FROM THE OFFICE OF PUBLIC AFFAIRS
October 20, 2003
JS-917
Testimony of
Wayne A. Abernathy
Assistant Secretary for Financial Institutions
Department of the Treasury
before the
Subcommittee on Oversight and Investigations
Committee on Financial Services
Good afternoon Chairwoman Kelly, Ranking Member Gutierrez, and members of the subcommittee. Thank you for this opportunity to testify today about the resiliency of the U.S. financial system. I am here today representing not only the Treasury Department, but also the Financial and Banking Information Infrastructure Committee (FBIIC), which is chartered under the President's Working Group on Financial Markets. The FBIIC is charged with improving coordination and communication among financial regulators, enhancing the resilience of the financial sector, and promoting communication and coordination with the private sector entities that make up and operate within our financial services sector. I represent the Department of the Treasury in chairing the committee. I want to thank all of the members of the FBIIC for their dedication and excellence in executing the mission set forth in our charter.
An old proverb suggests that experience is not always the kindest of teachers, but it surely is the best. Following significant threats to the financial infrastructure, the FBIIC makes it a practice to review what has happened, what went well, what did not, what can we learn, and what do we need to do. The FBIIC conducted such a review following recent events and compiled a written report, the "Impact of the Recent Power Blackout and Hurricane Isabel on the Financial Sector," which the FBIIC is releasing to the public today. I have submitted a copy of the report together with my remarks.
The U.S. financial system is remarkably resilient, as reaffirmed by such recent events as the Northeast power outage of August 14 and 15, Hurricane Isabel, and increasingly severe cyber-attacks. This resilience comes from many sources. One of them is vigilance. We have to continue to work to improve the resilience of the critical financial infrastructure of the United States and the other critical infrastructures with which it is connected, such as the energy, telecommunications, and transportation infrastructures.
I would emphasize that our approach has been to begin and end by relying on the private sector. A central insight of the President's strategy to secure our critical infrastructure is that the infrastructure in this country is largely owned by private businesses. This is certainly true in the finance and banking sector. Accordingly, we pursue virtually all of our objectives in close collaboration with the private sector. I am especially pleased, therefore, that you have invited several important leaders of the private sector to this hearing to testify.
Both in preparation for potential disruptions to the financial infrastructure and in responding to actual threats, we are guided by four principles, in order of importance.
First, and most important, we must remember in all that we do to protect our financial infrastructure, that it is always about people. It is the people that make our financial institutions work, people that designed the systems, people that make them successful, people that innovate to keep them fresh and dynamic, and it is people whom they are designed to serve, people who rely upon financial services for so many aspects of their daily lives.
Second, because it is about people, it is about confidence. Our financial institutions operate on confidence, but they also promote confidence. In fact, confidence is what our financial institutions must provide, confidence that financial transactions will be carried out, that checks will clear, that bills will be paid, that investments will be made, that insurance promises will be kept. The confidence provided by financial institutions and their services play a big part in helping to cope with the trauma of disaster.
Third, essential to that confidence is open markets, financial institutions open for business, doing their business, allowing Americans everywhere to engage in their business, even during--especially during--times of stress. It is important for financial institutions and markets to continue to operate as close to business-as-usual as possible. During times of stress, investors need to price the effects of that stress on assets. The longer they are prevented from pricing the impact, the more anxiety builds and the worse the consequences will be when markets eventually re-open.
The fourth guiding principle is that we want to promote decentralized decision-making and problem-solving, both as we prepare for disruptions and as we weather them. In the event of a disruption to the payments system, for example, we want the payments systems experts to fix it. We do not want them to wait for guidance from Washington. Just fix it. The subject matter experts who are on the ground and in the field are in the best position to determine what steps should be taken to protect employees and customers. We will help where we can and where we need to, but we intend to leave the responsibility with the financial institutions and the regulators that are closest to the problems to find the solutions. Initiative and ingenuity are the most powerful tools to deal with any disruption, and we must give full room for their exercise.
Impact of the Power Outage of August 14-15, 2003
On Thursday, August 14, at approximately 4:11 pm, large areas of the Northeast lost power, including New York City, where a large amount of the U.S. financial infrastructure is concentrated.
The U.S. financial system handled the outage well.
The bond market and major equities and futures markets – with one exception – were able to open the next day for business at their usual trading hours. [1] The one exception, the American Stock Exchange, was able to open for a short, but important, trading session just prior to the normal market closing hour on Friday. Neither the Department of the Treasury nor any of our companion financial regulators received any reports of lost data, significant failed transactions, or other similar problems at individual institutions, exchanges, or the financial utilities that serve them.
Major market participants also performed well by keeping their systems up and running using power supplied by back up generators. The next day, major market participants traded in the currency, bond, equities, and futures markets. Although there were isolated reports of telecommunications difficulties between market participants and the markets or news services that supply real-time market data, the problems were minor and the participants and their telecommunications suppliers resolved these problems during the day.
Banks and credit unions also performed well. Although most branches and ATMs within the affected area were closed on Friday, there were no reports of lost or compromised data. In general, customers were able to briefly defer their banking transactions with little economic impact. The Federal Reserve System was fully prepared to make additional currency available to satisfy any increased demand for currency once power was restored. However, there was no significant increase in demand, and the Federal Reserve System did not need to implement fully its plan.
Impact of Hurricane Isabel, September 18-19, 2003
On September 18 and 19, some parts of the financial system were tested again, as Hurricane Isabel made landfall in North Carolina and moved across the Mid-Atlantic States. Isabel's impact on the financial system was significantly less than the impact of the power outage. For one thing, Isabel passed to the south and west of New York City and the surrounding metropolitan area, where much of the U.S. financial system is concentrated. For another, due to advanced weather reporting, the hurricane was not a surprise and the financial system had days to anticipate Isabel and prepare for its arrival.
Although the impact of Isabel was less significant in degree, it was quite similar in kind to the impact of the power outage – both resulted in widespread disruptions of electric power and the businesses that depend on it. However, the storm neither adversely affected the financial markets nor the major participants in those markets. Similarly, although many bank and credit union branches and ATMs lost power, there was no significant economic impact from this: people did their business before the much-anticipated storm, postponed their business until power was restored, or drove to a nearby branch or ATM that had power – with no instances of lost or compromised customer data reported.
The Resilience of the U.S. Financial System
There are several reasons why the U.S. financial system fared so well in the face of the severe challenges posed by the power outage of August 14-15 and the somewhat less severe challenges posed by Isabel.
First and foremost, the men and women who work in the financial system did an extraordinary job. During the outage, many of these people stayed at their posts at financial institutions to ensure both that their systems preserved and processed data from trading on Thursday and that their systems would be prepared to resume trading the next day, on Friday.
Almost immediately after the power went out on Thursday, financial institutions began asking themselves not whether they would open for business the next day, but how they could best serve their customers' needs once open. By 6:00 pm on Thursday the major financial markets publicly stated that they would be open for trading during normal hours on Friday. This commitment to serve customers even in times of adversity is important. It gives customers confidence in using the U.S. financial system and, in turn, helps promote rational financial decisions by institutions and their customers.
I wish to note an important point in this regard. Financial institutions decided on their own that they would open for business the next day. They did not wait for guidance from Washington. They did not ask for permission to serve their customers. They decided for themselves. They knew how to serve the best interests of their institutions and their customers, and they acted accordingly. This is precisely the sort of private sector leadership and responsibility that we are promoting, and we were gratified to see it work so well during the power outage.
Third, financial institutions and their employees were well-equipped to continue their businesses in the face of challenges such as the outage. While no one foresaw the specific nature and dimensions of the power outage, careful planning and preparation helped financial institutions survive it. After the power went out, many institutions relied on these plans to switch to power supplied from back-up generators; and, in some cases, to switch to back-up data processing facilities located outside the impacted area. Although such planning and preparation has long been part of the best practices of running a safe and sound financial institution, it also reflects the benefits realized by the financial services sector as a result of increased investments in contingency plans, procedures, and equipment. Financial institutions have more alternative options available to them than they had in the past. During August 14-15, these investments paid off.
Fourth, good communications helped to remove uncertainty and maintain confidence. The President's early expression of confidence in the ability of officials, businesses, and citizens to weather the outage helped build resolve and maintain calm. Mayor Bloomberg and his team also did a superb job of providing a range of emergency services and communicating the impact of the outage and their response clearly and confidently not just to the citizens of New York, but to the world. Financial institutions communicated well among themselves and with their regulators.
Finally, the regulators communicated efficiently and effectively among themselves and with the private sector. For example, shortly after the power went out, Treasury convened a conference call of the FBIIC, waiting just long enough for regulators to gather detailed information about the impact of the outage on Thursday's activity and the likely impact on Friday's activity. This conference call provided an early opportunity for the regulators to share information about the impact of the outage on each of their regulated sectors. As that information was, in turn, passed to major participants in the sectors it further helped the industry manage the impact of the outage. As another example, the private sector counterpart to the FBIIC, the Financial Services Sector Coordinating Council (FSSCC), convened a series of conference calls that enabled the financial sector to gain valuable, up to the minute information about power restoration which helped them prepare for the next day's activities.
Lessons Learned and Next Steps
Although the U.S. financial system weathered the power outage of August 14-15 and Isabel well, the Department of the Treasury and our companion financial regulators in the FBICC have extracted some lessons learned and identified steps to take next as we work with our partners in the financial industry to further improve the resilience of the U.S. financial system.
Need for Additional Work on Inter-Dependencies
The power outage highlighted some of the inter-dependencies of our critical infrastructure. The critical financial infrastructure, while extremely resilient, is also dependent on other infrastructures including energy, telecommunications, information technology, transportation, and others. These interdependencies were made all too clear by the attacks of September 11, 2001 when a vault containing a large number of telecommunications lines was destroyed. Financial institutions that purchased redundant lines from multiple carriers were surprised to learn that because many of the lines were routed through that same vault, they had much less telecommunications redundancy than they thought.
Since September 11, the financial industry and the telecommunications industry have made important strides toward improving the resilience of the telecomm infrastructure on which the financial services industry depends. For example, some exchanges, the key financial clearing and settlement facilities , major market participants, and telecommunications companies have created a dedicated, self-healing telecommunications network. More work is underway in this area
Another important interdependency exists between the financial services sector and the information technology sector. By many accounts, the financial services sector is one of the largest consumers of information technology products and services. The financial services industry uses information technology not only to operate critical business processes, but also to communicate with its customers and, in many cases, to distribute products. This use of information technology contributes, of course, to the remarkable productivity, ingenuity, and resilience of the U.S. financial system. At the same time, the heavy reliance upon information technology renders the U.S. financial system – like the financial system of many other nations – potentially vulnerable to cyber attacks. Over the past nine months, worms and viruses like Slammer, Bugbear, and Sobig.F, have challenged administrators of financial institutions' computer networks. Moreover, these attacks are not only becoming more sophisticated, they tend to spread more quickly and are occurring with greater frequency. It is clear that the financial services sector is an attractive target. For example, the Bugbear worm specifically targeted over 1600 financial institutions around the globe, with the apparent intent not just to disrupt transactions, but to steal funds.
Much work is underway to protect our critical financial infrastructure from cyber attack, and I would like to share some of these efforts with you.
As the first line of defense and responsibility, financial institutions shoulder the job of minimizing the vulnerabilities within their own systems. This responsibility is reinforced by the financial regulators, whose examiners inspect banks and other institutions for safe and sound practices, including "technological safeguards" required under Section 501(b) of the Gramm-Leach-Bliley Act.
To assist in the promotion and communication of best practices, as well as to assist in the dissemination of advisories, the Financial Services Information Sharing and Analysis Center (FS-ISAC) is expanding the reach of its communications network to nearly every financial institution. The Department of the Treasury was pleased to support the FS-ISAC in the development of this next-generation plan, and we look forward to supporting the FS-ISAC as it implements the plan.
Moreover, to assist in crime deterrence and apprehension of cyber crooks, the Treasury has been pleased to support and work with the United States Secret Service as it creates electronic crimes task forces across the nation. Just last week, my Deputy Assistant Secretary for these issues participated in the official roll-out of such a task force in Cleveland. We look forward to continuing efforts with Director Basham and others in the United States Secret Service in this important area.
Still more needs to be done to protect the financial sector from cyber attack. Two immediate priorities include reducing the number of vulnerabilities introduced into software products and addressing potential vulnerabilities introduced by the business practice of domestic and international outsourcing of customer service, data management, and software development.
Conclusion
The U.S. financial system is more resilient today than it was a year ago. The men and women who work in the system help make it so. Our job is not finished. It is a big job. To paraphrase Winston Churchill, we are not at the end, or even the beginning of the end. But we might be nearing the end of the beginning. Americans and the world can rely with increasing confidence on the U.S. financial system.
-30-
[1] The bond market, through the Bond Market Association and with the support of the Department of the Treasury, closed at 2:00 pm on Friday to provide bond traders and the employees who support them additional time to get home. At the time, it was unclear when subway and train service would be restored, and most anticipated a difficult commute.