NEWS RELEASE
Committee on Energy and Commerce Democrats
Congressman John D. Dingell, Ranking Member

GAO REPORT TO DINGELL, BARTON,
OTHER KEY LAWMAKERS
ON INFORMATION SECURITY AT SEVEN CRITICAL FINANCIAL ORGANIZATIONS DELAYED

Washington, D.C. – Congressman John D. Dingell (D-MI), Ranking Member of the House Committee on Energy and Commerce, today released a revised commitment letter dated April 19, 2005, from the Government Accountability Office (GAO), indicating that GAO would be forced to delay until June 29, 2005 submission to Energy and Commerce requesters the findings of GAO’s in-depth review of the adequacy of the information security programs at seven critical financial market organizations, including their abilities to prevent disruptions and recover from terrorist attacks. These organizations, which will not be identified in the report for security reasons, were selected because they either perform a unique function necessary to the markets or operate on such a large scale that a disruption in the operations of one of them would severely impair the ability of financial markets to function. (For more details on the request and on GAO’s scope and methodology, see the November 30, 2004, news release.)

GAO requests for information from one organization were repeatedly rejected, leading to action by the Securities and Exchange Commission Division of Market Regulation to help GAO obtain the needed data. Dingell said, “I cannot overstate the importance of GAO’s work on this project and the SEC’s oversight of operations risks at these organizations. I commend both for their work on this matter. The Committee on Energy and Commerce has jurisdiction over the communications networks on which financial markets and other strategic industries rely, giving us a unique perspective on vital information security issues.”

Dingell also noted that: “In 2003, SEC provided recovery goals and business continuity best practices to exchanges and electronic communications networks (ECNs) that conduct securities trading, with the goal of implementation no later than the end of 2004. In addition, SEC staff have asked the New York Stock Exchange, Nasdaq Stock Market, ECNs, and regional exchanges to develop plans and capabilities to provide sufficient venues for trading should a major disaster cripple one or more of them. I am asking GAO to look into whether the planned merger of the New York Stock Exchange with Archipelago Holdings and Nasdaq’s agreement to acquire the electronic trading operations of the Reuters Group institutional brokerage subsidiary Instinet raise any additional information security or business continuity issues that we should consider and address in the Winter 2005 progress report.”

- 30 -