[Senate Hearing 117-842]
[From the U.S. Government Publishing Office]
S. Hrg. 117-842
ENHANCING DATA SECURITY
=======================================================================
HEARING
before the
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
__________
OCTOBER 6, 2021
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available online: http://www.govinfo.gov
______
U.S. GOVERNMENT PUBLISHING OFFICE
54-871 PDF WASHINGTON : 2024
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
MARIA CANTWELL, Washington, Chair
AMY KLOBUCHAR, Minnesota ROGER WICKER, Mississippi, Ranking
RICHARD BLUMENTHAL, Connecticut JOHN THUNE, South Dakota
BRIAN SCHATZ, Hawaii ROY BLUNT, Missouri
EDWARD MARKEY, Massachusetts TED CRUZ, Texas
GARY PETERS, Michigan DEB FISCHER, Nebraska
TAMMY BALDWIN, Wisconsin JERRY MORAN, Kansas
TAMMY DUCKWORTH, Illinois DAN SULLIVAN, Alaska
JON TESTER, Montana MARSHA BLACKBURN, Tennessee
KYRSTEN SINEMA, Arizona TODD YOUNG, Indiana
JACKY ROSEN, Nevada MIKE LEE, Utah
BEN RAY LUJAN, New Mexico RON JOHNSON, Wisconsin
JOHN HICKENLOOPER, Colorado SHELLEY MOORE CAPITO, West
RAPHAEL WARNOCK, Georgia Virginia
RICK SCOTT, Florida
CYNTHIA LUMMIS, Wyoming
Melissa Porter, Deputy Staff Director
George Greenwell, Policy Coordinator and Security Manager
John Keast, Republican Staff Director
Crystal Tully, Republican Deputy Staff Director
Steven Wall, General Counsel
C O N T E N T S
----------
Page
Hearing held on October 6, 2021.................................. 1
Statement of Senator Cantwell.................................... 1
Statement of Senator Wicker...................................... 3
Statement of Senator Baldwin..................................... 49
Statement of Senator Blunt....................................... 50
Statement of Senator Tester...................................... 52
Statement of Senator Fischer..................................... 54
Statement of Senator Klobuchar................................... 55
Statement of Senator Cruz........................................ 57
Statement of Senator Hickenlooper................................ 59
Statement of Senator Blackburn................................... 61
Statement of Senator Blumenthal.................................. 62
Statement of Senator Moran....................................... 64
Statement of Senator Markey...................................... 66
Statement of Senator Scott....................................... 68
Statement of Senator Rosen....................................... 69
Statement of Senator Peters...................................... 72
Witnesses
James E. Lee, Chief Operating Officer, Identity Theft Resource
Center......................................................... 5
Prepared statement........................................... 6
Jessica L. Rich, Of Counsel, Kelley Drye & Warren; Distinguished
Fellow, Georgetown Institute for Technology Law and Policy..... 31
Prepared statement........................................... 32
Edward W. Felten, Robert E. Kahn Professor of Computer Science
and Public Affairs, Princeton University; Former Chief
Technologist, Federal Trade Commission......................... 35
Prepared statement........................................... 36
Kate Tummarello, Executive Director, Engine...................... 41
Prepared statement........................................... 43
Appendix
Response to written questions submitted to James E. Lee by:
Hon. Amy Klobuchar........................................... 77
Hon. Kyrsten Sinema.......................................... 77
Hon. Raphael Warnock......................................... 79
Hon. Roger Wicker............................................ 80
Hon. John Thune.............................................. 84
Response to written questions submitted to Jessica L. Rich by:
Hon. Amy Klobuchar........................................... 85
Hon. Roger Wicker............................................ 85
Hon. John Thune.............................................. 86
Response to written questions submitted to Edward W. Felten by:
Hon. Amy Klobuchar........................................... 86
Response to written questions submitted to Kate Tummarello by:
Hon. Kyrsten Sinema.......................................... 87
Hon. Raphael Warnock......................................... 88
Hon. Roger Wicker............................................ 95
Hon. John Thune.............................................. 96
ENHANCING DATA SECURITY
----------
WEDNESDAY, OCTOBER 6, 2021
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 10:05 a.m., in
room SR-253, Russell Senate Office Building, Hon. Maria
Cantwell, Chair of the Committee, presiding.
Present: Senators Cantwell [presiding], Klobuchar,
Blumenthal, Markey, Peters, Baldwin, Tester, Rosen,
Hickenlooper, Warnock, Wicker, Thune, Blunt, Cruz, Fischer,
Moran, Blackburn, Young, and Johnson.
OPENING STATEMENT OF HON. MARIA CANTWELL,
U.S. SENATOR FROM WASHINGTON
The Chair. The Committee on Commerce, Science, and
Transportation will come to order. Today, we are having a
hearing on enhancing data security. And this is the second in a
series of hearings that we are having on the importance of good
Federal standards for both privacy and data security.
Our first hearing focused on the empowerment of the FTC
with new resources and the Data Privacy Bureau that is being
considered as part of our reconciliation negotiations, as well
as hearing from the witnesses what we should be doing to
enhance further data privacy. Today, we want to focus on data
security and the fact that we are seeing record levels of
breaching and intrusions on the privacy of American
individuals.
Our hearing today, we will hear from a great list of
witnesses that I will mention and will formally introduce in a
few minutes. The data systems that we rely on today are very
vulnerable. We are experiencing increasing rates of data
breaches and now seeing sophisticated actors impacting hundreds
of millions of American consumers. I think that we are going to
hear from Mr. Lee's report that 2021 will again set a record
year for the number of data breaches and concerns to consumers
in the United States. What is troubling about that is that
every year we are breaking records.
What is troubling is that these breaches are now more
sophisticated and that we don't have the adequate security to
help stop them. Earlier this year, a hacker took Colonial
Pipeline offline, causing fuel shortages across the East Coast.
Ransomware attacks on hospitals have put patients? lives at
risk. We heard yesterday about Facebook going offline globally
due to faulty configuration, and there is word out this morning
that Amazon may be facing its own situation today. So part of
the problem is that we live in a more connected world, and what
we know now is that when there is a data breach, that consumers
are the ones that pay the heavy price.
We do not have enough on the books and a Federal standard
to make sure that companies are more accountable to these
breaches. Senator Wicker and I both introduced legislation
trying to set a Federal data security standard in the United
States. We agree that we need to monitor these systems for
threats and vulnerabilities, patch their system softwares when
they needed updates, make individuals who serve as data privacy
officers to be more efficient in their oversight, and we agree
that the Federal Trade Commission should enforce these
standards along with Attorney Generals.
We believe that these companies don't invest enough for the
fact that they have oversight to our precious data and
information, so we need to act. Massive amounts of personal
data are collected from Americans every day as they go online
to connect with family, pay bills, work, obtain medical
information, send their kids to school. And yesterday was an
example of the data that was being collected on children and
the offense that we all took to that information and data. Data
is collected on Americans, whether they like it or not. And we
all know stories of data brokers and the breaches behind the
scenes where data was collected without anybody's actual
acquiescence to that.
So today, Mr. Lee, who is with the Identity Theft Research
Center, a nonprofit organization dedicated to helping identity
theft victims, will be testifying. And according to the ITRC's
third quarter 2021 breach analysis report, we will again see a
record year of breaches in the United States and that these
tactics are putting people in greater risk. That is very
concerning to me in the State of Washington, where in 2020 we
saw seven times the rate of identity theft complaints to the
FTC over 2019.
So this means that 2021 is going to continue to have an
even larger number. Hackers are specifically targeting data
like login, the passwords, and often re-use them across
multiple accounts, unlock access to accounts, and cybercrime is
lucrative, and the data breaches that we are seeing, not only
as I said compromise our data, but are now a big business of
cyber and ransomware attacks. The number of reported data
breaches in the first 9 months of 2021 exceeded last year's 12
month by 17 percent. So the numbers keep rising and we are on
to another record breaking year.
About 160 million individuals had their data compromised
from July of this year to September 21. There have been more
ransomware attacks in the first 9 months of 2021 than in both
2019 and 2020. And the number of cyber-attacks so far this year
has already surpassed the total number of all data compromises
in the year of 2020. So these intrusions take a real toll on
people. Last year, the State of Washington was swept with an
insurance fraud as it related to unemployment benefits.
Later in the year, the Washington State Auditor's Office,
which had been receiving unemployment fraud claim, had its data
compromised due to that vulnerability in the legacy system that
was provided by a third party, Accellion. Accellion's systems
were breached throughout the country, and we still don't know
the extent of that breach. But in Washington, the personal
information of 1.6 million residents was stolen. So we know
that the identity theft can have a devastating impact on
individuals who can't obtain unemployment benefits because a
criminal has already applied for them. 40 percent of these
victims were not able to pay their bills. 14 were evicted for
not paying rent. 33 percent did not have enough money for food
and utilities. 13 percent were not able to get a job.
So while most identity theft victims lose less than $500,
21 percent of these victims report losing more than $20,000.
And these are a lot of people growing every year in numbers. So
we need to act to inform better national standard for data
security, to protect Americans' personal data and privacy so
they are less at risk. That is why we introduced the Consumer
Online Privacy Act, COPA, last Congress, along with my
colleagues here on the Committee, Senators Schatz, Klobuchar,
and Markey, and to continue to grow and strengthen our Federal
statutes so we can address these issues.
So we look forward to hearing from the witnesses today
about those particulars on how we strengthen these standards,
what we need to do to protect whistleblowers, what we need to
do to report data security and privacy problems, and what we
can do to better protect the public. We know that a stronger
FTC will help, but we need to give the FTC the resources that
they need to do their job. So I again will introduce the
witnesses in a few moments, but I think we have a very
distinguished panel here to hear from on these important
issues.
So now I will turn to the Ranking Member for his opening
statement.
STATEMENT OF HON. ROGER WICKER,
U.S. SENATOR FROM MISSISSIPPI
Senator Wicker. Thank you, Senator Cantwell. Appreciate it
very much. Good morning to our witnesses. Each year, Americans
benefit from a growing supply of digital products that make
life better. At the same time, they also collect, share, and
sell our personal data.
Although this data could provide meaningful insights about
consumer preferences, it has become a target for bad actors
seeking to exploit people's data for nefarious purposes.
According to reports, data breaches have gone up by 38 percent
this year alone. These include phishing attacks, ransomware
attacks, supply chain attacks and more. The average cost of a
data breach in the United States is roughly $8 million. But the
cost for the broader public is hard to measure. Data breaches
can bring long-term damage to reputations, personal finances,
and even to physical safety.
When Congress passed the FTC Act in 1914, the Federal Trade
Commission was given the task of protecting consumers from
deceptive and unfair commercial practices. The Commission has
rightly used this authority to curb business practices that put
consumers' personal information at risk. This required
companies to adopt stronger protections for consumer data and
in some instances implement safeguards such as employee
training, maintaining access controls, and monitoring systems
for data security incidents. The FTC also continues to inform
the private sector on best practices to prevent security
breaches. Importantly, the FTC's long standing approach to data
security has been based on reasonableness. With cyber threats
constantly evolving and growing more complex, there is no
single or perfect solution to the problem.
The FTC needs the flexibility to adjust to constantly
shifting cyber threats. Under the Obama Administration, the
Commission asserted this standard of reasonableness in a
bipartisan statement. I am going to quote what the Commission
said, ``a company's data security measures must be reasonable
and appropriate in light of the sensitivity and volume of
consumer information it holds, the size and complexity of its
business, and the cost of available tools to improve security
and reduce vulnerabilities. There is no one-size-fits-all data
security program. The mere fact that a breach occurred does not
mean that a company violated the law.''
Although this remains true today, there is certainly more
that Congress can and should do to make consumer data safer and
protect Americans from cybercrime. In July, Senator Blackburn
and I introduced the Safe Data Act, which would give the FTC
more tools and authorities to improve data security practices
in the marketplace and deter cyber criminals. Our legislation
would require covered entities to minimize the amount of
personal consumer data they collect and retain. Would require
businesses to maintain certain internal controls to reduce
risks to data. It would give the FTC targeted rulemaking
authority to ensure companies can identify security
vulnerabilities. It would expand the FTC's jurisdiction over
common carriers and nonprofits and to make sure companies
follow the law. Our bill would allow the FTC to impose civil
penalties for first time offenses. Many of these ideas
represent areas of bipartisan common ground among members of
this committee.
Today's hearing is an opportunity to discuss these and
other steps and improve data security through bipartisan
Federal privacy legislation. As I said last week, Americans
deserve to have their data protected. Now is the time for
Congress to act to pass legislation that protects the American
people's privacy and personal information. Thank you, Senator
Cantwell.
The Chair. Thank you, Senator Wicker. And again, welcome to
the witnesses. We are joined by Mr. James Lee, who is Chief
Operating Officer of Identity Theft Resource Center, a
nonprofit organization dedicated to helping identify identity
theft victims and analysis reports that are so helpful. In
fact, I think we have--part of your record is a pretty healthy
report on this year's data. We would also like to welcome Ms.
Jessica Rich, who is currently counsel at Kelly Drye, former
Bureau of Consumer Protection at the Federal Trade Commission,
where you had experiencing a vast number of roles of the FTC,
including the agency's Bureau of Consumer Protection Director,
where you oversaw actions against companies who failed to
uphold their promise to consumers.
So, thank you for being here. In addition, we have Ed
Felten, who is the Robert E. Kahn Professor of Computer Science
and Public Affairs at Princeton and former Chief Technology--
Technologist, I think that was the title at the Federal Trade
Commission. So we look forward to hearing your comments as it
relates to your time there and now and understanding the
marketplace.
And finally, Ms. Kate Tummarello, is that right?
Tummarello, who is Executive Director of Engine, a nonprofit
startup advocacy group, to discuss the importance of data
security and the ecosystem. So, welcome to all of you. Thank
you for being here. We will start with you, Mr. Lee.
STATEMENT OF JAMES E. LEE, CHIEF OPERATING OFFICER, IDENTITY
THEFT RESOURCE CENTER
Mr. Lee. Good morning, Chair Cantwell, Ranking Member
Wicker, the rest of the Committee. Thank you for the honor of
speaking with you today. My name is James Lee. I am the Chief
Operating Officer of the nonprofit Identity Theft Resource
Center. We are based in San Diego, California. The chair was
very kind to share a lot of our data for this morning that we
just released in our Q3 data breach report. So I am not going
to talk about those numbers as much as I am now going to talk
about the impacts, but I will say that we are now, as of today,
only 238 data breaches away from an all-time high. And we had
446 data breaches in this quarter.
So, you do the basic math. We are in for raising the bar
substantially. Let's discuss the real world example of what I
am talking about, which is poor cybersecurity leads to data
breaches which leads to identity crimes. That is the value
chain we are talking about. And let us talk specifically about
the identity related unemployment fraud. The ITRC advisors
first realized there was a problem last year when we started
getting calls from Seattle. Now we don't get a lot of calls
about unemployment fraud. Shortly after the Federal
unemployment subsidies went into effect, we started to receive
one call a day. That then became a couple of calls a day.
And very quickly it became where we had more contacts in 1
month than we had seen from all 50 states in 2 years. It was a
rapidly increasing problem. In 2019, we logged 14 cases of
identity related unemployment fraud, from March 2020 through
last week. The ITRC has logged 2,112 cases of unemployment
identity fraud in all 50 states and the District of Columbia,
and it continues today. Behind all those numbers, though, are
people, they are victims. And the victims in this case fall
into two cases, people who are still employed, but whose
information was misused to apply for benefits they did not
need. They were largely inconvenienced. But they are still at
risk, increased risk of future crimes because their data is in
the hands of criminals.
But for the victims who are denied benefits, these cyber
criminals got the money first. And our research shows, as the
Chair noted, 40 percent were unable to pay their bills, 14
percent were evicted, 33 percent could not pay for food. As of
April this year, we found that 69 percent of the victims denied
benefits last year still had not resolved the issues as of this
year. All of these issues are directly linked to identity
criminals misusing stolen personal information, largely from
data breaches, often directly linked to poor cybersecurity
practices, procedures, and execution.
Which begs a very simple question with a very complex
answer, what do we do? In the ITRC's view, the status quo is
broken. We believe policymakers and industry leaders need to
work together to focus on three key areas, which I am now going
to talk about. We need better cybersecurity standards and
practices. For example, cyber-attacks against known but
unpatched software flaws that come from data breaches, they
lead to data breaches, result--those results are largely
preventable. You can prevent those kinds of cyber-attacks.
Another highly effective tool, don't collect the information if
you don't need it. And if you are through with it, get rid of
it. You cannot breach what you do not have. A very simple
concept.
But without enforceable minimum standards, there are no
broad incentives beyond trying to avoid headlines or post
breach litigation that get people to actually make the broad
organizational changes that are often needed. We need better
enforcement. We believe victims are best served when there are
options for redress. In today's environment, where some states
are more aggressive in protecting their citizens than others,
the result is often disparate victim support for the same
crime, but what you are able to get accomplished for the victim
varies by where you actually are.
Technology moves faster than Government, so state and local
jurisdictions need the ability to be responsive to new threats
and technologies while maintaining a minimum base of strong
security and privacy. And we believe our partners at the FTC
are best equipped to be that enforcement agency. Finally, our
victim notification system is wholly inadequate. The first U.S.
data breach law was proposed in 2003 by a certain Senator from
Washington. California lawmakers took that and actually passed
a data breach law that same year. Since then, the average
number of data breaches reported in the United States has grown
to about five a day.
The average number of data breaches reported in the
European Union is 331 a day. Couple that with the estimated 15
billion stolen logins and passwords available for sale in the
digital marketplaces at any given time, and it is pretty
obvious that data breaches are underreported in the United
States. In our view, today's hearing is ultimately about how we
reduce the number of identity crime victims. Yet, there is a
separate conversation we also need to have about how we support
people when they are victimized.
That victim support system we have today is just as
inadequate as our cyber security standards, our enforcement
structure, and our system of victim notification. The ITRC
would love to talk to you about that too sometime. Thank you
for your time and attention, and I look forward to answering
any questions you may have.
[The prepared statement of Mr. Lee follows:]
Prepared Statement of James Everett Lee, Chief Operating Officer,
Identity Theft Resource Center
Introduction
Good morning, Chair Cantwell, Ranking Member Wicker and members of
the Committee. Thank you for the honor of speaking with you today. My
name is James Everett Lee and I am the Chief Operating Officer of the
non-profit Identity Theft Resource Center (ITRC) based in San Diego,
California.
For the past 21 years, the ITRC has offered free assistance to
victims of identity crimes. Through our contact center staffed by
trauma-informed advisors, about 11,000 times per year we directly help
victims recover their identities that have been stolen or otherwise
compromised and we help consumers who want to prepare for the day when
their personal information is acquired or misused by identity
criminals.
Through our website and outreach programs, we help educate an
additional one million people around the world who hold U.S. identity
credentials, including military personnel, on how to protect their
identity information. We also provide information about the latest
scams that involve the theft or misuse of personal information.
Since 2005 the ITRC has compiled the largest repository of publicly
noticed data breaches and other forms of identity data compromises.
What started as a handful of data points 16 years ago with a single
company notice has grown into a database of more than 13,000 data
breaches with as many as 90 data points per event that is updated
daily.
We also publish an annual data breach report and quarterly updates
that analyzes the trends reflected in the data breach notices mandated
by state law and Federal regulations. In fact, earlier today, we
published our Q3 Data Breach Analysis which shows we have already
surpassed the total number of U.S. data compromises reported in full-
year 2020. We are only 238 data compromises from tying the all-time
record set in 2017. You'll find the full report as an attachment to my
written testimony. Exhibit A: Q3 2021 ITRC Data Breach Analysis_October
6, 2021
I would like to briefly mention two additional reports that we
publish. First, our Consumer Aftermath Report is the only comprehensive
study on the total impact of identity crimes on consumers. I will
reference our most recent findings report later in my remarks and the
full report is attached as an exhibit. Exhibit B: 2021 Consumer
Aftermath Report, May 2021
Later this month, which coincidently is Cybersecurity Awareness
Month, we will publish our first report on the impacts of security and
data breaches on small businesses and solopreneurs including gig
workers. Our Business Aftermath Report is the first independent
research of its kind that is based on information taken directly from
small business owners and leaders.
Finally, as a non-profit, the ITRC is funded primarily through
grants from the Department of Justice, Office of Victims of Crime as
well as private contributions and corporate sponsorships. We work
closely with key Federal agencies on issues that involve identity crime
victims including the Federal Trade Commission (FTC), the Internal
Revenue Service's Security Summit, the Pandemic Response Accountability
Committee (PRAC), the Department of Homeland Security (DHS), and
numerous state and local law enforcement agencies. For example, the FTC
has referred more than 20,000 victims of the most complex identity
theft cases to us to provide the specialized support many ID crime
victims require that government agencies and large for-profit companies
are not equipped to address.
The connection between cybersecurity, data breaches, and identity
crimes
Our job, every day, is to talk with victims of identity crimes. The
information I'm going to share with you today is largely based on what
we learn from people directly impacted by these crimes. These
interactions also influence our advice to the Committee today.
When the ITRC was born two decades ago, the primary source of
identity crimes was physical--stolen mail, a lost laptop, dumpster
diving, shoulder surfing, a file folder left on a desk, or a filing
cabinet left unlocked. The criminal was likely someone you knew or
shared a connection.
Even when California passed the first data breach notice law, the
first nationwide data breach notice didn't involve a cyberattack--it
was the result of organized criminals setting up a legitimate-looking
insurance business for the purpose of ordering paper copies of credit
reports from a data broker. My how things have changed.
Today, the primary source of data compromises involving personal
information is related to cyberattacks launched by professional
criminals outside the U.S. or by Nation/States. Of the 1,291 publicly
reported data compromises so far in 2021, 1,111 are the result of a
cyberattack. The number of ransomware-related data compromises reported
so far in 2021 exceed the number of similar events in 2020 & 2019
combined. It should be noted that the 1,111 cyberattack-related data
events reported so far this year is more than all data compromises in
full-year 2020.
The chart below from the Q3 Data Breach Analysis shows the various
ways data compromises occur and the most common attack vectors used by
cybercriminals. Far and away phishing and related attacks followed by
ransomware are the most common forms of cyberattacks that lead to data
compromises.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
What has also changed over time is the type of data identity
thieves want and how they acquire it. The last time we set an all-time
high for data breaches in 2017, identity thieves wanted to Hoover up as
much data as possible from as many sources as they could find.
Today, we see highly organized cybercriminals launching highly
sophisticated attacks using automated tools. Data quantity is no longer
the goal of an attack; data quality is. With the right information--
primarily logins and passwords--cyberthieves do not need to engage in
time consuming and risky attacks that exploit known, but unpatched
software bugs. Using automated tools and data stolen in breaches, they
can walk in the front door and have access to everything they need to
extort an organization or take over the account of an individual.
As a result of this shift, we see more cyberattacks that impact
fewer individuals in mass attacks. Make no mistake, though, individuals
are still at-risk today.
We are moving from an era of identity theft where data is acquired
and accumulated to a time of identity fraud where ID thieves monetize
the data they've collected--with the occasional effort to refresh older
information. The chart below shows the shift in terms of the number of
data breach victims dating back to 2015.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Connecting the Dots
To connect the dots using a real-world example, let's discuss the
dramatic rise in identity-related unemployment benefits fraud during
the COVID-19 pandemic. Public and private sector estimates of the
financial impacts vary from just short of $100B to nearly $400B in
stolen benefits. The victims fall into two categories: those who needed
benefits and were denied because a cybercriminal applied for the
benefits first; and those who didn't lose their job, but someone
applied for and received benefits in their name.
At the ITRC, we first noticed there was something unusual occurring
when we began to receive phone calls from Washington State. In normal
times, the ITRC receives fewer than 20 inquiries per year about
identity-related unemployment fraud. Shortly after the Federal
unemployment subsidies went into effect, we began to see a call a day
from the Seattle area. That soon increased to several a day, before
leaping to more contacts in one month than we had seen from all 50
states in the previous two years. Exhibit C: Spreadsheet of 2020-21
ITRC Victim Stats by State
In early 2020 Washington State had a robust unemployment benefits
program and had recently upgraded its technology to a state-of-the-art
system that allowed taxpayers to register for a single account to
access all State services. The system included a credential
verification process that relied on readily available information about
a person--information that was available for sale in identity
marketplaces along with known logins and passwords. It was very easy
for cybercriminals to use stolen information to create a new State
benefits account or redirect an existing account using data breach-
fueled information.
The volume of applications overwhelmed the state teams responsible
for auditing the applications for fraud, eventually leading to the
decision to switch from identity verification before paying benefits to
auditing for fraud after-the-fact. After one month, Washington state
change their model and reports of fraudulent unemployment claims
dropped dramatically, but not before more than $500M in fraud was
identified in Washington State alone.
Since April 2020 through today, 98 Washington residents have sought
the assistance of the ITRC to help them recover from government benefit
related fraud. I've attached to these remarks a state-by-state breakout
of residents who turned to the ITRC for assistance since 2019.
Soon, this scenario played-out in every state to one degree or
another. Ironically, the states with technology dating back to the
1960s faired the best. And at least one state that upgraded mid-
pandemic saw their cyber-related fraud increase AFTER they implemented
a state-of-the-art system. From March 2020 to the end of September
2021, we logged 2,112 cases of unemployment identity fraud in all 50
states and the District of Columbia.
Behind all these numbers, though, are victims. Real people who
were--and in some cases still are--suffering.
The ITRC's Consumer Aftermath Report from May of this year
illustrates the impacts of this fraud on two distinct groups. However,
as you will see, the impacts are not proportionate.
Victims whose identities were used to apply for benefits they
didn't need were largely only inconvenienced. They are still at risk of
future attacks, however, because their information has been compromised
and is in the hands of known criminals who can use that information at
any time.
Of course, they may not have known their identities were being
misused until a debit card arrived in the mail loaded with unemployment
benefits. Often-times the letter was followed by a call from someone
claiming to be a representative of the State or issuing bank saying
there had been a mistake and to send the card to a ``special'' address.
Or a victim or mail carrier would find someone trying to collect
mail from their mailbox. In some incidents reported to the ITRC, as
many as 50 debit cards per day would arrive by mail--each addressed to
a different person. Others didn't learn their identities had been
compromised until they received a 1099 form saying they owed taxes on
benefits they did request or receive.
For the victims who needed those benefits but were denied the
resources they were due, the impacts could be devastating. In following
up directly with victims, we learned that:
40 percent were unable to pay their routine bills
14 percent were evicted for non-payment of rent or mortgage
33 percent did not have enough money to buy food or pay for
utilities
13 percent were unable to get a temp or permanent job as a
result of identity misuse
As of April 2021 when this survey of victims was conducted:
69 percent of victims denied benefits said their issues were
still unresolved from 2020
75 percent of victims whose identities were used to apply
for PPP loans had unresolved issues
82 percent of people who were the victims of benefits scams
where they unknowingly paid a criminal to expedite their
benefit payments had not resolved the issues from 2020.
And, the fraud continues to this day. A local television station
here in Washington, DC reports that one local Virginia business
continues to receive requests to verify unemployment claims--none of
which are for actual employees of the company. In 2020 we opened 802
unemployment ID fraud cases. To date in 2021, the count stands at
1,296. In 2019, the count was 14.
All of these issues are directly linked to identity thieves
stealing personal information. While it's not possible to always draw a
direct line to a specific data breach, the broad-based attacks that
impacted every state utilized data available in illicit identity
marketplaces. Information placed there as a result of an organizational
failure to prevent unauthorized access to consumer information, most
often because of poor cybersecurity practices, procedures, or
execution.
All of this begs a simple question with a complex answer: What can,
and should, we do?
In the ITRC's view, all potential solutions begin from the same
place: The status quo is broken. From there, we believe policymakers
and industry leaders need to focus on three key areas to achieve the
ultimate goal of any public policy: Protect our citizens and protect
the homeland. Specifically, we recommend intense focus on three areas:
We need better cybersecurity standards and practices.
The cyberattacks against known, but unpatched flaws and the data
breaches that result from them are largely preventable.
NIST has set a record each year since 2016 for the number of known
software flaws that are assigned a risk rating in the National
Vulnerability Database. We will set another record this year, too, most
likely in excess of 19,000 known software bugs. There have already been
33 Zero Day attacks--cyberattacks exploiting a previously unknown
software flaw--in calendar year 2021. That's 11 more than 2020.
Meanwhile, the average time to patch a known software bug in
enterprise software or web applications is measured in months or years
depending on the sector--while attackers can exploit a new flaw in a
matter of hours or minutes. Without enforceable minimum standards,
there is no incentive beyond headline avoidance and fear of post-breach
litigation to motivate most organizations. The ``it's cheaper to pay
the fine'' mentality is alive and well when it comes to cybersecurity.
There is an even more basic step that can be highly effective at
keeping personal information out of the hands of criminals: don't
collect the information in the first place. You cannot breach what you
do not have. Americans have made it pretty clear when given a choice
about opting in or out of data collection or sharing, most people will
say ``no thanks.'' An estimated six percent (6 percent) of U.S. iPhone
users opted-in to data tracking when given the opportunity to choose
earlier this year. That's six percent of an estimated 116M people in
the U.S.
We need better enforcement.
Victims deserve better enforcement mechanisms and we believe
victims are best served when there are options for redress. Clearly,
the sticking points here in Washington and the states that have
considered their own privacy & security laws are the issues of private
right of action and Federal pre-emption. When regulators have the tools
they need to fully enforce strong laws, everyone wins. However, in the
environment where we operate today, some states are more aggressive in
protecting their citizens than others, resulting in disparate impacts
for the same crime based on where you live. Victims and businesses
alike are well served when everyone knows the rules and faces the same
consequences. And just like in other areas of public policy, a system
where the government and the aggrieved share the ability to seek
redress provides the options that helps everyone.
The current California privacy law--the CCPA--is an example of that
shared authority. Only the California Attorney General may take an
enforcement action under most provisions of the law--the exception
being if a data breach is caused by a failure to provide adequate cyber
security. Then the law sets a procedure by which an individual can seek
a statutorily set level of damages. This limited right of action is
included in the new privacy law overwhelming approved by voters in 2020
that will take effect in 2023. The new CPRA also allows a slightly
expanded private right of action if an e-mail address and password are
compromised in a data breach.
As for Federal pre-emption, again we believe victims are best
served by options. While we need minimum standards, technology moves
faster than government. Giving state and local jurisdictions the
ability to be responsive to new threats and technologies while
maintaining a base of strong security and privacy is the kind of
flexibility we believe helps victims and organizations, too.
Lastly on this point, our partners at the FTC are best equipped to
be the enforcement agency for enhanced privacy and protection
standards--if they are given the proper tools, mechanisms, and
Congressional mandate.
Our victim notification system is wholly inadequate.
Please understand that what I'm about to say is not a rousing
endorsement of the European Union's General Data Protection Regulation
(GDPR). But, one area where the GDPR seems to be working is the breach
notification system wherein organizations are required to provide
notice to regulators and, ultimately, citizens if appropriate.
Why do I say this is a model worthy of exploration? The concept of
a U.S. data breach notice law was first proposed in 2003 by a certain
senator from Washington. Congress did not adopt the law, but California
lawmakers took notice and passed the world's first data breach notice
law that same year. It became effective in 2004. In 2005, ``data
breach'' entered the popular lexicon for the first time when a company
where I was an executive issued the first nationwide breach notice
under the theory that data doesn't respect dotted lines on a map. .
.and with a little friendly persuasion from Sens. Markey and Blumenthal
in their previous roles.
By the way, that breach was quaint by today's standards--156,000
potential victims, as Ms. Rich may remember--and would not even meet
the threshold for issuing a data breach in some states today. Over the
next 13 years, 90 other countries adopted data breach laws before the
final two states required breach notifications in the wake of the
Equifax compromise in late 2017.
I already mentioned that the ITRC database reflects some 13,000+
data breach notices accumulated over 16 years. The current average
number of breaches reported in the U.S. is about 5 per day. The average
number of data breaches reported in the EU under the GDPR is 331 per
day as of January 2021. Couple that with the estimated 15B stolen
logins and passwords available for sale in identity marketplaces and
it's obvious the number of U.S. data breaches are being under reported.
When they are reported, the notices are largely meaningless with
little transparency or actionable information. A recent study by the
University of Michigan and a second by Carnegie Melon University both
show that we simply are not equipping victims with enough information
about what happened and how to protect themselves. The vast majority of
breach victims simply do nothing.
The Michigan study concluded that even after receiving a breach
notice, most people in the study did not know their information had
been compromised at least three times. The Carnegie Melon study showed
that most people who receive a data breach notice do not take even the
basic step of changing the password on a compromised account; and if
they do, it's generally months after receiving the breach notice and
the replacement password is weaker than the original.
Mandatory reporting with strong penalties for failing to comply
with both the required form and substance of a notice along with a bias
toward more transparency will make a difference in terms of equipping
victims with the knowledge needed to protect themselves and their loved
ones from future data compromises.
Conclusion
In our view, today's hearing is ultimately about how we reduce the
number of identity crime victims. Yet, there is a separate conversation
needed about how we support people when they are victimized. The victim
support system we have today is just as inadequate as our cybersecurity
standards, our enforcement structure, and our system of victim
notification. The ITRC would love to engage with you on this topic,
too.
Thank you for your time and attention. I look forward to answering
any questions you may have.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
Exhibit C
The information for Exhibit C can be found on the Identify Theft
Resource Center website under the ``2021 Consumer Aftermath Report''
(idtheftcenter.org).
The Chair. Thank you, Mr. Lee. And again, thank you for
your annual reports and the information that you provided to
the Committee. I don't even know if in the Q&A I will get to
ask all my questions about that, but I am interested in the
State rankings. And you have data that shows the--what is going
on in each state. So I think that that is also interesting data
for our committee members. So thank you. Ms. Rich, welcome.
Thank you for being here.
STATEMENT OF JESSICA L. RICH, OF COUNSEL, KELLEY DRYE
& WARREN; DISTINGUISHED FELLOW, GEORGETOWN
INSTITUTE FOR TECHNOLOGY LAW AND POLICY
Ms. Rich. Chair Cantwell, Ranking Member Wicker, and
members of the Committee, I am Jessica Rich, a counsel at
Kelley Drye & Warren, and also a distinguished Fellow at
Georgetown Law. I am pleased to be here today testifying on the
need to strengthen data security protections in this country.
My remarks today are my own based on my years in Government
service. And my background is as a lawyer and a law enforcement
official. I worked for 26 years at the Federal Trade
Commission, the last four as its director of Bureau of Consumer
Protection. Before becoming the Director, I was the first and
longtime manager of the FTC's privacy program. I have supported
stronger data privacy and security laws for over 20 years.
Providing reasonable security for consumer data is at the heart
of privacy protection.
Without it, data can easily be stolen or compromised by
hackers or corrupt insiders. And that is what we have seen
again and again, scores of data breaches that harm consumers
and businesses alike in the form of fraud and identity theft,
loss of trust, and business disruption. Because commercial
systems are highly connected to the Nation's infrastructure,
these compromises undermine our national security as well. One
of the key problems is that current law fails to set clear
standards for data security or provide adequate remedies. Most
of the FTC's data security efforts are based on the FTC Act, a
law that leaves wide gaps in protection and doesn't even
authorize penalties for first time violations.
While there are sector specific laws with a data security
component and half the states now have their own data security
laws, it is a messy and confusing patchwork. For all of these
reasons, I strongly support Federal data security requirements,
whether it is part of a broader privacy law or on its own, if
that can be done, to bring stronger protections and greater
clarity to the marketplace.
My written remarks detail the main elements I recommend in
such a law, so many of which are already contained in some form
in both the Chair's and the Ranking Member's privacy bills. The
convergence between these bills reflects hard work and
commitment by this committee and shows that a Federal data
security standard is truly within reach. The Committee's
efforts to create a new privacy bureau at the FTC, something I
have also personally championed, will also make an enormous
difference for data protection in this country. So in terms of
the elements. First, the law should provide comprehensive
protections and a level playing field across the marketplace.
This means giving the FTC jurisdiction over nonprofits and
common carriers, which they don't currently have jurisdiction
over. Second, it should take--the law should take a process
based approach that is scalable to different types and sizes of
companies and the volume and sensitivity of the data they
collect. Otherwise, the law could quickly become obsolete or
impose requirements ill-suited and unattainable for small
businesses. And there should be requirements or incentives for
data minimization, as my fellow panelist just discussed.
Third, the law should extend broadly to the wide range of
data that in the world of AI and algorithms and IoT and
sophisticated consumer profiling can cause consumer privacy
harm. This means data that is reasonably linkable to a
consumer, and categories of data that go well beyond Social
Security and account numbers, like account credentials, health
data not covered by HIPPA, and precise geolocation data.
Fourth, to ensure accountability and deterrence, the law
should authorize strong remedies, both civil penalties and
redress, require oversight by qualified personnel reporting to
the highest levels of the organization, and give full
enforcement authority not just to the FTC, but to the state
Attorneys General. Finally, if the law is really strong enough
and the states can fully enforce it, I don't think we weaken
protections at all by preempting State laws and foregoing a
private right of action.
In fact, we gain a strong, consistent standard that can be
enforced nationwide by over 51 law enforcement agencies working
in tandem. However, given the chasm that continues to exist on
private rights of actions in particular, there are middle
grounds to consider as I discuss in my written testimony. Thank
you for having me here today and I am happy to answer
questions.
[The prepared statement of Ms. Rich follows:]
Prepared Statement of Jessica L. Rich, Of Counsel, Kelley Drye &
Warren; Distinguished Fellow, Georgetown Institute for Technology Law
and
Policy
I. INTRODUCTION AND BACKGROUND
Chair Cantwell, Ranking Member Wicker, and members of this
Committee, I am Jessica Rich, Of Counsel at Kelley Drye & Warren and a
Distinguished Fellow at Georgetown University. I am pleased to be here
today, testifying before this Committee on the need to strengthen data
security protections in this country. I want to thank this Committee
for its leadership and ongoing efforts on data privacy and security
issues. I also want to make clear that my remarks today are my own,
based largely on my years of experience in government service.
My background is as a lawyer and law enforcement official. I worked
for over 26 years at the Federal Trade Commission (FTC), the last four
as Director of its Bureau of Consumer Protection overseeing the
agency's fraud, advertising, and privacy initiatives. Earlier in my FTC
career, I launched the agency's very first privacy work, and then led
and expanded these efforts for over a decade--bringing cases against
companies that misrepresented their privacy practices and/or failed to
secure consumer data, and developing rules to implement the Gramm Leach
Bliley Act (GLB),\1\ Children's Online Privacy Protection Act
(COPPA),\2\ and Fair and Accurate Credit Transaction Act.\3\ In 2000, I
led the FTC team that wrote the first of many reports to Congress \4\
seeking stronger legal authority and remedies for data privacy and
security--and I have testified, spoken publicly, and written many
articles pleading the same case since.
---------------------------------------------------------------------------
\1\ 15 U.S.C. Sec. 6801 et seq.
\2\ 15 U.S.C. Sec. 6501 et seq.
\3\ 15 U.S.C. Sec. 1681 et seq.
\4\ https://www.ftc.gov/sites/default/files/documents/reports/
privacy-online-fair-information-practices-electronic-marketplace-
federal-trade-commission-report/privacy2000.pdf.
---------------------------------------------------------------------------
Providing reasonable security for consumer data is at the heart of
privacy protection. Even if a company determines not to sell or share
its data with anyone, data can still be stolen through the proverbial
``back door'' if it is not protected from hackers or insiders with ill-
intent.
And that is what we have seen, again and again over the years--
scores of data breaches that harm consumers and businesses alike.\5\
For consumers, data security failures can lead to fraud and identity
theft, and the expense and worry of monitoring compromised accounts,
changing passwords, and recovering losses.\6\ For businesses, data
security lapses can lead to loss of trust among customers, lost
business, costly remedial efforts, and ransomware and other serious
disruptions to operations.\7\ Because commercial systems are highly
connected to the Nation's infrastructure, these compromises can
undermine our national security as well.\8\
---------------------------------------------------------------------------
\5\ See e.g., https://www.upguard.com/blog/biggest-data-breaches.
\6\ See e.g., https://www.ftc.gov/system/files/documents/
public_comments/2017/10/00004-14
1444.pdf.
\7\ See e.g., https://www.fisglobal.com/en/insights/merchant-
solutions-worldpay/article/how-the-consequences-of-a-data-breach-
threaten-small-businesses.
\8\ https://www.cisa.gov/critical-infrastructure-sector-
partnerships.
---------------------------------------------------------------------------
One of the problems is that current law fails to set clear and
consistent standards for data security, or provide a solid basis for
holding companies accountable. Indeed, most of the FTC's data security
efforts are based on the FTC Act,\9\ a law that was not designed for
this purpose and is ill-suited for it in many ways. Among other things,
the law does not establish clear standards for everyone to follow
before problems occur--it is largely reactive. It does not cover non-
profits, or companies engaged in common carrier activities. It does not
authorize civil penalties for first time violations.
---------------------------------------------------------------------------
\9\ https://www.ftc.gov/sites/default/files/documents/statutes/
federal-trade-commission-act/ftc_act_incorporatingus_safe_web_act.pdf.
---------------------------------------------------------------------------
And now, after the Supreme Court's ruling in the AMG case,\10\ the
law does not even allow the FTC to seek monetary relief in Federal
court under Section 13(b).
---------------------------------------------------------------------------
\10\ https://www.supremecourt.gov/opinions/20pdf/19-508_l6gn.pdf.
---------------------------------------------------------------------------
While the FTC has some authority over data security under certain
sector-specific laws (Fair Credit Reporting Act,\11\ GLB, and COPPA),
these laws cover small slivers of the marketplace. Further, half of the
states have now passed data security laws of their own, splintering the
issue even further.\12\
---------------------------------------------------------------------------
\11\ 15 U.S.C. Sec. 1681 et seq.
\12\ https://www.ncsl.org/research/telecommunications-and-
information-technology/data-security-laws.aspx.
---------------------------------------------------------------------------
The absence of Federal standards in this area means that businesses
lack clear rules to follow; consumers lack consistent and reliable
protections, and remain confused and distrustful; and the FTC turns
somersaults and faces legal challenges as it tries to fill the gaps.
For all of these reasons, the U.S. urgently needs a Federal standard
that would bring stronger protections and greater clarity to the
marketplace.
II. KEY QUESTIONS IN THE DATA SECURITY DEBATE
As this Committee is well aware, despite growing support for the
concept of a Federal data security law, many questions and
disagreements remain about what it would include. So, to get right to
the point, I offer my thoughts (below) on some key questions that
always arise when the prospect of a Federal data security law is
discussed.
Should data security be addressed in a standalone Federal law or as
part of a Federal privacy law? Including data security as part of a
Federal privacy law has the advantages of ensuring that privacy and
data security requirements are harmonized; that consumers gain
comprehensive protections all at once; and that companies can move
forward with compliance plans on both fronts. Nevertheless, passing a
data security law on its own would still advance data protection in
this country considerably.
Who should enforce a Federal data security law? The FTC, at the
Federal level. It has deep background and expertise in this area from
over 20 years of enforcement experience and policy leadership; a strong
commitment to the issue, and relationships with key sister agencies
here and abroad (the Department of Justice, Health and Human Services,
and international privacy enforcers and regulators, among others). With
enhanced legal authority, the FTC could hit the ground running in a way
no other agency could (and certainly not a brand new one). Providing
the FTC with additional resources (the topic of last week's hearing)
would also be critically important.
As discussed below, the State Attorneys General also should be
fully empowered to enforce the Federal law.
What elements should be included in such a law? The new law should
fill many of the gaps discussed above:
First, it should extend across the marketplace to provide
comprehensive protection to consumer and a level playing field to
businesses. This means giving the FTC jurisdiction over non-profits and
common carriers.
Second, the law should extend broadly to any data that, if not
protected, could be used to cause consumer harm. In particular, the law
should cover data that is reasonably linkable to a consumer, and should
include categories of data that go well beyond account numbers--e.g.,
account credentials, health data not covered by the Health Insurance
Portability and Accountability Act,\13\ and precise geolocation data.
---------------------------------------------------------------------------
\13\ https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-
104publ191.pdf.
---------------------------------------------------------------------------
Third, the law should provide clarity about companies' obligations
while also giving them flexibility to tailor their data security
protections to their business models. This means taking a process-based
approach that includes certain key elements: (1) regular risk
assessments (2) effective safeguards to limit the risks (3) a data
security plan that is socialized throughout the company (4) training
and oversight of employees and vendors (5) regular evaluation and
updates to the plan and safeguards, and (6) accountability and
oversight by expert personnel who report to the highest levels of the
company. In addition, there should be requirements or incentives for
companies to minimize unnecessary data collection and storage, as this
is a huge source of risk to data.
Finally, of critical significance, the law should include the
authority for the FTC (and the states) to obtain civil penalties and
(in light of the AMG ruling) consumer redress--to deter misconduct and
compensate consumers for their losses.\14\
---------------------------------------------------------------------------
\14\ I did not include breach notification in these
recommendations. With state breach notification laws now in effect in
all 50 states, I believe including this issue would be highly
disruptive to the goals of passing Federal data security legislation.
---------------------------------------------------------------------------
Does a process-based approach provide sufficient guidance to
companies as to their obligations? This question has been a source of
debate. Companies have sometimes argued that they want more specific
guidance, even as they also say they want flexibility. To address this
concern, the Federal law could direct the FTC to issue periodic
guidance providing detailed, up-to-date information regarding security
measures and technologies that companies should consider adopting. The
guidance would not itself be enforceable, but it could provide valuable
information that could be updated on a regular basis.
Does the FTC need rulemaking to implement a Federal data security
law? A key purpose of rulemaking is to ensure that a law keeps pace
with rapid technological and market changes. Here, if the law takes a
process-based approach and also directs the FTC to issue periodic
guidance, full rulemaking authority may not be necessary. However,
there may be specific issues for which rulemaking is needed--notably,
what type of data should be covered under the law, an important issue
that is likely to evolve over time.
Should the law preempt state laws in this area? Preemption has the
advantage of ensuring clarity and consistency in an area that, as here,
is already complex and costly. On the other hand, the states have shown
leadership in this area and their continued efforts could help
strengthen protections and accountability nationwide. A good middle
ground would be to preempt state data security laws while fully
empowering the states to enforce the Federal law. The law could provide
a mechanism for coordination, similar to the coordination provisions in
COPPA.
Should the law grant a private right of action? Ideally, a private
right of action should not be necessary. One of the main arguments in
support of a private right of action is that the FTC, with its limited
resources, cannot possibly police the marketplace adequately to promote
compliance, deter wrongdoers, and obtain recourse for injured
consumers. A strong Federal law could address these concerns by giving
the FTC the legal tools and resource it needs, empowering the states to
enforce the Federal law, and including strong remedies for violations.
Federal and state enforcement--with no private right of action--
would also facilitate more consistency, and prevent the types of class
actions that have benefited lawyers more than consumers.
However, stakeholders have debated this issue for decades with no
resolution. To bridge the divide, Congress could consider some middle-
ground options--something Cam Kerry at Brookings\15\ and others have
written about. For example, a private right of action could be limited
to willful and repeated violations and/or actual damages. It also could
require proof of tangible harm, such as when data security failures
result in fraud or identity theft; indeed, the recent Supreme Court
decision in Trans Union,\16\ which defined privacy injury fairly
narrowly for purposes of standing in private actions, may already have
compelled this outcome. Additionally, a private right of action could
be subject to a right to cure, as in California's privacy law,\17\ but
that right would need to be clearly defined.
---------------------------------------------------------------------------
\15\ https://www.lawfareblog.com/privacy-legislation-private-right-
action-not-all-or-nothing-proposition.
\16\ https://www.supremecourt.gov/opinions/20pdf/20-297_4g25.pdf.
\17\ https://leginfo.legislature.ca.gov/faces/
codes_displayText.xhtml?division=3.&part=4.&law
Code=CIV&title=1.815.
---------------------------------------------------------------------------
III. CONCLUSION
I would be happy to assist the Committee as it continues its work
on this important issue. Thank you for allowing me to share my views
today.
The Chair. Thank you, Ms. Rich. Mr. Felten, Professor
Felten, is that right?
Mr. Felten. Yes, thank you.
The Chair. Thank you very much for being here and thank you
for your work.
STATEMENT OF EDWARD W. FELTEN, ROBERT E. KAHN
PROFESSOR OF COMPUTER SCIENCE AND PUBLIC AFFAIRS,
PRINCETON UNIVERSITY; FORMER CHIEF TECHNOLOGIST, FEDERAL TRADE
COMMISSION
Mr. Felten. Thank you. Chair Cantwell, Ranking Member
Wicker, and distinguished members of the Committee, thank you
for the opportunity to testify today. I am testifying today in
my personal capacity. A few years ago, researchers discovered
that many widely sold webcams had been set up by their
manufacturers with weak passwords like admin, guest, and 1234.
Anyone who knew or guessed these passwords could control
the camera. The consequence was that many Americans had webcams
in their homes that could be turned on and viewed across the
Internet by bad actors. Then a group of hackers automated the
process of scanning the Internet for vulnerable webcams and
installing malware on them.
By doing this, they took control of hundreds of thousands
of devices all over the internet, and they operated those
compromised devices under centralized control in what was
dubbed the Mirai botnet. Mirai was used to launch some of the
largest denial of service attacks seen to that time, including
one against an infrastructure provider that knocked many sites
offline for hours. It knocked out Twitter, Reddit, and Netflix,
among others.
A single and simple, careless practice had led to a cascade
of harm. And there was little that consumers could have done to
protect themselves. The FTC later brought enforcement action
against D-Link, a prominent webcam maker, requiring it to
change its practices. My written testimony summarizes another
similar case, and I could have included many more. It is a
distressingly common story. Consumers unable to protect
themselves rely on a company to take adequate precautions. The
company fails to do so. Intruders exploit that failure.
Consumers are harmed. And an FTC enforcement follows.
I had the privilege of serving as the FTC's first Chief
Technologist about 10 years ago. The FTC's staff and leadership
were and are smart, diligent, and dedicated to protecting
consumers, but they simply don't have the tools they need to
fully address today's data security enforcement challenges. I
would respectfully suggest three steps that Congress might take
to further empower the FTC. First, as others have advocated,
Congress can allow civil penalties for first time violations of
Section 5 of the FTC Act. The lack of first time penalties
makes the FTC Act a weak deterrent and attempts a company to
gamble that it won't face enforcement, or if it does, it can go
ahead with unfair practices and then clean up its act after the
first enforcement.
For example, D-Link paid no penalties in the FTC's webcam
enforcement. A second step Congress might take is to authorize
a data security rulemaking so the FTC can clarify what is
expected of companies. Today, most enforcements rely on Section
5, which is broad but not specific.
The FTC has created a body of case law through its
enforcement and public statements, but more specificity would
better protect consumers and help companies better understand
what is expected of them. A good structure would cover both
internal controls and responsibility, in the spirit of the GLBA
safeguard rule, and also require basic best practices that are
already widespread at well-managed companies, such as keeping
up to date on security patches.
My written testimony offers a longer list of suggested
provisions. A third step Congress might take is to increase the
FTC's resources for data security and technology, and to create
a new technology focused bureau in some form. When I joined the
FTC in 2011 as its first Chief Technologist, the agency was
just starting to build its workforce of technologists. The need
for more technology expertise was clear. And although the FTC
has increased its capacity to hire and work with technologists
over the 9-years since my term ended, there is still a long way
to go.
Government can't match the salaries or working conditions
available to top technologists in the private sector. But the
FTC can find and recruit outstanding technologists who are
motivated by the agency's mission of protecting Americans. I
know these motivated technologists exist because I have met
many of them and helped some of them get jobs at the FTC.
Skilled technologists will come to the FTC, and they will
stay as long as they believe they are empowered as full
partners in fulfilling the agency's mission. This requires
building a community of practice and establishing career paths
for technologists in the FTC so that they can develop their
talents and can hope to rise to high levels in the agency staff
if their performance merits it.
The key is to activate the virtuous cycle, where successful
recruiting increases the team's impact on the mission, and the
impact on the mission attracts top talent to join the team. The
successful FTC of the future is one that has stronger
authority, increased resources, and greater technological
capability. The FTC is ready to grow into this role, and I
thank the Committee for your work on empowering the FTC to do
this on behalf of American consumers. Thank you for your time
and I look forward to your questions.
[The prepared statement of Mr. Felten follows:]
Prepared Statement of Edward W. Felten, Professor of Computer Science
and Public Affairs, Emeritus, Princeton University
Chair Cantwell, Ranking Member Wicker, and distinguished members of
the Committee, thank you for the opportunity to testify.
As you know, data security is an issue that is important to many
Americans. More and more data about our lives is captured, stored, and
analyzed, with little transparency about what is collected, who has it,
what they are doing with it, and how well companies are protecting it.
Even the most careful companies may be subject to a data breach, and of
course the existence of a breach does not by itself prove security
measures were inadequate. But too often companies fail to take common,
reasonable steps to ensure data security, and too often these failures
lead to breaches that ultimately harm consumers.
At the national level, the Federal Trade Commission plays a primary
role in civil enforcement to protect data security in most sectors of
the economy, mainly by enforcing Section 5 of the FTC Act, which
prohibits ``unfair or deceptive acts or practices in or affecting
commerce.''
I had the privilege of serving as the FTC's first Chief
Technologist from 2011-2012, and I have continued to follow the FTC's
data security activities since. My testimony is informed by these
experiences and by my academic study of data security and privacy from
both technical and policy perspectives. I am testifying in my personal
capacity and not on behalf of any agency or organization.\1\
---------------------------------------------------------------------------
\1\ Although I am a Member of the Privacy and Civil Liberties
Oversight Board, I am testifying solely in my individual, non-official
capacity.
---------------------------------------------------------------------------
In this testimony I will cover two main areas. First, I will
summarize two examples in which companies' data security failures led
to breaches that harmed consumers. Second, I will discuss three things
Congress might do to strengthen the FTC's ability to protect consumers:
enabling civil penalties for first violations of the FTC Act; creating
a statutory or rulemaking framework regulating data security practices;
and providing resources to grow and empower the FTC's technology
workforce.
Impact on Consumers: An Example
The following example helps illustrate how data security failures
put Americans at risk.
Over the last decade or so, cheap Internet of Things devices have
proliferated in our homes and offices. For example, a parent might set
up a webcam in their home and then, while on a family trip to visit
relatives, might use a phone app to turn on the webcam and verify that
all is well back at home. This requires a way for the parent's phone to
connect over the network to the webcam and send a command to the camera
to stream video back to the parent's phone. Security requires that the
webcam must only accept commands from the authorized phones of the
parents and not from other sources.
In 2015, research revealed that many widely sold webcams had hidden
administrative functions that allowed anyone to log in to the webcam
and control it from afar, using weak and widely known username/password
combinations such as admin/admin, guest/guest, and administrator/1234.
These were not weak passwords chosen by the consumer but rather
passwords set up in advance by the manufacturer, without notice to the
consumer and without any reasonable way for the consumer to change
them.
The consequence was that many Americans had webcams in their homes
and offices that could be turned on and viewed across the Internet by
bad actors.
In addition to enabling direct exploitation to spy on consumers,
these vulnerabilities also opened the door to attackers using webcams
as a jumping-off point for cyberattacks on other targets anywhere on
the Internet.
This very possibility was exploited by hackers who automated the
process of scanning the Internet for vulnerable webcams and similar
devices, and installing malware on them. By this means they took
control of hundreds of thousands of devices all over the Internet, and
operated those compromised devices under centralized control to form
what was dubbed the Mirai botnet. Discovered in 2016, Mirai was used to
launch some of the largest denial of service attacks seen to that time,
including one against an infrastructure provider that knocked many
sites, including Twitter, Reddit, and Netflix, offline for several
hours. Three young Americans would later plead guilty to these
crimes.\2\
---------------------------------------------------------------------------
\2\ More detail about these events is available from the U.S.
Department of Justice: Justice Department Announces Charges and Guilty
Pleas in Three Computer Crime Cases Involving Significant Cyber
Attacks, Dec. 13, 2017. https://www.justice.gov/usao-nj/pr/justice-
department-announces-charges-and-guilty-pleas-three-computer-crime-
cases
---------------------------------------------------------------------------
There was little if anything that consumers could have done to
protect themselves. Nothing on the webcams or their packaging suggested
the existence of a minimally protected administrative interface. Few
consumers would have had the technical know-how to check or probe the
devices themselves. Consumers should have been able to rely on
companies to take simple and reasonable precautions to ensure data
security.
Consequences of Weak Security: The Equifax Breach
Even large and well-known companies sometimes fail to protect the
security of consumer data.
In 2017 the consumer credit reporting company Equifax discovered a
series of intrusions into its systems through which the private data of
about 150 million people was extracted--including 145 million
unencrypted social security numbers. The FTC and other agencies
investigated, and Equifax ultimately agreed to a consent order
including penalties of about $600 million.
According to the FTC and other sources, the initial breaches
occurred because the company failed to apply an available security
patch to a component of one of its public-facing servers. The company
knew of the problem--the security flaw in the component--and also knew
of the availability of the solution--the security patch--but still
failed to apply the patch to all of its vulnerable systems. Multiple
intruders exploited this failure and gained unauthorized access to
Equifax systems.
Because the company did not take other precautions, such as
partitioning its network, intruders were able to move laterally from
the initially compromised system into other internal Equifax systems.
Compounding this failure, the first breached system had access to an
unprotected, unencrypted file share that listed administrative
passwords for internal systems in plain text, which further helped the
intruders expand their access.
The intrusions went undetected for about four months, in part
because the company was not consistently using common defensive
measures such as file integrity checking and network intrusion
detection.
Several of these failures, such as neglecting to apply security
patches and storing sensitive data in unencrypted form, were contrary
to the company's own internally stated policies, suggesting a broader
failure to oversee and manage its internal data security operations.
The company's settlement with the FTC required it to establish stronger
data security management and accountability structures.
As in the webcam example, there was little if anything that
consumers could have done to protect themselves. Equifax, as a consumer
credit reporting agency, has data on many Americans who are not its
customers, and even those who are customers of an Equifax service would
have had no visibility into the company's internal security practices
or policies. The affected people could only rely on the company to
adopt reasonable measures, and on the FTC and other enforcement bodies
to enforce the law when necessary.
Further Empowering the FTC to Protect Data Security
The FTC's staff and leadership have been diligent and dedicated to
their data security mission. Yet the agency has sometimes struggled to
cope with the sheer scope, scale, and complexity of this mission--and
these challenges will only become more difficult as digital
technologies continue to proliferate and become even more complex.
Based on my experience at the FTC and my study of the agency, I
would point to several factors, listed below, that have contributed to
these challenges.
Limitations of the FTC Act: No Civil Penalties for First-time
Violations
A first challenge has been the structure of the FTC Act. Section 5
of the Act imposes no civil penalty for a first-time violation, so even
companies who commit serious violations can get a free pass if they
have not faced an FTC enforcement action before. Often, the most
important effect of an enforcement action is merely to enable civil
penalties for subsequent violations. Furthermore, civil penalties for a
second violation may only be available if the second violation involves
behavior covered by the first consent order.
The combination of limited enforcement resources and no first-time
penalties can make the FTC Act a weak deterrent, tempting a company to
gamble that it won't face enforcement, or even if it does face
enforcement, that it can gain an advantage through unfair practices and
then clean up its act after the first enforcement. This opens consumers
to risk. Congress could strengthen the deterrent effect of the FTC Act
by authorizing civil penalties for first-time violations of Section 5,
at least for data security related violations.
Many of the FTC's data security enforcements have been under the
unfair practices arm of Section 5. The FTC has developed a body of case
law through its past data security enforcements, and has offered
guidance on some practices it considers unfair.
The case law approach has had some benefits, especially in the
early days, but the public and the industry would benefit from a
rulemaking that offered more specificity for companies and consumers,
while retaining the flexibility needed to enable beneficial innovation
in an evolving technological space. I understand that in practice, any
data security rulemaking would require a new authorization from
Congress.
Need for Comprehensive and Technically Focused Data Security
Regulations
If Congress were to enact data security legislation that authorized
an FTC rulemaking or that created a statutory framework and directed a
rulemaking to fill in further details, it might include provisions such
as:
requiring companies to store and transmit sensitive consumer
data in encrypted form;
requiring strong multi-factor authentication for access to
administrative accounts that can access large amounts of
consumer data or can grant access to such data;
requiring reasonable data minimization so that consumer data
will be deleted when it is no longer needed for the purpose for
which it was collected;
requiring companies to apply a baseline level of security
due diligence to software they build or acquire for use in
handling consumer data;
requiring companies to make reasonable efforts to track and
install available security updates in systems that can access
consumer data;
where relevant and feasible, requiring companies to provide
a reasonable way for consumers to get security updates for
software a company supplies to them, and requiring that those
updates be delivered in a secure fashion;
in relevant cases, requiring a company to make available
such security updates for a specified time period, and
requiring prominent disclosure of when such security support
will no longer be available;
prohibiting companies from knowingly shipping devices or
systems with serious security vulnerabilities that endanger
data security;
prohibiting companies from shipping devices or systems
containing old versions of third-party software for which
security patches have been issued, without a reasonable
mitigation strategy;
where a company relies on a third-party service provider to
store or process consumer data, clarifying the company's
responsibility to ensure that the service provider is taking
reasonable steps to secure the data;
prohibiting default settings or behaviors that put consumers
at unnecessary risk;
establishing more stringent requirements for certain
sensitive categories of data such as health data, financial
data, or information about children, at least when such data is
outside the bounds of sector-specific privacy laws such as
HIPAA, COPPA, and FERPA; and
requiring companies handling significant amounts of consumer
data to establish internal reporting and accountability
structures for data security.
Need for Resources and Expertise for Technology Analysis and
Enforcement
Another challenge is the limited resources available to the FTC
relative to the scope of its mission--of which data security is just
one small part. The limited staff and resources available for data
security force the agency to be very selective and strategic in how and
when it enforces the law. Companies that stay ``under the radar'' of
the FTC may not see enforcement due to resource limits, and consumers
may suffer for it.
When I joined the FTC in 2011 as its first Chief Technologist, the
agency was just starting to build its workforce of technologists. The
need for more technology expertise seemed clear, especially in
technology-related cases. Although the FTC has increased its capacity
to hire and work with technologists over the nine years since my term
ended, there is still a long way to go.
Technology expertise and analysis play a crucial role in data
security investigations and enforcements. Below are a few examples of
how technology experts can help the FTC better protect the security of
consumers' data.
Companies that are under investigation often argue in their
defense that their practices were required for technical
reasons or that they chose their action over the alternatives
for valid technical reasons. For instance, a threshold question
in any unfairness case is whether the company's relevant
behavior was unreasonable under the circumstances. Where a case
depends on a company's technology design or practices,
technical expertise is required to evaluate claims such as
whether the company was following common engineering practices,
or whether there were technically feasible alternatives and how
much the alternatives would have cost in money or
functionality.
Companies also sometimes argue that they needed to collect
more data, or use data more aggressively, or withhold material
information about data practices from consumers in order to
better protect against cyberattacks or prevent fraudulent
activity by their users. Evaluating these claims, and helping
enforcers understand how much cybersecurity value these
measures might have provided, requires technical expertise.
Much of the evidence in data security cases will be
technological. Technology experts can understand and interpret
the evidence, help to draft the Civil Investigative Demands
(CIDs) used to get information from a company, and better
interpret companies' responses to CIDs.
Most investigations that lead to enforcement are resolved by
a consent decree negotiated with the subject company. These
consent decrees often contain forward-looking technology
requirements or limitations on a company's technology
practices. Technology experts can help agency leaders as they
work to negotiate meaningful limits on company behavior that
will continue to protect consumers as technology evolves,
without unnecessarily constraining a company's ability to
improve its products.
Resource limits have been one barrier to expanding the FTC's
technologist workforce. Agency leaders, knowing the scope of the
agency's mission and the workload facing all of its components, have
found it difficult to reduce headcount elsewhere in order to hire more
technologists. Congress could lower this hurdle by providing additional
resources and directing some of them to building a cohort of technology
experts, including people with advanced training in computer science
and closely related disciplines, or with equivalent experience in
industry.
How to Grow and Empower the FTC's Technology Workforce
Building and leveraging a strong technology team requires more than
just a budget. Having worked as the Chief Technologist at the FTC, and
having built technology teams in industry and academia, I can offer a
perspective on how it might be done.
Government can't match the salaries or working conditions available
to top technologists in the private sector, but the FTC can find and
recruit outstanding technologists who are motivated by the agency's
mission of protecting Americans. Sustaining that strategy, however,
relies on keeping the implied promise that a technologist will be able
to contribute fully to the agency's work, and that they can aspire to
contribute more and take on more responsibility as their career
advances. Retaining the best technologists will require having a career
path that offers a realistic possibility of reaching the most senior
staff positions in the FTC, if their performance merits it. And this
will only be possible if experienced technologists are treated as full
partners in the agency's internal processes and staff-level decision
making, and not merely as consultants or assistants to a legal team.
Although the analogy is not perfect, an interesting comparison is
to the role and organization of economists within the FTC. The Bureau
of Economics has been a useful vehicle for recruiting the agency's
economics workforce and applying its expertise across the FTC's
missions. With technology taking on a similarly important role in the
FTC's work, the question arises whether it is time to create a Bureau
of Technology along similar lines. The best placement of technologists
within the FTC is a point for reasonable debate; what is more certain
is that the agency can benefit greatly from building up its technology
team and including technologists as full partners in the agency's work
across the full range of its consumer protection and competition
missions.
Conclusion: The Future of Data Security, and the FTC's Role
Data security will only grow in importance as digital technology
becomes more prevalent, as new technologies are invented and deployed,
and as digital supply chains become more global. With more at stake,
and with attackers growing in sophistication, companies need to keep
improving their practices to stay ahead of the threats and offer
adequate protection for their users.
Civil enforcement by the FTC is an important backstop to protect
consumers against unfair or deceptive data security practices. In this
testimony, I suggested three steps that Congress might take to empower
the FTC in this mission: allowing civil penalties for first-time
violators; authorizing data security rulemaking; and enabling the
creation of a stronger technology workforce at the FTC.
I thank the Committee members for your attention to data security,
and for the work that you have already done to protect the security of
Americans' data; and I look forward to your questions.
The Chair. Thank you. And I knew there was something
there--Dr. Felten--I thought it was Dr. Felten, and I should
have known that because it is the University of Washington that
you graduated from. So, thank you. Thank you for that. We will
ask you more about the technology aspect of this, because I do
think the workforce is a very big issue. Ms. Tummarello, thank
you so much for being here.
STATEMENT OF KATE TUMMARELLO, EXECUTIVE DIRECTOR, ENGINE
Ms. Tummarello. Thank you. Chair Cantwell, Ranking Member
Wicker, members of the Committee, thank you for the opportunity
to testify before you today. My name is Kate Tummarello, and I
am the Executive Director of Engine, a nonprofit that works
with a nationwide network of thousands of startups to advocate
for pro-innovation, pro-entrepreneurship policies.
Most of the current technology policy debates focus on
concerns about how the largest players handle or mishandle
consumer data. But startups are critical contributors to
innovation and economic and job growth in the U.S., and they
have a unique perspective and need, a data security framework
that accounts for the breadth and diversity of the startup
ecosystem, sets clear consistent expectations, and protects
responsible actors from unwarranted legal and compliance costs
in worst case scenarios.
For many startups, data security is a business imperative.
Startups often don't have the name recognition or long standing
relationship with consumers that larger companies do. While
high profile data breaches of large corporations take up
headlines and Congressional attention, those companies live to
see another day. For a startup, one data breach can drive away
users and investors and ruin a company. Startups have to
constantly balance competing goals while building out a
successful product or service. One of the many things they have
to consider is securing user data.
In fact, many startups see privacy and security as a
competitive advantage and use strong security measures as a way
to differentiate themselves from others in the industry. But
every startup has to grapple with the fact that it could be the
victim of a data breach, as there are at least a thousand every
year and unintentional errors can still happen at responsible
companies. The startup ecosystem isn't a monolith, and each
company is risk assessment and security measures are going to
look different.
A two person startup collecting non-sensitive data from a
handful of users will have a very different risk profile than a
larger company collecting sensitive data from thousands of
users. At the same time, a new and small startup won't have the
resources to spend on compliance and security measures that a
larger company will. Being responsible stewards of user data
will look different for every company, and Federal data
security policy needs to recognize that.
As Aaron Vik, a startup advisor from Jackson, Mississippi
told us, smart and helpful data security policy should promote
flexible security practices, not make life harder for startups
when they are victims of data breaches. And if a startup is a
victim of a data breach, it has to spend its very limited time
and resources detecting, mitigating, and investigating the
breach, which can cost tens or even hundreds of thousands of
dollars. By contrast, the average seed stage startup has about
$55,000 to spend per month, a sum that needs to cover salaries,
equipment, research, development, marketing and more. And since
the vast majority of startups do not yet or do not yet--or do
not yet have outside funding, many startups have significantly
less than $55,000 a month to spend.
A complicated regulatory and legal regime makes a
disastrous situation for a startup worse in the wake of a data
breach. Congress should create a Federal framework that gives
startups clarity on the measures they need to implement to
protect consumer data and clarity on the steps they need to
take if they do suffer a data breach. A Federal framework
should also create certainty that startups won't face
regulatory and legal burdens if they do suffer a data breach
despite their precautions. The current patchwork of State laws
provides unclear data security standards on the front end and
varying or even conflicting requirements in the wake of a
breach, which creates ambiguity and uncertainty for startups.
For example, in notifying users of a breach, Michigan law
requires companies to describe the incident that led to the
breach, while Massachusetts prohibits notices containing that
sort of information. And because startups almost always have
users in multiple states, the first step of notifying users of
a data breach can involve hunting down additional user data the
company might not otherwise have or need to determine where
users are located, and which State laws are implicated. In
addition to having to navigate State laws, startups also have
to worry about being sued in multiple states.
A lawsuit, especially one where an organization is data
security measures are dissected in a lengthy discovery process,
can easily cost hundreds of thousands of dollars in legal fees.
This approach to enforcement also opens up the door for courts
to issue inconsistent rulings about what security measures are
adequate under the law. It also creates opportunities for
malicious or misguided lawsuits, where, for instance, a startup
is sued by a competitor or faces a nuisance value lawsuit.
Again, a Federal framework should create clarity and
consistency and restrict the opportunities for bad faith
litigation.
One bright spot in the current policy landscape is where
State laws incentivize security measures by, for instance,
easing compliance burdens if a data breach impacts only
encrypted data. Encryption is one of the most effective ways
startups can secure their users data. As Ben Golub, CEO of
Atlanta based Storj explained, the widespread use of encryption
is key to protecting sensitive consumer, financial, health
care, and research data from compromised by us or by bad
actors, and these are the kinds of measures we should be
encouraging.
Congress should create a Federal framework that
incentivizes a strong security measure that make sense for
startups and their unique risk profiles, allows room for the
universe of responsible security measures to grow and adapt as
the threat landscape evolves, and creates consistency and
certainty for responsible actors, including ensuring they won't
face unnecessary burdens in the event of a data breach.
We appreciate the Committee's attention to this issue and
the broader effort to create a Federal privacy framework. To
quote Tony Hyk, CEO of Minneapolis based TheraTech, ``if
lawmakers are going off an assumption that every business is
trying to do bad things, then they don't understand startups.
There will be a few bad actors but legislating for the lowest
common denominator is not the right approach.'' Thank you for
your time and I look forward to answering your questions.
[The prepared statement of Ms. Tummarello follows:]
Prepared Statement of Kate Tummarello, Executive Director, Engine
Chair Cantwell, Ranking Member Wicker, members of the committee,
thank you for the opportunity to testify before you today. My name is
Kate Tummarello, and I am the executive director of Engine. Engine is a
non-profit organization based in Washington, D.C. that works with a
nationwide network of thousands of startups to advocate for pro-
startup, pro-innovation, pro-entrepreneurship policies.
I'm especially appreciative to be here today, because most of the
current technology policy debates focus on concerns about how the
largest industry players handle, or mishandle, consumer data. But
startups are critical contributors to innovation and economic and job
growth in the U.S. and have a unique perspective and need: a data
security framework that accounts for the breadth and diversity of
startup companies; sets clear, consistent expectations; and protects
responsible actors from unwarranted legal and compliance costs in worst
case scenarios.
For many startups, data security is a business imperative. Startups
often don't have the name recognition or long-standing relationship
with consumers that larger companies do. While high profile data
breaches of large corporations and major retailers may take up
headlines and congressional attention, those companies live to see
another day. For a startup, one data breach can drive away users and
investors and ruin a company. Startups have to constantly balance
competing goals while building out a successful product or service and
cultivating a satisfied user base--one of the many things they have to
consider is securing user data. In fact, many startups see privacy and
security as a competitive advantage and use strong security measures as
a way to differentiate themselves from others in the industry.
But making user trust and data security a priority doesn't mean a
startup, or any organization, can't become the victim of a cyberattack.
In fact, every startup has to grapple with the fact that it could be
the victim of a data breach. According to the Identity Theft Resource
Center, there have been more than 1,000 data breaches every year since
2016,\1\ and data breaches in the first half of 2021 are on pace to
exceed last year's numbers.\2\ We sometimes hear about obvious,
irresponsible behavior--like losing an unencrypted hard drive--but
unintentional errors can still happen at responsible companies. If one
employee responds to a phishing e-mail or uses the same password across
multiple services, a data breach can occur.
---------------------------------------------------------------------------
\1\ 2020 in Review: Data Breach Report, Identity Theft Research
Center 10 (Jan. 28, 2021), https://notified.idtheftcenter.org/s/2020-
data-breach-report.
\2\ First Half of 2021 Data Breach Analysis, Identity Theft
Research Center 1, 2, https://notified.idtheftcenter.org/s/2021-first-
half-data-breach-analysis (last visited Oct. 4, 2021).
---------------------------------------------------------------------------
The startup ecosystem isn't a monolith, and each company's risk
assessment and security measures are going to look different. A two-
person startup collecting non-sensitive data from a handful of users
will have a very different risk profile than a larger startup
collecting sensitive data from thousands of users. At the same time, a
new and small startup won't have the resources to spend on the security
and compliance measures that a larger company will. Being responsible
stewards of user data will look different for every company, depending
on its resources as well as the sensitivity and amount of data it has.
Federal data security policy needs to recognize that. As Aaron Vick, a
startup advisor and former startup CEO from Jackson, Mississippi put
it, ``smart data security practices will and should look different for
every startup. Smart and helpful data security policy should promote
flexible data security practices, not make life harder for startups who
are victims of data breaches.''
And if a startup is a victim of a data breach, it has to spend its
very limited time and resources detecting, mitigating, and
investigating the breach. According to a recent survey, small firms
suffer the largest losses from cyber threats relative to company size.
Companies with fewer than ten employees reported spending a median of
$8,000 in response to cyber attacks, but for some those costs climbed
higher than $300,000 per year.\3\ By contrast, the average seed-stage
startup only has about $55,000 to spend per month \4\--a sum that needs
to cover salaries, equipment, research, development, marketing, and
more. And since the vast majority of startups do not, or do not yet,
have outside funding, most startups have significantly less than
$55,000 per month to spend.
---------------------------------------------------------------------------
\3\ Hiscox Cyber Readiness Report 2021, Hiscox 9 (Apr. 2021),
https://www.hiscoxgroup.com/sites/group/files/documents/2021-04/
Hiscox%20Cyber%20Readiness%20Report%202021.pdf.
\4\ The State of the Startup Ecosystem, Engine 17 (Apr. 22, 2021),
https://engineis.square
space.com/s/The-State-of-the-Startup-Ecosystem.pdf.
---------------------------------------------------------------------------
A complicated regulatory and legal regime makes a disastrous
situation worse for a startup in the wake of a data breach. Congress
should create a Federal framework that gives startups clarity on the
measures they need to implement to protect consumer data and the steps
they need to take if they suffer a data breach. A Federal framework
should also create certainty that startups won't face legal and
regulatory burdens if they suffer a data breach despite their
precautions.
The current patchwork of state laws provide unclear data security
standards on the front end, and varying or even conflicting
requirements in the wake of a breach, which creates ambiguity and
uncertainty for startups that want to protect their users. For example,
in notifying users of a breach, Michigan law requires companies to
describe the incident that led to a data breach, while Massachusetts
prohibits notices containing that sort of information.\5\ And because
startups almost always have users in multiple states, the first step of
notifying users of a data breach can often involve hunting down
additional user data the company might not otherwise have or need to
determine where users are located and which state laws are implicated.
These state-by-state differences drive up startups' compliance costs
without making consumers any safer.
---------------------------------------------------------------------------
\5\ Jeff Kosseff, Hacking Cybersecurity Law, 2020 U. Ill. L. Rev.
811, 838-39 (2020).
---------------------------------------------------------------------------
In addition to having to navigate state laws, startups also have to
worry about being sued if they are victims of a data breach in some
states. A lawsuit--especially one where an organization's data security
measures are dissected in a lengthy discovery process--can easily cost
hundreds of thousands of dollars in legal fees,\6\ which would entirely
deplete a startup's limited resources. This approach to enforcement
also opens up the door for courts to issue inconsistent rulings about
what security measures are adequate under the law,\7\ which creates
compliance confusion and costs that fall disproportionately on
startups. It also creates opportunities for malicious or misguided
lawsuits where, for instance, a startup is sued by a competitor or
faces a nuisance value lawsuit and chooses to settle rather than engage
in lengthy and expensive litigation.\8\ Again, a Federal framework
should create clarity and consistency and restrict the opportunities
for bad faith litigation.
---------------------------------------------------------------------------
\6\ Marcia Ernst, Data Breaches: They're Not Just Problems for the
IT Department--They Can be Legal Headaches Too, SGRLAW (Summer 2016),
https://www.sgrlaw.com/ttl-articles/data-breaches/.
\7\ Cf. Kosseff, supra note 5, at 823-27 (discussing the
possibility of shifting or unclear decisions in data security orders).
\8\ Cf. TCPA Litigation Sprawl: A Study of the Sources and Targets
of Recent TCPA Lawsuits, U.S. Chamber Institute for Legal Reform (Aug.
31, 2017), https://instituteforlegalreform.com/research/ tcpa-
litigation-sprawl-a-study-of-the-sources-and-targets-of-recent-tcpa-
lawsuits/ (discussing expanding trends in Telephone Consumer Protection
Act suits targeted against legitimate U.S. businesses, and not just
``unscrupulous scam telemarketers'').
---------------------------------------------------------------------------
One bright spot in the current policy landscape is where state laws
incentivize security measures by, for instance, easing compliance
burdens if a data breach impacts only encrypted data. Encryption is one
of the most effective ways startups can secure their users' data, and
startups can benefit from policies that encourage and incentivize
strong security measures, including encryption and data minimization.
As Ben Golub, CEO of Atlanta-based encrypted, decentralized cloud
storage company Storj, explained, ``we design our decentralized systems
so there are no single points of failure, and so that they are highly
resistant to both traditional and ransomware attacks. The widespread
use of encryption is key to protecting sensitive consumer, financial,
healthcare, and research data from compromise--by us or by bad actors--
and those are the kinds of measures we should be encouraging.''
As Congress considers ways to increase data security for consumers
across the Internet, lawmakers should keep startups in mind. Congress
should create a Federal framework that incentivizes strong security
measures that make sense for startups and their unique risk profiles,
allows room for the universe of responsible security measures to grow
and adapt as the cybersecurity threat landscape evolves, and creates
consistency and certainty for responsible actors, including ensuring
that they won't face unnecessary burdens in the event of a data breach.
Finally, Congress should promote training and support for a top
cybersecurity talent pool--and therefore a diverse cybersecurity talent
pool--because these professionals will be vital to keep pace with
emerging technology and new threats, and because they can (and should)
be a part of ongoing policy discussions about data security. As Safi
Mojidi, Founder of Hacking the Workforce, has explained: there are
``legislative gaps [that] should be addressed immediately in order to
achieve more consistent standards for how organizations use personal
information, while also providing industry with clear national guidance
on how to protect privacy and security. [But w]hen thinking through the
consequences of policy decisions, we need to make sure we have some of
the brightest, diverse minds in the room, who can think about the
impact on entire communities that policies would have.'' \9\
---------------------------------------------------------------------------
\9\ #StartupsEverywhere profile: Safi Mojidi, Founder, Hacking the
Workforce, Engine (July 9, 2021), https://www.engine.is/news/
startupseverywhere-alexandria-va-hacking-the-workforce.
---------------------------------------------------------------------------
We appreciate the committee's attention to this issue and the
broader effort to create a Federal privacy framework. We hope lawmakers
will continue to take into account the unique challenges startups face
in this space and find a legislative solution that works for the
thousands of startups that want to be secure, responsible, and
successful. To quote Tony Hyk, CEO of Minneapolis-based digital health
startup TheraTec, ``if lawmakers are going off an assumption that every
business is trying to do bad things, then they don't understand
startups. There will be a few bad actors, but legislating for the
lowest common denominator is not the right approach.''
The Chair. Thank you. Thank you for all the testimony
today. I want to do as we did our last hearing, try to figure
out whether we have a lot of commonality. So if you could just
kind of be brief on answers, if you could. Do you all support
an FTC Privacy and Data Security Bureau?
Mr. Lee. Yes.
Ms. Rich. Yes.
Mr. Felten. Yes.
Ms. Tummarello. Yes.
The Chair. Do you support first time penalties? If somebody
knows the answer--.
Ms. Rich. Yes.
Mr. Lee. Yes.
Ms. Tummarello. Yes, if there are clear rules of the road.
Mr. Felten. Same.
The Chair. OK. Do you--on this technology issue, one of the
key things, Dr. Felten, is to get technology workforce at the
FTC who understands these issues. Ms. Tummarello is bringing up
a point about small businesses, but I venture to guess knowing
what I have known about the past cases at the FTC, is that the
people who are the breach and privacy violators are those who
don't have the workforce within their organizations or
understand their responsibility as it relates to data and the
threat. I don't know if Mr. Lee might see the same thing.
Juxtaposed to startups who are very sophisticated
technology players because they wouldn't be in that business if
they weren't very sophisticated technology players. So what we
are seeing is an absence of technology expertise at these
firms, is that correct? The ones that are getting the
violations. And Ms. Rich, you can join in here too. Is that
what we saw at the FTC?
Ms. Rich. I wouldn't totally agree with that. Sometimes
that was the case, but sometimes it was simply a failure to
prioritize it or put the investment there. So----.
The Chair. That is exactly my point----.
Ms. Rich. Yes----.
The Chair. Companies have a lot of data.
Ms. Rich. Yes----.
The Chair. And then they don't prioritize----.
Ms. Rich. Right--exactly.
The Chair. Which I consider somewhat being sophisticated--
that level of data. So that is the point. So that is--who was
violating the FTC's actions against people were people who
weren't taking that responsibility seriously.
Ms. Rich. Exactly.
Mr. Felten. Yes. Often, it is a failure to take sufficient
care, meaning not recruiting the technology people you need,
not managing them carefully, not making this an issue that is
on the radar of senior officials in the company. That is what
leads to sloppiness and corner cutting, which ultimately is the
cause of a lot of these problems.
The Chair. So, Mr. Lee, your report show that we had a
hearing more than a year ago about Equifax and its breach,
which was simply not applying a patch that was a known
solution. But you are saying we are beyond that even. We are
beyond the people just not doing patches, because now the
attacks, because people understand the amount of money and
resources here, are much more sophisticated.
Mr. Lee. We have gone from a period of data acquisition. So
let's think of Equifax as sort of the high point where bad guys
wanted to accumulate as much data as they could from as many
sources that they could find. Now we are into a period where
they are using the data they have already stolen. So we have
gone from a period of theft to a period of fraud.
So a lot of what you are seeing in the last year has been
circumstances where they will use that to either perpetrate a
phishing attack that can lead to ransomware, can lead to that
kind of information when you have a log in and password from an
organization that can lead directly into a ransomware attack
because they can, they don't need to breach your system, they
can go in with a log in and password. Or you have what you saw
with unemployment, where you can pretend to be individuals and
open up accounts or take over accounts.
So we have gone from acquisition to fraud. Now that doesn't
mean they are not still trying to acquire, and they are not
still using our own tools against us. We don't patch fast
enough. We have legacy software that hasn't been updated or
replaced in in some cases decades, but certainly you have a lot
of legacy software out there in organizations. Time consuming--
it is expensive, I understand that, but it still has to be
done, and that leads to the attacks like what you saw at
Accellion.
The Chair. And so, Dr. Felten, what do you need to require
of the companies as it relates to the level of technical
sophistication that they should have in dealing if they are,
let's just say, dealing with large volumes of public content.
Mr. Felten. Yes, the bar is certainly higher for them,
needs to be higher for them than it has been because the threat
is higher. It requires--it requires staff, it requires
especially a sophisticated and strategic approach to managing
these systems, and it requires consistent execution.
Companies need to be willing to in some cases spend money,
in some cases encounter inconvenience to upgrade legacy systems
and so on, in order to protect things because what the
community has learned over and over is that a single failure to
patch one thing or to upgrade something when it needs to be
there, to make sure that some digital door is locked can lead
to a huge breach.
The Chair. Thank you. Senator Wicker.
Senator Wicker. Thank you, Madam Chair. Let's go down the
line on some other questions. Do you all support inclusion of a
data security requirement in a Federal data privacy law?
Mr. Lee. Yes.
Ms. Rich. If a--I wouldn't want to hold it up for what is
turning out to be a very difficult process of negotiating a
privacy law, which is very broad. So if you could enact a data
security law on its own, it would substantially improve data
protection in this country.
Mr. Felten. Yes.
Ms. Tummarello. Yes.
Senator Wicker. OK. Agree or disagree with this statement.
Let's start with Ms. Tummarello and go backward. A preemptive
Federal law does not mean a weaker law.
Ms. Tummarello. Agree.
Mr. Felten. Yes, it is not necessarily weaker.
Ms. Rich. If it is a strong law, it is not weaker.
Mr. Lee. Yes.
Senator Wicker. OK. And let me ask you, Ms. Rich. On your
statement, your oral statement about a private right of action,
is that consistent with your written statement or have you
changed your position? I am just not sure we all heard you
correctly there.
Ms. Rich. My position, I thought, was consistent between my
statement--.
Senator Wicker. OK, well just tell--tell us what it is.
Ms. Rich. Is that if it is a strong law, with strong
penalties--with strong remedies, resources for the FTC, State
AG enforcement, a private right of action is not necessary.
However, if there--if it just continues to be this very
difficult issue, there are middle grounds to consider. But I
don't personally think it is necessary.
Senator Wicker. OK, good. Now, on page seven of Mr. Lee's
testimony, he states, ``in the environment where we operate
today, some states are more aggressive in protecting their
citizens and others, resulting in disparate impacts for the
same crime based on where you live. Victims and businesses
alike are well served when everyone knows the rules and face
the same consequences.'' Mr. Lee, that is an argument for
preemption, isn't it?
Mr. Lee. Not necessarily. What we believe is that victims
need options. And we are--you know, we are here today
advocating for victims and the redress that is available to
them. But what we see today is, when every part of the process,
whether it is the enforcement of whatever a State has deemed to
be a data breach all the way to the form of the notice and the
substance of the notice, we are so across the board in so many
different areas, it is very difficult for anyone to have any
kind of understanding if you are the business or you are the
victim of what it is that I can do to protect myself or what is
it that somebody is going to do to protect me.
Senator Wicker. OK. You may want to enlarge on that on the
record. Ms. Rich, I think Mr. Lee's written statement makes a
case for preemption. Do you agree?
Ms. Rich. You are trying to get us to argue?
[Laughter.].
Senator Wicker. I am trying to compare and contrast.
Ms. Rich. I think that the case for preemption, if the law
is strong and all the State AGs enforce it, is very strong.
Senator Wicker. And that would prevent situations in which
the same crime based on where you live has disparate impacts,
would it not?
Ms. Rich. Yes.
Senator Wicker. Now, OK, Mr. Lee, I think Senator Cantwell
and I, I think she will give us a little leeway here. I think
we are interested in a ranking of who is doing a good job. Now,
I think what I understand you to say is you think there are
just as many breaches in the United States as there are in the
EU. They are just not being reported, and the difference is
grossly--I mean, it is just obvious. Is that correct? And also
where--which data security laws are doing a really, really good
job? And how can you prove that?
Mr. Lee. Great question.
Senator Wicker. I just think Senator Cantwell wanted me to
ask that.
Mr. Lee. Well, also to answer to both of you then, we do
believe that it is obvious. We know because of the disparate
nature of State regulations and State laws. What is a breach in
one state is not a breach in another state? That in and of
itself tells us that we are not being--we are not having
uniform reporting. I can give you two examples of large
breaches that impact--has impacted millions of people, but
there is never been a single data breach because the
organization deemed it doesn't apply to us.
Now that is being litigated. We are going to find out if it
applies to them. But their position is we had a breach, we were
attacked, we had a ransomware attack, but we are not
responsible for notifying any victims because we were just
holding the data of our customers.
Senator Wicker. Must that be reported in one state and not
another, and must that be reported in the European Union and
not in half the states?
Mr. Lee. That would be correct. There are states that do
not require that.
Senator Wicker. Which State has the best law in your
judgment?
Mr. Lee. Actually, Maine has a tremendous data breach law
and a tremendous data breach reporting system. We get some of
our very best data from the State of Maine. There are a number
of States that have very good laws. Obviously, you know,
California with the genesis of data breach laws being in
California, they have a very strong law. New York has a very
strong law. New York has very strong regulations underneath
that.
Senator Wicker. And there are results to prove this?
Mr. Lee. Yes, sir.
Ms. Rich. Can I make just a quick comment? I think what is
missing is data security. Data breach is great. Data breach
notification laws are great. They create accountability, but
they put the burden back on consumers to protect themselves.
And what I thought we were talking more about here was having a
data security standard to prevent breaches in the first place.
And that is critical.
The Chair. Senator Baldwin is next. Thank you.
STATEMENT OF HON. TAMMY BALDWIN,
U.S. SENATOR FROM WISCONSIN
Senator Baldwin. Thank you, Madam Chair. I want to focus a
little bit on the security issues that Chair Cantwell brought
up that resulted in the big breaches. So things as simple as
failure to install a software patch or failure to encrypt user
information.
We know the Equifax breach was possible because the company
failed to apply a patch and the Colonial Pipeline ransomware
attackers infiltrated a virtual private network account that
didn't use multifactor authentication--authentication, which is
a basic cybersecurity tool. Dr. Felten, in light of that
reality, how should we be thinking about best incentivizing
companies to do what should frankly be common sense
cybersecurity practices?
Mr. Felten. Well, I think there is--there is by now a well-
established list of basic practices, including the ones you
mentioned, and I suggest a longer list in my written testimony.
But in my view, a rulemaking might require companies to follow
those basic practices, in addition to the process and
accountability, internal control considerations that will help
to protect against more sophisticated attackers and more subtle
errors. This is--these baseline practices, I think, ought to be
required.
Senator Baldwin. Ms. Tummarello, you talked in your
testimony about the fact that small businesses don't have the
same resources to ensure compliance with data security
requirements. And frankly, if we don't expect a major company
like Colonial Pipeline to take the basic steps on data
security, do you think it is unfair to expect a company with
perhaps only a few staff or no in-house IT expertise to succeed
where large and well-resourced companies have failed?
That is rhetorical. Let me just ask specifically, how do
you think Congress can ensure that smaller businesses engage in
appropriate data security practices? And how should small
business--the carrots and sticks for small businesses be
different than those of large businesses that are well
resourced?
Ms. Tummarello. Thank you for the question, Senator. I
think, you know, first and foremost, the vast majority of
startups want to do the right thing, and currently they are
stuck trying to figure out what exactly the right thing is. And
so clear, consistent guidelines, whether through an FTC
rulemaking or elsewhere, just saying here is the menu of
options that count as responsible security practices, and if
you do these, we know that we can't prevent 100 percent of
cyber-attacks, but this is what responsible behavior looks like
and this is what you should model after, I think that would be
a huge step up for startups that want to do the right thing,
but again, just don't know what it is.
And I would hope that any kind of menu of options provided
by, for instance, in FTC rulemaking would account for scale and
size and resources. Some of the things you mentioned in your
first question are low hanging fruit, and a startup can easily
do them. It is just needing to know that that is enough. And so
I think there is a way to create a framework that allows
flexibility but still provide startups the certainty they need.
Senator Baldwin. Yes. Well, speaking of resources, I think
there is agreement that the Federal Trade Commission does not
have sufficient resources and staff today to handle the issues
related to data security and data breaches. I wonder if you
can, Dr. Felten and Ms. Rich, talk about what kind of
additional needs the agency has if Congress were to expand its
authority on data security.
Mr. Felten. So in terms of staffing of technologists, I
think the agency is on the order of 10 professional
technologists who are working in the mission side of the agency
right now. And I think with resources, the FTC could reasonably
use 50 to 60 people in those roles.
Ms. Rich. In addition to--to help attract technologists,
there have actually been a few serious problems that have been
identified by former technologists at the agency other than Ed.
One is there is no career path, as Ed talked about, but another
is that there are very rigid and outdated ethics rules
governing what technologists can do when they leave the FTC.
That ends up meaning that if they ever worked on a case
involving Google, they can never work on any other case
involving Google. So it is a big disincentive in some articles
have been written about it. In terms of what the FTC needs, it
is not just money, it is authority. I worked for years with
Section 5, trying to bring privacy and data security cases, and
they are really tough because there is so many gaps.
Section 5 doesn't even allow you to prescribe practices, it
only allows you to get an order against a company that already
engaged in negligent practices. And it doesn't cover certain
entities, and we talked about the civil penalties, et cetera.
So there just needs to be a law that allows the FTC to hang its
hat on it and hold companies accountable.
Mr. Felten. And I agree with the point about overly rigid
conflict of interest rules.
Senator Baldwin. Thank you.
The Chair. Thank you. Senator Blunt.
STATEMENT OF HON. ROY BLUNT,
U.S. SENATOR FROM MISSOURI
Senator Blunt. Thank you, Chairman. Ms. Rich, I want to get
to another topic here, you mentioned in your testimony that
examples of data were account credentials, health data not
covered by HIPAA, and precise geolocation data. Senator Schatz
and I, both on this committee worked in the last Congress to
try to get more attention to facial recognition standards.
I wonder if you would talk about that, and then if anybody
else has an opinion on the use of this data and how there--and
the lack of standards for collecting that kind of data that is
out there, everything from whether you are on a screen and
looking at something and you are recognized facially, or you
are walking through a drugstore. There is all kinds of this out
there and wondering what you are thinking about it as one of
the things we should be concerned about.
Ms. Rich. Absolutely. I didn't happen to mention biometric
data in my testimony, but it is absolutely part of the class of
sensitive data that should be protected by any data security
law. It also has a lot of privacy issues associated with it.
And right now, other than the FTC Act and the extent to which
it falls, for example, under HIPPA, which still only covers a
segment of hell of health data, there is really no Federal law
that mandates security for biometric data.
Senator Blunt. Alright. Mr. Felten.
Mr. Felten. Facial recognition particularly is an area that
poses a lot of risks for consumers, because of the way that
facial images can be captured at a distance and used without
consent or even awareness of the consumer. So I think it is an
area that requires special attention, even relative to the
already serious other security issues.
Senator Blunt. Mr. Lee.
Mr. Lee. Certainly made great points about the issues of
capture. From our perspective is if your biometric is somehow
compromised, you can't change your biometric. You can't change
your fingerprint, you can't change your face, your retina scan,
your voice print. So we need to be very careful about how we
protect that kind of data, and we have to have very specific
ways of helping people who are--whose identities are
compromised when that biometric data is indeed compromised. And
we don't really have a good framework for that today.
Senator Blunt. Ms. Tummarello.
Ms. Tummarello. Thank you. I think definitely biometric
data, including facial recognition data, should be considered
sensitive and should face heightened privacy and security
requirements. I do think we would want to be careful not to
completely eliminate the opportunities to use it in innocuous
and innovative ways, but totally recognize there is a bigger
threat here and it makes sense to put extra precautions around
it.
Senator Blunt. Well, you know, one thing people don't want
is walking through a grocery store and then suddenly start
getting ads for products, so you get a little of that by
looking up anything while you are in the grocery store from the
geolocation side of this, but also from whether it is a grocery
store or whatever else. While I have got Ms. Rich and Mr.
Felten here, to the FTC, you are both really well grounded
there, is trying to move toward more open hearings. Your view
of whether that is--the challenges there and whether that is a
good idea or not.
Ms. Rich. I don't believe the FTC is sharing nonpublic
information in those open hearings, so I see nothing wrong with
it. There have been--there has been some controversy about
whether all the information that is needed has been circulated
prior to the open meetings, but I think being more open is a
perfectly legitimate thing to do.
Senator Blunt. Mr. Felten.
Mr. Felten. Ensuring that nonpublic information is not
shared at those hearings, if we assume that, then I think this
is a good idea, the transparency about what it is that the
Commissioners are concerned about, and openness to the public
is really useful in a lot of different areas. So I think for
the Commission to do an appropriate part of its work in public
is a positive step.
Senator Blunt. There seem to be some early transition
questions about how to give notice and how much notice would be
necessary and if notice itself sort of takes away from looking
at what the Commission is really talking about. But I may want
to follow up with the both of you. Is there any--I don't know--
I think this is pretty much an FTC question. Thank you,
Chairman.
The Chair. Thank you. Thank you. Senator Tester.
STATEMENT OF HON. JON TESTER,
U.S. SENATOR FROM MONTANA
Senator Tester. Thank you, Madam Chair. I want to thank you
for having this hearing, and I want to thank the folks who have
testified today. I appreciate your testimony and your
expertise. I really don't know where to start, so we will start
here. Let's start with you, Mr. Lee. When we are talking about
data breaches and the potential for identity theft, has anybody
done any work to find out how much of this identity theft
information is coming from the private sector and how much is
coming from Government agencies?
Mr. Lee. We actually tracked the source of information.
Based on the publicly noticed data breach reports--.
Senator Tester. Yes.
Mr. Lee. So we can tell you, you know--.
Senator Tester. Can you give me any sort of statistics on
data breaches and how often--I am talking about, I don't know,
severe is in the eyes of the beholder, but how many are
happening in Government versus business?
Mr. Lee. So let's just look at this, this quarter, which
was completed last week. There were 446 data breaches. 21 of
those were from Government agencies.
Senator Tester. OK. And so we are basically talking in
today's hearing, though I assume on the private sector
businesses, correct?
Mr. Lee. Although they are all important.
Senator Tester. But we are talking about empowering the
FTC. And I wouldn't think the FTC has power over the Veterans
Administration, but who knows. I want to clarify some things
up. But it is not to get you and Ms. Rich to fight, but you had
said that some of the states that had strong laws are Maine,
California, and New York. Is that from a notification
standpoint or is that from a data security standards
standpoint?
Mr. Lee. It is actually from both. And one of the things
that you are seeing at the State level is this convergence of
what historically has been three silos. We have had privacy
laws is one silo. We have had identity management as one. And
then we have had, you know, cybersecurity. And there was very
little cross-pollination. But now what we are seeing is that as
states are beginning to adopt stronger laws, there are actually
cybersecurity, privacy, and identity elements in all of those
laws.
Senator Tester. Yes. So this may be an unfair question
because once again the viability of the law is in the eye of
the beholder, but would you say that half the states have
adequate security laws or three quarters, 30 out of 50?
However, you want to do it.
Mr. Lee. Well, you know, every law is helpful, but there
are--we have gone through a period of transition where a lot of
the states have sort of caught up to more common kind of data.
A lot of the states, only about half, don't recognize biometric
data.
Senator Tester. Would you agree, and not to get you to
fight, but would you agree with that, Ms. Rich?
Ms. Rich. According to the State legislative website,
half--half of the states have data security laws----.
Senator Tester. Oh, and half have none at all?
Ms. Rich. All of the states have data breach notification
laws. Yes.
Senator Tester. OK. Alright. And I might be able to get to
that if time goes on. This is a question for Kate Tummarello.
Sorry, if I bust your name. But there was an answer to one of
the questions that said, what the FTC needs is the authority to
prescribe practices. Doesn't matter what I believe, or actually
it does if we pass a law, but as a representative of the
startups, how do you feel about that?
Ms. Tummarello. I think the FTC could be empowered to set
out, you know, a menu of options, right. Not every
cybersecurity and data security practice is going to make sense
for each company. But there are things that everyone should be
doing, and there are certainly things that lots of folks that
handle sensitive data should be doing or folks that handle a
lot of data should be doing. And so having a flexible framework
that allows companies to pick and choose the things that makes
sense for their companies----
Senator Tester. OK. So let me give you an example. And I
don't know--I think the name of the company was D-Link,
professor, isn't that correct? I don't know if they are a
startup, I don't know if they have been around a long time, but
it would seem to me the FTC should say, clean up your act or we
are going to fine you till you don't exist anymore. How do you
feel about that?
Ms. Tummarello. Yes, I think the D-Link example is a great
example of not just sensitive data, but kind of sensitive
technical capabilities baked in. And it would make sense for
the FTC to have especially prescriptive ideas there.
Senator Tester. So they could be very prescriptive, is what
you are saying.
Ms. Tummarello. For a company handling sensitive data and
sensitive technical capabilities.
Senator Tester. OK. Alright. So this is just for my
curiosity, Ms. Rich. And by the way, we are not picking on
anybody. I appreciate all your testimony very, very much. But
could you give me the definition of non-sensitive data versus
sensitive data? And if not, we will turn to the professor.
Ms. Rich. I think that people regard simple name and
address these days, since it's out in the public domain, as
fairly non-sensitive.
Senator Tester. So, let me ask you this. I am a farmer in
my real life, and I drive down the road and there is an
implement behind me that has a computer on it is collecting
everything that I do, how much seed I put in the ground. I
don't use fertilizer, but if they use fertilizer, they can do
that. They can--I mean, all sorts of data. And some people
don't think that that is sensitive data. Do you think that is
sensitive data?
Ms. Rich. I actually don't think the distinction is that
relevant, because if you have a scalable--a scalable data
security program, you are going to provide security for all
your data. You just may provide more security for data that----
Senator Tester. I understand that. But the question becomes
for me, as the beauty is in that the beholder, I think that
that data is sensitive and I don't want anybody else to have
it, even though my name isn't attached to it. I don't want
people to have it because the way computers work this day, they
can figure out who is doing it. And so----
Ms. Rich. I think the issue is that companies have limited
amount of money or many companies, especially the one Kate
represents, and you should be taking care of all your data and
trying to make sure it isn't breached. But when you have--when
it is something--when a system is going to cost a lot of extra
money to protect something in a really, really secure way, you
want to make sure it is the really sensitive----.
Senator Tester. The good stuff----.
Ms. Rich. Kids or health, or--yes.
Senator Tester. I am sorry, I ran over, Madam Chair.
The Chair. Thank you. Senator Fischer, and then Senator
Klobuchar. Senator Fischer, are you available?
STATEMENT OF HON. DEB FISCHER,
U.S. SENATOR FROM NEBRASKA
Senator Fischer. Thank you, Senator Cantwell. And thank you
to our witnesses for being here today. So much of our daily
lives and work shifted on the online space during the COVID 19
pandemic. And this shift online also led to a spike in
ransomware attacks and targeted our work patterns, how they
were changing. I am sure many members of this panel know the
local companies and organizations in their states that have
been impacted by ransomware.
Just a couple of days ago, a company based in Lincoln,
Nebraska, that hosts several online auctions for farm
equipment, livestock, and land was hit by ransomware attack,
and the company had to take all of its sites offline. It has
been very concerning for me to see the rise in these attacks,
especially in the Ag industry, which drives Nebraska's economy
and makes up one-fifth of our Nation's economy. But no sector
has been immune from these attacks.
Ms. Tummarello, how do we ensure any Government led
solutions are responsive to cybersecurity across industries,
particularly with the increase in ransomware attacks?
Ms. Tummarello. Thank you for the question, Senator. Like I
said, I think giving the FTC authority to issue a menu of
options where a company can recognize, OK, I am in this sector,
I handle this kind of data, these are my resources, here is
what makes sense, would allow a model that scales not just
across the tech sector, but to your point, across all sectors.
Because at this point, data security problems aren't just in
the tech sector. Every business online or offline has data and
making sure there is a solution that works for them will ensure
that we protect consumers not just in one part of the economy,
but in the entire economy.
Senator Fischer. Thank you. Mr. Felten, how do you believe
that cybersecurity policy should address critical sectors such
as agriculture and communications or energy?
Mr. Felten. Well, it is certainly true, as you said,
Senator, that there is no sector that is immune from these
issues, immune from ransomware or other sort of data security
considerations. And one thing that I think is important to do
is to make sure that the services and products that companies
in these sectors use when they outsource some of their
functions are providing the protection that they ought to be
providing.
So ensuring that the division of responsibilities between a
supplier and a company that is using a product or service are
clear, so that responsibility for these problems doesn't fall
between the cracks, is very important. And that is one thing
that legislation or a regulation could help to clarify.
Senator Fischer. Thank you. As we saw with Equifax's
neglected patching policy, ensuring timely updates and patches
is important for guarding against cyber vulnerabilities, but
keeping software up to date isn't a simple cure all to ward off
breaches. The SolarWinds cyberattack showed us all too clearly
that software updates themselves could be compromised. Ms.
Rich, as we look to create a solid basis for policy around data
security and accountability, how do we also work toward the
need to create more trust throughout the software supply
chains?
Ms. Rich. As Professor--Dr. Felten just talked about, there
really does need to be accountability through the supply chain,
which really doesn't exist right now. So when you share data,
you need to make sure you are sharing it with people who can
handle it responsibly. You need to make sure you are not giving
them data that is subject to controls without passing along
those controls.
So that cascading set of responsibility is very important.
I want to also mention, though, that we have talked a lot
about--Kate has talked about a menu of options that the FTC
could create. It is very important that whatever we, whatever
you do--pass here is enforceable.
So that is why, in my testimony, I talk about process based
requirements that are enforceable, coupled with more detailed
guidance that is nimble that the FTC could issue on an annual
basis that responds to, you know, up to date protections and
technologies that gives that menu. But there needs to be an
enforceable law or rule underlying it.
Senator Fischer. OK. Thank you very much. Thank you, Madam
Chair.
The Chair. Thank you. Senator Klobuchar.
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Thank you very much, Madam Chair, for
not only today's hearing, but the Subcommittee and Full
Committee hearing yesterday. We are on the move in Commerce,
and we are on the cutting edge as all of you are in discussing
the issues of our day, which is what do we do about data?
What do we do about privacy rules? And as I argued
yesterday, we simply cannot, and I appreciate Senator
Cantwell's leadership in the privacy area, we cannot have this
gigantic change in our economy like anything we have ever seen
in the last few decades, some of it good, some of it bad, some
incredible innovations, you know, like the Fitbit I am wearing
right now. But also, as we know, one of the jobs of Government,
number one job is to keep people safe.
And as we heard yesterday, that is not always happening as
we hear from these cyber-attacks. So we need to make our laws
as sophisticated as the companies in our economy. And that
means upgrading our laws and updating them. And so I appreciate
you being here today. I think we need a national privacy law
that creates digital rules of the road, and we need the
resources for our agencies to enforce them. They are two
separate things, but you can't have one without the other.
And I joined Senator Cantwell, and Schatz, and Markey in
introducing a comprehensive privacy legislation to ensure that
consumers can access and control how their personal data is
being used. Do you all agree that consumers should have the
ability to control their own data? Is that an agreement, all of
you?
Mr. Lee. Yes.
Senator Klobuchar. OK. Everyone else?
Ms. Rich. I think a privacy law should go further than
consumer control, which is notice and choice, which we have
seen is problematic. It should provide more substantive
protections as well.
Senator Klobuchar. Thank you. I think one of the things
that was interesting was recently when Apple gave their
customers a choice about protecting their data or not. And what
was it? You can maybe explain better for me here, but 75
percent of their customers, is the number out there, chose not
to have their data used. And it just shows us what would happen
if this was available with all platforms. Professor Felten, in
your testimony, you note that we can empower the FTC by
authorizing data security rulemaking. Why is this rulemaking so
important to protect consumers' data?
Mr. Felten. For a couple of reasons. First, that it
provides more specificity than is available through the current
structure of the FTC Act, so that companies have a clear idea
of what they are expected to do. And it can also help to
clarify ideas such as--clarify issues such as the
responsibility of suppliers in a supply chain. So that there is
not ambiguity about what companies are expected to do, and
therefore there can be strong enforcement if they fail to do
it.
Senator Klobuchar. Thank you. And Ms. Rich, the bill would
also increase transparency and require companies to maintain
certain standards for their data security. In your testimony,
you note that it can be a problem in companies over collect or
over store data. How could a Federal privacy law help with this
issue?
Ms. Rich. I believe that both bills, they are a little
different, but they both talk about data minimization and
reducing unnecessary collection and storage of data, and that
would be a very important component of a data security law.
Senator Klobuchar. And are you aware that one of the
proposals out there as we debate this build back better agenda
and making our laws sophisticated and putting people first,
some of it is putting some funding into the FTC for privacy, as
well as for my position as Chair of the Antitrust subcommittee,
we hope additional resources on antitrust at both the FTC and
the Department of Justice. Could you talk about how important
that is to have those resources?
Yes, the privacy bureau. I know Senator Cantwell asked all
of you that question, but also the resources for these agencies
to do their jobs.
Ms. Rich. The FTC's resources in privacy and also
antitrust, but I am less familiar with that, is miniscule
compared to other comparable enforcers abroad or even sectoral
enforcers here in the United States. 45 to 50 attorneys, that
was the maximum when I was there working on privacy. So
resources are a critical piece of this as well as authority.
Senator Klobuchar. I keep reminding people these are the
biggest companies the world has ever known. Several of them are
over trillion dollars, and we are trying to fight this with
duct tape and Band-Aids. The other thing I like to remind
people is in the competition policy area. And when we add
resources to that, and I am sure the same could be said of some
of the privacy work, we actually bring in money for the
Government because they are doing their jobs and they are
enforcing the laws. And so we are literally, as, you note Ms.
Rich, these agencies are a shadow of their former selves, even
during Ronald Reagan.
And that is why we have long neglected them. And there are,
in the compensatory deals that Bill Baer, the former head of
antitrust under President Obama, said shouldn't be getting out
of the boardroom. And I can think the same could be said of
policies that are hurting people's privacy. Because if we are
not there on the other side, you know, creating that safety for
people and making clear we are going to be tough and strong,
then they are just going to push the max, as we saw yesterday
from the whistleblower.
They are just going to target kids with bad anorexia
content and the like, or let the algorithms do that and not do
anything about it. That is what is going to keep happening
unless we strengthen our side of the table. So thank you very
much for your work, and I have some questions on cyber threats
and the like which I will be putting on the record. Thank you.
The Chair. Senator Cruz, are you ready? Senator Cruz.
STATEMENT OF HON. TED CRUZ,
U.S. SENATOR FROM TEXAS
Senator Cruz. Thank you, Madam Chairman. Welcome to each of
the witnesses. There seems to be pretty broad agreement across
the witnesses today that the way we currently handle the issue
of data security at the Federal level is at best a patchwork,
and a problem made worse by a patchwork of different State laws
across the country. At the Federal level, there is a multitude
of rules, regulations, guidances, not to mention outdated
statutes, some of which were enacted at a time when cars were
brand new technology. And together, that creates confusion and
uncertainty among companies and consumers, and often leaves
regulators powerless to address genuine harm. And leaves the
American public significantly vulnerable. I want to start with
a simple question to all the witnesses, let's say Congress can
somehow get to yes on a sensible data security law. Who should
be responsible for it? The FTC, somebody else?
Ms. Rich. The FTC has the experience and the expertise in
this area and the will to protect consumers in this area. It
has been trying to do that for 20 years. It is absolutely the
right agency, but with the resources it needs and the authority
it needs.
Senator Cruz. Any disagreement on that question?
Mr. Lee. No, the FTC has had a mission of consumer
protection for its whole history. It is the right agency for
this.
Senator Cruz. So if the FTC has the principal authority,
should the FTC also have the authority to harmonize regulations
and guidance across Federal agencies? So for example, should
the FTC be able to tell the TSA that its cybersecurity
regulations need to change one way or another? Tell HHS that it
needs to beef up minimum standards for what is or isn't HIPPA
compliant?
Ms. Rich. I think that is putting the FTC in a very
difficult position, and I would not recommend that. I would say
that you should do that. You as a body should decide how the
regulations and laws harmonize.
Senator Cruz. Anyone have a different perspective? So there
should be no regulatory role for harmonizing regulations?
Ms. Rich. No, there certainly should be discussions about
harmonizing it, I just don't think the little FTC should be the
one telling all the other agencies what to do. They are equal
players and that is something maybe OMB could do, or Congress
could do.
Senator Cruz. Let's focus then on how Congress and or the
FTC strikes the right standard, strikes the right standard that
has the substance needed to be effective, while also the
flexibility to be applicable to companies with very different
risk profiles. What do the witnesses think the guidance should
be on that?
Ms. Tummarello. Thank you for the question, Senator. I
think the FTC could issue kind of a menu of options where
startups and bigger companies and other organizations can
decide what makes the most sense for them, knowing that they
are meeting some kind of minimum standard set by the FTC, so
that if something does go wrong, because again, not all data
breaches can be prevented, they have done the right thing. And
again, startups just want to do the right thing and would
appreciate guidance on what that right thing is.
Mr. Felten. I think there are some baseline practices that
companies across the board ought to be following, and some of
those are listed in my written testimony. But beyond that, I
think it would depend, or it ought to depend on the amount and
sensitivity of consumer data that a particular company is
dealing with. So companies with more, and more sensitive data,
could be held to a more stringent standard.
Ms. Rich. And in my testimony, I proposed that there be a
process based law that is scalable, similar to the safeguards
rule, the original safeguards rule, but maybe a little more
meat on the bones of it. And then the FTC would provide
Congressionally mandated annual updated guidance with that menu
of option that Ms. Tummarello is discussing.
Senator Cruz. And what are the risks of overregulation, of
standards that are too strict and what are the potential
downsides that could come from that?
Ms. Rich. They quickly become outdated as technology
changes, and there is no chance for Congress to amend the law
or rulemaking to keep pace, or they are not suited for small
businesses because they are too prescriptive in terms of
technologies that may not be necessary for certain small
businesses.
Senator Cruz. So how do we avoid that risk?
Ms. Rich. I think by having a process based rule that is
scalable based on the size of--the volume of information a
company collects, the sensitivity of data, the nature of the
operations, coupled with updated guidance that the FTC could
issue on an annual basis or more. Thank you.
The Chair. Thank you. Senator Hickenlooper.
STATEMENT OF HON. JOHN HICKENLOOPER,
U.S. SENATOR FROM COLORADO
Senator Hickenlooper. Great. Thank you, Madam Chair, and
thank all of you for your time. This is something that I have--
having been a Governor in Colorado, I am not ignorant of. I
will start out with Ms. Tummarello. We signed into law a
Colorado statute that requires reporting of security breaches
of over 500 or more Colorado residents. Has to go to the
Attorney General within 30 days.
We also created the National Cyber Security Center, which
was and continues to be an effort to promote data security with
both private and public companies with the NCC. We launched
Cyber Security for State leaders, which is a Google effort to
educate, provide a training curriculum for State officials,
including county Commissioners and municipal folks.
Obviously, timely reporting, as you guys have all said,
pays a lot of different dividends. How should we think about a
national reporting process? I think everyone is kind of talked
about the need for it. What would you say it should look like
in terms of how do we--as a small businessperson for many years
myself, I want to start with your perspective on that?
Ms. Tummarello. Thanks for the question, Senator. I think
first and foremost, one standard is a huge advantage for small
businesses and startups. And we have talked a lot about data
minimization at this hearing. And I think one of the points
that gets glossed over is that if you are having to follow a
State by State patchwork, you are having to collect information
about where your users are located to figure out if those State
laws are implicated.
And so creating a single standard not only incentivizes
better data practices at the outset by not requiring State
information, it also just makes it easier. If a startup is the
victim of a data breach, it has to jump into action without
having to figure out 50 State laws. And so I think you know it
almost--a 30 day reporting requirement seems reasonable. It is
more just about having one requirement across the board.
Senator Hickenlooper. Alright. I wasn't going to suggest
that Colorado's be the model. But since you put it out there,
Dr. Felten, I wanted to ask you a little bit about some of
these ransomware attacks that we have seen so much of. We had
a--in May 2020, JBS is a large meatpacker in Colorado, had a
serious breach. We had a Colorado hospital that lost 5 years of
electronic health records from 2012 to 2017, and it took 6
months to recover a lot of the critical health data.
We have really pushed that businesses should provide
security training for their employees, that they should have an
incident response plan, that there should be a backup for their
server data. So obviously, as you all know, that it is not a
question of if, it is a question of when an organization or an
enterprise is going to be breached.
So what--in your opinion, Dr. Felten, what targeted
resources can Congress provide to support businesses' data
security? In other words, what can we provide?
Mr. Felten. To support businesses specifically, I think
there are important educational roles that Government can play.
The FTC has an office that is engaged in this education for
consumers and small businesses to help them understand what is
out there and how to make safe decisions, giving them simple
checklists of best practices and so on.
It becomes more difficult when you are talking about larger
organizations that face more sophisticated threats. There, I
think Government can help to play a convening role so that
information can flow between organizations about what are the
best practices and how can they protect themselves.
Senator Hickenlooper. Right. Well, I would probably go
further than that, but I appreciate that. Mr. Lee. I was struck
that in large part, what we are talking about here is security,
the most basic type, and that the traditional way that we look
at security in this country has been, you know, we have the
Federal Government does national security and then most of us
in our local communities have our local police department, is
where we really look at security.
And yet right now, in terms of cybersecurity, it is largely
relegated to the private sector and for individual small
companies, large companies, health care providers, it is catch
as catch can. How do you see that balance between private
companies providing cybersecurity protection, and clearly what
I think is becoming apparent, the public need?
Mr. Lee. It is a great question, Senator, and I was also
struck by something you just said about the question of it is
not a matter of if, it is a matter of when. It is actually a
matter of how many times--.
[Laughter.].
Senator Hickenlooper. Don't say that.
Mr. Lee. Unfortunately. The practical reality is, the
private sector and the Government for their agencies are in the
only position to be able to provide security and to prevent the
kinds of incidents we are seeing that impact people, so create
victims. So we have to have a partnership between all of the
parties, beginning with Government setting a standard, an
enforceable standard, that then the private sector can go and
implement.
And they have the clear rules of the road. They know the
consequences if they breach them, and they have the tools
necessary to be able to implement them. If we have that system,
we will reduce the number of cyber incidents, we will reduce
the number of data breaches, and we will therefore reduce the
number of identity crime victims.
Senator Hickenlooper. I think that is something we can all
work toward.
The Chair. Thank you.
Senator Hickenlooper. Thank you, Madam Chair,
The Chair. Thank you for that questioning. I am going to
ask Senator Moran's indulgence. From the hearing the other day
we had--there is some confusion, I am going to talk to Senator
Wicker. And we had Commerce committee rules pre-COVID and then
COVID adoption, and now we are still in a kind of a hybrid
thing where some people are logging in, you know, remotely, so
I think we have to figure out how to get back to what rules
that we are going to operate under--.
Senator Blackburn. Exactly. And some of us logged in at the
start of that hearing to get----.
The Chair. Well, I think--we will have--but I have asked
Senator Moran for his indulgence today, given that we--.
Senator Moran. I am very indulgent.
The Chair. So we really appreciate his----.
Senator Moran. Madam Chairman.
The Chair. Yes, thank you.
[Laughter.].
The Chair. So Senator Blackburn, then followed by Senator
Blumenthal. Then Senator Moran.
STATEMENT OF HON. MARSHA BLACKBURN,
U.S. SENATOR FROM TENNESSEE
Senator Blackburn. Thank you so much, Madam Chairman. And
to each of you, thank you. This has been such an interesting
week. Yesterday we did privacy, kids' privacy in the online
space, and of course, with data security today. But what I want
to do is break out social media from small business and other
interests.
And let's talk specifically, and professor, I am going to
come to you on this first. Is there a--we know how social media
is collecting data. They keep that data. They mine that data.
Then they turn around, they sell the information in that data.
So should there be a special set of obligations and enforcement
and penalties that we expect from those social media companies?
Mr. Felten. In my view, social media companies differ from
many other companies more in degree than in type when it comes
to privacy. These are companies--these are among the companies
to collect the most data that use it most aggressively. And so
the need for strong rules of the road and enforcement would be
strongest for those companies.
Senator Blackburn. So you would do a broader bill that
would capture all entities. Would that be your approach?
Mr. Felten. I think a comprehensive data security framework
is important, one that covers everyone, but that scales
according to the volume and sensitivity of information that a
particular entity has.
Senator Blackburn. OK. Ms. Rich, I see you are thinking out
loud there with us.
Ms. Rich. Well, I am nodding, and I am shivering, too. It
is really cold in here. But I agree with everything Professor
Felten just said.
Senator Blackburn. OK. Thank you. So one set of rules, the
entire Internet ecosystem. One regulator, the FTC. Platforms
can't boot you off. That is basically where you all are.
Ms. Rich. This is one reason the FTC needs a lot more
resources, it is because when they investigate a giant company
like that, that is collecting a lot of data, that investigation
is going to be really, really complex and take a lot of
resources. But I do think it is important in this law,
especially if it is going to have preemption, for the State AGs
to also be able to enforce it.
Senator Blackburn. OK. Alright, Ms. Tummarello, the IRS
data security breach.
That supposedly has the data on tax returns of thousands of
people and may go back as much as 15 years into a person--this
is something that is of tremendous concern. We know that as of
last month, the IRS is still looking at this alleged breach,
but now we are hearing that the Administration is wanting to
propose a sharing of the information, letting the IRS look at
every transaction, $600 and above, and that amount of data and
invasiveness is--that really carries a lot of privacy concerns
for me. Tennesseans don't want that.
And they have really been quite vocal about this. But talk
about the potential issues that you see with that type of
invasive practice from an agency that has seen data security
issues.
Ms. Tummarello. Yes, absolutely. Thank you for the
question, Senator. So we have thought about it, you know,
because we are focused on startups in the cryptocurrency
context, because there are cryptocurrency startups who don't
want data, they don't want to have the data, they don't--they
want to, you know, protect the privacy and security of their
users. And we are always concerned about Federal rules that not
only right might make it so that agencies can get the data, but
that require companies to keep and get the data in the first
place.
We have talked about data minimization. I think that is a
great principle and one that should be baked into any privacy
or security law. But anything that kind of counteracts that by
requiring collection and storage of data in the private sector
goes, you know, right up against what companies should be
encouraged to do.
Senator Blackburn. OK. Madam Chairman, I am going to stop
at that. I yield my time back. Thank you very much.
The Chair. Thank you. Senator Blumenthal.
STATEMENT OF HON. RICHARD BLUMENTHAL,
U.S. SENATOR FROM CONNECTICUT
Senator Blumenthal. Thank you, Madam Chair. And thanks for
having this hearing and for your work on data security. I am
going to take advantage of this panel's very impressive
expertise to talk a little bit about a topic we discussed
yesterday in this room with Frances Haugen, the whistleblower
in the Facebook documents, she spoke very powerfully and
compellingly about the role that algorithms play in pushing
harmful content on children. And obviously, the algorithms use
data, so it is not completely unrelated.
She is a data scientist and engineer with an MBA from
Harvard, and she spent years working on algorithms. And her
observation was that the Facebook algorithm is a kind of black
box. That is my word, not hers, because nobody outside Facebook
knows how it works. And we conducted an experiment, my office
did, creating a 13 year old girl on Instagram who expressed
interest in weight loss and dieting and eating disorders, and
she was flooded within 24 hours with accounts relating, or
recommendations for them, to eating disorders, self-injury and
so forth. So algorithms obviously have a powerful part to play
on Instagram and Facebook and social media. We are going to
pursue this issue.
I am drafting legislation on it. One of her recommendations
was that there should be more transparency, more disclosure
about how algorithms work, more oversight into this aspect of
the internet. So my question to you, Professor Felten, is and
to others who want to make observations, what should we be
asking Facebook to tell us about their algorithms? What
specific should we be demanding of them?
Mr. Felten. Sure. So an algorithm like Facebook's is
extraordinarily complex. I think the conceptual handles one can
get on it are maybe three things. One is, which data go into
the algorithm, what is it using, and then any issues around
accuracy or nature of that data? That is number one. I think
number two is, what is it that the algorithm is trying to
optimize or maximize? These machine learning algorithms are all
trying to maximize some metric or measure of something.
With Facebook, it is maybe something like engagement, how
often people click or time they spend on the site. And then
what are they doing to understand the consequences? It is not
simple to understand the consequences of one of these complex
algorithms in operation.
But companies are constantly monitoring, measuring,
evaluating how these things go, and getting a picture into what
they are seeing internally on their dashboards or reports. It
seems quite important for understanding what is going on.
Senator Blumenthal. I am assuming you would agree that
algorithms can be made safer in terms of protecting children
and protecting data?
Mr. Felten. Absolutely.
Senator Blumenthal. Would you have specific recommendations
based on what you know about Facebook or Instagram's algorithms
on what they should be doing.
Mr. Felten. With respect to children, the obvious first
question is, should children be interacting with these
technologies at all or interacting as part of the same broad
system that adults are? In addition, I think the companies have
at least an ethical responsibility to take special pains to
understand how what they are doing impacts children.
What are the behaviors of children on this site? Because it
is very difficult for anyone else, such as parents, to really
govern this behavior if the company is not there taking basic
precautions.
Senator Blumenthal. But parents don't have the ability to
change the algorithm, do they?
Mr. Felten. No, all they can do is look over their kid's
shoulders or cut them off entirely.
Senator Blumenthal. And in fact, my guess is that most
parents have no idea what an algorithm is or what its effect is
on their children.
Mr. Felten. Even I, as a parent of a once a young child,
didn't really understand what these algorithms would be doing
to my child. It is a lot of guesswork.
Senator Blumenthal. So a good place to start for Congress
might well be to require greater disclosure and transparency
about algorithms. And if we were to establish, for example, an
oversight board, it would be the work of that board to enforce
greater safety to protect children.
Mr. Felten. I think understanding is a first step. And then
thinking about how to govern these algorithms is
extraordinarily difficult but important.
Senator Blumenthal. But if Mark Zuckerberg is really
serious about transparency, he would provide more disclosure
about his algorithms.
Mr. Felten. There is certainly more they could do in terms
of disclosure.
Senator Blumenthal. Thank you.
Ms. Rich. Can I just add that I don't think it would be
very useful for the disclosure to be to consumers. Because I
don't think in the same way consumers don't read privacy
policies, they are not going to look at all this programming
and figure out how the algorithm works. So if there is going to
be oversight, I think it should be Congressional oversight or
agency oversight, but not disclosures to consumers unless it
is--you are able to boil it down to something consumers can
really understand.
Senator Blumenthal. In the same way that the FDA regulates
drugs or tobacco, for example. You would need some kind of
oversight agency that had that specialized knowledge?
Ms. Rich. If Congress wants to regulate this, it needs to
do more than have it be an ethical obligation. Yes, there needs
to be some structure in place.
Senator Blumenthal. Thank you.
Mr. Lee. Access to this data and information by independent
researchers who truly are experts is also valuable.
Senator Blumenthal. Very good point. Thank you.
The Chair. Senator Moran.
STATEMENT OF HON. JERRY MORAN,
U.S. SENATOR FROM KANSAS
Senator Moran. Chairman, thank you. Please take note of my
indulgence and remember that. I am pleased to be here and
appreciate this panel and this topic of conversation. This--as
Senator Blackburn said, this has been a week of useful and
valuable time spent in the Commerce committee. I don't know how
to narrow my questions, and I have several and I want to get to
one in particular, and I am saving it to last, which is
probably a mistake.
But let me first of all, say Senator Shaheen and I are the
appropriators for NIST, which are the ranking, Republican and
back--and so my question maybe attended for Mr. Lee is, how can
Congress better equip NIST to provide effective cybersecurity
guidance to organizations?
Mr. Lee. Well NIST does an amazing job, as you well know.
And they provide, you know, great guidance that can form the
basis of many of these enforceable standards that we are
talking about. You already have some States now that are trying
to make that easy to do. And if you do that, then you are
relieved of some obligations and some liability under State
law. So NIST is a great partner for what we have been talking
about today. If we empower the FTC, the way it needs to be
empowered, with the resources, with the personnel and with the
mandate, it has to be in concert with NIST.
Senator Moran. I am also an appropriator for the FTC. Let
me ask, maybe this is for Ms. Tummarello. Our data--our
Consumer Data Privacy Act, Privacy and Security Act, we try to
scale the requirements based upon size, complexity, and the
resources covered--resources of the covered entity or provider,
as well as the sensitivity of the data. Tell me, in formulating
comprehensive data privacy policy, how can Congress properly
calibrate the data security requirements to ensure that tech
startups aren't harmed, that we don't stifle innovation?
Ms. Tummarello. Thank you for the question, Senator, and I
appreciate the focus on not stifling startups' innovation. I
think, you know, a guidance would have to be--requirements have
to be nimble. And I think the suggestion of having the FTC
issue annual guidance is a good one. Something that allows not
only the cybersecurity threat landscape evolving, taking that
into account, but also kind of the capabilities of startups. As
those both evolve, the guidance will need to change. And so
giving the FTC rulemaking authority and then a requirement to
issue updated guidance annually or something like that would be
a huge step to provide startups clarity but also evolve with
changing technology.
Senator Moran. Maybe there is a point that you are making,
which I would highlight, at least for me and others, is not
just the nature of the regulations, not just the magnitude, but
also the certainty. Certainty is hugely important. On this
topic of certainty, as you and others may know, I have been
engaged in negotiations, which I have answered every press
person's question and every interested party's question that we
are this far apart on getting something done.
But I have been saying that now for 2 years. I think what
we heard yesterday, what is going on in the country, the
states' enactment, international activity means that our work
is more important maybe than it was when we started it. So the
crux of the challenge is a desire for certainty and a
nationwide standard. And then the other kind of issue that
comes together is a private right of action. So the two things
that keep pulling us apart are these two.
I would ask you, Ms. Tummarello, is there something that
can be--that would be satisfactory, in--if the certainty of a
national standard was provided, preemption, what is the ideas
that we ought to be discussing to try to find common ground on
the issue of liability or private right of action?
Ms. Tummarello. Thank you. I think, you know, private right
of action does get to the certainty question. It is not just--
--
Senator Moran. They are not separate. You are right.
Ms. Tummarello. Yes. And so having courts across the
country issue different rulings is a huge issue that creates
another patchwork for startups to comply with. And that is--
that is kind of baked in to needing certainty. So I think there
are ways to scope a narrow private right of action, especially
around, you know, things like whether or not they have had
notice and the opportunity to fix the problems. If there are
specific harms, we are worried about making sure that is what
the private right of action is focused on.
There are ways to scope it such that you mitigate the
chance of bad faith litigation. But startups are especially
vulnerable to bad faith litigation. We see it in other
contexts, especially around intellectual property. And so
making sure Congress is trying to put guardrails on a private
right of action, I think is really critical.
Senator Moran. I was going to ask others this similar
question, but I am happy to do that, although my time has
expired. And I don't know whether Senator Markey has become the
Chairman of the hearing or not.
STATEMENT OF HON. EDWARD MARKEY,
U.S. SENATOR FROM MASSACHUSETTS
Senator Markey. Yes, through a miracle of a paucity of
attendance, the chairmanship has devolved to me for a very
brief, a fleeting moment in time.
Senator Moran. And for which you have a conflict of
interest because you are the next Senator to ask questions.
Senator Markey. And I recognize myself for as much time as
I might want to consume on this incredibly important subject.
So let me ask--you know, questions I have asked over and over
and over again because any comprehensive cybersecurity regime
must address the unique challenges created by the Internet of
Things, the IoT.
And the Internet of Things includes all of the Internet
connected devices increasingly prevalent in our everyday lives,
such as connected refrigerators, laundry machines, dryers, baby
monitors, smart locks with as many as 75 billion, can I say
that again, 75 billion Internet of Things devices projected to
be in our pockets and homes by 2025. The Internet of Things
will also stand for the Internet of threats, until we protect
this omnipresent technology from hacking and cyber intrusions.
That is why I introduced the Cyber Shield Act with Congressman
Ted Lieu, legislation to create a voluntary--can I underline
that--voluntary cybersecurity certification program for
Internet of Things devices. Our bill establishes an expert
advisory committee to create cyber security benchmarks for
Internet of Things devices.
Manufacturers can then voluntarily certify that their
products meet these benchmarks and display this certification
to the public with a Cyber Shield label akin to the Energy Star
for energy efficient appliances that will help consumers
identify and purchase more secure technology. I am very proud
that President Biden included a new Internet of Things labeling
pilot program that mirrors my Cyber Shield Act in his May 2021
Executive Order on cybersecurity.
Dr. Felten, do you agree that we should make an Internet of
Things labeling program a permanent component of our Nation's
cybersecurity safeguards by passing my bill?
Mr. Felten. Yes, I think having a permanent program of that
nature would be--would certainly be helpful. There is an old
saying that the problem with many of these devices is you can't
tell if it is secure by looking at the box. And having a label
that can be on there that consumers can recognize and having
people be able to count on that into the future would be
valuable.
Senator Markey. OK, great. And Ms. Tummarello, same
question. Would that labeling program be helpful?
Ms. Tummarello. Yes, absolutely. And I think the fact that
it is voluntary is appreciative. And then it would allow
startups to compete on security and privacy by saying we are
certified, which could make it easier for them to get in
consumers' hands. So I appreciate the idea.
Senator Markey. Yes, and you know, an energy star works.
People can just see, oh, it is less expensive, and I get less
efficiency out of this energy device as well. Or when you are
buying a car and say, oh, it is only has two stars for safety
and I have three young kids, maybe you have a car that has
three or four or five stars here. You know, let me see. Just so
you can have that kind of transparency.
Well, the same thing is true for all Internet of Things
devices. People are just going to want to know and then they
can make up their own minds. It is all voluntary. But at least
they have the transparency of the information that allows them
to make the decisions to protect their children or protect
their own privacy by buying a higher standard. But just leaving
it to an individual consumer to figure that out is obviously
ultimately going to be very difficult to navigate. And I am
also particularly concerned about cyber threats to children and
teens' data. And that is why I reintroduced my bipartisan
update to the Children's Online Privacy Protection Act.
The bill includes key data security protections to help
kids and teens safely navigate the online ecosystem.
Specifically, my legislation would require children's websites
and apps to employ strong safeguards against hacks, require
kids connected devices to meet robust cyber security standards,
and require manufacturers to clearly communicate to consumers
how they are protecting kids' data. So, Ms. Rich, do you agree
that we should enact heightened cybersecurity protections for
children and teens online?
Ms. Rich. Absolutely.
Senator Markey. Yes. Thank you. Dr. Felten, same question.
Mr. Felten. Yes.
Senator Markey. Ms. Tummarello?
Ms. Tummarello. Yes, as long as we are not encouraging
general audience services and products to collect more
information to try to suss out if they have children. As long
as this is child directed, I think that makes sense.
Senator Markey. Child directed. Yes--Mr. Lee.
Mr. Lee. Absolutely.
Senator Markey. Yes. Thank you. And so again, that is why
Senator Cassidy and I have introduced this legislation. We just
carve out a special category of kids, provide them the
protections, and what we do with adults, we will see, you know,
but at least for children, they should have that safe harbor,
you know, to grow up and not be concerned, especially parents,
what is happening to the kids. So thank you. Let me turn and
recognize the Senator from Florida, Senator Scott.
STATEMENT OF HON. RICK SCOTT,
U.S. SENATOR FROM FLORIDA
Senator Scott. Thank you, Chair--are you Chairman Markey--
are you the Chair?
Senator Markey. I have the title for a brief period of
time. I am like--I am like King John waiting for King Richard
to return from the Middle East. So for the time being, I have
it, yes.
Senator Scott. Thank you. Recently, the Biden
Administration and Democrats in Congress have embraced a
radical new policy that should terrify every American. Under
Joe Biden's America, the Federal Government's authority would
be vastly expanded, so the IRS would get a look at any account
over $600. The madness doesn't stop there. This new rule from
Joe Biden will also require banks to report every transaction
of $600 or more. I completely oppose this disastrous proposal
full stop. But to make matters even worse, the Federal
Government can't even be trusted to keep the data it already
collects safe. As we all know, in 2016, the IRS was the subject
of a massive data breach.
Now, President Biden wants the IRS to have a data on the
financial transactions that nearly every American family. You
might expect this would come from communist China or Cuba, but
a surveillance state is not something we should put up with in
the United States. I have never--I have only been up here two
and a half years, I have never gotten as much feedback from my
constituents. I have heard from more than 18,000 Floridians on
this issue alone in 2 weeks.
So here is my question. Do any of you believe the Federal
Government is adequately prepared to protect the private
financial information of millions and millions of Americans in
a massive expansion of its current data holding capacity? And
how can we expect hackers to not have a field day if the IRS,
which is already a woefully unresponsive--is woefully
unresponsive as a Federal agency gets this new authority? So
what do you all think?
Ms. Rich. I am not an expert on Government security. I
really worked on commercial area. But being a victim of data
breaches affecting the Federal Government as a former
Government employee and also working in an area where you know,
we observed a lot of Government security problems, I do have
concerns about the Government's ability to safeguard data.
Senator Scott. How about everybody else?
Ms. Tummarello. Yes, I think there are concerns across the
board about the Government's availability to safeguard data.
Senator Scott. Anybody feel comfortable with all your data
being held by the Federal Government? Come on. There is no
yeses, I guess. Alright.
Ms. Rich. I think we said yes.
Senator Scott. Every company looking to communist China is
required by law to turn over any information their communist
Government demands. How can we be sure that data stored in
companies based in adversarial countries like communist China
is protected?
Mr. Felten. There is a limit--there is a limited amount we
can do, if anything, to protect that data. So we should
absolutely be concerned about where our data is going, and what
protections exist. They are both under the local law, but also
in practice in those places.
Senator Scott. Anybody else? So what limitations we put on
American tech companies that do business in communist China to
make sure that information about Americans stored in a foreign
country--what sort of limitations do you all recommend?
Ms. Rich. I would--if you decided to regulate American
companies and they stored U.S. data abroad, I think technically
there are legal theories for--that they need to protect that
data even if it is kept abroad. Implementing that, bringing
enforcement against them for that is the more difficult task.
Senator Scott. Anybody else? Thank you.
Senator Markey. So thank you, Senator Scott. And I think
Senator Rosen is----
Senator Rosen. I am here, Senator Markey----
Senator Markey. I recognize the Senator from Nevada.
STATEMENT OF HON. JACKY ROSEN,
U.S. SENATOR FROM NEVADA
Senator Rosen. Thank you so much, Mr. Chair, appreciate it,
and like my colleagues before me, everyone is trying to work on
this issue, so I don't want to hoarder some of the bills that I
have introduced to enhance data security. I would like to just
address one. They are aimed at strengthening our cybersecurity
capacity, providing cybersecurity resources, education to small
businesses, to schools, local Governments. So like I said, one
such bill I have Improving Telework Cybersecurity for Small
Organizations Act. That would work to strengthen the
cybersecurity capacity of small organizations to defend against
telework related cyber threats through collaborative guidance
and support from CISA and the FTC. We know telework, of course,
has increased so much because of the pandemic, and I think a
lot of that is here to stay, so I just want to bring that up.
But we also need to think about protecting our data through
our cloud services because as more and more of us have to store
data, we want to keep it safe and secure. Adopting cloud
services we know can strengthen data security. It is going to
provide a more resilient source of data sourcing. 90 percent of
companies that have taken advantage of these benefits, and they
are now on the cloud. But while migrating to cloud services
provides a more resilient source of data hosting, it
concentrates critical data, maybe in a small number of
entities.
Last week, leaders in the cloud computing industry created
an initiative aimed at establishing trusted cloud principles,
basic commitments and protections for companies to store and
process their data on the cloud. So Mr. Lee and then Dr.
Felten, can you discuss the unique data security challenges
facing the cloud computing industry? Mr. Lee, first.
Mr. Lee. Thank you for the question. It is an issue for
victims because increasingly, as we do move to the cloud, not
every organization has the same level of robust security in
place. So any effort to have more uniform standards around what
you need to do for security would be welcome. I noted in our
report from the--our data breach analysis from this last
quarter, nearly 100 million individuals were impacted by the
fact that organizations failed to add a password to their cloud
environment.
It is basic blocking and tackling in many cases that
compromises people's information. It is the lack of basic
blocking and tackling, if you will. So it is an important
issue, and it is something that needs to be addressed in a way
that is enforceable. So if someone does fail to add that
password, not very tough, but at least add that password, then
if they fail to do that, there should be some enforcement
action.
Senator Rosen. Good cyber hygiene always helps. Thank you.
Dr. Felten, could you address some of the unique challenges,
and then I want to move on to talk about some resiliency and
redundancy issues in the cloud.
Mr. Felten. Sure. There are a lot of advantages to
organizations, especially smaller ones, relying on cloud
services rather than trying to do things in-house. As you said,
it does concentrate some of the vulnerability, but cloud
companies can be central to sources of more cybersecurity
expertise and better practices. They can really--they can
really give the issue the attention that it needs.
The kind of standards and coordination that you talked
about, I think, are really important to make sure that not only
that the companies are--the cloud companies are doing what they
can, but also their clear expectations about what the
responsibilities of the cloud company versus their customers
are so that things don't fall in between and get neglected.
Senator Rosen. Thank you. Because I want to move on again,
Dr. Felten, with the security implications again of a
concentrated cloud service market. We not just have--we don't
just have cyber security but also have physical security. I
want to remind people the cloud is not really in space. The
cloud is often warehouses and warehouses of servers, and so we
have physical security to worry about. So how do we build
resiliency and redundancy to minimize downtime and outages, not
just in the cyber space for the cloud, but also perhaps in the
physical space?
Mr. Felten. Sure. And as you know, there is no simple
recipe for this. Redundancy is especially difficult when you
are operating at this very large scale because you don't have
much opportunity to try it out. It is an area that the largest
cloud companies are putting a lot of attention into. They don't
always succeed. We saw downtime from Facebook this week that
was due to exactly the kind of failure that you were talking
about.
So even the biggest and most sophisticated companies don't
always get this right. I do think it is something that needs
attention from the companies. It is an area where Government
has expertise about defenses and about the threat landscape,
which can be really valuable. And so there is a role that
Government can play as well in helping companies to figure out
how to be as resilient as they need to be.
Senator Rosen. I think you are exactly right. Things like
parallel processing, mirror image systems, those things can
really help. Thank you all for being here today and I see my
time is up. Thank you, Mr. Chair.
The Chair. Thank you, Senator Rosen. And thank you for that
line of questioning. I know we have several other members who
still want to ask questions and are on the way from the vote,
so I am just going to ask a second round while we are waiting
for those senators to show up and then hopefully you guys can
go on your way. I know it is been a long morning already and I
know it is a little chilly in here.
I wanted to go back to Senator Cruz's question. You know,
he was asking about other Federal agencies and our own data
security issues. And I know now a couple of members have had
discussions with you around NIST. So one, why isn't the FTC
just good guidance for the rest of the Federal Government as it
relates to data security? I mean, I look at NIST as a standard
setting, but they are certainly not the policeman on the beat,
and we are not asking the FTC to be the policeman on the beat
for all of the Federal Government, but I guarantee you are
definitely not going to get that out of NIST.
So here we have this burgeoning issue of cybersecurity for
us as a nation, and we need to build our own capacity. We need
to build our own capacity of a very technical, skilled team.
And if you ask me, I have found that there are people in the
boughs of organizations who are very, very technical. And then
I know people at the very high ends of operations in various
aspects of the Federal Government who are also very
knowledgeable and very technical. But I see a gulf of people in
between who aren't.
And that is the most frustrating thing. So could the FTC--
what do you see this role--do you--are you back to this notion
of we are just going to have to find somebody else to be the
Government enforcer here to make sure that agencies are doing
the oversight?
Ms. Rich. I think what I meant wasn't that the FTC can't
provide guidance. In fact, the FTC has been brought in by OPM
and OMB to help when there have been breaches to deal with the
aftermath because of their expertise. But so I think the FTC
could work with NIST to provide guidance for the Federal
Government and there may be others, you know, cybersecurity
folks that would participate in that too. What the FTC can't do
is make the other agencies follow it because it is just a
lateral agency.
And I was in the trenches long enough, with squabbles
between the agencies and to know that that is just not
workable. But the FTC could certainly help provide leadership
and guidance that OMB could then push down to the agencies.
The Chair. OK. Anything else, Dr. Felten on that? So
another point that was brought up. So, Ms. Rich, on--when
consumers have been harmed, you believe in their common law
rights to sue and to have damages and--correct?
Ms. Rich. I generally do believe that, absolutely. But I am
speaking, you know, practically about--because it is been such
an intractable issue that if you have a really strong law,
sufficient resources to enforce it, 50 State AGs on the beat
too, that that would be a very good outcome, much better than
we have now and could mean we don't need to have a private
right of action, especially since private rights of action can
complicate an already complicated issue.
The Chair. Well, I would beg to differ on that from a
global perspective. I think yesterday was a perfect example of
how you can--if you don't have real damages that someone is
going to feel in these situations, you are going to have a lot
of behavior that just continues. And just like on the data
security side here, we again, Mr. Lee has been very crisp and
clear about the amount of damage that is being done to
consumers.
But when you think about these organizations across the
board, they are not paying the price. I guarantee you that
Equifax had nowhere near the damage done to it as the
individuals did, if you were looking at it in a comparison. I
mean, when people lost their homes, lost their jobs, lost their
health care, lost these things, it has been pretty significant.
So I would just hope that we will certainly get to you with
some questions about what you meant on those middle ground
issues. But I am going to turn to my colleague, Senator Peters.
STATEMENT OF HON. GARY PETERS,
U.S. SENATOR FROM MICHIGAN
Senator Peters. Well, thank you, Madam Chair. Thank you for
this hearing and a very important discussion. I want to thank
each of our witnesses for being here. First of all, I just want
to echo my colleague's calls that we have heard here in
committee for increased reporting on data breaches and how
important that is. Actually, just moments ago, where I just
came from, the Homeland Security committee where I chair, we
just marked up a bipartisan bill that I sponsor that would
require certain entities to report substantial cyber incidents
to CISA. And included in that, of course, are major data
breaches.
I certainly think this bill will address some of the
challenges that have been mentioned today, although we know
there are many more. I have also introduced legislation in this
committee, the Data Broker List Act, which would require data
brokers to have in place comprehensive information security
systems to prevent those data breaches from happening in the
first place. We want to be on the front end, certainly.
My first question is for Mr. Lee. When we think about
ransom attacks, we know that they have become increasingly
common, and data security legislation has to certainly limit
these illicit acts. As an example, in 2020, Ukrainian hackers
targeted a health care company with locations throughout Monroe
County in Michigan, and in order to unlock stolen patients and
financial data, they had to pay over a $30,000 ransom.
So my question for you, Mr. Lee, is, can you give me
examples of data security standards that would have the most
impact in trying to prevent ransomware attacks from occurring
in the first place? What would you suggest that we really focus
on?
Mr. Lee. It really all begins with, let's prevent the data
breach because ransomware attacks are fueled by data that has
already been stolen. So if we can prevent that from ever
happening for the most part, then you are going to have a
tremendous impact downstream. You won't have as many ransomware
attacks.
You will still have them because there is multiple ways of
doing it, but you won't have what you have today where largely
ransomware attacks are committed because someone has a log in
and a password and can infiltrate a system, or the SolarWinds
attack, which was because of a administrator's password that
had been acquired.
And then it was a weak password to begin with, so that
didn't help. So if we can prevent those breaches from ever
occurring because of stronger cybersecurity standards that are
enforceable, we will get to ransomware.
Senator Peters. Well, that is good to hear. Well, my bill,
the Data Broker List Act, would require data brokers to have in
place a comprehensive information security system to mitigate
that risk that you mentioned, Mr. Lee. And because of the role
that data brokers play in today's data marketplace, it seems to
me it is critical that regulations address their storage, their
use, and certainly as you mentioned, the security of their
data.
Ms. Rich, how do you believe data brokers should be
addressed if we are looking at comprehensive data security
legislation? Could you be specific about data brokers?
Ms. Rich. The opposite--in the same way that that Dr.
Felten talked about social networks, it being a matter of
degree because they have so much data, the same can be said
about data brokers and their whole business is data.
So they have got a lot of it, and they have to, in terms of
scalability, they would be at the top of the scale of
protecting information because they also have a lot of
sensitive data. Of course, for data brokers, privacy is a
critical issue too. I mean, just as critical.
You know, when can they--what kind of vetting do they need
to do? Who can they sell the data to? Are they sure when they
got the data that it wasn't subject to, you know, controls, et
cetera? So privacy is a huge piece of the data broker story as
well.
Senator Peters. And a follow up to that, what other tools
that we could provide to the FTC to actually enforce standards
that are in place for data brokers?
Ms. Rich. If there were standards in place for data
brokers, then all the tools that the Chair Cantwell is trying
to provide to the FTC, more resources for technologists, for
attorneys, for this new privacy bureau would be extremely
valuable--essential. But there need to be standards in place
because there aren't any.
Senator Peters. Yes, you have to start with standards, but
you also have to make sure those standards are followed and
enforcement. It is a two-step process that is both critical, as
you well know. Well, the Michigan patients that had their
financial data stolen, as I mentioned earlier in my comments,
were given free credit monitoring service after that, but their
data obviously was already compromised, already a big issue.
So, Mr. Lee, I know you noted in your testimony a study by
the University of Michigan that showed that we are not
equipping victims with the information needed to protect
themselves. What are some of the most effective ways in your
mind to support victims of these identity crimes? Is there
something we are not doing now that we should be thinking
about?
Mr. Lee. Well, first of all, we should be more transparent
in what we tell people. The Michigan study, along with the
Carnegie Mellon study, make it very clear that the--literally
the language we use in the notices is so dense, people don't
read it.
Senator Peters. Right.
Mr. Lee. They don't even realize that they have been
breached not once, not twice, three and four times, and they
don't know it. And so they basically they don't do anything.
There are very basic steps that people can take that we should
tell them about, but we don't. And we are not--because of the
patchwork of State laws, each one being a little bit different,
each one has a different form and both substance, so something
as simple as, while credit monitoring is great, a credit freeze
is better because a credit freeze means no one can open an
account with your information. They can't--they cannot incur
debt on your behalf.
A credit monitoring, while it is helpful, it tells you what
has happened. The horse is out of the barn. We don't need just
that. We need a lot more robust kinds of information and--that
we give to consumers. We give to victims. And we need to do it
ahead of time, too. So that is a different conversation, but
the whole concept of a victim support structure that is lacking
in this area of identity crime--we can prevent a lot of it, and
we can equip people to prepare them for it when it does happen.
Senator Peters. Right. Thank you. Thank you, Madam Chair.
The Chair. So do we have Senator Warnock, remotely? OK. And
we still may be waiting for one more senator. I wanted to ask
you, Ms. Rich, on your testimony, written testimony. I am not
sure if you mentioned it in your oral testimony. You were
talking about common carriers being under the FTC instead of
the FCC. Would you elaborate on that?
Ms. Rich. Well, I didn't say instead. I didn't say that.
But I do----
The Chair. OK--on privacy and data.
Ms. Rich.--I do believe that it would be important to
create a level playing field, both for consumers and for
businesses, if you have a data security law. And so for that
reason, covering non-profits and common carriers and allowing
the FTC with the new resources you are giving it to bring
enforcement would be very important. As to the FCC, I don't
think they have been particularly active in the data security
area.
I mean, if you were going to switch it over, I would have
to look at a provision and give--you know, see whether it would
reduce any protections that exist now. But I don't think this
has been an area where the FCC has been active or has
particular expertise. I think the FTC could do an amazing job
with the resources you are going to give it on data security--
and the authority you are going to give it on data security.
The Chair. Dr. Felten.
Mr. Felten. I agree. The FCC is good at what they do, but I
think having that--having that level playing field and allowing
the FTC to not face these sort of artificial boundaries in how
it does enforcement, would be valuable.
The Chair. Mr. Lee, did you have any comment on this point?
I know it might not be your area, but you might have seen cases
in here. No. OK.
Mr. Lee. No.
The Chair. Alright.
Mr. Lee. Thanks for asking though.
The Chair. Thank you. Well--.
Ms. Rich. Could you give me 30 seconds to just address the
private right of action, again?
The Chair. Yes.
Ms. Rich Because I think you think I don't care about
consumers and their rights. My point was just that the if you--
with the proper resources and authority, the FTC and the states
could also represent consumers and get money back for them,
redress, civil penalties, whatever is appropriate, if the law
is strong enough and it gives the remedies. That was my point.
The Chair. So again, not to put words in your mouth, but
you are saying, yes, if consumers are harmed, they should be
able to get actual damages. The question is what process should
they be able to get actual damages?
Ms. Rich. Yes.
The Chair. And so I think that is going to be a big
discussion point among us as well. And so I really appreciate
your input on it. So but I just I didn't think that you didn't.
I just wanted to make clear that this actually is the issue.
And when you look at yesterday, you, in my opinion, you look at
how do you create bright lines within big organizations, how do
you have out there in the public and within these companies,
because you don't have a CFO or CTO or even the general counsel
running around every day saying these are the do's and don'ts,
but you do, if there is a strong law, and you know that the
company can be held accountable for it. That is the kind of
thing we are looking for.
And we have to build in--as my colleague, Senator Klobuchar
was saying, this is like an entire growth area of our economy.
And we want it to succeed. I sit here and listen to--there are
a lot of good algorithms, trust me. A lot of--there are a lot
of algorithms that are helping us even today. So yes, now we
have a lot of people who are going to understand what
algorithms are all about. But the point is, we have to have
some bright lights--bright lines here.
And as much as I want a powerful FTC, I think that Europe
still fails to get the job done. We kind of know what that
looks like. We can see what the European model is
accomplishing, and we can see that it has shortcomings. So we
know this, that as Mr. Lee was saying, that if you can have
these people be accountable to their--the damage, the same kind
of damage that is being done to consumers, you are going to get
a better response in policing them. And the information age is
going to continue to change.
So this committee has been very prescriptive. I would say,
for 15--the amount of time I have been on this committee, very
prescriptive. So that is where it has gotten us. So the
information age is growing by leaps and bounds and each little
sector we have tried to be prescriptive, and I would say, have
we accomplished what we have wanted to accomplish? I would say
no, given Mr. Lee's data and given what we just had yesterday.
I would say we need something stronger. We need a very bright
line on accountability. But anyway, we will get to this
discussion with our colleagues.
And hopefully--I think the one thing people who have been
watching these hearings will see is that we have a very engaged
committee. And it doesn't matter how many cameras are outside
that door, OK, because you had a lot of people here and a lot
of people last week asking and knowing the subject area. They
are drafting or have drafted legislation in this area.
Practically every member of the Committee has been on one
form or another of these legislations. So I do think the moment
is here. And again, just thank you all for your expertise. This
is very, very helpful. And I think that hopefully our
colleagues will come together at this moment, and we will be
able to get some legislation to help bolster and protect
consumers.
So with that, the hearing record will remain open for 1
week until October 13, 2021. Any Senators who would like to
submit questions for the record should do so by that date. We
ask that responses be returned to the Committee as quickly as
possible, but no later than October 27, 2021. So with that, the
hearing is concluded.
[Whereupon, at 12:24 p.m., the hearing was adjourned.]
A P P E N D I X
Response to Written Questions Submitted by Hon. Amy Klobuchar to
James E. Lee
Cybersecurity Literacy. We must educate Americans on how to
identify and react to cyber threats. For example, it's important for
everyday Americans to be able to identify a phishing scam. 91 percent
of all cyberattacks begin with a phishing e-mail. My bill with Senator
Thune, the American Cybersecurity Literacy Act, aims to improve
cybersecurity literacy by requiring the National Telecommunications and
Information Administration to conduct a cybersecurity literacy campaign
to increase knowledge of best practices to reduce risks.
Question 1. In your testimony, you note that phishing attacks are
the most common form of cyberattacks. Can you speak to the importance
of educating Americans on how to identify and avoid cybersecurity
threats?
Answer. Thank you, Senator Klobuchar. As the only national non-
profit that directly supports identity crime victims and provides
education resources to help consumers from becoming victims (all
provided free of charge), the ITRC could not agree more with your
statement and the goal of your bill with Senator Thune. While the focus
of the October committee hearing was to improve cybersecurity as a
means of protecting consumers and businesses, the reality is much more
is needed, including a comprehensive and sustained effort to both equip
consumers with the tools needed to protect themselves and support
services when their identities are compromised and/or misused.
Since the committee hearing, the ITRC has published research that
shows consumers and small businesses are repeatedly victimized at an
alarming rate. Yet, only three percent (3 percent) of consumers take
the most effective action to protect themselves from identity crimes:
freezing their credit or using different passwords on every account--
even though nearly 80 percent of consumers admit they know about credit
freezes, and only 15 percent claim they have unique credentials for
every online account.
More than one million consumers come to the ITRC's website each
year to learn about the latest identity scams and how to avoid them or
recover from them. We would welcome the opportunity to help even more
people avoid becoming a victim. Providing the NTIA with the ability to
award grants to organizations that provide identity protection, without
charge, would be a welcome addition to the victim prevention landscape.
______
Response to Written Questions Submitted by Hon. Kyrsten Sinema to
James E. Lee
State Privacy Laws. Like many states, the Arizona state legislature
has considered implementing a consumer privacy law. Three states--
California, Colorado, and Virginia--have enacted their own privacy
legislation.
Question 1. Do you believe Congress should enact a national
consumer privacy law? If so, what are the key elements of a Federal
data privacy law to protect Arizonans, especially in regards to data
security?
Answer. Thank you, Senator Sinema, for the opportunity to expand on
the ITRC's earlier testimony.
In short, the ITRC believes identity crimes and, as a result, the
number of identity crime victims would be reduced with the adoption of
comprehensive, enforceable data security and privacy standards. As you
note, states are already adopting a unified approach that combine
privacy and security protections into a single legal framework. In the
absence of a Federal law, states will continue to adopt their own
standards resulting in the same inefficient patchwork of laws we see
today with data breach notice requirements. I would point you and the
staff to our response to the Minority members' questions where we
provide a detailed discussion of state laws.
The result of the state-by-state efforts is identity crime victims
having different protections and different remedies to the same event
depending on where they live. As we pointed out to Senator Wicker,
without a uniform national definition of what is considered ``personal
information,'' a resident of Mississippi whose passport, military ID,
or biometric data was breached would not be required to be notified of
a compromise of that information, yet someone across the state line in
Alabama would because the two states define personal information
differently.
The ITRC believes the core elements of any national privacy law can
be found in the California, Colorado, and Virginia state laws: Right of
Notice, Right of Access, Right to Delete, Right to Correct, and Limited
Right to Opt-out, and Data Minimization. We also believe consumers are
well served by mandatory privacy and security audit provisions found in
the new state laws as well as the cybersecurity regulations of the New
York Department of Financial Services (23 NYCRR Part 500--
Cybersecurity). There should be a robust penalty provision for
violations balanced with incentives for compliance--a Safe Harbor for
good faith efforts to comply, for example.
Question 2. How should a Federal data privacy law interact with
state data privacy laws?
Answer. The ITRC believes that identity victims and the public at
large are best served with strong, enforceable minimum standards at the
Federal level. However, technology in general and cybercriminals in
particular move faster than Congress can respond with new laws.
Allowing states the flexibility to rapidly respond to new and emerging
threats is important to ensure consumers and businesses are well
protected.
FTC Resources. Unfortunately, Arizona schools, hospitals, and
companies have been the victims of cyberattacks that have resulted in
the release of personal information. Since 2005, data breaches have
cost Arizonans at least $1.6 billion.
Question 1. Considering the costs of these cyber incidents to
Arizona and the Nation as a whole, what are your thoughts on providing
additional resources to the Federal Trade Commission (FTC) to enforce
existing Federal data privacy laws?
Answer. As a long-time partner of the FTC to whom the Commission
refers complex identity crime cases for victim support, the ITRC
supports providing the FTC with a clear enforcement mandate and the
additional resources needed to fulfill its mission. We also believe
there is an equally important opportunity to improve support services
for identity crime victims by giving the FTC grant-making authority and
funding.
Question 2. If you believe that additional funding is warranted,
what is the appropriate amount of additional funding for FTC
enforcement? Should that number be based on whether Congress passes
legislation related to data privacy or data security?
Answer. The ITRC is not in a position to advise the Committee on
the appropriate level of funding, but we do believe additional funding
is required to adequately address the issues at hand. However, the need
for additional enforcement and victim support should not be contingent
on a Federal privacy and/or security law. The need for both enhanced
enforcement and victim support is justified by the increasing number of
cyberattacks, cyberbreaches, and business and individual identity crime
victims.
Question 3. If a data breach involving their systems occurs, what
types of services should companies provide to their consumers?
Answer. The ITRC believes that the current data breach notification
system is ineffective and inadequate as we have noted in previous
testimony and in response to questions from other Committee members.
This includes the remediation services most often offered to victims.
However, the ITRC believes the most effective actions breached
organizations can take to help victims include the following, several
of which can be accomplished at no cost to the breached business:
Consumers should be advised to freeze their credit with the
credit reporting agencies and take the same action for their
minor children. Credit monitoring offers no protective
benefits.
Businesses should force password resets for all impacted
accounts and victims should be advised to reset passwords on
every account with a unique, strong password using a password
manager if needed.
Businesses should provide identity remediation and
restoration services in addition to credit monitoring for a
minimum of five (5) years that should be renewed for an
additional five years if there is evidence of identity crimes
resulting from the compromised data.
Beyond the breach notice, businesses should provide access
to comprehensive identity protection education and remediation
resources from independent sources. Research shows some
consumers are deeply skeptical of paid services offered by
providers affiliated with a breached organization, so offering
a self-help or independent alternative is important.
The ITRC also recommends the form, substance, and delivery channel
of breach notices should be reviewed in light of the emerging body of
evidence that consumers are not taking appropriate post-breach
protective actions. The current trend of businesses using website
notices, news releases, or AGs notices instead of direct notices to
consumers is having a detrimental effect on consumers and is increasing
the risk of a ransomware attack or other compromise due to poor
password management, especially at small businesses.
By way of explanation, the nature of identity crimes makes it
difficult to craft ``one-size-fits-all'' solutions for victims which
increasingly include small businesses and solopreneurs. The current
practice of providing credit monitoring for one or two years is
helpful, but not always adequate or effective. (Some states require
credit monitoring for varying periods of time depending on the company,
while some states do not require any monitoring or remediation be
provided to consumers.)
Identity crimes, though, have a long tail where the compromised
data can be used multiple times by multiple criminals over a period of
years that may extend well beyond the monitoring period. As of 2021, 29
percent of victims contacting the ITRC were repeat victims who would
not be protected by a one-year credit monitoring protocol.
Since the October Committee hearing, the ITRC has published
research that shows more than 70 percent of adult consumers have
received a data breach notice, yet only three percent (3 percent) take
the most effective step needed to protect themselves from future
identity crimes--a credit freeze. Sixteen percent (16 percent) take no
action at all; Forty-eight percent (48 percent) only change the
password on the account that has been compromised--even when 85 percent
of consumers admit they use the same password on multiple accounts.
Research from Carnegie Melon University shows that most consumers
replace a breached password with a weaker password, too.
Compliance Costs. Some tech companies have the resources to employ
large numbers of compliance staff to ensure they are following national
and state regulations. Many Arizona small businesses do not have access
to comparable resources.
Question. How can we craft a Federal data privacy law that does not
put small businesses at a disadvantage while still offering consumers
strong data security protections?
Answer. The ITRC believes that adopting a strong, enforceable
minimum standard will help small businesses--especially those who
already commit to provide data and privacy protections for their
customers, prospects, and employees--by leveling the playing field.
Much of the inefficiency (and risk) in the current system is based on
the patchwork of state and industry self-regulation requirements or
lack thereof. Adopting a uniform, but enforceable, minimum standard
ensures all small businesses play by the same rules. Minimum standards
should take into consideration unique risks based on business size,
data type, use, storage, and sharing/selling.
New businesses, in particular, should be encouraged to collect and
maintain the least amount of data needed, thereby reducing the risk
landscape.
______
Response to Written Questions Submitted by Hon. Raphael Warnock to
James E. Lee
Identity Theft. Every year, millions of Americans become victims of
identity theft, costing them sensitive and private information and
millions of dollars. Georgia has the seventh highest rate of reported
identity theft in the country, and many incidents of these identity
theft incidents stem from some type of data breach. In addition to the
financial harm to working families, identity theft can also prevent
these same families from accessing government resources to get them
back on their feet, like stimulus checks, unemployment insurance, or
child-tax credits. Although many states have their own resources and
regulations to protect Americans from identity theft, I believe there
is more Congress and the FTC can do to prevent identity theft and
assist victims in recovering.
Question. What is the single most important thing Congress can
include in legislation to protect victims of identity theft?
Answer. Thank you, Senator Warnock for the opportunity to talk
about the need to assist identity crime victims.
Without a doubt, Congress can and should play a more active role in
protecting identity crime victims. While the Committee is rightly
focused in this proceeding on preventing identity crimes through data
and privacy protections, these actions will only address half of the
problem. By definition, though, there will still be identity crime
victims who need support and assistance to recover from identity
compromises like a data breach or identity fraud that results in the
denial of a needed resources such as unemployment benefits.
Based on the most recent FBI, Department of Justice, and FTC
statistics, there are more identity crimes (and crime victims) per year
than all violent crimes combined. With a 29 percent revictimization
rate, identity crime victims find themselves the subject of subsequent,
repeat crimes more than any other offense types.
Yet, identity crime victims are not eligible for crime victim
assistance funds from the Office of Victims of Crimes (OVC) programs.
Identity crimes are not specifically tracked by the Bureau of Justice
Statistic. Only 11 states allow victims to pursue private legal actions
in the wake of an identity crime (AK, CA, DC, LA, MD, MN, NH, NC, SC,
TN, and WA). In the past decade, the Federal government has provided
less than $10M dollars in three budget cycles for identity crime victim
assistance. No state provides dedicated funding to identity crime
victim assistance. Absent additional, dedicated resources from
government and the private sector, there exists the very real
possibility of no free, direct consumer support offerings in the next
several years.
Direct identity crime victim assistance is available from only a
handful of organizations--most of which are for-profit organizations.
There is only one non-profit organization offering nationwide no-cost
victim assistance, consumer and business education, and government
agency tier-two support--the ITRC.
The ITRC believes Congress should pursue a model for addressing
identity crimes that has proven to be successful in other areas of law
enforcement. Specifically, the fusion center model adopted in the wake
of the September 11, 2001, terrorist attacks.
A virtual Identity Fusion Center (IFC)--or ``one-stop shop''--for
addressing identity crimes and supporting identity crime victims would
link local, state, and Federal agencies along with private sector
entities such as data brokers, credit bureaus, financial institutions,
and victim assistance groups like the ITRC in a single, virtual hub.
Through a triage system, crime victims and curious consumers could
contact the IFC to obtain advice or direct assistance from the
appropriate agencies across multiple jurisdictions and geographic
regions as well as non-profit and private sector organizations.
The ITRC is available to discuss this concept at your convenience.
______
Response to Written Questions Submitted by Hon. Roger Wicker to
James E. Lee
Question. Today, all 50 states have enacted data breach
notification laws. At least 25 states have laws that address the data
security of private sector entities. Please answer the following:
Which state (or states) has the strongest breach notification law?
Which state (or states) has the least effective breach notification
law?
Why is it considered the strongest law? The least effective? Please
explain and reference particular elements or features of the law.
Which state (or states) has the strongest data security law? Which
state (or states) has the least effective data security law?
Why is it considered the strongest law? The least effective? Please
explain and reference particular elements or features of the law.
Of the states identified above, which states have had the most
success in preventing cyber incidents and/or responding to security
breaches with respect to limiting consumers' exposure to threats and
reducing security risks to consumers' data?
Answer. Thank you, Ranking Member Wicker, for the questions. There
is a lot to learn from looking at the myriad number of state laws and
regulations--some positive examples and some areas for improvement--as
your question suggests.
As a preamble to answering your specific questions and as stated in
our previous testimony, the ITRC believes the current state-by-state
breach notification system is inadequate. With no uniform definition of
Personally Identifiable Information (PII), triggering event, time-frame
or method of notification, penalty for non-compliance, or mandatory
victim support, victims in different states impacted by a single data
compromise are treated differently.
For example, a resident of Mississippi where the state law does not
include passport or biometric information in the definition of PII
would not be required to receive a notification if such information
were compromised, but a person in Alabama would.
Next, state laws tend to fall into three categories: those which
were passed in the wake of 2005's data breaches revealed by the
California law; those passed after the data breaches at Target and
later at Equifax; and those laws that have been amended over time to
expand the definition of PII. For ease of reference for your staff, I
have attached the compendium of state laws published by PerkinsCoie
that was updated in September 2021 that provides code citations,
effective dates, and dates of amendments.
You have asked the following specific questions:
Which state (or states) has the strongest breach notification law?
Why is it considered the strongest law? Please explain and reference
particular elements or features of the law.
It's difficult to point to a single state or set of state laws as
being the ``strongest'' since even those laws which have strong
provisions often have equally weak provisions, too. For example, a
majority of states require residents to be notified of a data breach
irrespective of how many residents are impacted--that's a strong
provision.
Yet, many of those same states do not set a specific time-period
for the notice--and still more allow the breached entity to determine
if there is risk of harm from the compromise. No risk; no notice
required; and no specific time-frame for issuing a notice. Those are
weak provisions.
In the view of the ITRC, the following state law provisions should
be considered for a Federal law:
Definition of PII
California--Cal. Civ. Code Sec. 1798.29; 1798.82 et seq.
Personal Information Definition.
(1) An individual's first name or first initial and last name
in combination with any one or more of the following data
elements, when either the name or the data elements are not
encrypted (meaning rendered unusable, unreadable, or
indecipherable to an unauthorized person through a security
technology or methodology generally accepted in the field of
information security):
Social Security number;
Driver's license number or state identification card
number, tax identification number, passport number,
military identification number, or other unique
identification number issued on a government document
commonly used to verify the identity of a specific
individual;
Account number, credit card number, or debit card number
in combination with any required security code, access
code, or password that would permit access to an
individual's financial account;
Medical information (any information regarding an
individual's medical history, mental or physical condition,
or medical treatment or diagnosis by a health care
professional);
Health insurance information (an individual's health
insurance policy number or subscriber identification
number, any unique identifier used by a health insurer to
identify the individual, or any information in an
individual's application and claims history, including any
appeals records);
Information or data collected through the use or operation
of an automated license plate recognition system (a
searchable computerized database resulting from the
operation of one or more mobile or fixed cameras combined
with computer algorithms to read and convert images of
registration plates and the characters they contain into
computer-readable data); or
biometric data generated from measurements or technical
analysis of human body characteristics (e.g., fingerprint,
retina, or iris image) used to authenticate a specific
individual.
(2) User name or e-mail address, in combination with a password
or security question and answer that would permit access to an
online account.
PI does not include publicly available information that is
lawfully made available to the general public from federal,
state, or local government records.
California currently offers the most comprehensive definition of PII.
Identities are not static and the definition of PII requires periodic
updates to be effective.
Notice Provisions
Connecticut--Conn. Gen. Stat. Sec. 36a-701b
Notification Obligation to Attorney General. Any Entity that is
required under the statute to notify CT residents of any breach
of security shall provide notice of the breach of security to
the Attorney General not later than the time notice is provided
to the residents.
Connecticut's provision is similar to requirements in other states, but
Connecticut requires the Attorney General to be notified irrespective
of the number of victims as opposed to other states that set a
threshold--usually 500 to 1000 residents. At the Federal level, this
requirement would provide a uniform data set for reporting purposes as
well as an incentive to issue notifications when required.
Oregon--Or. Rev. Stat. Sec. Sec. 646A.600, 646A.602, 646A.604,
646A.624, 646A.626
Notification Obligation. Any Entity to which the statute
applies shall give notice of the breach of security following
discovery of such breach of security, or receipt of
notification, to any consumer to whom the PI pertains.
Notification is not required if, after an appropriate
investigation or after consultation with relevant federal,
state, or local agencies responsible for law enforcement,
the Entity reasonably determines that the breach has not
and will not likely result in harm to the individuals whose
PI has been acquired and accessed. Such a determination
must be documented in writing and the documentation must be
maintained for 5 years.
Oregon's notification provision is stronger than most states in that it
requires an independent review of the risks associated with a breach.
Most states only require the breached entity to make a determination
that the breach ``has not and will not likely result in harm'' to
victims who PII has been compromised.
As the nature of PII changes to include logins and passwords, it is
increasingly difficult to determine ``likely harm'' resulting from a
data breach. The volume of data breaches also makes it difficult to
determine which data breach may have caused a particular harm. A
provision similar to Oregon's reduces the chances of a well-
intentioned, but ill-equipped entity misjudging the risk of their own
breach.
Enforcement & Penalty Provisions
Forty-one states and the District of Columbia have enforcement and/or
penalty provisions. Those states generally give responsibility to the
Attorney General or other state agency to enforce civil penalties.
Michigan imposes criminal penalties, too. Within the universe of states
with enforcement provisions, 11 states have some form of a private
right of action. No state without an enforcement mechanism offers a
PROA. The eleven states are: AK, CA, DC, LA, MD, MN, NH, NC, SC, TN,
and WA.
Enforcement by the state Attorney General is the most common scheme
with most Attorneys General having the authority to seek injunctions as
well as civil penalties and restitution. The following state laws offer
strong enforcement and civil penalty provisions.
Arizona--Ariz. Rev. Stat. Sec. 18-551 et seq.
Attorney General Enforcement. A knowing and willful violation
of this section is an unlawful practice pursuant to ARS 44-
1522, enforced by the Attorney General. The Attorney General
may impose a civil penalty for a violation of this article not
to exceed the lesser of $10,000 per affected individual or the
total amount of economic loss sustained by affected
individuals, but the maximum civil penalty from a breach or
series of related breaches may not exceed $500,000.
Florida--FLA. STAT. Sec. 501.171
Penalties. An Entity that violates the statute in the following
manner is subject to the following administrative fines:
A violation of this section shall be treated as an unfair
or deceptive trade practice in any action brought by the
Department against an Entity or third-party agent.
An Entity that fails to notify the Department or Affected
Individuals shall be liable for a civil penalty not to
exceed $500,000 (i) in the amount of $1,000 for each day
the breach goes undisclosed for up to 30 days and,
thereafter, $50,0000 for each 30-day period or portion
therefore for up to 180 days; or (ii) if the violation
continues for more than 180 days, in an amount not to
exceed $500,000. The civil penalties under this paragraph
apply per breach, and not per individual affected by the
breach.
Which state (or states) has the least effective breach notification
law? Why is it considered the least effective? Please explain and
reference particular elements or features of the law.
Any of the state laws that lack specific enforcement provisions.
Without a specific enforcement and penalty provision or the private
right of action, victims have no recourse in the event of a breach in
the 10 jurisdictions that lack such.
Any of the states that still have narrow definitions of PII that often
date back to the first series of data breach laws passed in the mid-
2000s. For example, the most valuable PII to a cybercriminal today is a
login and password, yet not all states define e-mail or account
credentials as PII. The same is true of passports, military ID,
biometrics, geo-location data, and other common or emerging PII.
All 52 state and territorial laws fall short when it comes to informing
victims as to what happened, why, and what they can do to protect
themselves. Breached entities are increasingly using the alternate
notification methods allowed under virtually all of the state laws,
which means victims are not receiving a direct notice. Here's a common
example from an otherwise strong state law:
Oregon--Or. Rev. Stat. Sec. Sec. 646A.600, 646A.602, 646A.604,
646A.624, 646A.626
1. Substitute Notice Available. If the Entity demonstrates that
the cost of providing notice would exceed $250,000, that
the affected class of individuals to be notified exceeds
350,000, or if the Entity does not have sufficient contact
information to provide notice. Substitute notice consists
of the following:
Conspicuous posting of the notice or a link
to the notice on the Entity's website, if the Entity
maintains a website; and
Notification to major statewide television
and newspaper media.
Which state (or states) has the strongest data security law? Why is it
considered the strongest law? Please explain and reference particular
elements or features of the law.
The trend at the state level is to take a more holistic approach to
data security and privacy. While we've traditionally treated them as
separate issues, the reality is they are interrelated--you can't have
strong privacy without strong security.
Since 2020 three states that have adopted strong, integrated privacy
and security laws and still more states have considered or are
considering similar laws. One state, New York, has an especially strong
and effective set of sector specific data security and privacy specific
requirements for companies regulated by the state Department of
Financial Services (23 NYCRR Part 500--Cybersecurity).
The principals found in the state laws of California, Virginia, and
Colorado as well as those bills that failed in Washington, Oklahoma,
and Florida (and are likely to be revived in the next legislative
cycle) offer a good guide for a Federal law. All of these laws to one
degree or another include the following principals: Right of access,
deletion, correction, portability, and opt-out of data for marketing
purposes as well as certain automated processes.
These laws also focus on data minimization--don't collect more
information than is needed & don't keep it longer than required to
complete a transaction.
There are also specific provisions that require routine cybersecurity
and privacy assessments. These routine audits are also required by the
NY DFS regulations cited above and have already led to both improved
cybersecurity and enforcement actions.
Which state (or states) has the least effective data security law? Why
is it considered the least effective? Please explain and reference
particular elements or features of the law.
Most of these laws are so new and their provisions are so varied, it's
difficult to tell how well they are or are not working. With the
limited data available, there are no indicators--number of breaches,
number of identity crime victims, location of both--that point to a
significant, positive impact that can be traced directly to any
particular law or regulation.
Of the states identified above, which states have had the most success
in preventing cyber incidents and/or responding to security breaches
with respect to limiting consumers' exposure to threats and reducing
security risks to consumers' data?
Frankly, the state data breach laws are all well-intentioned, but are
not as effective as they should be. Given the research conducted by the
University of Michigan and Carnegie Melon University as cited in the
previous ITRC testimony as well as new research by the ITRC, the
notices generally fall on deaf ears and do not prompt consumers to take
the very basic steps needed to protect themselves from harm.
In an ITRC survey of 1000 consumers, 72 percent acknowledged they had
received at least one data breach notice. Of those respondents only
three percent (3 percent) stated they had taken the single most
important step following a data breach--freezing their credit--even
though 80 percent said they were familiar with the process of freezing
their credit.
As for cybersecurity, look to the pending legislation in Ohio that
creates a Safe Harbor for organizations that adopt and follow the NIST
cyber standards. If enacted, it will be fascinating to see what happens
there.
______
Response to Written Question Submitted by Hon. John Thune to
James E. Lee
Question. What can Congress do to make compliance with a new
Federal law less complex, while still ensuring that companies are
protecting consumers' data and privacy?
Answer. Thank you, Senator Thune, for the question. Businesses of
all sizes that work across state and national borders are currently
compelled to comply with a variety of privacy, security, and data
breach notice laws. Depending on the type of organization and the
sector in which the business operates, there can be multiple regulatory
agency rules and regulations that compel compliance, too.
Applying a common, strong minimum Federal standard that is
enforceable will actually result in less complexity for these
organizations and better protections from cyber and identity crimes,
especially for those residents of states with less stringent current
laws. For the millions of small businesses that do not operate outside
a single state or in a regulated industry, a common minimum standard
will result in a level of certainty that does not exist today. It will
also level the playing field for those businesses that operate with a
high level of protection for their customers' data compared to those
organizations that take a less privacy and security conscious approach
to business.
When adopting a new, national minimum standard, Congress should
look to those states which have already adopted strong, integrated
privacy, identity, and cybersecurity statutes. Taking an integrated
approach to what have traditionally been three separate legal silos
also reduces complexity and increases the likelihood of compliance and
efficacy.
The ITRC believes identity crime victims are best served when we
prevent data breaches and cyberattacks from happening, and when they
do, by ensuring the data that is available is benign. Therefore, we
believe Congress should look to the principals found in the California
and Virginia privacy laws adopted by the voters in 2020 and state
legislature in 2021, respectively, as good guides for a national
privacy and security framework. Specifically, the rights of data
access, correction, limited deletion, and opt-out--easily exercised--
coupled with the concept of data minimization--i.e. don't collect or
keep more data than you need. Equally important are the requirements
for routine privacy and cybersecurity audits to help ensure
organizations subject to the law know and act upon any deficiencies
that pose a risk to their business and customers.
What Congress should not do is adopt overly prescriptive approaches
or preclude states from adopting innovative tactics in response to the
constantly evolving attack vectors favored by financially motivated
cybercriminals and Nation/State threat actors. The Federal Government,
as well intentioned as it is, cannot react as fast as technology
changes, so there must be a level of flexibility built into the system
to ensure business and consumers alike can be protected from new forms
of cyberattacks and cybercrimes as they emerge.
______
Response to Written Question Submitted by Hon. Amy Klobuchar to
Jessica L. Rich
Working with the Private Sector. The public and private sector need
to work together to combat cyberattacks. Last year, SolarWinds--a
commercial software product used by many government agencies--was
revealed to have been hacked, resulting in a massive breach in computer
systems across various parts of the Federal government and the private
sector. The hackers were able to access over 18,000 government and
private computer networks.
Question. In your testimony, you note that national security is at
risk when government agencies use commercial software that is
susceptible to hacking and other cyberattacks. Specifically, how should
the government work with the private sector to improve cybersecurity?
Answer. To truly incentivize robust cybersecurity measures in the
private sector, Congress should pass a Federal law requiring
implementation of such measures by all U.S. companies (and, to the
extent jurisdictional limits allow, foreign companies that collect data
from U.S. consumers and/or connect to U.S. commercial systems). To
date, such measures have generally been considered as one element in
proposals to enact a broader Federal privacy law. However, because
cybersecurity mandates enjoy more widespread support among stakeholders
than a privacy law, Congress should consider passing a standalone
cybersecurity law.
Given the vast range of companies that such a law could and should
cover, the law should be flexible and process-based. However, to
provide appropriate incentives and deterrence, it should empower both
the Federal Trade Commission (FTC) and the State Attorneys General to
enforce it, and should authorize civil penalties for violations. In
addition, to ensure a level playing field across the economy, the law
also should cover non-profits and common carriers.
Short of Congress passing such a law, there are a variety of recent
and ongoing measures that should be strengthened. First, the FTC should
ramp up its efforts to enforce existing privacy laws against companies
that fail to implement reasonable security for consumer data, and to
educate consumers and business about this important issue. The $500,000
million allocated to the FTC in the Build Back Better Bill should
assist the FTC enormously in this regard.
Second, while I believe the likely success of FTC rulemaking under
its Section 5 (Magnuson-Moss) authority has been vastly overstated in
some quarters, use of this authority holds promise when it comes to the
issue of cybersecurity, and should be considered.
Finally, the Department of Homeland Security has ongoing efforts to
engage with the private sector to strengthen cybersecurity, and the
Administration (pursuant to the recent executive order) is attempting
to remove barriers to sharing threat information while also imposing
strong
cybersecurity measures on companies that contract with the
government. Congress should support these important efforts in any way
that it can.
Please let me know if I can provide further assistance to you, your
staff, or the Committee regarding issues related to cybersecurity and/
or privacy more generally.
______
Response to Written Questions Submitted by Hon. Roger Wicker to
Jessica L. Rich
Question. Today, all 50 states have enacted data breach
notification laws. At least 25 states have laws that address the data
security of private sector entities. Please answer the following:
Which state (or states) has the strongest breach notification law?
Which state (or states) has the least effective breach notification
law?
Why is it considered the strongest law? The least effective? Please
explain and reference particular elements or features of the law.
Which state (or states) has the strongest data security law? Which
state (or states) has the least effective data security law?
Why is it considered the strongest law? The least effective? Please
explain and reference particular elements or features of the law.
Of the states identified above, which states have had the most
success in preventing cyber incidents and/or responding to security
breaches with respect to limiting consumers' exposure to threats and
reducing security risks to consumers' data?
Answer. I have not personally conducted a detailed analysis of the
relative strength and effectiveness of the many state breach
notification and data security laws currently in effect. Also, I think
that the effectiveness of each law will largely depend on how it is
enforced. However, as said in my testimony, I do have thoughts about
what elements would be desirable in a Federal data security law.
First, it should be process-based so as not to become obsolete when
technology changes. At the same time, it should provide enough detail
so that it provides sufficient guidance and is enforceable. The
standard in the December 2019 proposal from Privacy for America (which
I helped to draft) provides a good starting point.
Second, the law should cover data security but not breach
notification. With state breach notification laws now in effect in all
50 states, I believe including this issue in the law would be highly
disruptive to the goals of passing Federal data security legislation.
Third, it should authorize civil penalties to ensure appropriate
deterrence. Currently, as you know, the FTC cannot obtain civil
penalties for first-time violations.
Fourth, to ensure a level playing field, the law should plug
existing holes in the FTC's jurisdiction--notably as to non-profits and
common carriers.
Fifth, to achieve consistency while maintaining the important role
of the states, it should preempt inconsistent state laws but empower
the states to enforce the new law.
Finally, so that the law keeps pace with technological
developments, it could provide narrow rulemaking authority (e.g., for
issues such as scope of data covered by the rule) coupled with a
requirement that the FTC issue periodic guidance regarding specific
types of safeguards that could assist with compliance.
______
Response to Written Questions Submitted by Hon. John Thune to
Jessica L. Rich
Question 1. Do you believe a national standard would benefit both
consumers and businesses rather than a patchwork of state laws?
Answer. Yes, a national standard would provide greater clarity to
businesses as to their obligations and to consumers as to their rights.
It would also provide a mandate and clear direction to the agency(ies)
charged with enforcing the law.
Question 2. You mentioned that a private right of action should not
be necessary in a Federal data security law. Can you speak to that
further?
Answer. One of the main arguments in support of a private right of
action is that the FTC, with its limited resources, cannot police the
marketplace adequately to promote compliance, deter wrongdoers, and
obtain recourse for injured consumers. A strong Federal law could
address these concerns by giving the FTC the legal tools and resource
it needs, empowering the states to enforce the Federal law, and
including strong remedies for violations.
Question 3. What can Congress do to make compliance with a new
Federal law less complex, while still ensuring that companies are
protecting consumers' data and privacy?
Answer. Passing a strong Federal law establishing a national
standard would go a long way towards reducing complexity. The law could
preempt inconsistent state laws while giving the states the ability to
enforce it--thus achieving consistency while enlisting and empowering
the states in the outcome. As noted above, if the law is strong enough,
a private right of action should not be necessary.
______
Response to Written Questions Submitted by Hon. Amy Klobuchar to
Edward W. Felten
Protecting Against Ransomware Attacks. Each day, there are over
4,000 ransomware attacks. Recent ransomware attacks such as the attack
on the Colonial Pipeline--which halted the distribution of nearly half
of the fuel to the East Coast in May--highlight the need to improve the
cybersecurity of our critical infrastructure.
Question 1. In 2020, ransomware attacks cost local and state
economies over $18 billion. What do you believe are the greatest
current cybersecurity threats to state and local governments?
Answer. Ransomware is among the most important cybersecurity
threats faced by state and local governments. These days, everyone
faces ransomware threats, but state and local governments may be at
particular risk because of the breadth of their missions, the
sensitivity of some of their information, and the importance of their
work for the people they serve.
Also significant are threats against elections and the operation of
democratic processes more generally. These are especially challenging
because the existence of threats can itself undermine confidence and
legitimacy of governments, even without any attack, by serving as a
subject for disinformation campaigns.
Question 2. What should Congress do to support state and local
governments on this issue?
Answer. There are several things Congress can do.
First, Congress can ensure that Federal agencies are vigorously
enforcing the law, and are taking action, consistent with
Constitutional and statutory limits, to deter and disrupt ransomware
networks. These missions are unique to the Federal Government and can
make ransomware activities riskier and less lucrative for bad actors.
Second, Congress can ensure that agencies share threat information
with state and local governments to the extent possible. This includes
assuring that agencies provide necessary help to state and local
governments so that their personnel can be appropriately cleared and
can set up the systems and processes needed to securely handle
sensitive information.
Third, Congress can ensure that Federal agencies make available
technical assistance, including information about staffing and best
practices. Congress can encourage state and local governments, and
organizations representing state and local officials, to work together
to develop tools and guidance usable by state and local governments of
all sizes.
Fourth, Congress can ensure that when funding is provided through
Federal agencies for state and local programs, the funded programs are
appropriately required to, and funded for, necessary cybersecurity
operations as an integral part of program management.
Question 3. What are the most important actions for Congress to
take to stop ransomware attacks on critical infrastructure?
Answer. First, many of the same strategies listed above to help
state and local governments will also benefit critical infrastructure
providers. Deterrence and threat intelligence are especially important
when the potential threat actors are foreign governments, organized
crime, or terrorist organizations, which is more likely in the critical
infrastructure space. Coordination is also more practical because most
critical infrastructure sectors have strong sectoral institutions to
support security and preparedness, which can partner with the Federal
government.
Second, the impact of ransomware can be reduced by making these
infrastructures more resilient overall so that an attack that disables
one component or organization causes less harm. This not only reduces
the impact of attacks if they do occur; it also decreases adversaries'
motive to attack.
______
Response to Written Questions Submitted by Hon. Kyrsten Sinema to
Kate Tummarello
State Privacy Laws. Like many states, the Arizona state legislature
has considered implementing a consumer privacy law. Three states--
California, Colorado, and Virginia--have enacted their own privacy
legislation.
Question 1. Do you believe Congress should enact a national
consumer privacy law? If so, what are the key elements of a Federal
data privacy law to protect Arizonans, especially in regards to data
security?
Answer. Engine supports Congress crafting a Federal privacy and
data security framework that builds off of the protections in existing
state laws but creates one clear, consistent Federal standard,
including basic rights around data access and deletion. A Federal
framework should also incentivize cybersecurity best practices, such as
data minimization and encryption, by protecting organizations for
compliance and legal costs if they suffer a data breach despite
following best practices.
Question 2. How should a Federal data privacy law interact with
state data privacy laws?
Answer. Startups on bootstrap budgets need clarity and consistency.
A Federal data privacy and security law should preempt general state
data privacy laws, creating one--not a 51st--standard for startups to
meet.
FTC Resources. Unfortunately, Arizona schools, hospitals, and
companies have been the victims of cyberattacks that have resulted in
the release of personal information. Since 2005, data breaches have
cost Arizonans at least $1.6 billion.
Question 1. Considering the costs of these cyber incidents to
Arizona and the Nation as a whole, what are your thoughts on providing
additional resources to the Federal Trade Commission (FTC) to enforce
existing Federal data privacy laws?
Answer. Engine supports the FTC having the resources it needs to
enforce existing Federal data privacy laws as well as a potential
Federal comprehensive data privacy and security framework.
Question 2. If you believe that additional funding is warranted,
what is the appropriate amount of additional funding for FTC
enforcement? Should that number be based on whether Congress passes
legislation related to data privacy or data security?
Answer. Engine defers to agency experts on whether or how much
additional funding is needed for FTC enforcement of current and
potential privacy and data security laws, but we encourage Congress to
pass a comprehensive Federal privacy and data security framework and
equip the FTC with the resources it needs to provide guidance and
enforcement for that framework.
Question 3. If a data breach involving their systems occurs, what
types of services should companies provide to their consumers?
Answer. The obligations on a company following a data breach should
depend on the type and amount of data that was accessed during the
breach. If a company holding, for instance, only e-mail addresses
suffers a breach, the measures necessary to mitigate the impact on
consumers will be different than if a company holding credit card
information had suffered a breach.
Compliance Costs. Some tech companies have the resources to employ
large numbers of compliance staff to ensure they are following national
and state regulations. Many Arizona small businesses do not have access
to comparable resources.
Question. How can we craft a Federal data privacy law that does not
put small businesses at a disadvantage while still offering consumers
strong data security protections?
Answer. Startups and other small businesses need clarity and
consistency, including around what kind of data security measures are
considered adequate under the law. And, recognizing that even the most
responsible companies can fall victim to bad actors, startups need
clarity around what steps are required and when they are required to
take those steps in the event of a data breach. In addition to the
clarity and consistency that a Federal data privacy and security
framework can create, the obligations and responsibilities created by
the framework regarding data security should depend on several factors,
including the amount and type of consumer data a company holds as well
as the company's size and resources to shoulder compliance burdens.
______
Response to Written Questions Submitted by Hon. Raphael Warnock to
Kate Tummarello
Cybersecurity Workforce Development. Data security is important for
both our economic and national security. Just last year, Congress
directed the Department of Defense to assess cybersecurity threats to
the defense industrial base and the ability of the Department's
industrial base and private sector partners to meet software
development needs for our national security. I recently visited Project
Synergy in Warner Robins, Georgia, a cutting-edge software laboratory
built on a partnership between Robins Air Force Base's software depot
maintenance and Mercer College's engineering and computer science
schools. One of their top requests was increased investment in
cybersecurity education and a strong workforce pipeline to ensure they
can grow to meet their current needs and the threats of the future.
Question. What is the role of increasing STEM and cyber education
in promoting a skilled cybersecurity workforce?
Answer. It is imperative that policymakers support efforts to
expand and diversify the country's cybersecurity workforce. As
discussed in my testimony, the current cybersecurity talent pool needs
an increase both in terms of size and in terms of representation; a
large, well-trained, diverse cybersecurity workforce will find and
solve more problems in ways that work for more communities of users.
Policymakers should expand access to STEM and cybersecurity education
across the board--including at varying levels of education--with a
focus on increasing access to education and resources in historically
underrepresented communities. In comments to the Patent and Trademark
Office earlier this year (relevant section attached), Engine examined
several facets of this issue as well as potential policy solutions.\1\
---------------------------------------------------------------------------
\1\ Matt O. Dhaiti, Jamie Dohopolski, and Phillip R. Malone,
Engine's Response to the Call for Comments on Expanding American
Innovation, Engine (Feb. 23, 2021), https://static1.square
space.com/static/571681753c44d835a440c8b5/t/60366ecbd288114c62743c45/
1614180046522/Engine+USPTO+diversity+comments.pdf
Small Business and Economic Development. Businesses of all sizes
face threats to their data security, but smaller businesses often have
to take on these bad actors with a fraction of the resources as their
larger competitors. For example, in my conversations with Georgia's
Manufacturing Extension Partnership, I've heard that cybersecurity is
one of the top concerns of small manufacturers, and they need more
---------------------------------------------------------------------------
support to understand and implement best practices.
Question 1. How can Congress help small businesses, who may have
limited financial and technical resources, keep up with best practices
and defend themselves against cybersecurity threats?
Answer. The cybersecurity threat landscape is constantly evolving;
deep-pocketed, multinational corporations and government bodies aren't
able to defend themselves against all cybersecurity threats. Formal
information sharing about specific threats as well as general best
practices--including through regularly updated FTC guidance issued as
part of a comprehensive Federal privacy and data security framework--
would help create a menu of options for startups to consider as they
look to protect themselves and their users against cybersecurity
threats.
Question 2. How can Congress and the FTC ensure that any new laws
and regulations work for businesses of all sizes?
Answer. Startups and other small businesses, by and large, want to
be responsible stewards of their users' data. Policy can provide them
with clear, consistent guidance around what it takes to be responsible.
In this context, Congress should provide a framework that clearly lays
out what data security measures are required under the law and what
steps are required--and when they are required--in the event of a data
breach. If the FTC is granted rulemaking authority under a Federal
privacy and data security law, the agency should ensure that
obligations and responsibilities scale based on the amount and type of
consumer data a company holds as well as the company's size and
resources to shoulder compliance burdens.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
______
Response to Written Questions Submitted by Hon. Roger Wicker to
Kate Tummarello
Question. Today, all 50 states have enacted data breach
notification laws. At least 25 states have laws that address the data
security of private sector entities. Please answer the following:
Which state (or states) has the strongest breach notification law?
Which state (or states) has the least effective breach notification
law?
Why is it considered the strongest law? The least effective? Please
explain and reference particular elements or features of the law.
Answer. It's difficult to pin down the strongest or least effective
state data breach notification law, as laws have multiple provisions,
each of which could be considered stronger or less effective. But some
state data breach notification laws contain provisions that are
particularly strong or ineffective and should be informative for
policymakers crafting a Federal privacy and data security law with an
eye towards the clarity and consistency that startups need.
While startups recognize the need to protect their users' data,
some amount of data breaches are inevitable as the landscape of
cybersecurity threats is vast and evolving. Some state laws have
provisions that minimize compliance uncertainty when an organization
has been breached, which helps ease the burden for startups that are
already grappling with a costly and time-consuming breach. For
instance, California law provides a template data breach notification
letter, which clearly spells out what information must be included in
notification for a company to be in compliance with the law if they've
suffered a data breach and need to notify consumers. State laws that
provide means for substitute notice in lieu of individual notification
for affected consumers in some circumstances also help ease compliance
burdens in the wake of a breach.
But state laws that keep organizations that have suffered a data
breach from clearly communicating the fact of the breach and relevant
context put organizations, including startups, in the difficult
position of having to communicate an incomplete picture to users.
Massachusetts prohibits organizations that have suffered a data breach
from including in their notice to consumers ``the nature of the
breach.'' In addition to conflicting with other state laws that require
organizations to include a description of the data breach in notices to
consumers, the Massachusetts law risks arming consumers with
insufficient information if their data has been compromised in a data
breach.
Which state (or states) has the strongest data security law? Which
state (or states) has the least effective data security law?
Why is it considered the strongest law? The least effective? Please
explain and reference particular elements or features of the law.
Answer. Again, it's difficult to say which state data security law
is the strongest and which is the least effective, but policymakers can
learn lessons from varying provisions of multiple states' laws about
what works well and what doesn't. Effective state data security laws
incentivize organizations, including startups, to proactively take
steps to secure their users' data without being overly prescriptive or
ignoring the reality that different security measures will make sense
for different organizations based on their resources and the amount and
type of data they hold.
A few states have found ways to incentivize security measures--such
as encryption--by easing regulatory and legal burdens if an
organization suffers a breach despite using those security measures. As
discussed in my written testimony, startups on tight budgets--the
average seed-stage startup has about $55,000 per month to cover all of
its costs, and the vast majority of startups have much less--are
particularly ill-equipped to spend hundreds of thousands of dollars on
litigation. Under the California Consumer Privacy Act, an organization
that suffers a data breach is granted immunity from the law's private
right of action where the only data obtained in the breach is
encrypted. The law's private right of action carries potential
statutory damages on top of typical legal costs, so the ability to
evade a costly and time consuming lawsuit is a powerful incentive for
companies to encrypt users' data. Other states have similar incentives,
including the Ohio Data Protection Act, which provides an affirmative
defense against certain data breach tort claims if the organization
followed cybersecurity best practices. Engine remains concerned about
the inclusion of a private right of action in any Federal privacy, data
security, and/or data breach notification law, but these kinds of
incentives should be included and expanded in a Federal law to mitigate
the risk of harm to startups from onerous regulatory or legal action.
One of the less helpful elements of state data security laws is
mandates that organizations comply with ``reasonable data security
measures'' without specifying what that entails. While it's critical
that any data security framework be flexible and scalable, a startup
needs to know it's in compliance with the law without having to survive
a regulatory or legal challenge in the event of a breach. Engine
supports FTC rulemaking authority to create a flexible, scalable data
security framework that can be regularly updated as technology and the
threat landscape evolve, creates clear, consistent standards for
startups to meet, and takes into account the resources available to
organizations as well as the amount and type of data they hold.
Of the states identified above, which states have had the most
success in preventing cyber incidents and/or responding to security
breaches with respect to limiting consumers' exposure to threats and
reducing security risks to consumers' data?
Answer. Given the inherently interstate nature of the Internet and
the flow of data, it's difficult to identify which state has the best
record with cyber incidents and data breaches and even more difficult
to tell if that record is the direct result of the state's data
security and data breach notification laws. However, California's data
security and breach notification framework, taken on the whole, is
widely considered the original and gold standard, and Congress should
especially look at what is working well in that state, including the
elements mentioned above.
______
Response to Written Questions Submitted by Hon. John Thune to
Kate Tummarello
Question 1. In your testimony, you mention that the current
patchwork of state laws drive up startups' compliance costs without
providing any benefits to consumers.
Can you elaborate on the effects a patchwork of state laws have on
small businesses, and would a single Federal law be preferable for both
businesses and consumers?
Answer. Thank you for the opportunity to elaborate on the burdens
the current patchwork of state laws can create for startups. The small
and young companies across the country that make up the startup
ecosystem overwhelmingly want to do the right thing and protect their
users' data. That's one of the many competing pressures startups face
as they launch and scale. In fact, many startups compete on privacy and
security and use strong security protections as a way to differentiate
themselves from their large competitors.
It is, unfortunately, impossible for a startup--or any company,
organization, government agency, etc.--to be completely immune to data
breaches; the technological capabilities of bad actors and the threat
landscape is constantly evolving. Knowing they should be responsible
but can't be perfect in preventing data breaches, startups need clarity
and consistency around their obligations under data security and data
breach notification laws. Currently, startups have to navigate a mosaic
of dozens of state laws around data security and 50 state laws around
data breach notification. Even where the laws have similar substantive
goals, small differences can create compliance costs and burdens that
are difficult for startups on bootstrap budgets--the average seed-stage
startup has roughly $55,000 per month to cover all costs, and the vast
majority of startups have much less--to navigate. Those burdens
increase substantially when the laws explicitly conflict.
A single, Federal law around how companies process and store data
and notify users in the event of a data breach would give the startup
ecosystem much-needed consistency and clarity. At the same time, a
single Federal law could be written to build off of the strongest
consumer protections that exist, which would expand stronger
protections to all consumers across the country.
It's critical that a Federal law not open the door to a new
patchwork of requirements as determined by courts across the country as
they rule on private lawsuits brought under a new Federal law. While a
private right of action could be narrowly tailored to go after bad
actors in clear cut circumstances, a sweeping, unrestrained private
right of action would just shift the patchwork from state capitals to
courthouses.
Question 2. What can Congress do to make compliance with a new
Federal law less complex, while still ensuring that companies are
protecting consumers' data and privacy?
Answer. Startups need clear, consistent rules, and they need to
know that if they follow the rules, they won't be subject to onerous
regulatory and legal costs. On data security, Engine supports giving
the FTC rulemaking authority to craft rules that provide a menu of
options for startups to choose from based on the resources available to
them and the amount and types of data they hold. Congress should
include in a law a requirement that the FTC update the rules regularly
to keep up with advancing technological capabilities and threats.
More generally, Congress can minimize complexity by preempting the
current patchwork of state laws, ensuring enforcement is coordinated--
so that what is permitted under the reading of the law in one
jurisdiction isn't prohibited in another--and, if Congress includes a
private right of action in the law, crafting a narrowly tailored
private right of action that doesn't open the door to bad faith
litigation or disparate court rulings about what is permissible under
the law.
[all]