U.S. GOVERNMENT PRINTING OFFICE

60–842 WASHINGTON : 2000

COMPUTER SECURITY IMPACT OF Y2K:

EXPANDED RISKS OR FRAUD?

JOINT HEARING

BEFORE THE

SUBCOMMITTEE ON TECHNOLOGY

OF THE

COMMITTEE ON SCIENCE

AND THE

SUBCOMMITTEE ON

GOVERNMENT MANAGEMENT, INFORMATION,

AND TECHNOLOGY

OF THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SIXTH CONGRESS

FIRST SESSION

AUGUST 4, 1999

Science Serial No. 106–23

Government Reform Serial No. 106–57

Printed for the use of the Committee on Science

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

DAVID M. MCINTOSH, Indiana

MARK E. SOUDER, Indiana

JOE SCARBOROUGH, Florida

STEVEN C. LATOURETTE, Ohio

MARSHALL ‘‘MARK’’ SANFORD, South

Carolina

BOB BARR, Georgia

DAN MILLER, Florida

ASA HUTCHINSON, Arkansas

LEE TERRY, Nebraska

JUDY BIGGERT, Illinois

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

HELEN CHENOWETH, Idaho

DAVID VITTER, Louisiana

HENRY A. WAXMAN, California

TOM LANTOS, California

ROBERT E. WISE, JR., West Virginia

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

CHAKA FATTAH, Pennsylvania

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

HAROLD E. FORD, JR., Tennessee

JANICE D. SCHAKOWSKY, Illinois

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

DAVID A. KASS, Deputy Counsel and Parliamentarian

CARLA J. MARTIN, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY

STEPHEN HORN, California, Chairman

JUDY BIGGERT, Illinois

THOMAS M. DAVIS, Virginia

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

JIM TURNER, Texas

PAUL E. KANJORSKI, Pennsylvania

MAJOR R. OWENS, New York

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

MATT RYAN, Senior Policy Director

BONNIE HEALD, Communications Director/Professional Staff Member

GRANT NEWMAN, Clerk

TREY HENDERSON, Minority Counsel

(III)

COMMITTEE ON SCIENCE

F. JAMES SENSENBRENNER, JR., Wisconsin, Chairman

SHERWOOD L. BOEHLERT, New York

LAMAR SMITH, Texas

CONSTANCE A. MORELLA, Maryland

CURT WELDON, Pennsylvania

DANA ROHRABACHER, California

JOE BARTON, Texas

KEN CALVERT, California

NICK SMITH, Michigan

ROSCOE G. BARTLETT, Maryland

VERNON J. EHLERS, Michigan

DAVE WELDON, Florida

GIL GUTKNECHT, Minnesota

THOMAS W. EWING, Illinois

CHRIS CANNON, Utah

KEVIN BRADY, Texas

MERRILL COOK, Utah

GEORGE R. NETHERCUTT, JR., Washington

FRANK D. LUCAS, Oklahoma

MARK GREEN, Wisconsin

STEVEN T. KUYKENDALL, California

GARY G. MILLER, California

JUDY BIGGERT, Illinois

MARSHALL ‘‘MARK’’ SANFORD, South

Carolina

JACK METCALF, Washington

RALPH M. HALL, Texas

BART GORDON, Tennessee

JERRY F. COSTELLO, Illinois

JAMES A. BARCIA, Michigan

EDDIE BERNICE JOHNSON, Texas

LYNN C. WOOLSEY, California

LYNN N. RIVERS, Michigan

ZOE LOFGREN, California

MICHAEL F. DOYLE, Pennsylvania

SHEILA JACKSON LEE, Texas

DEBBIE STABENOW, Michigan

BOB ETHERIDGE, North Carolina

NICK LAMPSON, Texas

JOHN B. LARSON, Connecticut

MARK UDALL, Colorado

DAVID WU, Oregon

ANTHONY D. WEINER, New York

MICHAEL E. CAPUANO, Massachusetts

BRIAN BAIRD, Washington

JOSEPH M. HOEFFEL, Pennsylvania

DENNIS MOORE, Kansas

VACANCY

(V)

C O N T E N T S

Page

August 4, 1999:

Opening Statement by Representative Constance A. Morella, Chairwoman, Subcommittee on Technology, U.S. House of Representatives ... 1

Opening Statement by Representative Stephen Horn, Chairman, Subcommittee on Government Management, Information and Technology,

U.S. House of Representatives ..................................................................... 3

Opening Statement by Representative Mark Udall, Member, Subcommittee on Technology, U.S. House of Representatives ........................ 6

Witnesses:

Mr. Joe Pucciarelli, Vice President and Research Director, Gartner Group

Inc.:

Oral Testimony .......................................................................................... 7

Prepared Testimony .................................................................................. 10

Biography ................................................................................................... 15

Financial Disclosure .................................................................................. 16

Mr. Harris Miller, President, Information Technology Association of

America:

Oral Testimony .......................................................................................... 17

Prepared Testimony .................................................................................. 19

Biography ................................................................................................... 33

Financial Disclosure .................................................................................. 35

Mr. Dean Rich, Vice President for Security Services, WarRoom Research:

Oral Testimony .......................................................................................... 36

Prepared Testimony .................................................................................. 39

Biography ................................................................................................... 41

Financial Disclosure .................................................................................. 44

Mr. Wayne Bennett, Chair, Commercial Technology Practice Area, Bingham Dana LLP:

Oral Testimony .......................................................................................... 45

Prepared Testimony .................................................................................. 47

Biography ................................................................................................... 52

Financial Disclosure .................................................................................. 56

APPENDIX 1: ADDITIONAL STATEMENTS

Statement by Representative Debbie Stabenow, Member, Subcommittee on

Technology, U.S. House of Representatives ....................................................... 76

APPENDIX 2: MATERIALS FOR THE RECORD

USA Today Article, Y2K fixes open door for electronic heist, M.J. Zuckerman . 78

Gartner Group Report, Year 2000 and the Expanded Risk of Financial Fraud,

April 1, 1999 ......................................................................................................... 80

(1)

HEARING ON THE COMPUTER SECURITY IMPACT OF Y2K: ‘‘EXPANDED RISKS OR

FRAUD?’’

WEDNESDAY, AUGUST 4, 1999

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON TECHNOLOGY, COMMITTEE ON SCIENCE, AND THE SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY, COMMITTEE ON GOVERNMENT

REFORM,

Washington, DC.

The subcommittees met, pursuant to notice, at 10:06 a.m., in

Room 2318, Rayburn House Office Building, Hon. Constance A.

Morella [chairwoman of the subcommittee] presiding.

Present: Representatives Morella, Horn, Bartlett, Gutknecht,

Turner, Rivers, Stabenow, Udall, and Wu.

Chairwoman MORELLA. I’m going to call to order the latest in our

series of ongoing hearings on our House Y2K Working Group made

up of the Science Committee’s Technology Subcommittee and the

Government Reform Committee’s Government Management, Information, and Technology Subcommittee.

On behalf of my colleagues Chairman Horn, Ranking Members

Barcia and Turner, and Mr. Udall, I want to welcome our distinguished panel as we discuss today the concerns raised by a number

of information technology experts that Y2K fixes may pose a substantial security threat to computer operating systems.

While the Technology Subcommittee has been reviewing the year

2000 problem over the past 3 years, during that time we have also

been looking closely at the issue of computer security.

Many of you have heard me compare our Nation’s lack of adequate information security to the year 2000 computer problem.

Well, it now appears that Y2K and computer security aren’t just

inviting comparisons, but have overlapped into one issue.

A lot of recent attention has been focused on the April 1, 1999,

GartnerGroup report suggesting that as part of every year 2000

system fix, every aspect of every single information technology system is potentially subject to change and manipulation, raising the

risk of theft, fraud, or corruption.

The GartnerGroup report also stated that at least one publicly

reported theft exceeding $1 billion may occur through lapses in security directly resulting from Y2K remediation efforts.

Since the publication of the report, a number of independent scientists, security professionals, and others in the Y2K community

2

appear to have few quarrels with the GartnerGroup’s dire prediction.

The concern is that Y2K employees who have been hired to correct systems might have left ‘‘trap doors’’ or may manipulate the

computer code through which they can clandestinely take control of

the system at a future date—leaving vulnerable the systems that

electronically move $11 trillion a year among financial institutions,

corporations, governments, and private organizations.

The computer security threat, however, may not be motivated

merely by just financial theft and fraud.

Some Y2K programmers with malicious intent may be quietly installing malicious software codes—such as a logic bomb or a timedelayed virus—to sabotage companies or gain access to sensitive information sometime in the new millennium.

Most troubling is that several security firms say that they have

already found ‘‘trap doors’’ in Y2K programming.

If used successfully for hostile purposes, these computer ‘‘trap

doors’’ can open to make sensitive national and proprietary information systems vulnerable to be accessed, stolen, compromised, or

disrupted.

With less than 150 days now before the January 1, 2000, deadline, the last thing we want to do is to defer any Y2K remediation

efforts.

It should be made clear that nobody should halt or suspend fixing their Y2K problems simply because there exists this potential

for computer security breaches.

The goal of this hearing is not to create a how-to guide and stoke

the embers of those Y2K programmers with a felonious heart and

malicious intent.

The goal of this hearing is to determine what measures can be

undertaken to protect our computer systems and to limit the potential of Y2K computer security breaches.

It is my hope that, today, this panel can collectively come up

with measures and guidelines that both the private and public sectors can review and utilize in their current remediation efforts to

deter and catch any computer security breach that may occur as a

result of the Y2K fix.

Toward that end, I am pleased that we have a very distinguished

panel.

I welcome Mr. Joe Pucciarelli, Vice President, Research Director

of the GartnerGroup, a leading and influential information technology research firm, which we know very well through our hearings, and the author of the GartnerGroup Y2K computer security

report.

Also joining us is a familiar figure to us, Mr. Harris Miller,

President of the Information Technology Association of America.

The Technology Subcommittee has worked very closely with Mr.

Miller and the ITAA in the past on both the Y2K and the computer

security issue, and it is great to see him back as a witness before

us.

We also have Mr. Dean Rich, Vice President for Security Services

at WarRoom Research in Annapolis, Maryland, who is a computer

security consultant with a great deal of expertise and experience in

3

both the public and private sectors. I’m somebody who knows Annapolis well. I welcome you also, Mr. Rich.

Additionally, Mr. Wayne Bennett, Chair of the Commercial Technology Practice Area of the law firm of Bingham Dana in Boston

and an expert in computer security laws and practice, is with us

today. A pleasure to have you, Mr. Bennett.

So I look forward to everybody’s testimony, and I would now like

to turn to our distinguished Co-Chair of today’s hearing, the member from California, Chairman of the Government Management, Information and Technology Subcommittee, Mr. Horn, for any opening statement that he may wish to make. Mr. Horn.

Mr. HORN. Thank you very much.

For the past 3 years, these two Subcommittees have been prodding agencies in the executive branch of the Federal Government

to prepare their computer systems for the year 2000. Nearly all

seem to have made good progress toward avoiding major computer

disruptions at the end of this year. However, the rush to solve the

year 2000 problem may have created another more insidious and

potentially troubling problem.

Today, we will discuss the danger that government agencies, corporations, and individuals are now more vulnerable to computer

fraud, whether it is in the form of electronic robberies or information warfare.

The reality is that computer systems can be compromised for any

number of reasons—some far more damaging than the loss of

money. Among them are the threats of industrial or military espionage and the use of computers and the network systems by terrorists or organized crime.

Private companies and government agencies alike have opened

up their most sensitive computer systems to outside contractors

who are helping them sort through billions of lines of computer

code to ensure their year 2000 compliance.

Although the vast majority of these contractors are honest and

truthworthy people, even a few unscrupulous operators could create

a significant problem.

The GartnerGroup, which is represented here today, has predicted that by 2004, there will be at least one reported $1 billion

or more theft due to the year 2000 remediation effort.

The concern involves something called ‘‘trap doors,’’ computer

coding that can give unscrupulous contractors access to the sensitive information in a computer long after the year 2000 work is

completed.

From bank accounts and intellectual property to medical records

and defense secrets, companies and government agencies have

given contractors the keys that unlock an enormous storehouse of

information.

With only 149 days left until the new millennium, we must ensure that our critical information technology infrastructure is secure long after the year 2000 has passed away.

So, with Mrs. Morella, I welcome the witnesses we have today,

and I’m sure you will enlighten us in a number of areas.

[The prepared statement of Hon. Stephen Horn follows:]

4

5

6

Chairwoman MORELLA. Thank you, Chairman Horn.

I am now pleased to recognize for any opening comments Mr.

Udall, who is our ranking member today.

Mr. UDALL. Thank you, Madam Chairman. I want to join my colleagues in welcoming all of you here today to the hearing. This

hearing focuses on two issues, the way I see it: computer and network security and then, secondly, whether Y2K-related computer

system upgrades have increased the threat to a company’s or a federal agency’s computer security.

I’d like to take a few minutes to speak about the Science Committee’s role in the area of computer security. Going back into the

late 1980s, the members of this Committee were aware that the

first computer networks, such as ARPANET, which became

NSFNET and is now known, of course, as the Internet, had a twoedged quality: they improved electronic communication but also

compromised computer security.

In 1987, the Science Committee was instrumental in developing

and passing the Computer Security Act. This was the first effort

to improve the security of federal computer systems. Ever since,

the Science Committee has maintained a high profile in this area.

I mention this issue because many believe that Congress has not

given sufficient attention to this issue of computer security. I wanted to highlight that at least one Congressional Committee has

worked diligently to raise public and government awareness of

computer security issues for more than a decade. This was long before most people even knew that the Internet existed, let alone before related computer security issues became important.

Today’s hearing, as my fellow colleagues have mentioned, was

prompted by recent newspaper stories about a GartnerGroup report

warning that by 2004 there will be at least one publicly reported

electronic theft exceeding $1 billion and that steps to solve the Y2K

problem will be a root cause of the security lapses that have allowed this step to happen.

This is a serious assertion that raises more questions than it answers. For example, if it’s true there will be at least a $1 billion

theft, what about the likelihood of several thefts in the range of

$100 million or the tens of thousands of dollars?

Further, how credible are these alarms? After all, the warnings

themselves could undermine public trust in our financial systems

and the government’s ability to provide public services and in our

computer-based infrastructure as a whole.

So, in that spirit, there are several issues that I hope our witnesses will address today. The first is: What data substantiates

claims that there’s an increased risk of fraud as a result of these

Y2K fixes? Secondly, federal agencies, including Congress, and industry have relied on contractors to service their computer systems

since their first installation. What has been the past experience of

this type of fraud? And then, finally, if this Y2K-related fraud is

a real problem, what steps can federal agencies and large corporations take to determine if the malicious code, the so-called trap

doors, have been inserted into their programs?

I want to thank you for being here. I very much look forward to

hearing what you have to say.

Thank you.

7

Chairwoman MORELLA. Thank you, Mr. Udall, and thank you for

also mentioning sort of the genesis of the Science Committee’s interest and involvement in this issue.

I’m now going to ask our panelists if they would rise and raise

their right hand. It’s the policy of this Committee to swear in those

who will testify.

Do you swear that the testimony you are about to give is the

truth, the whole truth, and nothing but the truth?

Mr. PUCCIARELLI. I do.

Mr. MILLER. I do.

Mr. RICH. I do.

Mr. BENNETT. I do.

Chairwoman MORELLA. The record will reflect an affirmative response from all. And, again, we’ll try to follow a tradition, to give

time for questions and other comments, of asking each panelist to

speak about 5 minutes, and then we’ll open it up to questions. And

we’ll start off then in the order in which I mentioned you.

Mr. Pucciarelli, you will start off with the Gartner report.

STATEMENTS OF JOSEPH C. PUCCIARELLI, VICE PRESIDENT

AND RESEARCH DIRECTOR, GARTNERGROUP, INC., STAMFORD, CONNECTICUT; HARRIS N. MILLER, PRESIDENT, INFORMATION TECHNOLOGY ASSOCIATION OF AMERICA, ARLINGTON, VIRGINIA; L. DEAN RICH, VICE PRESIDENT FOR

SECURITY SERVICES, WARROOM RESEARCH, ANNAPOLIS,

MARYLAND; AND WAYNE D. BENNETT, CHAIR, COMMERCIAL

TECHNOLOGY PRACTICE AREA, BINGHAM DANA LLP, BOSTON, MASSACHUSETTS

STATEMENT OF JOSEPH C. PUCCIARELLI

Mr. PUCCIARELLI. Madam Chairman—Madam Chairwoman, Mr.

Chairman, and Members of the two Subcommittees, I appreciate

the opportunity to testify—— Chairwoman MORELLA. I think you should either move it closer

or make sure it’s on.

Mr. PUCCIARELLI. Madam Chairwoman, Mr. Chairman, and

Members of the two Subcommittees, I appreciate the opportunity

to testify today on the computer security impact of year 2000 and

the expanded risks of fraud. Key points in my testimony we will

discuss: our prediction, the analysts of GartnerGroup, that by 2004

there will be at least one publicly reported electronic theft exceeding $1 billion, 70 percent likelihood; our forecast that year 2000 remediation efforts will be identified as a root cause of the security

lapses that will have allowed this theft to happen, 70 percent likelihood; and how input from our clients was factored into these predictions and caused us to increase the probabilities.

My role is to advise business and financial executives in the public and private sector on actions they should take to protect and

maximize the effectiveness of their investments in computer technology. We found medium and large organizations in the United

States spend some 8 percent of sales revenue—that is, 8 cents of

every sales dollar—for computer systems. Ten years ago, this number was only 1 percent. During the same period, our financial systems have largely migrated to an electronically interconnected

8

business model. Best estimates are that $11 trillion in electronic

transfers occurred in the United States in 1998.

Earlier this year, as part of my ongoing research, I reviewed

those issues that may require action by my clients. I concluded, by

reviewing the technical research conducted by my colleagues at

GartnerGroup, that many firms had not taken adequate steps to

secure and audit a year 2000 remediation process. Based on these

observations, I formulated a recommendation to our clients.

I reviewed these preliminary findings with some 300 clients on

Tuesday, March 2, 1999, at a conference in New Orleans. Our clients had differing opinions. Their feedback indicated that the risk

of theft was even higher than I had proposed. As a result, we formally advised our clients in April that we believe that by 2004

there will be at least one publicly reported electronic theft exceeding $1 billion, and that Y2K remediation efforts will be a root cause

of those—that allowed this theft to happen, 70 percent likelihood.

Predicting what will happen is challenging. Anticipating how it

may happen raises the bar considerably. In the case of the first $1

billion electronic theft, the motive will likely be one of greed combined with feelings of underappreciation by a highly skilled software engineer, especially related to the stress of the year 2000 remediation effort. The means will be the tools at hand—the same

electronic systems reliably transact the business of the day will be

instructed to transfer funds beyond the boundaries of the enterprise into the hands of a thief. The opportunity to perpetrate the

crime will come in an odd moment, a situation outside the bounds

of the operating manual. A system will crash unexpectedly and a

single software engineer could make changes without the normal

reviews, due diligence, or oversight. Further, the incident will likely occur long after January 1, 2000.

Clearly, a billion dollars is a huge sum of money. However, compared with the $11 trillion in annual volume of financial electronic

data interchange transfers during 1998, which are growing some

40 percent annually, it represents only 0.0009 percent. To use a

metaphor, a $1 billion theft compared to the $11 trillion in

throughput equates to 48 minutes over the course of a year. In this

context, a billion seems somewhat less significant. Opposing all

this money is the unbounded creativity of the human mind—which

has proved the world round, produced Einstein’s theory of relativity, placed a man on the moon, and committed countless crimes

throughout history. From the Brinks armored car robbery through

the Great Train Robbery, to the most recent financial scandals including BCCI and Barings, each generation adapts theft and fraud

to the technological circumstances of the day.

Given the enormity of the year 2000 remediation process, the

scope of the cash flowing through these systems and the resourcefulness of the human mind in finding different ways to steal, a

large theft seems much more likely perhaps inevitable.

Specific steps need to be taken now and continually re-emphasized to minimize risk. Specifically, we recommended:

One, the most effective theft and fraud deterrent is maintaining

the perception that there are high levels of security. To accomplish

this, we advise our clients to collaborate to create a year 2000 secuVerDate 11-MAY-2000 14:06 Mar 08, 2001 Jkt 010199 PO 00000 Frm 00014 Fmt 6633 Sfmt 6602 E:\HEARINGS\60842.TXT pfrm11 PsN: 60842
9

rity team with the requisite technical and auditing skills to review

procedures, assess the threats, and implement a containment plan.

Second, procedure reviews must limit the ability of a single individual to make changes or initiate activities without a second person participating in the process.

Third, risk assessment must include reviewing all enterprise insurance coverage as well as contracts with external service providers and independent (programmer) contractors.

Four, risk management plans should include careful reconsideration of all existing theft and fraud deterrence activities in light of

this expanded threat profile.

The law of very large numbers dictates that we will have a vastly

increased risk of theft after the year 2000 remediation efforts. In

the rush to aggressively solve one problem, enterprises need to ensure appropriate resources have been rededicated to protecting the

enterprise from the increased risks of electronic theft and fraud— possibly the most important artifact created by year 2000 remediation. These nonlinear consequences of the year 2000 computer

maintenance effort may have a more profound implication than the

linear consequences such as a failure of a specific computer system.

Thank you.

[The statement of Mr. Pucciarelli follows:]

10

11

12

13

14

15

16

17

Mr. MILLER. Thank you, Chairwoman Morella and Chairman

Horn and other Members of the Subcommittee. It is an honor to

appear before your joint Subcommittees, and I want to commend

you and your colleagues for holding this hearing on computer security as attention moves from the Y2K problem to the next and even

greater challenge—Information Security or Critical Information Infrastructure Protection, as it is often called.

Just as your two Subcommittees were among the leaders in educating Congress and the Nation on the year 2000 challenge, I know

that you will play the same role on Information Security. Make no

mistake about it: Information Security is the next Y2K issue for

the IT community and its users.

The evildoers are not just unscrupulous Y2K repair firms. The

infosec threat comes in numerous guises: mischief-minded hackers,

disgruntled employees, corporate spies, cyber criminals, terrorists,

and unfriendly nations.

Virus episodes like Melissa and Chernobyl are becoming more

frequent. The Symantec Anti-Virus Research Center estimates that

new viruses are being launched at a rate of 10 to 15 per day and

that over 2,400 currently exist, and 35 percent of those are considered to be intentionally destructive.

And, of course, there are the unintended consequences associated

with our new dynamic information technology evolution, and, of

course, year 2000 is the exhibit number one.

Assessing the ultimate infosec roles for government and the private sector is really very simple. Our new information-based assets

must be protected and preserved. Participants and users must understand that along with the obvious benefits of information technology are corresponding commitments to protect information technology. With rights—the right for IT to become the firmament on

which most of our society, our government, and our economy are

built—come responsibilities. And the primary responsibility is to

ensure the security of our information society. The societal stakes

involved compel government and industry to seek common ground

on the issue.

Security is much more challenging in the digital world because

it is not the traditional security of wire fences, thick walls, and

guard dogs. And it is not an activity just to be left to the experts,

for all of us are part of the information age and must be sensitive

to protecting it.

The road to a common ground between government and industry

will never be a straight line. On the contrary, while the ends are

commonly shared, the policies that government and industry will

develop in order to provide this protection are likely to be quite different. Again, I remind the Subcommittees that the year 2000 is

the wake-up call. A well-prepared and well-informed private sector

can work with government to find the proper balance which optimizes the government’s needs to protect the critical infrastructure

with business’ needs to manage risks appropriately.

Significant reservations exist, however, on the part of both private industry and government, and ITAA is attempting to address

both from a theoretical and practical standpoint.

18

In developing industry positions on national infosec issues, ITAA

has established a list of general principles that will guide the development of our policy. They emphasize industry leadership, communication and collaboration, infosec commensurate with the true

threat involved without embellishment or magnification, and international collaboration. My written statement provided to the Committee outlines these principles in more detail.

But there are also many questions that must be addressed, including the question, for example: What should be the mechanism

for sharing information between government and the private sector, or even within the private sector itself? What type of threat

and intrusion reporting will be required as opposed to optional?

What type of organizations should plan and execute the strategy

for critical information infrastructure defense? And what kind of

legal and regulatory obstacles are there to information sharing and

information security?

And, of course, a less tangible concern must be addressed, particularly development of trust, both within the private sector and

between the private sector and government. So as you can see,

there is much to be done.

We are working with our customers and with our government to

build the necessary bridges. ITAA is taking a number of actions to

focus on this issue. Following, for example, the issuance of Presidential Decision Directive 63 last year, ITAA was appointed as the

sector coordinator for the IT sector along with two other high-tech

trade associations. We are involved in massive education efforts, including White Papers, and we have held frequent meetings with

representatives across the government to educate, discuss, and provide input.

Education and outreach will be critical to the success of our efforts collectively. This past March, ITAA created the framework for

a new Cybercitizen Partnership in conjunction with Attorney General Janet Reno. The partnership will focus on promoting individual responsibility in cyberspace and creating a private-public

sector forum for exchange and cooperation.

In all honesty, we at ITAA face a daunting job of convincing the

IT industry and our customers to work with government on these

initiatives. But it is a challenge we must step up to if we are to

achieve any degree of success in opening lines of communication.

The United States and much of the world are building their economic house on an information technology foundation. This is an

extremely positive approach to take, delivering tangible benefits to

a fast-growing percentage of the world’s population. If year 2000 is

the first challenge to place our economic house at risk, failure to

adopt a rigorous approach to infosec will be the second and even

more dangerous. ITAA and its member companies are committed

to a private sector leadership role in ensuring that the necessary,

timely, and cost-effective solutions are implemented.

Thank you, and I would be happy to answer any questions you

may have.

[The statement of Mr. Miller follows:]

19

20

21

22

Introduction


g:\graphics\60842.013
23

24

25

26

27

28

29

30

31

32

33

34

35

36

Chairwoman MORELLA. Thank you, Mr. Miller. And I want all of

the panelists to know that the entirety of their statements as submitted to us will be included in the record, and I know that you

have submitted extensive statements, and we appreciate that.

Mr. Rich, I now recognize you, sir. May I indicate that we have

been joined by Mr. Bartlett from the great State of Maryland. Mr.

Rich is from Maryland, Mr. Bartlett.

STATEMENT OF L. DEAN RICH

Mr. RICH. Thank you. Chairwoman Morella, Chairman Horn, and

Members of the Subcommittees, I appreciate the opportunity to appear before you and I thank you for continuing to address the problems associated with information assurance and national critical

infrastructure. As a lead into Y2K, I’d like to submit that Y2K,

while a problem in itself, is a manifestation of a much larger

issue—overall infrastructure assurance. We can look at Y2K as a

wake-up event to better understand and manage those systems

that are increasing in control or influencing every aspect of our

lives.

I come to this Committee with a background of information security as a Naval Reserve Officer in the Naval Cryptologic community and as a businessman working with industry to address the

very issues we are discussing today. I support the Naval Criminal

Investigative Service in my reserve capacity addressing threat

issues. In my civilian position, I am currently with WarRoom Research as Vice President of Security Services, addressing both

threat and vulnerability issues.

You might recall that WarRoom research services the U.S. Senate’s Permanent Subcommittee on Investigations under the 1996

Security in Cyberspace Hearings where we collected information

security risk profiles of 205 Fortune 1,000 corporations.

As we move even further into the digital age, those elements that

comprise electronic commerce, networked systems, and national infrastructure are increasingly at risk. In order for this networked

world to be viable and to be able to operate without concern and

with all the worries transparent to the user, there must be an underpinning of robust security. Often we take security for granted

or, using traditional cost analysis, will accept a certain level of risk

as a cost of doing business. However, in today’s environment, the

cost of doing business without a strong security posture is too high.

Yet many are unaware of these costs. In order to understand the

new requirements of the digital age, governments and businesses

must understand that security can no longer be an afterthought or

redlined when budgets get squeezed. Security must be integral to

one’s overall management picture.

To effectively manage security, one must manage risk. I believe

in the formula risk equals threat multiplied by vulnerabilities and

apply it to my own business decisions. You can see that with zero

threat no matter the vulnerabilities, you will have zero risk. Likewise, if you have zero vulnerabilities and a world of ‘‘bad actors,’’

you have zero risk. Unfortunately, we have a great number of both,

which is driving the risk index skyward.

Vulnerabilities within our infrastructure are exposed on almost

a daily basis. The scale of the infrastructure affected magnifies the

37

impact of these vulnerabilities. Popular computer programs that

get larger distribution have a larger impact. This has been demonstrated recently by a vulnerability that allows the promulgation

of Macro viruses via e-mail. Using the risk formula, this vulnerability would not be an issue if it were not for the immense threat

we live with on a daily basis.

I believe the threat to our infrastructure is real. During the hearings on security in cyberspace in June of 1996, Mr. John Deutch

did a great job of summarizing the threat and the need for increased public awareness. Many companies and government agencies have taken a skeptic’s approach when discussing threats. They

will say, ‘‘My network and systems are running fine. I don’t see any

threat here.’’ They lack the ability to see the threat and, therefore,

deny it exists. They would be surprised to see, with an intrusion

detection package—or intrusion detection application on their

Internet perimeter, they would detect at least one unusual occurrence a day.

A number of years ago, while on active duty in the Navy, I was

deployed aboard a submarine for a couple of months. Having an interest in the sonar system, I asked one of the crew to give me an

overview. The young officer was very proud of the system and said,

‘‘If something were out in the water, we would hear it.’’ I caught

him by surprise when I said, ‘‘So, let me get it straight. If you don’t

hear, it isn’t there?’’ I think that overconfidence in current capabilities and the unwillingness to ‘‘think out of the box’’ will lead to

complacency. You need to look before you can see the threat. I support innovated efforts to look where no one has looked before.

I’d like to share a couple of short stories, and I will keep it to

the first one in the interest of time. In early 1995, I was running

a vulnerability assessment on a large number of Internet connected

systems operated by the Department of Defense—a Department of

Defense organization. During the assessment, I entered a computer

that was used by software developers to maintain the source code

for a communications package. The source code was clearly unclassified, but it was disturbing for me to know its only use was on a

classified network. A ‘‘total systems’’ approach was not used when

implementing a support structure for the communications package.

Others have demonstrated similar events over the last couple of

years, and we’ll still continue to have these problems.

I’d like to address the Y2K vulnerability issue. A recent newspaper article brought to light a problem of outsourcing Y2K remediation and the threat of foreign nation states inserting backdoors for

future year. I believe this is a valid threat and agree it needs to

be addressed today. On the other hand, many Fortune 500 companies have been outsourcing source code development and maintenance for years. A large number of these U.S. companies have permanent network connections into their corporate networks to facilitate the work from overseas. I can tell you that without intrusion

detection or traffic analysis, these foreign companies have the potential to run free and obtain unauthorized access to U.S. corporate

proprietary information.

In summary, I would recommend programs that support a total

risk management approach to infrastructure assurance. I recommend protecting the critical path and the life cycle of high-value

38

infrastructure, not just the end product. Keeping vigilant in the

search for vulnerabilities and new threats. I fully support the requirement for collaboration between government and commercial

organizations. We will not survive as a country without a framework of trust, dialogue, and collaboration. I look forward to working with this Subcommittee and others on this issue within the

months to come.

Again, thank you for the opportunity to speak, and I’d be happy

to answer any questions.

[The statement of Mr. Rich follows:]

39

40

41

42


g:\graphics\60842.030
43


g:\graphics\60842.031
44


g:\graphics\60842.032
45

Chairwoman MORELLA. We thank you very much, Mr. Rich, and

it’s now my pleasure to recognize Mr. Bennett.

STATEMENT OF WAYNE D. BENNETT

Mr. BENNETT. Thank you, Chairwoman Morella, Chairman Horn,

members of the Subcommittee. My name is Wayne Bennett. I’m a

partner at the law firm of Bingham Dana, and I chair the Commercial Technology Practice Area at our firm. Thank you for inviting

me to this hearing.

The nearly boundless creativity of the criminal mind will likely

one day result in a billion dollar computer fraud. But I believe the

apparent increased risk presented by the Y2K remediation effort is

more than offset by the improvements in remediation procedures

that have been implemented at large and mid-sized companies precisely to deal with the behemoth Y2K effort. When the billion dollar fraud occurs, its connection to the Y2K remediation effort will

be more in the nature of serendipity than statistical inference, and

law enforcement will be in a better position to identify the perpetrator because of the changes that the Y2K effort has brought.

Consider the recent testimony of Gary Beach, Publisher of CIO

Magazine, before the Senate Special Committee on the Y2K Technology Problem. I’m a member of the CIO Magazine editorial advisory board, and I can attest to the efforts that organization has

made to look past the Y2K hype and its coverage. While the purpose of Gary’s testimony was to report the results of a Y2K tracking poll, Gary added a particularly incisive thought at the conclusion of his remarks that one positive legacy of the Y2K exercise is

that many companies were finally moved to undertake comprehensive inventories of their information technology systems.

I would expand on that notion of a positive legacy. The learning

at many corporate IT departments, particularly at mid-sized corporations, has been greatly enhanced since the Y2K wake-up call

went out. My clients are from diverse industries, including banks,

mortgage companies, manufacturers, distributors, broker dealers,

grocers, IT hardware, software, and services lenders, and e-commerce companies. Many of them contacted leading experts to teach

their IT personnel the best industry practices for implementing

their Y2K projects, and they’re applying that learning to their

maintenance activities generally.

Before the Y2K exercise, systems maintenance was in some IT

shops just a tedious chore that was relegated to anonymous junior

programmers. Maintenance was a stepchild, and many IT departments struggled with version control, documentation, and accountability. Often IT personnel would open a source code file and find

no written clue regarding who worked on the code last, what

changes had been made, or even when or why it was changed.

The best maintenance practices recently introduced by consultants have a by-product. Many systems environments are now more

secure than they were just a couple of years ago. For example, the

introduction of project notebooks requiring formal sign-offs by responsible employees and contractors have employees staking their

reputations on their work. Each sign-off indicates that a software

routine is ready and that it successfully integrates into the larger

system. Testing naturally becomes more comprehensive. Validation

46

efforts are enhanced to ensure that no unwanted changes have

been introduced into the system. Internal and external auditors review project notebooks as part of their Y2K and technology operations audits. Reports are generated at each management level

until a summary is presented to the board of directors. Visibility

and accountability at every level has increased. Security has been

enhanced.

Trap doors and the attendant risk of major fraud have been

around since shortly after the beginning of commercial computing.

Then you enacted the Computer Fraud and Abuse Act of 1986,

the Information Infrastructure Act of 1996, the Economic Espionage Act of 1996, and the No Electronic Theft Act of 1997. The

criminal laws are in place. Now, with the introduction of better

maintenance practices, the forensic evidence is more likely to be

available to track down a wrongdoer.

A billion-dollar fraud is inevitable at some point since no security

system is completely airtight. But is it more likely now as a result

of the Y2K effort? I don’t think so.

Consider the current criminal opportunity. With increased scrutiny of every line of code, choosing this juncture to hide nefarious

software in systems is akin to the decision of a second story man

choosing to burglarize the police chief’s house. Some burglars may

find the prospect challenging, but most won’t and those that do will

find the going rather rough.

At the July 22nd Senate Y2K hearing, Senator Bennett put the

question of the reported increased security risk to a panel of IT executives. The panelists acknowledged that the security risk is increasing every day because of the increase in computer usage generally. But they also responded that the procedures implemented to

perform Y2K remediation make them more confident today that

while they can never fully prevent a security problem, they can at

least better now detect a security problem.

These procedures can fail, so we need to be ever vigilant about

security. But we should also be careful about any message that we

send to those thousands of employees and contractors who are honestly and diligently trying to solve the Y2K problem.

The Nation’s IT personnel are right now working at a breakneck

pace doing thankless, yeoman’s work against an unforgiving deadline. If they succeed in their Herculean task, some—perhaps even

some here today—will question why we spent billions of dollars on

a crisis that never came about. If they fail, they will be blamed.

At this point, I suggest that we let the security officers quietly

pursue their jobs while we lend all necessary support to the employees and contractors working on the Y2K effort—without any inadvertent suggestion from any quarter that any of them might be

criminals, even in the face of continuing risk. The job of fixing the

Y2K problem and the consequences of failure are so enormous that

the ongoing risk of fraud pales by comparison. We should keep our

focus over these next critical few months.

Thank you for your time.

[The statement of Mr. Bennett follows:]

47


g:\graphics\60842.033
48


g:\graphics\60842.034
49


g:\graphics\60842.035
50


g:\graphics\60842.036
51


g:\graphics\60842.037
52


g:\graphics\60842.038
53


g:\graphics\60842.039
54


g:\graphics\60842.040
55


g:\graphics\60842.041
56


g:\graphics\60842.042
57

Chairwoman MORELLA. Thank you very much, Mr. Bennett. I’m

glad we, you know, ended with you because then you put another

perspective on the concept of computer security being important,

but not necessarily, I was going to say, increased because of Y2K.

I understand also you were at the—what used to be called the National Bureau of Standards.

Mr. BENNETT. Yes, I was.

Chairwoman MORELLA. Which is now NIST, which has been very

much involved with our computer security system and more legislation coming up on that.

As you could tell, we do have a vote coming up. Maybe I could

start off by asking one question, and then we could recess for about

15 minutes, if you’ll all be here, and then continue with questions.

Unless you wanted to start off with a question, Chairman Horn?

Mr. HORN. I’ll be glad to, if you’d like. I don’t know if you want

to go vote and then I can go vote and keep the show on the road.

Whatever you’d like.

Chairwoman MORELLA. All right. He’s got a great idea. I will go

vote, and then he will keep this—keep it going, and then I’ll come

back.

Mr. HORN. Mr. Bennett, I was interested when you said the

criminal laws seem to be in place. Is that true in every state? Have

we done an analysis of that? Mrs. Morella and I can request the

American Law Division to look at that now that you’ve raised the

question.

Mr. BENNETT. Well, I think the federal laws are in place. In fact,

there was just a recent article in, I believe, Computer World where

a defense attorney based in San Francisco was complaining that

the federal laws are set up so that her—this is not surprising—that

her clients are having a tough time going and are pleading out instead of going to trial because they risk very severe criminal penalties. I do not know, however, on a state-by-state basis what the

answer is.

Mr. HORN. Any comments from anyone else here on that point?

Well, the $1 billion does catch a headline, and that’s, I think,

more likely to be banks. What will happen with the non-banks

where you could not have money to move, is blackmail. And the

question would be: To what degree can we already cope with blackmail, the disgruntled employee that was mentioned? No question

about it. You could—with a smart programmer, you could have

chaos within a computer system.

Mr. MILLER. Mr. Chairman——

Mr. HORN. Mr. Miller.

Mr. MILLER. Mr. Chairman, we had Mr. Scott Charney, who

heads the Criminal Division area of computer crimes speak at a

conference we cosponsored last week with George Mason University. And Mr. Charney indicated in his public comments, at least—

and maybe the Subcommittee would want to contact him directly,

but I think I would agree with Mr. Bennett—that the federal laws

are pretty strict.

The challenge is finding the miscreants and prosecuting them.

But I think they feel that the laws are pretty strict, and they’ve

been fairly successful in prosecutions. State laws, I don’t have any

information on them.

58

Mr. HORN. If it is blackmail and it isn’t moving money around

from accounts here to accounts abroad and so forth, how do we deal

with the blackmail aspect?

Mr. MILLER. They’re both federal statutes, as I understand it. I’m

not a lawyer.

Mr. HORN. Have we had much computer security blackmail?

Mr. MILLER. I’ve been told of stories anecdotally. Nothing’s been

reported publicly.

Mr. HORN. Well, I realize it’s like rare-book libraries. They don’t

want to talk about it, and that was the mistake of their life because now that they started talking about it, you find these people.

And the thief just had a field day, can walk off with all the precious books, and they did it at Harvard and Yale and my own university and so forth. But it just seems to me we need a strategy

here in educating chief executives. As we went through the Y2K bit

in the last year, one of the things that discouraged me was the bad

advice that their lawyers gave, which was, Chief, don’t say anything, then they can’t do something to you in court. Well, that’s

utter baloney because they’ll do you for not doing anything, and we

really needed CEOs to provide some leadership, which they finally

woke up and did.

But how would you deal with this in this way to get top management to understand that they’ve got to do some strategies and tactics here to protect themselves in the interest of their stockholders?

Mr. PUCCIARELLI. Congressman Horn?

Mr. HORN. Yes?

Mr. PUCCIARELLI. If I could just say, in my opinion, security is

to computers what safety was to automobiles in the 1960s. We have

a relatively immature technology, relatively in the context of 20

and 30 years versus 100 years. And what goes with a new technology is a certain exuberance and a denial of some of those risks.

And I think what happens over time, the experience of using the

technologies, of understanding the consequences, and understanding the implications will bring to light to the executives and

to the leadership of the organizations that use these tools the risks.

So rather than delegating the leadership and management of these

systems to technical specialists, the executives will become more

involved and more active in establishing security procedures for the

overall enterprise.

Mr. HORN. Now, with the Presidential Directive—by the way, if

you have your mikes still on, turn them off so we don’t get a feedback

On the Presidential Directive, how active has the security community and the information technology community been helpful in

that? And where are we in the progress under the Presidential Directive?

Mr. MILLER. I think there’s some good news and there’s some

bad news there. I think the good news is that the various government agencies are trying to come up with a plan. We saw a leaked

version of it in the New York Times very recently, an article by Mr.

Markoff which focused on just the privacy issue. But there has

been extensive consultation, and I do commend the people in the

government for trying to get as much industry input as possible

into the process.

59

As an example of bad news, though, Mr. Chairman, I’ll give you

one specific example. We were designed by the Department of Commerce, as I mentioned in my testimony, as the sector coordinator

for the information technology sector along with the Telecommunications Industry Association and the U.S. Telephone Association.

That office within the U.S. Department of Commerce is probably

going to be defunded in the year 2000. So, on the one hand, we are

trying to undertake activities in conjunction with the Department

of Commerce agency. On the other hand, the Department of Commerce, even though they did request some money, apparently it’s

not a very high priority. Congress hasn’t seen it as a high priority.

So we’re going to—may find ourselves on October 1st being designated by the sector coordinator of an office that no longer exists.

Mr. HORN. Well, we thank you for alerting us because we ought

to keep on top of that.

I’m going to have to declare a recess now so I don’t miss a vote.

So we’re in recess until Mrs. Morella returns to chair the meeting.

Thank you very much.

[Recess.]

Chairwoman MORELLA. Thank you, gentlemen and others, for

bearing with us as we had two votes instead of one vote. And matter of fact, one was on——

Mr. HORN. Patent policy.

Chairwoman MORELLA. Yeah, patent policy, which might interest

some of you.

Ms. Rivers is here from Michigan, and I guess I’ll start off with

a question or two and then let Ms. Rivers ask any questions.

Mention was made—I think you, Mr. Miller, mentioned the Presidential decision, Directive 63, which was issued in May of 1998,

and that explains the Administration’s policy on critical infrastructure protection. Incidentally, we had the first House hearing on the

critical infrastructures report. The infrastructures include telecommunications, banking and finance, and all the essential government services. The directive requires immediate Federal Government action, including risk assessment and planning to reduce exposure to attack.

Maybe I’d start off with you, Mr. Miller, in responding to this,

but I want to hear from the others, too. In your opinion, has the

implementation of this directive been effective? And why or why

not? Does more need to be done?

Mr. MILLER. The process has been a little slower than I think

many of us anticipated, but maybe that’s all for the good. The trial

CIAO office, which everyone sort of chuckles at, but the Critical Information Assurance Office, which has coordinated the development of the longer-term plan, has been somewhat slow, but they

have to engage numerous federal agencies. They have done a good

job, Madam Chair, I believe, of trying to engage industry and academia in getting input in the development of that plan. So I think

they are moving forward in a reasonable pace to come up with a

plan.

It’s very tricky, though, because the exact lines of responsibility

between the private sector and government—there may be differing

views, as I suggested in my testimony. The private sector may beVerDate 23-FEB-2001 14:40 Mar 08, 2001 Jkt 010199 PO 00000 Frm 00065 Fmt 6633 Sfmt 6602 E:\HEARINGS\60842.TXT pfrm07 PsN: 60842
60

lieve that the government needs to be less involved, and some people in government want to be more involved.

The point I mentioned to Chairman Horn while you were away

was some of the things that disturb us, for example, is the government, to industry, is not necessarily someone we like to work with

all the time. I have a little bit of concern about it. One of the departments, however, I think industry is most comfortable with is

the Department of Commerce. The Department of Commerce in the

National Telecommunications Information Agency, headed by Assistant Secretary Irving, has responsibility for this critical information issue, and we were designated, along with two other associations, as a sector coordinator for the IT industry.

But now it looks like they are going to have no money for FY

2000. There was a request for a small amount of money, I believe

$3.5 million, for FY 2000, but, candidly, I don’t think it’s very high

on the Administration’s priority list. And from what I understand,

with all the pressures that you all have to cut domestic spending,

that money may disappear.

So that’s an example of where we thought there were good plans

in place to try to move forward, and we were excited about the opportunity to be the sector coordinator for the IT industry. But if

that agency funding goes away and there’s nothing in Commerce

for us to work with, then in some sense industry’s role is back to

square one. At least my sector’s role is back to square one.

Chairwoman MORELLA. Would any of the other panelists like to

comment on that? I’m going to ask a question also that you might

want to respond to at the same time. Do you think we need a computer security czar? I don’t mean to overuse that term, but somebody in the Federal Government such as the role that John

Koskinen has played with Y2K that will be an oversee also of critical infrastructures, computer security. Mr. Pucciarelli?

Mr. PUCCIARELLI. Congresswoman, first a quick comment on the

Presidential Policy Directive 63. In general, the entire area of cyber

warfare and security is moving extremely quickly. It’s very difficult

to design a solution, just from an engineering perspective to design

a solution to address a threat, and to do it and get it implemented

in a timely fashion.

If you look at the typical procurement cycle right now, from the

time an engineering solution is designed until it’s presented, run

through for hearings, funded and implemented, it could take 2

years. The problem is, is that it’s difficult to anticipate—it’s virtually impossible to anticipate 2 years ahead of the threat what

needs to be done because this area is moving so quickly.

So just one comment on that is just I would counsel you to look

at the time lines to actually acknowledge the threat, design a solution, and implement it.

As far as your question on the computer security czar, I think

there’s a plus and a minus. My own personal perspective and the

perspective of the GartnerGroup is that security is an enterprise

issue. It is not an issue that belongs dedicated to somebody who

sits in the back room of the organization or off to the side in an

ancillary role. So I think there’s a risk with setting up a czar in

that it might be viewed as something that is the domain of the

technical specialists.

61

I think the challenge is how do we elevate security to an executive issue and an executive priority, and if a computer security czar

was able to portray the issue with that type of presentation, I think

there’s an opportunity to have a very positive impact.

Chairwoman MORELLA. Mr. Rich.

Mr. RICH. I support his statement. I think having a computer security czar would probably be not a good idea, that security is part

of an infrastructure, an enterprise implementation, and that we

need to support the current infrastructure assurance directives

that have been put out there.

Chairwoman MORELLA. Mr. Bennett, would you like to comment

on——

Mr. BENNETT. I think that anything that’s done has to draw

some very clear lines between government and corporate enterprises. I think that the prospect of a czar might actually frighten

some corporations who may have some operations that are even

part of what you might consider infrastructure. I mean, I think

that there are a lot of large corporations out there that would be

happy to just have government approve their international use of

very strong encryption methods and then stay out of the picture as

far as their own security is concerned until such time as there is— where their own security procedures fail, and then they’ll want the

help of law enforcement officials to try to track down whoever did

it.

Their biggest issues right now do not involve a billion-dollar

fraud. If they look past Y2K and they’re talking about people taking things from them, they’re worried about competitive intelligence.

Chairwoman MORELLA. Would either of you like to comment on

Directive 63?

Mr. RICH. I haven’t been myself involved a great amount with

the directive. From what I’ve observed and talking with others, I

support Mr. Miller’s comment on that it’s moving maybe not as fast

as some would expect, but I think it’s moving in the right direction.

And I’ve seen a lot of corporations now starting to talk to the government. I like the idea of collaboration and trust. Unless we can

get the point across to the commercial organizations that the government can help and not mandate or dictate and more or less

work together, I think we’ll get longer—further down the path.

Chairwoman MORELLA. I didn’t mean to be rigid when I said

computer security czar. I guess I’m thinking to implementation of

current policies in terms of coordinating. There is no doubt in my

mind we lack that in the Federal Government, but we can get into

that in some other questioning.

I would like to now recognize Ms. Rivers.

Ms. RIVERS. Thank you, Madam Chair.

Mr. Miller, I have a question regarding funding you raised in

your written commentary, and I apologize that I wasn’t here for the

testimony. But in your written statement, you raised concerns that

the $3.5 million that is now being allocated for CIIAP is inadequate

in your view or barely adequate. Are you aware that the Commerce, Justice, State bill, appropriations bill that we’re going to

vote on this afternoon, zeroes out that program? And what will the

effects be of that decision?

62

Mr. MILLER. I heard—I haven’t actually seen the language of the

legislation, Congresswoman Rivers, but I heard that they were

going to zero it out. I think that would be most unfortunate from

the perspective of private industry.

Clearly, the issue of information security has spread throughout

the government—the Department of Defense, the Department of

Justice, National Security Agency, et cetera, et cetera. And, by the

way, in response to Congresswoman Morella’s question, I would

support a czar for exactly that reason.

But, clearly, the government is perceived by many people in industry as kind of threatening, particularly if you’re talking to national security people or law enforcement people. To the extent the

industry is comfortable, I think they’re most comfortable talking to

the Department of Commerce, and so that’s a logical place for business to communicate. And zeroing out that budget item from within NTIA I think would be most unfortunate. Even a relatively

small amount, $3.5 million, is better than nothing, and I think the

problem is—I’ve spoken to Assistant Secretary Irving about this—

is he’s already had severe budget cuts over the last 2 or 3 years,

and if this money gets cuts down, he can’t find it to take out of hide

somewhere else. So I’d hope that the Congress would take another

look at that, and whether $3.5 million is exactly the right number

or not, I don’t know. But I hope the Congress would take another

look at that and put some funding in there because that would

make industry much more comfortable in terms of working with

government.

Again, there’s no disrespect to the FBI or the Defense Department, but if we have to talk to somebody, it’s a lot easier to talk

to the Commerce Department.

Ms. RIVERS. Thank you.

Mr. Pucciarelli, I have a question for you. In your comments, you

talk about a 70 percent probability that there would be at least one

electronic theft of a billion dollars, which—I may not have it right,

but that would seem to be the biggest theft in our history. I mean,

I don’t think we’ve ever had a billion dollar theft. And you use the

terminology that really reflects sort of the science of statistics.

How did you arrive at that?

Mr. PUCCIARELLI. What we do, Congresswoman, is, as part of our

recommendations at GartnerGroup, we have a practice of assigning

a probability to a particular prediction. And the reason that we assign probabilities is so that our clients have an ability to take these

predictions and appropriately factor them into their business plans.

The probabilities were not scientifically derived. They were arrived—derived based on judgment, and there is an explanation of

the probability process in my formal written testimony which has

been submitted to the Committee.

Ms. RIVERS. How do you translate a probability—or a judgment

into a 0.7 likelihood?

Mr. PUCCIARELLI. A 0.7 likelihood, in terms of how we explain

that to our clients and advise that to our clients, is we would say

that you should assume that this is likely to happen. If you—if it

had a 0.8 probability as an example, we would say assume it will

happen. So with a 0.7 probability there is still some risk that it

63

won’t happen. The range of probabilities that we publish goes from

0.6 to 0.9.

The whole notion and the whole purpose of this piece of research

was to advise our clients to escalate their risk management practices. And in the context of that, what we are really saying with

the probabilities is that we believe it’s likely that there will be at

least one large outrageous theft.

Ms. RIVERS. So what you’re saying is it’s really not a scientific

tool, it’s a sales tool?

Mr. PUCCIARELLI. No. That’s—not at all, Congressman. What my

point was, it’s not a sales tool at all. What it is is it’s a way for

management within our client organizations to appropriately weigh

the probability.

Ms. RIVERS. That’s what I’m trying to understand, given my

training, is how you are creating your probabilities, what you are

actually using that can be replicated by someone else. Looking at

the same data, can they come up with the same conclusion?

Mr. PUCCIARELLI. The way that we actually create the probabilities is based on—first of all, it is not data. It is—it is qualitative interactions with our clients and qualitative assessments of

what’s going on in the environment. The intention of the probabilities is to factor them into the management process within our

clients. So the idea is that we can give our clients a degree of confidence as to how sure we are that this will happen.

Ms. RIVERS. What are the elements that you weigh in coming to

this conclusion?

Mr. PUCCIARELLI. We look at three different major aspects in

forming a probability. First we do primary research, which is to

look at the specific area. And as I testified earlier, we did that

based on direct examination and in conversations with our clients,

what was going on in terms of the process itself. We then review

preliminary findings with our clients and ask their opinions and

their assessments of our recommendations. Then the third and

most important thing is, before we publish a recommendation and

assign a probability, we—as a community of analysts,

GartnerGroup has over 700 analysts review the major policy statements, and as a community of analysts, we have to agree on what

those probabilities are, and we have to agree what the major statements are.

So this forecast represents a consensus position of literally hundreds of people within our organization to support—and it has to

agree with their qualitative and quantitative observations as well.

Ms. RIVERS. Okay. Thank you.

Thank you, Madam Chair.

Chairwoman MORELLA. Thank you, Ms. Rivers.

Chairman Horn.

Mr. HORN. I’ve had 5 minutes, so let everybody else go, and then

I’ll have one question.

Chairwoman MORELLA. Mr. Turner from Texas.

Mr. TURNER. I will yield to Mr. Horn.

Chairwoman MORELLA. Chairman Horn? I mean, I’ll ask a question.

Mr. HORN. Let me just ask one question. I’ve appreciated the

various papers you four gentlemen have submitted.

64

You’ve suggested, Mr. Miller, that we grade federal agencies on

computer security, much like we currently do for the year 2000

work. And I’m just curious, What categories of criteria in relation

to this subject would you suggest and use?

Mr. MILLER. I think, Mr. Chairman, your grading system the last

31⁄2 years or so for the government’s reliability and readiness for

Y2K has been a tremendous tool toward driving them toward the

successes that you mentioned in your statement earlier today, and

you deserve a great deal of credit, as does Congresswoman Morella,

for focusing attention.

A similar system, I believe, could be developed. I’m not prepared

to give you the exact criteria, but things like the percentage of

spending on IT devoted to computer security, the attention paid by

senior management to computer security; reports of intrusions and

detections of intrusions could be another metric that you could look

to. So I think you could get—probably put together a fairly

straightforward and easily agreed upon list of indicia that you

could use to use your excellent grading system, and I think that

would help drive the agencies toward more attention to this problem.

Mr. HORN. Where do—where are the data on intrusions kept? Is

it simply by agency? Does OMB have any information that they’ve

collected over the years?

Mr. MILLER. There are two sets of data. There are data from the

private sector, which are reported to what’s called CERT, the Computer Emergency Response Team, at Carnegie Mellon University.

They’re, of course, voluntary reports. And to go back to Congresswoman Rivers’ question about hard data versus theoretical data, I

do note that the number of incidents reported to CERT has increased dramatically over the last few years.

Within the government, my understanding is that they don’t necessarily share information among agencies, and that’s one of the

issues being looked upon—looked at within the PDD–63, is to exactly how do you make sure that all the information is being

shared appropriately among the agencies.

Mr. HORN. Are the Carnegie information—are those data accessible?

Mr. MILLER. In some cases, the specifics are accessible, and

sometimes it’s just the generic numbers. I think one of the biggest

challenges that this issues faces, as Mr. Pucciarelli was suggesting

in his earlier comments, is how much willingness is there among

companies as they mature to share information. Certain industries

such as the financial services industry have already been exposed.

Citibank had a relatively large potential theft several years ago,

and so Citibank is now wanting to talk about this publicly. You can

get them to go to any conference, any open meeting, and they’ll

come and talk about it. But if you ask 99 percent of all financial

institutions or other types of organizations, ‘‘Do you want to admit

times that you’ve had intrusions or thefts or breakdowns?’’ most of

them are going to be totally silent, totally mum.

So one of the challenges we’ve had as an industry, Mr. Chairman, is figuring out how to get companies to share information in

a way that will help everyone fight off other potential intrusions

and threats, but at the same time not be concerned that propriVerDate 23-FEB-2001 14:40 Mar 08, 2001 Jkt 010199 PO 00000 Frm 00070 Fmt 6633 Sfmt 6602 E:\HEARINGS\60842.TXT pfrm07 PsN: 60842
65

etary information will leak out or that their competitors will get an

advantage or it will leak to the press and hit the stock price, et

cetera. So companies are always trying to balance these two things

off. It’s not just the legal issue which you raised before in regard

to the Y2K. It’s a whole set of potential down sides to exposing information as opposed to the one up side, which is to sort of be a

good citizen and by reporting the information about an intrusion

that you had, you may save somebody else or you may help to protect the entire economy. And we are not yet at a position, I think,

where the leadership of business in this country has made that balance of that equation and said in all cases we will share information. And one of the reasons is that they’re not sure about sharing

information.

Let me just bring one more specific problem to your attention, is

the Shelby amendment. I think industry supports the Shelby

amendment generally. We believe that federally funded research

results should be available to the public. And what Senator Shelby

has done is good. But my companies have come to me and said,

Now, what if we share information and there’s some kind of federal

grant involved with the organization that has that information and

we believe it’s confidential and then a FOIA request comes in? Government FOIA exemptions can’t be used because it’s a private sector organization. Then what do we do?

So I think that’s not—it’s an unintended consequence of the Shelby amendment which is something we’re trying to puzzle through

right now.

Mr. HORN. Yeah, well, as you know, we’re going to struggle

through on that, and you have to protect the people that, let’s say,

are trying to win the Nobel Prize or something. We shouldn’t have

their data all around and polluted. That will get tested soon

enough. And we don’t want to discourage science. On the other

hand, we don’t want to—in this situation, we’re talking about, we

don’t want to have sitting-duck targets because they say, boy, look

at all the entries there, let’s see if we can do it. And I suspect

that’s worrying some. The Good Samaritan law has helped on the

year 2000 a bit, and industry plants have been working with each

other, from the best we can understand on that. I don’t know if

that’s your feeling or not. There’s much sharing of information.

Mr. MILLER. Definitely. But it took legal action to do it. But,

again, if Long Beach State, your former institution, set up a classified center and encouraged companies to provide information and

they got Federal funding somehow, what does the Shelby amendment do to that data? It supposed to be sanitized. It’s supposed to

be protected within this research center within the university. But

can someone use—I don’t know, but the questions have been asked.

Can someone use the Shelby amendment to come in and say I want

access to all that data? And suddenly the whole confidentiality system breaks down, the trust breaks down, and no one supplies information to the Long Beach State center. We’ve lost the whole purpose of the organization in the first place.

Mr. HORN. Are there any questions and thoughts that none of

you have mentioned that you now would like to make? This is at

least my wrap-up question. Mrs. Morella might have many more.

But just what are we missing that we haven’t really focused in on?

66

Mr. RICH. Mr. Chairman, I’d like to make a quick comment

there. In the spirit of PDD–63, rather than requiring—or asking

people to give you their particular data on break-ins, if we take a

baby step and say how about sharing threat information-these are

people that are trying to touch you and look at your networks but

not successful in getting in—that would be a first step in establishing the trust relationship.

Mr. HORN. That’s a good suggestion.

Chairwoman MORELLA. Thank you, Chairman Horn. That’s

great.

This is so reminiscent of Y2K when we talk about failure to and

concern about sharing information and the coordination that is necessary. And, of course, we’re talking about computer security that

is troubled particularly because of Y2K compliance.

With regard to the Shelby amendment, it’s interesting that here

we are in the room where the ranking member, George Brown, is

the one who’s introduced the legislation to get rid of the Shelby

amendment, and, of course, I’ve heard from National Institutes of

Health and a number of other institutions like that that are hoping

that—Mr. Miller, that you can—we can work out some kind of a

compromise.

I—in terms of where information may come from, I can remember years ago, GAO, you know, when they came out with their list

of high-risk areas, they had Y2K there, and they’ve had computer

security there for some time. That maybe another source of information to have GAO do further reporting. And, of course, they’ve

done a number of reports on problems with computer security, particularly in DOD. And I wonder, the inspector generals, would they

not also be looking at this, or should we be telling them to begin

to look at this? I don’t know if any of you are cognizant.

Mr. Pucciarelli.

Mr. PUCCIARELLI. Congresswoman, I think that the whole issue

of computer security could clearly fall into the domain of the inspector generals, and I think that depending on which agency is

looked at, I think you’ll see different degrees of activity in the area.

I think that there’s clearly an opportunity to raise the issue on the

agenda of the IGs, and, again, I’ll come back to my point earlier.

The real challenge is how do we get the leadership of the organizations involved as well.

Yes, the IG is the means by which to do it, but the challenge is

how do we get it to the executives.

Chairwoman MORELLA. And you mentioned—Mr. Miller, you

wanted to comment.

Mr. MILLER. I agree exactly with what Mr. Pucciarelli is saying.

That’s why I endorse your idea of the czar, as long as the czar is

conceptualized the way Mr. Koskinen has conceptualized the role,

not that the czar——

Chairwoman MORELLA. Right.

Mr. MILLER [continuing]. Is to fix everything himself or, if it’s a

czarina, herself; but that, number one, that person has the authority to go directly to Cabinet officers and make sure that the Cabinet officers personally are paying attention to the issue; that that

person has the ability to work with the private sector by organizing

them by sectors, as Mr. Koskinen has done very effectively. He’s

67

not trying to fix the problems with the electricity industry or the

retail industry, but he’s working with the appropriate private sector groups to do that.

Also, he or she would be able to coordinate among the different

agencies, and, frankly, it’s a little confusing to the private sector

to know whether we should talk to people at the CIAO or Mr.

Hamre at DOD or people at the NIPC or people at Commerce. It

would be a little bit easier to, if there were someone who had a central role and also had access directly to the President and Vice

President, as I believe Mr. Koskinen does on Y2K issues.

Chairwoman MORELLA. And looking at the private sector, Mr.

Pucciarelli, you mentioned in your statement that many firms have

not taken—you used the term ‘‘adequate steps’’—to secure and

audit the year 2000 remediation process. I wonder, what do you

mean by adequate steps?

Mr. PUCCIARELLI. Congresswoman, in forming this scenario that

I identified, one of somebody stealing a large amount of money, I

started from the premise that somebody would do it. And then I

posed the question back to my clients and said how likely is this

to happen. And the response back from the practitioners in the

field was that, in general, the level of security in their opinion was

not very high. And that was one of the reasons why I went forward

with this research and deemed it appropriate to recommend to the

executive leadership of the various organizations to take as a given

that this is a likely event and to implement risk management activities, which was really the underpinning of what my research

was.

It basically said you as leaders of these organizations need to implement risk management because the details—the people that are

actually doing it, the practitioners, believe that there is a relatively

high risk.

Chairwoman MORELLA. Is implementing an independent

verification validation process going to mitigate the problems and

the trap doors?

Mr. PUCCIARELLI. To implement a comprehensive security program, we have to cover three specific areas. We have to cover people, process, and products. And when talk about people, a metaphor

might be to look at the bar exam. If we were to look at process,

it might be the equivalent of the FDA certifying a surgical procedure, or a process might be the certification of a particular software

development process. And a product might be the equivalent of the

regulation that DOT has for automobiles to meet safety standards

or, in the public domain, the UL underwriting seal of approval.

To get true security, we’re going to have to approach it from all

three fronts.

Chairwoman MORELLA. I’m glad you wanted to respond, Mr. Bennett, because I really felt I had to give you an opportunity to engage since your point is that it’s not Y2K that is the big problem

with computer security. So, sir?

Mr. BENNETT. Well, I think I stated my point on the relationship.

I think they’re both very important issues. I just don’t see them— the statistical inference there. But with respect to the independent

audit and the IG’s role, it seems to me that the independence of

both an IG or an outside auditor is one piece and the only piece

68

that should be independent of line management. While auditing on

the one hand has to be independent, someone has to come in and

say how good a job you’re doing, there are a couple of stages that

have to come before that, and those, if you’re ever going to make

this work, it seems to me, have to be done by line management because they have to believe in what they’re doing.

Now, in defense, there may be a different weighing that takes

place. How much—there’s a certain drag on productivity that’s

going to happen when you implement extra security procedures.

You try to minimize it, but it happens. That—where—how much of

a drag on productivity you’re willing to tolerate may be different

if I’m trying to keep secret the Nation’s defense secrets. At the

same time, if I’m a corporation and I am trying to keep competitive

information out of my competitor’s hands, which is very important,

there’s a different drag on my productivity that I might accept.

So line management, first of all, has to decide how important is

it and to what level are we going to protect it or try to protect it.

And then there has to be an implementation process, all of which

should stay within line management. And only then, after you’ve

done those two steps, it seems to me, without sort of alienating line

management, who you need to do those two steps, then there’s a

role for an outsider to come in and say, okay, how good a job are

you doing?

Chairwoman MORELLA. Prioritize, organize, then verify.

Mr. RICH. I’d like to recommend that we take a look, as was

mentioned here earlier about process, that over a period of time in

my time working in the government we had process, accreditation

for systems for security. And over a period of time, the accreditation process failed to work because it wasn’t updated, that we

would do the checklists and everything was great. I think as the

IG goes through the process of checking, somebody should be

checking the IG. Maybe that’s the computer security czar that you

mentioned, as an oversight position, that we have to keep up with

the technology that we’re looking at as we go through that.

Chairwoman MORELLA. Thank you.

Mr. Turner.

Mr. TURNER. I was really interested in knowing what suggestions

any of you might have regarding how we might strengthen law enforcement in this area. It seems that it’s an area that we’re really

very ill equipped to deal with. We don’t have the expertise in local

district attorney’s offices. I’m not even sure we have it in the Department of Justice.

But I think we really—there seems to be a need to take a good

look at the existing criminal laws. Obviously, some of the laws fit.

Theft is theft, I guess, no matter how you accomplish it. But in any

of the intrusions that don’t result in outright theft of dollars, I’m

just not sure that the penalties are out there, the laws are out

there to really effectively deal with this, nor is there the expertise

available to fully prosecute what appears to me, from listening to

your testimony, to be a growing area of criminal activity.

Am I correct on that? And do any of you have any suggestions

you might——

Mr. MILLER. I think that’s a very important point, Mr. Turner.

We’re working very close with the Justice Department Criminal DiVerDate 23-FEB-2001 14:40 Mar 08, 2001 Jkt 010199 PO 00000 Frm 00074 Fmt 6633 Sfmt 6602 E:\HEARINGS\60842.TXT pfrm07 PsN: 60842
69

vision on this, and they have asked, for example, to help us help

them put together a list of experts, cyber experts, that they can call

upon for—when they need to do prosecutions so that the Assistant

U.S. Attorneys around the country, when they’re referred these

cases, frequently do not have the kind of expertise that they may

have in securities fraud or other kinds of more traditional non-digital fraud. And so we are working with Mr. Scott Charney and Attorney General Reno to help put together a list of those experts

that the Assistant U.S. Attorneys can call upon.

Also, I have been told that the Justice Department is doing training for state and local officials on cyber crime, detection, investigation, prosecution. But how extensive that is, I don’t really know.

You can contact the Justice Department. I don’t have any data on

how many—how many training sessions have been done.

I understand that when they do offer them, they are heavily subscribed, that there’s clearly a lot of interest among law—local law

enforcement officials to get this kind of training. But how extensive

the training is currently, I don’t know.

Mr. BENNETT. Congressman?

Mr. TURNER. Yes?

Mr. BENNETT. I believe you have the laws. You have got your

Computer Fraud and Abuse Act. You have the Espionage Act,

which covers trade secrets, and both of those have attempt parts

to them.

You also have a fair amount of expertise. It is growing within the

Department of Justice, but there’s a fair amount of expertise. When

we call up on behalf of our clients and there’s been a problem, we

do not get a befuddled person who has either no interest or expertise in the area. We’re generally directed to somebody who does

that for a living.

I think the only problem we’re running into is the usual, and

that is, you’ve got to have enough time and so you’ve got to allocate

scarce resources even in the Department of Justice. And the way

they’ve allocated it, to use one example, one of my clients called up,

and someone had scanned their ports looking for a way in, and

they were very concerned that some—a specific competitor, in fact,

might have been the one doing it. And they wanted to get to the

bottom of it. And when we called up, it seemed to us that there was

a bright line from the United States Attorney’s Office, and that

was, really, if you can show us that they got in, then that’s going

to put it into one basket over here and we’re going to have the time

to be able to address it. If, on the other hand, you don’t know because your firewall software maybe only tracks unauthorized attempts and maybe perhaps doesn’t track authorized entries that

might have been fraudulent, then we’re—maybe you ought to go

the civil route and try to discover this by suing the ISP and getting

the name and then going after them and finding out who it is on

your own.

And, clearly, you don’t want to go down both those paths, and we

could really understand it. We ended up going down in this last instance, which was only a few months ago, going down the civil

route and finding out that it was some teenage hackers attempting

to get into a corporate—past a corporate a firewall. But the laws

are certainly there. The expertise is there and growing, at least at

70

the Federal level, and now it’s just a matter of putting in a priority

because I think they have enough to do with the actual break-ins

at this point.

Mr. MILLER. Mr. Turner, my staff reminds me that Senator Leahy has introduced a bill to provide $25 million a year to the Department of Justice for state and local cyber crime training. So obviously Senator Leahy at least believes there’s not currently sufficient funds and is trying to increase that.

Mr. TURNER. Thank you, Mrs. Morella.

Chairwoman MORELLA. Thank you, Mr. Turner.

It seems to me there could be a problem with companies overseas

and the kind of security because they haven’t had a check to do— an opportunity to do background checks of—and this made by the

more prone to computer security problems with Y2K. Would any of

you like to comment on that, maybe what we could do about it?

You look ready, Mr. Bennett, then Mr. Miller.

Mr. BENNETT. I believe this problem’s been with us for a while,

and to try to put it in perspective, if you got three different levels

of folks you might engage—and they’ve been engaged over the

course of time, at least in corporate America, to work on IT systems there, your own employees, your domestic contractors, and

then foreign contractors, and I would suggest that at this moment

in most states in the United States you can learn not very much

about your own new employees for starters. So, yes, it is true that

there could be foreigners or contractors who could pose a definite

threat to your IT.

But right now, in the position of any ordinary employer—not the

government but an ordinary employer, we’re just not permitted to

get the kind of information you can get, and so I have a live threat

right with my employees.

A second quick point is that—put aside just for a moment—I

know it’s not the scope here, but to try to put this in perspective,

you’ve got the threat to your IT systems, and yet in many, many

companies today, the most valuable information that they have

walks out the door every single day with their employees. It is not

sitting on their computer system.

So when they put this whole thing into perspective for, you

know, the billion dollar fraud over here and then the foreign threat

and then even the domestic contractor threat, then the employee

threat, what they’re really worried about is: How can I find out information about the people who are here? And, moreover, where

are they going to go? In the State of California, for example, companies cannot use non-competes for some good and wholesome reasons. And so that means that my employee can leave today, go

down the street to my competitor, and use that information.

Mr. HORN. I missed the word there. Companies cannot use what?

Mr. BENNETT. They cannot use—in California, as an example,

one cannot include a non-competition clause in a contract with an

employee to say, look, for 6 months after you leave here please

don’t go down the street—or you may not go down the street to our

competitor to do the same kind of thing.

Mr. HORN. As you were talking, I was thinking, the whole evolution of Silicon Valley is when somebody walked out and started

their own firm. American productivity.

71

Mr. BENNETT. Absolutely correct. And now—and we’ve gotten a

lot of great things from that. In addition, we’ve gotten ourselves a

rash of trade secret lawsuits.

Chairwoman MORELLA. It seems to me—you know how we have

the metal detectors going into buildings such as ours? What we

really need is a mental detector, and a mental detector would probably take care of a lot of that problem that you mentioned.

Mr. BENNETT. God forbid.

Chairwoman MORELLA. Okay. Right.

Mr. Miller.

Mr. MILLER. Two brief points. One is that there’s currently, in

addition to the overall challenge of the shortage of information

technology workers in our country, there’s a specific subset of that.

There’s a huge shortage of people with sophisticated security training or the ability to carry out these jobs. Going back to Mr.

Pucciarelli’s earlier point about people being one of the critical

three elements, it’s very important. I know a very large, sophisticated firm which is doing a lot of work on a contract basis for the

government has 1,500 positions to fill, and they have 1,000 people,

and they can’t find the other 500 because, first of all, you can’t use

foreign workers 99.9 percent of the time so you can’t fall back on

H(1)(b)s or anything like that. You can’t even fall back on permanent residents. Most of the time they have to be U.S. citizens. They

have to have security clearance. They have to have sophisticated

training, et cetera, et cetera.

So that’s a big job. I know Attorney General Reno and other people are trying to focus on some kind of a cyber corps idea where

there’d actually be government incentives, scholarships or a sort to

encourage people to get the kind of sophisticated training that they

could become specialists in information security. So I think that’s

an issue.

Also, on the international front, Chairwoman Morella, I know

that this is a huge issue in terms of laws. How do you enforce the

security laws? And right now the U.S. Government is engaged in

discussions with the G–8. Attorney General Reno I know is discussing with other members of the G–8, but it gets to be a huge

issue in cyberspace. Let’s talk about things like child pornography

and getting access. What laws do you use? Do you let Muammar

Qadhafi start issuing subpoenas for information that it wants to

get from AOL because it believes somebody in Libya who’s an AOL

customer is violating the laws of Libya? How do you enforce those

kind of laws? So there’s some incredibly open-ended questions out

there right now in terms of our cyber crimes on the international

front which are just at the earliest, earliest stages of discussion

right now.

Chairwoman MORELLA. Mr. Rich.

Mr. RICH. Yes. I’d like to mention a couple of months ago I went

to a national infrastructure protection conference out in Denver,

and I support the idea of Mr. Miller mentioning the cyber corps approach. I think that would go a long way, similar to the Peace

Corps, in incentivizing those to bring up the awareness within the

security area. And then they have a little payback to the government for helping them through school, or similar.

72

Mr. HORN. If I might be yielded to for a question, I probably

haven’t unloaded on you my feelings on when that visa deal comes

up. I was outraged by it. Why am I outraged by it? Very simply,

we’ve got a community college system—certainly in California

where it was founded, there’s 107 campuses in California and we’ve

got a Silicon Valley and San Diego, Orange County, and Santa

Clara County, and popping up hopefully in other counties. And

they need to work together, and we should not be importing people.

We should be training our own people.

When I think of the classrooms I go to where students are now

exposed to computing, and it seems to me we’re derelict both in

education in California—and I’ve unloaded on many of the community college presidents and said, Where are you on this? And where

are the CEOs in Silicon Valley that ought to be sitting down with

them saying this is the kind of curriculum we need if they’re going

to be helpful to us? That was the whole purpose of the community

college, was both vocational and academic. And you need both to

be a good programmer.

And I would hope that they would be working together so they could get the trained force. These are $60,000 jobs, and there are

a lot of bright kids. Escalante showed that in the Los Angeles

schools, you can teach young people to be as good as anybody, as

good as they are at Harvard. And these students proved they could

do it. And that’s what we ought to be doing, but we need the equipment, which is—the state is always behind, every state in the Nation is behind when it comes to giving and granting and providing

computer equipment. And if you’re going to work on new generations, this is where Silicon Valley can take a tax writeoff, or wherever, and get something out of it.

But your associations, it seems to me, would be very helpful to

be where you get these people together, both the community college

president and the CEO of a computer firm. We shouldn’t have to

be importing people from all over the world, and we shouldn’t have

to need a government program. I mean, the best education deal in

America are the community colleges. There’s very little tuition. At

least in California it is; in Texas it is. So why aren’t we taking advantage of that? Are we still going to just keep importing thousands of people? They’re all wonderful people, but what about our

own people? That’s where I’m coming from.

Mr. MILLER. Did you want a comment, or is that just an observation?

Mr. HORN. Well, I’m just saying—I’d like a comment, and I

think—you know, where is that industry and where are those educators to be linked up to get the job done?

Mr. MILLER. Well, I do disagree with you on the immigration

question, but I don’t disagree with you on your fundamental point,

Mr. Chairman. Our educational system is still an educational system designed for the industrial age, not the information age. And

we are trying to work with community colleges. In fact, I recently

met with the President of the American Association of Community

Colleges to discuss potential collaborative activities. We’re also

working with particular outreach to minority communities. I think

as you know, in the—even though—for example, African Americans

are 11 or 12 percent of the overall U.S. workforce; they’re only

73

about 5 or 6 percent of the IT workforce. So we’re involved in some

initiatives in that area, also.

The challenge is to do both at the same time, though. It does

take time for people to be trained and educated, and we have to

incentivise them to come in. And I think that’s why I was suggesting that government, cyber corps or IT tax credit training such

as the legislation that Senator Conrad and Congressman Moran

have introduced to try to create incentives.

I do believe, Mr. Chairman, that community colleges are much

more responsive than universities are in terms of adjusting their

curriculum. And you have several in California which have done— moved relatively quickly. But it’s—I think the late Governor of

Florida once said, the only thing harder to move than a cemetery

was the university faculty. So I think they find that trying to

change, getting rid of Russian history and political science department for computer science departments isn’t always easy; whereas,

at community colleges they can move quite quickly. And certainly

you see places like Contra Costa Community College. The one

that’s usually thrown up as the best example is Maricopa Community College in the Phoenix area where they work very closely with

Motorola, Intel, and other semiconductor manufacturing firms for

training.

So I think we’re getting there, Mr. Chairman. It’s just slower

than we’d like.

Mr. HORN. Well, that’s where you have to take these massive

systems because most of that is done at the local college, and that’s

why I suggested the community college. There’s more flexibility for

the reasons we all know than in the major research universities

around.

But if you’re doing it, I think that’s wonderful. We don’t need a

government program to do it. We just need you guys on the phone,

and gals, to work it out.

Chairwoman MORELLA. I think we also need the partnerships of

academia and the business sector and even government, you know,

state government, maybe Federal Government in some way, also

being kind of part of that partnership. But we have, Chairman

Horn and I and Ranking Member Turner, been aware of the personnel needs throughout this whole thing, Y2K, now computer security, and we’re trying to do something even legislatively on that,

too, to increase fellowships and, as you mentioned, the cyber corps.

We’ll continue to work on that with your help.

Just a wrap-up, if there are any comments from any one of you,

real briefly, in terms of what we should be doing now since we

have only that 149 days left to the end of—until we reach 2000,

recognizing whether Y2K has been remediated or not with regard

to computer security. Any final comments for us?

Mr. MILLER. My only concern is—and I don’t think this is Mr.

Pucciarelli’s intention in releasing his report—is that people don’t

move more slowly on Y2K because they’re concerned about information security. He’s correct that information security has to be

part of your Y2K, but I hope no one who reads that article uses

that as an excuse not to do their Y2K remediation. I certainly know

that wasn’t his intent. I know that Gartner has been one of the

strongest advocates for Y2K remediation. But one could imagine a

74

situation where someone would misinterpret that message instead

of the message being to be more conscious of security and say, well,

that’s one more excuse not to get my Y2K solution done. So I hope

this hearing will help to send the message that that is not the intention. I assume Mr. Pucciarelli would agree.

Chairwoman MORELLA. Thank you.

Mr. PUCCIARELLI. Yes, Mr. Miller. I appreciate your comments.

Congresswoman, one final thought that I have is that simply reminding folks, reminding organizations, enterprises, and the leaderships of those organizations of the need to redouble their efforts

and maintain the appropriate risk management criteria while they

complete their Y2K remediation activities. And I think that even

having this hearing on this matter has served a very important

purpose to that end. I think that encouraging the various federal

agencies and departments along the same lines would also be of

benefit.

Again, clearly our intention was not to suggest that you should— that organizations should go slower, but to merely point out that

risk management activities have a role as well.

Chairwoman MORELLA. Thank you.

Mr. Rich, a final comment?

Mr. RICH. Yes, ma’am. I’d like to basically agree here with both

of the gentlemen here in that people shouldn’t slow down, they

should pick it up a little bit and keep vigilant as we go toward the

year 2000. And I hope these hearings will allow people to look at

other aspects rather than just focus on Y2K remediation.

Chairwoman MORELLA. Good point.

Mr. Bennett.

Mr. BENNETT. I believe that if there are companies out there that

are still doing serious remediation and are not now doing contingency planning, then they probably have even more serious issues

than worrying about that trap that’s probably been set somewhere

in one of the other companies that’s now doing contingency planning.

Certainly a call has been made to the security officers, and they

need to pay attention, as they always have. I think the message

from this Subcommittee ought to be to keep focused on the Y2K effort.

Chairwoman MORELLA. I want to thank all of you, and before we

adjourn, I just want to mention the staff that have been very helpful always in contacting you and putting some things together: J.

Russell George, who’s with the Government Reform Subcommittee,

Matt Ryan, Bonnie Heald, Grant Newman, Chip Ahlswede, and

Seann Kallagher; our Technology Subcommittee, Jeff Grove and

Ben Wu, and the clerk, Joe Sullivan. And there are others: Michele

Ash, Trey Henderson, Earley Green, Jean Gosa; and the court reporter, Chris Bitsko. I think I covered everybody. Good.

Thank you. You were just a splendid panel. I hope you’ll feel free

to contact us at any point with any of your suggestions or recommendations. And as usual, if we could—have other members

who may have questions and any other questions we may have, if

we may forward them to you. Great. Thank you.

The Committee is now adjourned.

[Whereupon, at 12:06 p.m., the Subcommittee was adjourned.]

75


g:\graphics\60842.043
76


g:\graphics\60842.044
77


g:\graphics\60842.045
78


g:\graphics\60842.046
79


g:\graphics\60842.047
80


g:\graphics\60842.048
81


g:\graphics\60842.049