**SENATE JUDICIARY SUBCOMMITTEE ON TECHNOLOGY, TERRORISM AND GOVERNMENT
INFORMATION HEARING ON**

**CYBER ATTACK: THE NATIONAL PROTECTION PLAN AND**

**ITS PRIVACY IMPLICATIONS**

**FEBRUARY 1, 2000**

**[INTRODUCTION]{.underline}**

The Senate Judiciary Subcommittee on Technology, Terrorism and
Government Information held a hearing on February 1, 2000 on Cyber
Attack: The National Protection Plan and its Privacy Implications.
Chairman Jon Kyl presided. Other Senators attending were Ranking Member
Dianne Feinstein and Robert Bennett

Witnesses were:

**[Panel 1]{.underline}**

John Tritak, Director, Critical Infrastructure Assurance Office

**[Panel 2]{.underline}**

Marc Rotenberg, Executive Director, Electronic Privacy Information
Center

Frank Cilluffo, Senior Policy Analyst, Center for Strategic and
International Studies

The General Accounting Office did not testify but did provide its
February 1, 2000 Statement for the Record, Critical Infrastructure
Protection, Comments on the National Plan for Information Protection,
GAO/T-AIMD-00-72.

The hearing focused on the privacy implications of the National Plan for
Information Systems Protection, which was announced by President Clinton
on January 7, 2000. The Plan was prepared by the Critical Infrastructure
Assurance Office (CIAO) which was established by Presidential Decision
Directive (PDD) 63 in May 1998. PDD 63 called for the preparation of a
detailed plan to protect our critical infrastructure against cyber
disruptions. The Plan, which is also entitled An Invitation for
Dialogue, is the first major element of a more comprehensive effort and
will be updated. The Plan can be accessed at the CIAO Web site,
[http://www.ciao.gov.](http://www.ciao.gov/)

[The remainder of this report includes key extracts from member and
witness statements, the GAO Statement for the Record and
questions/answers.](http://www.ciao.gov/)

**[STATEMENTS]{.underline}**

**CHAIRMAN KYL**

The United States is the most technologically sophisticated country in
the world. Today, virtually every key service in our society is
dependent on computer technology: electric power grids, air traffic
control, nuclear warning, banking, to name a few examples. Highly
interdependent information systems control these infrastructures. With
the benefits of technological advances comes a new set of
vulnerabilities that can be exploited by individuals, terrorists and
foreign nations.

Our enemies don\'t need to risk confronting our powerful military if
they can attack vulnerabilities in our critical infrastructure.
According to the National Security Agency, more than 100 nations are
working on information warfare tactics. There have already been a
disturbing number of attacks on U.s. information systems, exposing our
\"Achilles Heel\" to any potential adversary.

I am pleased the Plan calls for specific milestones with timetables for
securing our nation\'s information systems, although its goals are
modest and merely a first step. I hope the Administration considers the
Plan a living document that must be reviewed and revised with new
technological advances and discovered vulnerabilities.

In securing the critical infrastructures that provide our way of life,
we must be careful that it doesn\'t occur at the expense of civil
liberties. We need to update our current legal framework to reflect the
revolution in information technology - to strike the right balance
between security and civil liberties. The reality is that doing nothing
to enhance cyber security in fact erodes the privacy and civil liberties
of Americans by making private information accessible to any hacker with
a computer and a modem. The National Plan\'s implementation must
consider the reasonable privacy issues that need to be discussed and
appropriately balance them with security interests.

**RANKING MEMBER FEINSTEIN**

Americans like to think that the United States has not been invaded
since the War of 1812. But in fact the U.S. is invaded every day. A
foreign army once burned the White House and Capitol in this very city.
But now an intruder could cause even greater damage to our Government
without ever setting foot in the country. As U.S. Deputy Secretary of
Defense John Hamre has said, \"We are at war-right now. We are in a
cyberwar.\"

This war, however, is largely invisible-unless, of course, a cyber
attack succeeds.

I am eager to examine today how the Plan will work, what changes should
be made to it, and how we can assist the Government in realizing the
Plan\'s promise. We have an obligation to protect this nation from the
threat of cyber terrorism and information warfare in a way that
maintains and even strengthens America\'s privacy and civil liberties.

**SENATOR BENNETT**

This issue will increase in intensity and importance.

Senator Bennett showed a map of the Internet World with circuits
spanning the globe. He noted there are no oceans or continents on the
map. He said we are talking about a whole new universe.

Senator Bennett said there are two main problems with the Plan:

1.  The architecture of the Plan is flawed.

> a\. The FBI is given the coordination function. There is question of
> FBI expertise vs. DOD and NSA who have the key experience.
>
> b\. The Plan seems to focus on the hacker threat. The broader threat
> is terrorist organizations and eventually nation states.
>
> c\. Y2K emphasized contingency plans and system reconstitution. There
> is nothing in the Plan that focuses on this.

2.  The Plan makes it almost impossible to follow the money. \$2.4B is
    spread over 15 agencies. This makes it difficult to follow
    expenditures.

**Chairman Kyl** said they had raised the point at earlier hearings
about the need to provide a greater role for DOD in this area.

**Senator Bennett** said today if a hostile activity decided to take
down one of our key facilities, does the FBI defend? Who is responsible
for reconstitution of cyber assets?

**Chairman Kyl and Ranking Member Feinstein** stated, in the case of
computers that track oil shipments, who has the ability to respond if
there is damage to the computer system? They said there is need to
address why DOD was not given a greater role in the Plan.

**Mr. Tritak** said as you have pointed out, there are clear lines of
responsibility in the information age that do not reflect the
information age. When you go beyond the current structure, it is much
more complicated. Ninety (90) % of the infrastructure is privately
owned. Hope that the private sector will assume a key role.

**Chairman Kyl** said it is not very cost effective for industry to
build robust redundancy in their networks. There are vulnerabilities
that did not exist before. There needs to be analysis how DOD and NSA
fit in the equation.

**Chairman Kyl** said they had had not discussed the issue that brought
them there, the need to address privacy concerns. He said it is good
that Senator Bennett reminded them re the assumptions that need to be
considered.

**Mr. Tritak** said a key point was raised re the role that the Federal
Government might have in reconstituting our systems

**GAO STATEMENT FOR THE RECORD**

As stressed at this Subcommittee\'s October 1999 hearing on critical
infrastructure protection, our nation\'s computer-based infrastructures
are at increasing risk of severe disruption. The dramatic increase of
computer interconnectivity-while facilitating communications, business
processes, and access to information-has increased the risk that
problems affecting one system will also affect other interconnected
systems. Massive computer networks provide pathways among systems that,
if not properly secured, can be used to gain access to data and
operations from remote locations. While the threats or sources of these
problems can include natural disasters, such as earthquakes, and
system-induced problems, Government officials are increasingly concerned
about attacks from individuals and groups with malicious intentions,
such as terrorists and nations engaging in information warfare.

This Plan is an important and positive step forward toward building the
cyber defense necessary to protect critical information assets and
infrastructures. It identifies risks associated with our nation\'s
dependence on computers and computer networks for critical services. It
outlines key concepts and general initiatives to assist in achieving
these goals.

In doing this, the Plan addresses many of the same points we raised at
last October\'s hearing, including the need for improved standards,
strengthened evaluations and oversight of agency performance, increased
technical expertise, adequate funding, and improved incident detection
and response capabilities.

However, there are opportunities for improvement as the Plan is further
developed as well as significant challenges that must be addressed to
build the public-private partnerships necessary for infrastructure
protection. In particular, we believe the Plan should place more
emphasis on providing agencies the incentives and tools to implement the
management controls necessary to assure comprehensive computer security
programs, as opposed to its current strong emphasis on implementing
intrusion detection capabilities. In addition, the Plan relies heavily
on legislation and requirements already in place that, as a whole, are
outmoded and inadequate as well as poorly implemented by the agencies.

**PANEL 1**

**John Tritak**

Mr. Tritak emphasized this is Version 1 of the Plan that is also
entitled, An Invitation to a Dialogue.

Ninety (90) % of our critical infrastructure is owned by the private
sector.

Threats posed to our critical infrastructures by hackers, terrorists,
criminal organizations and foreign governments are real and growing.

The challenge is how to protect civil liberties and privacy in an
information age. We hope to continue to protect and uphold privacy
rights of American citizens.

President Clinton has increased funding on critical infrastructure
substantially during the past three years, including a 15% increase in
the FY 2001 budget proposal to \$2.0B.

The National Plan for Information Systems Protection, released last
month, represents the first attempt by any government to design a way to
protect those infrastructures essential to the delivery of critical
services including electric power, etc.

The current version of the Plan focuses mainly on domestic efforts being
taken by the Federal Government to protect the Nation\'s critical
cyber-based infrastructures. Later versions will focus on the efforts of
the infrastructure owners and operators, as well as the risk management
and broader business community.

President Clinton directed the development of this Plan to chart the way
toward attainment of a national capability to defend our critical
infrastructures by the end of 2003. The Plan establishes 10 programs for
achieving three broad objectives:

-   **Objective 1: Prepare and Prevent**

> [Program 1]{.underline} Government and private sector to identify
> significant assets, interdependencies and vulnerabilities of critical
> information networks from attack, and to develop and implement
> realistic programs to remedy the vulnerabilities while continuously
> updating assessment and remediation efforts.

-   **Objective 2: Detect and Respond**

> [Program 2]{.underline} Install multi-layered protection on sensitive
> computer systems including advanced firewalls, intrusion detection
> monitors, anomalous behavior identifiers, enterprise-wide management
> systems and malicious code scanners.
>
> [Program 3]{.underline} Develop robust intelligence and law
> enforcement capabilities to protect critical information systems,
> consistent with the law.
>
> [Program 4]{.underline} Provide a more effective nationwide system to
> share attack warnings and information in a timely manner.
>
> [Program 5]{.underline} Create capabilities for response
> reconstitution and recovery to limit an attack while it is underway
> and to build into corporate and agency continuity plans the ability to
> deal with information attacks.

-   **Objective 3: Build Strong Foundations**

> [Program 6]{.underline} Establish research requirements and priorities
> needed to implement the Plan, ensure funding and create a system to
> ensure that our information security technology stays abreast with
> changes in the threat environment.
>
> [Program 7]{.underline} Survey the numbers of people and the skills
> required for information security specialists within the Federal
> Government and the private sector, and take action to train current
> Federal IT workers and recruit and educate additional personnel to
> meet shortfalls.
>
> [Program 8]{.underline} Explain publicly the need to act now, before a
> catastrophic event, to improve our ability to defend against
> deliberate cyber-based attacks.
>
> [Program 9]{.underline} Develop the legislative framework necessary to
> support initiatives proposed in other programs.
>
> [Program 10]{.underline} Build mechanisms to highlight and address
> privacy issues in the development of each and every program.

**[Panel 2]{.underline}**

**Marc Rotenberg**

There is no disagreement about the need to keep our computers secure.

The Internet design provides in-depth security on the network.

Over the past decade the Government was largely responsible for
preventing the widespread availability of encryption and security tools
that would have made the nation\'s computer systems more secure and less
vulnerable to attack.

Largely in response to concerns raised by privacy organizations and
members of Congress about the original plan for Critical Infrastructure
protection, the new Plan discusses the privacy issue at some length. But
in the end the recommendations on privacy fall short when compared with
the enormous surveillance authority that will be given to the
Government.

Referred to a March 8, 1999 memo from Mr. Ronald D. Lee, Associate
Deputy Attorney General that was obtained under the Freedom of
Information Act and that is attached to his Statement. He said Mr. Lee
concludes the only way that the GSA could conduct the type of monitoring
contemplated in the FIDNET proposal would be if the Federal Government
would notify all users of Federal computer systems that they would be
subject to monitoring.

Mr. Rotenberg\'s statement said while Mr. Lee indicates that the Justice
Department favors this type of Government-wide \"no privacy\" warning
notice, that he (Mr. Rotenberg) wants to make very clear that privacy
organizations across the political spectrum would oppose such a proposal
as a violation of the spirit of the Federal wiretap statute, the plain
language of the Federal Privacy Act, and contrary to the Fourth
Amendment. U.S. law simply does not give the Government the right to
conduct such general purpose searches.

He said the FIDNET proposal, as currently conceived, must simply be
withdrawn. It is impermissible in the United States to give a Federal
agency such extensive surveillance authority.

**Frank Cilluffo**

Today our real assets are stored electronically, not in Fort Knox and
the targets are increasingly not Government and military installations,
but rather public and private computer network systems. Information
warfare extends the battlefield to incorporate all of society.

The threat spectrum ranges from \"ankle biters\" to nations, with
currently no readily available means to discern who is committing the
attack.

It is only a matter of time before there is a convergence between those
with hostile intent and techno-savvy, where the real bad guys exploit
the real good stuff.

As we contemplate methods of dealing with these threats it is important
to remember that our national security community and law enforcement
institutions were designed and established to protect our freedom, our
civil liberties and our way of life. We expect the national law
enforcement agencies to protect us from criminal elements within our
borders. We expect the Defense Department and the Armed Forces to
protect us from external threats. We expect the nation\'s intelligence
agencies to provide insight into the intentions and capabilities of our
adversaries and to provide advance early warning of threats to us.

It would be a mistake to place our national security and law enforcement
institutions in a position where they would have to compromise our
precious hard-won rights or infringe upon our privacy in order to
protect us. The worst possible victory granted cyber attackers would be
one that destroyed these values whereby we would become less open, less
tolerant and less free.

Concomitantly, we must recognize the many benefits of information
technology and understand that these benefits far outweigh any risks.
Thus, our policies in response to threats of any kind must not stifle
the engines of innovation that drive our economy and enhance our lives.
We cannot afford to over react or to put up too many \"virtual\" or
\"physical walls.\" If we do, the adversary wins by default because our
way of life has been lost.

We must be willing to commit real money to tackling the problem. While
the President\'s proposed budget for FY 01 is a good start, a vast
majority of the resources have already been earmarked and allocated in
previous budgets. I believe that more money should be devoted to
Government-wide programs (i.e. a more robust and complete PKI
infrastructure) and measures aimed at prevention and protection. While
there are no protective measures that are completely effective, the 80
percent solution will be sufficient to deter most attackers by
increasing the risk of detection or failure. By raising the bar higher,
we would then improve our \"signal to noise\" ratio and be better
positioned to address the more significant threats. Moreover, only
through leading by example can the Government realistically hope for the
private sector to commit the sort of resources expected from them.

**[QUESTIONS/ANSWERS]{.underline}**

**[Panel 1]{.underline}**

**Q.1 Chairman Kyl. He and Ranking Member Feinstein have been critical
of the speed in which the Plan has been produced. One of the key things
of the Committee is to determine if any new changes are needed to
protect the American public\'s privacy. Some are concerned this could
damage civil liberties. Will you describe the kinds of information that
will be collected by FIDNET?**

A.  Mr. Tritak. Really, are just getting off the ground. FIDNET has been
    characterized as many things. Currently an agency can install
    systems to detect intrusions. Only one agency may not be able to
    detect the extent of what is going on. The GSA center would serve
    the role of correlating information from one or more agencies to
    determine that something is going on. At this point, this is where
    the FIDNET is. We must further assess and develop how the system
    will function.

**Q.2 Chairman Kyl. What kind of data will be collected?**

A.  Mr, Tritak. We will look at data that could have a bearing on system
    operation. The definition is still underway.

**Q.3 Chairman Kyl. There are reports that FIDNET could include
telephone information.**

A.  Mr. Tritak. None is included at this time. Telephone companies are
    collecting certain information now. Certain patterns of behavior
    could be detected. What we are looking for is to identify patterns
    of activity that could indicate an attack. We would look at this
    area to ensure that privacy is not invaded. We are not looking at
    monitoring voice communications. We are looking at e.mail traffic,
    not voice traffic.

**Q.4 Ranking Member Feinstein. Agencies are to submit an annual
remediation plan?**

A.  Mr. Tritak. Yes. Will meet this by including items in the budget on
    what assets are required to protect systems.

**Q.5 Ranking Member Feinstein. GAO\'s draft report refers to inadequate
and outmoded legislation. Would you define what is outmoded?**

A.  Mr. Tritak. Would want to get back to you on this point.

**Q.6 Ranking Member Feinstein. Do you agree FIDNET should operate
within the current wiretap law?**

A.  Mr. Tritak. Will have to get back to you on that.

**Q.7 Ranking Member Feinstein.** **Do you see any issues under the law
with GSA serving in a central role?**

A.  Mr. Tritak. GSA has authority to oversee civilian systems. DOD has
    authority in its area.

**Q.8 Ranking Member Feinstein. Does FIDNET duplicate the NIPC?**

A.  Mr. Tritak. The original plan was to place FIDNET separate from the
    NIPC.

**Q.9 Ranking Member Feinstein. What are you going to do re overly broad
issues re information?**

A.  Mr, Tritak. There is an effort to raise awareness re standards for
    information security. Are working on best practices.

**Q.10 Ranking Member Feinstein. You mentioned plan to recruit students.
This will take a long time. Have you considered recruiting from the
private sector?**

A.  Mr. Tritak. The scholarship program will produce first graduates in
    2002.

**[Panel 2]{.underline}**

**Q.1 Chairman Kyl. Agree we must do a plan that does not inhibit civil
liberties. Think the Government needs to pay more attention to questions
in this area. He said the issue came about because of serious concerns
that had been raised. He asked Mr. Rotenberg if he could come up with a
recommended structure?**

A.  Mr. Rotenberg. Think this is a fair criticism of the Plan. Think
    there is a sense that this program was put together without
    considering the key issues up-front like privacy. Think we run
    serious risks by trying to erect national barriers.

**Chairman Kyl**. What we need is a proposal that deals with both
issues, the threat to information systems and the threat to civil
liberties that could result.

A. Mr. Rotenberg. Think the Plan must deal with privacy to ensure there
are safeguards to protect privacy.

**Chairman Kyl**. The question is the technology provides a new barrier
that must be bridged. Sometimes you have to bring the law up to date.

A.  Mr. Cilluffo. Think a genuine partnership that covers security,
    privacy and intellectual property is needed. Think the Plan must
    cover these issues. The development of this is crucial.

**Chairman Kyl**. What gives people the right to look for anomalies? As
reach different levels, must be able to address the issue. The challenge
that Mr. Rosenberg lays out is an appropriate challenge**.**

**Q.2 Ranking Member Feinstein. What is wrong with using the same
procedures used for wiretaps?**

A.  Mr. Rotenberg. Think this is the right procedure. Agree that both
    goals are important, but think there is risk that privacy could get
    pushed off the table. Have to consider privacy at the beginning.

**Q.3 Ranking Member Feinstein. Would you provide recommended
solutions?**

A.  Mr. Rotenberg. Think could put together a study group.

**Q.4 Chairman Kyl. What kind of limitations are we willing to have?
Would like to have you both back on points that are of interest to the
Committee.**

For further information or if there are questions, please contact John
Ray at (202) 501-3473 or [john.ray@gsa.gov](../john.ray@gsa.gov)