```

[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]

 
           EXAMINING THE PRESIDENT'S CYBERSECURITY 
                  INFORMATION-SHARING PROPOSAL

=======================================================================

                                HEARING

                               BEFORE THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             FIRST SESSION

                               __________

                           FEBRUARY 25, 2015

                               __________

                            Serial No. 114-4

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT] 

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                        U.S. GOVERNMENT PUBLISHING OFFICE
94-108 PDF                  WASHINGTON : 2015                        
                     
_______________________________________________________________________________________                    
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, 
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected].  
                 
                     
                     
                     
                     
                     
                     
                     
                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice    James R. Langevin, Rhode Island
    Chair                            Brian Higgins, New York
Jeff Duncan, South Carolina          Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Steven M. Palazzo, Mississippi       Donald M. Payne, Jr., New Jersey
Lou Barletta, Pennsylvania           Filemon Vela, Texas
Scott Perry, Pennsylvania            Bonnie Watson Coleman, New Jersey
Curt Clawson, Florida                Kathleen M. Rice, New York
John Katko, New York                 Norma J. Torres, California
Will Hurd, Texas
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
                   Brendan P. Shields, Staff Director
                    Joan V. O'Hara,  General Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Michael T. McCaul, a Representative in Congress 
  From the State of Texas, and Chairman, Committee on Homeland 
  Security:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5

                               Witnesses

Ms. Suzanne E. Spaulding, Under Secretary, National Protection 
  and Programs Directorate, U.S. Department of Homeland Security:
  Oral Statement.................................................     7
  Joint Prepared Statement.......................................     9
Ms. Phyllis Schneck, Deputy Under Secretary, Cybersecurity and 
  Communications, National Protection and Programs Directorate, 
  U.S. Department of Homeland Security:
  Oral Statement.................................................    13
  Joint Prepared Statement.......................................     9
Mr. Eric A. Fischer, Senior Specialist, Science and Technology, 
  Congressional Research Service, Library of Congress:
  Oral Statement.................................................    15
  Prepared Statement.............................................    17

                             For the Record

The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Letter.........................................................    25

                                Appendix

Questions From Ranking Member Bennie G. Thompson for Suzanne E. 
  Spaulding and Phyllis Schneck..................................    47
Questions From Honorable Jim Langevin for Suzanne E. Spaulding 
  and Phyllis Schneck............................................    48
Question From Ranking Member Bennie G. Thompson for Eric A. 
  Fischer........................................................    48
Questions From Honorable Jim Langevin for Eric A. Fischer........    52

  EXAMINING THE PRESIDENT'S CYBERSECURITY INFORMATION-SHARING PROPOSAL

                              ----------                              

                      Wednesday, February 25, 2015

             U.S. House of Representatives,
                    Committee on Homeland Security,
                                                    Washington, DC.
    The committee met, pursuant to call, at 12:04 p.m., in Room 
311, Cannon House Office Building, Hon. Michael T. McCaul 
[Chairman of the committee] presiding.
    Present: Representatives McCaul, Rogers, Barletta, Clawson, 
Katko, Hurd, Carter, Walker, Loudermilk, McSally, Ratcliffe, 
Thompson, Jackson Lee, Langevin, Richmond, Payne, Vela, Watson 
Coleman, and Torres.
    Chairman McCaul. The Committee on Homeland Security will 
come to order.
    First of all, my apologies to the Members and the 
witnesses. I had a conflict with the--on the Foreign Affairs 
Committee with the Secretary of State on the authorized use of 
military force against ISIS, which I think is a very relevant 
issue to this committee, as well, in terms of dealing with the 
threat where it exists before it can come into the United 
States. Anyway, I just want to thank everybody for your 
patience.
    I will give this opening statement. Been involved in this 
issue for quite some time. To Suzanne and Phyllis Schneck, 
thank you for being here, Dr. Fischer.
    At the dawn of the digital age, our Nation saw endless 
opportunities to generate prosperity by expanding our networks 
and connecting to the world. But today, American prosperity 
depends as much on defending those networks as it does on 
expanding them. Every day, our country faces digital intrusions 
from criminals, activists, terrorists, and nation-states like 
Russia, China, and Iran. The impact of those intrusions are 
felt everywhere; from our National security secrets to the 
personal information of Americans.
    We cannot tolerate acts of cyber vandalism, theft, or cyber 
warfare, especially when they put our Nation's critical 
infrastructure at risk and when they steal American 
intellectual property and innovations. Accordingly, our 
Government must play a leading role in combating threats in the 
digital domain.
    It is clear that safeguarding American cyber space is one 
of the great National security challenges of our time. We are 
confronted almost daily with frightening new precedents, such 
as North Korea's act on Sony Pictures; a cowardly act meant to 
intimidate Americans and stifle freedom of expression. This 
attack came from a nation-state using a digital bomb to target 
and destroy computer systems here in the United States.
    Iranian-backed hackers also demonstrated this capability 
when they attacked Saudi Arabia's national oil company, Aramco, 
and destroyed 30,000 computers. Iran also targeted and 
continues to target major U.S. banks to shut down websites and 
restrict Americans' ability to access their bank accounts.
    Imagine this type of attack on our gas pipelines or power 
grids in the northeast. Such assaults on our critical 
infrastructure could cripple our economy and weaken our ability 
to defend the United States. These scenarios sometimes sound 
alarmist. But we must take them seriously, as they grow more 
realistic every day. Our adversaries are hard at work 
developing and refining cyber attack capabilities, and they are 
using them to intimidate our Government and threaten our people 
in both times of peace and times of conflict.
    But the threat extends beyond the industrial engines that 
drive our economies, to the homes of Americans themselves. 
Criminals and countries alike can use cyber attacks to raid 
Americans' saving accounts or steal their personal health 
records. The recent breach of health insurer Anthem illustrates 
the intrusiveness of these attacks. That assault alone exposed 
the personal information of up to 80 million people, including 
the names, birth dates, and Social Security numbers of tens of 
millions of children.
    But this is just the latest in a long string of cyber 
breaches targeting private citizens, a list that includes 
breaches at Target, Neiman Marcus, Home Depot, and J.P. Morgan. 
Our adversaries are also seeking to steal secrets from our 
Government and our most innovative companies. We know that 
Chinese hackers, for instance, continue to breach Federal 
networks for the purpose of espionage and attack major U.S. 
businesses to give themselves a competitive edge in the global 
economy.
    Make no mistake, these attacks are costing Americans their 
time, their money, and their jobs. General Keith Alexander 
described cyber espionage and the loss of American intellectual 
property as the greatest transfer of wealth in human history.
    Sadly, our laws are not keeping up with the threat. For 
instance, fearing legal liability, many private companies 
choose not to disclose the threats they see on their own 
networks, leaving others vulnerable to the same intrusions. We 
cannot leave the American people and our businesses to fend for 
themselves. Now more than ever, Congress must take aggressive 
action.
    This year I will lead a renewed effort to push 
cybersecurity legislation through Congress. Last year, the 
Ranking Member and I in this committee passed five 
cybersecurity bills. These new statutes lay out the rules of 
the road on how cyber information will be shared between 
Government and the private sector so that the two can work 
together to combat this persistent threat.
    The laws also provide important protections to ensure 
Americans' information and civil liabilities are not 
compromised. But now we must build on that success. We can 
start by creating a safe harbor, where legal barriers to share 
cyber threat information are removed and the private sector is 
encouraged to collaborate. This will allow us to respond to 
cyber incidents more quickly and effectively and will give 
Government and private entities the ability to see the threat 
landscape in real time.
    I am pleased the President has come forward with a proposal 
on this important issue. Our solutions must transcend partisan 
boundaries if we are going to tackle this challenge, and the 
American people are counting on us.
    Again, I want to thank the witnesses. I want to thank the 
Members for their patience here today.
    [The statement of Chairman McCaul follows:]
                Statement of Chairman Michael T. McCaul
                           February 25, 2015
    At the dawn of the digital age, our Nation saw endless 
opportunities to generate prosperity by expanding our networks and 
connecting to the world. But today, American prosperity depends as much 
on defending those networks as it does on expanding them.
    Every day our country faces digital intrusions from criminals, 
hacktivists, terrorists, and nation-states like Russia, China, and 
Iran. The impacts of those intrusions are felt everywhere--from our 
National security secrets to the personal information of Americans.
    We cannot tolerate acts of cyber vandalism, cyber theft, and cyber 
warfare especially when they put our Nation's critical infrastructure 
at risk and when they steal American intellectual property and 
innovation. Accordingly, our Government must play a leading role in 
combating threats in the digital domain.
    It is clear that safeguarding American cyber space is one of the 
great National security challenges of our time. We are confronted 
almost daily with frightening new precedents, such as the North Korean 
cyber attack on Sony Pictures--a cowardly act meant to intimidate 
Americans and stifle freedom of expression.
    This attack came from a nation-state using a digital bomb to target 
and destroy computer systems here in the United States. Iranian-backed 
hackers also demonstrated this capability when they attacked Saudi 
Arabia's national oil company, Aramco, and destroyed 30,000 computers. 
Iran also continues to target major U.S. banks to shut down websites 
and restrict Americans ability to access their bank accounts.
    Imagine this type of attack on our gas pipelines or power grid in 
the Northeast. Such assaults on our critical infrastructure could 
cripple our economy and weaken our ability to defend the United States. 
These scenarios sometimes sound alarmist, but we must take them 
seriously as they grow more realistic every day. Our adversaries are 
hard at work developing and refining cyber attack capabilities, and 
they are using them to intimidate our Government and threaten our 
people in both times of peace and times of conflict.
    But the threat extends beyond the industrial engines that drive our 
economy to the homes of Americans themselves. Criminals and countries 
alike can use cyber attacks to raid Americans' savings accounts or 
steal their personal health records.
    The recent breach of health insurer, Anthem, illustrates the 
intrusiveness of these attacks. That assault alone exposed the personal 
information of up to 80 million people, including the names, birth 
dates, and social security numbers of tens of millions of children. But 
this is just the latest in a long string of cyber breaches targeting 
private citizens--a list that includes breaches at Target, Neiman 
Marcus, Home Depot, and JP Morgan.
    Our adversaries are also seeking to steal secrets from our 
Government and our most innovative companies. We know that Chinese 
hackers, for instance, continue to breach Federal networks for the 
purpose of espionage and attack major U.S. businesses to give 
themselves a competitive edge in the global economy. Make no mistake: 
These attacks are costing Americans their time, money, and jobs. 
General Keith Alexander has described cyber espionage and the loss of 
American intellectual property as the ``greatest transfer of wealth in 
history.''
    Sadly, our laws are not keeping up with the threat. For instance, 
fearing legal liability, many private companies choose to not disclose 
the threats they see on their own networks, leaving others vulnerable 
to the same intrusions.
    We cannot leave the American people and our businesses to fend for 
themselves. Now, more than ever, Congress must take aggressive action.
    This year I will lead a renewed effort to push cybersecurity 
legislation through Congress. Last year, the Ranking Member and I, and 
this committee, passed five cyber bills. These new statutes lay out the 
rules of the road on how cyber information will be shared between 
Government and the private sector so that the two can work together to 
combat this persistent threat. The laws also provide important 
protections to ensure Americans' information and civil liberties are 
not compromised.
    But now, we must build on that success. And, we can start by 
creating a ``safe harbor'' where legal barriers to sharing cyber threat 
information are removed and the private sector is encouraged to 
collaborate. This will allow us to respond to cyber incidents more 
quickly and effectively--and will give Government and private entities 
the ability to see the threat landscape in real time.
    I am pleased the President has come forward with a proposal on this 
important issue. Our solutions must transcend partisan boundaries if we 
are going to tackle this challenge. The American people are counting on 
us.
    I want to thank the witnesses for testifying before this committee 
and I look forward to your testimony.

    Chairman McCaul. I now recognize the Ranking Member.
    Mr. Thompson. Thank you very much, Mr. Chairman. Let me 
also welcome our witnesses and thank them for their patience on 
getting started.
    Earlier, some of us were briefed on some on-going efforts 
by the Department, Mr. Chairman. I might add, it was very 
informative. Thank you all very much for doing it.
    Our hearing today is examining the President's 
cybersecurity information-sharing proposal. Mr. Chairman, at 
its core cybersecurity relies on effective information sharing 
among network operators about indicator, hacks, and cyber 
vulnerabilities.
    This committee has been central in its effort to foster 
better cyber information sharing by producing bipartisan 
cybersecurity legislation that President Obama signed into law 
at the end of last year. As you talked about it, the National 
Cybersecurity Protection Act of 2014 authorizes the National 
Cyber and Communications Integrity Center, NCCIC, within the 
Department of Homeland Security as an information-sharing hub 
for cybersecurity risk and incidents, and erected the NCCIC to 
provide technical assistance, risk management support, and 
incident response capabilities to impacted network operators.
    The legislative proposal that the President unveiled last 
month has again spurred debate. Importantly, the 
administration's proposal would require participating companies 
to comply with certain privacy restrictions, such as removing 
unnecessary personal information and taking measures to protect 
any personal information to quality for liability protection. 
In my view, the President's proposal has some merit.
    As we go forward, we should consider the following 
questions: First, what is being shared? Is it just computer 
code made up of zeros and ones, or does the information contain 
Americans' sensitive personal data? If it does contain personal 
data, I believe that reasonable efforts should be made by 
participating companies to remove personally identifiable 
information from the information shared with the Government 
that will help to preserve Americans' privacy.
    Second, who is doing the sharing? Is it a critical 
infrastructure operator?
    Third, where is the sharing happening? The answer to the 
question has privacy implications, particularly when the 
sharing is between the Federal Government and the private 
sector, as opposed to sharing between private-sector companies.
    I look forward to hearing testimony from our witnesses on 
the potential risks and rewards of a cyber information-sharing 
environment dominated by ISAO, as the President envisions. 
Certainly, I would like to hear how the proposed changes could 
impact NCCIC. The success of NCCIC is dependent on the 
companies' seeing the value of proposition for sharing with the 
Department.
    I look forward to hearing from the Department on how they 
intend to drive traffic to the NCCIC and how implementation of 
a new cyber law is progressing. I would also like to hear more 
about the new education grant program that the President has 
proposed.
    While I am pleased that the President seems to agree about 
the importance of making this investment in growing our cyber 
workforce, I am disappointed that the proposal calls for just 
$5 million a year to be spent over 5 years at 13 historically 
black colleges and universities and two National laboratories 
is disappointing, especially in light of a documented shortfall 
in cyber workforce. Given the billions of dollars spent on 
cybersecurity, much of which is spent on Federal contractors, I 
would have expected a more ambitious plan for developing cyber 
tactics.
    Before I close, I would like to note that on February 11, 
together with the Chairman and the leadership of its Senate 
Homeland Security and Governmental Affairs Committee, we wrote 
to the President about the new Cyber Threat Intelligence 
Integration Center. We look forward to a formal response to our 
questions, particularly as they relate to the NCCIC.
    I look forward to hearing from our witnesses today and 
working with the Chairman on forthcoming legislation to help 
ensure that the networks of our Nation's critical 
infrastructure are more secure.
    With that, I yield back.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
                           February 25, 2015
    Over the past decade, we have witnessed an explosion of internet 
use in all aspects of life. As a Nation, we do more business on-line 
than ever before--trillions of dollars a year. For most Americans, 
smartphones, tablets, and other computers have become the platforms on 
which we live, work, and play.
    Unfortunately, these devices and networks have also become targets 
for bad actors.
    Last month's cyber attack on the Nation's second-largest health 
insurer, Anthem, resulted in tens of millions of Social Security 
numbers, birth dates, addresses, and names being stolen from its 
database. Given that Anthem insures 7.5 million people in 14 States, 
the potential damage of this breach is expected to be extensive.
    Last year's attack on Sony destroyed data, disabled thousands of 
computers, and exposed the personal information of Sony employees.
    These attacks underscore that any network that is connected to the 
internet is a potential victim.
    The fact that our Nation's critical infrastructure--including the 
power grid, financial institutions, and health care systems--are all 
connected to the internet make them particularly attractive targets for 
attack.
    Cyber attackers are constantly probing for weaknesses in our 
critical infrastructure which powers much of our electric grid, 
financial institutions, and health care systems.
    The attention that cybersecurity has received in recent years by 
President Obama and Congress is reflective of the increasing awareness 
that the responsibility to address this homeland security threat is a 
collective one.
    At its core, cybersecurity relies on effective information sharing 
among network operators about indicators, hacks, and cyber 
vulnerabilities.
    This committee has been central in efforts to foster better cyber 
information sharing by producing bipartisan cybersecurity legislation 
that President Obama signed into law at the end of last year.
    The ``National Cybersecurity Protection Act of 2014'' authorizes 
the National Cybersecurity and Communications Integrity Center (NCCIC) 
within the Department of Homeland Security as an information-sharing 
hub for cybersecurity risks and incidents, and directed the NCCIC to 
provide technical assistance, risk management support, and incident 
response capabilities to impacted network operators.
    The legislative proposal that the President unveiled last month 
has, again, spurred debate.
    Importantly, the administration's proposal would require 
participating companies to comply with certain privacy restrictions 
such as removing unnecessary personal information and taking measures 
to protect any personal information to qualify for liability 
protection.
    In my view, the President's proposal has some merit.
    As we go forward, we should consider the following questions: 
First, what is being shared?--Is it just computer code made up of 
``zeroes and ones'' or does the information contain Americans' 
sensitive personal data? If it does contain personal data, I believe 
that ``reasonable efforts'' should be made by participating companies 
to remove ``personally identifiable information'' from information 
shared with the Government. This will help to preserve Americans' 
privacy.
    Second, who is doing the sharing?--Is it a critical infrastructure 
operator?
    Third, where is the sharing happening?--The answer to that question 
has privacy implications--particularly when the sharing is between the 
Federal Government and the private sector, as opposed to sharing 
between private-sector companies.
    I look forward to hearing testimony from our witnesses on the 
potential risks and rewards of a cyber information-sharing environment 
dominated by ISAOs, as the President envisions.
    Certainly, I would like to hear how these proposed changes could 
impact the NCCIC. The success of the NCCIC is dependent on companies 
seeing the ``value proposition'' for sharing with the Department.
    I look forward to hearing from the Department on how they intend to 
drive traffic to the NCCIC and how implementation of the new cyber law 
is progressing.
    I would also like to hear more about the new education grant 
program that the President has proposed.
    While I am pleased that the President seems to agree about the 
importance of making this investment in growing our cyber workforce, I 
am disappointed that the proposal calls for just $5 million a year to 
be spent over 5 years at 13 Historically Black Colleges and 
Universities, and two National laboratories, is disappointing.
    Given the billions of dollars spent on cybersecurity, much of which 
is spent on Federal contractors, I would have expected a more ambitious 
plan for developing cyber talent.
    Before I close, I would like to acknowledge that the committee just 
met with the President's cybersecurity advisor, Michael Daniel. I 
appreciate Mr. Daniel's willingness to lay out the administration's 
vision for cybersecurity and to address our questions, particularly 
about the newly-announced cyber center that will be housed in the 
intelligence community.
    On February 11, together with the Chairman and the leadership of 
the Senate Homeland Security and Governmental Affairs Committee, we 
wrote to the President about this new ``Cyber Threat Intelligence 
Integration Center''. We look forward to a formal response to our 
questions, particularly as they relate to the NCCIC.
    In conclusion, I look forward to hearing from our witnesses today 
and to working with the Chairman on forthcoming legislation to help 
ensure that the networks of our Nation's critical infrastructure are 
more secure.

    Chairman McCaul. Thank the Ranking Member.
    Chairman now recognizes the--I would like to briefly 
introduce the witnesses. First, we have the Honorable Suzanne 
Spaulding. She is the under secretary for the National 
Protection and Programs Directorate at the Department of 
Homeland Security.
    Next, we have Dr. Phyllis Schneck. She is a deputy under 
secretary for cybersecurity and communications within the 
National Protection and Programs Directorate at the Department 
of Homeland Security. It is great to have both of you here 
today.
    Finally, we have Dr. Eric Fischer, who is a senior 
specialist for science and technology at the Congressional 
Research Service.
    The witnesses' full statements will appear in the record. 
The Chairman now recognizes Ms. Spaulding for 5 minutes.

 STATEMENT OF SUZANNE E. SPAULDING, UNDER SECRETARY, NATIONAL 
    PROTECTION AND PROGRAMS DIRECTORATE, U.S. DEPARTMENT OF 
                       HOMELAND SECURITY

    Ms. Spaulding. Thank you, Chairman McCaul, Ranking Member 
Thompson, Members of the committee.
    We are very pleased to be here today to discuss the 
administration's proposal to enhance cybersecurity information 
sharing. This proposal recognizes the unique mission and 
capabilities of the Department of Homeland Security's National 
Protection and Programs Directorate. It will facilitate 
information sharing in ways that will significantly advance our 
National security.
    By placing the Department's National Cybersecurity and 
Communications Integration Center, or NCCIC, as the 
coordination center for receiving and disseminating cyber 
threat indicator information, which will be very quickly 
shared. We will receive and disseminate that information to 
Federal and non-Federal entities.
    As this committee knows, we are faced with pervasive cyber 
threats from a variety of actors, including nation-state 
actors. They are motivated by a range of objectives, including 
espionage, political and ideological beliefs, and financial 
gain.
    The National Preparedness and Protection Directorate 
focuses on helping our partners across Government and non-
Government to manage those cyber risks, to reduce the frequency 
and impact of cyber incidents, and to build their own capacity. 
We do this by sharing timely and accurate information and 
analysis, particularly to enable the private and public-sector 
partners to protect themselves. This includes detailed analysis 
about cascading consequences in the physical world that can 
result from cyber incidents.
    We provide technology to detect and block cyber threats 
from impacting the dot.gov networks, the civilian Government 
networks, and enable those agencies to more readily identify 
network security issues and prioritize the actions that they 
must take to address those.
    We enable commercial cybersecurity companies to use 
Government-furnished Classified information to better protect 
their private-sector customers. We provide on-site assistance 
to critical infrastructure and Federal agencies who have been 
impacted by a significant cyber incident. We maintain a trusted 
environment for private-sector partners to share information 
and to collaborate to address cybersecurity threats and trends.
    Congress' support for these activities led to the 
bipartisan action last year to pass critical cybersecurity 
legislation. That legislation enhanced our ability to work with 
the private sector and with other Federal civilian departments. 
As been noted, it strengthened the Department's ability to 
recruit and to retain the kind of cybersecurity exerts that we 
now have on-board.
    Enactment of these bills represents significant progress in 
the Department's cybersecurity mission. I am very grateful to 
Congress, to this committee, and particularly to Chairman 
McCaul and Ranking Member Thompson, who contributed significant 
efforts to ensure the enactment of this legislation.
    But we need to keep moving forward. Additional legislation 
is needed. Carefully updating laws to facilitate cybersecurity 
information sharing is essential to improving the Nation's 
cybersecurity. While many companies currently do share 
cybersecurity information with each other and with the 
Government under existing laws, there is a growing need to 
increase the volume and the speed of such information sharing, 
without sacrificing the trust of the American people or 
individual privacy and civil liberties.
    The President's legislative proposal incentivizes private 
entities to share information with the Government through that 
National Cybersecurity and Integration Center, or NCCIC, that I 
mentioned earlier. That is our 24/7 operations and watch 
center. It brings together currently Government partners from 
across the Government and the private sector. This is 
important.
    The NCCIC's core mission, as stated in this committee's 
unanimously-passed National Cybersecurity Protection Act, is 
coordinating and serving as the interface for cybersecurity 
information across the Government and the private sector. We do 
this with strong protections in place for protecting privacy 
and for protecting sensitive business information.
    Having a single designated entry point into the Government 
makes it easier to ensure that privacy protections are being 
consistently applied across the Government. It reduces the 
complexity for the private sector that wonders where to go. It 
improves our ability to develop a common operating picture of 
the cyber threats that we see daily. It helps us to connect the 
dots, if you will, with regard to cyber threats.
    I understand that Chairman McCaul has invited Members of 
this committee to visit and tour our National Cybersecurity 
Communications Integration Center. I look forward to seeing 
many of you there and continuing this discussion at that time.
    Before I close, I would like to reiterate Secretary 
Johnson's comments on the Department's funding situation. 
Congress still has not passed a fiscal year 2015 appropriations 
bill for the Department of Homeland Security. As long as we 
operate on a continuing resolution, we are hampered by 
uncertainty and the inability to fund vital new homeland 
security initiatives. Without funding, NPBD's cybersecurity and 
critical infrastructure mission will be significantly impacted.
    Let me end by saying that today, our adversaries can 
exploit a fundamental asymmetry in our network infrastructure. 
While nearly all of our systems and networks are globally 
interconnected, our defensive capabilities are not yet. This 
gives the attacker a compelling advantage. They can find and 
exploit weak links in our systems from anywhere around the 
world at machine speed. By sharing cyber threat indicators in 
near real time, we can and will reduce that asymmetry.
    I want to thank you for this opportunity to testify. I look 
forward to your questions.
    I turn it over to my cyber deputy, Dr. Phyllis Schneck.
    [The joint prepared statement of Ms. Spaulding and Ms. 
Schneck follows:]
  Joint Prepared Statement of Suzanne E. Spaulding and Phyllis Schneck
                           February 25, 2015
                              introduction
    Chairman McCaul, Ranking Member Thompson, and distinguished Members 
of the committee, we are pleased to appear today to discuss the 
President's cybersecurity legislative proposal on information sharing.
    In our testimony today, we will highlight the Department of 
Homeland Security (DHS) National Protection and Programs Directorate 
cybersecurity role and capabilities, and describe how the President's 
legislative proposal to facilitate cyber threat indicator information 
sharing will further our National security, with DHS's National 
Cybersecurity and Communications Integration Center (NCCIC) as the 
coordination center to receive and disclose cyber threat indicators to 
Federal and Non-Federal entities.
        the on-going cyber threat and the dhs cybersecurity role
    As a Nation, we are faced with pervasive cyber threats. Malicious 
actors, including those at nation-state level, are motivated by a 
variety of reasons that include espionage, political and ideological 
beliefs, and financial gain. Increasingly, State, Local, Tribal and 
Territorial (SLTT) networks are experiencing cyber activity of a 
sophistication level similar to that seen on Federal networks.
    To achieve our cybersecurity mission, the National Protection and 
Programs Directorate focuses on helping our partners understand and 
manage cyber risk, reduce the frequency and impact of cyber incidents, 
and build partner capacity. We share timely and accurate information 
and analysis to enable private and public-sector partners to protect 
themselves. We provide on-site assistance to Federal agencies and 
critical infrastructure entities impacted by a significant 
cybersecurity incident. We provide technology and services to detect 
and block cyber threats from impacting Federal civilian networks. We 
enable Federal agencies to more readily identify network security 
issues and take prioritized action. We enable commercial cybersecurity 
companies to use Classified information so they can better protect 
their private-sector customers. We perform comprehensive consequence 
analyses that assess cross-sector interdependencies and cascading 
effects, including the potential for kinetic harm that includes loss of 
life, and we maintain a trusted environment for private-sector partners 
to share information and collaborate on cybersecurity threats and 
trends.
DHS's National Cybersecurity and Communications Integration Center
    The NCCIC serves as a 24x7 centralized location for the 
coordination and integration of cyber situational awareness and 
incident management. NCCIC partners include all Federal departments and 
agencies; State, local, Tribal, and territorial governments; the 
private sector; and international entities. The NCCIC continues to 
explore opportunities to expand its liaison capacity from other 
agencies and the private sector. The NCCIC provides its partners with 
enhanced situational awareness of cybersecurity and communications 
incidents and risks, and provides timely information to manage 
vulnerabilities, threats, and incidents. In 2014, the NCCIC received 
over 97,000 incident reports, and issued nearly 12,000 actionable cyber 
alerts or warnings. NCCIC teams also detected over 64,000 significant 
vulnerabilities on Federal and non-Federal systems and directly 
responded to 115 significant cyber incidents.
    The NCCIC actively shares cyber threat indicators to and from 
multiple sources including private-sector partners, the intelligence 
community, Federal Departments and agencies, law enforcement, State, 
local, Tribal, and territorial governments, and international 
governments. This sharing, which has been taking place for many years, 
takes many forms including person-to-person interactions on the NCCIC 
floor, manual exchange of information via e-mail and secure web 
portals, and more recently via automated, machine-to-machine exchanges 
in STIX and TAXII protocols. While all of these sharing methods have 
value, the cybersecurity community has recognized the strategic 
importance of migrating cyber threat indicator sharing to more 
automated mechanisms when and where appropriate.
                       cybersecurity legislation
    Last year, Congress acted in a bipartisan manner to pass critical 
cybersecurity legislation that enhanced the ability of the Department 
of Homeland Security to work with the private sector and other Federal 
civilian departments in each of their own cybersecurity activities, and 
enhanced the Department's cyber workforce authorities. Enactment of 
these bills represents a significant moment for the Department's 
cybersecurity mission, and this committee in particular undertook 
significant efforts to bring the bills to passage. We are thankful for 
your support and we are deploying those additional authorities with 
clarity of mission.
    Additional legislation is needed. We must take additional steps to 
ensure that DHS is able to rapidly and efficiently deploy new 
protective technologies across Federal civilian agency information 
systems. In addition, carefully updating laws to facilitate 
cybersecurity information sharing within the private sector and between 
the private and Government sectors is also essential to improving the 
Nation's cybersecurity. While many companies currently share 
cybersecurity threat information under existing laws, there is a 
heightening need to increase the volume and speed of information shared 
without sacrificing the trust of the American people or the protection 
of privacy, confidentiality, civil rights, or civil liberties. It is 
essential to ensure that cyber threat information can be shared quickly 
among trusted partners, including with law enforcement, so that network 
owners and operators can take necessary steps to block threats and 
avoid damage.
    The NCCIC plays a critical role in the President's recent 
legislative proposal because its core mission--as articulated in the 
National Cybersecurity Protection Act, developed by this committee and 
unanimously passed by the House in December--is to coordinate and serve 
as an interface for cybersecurity information across the Government and 
private sector.
The Administration's Information-Sharing Proposal for Cyber Threat 
        Indicators
    Building on the bipartisan cybersecurity legislation enacted last 
Congress, President Obama visited the NCCIC on January 13, 2015, to 
announce a proposal for additional legislation to improve cybersecurity 
information sharing. The President noted, ``Much of our critical 
infrastructure runs on networks connected to the Internet . . . [a]nd 
most of this infrastructure is owned and operated by the private 
sector. So neither Government nor the private sector can defend the 
Nation alone. It's going to have to be a shared mission--Government and 
industry working hand in hand, as partners.'' This partnership entails 
sharing cyber threat indicators to better enable Government agencies 
and the private sector to protect themselves.
    Information sharing, especially of these technical ``threat 
indicators'' that can be used to identify and block malicious activity, 
is the lifeblood of effective cyber defense and response. Pulling 
together this information allows defenders to identify anomalies or 
patterns and recognize dangerous activity before it can do significant 
damage. The goal of the President's proposal is to increase the sharing 
of this type of information, as quickly as possible, with appropriate 
protection for privacy and of sensitive information and systems.
    Among other things, the administration's proposal would reduce the 
risks for private entities to voluntarily share technical cyber threat 
indicators with each other and the NCCIC by providing protections 
against civil or criminal liability for such sharing. Equally 
important, the proposal narrowly defines the threat indicators that 
will be shared, requires that irrelevant identifying information be 
minimized from these indicators, and generally requires strong 
protections for the privacy and confidentiality of personal 
information. Finally, the proposal calls for the creation of 
Information Sharing and Analysis Organizations (ISAOs). ISAOs would be 
information sharing organizations that would help speed information 
sharing within the private sector and between the private sector and 
Government.
    Our goal is to expand information sharing within the private 
sector, and to build on the existing relationships, processes and 
programs of the NCCIC to enhance cooperation between the Government and 
private sector. The proposal will help us improve the methods that the 
NCCIC already uses to share cyber threat indicators, and leverage 
automation to achieve scalability wherever possible. We look to evolve 
and expand indicator sharing at the NCCIC from human exchanges, 
portals, and written reports to automated machine-to-machine 
communications. Our vision is that this may reduce the time to receive 
and act on indicators from hours to milliseconds, create consistency in 
information provided to interagency partners, law enforcement, and the 
private sector, and free analysts to focus on the threats that require 
human analysis while expediting detection and blocking of new threats.
NCCIC as the Coordination Center
    Cyber threat indicators, which allow Government agencies and the 
private sector to better protect themselves, come from a variety of 
sources, including: Government agencies, private companies, 
international partners, and ISAOs. Given the variety of formats used--
and information that is included--when sharing such information, the 
Government must have a central clearinghouse to ensure that privacy and 
confidentiality protections are consistently applied and that the right 
information reaches the right Government and private-sector entities.
    DHS is a leader within the Government when it comes to the 
development and operational implementation of privacy, confidentiality, 
and civil liberties policies. DHS was the first agency to have 
statutorily established Officers for Privacy and for Civil Rights and 
Civil Liberties. From its creation, DHS has built both privacy and 
civil liberties protections into all of its programs and has dedicated, 
on-site privacy professionals committed to ensuring that its cyber 
mission is carried out in a way consistent with our Nation's values. 
Through statutory protections like Protected Critical Infrastructure 
Information (PCII), DHS will continue to anonymize the identity of 
submitters and other proprietary and sensitive information in threat 
indicator submissions. Moreover, the President's proposal calls for DHS 
to build upon its existing privacy, confidentiality, and civil liberty 
procedures by working with the Attorney General to develop new 
procedures to appropriately limit Government receipt, use, and 
retention of threat indicators. Establishing the NCCIC as the primary 
entry way for cyber threat indicators from the private sector will 
ensure uniform application of these important privacy and 
confidentiality protections, while still allowing cyber threat 
indictors to be shared with law enforcement for the specific purposes 
identified in the legislation.
    NCCIC sits at the intersection of cyber communities, with 
representatives from the private sector and other Government entities 
physically present on the NCCIC floor and connected virtually. This 
diverse participation in the NCCIC was cemented by section 226(d) of 
the Homeland Security Act as added by the National Cybersecurity 
Protection Act. NCCIC's core mission is to enable better network 
defense by assessing and appropriately sharing information on the risks 
to America's critical cyber systems and how to reduce them.
   building capacity to accelerate automated sharing of cyber threat 
                               indicators
    The administration's proposal directs DHS to automate and share 
information in as close to real time as practicable with relevant 
Federal agencies, including law enforcement entities, and with ISAOs. 
For the past 3 years, DHS has led the development in collaboration with 
the private sector of specifications--known as STIX and TAXII--which 
standardize the representation and exchange of cyber threat 
information, including actionable cyber threat indicators. STIX, the 
Structured Threat Information eXpression, is a standardized format for 
the representation and exchange of cyber threat information, including 
indicators. TAXII, the Trusted Automated eXchange of Indicator 
Information, is a standardized protocol for discovering and exchanging 
cyber threat information in STIX. The interagency Enhance Shared 
Situational Awareness initiative has already chosen STIX as the basis 
for sharing cyber threat indicators between the Federal cyber centers, 
ensuring interoperability between these key sources of information.
    Through collaboration between DHS and the private sector, there is 
a solid and rapidly-growing base of commercial offerings supporting 
STIX and sharing indicators via the TAXII, including platforms, network 
protection appliances and endpoint security tools. While the NCCIC has 
in-house systems and tools to assist analysts in generating STIX 
indicators, those indicators are currently analyzed and filtered by 
human analysts and shared back out with the private sector and Federal 
partners through manual methods such as e-mail and secure portals. In 
2014, the NCCIC began a limited pilot with several organizations to 
test automated delivery of STIX indicators via TAXII.
    To inform our plan for achieving automated cyber threat indicator 
information sharing, DHS created a working group between a range of DHS 
offices and the FBI, a critical stakeholder in the NCCIC. We also 
included experts from our Privacy, Civil Rights and Civil Liberties, 
and Science and Technology offices, among others, to ensure that our 
architecture is based on best-in-class technology and is consistent 
with our values and our respect for Americans' privacy and civil 
liberties.
    Implementation will proceed through four major phases: (1) An 
initial operating capability phase in which we will deploy a TAXII 
system that can disseminate STIX cyber threat indicators with increased 
automation capability, enabling the use of human analysis for the most 
complex problems and egregious threats; (2) an expanded automation 
phase in which we will develop and deploy DHS infrastructure that can 
receive, filter, and analyze cyber threat indicators--during this 
phase, we will promulgate guidance for private-sector companies to 
minimize, redact, and tag their data prior to submission to NCCIC, and 
will complete a Privacy Impact Assessment; (3) a final operating 
capability phase in which we will fully automate DHS processes to 
receive and appropriately disseminate cyber threat indicators in a 
machine-readable format and finalize policies for filtering, receipt, 
retention, use, and sharing, including regular compliance reviews; and 
(4) a scaled services capability phase, during which DHS will work to 
enable agencies that lack sufficient cybersecurity resources or 
expertise to receive and share cyber threat indicators with the NCCIC 
in near-real time by providing a turnkey technical solution to ``plug 
in'' to the NCCIC.
  dhs shares information widely with federal agencies and the private 
                                 sector
    Currently, DHS shares information with Federal agencies and the 
private sector. DHS takes a customer-focused approach to information 
sharing, and different types of information require differing response 
times and dissemination protocols. DHS provides information to detect 
and block cybersecurity attacks on Federal civilian agencies and shares 
information to help critical infrastructure entities in their own 
protection; provides information to commercial cybersecurity companies 
so they can better protect their customers through the Enhanced 
Cybersecurity Services program, or ECS; and maintains a trusted 
information-sharing environment for private-sector partners to share 
information and collaborate on cybersecurity threats and trends via a 
program known as the Cyber Information Sharing and Collaboration 
Program, or CISCP. This trust derives in large part from our emphasis 
on privacy, confidentiality, civil rights, and civil liberties across 
all information-sharing programs, including special care to safeguard 
personally identifiable information.
    DHS also directly supports Federal civilian departments and 
agencies in developing capabilities that will improve their own 
cybersecurity posture. Through the Continuous Diagnostics and 
Mitigation (CDM) program, DHS enables Federal agencies to more readily 
identify network security issues, including unauthorized and unmanaged 
hardware and software; known vulnerabilities; weak configuration 
settings; and potential insider attacks. Agencies can then prioritize 
mitigation of these issues based upon potential consequences or 
likelihood of exploitation by adversaries. The CDM program provides 
diagnostic sensors, tools, and dashboards that provide situational 
awareness to individual agencies, and will provide DHS with summary 
data to understand relative and system risk across the Executive 
branch. DHS is moving aggressively to implement CDM across all Federal 
civilian agencies, and Memoranda of Agreement with the CDM program 
encompass over 97 percent of all Federal civilian personnel.
    While CDM will identify vulnerabilities and systemic risks within 
agency networks, the National Cybersecurity Protection System, also 
known as EINSTEIN, detects and blocks threats at the perimeter of those 
networks or at an agencies' Internet Service Provider. EINSTEIN is an 
integrated intrusion detection, analysis, information-sharing, and 
intrusion-prevention system. The most recent iteration, Einstein 3 
Accelerated (E3A), supplements EINSTEIN 2 by adding additional 
intrusion prevention capabilities and enabling Internet Service 
Providers (ISPs), under the direction of DHS, to detect and block known 
or suspected cyber threats using indicators.
                               conclusion
    We are working together to find new and better ways to share 
accurate, timely data in a manner consistent with fundamental American 
values of privacy, confidentiality, and civil rights. While securing 
cyberspace has been identified as a core DHS mission since the 2010 
Quadrennial Homeland Security Review, the Department's view of 
cybersecurity has evolved to include a more holistic emphasis on 
critical infrastructure which takes into account the convergence of 
cyber and physical risk.
    Today our adversaries exploit a fundamental asymmetry in our 
network infrastructure: While nearly all of our systems and networks 
are globally interconnected, our defensive capabilities are not. This 
gives the attackers a compelling advantage as they can find and exploit 
the weak links in our systems from anywhere around the world--at 
machine speed. By sharing cyber threat indicators in near-real time, we 
reduce that asymmetry.
    As our defensive cybersecurity capabilities become more 
interconnected, we greatly reduce the likelihood that an adversary can 
re-use attack infrastructure, tools, tactics, techniques, and 
procedures. In addition, we greatly reduce the time window in which new 
and novel attacks are effective because the ecosystem shares those 
indicators and develops a type of ``herd immunity,'' improving defenses 
as indicators are shared and events are correlated in near-real time. 
These two factors do not eliminate all cyber threats, but they hold the 
promise of significantly increasing the time and resources (both 
technical and human) that attackers must expend to achieve their goals. 
Moreover, the STIX data format and the TAXII transport method are 
increasingly compatible with commonly-used commercial information 
technology (IT) products. This means more entities are able to send 
indicators automatically to the NCCIC, creating an ecosystem of 
indicators which will in turn provide greater context to malicious 
cyber activity and rapidly increase situational awareness per Executive 
Order 13636, Improving Critical Infrastructure Cybersecurity and 
Executive Order 13691, signed February 13, 2015, Promoting Private 
Sector Cybersecurity Information Sharing.
    DHS will continue to serve as one of the Government's primary 
resources for information sharing and collaborative analysis, at 
machine speed wherever possible, of global cyber risks, trends, and 
incidents. Through our leadership role in protecting civilian 
Government systems and helping the private sector protect itself, DHS 
can correlate data from diverse sources, in an anonymized and secure 
manner, to maximize insights and inform effective risk mitigation.
    DHS provides the foundation of the U.S. Government's approach to 
securing and ensuring the resilience of civilian critical 
infrastructure and essential services. We look forward to continuing 
the conversation and supporting the American goals of peace and 
stability; in these endeavors, we rely upon your continued support.
    Thank you for the opportunity to testify, and we look forward to 
any questions you may have.

    Chairman McCaul. Thank you, Ms. Spaulding. We appreciate 
your service and dedication to this important issue.
    The Chairman now recognizes Dr. Schneck.

     STATEMENT OF PHYLLIS SCHNECK, DEPUTY UNDER SECRETARY, 
   CYBERSECURITY AND COMMUNICATIONS, NATIONAL PROTECTION AND 
   PROGRAMS DIRECTORATE, U.S. DEPARTMENT OF HOMELAND SECURITY

    Ms. Schneck. Good morning and thank you Chairman McCaul, 
Ranking Member Thompson, and distinguished Members of the 
committee.
    Let me echo Under Secretary Spaulding's thanks for 
convening this meeting today. Thank you for your tireless 
support to our cyber mission and thank you for making it a 
constant between my time in the private sector and my time now 
in Government, the impact that our work and our legislative 
process can have on good things.
    The under secretary explained the Department of Homeland 
Security's role and capabilities in cybersecurity and explained 
why our National Cybersecurity and Communications Integration 
Center, our NCCIC, is key and at the forefront of the 
President's proposal for increasing the volume and speed of 
information sharing.
    I would like to amplify that and tell you how we are going 
to do this and how we are building that capability. First, to 
the Ranking Member's question; what is being shared and what do 
we need most? We need information sharing and especially the 
technical threat indicators; the bare bones information of, for 
example, what is an address of a machine that is doing 
something bad that we see? What is the specific code of 
software that is being sent to hurt good people? By identifying 
these indicators, that is the life blood of cyber defense; by 
being able to very quickly recognize them and put them 
together.
    Pulling together this information, it builds on the rules 
of statistics. We have to understand good behavior and bad 
behavior to identify anomalies. Identifying those anomalies at 
the speed of machines will help us in our cyber defense 
initiatives.
    The President's proposal defines the kind of information, 
specifically, that can be shared and requires very strong 
protections around privacy and civil liberties to protect our 
personal information and protect those privacy and civil 
liberties and American ways of life that we seek to protect and 
defend through our cybersecurity mission.
    The proposal narrowly defines categories of technical 
information used to define and mitigate these threats so that 
we can then pull them together. But it does not, for an 
example, include exfiltrated information; which means the 
information, for example, that someone might have tried to 
steal, which could include proprietary information or someone's 
private information. So very narrowly-defined information on 
what we need to share and share quickly.
    The President's ISAO Executive Order will enhance the 
information-sharing efforts. The order focuses specifically on 
encouraging the formation effectiveness of information sharing 
and analysis organizations. They can be profit or nonprofit, 
private sector, and they can be composed of any combination of 
public and private sectors. The Executive Order directs DHS to 
strongly encourage the development of these formations to bring 
people together in trusted relationships to share information 
that transcends competition to enable those cyber threat 
indicators to come together and show us, again at machine 
speed, what enemy might be trying to hurt our systems and be 
able to see at that 50,000-foot level all over the world what 
actions are happening dispersed that we could use to protect 
somebody right now.
    DHS--this is a very important point--is already sharing 
information in real time with Federal agencies and the private 
sector. We share with people and machines using people and 
machines. We provide information to detect and block 
cybersecurity threats to our Federal civilian government 
agencies and, as the under secretary mentioned, within that, 
using Government-Classified information.
    We also provide information to commercial companies so that 
they can better protect themselves as well, also with some 
systems using that Classified information. We maintain key 
trusted information-sharing partnerships at a scientist level 
and at policy levels with parts of the private sector so we can 
enable us--ourselves and them to understand what is the science 
and what are the key things we need to be looking for? So trust 
between people and machines.
    Where are we going and why is this so important? We need to 
up our game to automate. We need to take the machines and 
remember that machines are not smart, they are just fast, and 
use that very machine speed that the adversary uses to steal 
and hurt us in our cyber systems and use that machine to 
understand what is happening all over the world and enable our 
machines in addition to other technologies to sense bad 
behavior before it hurts.
    In doing that, part of that is pulling those automated 
cyber threat indicators together so that we can start looking 
at behavior all over the world and work--and this is very, very 
important--in partnership. So no one can do this alone. We need 
DHS, we need the FBI, we need the Secret Service, we need the 
intelligence community, and we need the private sector.
    I thank you, Chairman, as well for all the work you have 
done with the private sector to engage them with your committee 
and how important it is to work with Government.
    We have developed a common language and a common way of 
writing cyber threat indicators so that anyone who wants to 
share with us can, that can be transported at machine speed, 
and that machines can readily read the information; and it 
limits itself to what is required to be a cyber threat 
indicator. We need to continue to work with our privacy and 
civil liberties experts constantly; with the FBI, with the 
Secret Service, with law enforcement, with the intelligence 
community to manage all the expectations and all of the 
equities.
    But we are building protocols and structured language to 
equalize and normalize with what a cyber threat indicator is, 
to have the machines get a lot of the noise out of the way so 
our top minds can look at the most egregious threats, and to 
have our networks become more self-healing and more resilient.
    Finally, I would like to reemphasize the importance of our 
NCCIC, our National Cybersecurity Communications Integration 
Center, and point out that that is the interface for sharing 
cyber information across the Government and private sector. But 
we do this in clear cooperation, and as we develop these 
protocols, it is with the Secret Service and the FBI and all 
the law enforcement and the intelligence community and the 
private sector.
    This can't work if we do it alone. It has to respect 
everyone's equities and all privacy and civil liberties. Having 
that single designated entity in the Government reduces 
complexity, as the under secretary stated and streamlines our 
ability to develop that common picture of the threats we see 
daily.
    Thank you for this opportunity to testify. I look forward 
to any questions you might have.
    Chairman McCaul. Thank you. Just let me say that you have 
really done an outstanding job standing up the NCCIC, bringing 
the capabilities of the NCCIC to the current threats that we 
have. Your experience at McAfee is well-served. I thank the 
Department.
    With that, the Chairman now recognizes Dr. Fischer.

 STATEMENT OF ERIC A. FISCHER, SENIOR SPECIALIST, SCIENCE AND 
TECHNOLOGY, CONGRESSIONAL RESEARCH SERVICE, LIBRARY OF CONGRESS

    Mr. Fischer. Good afternoon, Chairman McCaul, Ranking 
Member Thompson, and distinguished Members of the committee.
    On behalf of the Congressional Research Service, I would 
like to thank you for the opportunity to testify today on 
information sharing and cybersecurity. Barriers to sharing of 
cybersecurity information are considered by many, as we heard, 
to be a significant hindrance to effective protection of 
information systems.
    That is especially true for critical infrastructure, even 
though most recent prominent cases of successful cyber attacks 
have not involved such organizations. Many examples have been 
cited of legal, technical, and other barriers. In addition, 
traditional approaches to security and confidentiality would 
themselves impede sharing of information.
    There is some disagreement among experts about whether 
Federal legislation is needed. Nevertheless, there appears to 
be a fairly broad consensus that legislation could be useful if 
crafted appropriately. However, there is disagreement also 
about what the key characteristics should be. Proposals to 
reduce or remove barriers have raised concerns, some of which 
are related to the purpose of the barriers; that the barriers 
are thought to currently impede sharing.
    A key challenge appears to be how to achieve the proper 
level of balance that fosters the sharing of useful information 
efficiently and effectively, while ensuring avoidance of 
adverse impacts. I will touch on five questions that the debate 
has tended to focus on.
    Question No. 1: What are the kinds of information for which 
barriers to sharing make effective cybersecurity more 
difficult? Information sharing can involve a wide variety of 
materials communicated on a wide variety of time scales. The 
level of sensitivity of information can vary. For example, it 
may be Classified, proprietary, or personal, or open public 
information. Information of any class will also vary in its 
value for cybersecurity and the degree to which it needs human 
processing to be useful.
    To the extent that the goal of information sharing is to 
defend information systems against cyber attacks, the focus has 
been on actionable information. Such information may often need 
to be shared very quickly, as Dr. Schneck has mentioned, with 
little or no time for human examination.
    Broader information contributing to shared situational 
awareness may also be useful; for example, among companies 
within a sector. Such information might not be technically 
actionable, but helps organizations to analyze their current 
security postures and inform their responses.
    A key point is that addressing what should be shared, how 
and when, is not as straightforward as it may seem. This is 
true not only for cybersecurity information, but more broadly 
with security information.
    Question No. 2: How should information sharing be 
structured to ensure that it is efficient and effective? 
Information sharing can conceivably lead to information 
overload. That can include not only information of uncertain 
quality and use, but also similar or redundant information from 
a variety of sources.
    Various legislative proposals have approached the structure 
information sharing differently. The White House proposal would 
use information sharing and analysis organizations, which were 
created in the Homeland Security Act, but few of which appear 
to exist today. It might be useful to clarify the roles of 
these and other entities as the committee considers 
legislation.
    Question No. 3: What are the risks to privacy rights and 
civil liberties of individual citizens, and how are they best 
protected? Such concerns have been a significant source of 
controversy and debate about information sharing and 
legislation. They have arisen in part because proposals would 
permit sharing of specific information or specified information 
by covered private entities, notwithstanding any other 
provision of law. That particular phrase has certain 
implications that would be worthy of--perhaps of additional 
consideration. Now, the various legislative proposals address 
privacy concerns in various ways, but there are also many 
similarities among them.
    Fourth question is: What, if any, statutory protections 
against liability are needed? Concerns about liability has 
often been cited as a significant barrier to private-sector 
information sharing, both with other private entities and with 
the Federal Government. There are--in addition to the 
notwithstanding provisions, there are also various proposals to 
prohibit court actions to protect organizations against such 
actions--or against liability concerns and reduce that barrier.
    The fifth question, finally, is: What improvements to 
current standards and practices are needed to ensure that 
information sharing is useful and efficient for protecting 
information systems, networks, and their contents? As the other 
witnesses have testified, standards for exchange of threat data 
have been developed and their use is growing. But there are 
also calls for additional standards and best practices. There 
are some concerns among observers that such work is needed, 
particularly with respect to--well, for example, evaluating the 
effectiveness of information sharing.
    That concludes my testimony. Once again, thank you for 
asking me to appear before you today.
    [The prepared statement of Mr. Fischer follows:]
                 Prepared Statement of Eric A. Fischer
                           February 25, 2015
    Chairman McCaul, Ranking Member Thompson, and distinguished Members 
of the committee: Thank you for this opportunity to discuss legislative 
proposals on information sharing in cybersecurity.\1\ In January of 
this year, the White House announced a revision of its 2011 
information-sharing proposal as part of a set of updated proposals and 
other actions relating to cybersecurity:\2\
---------------------------------------------------------------------------
    \1\ This statement is limited to a policy analysis of the proposals 
and initiatives discussed and is not intended to reach any legal 
conclusions regarding them.
    \2\ The White House, ``Securing Cyberspace: President Obama 
Announces New Cybersecurity Legislative Proposal and Other 
Cybersecurity Efforts,'' Press Release (January 13, 2015), http://
www.whitehouse.gov/the-press-office/2015/01/13/securing-cyberspace-
president-obama-announces-new-cybersecurity-legislat.
---------------------------------------------------------------------------
   A draft bill to enhance information sharing on cybersecurity 
        within the private sector and between the private sector and 
        the Federal Government. Most of my testimony today will focus 
        on this proposal and related bills in the 113th and 114th 
        Congresses.\3\
---------------------------------------------------------------------------
    \3\ The White House, Updated Information Sharing Legislative 
Proposal, 2015, http://www.whitehouse.gov/sites/default/files/omb/
legislative/letters/updated-information-sharing-legislative-
proposal.pdf.
---------------------------------------------------------------------------
   A draft bill to amend Federal statutes relating to cyber 
        crime by creating or increasing criminal penalties for certain 
        types of offenses and providing some other authorities to law-
        enforcement agencies and the courts.\4\
---------------------------------------------------------------------------
    \4\ The White House, Updated Administration Proposal: Law 
Enforcement Provisions, 2015, http://www.whitehouse.gov/sites/default/
files/omb/legislative/letters/updated-law-enforcement-tools.pdf.
---------------------------------------------------------------------------
   A draft bill to harmonize State laws requiring companies 
        holding personal information on customers to notify them of 
        data breaches involving such information.\5\
---------------------------------------------------------------------------
    \5\ The White House, The Personal Data Notification & Protection 
Act, 2015, http://www.whitehouse.gov/sites/default/files/omb/
legislative/letters/updated-data-breach-notification.pdf.
---------------------------------------------------------------------------
   A 5-year, $25 million grant to create a new cybersecurity 
        consortium consisting of 13 Historically Black Colleges and 
        Universities (HBCUs), the Lawrence Livermore and Sandia 
        National Laboratories of the Department of Energy, and a South 
        Carolina school district. The object of the program is to help 
        fill demand for cybersecurity professionals while diversifying 
        the pipeline of talent for this and related fields of 
        expertise.\6\ This program can be seen as a complement to 
        legislation enacted by the 113th Congress that addresses 
        cybersecurity workforce needs in the Department of Homeland 
        Security \7\ (DHS) and more broadly.\8\
---------------------------------------------------------------------------
    \6\ The White House, ``Vice President Biden Announces $25 Million 
in Funding for Cybersecurity Education at HBCUs,'' Press Release 
(January 15, 2015), http://www.whitehouse.gov/the-press-office/2015/01/
15/vice-president-biden-announces-25-million-funding-cybersecurity-
educatio.
    \7\ H.R. 2952, the Cybersecurity Workforce Assessment Act (Pub. L. 
No. 113-246), and S. 1691, the Border Patrol Agent Pay Reform Act of 
2014 (Pub. L. No. 113-277), requiring assessments of workforce needs 
within the Department of Homeland Security and providing enhanced 
authorities to the Secretary for recruitment and retention of 
cybersecurity personnel.
    \8\ S. 1353, the Cybersecurity Enhancement Act of 2014 (Pub. L. No. 
113-274), establishing in statute a National Science Foundation program 
for educating cybersecurity professionals for Government agencies, and 
an interagency program of challenges and competitions in cybersecurity 
to stimulate identification and recruitment of cybersecurity 
professionals more broadly as well as cybersecurity research and 
innovation.
---------------------------------------------------------------------------
    The announcement also included a description of the White House 
cybersecurity summit held on February 13 at Stanford University.
    Barriers to the sharing of information on threats, attacks, 
vulnerabilities, and other aspects of cybersecurity--both within and 
across sectors--have long been considered by many to be a significant 
hindrance to effective protection of information systems, especially 
those associated with critical infrastructure.\9\ Examples have 
included legal barriers, concerns about liability and misuse, 
protection of trade secrets and other proprietary business information, 
and institutional and cultural factors--for example, the traditional 
approach to security tends to emphasize secrecy and confidentiality, 
which would necessarily impede sharing of information.
---------------------------------------------------------------------------
    \9\ See, for example, The Markle Foundation Task Force on National 
Security in the Information Age, Nation At Risk: Policy Makers Need 
Better Information to Protect the Country, March 2009, http://
www.markle.org/downloadable_assets/20090304_mtf_report.pdf; CSIS 
Commission on Cybersecurity for the 44th Presidency, Cybersecurity Two 
Years Later, January 2011, http://csis.org/files/publication/
110128_Lewis_CybersecurityTwoYearsLater_Web.pdf.
---------------------------------------------------------------------------
    A few sectors are subject to Federal notification requirements,\10\ 
but most such information sharing is voluntary, often through sector-
specific Information Sharing and Analysis Centers (ISACs)\11\ or 
programs under the auspices of the Department of Homeland Security 
(DHS) or sector-specific agencies.\12\
---------------------------------------------------------------------------
    \10\ Notable examples include the chemical industry, electricity, 
financial, and transportation sectors.
    \11\ See, for example, ISAC Council, ``National Council of ISACS,'' 
2015, http://www.isaccouncil.org/. ISACs were originally formed 
pursuant to a 1998 Presidential Directive (The White House, 
``Presidential Decision Directive 63: Critical Infrastructure 
Protection,'' May 22, 1998, http://www.fas.org/irp/offdocs/pdd/pdd-
63.htm).
    \12\ See also CRS Report R42114, Federal Laws Relating to 
Cybersecurity: Overview and Discussion of Proposed Revisions, by Eric 
A. Fischer; CRS Report R42409, Cybersecurity: Selected Legal Issues, by 
Edward C. Liu et al.; CRS Report R42984, The 2013 Cybersecurity 
Executive Order: Overview and Considerations for Congress, by Eric A. 
Fischer et al.; CRS Report R4381, Legislation to Facilitate 
Cybersecurity Information Sharing: Economic Analysis, by N. Eric Weiss.
---------------------------------------------------------------------------
    While there is some disagreement among experts about whether 
Federal legislation is needed to address the problem, there appears to 
be fairly broad consensus that such legislation could be useful if 
crafted appropriately but potentially harmful if not. However, there is 
disagreement about what the key characteristics of useful legislation 
would be. Proposals to reduce or remove such barriers, including 
provisions in legislative proposals in the last two Congresses, have 
raised concerns, some of which are related to the purpose of barriers 
that currently impede sharing. Examples include risks to individual 
privacy and even free speech and other rights, use of information for 
purposes other than cybersecurity, such as unrelated Government 
regulatory actions, commercial exploitation of personal information, or 
anticompetitive collusion among businesses that would currently violate 
Federal law.
    More broadly, debate has tended to focus on questions such as the 
following:
    1. What are the kinds of information for which barriers to sharing 
        exist that make effective cybersecurity more difficult, and 
        what are those barriers?
    2. How should information sharing be structured in the public and 
        private sectors to ensure that it is efficient and effective?
    3. What are the risks to privacy rights and civil liberties of 
        individual citizens associated with sharing different kinds of 
        cybersecurity information, and how can those rights and 
        liberties best be protected?
    4. What, if any, statutory protections against liability are needed 
        to reduce disincentives for private-sector entities to share 
        cybersecurity information with each other and with Government 
        agencies, and how can the need to reduce such barriers best be 
        balanced against any risks to well-established protections?
    5. What improvements to current standards and practices are needed 
        to ensure that information sharing is useful and efficient for 
        protecting information systems, networks, and their contents?
    The White House information-sharing proposal would attempt to 
address such questions in several ways. The discussion below includes a 
summary of how the proposal would address them in comparison to the 
following bills addressing information sharing:
   H.R. 234, the Cyber Intelligence Sharing and Protection Act 
        (CISPA), in the 114th Congress, identical to H.R. 624 as passed 
        by the House in the 113th Congress;
   S. 2588, Cybersecurity Information Sharing Act of 2014 
        (CISA) as reported to the Senate in the 113th Congress;
   S. 456, the Cyber Threat Sharing Act of 2015, as introduced 
        in the 114th Congress.
                      kinds of information shared
    Information sharing can involve a wide variety of material 
communicated on a wide range of time scales, ranging from broad 
cybersecurity policies and principles to best practices to descriptions 
of specific threats and vulnerabilities to computer-generated data 
transmitted directly from one information system to another 
electronically. The level of sensitivity of information can also vary--
for example, it may be Classified, proprietary, or personal. 
Information of any class will also vary in its value for cybersecurity 
and the degree to which it needs human processing to be useful.\13\
---------------------------------------------------------------------------
    \13\ See, for example, Kathleen M. Moriarty, ``Transforming 
Expectations for Threat-Intelligence Sharing,'' RSA Perspective (August 
3, 2013), https://www.emc.com/collateral/emc-perspective/h12175-transf-
expect-for-threat-intell-sharing.pdf.
---------------------------------------------------------------------------
    To the extent that the goal of information sharing is to defend 
information systems against cyber attacks, there appears to be a 
consensus that shared information needs to be actionable--that is, it 
should identify or evoke a specific response aimed at mitigating 
cybersecurity risks. To be meaningfully actionable, information may 
often need to be shared very quickly or even in an automated fashion. 
There may therefore be little or no time for human operators to examine 
a specific parcel of data to determine whether sharing it could raise 
privacy, liability, or other concerns.
    The White House proposal would limit the scope of shared 
information covered under the proposal to ``cyber threat indicators,'' 
which includes information needed to ``indicate, describe, or 
identify'' malicious reconnaissance or command-and-control activities, 
methods of social engineering and of defeating technical or operational 
controls, and technical vulnerabilities, and from which ``reasonable 
efforts'' have been made to remove personally identifying information 
if the person is thought to be unrelated to the threat. The definition 
in S. 456 is largely identical.
    The definition in the White House proposal and S. 456 are arguably 
the narrowest in scope. S. 2588 also focuses on ``cyber threat 
indicators,'' with a definition that is similar to that in the White 
House proposal, but is somewhat broader, including other attributes, 
such as the actual or potential harm caused by an incident. It also 
expressly permits sharing of information on countermeasures--measures 
to prevent or mitigate threats and vulnerabilities.
    H.R. 234 uses the term ``cyber threat information,'' characterized 
as information ``directly pertaining to'' efforts to gain unauthorized 
access to information systems or to effect negative impacts on systems 
or networks, threats to the information security of a system or its 
contents, and vulnerabilities of systems and networks. The bill also 
defines a related term, ``cyber threat intelligence,'' with 
characteristics similar to those of cyber threat information but is in 
the possession of the intelligence community.
                    structure of information sharing
    Information sharing can conceivably lead to information overload, 
where an entity receives much more information than it can reasonably 
process. That could include not only information of uncertain quality 
and use, but also similar or redundant information from a variety of 
sources. In addition, a proliferation of sharing mechanisms could lead 
to stovepiping, which could reduce sharing across sectors, for example, 
and lack of clarity with respect to responsibilities, which could lead 
to gaps in sharing useful information. In contrast, a narrow, tightly-
defined structure for information sharing could lead to logjams or 
impede innovation in response to continuing evolution of cyberspace.
    The White House proposal and S. 456 would create a structure for 
information sharing that includes the National Cybersecurity and 
Communications Integration Center (NCCIC) as the Federal hub for 
receipt and distribution of cybersecurity information, and fostering 
the use of private information sharing and analysis organizations 
(ISAOs) as recipients of information from private entities.\14\ ISAOs 
could presumably also share such information under the provisions of 
the Homeland Security Act, but the proposal does not specifically 
address that function for them. The proposal would require the DHS 
Secretary to ensure that indicators are shared in a timely fashion with 
other Federal agencies. S. 456 would require that procedures for such 
sharing be established and would specifically require the Secretary to 
ensure that both useful Classified and Unclassified information is 
shared with non-Federal entities.
---------------------------------------------------------------------------
    \14\ ISAOs were defined in the Homeland Security Act (6 U.S.C.  
131(5)) as entities that gather and analyze information relating to the 
security of critical infrastructure, communicate such information to 
help with defense against and recovery from incidents, and disseminate 
such information to any entities that might assist in carrying out 
those goals. The proposal covers receipt of indicators by ISAOs but 
does not mention communication or dissemination of information by them, 
except, by inference, to the NCCIC. Information Sharing and Analysis 
Centers (ISACs) are more familiar to most observers. They may also be 
ISAOs but are not the same, having been originally formed pursuant to a 
1998 Presidential directive (The White House, ``Presidential Decision 
Directive 63: Critical Infrastructure Protection,'' May 22, 1998, 
http://www.fas.org/irp/offdocs/pdd/pdd-63.htm).
---------------------------------------------------------------------------
    H.R. 234 would create an entity at DHS (presumably the NCCIC \15\) 
to share threat information and an entity at the Department of Justice 
to share cyber crime information. It would require individual agencies 
that receive threat information to develop procedures for sharing it. 
In contrast to S. 456, it would require the Director of National 
Intelligence to establish procedures for sharing Classified threat 
information. It would also designate specific classes of private-sector 
entities as those permitted to monitor systems and share threat 
information under the bill. Those include entities that provide 
cybersecurity goods and services to others or to themselves.
---------------------------------------------------------------------------
    \15\ The text in the bill was originally drafted before the 
enactment of the National Cybersecurity and Communications Integration 
Center Act of 2014 (Pub. L. No. 113-282), which established the NCCIC 
by statute.
---------------------------------------------------------------------------
    S. 2588 would require DHS to create a ``capability and process'' 
for sharing both threat indicators and countermeasures. It would 
establish an interagency process to develop procedures for sharing 
Federal information with the private sector. It would require 
development of an interagency process for sharing Classified threat 
indicators.
                         timeliness of sharing
    The time scale on which shared information will be most useful 
varies. That is especially an issue in an environment where the 
relevance of timing for shared information may be measured in seconds 
or even milliseconds in many cases.\16\ The White House proposal and S. 
456 would address this concern by requiring the NCCIC to share 
indicators ``in as close to real time as practicable'' and by requiring 
establishment of a program to advance automated mechanisms for such 
sharing.
---------------------------------------------------------------------------
    \16\ See, for example, M.J. Herring and K.D. Willett, ``Active 
Cyber Defense: A Vision for Real-Time Cyber Defense,'' Journal of 
Information Warfare 13, no. 2 (April 2014): 46-55.
---------------------------------------------------------------------------
    H.R. 234 and S. 2588 would also require ``real-time sharing.'' The 
meaning of this term is not explicitly defined or described in the 
bills, but it presumably refers to sharing that occurs rapidly, for 
example, by machine-to-machine transmission. That is consistent with 
the stated purposes of the legislative proposals, in that threat 
information would likely need to be disseminated quickly in order to 
detect or prevent incoming cyber attacks, which can occur very quickly. 
This raises the question of whether this term should require any 
particular mode of sharing, for example, by machine-to-machine 
transmission without or with minimal intervening processing by human 
operators, and how different interpretations of the term may impact 
operational effectiveness, privacy interests, and competition for 
technical and financial resources. The White House proposal appears to 
address that through its proposed development of automated mechanisms, 
and S. 2588 would require development of a process to receive 
indicators and countermeasures electronically, including via an 
``automated process between information systems.''
                      privacy and civil liberties
    Concerns relating to privacy and civil liberties, especially the 
protection of personal and proprietary information and uses of shared 
information, have been a significant source of controversy in debate 
about information-sharing legislation. Such concerns have arisen in 
part because the White House proposal and the bills would permit 
sharing of specified cybersecurity information by covered private 
entities ``notwithstanding any other provision of law.'' That would 
arguably remove barriers to sharing stemming from concerns that 
information would inadvertently violate laws such as those on privacy 
and anti-trust.
    However, it also raises concerns about privacy and civil liberties. 
In particular, personally identifying information might be included in 
the shared information but might not be related to the threat. In 
addition, data analytics might conceivably be used to draw inferences 
about identity from data sets even if any given piece of the shared 
information would not be identifying. Second, if access to shared 
information is not strictly controlled and restricted, or is used for 
purposes other than cybersecurity, risks to civil liberties may arise. 
Concerns have also been raised about regulatory use of shared 
information and disclosure of proprietary business information.
    The White House proposal would address such concerns by:
   limiting application of the ``notwithstanding'' provision to 
        indicators disclosed to the NCCIC and ISAOs;
   limiting private-sector use of shared indicators to purposes 
        relating to protection of information systems and their 
        contents;
   requiring minimization of personally identifiable 
        information and safeguarding of any such information that 
        cannot be removed;
   requiring development of guidelines by the Attorney General 
        on limiting the acquisition and sharing of personally 
        identifiable information and establishing processes for 
        anonymization, safeguarding, and destruction of information;
   exempting information received by the Federal Government 
        from disclosure under the Freedom of Information Act;
   prohibiting use of shared information for regulatory 
        enforcement;
   requiring penalties for Federal violations of its 
        restrictions relating to information sharing; and
   an annual report to Congress on privacy and civil liberties.
    S. 456 includes those provisions but would also permit a private 
entity to receive indicators under the ``notwithstanding'' provision.
    H.R. 234 and S. 2588 have related provisions except as follows: 
Both bills explicitly limit Federal use of shared information to 
cybersecurity purposes and uses relating to protection of individuals 
and investigation and prosecution of cyber crimes and certain other 
offenses. They both require various activities to reduce the degree to 
which personal information is shared and other means of safeguarding it 
from unauthorized sharing and use. H.R. 234 requires that guidelines be 
developed through an interagency process.
                         liability protections
    Concern about liability has often been cited as a significant 
barrier to private-sector sharing of cybersecurity information, both 
with other private entities and with the Federal Government. In 
addition to the protections granted by the use of ``notwithstanding any 
other provision of law'' with respect to provision of information by 
private-sector entities, the White House proposal would address this 
issue by prohibiting civil or criminal actions in Federal or State 
courts for covered activities with respect to lawfully obtained cyber 
threat indicators disclosed to or received from the NCCIC or a 
certified ISAO. However, it also specifies monopolistic actions such as 
price fixing that are not permitted.
    The prohibition on civil or criminal actions in H.R. 234 covers 
acquisition and sharing of cyber threat information, or decisions for 
cybersecurity purposes based on such information. The bill stipulates 
that actions must be taken in good faith. The S. 2588 prohibition 
covers only private defendants, and includes monitoring systems or 
sharing information. S. 2588 states that a good-faith reliance that an 
activity was permitted under the bill's provisions will serve as a 
complete defense against any court action. It also stipulates that 
private-sector exchange of cyber threat information or assistance for 
cybersecurity purposes does not violate anti-trust laws, but further 
specifies monopolistic actions such as price-fixing that are not 
permitted.
                improvements to standards and practices
    The concerns discussed above about what information would be most 
useful to share and how raise the question of whether better standards 
and best practices are needed for improving the effectiveness and 
efficiency of information sharing.\17\ The White House proposal and S. 
456 would require the DHS Secretary to establish a process for 
selecting a private entity that would determine best practices for 
creating and operating private ISAOs. The recent Executive Order on 
information sharing has a similar provision.\18\ There are no similar 
provisions in the other bills.
---------------------------------------------------------------------------
    \17\ See, for example, Moriarty, Transforming Expectations for 
Threat-Intelligence Sharing.
    \18\ Executive Order 13691, ``Promoting Private Sector 
Cybersecurity Information Sharing,'' Federal Register 80, no. 34 
(February 20, 2015): 9349-53.

    Chairman McCaul. Thank you, Dr. Fischer.
    I now recognize myself for questions.
    Ms. Spaulding, I think as you mentioned, we have 
extraordinary offensive capabilities that we--you and I have 
seen and Dr. Schneck. That kind of capability turned against us 
could be very destructive. It is the defensive capability that 
I think is where we are trying to improve here through 
additional legislation.
    I am very proud of this committee's work last Congress in 
passing really the first cybersecurity legislation, landmark 
cybersecurity legislation, that I think the Ranking Member--I 
can speak for him as well--is both pro-security but pro-
privacy. We had that support from two groups that don't always 
agree on how to get things done.
    Mr. Thompson. Oh, really?
    Chairman McCaul. Well, I am not talking about you. I am 
talking about the pro-privacy and pro-security.
    You know, as I have studied this--and I have studied it 
extensively--it seems to me that there is--the Department of 
Homeland Security is really the ideal place for the safe 
harbor. It is the civilian interface to the private sector. It 
also has a robust privacy office and can protect personal 
information.
    Some would argue it should be another portal in the Federal 
Government. I think that the safe harbor at DHS is--again, 
should be the lead portal, if you will, for the sharing of this 
information.
    But there are other opinions on that. I wanted to elicit 
first from Dr. Schneck and Ms. Spaulding, what are your 
thoughts on how to integrate the other portals that exist 
today? We have, of course, NSA, the intelligence community, we 
have Treasury Department that the financial world, as I talk to 
people in that sector seem to--they like that portal, as well. 
I know that you would be taking it--you know, information from 
the intelligence community, FBI, and other agencies to 
basically funnel that threat information through the DHS 
civilian interface.
    But can you speak to these other portals and how they 
factor into the President's proposal and what do you think 
would be the best idea here?
    Ms. Spaulding. Yes, thank you, Mr. Chairman.
    First, I think it is really important to emphasize what 
this legislation does and does not cover. So this is narrowly 
focused on network defense and the kind of information that is 
most important for specifically defending networks; and that is 
this cyber threat indicator information. It is in no way 
intended to get in the way of existing relationships that 
companies might have today with other parts of the Federal 
Government, whether it is the FBI or Treasury or elsewhere in 
the Federal Government.
    Calls to say we think we see something odd going on in our 
system should continue to be made wherever those companies are 
most comfortable going in. We have mechanisms in place to 
ensure that a call to one is effectively and appropriately a 
call to all; and that we put together the appropriate 
interagency teams to respond to those kinds of requests for 
assistance and information coming in.
    So this is by no means intended to cover all kinds of 
information sharing between the private sector and the 
Government. Those relationships are very important.
    Chairman McCaul. I think that is an important point. As I 
talk to the private sector--and it is very important to me to 
have their buy-in on this--I think that is a very important 
point to make; is that we are not saying you can't have contact 
with these other portals. It is just that DHS is, you know, the 
lead interface.
    Dr. Schneck, do you have any thoughts on that?
    Ms. Schneck. I would only add at a technical level, we are 
working day in and day out with our----
    Ms. Spaulding. Push to talk.
    Ms. Schneck. Sorry. At a technical level, we are working 
constantly with our peers, across with the FBI and with the 
Secret Service and with the intelligence community to look at 
how do we make sure that information that comes in is handled 
and distributed exactly the right way in real time, as if it 
had come into them, so that we can have it. The important thing 
here is that it is not a fragmented weather map, if you would. 
The way to see a tornado--and I used to work tornado modeling. 
The way you do this is to see all the information at once.
    That is one of the key reasons why we think this is so 
important, to have the NCCIC do this. But we are working 
constantly with our partners to make sure that no one is 
deprived of any information. That is what takes so long. It is 
not just a technology problem. This is a policy puzzle of how 
do we preserve the privacy, civil liberties, and equities, 
continue to maintain all the existing relationships and make 
sure information gets to the right people at the right time at 
light speed.
    Chairman McCaul. Let me just echo the comments made 
earlier, and that is that in the last 5 years, I have seen the 
capabilities at Homeland Security go way up. The sharing of 
this threat information in real time has increased 
exponentially, I think, under your leadership. That makes a 
difference. Because there were doubters, you know, 5 years ago 
about whether DHS could stand up and have that capability. I 
think you have demonstrated and proved that they can.
    So last question. Well, I have two quick ones. But on the 
liability protection, I commend the Secretary for coming 
forward with this piece. It is sometimes a bone of contention 
between both sides of the aisle. But I think it is absolutely 
essential to incentivize the private sector to participate in 
the safe harbor; for without that, they will not do so. I think 
they have to have the assurance that if they share information, 
they are not open to a lawsuit.
    So I have talked to the private sector. They like the 
liability protections that are presented here. I think they 
have some concern about private-to-private sharing and the 
certification process and all this. How would that work under 
this proposal?
    Ms. Spaulding. So the liability protections, as you know, 
apply not only to sharing of these cyber threat indicators with 
the NCCIC, with the Department of Homeland Security, but also 
to sharing with these information sharing and analysis 
organizations, these--we call them ISAOs. Many of those are the 
ISACs that exist today for the various sectors; the financial 
services ISAC, the multi-State ISAC, and others.
    So what the legislation provides is that the private sector 
can share among themselves through these appropriate 
organizations and enjoy the same liability protection for 
providing that information to those organizations.
    Chairman McCaul. I think the safe harbor at DHS is a 
construct within--where we want to incentivize most of the 
sharing of information. But I do think the private sector's 
private-to-private sharing also should be protected as well. We 
can discuss that more as this legislation unfolds.
    Last question. I get asked this question probably the most. 
That is, you know, what keeps you up at night? I talk about 
cybersecurity quite a bit. But within this space, to both Ms. 
Spaulding and Dr. Schneck, what keeps you up at night the most?
    Ms. Spaulding. So clearly, what I worry most about is cyber 
activity that would significantly disrupt our critical 
infrastructure. So we spend a lot of time thinking about those 
consequences and making sure we understand interdependencies 
within the physical world. Because this is not just about 
protecting machines, this is about protecting our ways of life.
    So we need to make sure that we understand what are those 
consequences that would be most devastating, and that we are 
working most closely with those parts of our critical 
infrastructure to make sure that we can mitigate those 
consequences and try to prevent, as Dr. Schneck said, bad 
things--bad things from doing bad harm.
    Chairman McCaul. Thank you.
    Dr. Schneck.
    Ms. Schneck. Thank you. I would echo the interface of the 
physical world. No one ever tried to keep a machine safe to 
keep a machine safe. Our job at Homeland Security is to keep 
people safe. The Secretary always tells us that cybersecurity 
is a key part of homeland security.
    Another piece that really does keep me up at night as well 
is our small-to-medium business and our State and local. They 
don't typically have enough budget to focus on cybersecurity. 
Part of the elegance that will come from our teamwork with our 
partners and the FBI and the intelligence community and across 
the private sector and Government is to pull those threat 
indicators together to be able to, in final phases, make them 
available to the greater 99 percent of our business fabric that 
is not a big company and to our State and locals, and to have 
that system learn by participating and make all of us smarter 
and safer.
    If I would just add, I thank you for your gracious comments 
about my leadership earlier. I think about the team back at the 
NCCIC and back across DHS that really makes it happen, and I 
want you to know about that. I walked into the finest team on 
the planet.
    Chairman McCaul. Well, thank you. Your boss just arrived. I 
want to recognize the Secretary. I will reiterate my comments 
about Ms. Spaulding and Dr. Schneck and their tremendous 
performance in standing up DHS with the capabilities with the 
respect it deserves, and I think the ability to move forward 
with the proposal from you, sir.
    I also commended you before you came in on your proposal of 
liability protection, which I think will incentivize the 
private sector to fully participate in this safe harbor. So 
thank you for your leadership. You got two really good 
employees right here.
    So with that, the Chairman now recognizes the Ranking 
Member.
    Mr. Thompson. Thank you, Mr. Chairman.
    Very rarely do we agree 100 percent on anything. But the 
two employees referenced here today absolutely have 
distinguished themselves. Not just here, but in their careers 
in general.
    I would like unanimous consent to have entered into the 
record the letter that you co-authored with me and our 
colleagues on the Senate to the President referencing some 
concerns we had about the new cyber center.
    Chairman McCaul. Without objection, it is ordered.
    [The information follows:]
  Letter Submitted for the Record by Ranking Member Bennie G. Thompson
                                 February 11, 2015.
The Honorable Barack Obama,
President of The United States, The White House, Washington, DC 20500.
    Dear Mr. President: Thank you for your dedication and leadership on 
the important national and economic security issue of cybersecurity. As 
the leaders of the Committees that developed legislation to codify the 
Department of Homeland Security's role as the lead Federal agency for 
helping to protect private sector networks, principally through the 
National Cybersecurity and Communications Integration Center (NCCIC), 
we have several questions regarding your newly-unveiled proposal for a 
new cybersecurity information integration center.
    We were pleased that you signed ``National Cybersecurity Protection 
Act of 2014'' (P.L. 113-282) into law less than two months ago, on 
December 18th, and implementation of that law is underway. At this 
time, the NCCIC, with its newly codified authority, is working to 
establish itself as an effective partner with the private sector to 
meet evolving cybersecurity challenges. Pursuant to the ``National 
Cybersecurity Protection Act of 2014,'' among the functions of the 
NCCIC are the following:
    ``(1) being a Federal civilian interface for the multi-directional 
        and cross-sector sharing of information related to 
        cybersecurity risks, incidents, analysis, and warnings for 
        Federal and non-Federal entities;
    ``(2) providing shared situational awareness to enable real-time, 
        integrated, and operational actions across the Federal 
        Government and non-Federal entities to address cybersecurity 
        risks and incidents to Federal and non-Federal entities;
    ``(3) coordinating the sharing of information related to 
        cybersecurity risks and incidents across the Federal 
        Government;''
    Additionally, the NCCIC is ``a 24/7 cyber situational awareness, 
incident response, and management center that is a national nexus of 
cyber and communications integration for the Federal government, 
intelligence community, and law enforcement.'' We understand that 
increasing private sector participation and improving the quantity and 
quality of information received at this Federal civilian center was a 
priority for you, as it is for us and DHS Secretary Jeh Johnson.
    Therefore, we have questions about your new proposal to establish 
another information sharing hub, the Cyber Threat Intelligence 
Integration Center (CTIIC) that was unveiled this week, as the 
activities outlined for the center seem to resemble the functions 
authorized in law for the NCCIC. We are concerned that the introduction 
of the CTIIC at this moment in the NCCIC's evolution may complicate 
those efforts and introduce uncertainty for the private sector and 
other partners. It also risks driving away activity to the new CTIIC, 
which would be operated by the Office of the Director of National 
Intelligence (ODNI).
    Accordingly, we request that you please answer the following 
questions:
   Why is the CTIIC needed at this time? How is it supposed to 
        differ from the NCCIC? Do you intend to submit a legislative 
        proposal to Congress to authorize this center? If so, when?
   Some have observed that functions of the CTIIC are 
        duplicative with those of the NCCIC.\1\ Others have said that 
        it introduces unnecessary bureaucracy.\2\ Is the CTIIC 
        duplicative? Specifically, what are the responsibilities and 
        activities of the CTIIC and are they already covered by the 
        NCCIC or, for that matter, the FBI's cyber center?
---------------------------------------------------------------------------
    \1\ Sean Lyngaas, ``New Cyber Agency Modeled on Counterterrorism 
Center,'' FEDERAL COMPUTER WEEK (FCW), February 10, 2015, wrote that 
Chris Cummiskey, the former DHS under secretary for management, said 
his first reaction to the news of the CTIIC's establishment was that 
``its prescribed functions sounded quite a bit like NCCIC's.''
    \2\ Melissa Hathaway, former White House cybersecurity coordinator 
and president of Hathaway Global Strategies told Ellen Nakashima in 
``New Agency to Sniff Out Threats in Cyberspace,'' WASHINGTON POST, 
February 10, 2015, that said ``We should not be creating more 
organizations and bureaucracy . . . we need to be forcing the existing 
organizations to become more effective--hold them accountable.'' 
Further, Stephen Cobb, a security researcher at ESET North America, 
told National Public Radio's Marketplace Tech that ``the only real 
difference between NCCIC and CTIIC is that NCCIC reports to the 
Department of Homeland Security, whereas the new agency answers to the 
Office of Director of National Intelligence,'' at http://
www.marketplace.org/topics/tech/two-cybersecurity-agencies-diverged-
wood.
---------------------------------------------------------------------------
   Why are you establishing this center at the ODNI, 
        particularly in light of your longstanding interest in 
        bolstering DHS as the interface for the private sector on 
        cybersecurity? What interactions will the new center have with 
        the private sector?
   Given that the CTIIC will be housed in the Intelligence 
        Community, please explain how it will relate to the National 
        Security Agency and the degree to which it will be involved in 
        the collection of intelligence?
   As you roll out this new center, how do you plan to ensure 
        that the private sector shares timely cyber threat information 
        with the statutorily-authorized NCCIC?
   To what degree does the effectiveness of the CTIIC depend on 
        enactment of information-sharing legislation? The protections 
        for personally identifiable information are well-established 
        with respect to private sector information sharing at the 
        NCCIC. What, if any, privacy protections would be required for 
        information sharing with the CTIIC?
    As partners in efforts to bolster the nation's cyber posture, we 
have a keen interest in ensuring efficiency and effectiveness of the 
Federal government's efforts and seek opportunities to minimize 
duplication and get the best results for our money.
    Thank you, in advance, for your timely response to our questions. 
Should you or other members of your team need to follow up on this 
request, please feel free to contact Hope Goins, Chief Counsel for 
Oversight (Committee on Homeland Security, Minority), Brett DeWitt, 
Senior Policy Advisor for Cybersecurity (Committee on Homeland 
Security, Majority), Matt Grote, Senior Professional Staff Member 
(Senate Homeland Security and Governmental Affairs Committee, Minority) 
or William McKenna, Chief Counsel for Homeland Security (Senate 
Homeland Security and Governmental Affairs Committee, Majority).
            Sincerely,
                                        Bennie G. Thompson,
                    Ranking Member, Committee on Homeland Security.
                                         Michael T. McCaul,
                          Chairman, Committee on Homeland Security.
                                          Thomas R. Carper,
Ranking Member, Homeland Security and Government Affairs Committee.
                                               Ron Johnson,
      Chairman, Homeland Security and Government Affairs Committee.

    Mr. Thompson. Thank you.
    Ms. Spaulding, I referenced the letter in my opening 
statements. I would hope that at some point we will have an 
answer back on that. Thank you very much.
    In 3 days, unless a miracle happens, we will be, as a 
Department, out of money. We have talked here about the cyber 
threat and what that means to this country, what keeps us up at 
night and all of that.
    Ms. Spaulding, can you enlighten the Members of this 
committee, if 3 days come and DHS is without money to go 
forward, what that would mean for our cyber defense here?
    Ms. Spaulding. Absolutely, Ranking Member Thompson. Thank 
you, and let me just reassure you that we are working 
diligently on the response to your letter, and it will arrive 
promptly. It is a priority of the Secretary's that we be prompt 
in our response to Congressional inquires. This is one we take 
particularly seriously. We will get back to you very quickly on 
that.
    With regard to the impact of a potential funding hiatus, I 
can say it will--as I said in my testimony, it will have an 
impact on our cyber mission. Let me give you a few examples. So 
we are in the process of deploying the latest iteration of our 
sensors in the dot.gov, in our civilian government networks and 
systems. That is our Einstein program. This is Einstein 3A, 
which is the technology that will help us not just detect, but 
block the intrusions coming in; and Einstein 2, which is the 
detection capability.
    These activities of rolling this out will have to stop in 
the event of a funding hiatus. I will say a week of stoppage we 
could probably make up. But with each week that continues, that 
is another couple of agencies that are not brought on-board and 
receiving the protection at a time when the adversary is not 
taking any break in their efforts to penetrate our civilian 
government systems.
    Our other dot.gov technologies is our continuous 
diagnostics and mitigation program, which looks inside that 
civilian government networks and systems to look at their 
health. That--deployment of that also will be delayed if we 
have a funding hiatus. That has an impact on our ability to 
quickly address--identify and address vulnerabilities like the 
JASBUG vulnerability that has been most recently in the media.
    With regard to our enhanced cybersecurity services program, 
where we make sensitive Government and Classified information 
available to cybersecurity providers to better protect private-
sector companies, the on-boarding of new providers will be 
delayed if we have a funding hiatus. So our ability to protect 
critical infrastructure owners and operators will be impacted.
    On the communications side, our ability to keep up with the 
next generation of communication technologies that the private 
sector is going full-speed-ahead to implement, our ability to 
continue to provide priority interoperable communication for 
National security and emergency response will be impacted, will 
be delayed. As I say, in the mean time, the private sector is 
rolling out that new technology. If we don't keep up, we will 
not be able to provide that prioritized interoperable 
communications that is so essential.
    Mr. Thompson. Well, thank you very much. A follow-up to 
that, all of us want to work with the business community. What 
constraints would a lack of money impact the Department's work 
in interfacing from a cyber standpoint with the business 
community?
    Ms. Spaulding. So the work we do on a daily basis to build 
those essential trusted relationships would be put on hold. All 
of that outreach, we are--have done a campaign across the 
country, for example, to educate critical infrastructure owners 
and operators about threats to their industrial control systems 
in cyber space. Critically important; you asked what keeps me 
awake at night, those are the kinds of things that do. Those 
activities would not be able to continue.
    The guidance from the President, the direction to the 
President to have--for the Department to set up the standards 
body to facilitate the establishment of these appropriate 
information-sharing mechanisms between private-sector entities, 
these information sharing and analysis organizations, our 
ability to issue that grant and get that going forward would be 
hampered by both a continuing resolution and certainly by a 
funding hiatus.
    Mr. Thompson. Thank you, Mr. Chairman. I yield back.
    Chairman McCaul. Let me just say for myself that I don't 
think we should be playing politics with the National Security 
Agency, given the high-threat environment that we are in today, 
both from a cybersecurity standpoint and also from al-Qaeda and 
ISIS, as well. I certainly hope that Congress can resolve this 
and avoid a shutdown of the Department.
    With that, the Chairman now recognizes Mr. Clawson.
    Mr. Clawson. Thank you for coming today and for your 
service. Thank you--both of y'all for holding this important 
session.
    So I imagine myself on the top of a large multi-national 
company. I have got employee--I have got stakeholders all over 
the world, a board of directors that is not all Americans. I 
have got an ERP system, maybe it is--could be Triton Bond, 
could be Oracle, could be--you know, could be SAP, could be 
anything. I have worked years to get it integrated around the 
world. Factories everywhere. I accept that cybersecurity is an 
important public good, and that if we don't have it, we are 
dead. I also accept that the liability insurance that you y'all 
talk about here protects one stakeholder, and that is the 
shareholder.
    But my world is much more complicated. I have data centers, 
regional data centers, all over the world, with customers and 
suppliers integrated in those data centers. Now as CEO, I am 
gonna go out and say look, y'all, in the name of cybersecurity 
for the world, but mainly for America, we are gonna start 
sharing data. You kind of have to trust us on what we are gonna 
share, when we are gonna share it. The devil will be in the 
details actually. We are gonna--you know, those specifics will 
be defined later. But don't worry, none of this data will get 
into the wrong hands; your privacy will not be violated, even 
though you grew up in the Czech Republic or Russia, where they 
were spied upon their whole lives, and the last thing they want 
is another big brother.
    It feels to me like y'all got a tough sale. It feels to me 
liability insurance or not, that my world is all about multiple 
stakeholders. It is not just about profit; big, bad 
corporations making more money. We are trying to protect our 
customers, our suppliers, the communities that we live in. What 
I have read so far about what y'all propose just doesn't feel 
like a very compelling case that I can take to my multi-
national board of directors.
    What am I missing, and what data can you give to make this 
more palatable? Because if you can't get me, I know what my 
friends back in the private sector are gonna say. It is not 
just about profit. Go ahead.
    Ms. Spaulding. No, Congressman, you have very well 
articulated the concerns that we hear when we are out talking 
to our partners in the private sector. You are absolutely 
right. There is a wide range of reasons that companies have--
legitimate reasons--for having concerns about sharing 
information with the Government.
    Mr. Clawson. It is not just lack--it is not lack of 
patriotism.
    Ms. Spaulding. Right. No, I totally agree. Throughout my 
career, interacting with CEOs of companies, I find them to be 
an extremely patriotic bunch. So I absolutely agree.
    I will say, with respect to this legislative proposal and 
the sharing of cyber threat indicator information, you are 
correct, the devil is in the details. The good news is that as 
we move to automated information sharing, those details will be 
apparent. There will be total transparency about the specific 
kinds of information that we are seeking and receiving.
    Because we are creating a structured way of presenting that 
information that will detail very specifically the kind of 
information that we want to get. We will also work through the 
policy and protocols for protecting that sensitive information, 
both in terms of proprietary information and privacy 
information. So those things will be transparent.
    Mr. Clawson. Can you imagine if, in one of the countries 
that I operate in, the government of that country telling me 
that I had to share this same sort of information? How would we 
respond?
    Ms. Spaulding. Again, I--think the--limiting this to cyber 
threat indicator information, which is fairly technical 
information about the IP addresses that are sending malware, 
for example, to disrupt equipment, this is the kind of 
information that is less sensitive. Each company will make its 
own decisions. I think you are right.
    One of the things we have tried to be clear about, this is 
not a silver bullet, this is not a panacea, this is not gonna 
make every company open its doors. But it does address concerns 
that we have heard from the private sector. There will be a 
fair amount of detail about precisely what we are talking about 
sharing here. The legislation defines it fairly----
    Mr. Clawson. I think that without that detail, any private-
sector CEO would be negligent to go along on the basis of 
trust.
    Chairman McCaul. Dr. Schneck, would you like to answer 
that?
    Ms. Schneck. Yes, very briefly. So I was in a very large 
company about 18 months ago. I hear you. I lived that. I was 
not at the level you describe. But I was a key technology 
officer for the global government. I was the one that shared 
information or didn't. I was the subject of a storied phone 
call from a former FBI executive and executive assistant 
director, three down from the top, who I consider a very close 
friend, who yelled at me at 11:00 at night on my home phone 
because he found out something he didn't know, and I couldn't 
share it with him.
    We are going to have to earn your trust. This sharing is 
not required. It is my scientific belief that there will be 
benefits in getting our data. You don't have to give anything 
at first to get it. I think what the under secretary points out 
is very important, it is key. These are just scientific 
indicators. But you--the companies will see that. We will work 
to earn your trust. It is voluntary.
    Mr. Clawson. I am nonpartisan on this issue. Anything I can 
do to help you, you know, with my background, I urge you to 
seek me out. I am always worried about people on the telephone. 
I am even more worried about people in my ERP system. So with 
that as a starting point, y'all--you know, use--anything I can 
do to help, I am here.
    Ms. Spaulding. Thank you very much, Congressman. We will 
definitely take you up on that. Thank you.
    Chairman McCaul. If the gentleman would yield, we do have a 
field trip, if you will, to the NCCIC facility. I would 
encourage you to attend that. I think it is important to note 
also this is not a mandatory sharing system. It is voluntary. 
This authorization that we authorized the Department's cyber 
operations last Congress had the support of industry, the 
chamber, the privacy groups.
    All I think in moving forward what we want to do is provide 
liability protection so that they can fully participate. 
Because I think there is a reluctance, as you point out. 
Because you have a duty to the shareholders to not want to 
participate until you have that assurance that you wouldn't 
open yourself up to a lawsuit. So I look forward to you--you 
obviously have tremendous experience on this issue. I look 
forward to working with you on this.
    Chairman recognizes the gentlelady from Texas, Ms. Jackson 
Lee.
    Ms. Jackson Lee. Mr. Chairman, thank you very much. I might 
say to my good friend, Mr. Clawson, with his experience but 
also his demeanor. I truly believe that we have common ground 
on these very important issues.
    I gave an old story that I hope will be very brief. I 
indicated that when I chaired the transportation security 
committee, we had included infrastructure, which was then 
cybersecurity. The point was that it was all embracing an 
infrastructure that we had not yet hit, if you will, the 
epicenter of fear and epicenter of hacking. But we did look at 
the infrastructures that are governed by cybersecurity and 
realized that we were vulnerable.
    So I want to thank all of you for bringing us up into the 
21st Century as it relates to home homeland security and this 
very crucial issue. I want to add my appreciation for those of 
you who have come from the private sector for serving your 
Nation.
    Let me acknowledge the Secretary in his absence and thank 
him for being, as he has indicated, everywhere and all over on 
the basis of National security.
    I want to thank the Chairman of this full committee. I hope 
that his efforts will be heard in his Republican conference 
that we should be dealing with National security and not 
political security. Clearly, on the issue of where we are in 
this time and date and what we are facing, I can't imagine a 
more important component. There are many important components 
at DHS. But certainly, what we are discussing today has far-
reaching impact.
    So I want to just take the words that were presented when 
the President offered his thoughts on January 13 and he said 
when public and private networks are facing an unprecedented 
threat from rogue hackers, as well as organized crime and even 
state actors, the President is, of course, unveiling the next 
steps in his plan to defend the Nation.
    At that time, then he unveiled the White House proposal. 
That is, of course, the Cyber Threat Intelligence Integration 
Center. Many of you know that we have worked so hard on the 
efforts to have the National Cybersecurity and Communications 
Integration Center.
    So my questions are going to be--I know we had some earlier 
discussions--the pointed synergism, if you will, of those two 
entities and the concern about confusion between the broader 
public. My interpretation--I have some privacy questions--is 
that the CTIIC will be not gathering, but analyzing; will be 
the high-level threat entity. My concern is, will that 
information of their analysis be accessible to DHS, Members of 
the respective homeland security committees? Because it looks 
as if there is an attempt to put a wall between the very agency 
that then has to act on trying to save the Nation.
    Then, of course, the NCCIC will be the face to the private 
sector. We will have to engender their trust. They will have to 
know well, this is an agency that can help me, or do I need to 
try to bang down the doors of the CTIIC, even though that is 
not the intent?
    So let me just end right there so that I can ask you, Madam 
Secretary Spaulding, our Ranking Member gave you the 
opportunity for a long litany. Let me for the record speak to 
this defunding or no funding of Department of Homeland Security 
in the backdrop of--let me try not to use the word ``crisis''--
but the increasing threats that are viable through hacking, 
through other efforts as it relates to security.
    Does this put us, the Department of Homeland Security and 
the security of this Nation, in a position of jeopardy if all 
of the functions in your area are either halted, stalled, 
people laid off because of the actual moment in history that we 
are in? Are we at a serious moment in history that you need all 
hands on deck?
    Ms. Spaulding. Congresswoman, I think that is an accurate 
statement. I mean, we are--as this committee knows as well as 
anyone, we are, as I said, under daily moment-by-moment efforts 
by adversaries to penetrate our networks and systems across the 
Federal Government, State, local, territorial, Tribal 
government systems, and the private sector.
    There is no pausing, no slowing down, in that range of 
actors' efforts to penetrate our systems and to do us harm. So 
anything that hampers, we are running on a daily basis full 
speed ahead to try to keep ahead of those--efforts of those 
adversaries. Anything that hampers and slows us down creates 
risk for us and for the Nation.
    Ms. Jackson Lee. If I could get these last two questions 
in, I would greatly appreciate it.
    I started out by offering my assessment of the CTIC--CTIIC 
and the NCCIC. So if I could get the question answered as to 
how the public is to decipher between these entities. Then I 
want to add a question of my colleague here on privacy.
    Will the information shared that is going to be shared with 
the Government identify the identity of law-abiding citizens? 
Will it be the responsibility of the company--companies--for 
removing personal information for what is shared with DHS?
    So first, how are they gonna interface with these two 
entities? I am concerned about the confusion. Then the privacy 
question.
    Ms. Spaulding. Great. I very much appreciate the question. 
We welcome the establishment of the Cyber Threat Intelligence 
Integration Center. Those two ``I''s are actually important to 
help make this distinction. Because what the CTIIC will do for 
us is to pull together intelligence information from across the 
16 different entities that make up that intelligence community 
over which the DNI, the Director of National Intelligence, has 
purview.
    So that is a very useful function for us. Part of their 
articulated, explicit mission is to support the NCCIC, our 
operations in watch center, and the other centers across 
Government; the FBI's NCIJTF and the other centers out there 
across Government. They are--in military terms, they are 
supporting command and we are the supported demand. So they 
will provide that integrated analysis for us, which will be 
very useful.
    They also will be one place where we can go to work with 
the intelligence community to get information cleared for wide 
dissemination. So whether that is continuing to press 
intelligence agencies to write or release, to create products 
from the very beginning that can be widely disseminated or to 
go back to them to get things declassified that we think are 
important to disseminate widely. Instead of having to go to 16 
different entities, we can go to this one place who will be an 
advocate for us, because that is their mission in making sure 
we can disseminate this information.
    Those two key functions will be really helpful for us. It 
is a very distinct mission from our mission, which is to 
interact with the private sector. That is not the mission of 
the CTIIC. Our mission is to interact on a daily basis with our 
partners across the Federal Government and the private sector 
and to receive information from them; and most importantly, to 
get information out as broadly as we the can so that those who 
are trying to defend their networks can do so effectively.
    I will ask the deputy to address the privacy issue if----
    Mr. Clawson [presiding]. Quickly, if that is okay.
    Ms. Schneck. I will make it very quick, sir.
    The privacy issue cuts to the core of why we do what we do 
and why I came here to the Department to serve in Government. 
The story I shared about the call from the FBI, this is one of 
the finest investigators on the planet. I wanted to answer him. 
I couldn't. If we had a system like this in place that night, I 
could have. My lawyer would have given us the ability to share 
just the indicators. So what we are building----
    Mr. Clawson. That I understand.
    Ms. Schneck. So what we are building is with a team, 
working every day with the FBI, their assistant director of 
cyber. He called me last night just to make sure we were in the 
loop on things. This is the kind of relationship that we have. 
He called me on my cell phone a couple of weeks ago. We have--
--
    Ms. Jackson Lee. Are you answering--I am sorry. I don't 
want to interrupt. But are you answering my question, which is 
will the information----
    Ms. Schneck. Yes.
    Ms. Jackson Lee [continuing]. Shared identify--because I 
want to--abide by the Chairman----
    Ms. Schneck. No. Working with----
    Ms. Jackson Lee [continuing]. Identify law-abiding citizens 
and is the companies have the responsibility of removing the 
personal data?
    Ms. Schneck. The companies have a responsibility to make a 
good-faith effort. This is a policy puzzle that which is being 
solved each day by working together with each different equity 
with the private sector, with law enforcement, with the 
intelligence community. We are doing our best to get everybody 
to design that.
    Ms. Jackson Lee. Mr. Chairman, I am just gonna say this for 
the record and then yield back.
    You all issued $25 million in cybersecurity education 
grants. I noticed that States to the west of the Mississippi, 
including Texas, have not been included. I would like to meet 
with whoever is appropriate to talk about these important 
grants. Because we need a vast array of representation. So 
would someone let me know who I should be meeting with?
    Ms. Spaulding. Absolutely, Congresswoman. That was 
announced by the Department of Energy for historically black 
colleges and universities. We will absolutely make sure that 
you get a full briefing on that and hear your thoughts.
    Ms. Jackson Lee. I thank the gentleman for his courtesy. 
Thank you. I yield back.
    Mr. Clawson. The Chairman recognizes the gentleman from 
Texas, Mr. Hurd.
    Mr. Hurd. I would like to also thank y'all for being here. 
This is an important topic. I know a little something about it. 
I spent 9 years as an undercover officer in the CIA. My job was 
collecting intelligence on threats to the homeland. But I also 
did some offensive cyber operations and I recognize the 
dangerous threat that is out there. Helped start a 
cybersecurity company, as well. I have been doing that for the 
last 5 years. It is pretty scary, the folks that y'all have to 
help defend against. So it is a difficult job. But I appreciate 
you all being here.
    My question is, you know, when you look at Border Patrol 
and ICE, they have difficulty sharing information amongst each 
other. A lot of it is structural issues; right? You know, it 
is--and then you talk about, you know, having DHS sharing with 
FBI or CIA or NSA. Even more difficult. Then also trying to do 
it with the private sector. I know this is one of the areas 
that these new entities have been created to do.
    My question is, you know, in an attack of the magnitude 
that we are starting to see, one of the most important things 
that you need is you need timely information. What is the 
system--how are y'all trying to design this so that the 
information is timely?
    Ms. Schneck. So as information comes in, it will go through 
a process that is automatic. So that is fractions of a second 
for a machine. Indicators will be available through those 
standard protocols that every machine can read and every 
machine can send. So right now, we are depending our real-time 
sharing on people to all be in the room to get it at once to 
create a report and to fan it out. Now you will have machines 
do it at their speed, which is the speed of the adversary.
    This already works in pockets in the private sector, 
protecting against bot-nets. A few tens of thousands of 
machines light up with bad behavior, and the rest of the world 
can block against them. We will do that for extended threats, 
as well as the ability to combine what we see of protecting the 
Government, combining it with what we see which may be 
partnered or bought from private sector, and creating a large 
set of data that can be provided to all.
    Mr. Hurd. So how do you plan on sharing tactics, 
techniques, and procedures that the bad guys are using; right? 
It is one thing to have an IP address or a piece of digital 
code that you can share, that you can share quickly. But some 
of the--you know, they are looking at certain, you know, ports 
or the style of the attack. How is that gonna be shared with 
the broader community?
    Ms. Schneck. I think two ways. One is, that is currently 
shared today across the agencies and with the private sector 
through trusted relationships. The other way is as we see those 
indicators coming in, we build patterns that can be combined. 
Again, this is where the CTIIC can help, as well. That can be 
combined with the intelligence they would give us and creating 
an even broader picture for then people to disseminate that 
context.
    Mr. Hurd. Thank you. Thank you for that. The other area is, 
you know, the stuff that you are talking about, obviously, the 
level of classification of the data, you know, is not going to 
be a problem because you are sharing it, you know, with folks. 
But how do we address the classification of threat information 
that is gathered by, you know, elements throughout the entire 
Federal Government to push that down to the private sector?
    Ms. Spaulding. So this is also an issue that we deal with 
on a regular basis currently. We have a couple of ways we 
address this. One is, as I mentioned, the enhanced 
cybersecurity services program that we are implementing and 
have implemented, where we work with managed security providers 
to build systems that can take Classified information and, 
while protecting sources and methods, use that information to 
provide enhanced cybersecurity solutions to their customers.
    So this is a way for us to use Classified information, to 
protect private-sector entities, without having to clear all of 
those private-sector entities to receive the information. So 
that is one way.
    The other thing that we do is we do interact on a very 
regular basis with the help of our intelligence and analysis 
I&A directorate, headed by General Frank Taylor, with the 
intelligence community to help them understand what is the 
information that we need to get out more broadly and what is 
the information we don't need to share that might implicate 
sources and methods.
    That granularity we are able to achieve because we bring in 
cleared private-sector folks who look at the intelligence and 
say as a network defender, this is the piece I need. I don't 
need to know where it came from. I don't need to know all of 
these other things that are very sensitive. But this bit I 
need. Then we can go back to the intelligence community and say 
this is the piece we really need to get out to folks.
    That equities review process is actually working fairly 
well. We have shortened the amount of time that it takes to run 
through that process significantly. We also have ways of, 
again, working to mask sources and methods and be able to 
disseminate that information.
    So these are issues we are working through, but would love 
to sit down and talk with you. You might have some additional 
insights and ideas for us to continue to push that boundary.
    Mr. Hurd. Thank you. I yield back.
    Chairman McCaul [presiding]. Thank you, Mr. Hurd.
    The Chairman now recognizes my fellow co-chair of the 
cybersecurity caucus, Mr. Langevin.
    Mr. Langevin. Thank you, Mr. Chairman. I thank you, Mr. 
Chairman, and Ranking Member Thompson for the attention and 
support you have been giving to this topic for many years. In 
many ways, you and I were pioneers on this--in the Congress on 
the challenges we face in cyber space.
    I want to thank our panelists for their testimony today, 
for the work you are doing on this issue. I applaud your work 
and the Department's work, and especially the President's 
leadership on trying to better protect the Nation's cyber 
space, close the glaring vulnerabilities that we face.
    Of the range of things that we could do in this area and 
clearly, we face significant challenges, I have often said that 
this is never a problem, unfortunately, that we are going to 
solve. It is a problem to be managed. Right now, the aperture 
vulnerability is wide open. What we need to do is shrink this 
down to something that is much more manageable.
    I have often said that the single most important thing we 
can do in closing that aperture vulnerability is information 
sharing. Right now in many ways we are fighting this battle 
with both hands tied behind our back. If we can inform, the 
Government can share the information that it has with private 
sector more easily and private sector can share the threat and 
the hacks that they are experiencing, we can disseminate that, 
we are going to be light years ahead of where we are right now.
    So with that point--and maybe, Dr. Fischer, I will start 
with you. Information sharing is in many ways, it is a means to 
an end. It is undoubtedly an important means. However, as has 
been demonstrated, even at DHS, for example, during Heartbleed, 
perfect information is useless without appropriate processes, 
protocols, and people to act on it.
    So based on your scholarship, can you give a base 
assessment of the proportion of cyber incidents that only 
suceeded because information about a known threat was not 
disseminated? How substantial an impact do you foresee cyber 
information sharing legislation, such as the President's 
proposal, having on the overall state of cybersecurity?
    Mr. Fischer. Well, Congressman, I would have to get back to 
you on the specifics with respect to what there might be--what 
the proportion of attacks that have been, say, prevented 
specifically with respect to--because of cybersecurity 
information sharing.
    The question, though, with respect to--I mean, part of the 
problem here is that there are--information sharing, as a 
number of people have said, is no silver bullet. It is an 
important tool for protecting systems and their contents. As 
long as organizations are not implementing even basic cyber 
hygiene, there are going to be some significant difficulties.
    So companies--there are demonstrated cases of companies 
that have had the information which--but nevertheless, did not 
pay sufficient attention to it. They have had information they 
could have used to prevent an attack.
    If a company is not prepared to implement sort of threat 
assessments that they receive, then that is going to be a 
problem. A recent study by Hewlett Packard I think indicated 
like 45 percent of companies do not actually have sufficient 
basic cyber hygiene. So those sorts of companies are not going 
to be able to actually implement information sharing 
effectively. So--and what was the second part of your question, 
sir?
    Mr. Langevin. I wanted to know the substantial impact that 
you perceive that information-sharing legislation would have on 
the--such as the President's bill would have on the overall 
state of cybersecurity.
    Mr. Fischer. Right. That is something--there is a 
fundamental sort of issue about the effectiveness of 
information sharing. It is very difficult to measure--and there 
have been attempts by a number of folks. I saw a recent study 
by the Rand Corporation, for example, to try to analyze what 
the effectiveness of information sharing is.
    So you start out with a baseline. So the question is well, 
what is the current baseline for information sharing? How much 
would actually improving information sharing improve 
cybersecurity? There are plenty of examples, specific examples. 
It is very--I think one could make a fairly compelling case on 
principle as to why improving information sharing is important.
    But to really be able to determine its actual effectiveness 
will require, I think, additional information and study, and 
perhaps some information that is not readily available now. So 
I am sorry I can't give you a--you know, a definite answer to 
it. But it is an important challenge, and one I think that a 
number of people are thinking about.
    Mr. Langevin. Well, my time is expired. But I will have 
additional questions for our witnesses. I just want to thank 
you for the expertise you bring to the table, the work you are 
doing in this, and I look forward to supporting you in your 
efforts.
    Thank you, Mr. Chairman.
    Chairman McCaul. Thank you. Thank you for your strong 
interest and leadership on this issue.
    The Chairman now recognizes the gentleman from Georgia, Mr. 
Carter.
    Mr. Carter. Thank you, Mr. Chairman. Thank you to each of 
you for being here.
    This is obviously something that is very needed. I want to 
speak about small businesses, in particular. I am a small 
business owner, or I was. My wife is now. But, you know, I have 
three independent retail pharmacies, have 19 employees. This is 
important. This is important to my business, just as it is 
important to a big corporation. But it is tough. It is tough 
for us to adhere to some of the procedures, some of the 
policies that we are gonna be forced to adhere to. Do you take 
that into account at all?
    Ms. Spaulding. We absolutely pay, as the deputy said, 
particular attention to small and medium-sized businesses. So 
the first thing that I want to point out is that even with this 
information-sharing legislation, it is all voluntary. So there 
are no new requirements being imposed on businesses of any size 
pursuant to this legislative proposal.
    But that said, even a company that wants to voluntarily 
participate in this may be challenged by a lack of resources 
and the ability to bring on the human resources.
    So we do look at how can we facilitate better cyber hygiene 
by small and medium-size businesses. Because they make up the 
important part of that cyber ecosystem in which our critical 
infrastructure swims. We all swim in the same ocean. As we saw 
in the Target breach, those small companies can be an opening 
for an adversary.
    So I will let the deputy address a request for proposals 
for information that we put out to the cybersecurity solution 
providers to say, what ideas can you give us from your 
innovation in the private sector to specifically address the 
needs of small and medium-size businesses? Because we 
understand that is a real challenge, but it is critically 
important.
    Mr. Carter. Well, and thank you for recognizing that.
    Ms. Schneck. So as I mentioned earlier, it is the small 
businesses and State and locals that also keep me at night. Two 
initial things I did when I came here. First is we put money to 
protect the State and local governments and gave them 
management security services that we paid for. We couldn't do 
that for small businesses.
    So what we did was put out a request for information, which 
is basically asking all the companies to please tell us how 
would you use your innovation and use your desire for revenue, 
use the market to drive better, faster, safer, cheaper 
solutions that can enable, whether you are a small business 
that makes the solution, makes money off it, or whether you are 
one that gets the protection from it.
    The other piece I want to make very, very clear is in all 
this technical talk, the main thing is that as we as a 
Government are able to put together this indicator information, 
that is available for you. You don't have to give us anything. 
So you will inevitably, as any business, buy a few widgets to 
protect yourself. Whatever those widgets are in our vision--and 
I don't mean in 5 years, I mean hopefully in 1, if not sooner--
will be able to start to talk to our big database and get what 
we have. We are not asking you to necessarily deliberately 
share things. So we are trying to just make it available to you 
because we recognize that.
    Mr. Carter. Well, good. Thank you for that. But let me ask 
you, thus far have you had a good participation rate from small 
and medium-sized businesses?
    Ms. Schneck. I have a binder literally that thick full of 
responses to that proposal and requests for information that 
could lead to a request for a proposal. The team is looking at 
how we act on that. It will go into a larger strategy in the 
name of efficiency in cybersecurity really across DHS with all 
the components, the two pieces of cyber.
    But our State and local and Tribal territorial is--and our 
small-to-medium business work--is huge to us. This is homeland 
security, not big business security. It is everybody.
    Mr. Carter. Right. Right. Well, let me ask you this: 
Specifically to health care, do you see any specific threats in 
that? I mean, you know, we have insurance information. We have 
Social Security numbers, birth dates. I mean, we have 
everything that is essential that would use in a patient's 
information. What are the real threats there?
    Ms. Schneck. So I think that any time you have a computer 
that is connected to the internet, somebody can see whatever it 
stores. So the adversaries are looking for whatever the motive 
that was mentioned earlier, they can get that information. So 
what you have to do, no matter what the information, is find 
the best way to secure those assets. We will work with you on 
that. We have people in each of the areas that can work with 
you on that and partnerships with the U.S. Chamber of Commerce 
to get this message out.
    Ms. Spaulding. We are absolutely seeing activity in the 
health care arena. Some of which appears to be for financial 
gain. It is a target-rich environment with very rich 
information; beyond just Social Security numbers or credit card 
numbers, for example; but information that can perpetrate other 
criminal schemes, such as Medicare fraud. So----
    Mr. Carter. Exactly.
    Ms. Spaulding. Right? So we are watching that very 
carefully. The FBI and others in law enforcement are looking at 
this.
    Mr. Carter. Well, great. Thank you very much for what you 
are doing. We appreciate this.
    Mr. Speaker, I yield back.
    Chairman McCaul. Appreciate the promotion in my title. But 
I am not sure I would want to be Speaker right now, to be 
honest.
    The Chairman now recognizes Mrs. Watson Coleman.
    Mrs. Watson Coleman. Thank you, Mr. Chairman. Thank you for 
the generosity you demonstrated with the information sharing 
that we have been doing here today.
    First of all, let me just acknowledge the fact that this 
has been an incredible experience for me, information that you 
have given me today. I am really very, very proud that there 
are two women at this helm. I get to say that without possibly 
being a discrimination complaint, being a woman. But it is 
unusual, and it is an illustration that women should really be 
in these areas much more. You all are fantastic. So are you, 
Mr. Fischer. You are fantastic too.
    But even so, I have so many questions I just don't even 
know where to begin.
    First of all, let me ask this. There is the--this CTIIC, 
which is being proposed. There is the NCCIC, which exists. 
Thank you so--oh, NCCIC. Sure enough is. CTIIC and NCCIC.
    So what is the guarantee that the new proposal, this CTIIC, 
doesn't wander out there and become the face of the interaction 
with businesses and companies and stuff and basically infringes 
upon the NCCIC?
    Ms. Spaulding. Congresswoman, first of all, let me echo 
your plug for encouragement for more women to get into STEM 
fields. I think it is critically important. So thank you for 
that.
    With regard to the CTIIC and the NCCIC, the CTIIC is very 
clearly defined in the President's roll-out of this, which I 
believe occurred this morning, just a couple of hours ago. As a 
place for integrating the intelligence information, it is 
really to help Government. It is a Government-to-Government. To 
help the centers that exist already, including the NCCIC, to 
have a common operating picture and all sorts of intelligence 
analysis that we can provide to the private sector.
    Again, we will also be taking in information from the 
private sector and with appropriate safeguards for privacy and 
civil liberty, sharing that with both the intelligence 
community and law enforcement as appropriate to help enrich the 
common picture that we all have.
    So it--its responsibilities and its role are pretty clearly 
defined, and I think very distinct from the role of the NCCIC 
which, again, has been defined both by this committee and again 
in the President's legislative proposal as the central place 
for interacting with the private sector with regard to 
indicator information.
    Mrs. Watson Coleman. Should we not come up with the 
funding, should there not be a funding solution on the 27th of 
February? Will the two of you be working on the 28th?
    Ms. Spaulding. We will, Congresswoman. We will be working 
without a paycheck. But we are under the statutory definition. 
But I will tell you in my organization, the National Protection 
Programs Directorate, which is responsible for critical 
infrastructure security and resilience, we will be down to 57 
percent of our workforce.
    Mrs. Watson Coleman. Are you at full force right now?
    Ms. Spaulding. Right now we are at full force. But of our a 
little over 3,000 employees, if there is a funding hiatus, we 
will be down to 1,748. So it will be, again, 57 percent. I want 
to point out that those numbers include--most of those numbers 
are the Federal Protective Service, which engages on a daily 
basis in the critical mission of protecting Federal facilities, 
and our office of biometrics and identity management, which 
uses biometrics to particularly keep known and suspected 
terrorists out of the country.
    Mrs. Watson Coleman. That is pretty scary.
    Ms. Spaulding. Two critical important missions, they will 
be on the job. But the rest of my workforce that worries about 
critical infrastructure in the private sector, cyber, will be 
down to about 9 percent--normal strength----
    Mrs. Watson Coleman. So I have two quick questions, because 
that is pretty scary. I need to know the difference between 
ISAOs and ISACs.
    Ms. Spaulding. Yes.
    Mrs. Watson Coleman. My other questions is to Mr. Fischer 
real fast. What is it that this new proposal that the White 
House has put out, what does it address that is deficient in 
what exists now? Did we need to do this in an entirely new 
legislative approach, or could there have been some tweaking to 
what already existed? Thank you.
    Ms. Spaulding. So I should point out under the--in a 
funding hiatus, our--again, we are gonna make sure that we have 
in place everything we need to have in place to protect lives 
and property on a daily basis. So our NCCIC will continue to 
function. But the analytic support that feeds that and helps 
prioritize those activities will be hampered, and the roll-out 
of the things that I mentioned earlier will be hampered.
    The ISAC, ISAO--ISACs information and analysis centers are 
a kind of information sharing and analysis organization. So 
they are a subset, ISACs share a subset of ISAOs. What the 
administration's Executive Order hopes to do is to encourage 
additional coming together of private-sector entities to share 
information.
    Mrs. Watson Coleman. Thank you. Mr. Fischer.
    Mr. Fischer. So what the--there are, I should preface by 
saying that there are some observers who would argue that, in 
fact, new legislation is not really necessary; that current 
mechanisms are sufficient. But there are plenty of people who 
actually think the opposite, as well.
    With respect to what the new legislation would do, the 
White House proposal, it would create some mechanisms, 
including the establishment of these ISAOs for the receiving 
and sharing of information that don't really exist now, or that 
exists in another form; like, for example, the ISACs exist now 
but they are--the ISAOs are somewhat different from that. It 
specifically designates the NCCIC as a particular role with 
respect to receiving and sharing this kind of information.
    It also would provide certain--it tries to remove these 
barriers that have been mentioned that private-sector 
organizations may have for sharing information and make sure 
to--and provide protections for things like privacy and----
    Mrs. Watson Coleman. So you said, I believe, that there is 
both the issue of barriers, and there is the issue of 
incentives; incentives perhaps doing something, eliminating or 
minimizing some of the barriers. So is the incentive just 
simply the value of the sharing of the information, or is there 
some other kind of incentive that needs to use to encourage 
these businesses to engage in this?
    Mr. Fischer. Right. So, I mean, one of the questions is 
what would the--why would a company want to share information? 
One way, of course, to encourage them to share information is 
to reduce the risks to them of sharing that information. But at 
the same time, what are they going to get out of sharing it? 
Are they doing it as simply a--something that they think is for 
the public good, or are they gonna get something back?
    So one of the ways that they might get something back is 
through reciprocity. So, for example, if they are a member of 
an ISAC or perhaps an ISAO, they may have some relationship 
with that organization that ensures that if they provide 
information, they will be able to get information.
    But of course, with respect to the Federal Government, 
there have been enough concerns about, you know, forcing 
organizations to give information to the Federal Government 
that, in fact, all of the legislative proposals say that they 
are voluntary.
    Mrs. Watson Coleman. Thank you, Mr. Chairman. I yield back.
    Chairman McCaul. The Chairman now recognizes the Chairman 
of the Subcommittee on Cybersecurity, Infrastructure 
Protection, and Security Technologies, Mr. Ratcliffe.
    Mr. Ratcliffe. Thank you, Mr. Chairman.
    Ms. Spaulding, I would like to start with you. The 
administration's proposal discusses how Federal agencies--and I 
will quote--``through an open and competitive process will 
choose a private entity to identify and develop a common set of 
best practices for the creation and operation of private 
information sharing and analysis organizations.''
    The NIST, the National Institute of Standards and 
Technology led a collaborative process last year to develop the 
cybersecurity framework. Why isn't this NIST framework, why 
isn't it being utilized in the process here?
    Ms. Spaulding. Congressman, I think it will be utilized in 
the process here. What the NIST framework does is provide a 
framework, a way for companies to think about their 
cybersecurity and how to achieve better cybersecurity. So it 
breaks it down into five key functions; identify, identify the 
assets you want to protect and the risks that it faces, ways to 
protect, ways to detect, ways to respond, and ways to recover. 
It pulled together from the private sector their best practices 
in each of those categories. So that is the cybersecurity 
framework.
    What this standards organization will do is to look at what 
are the best practices for these ISAOs. Of the ISACs, of the 
ISAOs, of the information-sharing organizations that are out 
there today, which are the best ones, what are the best 
practices that we see out there? Let's pull that together as a 
guideline for private-sector groups that want to come together 
to say here are some of the best practices in terms of ways in 
which they are protecting the information that has been given--
that is being shared in there. So that I know that if I give it 
to you, you are only going to share it within this ISAC, for 
example. Or ways in which you are going to protect privacy 
information, et cetera; ways in which you are gonna get it out 
quickly to me, get back to me, so that I get information for 
information I give in. How do I know I am going to get 
something good back from it?
    So it is a different set of best practices. But the process 
for developing that will be very similar to the one NIST used. 
This third-party standards organization, will be canvassing the 
private sector, the existing public and private-sector sharing 
organizations to say to them tell us what you think are the 
best practices. Very collaborative is what we envision.
    Mr. Ratcliffe. Sure. So I want to talk a little bit about 
this--a single portal for information sharing. As a former 
terrorism prosecutor after 9/11, while we would have liked the 
information to come through one single avenue, what was more 
important was that people would share information. So whether 
it was with the FBI or whether it was with Secret Service, we 
encouraged information sharing.
    So I am wondering if you can expound on the process here, 
the thought process behind there just being one single portal 
for sharing information.
    Ms. Spaulding. Yes, absolutely. We totally agree. The 
highest priority is on information sharing. Again, that is such 
a high priority, that even if it is only sharing between 
private-sector companies and they don't share with the 
Government, we think that is worth promoting, because sharing 
of information is gonna significantly advance the ball here.
    But with respect to sharing with the Government, again, we 
want to make sure that existing relationships are not disrupted 
here. So companies that have relationships with the FBI, with 
Treasury, with other parts of the Government and are 
comfortable picking up the phone and calling them, they should 
continue to reach out and say we think we see something, you 
know, that looks a little strange on our system; we think we 
may have some intrusion activity here. That kind of information 
sharing across Government we hope will continue to take place.
    What we are trying to do--and even sharing of cyber threat 
indicators can be shared--you know, we are not saying you can't 
share it with other departments and agencies.
    We are creating a newly-incentivized program. If we are 
doing that, we want to use that to help us create a common 
operating picture. So rather than have that information coming 
in in a distributed, dispersed way all across the Government 
and hope that it comes together somewhere at some point, 
sometime, we want to say we would really like to incentivize 
you to bring it in to this one place, and we will take 
responsibility for making sure that it gets to the people who 
need it very quickly.
    But this way, we are--greater confidence, both that we have 
a common operating picture and that privacy protections are 
clearly in place.
    Mr. Ratcliffe. Terrific. Thank you, Ms. Spaulding.
    Very quickly, Dr. Schneck, I wanted to give you an 
opportunity. Ms. Spaulding and Dr. Fischer were able to expand 
on Congresswoman Watson Coleman's question about privacy.
    Just very quickly, I want to give you an opportunity. Can 
you explain the processes in which NCCIC protects privacy and 
explain that relationship with DHS privacy office?
    Ms. Schneck. So thank you. Very quickly, DHS has one of the 
first statutory privacy officers. We work not only with the 
front office at that level, but the under secretary has for our 
directorate her own privacy officer that reports up. Every 
program that we have engages them. When I came in I actually 
asked--because I write code. Or I used to--the people that 
write code, I asked them; are you getting rid of the extra 
memory so that there isn't--because this is one of the famous 
ways that attackers attack--so that there isn't a gap that we 
didn't know about that is actually storing information that we 
didn't know about.
    Every step of the way in how we build our programs, we work 
with those teams on privacy. We also do impact assessments, 
which means a document is published on our website. What we do, 
what we collect, what we are doing with it, and why we do it. 
As we grow these capabilities, that is an ingrained philosophy 
in who we do at DHS.
    There has never been a harder time to want companies, as we 
heard before and it is true, to share with Government. There 
has also never been a more urgent time to put the indicators 
together to respond to an adversary that candidly has an 
infinite appropriation and does whatever they want.
    We need to make sure that we have our defensive 
capabilities as strong as they are. That means putting this 
data together. It is speed and privacy and the balance therein. 
It takes all hands on deck, everybody to work this. Part of the 
reason it is taking us more than just a few months to build 
this capability is because we have to build it with the right 
privacy, the right policy, and the right equities to make it 
light speed and get it right. Does that answer your question?
    Mr. Ratcliffe. It does. Thank you. I am out of time. But I 
do want to thank you all of you for being here and for better 
informing the committee Members so that we can hopefully move 
forward with cyber legislation in this Congress. I yield back.
    Chairman McCaul. Thank the gentleman. Excuse me.
    The Chairman now recognizes Mrs. Torres.
    Mrs. Torres. Thank you, Mr. Chairman. and I also want to 
join my colleagues in thanking the panel--or the witnesses for 
being here. Most of all, for spending an entire hour with some 
of us, ensuring that we understand and that we somehow feel at 
peace that you are collecting data that is absolutely 
necessary, but actually being very cautious at ensuring that 
individual privacy rights are being abided by.
    We have also heard a lot from the perspective of corporate 
America. But what I haven't heard yet coming from you is how 
you plan to communicate everything that you are doing with the 
general public. So someone like myself at home, where my 
computer gets hacked and my IP address gets duplicated 15 
times, how is my information as an individual victim or 
survivor of a hack attack in my personal network, how are you 
going to protect me from sharing my personal information with 
anyone else?
    I haven't heard it from a perspective that I think the 
general public can relate to. We have been speaking at this 
level, and we haven't really simplified it in a way that my 
constituents could be comfortable with what we are doing here.
    So could you explain a little bit as to--in the private 
session, you know, we heard specific information of what would 
be pulled. Can you speak to that here?
    Ms. Spaulding. Congresswoman, thank you for the question. 
As I hear it, it involves at least two aspects. One is as a 
private citizen, what does this mean to me; right? How is what 
you have just been describing here for the last couple of hours 
relevant to protecting my identity information----
    Mrs. Torres. Right.
    Ms. Spaulding [continuing]. For example, my PII?
    What I would say to that is that by protecting the networks 
and systems that hold your information, we are protecting you--
and your--against identity theft, for example. One of the 
pieces of legislation that the administration proposed--we have 
talked about their information-sharing legislation, but they 
also proposed breach notification legislation. That is very 
much designed to protect consumers; to make sure that companies 
have a single standard across the country for being required to 
notify individuals when there is reasonable basis to believe 
that their personal information may have been stolen, and to do 
so promptly. So that is very much geared toward the individual 
and the consumer.
    In terms of how do we reassure them that this work that we 
are doing on their behalf is not interfering with their privacy 
interests? As we have talked today, we are very much focused on 
the specific information that we need to defend networks. We 
are very precise. The legislation the administration has 
proposed defines that information very carefully.
    The automation that we are building will have a structured 
way of providing that information that will minimize the 
likelihood that information we don't need could be included. We 
place a very high priority on making sure that we are--we have 
no interest, it does not help our network defense to gather a 
lot of personal information about Americans or others.
    I will let the deputy address that, as well.
    Ms. Schneck. I would only add that it is my hope that we 
can use campaigns like our ``Stop. Think. Connect.'' messaging 
or the awareness that we do every October in cybersecurity 
awareness month. I think every month should be cyber awareness 
month. But we focus that month to get out on the road and talk 
to everyone.
    I am hoping that the public will start to understand this. 
We have to work to take some of our technical terms and make 
them actually English. But start to understand that Government 
is working very hard to protect them. It starts with getting 
our own agencies talking, which we are doing. It starts with 
building into the private sector. Then making sure that through 
its providers of theirs of other programs with agencies in the 
Federal Government that work directly with citizens, that we 
get that right. But we need to really enhance the trust 
relationship in the cyber area.
    Mrs. Torres. So I am almost out of time. I just want to 
make sure that I get my two other questions answered.
    To this issue though, my final word on this is that we need 
to ensure that that community outreach is part of whatever 
legislation that we can produce; that community grants and 
opportunities to include the public in this discussion happens.
    Mr. Fischer, the fair information practice principles we 
have been talking about, mentioned in the President's--in his 
security Executive Order, how are they incorporated into the 
Department procedures, from your perspective?
    Mr. Fischer. Well, I think the Department people would 
probably be better-situated to answer the specifics with 
respect to that. But I think on the question of how privacy is 
incorporated, it is a--one of the difficulties--and this also 
gets back to your earlier question a little bit--that the 
general public has various views of what privacy means. There 
isn't any one really universal kind of understanding. I mean, 
there is something called, you know, ``personally identifiable 
information,'' which is kind of interpreted as being something 
that, you know, could actually identify a person specifically.
    But when people think about privacy, they don't necessarily 
think about it in the same way as Government may think about 
privacy. So, you know, if one is going to develop a set of 
principles or use a set of principles or, in fact, incorporate 
something like privacy by design, which has been around for a 
long time, or something that people have tried to do, it is--
there--it can become very complicated very quickly.
    I think one of the things that is very important is to be 
able to create a way of letting people understand specifically 
what the issues are so that there can become really a consensus 
among consumers about what it is that we are really trying to 
protect.
    Because one more point here, which is, you know, people are 
always worried about--understandably, about Government and its 
role. But, in fact, people willingly give huge amounts of 
information to private companies.
    Mrs. Torres. We do.
    Mr. Fischer. If you get software that is free, it just 
means you are the product. Because the company is getting 
something out of it. Usually, that means they are getting 
information from you; right?
    Well, people don't even often realize this. You know, the 
service agreements that we sign, I mean, who has time to read 
through them or can understand them? So I think it is very 
important that there be a--you know, a dialogue, really, about 
how to characterize privacy more clearly for everybody so there 
can be consensus.
    Mrs. Torres. Thank you. I think I am out of time. I yield 
back.
    Chairman McCaul. Recognize the Ranking Member for closing 
comments.
    Mrs. Watson Coleman. Thank you. I just want to thank the 
entire panel for giving us this time today and the information. 
Particularly, I want to thank you, Honorable, Honorable, 
Honorable Spaulding and Dr. Schneck, because you have given us 
the majority of the day when I knew you could be doing some 
other things, including preparing for what might be a furlough 
of some very important people. I hope you don't have to do 
that. But I want you to know and I thank you, Chairman, for 
guiding me through this very moment of being next to you. Thank 
you.
    Chairman McCaul. Well, you did quite well, I must say.
    Let me thank the witnesses. Let me thank Ms. Spaulding and 
Dr. Schneck for your service to our country on a very important 
issue. I think the education process is very important for 
Members of Congress and for the American people to identify 
that this is a real and valid threat that we need to defend the 
Nation from. The hearing will be open for 10 days, the record I 
should say.
    Without objection, the committee stands adjourned.
    [Whereupon, at 1:51 p.m., the committee was adjourned.]

                            A P P E N D I X

                              ----------                              

    Questions From Ranking Member Bennie G. Thompson for Suzanne E. 
                     Spaulding and Phyllis Schneck
    Question 1. According to the testimony of the under secretary, the 
White House legislative proposal on information sharing would immunize 
against civil or criminal liability entities that voluntarily disclose 
to or receive lawfully obtained cyber threat indicators from the NCCIC 
or a private ISAO that has adopted certain best practices. Please 
explain the scope of the liability protection, including a delineation 
of the circumstances in which liability protections would not be 
afforded to an entity that chooses to disclose or receive information 
from the NCCIC or a certified ISAO.
    Answer. The President's information-sharing legislative proposal 
provides targeted liability protection to private entities that 
voluntarily disclose or receive lawfully obtained cyber threat 
indicators from a private information security and analysis 
organization (ISAO) or the National Cybersecurity and Communications 
Integration Center (NCCIC). It affords such entities protection from 
public disclosure, and from use of disclosed indicators as evidence in 
a regulatory enforcement action.
    The proposal directs DHS to select a non-governmental Standards 
Organization for the purpose of identifying a common set of best 
practices for the creation and operation of private ISAOs. The 
Standards Organization will work directly with the public to identify 
and develop best practices. To receive the liability protection 
afforded by the President's proposal, private-sector entities must 
share with the NCCIC or an ISAO that has self-certified that it adheres 
to these best practices.
    Question 2a. To receive liability protection, does a private entity 
need any kind of certification from the NCCIC or an ISAO to which it 
disclosed or from which it received cyber threat indicators?
    If so, what standards would guide an NCCIC or ISAO in issuing such 
a certification?
    Answer. There is no NCCIC- or ISAO-issued certification. The 
proposal directs DHS to select a non-governmental Standards 
Organization for the purpose of identifying a common set of best 
practices for the creation and operation of private ISAOs. The 
Standards Organization will work directly with the private sector to 
identify and develop best practices. To receive the liability 
protection afforded by the President's proposal, private-sector 
entities must share with the NCCIC or an ISAO that has self-certified 
that it adheres to these best practices.
    The proposed independent standards organization for ISAOs would not 
promulgate Government-determined standards or require a compliance 
certification. It would be an independent organization that sets forth 
voluntary standards that it will develop in consultation with the 
public.
    Question 2b. If no certification were required or issued, would a 
court in the first instance have to assess whether a private entity 
deserves immunity under Section 106?
    Answer. ISAOs would have to self-certify under Section 106 of the 
information-sharing proposal. That self-certification is distinct from 
any acknowledgement of receipt that the NCCIC or the ISAO might 
generate as a way to reassure an entity sharing threat indicators that 
it has submitted the information to the correct place.
    Question 3. What are the limitations of the ISAC model that 
necessitate the effort to increase the proliferation of ISAOs?
    Answer. An ISAC is a type of ISAO. In practice, as ISACs have 
evolved, they are sector-specific entities that encourage information 
sharing within specific critical infrastructure sectors. While ISACs 
have had a great deal of success and lessons learned that will serve 
ISAOs as they form, many companies do not fall within a designated 
sector or fall within multiple sectors. And some companies want to 
share with partners outside of their sector for a wider scope of 
situational awareness.
    Encouraging ISAOs beyond just ISACS will provide for more 
organizational flexibility. ISAOs can be organized around a particular 
region, community of interest, or concern about a particular type of 
cybersecurity risk. ISAOs could include companies regardless of their 
sector affiliation.
    Question 4. What are the risks and rewards of an information-
sharing environment that is dominated by ISAOs?
    Answer. Critical infrastructure includes both physical and cyber 
infrastructure, publicly- and privately-owned. The ISAO model builds 
upon the successes of existing models. The formulation of ISAOs allows 
and encourages organizations to participate in cyber threat information 
sharing to proactively detect and prevent cybersecurity incidents 
before they can cause damage to their networks by applying the 
knowledge, capabilities, and experiences of a wider community. Sharing 
cyber threat information broadly and with sufficient timeliness can 
improve the Nation's cybersecurity writ large by reducing our cyber 
adversaries' advantages of speed and stealth.
  Questions From Honorable Jim Langevin for Suzanne E. Spaulding and 
                            Phyllis Schneck
    Question 1. In reviewing the President's information-sharing 
proposal, I was drawn to the phrase ``lawfully obtained'' as it relates 
to cyber threat indicators. Due to ambiguities in anti-hacking 
statutes, courts have not yet settled whether the work of many well-
intentioned security researchers--so-called white-hat hackers--is 
lawfully obtained. How can we work to ensure that information-sharing 
legislation does not chill vital security research while at the same 
time not opening the door to companies ``hacking back''?
    Answer. The President's information-sharing proposal aims to 
emphasize that activities conducted to obtain cyber indicators should 
comply with the law. The Department of Justice is best positioned to 
answer questions pertaining to the relevant statutes and to what extent 
they apply to the activities of cybersecurity researchers.
    Question 2. It is vitally important that we incent private-to-
private information sharing, something the President's proposal does 
through the use of Information Sharing and Analysis Organizations 
(ISAOs). However, ISAOs need only self-certify to be able to receive 
threat indicators. Without any independent oversight to be sure that 
best practices are being followed, are you concerned that this could 
lead to a reduction in privacy?
    Answer. Having publically-available standards for ISAOs, including 
standards for privacy protection, will help ISAO member companies hold 
their ISAO accountable. ISAOs that are transparent and accountable are 
likely to attract more members, providing an incentive to clearly 
demonstrate compliance with the standards.
    Question 3. We know that cyber threat information is most valuable 
when shared expeditiously, which, in this domain, essentially means at 
machine speed. How can DHS lead efforts to ensure that the stripping of 
PII is accomplished as thoroughly and quickly as possible so that the 
information shared is timely?
    Answer. DHS requests that, before sharing cyber threat information 
with the Department, partners filter out any PII, content, and other 
information that is not necessary to describing the cyber threat. In 
addition, currently, DHS Analysts are required to review cyber threat 
indicator information for PII and handle it as outlined in US-CERT 
standard operating procedures. Generally, DHS's policy is to minimize 
or redact any personal information that is not necessary to understand 
or analyze a threat. As we move to automated threat indicator sharing, 
DHS and interagency partners are studying privacy-by-design technical 
safeguards as well as policy and process approaches to minimization 
that include a combination of automated removal and/or filtering of 
sensitive data, oversight capabilities, and where necessary, manual 
review. Technical safeguard requirements may also be required. To 
safeguard Americans' personal privacy, the administration's 
cybersecurity legislative proposal requires private entities to comply 
with certain privacy restrictions, such as removing unnecessary 
personal information and taking measures to protect any personal 
information that must be shared, in order to qualify for liability 
protection. The proposal further requires the Attorney General, in 
coordination with the Secretary of Homeland Security and in 
consultation with the Privacy and Civil Liberties Oversight Board and 
others, to develop receipt, retention, use, and disclosure guidelines 
for the Federal Government.
    Any future cybersecurity legislation will incorporate strong 
privacy, confidentiality, and civil liberties safeguards while 
strengthening our critical infrastructure's security and resilience DHS 
is committed to furthering information sharing and promoting 
cybersecurity standards for critical infrastructure.
  Question From Ranking Member Bennie G. Thompson for Eric A. Fischer
    Question. What are the risks and rewards of an information-sharing 
environment that is dominated by ISAOs?
    Answer.\1\ This question cannot be answered definitively at 
present. Such an answer would depend on several factors that are 
currently unknown or uncertain. However, the analysis below may be 
useful in helping to determine the potential benefits and disadvantages 
of the ISAO model in such an environment.
---------------------------------------------------------------------------
    \1\ Some responses were prepared in consultation with other CRS 
experts.
---------------------------------------------------------------------------
    ISAOs (Information Sharing and Analysis Organizations) are defined 
in the Homeland Security Act (6 U.S.C.  131(5)) as ``any formal or 
informal entity or collaboration created or employed by public or 
private sector organizations'' created to assist in securing critical 
infrastructure and protected systems by acquiring, analyzing, or 
sharing ``critical infrastructure information,'' which refers to non-
public information relating to threats to and defense and recovery of 
critical infrastructure or protected systems.
    Information Sharing and Analysis Centers (ISACs) are more familiar 
to most observers. They may also be considered ISAOs but have a 
different origin, having been initially formed pursuant to a 1998 
Presidential directive (PPD 63) on critical infrastructure 
protection.\2\ The directive called for a single ISAC but also for a 
National Infrastructure Protection Center (somewhat analogous to the 
National Cybersecurity and Communications Integration Center [NCCIC]) 
that would ``establish its own relations directly with others in the 
private sector and with any information sharing and analysis entity 
that the private sector may create.''\3\ Also, the directive stated 
that the ``actual design and functions'' of the ISAC would ``be 
determined by the private sector, in consultation with and with 
assistance from the Federal Government.'' The result was the creation 
of several sector-focused ISACs, rather than a single entity. Many of 
today's ISACs are associated with Federally-recognized critical 
infrastructure sectors. Eighteen are listed as members of the National 
Council of ISACs (NCI).\4\ There are currently 16 Federally-recognized 
critical infrastructure sectors.\5\ The table below shows the 
relationships between those sectors and the ISACs.
---------------------------------------------------------------------------
    \2\ The White House, ``Presidential Decision Directive 63: Critical 
Infrastructure Protection,'' May 22, 1998, http://www.fas.org/irp/
offdocs/pdd/pdd-63.htm.
    \3\ It is not clear what ``others in the private sector'' refers 
to, as the NIPC was a Federal entity. Presumably, this was a drafting 
error.
    \4\ National Council of ISACs, ``Member ISACs,'' 2015, http://
www.isaccouncil.org/memberisacs.html.
    \5\ The White House, ``Critical Infrastructure Security and 
Resilience,'' Presidential Policy Directive 21, (February 12, 2013), 
http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-
policy-directive-critical-infrastructure-security-and-resil.

------------------------------------------------------------------------
                                              Information Sharing and
      Critical Infrastructure Sector              Analysis Center
------------------------------------------------------------------------
Chemical.................................
Commercial Facilities....................  Real Estate ISAC
Communications...........................  Communications ISAC (National
                                            Coordinating Center for
                                            Communications-NCC)
Critical Manufacturing...................
Dams.....................................
Defense Industrial Base..................  DIB-ISAC
Emergency Services.......................  EMR-ISAC
Energy...................................  ES-ISAC (electric sector)
                                           Oil and Gas ISAC
Financial Services.......................  Financial Services ISAC
Food and Agriculture.....................
Government Facilities....................  Multi-State ISAC
Healthcare and Public Health.............  Health ISAC
Information Technology...................  IT-ISAC
Nuclear Reactors, Materials, and Waste...  Nuclear Energy Institute
Transportation Systems...................  Aviation ISAC
                                           Maritime ISAC
                                           Public Transit ISAC
                                           Surface Transportation ISAC
Water and Wastewater Systems.............  Water ISAC
No specific critical-infrastructure        Research and Education ISAC
 sector.                                   Supply-Chain ISAC
                                           ICS-ISAC (industrial control
                                            systems)
------------------------------------------------------------------------
Source.--See text.
Notes.--A Food and Agriculture ISAC and a Chemical ISAC were established
  in 2002 (Government Accountability Office, Critical Infrastructure
  Protection: Improving Information Sharing with Infrastructure Sectors,
  July 2004, http://www.gao.gov/assets/250/243318.pdf) but appear to be
  no longer operational. The NCC, within DHS, has served as the
  Communications ISAC since 2000 (http://www.dhs.gov/national-
  coordinating-center-communications). The ICS-ISAC is not listed as a
  member of the NCI. Other entities such as State governments may also
  have ISACs.

    As the table shows, ISACs currently exist for 12 of the designated 
critical infrastructure sectors.\6\ There are also three ISACs that are 
cross-sectoral. There appear to be few organizations that call 
themselves ISAOs at present.\7\ The concept increased in prominence 
following a legislative proposal and an Executive Order from the Obama 
administration in January and February of 2015 fostering their 
development and use.\8\ The White House described the intent as 
``expand[ing] information sharing by encouraging the formation of 
communities that share information across a region or in response to a 
specific emerging cyber threat. An ISAO could be a not-for-profit 
community, a membership organization, or a single company facilitating 
sharing among its customers or partners.'' The Executive Order 
specifies that ``ISAOs may be organized on the basis of sector, sub-
sector, region, or any other affinity,'' that members may be public 
sector, private sector, or both, and that an ISAO may be ``a not-for-
profit community, a membership organization, or a single company 
facilitating sharing among its customers or partners.''\9\ Under the 
proposed legislation, ISAOs that wish to protect members from liability 
risks for sharing information would need to be self-certified according 
to standards to be developed under a process to be established by DHS.
---------------------------------------------------------------------------
    \6\ Some caution should be exercised with respect to the 
completeness of this list, as there may also be organizations that have 
ISAC-like functions but do not call themselves ISACs.
    \7\ One example is the HITRUST Alliance (see Testimony of HITRUST 
Alliance CEO Dan Nutkis, Cybersecurity: The Evolving Nature of Cyber 
Threats Facing the Private Sector, 2015, http://oversight.house.gov/wp-
content/uploads/2015/03/3-18-2015-IT-Hearing-on-Cybersecurity-Nutkis-
HITRUST.pdf). Some organizations may function like ISAOs or ISACs but 
not call themselves that.
    \8\ The White House, Updated Information Sharing Legislative 
Proposal, 2015, http://www.whitehouse.gov/sites/default/files/omb/
legislative/letters/updated-information-sharing-legislative-
proposal.pdf; The White House, ``Fact Sheet: Executive Order Promoting 
Private Sector Cybersecurity Information Sharing,'' Press Release, 
(February 12, 2015), http://www.whitehouse.gov/the-press-office/2015/
02/12/fact-sheet-executive-order-promoting-private-sector-
cybersecurity-inform; Executive Order 13691, ``Promoting Private Sector 
Cybersecurity Information Sharing,'' Federal Register 80, no. 34 
(February 20, 2015): 9349-53, http://www.gpo.gov/fdsys/pkg/FR-2015-02-
20/pdf/2015-03714.pdf.
    \9\ The Homeland Security Act definition is both broader, in that 
ISAOs can be ``any formal or informal entity or collaboration created 
or employed by public or private sector organizations'', and narrower, 
in that under the act, the organizations must be ``created or 
employed'' for ``gathering and analyzing,'' ``communicating or 
disclosing,'' and ``voluntarily disseminating'' critical infrastructure 
information as specified in the act (6 U.S.C. 131(5)). The 
administration proposal does not appear to limit ISAOs to information 
about critical infrastructure, although its focus is on cybersecurity, 
rather than on the all-hazards emphasis in the act.
---------------------------------------------------------------------------
    If this approach were adopted by Congress, ISAOs could possibly 
become dominant entities in the information-sharing environment. Given 
the uncertainties associated with their anticipated impacts, it may be 
best to examine possible effects through a series of questions:
   Would ISAOs lead to more information sharing among private-
        sector entities and between the NCCIC and the private sector? 
        The broad and flexible nature of the ISAOs envisioned in the 
        administration proposal, as opposed to ISACs as currently 
        configured, could lead to the creation of ISAOs for affinity 
        groups for which ISACs are not viewed as applicable--for 
        example, the entertainment industry, with companies such as 
        Sony.\10\ That could lead to much broader information sharing 
        among private-sector entities that join the ISAOs and with the 
        NCCIC. Yet, there is no guarantee that new ISAOs would be 
        established, or, if they were, that they would lead to 
        increased information sharing either among the members or with 
        the NCCIC. Even for a few CI sectors, some former ISACs are no 
        longer in operation, and the degree to which existing ISACs are 
        active in information sharing is considered variable by many 
        observers. Furthermore, the degree to which the NCCIC could 
        process and usefully disseminate the volume and variety of 
        information it may likely receive from a large number of ISAOs 
        is uncertain.
---------------------------------------------------------------------------
    \10\ However, the IT-ISAC already lists Sony as a member (https://
www.it-isac.org/).
---------------------------------------------------------------------------
   Would increases in information sharing through ISAOs improve 
        cybersecurity? The relationship between the volume of 
        information shared and improved cybersecurity is not 
        straightforward. Both providers and recipients--whether they 
        are businesses, ISAOs, or Government agencies--will incur 
        various costs, including developing, assessing, processing, 
        sharing, and applying the information. For sharing to be 
        effective, information from the provider must be relevant to 
        recipients' needs and in forms that can be readily applied in 
        their IT and security environments. Recipients must also have 
        the capacity and willingness to assess and use the information 
        received in a timely fashion. A large increase in the amount of 
        information received may in fact be counterproductive, 
        especially if much of the information proves to be of little 
        use to the recipient. In theory, ISAOs can be closely tailored 
        to the needs of their members and therefore help ensure that 
        those needs are met. However, a closely-tailored ISAO might not 
        provide information relevant to all the lines of business in 
        which members may engage, and membership in several 
        organizations might be preferred.\11\
---------------------------------------------------------------------------
    \11\ For example, Sony is involved in electronics, gaming, movies, 
and music. However, it is not clear whether Sony would have been better 
protected against recent attacks against it if it had been a member of 
ISAOs in any of those subsectors in addition to its membership in the 
IT-ISAC.
---------------------------------------------------------------------------
   Would ISAOs provide overlapping or duplicative services? One 
        potential advantage of the sector-focused approach taken by the 
        ISACs is that it can minimize such duplication. However, it can 
        also create gaps for entities that do not fall clearly into one 
        or another ISAC sector or that are multi-sectoral. Addressing 
        such gaps is one of the stated purposes of the administration's 
        ISAO proposal. In addition, the potential for duplication 
        creates the potential for market competition, and such market 
        forces would ideally yield more innovation and more rapid 
        improvement in information sharing than would a more restricted 
        approach. Market forces might also lead to lower costs, and 
        cost is often cited as an impediment to improved information 
        sharing, especially for small businesses. Yet market forces 
        might also lead to higher costs, and a proliferation of ISAOs 
        might also make decisions about which one or ones to join more 
        difficult for potential members. It also creates the 
        possibility that members could receive conflicting information 
        or even recommendations from different ISAOs. At present, there 
        appear to be few examples of potentially overlapping 
        information-sharing entities. One possible case is in the 
        health sector, which has both the Health ISAC \12\ and an ISAO, 
        the HITRUST Alliance.\13\ Services provided by the two appear 
        to be both complementary and potentially competitive.\14\
---------------------------------------------------------------------------
    \12\ National Health Information Sharing and Analysis Center, ``NH-
ISAC,'' 2015.
    \13\ Nutkis, Testimony at COGR Hearing.
    \14\ See, for example, Marianne Kolbasuk McGee, ``NH-ISAC Offers 
Cyber-Intelligence Tool,'' Data Breach Today, December 5, 2014, http://
www.databreachtoday.com/nh-isac-offers-cyber-intelligence-tool-a-7642.
---------------------------------------------------------------------------
   Would for-profit ISAOs be beneficial or disadvantageous for 
        improving information sharing? The administration proposal 
        states that for-profit entities that share information can be 
        ISAOs. That would presumably include internet and cybersecurity 
        service providers, for example. Such entities might be 
        particularly well-positioned to share information efficiently 
        and effectively with customers and to bring market forces to 
        bear favorably in the information-sharing environment. However, 
        unintended adverse impacts are also possible. For example, for-
        profit companies might have a resource and marketing advantage 
        over non-profit organizations, and some may perceive such an 
        advantage as unfair or counterproductive. It is also possible 
        that competitive pressures may impede information sharing 
        involving more than one company. Some entities that could 
        potentially be ISAOs are currently members of ISACs and could 
        also be members of other ISAOs, creating possible conflicts of 
        interest.
   Would a cybersecurity environment dominated by ISAOs 
        complement or encumber improvement of cybersecurity risk 
        management? The NIST Cybersecurity Framework,\15\ developed to 
        assist critical-infrastructure and other entities in adopting 
        effective cybersecurity risk management, discusses the role of 
        information sharing in cybersecurity, including the roles 
        played by ISACs and other entities in helping organizations 
        determine their desired levels--called tiers--of cybersecurity 
        implementation. Each of the four tiers includes descriptions of 
        risk-management processes and programs, and ``external 
        participation,'' which largely describes the level of 
        information sharing in which the organization engages.\16\ 
        Broad availability of involvement with ISAOs could help 
        organizations that so desire to move to higher tiers with 
        respect to information sharing. However, as the Framework makes 
        clear, that is only one facet of cybersecurity implementation. 
        There may be a risk, therefore, that a proliferation of ISAOs 
        would lead to an overemphasis on information sharing to the 
        detriment of other, possibly more critical cybersecurity needs, 
        thereby resulting paradoxically in a decline in overall 
        cybersecurity preparedness.
---------------------------------------------------------------------------
    \15\ National Institute of Standards and Technology, Framework for 
Improving Critical Infrastructure Cybersecurity, Version 1.0, February 
12, 2014, http://www.nist.gov/cyberframework/upload/cybersecurity-
framework-021214-final.pdf.
    \16\ A Tier-2 organization ``knows its role in the larger 
ecosystem, but has not formalized its capabilities to interact and 
share information externally,'' whereas a Tier-4 organization `` . . . 
actively shares information with partners to ensure that accurate, 
current information is being distributed and consumed to improve 
cybersecurity before a cybersecurity event occurs (ibid., 10, 11).
---------------------------------------------------------------------------
   Would the proposed ISAO standards process sufficiently 
        address concerns such as those raised above? Both the 
        legislative proposal and the Executive Order call for 
        designation of a nongovernmental organization whose purpose 
        would be to specify a ``common set'' of ``best practices'' or 
        ``voluntary standards or guidelines'' for creating and 
        operating ISAOs. Such standards and practices may help address 
        some but not all of the issues discussed above. For example, 
        standards may be helpful in determining what kinds of 
        information may be most useful to share for different purposes 
        and different kinds of entities, as well as how best to use 
        such information, but it seems unlikely that they can address 
        concerns about overlapping or duplicative services, or problems 
        such as gaps in coverage for key groups caused by economic 
        factors.
    If ISAOs do in fact proliferate, it is very likely that substantial 
changes will occur in the information-sharing environment, but many of 
those effects may be difficult or even impossible to predict 
accurately. However, there appear to be few independent assessments of 
the performance and effectiveness of current information-sharing 
entities and their relationships.\17\ Some studies have concluded that 
measuring the effectiveness of information sharing is difficult in the 
current environment,\18\ and the creation of a large number of ISAOs 
could further complicate any assessments. Such concerns might be 
addressed by options such as on-going independent research and 
evaluation activities designed to determine the effectiveness of ISAOs, 
perhaps as a part of or complementary to the standards-development and 
revision process envisioned by the administration. That could 
potentially be started in conjunction with another option-staged 
implementation of the ISAO model, perhaps including pilot programs.\19\
---------------------------------------------------------------------------
    \17\ One example is Government Accountability Office, Public 
Transit Security Information Sharing: DHS Could Improve Information 
Sharing Through Streamlining and Increased Outreach, September 2010, 
http://www.gao.gov/assets/310/309903.pdf.
    \18\ See, for example, Matthew H. Fleming, Eric Goldstein, and John 
K. Roman, Evaluating the Impact of Cybersecurity Information Sharing on 
Cyber Incidents and Their Consequences (Homeland Security Studies and 
Analysis Institute, March 31, 2014), http://papers.ssrn.com/sol3/
papers.cfm?abstract_id=?2418357; Brian A. Jackson, ``How Do We Know 
What Information Sharing Is Really Worth?,'' Product Page, (2014), 
http://www.rand.org/pubs/research_reports/RR380.html.
    \19\ These options are provided for purposes of illustration. CRS 
does not make recommendations or take positions on legislative issues.
---------------------------------------------------------------------------
       Questions From Honorable Jim Langevin for Eric A. Fischer
    Question 1. In reviewing the President's information-sharing 
proposal, I was drawn to the phrase ``lawfully obtained'' as it relates 
to cyber threat indicators. Due to ambiguities in anti-hacking 
statutes, courts have not yet settled whether the work of many well-
intentioned security researchers--so-called white-hat hackers--is 
lawfully obtained. How can we work to ensure that information-sharing 
legislation does not chill vital security research while at the same 
time not opening the door to companies ``hacking back''?
    Answer. The current cybersecurity environment creates a number of 
dilemmas, and one of them is captured by this question. The problem is 
that the complexities of cyberspace--whether hardware, software, 
networks, or the people using them--combined with its rapid 
technological evolution and the changing threat environment, create 
significant challenges for distinguishing appropriate and inappropriate 
behavior, especially by those pursuing protective and defensive 
activities. Such ambiguity can create problems for legal and ethical 
interpretation of such actions and is believed by at least some 
observers to have a potentially chilling effect on needed research. 
This is not a new issue,\20\ but some legislative proposals to improve 
cybersecurity have led to increased attention to the concern.\21\
---------------------------------------------------------------------------
    \20\ Aaron J. Burstein, ``Conducting Cybersecurity Research Legally 
and Ethically,'' April 4, 2008, https://www.usenix.org/legacy/event/
leet08/tech/full_papers/burstein/burstein_html/index.html.
    \21\ See, for example, Jan Ellis, ``Will the President's 
Cybersecurity Proposal Make Us More Secure?,'' Security Street, January 
23, 2015, https://community.rapid7.com/community/infosec/blog/2015/01/
23/will-the-president-s-cybersecurity-proposal-make-us-more-secure; 
Mark Jaycox and Lee Tien, ``Obama's Computer Security Solution Is a 
Mishmash of Old, Outdated Policy Solutions,'' January 16, 2015, https:/
/www.eff.org/deeplinks/2015/01/obamas-computer-security-solution-mish-
mash-old-outdated-policy-solutions.
---------------------------------------------------------------------------
    In addition, researchers who are part of an established and 
recognized enterprise, such as a university or research institution, 
are likely to have different opportunities and constraints than those 
who operate independently, without either the benefits or the 
strictures of an institutional environment. Also, research may refer to 
many different activities, from the acquisition of fundamental 
knowledge about threats, vulnerabilities, and defenses, to the 
development of hardware, software, and procedures to address 
cybersecurity needs, to the investigation of specific incidents for 
purposes of attribution and response. Constraints on research are 
likely to apply to such different classes of researchers and activities 
in significantly different ways.
    One of the core challenges in finding ways to reduce the risk that 
the legal environment will chill needed research is in reaching a clear 
consensus among stakeholders about what constitutes proper and improper 
research activity. If such a consensus can be reached, legal 
ambiguities might be much more easily resolved. Without a consensus, 
resolution is likely to be very difficult. For example, some may argue 
that a research exception should be provided in communications privacy 
laws,\22\ but without agreement on what is and is not appropriate 
behavior, such an exception may be difficult to scope.
---------------------------------------------------------------------------
    \22\ Burstein, ``Conducting Cybersecurity Research.''
---------------------------------------------------------------------------
    Another issue that may be worth considering is lack of 
understanding and education among researchers about what they can and 
cannot do under current law and regulations. Researchers may be 
reluctant to take some actions that are lawful solely because of 
uncertainty about their legality.\23\ One way to address this issue is 
to provide researchers with access to appropriate education resources 
that can clarify what is permitted and also provide guidance for 
reducing the risk of violating legal requirements.\24\ For example, the 
legal risks associated with the use of honeypots--websites or other 
information resources specifically designed to attract attacks--may 
depend, some have argued, on how they are implemented.\25\
---------------------------------------------------------------------------
    \23\ Ibid.
    \24\ See, for example, Jody R. Westby, Legal Guide to Cybersecurity 
Research (Chicago, IL: American Bar Association, Section of Science & 
Technology Law, 2013).
    \25\ Burstein, ``Conducting Cybersecurity Research.''
---------------------------------------------------------------------------
    Finally, an option available for some research problems is the use 
of isolated testbeds or ``cyber ranges.'' Such facilities are designed 
for research and training, can mimic many features of cyberspace, and 
permit a wide range of actions that could possibly be illegal if done 
in ``the wild.'' However, they are limited in scale and may otherwise 
be unable to mimic the environment of cyberspace sufficiently for some 
kinds of research. In addition, if they are not completely isolated 
from the internet, the risk of impacts on external systems would need 
to be considered.
    Question 2. I think I can safely speak for everyone on this panel 
in saying that we agree that cyber threat information sharing is 
important. I believe that the President's proposal will help lower 
legal barriers to information sharing. What are other obstacles that 
could continue to keep information sharing from being as ubiquitous as 
we'd like?
    Answer. Awareness of the potential utility of information sharing 
in cybersecurity appears to be increasing. As the question points out, 
legal barriers are only one set of obstacles that would need to be 
overcome for ubiquitous and effective use of this cybersecurity tool. 
Several additional potential obstacles are discussed below.\26\
---------------------------------------------------------------------------
    \26\ The list is not intended to be definitive or exhaustive. That 
would require a comprehensive, objective study of all aspects of 
information sharing in the broader cybersecurity context. In addition, 
any such list is likely to change significantly as cyber space and its 
component threat and information-sharing environments continue to 
evolve. The items in this list are not presented in any order of 
priority or desirability.
---------------------------------------------------------------------------
Resources
    The costs of information sharing vary, but may be prohibitive for 
some entities. The costs of obtaining information from an entity such 
as an ISAC may be comparatively low,\27\ but that is only for a 
mechanism to receive information. The information must be processed by 
the recipient and applied where appropriate. That will require staff 
time and perhaps additional hardware and software, especially for 
implementation of so-called ``real-time'' information sharing, which 
often involves machine-to-machine communication and action. Such costs 
may be particularly problematic for small businesses, which may be of 
concern not only because of their broad role in the economy, but also 
because the sector includes many innovators that can be inviting 
targets for cyber espionage, and because many are contractors with 
larger organizations that may be inviting targets for cyber crime.\28\
---------------------------------------------------------------------------
    \27\ See, for example, N. Eric Weiss, Legislation to Facilitate 
Cybersecurity Information Sharing: Economic Analysis, CRS Report 
R43821.
    \28\ In the attack on Target, the criminals accessed the store's 
computer system through a compromised system of an HVAC contractor (see 
N. Eric Weiss and Rena S. Miller, The Target and Other Financial Data 
Breaches: Frequently Asked Questions, CRS Report R43496).
---------------------------------------------------------------------------
Awareness
    Concerns about the lack of awareness about cybersecurity in general 
and information sharing in particular, especially within the private 
sector, have been long-standing. While the NIST Cybersecurity Framework 
\29\ and other efforts, along with media attention to major breaches, 
appear to have resulted in some increased awareness of the need for 
better cybersecurity, it is not yet clear the degree to which awareness 
has improved as a result. Awareness of a problem or need is also not 
sufficient on its own. To be effective, it must be translated into 
appropriate action, which often may not be the case. For example, 
according to a 2012 survey, three-quarters of small businesses believe 
that cybersecurity is important, but only 10% have a written policy on 
it.\30\
---------------------------------------------------------------------------
    \29\ National Institute of Standards and Technology, 
``Cybersecurity Framework,'' August 26, 2014, http://www.nist.gov/
cyberframework/index.cfm.
    \30\ About a quarter have an ``informal'' policy (National Cyber 
Security Alliance, Symantec, and JZ Analytics, 2012 NCSA/Symantec 
National Small Business Study, October 2012, https://
www.staysafeonline.org/ . . . /2012_ncsa_symantec_small_business_ 
study.pdf).
---------------------------------------------------------------------------
Usefulness of Information
    Many kinds of information can be shared, from threat intelligence 
\31\ to business strategies and best practices. In addition, the same 
information may have different utility for different users--for 
example, threat signatures relating to attacks on one critical 
infrastructure sector may be of marginal concern for another, and best 
practices may be much more useful for small businesses than signatures 
associated with advanced targeted threats. Also, shared information may 
prove of little use if it is delayed, provided without relevant 
contextual detail, or provided in a form that requires substantial 
additional processing to determine its applicability. If recipients 
find that the information they are provided is of little use to them, 
they may be less likely to participate in or continue with information-
sharing initiatives.
---------------------------------------------------------------------------
    \31\ This can be described as ``indicators (i.e., an artifact or 
observable that suggests that an attack is imminent, that an attack is 
underway, or that a compromise may have already occurred); the TTPs 
[tactics, techniques and procedures] of an adversary; and recommended 
actions to counter an attack'' Chris Johnson, Lee Badger, and David 
Waltermire, Guide to Cyber Threat Information Sharing (Draft), SP 800-
150 [National Institute of Standards and Technology, October 2014], 4, 
http://csrc.nist.gov/publications/drafts/800-15sp800_150_draft.pdf.
---------------------------------------------------------------------------
Application of Information
    Information sharing by itself is not sufficient to improve 
cybersecurity. Not only must it be actionable--presented in a form that 
can be usefully applied--but the recipient must also have processes, 
including equipment and software, in place to use the information 
effectively. If such processes are not in place and utilized properly, 
the net effect is the same as if the information were not shared at 
all.\32\
---------------------------------------------------------------------------
    \32\ See, for example, Johnson, Badger, and Waltermire, Guide to 
Cyber Threat Information Sharing (Draft).
---------------------------------------------------------------------------
Reliability of Sources
    There are several reasons why sources of information may not be 
considered reliable by potential recipients. For example, the source 
may be a competitor, such as another business. The kinds of information 
the source provides may focus on a set of entities other than the one 
to which the recipient belongs. Or the source might have a reputation 
for providing erroneous, outdated, or otherwise useless information. If 
no sources are available to an entity that it deems reliable, it may be 
reluctant to participate in information-sharing activities.
Mechanisms for Information Sharing
    Currently, there appear to be two general models for information 
sharing--a decentralized, ``peer-to-peer,'' often informal approach 
between entities with complementary needs, and a more centralized 
``hub-and-spoke'' model such as the ISACs.\33\ Organizations such as 
ISACs are generally sector-specific. Not all sectors have such 
organizations, and other affiliations other than sector may also be 
important for some kinds of information sharing. Filling such gaps 
appears to be part of the rationale behind the administration's ISAO 
proposal.\34\ On the one hand, the absence of an appropriate mechanism 
can be a barrier to information sharing for an entity. On the other 
hand, a proliferation of mechanisms, such as some observers fear the 
administration's ISAO model might result in, could also serve as a 
barrier if it makes information sharing inefficient or confusing for 
possible participants.
---------------------------------------------------------------------------
    \33\ Denise E. Zheng and James A. Lewis, Cyber Threat Information 
Sharing: Recommendations for Congress and the Administration (CSIS, 
March 2015), https://csis.org/files/publication/
150310_cyberthreatinfosharing.pdf.
    \34\ The White House, Updated Information Sharing Legislative 
Proposal; The White House, ``Fact Sheet: Executive Order Promoting 
Private Sector Cybersecurity Information Sharing''; Executive Order 
13691, ``Promoting Private Sector Cybersecurity Information Sharing.''
---------------------------------------------------------------------------
Standards
    The adoption of standards for information sharing is one way to 
help address concerns about reliability and utility of information 
received. Dozens of standards exist relating to information 
sharing.\35\ The Department of Homeland Security has been developing a 
single set applicable to sharing of threat intelligence.\36\ Lack of a 
broadly-accepted set of consensus standards or a framework for 
information sharing might impede more wide-spread adoption of 
information-sharing activities.
---------------------------------------------------------------------------
    \35\ European Union Agency for Network and Information Security, 
Standards and Tools for Exchange and Processing of Actionable 
Information, November 2014, https://www.enisa.europa.eu/activities/
cert/support/actionable-information/standards-and-tools-for-exchange-
and-processing-of-actionable-information.
    \36\ Department of Homeland Security, ``Information Sharing 
Specifications for Cybersecurity,'' 2015, https://www.us-cert.gov/
Information-Sharing-Specifications-Cybersecurity.
---------------------------------------------------------------------------
Economic Incentives
    Some observers have noted that the benefits of receiving 
cybersecurity information tend to outweigh the benefits of providing 
such information for many organizations.\37\ In addition to legal 
issues that may be associated with providing information, businesses 
may be concerned about reputation costs, if they provide information 
showing that they have been victims of cyber attacks. In the absence of 
incentives for reciprocity, it is hard to see what benefit an 
organization would gain from providing information, unless it is a 
Government entity whose mission is to provide such data or a provider 
of cybersecurity services. Government measures such as requirements for 
data-breach notification, as enacted in most States, can provide 
incentives for organizations to share information about attacks that 
may be used to help prevent future attacks on other entities or to 
capture and prosecute cyber criminals.
---------------------------------------------------------------------------
    \37\ See, for example, N. Eric Weiss, Legislation to Facilitate 
Cybersecurity Information Sharing: Economic Analysis, CRS Report 
R43821; Zheng and Lewis, Cyber Threat Information Sharing: 
Recommendations for Congress and the Administration.
---------------------------------------------------------------------------
Reducing the Need for Information Sharing
    Some observers have expressed concern about risks associated with 
an overemphasis on the role of information sharing in cybersecurity. It 
is only one of many cybersecurity tools. For example, it is a 
relatively small part of the NIST Cybersecurity Framework, and target 
levels of sharing vary among the tiers the Framework identified.\38\ In 
addition, information sharing tends to focus on immediate concerns such 
as cyber attacks and imminent threats. While those must be addressed, 
that does not diminish the need to reduce risks through design and 
implementation of more secure systems and networks--sometimes referred 
to as ``building security in''--and finding ways to change the 
incentive structure within cyber space to increase the costs and reduce 
the potential for profit from cyber crime and activities of other 
adversaries.
---------------------------------------------------------------------------
    \38\ National Institute of Standards and Technology, Framework for 
Improving Critical Infrastructure Cybersecurity, Version 1.0.
---------------------------------------------------------------------------

                                 [all]
```