<DOC>
[106th Congress House Hearings]
[From the U.S. Government Printing Office via GPO Access]
[DOCID: f:60842.wais]
COMPUTER SECURITY IMPACT OF Y2K:
EXPANDED RISKS OR FRAUD?
=======================================================================
JOINT HEARING
before the
SUBCOMMITTEE ON TECHNOLOGY
of the
COMMITTEE ON SCIENCE
and the
SUBCOMMITTEE ON
GOVERNMENT MANAGEMENT, INFORMATION,
AND TECHNOLOGY
of the
COMMITTEE ON
GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTH CONGRESS
FIRST SESSION
__________
AUGUST 4, 1999
__________
Science Serial No. 106-23
__________
Government Reform Serial No. 106-57
__________
Printed for the use of the Committee on Science
U.S. GOVERNMENT PRINTING OFFICE
60-842 WASHINGTON : 2000
COMMITTEE ON GOVERNMENT REFORM
DAN BURTON, Indiana, Chairman
BENJAMIN A. GILMAN, New York HENRY A. WAXMAN, California
CONSTANCE A. MORELLA, Maryland TOM LANTOS, California
CHRISTOPHER SHAYS, Connecticut ROBERT E. WISE, Jr., West Virginia
ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York
JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York
STEPHEN HORN, California PAUL E. KANJORSKI, Pennsylvania
JOHN L. MICA, Florida PATSY T. MINK, Hawaii
THOMAS M. DAVIS, Virginia CAROLYN B. MALONEY, New York
DAVID M. McINTOSH, Indiana ELEANOR HOLMES NORTON, Washington,
MARK E. SOUDER, Indiana DC
JOE SCARBOROUGH, Florida CHAKA FATTAH, Pennsylvania
STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland
MARSHALL ``MARK'' SANFORD, South DENNIS J. KUCINICH, Ohio
Carolina ROD R. BLAGOJEVICH, Illinois
BOB BARR, Georgia DANNY K. DAVIS, Illinois
DAN MILLER, Florida JOHN F. TIERNEY, Massachusetts
ASA HUTCHINSON, Arkansas JIM TURNER, Texas
LEE TERRY, Nebraska THOMAS H. ALLEN, Maine
JUDY BIGGERT, Illinois HAROLD E. FORD, Jr., Tennessee
GREG WALDEN, Oregon JANICE D. SCHAKOWSKY, Illinois
DOUG OSE, California ------
PAUL RYAN, Wisconsin BERNARD SANDERS, Vermont
HELEN CHENOWETH, Idaho (Independent)
DAVID VITTER, Louisiana
Kevin Binger, Staff Director
Daniel R. Moll, Deputy Staff Director
David A. Kass, Deputy Counsel and Parliamentarian
Carla J. Martin, Chief Clerk
Phil Schiliro, Minority Staff Director
------
Subcommittee on Government Management, Information, and Technology
STEPHEN HORN, California, Chairman
JUDY BIGGERT, Illinois JIM TURNER, Texas
THOMAS M. DAVIS, Virginia PAUL E. KANJORSKI, Pennsylvania
GREG WALDEN, Oregon MAJOR R. OWENS, New York
DOUG OSE, California PATSY T. MINK, Hawaii
PAUL RYAN, Wisconsin CAROLYN B. MALONEY, New York
Ex Officio
DAN BURTON, Indiana HENRY A. WAXMAN, California
J. Russell George, Staff Director and Chief Counsel
Matt Ryan, Senior Policy Director
Bonnie Heald, Communications Director/Professional Staff Member
Grant Newman, Clerk
Trey Henderson, Minority Counsel
COMMITTEE ON SCIENCE
F. JAMES SENSENBRENNER, Jr., Wisconsin, Chairman
SHERWOOD L. BOEHLERT, New York RALPH M. HALL, Texas
LAMAR SMITH, Texas BART GORDON, Tennessee
CONSTANCE A. MORELLA, Maryland JERRY F. COSTELLO, Illinois
CURT WELDON, Pennsylvania JAMES A. BARCIA, Michigan
DANA ROHRABACHER, California EDDIE BERNICE JOHNSON, Texas
JOE BARTON, Texas LYNN C. WOOLSEY, California
KEN CALVERT, California LYNN N. RIVERS, Michigan
NICK SMITH, Michigan ZOE LOFGREN, California
ROSCOE G. BARTLETT, Maryland MICHAEL F. DOYLE, Pennsylvania
VERNON J. EHLERS, Michigan SHEILA JACKSON LEE, Texas
DAVE WELDON, Florida DEBBIE STABENOW, Michigan
GIL GUTKNECHT, Minnesota BOB ETHERIDGE, North Carolina
THOMAS W. EWING, Illinois NICK LAMPSON, Texas
CHRIS CANNON, Utah JOHN B. LARSON, Connecticut
KEVIN BRADY, Texas MARK UDALL, Colorado
MERRILL COOK, Utah DAVID WU, Oregon
GEORGE R. NETHERCUTT, Jr., ANTHONY D. WEINER, New York
Washington MICHAEL E. CAPUANO, Massachusetts
FRANK D. LUCAS, Oklahoma BRIAN BAIRD, Washington
MARK GREEN, Wisconsin JOSEPH M. HOEFFEL, Pennsylvania
STEVEN T. KUYKENDALL, California DENNIS MOORE, Kansas
GARY G. MILLER, California VACANCY
JUDY BIGGERT, Illinois
MARSHALL ``MARK'' SANFORD, South
Carolina
JACK METCALF, Washington
C O N T E N T S
----------
Page
August 4, 1999:
Opening Statement by Representative Constance A. Morella,
Chairwoman, Subcommittee on Technology, U.S. House of
Representatives............................................ 1
Opening Statement by Representative Stephen Horn, Chairman,
Subcommittee on Government Management, Information and
Technology, U.S. House of Representatives.................. 3
Opening Statement by Representative Mark Udall, Member,
Subcommittee on Technology, U.S. House of Representatives.. 6
Witnesses:
Mr. Joe Pucciarelli, Vice President and Research Director,
Gartner Group Inc.:
Oral Testimony........................................... 7
Prepared Testimony....................................... 10
Biography................................................ 15
Financial Disclosure..................................... 16
Mr. Harris Miller, President, Information Technology
Association of America:
Oral Testimony........................................... 17
Prepared Testimony....................................... 19
Biography................................................ 33
Financial Disclosure..................................... 35
Mr. Dean Rich, Vice President for Security Services, WarRoom
Research:
Oral Testimony........................................... 36
Prepared Testimony....................................... 39
Biography................................................ 41
Financial Disclosure..................................... 44
Mr. Wayne Bennett, Chair, Commercial Technology Practice
Area, Bingham Dana LLP:
Oral Testimony........................................... 45
Prepared Testimony....................................... 47
Biography................................................ 52
Financial Disclosure..................................... 56
Appendix 1: Additional Statements
Statement by Representative Debbie Stabenow, Member, Subcommittee
on Technology, U.S. House of Representatives................... 76
Appendix 2: Materials for the Record
USA Today Article, Y2K fixes open door for electronic heist, M.J.
Zuckerman...................................................... 78
Gartner Group Report, Year 2000 and the Expanded Risk of
Financial Fraud, April 1, 1999................................. 80
HEARING ON THE COMPUTER SECURITY IMPACT OF Y2K: ``EXPANDED RISKS OR
FRAUD?''
----------
WEDNESDAY, AUGUST 4, 1999
House of Representatives, Subcommittee on
Technology, Committee on Science, and the
Subcommittee on Government Management,
Information, and Technology, Committee on
Government Reform,
Washington, DC.
The subcommittees met, pursuant to notice, at 10:06 a.m.,
in Room 2318, Rayburn House Office Building, Hon. Constance A.
Morella [chairwoman of the subcommittee] presiding.
Present: Representatives Morella, Horn, Bartlett,
Gutknecht, Turner, Rivers, Stabenow, Udall, and Wu.
Chairwoman Morella. I'm going to call to order the latest
in our series of ongoing hearings on our House Y2K Working
Group made up of the Science Committee's Technology
Subcommittee and the Government Reform Committee's Government
Management, Information, and Technology Subcommittee.
On behalf of my colleagues Chairman Horn, Ranking Members
Barcia and Turner, and Mr. Udall, I want to welcome our
distinguished panel as we discuss today the concerns raised by
a number of information technology experts that Y2K fixes may
pose a substantial security threat to computer operating
systems.
While the Technology Subcommittee has been reviewing the
year 2000 problem over the past 3 years, during that time we
have also been looking closely at the issue of computer
security.
Many of you have heard me compare our Nation's lack of
adequate information security to the year 2000 computer
problem.
Well, it now appears that Y2K and computer security aren't
just inviting comparisons, but have overlapped into one issue.
A lot of recent attention has been focused on the April 1,
1999, GartnerGroup report suggesting that as part of every year
2000 system fix, every aspect of every single information
technology system is potentially subject to change and
manipulation, raising the risk of theft, fraud, or corruption.
The GartnerGroup report also stated that at least one
publicly reported theft exceeding $1 billion may occur through
lapses in security directly resulting from Y2K remediation
efforts.
Since the publication of the report, a number of
independent scientists, security professionals, and others in
the Y2K community appear to have few quarrels with the
GartnerGroup's dire prediction.
The concern is that Y2K employees who have been hired to
correct systems might have left ``trap doors'' or may
manipulate the computer code through which they can
clandestinely take control of the system at a future date--
leaving vulnerable the systems that electronically move $11
trillion a year among financial institutions, corporations,
governments, and private organizations.
The computer security threat, however, may not be motivated
merely by just financial theft and fraud.
Some Y2K programmers with malicious intent may be quietly
installing malicious software codes--such as a logic bomb or a
time-delayed virus--to sabotage companies or gain access to
sensitive information sometime in the new millennium.
Most troubling is that several security firms say that they
have already found ``trap doors'' in Y2K programming.
If used successfully for hostile purposes, these computer
``trap doors'' can open to make sensitive national and
proprietary information systems vulnerable to be accessed,
stolen, compromised, or disrupted.
With less than 150 days now before the January 1, 2000,
deadline, the last thing we want to do is to defer any Y2K
remediation efforts.
It should be made clear that nobody should halt or suspend
fixing their Y2K problems simply because there exists this
potential for computer security breaches.
The goal of this hearing is not to create a how-to guide
and stoke the embers of those Y2K programmers with a felonious
heart and malicious intent.
The goal of this hearing is to determine what measures can
be undertaken to protect our computer systems and to limit the
potential of Y2K computer security breaches.
It is my hope that, today, this panel can collectively come
up with measures and guidelines that both the private and
public sectors can review and utilize in their current
remediation efforts to deter and catch any computer security
breach that may occur as a result of the Y2K fix.
Toward that end, I am pleased that we have a very
distinguished panel.
I welcome Mr. Joe Pucciarelli, Vice President, Research
Director of the GartnerGroup, a leading and influential
information technology research firm, which we know very well
through our hearings, and the author of the GartnerGroup Y2K
computer security report.
Also joining us is a familiar figure to us, Mr. Harris
Miller, President of the Information Technology Association of
America.
The Technology Subcommittee has worked very closely with
Mr. Miller and the ITAA in the past on both the Y2K and the
computer security issue, and it is great to see him back as a
witness before us.
We also have Mr. Dean Rich, Vice President for Security
Services at WarRoom Research in Annapolis, Maryland, who is a
computer security consultant with a great deal of expertise and
experience in both the public and private sectors. I'm somebody
who knows Annapolis well. I welcome you also, Mr. Rich.
Additionally, Mr. Wayne Bennett, Chair of the Commercial
Technology Practice Area of the law firm of Bingham Dana in
Boston and an expert in computer security laws and practice, is
with us today. A pleasure to have you, Mr. Bennett.
So I look forward to everybody's testimony, and I would now
like to turn to our distinguished Co-Chair of today's hearing,
the member from California, Chairman of the Government
Management, Information and Technology Subcommittee, Mr. Horn,
for any opening statement that he may wish to make. Mr. Horn.
Mr. Horn. Thank you very much.
For the past 3 years, these two Subcommittees have been
prodding agencies in the executive branch of the Federal
Government to prepare their computer systems for the year 2000.
Nearly all seem to have made good progress toward avoiding
major computer disruptions at the end of this year. However,
the rush to solve the year 2000 problem may have created
another more insidious and potentially troubling problem.
Today, we will discuss the danger that government agencies,
corporations, and individuals are now more vulnerable to
computer fraud, whether it is in the form of electronic
robberies or information warfare.
The reality is that computer systems can be compromised for
any number of reasons--some far more damaging than the loss of
money. Among them are the threats of industrial or military
espionage and the use of computers and the network systems by
terrorists or organized crime.
Private companies and government agencies alike have opened
up their most sensitive computer systems to outside contractors
who are helping them sort through billions of lines of computer
code to ensure their year 2000 compliance.
Although the vast majority of these contractors are honest
and truthworthy people, even a few unscrupulous operators could
create a significant problem.
The GartnerGroup, which is represented here today, has
predicted that by 2004, there will be at least one reported $1
billion or more theft due to the year 2000 remediation effort.
The concern involves something called ``trap doors,''
computer coding that can give unscrupulous contractors access
to the sensitive information in a computer long after the year
2000 work is completed.
From bank accounts and intellectual property to medical
records and defense secrets, companies and government agencies
have given contractors the keys that unlock an enormous
storehouse of information.
With only 149 days left until the new millennium, we must
ensure that our critical information technology infrastructure
is secure long after the year 2000 has passed away.
So, with Mrs. Morella, I welcome the witnesses we have
today, and I'm sure you will enlighten us in a number of areas.
[The prepared statement of Hon. Stephen Horn follows:]
[GRAPHIC] [TIFF OMITTED] T0842.001
[GRAPHIC] [TIFF OMITTED] T0842.002
Chairwoman Morella. Thank you, Chairman Horn.
I am now pleased to recognize for any opening comments Mr.
Udall, who is our ranking member today.
Mr. Udall. Thank you, Madam Chairman. I want to join my
colleagues in welcoming all of you here today to the hearing.
This hearing focuses on two issues, the way I see it: computer
and network security and then, secondly, whether Y2K-related
computer system upgrades have increased the threat to a
company's or a federal agency's computer security.
I'd like to take a few minutes to speak about the Science
Committee's role in the area of computer security. Going back
into the late 1980s, the members of this Committee were aware
that the first computer networks, such as ARPANET, which became
NSFNET and is now known, of course, as the Internet, had a two-
edged quality: they improved electronic communication but also
compromised computer security.
In 1987, the Science Committee was instrumental in
developing and passing the Computer Security Act. This was the
first effort to improve the security of federal computer
systems. Ever since, the Science Committee has maintained a
high profile in this area.
I mention this issue because many believe that Congress has
not given sufficient attention to this issue of computer
security. I wanted to highlight that at least one Congressional
Committee has worked diligently to raise public and government
awareness of computer security issues for more than a decade.
This was long before most people even knew that the Internet
existed, let alone before related computer security issues
became important.
Today's hearing, as my fellow colleagues have mentioned,
was prompted by recent newspaper stories about a GartnerGroup
report warning that by 2004 there will be at least one publicly
reported electronic theft exceeding $1 billion and that steps
to solve the Y2K problem will be a root cause of the security
lapses that have allowed this step to happen.
This is a serious assertion that raises more questions than
it answers. For example, if it's true there will be at least a
$1 billion theft, what about the likelihood of several thefts
in the range of $100 million or the tens of thousands of
dollars?
Further, how credible are these alarms? After all, the
warnings themselves could undermine public trust in our
financial systems and the government's ability to provide
public services and in our computer-based infrastructure as a
whole.
So, in that spirit, there are several issues that I hope
our witnesses will address today. The first is: What data
substantiates claims that there's an increased risk of fraud as
a result of these Y2K fixes? Secondly, federal agencies,
including Congress, and industry have relied on contractors to
service their computer systems since their first installation.
What has been the past experience of this type of fraud? And
then, finally, if this Y2K-related fraud is a real problem,
what steps can federal agencies and large corporations take to
determine if the malicious code, the so-called trap doors, have
been inserted into their programs?
I want to thank you for being here. I very much look
forward to hearing what you have to say.
Thank you.
Chairwoman Morella. Thank you, Mr. Udall, and thank you for
also mentioning sort of the genesis of the Science Committee's
interest and involvement in this issue.
I'm now going to ask our panelists if they would rise and
raise their right hand. It's the policy of this Committee to
swear in those who will testify.
Do you swear that the testimony you are about to give is
the truth, the whole truth, and nothing but the truth?
Mr. Pucciarelli. I do.
Mr. Miller. I do.
Mr. Rich. I do.
Mr. Bennett. I do.
Chairwoman Morella. The record will reflect an affirmative
response from all. And, again, we'll try to follow a tradition,
to give time for questions and other comments, of asking each
panelist to speak about 5 minutes, and then we'll open it up to
questions. And we'll start off then in the order in which I
mentioned you.
Mr. Pucciarelli, you will start off with the Gartner
report.
STATEMENTS OF JOSEPH C. PUCCIARELLI, VICE PRESIDENT AND
RESEARCH DIRECTOR, GARTNERGROUP, INC., STAMFORD, CONNECTICUT;
HARRIS N. MILLER, PRESIDENT, INFORMATION TECHNOLOGY ASSOCIATION
OF AMERICA, ARLINGTON, VIRGINIA; L. DEAN RICH, VICE PRESIDENT
FOR SECURITY SERVICES, WARROOM RESEARCH, ANNAPOLIS, MARYLAND;
AND WAYNE D. BENNETT, CHAIR, COMMERCIAL TECHNOLOGY PRACTICE
AREA, BINGHAM DANA LLP, BOSTON, MASSACHUSETTS
STATEMENT OF JOSEPH C. PUCCIARELLI
Mr. Pucciarelli. Madam Chairman--Madam Chairwoman, Mr.
Chairman, and Members of the two Subcommittees, I appreciate
the opportunity to testify----
Chairwoman Morella. I think you should either move it
closer or make sure it's on.
Mr. Pucciarelli. Madam Chairwoman, Mr. Chairman, and
Members of the two Subcommittees, I appreciate the opportunity
to testify today on the computer security impact of year 2000
and the expanded risks of fraud. Key points in my testimony we
will discuss: our prediction, the analysts of GartnerGroup,
that by 2004 there will be at least one publicly reported
electronic theft exceeding $1 billion, 70 percent likelihood;
our forecast that year 2000 remediation efforts will be
identified as a root cause of the security lapses that will
have allowed this theft to happen, 70 percent likelihood; and
how input from our clients was factored into these predictions
and caused us to increase the probabilities.
My role is to advise business and financial executives in
the public and private sector on actions they should take to
protect and maximize the effectiveness of their investments in
computer technology. We found medium and large organizations in
the United States spend some 8 percent of sales revenue--that
is, 8 cents of every sales dollar--for computer systems. Ten
years ago, this number was only 1 percent. During the same
period, our financial systems have largely migrated to an
electronically interconnected business model. Best estimates
are that $11 trillion in electronic transfers occurred in the
United States in 1998.
Earlier this year, as part of my ongoing research, I
reviewed those issues that may require action by my clients. I
concluded, by reviewing the technical research conducted by my
colleagues at GartnerGroup, that many firms had not taken
adequate steps to secure and audit a year 2000 remediation
process. Based on these observations, I formulated a
recommendation to our clients.
I reviewed these preliminary findings with some 300 clients
on Tuesday, March 2, 1999, at a conference in New Orleans. Our
clients had differing opinions. Their feedback indicated that
the risk of theft was even higher than I had proposed. As a
result, we formally advised our clients in April that we
believe that by 2004 there will be at least one publicly
reported electronic theft exceeding $1 billion, and that Y2K
remediation efforts will be a root cause of those--that allowed
this theft to happen, 70 percent likelihood.
Predicting what will happen is challenging. Anticipating
how it may happen raises the bar considerably. In the case of
the first $1 billion electronic theft, the motive will likely
be one of greed combined with feelings of underappreciation by
a highly skilled software engineer, especially related to the
stress of the year 2000 remediation effort. The means will be
the tools at hand--the same electronic systems reliably
transact the business of the day will be instructed to transfer
funds beyond the boundaries of the enterprise into the hands of
a thief. The opportunity to perpetrate the crime will come in
an odd moment, a situation outside the bounds of the operating
manual. A system will crash unexpectedly and a single software
engineer could make changes without the normal reviews, due
diligence, or oversight. Further, the incident will likely
occur long after January 1, 2000.
Clearly, a billion dollars is a huge sum of money. However,
compared with the $11 trillion in annual volume of financial
electronic data interchange transfers during 1998, which are
growing some 40 percent annually, it represents only 0.0009
percent. To use a metaphor, a $1 billion theft compared to the
$11 trillion in throughput equates to 48 minutes over the
course of a year. In this context, a billion seems somewhat
less significant. Opposing all this money is the unbounded
creativity of the human mind--which has proved the world round,
produced Einstein's theory of relativity, placed a man on the
moon, and committed countless crimes throughout history. From
the Brinks armored car robbery through the Great Train Robbery,
to the most recent financial scandals including BCCI and
Barings, each generation adapts theft and fraud to the
technological circumstances of the day.
Given the enormity of the year 2000 remediation process,
the scope of the cash flowing through these systems and the
resourcefulness of the human mind in finding different ways to
steal, a large theft seems much more likely perhaps inevitable.
Specific steps need to be taken now and continually re-
emphasized to minimize risk. Specifically, we recommended:
One, the most effective theft and fraud deterrent is
maintaining the perception that there are high levels of
security. To accomplish this, we advise our clients to
collaborate to create a year 2000 security team with the
requisite technical and auditing skills to review procedures,
assess the threats, and implement a containment plan.
Second, procedure reviews must limit the ability of a
single individual to make changes or initiate activities
without a second person participating in the process.
Third, risk assessment must include reviewing all
enterprise insurance coverage as well as contracts with
external service providers and independent (programmer)
contractors.
Four, risk management plans should include careful
reconsideration of all existing theft and fraud deterrence
activities in light of this expanded threat profile.
The law of very large numbers dictates that we will have a
vastly increased risk of theft after the year 2000 remediation
efforts. In the rush to aggressively solve one problem,
enterprises need to ensure appropriate resources have been
rededicated to protecting the enterprise from the increased
risks of electronic theft and fraud--possibly the most
important artifact created by year 2000 remediation. These
nonlinear consequences of the year 2000 computer maintenance
effort may have a more profound implication than the linear
consequences such as a failure of a specific computer system.
Thank you.
[The statement of Mr. Pucciarelli follows:]
[GRAPHIC] [TIFF OMITTED] T0842.003
[GRAPHIC] [TIFF OMITTED] T0842.004
[GRAPHIC] [TIFF OMITTED] T0842.005
[GRAPHIC] [TIFF OMITTED] T0842.006
[GRAPHIC] [TIFF OMITTED] T0842.007
[GRAPHIC] [TIFF OMITTED] T0842.008
[GRAPHIC] [TIFF OMITTED] T0842.009
STATETEMENT OF HARRIS N. MILLERMr. Miller. Thank you,
Chairwoman Morella and Chairman Horn and other Members of the
Subcommittee. It is an honor to appear before your joint
Subcommittees, and I want to commend you and your colleagues
for holding this hearing on computer security as attention
moves from the Y2K problem to the next and even greater
challenge--Information Security or Critical Information
Infrastructure Protection, as it is often called.
Just as your two Subcommittees were among the leaders in
educating Congress and the Nation on the year 2000 challenge, I
know that you will play the same role on Information Security.
Make no mistake about it: Information Security is the next Y2K
issue for the IT community and its users.
The evildoers are not just unscrupulous Y2K repair firms.
The infosec threat comes in numerous guises: mischief-minded
hackers, disgruntled employees, corporate spies, cyber
criminals, terrorists, and unfriendly nations.
Virus episodes like Melissa and Chernobyl are becoming more
frequent. The Symantec Anti-Virus Research Center estimates
that new viruses are being launched at a rate of 10 to 15 per
day and that over 2,400 currently exist, and 35 percent of
those are considered to be intentionally destructive.
And, of course, there are the unintended consequences
associated with our new dynamic information technology
evolution, and, of course, year 2000 is the exhibit number one.
Assessing the ultimate infosec roles for government and the
private sector is really very simple. Our new information-based
assets must be protected and preserved. Participants and users
must understand that along with the obvious benefits of
information technology are corresponding commitments to protect
information technology. With rights--the right for IT to become
the firmament on which most of our society, our government, and
our economy are built--come responsibilities. And the primary
responsibility is to ensure the security of our information
society. The societal stakes involved compel government and
industry to seek common ground on the issue.
Security is much more challenging in the digital world
because it is not the traditional security of wire fences,
thick walls, and guard dogs. And it is not an activity just to
be left to the experts, for all of us are part of the
information age and must be sensitive to protecting it.
The road to a common ground between government and industry
will never be a straight line. On the contrary, while the ends
are commonly shared, the policies that government and industry
will develop in order to provide this protection are likely to
be quite different. Again, I remind the Subcommittees that the
year 2000 is the wake-up call. A well-prepared and well-
informed private sector can work with government to find the
proper balance which optimizes the government's needs to
protect the critical infrastructure with business' needs to
manage risks appropriately.
Significant reservations exist, however, on the part of
both private industry and government, and ITAA is attempting to
address both from a theoretical and practical standpoint.
In developing industry positions on national infosec
issues, ITAA has established a list of general principles that
will guide the development of our policy. They emphasize
industry leadership, communication and collaboration, infosec
commensurate with the true threat involved without
embellishment or magnification, and international
collaboration. My written statement provided to the Committee
outlines these principles in more detail.
But there are also many questions that must be addressed,
including the question, for example: What should be the
mechanism for sharing information between government and the
private sector, or even within the private sector itself? What
type of threat and intrusion reporting will be required as
opposed to optional? What type of organizations should plan and
execute the strategy for critical information infrastructure
defense? And what kind of legal and regulatory obstacles are
there to information sharing and information security?
And, of course, a less tangible concern must be addressed,
particularly development of trust, both within the private
sector and between the private sector and government. So as you
can see, there is much to be done.
We are working with our customers and with our government
to build the necessary bridges. ITAA is taking a number of
actions to focus on this issue. Following, for example, the
issuance of Presidential Decision Directive 63 last year, ITAA
was appointed as the sector coordinator for the IT sector along
with two other high-tech trade associations. We are involved in
massive education efforts, including White Papers, and we have
held frequent meetings with representatives across the
government to educate, discuss, and provide input.
Education and outreach will be critical to the success of
our efforts collectively. This past March, ITAA created the
framework for a new Cybercitizen Partnership in conjunction
with Attorney General Janet Reno. The partnership will focus on
promoting individual responsibility in cyberspace and creating
a private-public sector forum for exchange and cooperation.
In all honesty, we at ITAA face a daunting job of
convincing the IT industry and our customers to work with
government on these initiatives. But it is a challenge we must
step up to if we are to achieve any degree of success in
opening lines of communication.
The United States and much of the world are building their
economic house on an information technology foundation. This is
an extremely positive approach to take, delivering tangible
benefits to a fast-growing percentage of the world's
population. If year 2000 is the first challenge to place our
economic house at risk, failure to adopt a rigorous approach to
infosec will be the second and even more dangerous. ITAA and
its member companies are committed to a private sector
leadership role in ensuring that the necessary, timely, and
cost-effective solutions are implemented.
Thank you, and I would be happy to answer any questions you
may have.
[The statement of Mr. Miller follows:]
[GRAPHIC] [TIFF OMITTED] T0842.010
[GRAPHIC] [TIFF OMITTED] T0842.011
[GRAPHIC] [TIFF OMITTED] T0842.012
Introduction
[GRAPHIC] [TIFF OMITTED] T0842.013
[GRAPHIC] [TIFF OMITTED] T0842.014
[GRAPHIC] [TIFF OMITTED] T0842.015
[GRAPHIC] [TIFF OMITTED] T0842.016
[GRAPHIC] [TIFF OMITTED] T0842.017
[GRAPHIC] [TIFF OMITTED] T0842.018
[GRAPHIC] [TIFF OMITTED] T0842.019
[GRAPHIC] [TIFF OMITTED] T0842.020
[GRAPHIC] [TIFF OMITTED] T0842.021
[GRAPHIC] [TIFF OMITTED] T0842.022
[GRAPHIC] [TIFF OMITTED] T0842.023
[GRAPHIC] [TIFF OMITTED] T0842.024
[GRAPHIC] [TIFF OMITTED] T0842.025
[GRAPHIC] [TIFF OMITTED] T0842.026
Chairwoman Morella. Thank you, Mr. Miller. And I want all
of the panelists to know that the entirety of their statements
as submitted to us will be included in the record, and I know
that you have submitted extensive statements, and we appreciate
that.
Mr. Rich, I now recognize you, sir. May I indicate that we
have been joined by Mr. Bartlett from the great State of
Maryland. Mr. Rich is from Maryland, Mr. Bartlett.
STATEMENT OF L. DEAN RICH
Mr. Rich. Thank you. Chairwoman Morella, Chairman Horn, and
Members of the Subcommittees, I appreciate the opportunity to
appear before you and I thank you for continuing to address the
problems associated with information assurance and national
critical infrastructure. As a lead into Y2K, I'd like to submit
that Y2K, while a problem in itself, is a manifestation of a
much larger issue--overall infrastructure assurance. We can
look at Y2K as a wake-up event to better understand and manage
those systems that are increasing in control or influencing
every aspect of our lives.
I come to this Committee with a background of information
security as a Naval Reserve Officer in the Naval Cryptologic
community and as a businessman working with industry to address
the very issues we are discussing today. I support the Naval
Criminal Investigative Service in my reserve capacity
addressing threat issues. In my civilian position, I am
currently with WarRoom Research as Vice President of Security
Services, addressing both threat and vulnerability issues.
You might recall that WarRoom research services the U.S.
Senate's Permanent Subcommittee on Investigations under the
1996 Security in Cyberspace Hearings where we collected
information security risk profiles of 205 Fortune 1,000
corporations.
As we move even further into the digital age, those
elements that comprise electronic commerce, networked systems,
and national infrastructure are increasingly at risk. In order
for this networked world to be viable and to be able to operate
without concern and with all the worries transparent to the
user, there must be an underpinning of robust security. Often
we take security for granted or, using traditional cost
analysis, will accept a certain level of risk as a cost of
doing business. However, in today's environment, the cost of
doing business without a strong security posture is too high.
Yet many are unaware of these costs. In order to understand the
new requirements of the digital age, governments and businesses
must understand that security can no longer be an afterthought
or redlined when budgets get squeezed. Security must be
integral to one's overall management picture.
To effectively manage security, one must manage risk. I
believe in the formula risk equals threat multiplied by
vulnerabilities and apply it to my own business decisions. You
can see that with zero threat no matter the vulnerabilities,
you will have zero risk. Likewise, if you have zero
vulnerabilities and a world of ``bad actors,'' you have zero
risk. Unfortunately, we have a great number of both, which is
driving the risk index skyward.
Vulnerabilities within our infrastructure are exposed on
almost a daily basis. The scale of the infrastructure affected
magnifies the impact of these vulnerabilities. Popular computer
programs that get larger distribution have a larger impact.
This has been demonstrated recently by a vulnerability that
allows the promulgation of Macro viruses via e-mail. Using the
risk formula, this vulnerability would not be an issue if it
were not for the immense threat we live with on a daily basis.
I believe the threat to our infrastructure is real. During
the hearings on security in cyberspace in June of 1996, Mr.
John Deutch did a great job of summarizing the threat and the
need for increased public awareness. Many companies and
government agencies have taken a skeptic's approach when
discussing threats. They will say, ``My network and systems are
running fine. I don't see any threat here.'' They lack the
ability to see the threat and, therefore, deny it exists. They
would be surprised to see, with an intrusion detection
package--or intrusion detection application on their Internet
perimeter, they would detect at least one unusual occurrence a
day.
A number of years ago, while on active duty in the Navy, I
was deployed aboard a submarine for a couple of months. Having
an interest in the sonar system, I asked one of the crew to
give me an overview. The young officer was very proud of the
system and said, ``If something were out in the water, we would
hear it.'' I caught him by surprise when I said, ``So, let me
get it straight. If you don't hear, it isn't there?'' I think
that overconfidence in current capabilities and the
unwillingness to ``think out of the box'' will lead to
complacency. You need to look before you can see the threat. I
support innovated efforts to look where no one has looked
before.
I'd like to share a couple of short stories, and I will
keep it to the first one in the interest of time. In early
1995, I was running a vulnerability assessment on a large
number of Internet connected systems operated by the Department
of Defense--a Department of Defense organization. During the
assessment, I entered a computer that was used by software
developers to maintain the source code for a communications
package. The source code was clearly unclassified, but it was
disturbing for me to know its only use was on a classified
network. A ``total systems'' approach was not used when
implementing a support structure for the communications
package.
Others have demonstrated similar events over the last
couple of years, and we'll still continue to have these
problems.
I'd like to address the Y2K vulnerability issue. A recent
newspaper article brought to light a problem of outsourcing Y2K
remediation and the threat of foreign nation states inserting
backdoors for future year. I believe this is a valid threat and
agree it needs to be addressed today. On the other hand, many
Fortune 500 companies have been outsourcing source code
development and maintenance for years. A large number of these
U.S. companies have permanent network connections into their
corporate networks to facilitate the work from overseas. I can
tell you that without intrusion detection or traffic analysis,
these foreign companies have the potential to run free and
obtain unauthorized access to U.S. corporate proprietary
information.
In summary, I would recommend programs that support a total
risk management approach to infrastructure assurance. I
recommend protecting the critical path and the life cycle of
high-value infrastructure, not just the end product. Keeping
vigilant in the search for vulnerabilities and new threats. I
fully support the requirement for collaboration between
government and commercial organizations. We will not survive as
a country without a framework of trust, dialogue, and
collaboration. I look forward to working with this Subcommittee
and others on this issue within the months to come.
Again, thank you for the opportunity to speak, and I'd be
happy to answer any questions.
[The statement of Mr. Rich follows:]
[GRAPHIC] [TIFF OMITTED] T0842.027
[GRAPHIC] [TIFF OMITTED] T0842.028
[GRAPHIC] [TIFF OMITTED] T0842.029
[GRAPHIC] [TIFF OMITTED] T0842.030
[GRAPHIC] [TIFF OMITTED] T0842.031
[GRAPHIC] [TIFF OMITTED] T0842.032
Chairwoman Morella. We thank you very much, Mr. Rich, and
it's now my pleasure to recognize Mr. Bennett.
STATEMENT OF WAYNE D. BENNETT
Mr. Bennett. Thank you, Chairwoman Morella, Chairman Horn,
members of the Subcommittee. My name is Wayne Bennett. I'm a
partner at the law firm of Bingham Dana, and I chair the
Commercial Technology Practice Area at our firm. Thank you for
inviting me to this hearing.
The nearly boundless creativity of the criminal mind will
likely one day result in a billion dollar computer fraud. But I
believe the apparent increased risk presented by the Y2K
remediation effort is more than offset by the improvements in
remediation procedures that have been implemented at large and
mid-sized companies precisely to deal with the behemoth Y2K
effort. When the billion dollar fraud occurs, its connection to
the Y2K remediation effort will be more in the nature of
serendipity than statistical inference, and law enforcement
will be in a better position to identify the perpetrator
because of the changes that the Y2K effort has brought.
Consider the recent testimony of Gary Beach, Publisher of
CIO Magazine, before the Senate Special Committee on the Y2K
Technology Problem. I'm a member of the CIO Magazine editorial
advisory board, and I can attest to the efforts that
organization has made to look past the Y2K hype and its
coverage. While the purpose of Gary's testimony was to report
the results of a Y2K tracking poll, Gary added a particularly
incisive thought at the conclusion of his remarks that one
positive legacy of the Y2K exercise is that many companies were
finally moved to undertake comprehensive inventories of their
information technology systems.
I would expand on that notion of a positive legacy. The
learning at many corporate IT departments, particularly at mid-
sized corporations, has been greatly enhanced since the Y2K
wake-up call went out. My clients are from diverse industries,
including banks, mortgage companies, manufacturers,
distributors, broker dealers, grocers, IT hardware, software,
and services lenders, and e-commerce companies. Many of them
contacted leading experts to teach their IT personnel the best
industry practices for implementing their Y2K projects, and
they're applying that learning to their maintenance activities
generally.
Before the Y2K exercise, systems maintenance was in some IT
shops just a tedious chore that was relegated to anonymous
junior programmers. Maintenance was a stepchild, and many IT
departments struggled with version control, documentation, and
accountability. Often IT personnel would open a source code
file and find no written clue regarding who worked on the code
last, what changes had been made, or even when or why it was
changed.
The best maintenance practices recently introduced by
consultants have a by-product. Many systems environments are
now more secure than they were just a couple of years ago. For
example, the introduction of project notebooks requiring formal
sign-offs by responsible employees and contractors have
employees staking their reputations on their work. Each sign-
off indicates that a software routine is ready and that it
successfully integrates into the larger system. Testing
naturally becomes more comprehensive. Validation efforts are
enhanced to ensure that no unwanted changes have been
introduced into the system. Internal and external auditors
review project notebooks as part of their Y2K and technology
operations audits. Reports are generated at each management
level until a summary is presented to the board of directors.
Visibility and accountability at every level has increased.
Security has been enhanced.
Trap doors and the attendant risk of major fraud have been
around since shortly after the beginning of commercial
computing.
Then you enacted the Computer Fraud and Abuse Act of 1986,
the Information Infrastructure Act of 1996, the Economic
Espionage Act of 1996, and the No Electronic Theft Act of 1997.
The criminal laws are in place. Now, with the introduction of
better maintenance practices, the forensic evidence is more
likely to be available to track down a wrongdoer.
A billion-dollar fraud is inevitable at some point since no
security system is completely airtight. But is it more likely
now as a result of the Y2K effort? I don't think so.
Consider the current criminal opportunity. With increased
scrutiny of every line of code, choosing this juncture to hide
nefarious software in systems is akin to the decision of a
second story man choosing to burglarize the police chief's
house. Some burglars may find the prospect challenging, but
most won't and those that do will find the going rather rough.
At the July 22nd Senate Y2K hearing, Senator Bennett put
the question of the reported increased security risk to a panel
of IT executives. The panelists acknowledged that the security
risk is increasing every day because of the increase in
computer usage generally. But they also responded that the
procedures implemented to perform Y2K remediation make them
more confident today that while they can never fully prevent a
security problem, they can at least better now detect a
security problem.
These procedures can fail, so we need to be ever vigilant
about security. But we should also be careful about any message
that we send to those thousands of employees and contractors
who are honestly and diligently trying to solve the Y2K
problem.
The Nation's IT personnel are right now working at a
breakneck pace doing thankless, yeoman's work against an
unforgiving deadline. If they succeed in their Herculean task,
some--perhaps even some here today--will question why we spent
billions of dollars on a crisis that never came about. If they
fail, they will be blamed.
At this point, I suggest that we let the security officers
quietly pursue their jobs while we lend all necessary support
to the employees and contractors working on the Y2K effort--
without any inadvertent suggestion from any quarter that any of
them might be criminals, even in the face of continuing risk.
The job of fixing the Y2K problem and the consequences of
failure are so enormous that the ongoing risk of fraud pales by
comparison. We should keep our focus over these next critical
few months.
Thank you for your time.
[The statement of Mr. Bennett follows:]
[GRAPHIC] [TIFF OMITTED] T0842.033
[GRAPHIC] [TIFF OMITTED] T0842.034
[GRAPHIC] [TIFF OMITTED] T0842.035
[GRAPHIC] [TIFF OMITTED] T0842.036
[GRAPHIC] [TIFF OMITTED] T0842.037
[GRAPHIC] [TIFF OMITTED] T0842.038
[GRAPHIC] [TIFF OMITTED] T0842.039
[GRAPHIC] [TIFF OMITTED] T0842.040
[GRAPHIC] [TIFF OMITTED] T0842.041
[GRAPHIC] [TIFF OMITTED] T0842.042
Chairwoman Morella. Thank you very much, Mr. Bennett. I'm
glad we, you know, ended with you because then you put another
perspective on the concept of computer security being
important, but not necessarily, I was going to say, increased
because of Y2K. I understand also you were at the--what used to
be called the National Bureau of Standards.
Mr. Bennett. Yes, I was.
Chairwoman Morella. Which is now NIST, which has been very
much involved with our computer security system and more
legislation coming up on that.
As you could tell, we do have a vote coming up. Maybe I
could start off by asking one question, and then we could
recess for about 15 minutes, if you'll all be here, and then
continue with questions. Unless you wanted to start off with a
question, Chairman Horn?
Mr. Horn. I'll be glad to, if you'd like. I don't know if
you want to go vote and then I can go vote and keep the show on
the road. Whatever you'd like.
Chairwoman Morella. All right. He's got a great idea. I
will go vote, and then he will keep this--keep it going, and
then I'll come back.
Mr. Horn. Mr. Bennett, I was interested when you said the
criminal laws seem to be in place. Is that true in every state?
Have we done an analysis of that? Mrs. Morella and I can
request the American Law Division to look at that now that
you've raised the question.
Mr. Bennett. Well, I think the federal laws are in place.
In fact, there was just a recent article in, I believe,
Computer World where a defense attorney based in San Francisco
was complaining that the federal laws are set up so that her--
this is not surprising--that her clients are having a tough
time going and are pleading out instead of going to trial
because they risk very severe criminal penalties. I do not
know, however, on a state-by-state basis what the answer is.
Mr. Horn. Any comments from anyone else here on that point?
Well, the $1 billion does catch a headline, and that's, I
think, more likely to be banks. What will happen with the non-
banks where you could not have money to move, is blackmail. And
the question would be: To what degree can we already cope with
blackmail, the disgruntled employee that was mentioned? No
question about it. You could--with a smart programmer, you
could have chaos within a computer system.
Mr. Miller. Mr. Chairman----
Mr. Horn. Mr. Miller.
Mr. Miller. Mr. Chairman, we had Mr. Scott Charney, who
heads the Criminal Division area of computer crimes speak at a
conference we cosponsored last week with George Mason
University. And Mr. Charney indicated in his public comments,
at least--and maybe the Subcommittee would want to contact him
directly, but I think I would agree with Mr. Bennett--that the
federal laws are pretty strict.
The challenge is finding the miscreants and prosecuting
them. But I think they feel that the laws are pretty strict,
and they've been fairly successful in prosecutions. State laws,
I don't have any information on them.
Mr. Horn. If it is blackmail and it isn't moving money
around from accounts here to accounts abroad and so forth, how
do we deal with the blackmail aspect?
Mr. Miller. They're both federal statutes, as I understand
it. I'm not a lawyer.
Mr. Horn. Have we had much computer security blackmail?
Mr. Miller. I've been told of stories anecdotally.
Nothing's been reported publicly.
Mr. Horn. Well, I realize it's like rare-book libraries.
They don't want to talk about it, and that was the mistake of
their life because now that they started talking about it, you
find these people. And the thief just had a field day, can walk
off with all the precious books, and they did it at Harvard and
Yale and my own university and so forth. But it just seems to
me we need a strategy here in educating chief executives. As we
went through the Y2K bit in the last year, one of the things
that discouraged me was the bad advice that their lawyers gave,
which was, Chief, don't say anything, then they can't do
something to you in court. Well, that's utter baloney because
they'll do you for not doing anything, and we really needed
CEOs to provide some leadership, which they finally woke up and
did.
But how would you deal with this in this way to get top
management to understand that they've got to do some strategies
and tactics here to protect themselves in the interest of their
stockholders?
Mr. Pucciarelli. Congressman Horn?
Mr. Horn. Yes?
Mr. Pucciarelli. If I could just say, in my opinion,
security is to computers what safety was to automobiles in the
1960s. We have a relatively immature technology, relatively in
the context of 20 and 30 years versus 100 years. And what goes
with a new technology is a certain exuberance and a denial of
some of those risks.
And I think what happens over time, the experience of using
the technologies, of understanding the consequences, and
understanding the implications will bring to light to the
executives and to the leadership of the organizations that use
these tools the risks. So rather than delegating the leadership
and management of these systems to technical specialists, the
executives will become more involved and more active in
establishing security procedures for the overall enterprise.
Mr. Horn. Now, with the Presidential Directive--by the way,
if you have your mikes still on, turn them off so we don't get
a feedback
On the Presidential Directive, how active has the security
community and the information technology community been helpful
in that? And where are we in the progress under the
Presidential Directive?
Mr. Miller. I think there's some good news and there's some
bad news there. I think the good news is that the various
government agencies are trying to come up with a plan. We saw a
leaked version of it in the New York Times very recently, an
article by Mr. Markoff which focused on just the privacy issue.
But there has been extensive consultation, and I do commend the
people in the government for trying to get as much industry
input as possible into the process.
As an example of bad news, though, Mr. Chairman, I'll give
you one specific example. We were designed by the Department of
Commerce, as I mentioned in my testimony, as the sector
coordinator for the information technology sector along with
the Telecommunications Industry Association and the U.S.
Telephone Association. That office within the U.S. Department
of Commerce is probably going to be defunded in the year 2000.
So, on the one hand, we are trying to undertake activities in
conjunction with the Department of Commerce agency. On the
other hand, the Department of Commerce, even though they did
request some money, apparently it's not a very high priority.
Congress hasn't seen it as a high priority. So we're going to--
may find ourselves on October 1st being designated by the
sector coordinator of an office that no longer exists.
Mr. Horn. Well, we thank you for alerting us because we
ought to keep on top of that.
I'm going to have to declare a recess now so I don't miss a
vote. So we're in recess until Mrs. Morella returns to chair
the meeting. Thank you very much.
[Recess.]
Chairwoman Morella. Thank you, gentlemen and others, for
bearing with us as we had two votes instead of one vote. And
matter of fact, one was on----
Mr. Horn. Patent policy.
Chairwoman Morella. Yeah, patent policy, which might
interest some of you.
Ms. Rivers is here from Michigan, and I guess I'll start
off with a question or two and then let Ms. Rivers ask any
questions.
Mention was made--I think you, Mr. Miller, mentioned the
Presidential decision, Directive 63, which was issued in May of
1998, and that explains the Administration's policy on critical
infrastructure protection. Incidentally, we had the first House
hearing on the critical infrastructures report. The
infrastructures include telecommunications, banking and
finance, and all the essential government services. The
directive requires immediate Federal Government action,
including risk assessment and planning to reduce exposure to
attack.
Maybe I'd start off with you, Mr. Miller, in responding to
this, but I want to hear from the others, too. In your opinion,
has the implementation of this directive been effective? And
why or why not? Does more need to be done?
Mr. Miller. The process has been a little slower than I
think many of us anticipated, but maybe that's all for the
good. The trial CIAO office, which everyone sort of chuckles
at, but the Critical Information Assurance Office, which has
coordinated the development of the longer-term plan, has been
somewhat slow, but they have to engage numerous federal
agencies. They have done a good job, Madam Chair, I believe, of
trying to engage industry and academia in getting input in the
development of that plan. So I think they are moving forward in
a reasonable pace to come up with a plan.
It's very tricky, though, because the exact lines of
responsibility between the private sector and government--there
may be differing views, as I suggested in my testimony. The
private sector may believe that the government needs to be less
involved, and some people in government want to be more
involved.
The point I mentioned to Chairman Horn while you were away
was some of the things that disturb us, for example, is the
government, to industry, is not necessarily someone we like to
work with all the time. I have a little bit of concern about
it. One of the departments, however, I think industry is most
comfortable with is the Department of Commerce. The Department
of Commerce in the National Telecommunications Information
Agency, headed by Assistant Secretary Irving, has
responsibility for this critical information issue, and we were
designated, along with two other associations, as a sector
coordinator for the IT industry.
But now it looks like they are going to have no money for
FY 2000. There was a request for a small amount of money, I
believe $3.5 million, for FY 2000, but, candidly, I don't think
it's very high on the Administration's priority list. And from
what I understand, with all the pressures that you all have to
cut domestic spending, that money may disappear.
So that's an example of where we thought there were good
plans in place to try to move forward, and we were excited
about the opportunity to be the sector coordinator for the IT
industry. But if that agency funding goes away and there's
nothing in Commerce for us to work with, then in some sense
industry's role is back to square one. At least my sector's
role is back to square one.
Chairwoman Morella. Would any of the other panelists like
to comment on that? I'm going to ask a question also that you
might want to respond to at the same time. Do you think we need
a computer security czar? I don't mean to overuse that term,
but somebody in the Federal Government such as the role that
John Koskinen has played with Y2K that will be an oversee also
of critical infrastructures, computer security. Mr.
Pucciarelli?
Mr. Pucciarelli. Congresswoman, first a quick comment on
the Presidential Policy Directive 63. In general, the entire
area of cyber warfare and security is moving extremely quickly.
It's very difficult to design a solution, just from an
engineering perspective to design a solution to address a
threat, and to do it and get it implemented in a timely
fashion.
If you look at the typical procurement cycle right now,
from the time an engineering solution is designed until it's
presented, run through for hearings, funded and implemented, it
could take 2 years. The problem is, is that it's difficult to
anticipate--it's virtually impossible to anticipate 2 years
ahead of the threat what needs to be done because this area is
moving so quickly.
So just one comment on that is just I would counsel you to
look at the time lines to actually acknowledge the threat,
design a solution, and implement it.
As far as your question on the computer security czar, I
think there's a plus and a minus. My own personal perspective
and the perspective of the GartnerGroup is that security is an
enterprise issue. It is not an issue that belongs dedicated to
somebody who sits in the back room of the organization or off
to the side in an ancillary role. So I think there's a risk
with setting up a czar in that it might be viewed as something
that is the domain of the technical specialists.
I think the challenge is how do we elevate security to an
executive issue and an executive priority, and if a computer
security czar was able to portray the issue with that type of
presentation, I think there's an opportunity to have a very
positive impact.
Chairwoman Morella. Mr. Rich.
Mr. Rich. I support his statement. I think having a
computer security czar would probably be not a good idea, that
security is part of an infrastructure, an enterprise
implementation, and that we need to support the current
infrastructure assurance directives that have been put out
there.
Chairwoman Morella. Mr. Bennett, would you like to comment
on----
Mr. Bennett. I think that anything that's done has to draw
some very clear lines between government and corporate
enterprises. I think that the prospect of a czar might actually
frighten some corporations who may have some operations that
are even part of what you might consider infrastructure. I
mean, I think that there are a lot of large corporations out
there that would be happy to just have government approve their
international use of very strong encryption methods and then
stay out of the picture as far as their own security is
concerned until such time as there is--where their own security
procedures fail, and then they'll want the help of law
enforcement officials to try to track down whoever did it.
Their biggest issues right now do not involve a billion-
dollar fraud. If they look past Y2K and they're talking about
people taking things from them, they're worried about
competitive intelligence.
Chairwoman Morella. Would either of you like to comment on
Directive 63?
Mr. Rich. I haven't been myself involved a great amount
with the directive. From what I've observed and talking with
others, I support Mr. Miller's comment on that it's moving
maybe not as fast as some would expect, but I think it's moving
in the right direction. And I've seen a lot of corporations now
starting to talk to the government. I like the idea of
collaboration and trust. Unless we can get the point across to
the commercial organizations that the government can help and
not mandate or dictate and more or less work together, I think
we'll get longer--further down the path.
Chairwoman Morella. I didn't mean to be rigid when I said
computer security czar. I guess I'm thinking to implementation
of current policies in terms of coordinating. There is no doubt
in my mind we lack that in the Federal Government, but we can
get into that in some other questioning.
I would like to now recognize Ms. Rivers.
Ms. Rivers. Thank you, Madam Chair.
Mr. Miller, I have a question regarding funding you raised
in your written commentary, and I apologize that I wasn't here
for the testimony. But in your written statement, you raised
concerns that the $3.5 million that is now being allocated for
CIIAP is inadequate in your view or barely adequate. Are you
aware that the Commerce, Justice, State bill, appropriations
bill that we're going to vote on this afternoon, zeroes out
that program? And what will the effects be of that decision?
Mr. Miller. I heard--I haven't actually seen the language
of the legislation, Congresswoman Rivers, but I heard that they
were going to zero it out. I think that would be most
unfortunate from the perspective of private industry.
Clearly, the issue of information security has spread
throughout the government--the Department of Defense, the
Department of Justice, National Security Agency, et cetera, et
cetera. And, by the way, in response to Congresswoman Morella's
question, I would support a czar for exactly that reason.
But, clearly, the government is perceived by many people in
industry as kind of threatening, particularly if you're talking
to national security people or law enforcement people. To the
extent the industry is comfortable, I think they're most
comfortable talking to the Department of Commerce, and so
that's a logical place for business to communicate. And zeroing
out that budget item from within NTIA I think would be most
unfortunate. Even a relatively small amount, $3.5 million, is
better than nothing, and I think the problem is--I've spoken to
Assistant Secretary Irving about this--is he's already had
severe budget cuts over the last 2 or 3 years, and if this
money gets cuts down, he can't find it to take out of hide
somewhere else. So I'd hope that the Congress would take
another look at that, and whether $3.5 million is exactly the
right number or not, I don't know. But I hope the Congress
would take another look at that and put some funding in there
because that would make industry much more comfortable in terms
of working with government.
Again, there's no disrespect to the FBI or the Defense
Department, but if we have to talk to somebody, it's a lot
easier to talk to the Commerce Department.
Ms. Rivers. Thank you.
Mr. Pucciarelli, I have a question for you. In your
comments, you talk about a 70 percent probability that there
would be at least one electronic theft of a billion dollars,
which--I may not have it right, but that would seem to be the
biggest theft in our history. I mean, I don't think we've ever
had a billion dollar theft. And you use the terminology that
really reflects sort of the science of statistics.
How did you arrive at that?
Mr. Pucciarelli. What we do, Congresswoman, is, as part of
our recommendations at GartnerGroup, we have a practice of
assigning a probability to a particular prediction. And the
reason that we assign probabilities is so that our clients have
an ability to take these predictions and appropriately factor
them into their business plans. The probabilities were not
scientifically derived. They were arrived--derived based on
judgment, and there is an explanation of the probability
process in my formal written testimony which has been submitted
to the Committee.
Ms. Rivers. How do you translate a probability--or a
judgment into a 0.7 likelihood?
Mr. Pucciarelli. A 0.7 likelihood, in terms of how we
explain that to our clients and advise that to our clients, is
we would say that you should assume that this is likely to
happen. If you--if it had a 0.8 probability as an example, we
would say assume it will happen. So with a 0.7 probability
there is still some risk that it won't happen. The range of
probabilities that we publish goes from 0.6 to 0.9.
The whole notion and the whole purpose of this piece of
research was to advise our clients to escalate their risk
management practices. And in the context of that, what we are
really saying with the probabilities is that we believe it's
likely that there will be at least one large outrageous theft.
Ms. Rivers. So what you're saying is it's really not a
scientific tool, it's a sales tool?
Mr. Pucciarelli. No. That's--not at all, Congressman. What
my point was, it's not a sales tool at all. What it is is it's
a way for management within our client organizations to
appropriately weigh the probability.
Ms. Rivers. That's what I'm trying to understand, given my
training, is how you are creating your probabilities, what you
are actually using that can be replicated by someone else.
Looking at the same data, can they come up with the same
conclusion?
Mr. Pucciarelli. The way that we actually create the
probabilities is based on--first of all, it is not data. It
is--it is qualitative interactions with our clients and
qualitative assessments of what's going on in the environment.
The intention of the probabilities is to factor them into the
management process within our clients. So the idea is that we
can give our clients a degree of confidence as to how sure we
are that this will happen.
Ms. Rivers. What are the elements that you weigh in coming
to this conclusion?
Mr. Pucciarelli. We look at three different major aspects
in forming a probability. First we do primary research, which
is to look at the specific area. And as I testified earlier, we
did that based on direct examination and in conversations with
our clients, what was going on in terms of the process itself.
We then review preliminary findings with our clients and ask
their opinions and their assessments of our recommendations.
Then the third and most important thing is, before we publish a
recommendation and assign a probability, we--as a community of
analysts, GartnerGroup has over 700 analysts review the major
policy statements, and as a community of analysts, we have to
agree on what those probabilities are, and we have to agree
what the major statements are.
So this forecast represents a consensus position of
literally hundreds of people within our organization to
support--and it has to agree with their qualitative and
quantitative observations as well.
Ms. Rivers. Okay. Thank you.
Thank you, Madam Chair.
Chairwoman Morella. Thank you, Ms. Rivers.
Chairman Horn.
Mr. Horn. I've had 5 minutes, so let everybody else go, and
then I'll have one question.
Chairwoman Morella. Mr. Turner from Texas.
Mr. Turner. I will yield to Mr. Horn.
Chairwoman Morella. Chairman Horn? I mean, I'll ask a
question.
Mr. Horn. Let me just ask one question. I've appreciated
the various papers you four gentlemen have submitted.
You've suggested, Mr. Miller, that we grade federal
agencies on computer security, much like we currently do for
the year 2000 work. And I'm just curious, What categories of
criteria in relation to this subject would you suggest and use?
Mr. Miller. I think, Mr. Chairman, your grading system the
last 3\1/2\ years or so for the government's reliability and
readiness for Y2K has been a tremendous tool toward driving
them toward the successes that you mentioned in your statement
earlier today, and you deserve a great deal of credit, as does
Congresswoman Morella, for focusing attention.
A similar system, I believe, could be developed. I'm not
prepared to give you the exact criteria, but things like the
percentage of spending on IT devoted to computer security, the
attention paid by senior management to computer security;
reports of intrusions and detections of intrusions could be
another metric that you could look to. So I think you could
get--probably put together a fairly straightforward and easily
agreed upon list of indicia that you could use to use your
excellent grading system, and I think that would help drive the
agencies toward more attention to this problem.
Mr. Horn. Where do--where are the data on intrusions kept?
Is it simply by agency? Does OMB have any information that
they've collected over the years?
Mr. Miller. There are two sets of data. There are data from
the private sector, which are reported to what's called CERT,
the Computer Emergency Response Team, at Carnegie Mellon
University. They're, of course, voluntary reports. And to go
back to Congresswoman Rivers' question about hard data versus
theoretical data, I do note that the number of incidents
reported to CERT has increased dramatically over the last few
years.
Within the government, my understanding is that they don't
necessarily share information among agencies, and that's one of
the issues being looked upon--looked at within the PDD-63, is
to exactly how do you make sure that all the information is
being shared appropriately among the agencies.
Mr. Horn. Are the Carnegie information--are those data
accessible?
Mr. Miller. In some cases, the specifics are accessible,
and sometimes it's just the generic numbers. I think one of the
biggest challenges that this issues faces, as Mr. Pucciarelli
was suggesting in his earlier comments, is how much willingness
is there among companies as they mature to share information.
Certain industries such as the financial services industry have
already been exposed. Citibank had a relatively large potential
theft several years ago, and so Citibank is now wanting to talk
about this publicly. You can get them to go to any conference,
any open meeting, and they'll come and talk about it. But if
you ask 99 percent of all financial institutions or other types
of organizations, ``Do you want to admit times that you've had
intrusions or thefts or breakdowns?'' most of them are going to
be totally silent, totally mum.
So one of the challenges we've had as an industry, Mr.
Chairman, is figuring out how to get companies to share
information in a way that will help everyone fight off other
potential intrusions and threats, but at the same time not be
concerned that proprietary information will leak out or that
their competitors will get an advantage or it will leak to the
press and hit the stock price, et cetera. So companies are
always trying to balance these two things off. It's not just
the legal issue which you raised before in regard to the Y2K.
It's a whole set of potential down sides to exposing
information as opposed to the one up side, which is to sort of
be a good citizen and by reporting the information about an
intrusion that you had, you may save somebody else or you may
help to protect the entire economy. And we are not yet at a
position, I think, where the leadership of business in this
country has made that balance of that equation and said in all
cases we will share information. And one of the reasons is that
they're not sure about sharing information.
Let me just bring one more specific problem to your
attention, is the Shelby amendment. I think industry supports
the Shelby amendment generally. We believe that federally
funded research results should be available to the public. And
what Senator Shelby has done is good. But my companies have
come to me and said, Now, what if we share information and
there's some kind of federal grant involved with the
organization that has that information and we believe it's
confidential and then a FOIA request comes in? Government FOIA
exemptions can't be used because it's a private sector
organization. Then what do we do?
So I think that's not--it's an unintended consequence of
the Shelby amendment which is something we're trying to puzzle
through right now.
Mr. Horn. Yeah, well, as you know, we're going to struggle
through on that, and you have to protect the people that, let's
say, are trying to win the Nobel Prize or something. We
shouldn't have their data all around and polluted. That will
get tested soon enough. And we don't want to discourage
science. On the other hand, we don't want to--in this
situation, we're talking about, we don't want to have sitting-
duck targets because they say, boy, look at all the entries
there, let's see if we can do it. And I suspect that's worrying
some. The Good Samaritan law has helped on the year 2000 a bit,
and industry plants have been working with each other, from the
best we can understand on that. I don't know if that's your
feeling or not. There's much sharing of information.
Mr. Miller. Definitely. But it took legal action to do it.
But, again, if Long Beach State, your former institution, set
up a classified center and encouraged companies to provide
information and they got Federal funding somehow, what does the
Shelby amendment do to that data? It supposed to be sanitized.
It's supposed to be protected within this research center
within the university. But can someone use--I don't know, but
the questions have been asked. Can someone use the Shelby
amendment to come in and say I want access to all that data?
And suddenly the whole confidentiality system breaks down, the
trust breaks down, and no one supplies information to the Long
Beach State center. We've lost the whole purpose of the
organization in the first place.
Mr. Horn. Are there any questions and thoughts that none of
you have mentioned that you now would like to make? This is at
least my wrap-up question. Mrs. Morella might have many more.
But just what are we missing that we haven't really focused in
on?
Mr. Rich. Mr. Chairman, I'd like to make a quick comment
there. In the spirit of PDD-63, rather than requiring--or
asking people to give you their particular data on break-ins,
if we take a baby step and say how about sharing threat
information-these are people that are trying to touch you and
look at your networks but not successful in getting in--that
would be a first step in establishing the trust relationship.
Mr. Horn. That's a good suggestion.
Chairwoman Morella. Thank you, Chairman Horn. That's great.
This is so reminiscent of Y2K when we talk about failure to
and concern about sharing information and the coordination that
is necessary. And, of course, we're talking about computer
security that is troubled particularly because of Y2K
compliance.
With regard to the Shelby amendment, it's interesting that
here we are in the room where the ranking member, George Brown,
is the one who's introduced the legislation to get rid of the
Shelby amendment, and, of course, I've heard from National
Institutes of Health and a number of other institutions like
that that are hoping that--Mr. Miller, that you can--we can
work out some kind of a compromise.
I--in terms of where information may come from, I can
remember years ago, GAO, you know, when they came out with
their list of high-risk areas, they had Y2K there, and they've
had computer security there for some time. That maybe another
source of information to have GAO do further reporting. And, of
course, they've done a number of reports on problems with
computer security, particularly in DOD. And I wonder, the
inspector generals, would they not also be looking at this, or
should we be telling them to begin to look at this? I don't
know if any of you are cognizant.
Mr. Pucciarelli.
Mr. Pucciarelli. Congresswoman, I think that the whole
issue of computer security could clearly fall into the domain
of the inspector generals, and I think that depending on which
agency is looked at, I think you'll see different degrees of
activity in the area. I think that there's clearly an
opportunity to raise the issue on the agenda of the IGs, and,
again, I'll come back to my point earlier. The real challenge
is how do we get the leadership of the organizations involved
as well.
Yes, the IG is the means by which to do it, but the
challenge is how do we get it to the executives.
Chairwoman Morella. And you mentioned--Mr. Miller, you
wanted to comment.
Mr. Miller. I agree exactly with what Mr. Pucciarelli is
saying. That's why I endorse your idea of the czar, as long as
the czar is conceptualized the way Mr. Koskinen has
conceptualized the role, not that the czar----
Chairwoman Morella. Right.
Mr. Miller [continuing]. Is to fix everything himself or,
if it's a czarina, herself; but that, number one, that person
has the authority to go directly to Cabinet officers and make
sure that the Cabinet officers personally are paying attention
to the issue; that that person has the ability to work with the
private sector by organizing them by sectors, as Mr. Koskinen
has done very effectively. He's not trying to fix the problems
with the electricity industry or the retail industry, but he's
working with the appropriate private sector groups to do that.
Also, he or she would be able to coordinate among the
different agencies, and, frankly, it's a little confusing to
the private sector to know whether we should talk to people at
the CIAO or Mr. Hamre at DOD or people at the NIPC or people at
Commerce. It would be a little bit easier to, if there were
someone who had a central role and also had access directly to
the President and Vice President, as I believe Mr. Koskinen
does on Y2K issues.
Chairwoman Morella. And looking at the private sector, Mr.
Pucciarelli, you mentioned in your statement that many firms
have not taken--you used the term ``adequate steps''--to secure
and audit the year 2000 remediation process. I wonder, what do
you mean by adequate steps?
Mr. Pucciarelli. Congresswoman, in forming this scenario
that I identified, one of somebody stealing a large amount of
money, I started from the premise that somebody would do it.
And then I posed the question back to my clients and said how
likely is this to happen. And the response back from the
practitioners in the field was that, in general, the level of
security in their opinion was not very high. And that was one
of the reasons why I went forward with this research and deemed
it appropriate to recommend to the executive leadership of the
various organizations to take as a given that this is a likely
event and to implement risk management activities, which was
really the underpinning of what my research was.
It basically said you as leaders of these organizations
need to implement risk management because the details--the
people that are actually doing it, the practitioners, believe
that there is a relatively high risk.
Chairwoman Morella. Is implementing an independent
verification validation process going to mitigate the problems
and the trap doors?
Mr. Pucciarelli. To implement a comprehensive security
program, we have to cover three specific areas. We have to
cover people, process, and products. And when talk about
people, a metaphor might be to look at the bar exam. If we were
to look at process, it might be the equivalent of the FDA
certifying a surgical procedure, or a process might be the
certification of a particular software development process. And
a product might be the equivalent of the regulation that DOT
has for automobiles to meet safety standards or, in the public
domain, the UL underwriting seal of approval.
To get true security, we're going to have to approach it
from all three fronts.
Chairwoman Morella. I'm glad you wanted to respond, Mr.
Bennett, because I really felt I had to give you an opportunity
to engage since your point is that it's not Y2K that is the big
problem with computer security. So, sir?
Mr. Bennett. Well, I think I stated my point on the
relationship. I think they're both very important issues. I
just don't see them--the statistical inference there. But with
respect to the independent audit and the IG's role, it seems to
me that the independence of both an IG or an outside auditor is
one piece and the only piece that should be independent of line
management. While auditing on the one hand has to be
independent, someone has to come in and say how good a job
you're doing, there are a couple of stages that have to come
before that, and those, if you're ever going to make this work,
it seems to me, have to be done by line management because they
have to believe in what they're doing.
Now, in defense, there may be a different weighing that
takes place. How much--there's a certain drag on productivity
that's going to happen when you implement extra security
procedures. You try to minimize it, but it happens. That--
where--how much of a drag on productivity you're willing to
tolerate may be different if I'm trying to keep secret the
Nation's defense secrets. At the same time, if I'm a
corporation and I am trying to keep competitive information out
of my competitor's hands, which is very important, there's a
different drag on my productivity that I might accept.
So line management, first of all, has to decide how
important is it and to what level are we going to protect it or
try to protect it. And then there has to be an implementation
process, all of which should stay within line management. And
only then, after you've done those two steps, it seems to me,
without sort of alienating line management, who you need to do
those two steps, then there's a role for an outsider to come in
and say, okay, how good a job are you doing?
Chairwoman Morella. Prioritize, organize, then verify.
Mr. Rich. I'd like to recommend that we take a look, as was
mentioned here earlier about process, that over a period of
time in my time working in the government we had process,
accreditation for systems for security. And over a period of
time, the accreditation process failed to work because it
wasn't updated, that we would do the checklists and everything
was great. I think as the IG goes through the process of
checking, somebody should be checking the IG. Maybe that's the
computer security czar that you mentioned, as an oversight
position, that we have to keep up with the technology that
we're looking at as we go through that.
Chairwoman Morella. Thank you.
Mr. Turner.
Mr. Turner. I was really interested in knowing what
suggestions any of you might have regarding how we might
strengthen law enforcement in this area. It seems that it's an
area that we're really very ill equipped to deal with. We don't
have the expertise in local district attorney's offices. I'm
not even sure we have it in the Department of Justice.
But I think we really--there seems to be a need to take a
good look at the existing criminal laws. Obviously, some of the
laws fit. Theft is theft, I guess, no matter how you accomplish
it. But in any of the intrusions that don't result in outright
theft of dollars, I'm just not sure that the penalties are out
there, the laws are out there to really effectively deal with
this, nor is there the expertise available to fully prosecute
what appears to me, from listening to your testimony, to be a
growing area of criminal activity.
Am I correct on that? And do any of you have any
suggestions you might----
Mr. Miller. I think that's a very important point, Mr.
Turner. We're working very close with the Justice Department
Criminal Division on this, and they have asked, for example, to
help us help them put together a list of experts, cyber
experts, that they can call upon for--when they need to do
prosecutions so that the Assistant U.S. Attorneys around the
country, when they're referred these cases, frequently do not
have the kind of expertise that they may have in securities
fraud or other kinds of more traditional non-digital fraud. And
so we are working with Mr. Scott Charney and Attorney General
Reno to help put together a list of those experts that the
Assistant U.S. Attorneys can call upon.
Also, I have been told that the Justice Department is doing
training for state and local officials on cyber crime,
detection, investigation, prosecution. But how extensive that
is, I don't really know. You can contact the Justice
Department. I don't have any data on how many--how many
training sessions have been done.
I understand that when they do offer them, they are heavily
subscribed, that there's clearly a lot of interest among law--
local law enforcement officials to get this kind of training.
But how extensive the training is currently, I don't know.
Mr. Bennett. Congressman?
Mr. Turner. Yes?
Mr. Bennett. I believe you have the laws. You have got your
Computer Fraud and Abuse Act. You have the Espionage Act, which
covers trade secrets, and both of those have attempt parts to
them.
You also have a fair amount of expertise. It is growing
within the Department of Justice, but there's a fair amount of
expertise. When we call up on behalf of our clients and there's
been a problem, we do not get a befuddled person who has either
no interest or expertise in the area. We're generally directed
to somebody who does that for a living.
I think the only problem we're running into is the usual,
and that is, you've got to have enough time and so you've got
to allocate scarce resources even in the Department of Justice.
And the way they've allocated it, to use one example, one of my
clients called up, and someone had scanned their ports looking
for a way in, and they were very concerned that some--a
specific competitor, in fact, might have been the one doing it.
And they wanted to get to the bottom of it. And when we called
up, it seemed to us that there was a bright line from the
United States Attorney's Office, and that was, really, if you
can show us that they got in, then that's going to put it into
one basket over here and we're going to have the time to be
able to address it. If, on the other hand, you don't know
because your firewall software maybe only tracks unauthorized
attempts and maybe perhaps doesn't track authorized entries
that might have been fraudulent, then we're--maybe you ought to
go the civil route and try to discover this by suing the ISP
and getting the name and then going after them and finding out
who it is on your own.
And, clearly, you don't want to go down both those paths,
and we could really understand it. We ended up going down in
this last instance, which was only a few months ago, going down
the civil route and finding out that it was some teenage
hackers attempting to get into a corporate--past a corporate a
firewall. But the laws are certainly there. The expertise is
there and growing, at least at the Federal level, and now it's
just a matter of putting in a priority because I think they
have enough to do with the actual break-ins at this point.
Mr. Miller. Mr. Turner, my staff reminds me that Senator
Leahy has introduced a bill to provide $25 million a year to
the Department of Justice for state and local cyber crime
training. So obviously Senator Leahy at least believes there's
not currently sufficient funds and is trying to increase that.
Mr. Turner. Thank you, Mrs. Morella.
Chairwoman Morella. Thank you, Mr. Turner.
It seems to me there could be a problem with companies
overseas and the kind of security because they haven't had a
check to do--an opportunity to do background checks of--and
this made by the more prone to computer security problems with
Y2K. Would any of you like to comment on that, maybe what we
could do about it? You look ready, Mr. Bennett, then Mr.
Miller.
Mr. Bennett. I believe this problem's been with us for a
while, and to try to put it in perspective, if you got three
different levels of folks you might engage--and they've been
engaged over the course of time, at least in corporate America,
to work on IT systems there, your own employees, your domestic
contractors, and then foreign contractors, and I would suggest
that at this moment in most states in the United States you can
learn not very much about your own new employees for starters.
So, yes, it is true that there could be foreigners or
contractors who could pose a definite threat to your IT.
But right now, in the position of any ordinary employer--
not the government but an ordinary employer, we're just not
permitted to get the kind of information you can get, and so I
have a live threat right with my employees.
A second quick point is that--put aside just for a moment--
I know it's not the scope here, but to try to put this in
perspective, you've got the threat to your IT systems, and yet
in many, many companies today, the most valuable information
that they have walks out the door every single day with their
employees. It is not sitting on their computer system.
So when they put this whole thing into perspective for, you
know, the billion dollar fraud over here and then the foreign
threat and then even the domestic contractor threat, then the
employee threat, what they're really worried about is: How can
I find out information about the people who are here? And,
moreover, where are they going to go? In the State of
California, for example, companies cannot use non-competes for
some good and wholesome reasons. And so that means that my
employee can leave today, go down the street to my competitor,
and use that information.
Mr. Horn. I missed the word there. Companies cannot use
what?
Mr. Bennett. They cannot use--in California, as an example,
one cannot include a non-competition clause in a contract with
an employee to say, look, for 6 months after you leave here
please don't go down the street--or you may not go down the
street to our competitor to do the same kind of thing.
Mr. Horn. As you were talking, I was thinking, the whole
evolution of Silicon Valley is when somebody walked out and
started their own firm. American productivity.
Mr. Bennett. Absolutely correct. And now--and we've gotten
a lot of great things from that. In addition, we've gotten
ourselves a rash of trade secret lawsuits.
Chairwoman Morella. It seems to me--you know how we have
the metal detectors going into buildings such as ours? What we
really need is a mental detector, and a mental detector would
probably take care of a lot of that problem that you mentioned.
Mr. Bennett. God forbid.
Chairwoman Morella. Okay. Right.
Mr. Miller.
Mr. Miller. Two brief points. One is that there's
currently, in addition to the overall challenge of the shortage
of information technology workers in our country, there's a
specific subset of that. There's a huge shortage of people with
sophisticated security training or the ability to carry out
these jobs. Going back to Mr. Pucciarelli's earlier point about
people being one of the critical three elements, it's very
important. I know a very large, sophisticated firm which is
doing a lot of work on a contract basis for the government has
1,500 positions to fill, and they have 1,000 people, and they
can't find the other 500 because, first of all, you can't use
foreign workers 99.9 percent of the time so you can't fall back
on H(1)(b)s or anything like that. You can't even fall back on
permanent residents. Most of the time they have to be U.S.
citizens. They have to have security clearance. They have to
have sophisticated training, et cetera, et cetera.
So that's a big job. I know Attorney General Reno and other
people are trying to focus on some kind of a cyber corps idea
where there'd actually be government incentives, scholarships
or a sort to encourage people to get the kind of sophisticated
training that they could become specialists in information
security. So I think that's an issue.
Also, on the international front, Chairwoman Morella, I
know that this is a huge issue in terms of laws. How do you
enforce the security laws? And right now the U.S. Government is
engaged in discussions with the G-8. Attorney General Reno I
know is discussing with other members of the G-8, but it gets
to be a huge issue in cyberspace. Let's talk about things like
child pornography and getting access. What laws do you use? Do
you let Muammar Qadhafi start issuing subpoenas for information
that it wants to get from AOL because it believes somebody in
Libya who's an AOL customer is violating the laws of Libya? How
do you enforce those kind of laws? So there's some incredibly
open-ended questions out there right now in terms of our cyber
crimes on the international front which are just at the
earliest, earliest stages of discussion right now.
Chairwoman Morella. Mr. Rich.
Mr. Rich. Yes. I'd like to mention a couple of months ago I
went to a national infrastructure protection conference out in
Denver, and I support the idea of Mr. Miller mentioning the
cyber corps approach. I think that would go a long way, similar
to the Peace Corps, in incentivizing those to bring up the
awareness within the security area. And then they have a little
payback to the government for helping them through school, or
similar.
Mr. Horn. If I might be yielded to for a question, I
probably haven't unloaded on you my feelings on when that visa
deal comes up. I was outraged by it. Why am I outraged by it?
Very simply, we've got a community college system--certainly in
California where it was founded, there's 107 campuses in
California and we've got a Silicon Valley and San Diego, Orange
County, and Santa Clara County, and popping up hopefully in
other counties. And they need to work together, and we should
not be importing people. We should be training our own people.
When I think of the classrooms I go to where students are
now exposed to computing, and it seems to me we're derelict
both in education in California--and I've unloaded on many of
the community college presidents and said, Where are you on
this? And where are the CEOs in Silicon Valley that ought to be
sitting down with them saying this is the kind of curriculum we
need if they're going to be helpful to us? That was the whole
purpose of the community college, was both vocational and
academic. And you need both to be a good programmer.
And I would hope that they would be working together so
they could get the trained force. These are $60,000 jobs, and
there are a lot of bright kids. Escalante showed that in the
Los Angeles schools, you can teach young people to be as good
as anybody, as good as they are at Harvard. And these students
proved they could do it. And that's what we ought to be doing,
but we need the equipment, which is--the state is always
behind, every state in the Nation is behind when it comes to
giving and granting and providing computer equipment. And if
you're going to work on new generations, this is where Silicon
Valley can take a tax writeoff, or wherever, and get something
out of it.
But your associations, it seems to me, would be very
helpful to be where you get these people together, both the
community college president and the CEO of a computer firm. We
shouldn't have to be importing people from all over the world,
and we shouldn't have to need a government program. I mean, the
best education deal in America are the community colleges.
There's very little tuition. At least in California it is; in
Texas it is. So why aren't we taking advantage of that? Are we
still going to just keep importing thousands of people? They're
all wonderful people, but what about our own people? That's
where I'm coming from.
Mr. Miller. Did you want a comment, or is that just an
observation?
Mr. Horn. Well, I'm just saying--I'd like a comment, and I
think--you know, where is that industry and where are those
educators to be linked up to get the job done?
Mr. Miller. Well, I do disagree with you on the immigration
question, but I don't disagree with you on your fundamental
point, Mr. Chairman. Our educational system is still an
educational system designed for the industrial age, not the
information age. And we are trying to work with community
colleges. In fact, I recently met with the President of the
American Association of Community Colleges to discuss potential
collaborative activities. We're also working with particular
outreach to minority communities. I think as you know, in the--
even though--for example, African Americans are 11 or 12
percent of the overall U.S. workforce; they're only about 5 or
6 percent of the IT workforce. So we're involved in some
initiatives in that area, also.
The challenge is to do both at the same time, though. It
does take time for people to be trained and educated, and we
have to incentivise them to come in. And I think that's why I
was suggesting that government, cyber corps or IT tax credit
training such as the legislation that Senator Conrad and
Congressman Moran have introduced to try to create incentives.
I do believe, Mr. Chairman, that community colleges are
much more responsive than universities are in terms of
adjusting their curriculum. And you have several in California
which have done--moved relatively quickly. But it's--I think
the late Governor of Florida once said, the only thing harder
to move than a cemetery was the university faculty. So I think
they find that trying to change, getting rid of Russian history
and political science department for computer science
departments isn't always easy; whereas, at community colleges
they can move quite quickly. And certainly you see places like
Contra Costa Community College. The one that's usually thrown
up as the best example is Maricopa Community College in the
Phoenix area where they work very closely with Motorola, Intel,
and other semiconductor manufacturing firms for training.
So I think we're getting there, Mr. Chairman. It's just
slower than we'd like.
Mr. Horn. Well, that's where you have to take these massive
systems because most of that is done at the local college, and
that's why I suggested the community college. There's more
flexibility for the reasons we all know than in the major
research universities around.
But if you're doing it, I think that's wonderful. We don't
need a government program to do it. We just need you guys on
the phone, and gals, to work it out.
Chairwoman Morella. I think we also need the partnerships
of academia and the business sector and even government, you
know, state government, maybe Federal Government in some way,
also being kind of part of that partnership. But we have,
Chairman Horn and I and Ranking Member Turner, been aware of
the personnel needs throughout this whole thing, Y2K, now
computer security, and we're trying to do something even
legislatively on that, too, to increase fellowships and, as you
mentioned, the cyber corps. We'll continue to work on that with
your help.
Just a wrap-up, if there are any comments from any one of
you, real briefly, in terms of what we should be doing now
since we have only that 149 days left to the end of--until we
reach 2000, recognizing whether Y2K has been remediated or not
with regard to computer security. Any final comments for us?
Mr. Miller. My only concern is--and I don't think this is
Mr. Pucciarelli's intention in releasing his report--is that
people don't move more slowly on Y2K because they're concerned
about information security. He's correct that information
security has to be part of your Y2K, but I hope no one who
reads that article uses that as an excuse not to do their Y2K
remediation. I certainly know that wasn't his intent. I know
that Gartner has been one of the strongest advocates for Y2K
remediation. But one could imagine a situation where someone
would misinterpret that message instead of the message being to
be more conscious of security and say, well, that's one more
excuse not to get my Y2K solution done. So I hope this hearing
will help to send the message that that is not the intention. I
assume Mr. Pucciarelli would agree.
Chairwoman Morella. Thank you.
Mr. Pucciarelli. Yes, Mr. Miller. I appreciate your
comments.
Congresswoman, one final thought that I have is that simply
reminding folks, reminding organizations, enterprises, and the
leaderships of those organizations of the need to redouble
their efforts and maintain the appropriate risk management
criteria while they complete their Y2K remediation activities.
And I think that even having this hearing on this matter has
served a very important purpose to that end. I think that
encouraging the various federal agencies and departments along
the same lines would also be of benefit.
Again, clearly our intention was not to suggest that you
should--that organizations should go slower, but to merely
point out that risk management activities have a role as well.
Chairwoman Morella. Thank you.
Mr. Rich, a final comment?
Mr. Rich. Yes, ma'am. I'd like to basically agree here with
both of the gentlemen here in that people shouldn't slow down,
they should pick it up a little bit and keep vigilant as we go
toward the year 2000. And I hope these hearings will allow
people to look at other aspects rather than just focus on Y2K
remediation.
Chairwoman Morella. Good point.
Mr. Bennett.
Mr. Bennett. I believe that if there are companies out
there that are still doing serious remediation and are not now
doing contingency planning, then they probably have even more
serious issues than worrying about that trap that's probably
been set somewhere in one of the other companies that's now
doing contingency planning.
Certainly a call has been made to the security officers,
and they need to pay attention, as they always have. I think
the message from this Subcommittee ought to be to keep focused
on the Y2K effort.
Chairwoman Morella. I want to thank all of you, and before
we adjourn, I just want to mention the staff that have been
very helpful always in contacting you and putting some things
together: J. Russell George, who's with the Government Reform
Subcommittee, Matt Ryan, Bonnie Heald, Grant Newman, Chip
Ahlswede, and Seann Kallagher; our Technology Subcommittee,
Jeff Grove and Ben Wu, and the clerk, Joe Sullivan. And there
are others: Michele Ash, Trey Henderson, Earley Green, Jean
Gosa; and the court reporter, Chris Bitsko. I think I covered
everybody. Good.
Thank you. You were just a splendid panel. I hope you'll
feel free to contact us at any point with any of your
suggestions or recommendations. And as usual, if we could--have
other members who may have questions and any other questions we
may have, if we may forward them to you. Great. Thank you.
The Committee is now adjourned.
[Whereupon, at 12:06 p.m., the Subcommittee was adjourned.]
[GRAPHIC] [TIFF OMITTED] T0842.043
[GRAPHIC] [TIFF OMITTED] T0842.044
[GRAPHIC] [TIFF OMITTED] T0842.045
[GRAPHIC] [TIFF OMITTED] T0842.046
[GRAPHIC] [TIFF OMITTED] T0842.047
[GRAPHIC] [TIFF OMITTED] T0842.048
[GRAPHIC] [TIFF OMITTED] T0842.049