**Embargoed Until 2:00 pm EDT Contact: Betsy Holahan**

**October 20, 2003 202-622-2960**

**Testimony of\
Wayne A. Abernathy\
Assistant Secretary for Financial Institutions\
Department of the Treasury\
before the\
Subcommittee on Oversight and Investigations\
Committee on Financial Services\
U.S. House of Representatives**

Good afternoon Chairwoman Kelly, Ranking Member Gutierrez, and members
of the subcommittee.  Thank you for this opportunity to testify today
about the resiliency of the U.S. financial system. I am here today
representing not only the Treasury Department, but also the Financial
and Banking Information Infrastructure Committee (FBIIC), which is
chartered under the President\'s Working Group on Financial Markets. The
FBIIC is charged with improving coordination and communication among
financial regulators, enhancing the resilience of the financial sector,
and promoting communication and coordination with the private sector
entities that make up and operate within our financial services sector.
I represent the Department of the Treasury in chairing the committee. I
want to thank all of the members of the FBIIC for their dedication and
excellence in executing the mission set forth in our charter.

An old proverb suggests that experience is not always the kindest of
teachers, but it surely is the best. Following significant threats to
the financial infrastructure, the FBIIC makes it a practice to review
what has happened, what went well, what did not, what can we learn, and
what do we need to do. The FBIIC conducted such a review following
recent events and compiled a written report, the "Impact of the Recent
Power Blackout and Hurricane Isabel on the Financial Sector," which the
FBIIC is releasing to the public today. I have submitted a copy of the
report together with my remarks.

The U.S. financial system is remarkably resilient, as reaffirmed by such
recent events as the Northeast power outage of August 14 and 15,
Hurricane Isabel, and increasingly severe cyber-attacks. This resilience
comes from many sources. One of them is vigilance. We have to continue
to work to improve the resilience of the critical financial
infrastructure of the United States and the other critical
infrastructures with which it is connected, such as the energy,
telecommunications, and transportation infrastructures.

I would emphasize that our approach has been to begin and end by relying
on the private sector. A central insight of the President's strategy to
secure our critical infrastructure is that the infrastructure in this
country is largely owned by private businesses. This is certainly true
in the finance and banking sector. Accordingly, we pursue virtually all
of our objectives in close collaboration with the private sector. I am
especially pleased, therefore, that you have invited several important
leaders of the private sector to this hearing to testify.

Both in preparation for potential disruptions to the financial
infrastructure and in responding to actual threats, we are guided by
four principles, in order of importance.

First, and most important, we must remember in all that we do to protect
our financial infrastructure, that it is always about people. It is the
people that make our financial institutions work, people that designed
the systems, people that make them successful, people that innovate to
keep them fresh and dynamic, and it is people whom they are designed to
serve, people who rely upon financial services for so many aspects of
their daily lives.

Second, because it is about people, it is about confidence. Our
financial institutions operate on confidence, but they also promote
confidence. In fact, confidence is what our financial institutions must
provide, confidence that financial transactions will be carried out,
that checks will clear, that bills will be paid, that investments will
be made, that insurance promises will be kept. The confidence provided
by financial institutions and their services play a big part in helping
to cope with the trauma of disaster.

Third, essential to that confidence is open markets, financial
institutions open for business, doing their business, allowing Americans
everywhere to engage in their business, even during---especially
during---times of stress. It is important for financial institutions and
markets to continue to operate as close to business-as-usual as
possible. During times of stress, investors need to price the effects of
that stress on assets. The longer they are prevented from pricing the
impact, the more anxiety builds and the worse the consequences will be
when markets eventually re-open.

The fourth guiding principle is that we want to promote decentralized
decision-making and problem-solving, both as we prepare for disruptions
and as we weather them. In the event of a disruption to the payments
system, for example, we want the payments systems experts to fix it. We
do not want them to wait for guidance from Washington. Just fix it. The
subject matter experts who are on the ground and in the field are in the
best position to determine what steps should be taken to protect
employees and customers. We will help where we can and where we need to,
but we intend to leave the responsibility with the financial
institutions and the regulators that are closest to the problems to find
the solutions. Initiative and ingenuity are the most powerful tools to
deal with any disruption, and we must give full room for their exercise.

**Impact of the Power Outage of August 14-15, 2003**

On Thursday, August 14, at approximately 4:11 pm, large areas of the
Northeast lost power, including New York City, where a large amount of
the U.S. financial infrastructure is concentrated.

The U.S. financial system handled the outage well.

The bond market and major equities and futures markets -- with one
exception -- were able to open the next day for business at their usual
trading hours.[^1] The one exception, the American Stock Exchange, was
able to open for a short, but important, trading session just prior to
the normal market closing hour on Friday. Neither the Department of the
Treasury nor any of our companion financial regulators received any
reports of lost data, significant failed transactions, or other similar
problems at individual institutions, exchanges, or the financial
utilities that serve them.

Major market participants also performed well by keeping their systems
up and running using power supplied by back up generators. The next day,
major market participants traded in the currency, bond, equities, and
futures markets. Although there were isolated reports of
telecommunications difficulties between market participants and the
markets or news services that supply real-time market data, the problems
were minor and the participants and their telecommunications suppliers
resolved these problems during the day.

Banks and credit unions also performed well. Although most branches and
ATMs within the affected area were closed on Friday, there were no
reports of lost or compromised data. In general, customers were able to
briefly defer their banking transactions with little economic impact.
The Federal Reserve System was fully prepared to make additional
currency available to satisfy any increased demand for currency once
power was restored. However, there was no significant increase in
demand, and the Federal Reserve System did not need to implement fully
its plan.

**Impact of Hurricane Isabel, September 18-19, 2003**

On September 18 and 19, some parts of the financial system were tested
again, as Hurricane Isabel made landfall in North Carolina and moved
across the Mid-Atlantic States. Isabel's impact on the financial system
was significantly less than the impact of the power outage. For one
thing, Isabel passed to the south and west of New York City and the
surrounding metropolitan area, where much of the U.S. financial system
is concentrated. For another, due to advanced weather reporting, the
hurricane was not a surprise and the financial system had days to
anticipate Isabel and prepare for its arrival.

Although the impact of Isabel was less significant in degree, it was
quite similar in kind to the impact of the power outage -- both resulted
in widespread disruptions of electric power and the businesses that
depend on it. However, the storm neither adversely affected the
financial markets nor the major participants in those markets.
Similarly, although many bank and credit union branches and ATMs lost
power, there was no significant economic impact from this: people did
their business before the much-anticipated storm, postponed their
business until power was restored, or drove to a nearby branch or ATM
that had power -- with no instances of lost or compromised customer data
reported.

**The Resilience of the U.S. Financial System**

There are several reasons why the U.S. financial system fared so well in
the face of the severe challenges posed by the power outage of August
14-15 and the somewhat less severe challenges posed by Isabel.

First and foremost, the men and women who work in the financial system
did an extraordinary job. During the outage, many of these people stayed
at their posts at financial institutions to ensure both that their
systems preserved and processed data from trading on Thursday and that
their systems would be prepared to resume trading the next day, on
Friday.

Almost immediately after the power went out on Thursday, financial
institutions began asking themselves not whether they would open for
business the next day, but how they could best serve their customers'
needs once open. By 6:00 pm on Thursday the major financial markets
publicly stated that they would be open for trading during normal hours
on Friday. This commitment to serve customers even in times of adversity
is important. It gives customers confidence in using the U.S. financial
system and, in turn, helps promote rational financial decisions by
institutions and their customers.

I wish to note an important point in this regard. Financial institutions
decided [on their own]{.underline} that they would open for business the
next day. They did not wait for guidance from Washington. They did not
ask for permission to serve their customers. They decided for
themselves. They knew how to serve the best interests of their
institutions and their customers, and they acted accordingly. This is
precisely the sort of private sector leadership and responsibility that
we are promoting, and we were gratified to see it work so well during
the power outage.

Third, financial institutions and their employees were well-equipped to
continue their businesses in the face of challenges such as the outage.
While no one foresaw the specific nature and dimensions of the power
outage, careful planning and preparation helped financial institutions
survive it. After the power went out, many institutions relied on these
plans to switch to power supplied from back-up generators; and, in some
cases, to switch to back-up data processing facilities located outside
the impacted area. Although such planning and preparation has long been
part of the best practices of running a safe and sound financial
institution, it also reflects the benefits realized by the financial
services sector as a result of increased investments in contingency
plans, procedures, and equipment. Financial institutions have more
alternative options available to them than they had in the past. During
August 14-15, these investments paid off.

Fourth, good communications helped to remove uncertainty and maintain
confidence. The President's early expression of confidence in the
ability of officials, businesses, and citizens to weather the outage
helped build resolve and maintain calm. Mayor Bloomberg and his team
also did a superb job of providing a range of emergency services and
communicating the impact of the outage and their response clearly and
confidently not just to the citizens of New York, but to the world.
Financial institutions communicated well among themselves and with their
regulators.

Finally, the regulators communicated efficiently and effectively among
themselves and with the private sector. For example, shortly after the
power went out, Treasury convened a conference call of the FBIIC,
waiting just long enough for regulators to gather detailed information
about the impact of the outage on Thursday's activity and the likely
impact on Friday's activity. This conference call provided an early
opportunity for the regulators to share information about the impact of
the outage on each of their regulated sectors. As that information was,
in turn, passed to major participants in the sectors it further helped
the industry manage the impact of the outage. As another example, the
private sector counterpart to the FBIIC, the Financial Services Sector
Coordinating Council (FSSCC), convened a series of conference calls that
enabled the financial sector to gain valuable, up to the minute
information about power restoration which helped them prepare for the
next day's activities.

**Lessons Learned and Next Steps**

Although the U.S. financial system weathered the power outage of August
14-15 and Isabel well, the Department of the Treasury and our companion
financial regulators in the FBICC have extracted some lessons learned
and identified steps to take next as we work with our partners in the
financial industry to further improve the resilience of the U.S.
financial system.

**Need for Additional Work on Inter-Dependencies**

The power outage highlighted some of the inter-dependencies of our
critical infrastructure. The critical financial infrastructure, while
extremely resilient, is also dependent on other infrastructures
including energy, telecommunications, information technology,
transportation, and others. These interdependencies were made all too
clear by the attacks of September 11, 2001 when a vault containing a
large number of telecommunications lines was destroyed. Financial
institutions that purchased redundant lines from multiple carriers were
surprised to learn that because many of the lines were routed through
that same vault, they had much less telecommunications redundancy than
they thought.

Since September 11, the financial industry and the telecommunications
industry have made important strides toward improving the resilience of
the telecomm infrastructure on which the financial services industry
depends. For example, some exchanges, the key financial clearing and
settlement facilities , major market participants, and
telecommunications companies have created a dedicated, self-healing
telecommunications network. More work is underway in this area

Another important interdependency exists between the financial services
sector and the information technology sector. By many accounts, the
financial services sector is one of the largest consumers of information
technology products and services. The financial services industry uses
information technology not only to operate critical business processes,
but also to communicate with its customers and, in many cases, to
distribute products. This use of information technology contributes, of
course, to the remarkable productivity, ingenuity, and resilience of the
U.S. financial system. At the same time, the heavy reliance upon
information technology renders the U.S. financial system -- like the
financial system of many other nations -- potentially vulnerable to
cyber attacks. Over the past nine months, worms and viruses like
Slammer, Bugbear, and Sobig.F, have challenged administrators of
financial institutions' computer networks. Moreover, these attacks are
not only becoming more sophisticated, they tend to spread more quickly
and are occurring with greater frequency. It is clear that the financial
services sector is an attractive target. For example, the Bugbear worm
specifically targeted over 1600 financial institutions around the globe,
with the apparent intent not just to disrupt transactions, but to steal
funds.

Much work is underway to protect our critical financial infrastructure
from cyber attack, and I would like to share some of these efforts with
you.

As the first line of defense and responsibility, financial institutions
shoulder the job of minimizing the vulnerabilities within their own
systems. This responsibility is reinforced by the financial regulators,
whose examiners inspect banks and other institutions for safe and sound
practices, including "technological safeguards" required under Section
501(b) of the Gramm-Leach-Bliley Act.

To assist in the promotion and communication of best practices, as well
as to assist in the dissemination of advisories, the Financial Services
Information Sharing and Analysis Center (FS-ISAC) is expanding the reach
of its communications network to nearly every financial institution. The
Department of the Treasury was pleased to support the FS-ISAC in the
development of this next-generation plan, and we look forward to
supporting the FS-ISAC as it implements the plan.

Moreover, to assist in crime deterrence and apprehension of cyber
crooks, the Treasury has been pleased to support and work with the
United States Secret Service as it creates electronic crimes task forces
across the nation. Just last week, my Deputy Assistant Secretary for
these issues participated in the official roll-out of such a task force
in Cleveland. We look forward to continuing efforts with Director Basham
and others in the United States Secret Service in this important area.

Still more needs to be done to protect the financial sector from cyber
attack. Two immediate priorities include reducing the number of
vulnerabilities introduced into software products and addressing
potential vulnerabilities introduced by the business practice of
domestic and international outsourcing of customer service, data
management, and software development.

**Conclusion**

The U.S. financial system is more resilient today than it was a year
ago. The men and women who work in the system help make it so. Our job
is not finished. It is a big job. To paraphrase Winston Churchill, we
are not at the end, or even the beginning of the end. But we might be
nearing the end of the beginning. Americans and the world can rely with
increasing confidence on the U.S. financial system.

-30-

[^1]: The bond market, through the Bond Market Association and with the
    support of the Department of the Treasury, closed at 2:00 pm on
    Friday to provide bond traders and the employees who support them
    additional time to get home. At the time, it was unclear when subway
    and train service would be restored, and most anticipated a
    difficult commute.