Commdocs.House.gov

The Subcommittee met, pursuant to notice, at 2 p.m., in room 2318, Rayburn House Office Building, Hon. Constance A. Morella, Chairwoman of the Subcommittee, presiding.

I'm going to call to order the Technology Subcommittee of the Science Committee.

This is the hearing that we're going to have on the role of computer security in protecting U.S. infrastructures. Our hearing today is going to explore the appropriate role of government and of the private sector in securing the backbone of this country's information and telecommunications infrastructures. It will focus on the recommendations of the President's Commission on Critical Infrastructure Protection.

Earlier this year, to improve computer security in federal civilian agencies, this Subcommittee and the full House passed the Computer Security Enhancement Act of 1997, H.R. 1903, and the bill is currently awaiting Senate action. So get those Senators to move fast.

The PCCIP—I never know whether or not we can pronounce it; do we say ''PCCIP?''—was created on July 5, 1996, by Executive Order 13010. The stated reason for the order was the need to assure the uninterrupted operation of critical infrastructure. The PCCIP delivered its report to the President on Wednesday, October 22, 1997.

The Commission was tasked with addressing vulnerabilities of eight different critical infrastructures: telecommunications; electric power systems; water supply systems; transportation; banking and finance; gas, oil storage and distribution; emergency services, and continuity of government. Although the task of the Commission was to look at vulnerabilities which would involve physical and cyber security, their primary focus was on cyber threats.

The Commission focused on the fact that all of these infrastructures are independently vulnerable. The Commission further recognized that these critical infrastructures are closely related and dependent on the underlying computer communications infrastructure.

We've all been made familiar with stories of attacks on defense and civilian systems over the last several months. It is important, however, to remember that computer security affects all of us every day in ways both large and small.

Most of you may be aware that the Senate recently suffered an e-mail bomb which slowed its system to a crawl. What you may not have realized is that that attack was the work of one man. An individual who was experiencing difficulty with unwanted electronic junk mail, wrote to several Senate offices. Unhappy with the responses which he received, he decided to take matters in his own hands and forward on to Senate offices all unwanted mail he received with a header identifying himself and asking them to call if they had questions. I hope they don't get this idea on the House side, Mr. Gordon.

His actions caused the Senate mail system to crash. As the story was related to me, he was probably a bit naive how serious the response would be to his actions, and was probably a bit taken back to receive a call from the FBI.

The size of the danger to our economy in dollars is hard to gauge. The CSI/FBI survey of 1996 states that $4.5 billion was lost to business by compromises in information security. Forty-two percent of all businesses report that they've experienced attacks, and of these, 58 percent of the companies cite competitors as the most likely authors of these attacks. These numbers pale somewhat when compared to the fact that over 74 percent of the companies surveyed believed they had experienced unauthorized access to material on their systems.

The majority of critical infrastructures are owned and operated not by government entities, but by private companies and citizens. In addition, most of the extraordinary advances in security and implementation of security technologies have been created by the private sector. Whatever security measures are taken by the government must, therefore, be based on a trust relationship led by the private sector. Any efforts to implement a top-down approach which ignores the expertise and ability of our citizens and companies will be doomed to fail.

So I look forward to hearing from our expert panelists today on how we can facilitate the needed public/private cooperation to ensure our economy is safe from both cyber crimes and potentially-stifling government mandates.

And I'm now very pleased to recognize our distinguished Ranking Member, Mr. Gordon, for his opening .

In 1956, Howard Aiken, a computer pioneer from Harvard University, remarked, ''If it should ever turn out that a machine designed for the numerical solution of differential equations coincides with a machine intended to make bills for a department store, I regard this as the most amazing coincidence that I've ever encountered.''

Fortunately for us, Dr. Aiken's assessment of probability was wrong. Forty years after his pronouncement, he would be hard-pressed to think of an activity that doesn't include some form of computer technology. Computers are a basic and essential element of every aspect of our infrastructure, including the air traffic control system, the stock market, medical diagnostics, and, yes, even department store billing. Today's hearing highlights the integration of computer technology into every aspect of our society.

Computer systems and networks not only support individual companies and industries, but linked together via the Internet, they form a global information infrastructure expanding the ways we do business and how we view security. Before the development of this open international information network, threats to national infrastructure were viewed only in a physical context. In this new world, an e-mail message or a computer virus can wreak havoc on an entire network system. Someone can do this damage from thousands of miles away in another country, and often with complete anonymity. We are only beginning to think the nature of these threats and how to protect ourselves.

I want to commend the Commission and General Marsh for what they've accomplished. The breadth and scope of this report produced in remarkably short time is impressive and provides a basis for discussion. The Commission's assessment that vulnerabilities and threats exist in all of these critical infrastructures should serve as a wake-up call to Congress and the public. Now our task, working with all the stakeholders, including industry, is to develop a workable, comprehensive plan to meet this challenge.

This is a process that will take time and will require close collaboration between industry and government. Clearly, the report leaves many details unaddressed and important issues remain to be solved. I'm surprised that the Commission report said so little encouraging greater use of cryptology to secure the computer networks. These computer networks are at the heart of infrastructure vulnerability. Much work remains to be done in defining the research activities in the proposed major R&D initiatives.

Although I realize it's easy to focus on outside threats to the computer network, I'm disappointed also that the Commission didn't address a cyber threat that lurks within computer systems. I'm talking the Year 2000 computer problem. Just last Tuesday, the Technology Subcommittee held a hearing on how the Year 2000 problem threatens some of the same basic infrastructures identified by the Commission.

This hearing is the first step in the ongoing process of education and policy development. I want to thank our witnesses for appearing before us today, and I would look forward to working with Chairwoman Morella on this topic.

Thank you very much, Mr. Gordon. I'm sure that they'll probably in their testimony with regard to the points that you brought out that were not part of their report.

I'm now pleased to recognize the Vice Chair of this Technology Subcommittee, the gentleman from Minnesota, Mr. Gutknecht.

Thank you, Madam Chairwoman. I'll be very brief.

Once again, you and the staff have assembled a very distinguished panel, and I look forward to their testimony. I especially want to thank Mr. Marsh for his service on the Critical Infrastructure Commission, and I will speak on behalf of some of the other members. We do apologize that there are a number of meetings going on at the same time. It's not that we are not interested in this issue; it's just that this is a very busy time in the Congressional session.

So, again, thank you, Madam Chairwoman, for this hearing, and I look forward to the testimony.

Mr. Gutknecht is right; we're hoping to wind down. I hate to say when it will be, for fear that my prognostication will be awry because of that, but we do have many, many hearings. But we felt, this Subcommittee felt that this was so important that, before we adjourn this first session, that it was necessary for it to have an airing in Congress.

It is the policy of the Science Committee, and therefore of this Subcommittee, to swear in all of our witnesses, and so I might ask you, gentlemen, would you stand and raise your right hand?

Do you solemnly swear that the truth—that the testimony that you're to give is the truth and nothing but the truth?

The report will demonstrate an affirmative response.

I'll introduce all of you at one time, one at a time, but right away, and then ask you each if you will try to confine your testimony as much as you can to 5 minutes, recognizing that your written testimony in its totality is included in the record, so that you might want to summarize or bring out some other points that are not in your written testimony, and then we will have an opportunity to ask questions.

First of all, starting off with the Chairman, Mr. Robert T. Marsh, President's Commission on Critical Infrastructure Protection Chairman, Mr. Marsh is a retired four-star Air Force general who has an extensive background as an aerospace consultant. From 1989 to 1991, he served as the first Chairman of Thiokol Corporation.

Our witness, Russell B. Stevenson, Jr., Esq., is General Counsel and Secretary of CyberCash, Inc. Before coming to CyberCash, Mr. Stevenson was engaged in private law practice in Washington, DC., concentrating on corporate and securities law.

Following him will be Mr. Stephen R. Katz, Chief Information Security Officer at Citibank, where he is head of the Corporate Information Security Office and responsible for the bank's worldwide information security program. Mr. Katz has been associated with information security for over 20 years.

Mr. Glenn Davidson, Executive Vice President, Computer and Communication Industry Association, CCIA is an association of computer and communications firms, as represented by their senior executives, including equipment manufacturers, software developers, telecommunications, and online service providers, resellers, system integrators, third-party vendors, and other related business ventures. CCIA's member companies employ well over a half million workers and generate annual revenues of nearly $200 billion.

Dr. Peter G. Neumann, the author of the book, is principal scientist in the Computer Science Laboratory at SRI International, where he has been since 1971. In 1985, he created and still moderates the Association of Computing Machinery Forum on Risks to the Public in the Use of Computers and Related Technology, which is one of the most widely-read of the online computer news groups. SRI International, an independent, nonprofit research institute, is a pioneer in the creation and application of innovative technologies to industry and government. And I have a book here, his latest book, Computer-Related Risks, and I appreciate that.

And so, gentlemen, we'll now commence, then, starting with Mr. Marsh.

TESTIMONY OF ROBERT T. MARSH, CHAIRMAN, PRESIDENT'S COMMISSION ON CRITICAL INFRASTRUCTURE PROTECTION, WASHINGTON, DC

Thank you, Madam Chairwoman and members of the Subcommittee. On behalf of my fellow Commissioners, several of whom are with me today, I'm pleased to with you the work of the Commission and summarize the principal findings——

You may want to introduce them, Mr. Marsh, or have them stand or——

I would, please. If you'd stand—first, Mr.——

Bill Joyce from the Central Intelligence Agency, Ms. Mary Culnan from Georgetown University, Mr. Stevan Mitchell from the Attorney General's Office, Ms. Sue Simens from the Federal Bureau of Investigation, Mr. John Davis from the National Security Agency, and let's see, I guess that's it.

Very good, very good. Thank you. Thank you all for being here. I appreciate the work you did and the fact that you're here today. Thank you, Mr. Marsh.

Since you're all familiar with the background of the Commission, and maybe you have received copies of our report, I'll try to condense our 15-month effort into a summary of our significant findings and recommendations.

Our most important finding is that adapting to this challenge requires thinking differently infrastructure protection. We must look through the lens of information technology as we approach the third millennium. We've long understood physical threats and vulnerabilities, but the fast pace of technology means we are always running to catch in the cyber dimension. Thus, the Commission's work and our report focus primarily on coping with the cyber threat.

We knew this could not be a big government effort. In fact, infrastructure protection is a shared responsibility. The private sector, which owns and operates most of the infrastructures, is responsible for prudent business investments that will protect against individual hackers and criminals. These steps will also assure a level of protection against cyber terrorist attack, adding a level of national security.

And, finally, this is a long-term effort which requires continuous improvement. There is no magic bullet solution.

After 15 months of research, consultation, assessment, and deliberation, the Commission concluded that waiting for disaster is a dangerous strategy. Now is the time to act to protect our future, and this action requires a new partnership to address the risks of protecting our Nation's infrastructures.

The Commission's recommendations fall generally into three categories: actions the Federal Government must take, actions the owners and operators of the infrastructures must take, and actions that require partnership between government and industry. We heard time and again that the owners and operators of the infrastructures need more information cyber threats and they need a trusted environment where they can freely exchange information without fear of regulation, loss of public confidence, incurred liability, or damaged reputation.

The Commission's recommendations lay the foundation for creating a new, collaborative environment that includes a two-way exchange of information. Our recommendations focus on protecting proprietary information and ensuring anonymity when necessary, easing legal impediments to information-sharing, such as antitrust provisions and the Freedom of Information Act, and creating information-sharing mechanisms both within industry and between industry and government.

We recommend specific steps the government must take to ensure owners and operators and state and local governments are sufficiently informed and supported to accomplish their infrastructure's protections role. Examples include expanding the availability of government risk assessments to the private sector and encouraging and assisting, if necessary, industry to develop risk methodologies, and doubling funds appropriated under the Nunn-Lugar-Domenici Domestic Preparedness Program.

Educating our citizens the emerging threats and vulnerabilities in the cyber dimension is key to the success of all of our initiatives. The Commission's recommendations in this area range from grammar to graduate school and beyond. They include a series of White House conferences, a nationwide public awareness campaign, and grants by the National Science Foundation for graduate-level work on network security.

The Federal Government must lead the way in the partnership by developing and employing the tools, practices, and policies required to conduct business in the cyber age. Some specifics include improving government information security through best practices and standards; formalizing information assurance as a foreign intelligence priority, and recruiting and retraining law enforcement personnel with cyber skills.

We examined a full range of legal issues relating to protecting the critical infrastructures. We proposed the further review and revision of major federal legislation relating to the critical infrastructures and the cyber threat; an expert study group, representing a wide range of interest groups to make recommendations for reform in the employer-employee relationship for certain sensitive positions, and easing legal impediments to information-sharing, such as antitrust provisions and the Freedom of Information Act.

Federal research and development efforts are inadequate to meet the challenge presented by emerging cyber threats. $250 million is spent each year on infrastructure assurance-related R&D, of which $150 million is dedicated to information security. There is very little research supporting a national cyber defense.

We recommend doubling federal R&D funding for infrastructure protection to $500 million the first year with 20 percent increases each year for the 5 years. This funding should target areas such as risk management, simulation and modeling, decision support, and early warning and response.

Institutionalizing infrastructure protection requires several channels between the public and private sectors. At the policymaking level, we recommend an Office of National Infrastructure Assurance located within the White House to serve as the Federal Government's focal point for infrastructure protection.

Second, a National Infrastructure Assurance Council comprised of selected infrastructure CEOs and Cabinet officials to propose policy and advise the President; and an Infrastructure Assurance Support Office to support both the Council and the national office.

At the operational level, we recommend sector infrastructure assurance coordinators or clearinghouses as focal points within each infrastructure to information; federal lead agencies to promote and assist in establishing the sector coordinators, an Information-Sharing and Analysis Center staffed by both private industry and government to receive and information infrastructure incidents and practices to be located in the private sector; and, finally, a warning center designed to provide operational warning whenever possible of an attack on the infrastructures, either physical or cyber, located within the Federal Bureau of Investigation.

In conclusion, just as the risks are shared between the public and private sectors, so must the solutions be. Our national and economic security has become a shared responsibility, one that will require a new kind of partnership between government and industry, one which encourages information-sharing, and one which requires the government to lead by example. And I believe the findings and conclusions of the Commission are based on accurate and reasonable information and analyses. Our recommendations, if implemented, will create the partnerships and the structures essential to reducing vulnerabilities in our infrastructures. They will provide the impetus for research and development efforts to increase information security and provide a cyber defense system. They will increase the Nation's ability to prepare, protect, and respond to any threat, strategic or otherwise, directed against our infrastructures, thereby ensuring their continued effective operation in support of our defense, economic growth, and general well-being.

This completes my statement, Madam Chairwoman. I'd be pleased to answer any questions you or your colleagues may have. Thank you.

[The prepared statement and attachments of Mr. Marsh follow:]

Thank you very much, Mr. Marsh, for your testimony and for the work that you did on the Commission. I note that you have given us, fortunately, a lot of information in addition to what you've mentioned orally, and a whole long list of recommendations, and most of them that you have mentioned now. And thank you. We'll be asking questions.

Before I turn to Mr. Stevenson, let me just acknowledge that the Vice Chair of the Science Committee, Dr. Vern Ehlers, has joined us, too. Thank you.

TESTIMONY OF RUSSELL B. STEVENSON, JR., ESQ., GENERAL COUNSEL, CYBERCASH, INC, RESTON, VA

Thank you, Madam Chairwoman, members of the Subcommittee. I'm pleased to have the opportunity to appear before you this afternoon.

CyberCash is in the business of enabling secure financial transactions on the Internet. So, for obvious reasons, we have a deep and abiding interest in the security and stability of our electronic infrastructure.

I'd like to make three points this afternoon. First, public policy with respect to our infrastructure should limit collective action to those aspects of the infrastructure in which there's likely to be what economists call a market failure. That is, aspects in which the aggregate behavior of individual actors acting independently leads to a suboptimal system.

Second, it is critical that efforts to protect the electronic infrastructure not create unintentional consequences that curb the growth or stifle the creativity of the private sector in developing the infrastructure which has seen such remarkable growth to date.

Third, encryption is one of the cornerstones of security on the Internet, and nothing could threaten the security of electronic commerce more than ill-conceived public policy on encryption.

It is self-evident that there are strong private incentives that work toward the security of the Internet. In a perfect world, the combined actions of all of the users of this infrastructure would lead to an optimal degree of security. We don't, however, live in a perfect world. The greatest weaknesses in computer security today are the result not of failures of technology, but of simple human folly. People forget to put passwords on their computers; they provide inadequate physical security, and do things that any security consultant would say are simply stupid. A second class of potential weakness, and one in which I would argue the government has a much greater interest, is failure of the network itself resulting from flaws in design or operation.

What is the proper role of government in addressing these weaknesses? As to the first, government may well play a constructive role in research and education on good security practices, and I'm pleased to see that the Commission's report emphasizes this as one of the major roles for the government in this area.

Regulation also has a narrow place in this area, particularly with respect to sensitive institutions such as our major financial institutions. The government should certainly use its regulatory power over banks and other financial institutions to assure their safety and soundness, for example.

With respect to flaws in the design or operation of the system as a whole, there may also be a role for government. What that role might be depends on the nature of the flaws and the steps necessary to remedy them. While the Commission addresses this question, it is one that deserves considerably more research, and, again, I'm pleased to see that that's one of the Commission's recommendations.

It is also important, as we consider the role of the government, to remember that this technology is evolving at a revolutionary pace, and issues cannot be resolved once and for all and then forgotten. These are issues that call for regular re-evaluation.

All thoughtful observers of government policy know the iron law of unintended consequences, which says that all regulation has unintended consequences, often adverse ones. This problem is amplified when the government is dealing with rapidly-changing technologies. Laws move at the speed of Congress. The Internet moves at the speed of light. Congress should keep that firmly in mind when it's formulating policy regarding the electronic infrastructure.

And now I come to encryption. Of all the technologies on which the security of a computer network depends, encryption is perhaps the most important. Without it, sensitive communications would be vulnerable to interception by terrorists, thieves, industrial spies, warriors, and the merely curious.

U.S. policy on encryption has been both confusing and controversial. This may be inevitable, as there are several legitimate, but conflicting interests at stake. Unfortunately, some participants in the controversy persist in either willful ignorance of, or deliberate refusal to acknowledge, the importance of encryption in the security of our electronic infrastructure. It is no small irony that the law enforcement interests who argue so ardently for limitations on encryption seem to fail to recognize the increased vulnerability to crime and terrorism that would result from those limitations.

In conclusion, in considering the recommendations of the Commission, Congress should limit the role of government to, first, research and education, and, second, identifying and addressing those weaknesses in the electronic infrastructure as a whole that cannot be effectively addressed by the efforts of the private sector.

Congress should also pay particular attention to the importance of encryption to the security of the Internet and electronic commerce. It should not expose the electronic infrastructure to attacks by terrorists and criminals in an ill-considered effort to provide law enforcement agencies with tools to investigate terrorists and criminals.

[The prepared statement and attachments of Mr. Stevenson follow:]

We're going to be asking you later encryption, so get ready for it.

STATEMENT OF STEPHEN R. KATZ, CHIEF INFORMATION SECURITY OFFICER, CITIBANK, NEW YORK, NY

Madam Chairwoman, members of the Subcommittee, good afternoon. I'd like to thank you for the opportunity of your inviting me to appear here.

I think the report that was done was an impressive piece of work, and as I begin to address my and recommendations, I would first say that the main product offered by banks is trust. We have a trust contract with our customers, so at all times we ensure the integrity, the confidentiality, and the availability of data, and in today's world that is 24 hours a day, literally from anywhere in the world, and increasingly via the Internet. And any significant compromise that would occur at a number of—in a small number of money central and super regional banks could pose a substantial risk to the confidence of the financial services industry.

I would also like to take this opportunity to correct what I think it a significant misconception. Contrary to what has generally been reported in the media, banks must, and consistently do, comply with the extensive regulatory requirements in reporting losses that result from breaches in information security. Under the Bank Secrecy Act, since then, the financial crimes enforcement at work requires financial institutions to report suspicious transactions and known or suspected violations.

It is my assessment that banks are leaders in implementing information security. Banks have been one of the major users of cryptography, and were among the earliest adapters in implementing state-of-the-art technology to identify the identity of our customers dealing with us electronically.

The reasons for this are multiple. First and foremost, sound business practices require that we meet our trust contract with our customers. Second, we are highly regulated by multiple federal and state authorities—all of which require information security and continuity of business programs. In addition, associations like the American Bankers Association and the New York Clearinghouse have for years encouraged and facilitated ongoing dialog and sharing of information among bank information security officers.

Bank products and services at this point in time are inexorably intertwined with technology. You really can't figure out where one begins and the other ends, and it is essential that security become a fundamental and is a fundamental component of any product. Therefore, I'll just very quickly touch on some of the risks and concerns that we deal with.

For instance, technology that does damage: Global availability, often via the Internet, provides access to a large number of malicious code or hacker tools, Trojan horses, denial-of-service programs, very similar to what the Senate experienced, and programs designed to steal and corrupt data.

Then we have the internal threat. It is estimated that the greatest exposure posed to a company is from security breaches caused by insiders. They have availability; they have access, and they have knowledge. While banks routinely perform drug testing and submit fingerprints to the FBI, and conduct minimal background checks, we do not have the mechanisms available to us to openly check the background and employment history of current and potential employees.

In addition, concerns liability tend to prevent prior employers from discussing performance issues, employee performance issues, with us. In fact, all they will provide at best are dates of employment. This risk is further exacerbated by the lack of information available contractors, consultants, and outsource vendors, where it is even more difficult to get information.

Technology: New and emerging technology often does not have effective security. Hardware and software is often delivered with security functionality turned off, and in fact much of the technology is delivered with widely known default passwords turned on. As a result, unless extreme care is taken, back doors, vulnerabilities, and unauthorized entry points in the systems and networks can be left open.

Extremely important is intrusion detection. There are few effective tools today that can function as real-time burglar alarms, burglar alarms to notify us that there are problems with the system or that somebody is trying to break in.

In terms of recommendations, the first is the need for sound practices for information security.

Since you hesitated, we have now 15 minutes to vote, but I really think we can finish our testimony, if we do it well. So you'll hear the bells again in another 5 minutes. If that's amenable to you, then we'll come back and start the questioning.

Okay. Do you want me to continue then? Okay.

Last year the New York Federal Reserve Bank formed a task force to develop information security sound practices. The task force was under the aegis of the supervisory wing of the Fed. However, they asked the person responsible for internal security at the New York Fed to lead the effort. What added to his credibility is that he is a well-known and active member of a number of banking industry and information security organizations, and well respected in the private sector. The result that they produced will help set the direction for information security standards and practices within the banking sector. So I recommend that the government charter and direct a similar effort, but please note that I am not advocating best practices, since ''best'' is always a moving target and creates a really false sense of confidence. I'm not advocating detailed, across-the-board standards. What I am advocating is sound practices.

Oversight: Bank Circular 177 requires boards of directors to have oversight over continuity of business plans. The board should also have oversight and responsibility for information security.

Privacy and confidentiality: The banking sector, as you know, is heavily regulated. Voluntary data recovery is routinely performed by banks to satisfy information requests during regulatory examinations. That, coupled with the requirement to ensure customer privacy, mandates the need and justifies the use of unrestricted, robust cryptography, regardless of key length and without requiring mandatory key escrow systems.

Historically, the government has recognized the need for security and financial networks. Consequently, export controls on encryption products used by banks have included special exemptions. It is essential that these exemptions not only be continued, but be broadened to ensure that we can generally export cryptography without key escrow recovery requirements.

Digital signatures: Numerous States have enacted some form of electronic digital signature legislation. The laws tend to be inconsistent and also create a tremendous amount of uncertainty. In order for there to be secure and effective electronic commerce without the overriding threat of forgery, banks need federal regulation to ensure consistent treatment of electronic authentication and digital signatures within the United States. And since e-commerce is borderless, we then need international agreements governing standards.

Education and awareness is an area where funds should and must be invested. A program stressing computer ethics must be put together and reinforced at all grade levels, literally from kindergarten through graduate school.

Partnership for information-sharing: There is a need to establish an informal partnership between government and industry to information security practices and education and training programs. There is also a need to have greater access to reliable, up-to-date information from the government and across industry regarding the identification of threats and liabilities.

The types of information being shared need to be defined by experienced security practitioners from multiple sectors. In addition, once criteria are defined, information-sharing needs to be via specific trade organizations—for example, the American Bankers Association—in a climate of trust, where anonymity is ensured and liability is limited.

That concludes my testimony, Madam Chairwoman, and I would be pleased to answer your questions.

[The prepared statement and attachments of Mr. Katz follow:]

We've decided it would not do justice to our witnesses to have them try to rush through in a few minutes. So we are going to recess for probably 15 minutes. We think we're going to have another vote following this particular vote, and then we'll come right back and we'll hear our last two witnesses. Does that work out for everybody? And then we'll go through the questioning. Thank you.

We're going to recommence or continue with our hearing on the critical infrastructure report and its implications, and we're going to start off with Mr. Davidson.

TESTIMONY OF GLENN DAVIDSON, EXECUTIVE VICE PRESIDENT, COMPUTER AND COMMUNICATION INDUSTRY ASSOCIATION, WASHINGTON, DC

Incidentally, may I say that we've been joined by my colleague from Maryland, Roscoe Bartlett—Dr., Congressman, Scientist Bartlett. Thank you.

And Congressman Bartlett, thank you for the honor and privilege of appearing here today.

Let me say right from the start that we at CCIA fully understand and identify with the need to guard against any attacks capable of disabling our Nation's first-class infrastructure, systems that are so vital to the operation of government and to our economy, and we recognize that in today's information age such attacks can be more than just physical; they can be also—there's dangers of techno-terrorism. However, we have some serious concerns the Commission's work and recommendation which we have been following since its outset in July of 1996.

First, we fail to understand why the Commission's work and report is shrouded in secrecy, especially when the Commission readily admits that it has no evidence of an imminent cyber threat. The reason I suggest this is that the National Research Council, on one hand, can make some very important decisions concerning information security in its report on cryptography without its work being classified. So why is the Commission hiding behind the mantle of classified information in this regard?

Just allow me to suggest, and the reason I raise this, allow me to suggest that if the public generally and industry specifically are to accept the Commission's sweeping recommendations, then it must provide more than anecdotal evidence; it must come forward with a threat assessment, so that it may be discussed, debated, and understood by the public. That's the first point.

The second point is, which all the other panelists have shared today, we don't understand why the report is so weak on encryption. The Commission calls for the immediate and universal implementation of various protection tools, including firewalls, password controls, authentication mechanisms, action logs, etc., to guard against cyber attacks, and it fails to advocate the use of the strongest available encryption, perhaps the most effective means to individuals and companies to secure communications and protect digital files against fraud, white-collar crime, economic espionage, and even terrorism.

Despite its 178-page length, the report devotes nary a page to the subject of encryption. It states that, ''The establishment of trustworthy key management infrastructures is the only way to enable encryption on a large scale and must include the development of appropriate standards for interoperability on a global scale.'' Call it what you will, key management, key recovery, or key escrow, industry will tell you that the system just will not work on a large scale. Just ask the National Research Council, which came to the same conclusion.

Third, the report suggests in a thinly-veiled fashion that industry has an obligation to pay for ruggedizing our critical infrastructures to suit the government's national security and law enforcement objectives. We in industry have long understood the need for information security and network reliability. In fact, providers and operators of public switch networks have long established redundant networks in the event of natural and even man-made catastrophes. Providers of private switched networks do much the same, at the request or insistence of their clients. We have also developed and utilized various security tools, which we've mentioned before, to protect the integrity of our solutions.

However, if our Nation's security and law enforcement agencies desire a higher level of security and reliability of our systems and networks than what commerce itself demands, then I believe and our association believes that they should be the ones to pay for it. The cost of the difference between what we provide our customers to allow safe communications and the integrity of information and what the government wants for national security or national defense or law enforcement purposes should be borne by the government. CCIA believes that requiring American industry to bear the cost of building such super-rugged infrastructure would constitute an excessive financial burden that would blunt the competitive edge of American industry.

Fourth and finally—and there are many more concerns—I want to talk sharing information. Today I was very happy to hear from General Marsh that this is to be a two-way flow of information, which I had not heard before. But while we at CCIA are not opposed in principle to the sharing of such information, it's just putting that principle into work or into practice that concerns us. If the government purposefully or inadvertently released information network vulnerabilities and security breaches, clients and customers could sue providers and operators for the damages, claiming that these firms knew that those vulnerabilities existed and insufficient steps were taken to prevent them. We in industry would need protection from such frivolous lawsuits, and we are pleased to know that this report discusses that.

Furthermore, if a major foreign partner cannot be assured of confidentiality, we really believe that they'll move to another corporation in another country. In today's global economy, these concerns are not hypothetical; they're real.

But one of the things that bothers us in all this information-sharing is it recommends the modification of our Nation's antitrust laws, so that companies would be free to information with each other and our government. To our knowledge, our industry is not asking for safe harbor from our antitrust laws, with maybe the exception of Microsoft and Intel. Allow me to suggest that if it were not for the U.S. government's vigorous enforcement of our antitrust laws, the dynamic, innovative, entrepreneurial, and competitive computer and communications industry that we know and enjoy today would not exist.

I will conclude by suggesting, and go back to the top, which is, you know, I think we should move at a slower, more reasoned pace. Again, I was happy to hear that the General talked this being a long-term effort and that there is no single bullet. But let's release the Commission's full report and allow it to be publicly discussed and debated. If General Marsh really wants to see buy-in from all sectors, as the report suggests, then the American people need and deserve to understand the threat assessment, so they may appreciate and accommodate the changes and actions that are envisioned here.

Thank you for your time, and I'm willing to take questions.

[The prepared statement and attachments of Mr. Davidson follow:]

I'm now pleased to recognize Dr. Neumann.

TESTIMONY OF PETER G. NEUMANN, PRINCIPAL SCIENTIST, COMPUTER SCIENCE LABORATORY, SRI INTERNATIONAL, MENLO PARK, CA

Thank you very much. I'm speaking as an individual, not as a member of the not-for-profit organization to which I belong. I would like to cover a great deal of material. I'll do the best I can. I may talk a little too rapidly for recorders, but that's life.

I was delighted to hear Congressman Gordon mention Howard Aiken, who was the person who got me into computers in the first place in 1953. I'm delighted to see what it says up here on the board: ''Where there is no vision, the people perish''—from Proverbs, 29:18. This is exactly the issue that is confronting us here today. We have to take a relatively long look at the problem. We're not dealing just with security or just with reliability or just with survivability of our infrastructures. We're dealing with the integration of all of those things into one coherent, sensible organization. And I'm not going to deal with the specific organizations that the Commission has recommended create; I'm going to try to deal with the principles and the problems that need to be addressed.

I will mention in passing that there is only a three-page section on research and development in the Commission's report, which I find surprising, not just because I come from a research organization.

To illustrate this business security and reliability and survivability, I again go back to Congressman Gordon, who noticed that the Year 2000 problem was not really very evident. I spent Monday and Tuesday of this week on the General Accounting Office Executive Council for Information Management. The first half-day was devoted exclusively to the Year 2000 problem, and the GAO is badgering that, I think, very nicely.

If you look at my handout, you'll see—not my testimony, but my attachment—you'll see a long list of calendar-related and clock-related problems, one of which is the fact that the global positioning satellite system clock was designed in such a way that on the 21st of August, 1999, it goes back to the 6th of January, 1980. There was a fundamental problem. So they have a Year 2000 problem before the Year 2000 happens.

The point there is, very simply, that if we look at all of the systems that are being developed, they are, for the most part, deeply flawed. We have serious problems in our system development projects. If you look at, say, the IRS tax modernization system, the FBI fingerprint system, the FAA's air traffic control rehosting, all of those systems went down the tubes at the cost of billions and billions of dollars.

We simply in this country do not know how to procure and develop very large systems. If we cannot develop even modest-sized systems properly—and I look at, say, operating systems and networking software, which are riddled with security holes and crash all the time—how can we possibly be expected to develop a key recovery scheme that will work without any risks? And when you consider all of the people risks, we have an even bigger problem.

Again quoting a GAO report, they looked at the IRS and they found rampant misuse of IRS information systems, and they found rampant misuse of law enforcement systems. If the government cannot be expected to have employees who are above-board, how can you expect a key recovery scheme to work without risk?

Let me touch briefly on cryptography. This is a subject that is of great complexity. The Commission has basically thrown in, as you said, one page. They have said that key recovery is a good thing; it's prudent; therefore, you should do it. They did not look at any of the risks of key recovery. They didn't even cite our National Research Council study. They didn't cite the 11-authored report that I cite in my written testimony. And I think I have to make a very careful distinction between key management, on one hand, which is absolutely necessary, and key recovery. Key recovery implies that the keys are kept around. If you ask the NSA folks whether they're willing to their keys with a trusted third party, they're going to laugh you in the face. This is absolutely absurd. So the notion of a trusted third party who might not be trustworthy is a very, very difficult topic.

And I have to make the very careful distinction between trustworthiness and trust. Trustworthiness means it's worthy of trust. Trust merely means that you're stupid enough to trust it without understanding the issues. And I suggest that when we deal with cryptography, this is an issue where everything that appears to be true tends not to be true, when you start scraping the surface. So I urge you to look at all of the backup materials that the Commission has not really sought to mention. Perhaps it's there somewhere in their backup materials that I haven't seen, as I presume the research and development material will appear eventually in some form or another.

But I think the important thing here is that, even though somebody will show you a demo of a key recovery system, that is not a demonstration that there are no risks involved, and if you can't trust the computer systems and you can't trust the communications, and you can't trust the implementations of the cryptography that are in the operating systems developed by the folks who are producing the commercial systems on which the entire Nation depends, and if you can't trust all of the people, we have a situation which is essentially intractable. And I think you really have to look at those risks in great detail.

With regard to the question of preparedness, are all of the risks that one might worry real? If you look at, again, the handout material that I've included, you'll see a list of thousands of cases of things where things didn't work the way they were supposed to. And the real paradox—do I get another 30 seconds or is that it?—the real paradox is that if you are really prepared, then nothing bad is likely to happen. If you're not really prepared, you never know whether something colossally bad is happening.

And as was indicated at the very beginning, simultaneous, systematic coordinated attacks on the entire national infrastructure are possible. If they occurred at a strategically-opportune moment in combination with something else, they could be devastating to the Nation.

I will stop at this point and hope that you'll ask some questions that will allow me to talk a little more. Thank you.

[The prepared statement and attachments of Mr. Neumann follow:]

We really could have questions that could take another 2 hours and still have more questions. I'm going to start off with General Marsh, and I'm going to then allow any of you to respond to any of the questions, and then give Mr. Bartlett an opportunity to ask questions, and we'll do it all within 10 minutes.

The Commission's definition of national security-related infrastructures seems to include just everything. The report also indicates that the private sector should take a lead in securing these systems. I wonder, General Marsh, do you feel that there's a conflict between the designation of infrastructures as national security-related and retaining civilian control of security for these infrastructures?

Madam Chairwoman, it appears as a conflict, but I think it brings to light to fundamental challenge that this Nation's facing as we go forward, and that is that we're entering an era where we no longer have the peaceable neighbors and the great oceans on all sides to protect our critical infrastructures. We're approaching an era where they now may be the front lines of defense of our very society, and be important targets for anyone who would do us serious harm, and tools that are readily available with which to do that harm, the knowledge is readily available; the vulnerabilities exist. All it takes is the intent to do harm, and therefore, it becomes a national security problem as well as an economic security and a society well-being problem.

Let me also ask you how you think that the safeguards that you have enumerated and which are in the written testimony, as well as in the report—I guess one of the concerns I've sensed, that others have asked, too, and I was concerned , is: How would these safeguards be funded?

In the main, the safeguards that will protect against commonplace threats—that is, hackers, criminals, thieves—if those safeguards...