**REPORT ON**

**SENATE GOVERNMENTAL AFFAIRS COMMITTEE**

**HEARING ON**

**HOW SAFE IS OUR CRITICAL INFRASTRUCTURE?**

**SEPTEMBER 12, 2001**

**[INTRODUCTION/SUMMARY]{.underline}**

The Senate Governmental Affairs Committee held a hearing on September
12, 2001 on How Safe is our Critical Infrastructure? The hearing was
conducted by Chairman Joseph Lieberman. Other Senators attending the
hearing were Ranking Minority Member Fred Thompson, Carl Levin, Robert
Bennett, Thomas Carper, Mark Dayton, and Jim Bunning.

The hearing had been scheduled prior to the tragic events at the
Pentagon and the World Trade Center on September 11.

Witnesses testifying were:

Roberta Gross

Inspector General

National Aeronautics and Space Administration

Joel C. Willemssen

Managing Director, Information Technology Issues

General Accounting Office

Other witnesses, who were from out of town, had been scheduled to
testify but were unable to attend because of the commercial air stand
down.

A series of hearings on critical infrastructure topics are planned by
the Committee.

Significant points discussed during the hearing were:

-   Although agencies are cooperating, it has not been a high priority
    in agencies to follow-up on Presidential Decision Directive (PDD)
    63, which was signed by President Clinton in May 1998.

```{=html}
<!-- -->
```
-   GAO\'s reviews continue to show continued security weaknesses in
    Federal computer systems.

```{=html}
<!-- -->
```
-   Legislation, similar to what was enacted for Y2K, is needed to allow
    information sharing between companies on critical information
    protection issues without fear of breaking antitrust regulations.

The remainder of this report includes key points from member opening
statements and witness statements and questions/answers.

**[OPENING STATEMENTS]{.underline}**

**[Chairman Joseph Lieberman]{.underline}**

A series of hearings on critical infrastructure are planned. The
hearings will explore the extent our infrastructure is vulnerable and
what must be done to improve things.

Yesterday\'s attacks open a new era for critical infrastructure
protection. We must be prepared to protect against opponents who will
use various weapons to attack our infrastructures. Future attacks will
be aimed at paralyzing our infrastructures.

This is not a new issue to the Committee.

Senator Robert Bennett urged that the Committee hold this series of
hearings.

Chairman Lieberman asked the rhetorical question, do we need an agency
or department of homeland defense?

**[Ranking Minority Member Fred Thompson]{.underline}**

The Soviet Union has been replaced by different threats\--rogue nations,
terrorists and combinations of both of these.

The Hart-Rudman report and the report of the commission Governor Gilmore
is chairing (Advisory Panel to Assess Domestic Response Capabilities for
Terrorism Involving Weapons of Mass Destruction) are especially
appropriate. As late as January 31, 2001, the Hart-Rudman report said
attacks on this country in the next quarter of century are much more
likely.

Our efforts are fragmented, our borders are porous, and the cyber threat
is much more focused. We have to change our way of looking at this.

The word he is getting on the Government\'s response on computer
security is not good.

**[Senator Robert Bennett]{.underline}**

Yesterday was an attack on our infrastructure. The net result of the
attack was a stand down of our commercial airlines and financial trading
could not go on. Also, think about the loss of records and securities in
the proximity of the World Trade Center. The economic devastation will
take billions of dollars and much time to repair.

The question is how well organized is our country to respond.

PDD 63 was the first attempt to get the Government arms around the
critical infrastructure issue.

The Goldwater-Nichols Act was very successful in achieving the
organizational flexibility the Department of Defense needed to wage the
War in the Gulf. A similar Act may be needed for critical
infrastructure.

Suggest we need to reorganize our Government, the Executive Branch and
the Congress, to deal with critical infrastructure issues.

Senator Bennett had a large briefing chart he had prepared to show the
overall critical infrastructure organization in the Government. It was a
very busy chart.

**[WITNESS STATEMENTS]{.underline}**

**[Roberta Gross, NASA IG]{.underline}**

(Ms. Gross is responsible for coordinating the critical infrastructure
review that is being conducted by agency IGs for the President\'s
Council on Integrity and Efficiency.)

The nation must have an effective response to terrorist attacks to
ensure continuity of operations for our Government and the nation.

The annual independent review and reporting requirements of the
Government Information Security Reform Act (GISRA) dovetail with what is
needed to implement PDD 63.

The IGs have found through their reviews there has been a start, but
they also found that PDD 63 has not had a high priority in agencies.

Not all agencies began to implement PDD 63. Some mistakenly believed
that PDD 63 only applied to the specific agencies listed in the
Directive and its addendum.

Agencies were told they were required to achieve a level of security
preparedness, or \"initial operating capability\" (IOC) no later than
December 31, 2000. Agencies were not provided a uniform definition of
IOC, and there was no consistent implementation.

The Federal organizations primarily responsible for implementing PDD 63
did not coordinate and manage their activities. The absence of
coordinated oversight and management of PDD 63 has caused certain
fundamental elements of the Directive to receive less than adequate
attention.

Some agencies have not performed vulnerability assessments of their
critical infrastructure assets or prepared the related remediaton plans.
This occurred because the budget requests that the agencies submitted to
OMB were rejected by OMB as not sufficiently detailed to justify funding
the agencies\' Critical Infrastructure Plans (CIPs) requirements.

The agency I.G.s made general suggestions to OMB based on their
findings. Generally, these suggestions related to the need to better
define terms, measures and expectations set forth in PDD 63 and the need
to ensure better coordination among the entities and organizations
responsible for PDD 63 implementation.

**[Joel Willemssen, GAO]{.underline}**

Overall, GAO\'s reviews continue to show continued weakness in Federal
computer systems.

Believe the key underlying problem has been ineffective program
management.

OMB will soon receive the first agency reports (annual) from the
Government Information Security Reform Act (GISRA).

A key element of the strategy outlined in PDD 63 was establishing the
National Infrastructure Protection Center (NIPC) as a national focal
point for facilitating the Federal Government\'s response to
computer-based incidents. The NPIC has initiated a variety of critical
infrastructure protection efforts that establish a foundation for future
government-wide efforts. However, the analytical and information-sharing
capabilities that PDD 63 asserts are needed to protect the nation\'s
critical infrastructures have not yet been achieved. We made
recommendations to the Assistant to the President for National Security
Affairs and the Attorney General regarding the need to more fully define
the role and responsibilities of the NPIC, develop plans for
establishing analysis and warning capabilities, and formalize
information-sharing relationships with private sector and Federal
entities.

Since 1996, our analyses of information security at major Federal
agencies have shown that Federal systems were not being adequately
protected from computer-based threats, even though these systems
process, store and transmit enormous amounts of sensitive data and are
indispensable to many Federal operations.

Our most recent analysis, last April, of reports published since July
1999, showed that Federal computer systems continued to be riddled with
weaknesses that put critical operations and assets at risk. Weaknesses
continued to be reported in each of the 24 agencies covered by our
review.

**[QUESTIONS/ANSWERS]{.underline}**

**[Q.1 Chairman Lieberman.]{.underline}** Take it that PDD 63 has been
inadequately implemented, and, as a result, our country is vulnerable.

A.  Ms. Gross. Agencies are cooperating. Why have agencies not come up
    with minimum critical infrastructure requirements? It has not been a
    priority in Agencies to follow-up on PDD 63.

**[Q.2 Chairman Lieberman]{.underline}**. What do you think are the most
critical issues?

A.  Mr. Willemssen. (1) Must identify roles of key players. (2) Being in
    a position strategically to understand the threat and have a warning
    capability. (3) Stepping back and defining the extent of the most
    likely threats. (4) If high threat and high risk, must be in a
    position to plan and organize a response. The program has been slow
    in evolving with the private sector.

**[Q.3 Ranking Member Thompson]{.underline}**. Must guard against all
threats. Problem is multi-faceted. Noticed you have pointed out a lack
of leadership. Why is this so difficult?

A.  Mr. Willemssen. As noted on Senator Bennett\'s chart, we have a
    complex organization.

**[Q.4 Ranking Member Thompson.]{.underline}** How do we break through
concerns of private industry? The Y2K legislation we had re industry
coordination and sharing information is an example of what is needed to
obtain greater support and participation by industry. Note that the GAO
has done nine reports on information security. Also, note that GISRA is
up for renewal because it was passed as an amendment to the Paperwork
Reduction Act, which is up for renewal.

**Q.5 Senator Bennett.** I do have a bill that is patterned after the
Y2K bill on information disclosure by industry. Do you agree that we
need a bill like this to share information?

(**Special Note**: Senator Bennett introduce his bill on 9/24/2001;
S.1456, Critical Infrastructure Information Security Act of 2001, which
will exempt industry from antitrust regulations if information is shared
with other companies on critical infrastructure protection and will
establish procedures for agencies to safeguard information received from
industry. Rep. Tom Davis, Rep Jim Moran and Rep. Pete Sessions
introduced H.R. 2435, Cyber Security Information Act, on 7/10/2001,
which has the same objectives as Senator Bennett\'s bill. A hearing has
not been held on H.R. 2435 as of 9/26/2001.)

A.  Mr. Willemssen. Agree this is needed.

**[Q.6 Senator Bennett.]{.underline}** We need to think strategically on
this area. One of criticisms of PDD 63 is that it placed the FBI, a law
enforcement agency, as the primary coordination link with industry.
Believe the primary responsibility for coordination with industry needs
to be reassessed.

A.  Mr. Willemssen. The GAO has gotten in to the root level with its
    penetration testing. This kind of information must be shared on a
    protected basis so that others may learn.

```{=html}
<!-- -->
```
A.  Ms. Gross. We need to get the attention level higher. Think this
    Committee is a real key tool.

**[Q.7 Chairman Lieberman]{.underline}**. Want to discuss private sector
involvement.

A.  Ms. Gross. You have a lot of interrelated systems which creates
    vulnerabilities.

**[Q.8 Chairman Lieberman]{.underline}**. Is there a partnership with
Government and industry?

A.  Ms. Gross. Think the legislation that Senator Bennett mentioned is
    needed. Also, companies should not be putting products on the market
    with known vulnerabilities before they have been adequately tested
    and retrofitted. A very important consideration is companies do not
    like any publicity on problem areas.

```{=html}
<!-- -->
```
A.  Mr. Willemssen. The level of activity with different infrastructure
    areas varies. Some are more advanced in their implementation.
    Suggest from an oversight standpoint that you need to look at the
    lead agency agreements with industry sectors to see the extent that
    coordination has been established.

**[Q.9 Senator Carper.]{.underline}** Understand that some segments of
the infrastructure have done a better job with security.

A.  Mr. Willemssen. Banking and Finance is near the top of the list.
    Electric power has a strong coordinating organization.

**[Senator Carper.]{.underline}** What are the weak ones?

A.  Mr. Willemssen. Public health requires attention. Transportation
    requires more focus.

**[Q.10 Senator Carper.]{.underline}** What advice do you have?

A.  Mr. Willemssen. GISRA is an example of legislation to hold agencies
    responsible. Committee must hold agencies accountable.

**[Q.11 Senator Carper.]{.underline}** What about legislation that has
been introduced?

A.  Mr. Willemssen. S.803. E-Government act of 2001, which would
    establish a Federal CIO, is very important.

```{=html}
<!-- -->
```
A.  Ms. Gross. Y2K program management approach the Government used is a
    good example of how to deal with a problem issue.

**[Q.12 Senator Carper.]{.underline}** What lesson on transportation
would you share?

A.  Ms. Gross. Demarcation between cyber and programs is becoming more
    and more blended.

**[Q.13 Senator Bennett]{.underline}**. Your references to Y2K program
management and John Koskinen are appreciated. Looking back on Y2K have
found that a large portion of the costs had significant benefits.

If there are questions, please contact John Ray at (202) 501-3473 or
<john.ray@gsa.gov>.