<DOC> [108th Congress House Hearings] [From the U.S. Government Printing Office via GPO Access] [DOCID: f:98486.wais] IDENTITY THEFT: THE CAUSES, COSTS, CONSEQUENCES, AND POTENTIAL SOLUTIONS ======================================================================= HEARING before the SUBCOMMITTEE ON TECHNOLOGY, INFORMATION POLICY, INTERGOVERNMENTAL RELATIONS AND THE CENSUS of the COMMITTEE ON GOVERNMENT REFORM HOUSE OF REPRESENTATIVES ONE HUNDRED EIGHTH CONGRESS SECOND SESSION __________ SEPTEMBER 22, 2004 __________ Serial No. 108-272 __________ Printed for the use of the Committee on Government Reform Available via the World Wide Web: http://www.gpo.gov/congress/house http://www.house.gov/reform ______ U.S. GOVERNMENT PRINTING OFFICE 98-486 WASHINGTON : 2005 _____________________________________________________________________________ For Sale by the Superintendent of Documents, U.S. Government Printing Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512ÿ091800 Fax: (202) 512ÿ092250 Mail: Stop SSOP, Washington, DC 20402ÿ090001 COMMITTEE ON GOVERNMENT REFORM TOM DAVIS, Virginia, Chairman DAN BURTON, Indiana HENRY A. WAXMAN, California CHRISTOPHER SHAYS, Connecticut TOM LANTOS, California ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York JOHN L. MICA, Florida PAUL E. KANJORSKI, Pennsylvania MARK E. SOUDER, Indiana CAROLYN B. MALONEY, New York STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland DOUG OSE, California DENNIS J. KUCINICH, Ohio RON LEWIS, Kentucky DANNY K. DAVIS, Illinois TODD RUSSELL PLATTS, Pennsylvania JOHN F. TIERNEY, Massachusetts CHRIS CANNON, Utah WM. LACY CLAY, Missouri ADAM H. PUTNAM, Florida DIANE E. WATSON, California EDWARD L. SCHROCK, Virginia STEPHEN F. LYNCH, Massachusetts JOHN J. DUNCAN, Jr., Tennessee CHRIS VAN HOLLEN, Maryland NATHAN DEAL, Georgia LINDA T. SANCHEZ, California CANDICE S. MILLER, Michigan C.A. ``DUTCH'' RUPPERSBERGER, TIM MURPHY, Pennsylvania Maryland MICHAEL R. TURNER, Ohio ELEANOR HOLMES NORTON, District of JOHN R. CARTER, Texas Columbia MARSHA BLACKBURN, Tennessee JIM COOPER, Tennessee PATRICK J. TIBERI, Ohio BETTY McCOLLUM, Minnesota KATHERINE HARRIS, Florida ------ ------ ------ BERNARD SANDERS, Vermont (Independent) Melissa Wojciak, Staff Director David Marin, Deputy Staff Director/Communications Director Rob Borden, Parliamentarian Teresa Austin, Chief Clerk Phil Barnett, Minority Chief of Staff/Chief Counsel Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census ADAM H. PUTNAM, Florida, Chairman CANDICE S. MILLER, Michigan WM. LACY CLAY, Missouri DOUG OSE, California STEPHEN F. LYNCH, Massachusetts TIM MURPHY, Pennsylvania BETTY McCOLLUM, Minnesota MICHAEL R. TURNER, Ohio Ex Officio TOM DAVIS, Virginia HENRY A. WAXMAN, California Bob Dix, Staff Director Dan Daly, Professional Staff Member/Deputy Counsel Juliana French, Clerk Adam Bordes, Minority Professional Staff Member C O N T E N T S ---------- Page Hearing held on September 22, 2004............................... 1 Statement of: Schmidt, Howard, former White House Cybersecurity advisor, and vice president, chief information security officer, eBay, Inc.; Bill Hancock, vice president, security practice & strategy, chief security officer, Savvis Communications Corp.; Bill Conner, chairman and chief executive officer, Entrust, Inc.; and Jody Westby, chair of privacy and computer crime committee, American Bar Association, section of science and technology law, and managing director, PricewaterhouseCoopers..................................... 76 Swindle, Orson, Commissioner, Federal Trade Commission; Steven Martinez, Deputy Assistant Director, Cyber Division, Federal Bureau of Investigation; Larry Johnson, Special Agent in Charge, Criminal Investigative Division, U.S. Secret Service; and Patrick O'Carroll, Acting Inspector General, Social Security Administration.................... 16 Letters, statements, etc., submitted for the record by: Clay, Hon. Wm. Lacy, a Representative in Congress from the State of Missouri, prepared statement of................... 14 Conner, Bill, chairman and chief executive officer, Entrust, Inc., prepared statement of................................ 99 Hancock, Bill, vice president, security practice & strategy, chief security officer, Savvis Communications Corp., prepared statement of...................................... 91 Johnson, Larry, Special Agent in Charge, Criminal Investigative Division, U.S. Secret Service, prepared statement of............................................... 50 Martinez, Steven, Deputy Assistant Director, Cyber Division, Federal Bureau of Investigation, prepared statement of..... 38 O'Carroll, Patrick, Acting Inspector General, Social Security Administration, prepared statement of...................... 59 Putnam, Hon. Adam H., a Representative in Congress from the State of Florida, prepared statement of.................... 7 Schmidt, Howard, former White House Cybersecurity advisor, and vice president, chief information security officer, eBay, Inc., prepared statement of.......................... 80 Swindle, Orson, Commissioner, Federal Trade Commission, prepared statement of...................................... 19 Westby, Jody, chair of privacy and computer crime committee, American Bar Association, section of science and technology law, and managing director, PricewaterhouseCoopers, prepared statement of...................................... 116 IDENTITY THEFT: THE CAUSES, COSTS, CONSEQUENCES, AND POTENTIAL SOLUTIONS ---------- WEDNESDAY, SEPTEMBER 22, House of Representatives, Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, Committee on Government Reform, Washington, DC. The subcommittee met, pursuant to notice, at 2:46 p.m., in room 2154, Rayburn House Office Building, Hon. Adam Putnam (chairman of the subcommittee) presiding. Present: Representatives Putnam and Clay. Staff present: Bob Dix, staff director; John Hambel, senior counsel; Dan Daly, professional staff/deputy counsel; Juliana French, clerk; Adam Bordes, minority professional staff member; and Jean Gosa, minority assistant clerk. Mr. Putnam. A quorum being present, this hearing of the Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census will come to order. Good afternoon, and welcome to the subcommittee's hearing entitled, ``Identity Theft: The Causes, Costs, Consequences, and Potential Solutions.'' Today the subcommittee conducts its 11th hearing this Congress on cybersecurity issues, and this is the 39th hearing overall of this subcommittee in the 108th Congress. I certainly want to commend staff for the majority and staff for the minority and the hard work that they have put into all of these hearings and the work of the membership, as we have covered an awful lot of ground in this Congress. Throughout the 108th Congress, the subcommittee has focused a great deal of attention and oversight on the topic of computer information security, and the growing cyberthreat to this Nation. This hearing will examine the cybersecurity threat from a somewhat different perspective and delve into an issue that has already adversely impacted millions of Americans and has the potential to become even worse as more and more information is gathered, stored and shared through the Internet in an all too often unprotected environment. The issue is computer identity theft. I am concerned about the threat that identity theft poses to the U.S.' national and economic security. Identity theft is one of the fastest-growing crimes in the United States, and it appears that the battleground is expanding from one populated primarily by those seeking notoriety, to those seeking profit and disruptive impact. Federal statistics show that nearly 10 million identities were stolen in the United States last year alone, and that the total cost of this crime in the United States is approximately $50 billion per year. Some predict that the worldwide costs of identity theft in all of its forms will exceed $2 trillion in financial losses by the end of 2005. These numbers are staggering, and they highlight why this hearing is so important. As use of the Internet continues to expand every day, more personal information is converted into electronic data. Both the Federal Government and the private sector maintain large data bases of personal information about their employees and customers. The efficiencies realized through the increased availability of electronic data storage and transmission are tremendous, but the wealth of available personal information in digital form also provides a target-rich environment for criminals and terrorists. By hacking into data bases, paying off insiders, loading spyware onto users' machines or using fraudulent e-mails to trick users into revealing Social Security and other account numbers, criminals and terrorists are utilizing the Internet to profit illegally. It seems as if not a day goes by without a new report of some worm, virus, phishing scheme or other cybercrime threatening users of the Internet. This week we have also learned that there is a dramatic increase in the number of zombie PCs, also called bots. These are computers infected by worms or Trojans and taken over surreptitiously by hackers and used to send spam, more viruses, harvest financial and personal information, or launch denial of service attacks. It is estimated that the number of computers being taken over by remote control is now averaging 30,000 per day, peaking at 75,000 in a single day. We need to quarantine and vaccinate infected computers, close the back doors, shut down the tunnels and cutoff bad guy access to our computers and networks. A recent crackdown on cybercrime by the Department of Justice known as Operation Web Snare demonstrates just how large a problem cybercrime has become. The Department, through its U.S. Attorneys' offices, its Criminal Division, and the FBI, coordinated with the Secret Service, the FTC and a variety of other State, local and Federal and foreign law enforcement agencies, conducted this operation. Investigators identified more than 150,000 victims with estimated losses of more than $200 million. This operation to date has resulted in more than 150 arrests and convictions for electronic crimes including identity theft, fraud, counterfeiting software, computer intrusions and other intellectual property crimes. We have representatives from the FBI, the FTC and the Secret Service with us here today. I applaud your efforts and the efforts of all of those involved in this operation, and I thank you for your service to this Nation. In addition to highlighting the threat of organized crime on the Internet, Operation Web Snare touched on another growing problem: the potential nexus between cybercrime and terrorism. The report on the operation noted that terrorists and their support groups are hiding behind the cloak of the Internet to conceal their true locations and to communicate, generate funds and develop resources in support of terrorism. Furthermore, the report noted an increase in on-line complaints in which illegally obtained funds are flowing to parts of the world where terrorist groups are known to operate. Operation Web Snare makes it clear that this is a global problem, and not only are criminals and terrorists aware of the vulnerabilities in cyberspace, but they are exploiting them for monetary profit as well. Make no mistake about it, our Nation's information systems are under attack 24 hours a day, 7 days a week from around the world. We cannot stick our heads in the sand and ignore these problems or continue to make excuses for why we are not taking more affirmative action. We have to address them head on and make sure that our cyberdefenses are prepared to repel these intruders. Unfortunately through the work of this subcommittee, through our extensive research and oversight, I am not convinced that we are prepared either in the public or the private sector to adequately deal with these problems. I fear that cybercrime may get worse before it gets better. And I do not wish to wait for some large-scale failure of our Internet infrastructure or the launch of a combined physical and confined cyberattack against our citizens and our economy before we as a Nation get serious about protecting our information systems. About a year ago, after several oversight hearings on the subject, in an information-gathering visit to Silicon Valley, I began to realize just how vulnerable this Nation had become to a growing and dangerous threat of cyberattack. Not only were Federal agencies failing to comply with the requirements of the law as outlined by FISMA, but the private sector was also seriously delinquent in its attention to these matters. After examining alternatives, we drafted the Corporate Information Security Accountability Act, which would have set forth certain computer information security plan reporting requirements for publicly traded companies in an effort to elevate the profile of this matter to the ``C'' level of management and respective boards of directors. I did not introduce the legislation at that time, preferring a private-sector-driven, market-based solution to this growing threat to the American people and the economy, and hearing from the private sector that they could address this issue without the assistance or intervention by Congress. Well, here we are a year later, and, quite frankly, not only has the problem not gotten much better, there is compelling evidence, some of which we will hear today, that the problem was getting worse, and perhaps a lot worse. Thankfully, there are some key stakeholders such as Microsoft, RSA and AOL who are taking visible steps to proactively address this challenge. But the world has grown to be a very dangerous place. Most of us make sure that we lock our doors and windows in our homes and businesses before we end the day. Some even pay extra to have an alarm system installed in their home or business to provide protection against unwanted intruders who wish to do us harm or steal our assets. In today's digital world, we must also protect our cyberassets and our personal information from intruders, both internal and external, from those who would do us harm and steal our information. We have not focused sufficiently on this challenge, and as a result our personal and national security, and our personal and national economic stability, are subject to a growing risk from enemies who may attack at any time of day and night from anywhere in the world 365 days a year. So today I call on this Nation, everyone in this Nation, to take immediate actions to increase their protection and to dramatically improve the cybersecurity profile of this country. We are all stakeholders, and we all have responsibility to be a part of the solution and not a continuing part of the problem. I call on major corporations to schedule on the agenda of their next senior management meeting and their next board of directors meeting, a discussion about your company's computer information security plan. This is a management, governance and business process issue and must be treated accordingly. Have you invested in the implementation of fundamental information security best practices and benchmarks, and is your IT security risk assessment and risk management plan up to date? The National Cybersecurity Partnership, with the tremendous help and leadership of the Business Software Alliance and others, has produced a Guide to Corporate Governance that provides tools and strategies that corporations can affordably implement immediately. I am tired of hearing that lawyers are advising against the adoption and implementation of cybersecurity best practices or on-line privacy policy because they are afraid that they may be creating liability. Friends, in my estimation, a failure to aggressively address these issues may in and of itself be creating the liability. While I am not a lawyer, I am a businessman, I am a citrus grower, taxpayer, I am an involved citizen. This issue is about national security and economic stability along with sound business practices and deserves immediate attention. How about training for employees and information about how to protect their home computers from unwanted intruders and thieves? What a great and inexpensive corporate benefit that would be. And for those who are already doing that, thank you, and keep up the great work. We call on the larger businesses of corporate America to work with your entire supply chain to demand that all the businesses that connect to your network understand the responsibility to make sure their systems are secure. We speak to the financial services sector, credit card companies, health care providers and others to reexamine their own information security protection profiles. Many Americans trust you with their most personal information and have an expectation that the information will remain confidential and protected. Why are we experiencing such a proliferation of identity theft? Is the day of the pin and password behind us, and we need to move immediately to a two-part authentication process that may include biometrics? Are we making the necessary investments to protect the information? Or do some view the cost of identity theft as merely the cost of doing business? I call on software and hardware manufacturers and the national associations that represent you to take the lead from a number of major CEOs who have already publicly committed to improving the quality and security of their products by issuing a public statement that makes that commitment in a manner that the public can have the confidence to know that you, too, view the proliferation of worms, viruses and other challenges resulting from vulnerabilities in your software and hardware products as a matter deserving of a greater investment of time and resources to provide sturdier and more secure products for the marketplace. I would further call on those same hardware and software manufacturers to expand your commitment to providing the consuming public with secure out-of-the-box computing products with user-friendly instructions, preset default security controls, and alerts about creating and maintaining a secure computing environment. I call on the manufacturers of these essential products to work more closely with critical infrastructure sectors to provide security and configuration requirements in advance and build those requirements into the life cycle development process to deliver more compatible, secure and higher-quality products to the marketplace. Companies like Oracle, Microsoft, Sun, Verizon and Entrust are examples of those who are taking this matter seriously. I call on Internet service providers and operating systems manufacturers to work more aggressively with other public and private stakeholders to provide consumers of all levels of sophistication--to provide information about affordable, user- friendly tools that are available to help protect themselves and immediately improve their cybersecurity hygiene. We urge small businesses to take the time and learn about steps that you can take that are affordable and user-friendly to make your system more secure from the growing threats of cyberspace. There are fundamental steps in cybersecurity hygiene that will improve your protection profile overnight. You are an important stakeholder in this matter, and you have a responsibility to be a part of the solution. Home users are not exempt. Home users can become more aware of the tools that are available to improve the protection of their home computer. Make sure that you know about the antivirus software and personal firewalls and how to update your applications, including your operating system, in a timely manner. The National Cybersecurity Alliance is sponsoring National Cybersecurity Awareness Month during October, and you may get a lot of the necessary information about fundamental steps that you can take to protect yourselves by visiting their Website at www.staysafeonline.info. Today we call on the States and local governments to examine their own information security plans, along with their education, awareness and training programs, and, again, to speak to the agencies of the Federal Government, large and small, to step up and provide the example for the rest of the Nation. Receiving Ds and Fs on scorecards about requirements and compliance with the law is unacceptable. We must absolutely experience a recommitment by every Cabinet Secretary, department agency and bureau head to address the issue of securing the Federal computer networks and protecting the information assets that they contain. Federal CIOs and CISOs must be empowered to develop and implement effective strategies and to examine opportunities for enterprise solutions. And we call on Congress to work with all stakeholders, including military, intelligence and law enforcement agencies, domestic and international, to ensure an adequate level of preparedness to meet this growing cyberchallenge and recognize this battle in an overall threat domain. There is much that each of us can do today. The magnitude of this threat demands that we pay increased attention to the issue. If each of us takes the steps today to ensure that we have implemented the basic fundamental elements of cybersecurity hygiene, the cybersecurity protection profile of this Nation will improve overnight. We will send in an enormous message to all of the bad guys that we take this challenge seriously, and we will make the necessary steps to protect our national security and economic stability. As e-government, e-commerce, e-banking and e-health continue to take hold, we must be sure that we have a comprehensive national strategy that provides flexibility, while encouraging innovation and creativity in developing the tools and strategies necessary to secure the computer networks of this Nation and to protect the information that they contain. Today's hearing provides the subcommittee the opportunity to examine this challenge in the context of the impact that unprotected computers and networks have had on the rise of computer-related identity thefts and the adverse impact that these data thefts are having on the national security and economic profile of this Nation. We will hear from experts about potential solutions to these problems, such as vulnerability management, credentialing and authentication tools which may help reduce the impacts of viruses, worms, spyware, spam and phishing, and in return reduce identity-related cyberthefts. I eagerly look forward to the expert testimony that our panel of leaders in information security will provide today, as well as the opportunity to discuss the challenges ahead. Today's hearing can be viewed live via Webcast by going to reform.house.gov and clicking on the multimedia link. [The prepared statement of Hon. Adam H. Putnam follows:] [GRAPHIC] [TIFF OMITTED] T8486.001 [GRAPHIC] [TIFF OMITTED] T8486.002 [GRAPHIC] [TIFF OMITTED] T8486.003 [GRAPHIC] [TIFF OMITTED] T8486.004 [GRAPHIC] [TIFF OMITTED] T8486.005 [GRAPHIC] [TIFF OMITTED] T8486.006 Mr. Putnam. At this time I would like to recognize the distinguished ranking member of the subcommittee, the gentleman from Missouri Mr. Clay, for his opening statement. Mr. Clay. Thank you, Mr. Chairman for holding today's hearing for what is a new topic for our subcommittee, but also part of a growing threat to our Nation's economy, identity theft. That said, I am hopeful that our distinguished panelists will offer constructive and thoughtful proposals on how the Federal Government can be a catalyst for protecting its citizens from those using the Internet or other electronic methods for criminal activity. The costs associated with identity theft activities are staggering when accounting for both economic losses and the time dedicated by victims to remedying credit ratings and financial records. According to the FTC September 2003 survey, the personal costs accumulated by victims of identity theft totals approximately $5 billion annually, with the average costs ranking between $500 and $1,200 per victim. In addition, approximately 15 percent of those surveyed had their personal information misused in nonfinancial activities, often subjecting them to legal investigations or other unwarranted personal invasions. Although the Federal Government has taken steps to counter identity theft-related activity, I remain troubled that identity-theft related investigations are not properly coordinated among local, State and Federal agencies. While progress has been made in coordinating such investigations through the FTC's Identity Theft Data Clearinghouse, efforts must continue to ensure its interconnectivity to all State and local law enforcement jurisdictions. Success can only be achieved when such systems are seamless and interoperable with all stakeholders. In closing, I am hopeful that this issue will remind us of the importance of ensuring the security of our Nation's critical infrastructure and the electronic commerce-based industry. Our Nation's security depends on it. Thank you, Mr. Chairman, and I yield back. Mr. Putnam. I thank the gentleman. [The prepared statement of Hon. Wm. Lacy Clay follows:] [GRAPHIC] [TIFF OMITTED] T8486.007 [GRAPHIC] [TIFF OMITTED] T8486.008 Mr. Putnam. And we will move right to testimony. I would ask the first panel of witnesses, and anyone accompanying you who will be providing support to your answers, to please rise and raise your right hands for the administration of the oath. [Witnesses sworn.] Mr. Putnam. I note for the record that all of the witnesses responded in the affirmative. I would like to introduce our first witness for his opening statement. All of your written testimony will be included for the record. We would ask you to summarize those statements to a 5-minute opening, and we will begin with Mr. Swindle. Commissioner Orson Swindle was sworn in as a Commissioner on the Federal Trade Commission in December 1977. Commissioner Swindle was appointed in December 2001 as head of the U.S. delegation to the Organization for Economic Cooperation and Development experts group to review the 1992 OECD guidelines for the security of information systems. Commissioner Swindle has had a distinguished military career and served in the Reagan administration from 1981 to 1989 directing financial assistance programs to economically distressed rural and municipal areas of the country. We welcome you back to the subcommittee, sir, and you are recognized for 5 minutes. STATEMENTS OF ORSON SWINDLE, COMMISSIONER, FEDERAL TRADE COMMISSION; STEVEN MARTINEZ, DEPUTY ASSISTANT DIRECTOR, CYBER DIVISION, FEDERAL BUREAU OF INVESTIGATION; LARRY JOHNSON, SPECIAL AGENT IN CHARGE, CRIMINAL INVESTIGATIVE DIVISION, U.S. SECRET SERVICE; AND PATRICK O'CARROLL, ACTING INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION Mr. Swindle. Thank you. Mr. Chairman, Mr. Clay and members of the subcommittee, I appreciate this opportunity to discuss the theft and misuse of electronic data and the FTC's efforts to promote better information security practices. My written statement represents the views of the Commission. My comments today are my own and do not necessarily reflect those of the Commission. Consumers and businesses enjoy many benefits in today's information economy. We can purchase products, process financial transactions and access information at any time. The same information-rich data bases that make this possible also are attractive targets for identity thieves and other criminals. The challenge for each of us, consumers, businesses and government alike, is to protect these data bases and the national information infrastructure that supports them. Vulnerabilities and threats to the information economy are very real. Many instances have occurred in which computers are stolen, our networks penetrated, and sensitive personal information of thousands of individuals compromised. These breaches of information security lead to identity theft and impose great cost on both consumers and businesses. Perhaps more damaging is the loss of consumer confidence in using electronic commerce and the vast benefits of the information age. Addressing these threats begins with education. Consumers and businesses must learn how to better protect personal information. Law enforcement actions by the Federal Trade Commission and others can help stop harmful practices and highlight the importance of information security. We also encourage the development of authentication and other security technology to help protect consumers from spam and phishing attacks. This November the FTC will host a workshop to explore and promote the adoption of e-mail authentication standards. Improving information security is essential to our society. We have conducted security-related workshops, worked with the OECD on its information security guidelines, issued the Gramm- Leach-Bliley Safeguards Rule, and brought numerous law enforcement actions. Some basic lessons are evident from our work. First, information security is an ongoing, never-ending process of assessing risks and vulnerabilities. As security threats and technologies constantly evolve, so must our security measures. Second, there is no one-size-fits-all solution for all organizations and types of information. Security procedures must be reasonable and appropriate with regard to the organization, the complexity and sensitivity of the information itself, and the nature and scope of activities in which the information is used. Third, there is no such thing as perfect security. Breaches can happen, even when a company or person has taken every reasonable precaution. Conversely, the absence of a breach does not necessarily mean that adequate security precautions are in place. Fourth, all computer users have an extraordinary role to play in achieving adequate information security, and they must do their job. Information security demands that all of us be involved. Recognizing these lessons, we believe there are some basic steps businesses can take to help minimize vulnerabilities and compromises. Businesses should implement a security plan and make good information practices an essential part of their business operations, literally a part of their business culture. Information security practices must include: risk assessment; identifying internal vulnerabilities and external threats to personal information; designing and implementing safeguards to control these risks; routinely evaluating effectiveness of these safeguards; adjusting the plan as necessary to maintain effective security; and overseeing the information-handling practices of third-party or affiliated service providers who have access to personal information. A good security plan includes effective response procedures should a breach or compromise of sensitive personal information occur. For example, if the breach would result in harm to a person or business, report the situation to appropriate law enforcement agencies. If a breach affects other businesses, such as when a company stores personal information on behalf of other businesses, notify that business. In addition, some breaches dictate that businesses notify customers. Although notifying customers or consumers may not be necessary in all situations, when identity theft is possible because of a breach, customers need to know this quickly. For example, the theft of Social Security numbers. Early notification of consumers allows them to take steps to limit harm, such as placing a fraud alert on their credit file with a consumer reporting agency. The FTC provides businesses valuable information and advice on steps to take in the event of an information security breach. Our law enforcement and education efforts should help deter identity theft before it occurs. However, identity theft will no doubt continue, and the FTC has a comprehensive program to assist consumers and businesses who become victims. The Commission serves as the Federal Government's central repository for identity theft complaints. We take the lead in referring complaints about identity theft to appropriate law enforcement authorities. We provide victim assistance and consumer education. Our identity theft Website provides a variety of resources for both customers and businesses. Educating customers and businesses about the risks to personal information and the importance of good security practices has high priority at the Commission. We will pursue those who violate information security laws, and we will provide assistance to victims of identity theft. Chairman Putnam, in closing I would like to thank you and Chairman Davis for your Dear Colleague letters in support of the National Cybersecurity Awareness Month and your personal leadership on these issues in general. Thank you for this opportunity today, and I look forward to responding to your questions. Mr. Putnam. Thank you very much, Commissioner. [The prepared statement of Mr. Swindle follows:] [GRAPHIC] [TIFF OMITTED] T8486.009 [GRAPHIC] [TIFF OMITTED] T8486.010 [GRAPHIC] [TIFF OMITTED] T8486.011 [GRAPHIC] [TIFF OMITTED] T8486.012 [GRAPHIC] [TIFF OMITTED] T8486.013 [GRAPHIC] [TIFF OMITTED] T8486.014 [GRAPHIC] [TIFF OMITTED] T8486.015 [GRAPHIC] [TIFF OMITTED] T8486.016 [GRAPHIC] [TIFF OMITTED] T8486.017 [GRAPHIC] [TIFF OMITTED] T8486.018 [GRAPHIC] [TIFF OMITTED] T8486.019 [GRAPHIC] [TIFF OMITTED] T8486.020 [GRAPHIC] [TIFF OMITTED] T8486.021 [GRAPHIC] [TIFF OMITTED] T8486.022 [GRAPHIC] [TIFF OMITTED] T8486.023 [GRAPHIC] [TIFF OMITTED] T8486.024 [GRAPHIC] [TIFF OMITTED] T8486.025 Mr. Putnam. Our next witness is Steven Martinez. Mr. Martinez began work for the FBI in 1987. He has held a variety of supervisory and investigative positions within the FBI throughout the United States. In February 2003, Mr. Martinez was assigned as the FBI's first on-scene commander at CENTCOM, or Central Command, in Doha, Qatar, and in Baghdad, Iraq, in the staging of Operation Iraqi Freedom. While there he was in charge of all deployed FBI personnel and managed the FBI's counterterrorism and counterintelligence efforts spanning the initial combat phase of the war. Mr. Martinez was appointed to his current position as Deputy Director of the Cyber Division in August 2004. Welcome to the committee, Mr. Martinez. You are recognized. Welcome home. Mr. Martinez. Thank you, Mr. Chairman. Again, good afternoon, Mr. Chairman and members of the subcommittee. I want to thank you for the opportunity to testify today regarding the FBI's efforts to combat identity theft as well as overlapping cybercrime problems. Some studies show that last year alone more than 10 million victims were victimized by identity theft, with estimated losses exceeding $50 billion. These efforts demonstrate the significant impact identity theft has on U.S. citizens and businesses. Identity theft is a growing problem and can manifest itself in many ways, to include large-scale intrusions into third- party credit card processors, theft from the mails of printed checks and preapproved credit cards, credit card skimming, phishing schemes and other cyber-related crimes. More than 2 years ago, the FBI prioritized and restructured its approach to cybercrime with the establishment of the Cyber Division. Under the Cyber Division, the Internet Crime Complaint Center, or IC3, has focused on combating identity theft through the development of joint investigative initiatives with both our law enforcement partners and key e- commerce stakeholders. The IC3 receives on average more than 17,000 consumer complaints every month. Of the more than 400,000 complaints referred to the IC3 since its opening in May 2000, more than 100,000 can be characterized as identity theft. The FBI is working to combat identity theft on many fronts, to include targeting criminal spammers. Spam is often the front end of a number of cybercrime scenarios used to invite unsuspecting customers to provide personal, financial or credit card information. Multiple agency operations, coordinated by the FBI to include Operation Web Snare, SLAM-Spam, Cyber Sweep and E-Con, has successfully launched hundreds of identity theft investigations. These investigations, involving thousands of U.S. victims and millions in dollars of losses, have resulted in the successful identification and arrest of hundreds of subjects. These operations further serve to alert both customers and industry about new or evolving schemes to which they may fall victim to identity theft. Integral to each of such initiatives are public service advisories, which are developed in coordination with the FBI, our law enforcement partners and the FTC. These advisories are posted on law enforcement and industry Websites in order to warn the public about Internet identity theft scams. The FBI has also seen an increase in identity theft matters with a foreign nexus to include a number of subjects from Eastern Europe and Africa. Many of these subjects solicit their victims through Internet job postings, e-mail, chat rooms, requesting detailed personal information under the guise of offering legitimate employment opportunities. In response, the FBI has developed a close working partnership with many international law enforcement agencies, frequently providing agents and resources abroad in order to directly go after perpetrators. Finally, computer intrusions can also significantly contribute to the problem of identity theft. One such instance involved the hacking of an e-commerce company system resulting in the network compromised and extortion of over 100 U.S. banks; 30 million credit card accounts, including subscriber information, were stolen as a result of the compromise. The FBI takes a proactive role in working to investigate these types of cases to include maintaining close private industry contacts through programs such as InfraGard, a public- private alliance of more than 13,000 members. In closing, the problem of identity theft is a significant matter, impacting the life and livelihood of U.S. citizens. The FBI appreciates the opportunity to share with you our efforts and successes in addressing this problem. The FBI will continue to combat identity theft so that America's citizens and the economy can be protected. Thank you. Mr. Putnam. Thank you very much, Mr. Martinez. [The prepared statement of Mr. Martinez follows:] [GRAPHIC] [TIFF OMITTED] T8486.026 [GRAPHIC] [TIFF OMITTED] T8486.027 [GRAPHIC] [TIFF OMITTED] T8486.028 [GRAPHIC] [TIFF OMITTED] T8486.029 [GRAPHIC] [TIFF OMITTED] T8486.030 [GRAPHIC] [TIFF OMITTED] T8486.031 [GRAPHIC] [TIFF OMITTED] T8486.032 [GRAPHIC] [TIFF OMITTED] T8486.033 [GRAPHIC] [TIFF OMITTED] T8486.034 [GRAPHIC] [TIFF OMITTED] T8486.035 Mr. Putnam. Our next witness is Larry Johnson. Mr. Johnson has been a part of the Secret Service for 22 years and has held supervisory positions in both its Protective and Investigative Divisions. He currently holds the title of Special Agent in Charge of the Criminal Investigative Division and is responsible for the oversight of the Secret Service's criminal investigations, both domestic and abroad. The Criminal Investigative Division also manages the Secret Service's electronic crime programs and initiatives, including the specialized training of agents in computer forensics and the developments and implementation of the Secret Service's electronic crime task forces. Welcome to the subcommittee, sir, you are recognized for 5 minutes. Mr. Johnson. Chairman Putnam, Mr. Clay, members of the subcommittee, thanks for inviting me today. In addition to providing the highest level of physical protection to our Nation's leaders, the Secret Service exercises broad investigative jurisdiction over a wide variety of financial crimes. As an original guardian of our Nation's financial payment system, the Secret Service has a long history of protecting American customers and industry from financial fraud. In recent years, the combination of the information revolution, the effects of globalization and the rise of international terrorism have caused the investigative mission of the Secret Service to evolve dramatically. The explosive growth of these crimes has resulted in the elevation of the Secret Service to an agency that is recognized worldwide for its expertise in the investigation of all types of financial crimes. In today's markets, customers routinely provide personal and financial identifiers to companies engaged in business on the Internet. Information trading and the wealth of personal information available creates a target-rich environment for today's sophisticated criminals, many of whom are organized and operate across international borders. Internet crime has increased significantly in the last several years. Since the early 1990's, organized computer underground networks have developed an extraordinary record of malicious software development. Starting in the late 1990's and increasing over the last few years, this criminal element has used such malicious software to penetrate financial and government institutions, extract data and illicit traffic in stolen and financial identity information. Criminal networks engage in electronic financial fraud, participate in a wide range of activities in order to make their scheme successful. They first obtain and store financial data for future exploitation. Gaining access to this data involves various techniques, technical methods, including hacking, virus-writing, phishing and skimming. The criminal underground active in credit card fraud and identity theft crimes has rapidly adapted its operations to an on-line world, where it has found convenient solutions to the age-old problems in the forms of anonymous communication networks, as well as global, unregulated movement of illegally obtained funds. This has created new challenges for Federal and local law enforcement agencies. By working closely with international police agencies, other Federal, State and local law enforcement, the Secret Service is able to provide a comprehensive network of ongoing investigative operations, intelligence sharing, resource sharing and technical expertise that has bridged judicial boundaries. This partnership approach to law enforcement is exemplified by our financial and electronic crime task forces located throughout the country. These task forces primarily target suspects in criminal enterprises engaged in financial and electronic criminal activity that fall within the investigative jurisdiction of the Secret Service. Members of these task forces, who include representatives from local and State law enforcement, prosecutors' offices, private industry and academia, pool their resources and expertise in a collaborative effort to detect and prevent electronic crimes and identity theft. The value of this crime-fighting and crime-prevention model has been recognized by Congress, which has authorized the Secret Service, pursuant to the U.S. Patriot Act of 2001, to expand our electronic crimes task forces to cities and regions across the country. Two new electronic crime task forces will be established this month, bringing the total number of ECTFs to 15. The Secret Service Electronic Crimes Task Force Program bridges the gap between conventional cybercrime investigations and the larger picture of critical infrastructure protection. Secret Service efforts to combat cyber-based assaults that target information and communications systems supporting the financial sector are a part of the larger and more comprehensive critical infrastructure protection. A key element in our strategy of sharing information and operating with other Federal agencies, to include IC3, the department of Treasury, Department of State and the FBI, are the 17 permanent U.S. Secret Service field offices that support both our protective and investigative missions. The Secret Service provides training for counterfeit investigations, financial crimes and computer intrusions to our international law enforcement partners. In a joint effort with the Department of Justice, the U.S. Postal Inspection Service, the FTC and the International Association of Police Chiefs, the Secret Service is hosting identity crime training seminars for local enforcement officers across the country. These training seminars are focused on providing local and State law enforcement officers with tools and resources that they can immediately put to use in their investigations of identity crime. Additionally, officers are provided resources that they can pass on to members of their community who are victims of identity crime. The Secret Service will continue its aggressive domestic and international pursuit of cybercriminals who are involved in the hacking of our Nation's computer systems, the intrusions of our networks and the theft of identities of U.S. citizens through mainly prevention and disruption. The Secret Service, with the assistance of the Department of Homeland Security, is committed to the deterrence and apprehension of all potential cybercriminal suspects who threaten citizens of the United States and its critical infrastructure. Mr. Chairman, that concludes my prepared statement. Mr. Putnam. Thank you very much, Mr. Johnson. [The prepared statement of Mr. Johnson follows:] [GRAPHIC] [TIFF OMITTED] T8486.036 [GRAPHIC] [TIFF OMITTED] T8486.037 [GRAPHIC] [TIFF OMITTED] T8486.038 [GRAPHIC] [TIFF OMITTED] T8486.039 [GRAPHIC] [TIFF OMITTED] T8486.040 [GRAPHIC] [TIFF OMITTED] T8486.041 [GRAPHIC] [TIFF OMITTED] T8486.042 Mr. Putnam. Our next witness is Patrick O'Carroll. Nice French name. Mr. O'Carroll currently serves as the acting inspector general for the Office of the Inspector General of the Social Security Administration. In fiscal year 2003, the office of investigators has reported over $356 million in investigative accomplishments. Prior to coming to the Social Security Administration, Mr. O'Carroll had 24 years of experience with the U.S. Secret Service. So we have two Secret Service representatives with us today. Throughout his career, Mr. O'Carroll has received numerous awards for his meritorious service. Welcome to the subcommittee, sir. You are recognized for 5 minutes. Mr. O'Carroll. Good afternoon, Mr. Chairman and Mr. Clay. Thank you for the invitation today to be here for this important hearing. You have my statement for the record, so I will provide a few remarks. Protecting information is vital to the Social Security Administration and its programs. Any breach in the confidentiality or integrity of their data would seriously jeopardize the agency's mission and erode the public's confidence in SSA programs. As part of the mission of the SSA Office of the Inspector General, we work closely with the agency to ensure that SSA has the proper controls in place to preserve the integrity of its data and business processes. Today I will focus on why it is important to prevent electronic data theft, what my office is doing to help SSA, some of SSA's data security efforts, and what more needs to be done. The information technology revolution brings a heightened risk of disruption or sabotage of critical operations. We need to protect the public by preventing destruction and cyberattacks when possible, or ensuring that they are infrequent and manageable. Another threat to our essential electronic data is identity theft, the fastest growing form of white-collar crime in America. Our investigations in this area reveal how widespread the misuse of SSNs and other sensitive data from public and private sector data bases has become. The topic of identity theft is more than just dollars and numbers. Let me give you a specific example. We have recently received a letter from an individual who found that her and her husband's personal information was posted on a publicly available government Website complete with her Social Security number. In a letter to me, she indicated she had made multiple inquiries at the local, State and Federal level trying to have her personal information removed. The individual commented in her letter that the Government, both State and Federal, should do whatever is possible to ensure the integrity of every citizen's SSN. I couldn't agree more. In addition to our efforts regarding SSN misuse, we also consider investigations of employee fraud a high priority. It only takes one corrupt employee to compromise the integrity of the Social Security system. In particular, illegally used SSNs puts the financial integrity of the SSA system at risk and inhibits the country's work for terrorism. Let me discuss two of our successful investigations. In one, a 15-year SSA employee provided Social Security cards for a scheme in which immigrants paid up to $75,000 for citizenship. The SSA employee resigned and was only sentenced to 2 months of incarceration. In another, an SSA employee knowingly approved fraudulent applications for over 1,700 Social Security cards for approximately $1,000 each as part of a $4.3 million criminal enterprise. The SSA employee lost his job, was sentenced to 71 months in prison, and was ordered to forfeit $1 million. SSA has made significant progress in strengthening SSN integrity and has implemented important suggestions which our office has made. SSA's efforts toward protection of electronic data include the SSA Enumeration Response Team comprised of agency executives, including OIG representatives, that has implemented numerous policies and procedures designed to better ensure that only individuals authorized to receive an SSN are available to do so. The agency is also piloting an on-line Social Security number verification system, which will allow employers and third parties to verify employer names and SSNs via the Internet, using information and SSA records for wage-reporting purposes. This system will also indicate if the SSA record shows that an employee is deceased. While SSA protects its data with numerous controls and safeguards, we are concerned about how other Federal agencies maintain security of SSNs. Given the potential risk, we believe Federal agencies would benefit by strengthening controls over the access, disclosure and use of SSNs by State and local governments and other external entities. Misused SSNs, stolen or misappropriated birth certificates, and false or fraudulently obtained drivers' licenses are keys to identity fraud in the United States. Our OIG works closely with SSA to help ensure the integrity of all of its data. As technology has advanced, SSA has kept pace in developing appropriate safeguards against intrusion. SSA must continue to strike a balance between the need to be user-friendly and the demands for increased security. Together with Congress and SSA, we have made important strides in reducing vulnerabilities, and that effort continues. Still, to strengthen our defenses even further, we believe that SSA should work with agencies across government to improve safeguards for data security. We also believe SSA and lawmakers should exam the feasibility of the following initiatives: limiting the SSN's public availability, prohibiting the sale of SSNs, and prohibiting their display on public records, and enacting strong enforcement mechanisms and stiffer penalties to discourage SSN issues. I would be happy to answer any questions you may have. [The prepared statement of Mr. O'Carroll follows:] [GRAPHIC] [TIFF OMITTED] T8486.043 [GRAPHIC] [TIFF OMITTED] T8486.044 [GRAPHIC] [TIFF OMITTED] T8486.045 [GRAPHIC] [TIFF OMITTED] T8486.046 [GRAPHIC] [TIFF OMITTED] T8486.047 [GRAPHIC] [TIFF OMITTED] T8486.048 [GRAPHIC] [TIFF OMITTED] T8486.049 [GRAPHIC] [TIFF OMITTED] T8486.050 Mr. Putnam. Thank you very much, and I want to thank all of our first panel of witnesses, and we will go straight to questions. Commissioner Swindle, in the current threat environment in which we live where systems face ongoing attacks, probes, or are constant for vulnerabilities, the bots, the zombies and everything else, some companies, it is becoming clear, are purposefully avoiding conducting IT risk assessments because of the fear that those assessments themselves will establish knowledge of vulnerabilities that could be used against them in litigation. What are your thoughts on the position that a lot of these companies have taken? Mr. Swindle. Mr. Chairman, I would compare their conduct to that conduct you spoke of earlier about lawyers recommending they don't have privacy policies so as to avoid liability. I think it is a road to suicide, quite frankly, because it will catch up with them eventually. And, I think consumers, as they become more aware of the full privacy issue and certainly information security issue, are going to look to companies that are responsible, and they will and turn away from those that are not. Soon there will be more of those that are resonsible than not, and the losers will be the ones that choose this course of action. I think it is incredibly dumb. I have encountered this in several fora that I have attended over the years, and I just look at them with astonishment that they would take that approach, because I don't think it is realistic. It is certainly not responsible. Mr. Putnam. Is there a need for some form of safe harbor that would encourage companies to conduct thorough examinations and then come forward with whatever deficiencies they find? Mr. Swindle. Safe harbor, I would say, is perhaps a good vehicle to protect those who do the right thing, and inadvertently have security failures, as I said, no security package is going to be complete. They have taken responsible actions, they have done as much as they could see to do, and a breach occurs--I don't think they should be held responsible for something they couldn't really avoid. But, I have a hard time giving people an easy way out, if you will. But, we may have to come to that position, because, as both Mr. Clay and yourself have mentioned, these problems are growing. We are making progress, but the problems are growing faster oftentimes than the progress, and it may be that we have to seek some kind of means to encourage people to get in and start doing the right thing. But, I would still prefer to see the private sector lead, for their own self-interest, to do the right thing. I am still not convinced that we are incapable of doing that. I have hopefully not unfounded confidence that we will do the right thing. Mr. Putnam. Thank you. Mr. Martinez, Mr. Johnson, a recent survey was conducted by Carnegie Mellon and Information Week of 100 small and medium- sized businesses that found that 17 percent of the participating companies had been the targets of some form of cyberextortion. Could you tell us more about the cyberextortion problem and the trends that you are seeing out there, and what advice you would have for companies who are faced with that threat? With the FBI? Mr. Martinez. Well, in simplified terms, the cyberextortion is not just the mere use of the facility of the Internet to make an extortion as demand, but instead a sophisticated hacker might find a vulnerability in a system, steal proprietary information, customer lists, personnel information from a company, and then pitch them that they can fix it. And if they aren't allowed to come in as a, ``consultant,'' they will release that information in a way that would be harmful to that company. That's one manner in which it can occur. Trends, the level of sophistication, absolutely is going up. The ease with which tools can be obtained to make the initial intrusion are becoming far, far more available and simpler to use. It doesn't take a rocket scientist to drive some of these tools at this point. It was mentioned previously about the playing field changing from hacking for fun to now hacking for profit. As far as advice goes, of course, good computer security, engaging in private industry partnership, partnerships with law enforcement organizations such as InfraGard where information could be shared so that we can have a prophylactic effect, you know, share information about how we can protect systems, and also, as was mentioned previously, have a response plan. Companies have to have a response plan, they need to know what to do when they have been attacked. By all means, contact law enforcement. There's a lot we can do. There are a lot of resources we can bear to solve the problem. Not all of these problems can be solved from the desk, from the desktop of a systems administrator. Again, we need to know how to respond, how to freeze evidence, how to establish the logs so that we can go in and determine what the methodology was, see if it is common with another case we have been working in the past and what resources we can bring to bear to work with the problem. Mr. Putnam. Mr. Johnson, I understand that the Secret Service recently released a report on insider cybercrime activities in the banking and finance sector. As part of its ongoing insider cyberthreat study, could you elaborate on the threats of that study, the difficulties of dealing with an insider threat, and the implications that report has for combating identity theft? Mr. Johnson. Yes, Mr. Chairman. I echo the sentiments and statements of the FBI in that we recently had a case involving AOL that involved an insider threat, the selling of personal identities to spammers for monetary gain. With the insider threat, the last 2 years, the Secret Service, in conjunction with Carnegie Mellon University CERT Coordination Center, collaborated on this insider threat study. The threat to critical systems includes individuals who have manipulated vulnerabilities within the system for personal gain, as is the case I mentioned with AOL. Some of the relevant findings of the study were similar to a lot of things that we have talked about today, and that is updating firewalls when employees leave, taking them out of the access to networks, changing passwords. The simplest-type things are being overlooked by businesses and IT people. Most incidents were not sophisticated or complex. A majority of the incidents were thought out and planned in advance, and, in most cases, others had knowledge of the insider's intentions, plans and activities. Like the locks on your doors, changing access to network and changing passwords and updating firewalls is a smart business practice. Mr. Putnam. Mr. Martinez, you mentioned a series of ongoing investigations that involve, in some, the theft of 30 million credit card account numbers and potential losses of $15 billion. Can you elaborate on how thefts like this grow to such epic proportions, and are the penalties for cybercrime under the current code commensurate with the damage that is being done? Mr. Martinez. Well, of course, a case can be taken to this scope by consolidating like cases, and that's one of the things we try to do in developing strategies both for proactive efforts, and then also once we have complaints that have commonalities. And in order to do that, we have to employ analytical tools and analysts in a form like IC3 in order to determine if we have a problem that goes beyond the scope of a single complaint. In this case a rather large list of credit information was obtained. Again, it involved many different credit card companies, and so, again, I think we put the number at 100 that were affected, financial services and institutions. The idea here is to identify the scope and then work with these institutions, work with victims in order to track back. Let's see where this threat came from, see if we can't put our resources together in order to address the problem and to be proactive about the next attack. Mr. Putnam. Mr. Johnson, do you wish to add anything to that? Mr. Johnson. Not at this time. Mr. Putnam. Very good. My time has expired. I will recognize the distinguished ranking member, Mr. Clay, for his questions. Mr. Clay. Thank you, Mr. Chairman. Mr. Swindle, since your agency carries the responsibility for protecting the private information of consumers, what additional efforts need to be undertaken by FTC to further educate the public and corporate community on issues surrounding identity theft, or is education and awareness the key to prevention, or are more stringent regulations concerning privately held consumer information necessary to improve security? Mr. Swindle. Mr. Clay, I would hope that we are not, as stated, responsible for protecting the privacy of all the American citizens. That would be a hell of a big job, and I know you didn't mean it exactly that way. Mr. Clay. I would want you to. Mr. Swindle. We certainly do the best that we can, and we are taking every step we possibly can, given the resources we have--and this is not a plea for more resources, by the way--to help educate, and, through education, to deter the invasions of privacy and this theft of this personal identification of which we have all been speaking, and the damage it can do to people. A part of an education process is dealing with businesses, it is dealing with government agencies, it is dealing with Members of the Congress, asking them to help us make more people, the consumers, aware. It is dealing with the business association and working internationally, dealing with cross- border fraud issues and trying to work with just hundreds of agencies. We are now, with our identity theft complaint clearinghouse, I believe we call it, we are making that available to in excess of 1,000 law enforcement agencies around the country. We are about to make it available to the Canadians on a 24-hour basis. We are working with international groups. We are working with local and State law enforcement agencies. So, there is a lot going on, but I think that gets to the problem, as the chairman had mentioned, and Mr. Clay, I believe you mentioned also, the occurrence of these crimes seem to be growing no matter what we do. And, it is the proverbial needle- in-the-haystack operation, except that this haystack is the global haystack, and there are lots of needles in there. Trying to find solutions and punish those who are guilty is a difficult process. I don't know that we can solve the problem without massive education of customers and business. Then everyone who is involved becomes aware of the role that they can play and take it seriously. It is going to take a lot more effort. We have some, if I remember correctly, about 45 or 50 Congressmen, that have participated with a program we tried to initiate 2 years ago. We could get what, 395 more that could do it and help us a lot. It is just a massive problem. It is going to take repetition, repetition, repetition. Mr. Clay. What are the main things that the public should be aware of? What should they look out for? What advice do you give the public about identities? Mr. Swindle. Well, just starting off, liken it to an automobile. We know automobiles and safety intuitively. We have to get the use of computers into that mode of thinking. That means first realizing that a computer is a very sophisticated thing. It is now just second nature to log on and talk to somebody halfway across the world. When you and I were growing up, we didn't know how to talk to the community 15 miles away. Things have greatly changed. We have to educate people to learn. It will literally take an education program that starts with young persons. We are not doing enough. But also in the business side of the world, it's talking to businessmen and board members. They have to take information security and privacy seriously. It is their corporation, their business. It should be a primary part of the culture of that company to do these things right, and then it has to ripple right down the stream to the lowest levels. Mr. Clay. Thank you for that response. Let me shift real quickly to Mr. Johnson, and seeing my time is short. It seems to me the responsibility of the Secret Service runs concurrent to many other law enforcement agencies at all levels of government. Can you update us on any specific identity theft prevention activities among groups collaborating with the Secret Service, such as the Joint Terrorism Task Forces or Operation Direct Action? And are these groups improving the methods used to coordinate against suspected identity theft activity? Mr. Johnson. Yes, Mr. Clay. The Secret Service prides itself in the education of local and State law enforcement. We have a Secret Service e-information network that is available on line. We have a CD-Rom for State and locals. We have best practices for seizing electronic evidence. Operation Direct Action is working with third-party processors. Two of the primary third-party processors of credit cards are involved in Omaha, Nebraska, and Columbus, Georgia. By working and having agents assigned to those locations, we've found that access to the information that they can provide gives us quick response to State and locals or first responders to either identity theft or credit card fraud. We have seen the benefits in a good percentage of the cases that are ongoing and other cases that have been concluded. Mr. Clay. I thank you for that response. And thank you, Mr. Chairman, for your indulgence. Mr. Putnam. You are very welcome. Mr. O'Carroll, you mentioned that in your work on behalf of the President's Council on Integrity and Efficiency on controls over Social Security numbers that 9 of 15 inspectors reported that their agencies had inadequate controls over the protection of Social Security numbers in their data bases. Given the extensive information security requirements for Federal agencies under FISMA and GISRA, how can this be? Mr. O'Carroll. Mr. Chairman, historically the use of the SSN was the Federal identifier of employees, and much as we found with universities where it was on their identification card, in many Federal agencies it was on the identification card for the agency. It was posted on walls. Instead of system security flaws on it, it was mostly posting an easily observable SSN. And what we are fearing--we did the study of other inspector generals on this thing--is as much as you said there, is our feeling is that the first place to start correcting the use of the publication of SSNs is within the Federal Government. One of the ways that we just changed it recently, as probably many of the people in the room are aware, is when any check was going out from the Federal Government, in the window of it, it had the Social Security number of the individual receiving the check. These are all baby steps that were taken. We finally have gotten that taken off of the check. We have been stopping the publication of it. We are doing studies now in terms of the uses of non- Federal agencies' use of SSNs, for example, colleges and universities, and we are trying to do an education program to get the SSN taken out of the daily usage. And we figure that will be a good way to prevent its misuse in government, and misuse period. Mr. Putnam. Many companies avoid reporting security breaches due to the effect that the news would have on their reputation. Is that sound policy? It's certainly to a degree understandable. Or does it merely make the problem worse and encourage those cybercriminals by having them to believe that they won't get caught? We'll begin with Mr. Martinez. Mr. Martinez. Well, this issue is addressed across the board in some of the cybercrime matters that we address. I know when I was an assistant special agent in charge in Los Angeles, we worked with the entertainment community on IPR issues, intellectual property rights, and there was a bit of a dance that we had to do with the industry because they don't like to admit that they have a problem. It is bad business sometimes. It gives their competitors possibly an edge. And the same thing applies to e-commerce businesses, etc. So our approach to that is to try to engage to the fullest extent we can with those businesses, give them a comfort with us, let them know what to expect through training. Again, our InfraGard program, that's part and parcel, is to let them know what to expect if they do report and the FBI shows up, what we are going to be looking for, what we would hope to find when we get there as far as the procedures they've put in place to maintain evidence. Mr. Putnam. Anyone else want to answer that? Commissioner Swindle? Mr. Swindle. I believe I addressed this in part in my last response. There is almost a Washington, DC, ostrich syndrome that I think permeates the whole society that when we do something wrong, we fear addressing it up front more than I think is necessary. I think if we deal with things direct, up front, get it out, find a solution, we are far better off. I think it speaks well to the reputation of legitimate companies that they will do that. To do otherwise is just ignoring a problem that will never go away. It will come back, it will be found out, and then you are going to deal with why you covered it up. Mr. Putnam. It is not just Washington, as it might be a network problem, too. Anyone else want to add to that? The President has transmitted to the Senate the Council of Europe's Convention on Cybercrime. Given the international nature on this, and we certainly have law enforcement represented has to operate across borders, how important is the ratification of this treaty to improving our ability to apprehend cybercriminals? Mr. Martinez. Mr. Martinez. Well, absolutely it is important. The FBI has made a significant investment in international training and trying to work jointly with law enforcement agencies in other countries where we know we have problems and issues, where attacks are generated, where phishing schemes are located. And, again, we are very proactive about that, offering through international law enforcement academy several different blocks of cybertraining, ad hoc training really, anywhere in the world where it's required. We have 47 legal attache offices, about to add 3 more, and that's a big part of their job is to put us in contact with law enforcement agencies that need that kind of help. So having those kinds of devices to allow us to solidify those relationships, standardize the law and response in areas across the world is critical to our being able to address the problem here in the United States. Mr. Putnam. Mr. Johnson, do you wish to add anything? Mr. Johnson. Yes, Mr. Chairman. I would agree and the Secret Service would agree that the victimization of Americans and of businesses overseas is growing at a rapid pace. The world is borderless. The Internet provides the foreign criminals easy access to the United States and their citizens by quickly getting on line. Many countries have Internet access, they have TV access. Foreign public can only buy Western products on line. That is their only capabilities. The growing number of significant investigations overseas, virtually all terrorist investigations have a foreign nexus. The field offices that we have established have provided rapid response overseas and provided that capability, and it is also extending the reach of American law enforcement in general. Mr. Putnam. Commissioner, this is my final question, and then I will yield back to Mr. Clay. California has a law that took effect in 2003 that requires businesses or State agencies that maintain computerized data that includes specified personal information to disclose any breach of security to any California resident whose unencrypted information was or is reasonably believed to have been acquired by an unauthorized person. What effect do you think that law will have on improving information security? And what are your thoughts on taking it national? Mr. Swindle. Mr. Chairman, as I mentioned in my testimony, there certainly are circumstances where a person ought to be notified that there has been a breach. However, I don't for a minute believe that in every circumstance they should be notified. And I think, taken to extreme, that could be an enormous burden on businesses, and it would solve no problems. I don't think it necessarily would prevent it from happening again, and there may very well not be any damage done at all. A lot of the information that it is personally identifying is publicly known in phone books, for example. So I think you would have to deal with those circumstances on a case-by-case basis. And, to my knowledge, I think California is the only State, at least to date, that has that kind of legislation. That's not to say it is probably not being considered by many other States, but I think I would move in that direction extremely cautiously because I think it could be an overkill. Mr. Putnam. Mr. Clay, you are recognized. Mr. Clay. Thank you, Mr. Chairman. I will start with Mr. O'Carroll. Since the release of the 2003 report on the internal control structures for the use of Social Security numbers among Federal agencies, have there been any notable improvements reported by agencies that were identified as having deficiencies in the methods and practices used for protecting Social Security numbers or identifiers? Mr. O'Carroll. Mr. Clay, we were going to be doing another followup audit on that next year to see what improvements there have been. But anecdotally, from other inspectors general and from having conferences with them and discussions with them, most of those other agencies have all started robust plans on correcting the use of SSNs in their agency, and we expect it to be a much better audit when we do it next year. Mr. Clay. Thank you for that. Let me ask Mr. Martinez. Last Friday the Washington Post published an article on the increasing number of fraud-related investigations by the FBI within the mortgage marketplace, and identified my home State of Missouri as a so-called hot spot of activity. Can you provide for us any information on the number of cases that are specifically related to the use of fake identities or straw buyers or forged loan documents in the recent upswing of activities? Are you familiar with it at all? Mr. Martinez. I am familiar with the article and the circumstances; and that would fall under the responsibility of our Criminal Investigative Division that has the responsibility for traditional white-collar crime cases. I can tell you that it is certainly within the realm of possibility that type of criminal activity could be part and parcel of mortgage loan fraud. Again, identity theft might very well be applied. I mean, I think the answer here is that smart criminals will figure out a way to make it work for them. And with this vulnerability, it is just another vulnerability to be exploited, and I think it could be applied. But I couldn't give you specific figures, but I can certainly talk to the Criminal Investigative Division and get back with you on that. Mr. Clay. Thank you for that. Let me ask you for one last question. Can you cite for the committee specific areas where legal or policy barriers continue to impede information sharing or cooperation among stakeholders investigating potential identity theft activities? Mr. Martinez. I am not aware of any legal impediments. I think there is just an awful lot of work to go around. So the approach we have to take is to just leverage resources. Again, I am not here with my hand out saying we need more bodies. Of course I could throw another thousand agents at the identity theft problem, and in cybercrime in particular, and not solve it and not make a significant dent in what might continue to be the problem. But that said, we do have many, many initiatives that are intelligence-based. I've mentioned IC3 several times. It is more than just a place to receive complaints. We take that information, we crunch the numbers, we decide where can we apply our resources, our cyber task forces' resources, State and local resources that can be brought to bear, regional forensic labs to address the problem. So it is enormous, but I do think that with some collaboration, with our partners especially, you know, we have mentioned several times with private industry, it is enormously important. We can't do this alone. They are often out in front of us as far as being able to detect and plan and see threats coming. So we need to continue to leverage those resources the best we can. Mr. Clay. How successful is your agency in apprehending those who participate in identity theft, those--especially the bigger fish so to say? Pretty successful? Mr. Martinez. Well, I guess I would like to say that we have had some tremendous successes. Some of the things that impede those successes are, again, the international nature of the problem. Some of the groups that are perpetrating these types of crimes are located in countries where we don't have a good established working relationship. We work awful hard at it, but there is just--sometimes you can't overcome those problems. But, again, it is something that we need to work at every day. We do have a good network of legal attache offices and training and outreach that goes toward making those kinds of strides. Mr. Clay. Thank you for that response, Mr. Martinez. I yield back the balance. Mr. Putnam. Thank you, Mr. Clay. Before we wrap up this panel, I would give all of you the opportunity to have a final word or answer a question you wish you had been asked, whatever the case may be. And we will begin with Mr. O'Carroll and go down the line and just give you a moment, if you have anything that you would like to say, and then we will seat the second panel. Mr. O'Carroll. Mr. O'Carroll. The only thing I have to add, Mr. Chairman, is--continuing on with what Mr. Martinez said, is that I think nowadays since we all have so much more work than we have people to handle it, that the wave of the future is going to be cooperation between all Federal law enforcement agencies and also working with local agencies. And by doing that, we are using the task force concept which is being used right now very effectively in the terrorism arena. In the identity theft arena, I think that is the solution. We can share information, it is easier to do it, there is less structure--or strictures in relation to disclosures of information on a task force. And I think that is something that we are going to be seeing a lot more of. We participate in about six identity theft task forces around the country that have been very successful. Mr. Putnam. Mr. Johnson. Mr. Johnson. In closing, Mr. Chairman, I would agree with Mr. O'Carroll, that our Electronic Crimes Task Force is--the 15 that we have established, we are looking to double that number in the next 3 years. To further Mr. Clay's earlier question to Mr. Martinez about the big fish, are we--I would just like to say to the chairman that the Secret Service is, through prevention, our training at the local levels all the way up to the disruption of the major players in financial crimes and identity theft, that we are making inroads every day with these investigations. That along with the Electronic Crimes Task Forces in the United States, the Secret Service is not only dedicated to the problem, but it is a priority of our agency. Mr. Putnam. Thank you. Mr. Martinez. Mr. Martinez. First, I want to tell you how much I appreciate and the FBI appreciates the opportunity to come and speak to you today and talk about this important crime problem. And I want to tell you how much we appreciate Congress' support in enacting the SLAM-Spam Act, the identity theft penalty enhancement. These are the types of real tools that we can go out and take and try to make an impact on this crime problem. I just appreciate the opportunity to speak to you today. Thank you. Mr. Putnam. Thank you, sir. Mr. Swindle. Mr. Swindle. Mr. Chairman, someone, I've forgotten whether it was you or Mr. Clay, asked the question to another participant about whether or not the penalty matched the crime. I have been a Federal Trade Commission for roughly 6\1/2\ years now, and one of my great frustration is to see one scam artist after another come through our process. Our staff does remarkable work in finding them, building the case, but we are a civil penalty organization and do not have criminal authority. Oftentimes we find we catch the spammers, we catch the scam artists, and so much of it is being done electronically now, and we expend great resources to get them, and they have nothing. It is just a difficult task. I don't think the penalties anywhere come close to matching the crime. One of my greatest frustrations is that it appears as though some of this conduct is almost just the price of doing business when you get caught because the penalty is so insignificant relative to the size of the profits made. Another one is oftentimes we find people after we track them down and they have ripped off the consumers for multimillions of dollars. Guess what? They have no assets except perhaps a million-dollar house in Florida which we can't touch because of the homestead exemption. We ought to find ways to adjust the laws so that you don't get homestead exemption if you are engaged in criminal activity or alleged criminal activity and you settle. It is a big problem. I think it is demoralizing to those who try to apprehend these people, not to mention the poor victims of some of these crimes, which it is in staggering proportions. And I think that is something we should seriously look at. Mr. Putnam. Thank you very much. I want to thank all of you. And at this time we will dismiss panel one, and the committee will recess for such time as it takes to set up the second panel. [Recess.] Mr. Putnam. The subcommittee will reconvene. I would like to invite our second panel of witnesses and anyone accompanying them to please rise and raise your right hands for the administration of the oath. [Witnesses sworn.] Mr. Putnam. Note for the record that all the witnesses responded in the affirmative. We will move directly to testimony beginning with Howard Schmidt. Mr. Schmidt joined eBay as vice president and chief information security officer in May 2003 after retiring from the Federal Government with 31 years of public service. He was appointed by President Bush as the vice chair of the President's Critical Infrastructure Protection Board and as the special advisor for Cyberspace Security for the White House in December 2001. He assumed the role of the Chair of the Board in January 2003 until his retirement in May 2003. Welcome to the subcommittee. You are recognized, sir, for 5 minutes. STATEMENTS OF HOWARD SCHMIDT, FORMER WHITE HOUSE CYBERSECURITY ADVISOR, AND VICE PRESIDENT, CHIEF INFORMATION SECURITY OFFICER, eBAY, INC.; BILL HANCOCK, VICE PRESIDENT, SECURITY PRACTICE & STRATEGY, CHIEF SECURITY OFFICER, SAVVIS COMMUNICATIONS CORP.; BILL CONNER, CHAIRMAN AND CHIEF EXECUTIVE OFFICER, ENTRUST, INC.; AND JODY WESTBY, CHAIR OF PRIVACY AND COMPUTER CRIME COMMITTEE, AMERICAN BAR ASSOCIATION, SECTION OF SCIENCE AND TECHNOLOGY LAW, AND MANAGING DIRECTOR, PRICEWATERHOUSECOOPERS Mr. Schmidt. Thank you, Mr. Chairman and Ranking Member Clay. Thank you very much for the opportunity to be here today. I would like to keep my verbal comments relatively brief in lieu of all the questions that you had last time and I am sure you will have again. But I want to basically focus my remarks in three major areas: One, what eBay is--the company itself is doing relative to the leadership, relative to the area of on- line identity theft and phishing, as you have cited to, accurately so, a growing threat to consumers, business, Federal employees, and basically anybody that uses the Internet; also, some of the industrywide efforts that are taking place to collectively combat this area; and then some thoughts I think that I want to share relative to the public-private partnership that is so crucial to our success in moving forward on the cyberspace security area, but more specifically on the on-line identity management. You know, you have heard the numbers from the FTC. They reported earlier this year that the identity theft topped the list of consumer complaints for the 4th year in a row, about a 33 percent increase in what we have seen over the previous years, and even that didn't tell the full story. In June of this year, the Forrester Report showed approximately 9 percent of U.S. on-line consumers, about 6 million houses that use the Internet, that experienced identity fraud. Now, when you look at the overall international user base on the Internet, it is estimated to be about 840 million users currently. So we are talking about just the U.S. portion of that. And what I probably worry about most more than anything else is the fact that the numbers that we have mentioned are potentially capable of growing if we don't take action quickly and we don't move in a cohesive measure between private sector and public sector. One of the reasons, of course, as some of the previous folks testified about, and that is this issue around phishing. What we have seen is an evolution as we have been very, very concerted about better cybersecurity for enterprises. You mentioned the California 1386 law relative to reporting things, Sarbanes-Oxley-Graham. You list the name of things that have given us incentives to do things better when it comes to cybersecurity, and corporations both publicly traded as well as privately owned are doing more. We are starting to see the shift, the attack factor shift to the less sophisticated, the end users, the cable modem users. You know, we have seen instances even recently where phishing e-mails have come reported to be from the FBI, the FDIC telling people that if you don't fill out this form and give us all your information, Social Security number, mother's maiden name, dog's name, address, high school, we are going to shut down your bank account, and that is tremendously scaring to the uneducated and the non-IT professional. But it is interesting that this is not a new phenomenon. We have been dealing with this for over 20 years. In the 1980's, we were actually teaching classes at the Federal law Enforcement Training Center in Georgia on what we called at that time carting, with actually doing shoulder surfing, going to airports, New York La Guardia, and looking at people as they used calling card numbers and credit card numbers to make calls and using that for identity theft. And what we have seen as of about 2 or 3 years ago when this new spate of phishing started, they actually started from a perspective of trying to grab on- line time for free. It wasn't about identity theft, it wasn't about credit card fraud, it was getting on line for free. And then what happened is that evolved, and they said, well, listen, we can make money off of that. And I think all the previous witnesses testified as well that this has now moved from clever hobbyists and people thinking they are being funny and hacking to where it is true criminal enterprises. And other reports came out this year that estimated 57 million users on line had received phishing e-mails. I am averaging one a day now from major institutions all around the world. Mr. Putnam. Excuse me. Can I just interrupt? Does that include the Saudi plea? Mr. Schmidt. Yes. Mr. Putnam. Because that has to be at least two-thirds of it. Mr. Schmidt. That is a big chunk of it. Absolutely correct. And then, of course, we add into the political fundraising portion of it as well. And what happens now, we are seeing a more focused, what is being referred to by Marcus Jacobson, who did some analysis while at RSA Security Laboratories, what they call context attacks, where the phishing attacks are the same way. You just recently bought a new car, here is information relative to that, and really convincing you that this is a legitimate e-mail. So consequently, you know, this is indeed a new challenge we have not seen before. Now, what are some of the things we are doing? One, first and foremost, many of us, particularly those of us who have multi-multi-million-user bases like we do, are doing a continuous education process. We've changed our business process, so we no longer send active links in e-mails that we send to customers anymore. As a matter of fact, we tell them, if you want to do a transaction, type in the URL or use a bookmark. But basically we have also spent a tremendous amount of resources hiring people to do full time where we have the ability to identify these phishing sites on a near real-time basis and take them down. Now, in closing, I just want to make one quick comment relative to the overall homeland security piece, because as we were doing the national strategy to secure cyberspace out of the White House, some government agencies didn't feel that identity theft and identity management were homeland security issues, and I truly believe they are. One, first and foremost, no better tool--as we get better about physical identity, no better tool than for a terrorist or an organized crime to use--criminal person to use than your good name to be able to assume your identity and be able to pass through airports. Second, it becomes a nexus. And as you see in my written testimony that we are seeing 30,000 users that are being compromised on a regular basis that then can be used to launch denial of service attacks. And, last, to become a gateway into corporate enterprises such as critical infrastructure. And it is important to make sure that we do everything we can to stop that from taking place. So, with that, I thank you for the opportunity again, and I stand by for any of your questions you may have. Thank you. Mr. Putnam. Thank you very much. [The prepared statement of Mr. Schmidt follows:] [GRAPHIC] [TIFF OMITTED] T8486.051 [GRAPHIC] [TIFF OMITTED] T8486.052 [GRAPHIC] [TIFF OMITTED] T8486.053 [GRAPHIC] [TIFF OMITTED] T8486.054 [GRAPHIC] [TIFF OMITTED] T8486.055 [GRAPHIC] [TIFF OMITTED] T8486.056 [GRAPHIC] [TIFF OMITTED] T8486.057 [GRAPHIC] [TIFF OMITTED] T8486.058 Mr. Putnam. Our next witness is Dr. Bill Hancock. Dr. Hancock is the vice president of Security Practice & Strategy and the chief security officer of SAVVIS Communications, a large global telecommunications hosting and IT services company. He has designed thousands of networks and has been involved in hundreds of hacker investigations in his career of over 30 years in the high-tech industry. Dr. Hancock has written extensively on security and networking. He is well known in the industry as a technical visionary due to his various original inventions such as stealth firewall technology and intrusion detection and prevention technologies. Dr. Hancock is also a founding member and immediate past chairman of the Internet Security Alliance. Welcome to the subcommittee, sir. You are recognized for 5 minutes. Mr. Hancock. Thank you, Mr. Chairman, Mr. Clay, members of the subcommittee. I would like to start off by saying I'm probably the geek that you are going to have to deal with today, and a geek with nervous social skills. With that, I would like to do--we have heard from everyone today about how bad the identity theft problem is. I would like to do a couple things and point out a couple of little broader topics having to do with identity theft, and then also offer some ideas in terms of correction. One of the problems that we have with the basic concept of identity is, what is something? And that gets not even to the point of what is money. We often think very much about what happened on September 11. I had friends that were in one of the aircraft that hit the World Trade Center, I have acquaintances that were involved in the Pentagon, and I can tell you categorically that if we suffered a cyberattack against our financial resources of this Nation, it would cause trouble that you cannot possibly imagine. I will say that specifically for this reason: Money is an entry in a data base; it is not a pile of cash in a vault, it is not a bunch of collateral that is spread around evenly throughout different organizations. Anymore when you present a credit card or you go to an ATM machine, and you take that credit card in that ATM machine and you swipe the magnetic strip, everything in the middle assumes that is really who you say you are, and that the person who owns that card and the person that possesses that card is the person who is supposed to have that card. We know from past experience, and I am sure that other panelists will agree with this, that there are an enormous number of ways to go back and spoof credit cards, to create new credit cards, to go back over and create false magnetic strips and all kinds of other mechanisms. And those things are widely available on the Internet and almost anywhere you would like to go. Specifically, though, we have other types of attacks that happen because of identity theft because we continue to use protocols which are 30 years old. Specifically, when we sit down and consider the fact of things like denial of service attacks, which can be debilitating over a network, that can take out a complete Website, that can take out e-commerce, that can knock out a company completely from its network presence, what we find is that many times those attacks are caused by spoofing of source addresses or spoofing of destination addresses because we do not properly identify devices that join the network. If you are a device, and you get on the network and you send the right formatted message, something gives you a TCP/IP address, you are allowed to join the network, and you can go back and do whatever you want to do. In the cases of things like distributed denial of service attacks, there are literally networks of hundreds of thousands of zombies, and there is more and more being created every day. As a matter of fact, I read an estimate just yesterday morning that says that there is over 30,000 machines a day are being acquired and put into zombie networks. These particular networks can be used to go back and spoof source addresses because we do not adequately identify machines, identify technologies that join the networks, and then those source addresses can be used to go back and debilitate a company that is legitimately engaged in e-commerce all over the network. So as we go back and we examine identity management, I think one of the things that is very important to understand is that we not only have the problem that we all hear about consumer identity being stolen, that our consumer debt and consumer confidence is being eroded, but simultaneously we are also having the problem that networks themselves are being killed off from the simple fact that we have network technology that is being used that was never developed with security in mind. There are no controls in the TCP/IP protocol sweep whatsoever to go back and deal with the identity of a device that joins the network. There is nothing within the protocol that is used for Web sciences such as XML and HTML to properly authenticate and identify an individual or identify a particular program that may want to go back and access them back in. As a brief example, one of the more classic things that happens is when a front-end data base that is located on a Web surfer wishes to discuss something with a back-end data base that may be a legacy mainframe, what we find very often is that there is a singular identity that is exchanged between the two data bases. And if you look at every single data base transaction that happens, it comes from that same singular identity no matter who came in on the front end and no matter what you are asking for on the back end. And that is because of improper identity management at the program level. So, so far we have discussed the problems of identity management at the device level, at the program level. We know of the problems with the individuals. So, therefore, what kind of things do we need to do? One of the things we need to very seriously think about doing is a heavy lift of different protocols that are used in network communications. This is a very big deal because it allows us to properly identify devices and properly identify services, properly identify applications that are actually transacting over the networks. Eventually security should be invisible. It should be just like you walk in and you startup your car, you put a key in the ignition, and all kinds of magic happens. The fact that there is 28 processors under the hood and there is probably a network running around inside the car is totally irrelevant to you. And that is the way security should be over time. We can't do that until the protocols themselves have the controls and capabilities built into them. We need to start thinking about authentication implementation and audit capabilities at all companies. And, frankly, I am more concerned about companies involved in things like power grid management, water networks, food processing, food movement-type of networks, because all of these use the same protocols, all of these have exactly the same problem, yet the level of criticality of these particular networks and these particular types of infrastructures are more critical in terms of what we do. A good example is air-to-ground, ground-to-air uses a specific set of protocols that are bizarre and unique. Those are all being migrated right now to TCP/IP, which means very soon ground-to-air and air-to-ground communications protocols will be available to Internet connectivity. We will also find that there needs to be multiple methods of authentication, not just one. And the reason being is that if you compromise one, you don't want to compromise all of them. You need to take the time to establish the different types and different levels of authentication to have a defensive, in-depth type of profile. We need to think about incentives through industry to go back and help people realize that it is a good thing, a profitable thing to instill security, but also to go back over and deal with the identity management problem and to deal with the situation. We need to take an international approach to all of this, and this may even include modifications of trade agreements to ensure that ourselves, our trading partners and everyone are engaged in proper identity management when we start moving things around between different areas, because the Internet is truly without borders. And we also need to go back and think about leading from the front. Different companies, different organizations and everything are not incented, they are not told, they are not provided legislative requirements for CEOs to make the proper types of decisions. I deal with this all the time. I go out and I suggest to a customer, please improve your security. And they say, why? And the answer I give back to them as a typical rule is three things: Because of what I call a PAL technique of PR, assets, and the law. There is reasons to protect your brand, there are reasons to protect your assets, and there is laws that you must adhere to. That tends to be a good business case, but that is not the real reason why people should put in security. They should go back and install identity management because it is the right thing to do. With that, Mr. Chairman, that concludes my opening remarks. I would be happy to take some questions. Mr. Putnam. Thank you, Dr. Hancock. [The prepared statement of Mr. Hancock follows:] [GRAPHIC] [TIFF OMITTED] T8486.059 [GRAPHIC] [TIFF OMITTED] T8486.060 [GRAPHIC] [TIFF OMITTED] T8486.061 [GRAPHIC] [TIFF OMITTED] T8486.062 [GRAPHIC] [TIFF OMITTED] T8486.063 [GRAPHIC] [TIFF OMITTED] T8486.064 Mr. Putnam. Our next witness is Bill Conner. Mr. Conner is among the most experienced security and infrastructure executives worldwide, with a career that spans more than 20 years across numerous high-tech industries. Mr. Conner joined Entrust as its president and CEO in April 2001. In 2003, Mr. Conner received the corporate CEO award as part of the annual Tech Titans Award program. Most recently he has been a leader in the effort to elevate information security to a corporate governance issue and to fashion a public-private partnership to protect America's critical infrastructure. Welcome to the subcommittee, Mr. Conner. You are recognized for 5 minutes. Mr. Conner. Thank you, Mr. Chairman. Good afternoon. Chairman Putnam, Representative Clay, and members of the subcommittee. Thank you for the opportunity to provide testimony on this important subject. My name is Bill Conner. I am chairman, president, and CEO of Entrust. In my testimony today I will address the threat of identity theft and phishing. I will also examine what Congress can do about it. I want to be very clear in my message: Identity theft and phishing threaten not only to undermine the trust in business and the Internet, but also to disrupt our national economy. We need to protect all Internet users, not just the upper tier. Identity theft and phishing do not discriminate between the haves and have-nots, and corporate programs aimed at protecting only the most valued customers won't solved the problem. These are not isolated threats, but part of a broader cybersecurity challenge. I would like to first address why identity theft and phishing are serious problems. Just as the Internet has supercharged commercial transactions, it has also supercharged cybercrime. When the Internet was used mainly to communicate and access information, the lack of security didn't much matter. Now that it is used for on-line transactions and critical information, the absence of security is truly a big problem. It is as if consumers and businesses that rely on the Internet have wandered into a dangerous neighborhood of cheats, pickpockets and thieves and don't even know it. The fact that 9 percent of U.S. on-line consumers have experienced identity theft and that phishing attacks are now growing at 50 percent per month show that the little yellow locks on your desktop that are supposed to maintain law and order on the Internet are inadequate. The obvious question is why? Why has the market been so slow to respond? As a result of my role at Entrust and my experience as cochair of two major task forces on information security, I have become convinced that the only way for enterprises to address cybersecurity is to make it an executive management priority with board oversight. This is not the case today. There are several reasons for the lack of progress. One, companies don't know what to do. Many companies don't understand the scope or the threat and how to respond. As a result, they pretend the problem doesn't exist, and, if it does, it won't hurt them. Second, it is not a corporate priority. Even if they understand it, many firms refuse to make it an executive priority. They continue to treat cybersecurity as a technical issue and one that can be delegated and relegated to the CIO. Government regulations are unclear. A raft of legislation has been passed in recent years including GLB, HIPAA, California's Senate bill 1386, and most recently section 404 Sarbanes-Oxley. Until there is better understanding of what it takes to comply and the penalties for the failure to do so, progress will be slow. And, fourth, technology vendors aren't doing enough. Vendors share in this blame. We have been criticized for overhyping solutions, failing to correct and connect products to business needs, ignoring ways to measure the return on investment, and producing poor-quality products that constantly require patching. That is why I urge you to consider the road to information security lies through corporate governance. If the government and private sector are to secure their information assets, they must make cybersecurity an integral part of internal control and policies. Like quality, cybersecurity is a journey of continuous improvement, not a one-time event. The No. 1 priority for Congress should be to create a bright light between acceptable and unacceptable behavior. As long as the line is fuzzy, the market will be caught in the cybersecurity paradox. Everyone knows there is a problem, but in the absence of clear solutions or penalties, they are waiting for someone else to take the lead. I would offer the following recommendations for your consideration: One, Congress should demand that Federal agencies purchase and deploy cybersecurity technologies. Mr. Chairman, as part of your oversight of FISMA, I would urge you to initiate a dialog about how to drive deployment of security technology that Federal agents have purchased but left sitting on the shelf. Two, Congress should stipulate that cybersecurity measures are an explicit part of Sarbanes-Oxley section 404. By stating that section 404 Sarbanes-Oxley applies to cybersecurity controls, Congress could encourage publicly traded companies like mine to make information security governance a corporate policy and priority. Third, the Federal Government should lead by example. Congress should discourage Federal agencies from purchasing products from companies with inadequate cybersecurity, as well as create incentives for those that implement formations of cybersecurity governance programs. An example of such a program can be found in the report, ``Information Security Governance: A Call to Action,'' that was released by the National Cybersecurity Partnership Task Force on Corporate Governance in April of this year. Mr. Chairman, the cybersecurity threat is real and holds potential to incapacitate the Internet and our economy. The private sector has been much too slow to respond to this challenge. I would urge you and your colleagues in Congress to spur a rapid and constructive market response. Mr. Chairman, I would personally like to thank you for your leadership and your staff's in taking the lead and the initiative here in this area. Mr. Putnam. Thank you very much, Mr. Conner. [The prepared statement of Mr. Conner follows:] [GRAPHIC] [TIFF OMITTED] T8486.065 [GRAPHIC] [TIFF OMITTED] T8486.066 [GRAPHIC] [TIFF OMITTED] T8486.067 [GRAPHIC] [TIFF OMITTED] T8486.068 [GRAPHIC] [TIFF OMITTED] T8486.069 [GRAPHIC] [TIFF OMITTED] T8486.070 [GRAPHIC] [TIFF OMITTED] T8486.071 [GRAPHIC] [TIFF OMITTED] T8486.072 [GRAPHIC] [TIFF OMITTED] T8486.073 [GRAPHIC] [TIFF OMITTED] T8486.074 [GRAPHIC] [TIFF OMITTED] T8486.075 [GRAPHIC] [TIFF OMITTED] T8486.076 [GRAPHIC] [TIFF OMITTED] T8486.077 [GRAPHIC] [TIFF OMITTED] T8486.078 Mr. Putnam. Our next witness is Jody Westby. Ms. Westby recently joined PricewaterhouseCoopers as a managing director. Prior to joining PricewaterhouseCoopers, Ms. Westby held several positions in the IT field including serving as president of her own company, launching an IT solutions company for the CIA, and managing the domestic policy department for the U.S. Chamber of Commerce. She is the chair of the American Bar Association's Privacy and Computer Crime Committee, and was Chair, coauthor and editor of its International Guides to Cybersecurity, to Privacy, and to Combating Cybercrime. Welcome to the subcommittee. You are recognized for 5 minutes. Ms. Westby. Thank you, Mr. Chairman, Mr. Clay. I appreciate the opportunity to be here this afternoon. I would like to clarify at the outset that my remarks, my testimony, is in my individual capacity and is based on my own background and experience. It does not necessarily reflect the views of the American Bar Association or PricewaterhouseCoopers. I applaud your attention to this critical issue. The security breaches that allow access, unauthorized access, to personally identifiable information go beyond unauthorized credit card charges, although that is in and of itself a grave issue. This data also feeds terrorist organizations, organized crime, and other bad actors that can use this information to exploit us for their own good, and to launch asymmetrical attacks against us. Because 85 percent of our information infrastructure in this country is owned by the private sector, the only way we can control these risks and protect our national and economic security is to protect the critical infrastructure of the companies. Herein lies the problem. Technical solutions alone will not secure our networks. Time and again over the past decade, hardware and software has held hope that we could turn the tide. But the truth is the bad guys are winning. The root of the problem is that there is a lack of oversight and governance of enterprise security programs by senior management and boards. Quite simply, we must change the paradigm for information security. Part of the problem is perception. Most people think of information security as a technical issue. It is really a multifaceted issue that requires a multidisciplinary approach. It is multifaceted because it involves privacy and security and cybercrime. It is multidisciplinary because it requires you to dovetail the legal, operational, managerial, and technical considerations of all three of those issues piled in with the business plan that sets the architecture of a company. It is a complicated process. I believe the main reason privacy has taken off is because people perceived privacy--CEOs and boards--readily at the beginning as a policy issue. They readily appointed a chief privacy officer, they put out policy statements, and privacy was accepted as a corporate governance issue. Security, on the other hand, is still perceived as a geek issue. CEO and boards are afraid of becoming geeks. The primary reason senior management and boards don't want to take on these issues is because they don't know how to approach it from a governance perspective. They think they have technical people to take care of the computers, so why should they worry about it; they hired them; that is their responsibility. That is the wrong conclusion. Information and communication technology comprises one of the largest line items in corporate budgets. Officers and directors have a responsibility to exercise oversight over this equipment for the very reason that the viability and profitability of their corporation is dependent on it. Also, 80 percent of corporate assets today are digital. It is clear that directors and officers have a fiduciary duty of care to protect business assets. There also remains a high incidence of insider attacks, yet these are the very people who are under the direct control of boards and senior management. Companies also have a patchwork of laws and regulations they must comply with in the area of privacy and security, and compliance has always been viewed as a governance issue. Studies have shown that cyberattacks can impact market share and share price, two key areas of responsibility for officers and directors. A Delaware derivative shareholder case, Caremark, in 1996 was brought to the attention of the information security world because it emphasized that boards have to ensure that their corporate information reporting systems are, in concept and design, adequate. And the last reason why officers and directors need to pay attention to this is because cyberattacks are so common today. They are in the daily news. Leaving networks unsecured is the equivalent of leaving the R&D lab door unlocked. There are other consequences also that require consideration, one which was brought up by my colleague today about the inability to track and trace cyber incidents. Cyber incidents frequently pass through many countries, and we involve international cooperation of law enforcement, we have dual criminality issues, we have extradition issues. But terrorists and organized crime are exploiting this inability to track and trace cyber incidents, and they are using that as a way then to obtain this information and use it for trafficking of drugs, money laundering, and purchasing weapons and supplies. Corporations and data banks are their soft targets, and this puts us all at risk. Quite simply, corporations have to begin viewing security as an enterprise issue that is also a governance issue. Prevention of attacks is the best problem, and Congress can help them do that by providing tax credits to corporations that implement enterprise security programs. Such credits could encompass risk assessments, implementing best practices and standards, establishing internal controls, integrating security, and of capital planning and training. Another initiative could provide some funding grants to help advance models for effectively measuring return on investment for information security programs, and other tools that would help boards and senior management through the decisionmaking progress. Last, I want to stress that this is not just a U.S. problem, it is a global problem. The global security of the Internet has never been more important. We are close to a saturation point among the English-speaking populations in the world. Connectivity in the future will be in Asia-Pacific, Europe, and Latin America, in that order. In a globally connected network, we are only as secure as our neighbors, and we must help them if we are to help ourselves. We have to help them draft privacy, security, and cybercrime laws that are consistent with FISMA and the global framework; to help them understand the nexus between privacy, security, and cybercrime, and how to build enterprise security programs using the best practices and standards; and, as our earlier panel said, to train law enforcement and judges and prosecutors. The good news is this all repeatable. In the past several years I have done a lot of work in developing countries. Road shows with consistent materials trotted around the globe would be very effective. I am sorry, Mr. Bordes, do you have the three books that I brought up here? Could you please share those with Congressmen Clay and Putnam? These books are available. The American Bar Association's Privacy and Computer Crime has put its money where its mouth is. These books are free to people in developing countries. That is 180 countries around the world, they are free to them, and they set out all the issues of privacy, security, and cybercrime, and how to develop an enterprise security program. Our books would significantly improve our own security and advance world peace if we were able to get them into audiences as workshops and textbook materials. Thank you very much for your interest, and I await your questions. Mr. Putnam. Thank you very much. [The prepared statement of Ms. Westby follows:] [GRAPHIC] [TIFF OMITTED] T8486.079 [GRAPHIC] [TIFF OMITTED] T8486.080 [GRAPHIC] [TIFF OMITTED] T8486.081 [GRAPHIC] [TIFF OMITTED] T8486.082 [GRAPHIC] [TIFF OMITTED] T8486.083 [GRAPHIC] [TIFF OMITTED] T8486.084 [GRAPHIC] [TIFF OMITTED] T8486.085 [GRAPHIC] [TIFF OMITTED] T8486.086 [GRAPHIC] [TIFF OMITTED] T8486.087 [GRAPHIC] [TIFF OMITTED] T8486.088 [GRAPHIC] [TIFF OMITTED] T8486.089 [GRAPHIC] [TIFF OMITTED] T8486.090 [GRAPHIC] [TIFF OMITTED] T8486.091 [GRAPHIC] [TIFF OMITTED] T8486.092 [GRAPHIC] [TIFF OMITTED] T8486.093 [GRAPHIC] [TIFF OMITTED] T8486.094 Mr. Putnam. Mr. Schmidt and Mr. Conner, through your extensive work on information security issues, what conclusions have you drawn about why corporate America is not taking the problem with information security seriously enough? Mr. Schmidt. Well, I am not sure that I totally agree that it is not being taken seriously. I think, as has been pointed out more than once, there is a greater recognition now more so than ever before of the tremendous importance that cybersecurity is, but it is very complex. It is not as if we designed a system to eventually become secure. Many corporations that I see literally around the world have built systems that they put a system in place, and then they add another piece on top of it, so it has been very difficult. What happens in the past couple years, now we recognize obviously the critical infrastructure protection piece and the governance pieces, as Mr. Conners related to, where we have seen a lot more intended dollars and efforts put into the cybersecurity. But it is a complex issue, and is not something you can just flip a switch and turn it over. It will take a couple years by the time we get operating systems and engineering design and quality processes in place to make it be able to respond and say, yes, we have much better security now than we have in the past. Mr. Putnam. Mr. Conner. Mr. Conner. Simply, they are not taking the time. And if you take the time, the question is where you start. That is why we spent considerable amount of time on a framework, because I personally believe, as many companies do, you need a framework to systemically assess your business for where the high risk is and how do you get a baseline to measure it. Once you have that, then you can apply it. It is a very simple process to get started, but if you don't know where to start, all your journeys will take you somewhere, but maybe not where you want to go, and you won't get a return on investment, and you won't be more secure. I think that starts with the senior management executives and board saying, we are going to take a framework that exists now, it is public, it has been there for 6 months, and get started. And that means you can't delegate it to a CIO; you have to assess your own business needs and risks. And that is something in today's environment; many corporations do it, and many more don't do it. And I can assure you, in the ones I talk to, all of them are concerned about the liability of that assessment. It is a litigious society, and in this environment with class actions and others, that evidently comes through every discussion. Mr. Putnam. Dr. Hancock, do you wish to add anything to that? Mr. Hancock. I have two perspectives on it, sir. One is I deal with the same folks that Mr. Schmidt and Mr. Conner deal with in many respects because a lot of us all have the same kind of customers. It has been my experience that most board of directors-level folks have a very limited knowledge of security, and a lot of that is because security is not personal to them. They don't understand even the basics. And I will give an example, sir. My son is 15 years old. When he was 7 years old, someone tried to kidnap him. Because I am a security person and by definition paranoid, when he started--at 4 years old I started him in Taikwando. When the person grabbed my son, my son dislocated his kneecap and four of his knuckles. As a result of that, I believe that assets should be self-defensible, and includes my family, includes my children, includes my home, whatever the case may be. Most people don't look at security that way. To them, security is managed and dealt with by someone else, and, just like Mr. Conner said, a lot of times delegated to the CIO. Many times the CIO has no capabilities or understanding of what the security issues are. It is chopped out of the budget. It is considered to be something that is more of an irritant than something that needs to be done. So it's not part of the corporate agenda overall. The second problem runs in, just from a pure technology perspective. Very few people in the business really understand how to secure things correctly. One of the problems we have is we continue to deploy technologies that are not secure in nature, and then we go back and try to provide technology to secure that. As a case in point in my own company, I operate well over 50,000 routers. Of those 50,000 routers, I have over 11,000 firewalls. I know categorically that those firewalls cannot protect my network or my customers from everything that will come by, because the oppositions are far more creative and have a lot more time than my security people do. As a result of that, we are in a constant challenge from a pure security perspective. How do you stop things from happening when the technology doesn't exist for us to identify who is launching an attack or identify a way for us to go back and trace it back to figure out where it is coming from, just the very basics? So you have a secondary problem that if the board of directors did come down tomorrow and they did embrace security and said, yes, really want to do this, the sad reality is much of the technology that is required to stop a lot of this nonsense from happening just flat doesn't exist, and it will take time for that technology to be put into place since it is going to take research to make happen. Mr. Putnam. Thank you. My time has expired. I will call on Mr. Clay. Mr. Clay. Thank you. Ms. Westby. I will start with Ms. Westby. First of all, thank you for your publication, and can you tell me what lessons can be learned from the private sector's efforts to comply with the internal control requirements of the Sarbanes-Oxley legislation by the Federal agency community? Are there similarities between the public and private sectors in terms of securing networks containing vast amounts of individual data? Ms. Westby. Actually, I think that the private sector in this instance learns more from the government. Information security is very different from the days when Al Gore was reinventing the government and the government was looking to the private sector for best practices. Our government is clearly the world leader in information security practices, and NIST has done world-class work. Their guidance and controls in metrics is excellent, and they, the enterprise security program mandated by FISMA and the NIST guidance that corresponds with that, offer an excellent example. It is unfortunate that the word ``security'' is not mentioned anywhere in Sarbanes-Oxley, and there is a lot of traffic on my listserves about what does that really mean, what do the internal control requirements really encompass and how far does that go into checking integrity of financial data, how far does that goes into systems. Mr. Clay. Thank you for that response. Mr. Schmidt, as a former White House Cyber Security Adviser, would you agree that the Federal procurement process would be an ideal mechanism to improve the security of products and services delivered by vendors to the agency community? Wouldn't this have a profound effect on the development of more secure and uniform products for both the agency and critical infrastructure and communities? Mr. Schmidt. Yes, sir, I sure do. As a matter of fact, I talked from time to time about discussions we have had with vendors that supply service to the government and CIO, CSOs for the government, and it was amazing the disconnect that I have seen many times where, say, listen, we would like to actually pay extra money to get security services, but nobody is willing to provide it. And then you go to the vendor, vendor says nobody is willing to pay the extra money for it. So clearly the procurement arm of government can do much to, you know, set requirements, instead of, you know, accepting things the way they are, establish the requirements that one would have, and then that will have that trickle down effect to the rest of society, because if we are buying more secure routers and more secure operating systems for the government private sector is clearly going to jump on that bandwagon as well. So it's a vehicle I think can take us a long way in a short period of time. Mr. Clay. Let me ask you, according to Mr. O'Carroll, from our first panel, the SSA's Office of Inspector General had recently discovered a plan by one individual to sell up to 10,000 Social Security numbers and matching names on your company's Web site. Can you outline for us the methods and controls utilized by your company to identify and prevent such illicit activity? Mr. Schmidt. Yes, we do. We have an entire group, literally hundreds of people worldwide, that look at listings that occur for everything from counterfeit currency to, you know, war materiel, weapons, things of that nature, and we have not only physical reviews of data but also automated reviews. Various trigger mechanisms will actually flag something for the customer service people to dig down further into it. The challenge we run into from time to time is that people get very, very creative about how they title certain things. So they may not cite it saying, well, I am going to sell Social Security numbers but they are going to say identification cards, which may not trigger something. So we are constantly evolving and changing to make sure we that we adapt to the things that we see out there as new threats occur. Mr. Clay. Thank you for that response. Mr. Chairman, I yield back my time. I have no further questions. Mr. Putnam. Mr. Clay, thank you. Ms. Westby, from your testimony, and you have heard the answers that the other panelists have given about this issue, the issue of ignoring information security risks and the liability that it avoids or causes, in your experience in the field of information technology law, do you see the attitude of being proactive about information security taking hold? Ms. Westby. Yes. The market has matured. The awareness has increased, and I believe that especially in the environment we have today, with heightened emphasis on corporate governance, that senior management and boards are taking a look at what exactly is within their realm of responsibility, and they, at least many of the major companies who are assisting with Sarbanes-Oxley, are saying we have to look at how you are handling the data in the computer system. I think overall, though, our efforts have been in vain. Over the last 6 years there have been enormous efforts made by the Federal Government, by different organizations, to engage businesses through, as an enterprise, horizontally and vertically across an organization. I do think that has matured and that we are seeing progress. Mr. Putnam. Thank you. Mr. Schmidt and Dr. Hancock, in your lines of business, clearly spam and denial of service attacks are of great concern. A recent Symantec report suggests that for the first half of this year it saw a huge increase in zombie PCs. The company said it was monitoring 30,000 per day. You made reference to that, Dr. Hancock, with a peak of 75,000. Some estimates state that it is possible that as many as half of the machines on the Internet are in an infected state. How big of a threat is this bot issue or zombie issue to national or economic security? Mr. Schmidt. Well, I couldn't agree more. We have seen instances, in working with the law enforcement folks, those exact numbers--we have actually been able to identify from cable modem and home DSL users. So it's significant, because if you look through the cascade of litanies and ills that can result as a result of that, one clearly the hacking portion into the critical infrastructure, the identity theft, the denial of service attack capability. If you remember back, February 2000, when we had the big denial of service attack that people talked about all the time, that was done at a rate of about 800 megabytes per second, which is a relatively insignificant amount of data now. Now, with 20,000 systems that have been compromised, you can do 3 gigabytes, you know, almost three times as much worth of damage. So when you look at the overall aspect of it, you look at the identity theft, you look at the lack of trust that we have in the environment, if 87 percent of that 840 million users I referenced to earlier, are doing e-mail, less than 17 percent are doing e-commerce, economically that's just as bad. We should be able to go ahead and improve that. The way we can go ahead and do that is by making sure that we have the defense in depth where, No. 1, the spams and cams aren't getting in the inbox for the most part. If they do get there, some sort of firewall or browser protection or some sort of file validation keeps you from doing something ill from there; and then last of course making sure that we are getting a law enforcement prosecution of these things. The challenge I have with the law enforcement side, which is directly related to this, is this is a crime in progress. This is no different than somebody walking into a liquor store and sticking up somebody with a gun, except you are not there physically. It has to be dealt with on a real-time basis. Mr. Putnam. Dr. Hancock. Mr. Hancock. I will have to agree with Mr. Schmidt on all of that. I will also add that one of the problems we have with zombie networks is that many times that we found over the last few years--is that those zombie networks are now being operated by organized crime in some cases. As a matter of fact, there was one I was recently involved with--a direct investigation on--that was a gaming site, where the gaming site was held up for extortion because of a denial of service attack launched against it by a series of Russian organized crime. We know that. We tracked it back. We worked with the Russian law enforcement agencies. The fact of the matter was we pinned it down and nailed the guy. But the situation is that it took months to happen. This sort of thing is happening more and more. We are seeing a whole lot more happening where e-commerce is the reason for the site to exist. And we are seeing more and more of this happen where corporations are depending more on their network infrastructure and then they are being held up for extortion or being held up for some sort of, if you will, ransom because of their technology being disabled through things like denial-of-service attacks and things like zombie nets being used. I will also agree with Mr. Schmidt--what he just said-- about the severity of these types of attacks. We recently saw a denial-of-service attack execute a 3.2 gigabytes. I had not seen one like that before. We operate a very large network infrastructure. We have a lot of customers out there that are some of the places that you would normally frequent on the Web. When that one hit we disabled that one within 6 minutes. But what was more important about it was within 5 minutes after that the attacker completely redirected and attacked a completely different addressing block. I have never seen something like that happen. That means you can take 10,000 to 20,000 zombies, literally have them turn on a dime, and then reconnect and reattack a completely different site. That basically shows technical sophistication on the part of the attackers. It also shows that the zombie sophistication is increasing, which means that these products can be directed, redirected very, very quickly, and be pointed with a very debilitating attack against a very large network pipe. As a result of that, over time we are going to see more of that happen, where the zombie networks where we have 5,000, 6,000 zombies all of a sudden become 100,000. And now the types of attacks that can kill things like power networks, water networks, those start to become very serious reality, where a whole power grid is disabled simultaneously. So I believe that the zombie threat is a very severe one. I think it's going to get a lot worse, just like any other software. There are new versions of it coming out all the time and the zombies are being upgraded with additional capabilities. All of these things put together are going to cause very serious problems to our e-commerce capabilities. Mr. Putnam. Who has the sophistication and technical capacity to do what you just described? Mr. Hancock. If you asked me that question 10 years ago, I would have to say it would be a hard core, stone geek to do it. The fact is any more it takes very little sophistication. The attack Mr. Schmidt talked about in February 2000 was my first day of employment at the company that was acquired--and then acquired where I am now. I had been with the company exactly 2 minutes when Amazon.com, CNN.com and a few other sites went splat. The realty of that was we found out later in the day those attacks were executed by a 16-year-old out of Toronto, Canada who went by the handle called Mafia Boy. We were involved with the FBI and with the Secret Service and quite a few other agencies to track this individual down. We are capable of tracking these people down fairly quickly. Trying to get them apprehended and dealt with is a different story. That took weeks. So the end result was you had a child here who downloaded an ``exploit'' from a Web site. This individual had no sophistication whatsoever in understanding that exploit or in writing that tool. However, sophisticated people are all over the Web. Those sophisticated people will find the vulnerability. They will write the exploit. They will post it on a Web site. They themselves do not execute that particular attack. Instead, other people--which we call script kiddies, 13 to 18-year-old types--will download and execute debilitating attacks. This is very, very common and compromises approximately 80 percent of the attacks we see. My infrastructure gets attacked anywhere from 200 to 400 times a day. As a result of that, we see a lot of this stuff. We deal with a lot of that stuff. Most of the time it is pretty straightforward to deal with it. What I am concerned about is the people who are serious, doing it for profit motives. Those people will employ programmers--they will employ people with specific skill sets-- and those people with specific skill sets will create these tools for a specific nation reason. There may be a nation state that wishes to cause harm to us by debilitating capabilities or somebody just as simple as a Russian mob trying to go back and extort money from a company that executes business over the Web. Mr. Putnam. What responsibilities does the hardware and software community have in all of this? How much does the constant influx of new patches for vulnerabilities in their products contribute to the problem of cyber crime? Mr. Hancock. Well, sir, I will give you an example, a very popular desktop operating system that's floating around, used to have a version called Version 3 that comprised 3 million lines of code. The current version, which was very popular on most PCs, comes out with over 45 million lines of code. The next version coming out next year is going to be b almost 50 million lines of code. When you have something that large, trying to secure that, no matter how conscientious you are, is virtually impossible. And so the result is as our versions get more and more sophisticated, as they get more and more and more complex and we layer complexities on top of that operating system--for example, a very popular data base out there has almost 1 billion codes in it. When you take an operating system that has 45 billion lines of code, a data base with 1 billion lines of code, you then put on top of that object-oriented programming, which is done by the programmer so that you can communicate to the data base, so you can do something useful with it, you can end up very quickly with a couple of billion lines of code on a server sitting in a data center someplace. Trying to secure that is not trivial. Trying to go back and instill programming discipline to make that secure is not trivial. All of these things require a great deal of education on the part of programmers. They also require standards. They also require other types of methodologies that say this is a good way to write code or a bad way to write code. The problem that we have is that we have gone and put all these types of technology in for many years without any discipline in the areas of security, all from the way our program is written to the way that we deploy technology to the way we manage it on a day-by-day basis. And just like when Mr. Conner said and Ms. Westby said and Mr. Schmidt have said--a lot of it has to do with corporate governance. There has not been an insistence by the corporate echelon to require vendors to instill security in their technology, to put security in, code, to put security in even simple things like routers. My most basic concern is that I work very closely with all the chief security officers of the telcos through the FCC. We offer something there called Focus Group 2B, which puts forth cyber security best practices. There are 54 people involved with that. We own about 90 percent of the actual infrastructure that everybody uses. We got together last December and told the FCC categorically, and through public documentation, that one of the biggest problems we have is we are keeping to deploying technology which is woefully inadequate, and we keep deploying more. So to give you part of an example of a zombie problem, one of my base concerns that keeps me awake right now is third generation cell phones, and that is because most cell phones coming out of the cell phone manufacturers operate an operating system which is a derivative of Linux. That operating system can have viruses. That operating system can be used as a zombie. Under third generation cell phones they will all have a TCP-IP address. This means that every single handset can become a zombie and part of an attack vector, which means the current population of approximately 850 million Internet nodes will grow very quickly to 3 billion Internet nodes, all of which can be attacked and put through worm automation technology, a zombie parked on every handset out there. In addition, those handsets will be used for everything from e-commerce to charge services, to go back over and even get a soda out of a soda machine, because they are all being done that way in Europe right now. All those areas basically mean that the software development, the hardware development, has to instill security discipline, which is not there. In addition to that, we will continue to deploy these technologies, and these technologies have serious flaws in them. That is not being corrected. Mr. Putnam. That's uplifting. Mr. Schmidt, you made reference to the fact that simply using passwords is just not adequate any more and that the Nation should move to a two-factor authentication by the end of next year. Yesterday a major ISP announced that it would make major authentication available to its customers. Do you see this as being a positive development, and do you see that being the beginning of even more offerings of and a greater commitment to secure communications? Mr. Schmidt. Yes. As a matter of fact, it's a tremendous step forward. We have been working for about the past 7 months. We, meaning a group of security experts, have been working with that company, other companies, Mr. Conner's company, others, looking for solutions that we can do on a real-time basis to provide that extra two-factor authentication for the customer and end user space. I cite my DOD side of life as a computer crime investigator. I now have a spy card I can use on my computer government system that I can log into my DOD account with full encryption, full authentication, and to really know it's me. We need to move that way in a security space for the consumers. It's probably going to be a slow process. There's going to be some shaking up of who is going to be the coalition and who is doing this. I think we have clearly reached a point in society with the phishing e-mails, the identity theft, the hacking, that society is ready to move to the ATM card of online world, if you will. Mr. Putnam. Mr. Conner, do you see other companies following AOL's lead? Mr. Conner. Yes. The only comment I made, and Howard and I talk about, it's a necessary step but it's a baby step. Most of these are cost prohibitive for the masses, and this is not an issue that can be dealt with on the haves and have-nots. That is going to require innovation and deployment around identity and how do you deal with identity for every citizen or customer of eBay or someone else. And the current technology, that becomes quite cumbersome to do in terms of ease of use and economics. I would also offer it's only half the issue. Authentication or identity is one-half. It's the information they are reaching for that is the other half, and the second factor of any authentication scheme only deals with who is allowed in or not. That leaves the information itself still unprotected. I just offer, you know, earlier, in the earlier panel, the question on SB 1386 came up. I share with you, that's probably been one of the more successful legislations in terms of focus because it drove focus on information and how do you protect information. It is a given people are going to get in. The question is, what access to what information do they have when they get in? If all you are doing is playing defense on the perimeter and trying to keep people out, you are never going to win. You have to offensively protect and encrypt the information on the inside. And the threat in California of class action suit. Every corporate executive understands that, especially in California. So I just offer that identity theft, you can't be stuck on just the identity authentication, it is the information that must ultimately be protected. And anything that I have seen that's been announced up to this point, even yesterday with the ISP, only deals with half the equation. Mr. Putnam. Well, I would like to give this panel the same opportunity that the first panel had, and we will begin with you, Ms. Westby, of giving any closing remarks that you think are important for the subcommittee to have on the record, answering any question you wish you had been asked or giving us any other thoughts. Ms. Westby. Well, I would just leave you with the thought that there are some black holes that need to be addressed beyond technology gaps. One is in the legal framework. There is absolutely no legal framework or rules of law for how nation states will respond to cyber attacks. There is no capability for allied countries to work together to have some sort of allied response. In defense circles cyber defense is not a category. A defense category is still land, sea and air, and we see cyber as footnotes in presentations. It is also not an integrated response capability. And we have to think beyond, when we are looking at terrorist attacks and information warfare and the potential attacks from other countries, we have to look beyond our legal framework and think about how we can respond in a situation that would involve nation state activity or require coordinated action by other nation states. Mr. Putnam. Thank you. Mr. Conner. Mr. Conner. Mr. Chairman, I want to thank you for your diligence, support of these issues, and your forceful viewing of the hearing on these issues. I would just ask that the task force report on framework--I think this specific subcommittee that did such good work on GISRA and FISMA and putting the report cards out needs to go to the framework of assessment that we are asking private industry to do. I think part of the problem with the report card piece is it's a different model than what private industries are doing. So there's a gap between the two, and I think you would find you would make much more progress on a benchmark and measurements by using the [ISO] 17/7/99 standard that we consulted with FISMA on to hold the departments and agencies accountable and give them a reference for it, for the private industries they deal with, whether it's DOE with utilities or whether it's Commerce with banks or Treasury with banks. So I would just offer that as a final comment. Mr. Putnam. Thank you, Dr. Hancock. Mr. Hancock. Mr. Chairman, thank you very much for today and also for your continued leadership in the area of cyber security. One of the things that I think are important to realize with all of this is that we have a problem with corporate governance. I think that's pretty much a given. I think the secondary problem that we have also at the same time is that we have to realize that as we continue to deploy technology we continue to make the networks larger and more complex, and with complexity comes the difficulty of trying to secure it. And we are going to find in a very short amount of time that the size of the Internet will double or triple, and the reason we will do that is because of handsets and because of PDAs and because of other types of portable devices that will become enabled or Internet capable. We will also simultaneously find the technology that is invisible to us now, such as a refrigerator, will become an important machine on the network. We know that some vendors are working right now with appliance manufacturers to go back and provide an Internet connectivity with different types of appliances. So someone could turn your refrigerator off from a remote location if they desired or hack it. The result is that I think what we see is extortive attempts by people now will change. I think that what we will see is identity theft will change, where you will steal an entire city block's worth of IP addresses and sell them off to someone else. I think we are going to see the whole framework of what is an identity theft and what kind of crime could be committed with that change quite radically over the next couple of years. So I think there is a serious sense of urgency in terms of how do you deal with the identity of both individuals, applications and technology devices, so that we can probably go back over--not just trace these back, but secure them and put them in the proper technologies to make that happen. Mr. Putnam. And, Mr. Schmidt. Mr. Schmidt. Mr. Chairman, I also would like to thank you once again, not only for your leadership, continued leadership in this area, but also for Bob Dix, who as I jokingly told a friend of mine one time as I was driving out of D.C. after I retired, looking back in a rear window, at least Bob is there to keep this fight going. I thank you for that. Just a couple of quick comments, one relative to the private sector and the government now. We have seen over the past few years the changing of the guard, if you would, when it comes to cyber security within corporations. Executives such as, you know, Mr. Hancock and myself are now outside of the IT organization. We have a special focus on cyber security, no longer just an IT function, which I think is very important, because it is more than just the technology. Looking at the government side, I think there probably should be some good reviews on how the government functions in that regard. How closely, you know, are we still putting security folks in the IT organization, working for CIOs and somewhat handicap them in somewhat former fashions. The other portion of it--and both the Secret Service and FBI--we talked about information sharing. I constantly get calls from people because of my law enforcement. background asking me, well, who do I call in the city? Do I call the Secret Service, do I call the FBI? Is it the Electronic Crimes Task Force, the Cyber Crimes Squad? And the answer is not whoever gives you the best service. There should be a much more formal form of consolidation. If we have a cyber crime squad with the FBI, an electronic crimes in the same city, they should be part of a joint task force. And that would help solve a lot of the sharing information issue, plus a lot of the confusion in the private sector on who to call. And last, as I mentioned, I thank you for asking me that question about the two-factor authentication. We are poised within the government to do something about the stronger authentication piece, OMB's office. I think we can look at that from a two-factor perspective, provide some perspective not only for government employees, but also for the private sector as well, be able to do your health care, you know a litany of things that could be done that could make two-factor authentication the normal way of doing business as opposed to what we have seen up to now. But thank you once again. Mr. Putnam. Thank you. I want to thank all of our witnesses for their participation today. Your testimony is further evidence that it is so important for us to take immediate steps to improve our cyber security throughout the Nation. In the event there may be additional questions we did not have time for today, the record will remain open for 2 weeks for submitted questions and answers. We thank you all for your hard work and look forward to continued progress for the remainder of this year and in the next Congress. The subcommittee stands adjourned. [Whereupon, at 4:15 p.m., the subcommittee was adjourned.] <all>