[Congressional Record Volume 146, Number 28 (Tuesday, March 14, 2000)]
[House]
[Pages H974-H979]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
CYBER TERRORISM, A REAL THREAT TO SOCIETY
The SPEAKER pro tempore. Under the Speaker's announced policy of
January 6, 1999, the gentleman from New Jersey (Mr. Andrews) is
recognized for half the remaining time until midnight, approximately 50
minutes, as the designee of the minority leader.
Mr. ANDREWS. Mr. Speaker, I want to begin by expressing my
appreciation to the Chair at this very late hour and to the members of
the staff who are so diligently working here with us and for us at this
very late hour as well.
We are gathered tonight at a time of unprecedented peace and power
for our country. Because of the enormous dedication and sacrifice of
Americans who have served in our armed forces throughout history,
around the world in the past and at present, our country is stronger
and more secure than it has ever been, and that is a blessing for which
we are truly thankful.
Certainly that thanks is directed at those who wear the uniform of
our country tonight around the world and those who have so nobly worn
it in the past. It is truly a gift and a legacy that we enjoy tonight.
Our relative strength in the world does not mean that we live in a
purely safe world, a world without risk. We must endeavor not to repeat
the mistakes of history, where very often at times when we felt most
safe we were most vulnerable.
There are clearly three areas of major threats to our country's
security as we gather tonight. The first is the threat of an emerging
competing global superpower in the People's Republic of China. The
second is the continued virulent presence of regional negative hostile
dictatorial forces such as Saddam Hussein in the Persian Gulf,
President Milosevic in the former Yugoslavia. Those two threats, the
threat of China and the threat of those regional dictators, are very
severe threats indeed. I trust that in the coming weeks and months we
will consider as a Congress, along with the executive branch and the
military, ways to confront those threats.
This evening I want to spend, Mr. Speaker, some time talking about a
threat that is not so easily detected, is not so obvious, but a threat
that I believe is truly lethal and deadly, a threat that is unlike any
threat that we have faced in the history of our republic, and that is
the silent but deadly threat of cyber terrorism, the quiet but lethal
assault on our country's systems and people, which I believe will be
one of the major issues in the new century, the new millennium, in the
defense of our country.
Unlike the growth of a large superpower army, unlike the
proliferation of arms from a hostile nation state, we cannot readily or
easily see the development of the cyber threat. I pray that we may
never feel it and tonight I would like to talk about how we can prepare
for it.
I would like to begin by talking about what has already happened to
make it clear that our subject tonight is not an imaginary one. It is
all too real. Listen to George Tenet, the director of the Central
Intelligence Agency, speaking a few months ago. He said, and I am
quoting, ``An adversary capable of implanting the right virus or
accessing the right terminal can cause massive damage to the United
States of America,'' the right virus or the right terminal.
{time} 2215
In 1998, two youngsters in California, directed by a hacker in the
Middle East who was later described as the Analyzer, launched attacks
which disrupted our troop movements in the Persian Gulf. These two
young hackers, based in California and directed by the Analyzer in the
Middle East, disrupted troop deployments to the Persian Gulf in
February of 1998 from California, launched attacks against the Pentagon
systems, the National Security Agency and a nuclear weapons research
lab.
The deployment disruptions, that is, the disruptions in the
deployment of our troops around the world and the Persian Gulf, from a
computer terminal in California, were described by Deputy Secretary of
Defense John Hamre, a real leader in this field, as ``the most
organized and systematic attack'' on U.S. defense systems ever
detected. In fact, they were so expertly conducted that President
Clinton was warned in the early phases that Iraq was most probably the
electronic attacker.
Two teenagers steered and directed by a master hacker halfway around
the world, launching what our number one defender has called the most
organized and systematic attack on sophisticated defense computer
systems, so sophisticated that in the early hours of the attack the
President of the United States was told by his most wise and
knowledgeable advisers that Iraq was the electronic attacker. It was
not Iraq, it was two U.S. citizens directed by a hacker in the Middle
East.
On March 10, 1997, another teenager, this one based in Massachusetts,
invaded a computer system run by the Bell Atlantic company in
Massachusetts, knocked out telephone communications, among them
telecommunications, telephone service, for the Worcester, Massachusetts
air traffic control system at that airport in western Massachusetts.
The tower was knocked out for 6 hours.
Let me read from a report from the Boston Globe of March 19, 1998.
``The computer breach knocked out phone and radio transmission to the
control tower at the Worcester airport for 6 hours, forcing controllers
to rely on one cellular phone and battery powered radios to direct
planes.''
One teenager hacking into a computer system of a major regional
telephone company, knocking out for 6
[[Page H975]]
hours the telecommunications capacity of an entire area, and including
an airport. And as people flew through the skies above Worcester,
Massachusetts, the air traffic controllers relied on one cell phone and
battery powered radios to direct the planes.
Joseph Hogan, who manages the control tower at Worcester and 26 other
airports for the Federal Aviation Administration, said this: ``We
relied on our back-up systems, and, thank goodness, they worked. Had we
been busier, the potential for a serious incident with dire
consequences was there.'' Six hours.
In 1997, our intelligence community conducted what was called
Operation Eligible Receiver, a war game played in cyberspace, an
intelligent and far-reaching attempt by the U.S. military and
intelligence community to game out what would happen if a hostile
foreign power tried to attack our systems around the country.
A so-called red team put together by the intelligence community
pretended to be North Korea. Thirty-five men and women specialists, 35
people using hacking tools freely available on 1,900 web sites, Mr.
Speaker, any of our listeners tonight could access on their home
computer right now. These 35 men and women accessing those 1,900 web
sites in the public domain managed to shut down large segments of
America's power grid and silence the command and control system of the
Pacific Command in Honolulu.
The Defense Information Systems Agency, DISA, launched some 38,000
attacks against its own systems to test their vulnerabilities. Only 4
percent of the people in charge of those targeted systems realized they
were under attack, and, of those, only 1 in 150 reported the intrusion
to the superior authority.
We had a war game, and the good guys lost. The smartest and most
capable people that we have were rather easily outwitted by this war
game.
A Pentagon report goes on to say that probing attacks against the
Pentagon, there are tens of thousands of them a year, are routed and
looped through half a dozen other countries to camouflage where the
attack originated. Information warfare specialists at the Pentagon
estimate that a properly prepared and well-coordinated attack by fewer
than 30, 30 computer virtuosos, strategically located around the world,
with a budget of less than $10 million, could bring the United States
to its knees. Such a strategic attack mounted by a cyber-terrorist
group, either sub-state or non-state actors, that is to say either
terrorist groups that are not part of any state or terrorist groups
that are sponsored by a rogue state, would shut down everything from
electric power grids to air traffic control centers. A combination of
cyber-weapons, poison gas and even nuclear devices could produce a
global Waterloo for the United States.
In 1999, the Pentagon tracked 22,144 intrusions on its own sensitive
computer systems. 22,144 times in the last calendar year people figured
out how to hack their way in to our most vulnerable systems. That is
according to Major General John H. Campbell of the United States Air
Force.
Deputy Secretary Hamre reports that his sources show that there are
at least 20 countries who presently have information warfare strategies
and operations active against the United States. This is an
overwhelming and compelling body of evidence that says that this is not
a question of whether we will be prepared for something that will
happen to us in the future; this is a question of how well we are
prepared for something that is happening to us right now, tonight,
around the world.
Now, there is good news to report. As a member of the Committee on
Armed Services, I have had the opportunity to meet and listen to and be
briefed by some incredibly committed and talented men and women, both
in the civilian service of this country and the Department of Defense
and in the uniform of this country in the branches of our armed
Services, and also serving in the various intelligence agencies of this
government.
Mr. Speaker, we are blessed tonight with a robust, dynamic and bright
corps of young men and women who are committed to defending their
country. With the tools that we have given them, they are doing a
magnificent job. Deputy Secretary of Defense Hamre is the leader of
this effort and deserves special praise. His Assistant Secretary, Art
Money, deserves special praise, and so do many others who work at their
direction who have foreseen this problem, have been so diligent in
pursuing it, and are truly inspiring in their level of preparation.
I have no doubt, no doubt whatsoever, that if we do our job, Mr.
Speaker, and give these civilians and uniformed personnel and
intelligence personnel the tools to do their job, they will excel in
doing their job and protect our country.
This issue is not new to this floor. The gentleman from Pennsylvania
(Mr. Weldon), my friend and colleague from nearby Pennsylvania, has
been working on this issue years before it found its way into the
headlines. He is serving as the Chairman of the Subcommittee on
Research and Development of our Committee on Armed Services and has
been a long time advocate of this cause.
The gentleman from South Carolina (Mr. Spence), the chairman of the
Committee on Armed Services, a Republican, and the gentleman from
Missouri (Mr. Skelton), the Democratic ranking member of the committee,
have very wisely appointed a special task force of our committee to
focus on cyber-terrorism in this year's defense budget. That special
committee is ably chaired by my neighbor and friend, the gentleman from
New Jersey (Mr. Saxton). The members of the committee are truly
dedicated to this purpose, and I believe that the efforts of Chairman
Spence and Mr. Skelton and Chairman Weldon and Chairman Saxton and
those of us working with them on this effort are going to elevate this
issue in this Congress, in this defense budget and defense bill, and
take some important steps that really need to be taken.
Now, these steps would follow on the heels of the President's
directive number 63 which was issued on May 22, 1998. That directive,
which is well under way, is a good first step toward addressing the
very real problems that I talked about tonight. But I think we have to
build on those steps and understand the very unique nature of the
problem before us.
Our country is organized, and well organized, for the world of
physical space. Our military strategy has always been about protecting
and defending key points of territory, the seas, land, so we could
protect the sovereignty and rights of our people. We have always
recognized a distinction in our civil law between civilian and
military, between police action and law enforcement on the one hand and
military action on the other.
These are time-honored and wise distinctions that we should never
forfeit, but they are distinctions based on the physical world. And
when we deal with the world of cyber-terrorism, we need to rethink
them. By no means should we abandon cherished principles that recognize
that civilian authority rules our country and the military serves
civilian authority. By no means should we abandon the principle that
recognizes the rights of Americans to enjoy privacy in their homes, the
reasonable expectation of privacy in their affairs.
By no means should we forfeit those principles, but by no means
should we permit those who would do us harm and terror to hide behind
those principles to abuse the purposes of those principles and subject
the country to horrible acts of destruction.
This month I will be introducing legislation that creates a strategy
to address what I believe are the three great questions posed for our
country by the here and instant onslaught of cyber-terrorism.
The first question is how can we make sure that our military is fully
prepared? The President has given us great guidance in this in his
budget proposals for the new fiscal year. He has set aside $91 million,
not for software or fancy computers or bricks and mortar, but he set
aside $91 million so we can be sure that the smartest and most
motivated Americans serve their country in this field. Scholarships for
bright young students, continuing education for those who already
serve, institutes and centers and programs for people to come together
from the worlds of business and academia and government and the
military and think about ways that we can address and solve these
problems.
[[Page H976]]
I believe, based upon the classified briefings I have been privileged
to receive and the record in the public domain, that the U.S. military,
the U.S. intelligence community and the civilian employees of the
Department of Defense are ahead of the curve in this area. We are by no
means invulnerable in our defense infrastructure, but this is a problem
that has been thoroughly analyzed, and I believe we are well on the way
to thoroughly protecting the key defense infrastructure of our country
in military bases around our country and around the world.
But that leads us to the second question, which I am not so confident
has been resolved, and that is what can we do to protect ourselves
against the place at which we are most vulnerable, and that is in the
civilian infrastructure and civilian systems of our country?
{time} 2230
When the California hackers hacked into the Pentagon computers and
disrupted our troop deployments in the Persian Gulf, it was shocking.
But the Defense Department has acted swiftly and, I believe,
powerfully, to prevent future repeats of this problem, future
manifestations of this problem.
The same really cannot be said of our civilian sector, of the air
traffic control system, of water and power utilities, of our banking
and financial system, of our transportation and law enforcement
systems. Not because these people are not doing their jobs; they are
doing a very good job, Mr. Speaker. But I think the same level of
confidence cannot be stated about civilian institutions because they
are civilian institutions. Thank God for the fact that the United
States of America is not organized as a military society.
In our country, the military does not run the airports, the military
does not run our court system or our 911 system or our water and sewer
and power systems; and may they never, because we are not that kind of
society and the military is not designed for that purpose in America.
These systems are run by some combination of public and private
institutions that do a wonderful job of fueling and supporting the
strongest economy in the world, but they are not organized for the
purpose of preventing cyber-terrorism.
The phone companies are organized for the purpose of making our calls
go through and our data. The water and sewer and power utilities are
organized for the purpose of making the lights go on when we turn the
switch and the water go on when we turn the faucet and the heat go on
when we turn the thermostat up. The air traffic control system is
designed to get us safely from one point to another. The 911 system is
designed to dispatch the brave and courageous men and women who ride in
our police cars and who drive our ambulances and serve on our fire
trucks and other emergency vehicles. Those systems work.
Late in 1999, we saw as a country that we had a major and
comprehensive effort to make sure that accidental breakdowns in that
system would not paralyze and cripple our country. The phrase ``Y2K''
became forever embedded in our national lexicon, and it was an American
success story. At my house, we filled our bathtub up with water on New
Year's Eve and made sure we had all the flashlights ready and made sure
we had some means of communicating with our loved ones, because we were
not sure, were not exactly sure that the water would work or the lights
would stay on and the phones would work the next day, or at 12:01. To
the everlasting credit of America's institutions, in most cases, in
most ways, everything worked, because we were prepared.
But the Y2K story was really just the tip of the iceberg, Mr.
Speaker, because the real question is what if somebody intended to do
us harm. What if it was not an accident that the computer systems
turned over from 99 to 00, but what if someone who could not defeat us
by dropping bombs on our power plants or could not defeat us by having
an army invade our shores decided to defeat us and create chaos in
America by hacking into our systems on purpose and create that kind of
havoc? Are we prepared? I think the answer is not nearly well enough,
as the incident in Massachusetts in 1997 shows.
So what do we do about it? Well, there are three approaches we could
take and two of them are absolutely wrong. One approach would be to say
that let us militarize everything, let us be sure we can defend our
airports and our power plants and our phone systems and our 911 system;
let us put the military in charge of it. There is no one, I trust, in
this House and no one, I am certain, in America's military
establishment who would want that result, nor would I.
The second approach would be to say, let us just see what happens.
Let us let the normal market forces which work so well in organizing
our economy handle this problem. I know of very few captains of
industry who would be so naive as to agree with that statement. Our
phone companies, our power companies, our transportation companies are
not organized to defend against terrorists, nor should they be. They
are organized to deliver goods and services at a profit or in the
proper way to the public.
So there needs to be a third approach that is a partnership between
and among the military community, the intelligence community, the
private sector, the academic sector, and law enforcement. I think that
American ingenuity in the utility companies and the telecommunications
companies, in law enforcement could absolutely do this job and make us
thoroughly well prepared for the cyber-attacks which are happening to
us as we speak, but they need help. My legislation will propose that
very high standards be set, the same way they were for Y2K. They will
propose an active, cooperative system between and among our military
and our law enforcement and our civilian entities, and it will propose
reasonable and well-targeted financial assistance for those aspects of
industry and the private and civilian sector that reach the goal most
expeditiously and most efficiently.
There are precedents for this, Mr. Speaker. Our MIRAD program, our
shipbuilding program is a good precedent and it works this way, and my
legislation will reflect this principle. We say to certain shipbuilders
that if you are building a cargo ship, the Government of the United
States will subsidize in part the construction of that ship through
loan guarantees and direct contributions. We will help you build your
ship. What you need to do for us in exchange is to make that ship
available at a time of national emergency, to carry military cargo so
we can deploy our troops around the world if and when necessary. It is
burden-sharing between the vibrant commercial sector and the military
and law enforcement carrying out its mission to defend and protect the
country.
That is the approach that I think we should take in our bill, is to
share the burden with the dynamic private sector, but encourage and
indeed require that sector to bring its level of protection up so that
when someone wants to hack into an air traffic control system, when
someone wants to mask the computers at the water utility so that when
the person reading the water utility computer screen thinks there is no
arsenic in the water because that is what the printout says, but there
is arsenic in the water because someone has bugged the computer, there
is a backup system. Or when someone, and this has happened, hacks into
the telephone system and reroutes 911 calls to a pornographic call-in
line, as has happened, or a pizza delivery service, as has happened,
chaos will not occur; but there will be a backup system in place.
The third thing that my legislation will do is to answer the question
of prevention, and prevention is what we most want. We want our
military to be able to protect us so that we can prevent cyber-attacks.
We want our civilian sector to ramp up its efforts so that we can be
protected from cyber-attacks. However, sometimes they are still going
to happen, as they did in 1998 when the California hackers, aided by
the Middle East hacker, disrupted our troop deployment; as it did in
1997 when the airport air traffic control system in Massachusetts shut
down for 6 hours. It is still going to happen.
How do we very quickly find the perpetrators and understand whether
this is a law enforcement problem that requires prosecution in our
criminal law enforcement system or whether it is an international
terror problem that requires a military or diplomatic response.
There are two changes that I believe are foremost of importance that
will be
[[Page H977]]
in the legislation that I propose. The first change is a change that
says to the Department of Defense, we are going to take the handcuffs
off of your hands and when a Defense Department information system or
computer is attacked, we are going to let you find out who did it.
I think most Americans would be amazed, Mr. Speaker, to find out that
we have a law that works this way: if tonight a hacker hacked into an
important Defense Department software system or computer that affected
the launch codes for our nuclear weapons, or that affected our defenses
against poison or nerve gas, we have a law that says, until the law
enforcement people conclude and prove that the hackers are foreign
agents, the Department of Defense cannot do anything about it. They
have to wait until the law enforcement people conclude that it is not a
domestic threat, it is foreign. In other words, we treat these hackers
the same way we would someone who is running an illegal NCAA basketball
betting pool on-line.
Now, I do not for one minute disregard or impugn the abilities of our
law enforcement people. They do a great job. But their job is to deal
with organized crime or with those who would do harm within America. It
is certainly not to deal with the Libyan special services forces or
with people in North Korea who would do us harm.
We need a law which says, when the Department of Defense's computer
systems are under attack, they do not have to wait to find out who did
it, that they can immediately and expeditiously figure it out and take
whatever steps are necessary, consistent with our Constitution and
consistent with our law to do something about that.
The second change that I think is imperative is that we change the
law so that our government can find out more easily about criminal
records of people in very sensitive jobs that affect government
infrastructure. Believe it or not, right now, if the following
occurred, the Department of Defense and others would have a hard time
getting information. Let me sketch this scenario.
If what happened in Massachusetts in 1997 had happened because a
vendor who was working for the phone company as a troubleshooter
deliberately sabotaged the air traffic control system, and that vendor
had someone working there who was a spy for the vendor; and that spy,
in fact, had some kind of criminal record at the State or local level
that would attach that spy's conduct or relationships with foreign
agents, and we had in our CIA database evidence that if we knew that
this spy, if we knew about his record that we could figure out who was
hooked in internationally, our military people cannot get access to the
State and local criminal records of that spy. It is illegal. It is
unbelievable.
The fourth amendment does not give someone who wants to do harm to
the people of this country license to do so with impunity. There is no
Member of this body who is more committed to the principles of the
fourth amendment than me. I think it needs to be respected and revered
in every way. But this is not a fourth amendment issue; this is a
national security issue. We need to change the law in such a way that
our military protectors and defenders, if they have intelligence that
says that someone is trying to hack into the air traffic control system
because they are working for the Libyan government or the North Korean
government or the Iraqi government, and there is evidence in State and
local criminal records that would help them find that person and stop
them, we need to empower them to do that. The legislation that I will
be proposing will do just that.
Mr. Speaker, the gentleman from Pennsylvania (Mr. Weldon), the
chairman of the Subcommittee on Research and Development, and I have
both served in local government; and we understand that one of the
things that happens in local government is that for a long time people
will say, there really needs to be a traffic light at such-and-such an
intersection; it is really dangerous. And they come out to meetings and
they tell their mayor and they tell their council and they talk for
years about the need for a traffic light. Then, in places where
government is not very responsive, which is not true in Delaware
County, Pennsylvania, and it is not true in my area either, in places
where government is not responsive, they do not put up the traffic
light. They wait until there is a fatality, a fatal accident at that
intersection, and then they rush and put the traffic light up.
I never want to come to this floor and have 435 Members clamoring to
pass legislation that would unlock the potential of our military
people, consistent with our Constitution; I never want to have them
coming to this floor clamoring to do that because the morning news is
full of reports of planes crashing over the sky over a major airport,
or thousands of people being poisoned because their drinking water was
poisoned and the computer systems that would have told the utility that
were hacked into.
{time} 2245
I never want to have a national uproar because all the 911 calls for
a major city went to a pizzeria or an airline reservation counter
instead of to the police and the fire department. I never want to have
a situation where there is financial chaos and there is a run on our
banks because the checking account records or credit card records of
millions of Americans are deliberately sabotauged.
Mr. Speaker, this is not the stuff of a Tom Clancy novel. It is the
stuff that Members of this House are hearing about, both in classified
and unclassified briefings. We have been warned, and to the Paul
Reveres of this effort, like the gentleman from Pennsylvania (Mr.
Weldon), the gentleman from South Carolina (Mr. Spence), and the
gentleman from Missouri (Mr. Skelton) who have paid attention to this,
Secretary Hamre, people that work with him, we need to give them the
tools that they need to continue to do this job.
I notice that my friend, the gentleman from Pennsylvania (Mr. Weldon)
is here. I am happy to yield to him, and commend him on his leadership
on this for many years.
Mr. WELDON of Pennsylvania. Mr. Speaker, I thank my colleague and
friend for yielding. I came over for this special order, having watched
his beginning and agreeing totally with the statement, and I appreciate
the gentleman's leadership in making this a personal issue for him, for
taking the time to understand a very complicated issue that many
Members do not have the time to get into, but which is so vitally
important to our country.
As the gentleman knows from hearings that we have held in our
Subcommittee on Military Research and Development, we are going through
a major revolution in America that the people really do not understand.
In fact, we only have had one other revolution of this kind in our
country's history. It was when we changed from an agrarian country
where we made most of our living on the farms and on the land to an
industrial economy, where people went to work in our factories building
products and materials. It was a difficult change for America, but we
did it because we wanted to lead the world economy in the 1900s, and we
did it very successfully.
Now we are going through a similar revolution, changing from an
industrial economy to an information economy, where more and more every
day in our lives we are affected by the use of computers and
information technology.
As a result, some very interesting and difficult challenges face us,
because the single biggest technology, probably, to improving our
quality of life has been the use of information technology.
I would argue, and I think my colleague would agree with me, that the
single biggest vulnerability to continuing our quality of life is the
use of information technology. If an adversary wants to take out
America, they know in most cases they cannot match us gun for gun, tank
for tank, plane for plane. That is an impossible task. But they know
full well that our society is largely dependent upon information
systems: our military systems, our smart weapons; but even beyond that,
our information systems. Our banking, our communications, our air
traffic control, electric grid, are all based on information
technology.
So if you are an adversary of the U.S. in the 21st century, you are
going to try to find a way to neutralize that
[[Page H978]]
technology advantage, to level the playing field. That is exactly what
nations are doing today. As my colleague knows, in classified hearings
we have held, there are in fact countries today that are working very
diligently in finding ways to be able to shut down the communications
and information systems of America during times of conflict.
It is a major concern for us also because we are having a difficult
time keeping talented young people in the service when they can make
three to four times the amount of money they are making as a software
engineer for the Pentagon going out to work for a private company. So
we have a very difficult challenge keeping up with that technology
leap.
In fact, in the past, in the history of the country, military
technology has often been ahead of the civilian community: the first
airplane, the first jet engine. That is changing now. With the growth
of the information revolution, the private sector and information
technology companies and some of our would-be adversaries have the
technology capability equal to or better than we have in the military.
Therefore, we have a tough time keeping up.
So the kinds of ideas that the gentleman is pursuing, the kinds of
strategies to focus the attention of the American people, not just our
military, on information vulnerability are critically important.
I will give the gentleman a couple of horror stories. I cannot give
the details. But to highlight the point he has made, we had a
classified hearing several years ago where it was documented to us that
one of our military hospitals had all of its health care records, all
the blood types of all the patients, changed by a hacker who broke into
the IT system without the administration of the hospital knowing all
the blood types had been changed.
If the American citizen sitting at home wants to understand the
impact on their life, imagine a loved one being in the hospital and all
of a sudden, every blood type of every patient has been changed by
someone who had access to that information system.
The banking system in America likes to pride itself on being the best
at information security, but we all know there was a New York bank just
a few years ago that had $10 million illegally transferred out of its
accounts by a St. Petersburg, Russia firm that they were not able to
stop, and the banking community has had examples like that where
hackers have broken in and taken money away.
As the gentleman has pointed out, we need to think differently in the
21st century. If a terrorist group comes into America and wants to
discharge a chemical or biological weapon, we need to have broad-based
data systems so we can detect whether or not there is a pattern of
occurrence of health care problems that might indicate to us that
someone has released some type of toxic material. Because a warning may
not be accompanied by a bomb, it may simply be a low-key release of an
agent that we will not be able to determine unless we have processes in
place to be able to do massive data mining.
I want to also applaud my colleague because he has been assisting
very aggressively in establishing the first smart region in America.
The idea behind this initiative, the HUBs project, is to link up as
many of our institutions in the four States of New Jersey, Delaware,
Pennsylvania, and Maryland to demonstrate that we can build smart
regions in America, we can link technology, but we must build security
in the process. We must have encryption capability, we must have
security controls and access controls, not just in the government
agency systems but also in our hospitals, in our schools, in our
colleges, in our private business establishments.
I just want to add my comments and my praise. The gentleman is a
leader in this effort. I look forward to the legislation that the
gentleman is working on. As I have told the gentleman, I would be happy
to cosponsor it. We need forward thinking, because this is really a new
challenge. It is the single biggest threat to our security in the 21st
century, the threat of being able to disarm America's economy and
America's quality of life by disarming our information systems.
Mr. ANDREWS. I thank my friend, and again, long before this was an
issue on the evening news or the front page of the newspaper, the
gentleman from Pennsylvania (Mr. Weldon) was working on this issue on
his committee, on the floor.
It is not a partisan issue, it is an issue that he has played a major
role in educating people about. We thank the gentleman for that, and I
look forward to following the gentleman's lead and to bringing
legislation to this floor this spring that will help address these
issues.
Mr. WELDON of Pennsylvania. I look forward to supporting it. The
gentleman mentioned bipartisan. He is so right. The gentleman mentioned
John Hamre's name. There is no one I respect more in this
administration than John Hamre. It is unfortunate that he is leaving to
go head the Center for Strategic and International Security, but he is
a great leader.
It was John Hamre who 2 years ago, in leading this administration on
this issue, made this quote: ``It is not a matter of if America has an
electronic Pearl Harbor, but when.''
This past year when he came in before our committee, he said that we
were at war, in a cyber war, at the very moment he came in, because we
were in the middle of a massive attack on our defense information
systems by an organized network that we think was focused in a selected
few countries, but it has been a totally bipartisan effort.
The gentleman's leadership has been critically important. There is a
need for more work like the gentleman is doing, and again I look
forward to supporting the gentleman's legislation.
Mr. ANDREWS. I thank my friend for being here tonight as well, Mr.
Speaker. We are going to summarize.
I want again say that each one of us involved in this effort is
devoted to the idea of our constitutional principles, devoted to the
idea of the separation of civilian and military; of the fact that in
this country, the military responds to decisions by the civilian
sector.
Each one of us is firmly committed to the sanctity of the
constitutional rights of privacy, the protection against search and
seizure, the rights of legitimate people in our country to be protected
from the abuse of State power. We need not choose between forfeiting
our Fourth Amendment rights and defending our country. These are
consistent goals.
But in order to pursue these goals, we need to rethink the way we
pursue them. I think that is so very, very important.
Mr. Speaker, I am here late tonight, and normally I would have the
greatest privilege of my life, which is tucking my 7-year-old and 5-
year-old into bed, my daughters Jaqueline and Josie, and their mother
did that a while ago, I hope, tonight.
We are really fortunate that we put our children to bed tonight in a
country that is safe and strong. It is not safe and strong everywhere,
there are children who are going to sleep tonight in horribly violent
neighborhoods and areas and horribly violent homes, ruined by alcohol
and drug abuse and by all kinds of pernicious behavior.
But this is a country that, at least in terms of pernicious behavior
in the world, is safer than it has ever been, and is the safest place
in the world because of those who sacrificed in the service of their
country, and who do so tonight.
But despite that sacrifice, there is a war going on tonight. As we
put our children to sleep tonight, we have to put them to sleep with
the sure understanding that there are evil and pernicious people in the
world who are trying to do to us what Hitler and the Japanese could not
do to us with their bombs and their armaments in World War II, could
not do to us what the former Soviet Union threatened to do with us with
their intercontinental ballistic missiles in the Cold War, could not do
to us what foreign powers have tried to do to us throughout our
history. That is to undermine and destroy the sovereignty and sanctity
of our country. The way they are trying to do it is pernicious, it is
lethal, but it is very quiet.
I pray that the night will never come when we wake up and hear that
millions of our fellow citizens have been poisoned by their drinking
water because the software that is supposed to detect poison was hacked
into.
I pray that we never wake up and hear that thousands of people
crashed
[[Page H979]]
to their death above airports because of an intentional violation of
our air traffic control system.
I pray that we never wake up and find financial chaos, and people
withdrawing their money from our banking system because the money they
thought was safe and the records they thought were accurate proved to
be neither.
I pray that we never wake up to a country where, when we try to call
our police and fire and emergency management personnel by dialing 911,
we cannot get through because someone has deliberately interfered with
that system.
This is a reality. Now, thankfully, it is a reality that our military
and our intelligence community are preparing vigilantly to protect us
against. It is our job to give them the tools. But there is immense
preparation that still must be done on this floor in legislation with
our resources to both require and incentivize our civilian sector to
meet the same standards of protection as our military has met, and then
to give our military and law enforcement the tools to apprehend those
who do us harm.
Mr. Speaker, it is my prayer that this issue will become irrelevant
because we will be so well prepared, but I do not assume that that is
the case.
____________________