SENATE COMMITTEE ON THE JUDICIARY SUBCOMMITTEE ON ADMINISTRATIVE
OVERSIGHT AND THE COURTS

**HEARING ON**

**"ADMINISTRATIVE OVERSIGHT: ARE WE READY FOR A CYBER TERROR ATTACK?"**

# February 13, 2002

## INTRODUCTION

The Subcommittee on Administrative Oversight and the Courts of the
Senate Judiciary Committee held a hearing on February 13, 2002 on
"Administrative Oversight: Are We Ready For A Cyber Terror Attack?"

Subcommittee Chairman Charles Schumer conducted the hearing. Senators
Charles Grassley and John Edwards attended the hearing.

The hearing was a briefing on "Administrative Oversight: Are We Ready
For A Cyber Terror Attack? that was provided by Dr. Richard Clarke,
Special Advisor to the President for Cyberspace Security and Chairman of
the President's Critical Infrastructure Protection Board.

This report includes extracts of key information from Chairman Schumer's
opening statement, Dr. Clarke's briefing, and questions/answers
following the briefing.

## CHAIRMAN SCHUMER'S OPENING STATEMENT

In the immediate wake of September 11, we began addressing the most
obvious and most pressing security risks our country faces. Airline
security became a top priority. We quickly began a closer look at our
ports, nuclear power plants, utilities and other vulnerable sectors.

But one area that's been largely overlooked, at least in our public
analysis, is cyber-security. And when I say cyber-security, I'm not just
talking about the risk of our email going down for a few weeks. In the
past few weeks, I've started reviewing where we are on cyber-security
and, the answers are terrifying.

Some have described us as being vulnerable to a digital Pearl Harbor.
Frankly, I fear we're on the verge of a digital Armageddon.

### A well-planned and well-executed cyber attack on America wouldn't just mean the temporary loss of e-mail and instant messaging. Terrorists could gain access to the digital controls for the nation's utilities, power grids, air traffic control systems, and nuclear power plants.

We need to talk about the risks we face, we need to develop immediate
solutions, and that's what we'll begin accomplishing today.

As we'll soon hear from Mr. Clark, we're vulnerable on two primary
fronts.

First, we're vulnerable physically. The bulk of the actual hardware that
makes electronic communications work in this country is stored in a
shockingly small number of locations. All of the fiber optic wire
connecting us to Europe and the Middle East funnel into a mere two
locations in lower Manhattan. Roughly 80 % of Internet traffic routes
through fewer than a dozen facilities across the country.

A successful attack on any of these locations could have a devastating
effect, and yet we've done little to adequately protect them. We need
more security at those facilities.

Second, We are vulnerable technologically. Hackers can break in and take
over systems. I'm not just talking about the impact on the local server.
Terrorists can use viruses to shut down commerce in this country with
potential overwhelming impact.

We now know that North Korea, Iran, Iraq and China, are all training
people in Internet warfare. Hostile foreign nations are sending students
to American universities to learn computer science so they can use it
against us. And we're doing nothing about it.

This is scary stuff. The question is, what are we doing about it? The
answer is: not nearly enough. That's why we're holding this briefing and
that's what I'm looking forward to discussing today.

**[DR. CLARKE'S BRIEFING, ADMINISTRATIVE OVERSIGHT: ARE WE READY FOR
CYBER TERROR ATTACK?]{.underline}**

In the past we have looked at enemy capabilities.

Now, we are starting with our vulnerabilities.

Our basic infrastructures have migrated to networks including the
Internet. Every part of our economy is run by computer-controlled
networks. This includes manufacturing and public utilities.

A limited number of digital control systems run utilities throughout the
world. These never considered security in their initial designs.

No one had assumed people would use software vulnerabilities to bring
down systems.

Hamas and Al Queda have not yet attacked the Internet. There is evidence
from the caves that Al Queda was exploring the Internet.

We have seen 14-year old hackers.

Now, we have nation states including Iran, Iraq, China and North Korea
developing capabilities.

Most of the damage to date has been done to the Internet. Viruses have
been extensive including NIMDA and Code Red.

The following have occurred in the last 90 days:

-   The President has directed that a National Strategy for Critical
    Infrastructure Protection be written with the private sector,
    including banks, etc. We hope to have this completed by late spring
    or early summer.

-   The Presidential budget for security is up very significantly.

-   There is a major breakthrough in thinking at major companies. They
    have declared a major change in designing systems by placing
    increased emphasis on security features up-front.

-   We have agreed to set up a central control center for multiple
    agencies.

-   University scholarships for IT security have been established.

-   We have agreement with companies to work together on cyber threats.

-   Air traffic control will be handled separate from the Internet.

-   Established the capability to model critical systems to evaluate
    vulnerabilities.

## QUESTIONS/ANSWERS

**Q.1. Chairman Schumer**. Why have we been spared by attempts against
our crtical infrastructure?

A.  Dr. Clarke. We don't know what we don't know. Would bet that our key
    networks have been penetrated. We have to assume that cyber
    penetration has been accomplished. Do think we will be seeing cyber
    attacks in the future.

**Q.2 Chairman Schumer**. Appears cyber attacks or capabilities have
moved to nation states.

A.  Dr. Clarke. There are things we can look for in the way of
    signatures to help confirm traffic origin.

**Q.3 Chairman Schumer.** Do we know if the rogue states are attempting
this?

A.  Dr. Clarke. What we have seen is attempts to gain information such
    as what we have seen with the Al Queda. Much information on many
    things is available on the Internet.

```{=html}
<!-- -->
```
A.  Dr. Clarke. Anybody that engages in information warfare has to be
    aware that we will respond.

```{=html}
<!-- -->
```
A.  Dr. Clarke. It is very easy to hide tracks on the Internet.

**Q.4 Chairman Schumer.** How good are the new security objectives of
industry?

A.  Dr. Clarke. The objective of key companies including Microsoft and
    Oracle is to improve the design of new software to improve security
    with the objective of emphasizing security requirements in the early
    stages of software design.

**Chairman Schumer**. How long will it take companies to accomplish
this?

A.  Dr. Clarke. Companies such as Microsoft will stand down. Microsoft
    is standing down for 30 days to make the changes.

**Q.5 Senator Grassley.** Almost all of our critical infrastructure is
in the private sector. There have been concerns about the private sector
sharing information with the Government. Found that the National
Infrastructure Protection Center (NIPC) was late in sharing information
on the "I Love You" virus with the private sector. Because of problems
in sharing information, should the NIPC be moved from the FBI to the
National Security Council or the Office of Homeland security?

A. Dr. Clarke. In 1999 and 2000, NIPC was having difficulty in sharing
information. There is a new management team at the NIPC that has made a
turnaround. The NIPC is working well now and think should continue at
the FBI.

A. Dr. Clarke. The only way we know about certain attacks in industry is
through the rumor mill.

A. Dr. Clarke. Suggest an amendment is needed to the Freedom of
Information Act to help limit release of key or proprietary information.

**Q.6 Chairman Schumer.** What would be the impact of computer viruses
on our transportation infrastructure?

A. Dr. Clarke. Our trains would stop nationwide or stoppage could occur
within grids.

**Q.7 Chairman Schumer.** What about Air Traffic Control.

A. Dr. Clarke. It is separate.

**Q.8. Chairman Schumer**. What about the rest of Government? How out of
range are we with our IT security expenditures?

A. Dr. Clarke. Private sector is much further along in developing best
practices.

**Q.9 Senator Edwards**. We need to do more work in Government on
security. Are we doing what is necessary in the private sector? Training
work force of the future must be emphasized.

A. Dr. Clarke. The average IT company needs to ask if it is spending
enough on security to improve the security of its products.

A. Dr. Clarke. With regard to research and education, we are woefully
behind on this. We need to develop improved Master's programs. The
National Science Foundation has expanded its IT security scholarship
program to more schools with a security curriculum. A problem is keeping
faculties up to date with latest technologies.

**Q.10 Chairman Schumer**. What about physical damage to key targets?

A. Dr. Clarke. Our review of the War in the Gulf found we had not done
enough analysis. DOD has a small program to analyze electric grid and
telephone systems. They have found there are very limited accesses.
State and private sectors need to do more on this. The simulation and
modeling center can help with this.

A. The Executive Order signed by the President includes responsibilities
for physical security as well as electronic security.

**Q.11 Chairman Schumer.** What about armed forces?

A. Dr. Clarke. DOD is in early stages of this to include rerouting
circuits.

**Q.12 Chairman Schumer.** What about training? Are we being more
careful about students from rogue countries?

A. Dr. Clarke. Justice and INS are moving to work on this. Computer
sciences courses in schools are not yet on the watch lost.

**Q.13 Chairman Schumer.** Do we need to make more positions subject to
Congressional Review?

A. Dr. Clarke. Do not look forward to increased oversight.

**Q.14 Chairman Schumer.** How is the Government doing in recruiting
more people?

> A. Dr. Clarke. Very few people are willing to make financial
> sacrifices.

**Q.15 Chairman Schumer.** What do we need to do?

A. Dr. Clarke. Think may need to make this (security) an exempted
service.

**Q.16 Chairman Schumer**. What about a Cyber Corps or IT Corps?

A. Dr. Clarke. We have a small program for IT security. Think this
program is doing well and should be expanded to IT in general.

**Q.17 Chairman Schumer.** Is coordination with other branches still a
problem?

A. Dr. Clarke. There has been a management change at NIPC. The
President's Executive Order requires sharing information. Also,
coordination has improved since September 11, 2001.

**Q.18 Chairman Schumer.** Is there a plan to bring more people together
at a single location?

A. Dr. Clarke. Yes. We will bring a group together.

If there are questions, please contact John Ray at (202) 501-3473 or
<john.ray@gsa.gov>.