[Congressional Record Volume 146, Number 28 (Tuesday, March 14, 2000)]
[House]
[Pages H974-H979]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




               CYBER TERRORISM, A REAL THREAT TO SOCIETY

  The SPEAKER pro tempore. Under the Speaker's announced policy of 
January 6, 1999, the gentleman from New Jersey (Mr. Andrews) is 
recognized for half the remaining time until midnight, approximately 50 
minutes, as the designee of the minority leader.
  Mr. ANDREWS. Mr. Speaker, I want to begin by expressing my 
appreciation to the Chair at this very late hour and to the members of 
the staff who are so diligently working here with us and for us at this 
very late hour as well.
  We are gathered tonight at a time of unprecedented peace and power 
for our country. Because of the enormous dedication and sacrifice of 
Americans who have served in our armed forces throughout history, 
around the world in the past and at present, our country is stronger 
and more secure than it has ever been, and that is a blessing for which 
we are truly thankful.
  Certainly that thanks is directed at those who wear the uniform of 
our country tonight around the world and those who have so nobly worn 
it in the past. It is truly a gift and a legacy that we enjoy tonight.
  Our relative strength in the world does not mean that we live in a 
purely safe world, a world without risk. We must endeavor not to repeat 
the mistakes of history, where very often at times when we felt most 
safe we were most vulnerable.
  There are clearly three areas of major threats to our country's 
security as we gather tonight. The first is the threat of an emerging 
competing global superpower in the People's Republic of China. The 
second is the continued virulent presence of regional negative hostile 
dictatorial forces such as Saddam Hussein in the Persian Gulf, 
President Milosevic in the former Yugoslavia. Those two threats, the 
threat of China and the threat of those regional dictators, are very 
severe threats indeed. I trust that in the coming weeks and months we 
will consider as a Congress, along with the executive branch and the 
military, ways to confront those threats.
  This evening I want to spend, Mr. Speaker, some time talking about a 
threat that is not so easily detected, is not so obvious, but a threat 
that I believe is truly lethal and deadly, a threat that is unlike any 
threat that we have faced in the history of our republic, and that is 
the silent but deadly threat of cyber terrorism, the quiet but lethal 
assault on our country's systems and people, which I believe will be 
one of the major issues in the new century, the new millennium, in the 
defense of our country.
  Unlike the growth of a large superpower army, unlike the 
proliferation of arms from a hostile nation state, we cannot readily or 
easily see the development of the cyber threat. I pray that we may 
never feel it and tonight I would like to talk about how we can prepare 
for it.
  I would like to begin by talking about what has already happened to 
make it clear that our subject tonight is not an imaginary one. It is 
all too real. Listen to George Tenet, the director of the Central 
Intelligence Agency, speaking a few months ago. He said, and I am 
quoting, ``An adversary capable of implanting the right virus or 
accessing the right terminal can cause massive damage to the United 
States of America,'' the right virus or the right terminal.

                              {time}  2215

  In 1998, two youngsters in California, directed by a hacker in the 
Middle East who was later described as the Analyzer, launched attacks 
which disrupted our troop movements in the Persian Gulf. These two 
young hackers, based in California and directed by the Analyzer in the 
Middle East, disrupted troop deployments to the Persian Gulf in 
February of 1998 from California, launched attacks against the Pentagon 
systems, the National Security Agency and a nuclear weapons research 
lab.
  The deployment disruptions, that is, the disruptions in the 
deployment of our troops around the world and the Persian Gulf, from a 
computer terminal in California, were described by Deputy Secretary of 
Defense John Hamre, a real leader in this field, as ``the most 
organized and systematic attack'' on U.S. defense systems ever 
detected. In fact, they were so expertly conducted that President 
Clinton was warned in the early phases that Iraq was most probably the 
electronic attacker.
  Two teenagers steered and directed by a master hacker halfway around 
the world, launching what our number one defender has called the most 
organized and systematic attack on sophisticated defense computer 
systems, so sophisticated that in the early hours of the attack the 
President of the United States was told by his most wise and 
knowledgeable advisers that Iraq was the electronic attacker. It was 
not Iraq, it was two U.S. citizens directed by a hacker in the Middle 
East.
  On March 10, 1997, another teenager, this one based in Massachusetts, 
invaded a computer system run by the Bell Atlantic company in 
Massachusetts, knocked out telephone communications, among them 
telecommunications, telephone service, for the Worcester, Massachusetts 
air traffic control system at that airport in western Massachusetts. 
The tower was knocked out for 6 hours.
  Let me read from a report from the Boston Globe of March 19, 1998. 
``The computer breach knocked out phone and radio transmission to the 
control tower at the Worcester airport for 6 hours, forcing controllers 
to rely on one cellular phone and battery powered radios to direct 
planes.''
  One teenager hacking into a computer system of a major regional 
telephone company, knocking out for 6

[[Page H975]]

 hours the telecommunications capacity of an entire area, and including 
an airport. And as people flew through the skies above Worcester, 
Massachusetts, the air traffic controllers relied on one cell phone and 
battery powered radios to direct the planes.
  Joseph Hogan, who manages the control tower at Worcester and 26 other 
airports for the Federal Aviation Administration, said this: ``We 
relied on our back-up systems, and, thank goodness, they worked. Had we 
been busier, the potential for a serious incident with dire 
consequences was there.'' Six hours.
  In 1997, our intelligence community conducted what was called 
Operation Eligible Receiver, a war game played in cyberspace, an 
intelligent and far-reaching attempt by the U.S. military and 
intelligence community to game out what would happen if a hostile 
foreign power tried to attack our systems around the country.
  A so-called red team put together by the intelligence community 
pretended to be North Korea. Thirty-five men and women specialists, 35 
people using hacking tools freely available on 1,900 web sites, Mr. 
Speaker, any of our listeners tonight could access on their home 
computer right now. These 35 men and women accessing those 1,900 web 
sites in the public domain managed to shut down large segments of 
America's power grid and silence the command and control system of the 
Pacific Command in Honolulu.
  The Defense Information Systems Agency, DISA, launched some 38,000 
attacks against its own systems to test their vulnerabilities. Only 4 
percent of the people in charge of those targeted systems realized they 
were under attack, and, of those, only 1 in 150 reported the intrusion 
to the superior authority.

  We had a war game, and the good guys lost. The smartest and most 
capable people that we have were rather easily outwitted by this war 
game.
  A Pentagon report goes on to say that probing attacks against the 
Pentagon, there are tens of thousands of them a year, are routed and 
looped through half a dozen other countries to camouflage where the 
attack originated. Information warfare specialists at the Pentagon 
estimate that a properly prepared and well-coordinated attack by fewer 
than 30, 30 computer virtuosos, strategically located around the world, 
with a budget of less than $10 million, could bring the United States 
to its knees. Such a strategic attack mounted by a cyber-terrorist 
group, either sub-state or non-state actors, that is to say either 
terrorist groups that are not part of any state or terrorist groups 
that are sponsored by a rogue state, would shut down everything from 
electric power grids to air traffic control centers. A combination of 
cyber-weapons, poison gas and even nuclear devices could produce a 
global Waterloo for the United States.
  In 1999, the Pentagon tracked 22,144 intrusions on its own sensitive 
computer systems. 22,144 times in the last calendar year people figured 
out how to hack their way in to our most vulnerable systems. That is 
according to Major General John H. Campbell of the United States Air 
Force.
  Deputy Secretary Hamre reports that his sources show that there are 
at least 20 countries who presently have information warfare strategies 
and operations active against the United States. This is an 
overwhelming and compelling body of evidence that says that this is not 
a question of whether we will be prepared for something that will 
happen to us in the future; this is a question of how well we are 
prepared for something that is happening to us right now, tonight, 
around the world.
  Now, there is good news to report. As a member of the Committee on 
Armed Services, I have had the opportunity to meet and listen to and be 
briefed by some incredibly committed and talented men and women, both 
in the civilian service of this country and the Department of Defense 
and in the uniform of this country in the branches of our armed 
Services, and also serving in the various intelligence agencies of this 
government.
  Mr. Speaker, we are blessed tonight with a robust, dynamic and bright 
corps of young men and women who are committed to defending their 
country. With the tools that we have given them, they are doing a 
magnificent job. Deputy Secretary of Defense Hamre is the leader of 
this effort and deserves special praise. His Assistant Secretary, Art 
Money, deserves special praise, and so do many others who work at their 
direction who have foreseen this problem, have been so diligent in 
pursuing it, and are truly inspiring in their level of preparation.
  I have no doubt, no doubt whatsoever, that if we do our job, Mr. 
Speaker, and give these civilians and uniformed personnel and 
intelligence personnel the tools to do their job, they will excel in 
doing their job and protect our country.
  This issue is not new to this floor. The gentleman from Pennsylvania 
(Mr. Weldon), my friend and colleague from nearby Pennsylvania, has 
been working on this issue years before it found its way into the 
headlines. He is serving as the Chairman of the Subcommittee on 
Research and Development of our Committee on Armed Services and has 
been a long time advocate of this cause.
  The gentleman from South Carolina (Mr. Spence), the chairman of the 
Committee on Armed Services, a Republican, and the gentleman from 
Missouri (Mr. Skelton), the Democratic ranking member of the committee, 
have very wisely appointed a special task force of our committee to 
focus on cyber-terrorism in this year's defense budget. That special 
committee is ably chaired by my neighbor and friend, the gentleman from 
New Jersey (Mr. Saxton). The members of the committee are truly 
dedicated to this purpose, and I believe that the efforts of Chairman 
Spence and Mr. Skelton and Chairman Weldon and Chairman Saxton and 
those of us working with them on this effort are going to elevate this 
issue in this Congress, in this defense budget and defense bill, and 
take some important steps that really need to be taken.

  Now, these steps would follow on the heels of the President's 
directive number 63 which was issued on May 22, 1998. That directive, 
which is well under way, is a good first step toward addressing the 
very real problems that I talked about tonight. But I think we have to 
build on those steps and understand the very unique nature of the 
problem before us.
  Our country is organized, and well organized, for the world of 
physical space. Our military strategy has always been about protecting 
and defending key points of territory, the seas, land, so we could 
protect the sovereignty and rights of our people. We have always 
recognized a distinction in our civil law between civilian and 
military, between police action and law enforcement on the one hand and 
military action on the other.
  These are time-honored and wise distinctions that we should never 
forfeit, but they are distinctions based on the physical world. And 
when we deal with the world of cyber-terrorism, we need to rethink 
them. By no means should we abandon cherished principles that recognize 
that civilian authority rules our country and the military serves 
civilian authority. By no means should we abandon the principle that 
recognizes the rights of Americans to enjoy privacy in their homes, the 
reasonable expectation of privacy in their affairs.
  By no means should we forfeit those principles, but by no means 
should we permit those who would do us harm and terror to hide behind 
those principles to abuse the purposes of those principles and subject 
the country to horrible acts of destruction.
  This month I will be introducing legislation that creates a strategy 
to address what I believe are the three great questions posed for our 
country by the here and instant onslaught of cyber-terrorism.
  The first question is how can we make sure that our military is fully 
prepared? The President has given us great guidance in this in his 
budget proposals for the new fiscal year. He has set aside $91 million, 
not for software or fancy computers or bricks and mortar, but he set 
aside $91 million so we can be sure that the smartest and most 
motivated Americans serve their country in this field. Scholarships for 
bright young students, continuing education for those who already 
serve, institutes and centers and programs for people to come together 
from the worlds of business and academia and government and the 
military and think about ways that we can address and solve these 
problems.

[[Page H976]]

  I believe, based upon the classified briefings I have been privileged 
to receive and the record in the public domain, that the U.S. military, 
the U.S. intelligence community and the civilian employees of the 
Department of Defense are ahead of the curve in this area. We are by no 
means invulnerable in our defense infrastructure, but this is a problem 
that has been thoroughly analyzed, and I believe we are well on the way 
to thoroughly protecting the key defense infrastructure of our country 
in military bases around our country and around the world.
  But that leads us to the second question, which I am not so confident 
has been resolved, and that is what can we do to protect ourselves 
against the place at which we are most vulnerable, and that is in the 
civilian infrastructure and civilian systems of our country?

                              {time}  2230

  When the California hackers hacked into the Pentagon computers and 
disrupted our troop deployments in the Persian Gulf, it was shocking. 
But the Defense Department has acted swiftly and, I believe, 
powerfully, to prevent future repeats of this problem, future 
manifestations of this problem.
  The same really cannot be said of our civilian sector, of the air 
traffic control system, of water and power utilities, of our banking 
and financial system, of our transportation and law enforcement 
systems. Not because these people are not doing their jobs; they are 
doing a very good job, Mr. Speaker. But I think the same level of 
confidence cannot be stated about civilian institutions because they 
are civilian institutions. Thank God for the fact that the United 
States of America is not organized as a military society.
  In our country, the military does not run the airports, the military 
does not run our court system or our 911 system or our water and sewer 
and power systems; and may they never, because we are not that kind of 
society and the military is not designed for that purpose in America. 
These systems are run by some combination of public and private 
institutions that do a wonderful job of fueling and supporting the 
strongest economy in the world, but they are not organized for the 
purpose of preventing cyber-terrorism.
  The phone companies are organized for the purpose of making our calls 
go through and our data. The water and sewer and power utilities are 
organized for the purpose of making the lights go on when we turn the 
switch and the water go on when we turn the faucet and the heat go on 
when we turn the thermostat up. The air traffic control system is 
designed to get us safely from one point to another. The 911 system is 
designed to dispatch the brave and courageous men and women who ride in 
our police cars and who drive our ambulances and serve on our fire 
trucks and other emergency vehicles. Those systems work.
  Late in 1999, we saw as a country that we had a major and 
comprehensive effort to make sure that accidental breakdowns in that 
system would not paralyze and cripple our country. The phrase ``Y2K'' 
became forever embedded in our national lexicon, and it was an American 
success story. At my house, we filled our bathtub up with water on New 
Year's Eve and made sure we had all the flashlights ready and made sure 
we had some means of communicating with our loved ones, because we were 
not sure, were not exactly sure that the water would work or the lights 
would stay on and the phones would work the next day, or at 12:01. To 
the everlasting credit of America's institutions, in most cases, in 
most ways, everything worked, because we were prepared.
  But the Y2K story was really just the tip of the iceberg, Mr. 
Speaker, because the real question is what if somebody intended to do 
us harm. What if it was not an accident that the computer systems 
turned over from 99 to 00, but what if someone who could not defeat us 
by dropping bombs on our power plants or could not defeat us by having 
an army invade our shores decided to defeat us and create chaos in 
America by hacking into our systems on purpose and create that kind of 
havoc? Are we prepared? I think the answer is not nearly well enough, 
as the incident in Massachusetts in 1997 shows.
  So what do we do about it? Well, there are three approaches we could 
take and two of them are absolutely wrong. One approach would be to say 
that let us militarize everything, let us be sure we can defend our 
airports and our power plants and our phone systems and our 911 system; 
let us put the military in charge of it. There is no one, I trust, in 
this House and no one, I am certain, in America's military 
establishment who would want that result, nor would I.

  The second approach would be to say, let us just see what happens. 
Let us let the normal market forces which work so well in organizing 
our economy handle this problem. I know of very few captains of 
industry who would be so naive as to agree with that statement. Our 
phone companies, our power companies, our transportation companies are 
not organized to defend against terrorists, nor should they be. They 
are organized to deliver goods and services at a profit or in the 
proper way to the public.
  So there needs to be a third approach that is a partnership between 
and among the military community, the intelligence community, the 
private sector, the academic sector, and law enforcement. I think that 
American ingenuity in the utility companies and the telecommunications 
companies, in law enforcement could absolutely do this job and make us 
thoroughly well prepared for the cyber-attacks which are happening to 
us as we speak, but they need help. My legislation will propose that 
very high standards be set, the same way they were for Y2K. They will 
propose an active, cooperative system between and among our military 
and our law enforcement and our civilian entities, and it will propose 
reasonable and well-targeted financial assistance for those aspects of 
industry and the private and civilian sector that reach the goal most 
expeditiously and most efficiently.
  There are precedents for this, Mr. Speaker. Our MIRAD program, our 
shipbuilding program is a good precedent and it works this way, and my 
legislation will reflect this principle. We say to certain shipbuilders 
that if you are building a cargo ship, the Government of the United 
States will subsidize in part the construction of that ship through 
loan guarantees and direct contributions. We will help you build your 
ship. What you need to do for us in exchange is to make that ship 
available at a time of national emergency, to carry military cargo so 
we can deploy our troops around the world if and when necessary. It is 
burden-sharing between the vibrant commercial sector and the military 
and law enforcement carrying out its mission to defend and protect the 
country.
  That is the approach that I think we should take in our bill, is to 
share the burden with the dynamic private sector, but encourage and 
indeed require that sector to bring its level of protection up so that 
when someone wants to hack into an air traffic control system, when 
someone wants to mask the computers at the water utility so that when 
the person reading the water utility computer screen thinks there is no 
arsenic in the water because that is what the printout says, but there 
is arsenic in the water because someone has bugged the computer, there 
is a backup system. Or when someone, and this has happened, hacks into 
the telephone system and reroutes 911 calls to a pornographic call-in 
line, as has happened, or a pizza delivery service, as has happened, 
chaos will not occur; but there will be a backup system in place.
  The third thing that my legislation will do is to answer the question 
of prevention, and prevention is what we most want. We want our 
military to be able to protect us so that we can prevent cyber-attacks. 
We want our civilian sector to ramp up its efforts so that we can be 
protected from cyber-attacks. However, sometimes they are still going 
to happen, as they did in 1998 when the California hackers, aided by 
the Middle East hacker, disrupted our troop deployment; as it did in 
1997 when the airport air traffic control system in Massachusetts shut 
down for 6 hours. It is still going to happen.
  How do we very quickly find the perpetrators and understand whether 
this is a law enforcement problem that requires prosecution in our 
criminal law enforcement system or whether it is an international 
terror problem that requires a military or diplomatic response.

  There are two changes that I believe are foremost of importance that 
will be

[[Page H977]]

in the legislation that I propose. The first change is a change that 
says to the Department of Defense, we are going to take the handcuffs 
off of your hands and when a Defense Department information system or 
computer is attacked, we are going to let you find out who did it.
  I think most Americans would be amazed, Mr. Speaker, to find out that 
we have a law that works this way: if tonight a hacker hacked into an 
important Defense Department software system or computer that affected 
the launch codes for our nuclear weapons, or that affected our defenses 
against poison or nerve gas, we have a law that says, until the law 
enforcement people conclude and prove that the hackers are foreign 
agents, the Department of Defense cannot do anything about it. They 
have to wait until the law enforcement people conclude that it is not a 
domestic threat, it is foreign. In other words, we treat these hackers 
the same way we would someone who is running an illegal NCAA basketball 
betting pool on-line.
  Now, I do not for one minute disregard or impugn the abilities of our 
law enforcement people. They do a great job. But their job is to deal 
with organized crime or with those who would do harm within America. It 
is certainly not to deal with the Libyan special services forces or 
with people in North Korea who would do us harm.
  We need a law which says, when the Department of Defense's computer 
systems are under attack, they do not have to wait to find out who did 
it, that they can immediately and expeditiously figure it out and take 
whatever steps are necessary, consistent with our Constitution and 
consistent with our law to do something about that.
  The second change that I think is imperative is that we change the 
law so that our government can find out more easily about criminal 
records of people in very sensitive jobs that affect government 
infrastructure. Believe it or not, right now, if the following 
occurred, the Department of Defense and others would have a hard time 
getting information. Let me sketch this scenario.
  If what happened in Massachusetts in 1997 had happened because a 
vendor who was working for the phone company as a troubleshooter 
deliberately sabotaged the air traffic control system, and that vendor 
had someone working there who was a spy for the vendor; and that spy, 
in fact, had some kind of criminal record at the State or local level 
that would attach that spy's conduct or relationships with foreign 
agents, and we had in our CIA database evidence that if we knew that 
this spy, if we knew about his record that we could figure out who was 
hooked in internationally, our military people cannot get access to the 
State and local criminal records of that spy. It is illegal. It is 
unbelievable.
  The fourth amendment does not give someone who wants to do harm to 
the people of this country license to do so with impunity. There is no 
Member of this body who is more committed to the principles of the 
fourth amendment than me. I think it needs to be respected and revered 
in every way. But this is not a fourth amendment issue; this is a 
national security issue. We need to change the law in such a way that 
our military protectors and defenders, if they have intelligence that 
says that someone is trying to hack into the air traffic control system 
because they are working for the Libyan government or the North Korean 
government or the Iraqi government, and there is evidence in State and 
local criminal records that would help them find that person and stop 
them, we need to empower them to do that. The legislation that I will 
be proposing will do just that.

  Mr. Speaker, the gentleman from Pennsylvania (Mr. Weldon), the 
chairman of the Subcommittee on Research and Development, and I have 
both served in local government; and we understand that one of the 
things that happens in local government is that for a long time people 
will say, there really needs to be a traffic light at such-and-such an 
intersection; it is really dangerous. And they come out to meetings and 
they tell their mayor and they tell their council and they talk for 
years about the need for a traffic light. Then, in places where 
government is not very responsive, which is not true in Delaware 
County, Pennsylvania, and it is not true in my area either, in places 
where government is not responsive, they do not put up the traffic 
light. They wait until there is a fatality, a fatal accident at that 
intersection, and then they rush and put the traffic light up.
  I never want to come to this floor and have 435 Members clamoring to 
pass legislation that would unlock the potential of our military 
people, consistent with our Constitution; I never want to have them 
coming to this floor clamoring to do that because the morning news is 
full of reports of planes crashing over the sky over a major airport, 
or thousands of people being poisoned because their drinking water was 
poisoned and the computer systems that would have told the utility that 
were hacked into.

                              {time}  2245

  I never want to have a national uproar because all the 911 calls for 
a major city went to a pizzeria or an airline reservation counter 
instead of to the police and the fire department. I never want to have 
a situation where there is financial chaos and there is a run on our 
banks because the checking account records or credit card records of 
millions of Americans are deliberately sabotauged.
  Mr. Speaker, this is not the stuff of a Tom Clancy novel. It is the 
stuff that Members of this House are hearing about, both in classified 
and unclassified briefings. We have been warned, and to the Paul 
Reveres of this effort, like the gentleman from Pennsylvania (Mr. 
Weldon), the gentleman from South Carolina (Mr. Spence), and the 
gentleman from Missouri (Mr. Skelton) who have paid attention to this, 
Secretary Hamre, people that work with him, we need to give them the 
tools that they need to continue to do this job.
  I notice that my friend, the gentleman from Pennsylvania (Mr. Weldon) 
is here. I am happy to yield to him, and commend him on his leadership 
on this for many years.
  Mr. WELDON of Pennsylvania. Mr. Speaker, I thank my colleague and 
friend for yielding. I came over for this special order, having watched 
his beginning and agreeing totally with the statement, and I appreciate 
the gentleman's leadership in making this a personal issue for him, for 
taking the time to understand a very complicated issue that many 
Members do not have the time to get into, but which is so vitally 
important to our country.
  As the gentleman knows from hearings that we have held in our 
Subcommittee on Military Research and Development, we are going through 
a major revolution in America that the people really do not understand. 
In fact, we only have had one other revolution of this kind in our 
country's history. It was when we changed from an agrarian country 
where we made most of our living on the farms and on the land to an 
industrial economy, where people went to work in our factories building 
products and materials. It was a difficult change for America, but we 
did it because we wanted to lead the world economy in the 1900s, and we 
did it very successfully.
  Now we are going through a similar revolution, changing from an 
industrial economy to an information economy, where more and more every 
day in our lives we are affected by the use of computers and 
information technology.
  As a result, some very interesting and difficult challenges face us, 
because the single biggest technology, probably, to improving our 
quality of life has been the use of information technology.
  I would argue, and I think my colleague would agree with me, that the 
single biggest vulnerability to continuing our quality of life is the 
use of information technology. If an adversary wants to take out 
America, they know in most cases they cannot match us gun for gun, tank 
for tank, plane for plane. That is an impossible task. But they know 
full well that our society is largely dependent upon information 
systems: our military systems, our smart weapons; but even beyond that, 
our information systems. Our banking, our communications, our air 
traffic control, electric grid, are all based on information 
technology.
  So if you are an adversary of the U.S. in the 21st century, you are 
going to try to find a way to neutralize that

[[Page H978]]

technology advantage, to level the playing field. That is exactly what 
nations are doing today. As my colleague knows, in classified hearings 
we have held, there are in fact countries today that are working very 
diligently in finding ways to be able to shut down the communications 
and information systems of America during times of conflict.

  It is a major concern for us also because we are having a difficult 
time keeping talented young people in the service when they can make 
three to four times the amount of money they are making as a software 
engineer for the Pentagon going out to work for a private company. So 
we have a very difficult challenge keeping up with that technology 
leap.
  In fact, in the past, in the history of the country, military 
technology has often been ahead of the civilian community: the first 
airplane, the first jet engine. That is changing now. With the growth 
of the information revolution, the private sector and information 
technology companies and some of our would-be adversaries have the 
technology capability equal to or better than we have in the military. 
Therefore, we have a tough time keeping up.
  So the kinds of ideas that the gentleman is pursuing, the kinds of 
strategies to focus the attention of the American people, not just our 
military, on information vulnerability are critically important.
  I will give the gentleman a couple of horror stories. I cannot give 
the details. But to highlight the point he has made, we had a 
classified hearing several years ago where it was documented to us that 
one of our military hospitals had all of its health care records, all 
the blood types of all the patients, changed by a hacker who broke into 
the IT system without the administration of the hospital knowing all 
the blood types had been changed.
  If the American citizen sitting at home wants to understand the 
impact on their life, imagine a loved one being in the hospital and all 
of a sudden, every blood type of every patient has been changed by 
someone who had access to that information system.
  The banking system in America likes to pride itself on being the best 
at information security, but we all know there was a New York bank just 
a few years ago that had $10 million illegally transferred out of its 
accounts by a St. Petersburg, Russia firm that they were not able to 
stop, and the banking community has had examples like that where 
hackers have broken in and taken money away.
  As the gentleman has pointed out, we need to think differently in the 
21st century. If a terrorist group comes into America and wants to 
discharge a chemical or biological weapon, we need to have broad-based 
data systems so we can detect whether or not there is a pattern of 
occurrence of health care problems that might indicate to us that 
someone has released some type of toxic material. Because a warning may 
not be accompanied by a bomb, it may simply be a low-key release of an 
agent that we will not be able to determine unless we have processes in 
place to be able to do massive data mining.
  I want to also applaud my colleague because he has been assisting 
very aggressively in establishing the first smart region in America. 
The idea behind this initiative, the HUBs project, is to link up as 
many of our institutions in the four States of New Jersey, Delaware, 
Pennsylvania, and Maryland to demonstrate that we can build smart 
regions in America, we can link technology, but we must build security 
in the process. We must have encryption capability, we must have 
security controls and access controls, not just in the government 
agency systems but also in our hospitals, in our schools, in our 
colleges, in our private business establishments.
  I just want to add my comments and my praise. The gentleman is a 
leader in this effort. I look forward to the legislation that the 
gentleman is working on. As I have told the gentleman, I would be happy 
to cosponsor it. We need forward thinking, because this is really a new 
challenge. It is the single biggest threat to our security in the 21st 
century, the threat of being able to disarm America's economy and 
America's quality of life by disarming our information systems.

  Mr. ANDREWS. I thank my friend, and again, long before this was an 
issue on the evening news or the front page of the newspaper, the 
gentleman from Pennsylvania (Mr. Weldon) was working on this issue on 
his committee, on the floor.
  It is not a partisan issue, it is an issue that he has played a major 
role in educating people about. We thank the gentleman for that, and I 
look forward to following the gentleman's lead and to bringing 
legislation to this floor this spring that will help address these 
issues.
  Mr. WELDON of Pennsylvania. I look forward to supporting it. The 
gentleman mentioned bipartisan. He is so right. The gentleman mentioned 
John Hamre's name. There is no one I respect more in this 
administration than John Hamre. It is unfortunate that he is leaving to 
go head the Center for Strategic and International Security, but he is 
a great leader.
  It was John Hamre who 2 years ago, in leading this administration on 
this issue, made this quote: ``It is not a matter of if America has an 
electronic Pearl Harbor, but when.''
  This past year when he came in before our committee, he said that we 
were at war, in a cyber war, at the very moment he came in, because we 
were in the middle of a massive attack on our defense information 
systems by an organized network that we think was focused in a selected 
few countries, but it has been a totally bipartisan effort.
  The gentleman's leadership has been critically important. There is a 
need for more work like the gentleman is doing, and again I look 
forward to supporting the gentleman's legislation.
  Mr. ANDREWS. I thank my friend for being here tonight as well, Mr. 
Speaker. We are going to summarize.
  I want again say that each one of us involved in this effort is 
devoted to the idea of our constitutional principles, devoted to the 
idea of the separation of civilian and military; of the fact that in 
this country, the military responds to decisions by the civilian 
sector.
  Each one of us is firmly committed to the sanctity of the 
constitutional rights of privacy, the protection against search and 
seizure, the rights of legitimate people in our country to be protected 
from the abuse of State power. We need not choose between forfeiting 
our Fourth Amendment rights and defending our country. These are 
consistent goals.
  But in order to pursue these goals, we need to rethink the way we 
pursue them. I think that is so very, very important.
  Mr. Speaker, I am here late tonight, and normally I would have the 
greatest privilege of my life, which is tucking my 7-year-old and 5-
year-old into bed, my daughters Jaqueline and Josie, and their mother 
did that a while ago, I hope, tonight.
  We are really fortunate that we put our children to bed tonight in a 
country that is safe and strong. It is not safe and strong everywhere, 
there are children who are going to sleep tonight in horribly violent 
neighborhoods and areas and horribly violent homes, ruined by alcohol 
and drug abuse and by all kinds of pernicious behavior.
  But this is a country that, at least in terms of pernicious behavior 
in the world, is safer than it has ever been, and is the safest place 
in the world because of those who sacrificed in the service of their 
country, and who do so tonight.
  But despite that sacrifice, there is a war going on  tonight. As we 
put our children to sleep tonight, we have to put them to sleep with 
the sure understanding that there are evil and pernicious people in the 
world who are trying to do to us what Hitler and the Japanese could not 
do to us with their bombs and their armaments in World War II, could 
not do to us what the former Soviet Union threatened to do with us with 
their intercontinental ballistic missiles in the Cold War, could not do 
to us what foreign powers have tried to do to us throughout our 
history. That is to undermine and destroy the sovereignty and sanctity 
of our country. The way they are trying to do it is pernicious, it is 
lethal, but it is very quiet.

  I pray that the night will never come when we wake up and hear that 
millions of our fellow citizens have been poisoned by their drinking 
water because the software that is supposed to detect poison was hacked 
into.
  I pray that we never wake up and hear that thousands of people 
crashed

[[Page H979]]

to their death above airports because of an intentional violation of 
our air traffic control system.
  I pray that we never wake up and find financial chaos, and people 
withdrawing their money from our banking system because the money they 
thought was safe and the records they thought were accurate proved to 
be neither.
  I pray that we never wake up to a country where, when we try to call 
our police and fire and emergency management personnel by dialing 911, 
we cannot get through because someone has deliberately interfered with 
that system.
  This is a reality. Now, thankfully, it is a reality that our military 
and our intelligence community are preparing vigilantly to protect us 
against. It is our job to give them the tools. But there is immense 
preparation that still must be done on this floor in legislation with 
our resources to both require and incentivize our civilian sector to 
meet the same standards of protection as our military has met, and then 
to give our military and law enforcement the tools to apprehend those 
who do us harm.
  Mr. Speaker, it is my prayer that this issue will become irrelevant 
because we will be so well prepared, but I do not assume that that is 
the case.

                          ____________________