related intrusions pose one of the greatest threats to our national security the intent is to obtain detailed information from various sources and from various perspectives as to what the current threat actually entails so the committee can later delve more deeply into how effective the nation has been in confronting the immediate cyber threat as well as building defenses which safeguard us from what appears to be a daunting future cyber security environment given the unusual nature of the cyber threat it cannot be addressed solely by using the traditional national security apparatus in short the federal government is currently incapable of securing the nation against cyber threats on its own and must embrace the broad transparent involvement of non government entities like countries approximately eighty five percent of the nation's critical infrastructure is owned by the private sector many of which are small businesses because the nation relies so heavily on private industry to protect this infrastructure trusted partnerships between the government and the private sector must also be a priority in the words of the president  cybersecurity is a challenge that we as a government or as a country are not adequately prepared to counter in addition in a recent interview howard a schmidt the u s cybersecurity coordinator emphasized the critical nature of public private partnerships as it relates to cybersecurity unfortunately mister schmidt refused to testify today i truly do find this unfortunate because i believe he should be here in this important discussion i am deeply concerned that mister schmidt as the executive branch's cybersecurity coordinator charged with the responsibility for orchestrating the many important cybersecurity activities across the government believes that his management of this critical issue is exempt from congressional oversight that is certainly inconsistent with what i have heard the administration and this president say about the openness and transparency of the administration in his absence the administration has sent us an expert from the department of homeland security there was quite a debate whether the administration would allow him to sit on the same panel as the industry experts sitting in front of us today i am glad the issue was resolved no matter a few hours ago and we will now be able to receive testimony from both the public and private perspective together on one panel in the future i hope this is not so difficult that said i must stress my sincere disappointment in the number of days waste debating the need to hear testimony from government and private witnesses alike at the same time on the same panel in a manner that allows members to most effectively oversee this critical publicprivate partnership i believe it  critical that while we focus on the cyber threat we also keep in mind the need to develop well coordinated strategic cybersecurity partnerships with the private sector in order to confront the threat the administration has made repeated public statements about the importance of this partnership even the white house directed cyberspace policy review concluded that the united states cannot succeed in securing cyberspace if it works in isolation and should enhance its partnerships with the private sector cybersecurity experts agree that given the likely national security impact of cyber attacks on the economy our critical infrastructure as transportation energy and communications both private and public sectors must work together closely and in a very transparent way this would collaboration the ever changing face of the cyber threat means that the authorities and capabilities needed to confront the threat will likely need to be changed or updated on a regular basis this is the reason why congress must be as attentive to the threat as any other part of the government i do not believe anyone knowledgeable of cyber security would deny that cyber threat is a major national security issue for the united states the national security strategy published in may two thousand and ten highlights that cyber security threats represent one of the most serious security public safety and economic challenges we face as a nation therefore a national dialog in securing the nation's digital infrastructure must happen now and continue indefinitely it is my sincere hope that this dialog can include many segments of society and can be done in a nonpartisan way it is my hope that we as a nation bring to bear against this threat all expertise that resides within the country strangely we are faced with the critical national security threat to which the expertise needed to confront it does not necessarily reside solely in the federal government but also in the private sector a recent research project conducted by mcafee and the center for strategic and international studies looked at the threats to power grids oil gas and water across fourteen countries  concluded that there had been dramatic increases in cyber attacks against critical infrastructure with as much as eighty percent of the companies experiencing large scale attacks according to the project report nearly thirty percent of the companies believed they were unprepared for the and more than forty percent expected a major cyber attack within the next twelve months also according to an office of management and budget report the number of reported cyber incidents affecting u s federal agencies shot up thirty nine comprehensive legislative proposal to improve cybersecurity with a focus on our nation's critical infrastructure and the federal government's own networks and computers the proposal was drafted in response to numerous legislative proposals introduced in the last congress and specific requests from congressional leadership that white house legislation won't be the focus of today's hearing but is a much needed starting point for very important conversation as someone who doesn't purport to be a techie at all i can tell you i have a great deal of concern about the exposure we have in this area particularly having served a number of years on the intelligence committee and where that conversation goes should cause some sleepless nights for a lot of people  computer technology has advanced federal agencies and our nation's critical infrastructure such as power distribution water supply telecommunications and emergency services have become increasingly dependent on computerized information systems to carry out their information conduct operations and deliver services the interconnected nature of these systems creates risks for our national security economic security and public safety just last month in massachusetts a virus called unemployed workers may have had data compromised including their names social security numbers employer identification numbers addresses and email addresses although the virus was originally discovered back in april it wasn't until last week that the labor department realized the between information systems the internet and other infrastructures also creates opportunities for attackers to disrupt telecommunications electrical power and other critical services some industry sectors are so vital to the nation that their incapacity or destruction would impact on national security national economic security or public health and safety federal law enforcement and intelligence agencies have identified multiple sources of threats to our information systems and critical infrastructure these threats include foreign nations engaged in espionage and information warfare criminals hackers disgruntled employees and contractors in one recent example it has been alleged that the chinese government spread a virus that attacked google and at least eighty other united states companies not all threats to federal cybersecurity  external in june two thousand and ten wikileaks released thousands of classified department of state and department of defense documents immediately following the release of those documents the secretary of defense commissioned two internal department of defense studies to evaluate any weaknesses in their system the studies found that the department's policies for dealing with an internal security threat were inadequate and that the department had limited capability to detect and monitor anomalous behavior on its classified computer networks these examples imply underline the need for a comprehensive legislative approach that will protect our national security and the health and safety of the american people we have an obligation to ensure that the government's it systems are secure and that any critical infrastructure is protected from the threat of a cyber attack the failure to properly  please rise and raise your right hand discuss this important issue along with this distinguished panel of experts on cyber threats and the impact on critical infrastructure as both the chairman and ranking member have already identified sensitive information is routinely stolen from both government and private sector networks last year we saw an increase in the threat as a result of not what was being taken from networks but what was being left behind in the result of what was known as stuxnet successful cyber attacks could potentially result in physical damage and loss of life there are many challenges in the current landscape strong and rapidly expanding capabilities lack of comprehensive threat and vulnerability awareness and our information infrastructure is dependent upon its continual availability for our way of life the cyber environment is not homogenous under a single department or agency or the private sector we recognize that cybersecurity is a team sport government does not have all the answers so we must work closely with the private sector to provide solutions there is no one size fits all and there is no magical line to protect the cyber domain it is about information sharing and it is about sharing knowledge collectively knowledge is only power when it is shared we must leverage our expertise and our access to information along with industry's specific needs capabilities and  contribute the mission in cyber is many fold and our goals are clear in the law enforcement environment they work closely with the other agencies to identify and prosecute cyber intrusions the intelligence and military community work to attribute to defend and to pursue those individuals dhs along with the private sector including the financial services sector the energy sector communications and others work to prepare prevent response recovery and restore coordinating the national response to domestic emergencies is more of a matter of what and how and not necessarily who and why until much later to that end i would like to emphasize that my responsibilities from an operational standpoint  focused on preventing and resolving attacks not attributing the source of those threats i would be willing to take any questions in the future regarding the cyber threats and the cyber capabilities of our country with the committee under an appropriately classified setting with the available interagency representatives nccic or the national cybersecurity and communications integration center works closely with government and all levels of the private sector to coordinate the integrated and unified response to cyber communications incidents sponsoring security clearances for the private sector enables us to have our industry partners on the watch floor in a classified environment looking at actionable intelligence and providing information to asset owners and operators in near real time the dhs components have all been integrated into the nccic along with representatives from other agencies such as the national security agency u s cyber command the fbi the u s secret service and representatives from the intelligence community at large  in addition we have private sector representatives sitting on the watch floor from the communications sector the it sector the financial services sector and the energy sector additionally we have representatives from state local tribal and territorial governments represented by the multistate information sharing and analysis center in conclusion within our current legal authorities we continue to engage collaborate and provide analysis of vulnerability and mitigation assistance to the private sector we have experience and expertise in dealing with the private sector in planning steady state and crisis scenarios we have deployed numerous incident response and assessment teams that enable us to prevent respond recover and restore from cyber incidents finally we work closely with the private sector and our interagency partners in law enforcement and in the intelligence community to provide the full complement and capabilities of the federal government for the private sector in response to a cyber incident chairman chaffetz ranking member tierney and distinguished members of the panel let me conclude by reiterating that i look forward to exploring opportunities to advance this mission in collaboration with the subcommittee and my colleagues in the public and private sector also if the committee has any questions regarding the administration's legislative proposal i will be happy to defer those issues to the policy representatives testifying before the full committee next week thank you again for this opportunity to testify and i would be happy to answer any of your questions  cyber and the policy response we need first i would observe that cyber criminals respond rapidly they are creative in two thousand and ten mcafee labs identified more than twenty million new pieces of malware globally a two thousand and eleven online fraud report from rsa the security division of emc found that the u s has consistently hosted and been the target of a majority of the worldwide cyber attacks economic impact is serious it is about six dollars million a day when a corporation site is down on average and worldwide the economy loses some eighty six dollars billion a year due to cyber attacks protecting our networks  as the chair has observed is a publicprivate shared responsibility neither one of us can do it alone the private sector's responsibility is to innovate and operate its own infrastructure in a safe way the government has an obligation to share timely and accurate information so that the private sector can secure itself and turn around and help to secure the government i will defer to our witness from symantec on a little bit more technical descriptions of some of the threats i would just underscore this the range of threat actors especially right now including advanced persistent threats apts you will hear more about that are going directly after the end user they attempt to trick them into downloading  or divulging sensitive information again it is the actual user being targeted not the mechanical system the software or whatever it is going after human error as criminals probe for a soft spot in a system the also probing now the individuals who connect to that network with the increased reliance on all it devices now we see the great shift to mobile devices and that too will be an opportunity for cyber criminal applications many times are downloaded by users and not always being properly vetted we would submit that the policymakers and the industry as well and the economy and for government for government service as well they are our key to national security the war fighter has an advantage the key to homeland security the key to economic security high paying jobs where we need to be as an economy but with those advantages there also have been some down sides that is what we are attempting to talk about today please consider first in policy congress should do no harm do not undermine innovation it is our advantage one size fits all will not work second government should promote an outcome based layered security approach government should develop processes to manage and measure performance associated with real security third government should adopt a risk based approach to our nation's infrastructure that means critical infrastructure should be defined to include only that which is of the utmost importance to national security and then truly work to secure it fourth we believe government can provide incentives to encourage industry to invest in best practices in security for example safe harbor from data breach notification when an organization does what it should in advance of a breach incident fifth congress should update our government's federal information security practices and laws to perform in a more nimble environment so we strongly support updating fisma i know the committee knows about that finally if industry is to act at the behest of government it is necessary that there be clear liability protections so if you do what you should do or at the government's behest you should also be protected from unintended consequences or liabilities again on behalf of the industry thank you for holding this hearing we look forward to doing all that we can to be a part of the publicprivate partnership to find a solution and maintain our national advantage in innovation mister chaffetz thank you mister lewis you are recognized for five minutes lewis thank you mister chairman i thank the committee for the opportunity to testify i am really impressed with the energy that the committee is bringing to this issue it is something we need we depend as a nation on the internet but it is not secure gives criminals and foreign opponents real opportunity to damage the united states cyber threats fall into two categories high end attacks that cause damage destruction or casualties and threats from cyber crime and cyber espionage five countries including russia and china can launch high end cyber attacks another thirty countries are developing these capabilities states use skilled proxies cyber criminals and hackers to help them cyber attacks could destroy critical infrastructure or disrupt essential networks and services at the moment however no nation is likely to attack the united states because they fear  retaliation terrorists do not yet have cyber attack capabilities nor do dangerous nations like iran and north korea however they are eagerly pursuing these cyber capabilities we do not know how close they are to acquiring them but the moment they acquire them we can expect to see damaging cyber attacks the immediate threat to the national interest comes from crime and espionage the internet with all its weaknesses  created a golden age for espionage and the u s has been the chief victim we have lost military technology intellectual property for high tech companies oil exploration data and confidential business information banks suffer million dollar losses almost every month none of this attracts much attention and some companies prefer to conceal their losses and in some cases companies may not even know they have been hit our estimates of the damages as you heard are in the billions of dollars weak cyber security damages our economic competitiveness and technological leadership what can we do about this there is certainly a new energy in washington about approaching this proper which is great  first we need to accept that we need a new approach that puts cyber security as a major national security problem the most dangerous threats in cyberspace come from foreign military and foreign intelligence agencies second this new approach needs to combine trade policy law enforcement military strategy and critical infrastructure protection for critical infrastructure this means that dhs must be able to mandate risk based performance standards publicprivate partnerships are an important part of this it would help however to differentiate where the private sector is strongest in things like information sharing and innovation and where government action is needed the immediate question is whether we can improve our defenses before there is a damaging attack most of the experts i know believe this is not possible that america will only act after a crisis i believe that the work of this committee and others can help us avoid that fate and let us do what is necessary to improve public safety and national security in cyber space thank you for the opportunity to testify and i look forward to your questions chairman on behalf of the nearly five hundred symantec employees based in your district in linden we certainly appreciate your focus on cybersecurity issues my name is dean turner i am director of symantec's global intelligence network is the world's information security leader with over twenty five years experience in developing internet security technology our best in class global intelligence network allows us to capture worldwide security intelligence data we maintain eleven security response centers globally and utilize over two hundred and forty zero attack sensors in more than two hundred countries to track malicious activity twenty four hours a day three hundred and sixty five days a year in short if there is a class of threat on the internet symantec knows about it in my written testimony i have provided the committee with greater detail on the evolving threat landscape as well as an assessment of some of the real world impacts of cyber attacks on businesses and individuals i  also touch on major challenges and the vulnerabilities associated with securing new technologies and how organizations can better secure their important and critical systems in our april two thousand and eleven symantec internet security threat report we observed several exemplifying just how sophisticated and targeted threats are becoming it demonstrated the vulnerability of critical national infrastructure to attack and stuxnet was the first publicly known threat to target industrial control systems  social networks continue to be a security concern for organizations as government agencies and companies struggle to find a satisfactory compromise between leveraging the advantage of social networking and limiting the dangers posed by the increased exposure of potentially sensitive and exploitable information leveraging information from social networking sites as part of a social engineering campaign is one of the simplest and most effective ways an attacker can lure their target to a malicious website for example an attacker can use information from a social networking site to create a target email that then lures a victim to a website that hosts malicious code if the victim visits the website a trojan for example a key logger or a backdoor can be installed and that begins filtrating sensitive information back to the attacker in two thousand and ten attack tool kits continued to see widespread use a typical tool kit today is built to allow the cyber criminal to monetize infected machines in every way possible for example keystroke loggers are a simple way to capture any password a user types in other trojans can also steal email addresses found on the machine as well as add additional malware attack tool kits and their ability to update over the web greatly increase the speed with which new vulnerabilities are packaged exploited and spread one of the most significant attack kits known at the moment is the zeus trojan and is a favorite of cyber criminals due to its ease of use and low cost about four hundred dollars in the underground economy it takes little to no technical knowledge to launch this type of attack and it can be extremely profitable for cyber criminals with the proliferation of smart phones and mobile devices users are increasingly downloading third party applications which is creating an opportunity for the installation of malicious applications in two thousand and ten there was a forty two percent increase in the number of reported new mobile operating system vulnerabilities and most mobile malicious code is now designed to generate revenue therefore there is likely going to be more threats created for these devices as people increasingly use them for sensitive transactions such as on line shopping and banking we have learned many lessons from today's threat landscape and while the sophistication level of attacks is increasing as is the potential and real damage caused by such attacks we need to turn these lessons into action in addition to the recommendations contained in my written testimony the following steps must be taken in order to better protect critical systems from cyber attack first develop and enforce it policies and automate compliance processes second authenticate identities by leveraging solutions that allow business to ensure only authorized personnel have access to those system s third secure end points messaging and web environments in addition defending critical servers and implementing the ability to backup and recover data need to be top priorities members of the committee cybersecurity faces a constantly evolving threat and there is no single solution to prevent attacks attackers are getting smarter and more resourceful every day because of that any solution must include the private sector's expertise and innovation we must continue to be vigilant in protecting our economy our national security and our way of life symantec applauds congress for focusing much needed attention on cybersecurity and we look forward to continuing this important dialog i will be happy to answer any questions you might have  pose as something they are not trying to get you to either give information or simply click on a bogus connection which very often can be understood gleaned or perceived as a threat by simply stopping and thinking through wait a minute is this really coming from the company or an entity that it purports to be this links to issues about short address names and other things that are part of the challenge right not but i because you can harvest all kinds of data that will give you hints on passwords employment where you bank is so they have become kind of unmanageable problems there is little the companies can do about that i don't protection plan at the definition of risk we identified as threat vulnerability and consequence the department takes an all hazards approach the challenge there is identifying where the threat actors are originating that is a part of it but from our standpoint from the mitigation standpoint in protecting the networks restoring services and recovery the actual source is not as important as the vulnerability and the consequence of those vulnerabilities that is really where the department focuses most of its attention and how to field we have gone to companies of only seven employees that were experiencing cyber intrusion to fortune ten companies working with them to not only identify what the risk is but to mitigate that risk in their cyber environments on have been able to conduct seventy five risk assessments over this past year we have not had the opportunity or the requirement to turn anyone away it is completely voluntary part of the challenge is when a risk threat or intrusion is identified to the others and then proliferate and spread that word to address whatever the vulnerability is at the earliest possible stage as soon as we know about the threat you will uncover through the committee's efforts and hearings that there are information sharing challenges between the government and private sector between the got me thinking about as he was talking about who is responsible for what liability protections incentives and all of that i understand with respect to our national security concerns and homeland protection being a part of that that the government systems  services i don't know why we have to give you incentives and i don't know why you wouldn't be held liable if you make a mess of it a small community is targeted say the bank in that community is targeted because they want to get personal information or financial information because there may be a lot of dod workers in that community the federal government says gee that system there are going to be questions about a community bank in the future but while they are down because of a government request or demand and farmer mcdonald doesn't get his loan or loses the farm is the bank liable because they went down at the government request mister tierney forget the bank the bank didn't put the system in they bought it from somebody and paid for the service of installing it if it goes down whether it goes down because somebody breached it the government suggests they go down or whatever it is still their fault and  am trying to make a distinction that i think is legitimate when the government says based on what we know you should do this or we require you to do this and you do that any liability that stems from that step should be bond if it is an action taken at government requirement or policy i don't think it is the government's intent to make a company liable for obeying the law mister tierney let us take your example which i thought was the  a requirement to it that there not be liability attached to it being the requirement i could think of a lot of different examples but if you are adhering to the rules and best practices and something about that policy causes harm as a response that is something you are obeying policy on and you should not be liable mister tierney how do we ever get best policies to keep getting better if you never have an incentive to do it market so when you go down and that community goes down or whatever then you are on your own would that be something you want no consumer protections no government regulations would that make you happier mister bond i am taking your earlier point that market forces really do matter but i am trying to make  and that any regulatory steps should be taken very carefully with all the expertise of the different players in the room i am not here to draw any kind of line in the sand i am here to say that you need technical experts like mister turner and others in the room to where they were the ones to be held responsible for anything mister turner i understand but when you are asking to assess liability on a particular focal point whether that be the federal government the private sector or the vendor we have to deal with something called the law of intended consequences it is virtually impossible for add something mister chairman because it is an interesting line of questioning there is a point we might want to put out in the open and i think if you would use your experience and the experience of other committee members with the intelligence community you would be able to confirm this but there is no such thing as a secure unclassified system i have been told by senior intelligence officials that they have never seen an unclassified system that has not been penetrated we are dealing with  problem where anyone can get in the solution to that is not a technological solution yes over time our technologies will get better and that will squeeze out the low end threat so the high school kid who used to be able to in a couple of in now he might have to spend a little more time i think that is why a lot of us are in favor of a comprehensive approach you need to have law enforcement cooperation with other countries you need to have strong military forces to deter potential opponents you need to work with the service providers to get them to help consumers and you do need some kind of what we are calling now risk standards run through the government that would impose some requirements on at least critical assistance at some level mister bond i think i would say that we absolutely need and welcome government involvement around the critical infrastructure and as they do that we want to make sure experts  assessed at least i hope you do what is that number how many countries mister mcgurk i would actually defer that to the intelligence community representatives in another forum i wouldn't be able to comment on that here today mister chaffetz what is the consequence for somebody who is attacking us on the cybersecurity front is there anything we can do or have done is there any instance where we have actually said country x you have been doing this and this is the consequence but looking at the consequence analysis that the department conducts associated with cyber physical systems one of the demonstrations we conducted in two thousand and seven was known as the aurora experiment where we demonstrated the capability of taking digital protective circuits and physically chaffetz i hope we are doing that mister mcgurk yes sir in many of these cases these legacy based systems are ten twenty or thirty years old so subsequently we can't bolt on a new application so we either need to enclave these pieces of equipment in a secure environment or mitigate the risk associated with operating those systems in a connected world the comment was made earlier about separating networks and never finding a secure network in our experience in conducting hundreds of vulnerability assessments in the private sector in no case have we ever found the operations network the scada system or energy management system separated from the enterprise network on average we see eleven direct connections between those networks and in some extreme cases we identified up to two hundred and fifty connections between the actual producing network and the enterprise environment that is one of the challenges we have as i mentioned earlier in actually securing these networks and understanding the consequences associated with the bond i would probably identify better information sharing coming between the government and the private sector i don't think we are sometimes free to discuss the threats we see so that we can respond quickly lewis i would go back to your point about consequences if nobody is ever punished for doing something bad or even chastised they are just going to do more of it so i think our failure to have any consequence for any sort of cyber action is really piece arguably we have been sharing information for years between the government and the private sector we need to focus on collaboratively developing knowledge so that we can provide actionable intelligence to mitigate the risk the great example of that was in november of last year there was a particularly malicious piece of code known as the here you have virus it was actually identified through the intelligence community as being a known malicious piece of software and within hours the department was able to identify that particular piece of code and provide actionable intelligence to the community through a series of declassification measures using the private sector's expertise to provide information to the private sector so they could take the necessary steps to mitigate the risk that is the step we need to actually have an effect on cyber risk at that speed and not just simply put together another information sharing body mister chaffetz i want to go quickly here to the cloud there is a lot of movement within the lewis this time mister lewis you caught me off guard mister chairman right now i would say there is probably a slight advantage to having your stuff in the cloud because some of the companies some of the service the case in the questions that have to be asked if they don't there will be a lot people as we move to the cloud that will be able to make these services available whether they be onshore in the united states or offshore and these other places what is the track record going to be we have to make a very  us talk about databases the federal government has over two thousand databases on one hand you can say maybe that diversified portfolio provides a degree of safety and security so the bureau of indian affairs is separate from the department of consolidate those and have five really good data warehouses or databases or is this diversified portfolio advisable i worry that so many agencies are trying to create so many things we are duplicating efforts and consequently they in the infrastructure it goes to the cloud discussion we were just having one of the benefits of that secure environment is that you can have a disparate approach to data storage so that not all the keys to the kingdom are in one location that provides an obscurity model for data in motion and data at rest by being able to do that we can better allow for a distributed approach for data security that being said one of the initiatives the department has  been executing for quite some time now is a trusted internet connection program that was part of the comprehensive national cybersecurity initiative instead of trying to instrument or monitor each of the separate departments and agencies but we roll that up to an aggregation point so that we can understand flow and control the information access points at an aggregated standpoint and still allow for the diversity of the independent departments and agencies  just quickly i want to make sure to offer to brief the committee and its members our techamerica foundation actually has seventy three companies and academics involved in commission right now to advise the government on the cloud and the leadership opportunity for the u  critical infrastructure from cyber attacks do you think that is where we should leave it mister bond no i think we presume there are going to be special rules regulations and requirements around the critical infrastructure we think education jointly identifying where the government should invest r and d dollars in cybersecurity all will be a part of that ultimate solution we certainly advocate for clear distinction of what the critical infrastructure a good lewis in some ways the electrical grid is the most attractive target we have for some of our opponents it is not secure so if the statement he made was that we have been relying on an ad hoc process i  the responsibility in sharing the data itself what data can you share there are a whole host of impediments and barriers to sharing what is arguably confidential information in some areas that is part of the issue and requiring their grid operators to be more secure i said that is amazing how did you guys get away with that we could never do that they said when they privatize they made sure to keep two board seats where you are seeing a difference emerge is in the countries that still have a small number of service providers where the government has a more directive role they are pulling ahead a little bit right now i would say we are all sort of in equally bad shape and one of the trends to watch is whether that changes mcgurk i believe the current role we are executing as a coordinator and integrator to provide understanding and awareness across the eighteen critical infrastructures is a key role and a service that we provide as many of  members have said information may come from one sector and may be germane to another but there is no direct connection to share that information by aggregating that at the department we are able to take alerts requirements for that the farther out you move on the network and the closer to consumer applications and so forth i think we need this roundtable of real experts to understand what it means dhs and the other regulatory agencies would oversee for critical infrastructure better information sharing as you have heard and finally steps that would make the international environment more secure steps that would deter criminals and other intelligence that comes from the five i's or the united states alone we are also dealing with issues that come from other jurisdictions other western jurisdictions where the sharing of that information is considered  put it bluntly very difficult to do and can put you in a lot of hot water those issues have to be addressed if we are going to get down to the role where we talk about how do we make it easier for governments to protect the private sector especially when we are talking about critical infrastructure  those are some of the hurdles we have to address if we don't address them at the higher level sharing the information formally at a lower level is difficult it happens informally now i wouldn't want to leave the panel with the impression that  we do not share information because that is certainly not the case i personally have worked with all the levels of the united states government on sharing information about current threats to critical infrastructure but it is in an unofficial capacity because there doesn't exist an official capacity