocked out plants that
process roughly one-fifth of our Nation's meat supply. Earlier
this month REvil executed another ransomware attack, this time
on American IT management software company Kaseya, which
affected hundreds of businesses across the globe.
While Russian--while the Russian President Putin may not be
directly connected to these attacks, he refuses to crack down
on them. White House Press Secretary Jen Psaki recently said
that ``responsible states do not harbor ransomware criminals.''
Well, Mr. President, Russia is not a responsible state, and
greenlighting a pipeline for Putin after Russian cyber criminal
attacks on one of the most critical pipelines in the United
States certainly will not deter Russia.
But this threat is not unique to Russia. We know the
Chinese Government engages in malicious cyber behavior too.
Just yesterday the Biden administration publicly blamed hackers
affiliated with China's main intelligence service for a far-
reaching cyber attack on Microsoft. While this administration
must do more, I applaud them for taking this step and publicly
addressing the threat China poses.
The White House also recently announced a cross-government
task force to combat the rise in ransomware attacks. President
Biden's nominee to lead the Cybersecurity and Infrastructure
Security Agency, Jen Easterly, was also unanimously concerned--
confirmed, sorry. These are welcome steps.
I caution this administration, though, and this Congress,
from consolidating cyber at one agency. Doing so is a wrong and
dangerous approach, because it weakens an agency's ability to
leverage their expertise in cyber preparedness for their
specific and unique sectors. I urge the Biden administration to
lean on that expertise.
Director Easterly, I urge you to rely on your colleagues at
HHS, DOE, FCC, FTC, DOT, and others to address cyber threats in
their sectors.
As the committee which oversees our economy's most critical
sectors, we know firsthand the work of many of these Federal
agencies around cyber. This committee itself has a history of
working on cybersecurity issues to strengthen America's
defenses against bad actors. The committee has conducted
significant oversight over cyber incidences dating back to
Target, the Target hack in 2013 and 2017. We brought in the
Equifax CEO to answer for the hack of their systems that
resulted in the loss of 143 million Americans' personal
information.
In 2018, following dozens of briefings, hearings, letters,
reports, and roundtables, the Republicans on this committee
issued a cybersecurity strategy report that provided specific
priorities for more effective protection against
vulnerabilities.
Earlier this year we sent bipartisan letters to the
Department of Energy, the Department of Commerce, the
Department of Health and Human Services, the Environmental
Protection Agency, and the National Telecommunications and
Information Administration following the SolarWinds attack.
Cyber threats and ransomware attacks will only continue to
grow, and it is important for this committee to continue to
lead on cyber issues. The Colonial Pipeline attack underscored
the committee's long work to ensure the secure, reliable
delivery of energy. The Pipeline and LNG Facility Cybersecurity
Preparedness Act, reintroduced by Energy Subcommittee
Republican Leader Upton and Chairman Rush, will provide DOE
with strong, clear coordinating authorities to respond to
future threats. And soon, our Consumer Protection and Commerce
Subcommittee Republican leader, Gus Bilirakis, will introduce a
bill to ensure the FTC is focused on ransomware attacks from
abroad and working with foreign law enforcement agencies to
hold those cyber criminals accountable.
Yet there is more to do. Energy and Commerce should
continue to explore ways to identify and patch cybersecurity
vulnerabilities before they are exploited. We should also
encourage reporting by entities of cyber attacks to the Federal
agencies who oversee them and consider certain liability
protections for our critical infrastructure. This is an
important and timely discussion.
Thank you, Madam Chair. I look forward to hearing from our
esteemed witnesses.
Thank you, everyone. I yield back
[The prepared statement of Mrs. Rodgers follows:]
Prepared Statement of Hon. Cathy McMorris Rodgers
RISE IN ATTACKS
In recent months, we have seen a significant increase in
ransomware attacks coming from Russia.
In May, DarkSide--a ransomware group operating out
of Russia--attacked the Colonial Pipeline--which accounts for
about 45 percent of the East Coast's fuel.
In June, REvil [are-evil]--another ransomware
group operating in Russian--attacked JBS USA, which temporarily
knocked out plants that process roughly one-fifth of our
nation's meat supply.
Earlier this month, REvil [are-evil] executed
another ransomware attack. This time on American IT management
software company Kaseya [KUH-SAY-AH]--which affected hundreds
of businesses across the globe.
While President Putin may not be directly connected to
these attacks, he refuses to crack down on them.
White House Press Secretary Jen Psaki (saw-key) recently
said that quote "responsible states do not harbor ransomware
criminals."
Well, Mr. President, Russia is NOT a responsible state.
And greenlighting a pipeline for Putin after Russian cyber
criminals attack one of our most critical pipelines certainly
will not deter Russia.
But this threat is not unique to Russia.
We know the Chinese government engages in malicious cyber
behavior too.
Just yesterday, the Biden administration publicly blamed
hackers affiliated with China's main intelligence service for a
far-reaching cyberattack on Microsoft.
While this administration must do more, I applaud them for
taking this step and publicly addressing the threat China
poses.
ADMIN RECENT ANNOUNCEMENTS
The White House also recently announced a cross-government
task force to combat the rise in ransomware attacks.
President Biden's nominee to lead the Cybersecurity and
Infrastructure Security Agency--Jen Easterly--was also
unanimously confirmed.
These are all welcomed steps, but only if done right.
I caution this administration and this Congress from
consolidating cyber at one agency.
Doing so is a wrong and dangerous approach because it
weakens an agency's ability to leverage their expertise in
cyber preparedness for their specific and unique sectors.
I urge the Biden Administration to lean on that expertise.
Director Easterly, I urge you to rely on your colleagues at
HHS, DOE, the FCC, the FTC, DOT, and others to address cyber
threats in their sectors.
E&C Cyber Work
As the Committee which oversees our economy's most critical
sectors, we know firsthand the work many of these federal
agencies have done on cyber.
This Committee itself has a history of working on
cybersecurity issues to strengthen American defenses against
bad actors.
The Committee has conducted significant oversight over
cyber incidents dating back to the Target hack in 2013.
In 2017, we brought in the Equifax CEO to answer for the
hack of their systems that resulted in the loss of 143 million
Americans' personal information.
In 2018, following dozens of briefings, hearings, letters,
reports, and roundtables, the Republicans on this committee
issued a Cybersecurity Strategy Report that provided specific
priorities for more effective protection against
vulnerabilities.
Earlier this year, we sent bipartisan letters to the
Department of Energy, the Department of Commerce, the U.S.
Department of Health and Human Services, the Environmental
Protection Agency and the National Telecommunications and
Information Administration following the SolarWinds attack.
Cyberthreats and ransomware attacks will only continue to
grow and it is important for this Committee to continue lead on
cyber issues.
The Colonial pipeline attack underscored the Committee's
long work to ensure the secure, reliable delivery of energy.
The Pipeline and LNG Facility Cybersecurity Preparedness
Act, reintroduced by Energy Subcommittee Republican Leader
Upton and Chairman Rush will provide DOE with strong, clear
coordinating authorities to respond to future threats.
And soon, our Consumer Protection and Commerce Subcommittee
Republican Leader Gus Bilirakis will introduce a bill to ensure
the FTC is focused on ransomware attacks from abroad and
working with foreign law enforcement agencies to hold those
cybercriminals accountable.
Yet, there is more to do.
Energy and Commerce should continue to explore ways to
identify and patch cybersecurity vulnerabilities before they
are exploited...
...and we should also encourage reporting by entities of
cyberattacks to the federal agencies who oversee them and
consider certain liability protections for our critical
infrastructure.
This is an important and timely discussion and I look
forward to hearing from our esteemed witnesses. Thank you. I
yield back.
Ms. DeGette. The Chair now asks unanimous consent that the
Members' written opening statements be made part of the record.
And without objection, so ordered.
I now want to introduce our witnesses for today's hearing:
Kemba Walden, who is the assistant general counsel for
Microsoft Corporation; Robert M. Lee, who is the chief
executive officer of Dragos; Dr. Christian Dameff, assistant
professor of emergency medicine, biomedical informatics and
computer science, University of California, San Diego, medical
director of cybersecurity, U.C. San Diego Health--we are not
going to refer to that entire title every time we discuss it
with you, but congratulations; Charles Carmakal, senior vice
president and chief technology officer, FireEye-Mandiant; and
Philip Reiner, chief executive officer, Institute for Security
and Technology.
I want to thank all of you for appearing today, as I have
said.
And I know you are aware the committee is holding an
investigative hearing. And when doing so, we have the practice
of taking testimony under oath. Does anyone here object to
testifying under oath?
Let the record reflect the witnesses have responded no.
The Chair will then advise you that, under the rules of the
House and the rules of the committee, you are entitled to be
accompanied by counsel. Does anyone request to be accompanied
by counsel today?
Let the record reflect that the witnesses have responded
no.
If you would, please rise and raise your right hand, so
that you may be sworn in.
[Witnesses sworn.]
Ms. DeGette. Let the record reflect that the witnesses have
responded affirmatively.
Please be seated, and you are now under oath and subject to
the penalties set forth in title 18, section 1001 of the U.S.
Code.
The Chair will now recognize our witnesses for a 5-minute
summary of their written statements.
There is a timer on the screen that will count down your
time, and it will turn red when your 5 minutes have come to an
end.
Let me first recognize Ms. Walden for 5 minutes.
STATEMENTS OF KEMBA WALDEN, ASSISTANT GENERAL COUNSEL,
MICROSOFT CORPORATION DIGITAL CRIMES UNIT; ROBERT M. LEE, CHIEF
EXECUTIVE OFFICER, DRAGOS; CHRISTIAN DAMEFF, M.D., ASSISTANT
PROFESSOR OF EMERGENCY MEDICINE, BIOMEDICAL INFORMATICS, AND
COMPUTER SCIENCE, UNIVERSITY OF CALIFORNIA SAN DIEGO; CHARLES
CARMAKAL, SENIOR VICE PRESIDENT AND CHIEF TECHNICAL OFFICER,
FIREEYE MANDIANT; AND PHILIP JAMES REINER, CHIEF EXECUTIVE
OFFICER, INSTITUTE FOR SECURITY AND TECHNOLOGY
STATEMENT OF KEMBA WALDEN
Ms. Walden. Chair DeGette, Ranking Member Griffith, and
members of the subcommittee, thank you for the opportunity to
testify today. My name is Kemba Walden, and I lead our
ransomware analysis and disruption program within Microsoft's
Digital Crimes Unit. Our unit is an international program of
technical, legal, and business experts that has been fighting
cyber crime to protect victims since 2008.
It is estimated that last year over 2,400 organizations
were victims of ransomware attacks, with a financial impact of
nearly half a billion dollars. I fear that we are only seeing
the tip of the iceberg, as likely many attacks and
corresponding losses go unreported. This recent proliferation
of ransomware attacks impacts our national security, our
economic security, our public safety, and our health.
In my oral comments today I will focus on what ransomware
is, how the ransomware process works. I also wanted to share
some of the key trends Microsoft is observing.
So what is ransomware? Well, it is malicious software that,
once deployed in a victim's network, locks that network and the
information in it, making it inaccessible to the victim unless
the victim pays a ransom. You may have heard of different
strains of ransomware, such as REvil and DarkSide, Conti, Ryuk,
and so on. These are different types of ransomware, malicious
software that lock a victim's network. Ransomware is installed
after a series of criminal actions, so no single criminal gang
is associated with any particular type of ransomware. It is
simply the tool of choice for profit.
Today's ransomware attacks are different than the ones we
experienced only a few years ago, where criminals deployed
ransomware, often on a single computer in a predictable manner,
and then demanded ransom in exchange for a decryption key to
unlock that computer. Today's criminal has figured out how to
use human intelligence and research to not only lock entire
networks for a higher profit but to commit double or, in some
cases, triple extortion. We at Microsoft call this human-
operated ransomware, otherwise known as big-game ransomware.
Ransomware is a profitable business, with few barriers to
entry. It takes no specialized skill to profit from this crime.
Here's what we are seeing in recent cyber criminal attacks.
They customize their attacks and can be patient. Human-operated
ransomware has evolved over the past few years, such that cyber
criminals select specific networks to attack and then hunt for
entry vectors. Criminal gangs are performing massive, wide-
ranging sweeps of the internet, searching for vulnerable entry
points, such as through unpatched software or successful
phishing. Then they wait for a time that is advantageous to
their purpose.
Because cyber criminals want to move laterally from one
computer to the entire network, they focus on gaining access to
highly privileged account credentials. They have developed a
modular business model that we refer to as ransomware as a
service. A manager or ransomware developer will recruit
affiliates who have collected access, or collected credentials,
or otherwise specialize in some other crime, offering a cut of
the profits of an attack.
Make no mistake, these are fully fledged criminal
enterprises. They find opportunities to double- or even triple-
extort victims. So, before locking down a victim's system, they
will find high-value information and steal it. Not only will
they demand payment to unlock a victim's network, they will
demand payment in exchange for not leaking the victim's data.
In some cases, they will extort a victim a third time in
exchange for not committing even more crimes, such as a DDos
attack. They demand victims pay in cryptocurrency, thus taking
advantage of the anonymous nature of this payment system.
While the movement of money is transparent, the crypto
economy values privacy of the persons and the circumstances
behind each transaction. So when cryptocurrency is used,
criminals can easily verify when a victim has paid the ransom
but hide behind the opaqueness of a crypto wallet. Importantly,
this blockchain technology does not cause cyber criminals to
commit this crime. Rather, elements of the crypto ecosystem
make payments a bit easier, facilitating the crime.
In fact, while working with the Ransomware Task Force, I
learned that compliance stakeholders within the crypto economy
are just as eager as anyone to eliminate the nefarious use of
their platforms.
So what do we do about it? Well, there is something for
everyone to do. The Ransomware Task Force Report does a great
job laying this out, so I won't go into detail here. However, I
want to underscore the importance of partnership and actionable
information sharing.
Criminals are smart, they are creative, they are well
financed, and they are not limited by borders. The security
community must match this. At Microsoft, our impact is greatest
when we work collaboratively with government and others in the
private sector.
In conclusion, government has law enforcement and
intelligence resources that private sector cannot match. The
private sector has access to data and technological resources
that governments cannot match. We must work together to find
innovative solutions.
Thank you, and I look forward to your questions.
[The prepared statement of Ms. Walden follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Ms. DeGette. Thank you so much.
Now I am now pleased to recognize you, Mr. Lee, for 5
minutes.
STATEMENT OF ROBERT M. LEE
Mr. Lee. Thank you. Chairwoman DeGette, Ranking Member
Griffith, and members of the committee, thank you for providing
me the opportunity to testify before you today.
I started my career as an Air Force officer and spent most
of that time tasked at the National Security Agency, where I
built and led a first-of-its-kind mission to hunt for and
analyze threats targeting industrial control systems. At that
time, cyber threats towards industrial systems were seen as a
possibility, but not as a reality.
The problem, though, is everyone was looking in the wrong
location. Analysts around the community were hunting for
threats in enterprise IT, or information technology, networks,
such as those that people depend on for personal computer usage
and email. What we were not doing is looking at industrial and
operations networks themselves, such as those in power plants,
pipelines, water utilities, and manufacturing sites. Broadly, I
will refer to this as operations technology, or OT.
The easiest way to explain OT is to consider that
everything we have in IT, plus physics. When adversaries target
IT networks, they often steal data. And when they disrupt them
with malicious software such as ransomware, it impacts workers'
ability to do their job. When adversaries target OT networks,
they can, intentionally or not, create unsafe conditions that
cause damage to the world around us, up to and including the
loss of human life.
As I mentioned, though, we did not see the various OT
threats that existed, because the broader community was looking
for OT threats in IT networks. We lacked the visibility in OT
to determine what was happening. In essence, we had the
equivalence of Schrodinger's OT. We did not look inside the box
to determine if the cat was alive or not. In my time at the NSA
we started looking inside that box. To our surprise, we found a
wide variety of state actors targeting these systems.
Today, at Dragos, we track 15 state actors targeting OT
around the world, including many operations in the United
States. Specific to the topic of ransomware, we have responded
to numerous incidents and ransomware incidents in OT. Each
company has done the right thing. They have sought out help.
However, these incidents happen far more often than people
realize. Across all the cases, though, we continue to see that
a lack of visibility in the OT networks leads companies to
believing that they are in a better place than they actually
are.
Our hearing today, appropriately, is on ransomware. But I
want to underscore that it is just one risk facing our
infrastructure and, if anything, highlights that, if criminals
can be successful in breaching and disrupting our networks,
state actors will find much more success.
However, the threats are worse than we realize, but not as
bad as we want to imagine. And, ultimately, defense is doable.
Today I want to highlight a few key points.
Number one, to defend against ransomware, we must first
find a way to harmonize the roles and responsibilities of the
private sector with government.
Number two, there must be a simplified, unburdened process
and single point of contact with the government. CISA, as an
example, could be the front door of government, who could then
coordinate the interagency and communicate clearly to the
private sector. There are recommendations in the National
Infrastructure Advisory Council and Cyberspace Solarium
Commission to improve analyst collaboration, as well.
Ransomware in OT, my third point, is exposing the
underinvestment in cybersecurity in many organizations. My
prediction is, as we look to counter the ransomware threat, we
will start to gain more insights, and those insights will lead
us to find more state actors and other threats. We must be
prepared for what we find and think about the ransomware
strategy as an overall portion of our cybersecurity strategy.
Number four, critical infrastructure companies stand ready
to do the right thing and partner with government fully.
However, differing regulation regimes and requirements can
distract from the focus. Whatever regulations and standards
manifest, they should be thought of together so that companies
do not have overly burdensome requirements on them as we all
try to achieve the same goal.
And lastly, government should communicate the why and the
what to the private sector, but leave the how to the experts in
those entities. We have seen this work very well.
This administration and the Department of Energy launched a
100-day action plan earlier this year focused on OT. They did
that in the electric sector. The goal was increasing real-time
information sharing, visibility, detection, and response
capabilities in OT networks. The government laid out the
requirements and why they wanted companies to do this, but they
did not dictate the solution or how they had to achieve it.
This was done in collaboration with the electric sector
leaders, as well.
The electric sector coordinated, evaluated what was on the
market, and chose Neighborhood Keeper, a technology made by
Dragos in collaboration with the Department of Energy. They
then deployed it quickly, voluntarily, and at their own costs.
As a result, we went from less than 5 percent of the electric
system monitored in the United States to more than 70 percent
of the electric system monitored in OT networks in under 100
days. This is the exact type of visibility and success useful
in preventing ransomware and those issues.
Government setting requirements and amplifying them is
important. Letting the private sector figure out innovative
ways in how to achieve those requirements is paramount. I thank
the committee for providing me the opportunity to testify today
and welcome any additional questions or information.
[The prepared statement of Mr. Lee follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Ms. DeGette. Thank you so much.
Dr. Dameff, I am now pleased to recognize you for 5
minutes.
STATEMENT OF CHRISTIAN DAMEFF, M.D.
Dr. Dameff. Madam Chair DeGette, Ranking Member Griffith,
distinguished members of the subcommittee, thank you for this
opportunity to speak today on the effects of ransomware on
healthcare. My name is Dr. Christian Dameff, and I am a
practicing emergency medicine physician. I am also an assistant
professor of emergency medicine, biomedical informatics, and
computer science at the University of California, San Diego. I
also serve as the medical director of cybersecurity for U.C.
San Diego Health, the first position of its kind in the United
States.
Early in my adolescence, my fascination with computers and
networks led me to the hacker community, who taught me to
appreciate the complexity and fragility of modern computer
systems. Today I use that knowledge to improve the
cybersecurity of healthcare. My research focuses on the patient
safety and care quality impacts of cyber attacks. At my core, I
am an emergency medicine doctor. I am trained to care for any
patient who comes through the door, whether they suffer trauma,
heart attacks, strokes, or COVID. I am here to tell you that
healthcare is not prepared to defend or respond against
ransomware threats.
Our hospitals today are increasingly dependent on
technology. Doctors admit patients into the hospital, order and
review laboratory tests, prescribe medications, and prepare for
surgeries, all while using computerized workflows. We have come
to implicitly trust and rely on these systems. And when they
fail, healthcare grinds to a near halt.
We know ransomware attacks affecting the healthcare sector
are increasing in frequency, sophistication, and disruptive
potential, in addition to the exposure of sensitive data,
severe financial losses, and reputational damage. A cyber
attack on a hospital has the potential to threaten life and
limb.
When patients suffer from strokes, heart attacks, or severe
infections, minutes matter. The best outcome for patients with
these time-dependent crises depend on immediate, continuous
availability of the same digital systems that ransomware can
disrupt. When critical medical systems go offline, our
opportunity to save lives diminishes. The risk of error or
misdiagnosis increases. We are now learning that cyber attacks
impact not just the infected hospitals but the surrounding
healthcare ecosystem at large.
Two months ago, a ransomware attack disabled five large
hospitals in the San Diego area for an entire month. Adjacent
hospitals were quickly overwhelmed with unprecedented numbers
of emergency room patients, many of whom had serious, time-
dependent illness. Wait times skyrocketed. Hospital beds
rapidly filled. Clinicians caring for very sick patients lacked
vital medical records from the infected hospitals. I saw
firsthand the spillover effects and understood that the
vulnerability of one hospital is a vulnerability of many
hospitals.
You have heard today from experts with technical and policy
recommendations that, if enacted, would improve ransomware
defenses across all sectors. However, I hope you now understand
that healthcare has unique challenges and necessitates
additional actions.
First, the effects of ransomware attacks on patients'
health should be scientifically studied. Most hospitals are not
currently equipped to measure or report the impacts of these
attacks. I recommend the development of standardized metrics of
cyber attack severity on hospitals. Mandatory reporting of
patient safety and care quality outcomes should occur for
severe attacks. I recommend that Federal agencies such as the
National Institutes of Health and the National Science
Foundation prioritize funding for research on this topic.
Second, identifying cybersecurity vulnerabilities before
they are exploited will protect patients. There is currently
disparity between what I call the healthcare cybersecurity
haves and have nots. Lesser-resourced, critical-access, and
rural hospitals need help when it comes to increasing their
preparedness. As we seek to protect vulnerable hospitals, we
must also avoid overly punitive measures for those who are
unfortunate enough to fall victim to highly complex or novel
cyber attacks, understanding that stiff fines or penalties may
worsen an already devastating operational impact. We are only
as strong as our least-defended communities.
Third, I support software bill of materials as one
mechanism to increase transparency around cybersecurity
vulnerabilities. Software bill of materials enables
manufacturers and healthcare delivery organizations to take
more proactive steps to manage their cybersecurity risk.
Furthermore, I recommend ongoing support and legal
protections for security researchers engaging in good-faith
security research, otherwise known as coordinated vulnerability
disclosure. We need help from ethical hackers if we are going
to defend against the malicious ones.
Lastly, we must prepare hospitals for inevitable attack.
The ability to rapidly deploy backup manual patient care
systems is key to reducing patient harm. Such contingency
planning takes resources and expertise.
In conclusion, I applaud this committee's leadership on
ransomware response and remain optimistic about improving cyber
resilience in healthcare. Our patients deserve excellent care.
Ransomware and other cyber attacks targeting hospitals threaten
our ability to deliver that care as it is needed, when minutes
matter.
Thank you for this opportunity to testify today, and I
welcome any questions you may have.
[The prepared statement of Dr. Dameff follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Ms. DeGette. Thank you so much.
The Chair now recognizes Mr. Carmakal for 5 minutes.
STATEMENT OF CHARLES CARMAKAL
Mr. Carmakal. Thank you. Chairman DeGette, Ranking Member
Griffith, and members of the subcommittee, thank you for this
opportunity to share our observations on the ransomware threat.
My name is Charles Carmakal, and I am a senior vice president
and CTO at Mandiant.
Mediant is an organization that helps other organizations
across the globe deal with incredible cybersecurity challenges.
We have got over 1,000 security professionals within 25-plus
countries that help organizations deal with a variety of
threats, including those threats that are orchestrated by
foreign governments and organized criminals.
My colleagues here have done a pretty good job of talking
about the ransomware overview, but I would like to provide a
little bit more details on what the problem is like today.
Ransomware is the number-one cybersecurity threat that we all
face today. But what the--the problem that we are dealing with
today is much more than just ransomware.
We call the problem ``multifaceted extortion.'' This is how
organizations get compromised by threat actors, and they deal
with types of attacks where threat actors will steal data from
organizations, disrupt business operations, will embarrass
those organizations. They will reach out to partners of those
organizations and extort them. They will reach out to customers
and extort them, thus applying pressure to the victim
organizations to pay substantial extortion demands. Extortion
demands often will range, sometimes starting in six figures.
But very often, for larger organizations, it could turn into
seven figures, or even eight-figure demands.
Unfortunately, we work with organizations that are
compelled to pay substantial extortion demands--not because
they want to, not because they feel like that is the best
option--because they really have no choice.
We work with organizations to really think about what are
the things that they need to consider before paying extortion
demands. I would like to share some of the observations and the
learnings that we have acquired working with thousands of
organizations dealing with this type of threat.
I think there is a lot of misconceptions about why threat--
why victims pay threat actors. I think there is an assumption
that organizations that have to pay don't have good
cybersecurity hygiene, or they don't have good backups in
place. And let me just dispel a few myths. A lot of times we
find victim organizations pay threat actors because they want
to accelerate the process of recovering their business
operations. If you think about a situation where a municipality
loses access to their emergency services, or a hospital can no
longer treat patients and have to divert patients to other
hospitals, it becomes incredibly important to get access to
systems as quickly as possible. And so we sometimes find that
victim organizations feel compelled to pay, because they feel
that it is quicker to pay and to recover systems than it is by
just using their backup infrastructure.
We also find that backup infrastructure generally isn't
resilient enough to restore every single computer that was
impacted over a short period of time during a ransomware and a
multifaceted extortion operation.
The second thing that organizations need to think about
before paying is how reliable is the threat actor. And I know
it sounds kind of silly, thinking about the reliability of a
threat actor, but today we find that a lot of criminals, they
do demonstrate a certain level of reliability because they have
recognized their business model actually depends on that.
You also need to understand whether or not the threat
actors stole data from the organization before deploying
decrypters--or before deploying encrypters across the
enterprise. And if they stole data, there is obviously the risk
of publishing that information. And we find that many victim
organizations choose to pay because they feel that it is in
their best interest to protect the sensitivity and the privacy
of their customers and their business partners' information
from being exposed on the internet.
The next thing that organizations need to think about is
does the threat actor still have active access to the
environment, and, if they do, can they escalate their attack
and conduct more disruption?
You also need to understand whether or not cyber insurance
will cover the claim.
And finally, you really need to think about is the threat
actor sanctioned by the United States Government, and is it
actually legal to pay the threat actor?
So those are some of the considerations that we talk to our
clients about. And it is always our clients' decisions as to
whether or not they should pay or not. But we want to actually
walk them through the considerations.
So let me actually share some of the observations that we
have learned when victims have actually paid threat actors.
Well, first of all, you can't just pay a threat actor and
hope they go away. Technically, they have multiple different
back doors to get access back into the environment if they want
to. Many times we do find that they tend to move on, and move
on to the next victim. They don't tend to come back, once they
are paid, but technically, they do have the ability to do that.
You don't know who you are paying. You have no idea if you
are paying a sanctioned entity. You have no idea if you are
paying a terrorist organization. You don't know who you are
paying. It is typically a responsibility of a separate company
that engages in the negotiations with a threat actor and actual
facilitation of payment. And a lot of times they are the ones
that are actually trying to figure out who is being paid. But
at the end of the day, you never know who is actually getting
the money.
As I mentioned before, many threat actors are actually
reliable because, again, they are--their business model depends
on it. Reliability certainly, you know, depends on who the
threat actor is. Many times we find that threat actors will
provide working tools to be able to recover your systems and
data. And they also provide a promise to delete the data that
they have stolen from the victim environment. Of course, you
never actually have any real guarantees that the data was
actually deleted that was stolen from the victim environment.
We do anticipate, at some point in time, that some of the
data that was stolen--and for those threat actors that were
paid, we do anticipate that they will likely publish
information and the stolen data at a later point in time,
especially as time goes on.
In conclusion, I would like to thank you for this
opportunity to testify before the subcommittee. The ransomware
and the multifaceted problem has become at a level that is
completely intolerable, and we need to come together as a
community to better address the problem. Thank you.
[The prepared statement of Mr. Carmakal follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Ms. DeGette. Thank you so much.
The Chair now recognizes Mr. Reiner for 5 minutes.
STATEMENT OF PHILIP JAMES REINER
Mr. Reiner. Madam Chair DeGette, Ranking Member Griffith,
Chairman Pallone, members of the subcommittee, thank you for
the opportunity to testify today on the pervasive threat that
ransomware poses to our national security. My name is Philip
Reiner, and I am the chief executive officer of the Institute
for Security and Technology.
Our mission at IST is to create trusted venues where
national security policymakers can engage with technology
leaders to work together to devise solutions to emerging
security threats. That is what allowed us to convene the
Ransomware Task Force, of which I was the executive director.
We were pleased to convene representatives from more than 60
public and private organizations to devise a comprehensive
framework for combating the ransomware threat.
I will focus my testimony here today on three areas: first,
on the top-line recommendations of that task force report;
second, note some positive steps we have seen taken since that
report launched in April; and third, note some items from the
report that will require congressional action.
As is often repeated, there is no single solution to this
challenge. It poses too large of a threat for any one entity to
address alone. The timing of this hearing is thus incredibly
important. This is an international cybersecurity crisis, the
scale and magnitude of which demands leadership and action. The
task force determined four goals that should frame a
comprehensive approach to deter, disrupt, prepare, and respond.
These goals are interlocking and mutually reinforcing. This
framework should be considered as a whole. To achieve these
goals, the priority recommended actions were as follows.
Number one, coordinated international diplomatic and law
enforcement efforts must prioritize ransomware and work to
eliminate criminal safe havens.
Number two, the United States should and must lead by
example and execute a sustained, aggressive, whole-of-
government, intelligence-driven antiransomware campaign,
coordinated by the White House and in close collaboration with
the private sector.
Number three, governments should establish cyber response
and recovery funds, mandate that organizations report ransom
payment, and require organizations to consider alternatives
first, before making any such payments.
Number four, a clear, accessible framework must be
developed to help organizations prepare for and respond to
ransomware attacks.
And then number five, the cryptocurrency sector must be
better understood and more closely regulated to prevent further
facilitation of ransomware.
Since April, encouraging actions have been taken, some of
which have been noted already. These include the recent White
House launch of an interagency Ransomware Task Force. This is a
critical initial step, as the United States needs to execute a
campaign that leverages all tools of national power:
diplomatic, economic, intelligence, law enforcement, and
military. Again, this must be done in close cooperation with
the private sector in order to be successful.
Additionally, the call for leader-level diplomatic
prioritization of these issues, in some ways, has been heated.
President Biden has repeatedly asserted that ransomware is a
top priority and included this as a top-three item in his
recent summit with Russian President Putin. Similar
prioritization by the United Kingdom, the G7, the EU,
Australia, and others continues this necessary trend. These
declarations are great initial steps and need to be followed up
on with action. DOJ and DHS have their own internal ransomware-
focused efforts. The National Institute of Standards and
Technology has released an initial ransomware profile. Also,
seven large U.S.-based insurers have established a consortium
to share data. Followthrough will be the key for all of these
steps and, hopefully, for many more that are to come.
Finally, a number of recommended steps from the report can
be highlighted that necessitate congressional action, which
include but are not limited to requiring organizations to
report ransomware payment information prior to payment,
requiring further steps to shore up the cryptocurrency
ecosystem, providing clarification of lawful defensive measures
that private-sector actors can take, requiring local
governments and managed service providers to adopt limited
baseline security measures, and creating a ransomware response
fund to help incentivize the nonpayment of ransoms.
Congress has a critical role to play in a whole-of-
government response to this threat, and the Institute for
Security and Technology welcomes the opportunity to inform the
work of this committee. Thank you for your leadership, and I
look forward to your questions.
[The prepared statement of Mr. Reiner follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Ms. DeGette. Thank you so much, and thank you to the entire
witness panel for excellent testimony. It is now time for our
questioning, and the Chair will recognize herself for 5
minutes.
As I said in my opening statement, senior cyber experts
from the government have expressed concern about some of the
private sector's compliance with cyber hygiene requirements,
and the limits of----
Voice. This meeting is being recorded.
Ms. DeGette. Thank you. And the limits of the Federal
Government's existing authorities to manage the problem.
So, as Congress, it is our job to make sure that the
executive branch has the authorities it needs. I want to hear
from each one of you about this.
Mr. Reiner, your testimony identifies eight priority
considerations for Congress. Which two or three of those would
be the most impactful, and why?
Mr. Reiner. Madam Chair, thank you for the question. I
appreciate the sentiment that there is much more that companies
can be doing. I think----
Ms. DeGette. Sir, I have 5 minutes. So if you can tell me
which two or three of the actions you identify would be most
impactful, I think that would be helpful.
Mr. Reiner. Yes, ma'am.
Ms. DeGette. Thank you.
Mr. Reiner. As the report laid out, I think one of the
steps that can be taken for organizations, as part of potential
grants that can be provided, that they need to expand a certain
percentage of their efforts on cybersecurity----
Ms. DeGette. OK.
Mr. Reiner [continuing]. To basically raise their baseline
application of their own funds in order to receive national
grants.
Ms. DeGette. Federal.
Mr. Reiner Another element that the task force put forward
was that, in order to receive grant funding, was that a company
would have to meet the baseline requirements that are put
forward in the framework that we described in the report, that
NIST put forward----
Ms. DeGette. So--but basically, what you are saying is tie
government grants to good hygiene.
Mr. Reiner. Yes, ma'am.
Ms. DeGette. Ms. Walden, I wanted to ask you, your
testimony cites a Microsoft study which estimates ``more than
99 percent of cyber attacks would have been prevented if
multifactor authentication were deployed.'' So do you think
that we should mandate basic cyber hygiene requirements through
legislation? And if so, which ones?
Ms. Walden. Thank you, Chair. Yes, so we published a report
that 99 percent of cybersecurity attacks would not have
happened without--because of multifactor authentication. So I
think that you should encourage basic cyber hygiene principles
like multi----
Ms. DeGette. Do you think we should mandate it?
Ms. Walden. I think I agree that we should require it, yes.
Ms. DeGette. OK, thank you.
Ms. Walden. Yes.
Ms. DeGette. Now, Mr. Lee, in your testimony you seem to
agree that additional cybersecurity requirements could be
helpful but cautioned that we shouldn't be regulating the
``how.'' Can you explain very briefly what you mean by that?
What do you think the most effective legislative or
regulatory requirements would look like?
Mr. Lee. Absolutely, thank you. Generally speaking, we need
to be more outcomes-driven. And so a lot of times companies
will be told ``you must install antivirus,'' ``you must do the
patching within seven days,'' or whatever that kind of
prescriptive requirement is. But across our different
infrastructure, especially in our operations side of the house,
things can be so varied. And we need to tell them what are we
actually trying to solve for.
Ms. DeGette. OK----
Mr. Lee. ``We want you to be able to respond this
quickly,'' or so forth.
Ms. DeGette. To be results oriented.
Mr. Carmakal, your testimony cites to a white paper
published by Mandiant that outlines the priority technical
actions companies should take--ideally, prior to a ransomware
event. And I am wondering if you have seen widespread adoption
of those recommendations. And if not, what can we do to help
companies implement those actions?
Mr. Carmakal. Thank you, Chairwoman. So we basically built
that white paper as a documentation of the playbook that we use
when we conduct incident response exercises. And so these are
the types of things that we recommend to organizations after a
breach. But certainly, those could be applied beforehand.
Unfortunately, not enough organizations are taking that
knowledge and applying it within the organizations. We would
love to see greater adoption. Unfortunately, a lot of the
things that we see day in, day out, from a response
perspective, shows that they----
Ms. DeGette. So what can we do to either encourage or
mandate them to----
Mr. Carmakal. I would certainly love for more encouragement
of organizations to try to learn from other breached entities.
And that white paper is a good example of those learnings.
I don't know that I would necessarily say that you need to
mandate it, but more encouragement----
Ms. DeGette. But Mr. Reiner has a good suggestion, though,
which is to tie it to government grants. So you need to meet a
certain standard if you are going to get your public funding.
What do you think of that idea?
Mr. Carmakal. Generally, I think that sounds like a good
idea.
Ms. DeGette. Great. Finally, Dr. Dameff, as a medical
doctor and cyber researcher, you have an interesting
perspective to share. I am wondering if you can talk if there
are specific issues in the healthcare industry, and what this
committee--we have jurisdiction over healthcare policy--what we
can do to ensure good cyber compliance. Briefly.
Dr. Dameff. Thank you, Madam Chair. One of the most
important things I can articulate today is the need for
additional information. It is very difficult to measure the
impacts of a cyber attack on a patient. In other industries you
can measure the cost in dollars and cents. That is immediately
understandable. Or downtimes resulting in increased gas prices.
But in healthcare we do not have the infrastructure in place to
get the basic data, to measure what happens to our patients.
And what really matters is whether or not they walk or talk
after a stroke, or whether or not they survive after a heart
attack. Without measuring those very basic things through
things like NIH funding, scientific inquiry, we don't even know
the magnitude of the problem or the impact on our patients.
Ms. DeGette. Thank you. The Chair now will recognize
Ranking Member Griffith for the purposes of asking questions
for 5 minutes.
Mr. Griffith. All right, Dr. Dameff, and this is not on my
list of questions, but it came up as a part of feeding off of
Chairwoman DeGette's questions.
Ms. Walden said, you know, we could have prevented a lot of
these hacks with multifactor identification. You are an
emergency room doctor. How is that going to work? Because it is
easy to say here, but how is it going to work in your emergency
room?
Dr. Dameff. That is a great, great insight. Thank you for
the question. There are technical controls that will definitely
improve the cybersecurity posture of hospitals. Those should be
employed, right? Many hospitals are deploying multifactor
authentication, or already have, for protecting patient data.
You identify a key element here, which is that patient care
cannot be hindered in the emergency sense by overly--over-
security controls that impact patient care. I will say this,
though. It is not necessarily about which controls can prevent
the infection. Honestly, I am of the belief that we should
prepare for an inevitable attack and then have a backup system
in place to restore patient care as quickly as possible, and
rely on that until you can restore that. That is how you save
lives. That is what you do, is focus on your immediate response
to restoring patient care, while those technological systems
come back online.
Mr. Griffith. All right. So my next question would be how
expensive is that going to be?
And let me give you a reason why I am concerned about this.
I represent a large rural district. In a portion of my district
the previously competing hospital chains, for financial
reasons, were forced to merge, and they were given clearance by
both State of Virginia, the Federal Government, and the State
of Tennessee to basically have a monopoly in that area. So I
have got one hospital system serving many counties in east
Tennessee and southwest Virginia. How expensive is it going to
be for them, because they are under financial stress already,
to set up this good hygiene?
And do they--how are we going to fix that? I mean, how
expensive is what you are talking about? Because, in this case,
should what happened in San Diego happen there, there are no
hospitals to send these folks to that aren't at least an hour
to an hour and a half away, maybe further than that for some of
the folks. What are we going to do? Help me.
Dr. Dameff. Again, thank you for that fantastic question.
The consolidation of healthcare, exactly as you mentioned, has
increased the risk to patient safety from ransomware attacks
because of the shared infrastructure and technology among many
hospitals in a specific geographic location. We have seen that.
That is what happened 2 months ago, is that a single healthcare
delivery organization that was infected, five hospitals in a
geographic location were devastated. That exactly would impact
patient care, potentially.
And your identification of critical-access hospitals as
being a target, potentially, of attack, as well as the patient
harm implications cannot be overstated.
Specifically, how are they going to afford this? Really,
two things. One, that disaster resiliency that I mentioned
before, restoring technical systems in the background but
having a manual, nontechnical process to take care of patients
in the meantime, that already exists at most hospitals. That is
emergency response. That is disaster medicine. They prepare for
earthquakes and hurricanes and have plans in place to do that.
They should enact that--or they should prepare for that in a
cyber context.
The second thing is that, it is true, it is going to be
costly for a lot of the technical controls, and there are
hospitals out there that cannot afford it. They will simply not
be able to. I worked at hospitals and took care of COVID
patients in resource-stricken hospitals, wherein they were
concerned they were going to run out of ventilators. How do we
expect them to be able to defend against cyber attackers and
spend millions of dollars, potentially, to increase their
cybersecurity posture?
It is going to require some creative solutions. Quite
frankly, I don't see any----
Mr. Griffith. So what you are saying is that is a problem
we are going to have to solve.
Dr. Dameff. Yes, I think that is going to be a big, big
problem you have to solve.
Mr. Griffith. I appreciate that, and I tend to be tight
with Federal dollars, but this may be one area we don't have
any choice.
Let me say also, for us to provide assistance to an
organization, we need to know in advance, or we need to know
when it happens, if they are being attacked. And of course,
there are many reasons for not telling us. And you and Mr.
Carmakal want to--might want to tag-team on this one, if I have
time--I am running out.
But particularly related to hospitals, should we be looking
at, if not mandating, having a minimum requirement that would
then give the hospitals some protection? If they have done
their cyber--the good cyber hygiene to a minimal requirement
that perhaps the Federal Government sets up or industry sets
up, that they would then be limited on liability in any suits
that might follow, where a patient's health was affected, do
you think that is--that idea would work?
Dr. Dameff. I am definitely in support of ways we can
incentivize instead of slowly penalize hospitals for trying to
take care of patients. That is really key. Perhaps tying it to
reimbursement, for example, wherein if you meet a certain
cybersecurity threshold of protections, you can see increased
reimbursements for some of your medical care as a way to
incentivize. I could see that as one potential mechanism where
we can achieve even the most rural and critical-access
hospitals achieving the appropriate amount of cybersecurity
protections.
Mr. Griffith. All right, and if Madam Chair will give me
just the patience for a second, Ms. Walden, if you can get to
me in writing later, what do we do about cryptocurrencies and
its involvement in all of this?
Just--if you can cite me some articles later or whatever,
and we will probably send you a written question on that, as
well, and I yield back.
Ms. Walden. I am happy to.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes the full committee chairman, Mr. Pallone, for 5
minutes.
Mr. Pallone. Thank you, Chairwoman DeGette. One of my
concerns is that ransomware is a very sophisticated form of
attack, and it is not clear to me that smaller companies and,
to some extent, even larger companies have the resources or
tools needed to deal with these threats. So I was pleased to
see the StopRansomware.gov website that was launched by the
Biden administration last week, and--because it provides a new
resource hub for small businesses and other organizations.
But I mean, that is a good start, but I am wondering if we
can and should be doing more to assist U.S. companies,
particularly small to medium-sized businesses, to deal with
these threats. So let me start with Mr. Carmakal.
Given your experience in incident response, can you explain
the types of resources that companies need, once they find
themselves in the midst of a ransomware attack?
Mr. Carmakal. Yes, absolutely. Unfortunately, a lot of
these small organizations, some of them don't even have
security staffs. Some of them rely on IT resources to perform
security functionality.
When I think back to October of 2020, when we saw an acute
problem against healthcare organizations, I talked to a lot of
hospitals that were taken offline, couldn't take care of
patients leveraging digital technology. They ended up having to
divert patients to other hospitals. And I ended up talking to
the IT resources, who were trying to desperately get their
systems back online. They didn't know anything about digital
forensics. They didn't know anything about threat actors. They
didn't know how to respond to the intrusions. And so it was a
very difficult situation for those organizations to face, and I
really do feel for a lot of the smaller organizations that
don't have dedicated security teams.
So, look, to the extent possible I want organizations to do
the best that they can, from a, you know, cyber hygiene
perspective. But I don't believe the onus is fully on the
organizations themselves. I think there is a shared
responsibility----
Mr. Pallone. Well, what kind of resources would they need
is what I am asking.
Mr. Carmakal. Yes, I think they would need--well, I think
they would need government support. And, from a government
support perspective, I think there are things that government
could do in terms of indictments, arrests of individuals that
are behind these attacks.
I think there is more information sharing that could occur
for victim organizations that could be applicable to other
organizations out there.
I think there are, you know, things in terms of disruption
that government can do to curb the problem of ransomware, so
that these smaller organizations that don't have the resources
and the staff have some additional government support.
Mr. Pallone. But I guess--and let me go to Mr. Reiner. I
know that there's, you know, law enforcement agencies that
assist, and a lot of what Mr. Carmakal mentioned relates to
that. But are we providing--are there a variety of resources
beyond just, you know, the traditional--or some of the law
enforcement, you know, such as technical expertise that the
government can or should be providing, or can the government
provide help in assessing the scope of their situation?
I know he discussed some of that, but if you would respond
also, Mr. Reiner.
Mr. Reiner. Yes, Mr. Chairman. I think, through the process
that we conducted for the Ransomware Task Force, I mean, there
was an array--really, a list of things that we put forward that
we believe could be done to get ahead of this, right? So to get
to the left of boom, so that you better equip companies to be
able to defend themselves.
As has been discussed, though, a lot of those organizations
really don't have the capability to do so. So CISA and other
departments and agencies, I believe, can be very well
positioned to help share that information, provide those tools
in advance for free. But folks don't know about it. They are
not even aware that it exists. So how do you get it to them?
Awareness campaigns are often belittled as not effective
enough and not quick, but there needs--there can be a lot more
to get the information out there that there are tools that are
available. StopRansomware.gov, for example: great idea,
fantastic amalgamation of government resources. How do you tell
people that that is something that they can turn to and
utilize?
I think there is one piece here that is incredibly
important that came up over and over again through the process
that we conducted, which was that departments and agencies that
are responsible for doing this don't have the resources that
they need in order to develop those tools to engage those
private-sector partners to actually get that word out. NIST,
DHS, other departments--Commerce, other departments and
agencies really could use buttressing of resources, so that the
folks who are really specifically responsible for that training
and that piece of it have more capacity to do so.
Mr. Pallone. OK. Just quickly, Ms. Walden, when you talk
about cybersecurity--I mean cryptocurrency, I am sorry--again,
I don't think the small business owner knows much about how to
purchase or trade that. So how do you see--in other words, if a
small business is faced with having to pay ransom, for example,
in cryptocurrency, how likely is it they are going to be able
to navigate that? And what resources would they need?
There's only 20 seconds left, but if you could just
comment.
Ms. Walden. Well, first, hopefully, small business would
opt not to pay the ransom.
Mr. Pallone. Right.
Ms. Walden. But if they chose to pay the ransom, the
criminal actors are actually quite helpful. They have a bit of
customer service. Their ransomware notes will instruct the
victim on how to or where to obtain, usually, Bitcoin, because
Bitcoin is a lot easier to obtain than other types of
cryptocurrency. But there are avenues for small businesses to
be able to obtain cryptocurrency.
Mr. Pallone. Your recommendation is don't pay, though,
sure.
Ms. Walden. But my recommendation is do not pay.
[Laughter.]
Mr. Pallone. Right, thanks a lot. Take care.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes Mr. Burgess for 5 minutes.
Mr. Burgess. I thank the Chair, and I thank our panel for
being here today.
It is, obviously, not the first hearing we have had on
this. It is a little remarkable to me that we don't have law
enforcement as part of the panel, however. It has come up in
previous panel discussions that law enforcement can only go
after people that they know they need to go after. And it has
also come up in the past that there are disincentives to
report.
Dr. Dameff, you have kind of mentioned that it could be--
the reputational damage can be significant from your hospital
or hospital network.
In the past I have wondered if the construction of the
Office of Civil Rights, the data breach reporting that was
created as part of the HITECH Act back in 2009, if this is a
disincentive to reporting. Once a company becomes listed, or
once a healthcare entity becomes listed on that, it is--they
are, essentially, archived forever. And I have wondered if we
should have a statute of limitations, or a statute of repose or
some remedial actions that can be taken by an organization that
would allow them to extricate themselves from that list. Is
that something that has come up in any of your discussions? For
anyone on the panel.
Dr. Dameff, I will just ask you specifically, since you
work in a hospital.
Dr. Dameff. Thank you. The question of whether or not
reporting record breaches--as part of their mandatory
reporting, whether or not that inhibits potential reporting of
ransomware impacts, I think is still unknown. I will say,
anecdotally speaking, I could see how that would prevent
individual organizations from wishing to report or perhaps
delay the impact of the reporting until they are--to anticipate
what might potentially be a large punitive fine.
There also--when a hospital is hit with ransomware, they
are also trying to restore operational capacity to take care of
patients.
Mr. Burgess. Yes.
Dr. Dameff. And there are so many competing things
happening at that exact moment, it is difficult to then report.
Mr. Burgess. Let me ask you about that, because you brought
that up. And we have spent a lot of time in this subcommittee
and other subcommittees talking during the pandemic about the
Strategic National Stockpile. Of course, the creation of the
Strategic National Stockpile was in an emergent situation. You
could deliver a set of things to an institution that they would
need to function in whatever the emergency--earthquake,
hurricane, flood.
So is it possible to have an urgent deliverable of what you
would need to run your--say, your emergency room at your
hospital, if you were just completely shut down with a
ransomware attack? Is that something that we should look at?
Dr. Dameff. I definitely agree it is something we should
look into.
One of my recommendations is coming up with metrics to
measure the impact to a hospital. And hospitals that have
severe attacks that would be devastating to patient care might
benefit from such a resource, akin to something like the FEMA
DMAT response, in which----
Mr. Burgess. Right.
Dr. Dameff [continuing]. Outside resources, personnel,
systems, tents, et cetera, could be deployed rapidly to help
alleviate those patient care constraints, while they are
restoring systems. It is definitely something that should be
looked into. We have never seen anything like that before.
Mr. Burgess. So at this point we don't even know--if there
is a major hospital system that gets attacked, we don't know,
downstream, is there a loss of life, was there--as you pointed
out, during the course of treatment of a stroke, is there a
loss of function that could have been preserved? We just don't
know the answer to those questions, do we?
Dr. Dameff. And that is why I recommend in my testimony
here that there be mandatory reporting for severe attacks on
patient safety implications.
One of the barriers to that is that systems in which we
measure care quality and patient safety are themselves targets
of the ransomware.
What do I mean? The way that we measure the quality about a
stroke care or a heart attack or something else is measured and
recorded in the electronic health record. The electronic health
record is ransomed.
Mr. Burgess. Yes.
Dr. Dameff. So we don't even have tools to measure that,
because they are also collateral damage from the actual attack.
Mr. Burgess. Let me ask you this. And, you know, in order
to get the proper metrics, in order to get the proper--be
able--for us to make proper decisions, you are going to have to
get proper information. It is hard to get proper information if
people are scared to report.
You and I--I am a physician, also--we live in the world of
the National Practitioner Data Bank, right? There is a central
location that a hospital credentialing committee can query as
to whether or not we have had a problem in other cities and we
are just taking our problems from town to town. Do you think
there would be a benefit from having something structured along
the lines of a National Practitioner Data Bank for data
breaches, for ransomware attacks?
Dr. Dameff. Forgive me, for individual physicians or for
healthcare delivery organizations?
Mr. Burgess. For the healthcare organization writ large.
Dr. Dameff. I do believe that we should get visibility on
the differences in organizations that are under attack. But to
penalize them, or to fine them significantly would reduce their
ability to bounce back from that attack, deliver care. And so,
whether or not it should be like a National Provider Data Base
but for healthcare ransomware attacks, I would support any
efforts that collect additional metrics on ransomware attacks
and to make that data transparent and public.
Mr. Burgess. Yes, the difficulty there is, though, when we
get--then you drive--you are driving a fear factor: I don't
want to report, because I don't want to be included.
Ms. DeGette. The gentleman's time has expired. The Chair
now recognizes----
Mr. Burgess. I am going to send you some questions in
writing on that, as well as other members of the panel.
I appreciate you----
Ms. DeGette. The Chair now recognizes Ms. Kuster for 5
minutes.
Ms. Kuster. Thank you very much, Chair DeGette. I
appreciate you holding this hearing today.
Today's discussion regarding ransomware attacks and the
growing threats that they pose presents a unique opportunity
for this subcommittee to identify existing vulnerabilities and
gather information on actions Congress can take to respond to
this emerging threat.
As we have heard today, ransomware attacks are not new, but
they are certainly increasing in number and sophistication in
recent years. We continue to see front-page news reports on
this attack, but it is not just the high-profile ones that are
occurring. The implications of these attacks have a far-
reaching effect beyond the companies that are being targeted.
The attack on Colonial Pipeline's information technology
system a few months ago had a significant disruption in energy
distribution on the entire East Coast that led to delivery
delays for businesses, and gas stations closed for over
millions of Americans. This is just one example of why we need
to explore what makes these companies vulnerable to begin with,
and what they can do about it.
Ms. Walden, you state your testimony that ``applying basic
cybersecurity hygiene can prevent a cyber criminal's ability to
ransom a system.'' For the benefit of the business owners who
may be watching this hearing, Ms. Walden, what are the most
common vulnerabilities that put companies at risk of a
ransomware attack?
Ms. Walden. Thank you for the question. Yes, that is true.
You--the best way to resolve a ransomware is to make sure that
it can't get into the system in the first place.
So there are some simple things that are just true for
preventing cyber attacks in general: enabling multifactor
authentication; doing better training of your employees and
staff on identifying phishing and preventing the click;
segmenting your network--and those are tools for CISOs to take,
but segmenting your network so that cyber criminals, once they
are in, can't laterally move. But these are some of the simple
cyber hygiene activities that small and medium businesses can
and should take to prevent ransomware or any other cyber
criminal attack.
Ms. Kuster. Thank you. And I know, as Members of Congress,
we are learning to do our best in that regard, as well.
It is clear that companies need to be giving increased
attention to cybersecurity. But the amount of threats and
vulnerabilities can be overwhelming. Mr. Carmakal, if you were
running a medium-sized company, what are two or three things
that you would do right away, across the board to protect your
systems and data?
Mr. Carmakal. Yes, thank you, ma'am. Great question.
There's a few things I would do.
Number one, to the best of my ability, I would try to
enable multifactor authentication on all remote access into my
organization.
Number two, I would try to educate my employees as best as
they can to identify phishing emails. But I do need to
recognize that employees will always fall victim to phishing
emails at some point in time, so I need to provide technology
to block as many of those malicious emails as possible, and
also provide technology and processes so that, if something
does get past the initial security system, we have got other
checks and balances to be able to identify the attack as it
occurs.
The third thing I would do is try to, to the best of my
ability, install all the security patches that I can and that I
know about across my environment.
Ms. Kuster. Very helpful, thank you.
I note that some cybersecurity measures are very expensive,
especially if they involve reconfiguring entire networks, but
the cost of these attacks is also increasing. Mr. Reiner, is it
fair to say that investments in cybersecurity are good returns
on investment?
And what more can be done to incentivize companies to make
these changes or spread the word about the necessity of
addressing vulnerabilities?
Mr. Reiner. You know--thank you for the question. As we
have spoken about extensively as part of the Ransomware Task
Force, is that--investing in this up front is much more
affordable than having to, as you describe, having to
reconstitute your entire organization after an attack. So
absolutely, putting the investment up front in order to stay
left of boom and make sure that these are not attacks that can
actually get into your system, is absolutely where folks should
be putting their resources.
I think the thing that can be reverted back to a little bit
is what we were talking about before, which is getting the
information out to those folks who don't really have the
resources. One of the things that we delved into was in this
spectrum of organizations there are companies that know, that
have resources, but choose not to invest. How do you help
inform their decision making, so that they choose to do so? You
incentivize them through some of the steps that we have spoken
about here today, tying grant making, relieving penalties if
they are compliant, et cetera.
I think there are organizations out there, though, that
simply do not know that this is happening, and they do not have
the resources in order to prepare in advance. We have to do
better, I think, in terms of getting to them and letting them
know what it is that they can be doing better.
Everything that was just described--multifactor
authentication, et cetera--those are simple things that folks
can be considering. We need to get that information to them----
Ms. Kuster. Sorry to cut you off----
Ms. DeGette. The gentlelady----
Ms. Kuster. I need to yield back. Thank you.
Ms. DeGette. The Chair now recognizes Mrs. Rodgers for 5
minutes.
Mrs. Rodgers. Thank you, Madam Chair.
Earlier this year Scripps Health was hit with a ransomware
attack. In the attack, the cyber criminals stole data on about
150,000 patients and caused significant disruptions in
operations. A family member of mine--or a family member of,
really, a constituent of mine--was directly affected by this
attack, and so I have heard firsthand how devastating it was
and the impact on their health. The Scripps attack is a stark
reminder of the stakes of cybersecurity. When the hospitals are
hit, it can literally be life or death.
Mr. Dameff, these attacks can have a direct impact on
patient health and outcomes. Can you help us better understand
the cyber threat hospitals face today, and provide a few
examples of situations where a patient's health was negatively
impacted by a cybersecurity or ransomware attack?
Dr. Dameff. Thank you. It is true that, in some medical
conditions, minutes matter. For example, we have sometimes
minutes to hours to treat a stroke, wherein our medications and
our treatments will no longer benefit that patient after a
certain amount of time. The same is true for things like
certain heart attacks. And our ability to diagnose a patient is
tied to the technology that we use every day, as clinicians,
that technology we are so dependent on.
So you can imagine, during a large ransomware attack,
wherein these technical systems are no longer available, that
we can't do our jobs as clinicians. I jokingly say I am the
generation of doctors that has never used paper records. Until
early on in my fellowship training, I had never had written a
prescription.
The future of healthcare is not going back to the days of
antiquated systems. In the future, we are only more
technologically tied to our systems that we use. That--when it
is not there, we can't do our jobs well enough. It takes longer
to get test results, to make decisions to give things like
antibiotics in severe infections, or to identify when patients
have certain conditions.
So you can imagine at that--at a scale of not just one or
two patients, but of a--you know, 5 or 6 or 10 hospitals down
at once, where you could imagine that would impact care along
the continuum, not just patients in the emergency department,
patients in clinics, patients in the ICU, patients that are in
ambulances that have to be transported longer distances because
hospitals under attack are on diversion. These are all examples
of how patients could potentially be impacted by this.
I will say, though, we do not have the ability to measure
that impact. As mentioned previously, the systems in which we
measure care quality and patient safety themselves are digital,
are affected by the ransomware attacks. So I fear we don't even
have the tools now to answer that basic question.
Furthermore, I would say that these types of attacks are
exceptionally chaotic, and there's a lot of things happening at
once. The ability for hospitals to report on that type of thing
is nearly impossible as they attempt to restore their systems.
Mrs. Rodgers. OK. As a followup, you have expertise in the
field of medicine and cybersecurity. In your opinion, what
steps should hospitals take to better secure their networks
against cyber attacks?
Dr. Dameff. I think it is shared among many of the panel,
the same types of technical controls: multifactor
authentication, focusing on rigorous backup, and restorations.
But there is--my number-one recommendation would be to prepare
for an inevitable ransomware attack, to practice and prepare
for taking care of patients without systems, and to be able to
do that at--within 2 or 3 hours of an attack.
There are a lot of hospitals in this country that have not
considered this type of attack on their systems, have not
prepared adequately for it, have not put in place how to take
care of 1,000 patients without technology. That is the number-
one thing I would encourage most hospitals across the country
to do now. There is a framework for that at every hospital. And
that type of preparation, at least in its beginning, doesn't
cost a dime.
Mrs. Rodgers. Thank you.
Ms. Walden, what are the ways the private sector can
partner with government to address ransomware attacks?
Ms. Walden. Thank you for that question. The government has
legal authorities that the private sector doesn't have, right?
They have law enforcement authorities, they have intelligence
authorities. The private sector, frankly, has a lot of signals.
But if you match those things together, we can do coordinated
actions to bring cyber criminals to justice.
So law enforcement can bring the criminal to justice.
Private sector can work along with law enforcement to identify
those criminals. But we can also work with law enforcement to
tear down the infrastructure that they use.
Mrs. Rodgers. So what do you believe we need to be doing,
as far as coordinating between the two, then?
Ms. Walden. I believe that we need--and I know I keep
saying it over and over again, but we need actionable
information sharing. I like to be able to exchange ideas and
signals and technology with my government partners to be able
to get at the problem together.
Mrs. Rodgers. So how are we doing?
Ms. Walden. From the digital crimes perspective, we have
great relationships with all of U.S. law enforcement, but we
also have great relationships with other countries and their
law enforcement. I think this administration is taking the--
cyber crime and cybersecurity seriously, and they are signaling
the right things, the right messages to would-be cyber
criminals and cyber criminals across the globe. And I think
working with our allies is working pretty well. There is still
a lot to do, but I think we have taken the best first step that
we can.
Mrs. Rodgers. OK, thank you. I yield back.
Ms. DeGette. I thank the gentlelady. The Chair now
recognizes Miss Rice for 5 minutes.
Miss Rice. Thank you, Madam Chair.
Mr. Carmakal, can you speak more about ransom payments, and
how we should be treating them?
And, you know, you talked a little bit about what the
motivation is to pay them or not to pay them. Can you just
expand on that a little bit?
Mr. Carmakal. Yes, absolutely. Thank you for the question,
ma'am.
So, look, most organizations, they don't want to pay an
extortion demand. They just feel that they have no other
option. And, you know, for whatever reason, you know, maybe
they feel like they need to accelerate the process of being
able to recover their business operations, or perhaps they feel
like they are doing the right thing to minimize the impact to
their customers, or to their partners, or to maybe the
intellectual property that they have, where they don't want
that information to be published on the internet for anybody to
be able to download.
And so, you know, I have had an evolving position on ransom
payments. Many years ago I was in the camp of, absolutely, you
never want to pay an extortion demand, because we all grew up
learning that, and we all grew up understanding you don't pay
criminals, you----
Miss Rice. Yes.
Mr. Carmakal [continuing]. Don't give in to terrorist
demands.
But what I have learned is, over the years, many of my
clients, against my recommendations, made payments and they
actually saw relatively positive outcomes. They got access to
their data, or perhaps they paid because they didn't want that
information that was stolen to get published on the internet.
And so I recognize that there are certain situations in
which a company may choose to pay, and they might get some
temporary benefit out of it. It is not necessarily going to be
a long-term benefit. So the temporary benefit may be companies
get access to their systems and data through the decryption
tools that are provided by the threat actors. The potential
long-term benefit is that the data that was stolen may never
end up being published on the internet.
But again, there's no guarantees that things won't show up
down the road. And I do anticipate, over time, we will start to
see threat actors that have been paid will end up publishing
the data at some point down the road. And that was a pretty
common thing, prior to 2019, for us to observe.
Miss Rice. Mr. Reiner, that kind of brings me to one of the
issues that you have raised, which is the need to understand
and regulate cryptocurrency. Can you talk more about what we
can do here, as a body, in that area?
Mr. Reiner. Thank you for the question. It was a pillar of
the conversations that we engaged in, as part of the of the
Ransomware Task Force. This is a major facilitating element of
what really has accelerated what we are dealing with, in terms
of the ransomware threat today.
The--from my perspective--and it really has been a learning
experience for me to better understand specifically what are
the choke points when it comes to cryptocurrency, the
ecosystem. Where exactly can we focus our efforts to try and
make it so that criminals cannot abuse these systems?
These are incredibly innovative capabilities. I think that
is a separate conversation.
What can we actually do, though? We can work much more
closely with the community that understands these systems and
how they work, and get into the weeds as to how they are being
abused. I do not think that that is very clearly and well
understood broadly within government, but also in the private
sector. And I think that would afford a great deal of
opportunities, if we have that sort of information exchange and
transparency, and understand it. You will see more clearly
where it is that we can do more to stop criminal abuse of those
payment systems. It is an incredibly complex web, because so
much of it is really outside of jurisdictions.
So there is this notion that we came up--or that was often
noted in the process, this jurisdictional arbitrage. The United
States is not alone in this effort. We have partners
internationally that we can work very closely with, who have
the ability to do things that we can't.
Miss Rice. Well, who is doing it right?
And, I mean, I think you mentioned that the--for Federal
agencies that have jurisdiction over this issue----
Mr. Reiner. Yes.
Miss Rice. Is it a resource issue? Is it an intellectual
capacity issue? Are we not able to hire the best and the
brightest? What--where is the deficit?
Mr. Reiner. I would argue, from the--so from where I sit,
we see a wide variety of technologies that disrupt various
elements of our society. This is a technological ecosystem that
is very disruptive and it is incredibly innovative, and we are
just behind the curve. We haven't--really quite yet understood
what it--how it works, and how to get ahead of that, from a
policy perspective. I think the policy is really playing
catchup here.
There are folks, I think, who are out there that can be
relied upon, as Ms. Walden noted earlier, who are interested in
playing a role to make sure that they are--they don't want
their systems being abused. They want to be seen as legitimate,
and they are willing to engage in these conversations. It is a
conversation that we need to engender, though.
To your question of who is doing it well, I think there is
a lot of work that still needs to be done. Internationally, I
don't know that there really is one that I would point to that
is really doing it well yet. I think there is a lot of growth
that we need to see happen there. But we can help lead on that
effort, from the United States.
Miss Rice. Thank you very much.
Ms. DeGette. I thank the gentlelady. The Chair now
recognizes Mr. McKinley for 5 minutes.
Mr. McKinley. Thank you, Chairwoman DeGette. Thank you for
the panel.
I am a little frustrated that you all have put together a
lot of efforts to try to help out and guide us, but even Johnny
Wooden used to say there is some confusion over efforts versus
accomplishments. And I am frustrated over the lack of
accomplishments, because our U.S. laws on cyber crime were
originated in 1987. And then our last international cyber
agreement originated in 2001. So cyber criminals are exploiting
these outdated laws, clearly, and they are targeting our
critical infrastructure, as we have all talked about here, so
far with it.
And it is not just in America. Just in the last 2 years, we
have seen a 500 percent increase in ransomware attacks and a
300 percent increase in the amount of money that is being
exchanged with this.
So I looked back on the history of it since we have been
chatting about this, these efforts. In the Ukraine, Russia
attacked Ukraine in 2015 and 2016 and tried to destabilize
their country. The Mexican oil company has been attacked,
Pemex, by ransomware. The oil fields in Saudi Arabia were
hacked by Iran in a retaliatory move. And then earlier this
year, the water system in Florida was attacked. So--and then
what you have heard also is the Colonial Pipeline. It was held
for a ransom payment. And we understand, as was noted earlier,
it provides oil for half the East Coast in this. And we saw the
consequences. We saw increased prices and shortages with it.
Yet these attacks on our critical infrastructure certainly,
I think, could be mitigated with updated reforms to our
international treaty, including some stiff, enforceable
penalties. But--and also--and I believe it was you, Mr.
Carmakal, was talking about cryptocurrency, understanding and
getting control over cryptocurrency.
But--so what I am saying to you, as an alternative, while
you all work your magic and efforts, what about an
accomplishment--if we could develop a redundancy in our energy
system, a backup system?
For example, earlier this year Texas suffered massive
outages after an electric generation failure. It could have
been avoided if they had had the ability to go backup, to
connect to their neighboring States, to get electricity. This
lack of redundancy in their electric grid has served as a--to
me, a stark reminder as an alternative to avoiding problems
like this.
So--but President Biden and his people on the left,
unfortunately, seem to be continuing to block this optional
exchange of building additional pipelines as a redundant
system. In this report that was just printed back in May, it
talks about how this environmental council is not recommending
any creation, maintenance, or expansion of pipelines in
America. That is going to make us more vulnerable, to where
hackers can get into our system.
We look at the Keystone pipeline, Line 5 in Michigan;
Williams Pipeline in New York; the Atlantic coastline, the
Mountain Valley Pipeline, all in West Virginia, all were part
of our critical national security, are under attack or have
been canceled with it.
So even Tom Seagal, in 2015, came before our committee, and
he said that he could hand pick 10 engineers at Berkeley, and
those 10 engineers, within just a matter of a few days, could
shut down--4 days, he said--in 4 days could develop a system to
shut down our electric grid between Boston and New York. That
was testimony for our office. So we know these hacks are going
to occur.
But what we need--what I am looking for is, how do we
develop--while the magic is developing, how do we deal with it?
What are--how do we develop redundancy on this?
So my question to all of you is would a reliable firewall--
while a firewall was being developed, or your systems being
developed, would you support development of a redundant energy
system for additional pipelines, so that if we do get hacked,
we can go around it to--and we--I think it would lessen the
attractiveness of attacking our pipelines if we could do a
redundant backup system. Would you support that, any of you?
I will start with you--I want to call you ``Dammit,'' but I
know that is not right.
Dr. Dameff. I would support any efforts to increase
healthcare resiliency in the face of cyber attack, broadly. It
is quite difficult to build redundant hospitals, for example.
But there are----
Mr. McKinley. I am talking about energy. I am primarily
talking about energy. I will let the other people on this
committee to deal with some of the other matters. But I think
on energy, I think, our national security is at risk.
I have run out of time, so I yield back. Thank you.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes Ms. Schakowsky for 5 minutes.
Ms. Schakowsky. So this has been pretty frustrating,
actually, and I hear remarks like we are playing catchup, that
it is--the cyber criminals are getting more and more
sophisticated, and it does feel like we are--we have a lot of
catching up to do.
And I also heard that there is no one, internationally,
that is necessarily doing better than we are.
As a part of a legislative body--and I do believe that
Chairman DeGette did ask the question--are there things that
come to mind now, where we, as a legislative body--for example,
I chair a subcommittee of the Energy and Commerce Committee
that deals with consumer protection, and I am wondering if we
should be thinking about or getting your advice on legislation
that might address the problem that we are facing.
I understand that it is totally multifaceted, that the
executive branch has a huge role to play here, that it is
beginning to do more of that. But can you advise us on the
kinds of things that we could play?
I--really, anybody can jump in. You are looking, you know,
ready to go.
Mr. Carmakal. I would love to take your question, ma'am.
Ms. Schakowsky. Mr. Carmakal? OK.
Mr. Carmakal. So, first of all, look, I am equally
frustrated about the problem. Every week it is exhausting for
incident responders to have to deal with highly disruptive
attacks against organizations. And it feels like every week it
gets worse and worse.
But I do want to take a moment to celebrate the wins,
because there has been a lot of wins out there, and I don't
think we always celebrate that, or we don't celebrate it
enough.
Number one, I think organizations are defending themselves
against attacks every single day. We may not talk about that
publicly, but it happens a lot.
Number two, I would like to----
Ms. Schakowsky. Let me just ask. Do you think there should
be any requirements for building in these security systems?
Mr. Carmakal. I think there is a general expectation for
most organizations to have cybersecurity controls and
resiliency in place. Whether that is enforced by law or there
is--generally expected by customers, I think that does exist.
Ms. Schakowsky. Go ahead.
Mr. Carmakal. Beyond that, I think there's a number of
wins. If you look at some of the things that government has
been able to do over the past few weeks and months--and I am
pretty proud and excited that the Bureau was able to recover
some of the funds that were paid by Colonial Pipeline to the
threat actors. That was a pretty big win. And it is exciting to
be able to see some of those actions taking place.
It is pretty exciting to see some of the disruption to
threat actor botnets like TrickBot and Emotet, and some of the
more nefarious botnets that are operating out there, and that
is a good example of public-private collaboration and
coordination.
Ms. Schakowsky. Well, I----
Mr. Carmakal. Just this week----
Ms. Schakowsky. I want to just interrupt for a second.
Mr. Carmakal. Yes.
Ms. Schakowsky. And then where does responsibility mainly
lie?
Should the Federal Government be required, then, to step in
if there has been a failure in security that should have been
considered by the--either the private sector, or----
Mr. Carmakal. I think there is a shared responsibility from
victim organizations, from security companies, from government.
I don't think any one party can handle the problem on their
own. It is going to require a concerted effort from multiple
different parties, and I think we all need to step up, and we
all need to celebrate the wins, and we need to actually
continue to emphasize effort on the wins, on the things that
have been happening successfully.
And I look at things that the FBI is doing in terms of
notifying victim organizations about upcoming intrusions. It is
incredibly powerful when that happens, when somebody from the
FBI calls a victim organization and says, ``There is a threat
actor in your network today, and if you don't do something
about it in the next 3 days, they are going to take your
business offline.'' A lot of times that victim organization
actually has the ability to call in for help and to disrupt the
threat actors and eradicate them from the environment.
So when we see actions like that from the government, I
mean, it is incredible. You look at what happened earlier this
week, or yesterday, with the indictments of a number of, you
know, Chinese individuals that conducted intrusions over the
past several years. Those indictments are good steps. They are
good tools in the government's capability to try to curb the
problem. So we would love to see much more of that happening.
Ms. Schakowsky. Thank you.
Ms. Walden, you said don't pay, that--so what is the
alternative to that?
Ms. Walden. Well, I think there are a few things that can
take place and that Congress can do in order to prepare the
country and to raise the maturity level of potential victims,
and one is to create a recovery fund of some sort so that
victims aren't alone in absorbing----
Ms. Schakowsky. Could you turn on your microphone?
Ms. Walden. Sorry, is that better?
Ms. Schakowsky. Yes.
Ms. Walden. Ah, sorry about that. A couple of things that
Congress can do to make sure that victims are at a maturity
level to be able to not pay, right?
So one of those things, for example, is raising the
baseline for cyber hygiene, bringing everybody to a
cybersecurity maturity level that can handle it.
Another would be to develop a cost recovery fund that will
allow--that will help victims absorb--and the country, really--
to absorb the cost of critical infrastructure for having down
operations.
On the cryptocurrency piece, if I may, it is helpful to
know which department or agency has authority over the crypto
economy, whether it is--and the investors, right? Whether it is
the SEC or the CFTC, that is a great start.
So I also want to make a shameless plug for the Ransomware
Task Force report. I think there are about a dozen or so
potential legislative actions recommended in there.
Ms. Schakowsky. Well, why don't--I would like----
Ms. DeGette. I am sorry----
Ms. Schakowsky [continuing]. To see those.
Ms. DeGette [continuing]. The gentlelady's----
Ms. Schakowsky. And I yield back, I am sorry. Thank you.
Ms. DeGette. That is OK. The Chair now recognizes Mr. Dunn
for 5 minutes.
Mr. Dunn. Thank you very much, Madam Chair, and thank our
panel.
You know, recent ransomware and other cyber attacks have
highlighted our vulnerabilities, showing the difficulties in
holding those who perpetrate these attacks accountable. And it
should not escape any of us that the vast majority of these
significant cyber attacks originate from within countries that
just happen to be our greatest foreign adversaries: Russia and
China. It is my belief that the best defense is a good offense,
and that goes for ransomware, as well. You know, we have to put
Russia and China on notice that they will be held accountable
for these organizations operating freely in their company.
So, you know, I think back to the 2014 OPM hack. It put
millions of Americans' records at risk, tens of millions. This
was something, you know, that Congress and the American
Government simply has to address.
With that, Dr. Dameff, there has been a significant uptick
in ransomware attacks on healthcare organizations, certainly
since 2016. Now, I was amused when you said you had never
written a note in a chart, you had always--EMRs. You know, I
actually go back to the days when we had a lot of paper, and we
got a lot of work done. So I would say, while technology--and,
you know, it certainly has made huge, you know, advantages in
medicine--I am concerned that we are not ready for cyber
attacks. Is there a single vulnerability that you would point
to that makes us--that is worse than any of our other
vulnerabilities in healthcare?
Dr. Dameff. Thank you so much for that question. If I could
point to a single one, it is at the heart of what you
mentioned, which was this hyper connectivity that was
accelerated over the last 11 or so years by meaningful use. The
thought we would digitize healthcare rapidly to improve care--
--
Mr. Dunn. Everything is connected to everything.
Dr. Dameff. Yes, and I think the commensurate security
required for that did not happen, and did not occur. And so we
are in a position now where we have a very difficult sector,
generally a soft target for cyber attacks and ransomware.
And then on top of that we have a lot of demands,
especially over the last year. The COVID pandemic has spread
thin many healthcare delivery organizations across this country
and across the world. And as a consequence they are left
juggling many different constraints, of which only
cybersecurity is one of them.
Mr. Dunn. Yes, and I would daresay that we are not paying
as much attention to cybersecurity as we were before the
pandemic. Everybody is a little tired, I appreciate that.
In the interest of time, I am going to switch gears a bit
here. You know, the U.S. Government confirmed just yesterday a
mass ransomware attack on Microsoft earlier this year was done
at the direction of the Chinese Government. However, even
before this acknowledgment, anyone would be naive to believe
that these recent ransomware attacks and cyber attacks are
truly perpetuated by rogue criminal organizations within
authoritarian China and Russia with no connection to or tacit
permission from these authoritarian governments.
So, Ms. Walden, Microsoft Research Asia, MSRA, located in
Beijing, notes on their website, ``Technologies from MSRA have
had a large influence within Microsoft and around the world,
and new technologies are constantly born from MSRA. MSRA has
achieved breakthrough results in many areas of basic applied
computer research, and these results are transferred into
Microsoft products.''
Many experts, regulators around the world, have come to, I
believe, the rightful conclusion there is no such thing as a
private company in China, that virtually everything that
happens in that country happens with at least the--if not the
direction of the Communist Party.
Do you believe that the fact that you are making these
products in China makes them more or less vulnerable, more or
less--or makes us more or less vulnerable?
Yes, or--I mean, are we safer because of that? I don't
think so.
Ms. Walden. Well, thank you for the question. As you
pointed out, there are challenges for doing business in China.
And we--right? And we operate on an a zero-trust basis, and we
operate with our values. We don't----
Mr. Dunn. They can compel the----
Ms. Walden. Right.
Mr. Dunn [continuing]. Your information. I mean----
Ms. Walden. We don't store--we store no data, no U.S. data,
in China. And we operate on the principle of zero trust and
secure that data.
Mr. Dunn. But the code is also yours, right, and theirs.
The codes you write, the software code you write, it is theirs
as well as yours.
Ms. Walden. For Chinese products and services. But I will
tell you this. From an investigation point of view--and I am in
the Digital Crimes Unit--we go after cyber criminals and their
infrastructure wherever they may be, and that will include
China or Russia or other unfriendly jurisdictions.
Mr. Dunn. So, I--we are--run out of time, but I would say,
I just--like most of us, I think, we are nervous about the fact
that you are working so closely with the Chinese Government in
China.
I liked your comment on the cryptocurrency, by the way, and
it looks more like a security than a currency.
With that I yield----
Ms. DeGette. The gentleman's time has expired. The Chair
now recognizes Mr. Tonko for 5 minutes.
Mr. Tonko. Thank you, Chair DeGette, and thank you for the
hearing.
Our government has an important role in ensuring the
Nation's cybersecurity, especially related to critical
infrastructure. I am sorry to say that high-profile government
entities have also been victims of ransomware attacks
themselves. In my district alone, the Albany airport, local 911
systems, police departments, and the Albany City Government
have all been among those who have been attacked. So, with many
government agencies involved both as targets and as protective
actors, I would like to try to get clarity from our witnesses
today on just how the government can be better positioned to
address this threat and help respond.
So, Mr. Lee, can you first give us a sense of how it works
now?
When a critical infrastructure company is attacked with
ransomware and they seek assistance from the Federal
Government, who do they call? Which agencies get involved?
And most importantly, what services does the government
actually provide?
Mr. Lee. Thank you. I think that the candid answer would be
that there is a lot of confusion on who to call and how to
actually organize that. And each government agency is most
certainly helpful: CISA, FBI, DoD, so forth. They try to help
out. But the expectation on the power company, energy company,
and so forth, is that they have to talk to all of them. And
there is a lot of confusion on what is actually going to come
back as value.
So, while there are good relationships, I think,
ultimately, government would do better to be able to
communicate with one face, also be able to handle .gov and the
State and local agencies, as well, where there are a lot of
cybersecurity issues, and then show the private sector what is
working versus trying to go advocate for services and things to
do that they may them not--they may themselves not be taking
full advantage of.
Mr. Tonko. So who should be that go-to, which face in
government?
Mr. Lee. I don't think most companies really care, but in
my opinion it would be CISA. CISA is well established, as a
civilian agency, to be the front door to government. That
doesn't necessarily mean they are the ones that are going to do
all the work, but to be the coordinator of the interagency
process would be much more efficient.
Mr. Tonko. Thank you.
And Ms. Walden, you spent nearly a decade working on
cybersecurity and other national security issues at the
Department of Homeland Security. I heard your interaction with
a couple of my colleagues on the subcommittee here. But as we
consider solutions, are there more services that the government
could provide that are currently either in short supply or not
being provided at all?
I heard you encouraging us to provide that full complement,
but are there--those in short supply or not being done at all?
Ms. Walden. I think--and I agree with Mr. Lee here--that
there are services that the government can provide for free,
frankly.
I think what is in short supply are the resources, are the
workforce, the persons that are able to provide the technical
assistance that CISA is authorized to give to private-sector,
non-Federal, and Federal entities. There is just a shortage of
incident responders, of pen testers, of technical staff that
are able to address these issues.
But in terms of authority, legal authority, I think they
are--they exist across the government. I think it is our--it is
the government's job now to really use the full weight of those
authorities that they have.
Mr. Tonko. Thank you. And while it may sound reasonable to
have one agency in charge, one concern is that each industry or
sector has very specific circumstances and needs. One agency
cannot be expected to understand perhaps all the complications
of a ransomware attack against a power plant versus a hospital,
for example. That is why we have sector-specific agencies to
coordinate cyber info sharing with their industry and act as
industry partners. Over the years, however, there have been
some challenges about how such agencies coordinate with DHS.
So, Mr. Reiner, what improvements can be made regarding
coordination between DHS, sector-specific agencies, and the
private sector to address the ransomware threats?
Mr. Reiner. Mr. Tonko, I think one of the things that we
have been most emphatic about, coming out of the Ransomware
Task Force effort, is that there may well be--and I think
Charles spoke to this earlier--there are efforts that are
underway that are, actually, pretty phenomenal. There are folks
and departments and agencies and companies and individuals that
are out there that are fighting this every day, who are
actually doing an incredible job. And we really need to commend
them. But they need help.
And one of the things that I think that Rob was alluding to
is that having an interagency coordinated effort, where you
have that one door to turn to when you need that help, would be
immensely helpful. Our argument coming out of the task force is
that really needs to be coordinated by the White House. The
National Security Council really is in a unique position in
order to coordinate all elements of national power in a way
that, really, nobody else can.
You can look at elements like the NCIJTF. You can look at
the JCPO that has just been stood up in DHS. Those may be
helpful in this regard, in terms of coordinating interagency
assets. But really, at the end of the day, from our assertion,
it has got to be out of the White House.
Mr. Tonko. Thank you very much.
And Mr. Lee, I would ask that you could also respond. I am
out of time, but perhaps get word to the subcommittee.
Thank you.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes Mr. Palmer for 5 minutes.
Mr. Palmer. Thank you, Madam Chairman. I want to take this
a little different direction.
We have talked a little bit about law enforcement, but on
June 14th the heads of state with NATO--the NATO-allied
countries met, and they issued a communique from Brussels and
addressed the issue of the increasingly complex security
environment that all these nations are dealing with. And they
made this statement--they issued 79 statements--number 32, and
I will summarize it, that the alliance is ``determined to
deploy the full range of capabilities at all times to actively
deter, defend against, and counter the full spectrum of cyber
threats, including those conducted as part of hybrid campaigns,
in accordance with international law.''
But they reaffirm a decision as to when a cyber attack
would lead to the invocation of article 5, which would be taken
by NATO-allied nations on a case-by-case basis, and they said
they recognize that the impact of significant, malicious,
cumulative cyber activities might, in certain circumstances, be
considered as amounting to an armed attack. That is pretty
serious, and I think that is one of the things that we have
kind of danced around, we really haven't addressed. We treat
all these ransomware attacks as criminal activity, when they
may not be exactly carried out by nation states, but in some
cases--and I think, in particular, Russia and China--they are
at least, if not sanctioned, approved.
And Mr. Lee, I want to direct this to you because you have
military background. We have tremendous capabilities in our
military to address this. Does it make sense for us to
counterattack, and particularly in some of the nations where
the government is really a group of oligarchs with tremendous
financial interests?
Just--could you address that?
Mr. Lee. Thank you for that question. I think most people
in the military would generally like to not get to military
force. We want to take all mechanisms available before we get
there. And I think there are still plenty left.
However, to directly address the question, I think that we
do have to draw certain red lines of what we will and will not
accept in this country, and how we are going to respond. And
when I have looked at the messaging of NATO and others before
on that topic, one of the challenges not only is that we don't
specify what that red line is, but we don't tell anybody what
we are going to do about it. And so it is not deterrence, it is
strategic ambiguity.
Mr. Palmer. That is----
Mr. Lee. So if we are going to use military response, we
better well define it.
Mr. Palmer. Yes, I am not talking about an armed response.
I am talking about in the cyber field, because they are
attacking infrastructure. And I think our government may have a
different definition of what is critical infrastructure than
perhaps your organization does, and that is troubling to me. I
don't think that we can allow these cumulative attacks to
continue, when we know that there--these groups are giving safe
harbor in these nations. There needs to be a price that has to
be paid.
I want to transition a little bit away from that, and Ms.
Walden, I do appreciate what Microsoft is doing. You have
really stepped up in terms of law enforcement. But I am just
not sure that it is enough. And we have had this discussion
about whether or not people should pay. And it was mentioned
the percentage increase in ransomware attacks, and I just
wonder if the fact that people have cyber insurance and we know
that some of these ransomware--these hackers have hacked into
these insurance companies and they know what certain groups are
capable of paying, is the insurance helping or hurting?
I mean, when they know that they have the ability to pay
and they negotiate outside of law enforcement, is that helping
or hurting?
Ms. Walden. Well, quite frankly, I don't know if it is
helping or hurting. I am not a cyber insurance expert. But I
will say that there is a whole ecosystem out there that
supports victims that are attacked by ransom. And cyber
insurance companies are just part of that ecosystem. But
whether they are helping or hurting, it is the victims that
need to make the right business and operational decisions.
Mr. Palmer. Well----
Ms. Walden. I would hope that it means to not pay, but I
can understand when they do pay.
Mr. Palmer. Well, one of the things that is missing out on
the task force website, and that is whether or not people
should pay, and the whole issue of the insurance. That seems to
be a pretty substantial omission.
Could you address that, Mr. Reiner?
Mr. Reiner. Yes, thank you for the question, Mr. Palmer. I
think it really, at the end of the day, was the only item that
the task force didn't come to a very specific recommendation
on, in terms of why. I think there was a general leaning
toward, I think, as my colleagues here have noted, making it so
that the least amount of money is going to these criminals as
possible and to devise a set of steps so that we could actually
move in that direction.
If we were to, for instance, want to prohibit payment now,
the ecosystem is simply not ready. It is not prepared for that
sort of injunction. So how can we get there?
This--the report actually does lay out a number of steps,
milestones, potentially, that could be taken on over the course
of a couple of years to get us there. That is shoring up the
defenses that we are working with, that is going after these
criminals so that they don't act with such impunity. There is a
good list of steps that need to be taken first, and then maybe
we can move in that direction.
Mr. Palmer. I thank the Chair, and I will submit the
balance----
Ms. DeGette. I thank the gentleman.
Mr. Palmer [continuing]. Of my questions in writing.
And I yield back.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes Mr. Ruiz.
Mr. Ruiz. Thank you very much, Chair. Today's hearing is
focused on ransomware cyber attacks, which are becoming a
growing and frequent threat to our businesses, utilities, and
government agencies. Ransomware attacks have devastating
consequences on their victims. A company or utility being
locked out of its networks means lots--lost of time, lost
money, and, in some cases, can also threaten the public's
health and safety.
In fact, I have visited Riverside County's Information
Technology Center in my district to see what local governments
are doing to combat cyber threats, and I have worked with
California State University of San Bernardino to strengthen
their cyber workforce teaching programs, and for improved
pipeline workforce for our Nation.
I would like to know more about what happens when a company
suddenly finds its employees locked out of their computers due
to ransomware, who they can turn to, and what more the
government can do to help. So, Mr. Carmakal, I understand you
are involved in incidence response at Mandiant. What do
companies struggle with the most, or what are their barriers
when faced with a ransomware attack?
Mr. Carmakal. Thank you for the question, sir. So there is
a lot of confusion in the early days of an incident.
First of all, people don't actually know what actually
occurred. Sometimes you can figure out that you are a victim of
a cyber attack, because they see a ransom note that is deployed
across all systems. When they see that note, a lot of times
those--the victim organization may call a legal team to help
them assess what to do next. They might call an incident
response organization to help them investigate the intrusion.
They may call their cybersecurity insurance provider to see
whether or not the other third parties that they are engaging
can be reimbursed. They may reach out to law enforcement.
But within the first few days there is usually a lot of
confusion, and everybody wants to get things back online as
quickly as possible. They also want to assess what is the
actual true impact of the incident. They want to understand
whether or not data was stolen from the environment, and will
that information show up on the internet down the road?
And unfortunately, it is a very complex situation that
often takes several days or several weeks to be able to
investigate and to be able to recover the environment. Most
organizations that deal with some kind of disruption, best-case
scenario, they will be back online within a few days. Realistic
scenario, it is going to take them a few weeks, possibly even
months, to fully recover every system across the environment.
Every situation is different, and there is usually a team of
experts that victim organizations call in and ask for help.
Mr. Ruiz. Thank you. Thank you.
Mr. Reiner, as we have heard today, one of the most
challenging decisions a company faces is whether or not to pay
the ransom. In fact, whether or not to prohibit payments of
ransom was the one key issue on which your Ransomware Task
Force could not reach consensus. So can you please walk us
through the considerations here?
And what are the most important recommendations the task
force made when it comes to prohibiting ransom payments, and
how did you arrive at those priorities?
Mr. Reiner. Thank you for the question. Yes, it was
definitely a contentious discussion around this issue within
the task force. And, as we laid down in the report, what we
believe is probably the most appropriate way or the most
effective way of approaching this is to have a set of steps
that need to be taken in order to move in that direction, if
that is what is chosen to be done, from a policy perspective.
I think the conclusion of the task force was that, at this
point, if you were to mandate the prohibition of payment, that
it was just bad policy and that, again, a number of steps
really need to be taken in order to move in that direction, one
of which is to shore up defenses and get resources to companies
and entities, municipalities, what have you, so that they can
better defend themselves; take the fight to these ransomware
actors in ways that we currently have not been doing, so they
don't get to operate with such impunity; shoring up the cyber
insurance market so that it actually is functioning in response
to the level of threats that we are dealing with today.
There is really--there's a number of steps that we think
need to be undertaken, concurrently----
Mr. Ruiz. Thank you.
Mr. Reiner. Yes, sir.
Mr. Ruiz. Dr. Dameff, like you, I am a trained physician,
and I know firsthand the heavy reliance hospitals have on
digital records and network infrastructure. But people aren't
going to stop having medical emergencies or procedures, or
practice medicine when their technology is taken away. What
kind of procedures do hospitals need in order to be able to
effectively operate during ransomware attack?
For instance, should manual backup procedures exist for
when electronic records and machines go down?
How can a hospital practice paper backup for preparedness?
And should those drills be included in accrediting bodies'
criteria to be accredited?
Dr. Dameff. I strongly support the preparation for
hospitals to operate under ransomware attack in a manual
fashion to the--to restore those systems as quickly as
possible, but not to rely on them to deliver emergent care to
patients that are still going to come in the front door, like
you mentioned, still going to come into the emergency
department. Whether or not it should be a portion or a
prerequisite or a condition of hospital accreditation is a
complicated one, depending on what level of preparation you are
going to require of a particular hospital.
What I can say is that there are current processes in place
that are required of every hospital to be prepared for all
hazards, things like earthquakes and hurricanes, for which
cybersecurity disasters--truly, these could be disastrous
consequences for hospitals--should be incorporated, and should
be prioritized because, generally speaking, cybersecurity
attacks--sorry, cybersecurity and cyber attacks--can hit any
hospital without geographic predilection or precondition.
What am I trying to say here is that every hospital needs
to take this seriously. Every hospital should prepare for
taking care of sick patients without the Electronic Health
Record and other technical systems. Any preparation efforts for
that should be supported, standardized, studied, and spread
across the country.
Mr. Ruiz. Thank you very much.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes Mr. Joyce for 5 minutes.
Mr. Joyce. Thank you, Chairwoman DeGette and Ranking Member
Griffith, for holding today's hearing on the growing threat of
ransomware.
All too often we see our Nation's critical infrastructure
being attacked from nefarious actors, exposing our
vulnerabilities and ultimately harming our citizens. As a
doctor, I am aware of the growing importance of securing
patients' personal identifiable information and medical
records. This body must take a proactive approach to strengthen
all critical infrastructure and ensure that all Americans'
medical data is safe from those who choose to do harm.
Dr. Dameff, let's continue the discussion. In your
experience, when a hospital or a healthcare system is the
victim of a ransomware attack, how long are their systems down?
Is it days? Is it weeks? Has it gone on for months?
Dr. Dameff. Great question. We have seen the entire gamut.
And it doesn't necessarily always match with how prepared they
were. It depends often on who the adversary is, what they
particularly deployed.
But one thing I will say is that we need to study this
because, looking at the latest headlines, it seems like cyber
attacks are increasing in sophistication, frequency, and,
potentially, increasing downtimes. I see more a trend towards
weeks to months than I do days, insofar as these devastating
attacks are more impactful and would result in a longer
downtime.
Mr. Joyce. So in this recovery response timeline after a
cyber attack, does the healthcare system revert to manual
patient care systems?
You said something that is somewhat frightening to me. You
said you are a generation of doctors who have never used paper
charts or have never written a prescription. As one of the five
physicians on this committee here today talking to you, that is
frightening to me. How do we respond?
Dr. Dameff. I think that it is key that we incorporate
cybersecurity training and preparation into the next generation
of medical education.
Mr. Joyce. Would that include paper?
Dr. Dameff. I do. I do think that physicians should be
trained to operate in conditions that do not have technology,
or to rely on less connected technological backups as a stopgap
measure for patient care.
Mr. Joyce. When talking about ways to prevent or mitigate
the effects of a cyber attack on healthcare systems, some
individuals talk about the cloud or having a system backed up.
Are these ultimately foolproof ways to ensure that a hospital
system or a healthcare provider does not have to pay the
ransom, or the ransomware attack, or that patients are less
impacted?
Dr. Dameff. I think that this trend towards centralization
of medical device management, for example, or electronic health
records into the cloud is a trend we are not going to see
change.
I would defer to the specific security protections offered
by such cloud architecture to other members of the panel, as it
is not my expertise. But I will say that it is a two-edged
sword, if you will. The centralization of these into the cloud
means that a single attack on a cloud provider offering
services to many hospitals across the country, if attacked,
could impact all of them at once.
So that being said, many hospitals are not well equipped to
defend their systems, as it is. So do you offer increased
protections from the cloud more so than you would at individual
hospitals, taking the risk that, if that particular cloud
provider went down, you know, hundreds of hospitals could be
hit?
This is something we are going to have to figure out, and,
quite frankly, we do not have the data to make that decision
currently.
Mr. Joyce. Dr. Dameff, I would be remiss if I did not reach
out and thank emergency physicians, emergency nurses, emergency
technicians as we have faced a pandemic and as you continue to
face the ransomware attacks that are occurring in the medical
community. As someone who previously worked at Johns Hopkins
Bayview Emergency Department, I have great respect for the work
that you continue in the face of this pandemic, and I think I
acknowledge that today and thank you.
Madam Chair, I remain--I yield my remaining few seconds.
Ms. DeGette. Thank you, Mr. Joyce. And I think that the
entire panel and the entire Congress would echo your
sentiments, thanking----
Mr. Joyce. Thank you, Chair DeGette.
Ms. DeGette [continuing]. Emergency room personnel. Thank
you.
The Chair now is pleased to recognize Mr. Peters for 5
minutes.
Mr. Peters. Thank you, Madam Chair. Thanks to the witnesses
for being here.
Dr. Dameff, you have got all the questions, but you are
from San Diego, so I just have to ask you a couple.
First of all, thanks for your great work.
And just down the street from you, a major hospital system
suffered this very attack, and I assume will--as they ease out
of that, or as they climb out of that, we will learn more about
what protocols could be.
I have heard you talk about making sure that, in the
aftermath of an attack, that hospitals are prepared to operate
without their technology, also to define protocols that
hospitals might be able to rely on to prepare to defend
themselves against these hacks.
One question I just haven't had--you haven't--heard you
answer, and forgive me if I missed it, but should we be
disconnected a little bit more?
I have often wondered if there is a way to take a unit like
a hospital and to have some sort of way to fence it off so that
they can operate internally in a connected way without being so
exposed. And that may be a question for you or for some of the
people on the panel, but I am curious about that.
Dr. Dameff. I do believe we should invest in technology
that limits the exposure of hospitals. Traditionally speaking,
as I mentioned previously, hospitals are soft targets. They
generally have flat networks, meaning that they are often
employing the best practices for network segmentation. And as a
consequence, they are more at risk for rapid spread of
ransomware, for example.
So this concept of isolating critical sections of the
hospital and being able to rely on those systems without risk
of ransomware would require a lot of those technological
solutions. They are costly and, as mentioned previously, there
are a lot of healthcare systems that will not have the ability
to deploy such technology without resources and additional
guidance.
And so, for that, I would encourage that type of isolation.
But I fear we are not going to get to it. Instead, I think we
are, unfortunately, going to have to rely on just preparing for
an inevitable attack and limiting the damage to patient care
while we wait for system restoration.
Mr. Peters. And also deploying defined protocols or best
practices, I guess, as it would be--maybe we could help define.
You know, I appreciate that. And I also wanted to follow up
on comments from questions from the Chair and from Ms.
Schakowsky about what the duty is of private organizations to
take care of their stuff.
You know, I thought a lot about Equifax--not to pick on any
particular company--but there is a company that is performing a
public function with a lot of private data. And it seemed to me
that the loss of that data to the malefactors really didn't hit
their bottom line. And so I have often wondered if the
companies that do this kind of work--sort of like, in a way,
providing a public service--are appropriately incentivized to
take care of that data.
Maybe, Ms. Walden, I would direct this to you. Your
testimony said that we should make sure that companies make it
harder to get in, limit the scope of damage, and prepare for
the worst. I guess--do you believe that companies are
appropriately--to incentivize on--from the bottom line to take
care of individuals' data, or is that something that the
government has to define better?
Ms. Walden. First, as a victim of the OPM breach years
ago----
Mr. Peters. OPM, and the DNC, but I changed my cell phone
number. That is a different situation----
Ms. Walden. Those are different situations. But I do think
that companies need to be held to a standard to protect private
data. But these cyber attacks are more than just about data
leakage, right? They are interrupting business operations.
Mr. Peters. Right.
Ms. Walden. And I do think that there is a role for the
private sector in making sure that they prevent these criminal
actors from getting into their systems in the first place.
There are some very simple things that can take place that we
described here: multifactor authentication, patching your
software, et cetera.
But all that is to say is--I think we need to raise the
collective security of critical infrastructure owners and
operators, and we--we need to put the onus on both the
government, to protect the critical infrastructure, and the
private sector that owns and operates the critical
infrastructure----
Mr. Peters. Don't get me wrong. I actually, really, am a
believer that the private sector has the--is the appropriate
place for these solutions to be investigated and developed.
What I don't--what I am--just to make sure that I am clear, is
that I am not sure that companies are incentivized in a way
that would make them deploy the best practices.
So, even if we knew what those best practices were, even if
we defined them from sector to sector, what is going to make
the next company who has got private information invest in
that, knowing that maybe the loss of that information doesn't
directly affect their bottom line?
Ms. Walden. I would agree. I think many companies aren't
properly incentivized to protect their data.
Mr. Peters. I am out of my--I am out of time. I would just
suggest that we might want to think about defining a duty of
care in a piece of legislation that would just make sure that
everyone is properly noticed that they have to do the right
thing.
And Madam Chair, with that I yield back.
Ms. DeGette. I thank the gentleman. The Chair now
recognizes Ms. Schrier for 5 minutes.
Ms. Schrier. Thank you, Madam Chair, and thank you to our
witnesses.
When we hear the term ``ransomware,'' we often think of
high-dollar ransoms and large companies. But, as all of you
pointed out, individuals and communities are also affected by
these attacks when they can't get gas to go to work, when their
school or local hospital is impacted by an attack, or when
their own data is compromised.
I have heard from local hospitals about the immense cost
and manpower it takes to try to harden a whole system to
prevent a cyber attack--with my hospital, who is training up a
workforce to not fall prey to phishing, and then to recruit and
hire the best and brightest in cybersecurity, as you mentioned.
Dr. Dameff, I can tell you, from common experience, that
just a few hours of power outage completely handicapped my
ability to take care of patients, so I can only imagine how
this sort of thing would impact a hospital, especially for days
on end. And you already described for my colleague, Mr.
Griffith, how those impacts on patient care may be felt more
acutely in lesser-resourced and rural hospitals. Could you be a
little bit more specific about how sister hospitals, if there
even are sister hospitals, local entities, private-sector
actors, and the Federal Government could better support
specifically those healthcare systems, so that they have the
resources they need?
Dr. Dameff. Thank you so much for that question.
I think the first and most important thing is the
preparatory efforts to prevent and then mitigate the impacts of
those attacks. So, looking at your particular geographic area,
and understanding where are the linchpin hospitals, right?
Which ones are providing trauma services? Which ones are stroke
centers?
These types of specialized hospitals, who take care of
hyper acute patient care, should be identified early and
prioritized for that type of preparation, as well as resources
to ensure that, when they do go down or when they are attacked,
they are able to fail gracefully as much as possible, while
still taking care of patients. So there is a preparatory step
in that.
Second, in the response phase of this, I think it is common
for a hospital to reach out to law enforcement early. I think
that has been a pretty common theme, in that they will reach
out to the FBI to help with investigatory efforts and response.
But whether or not that type of communication transcends to
other government agencies such as CISA or the FDA, even if
medical devices are involved, can sometimes be--not happen.
And so I think that is partly the responsibility of a
particular hospital but also of the bodies that accredit
hospitals as well as local public health authorities in being
able to quickly propagate meaningful metrics of patient care to
authorities that can help, who can bring resources in the hour
of need to help hospitals still take care of patients while
addressing that.
Ms. Schrier. That is----
Dr. Dameff. So that type of interagency communication is
lacking.
Ms. Schrier. That is really helpful. And I know, in
Washington State, our Washington State Hospital Association
does these kinds of drills with hospitals to help them prepare.
And then, speaking of incentives, I know a hospital's
reputation is really integral to its ability to serve the
public. It seems like one of the things we need to communicate
to the public is that, even with the best preparation, these
attacks are so common that you can still be hit. Do you think
that is a role for public--you know, for the government, for
the private sector, to kind of communicate this to the public?
Dr. Dameff. The communication--oh, thank you very much--the
communication of that is rather difficult.
I have always said that there should be no competitive
advantage in healthcare cybersecurity, right? There should
never be billboards saying, ``Come to our hospital, we didn't
have this happen,'' because, quite frankly, I would agree with
you that, because of increased--the sophistication of these
types of attacks, no one is immune from this. No healthcare
organization is immune, regardless of their cybersecurity
budget.
So at the end of the day, I think communicating that it is
an unfortunate consequence of the hyperconnectivity of
healthcare, that there are steps being done and resources
provided to hospitals to prepare and mitigate that is key,
while still trying to restore trust in consumers and how they
approach a particular hospital for healthcare.
Ms. Schrier. Thank you.
Dr. Dameff. That is key. That is really important.
Ms. Schrier. I have one last question for Mr. Reiner.
Now, I appreciate your comments about our country not
really being quite at the right place to be able to prohibit
payment of ransoms, even though that might slow or stop these
cyber attacks. So, for now, what can companies do, for example,
to have duplicate systems, a wall between them so that they
could recover afterwards, maybe without paying the ransom?
Mr. Reiner. So one of the pieces that we haven't really
discussed here today, outside of some of the elements of what
companies can be doing to prepare, is to actually--what we
discovered through our process is that a lot of companies
actually don't have a plan. They actually haven't vetted out,
at the executive level, what to do, whether or not to pay. And
they have companies that they can turn to that can help them
through that process, whether it is their insurance company, or
a forensics company, or some of the folks on the panel here
with me today.
But actually having that in place ahead of time, companies
do tabletop this. They do exercise against it, but not all of
them. And I think that is a resource that everyone should have
in hand, to have a checklist, to have an actual plan to help
make you make that decision if you do get hit.
Ms. Schrier. Thank you very much. I yield back.
Ms. DeGette. I thank the gentlelady. The Chair now
recognizes Mrs. Trahan for 5 minutes.
Mrs. Trahan. Well, thank you, Chairwoman DeGette, for this
important, certainly informative, and timely hearing.
The threat that hackers pose to businesses and institutions
is so real, and the increasing frequency and severity of the
attacks is deeply disturbing. You know, like so many of my
colleagues and the panelists testifying today, I am concerned
that cyber attacks are becoming especially commonplace within
critical public service sectors, ranging from healthcare to
education. In fact, a public university in my district was
recently hit by a cyber attack that shut down operations for a
week.
Ransomware has become one of the most attractive tools for
criminals because of how lucrative it can be, often without
much effort. And hackers find vulnerable caches of critical
data being stored by organizations like hospitals, schools, and
sometimes even local governments and then use ransomware to
effectively lock the organization out of their own data until
they agree to pay up.
Now, what has become clear is that improving our cyber
defenses is not enough to combat this threat. We need to, you
know, find ways to disrupt the ability of criminals to demand
and receive ransom payments without consequence.
The Internet has allowed for ransoms to be paid remotely
through digital gift cards and, of course, cryptocurrency such
as Bitcoin. So, Ms. Walden, could you just explain what it is
about cryptocurrencies that make them the chosen method of
payment for ransoms in this type of cyber crime?
Ms. Walden. Yes, and thank you for that question.
So cryptocurrency, the technology underlying
cryptocurrency, blockchain technology, allows for a transparent
payment system that is decentralized and distributed, and it
allows for, at the same time, pseudoanonymity. It is a
complicated word to say for me, but that essentially means
that, while you can track the transaction and you can see
exactly, you know, the hops of money from one wallet to
another, the on-ramps and the off-ramps, you can't necessarily
see the persons behind the transaction. You can't see the
person that owns the wallet.
So that is one thing that makes it attractive. The other is
that the transactional costs in the crypto economy are much
lower than in the traditional fiat economy. So central banking
systems are just more expensive.
Mrs. Trahan. Sure.
Ms. Walden. And then, finally, the third thing is that it
is difficult to trace--not impossible, but it is difficult to
trace. So--but it is--and it is borderless. So you can have
money move quickly and effectively across borders. There is no
central banking authority that sort of maps it out. And the use
of Bitcoin, in particular, is prevalent because it is the most
widely used currency, virtual currency. It is easy to get, it
is liquid----
Mrs. Trahan. Yes.
Ms. Walden. And victims can--can easily put that into the
system.
Mrs. Trahan. Yes. And you----
Ms. Walden. I hope that answered your question.
Mrs. Trahan. Yes, it definitely did, and it is great to
have that thorough answer on the record, because an oft-cited
rationale for the use of cryptocurrency is the lack of
visibility into parties conducting transactions and a lack of
clarity regarding government relations.
And so, Mr. Reiner, I am wondering, you know, if you could
answer this question. You know, cryptocurrency exchanges
operate in the United States. They are subject to certain
regulations. But, clearly, there are opportunities to expand
the applicability and/or enforcement of those regulations. And
if so, if you agree with that statement, you know, what
specifically do you recommend?
Mr. Reiner. I would agree with that, and thank you for the
question.
I think the task force, as it came together, recommended a
number of steps that could be taken to--and I think it is
important to note here that the task force's position on this
wasn't necessarily that cryptocurrency is the problem, right?
Cryptocurrency is something that I think can add value to--in a
number of different ways, but that, in this instance, it is
something that is being abused.
There are a number of steps that could be taken to pull
elements of the cryptocurrency ecosystem into existing
regulatory regimes, whether that is expanding the application
of know-your-customer rules, the anti-money-laundering rules
that are already available.
I think, to your--to the nature of your question, though,
something that is incredibly important here is some of this is
outside of U.S. jurisdiction, and so there--and we need to be
working very closely with international partners so that they
can be taking these steps with actors in their spaces to do the
same thing.
I think a number of the actors that we engaged with through
the Ransomware Task Force process made it very clear that that
is a conversation they want to be a part of, to positively
contribute in that direction. I think there is real opportunity
there.
Mrs. Trahan. Great. Well, thank you. I am out of time. I
will submit the rest of my questions for the record.
Thank you, Madam Chair.
Ms. DeGette. I thank the gentlelady. The Chair now
recognizes Mr. O'Halleran for 5 minutes.
Mr. O'Halleran. Thank you, Madam Chair and the ranking
member, for today's hearing.
You know, securing the infrastructure for America is
critical. We are all in agreement with that. I haven't seen
anything today that would tell me that we aren't. Issues like
Colonial Pipeline, how many more times do we have to see this
occur and not get serious about this? Year after year after
year, something comes up, where this becomes an issue. And now
it is a critical issue, in my mind, for--and I know the
doctors' minds--for the health and welfare of the people of
America.
Big companies have tons of cyberspace security, and even
they are attacked frequently. Should we hope and pray that we
won't be targeted, or should we do something about this?
In Arizona we are facing record heat and droughts every
year. I am concerned what would happen to vulnerable
populations, especially older Americans, if our power, water
utilities, and others went down. Our families could be left
without running water or power for days, weeks, who knows, as
new developments and technologies occur. I hope we can learn
from today that this has to be a priority for our businesses in
America and our government.
Ms. Walden, I am sure you agree that we need to do more to
disrupt ransomware. You said in your testimony that Microsoft
is working to make ransomware less profitable and more
difficult to employ. What does that mean? What are you doing?
Ms. Walden. Thank you for the question. As you aptly
pointed out, there is an imbalance, right, that allows
ransomware to proliferate: one, it is a highly profitable
crime; second, there is--there are few barriers to entry. I
could get into the crime of ransomware, and I haven't coded
since 1985. So it is just off balance.
And so our opportunity at Microsoft is to disrupt its
scale. And what does that mean? That means that we go after the
infrastructure. So we go after payment systems that support the
profitability, and we disrupt that. But we also make it harder
for our products and services to be used to proliferate
ransomware. And we make the entry of the criminal to--more
difficult, right?
So that means tearing down payment systems where we can, or
the ability for ransomware actors to receive payment. And that
means tearing down negotiation opportunities between the
ransomware criminal gang and the victim. That means disrupting
their ability to easily commit this crime. And that also means,
from a threat actor perspective, working closely with our law
enforcement partners to bring justice to these criminals that
propagate the crime.
Mr. O'Halleran. Thank you very much for that answer.
Mr. Carmakal, what type of information sharing is there
between private sector and the U.S. Government when it comes to
attacks on businesses?
And how do we recommend--or you recommend--we can improve
this?
It is obvious from today that there's a lot of areas where
information sharing does not go on. And I don't know how this
whole system works if we don't share that information. Mr.
Carmakal, please.
Mr. Carmakal. Yes, thank you, sir. I think there is an
opportunity for us to do a better job of sharing information
between victim organizations and the rest of the world. But
they need to do it in a way where they don't feel like they are
going to be penalized for having a data security incident.
There is a common trend of victims becoming a second victim
because of public shaming by other organizations, by the
general public when there is a cybersecurity incident. So we
need to create an opportunity and facilitate a way for victim
organizations to be able to share information about active
attacks, about compromises with some central governing body or
some agency that is able to disseminate that information in a
quick and actionable way.
A lot of times when we see threat actors operate, they
conduct intrusions at dozens of organizations at the same time.
And if we are able to take information from one victim
organization and share it with the community, it helps us
disrupt threat actors, helps us increase the cost of threat
actor operations, and I think that is one of the many ways in
which we could all take collective actions to curb this
problem.
Mr. O'Halleran. I thank you.
And Madam Chair, I just don't believe that we are going to
get the type of process moving forward that we truly need as a
nation without clearly identifying how we are going to
communicate with one another in this area, whatever privacy
laws have to be placed or whatever has to be done to allow
people to be able to talk to one another.
So with that, I yield.
Ms. DeGette. Thank you. I thank the gentleman.
The committee has a storied tradition of allowing members
of the full committee to question. And that is particularly
useful today because we have our resident technology expert
with us, Mr. McNerney. So I am pleased to recognize him for 5
minutes.
Mr. McNerney. Well, I thank the Chair for the hearing and
the witnesses for your testimony. I thank the Chair and the
ranking member for allowing me to waive on this morning--or
this afternoon now.
Cybersecurity defenses are primarily intended to safeguard
organizations' IT systems, but many critical sectors are
relying on OT systems such as SCADA systems and PLCs to operate
machinery or industrial controls.
OT system attacks are increasing in severity and frequency.
For instance, the case of Colonial Pipeline attack, the company
proactively shut down its OT systems in response to ransomware
attacks on its IT system. Mr. Lee, how serious and widespread
is the ransomware threat on OT systems?
Mr. Lee. Thank you for that question. It is significantly
more frequent than people would realize. There's, you know,
some weeks that we go where we might have five different
incident response cases on just OT systems that never go
public.
And so I think, you know, I agree with a lot of the
recommendations around removing the stigma around this. But
also, we have to make sure that there is value back to those
organizations. So there is a lot of desire of you must
communicate to the government. But if there is no value back to
those organizations in doing that, it is just not a top
priority.
Mr. McNerney. Well, is there any government support for
companies in dealing with live OT threats?
Mr. Lee. I think that, while there are many great Members
in the government and there is some expertise there, I would
say that the OT cybersecurity expertise is very much more in
the private sector than in government, and it is very nascent
in the government to be able to handle that.
I would say, from a policy position, we should probably
more proactively partner with those folks doing that work and
make sure that we remove those barriers to get things like
visibility in those systems. I think it was mentioned
previously that you almost benefit when you have ransomware by
the fact that you know it. There's a lot of these cases that
people just simply don't know that they are getting
compromised.
Mr. McNerney. Thank you.
Mr. Carmakal, over the years in your career you have helped
organizations across the globe respond to some of the most
catastrophic cybersecurity attacks and insurance instances.
Based on your experience, what risks will ransomware attacks on
OT systems pose?
And how can the potential victim organizations best protect
themselves?
Mr. Carmakal. Yes, and thank you for the question, sir.
Ransomware attacks against operational technology systems have
the potential to be incredibly devastating. We had the
potential to see true kinetic responses and impacts that
everyday people may be able to observe. And so there is
certainly a risk and a threat there.
Generally speaking, a lot of organizations, they struggle
to think about security from an operational technology
perspective. Part of that challenge is with governance. A lot
of times the person that is responsible for cybersecurity
doesn't always have the governance and authority to be able to
apply cybersecurity protocols and policies on operational
technology environments. A lot of times it is the business
owner or the asset owner that is responsible for cybersecurity.
And a lot of times those asset owners don't actually have
cybersecurity experience. And so there's some fundamental
challenges that are out there.
I think we need to continue to focus on operational
technology security. There is a lot of potential real-world
impact that can occur there. And I think it is a natural
evolution of the threat that we are seeing today.
Mr. McNerney. Thank you.
And Mr. Lee, what role can the public-private partnerships
that the administration announced in April play in shoring up
some of these vulnerabilities in OT systems?
Mr. Lee. Yes, the very first thing is partnership with the
sector, but more specifically in actually understanding what
the sectors need.
A great example: There was many things recommended here
today about patching and phishing, you know, training and
similar, that are absolutely appropriate in the enterprise, and
they would make a top-10 list in operations technology
security. There's a lot of enterprise security people that come
into operations environments thinking that the playbook that
they run in IT is what they should do in OT. And there have
been more power outages in the United States to people patching
systems than Russia, China, and Iran combined.
So when we look at OT, we need to make sure that the
government partners understand: How do you operate a gas plant
different than a nuclear power plant? What do you need to see
in these standards, other than just what we think best
practices are from a higher level?
Mr. McNerney. Thank you.
Mr. Reiner, thank you for the recommendations from the IST.
The discussion today has been entirely focused on attacks on
institutions. I am a little curious about attacks on
individuals. Are those attacks continuing to escalate, as they
are?
Is there any resource in the government for people that
need help in that situation?
Mr. Reiner, you want to answer that?
Mr. Reiner. I think the preponderance of--I mean, this is a
profit-driven enterprise, and so the attackers are looking for
those--they do their research, they do their analysis to find
those that are not only the most vulnerable but are going to be
the most lucrative. And I don't really think that they
necessarily discriminate, per se.
I personally am not as familiar with attacks that are
targeted against individuals, as much as they are against
organizations, which has the large attack surface that can be
taken advantage of, et cetera, and that has the resources,
actually, to pay these ransoms that these criminals are really
looking for.
Mr. McNerney. OK, thank you. I yield back.
Ms. DeGette. I thank the gentleman, and I really want to
thank again all of our witnesses for participating in today's
hearing. It was a really excellent--both the ranking member and
I agreed, it was an excellent panel, gave us a lot of good
information. And we will be following up with all of you on
your recommendations.
I want to remind Members that, pursuant to committee rules,
they have 10 business days to submit their additional questions
for the record to be answered by the witnesses who have
appeared. And I would ask the witnesses to please agree to
respond promptly to any of those questions that you might
receive, because they will be very helpful to us in developing
further legislation and approaches.
Also, the ranking member and I would like to insert into
the record by unanimous consent a report on cybersecurity by
the E&C Republican staff dated December 7, 2018.
And without objection, it is ordered.
[The information appears at the conclusion of the hearing.]
Ms. DeGette. And with that, the subcommittee is adjourned.
[Whereupon, at 1:11 p.m., the subcommittee was adjourned.]
[Material submitted for inclusion in the record follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
[all]