issa the committee will come to order the oversight committee exists to secure two fundamental principles first americans have a right to know that the money washington takes from them is well spent and second americans deserve an efficient effective government that works for them our duty on the oversight and government reform committee is to protect these rights our solemn responsibility is to hold government accountable to taxpayers because taxpayers have a right to know what they get from their government we will work tirelessly in partnership with citizen watchdogs to deliver the facts to the american people and bring genuine reform to the federal bureaucracy today's hearing is the first in what will likely be a long series of committee hearings related to the nature extent and threat to america's digital infrastructure on may twenty five the subcommittee on national security and homeland defense and foreign operations held a hearing on the issue that focused on the importance of strategic public private partnership to effectively combat the threat we face the important work that our colleague mister chaffetz began will continue both at the subcommittee and the full committee his groundwork and this committee's  on what spans all of government all of the private sector and as we know every day more of all of the world is critical today we have representatives from each of the major areas of government that are often not seen together but are critical to implementing a plan which includes initiative by the president a task force by the republicans a similar effort by democrats and this committee on a bipartisan basis to ensure that both the house and the senate act on the president's proposal in a timely fashion and recognize that the vulnerabilities both public and private which are well known are in fact growing every day our vulnerability is not just because of enemies well know but can often be because of enemies unknown enemies who simply have a grudge against society it is today possible to be a great warrior with nothing but your slippers and your bedroom and the desire to bring down some aspect of public or private infrastructure related to the internet a recent office of management and budget report revealed that the number of cyber incidents affecting u s federal agencies shot up thirty nine percent in unavoidable if you leave your door open you can lose the contents of your house today we are going hear about efforts to make sure that at least in the public sector in cooperation with private enterprise we are attempting to provide the locks and the master key system to ensure that you have the ability to close that door if you do all that can be done cyber security is not simply for the large reports often the people hacked the most are small companies companies who are not particularly targeted but ultimately might have great losses one of the areas of concern in the president's proposal is  the vast reporting requirements we want to ensure that information is a two way street and that this not simply be about a way to empower the trial lawyers to ensure that someone who doesn't report in a timely fashion particularly a smaller company that may be somewhat unaware as to the loss doesn't find themselves simply being victimized by a lawsuit having been victimized by it is important to note that cyber threats are forever changing and that cyber attacks are always adapting to get around our defenses this committee is ideally suited to evaluate the federal government's strategy and ability to counter these threats by both defensive and most importantly potentially offensive innovations recently the secretary of defense robert gates stated that  cyber attacks were an act of war war is not a defensive only measure war is something that at times needs to have a counterattack practically every committee of congress can claim jurisdiction over  cybersecurity because of the uniquely expansive nature of the threat the strength of our nation's commerce utilities transportation banking telecommunications and national defense all depend on nimble response  and aggressive cybersecurity infrastructure we claim no special jurisdiction here today just the opposite the committee on government reform claims  be a conduit for all committees we will be joined by one or more individuals from other committees and this committee will welcome other individuals to be allowed to sit on the dais and to participate in future hearings because we view our committee as a conduit for all committees recognizing that any proposal although it may well originate from this committee or pass through this committee will also likely pass through virtually every committee of the congress in closing not since the end of world war ii has america seen a threat so great looming for so long as we led up to world war ii we had plenty of warning that the fascists were a threat we watched them arm we saw them attack others and we did little to prepare today we have bolstered many defenses but let us understand there is a difference between world war ii and today we as a nation have already been attacked during my opening statement thousands of times attacks go on every day because one doesn't appear to be as large as pearl harbor doesn't change the fact that sooner or later america will have to respond in a more aggressive fashion to some and be better prepared defensively for others with that telecommunications and emergency services has become increasingly dependent on computerized information systems to manage their operations and to process maintain and report essential information our government's national defense and critical information systems are also becoming increasingly reliant on information technology systems and web based transactions and services successful attacks on these systems threaten our troops impair vital federal programs and jeopardize the privacy of citizens whose personal information is maintained in government computer systems mister chairman i have served on the naval academy board of visitors of the last ten years and we have recently made it a priority to change our curriculum so that every midshipman and woman is required now to take defensive courses with regard to cybersecurity in the last congress members of the house and senate introduced at least fifty cybersecurity related bills to address these issues given that urgency and the complexity of these challenges congressional leadership called on the administration to help develop comprehensive cybersecurity legislation congress complete this important work for example the administration's proposal would make key changes to the federal information security management act including shifting to continu monitoring and streamlined reporting for all federal systems i supported similar legislation last year and the committee successfully reported bipartisan legislation that would have achieved these goals i am glad to see the administration's proposal has incorporated many of the improvements included in that legislation there are several provisions in the administration's proposal that i would like to see strengthened first i hope we will consider the creation of a senate confirmable official with authority to set administration wide cybersecurity policy it is important that the official responsible for implementing fisma have the authority to task all civilian departments and agencies with implementation of the federal security standards the administration's proposal also creates a framework to ensure that the federal government and private industry are working together to protect our critical infrastructure private industry owns approximately eighty five percent of the nation's critical infrastructure and the administration's proposal allows critical infrastructure operators to  their own frameworks for addressing cyber threats however while there is room for healthy debate even industry agrees that some level of government oversight is necessary to protect the american public from the potentially devastating consequences of a cyber attack at a recent hearing before the national security subcommittee tech america president phil bond testified that education and information sharing alone inadequate to protect critical infrastructure and that the government rules regulations and requirements are necessary to secure the nation's critical infrastructure other parts of the administration's proposal attempt to help consumers and companies by creating uniform reporting standards to address cyber attacks that result in breaches of personally identifiable consumer information however the proposal also would allow any entity to share with  personally identifiable information that otherwise could not be shared under existing law i agree that we should encourage information sharing between industry and government but we also have to be careful that personally identifiable information is appropriately protected and shared with the government only when necessary finally i agree that law enforcement should have every tool necessary to go after hackers  i am concerned that the imposition of mandatory minimum sentencing unduly interferes with judges discretion to set appropriate penalties i hope that future drafts of the legislation will not include this specific provision recently highlighted the issue of cybersecurity is not a partisan one and i am glad that the chairman agrees with that but is an issue on which democrats and republicans should be able to work together to come up with common sense solutions to help protect the american people mister chairman i look forward to working with you and the staff in a bipartisan way to update fisma and pass comprehensive cybersecurity legislation in this congress cyber threat is one of the greatest national security challenges facing the united states of america it affects nearly every facet of the private and public sector and reaches deep into our personal lives on may twenty five two thousand and eleven the subcommittee on national security homeland defense and foreign operations conducted a hearing to examine the threat government officials testified alongside their private sector counterparts about the challenges that we face each gave us sobering overview of the threat and each communicated that the threat is real is extremely dangerous and i persistent while digital connectivity has made life more convenient it has exposed new vulnerabilities our personal computers are at risk as well as cell phones financial institutions water and power infrastructure state local and federal government institutions bad actors continually scour the web for our most sensitive information social security numbers credit card information bank accounts proprietary business information defense and intelligence secrets plans and intentions for our political and business leaders they gain this information through advanced persistent threats social engineering and spear fishing some hacks are carried out by individual actors and small time crooks and other breaches are coordinated efforts by foreign governments the most devastating attacks such as the wiki lea incident come from within each has the ability to inflict significant and irreparable harm statistics indicate that corporations lose roughly six dollars million per day when sites are down because of cyber attacks the global economy loses approximately eighty six  billion per year there is every indication that these costs will continue to increase the president and members of the administration have publicly stated that the federal government is ill prepared to mitigate the threat the department of homeland security testified we cannot be certain that our information infrastructure will remain accessible and reliable during a time of crisis phillip bond the president of tech america testified cyber crime represents today's most prolific threat it is no secret that the federal government's it infrastructure has significant weaknesses across the executive branch systems are outdated and technology is behind legal and regulatory frameworks are equally behind the authorities roles and responsibilities of federal state local and private entities are unclear and insufficient to meet the threat the administration has submitted a proposal to remedy these shortfalls and this is a good first step however it will continue to need examination by this committee it will also need extensive input from the private sector which owns roughly eighty five percent of the digital infrastructure the solutions must be effective efficient and allow all parties to be as nimble as the enemy i am confident the solutions put forth by this congress the administration and the private sector will yield exactly the results we need to protect our critical infrastructure as a member of the house cybersecurity task force and as the chairman of the national security homeland defense and foreign operations subcommittee i look forward to working toward an effective and efficient solution to the cyber chaffetz for putting this matter on the agenda and for taking it as seriously as we have in a bipartisan fashion we are all familiar with the various incidents that have happened including earlier this month when citigroup revealed that hackers had stolen personal information from more than two hundred thousand credit card holders this was one of the larger direct attacks on a major bank ever reported but it is not singular in its occurrence thieves obtained customer names card numbers addresses and email information the unfortunate part is it took the company as it does too many companies over a month to notify all the customers of the breach so that sheds some light on the need for stringent reporting requirements for breaches of personal information it highlights the fact that banks and some other companies are focused on fraud and reducing fraud but they also have to be concerned about the prevention of data theft itself and the impact it can have on the consumer in fact the data theft arguably is of less cost to the entities the administration for creating a national data breach regulation system that will ensure that consumers learn about the data breaches as soon as possible i applaud their efforts to encourage companies to share data about cyber attacks and the federal government to improve defenses against these types of attacks when we hear about all of the incidents that occur i think it becomes clear that we need some standards of course the issue then becomes if everyone doesn't adhere to those standards how well protected are those that actually from some incentive to really focus on the need to go after stopping these data attacks from happening in the first place and from having people comply i would like to hear a lot of discussion on that i don't want to see us take the wrong approach and sort of immunize people then get lax and think i don't have to play i don't want to spend that money and i don't want to be responsible for it i think we have to talk about people being accountable particularly those that will profit from it but we have to reasonable and understand that in some places there may be need for incentives that draws in everyone because of the expense issa i thank the gentleman members may have seven days to submit opening statements and extraneous materials for the record we now recognize our panel of witnesses mister greg schaffer is the acting deputy assistan secretary of the national protection and programs directorate of the u s department of homeland security mister james a baker is associate deputy attorney general at the department of justice at the national institute of standards and technology at the department of commerce welcome to all of you pursuant to committee rule would you please rise to take the oath please raise your right hands do heroes so you know this drill in order to allow enough time your entire statements as presented will be placed in the record we would ask you to summarize in any way you choose but keep it within five minutes when you see the yellow light go on it is not before you today i know that the committee has already had a number of hearings and briefings on this topic so i will briefly summarize the current state of affairs and the impetus for the legislative proposal that you have from the administration today there is no security issue facing our nation that is more pressing than cybersecurity the vulnerability of our networks is an issue of national security of homeland security and of economic security the reality is that the united states is increasingly confronted by a dangerous cyber environment where threats are more targeted are more sophisticated and more serious than they have ever been before our adversaries are stealing sensitive information and intellectual property from both government and private sector networks comprising our competitive economic advantage and jeopardizing individual privacy our disturbing we also know that our adversaries are also capable of targeting elements of our critical infrastructure to disrupt dismantle or destroy the systems upon which we depend every day as the electric grid major financial institutions and mass transportation and other critical infrastructure elements attach to the networks they can become vulnerable to  attack this is not conjecture it is reality hackers probe critical infrastructure companies on a daily basis the status quo is simply unacceptable and we believe a solution can be found if we work together today's threats require engagement of our entire society from government to the private sector to the individual citizen for that reason the administration has recently sent a legislative proposal to congress that focuses on clarifying cybersecurity authority and collaborating with the leadership role in civilian cybersecurity consistent with the last administration's cnci comprehensive national cybersecurity initiative proposals first the proposal solidifies that the department of homeland security's responsibility for leading and protecting  federal civilian networks and ensure that our authorities are commensurate with our responsibilities dhs provides a number of services to departments and agencies today and sometimes the lack of clear legal authority slows us down in doing that and this proposal will clarify our legal authority it will also modernize as noted the federal information security management act fisma to focus on continuous monitoring and operational risk reduction rather than a paper based compliance would enhance by consolidating the policy development oversight and operational expertise within one agency under personnel authority the proposal would give dhs the ability to attract and retain  to move between government and the private sector to protect critical infrastructure we have a combination of voluntary and mandatory programs to focus on publicprivate partnerships the administration proposal clarifies dhs authority provide a range of voluntary assistance to a requesting private sector company state or local government it clarifies the type of assistance that dhs will be able to provide including alerts warnings risk assessments on site technical support and incident response organizations that suffer attacks often ask the federal government to assist but lack of clear statutory authority and a framework sometimes slows down that process and we think this will accelerate it from an information sharing perspective we will remove the barriers to sharing cybersecurity between industry and government it will allow industry partners to share with us that which they learn from their networks without having to go through a series of legal conversations in order to ensure themselves that they are allowed to share that will eliminate delays sometimes of days sometimes of weeks before we can get data that can be leveraged to help the entire community under the mandatory provisions of the proposal we would leverage our existing and consistent partnership with the private sector to develop a set of frameworks that would be used to reduce risk we would work with the private sector to identify the risk we would work with the private sector to identify the frameworks and then the private sector would develop plans to actually implement and reduce the risk within their organizations it is a proposal that really works with industry and leverages industry's expertise more than thinking that the government has all the answers we look forward to working with you this is a proposal it is not the end of the discussion but the beginning of the discussion we look forward to working with the committee on a going forward good morning mister chairman ranking member cummings and members of the committee thank you for the opportunity to testify on behalf of the department of justice today regarding the administration's cyber legislation proposal because of the short time i have this morning rather than commenting further on the cyber threat which as the committee is well aware is very serious i will focus my remarks on two portions of the administration's proposal intended to enhance our ability to protect the american people from cyber crime first is data breach notification data breaches frequently involve the compromise of sensitive personal information and expose consumers to identity theft and other crimes right now there are forty seven different state laws requiring companies to report data breaches in different situations and through different mechanisms the administration's data breach proposal would replace those forty seven state laws with a single national standard applicable to all entities that meet the minimum threshold as set forth in the proposal if enacted into law this proposal would better ensure that companies notify customers promptly when sensitive personally identifiable information is compromised and that they inform consumers about what they can do to protect themselves the proposal would empower the federal trade commission to enforce the reporting requirements it would also establish rules about what must be reported to law enforcement agencies when there is a significant intrusion so that for example the fbi and the u s secret service can work quickly to identify the culprit and protect others from being victimized the national standard would also make compliance easier for industry we ensuring that computer crimes and cyber intrusions can be investigated and punished to the same extent as other similar criminal activity of particular note the administration's proposal will make it clearly unlawful to damage or shut down a computer system that manages or controls a critical infrastructure and would establish minimum sentence requirements for such activities this narrowly focused proposal is intended to provide strong deterrence to this class of very serious potentially life threatening crimes moreover because cyber crime has become big business for organized crime groups the administration's proposal would make it clear that the racketeering influenced and corrupt organizations act  applies to computer crimes also the proposal would harmonize the sentences and penalties in the computer fraud and abuse act with other similar laws for example acts of wire fraud in the united states carry a maximum  twenty years in prison but violations of the computer fraud and abuse act involving very similar behavior carry a maximum of only five years thank you mister chairman and members of the committee i look forward to your questions on this important topic cha persistent threat the dod is reliant on a large portion of the nation's critical infrastructure such as power generation transportation telecommunications and of course the defense industrial base to defend the nation and perform those missions assigned to and expected of dod the most important aspect of the nation's critical infrastructure protection from our standpoint is the recognition that no one person or agency can protect the nation from this advanced persistent threat that we have been discussing rather it will require a whole of government approach necessitating many different federal agencies state governments and the private sector to work together this legislation is an important step in that direction it criminalizes the damage to critical infrastructure systems breaks down barriers to information sharing so that stakeholders can communicate effectively it engages the private sector as valuable stakeholders and strengthens the ability of the department of homeland security to lead the executive branch defending the nation against the very real cyber threat importantly this legislation accomplishes all of the above while respecting the values of freedom and ensuring the protection of privacy and civil liberties that we cherish in this country the department of defense has an important role in this nation's cybersecurity such as protecting our military networks and national security systems while providing support and technical assistance to the department of homeland security in carrying out other protection issues regarding critical infrastructure dod has and will continue to work hand in hand with homeland security commerce justice and the other departments along with the private sector in countering cyber threats and protecting our nation's critical infrastructure further legislative proposal allows dhs to leverage dod's practices in hiring and personnel exchange programs as well as reinforcing the complementary and continuing defense role in providing information systems controls of defense and national security systems under the federal information security and management act we do look forward to working with congress to ensure the executive branch has the appropriate authorities for cybersecurity and improving the overall security and safety of our nation i would like to close by noting by that while the work of defending the nation is never done this legislation will greatly help the united states government close the gap between us and those who would want to do us harm as i noted before the threat is chairman issa ranking member cummings and members of the committee thank you having me today to testify on behalf of the department of commerce on the administration's cybersecurity legislative proposal the main goal of this proposal is to maximize the country's effectiveness in protecting the security of the critical infrastructure networks and the systems that rely on the internet while also minimizing regulatory burdens on the entities that it covers and protecting the privacy and civil liberties of the public to accomplish this balance we focused on building transparencies throughout the process  rely heavily on publicprivate partnerships i will be addressing four important pieces of the proposal creating security plans for covered critical infrastructure protecting federal systems protecting data breach reporting and privacy protection one important theme of the proposal is accountability through disclosure in requiring creating of security plans the administration is promoting use of private sector expertise and innovation over top down government regulation importantly the knowing their approach has been approved and the federal government will benefit from knowing it will not need to invest in the resource intensive approach or development of government mandated frameworks unless industry fails to act covered critical infrastructure firms and their executives will then have to sign off cybersecurity plans subject them to performance evaluations and disclose them in their annual reports rather than substituting the government's judgment for private firms the plan holds covered entities accountable to consumers and the market this encourages innovation and mitigation strategies as well as improving adherence to best practices by facilitating greater transparency in publicprivate partnerships the main goal is to create an institutional culture in which cybersecurity is part of every day practice without creating a slow moving regulatory structure the proposal also clarifies the roles and responsibilities for setting federal information security standards importantly the secretary of commerce will maintain the responsibility for promulgating standards and guidelines which will continue to be dhs will then use these standards as a basis for binding directives and memoranda it issues to the federal agencies a working partnership between commerce nist and dhs will be important to ensure that agencies received information security requirements that are developed with appropriate technical operational and policy expertise on data breach reporting the administration has learned a great deal from the states selecting and augmenting the strategies and practices we feel most effective to protect security and privacy the legislation will help build certainty and trust in the marketplace by making it easy for consumers to understand the data breach notices they receive why they are receiving them and as a result they will better be able to take appropriate action as secretary locke and others at the co have heard from many companies and different industries including responses to our notice of inquiry last year a nationwide standard for data breach notification will make compliance much easier for the wide range of businesses that must follow forty seven different legal standards today finally i would like to point out that many of the new and augmented authorities in this package are governed by a new privacy framework for government that we believe would enhance privacy protection for information collected by and shared with the government for cybersecurity purposes this framework would be created consultation with privacy and civil liberties experts and the attorney general subject to regular reports to congress and overseen by the independent privacy and civil liberties oversight board governmental violations of this framework will be subject to criminal and financial penalties thank you fifty state solution it is fifty states plus california's add on so i look forward to working on this legislation so that it not be forty nine states plus california as it has been in so many other areas  that we have to get to an interstate commerce genuine compact with all states hopefully we can find a constitutional way to bind all states so that there is a one for all and all for one his background very much knows its history when we asked communications companies to give us information after they found themselves embroiled in lawsuits because of it one of the challenges in the proposal is that it presumes there will be this free flow of information one way and only one way which is from the private sector to government but it doesn't specify the actual protections for those who give what is otherwise not the requirement to give at least federally have you worked out how you are going to propose keeping the plaintiffs trial bar out of the businesses each and every time something goes wrong for these companies that have been but on the voluntary part mister baker thank you mister chairman i think on the voluntary part there is an immunity provision in the proposal and that would apply to the voluntary sharing so that if they shared the information and then somehow found themselves embroiled in a lawsuit they could rely on that provision we think that is how it would come out at the end of the day a judge would have to rule on whether it applied or not and if it was proper chairman issa with at and t and the others that was exactly the problem the federal government had a need to make sure that information not be made public as a result the companies were unable to properly defend themselves we have been down the road of a implied immunity versus and explicit one and also one of the concerns and mister tierney isn't here but i will share perhaps what is one of this concerns we don't want somebody to voluntarily deliver information in order to gain immunity they otherwise wouldn't have have you looked at that side of the equation not from the standpoint of a judge will decide but that our two bodies will write it in a way in which it is predictable what the outcome would be mister baker yes we are very aware of that concern and we have tried to factor that into our thinking very much that is why i think you see the immunity provision has sort of two parts to it one is appropriate sharing pursuant to the subtitle that would be this provision the other is where you have a good faith belief langevin and i both worked on this sometime ago having been there if the government asks one might say that if you answer that is a good faith belief that is exactly where george w bush and his attorney general found themselves sideways they had clearly asked industry had answered and then there was a debate about whether or not that was covered you may want to look at that as we go through the drafting process to make sure that effectively if government whatever government thinks it is legal and they ask the question that should be in my opinion at least an explicit immunity because even though it is voluntary i think all of us on both sides of the weeks ago we thought this was going to come out as recommendations and it came out as a proposal is that because you felt you were closer to if you will final legislative language or was it simply easier to put it and the decision was made that would be the easiest way to bring those ideas forward chairman issa as i recognize the ranking member the reason i asked that was that our intention is to bring a series of private sector individuals both in a formal fashion and in a less formal fashion so that we can glean their input our understanding is this has been government formatted and there has been no formal outreach to the private systemic resistance to sharing information they said something there is widespread consensus on the need for more robust information sharing from the private sector to the government and vice thank you sir i think the proposal is designed to eliminate some of the barriers that we see to information sharing one of the challenges we have consistently when an entity has information th believe the government should know and would help the broader community to protect both government and the private sector is there they are not sure what they are allowed to share and what they are not allowed to share they are not sure whether there is some legal provision somewhere that is going to get them into hot water if they provide the information on an expedited basis to the government this mention of it being one way sharing our goal when we receive the information at dhs is to use that information and distribute the pieces that you can provide that information and there is immunity for the sharing of that information if it is for a legitimate cybersecurity purpose we think will enhance the ability of private sector entities to give information to the government  protections in particular you need a clear immunity provision as i was just discussing with the chairman a few minutes and then you also need what we have heard clear exemptions from foia as well because when folks share information with the government they become concerned it is going to be certainly open to broader discussions of other kinds of sharing and other ways of addressing these issues without unduly affecting privacy and other issues mister cummings one of the things mister butler and some of the phenomenal speed now that we need to get this kind of teaching to private colleges we were trying to figure out how we could take the naval academy's curriculum and then spread it we were very concerned that we are not preparing enough of our young people to deal with this threat i am just wondering what we top priority in terms of next gen workforce education for defense and the national security base so it is the academy at annapolis and certainly the other academies we have a fairly large program through the department of defense on information assurance which reaches colleges around the united states working with them on curriculum development as well as internships and scholarships for students we build on that with the cyber patriot program where we are involved with high school and junior high students  support the national cyber collegiate defense competitions more than competitions they are actually coaching and mentoring programs there are continuous education outreach programs to allow us to help young people understand what we are fac am sorry i thought i threw you a softball to begin with is this happening or not mister schaffer i missed the very beginning of the question and the wording that you gave me and i apologize i don't want to get this wrong can you rephrase for me  there is a task force that dhs and dod co chair to look at these issues with goals to identify short term mitigation strategies and to also make sure that we have capability for maintaining s manufacturing capability over the long term and are in a position to ensure that the critical infrastructure pieces have what we need mister chaffetz it is terribly complicated i understand it is difficult but the concern is that it is happening and probably happening on a more frequent basis than most people recognize these things are embedded in devices and software and people don't know that it is very difficult to detect let me move on and stick with you mister schaffer on this there is a lot of discussion here about private to public having to report to the government how much did the government the white house homeland security and others work with the private sector the numbers are pretty big upwards of eighty five percent of the infrastructure that is used is from the private sector the networks used are run by the private sector but there is a lot of concern that the private sector really wasn't at the table when this was developed were they at the table and how much so mister schaffer with respect to the proposal you have before you as we said we think this is the beginning of the conversation it was developed and informed by our long term and existing relationships with the private sector frankly i have spent the vast majority of my career in the private sector working as a chief information security officer and as a consultant to large corporations we built this proposal based on what we have learned through the national infrastructure protection plan process our relationships with each of the sectors the sector coordinating councils the and others i believe this proposal is designed to give the private sector tremendous input into the process both in identifying the risk identifying the frameworks building their own plans this doesn't prescribe specific technologies they need to use it doesn't give them a mandate to do this in any certain way it gives them an opportunity to participate in developing a regime that will allow us to reduce risk mister schwartz mister chairman just briefly the department of commerce actually had a notice of inquiry last summer that for further discussion one of the shortcomings i see is how do we take it from the public realm and inform the private sector it seems to be very much a one way street it needs to be back and  forth i see you are all shaking your heads i hope there is concurrence on this we will have to work on the specific language and how that information would flow because it does need to be communicated back and forth i have lots more questions but my time has expired with that we will now recognize information systems is cyber attacks from foreign governments or organizations mostly aligned with them cyber attacks certainly are not exclusive to the united states other countries have experienced such attacks at what point do cyber attacks carried out by foreign governments become an act of war or what some refer to as cyber warfare against another nation i would open that to everyone  help us with attribution and tactics techniques and procedures but right now it is a fairly intensive forensic analysis process that we go through to attribute to actors mister desjarlais both public and private sectors are deeply and dependent upon each other for their operations and functionality for example telecommunications and transportation are heavily dependent on the power grid for operations and vice versa does our current internet or communications infrastructure have enough redundancy built in to ensure that we could survive a catastrophic attack on its physical or technical assets mister schaffer mister schaffer there have been numerous attempts to look at that question through risk analysis by various sectors including the it sector the calm sector and the belief is there is a significant amount of resiliency within the network certainly the internet was built with resiliency in mind and the ability to route around various types of problems on any given day with any particular kind of attack it is hard to say whether you will have enough resiliency in that particular place but i do think th architecture of the system is designed to be quite resilient there are certain pieces of the puzzle that obviously need more security and that is where i think we are with the legislative proposal today mister desjarlais does the federal government have an effective defensive posture to ensure that attacks on private sector networks or infrastructure can be isolated with little damage i would say that we are very much both industry and government dependent on one another in a variety of ways it would be very difficult to isolate the government from the critical  infrastructure pieces that are provided by industry as noted they own a substantial portion of that infrastructure mister desjarlais there have been a number of economic estimates regarding the cost of a major cyber attack on the global economy in which our products and equipment is installed and embedded in foreign product foreign product is installed and embedded in our product and the need to have appropriate processes to address we took testimony from a lot of federal agency heads who focused on the part of fisma that requires education training and awareness they could check off that box and say eighty percent of our workforce is trained when you ask the question are threats going up or exist and talk about how to prioritize those things that really matter and that will reduce operational risk our approach is to get to continuous monitoring so we aren't reporting annually with a piece of paper what happening on someone's network which as you know is outdated before the paper is written but are seeing what is happening on those networks can correlate that data with what we are seeing from our intrusion detection and intrusion prevention technology at d put in place as a checklist rather than trying to get at the main set of problems out there one of the things we try to do in the administration proposal is to provide more flexibility in the structure so that the inspector general will look at what is important for that particular agency at the same time as mister schaffer suggested we try to increase automation through continuous monitoring through other means that we have a better standard across  all different agencies that doesn't mean we can stop other means of looking at the best practices and the controls that are in place but we do need to do a better job of making sure we have the right controls for the right metrics we look at technology tactics techniques and procedures and people in an integrated way so as we work to harden networks and improve our cyber hygiene practices we also look at proactive defense measures that we  for exchanging best practices experiences tapping into the private sector expertise and the like is there some kind of forum formal or informal that does that mister schaffer actually there is one of the dhs sponsors is something called the cross sector cybersecurity working group this represents the critical infrastructure eighteen sector cybersecurity resources and gives them an opportunity to work together  to bring the knowledge that one sector may have learned to the other sectors it is one of the goals of the program to make sure that wherever we see an issue we can get that information out to the entire community  at an incredible rate i am very much afraid that we have a problem here that is going to be very difficult and very expensive to fix both within the government and within the private sector correct me if variety of people intruding into computer systems i don't think a day goes by that i don't have to install some sort of security update on my computer i guess my question is i guess we need to take a multi tiered approach where do you see the focus needs to be do we need to be focusing more on hardening systems to attack do we need to be focusing on prosecutions where is the balance we will get the most bang for the solved by any one entity it can't be solved by government alone it can't be solved by industry alone it can't be solved by a single technology this is going to take a whole of government effort it is going to take a whole of society effort right down to individuals who need to apply the patches and the virus updates to their machines the ecosystem was built in a way that allowed us to take advantage of moving very fast but the security pieces have been for the large measure bolted on after the  fact we are trying now to fix those issues but i do think it is going to require us to build better perimeters apply those patches everywhere on all of the systems update those systems to the best technology and  do this vigilantly in all cases mister farenthold i guess i will open this up to the rest of the panel i don't know who might be the expert on this or if anyone has any ideas does anyone have a clue what this is going to cost in some reasonable term that we can understand the price of a computer now is five hundred dollars an average piece of software depending on what is percentage wise how much is it going to raise the cost of computing to do this while i can't say how much it will cost to do this what i think has been said repeatedly is how much it is costing us for not having done it the cost to our society all that we are spending on  trying to chase this problem deal with the intrusions when they occur the intellectual property loss that is going to hit us in terms of our economic competitiveness at a later point in time those costs are also very hard to estimate but we proposal does that we never had before is a way to design for critical infrastructure a regime that actually allows for a standard of care to be developed for clear frameworks to be laid out that industry agrees with they understand the risks they know what they need to do in order to meet those risks and make them go down if we do that i think the markets will develop to produce the products that will make that easier and less expensive if everyone is working to that out in the cloud becomes accessible to the government and either by accident or through some sort of fishing expedition what i would consider to be my private communications are accessible to the government or the legitimate privacy expectations of americans we absolutely want that to happen there are a range of different laws today that protect your privacy so whatever we do we need to make sure we address all of those sort of holistically if you will because  estimate is about eighty percent of our cyber threats to security and critical infrastructure is through the private sector for example many of the critical infrastructures have organizations within which companies can share threat information and best practices the government should always be looking to these organizations to assist in the effort to protect the country do you currently work with any private sector organizations to facilitate the threat information sharing and best security practices and if you do can you tell me which organizations you are working with schaffer indeed the department of homeland security is working with many private sector organizations in an effort to share best practices and to share information about threats and vulnerabilities we work through the sector coordinating councils under the national infrastructure protection plan we work with the isac organizations the information security and analysis centers for the various sectors including the financial services sector the multi state isac which goes to work very closely with a range of private sector players including the standards development organizations and the wide range of other private sector standards setting organizations and take the standard practices from their side take the standards best practices from the government side and develop those to work within the federal government and vice versa a lot of standards that are developed within the federal government are then taken is an example as we kind of worked through the wikileaks mitigation but continuous efforts working with them on threat mitigation mister baker a significant amount of information sharing goes on as well with respect to law enforcement agencies back and forth obviously when you have a crime that has occurred you have information sharing that goes on but in other forums law enforcement agencies the fbi the secret service are working regularly to make sure this information is shared back and forth mister labrador i have one more question while protecting ourselves from attacks we know is extremely critical many private industry individuals have witnessed a proliferation of federal initiatives dedicated to this issue for example there are over twenty five different working groups or task forces being led by the federal government is based on continuous monitoring and automated reporting that was proposed by the administration in its legislative proposal what efforts have already been implemented and what are your projected estimates on effort and spending that is done today to meet the fisma requirements that are really compliance oriented check the box kind of exercises with an annual report can be repurposed in a way that allows us to actually buy down risk through the continuous monitoring and other solutions being proposed the work that we are doing with the departments and agencies on a general basis to improve cyber security across the board  also be done in a way that will get us to better fisma compliance i can't give you a dollar figure with respect to how much it will cost but i can tell you that we believe over the long run if this is done we will have a positive result over the long run once we start building security into everything we are doing there is consistent data that suggests building it in is much cheaper than bolting it   work with you to think about how to score this i don't have any numbers that i can present today with respect to estimates of what the actual savings would be again we know this is the beginning as you pointed out has the operational responsibility the legislative proposal would consolidate the oversight responsibility with the operational responsibility that we have and move things in the direction where we would be given the authority to believe this proposal is carefully crafted to give industry a strong voice in designing the solutions so it is hard to understand the suggestion that it will be overly expensive or over reaching when in fact industry will have an opportunity to say what the threats are that need to be mitigated what the framework should be in order to address those risks and then develop their own plans in order to meet those chaffetz part of this proposal calls for homeland security to authorized to publicly name critical infrastructure providers whose plans you deem to be inadequate and then publish those how is that going to help protect them the proposal would provide summaries of the plans and summaries of the evaluations it is not as if all of these entities aren't under attack today and if they are weak in fact the adversaries are taking advantage of them the proposal here is to make sure that not just the adversaries know they are weak but in fact the public knows and the markets can take appropriate action mister chaffetz so which of these companies would be required to report to the sec for  the proposal doesn't include any suggestion that others would be required to come into that kind of reporting mister chaffetz i have a lot more questions about that but given the time i want to go to one other quick subject let us focus with mister butler  obviously a lot of these concerns come from overseas players who are a little bit outside of our reach but increasing penalties how do we highlight these concerns if someone walked into a computer and physically we expose this and what kind of penalties can we possibly put in place mister baker the issue is making sure we have the penalties in place that we then can try to enforce the enforcement part i us we would be outraged but if they seem to do it as a cyber attack it seems to be quietly pushed under the rug because we don't want to be embarrassed mister butler again i will go back to the international cyberspace strategy for a moment we say in that document that as we and it is one of the biggest threats to the united states of america if there aren't any other questions from any other members yes the ranking member mister cummings i just want to thank you all but i also want to remind you could do everything we can to help prevent it at the same time i think we also need to recognize we need to preserve people's individual liberties need to make we don't overstep and overreach into what private companies are doing and finding that right balance will be one of the challenges for this congress and in the future congresses as well but we will do so i hope in a very bipartisan way we thank you for your expertise we thank you for being here today the committee