**Ken Silva**

**Testimony Before the**

**Senate Commerce Committee**

**September 20, 2006**

Good morning, Chairman Smith and distinguished Members of the Committee.
My name is Ken Silva and I serve as Chief Security Officer of VeriSign.

VeriSign operates intelligent infrastructure services that enable and
protect billions of interactions every day across the world's voice and
data networks. The company is headquartered in Mountain View, California
and it has additional corporate facilities in Virginia, Kansas,
Washington state and Massachusetts.

Thank you for the opportunity to testify today. I have a prepared
statement, which I would request be inserted in the record.

Internet Governance is not a topic that five years ago would have been
the subject of a congressional hearing. The Internet was still
relatively new and was not thought of yet as critical to our national
and economic security.

We have all witnessed, and learned, a lot over the last five years. We
have had tragic reminders that our critical infrastructure and national
symbols are targets. We have seen how not adequately preparing for
events can have disastrous consequences. And we have seen how questions
of who controls our critical infrastructure, such as the port issue, can
spark controversy.

And the United States is not the only country focused on Internet
Governance. In fact, a number of countries such as China, Cuba, and
Syria last year sought to shift control of the Internet over to the
United Nations or International Telecommunications Union. They did so
because they believe the United States has too much control over the
Internet.

Their efforts were not successful in large part due to the outstanding
efforts by the State Department and Commerce Department. These
countries, however, have not given up on their goal.

Internet Governance is an important issue today because the Internet is
critical to our national and economic security. The technology of the
Internet has transformed personal communications, banking and finance,
government process and manufacturing. Twenty-five percent of America's
economic value moves over network connections each day. If the Internet
were to go down for a just few hours, we would lose hundreds of millions
of dollars of economic activity. If it went down for several days, U.S.
economic activity would be severely curtailed; payrolls would not be
met, securities transactions not cleared; invoices not paid.

So whether it's Wal-Mart, the House of Representatives or a Soccer mom
checking email to see if today's practice is still on, we all rely on
the Internet.

The dramatic rise of Internet usage bears that out.

The dot-com bust gave the illusion that Internet growth slowed down, but
in fact it has grown at remarkable rate. At the height of the dot-com
boom in 2000, for example, roughly 250 million people used the Internet.
Today, according to Internet World Stats, more than 1 billion users
worldwide rely on the Internet, a 300 percent increase since 2000.

So, there are two questions we would pose today:

-   Is the Internet able to meet the growing demands on its
    infrastructure?

-   Is the Internet secure and reliable?

VeriSign's role in supporting the Internet's infrastructure gives us a
unique perspective on the Internet, and these questions.

VeriSign operates two of the 13 authoritative "root" server operation
centers that direct Internet traffic, including, at the request of the
U.S. Commerce Department, the \"A\" Root Server. In this server, we
maintain the authoritative address list of all Internet top-level
domains. VeriSign also manages the "dot COM" and "dot NET" domain
registries. These are the central data bases that enable you as an
Internet user to simply type in a domain name on your computer, such as
\"verisign.com,\" and connect it over the Internet to the machine that
hosts the proper Website.

Let's start with the first question: Is the Internet able to meet the
growing demands on its infrastructure?

The answer is yes, as long as we continue to promote investment in the
infrastructure. The explosion of Internet-enabled devices and
applications -- text messaging, music downloads, VoIP, Blackberries and
device-to-device communications -- has created exponential growth in
Internet traffic far surpassing the increase in users. While users have
increased 300 percent since 2000, the volume of traffic on .com and .net
has increased 1,900 percent.

VeriSign is proud of the fact that the .com and .net systems have had
100 percent uptime seven years straight. To support these functions,
VeriSign has invested hundreds of millions of dollars into building a
global network of computers that are a critical component of the
Internet's infrastructure.

VeriSign is not alone in this. There are more than 250 domain registries
in the world -- for domains such as .fr for France, .de for Germany and
what are called generic top-level domains such as .info, .org and .biz.
All of these domains have registry operators that like, VeriSign, must
operate and invest in critical infrastructure to keep the systems
running smoothly.

It is therefore essential that a framework is in place for all operators
that drives operational excellence so we can meet the coming demands for
the Internet, such as broadcast quality video and other real-time
high-bandwidth applications.

Now, to the second question: Is the Internet secure and reliable?

While the Internet has operated remarkably well we can never get lulled
into a false sense of security. What makes for good security today is
vulnerability tomorrow. We must continually probe our weaknesses and
invest and strengthen our networks.

This very growth of Internet users, broadband capacity and number of
Internet-enabled devices has created an opportunity for hackers,
organized criminals and even more serious terrorists to attack our
networks. Some do so for technical trophies, some for political
objectives, but today, most bad behavior on the Internet is done for
financial gain.

In fact, the very devices and increased bandwidth that make the Internet
more robust and user friendly are being deployed to compromise the
Internet. Now that computers are always-on, they are easily accessible
to hackers and other abusers to hijack. And the increased bandwidth and
computing power available literally gives hackers more ammunition to
utilize against the infrastructure:

-   Regular PCs are being hijacked to mount these attacks. According to
    CipherTrust, more than 180,000 PCs are illegally hijacked each day
    and turned into zombies.

-   Hackers are utilizing the computing capacity available to their
    advantage. While a Jupiter Research report in 2004 found that the
    typical home needed less than 3 Mbps of bandwidth, that level has
    steadily grown and given the demands of gaming and video that
    capacity is expected to grow to 57 Mbps by 2009. That means that
    hackers will have 19 times the computing capacity available to them
    in the PCs they hijack in that period.

Let me give you some historical examples of what types of attacks we as
a community have experienced.

In October 2002, the Internet community got a wake-up call when the 13
DNS root servers, which serve as the heart of the Internet addressing
system, came under heavy denial of service (DoS) attack. In these
attacks, the hackers send countless bogus inquiries to domain-name
servers, which are computers that direct Internet traffic. By sending
phony website requests to these servers, they overload and disable them,
making websites unavailable.

These attacks significantly impaired the operations of several of the
root servers. The industry stepped up, and today an attack of that scale
and type would be a blip on the radar.

But hackers never give up innovating. In early January 2006, for
example, a hacker systematically disabled over 1,500 websites using
hijacked PCs. In these attacks, the hacker didn't directly attack the
domain-name servers. Instead, they sent their traffic to a legitimate
server with a DNS query and a forged source address.

In this case, the hacker also made the DNS query larger, by a factor of
70 times, which amplified the attack and further disabled the victims
servers.

These hackers used approximately hijacked PCs to target their victims
over a six-week timeframe. And the scary part is the hacker used a small
fraction - 32,000 of 500,000 PCs (or just 6 percent) - available to
them. This could have been much worse, but it was still severe enough to
significantly disrupt the operations of 24 registry operators as well as
hundreds of businesses.

These attacks remain under investigation.

The lesson learned is that we must be prepared against all threats.
VeriSign, for example, has invested over \$250 million in the Internet
infrastructure and expects to continue to invest tens of millions of
dollars in the near term to strengthen it against potential attacks.

To put that investment in perspective, VeriSign today can manage 10,000
times the capacity of Internet traffic that it handled in 2000.

**[Looking Toward the Future]{.underline}**

The Internet is made up of a number of entities that all must work
together. The root servers serve at the heart of Internet enabling
Internet traffic gets to the right address, over 250 domain name
registries around the world ensure that each of the domains is
operational, service providers such as Earthlink provide service to
businesses and consumers, and registrars provide the services that
consumers use to register domain names.

The task of maintaining the technical coordination of these sometimes
disparate layers falls on ICANN, which gains its authority through a
memo of understanding, or MOU, with the Department of Commerce.

The Internet community's challenge is to promote innovation so that
consumers can do more while strengthening the infrastructure.

In the last year, several steps have been taken by the Internet
community to ensure a strong Internet. Progress has been made on
introducing internationalizing domain names and expanding both number of
Internet addresses available. ICANN has also established a framework for
registry operators that both rewards strong performance provides
incentives for investment and imposes safeguards for consumers.

ICANN has implemented new agreements for the .net and .mobi agreements,
and proposed new agreements for .com, .info, .biz and .org that
incorporate these principles. These agreements, for example, give the
operators flexibility to increase prices while protecting Internet users
by, in some cases, imposing limits on the levels of increases and
requiring a six-month notice so consumers could lock in at existing
prices.

This new framework advances the objective of security and stability by
ensuring the necessary investment into the critical infrastructure.

Finally, the question comes to ICANN itself. At the heart of the
question is ICANN's independence and what that means for the core
infrastructure of the Internet. ICANN has taken steps, through its
registry agreements, to become more financially independent. Under the
old model, one industry controlled ICANN's budget and that was an
unhealthy system.

ICANN has taken steps to get additional funding from the registries
without conditions, which means it will have more independence.

To conclude, Mr. Chairman, the last five years have brought painful
lessons on the importance of preparation. The Internet has worked -- in
fact, been taken for granted - because we have stayed a step ahead of
both the dramatic rise in Internet traffic as well as the nefarious
efforts to do it harm.

We must not lose that vigilance and continually take steps to strengthen
the Internet so it remains reliable and always available.

Thank you for this opportunity to testify.