```

[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]

 
      INDUSTRY PERSPECTIVES ON THE PRESIDENT'S 
        CYBERSECURITY INFORMATION-SHARING PRO-
        POSAL

=======================================================================

                                HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                     CYBERSECURITY, INFRASTRUCTURE
                        PROTECTION, AND SECURITY
                              TECHNOLOGIES

                                 OF THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             FIRST SESSION

                               __________

                             MARCH 4, 2015

                               __________

                            Serial No. 114-7

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT] 

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________
                               
                               
                         U.S. GOVERNMENT PUBLISHING OFFICE
94-578 PDF                   WASHINGTON : 2015                         
  
___________________________________________________________________________________________                              
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected].  
                              
                               
                               

                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice    James R. Langevin, Rhode Island
    Chair                            Brian Higgins, New York
Jeff Duncan, South Carolina          Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Steven M. Palazzo, Mississippi       Donald M. Payne, Jr., New Jersey
Lou Barletta, Pennsylvania           Filemon Vela, Texas
Scott Perry, Pennsylvania            Bonnie Watson Coleman, New Jersey
Curt Clawson, Florida                Kathleen M. Rice, New York
John Katko, New York                 Norma J. Torres, California
Will Hurd, Texas
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
                   Brendan P. Shields, Staff Director
                    Joan V. O'Hara,  General Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY 
                              TECHNOLOGIES

                    John Ratcliffe, Texas, Chairman
Peter T. King, New York              Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             Loretta Sanchez, California
Steven M. Palazzo, Mississippi       Sheila Jackson Lee, Texas
Scott Perry, Pennsylvania            James R. Langevin, Rhode Island
Curt Clawson, Florida                Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (ex             (ex officio)
    officio)
               Brett DeWitt, Subcommittee Staff Director
                    Dennis Terry, Subcommittee Clerk
       Christopher Schepis, Minority Subcommittee Staff Director
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable John Ratcliffe, a Representative in Congress From 
  the State of Texas, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Cedric L. Richmond, a Representative in Congress 
  From the State of Louisiana, and Ranking Member, Subcommittee 
  on Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Prepared Statement.............................................    14
The Honorable James R. Langevin, a Representative in Congress 
  From the State of Rhode Island:
  Oral Statement.................................................    13

                               Witnesses

Mr. Matthew J. Eggers, Senior Director, National Security and 
  Emergency Preparedness, U.S. Chamber of Commerce:
  Oral Statement.................................................    15
  Prepared Statement.............................................    17
Ms. Mary Ellen Callahan, Jenner & Block, Former Chief Privacy 
  Officer, U.S. Department of Homeland Security:
  Oral Statement.................................................    24
  Prepared Statement.............................................    26
Mr. Gregory T. Garcia, Executive Director, Financial Services 
  Sector Coordinating Council:
  Oral Statement.................................................    30
  Prepared Statement.............................................    32
Mr. Martin C. Libicki, The Rand Corporation:
  Oral Statement.................................................    37
  Prepared Statement.............................................    39

                             For the Record

The Honorable John Ratcliffe, a Representative in Congress From 
  the State of Texas, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Letter From the National Defense Industrial Association........     4
  Letter From the American Bankers Association...................     5
  Letter From the Retail Industry Leaders Association............     9
  Statement of the Financial Services Information Sharing & 
    Analysis Center and the National Council of Information 
    Sharing and Analysis Centers.................................    10

  INDUSTRY PERSPECTIVES ON THE PRESIDENT'S CYBERSECURITY INFORMATION-
                            SHARING PROPOSAL

                              ----------                              

                        Wednesday, March 4, 2015

             U.S. House of Representatives,
                    Committee on Homeland Security,
 Subcommittee on Cybersecurity, Infrastructure Protection, 
                                 and Security Technologies,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 2:06 p.m., in 
Room 311, Cannon House Office Building, Hon. John Ratcliffe 
[Chairman of the subcommittee] presiding.
    Present: Representatives Ratcliffe, Clawson, and Langevin.
    Mr. Ratcliffe. The Committee on Homeland Security, 
Subcommittee on Cybersecurity, Infrastructure Protection, and 
Security Technologies, will come to order.
    I now recognize myself for an opening statement.
    The subcommittee meets today to hear from key stakeholders, 
including industry, privacy advocates in academia, on the 
President's cybersecurity information-sharing proposal in 
recent cyber initiatives.
    Last week the full committee heard testimony from the 
Department of Homeland Security's top cyber officials on the 
growing cybersecurity threat and how this legislative proposal 
could enhance protection of our digital networks and American's 
most personal information.
    Today we turn to the private sector and look forward to 
hearing from our witnesses on what they think cyber threat-
sharing legislation should look like. For years, the private 
sector has been on the front line battling devastating cyber 
attacks from criminals, activists in nation-states such as 
Iran, China, Russia, and North Korea. Any cyber threat-sharing 
legislation produced by Congress should enhance existing 
capabilities and relationships while establishing procedures to 
safeguard personal privacy.
    Protecting privacy and the integrity of information is what 
compels us to act. The recent cyber breach of health insurance 
giant Anthem exposed the personal information of up to 80 
million Americans, approximately 1 in every 4 Americans, 
demonstrating that the quantity and sophistication of these 
attacks is only increasing.
    Just last week the director of national intelligence, James 
Clapper, underscored this fact, stating that cyber attacks 
against us are increasing in frequency, scale, sophistication, 
and severity of impact and that the methods of attack and the 
systems targeted and the victims are also expanding in 
diversity and intensity on a daily basis.
    He emphasized that privacy and the integrity of information 
are indeed at risk, stating that, ``In the future, we will 
probably see cyber operations that change or manipulate 
electronic information to compromise its integrity instead of 
simply deleting or disrupting access to it.''
    Director Clapper also revealed that, in 2014, America saw 
for the first time destructive cyber attacks carried out on 
U.S. soil by nation-state entities when he confirmed that Iran 
was behind the cyber attack against the Las Vegas Sands 
Corporation, which is owned by a vocal supporter of Israel. 
These breaches are now becoming the norm with attacks on Sony 
Pictures, Target, Home Depot, JPMorgan, and others as evidence 
of that fact.
    FBI director Jim Comey recently stated, ``There are two 
kinds of big companies in the United States, those who have 
been hacked by the Chinese and those who don't know they have 
been hacked by the Chinese.''
    Further, these attacks are not just affecting the largest 
businesses in financial institutions, but small and medium ones 
as well. Accordingly, we need to pass legislation that 
facilitates the sharing of cyber threat indicators and contains 
robust privacy protections to improve collaboration between 
Federal civilian agencies, like the DHS, and the private 
sector.
    The Department of Homeland Security's National 
Cybersecurity and Communications Integration Center, or NCCIC, 
has been at the forefront of working with the private sector to 
facilitate cyber threat sharing between the Government and the 
private sector. NCCIC is a civilian cyber operations center 
with an embedded statutorily-required privacy office.
    In fact, both industry and privacy advocates support NCCIC, 
which was codified into law last year in bipartisan legislation 
produced by this committee. NCCIC has been the lead civilian 
portal for cyber threat sharing between the private sector and 
the Government, and it is important that NCCIC and other 
civilian portals be the focus of any cyber threat-sharing 
legislation.
    Today many companies still choose not to share cyber threat 
indicators with one another or with NCCIC because they fear 
legal liability. Information about an attack experienced by one 
company can enable another to fortify its defenses. Yet, when 
the sharing does not occur, it leaves all of us more vulnerable 
because the same criminals can use the same tactics to target 
other companies, exposing even more Americans to having their 
private information compromised.
    Past legislative attempts to improve cyber threat sharing 
between the private sector and Government and private sector-
to-private sector have failed in large part because they could 
not balance privacy protections with the need for industry to 
share cyber threat indicators. This Congress I look forward to 
working with Chairman McCaul, Ranking Member Thompson, and 
Ranking Member Richmond to craft thoughtful cybersecurity 
legislation that achieves this balance.
    I look forward to hearing from each of the witnesses in 
their respective fields about the opinions on how best this 
committee should move forward on drafting legislation to 
address these issues and what perspectives each of you have on 
the President's recent legislative proposal and cyber 
initiatives.
    Every generation faces monumental moments where its 
tenacity to overcome the challenges of our time are tested. Now 
is our time, as we move deeper into the digital age, to ensure 
that the cybersecurity challenges we face today are met with 
the same resolve shown by previous generations of Americans.
    I want to thank the witnesses for testifying before this 
committee, and I look forward to your testimony.
    [The statement of Chairman Ratcliffe follows:]
                  Statement of Chairman John Ratcliffe
                            February 4, 2015
    The subcommittee meets today to hear from key stakeholders 
including industry, privacy advocates, and academia on the President's 
cybersecurity information sharing proposal and recent cyber 
initiatives. Last week, the full committee heard testimony from the 
Department of Homeland Security's top cyber officials on the growing 
cybersecurity threat and how this legislative proposal could enhance 
protection of our digital networks and Americans' most personal 
information. Today, we turn to the private sector and look forward to 
hearing from our witnesses on what they think cyber threat-sharing 
legislation should look like.
    For years, the private sector has been on the front lines battling 
devastating cyber attacks from criminals, hacktivists, and nation-
states such as Iran, China, Russia, and North Korea. Any cyber threat-
sharing legislation produced by Congress should enhance existing 
capabilities and relationships while establishing procedures to 
safeguard personal privacy.
    Protecting privacy and the integrity of information is what compels 
us to act. The recent cyber breach of health insurance giant Anthem 
exposed the personal information of up to 80 million individuals--
approximately 1 in 4 Americans--demonstrating that the quantity and 
sophistication of these attacks are only increasing. Just last week, 
Director of National Intelligence, James Clapper underscored this fact, 
stating that ``[cyber] attacks against us are increasing in frequency, 
scale, sophistication and severity of impact'' and ``the methods of 
attack, the systems targeted, and the victims are also expanding in 
diversity and intensity on a daily basis.'' He emphasized that privacy 
and the integrity of information are indeed at risk, stating, ``in the 
future, we'll probably see cyber operations that change or manipulate 
electronic information to compromise its integrity instead of simply 
deleting or disrupting access to it.''
    Director Clapper also revealed that in 2014, America ``saw, for the 
first time, destructive cyber attacks carried out on U.S. soil by 
nation-state entities,'' confirming that Iran was behind a cyber attack 
against the Las Vegas Sands Corp., which is owned by a vocal supporter 
of Israel.
    These breaches are becoming the norm, with attacks on Sony 
Pictures, Target, Home Depot, JP Morgan, and many others. FBI Director 
James Comey stated, ``There are two kinds of big companies in the 
United States. There are those who've been hacked by the Chinese and 
those who don't know they've been hacked by the Chinese.'' Further, 
these attacks are not just affecting the largest businesses and 
financial institutions, but small and medium ones as well. As such, we 
need to pass legislation that facilitates the sharing of cyber threat 
indicators and contains robust privacy protections to improve 
collaboration between Federal civilian agencies like DHS and the 
private sector.
    The Department of Homeland Security's National Cybersecurity and 
Communications Integration Center, or NCCIC, has been at the forefront 
working with the private sector to facilitate cyber threat sharing 
between the Government and the private sector. NCCIC is a civilian 
cyber operations center with an embedded statutorily-required privacy 
office. In fact, both industry and privacy advocates support NCCIC, 
which was codified into law last year in bipartisan legislation 
produced by this committee.
    NCCIC has been the lead civilian portal for cyber threat sharing 
between the private sector and the Government and it is important that 
NCCIC and other civilian portals be the focus of any cyber threat-
sharing legislation.
    Today, many companies still choose not to share cyber threat 
indicators with one another or NCCIC because they fear legal liability. 
Information about an attack experienced by one can enable another to 
fortify its defenses. Yet when this sharing does not occur, it leaves 
all of us more vulnerable because the same criminals can use the same 
tactics to target other companies, exposing even more Americans to 
having their private information compromised.
    Past legislative attempts to improve cyber threat sharing between 
the private sector and Government, and private sector-to-private 
sector, have failed in large part because they could not balance 
privacy protections with the need for industry to share cyber threat 
indicators. This Congress, I look forward to working with Chairman 
McCaul, Ranking Member Thompson, and Ranking Member Richmond to craft 
thoughtful cybersecurity legislation that achieves this balance.
    I look forward to hearing from each of the witnesses in their 
respective fields about their opinions on how best this committee 
should move forward on drafting legislation to address these issues and 
what perspectives each of you have on the President's recent 
legislative proposal and cyber initiatives.
    Every generation faces monumental moments where their tenacity to 
overcome the challenges of the time are tested. Now is our time, as we 
move deeper into the digital age, to ensure that the cybersecurity 
challenges we face today are met with the same resolve shown by 
previous generations of Americans.
    I want to thank the witnesses for testifying before this committee 
and I look forward to your testimony.

    Mr. Ratcliffe. Next I will ask for unanimous consent to 
insert into the record the letters received by the committee 
from the following organizations: National Defense Industrial 
Association, American Bankers Association, Retail Industry 
Leaders Association, and the Financial Services Information 
Sharing and Analysis Center. Without objection, so ordered.
    [The information follows:]
        Letter From the National Defense Industrial Association
                                     March 3, 2015.
The Honorable Michael McCaul,
Chairman, Committee on Homeland Security, U.S. House of 
        Representatives.
The Honorable Bennie Thompson,
Ranking Member, Committee on Homeland Security, U.S. House of 
        Representatives.

Dear Chairman McCaul and Ranking Member Thompson: The National Defense 
Industrial Association (NDIA) is a non-partisan, non-profit, 
association with more than 1,600 corporate members and approximately 
90,000 individual members. On March 4, 2015, your committee will hold a 
hearing titled ``Industry Perspectives on the President's Cybersecurity 
Information-Sharing Proposal.'' NDIA has received pertinent comments 
from its membership concerning the President's proposal which I have 
enclosed with this letter. Below is a synopsis of those comments to 
inform your committee hearing.
    The President's Cybersecurity Information-Sharing Proposal 
sometimes uses vague language that makes the legislation subject to the 
reader's interpretation. For example, section 103(c)(2) of the proposal 
states that a private entity receiving cyber threat indicators shall 
take ``reasonable efforts'' to protect the privacy of specific 
individuals and to ``safeguard'' information on specific persons. 
Section 103(c)(3) of the same proposal also uses the term 
``reasonable.'' However, the proposal does not define what is 
``reasonable,'' or what is adequate ``safeguarding.'' These undefined 
terms leave the door open for an enforcing agency or court to step in 
and provide definitions at their discretion, Instead, NDIA proposes 
that any legislation define what is ``reasonable'' or where such a 
definition can be obtained, such as in an industry or Government 
standard. To that end, we recommend that the work done by the National 
Institute of Standards and Technology (NIST) expand to include these 
definitions.
    The President's proposal also contemplates the creation of 
Information Sharing and Analysis Organizations (ISAOs) for the sharing 
of information by private industry. The role of ISAOs is further 
explained by Executive Order 13691, ``Promoting Private Sector 
Cybersecurity Information Sharing.'' Nothing appears to preclude 
existing Information Sharing and Analysis Centers (ISACs) from becoming 
ISAOs, although it is understood that ISAOs encompass a broader need-
specific range of activities. The legislative proposal should explain 
the role of ISACs in the new scheme and positively allow or disallow 
ISACs from becoming ISAOs. The legislative proposal should also explain 
the role of other information sharing efforts, such as the Defense 
Security Information Exchange (DSIE). The new legislation should not 
bring past successful efforts to a premature end.
    Missing from the creation of ISAOs is an explanation of how the 
``stovepiping effect'' prevalent among the ISACs and in other cyber 
sharing efforts can be eliminated. NIST is working hard to arrive at 
generally accepted standards for a ``cybersecurity framework.'' Their 
work should be emulated by having the legislation make clear that the 
government's role is to learn from industry standards and to conform 
itself to industry standards rather than the other way around. For 
example, ``best practices'' should be specifically recognized as 
evolving, and industry should have a mechanism to appeal previously 
determined ``best practices.'' Also, important missing language in the 
proposed legislation's concept of ``information sharing'' is that the 
information sharing should be secure. Otherwise, the value of 
information sharing is negated.
    The proposed legislation's liability protections should include an 
explicit extension of the Support Anti-Terrorism by Fostering Effective 
Technologies (SAFETY) Act. Your Committee previously introduced a bill 
that extended such liability protection, and a similar protection 
should be included in this legislation. The legislation should include 
anti-trust protection for entities that share information. A specific 
concern within the defense industrial base is that existing regulations 
already require breach notification and mandatory information sharing. 
Therefore, the proposed legislation needs to provide, in instances 
where the government requires the sharing or disclosure of information, 
extended liability protection to companies that are affected.
    Thank you for your attention to this letter. NDJA looks forward to 
working with your Committee on this and other important matters 
impacting industry. Please do not hesitate to contact us if you have 
any questions or need any further comments.
            Sincerely,
                                              Jimmy Thomas,
                                    Director of Legislative Policy.
                                 ______
                                 
              Letter From the American Bankers Association
                                     March 3, 2015.
The Honorable John Ratcliffe,
Chairman, Subcommittee on Cybersecurity, Infrastructure Protection, and 
        Security Technologies, Committee on Homeland Security, United 
        States House of Representatives, Washington, DC 20515.
The Honorable Cedric L. Richmond,
Ranking Member, Subcommittee on Cybersecurity, Infrastructure 
        Protection, and Security Technologies, Committee on Homeland 
        Security, United States House of Representatives, Washington, 
        DC 20515.

Dear Chairman Ratcliffe and Ranking Member Richmond: On behalf of the 
members of the American Bankers Association (ABA), I respectfully 
request this letter be included as part of the record for your hearing 
``Industry Perspectives on the President's Cybersecurity Information-
Sharing Proposal.''
    Recent cyber-attacks underscore the need to help all businesses 
improve their awareness of threats and enhance their response 
capabilities. The steps taken by the Administration, through the 
issuance of the February 13, 2015 executive order promoting private 
sector Cybersecurity information sharing, will help the business 
community and government agencies share critical threat information 
more effectively.
    While the recent executive order is an important step towards more 
effective information sharing, it is widely recognized that Congress 
must also act to pass legislation to fill important gaps that executive 
action cannot fill. For instance, legislation is necessary to give 
businesses legal certainty that they have safe harbor against frivolous 
lawsuits when voluntarily sharing and receiving threat indicators and 
countermeasures in real time and taking actions to mitigate cyber 
attacks.
    Legislation also needs to offer protections related to public 
disclosure, regulatory, and antitrust matters in order to increase the 
timely exchange of information among public and private entities. ABA 
also believes that legislation needs to safeguard privacy and civil 
liberties and establish appropriate roles for civilian and intelligence 
agencies. The financial sector is dedicated to protecting customer 
data, and has led the way for effective information sharing through the 
development of the Financial Services Information Sharing and Analysis 
Center (FS-ISAC). We are committed to working with others within the 
overall business community to develop a similarly strong and effective 
mechanism for sharing threat information.
    We share the views of the Financial Services Sector Coordinating 
Council (FSSCC) and the testimony that will be given by Mr. Greg 
Garcia. However, we would like to highlight two important areas within 
the executive order: The acceleration of the DHS security clearance 
process and the establishment of Information Sharing and Analysis 
Organizations (ISAOs).
    Information sharing is of critical importance to the financial 
services sector, other critical infrastructure sectors and the 
government. Without it, none of the financial sector's security and 
resiliency priorities would be achievable. With key federal support 
from the Treasury Department as our Sector Specific Agency, law 
enforcement and DHS, our network defenders are better able to prepare 
for cyber threats when there is a consistent, reliable and sustainable 
flow of actionable Cybersecurity information and analysis, at both a 
classified and unclassified level.
    As a nation, we are making some progress toward this goal, but it 
has become increasingly necessary for appropriately-cleared 
representatives of critical sectors such as financial services to have 
access, and provide contributions, to classified information that 
enables analysts and operators to take timely action to defend 
essential systems. Accordingly, the executive order's enhancement of 
DHS's role in accelerating the security clearance process for critical 
sector owners and operators is a clear indication of the 
Administration's support for this public-private partnership.
    The ISAC's have played an important role for critical 
infrastructure protection information sharing and incident response for 
their sectors. The FS-ISAC, in particular, enjoys strong support from 
sector members, Treasury and DHS. In this spirit, we also support the 
creation of ISAOs as a mechanism for all sectors, regions and other 
stakeholder groups to share Cybersecurity information and coordinate 
analysis and response. While ISACs must retain their status as the 
government's primary critical infrastructure partners, given their 
mandate for broad sectorial representation, the development of ISAOs 
should be facilitated for stakeholder groups that require a 
collaborative cyber and physical threat information sharing capability 
that builds on the strong foundation laid by the ISACs.
    As the ISAO standards development process unfolds, certain 
principles must be upheld for structuring both the ISAOs themselves and 
the government's interaction with them:
   Sharing of sensitive security information within and among 
        communities of trust is successful when operational standards 
        of practice establish clear and enforced information handling 
        rules;
   Information sharing is not a competitive sport: while 
        competition in innovation can improve technical capabilities, 
        operational standards should incentivize federated information 
        sharing. Threat and vulnerability intelligence needs to be 
        fused across trust communities, not diffused or siloed;
   Government internal processes for collecting, analyzing and 
        packaging critical infrastructure protection intelligence for 
        ISAC/ISAO consumption must be streamlined and transparent to 
        maximize timeliness, accuracy and relevance of actionable 
        shared information; and
   To manage scarce resources, government information sharing 
        mechanisms such as the National Cyber and Communications 
        Integration Center (NCCIC) and the Treasury Department's Cyber 
        Intelligence Group (CIG) should prioritize engagements with 
        ISACs and ISAOs according to transparently established 
        criteria.
    It is also important that the process to develop the ISAO standards 
is collaborative, open, and transparent. The process managed by the 
National Institute of Standards and Technology (NIST) during the 
development of the NIST Cybersecurity Framework is an excellent example 
of the appropriate leveraging of private sector input, knowledge and 
experience to develop guidance that will primarily impact non-
governmental entities. We encourage DHS, as the implementing authority 
of the president's EO, to emulate the engagement model that NIST used 
to create and adopt their Cybersecurity Framework. The process worked.
    Finally, for DHS to be successful implementing the EO and its many 
cyber security risk management and partnership authorities, it must be 
sufficiently resourced with the best analytical and technical 
capabilities, with a cadre of highly qualified Cybersecurity leaders 
and analytical teams to conduct its mission. There must be a concerted 
effort to recruit, retain and maintain a world class workforce that is 
able to assess cyber threats globally and help the private sector 
reduce risk to this nation. With the application of the principles 
discussed in this statement, we believe the creation of ISAOs and their 
partnership agreements with DHS have the potential to complement the 
ISAC foundation and measurably improve cyber risk reduction for 
critical infrastructure and the national economy.
    We look forward to working with Congress, the Administration and 
DHS to leverage the FS-ISAC as a successful model in the development of 
regional information sharing and analysis organizations. Above all, we 
urge Congress to send a bill to the president that gives businesses the 
liability and antitrust protections, and our citizens the privacy and 
civil liberty protections that will enhance our already significant 
efforts to protect the Cybersecurity of our nation.
    Although it was not the focal point of the hearing, we understand 
that an issue may be raised about whether or not requiring PINs on 
transactions would be a more effective way to prevent harm to 
consumers. There are some very positive features of PIN transactions, 
but the fact is that the recent data breaches show the limitations of 
PINs as a security feature. The recent breaches demonstrate the danger 
of PINs with debit cards that are directly linked to a person's bank 
account (e.g., through an ATM). It is possible that if a PIN is stolen 
from a retailer's system, a criminal could access the customer's entire 
account and commit fraud.
    Security reporter Brian Krebs wrote that there are recent examples, 
such as with the recent Home Depot breach, of thieves acquiring PINs, 
changing them, and withdrawing cash from customers' accounts.\1\ The 
data also shows that hackers increasingly target PINs. A report by the 
Federal Reserve Bank of Atlanta published in 2012 found that PIN debit 
fraud rates have increased more than threefold since 2004.\2\
---------------------------------------------------------------------------
    \1\ http://krebsonsecurity.com/2014/09/in-wake-of-confirmed-breach-
at-home-depot-banks-see-spike-in-pin-debit-card-fraud/.
    \2\ Federal Reserve Bank of Atlanta (2012) http://bit.ly/16RAPGW.
---------------------------------------------------------------------------
    The security threat we face now is a complex problem that cannot be 
solved by any single technology, standard, mandate or regulation. In 
fact, it cannot be solved by a single sector of society--businesses, 
standards-setting bodies, policymakers, and law enforcement--must work 
together to protect the financial and privacy interests of consumers. 
The attached white paper ``Preventing Data Breaches: Smart Security in 
a Changing Threat Landscape'' which was prepared by the ABA, goes into 
this issue in greater detail. It makes it clear that winning the war 
against criminal hackers will take a forward-looking approach and the 
best technologies. No single security feature is fail-proof and 
including a technology mandate in data breach legislation will only 
provide a false sense of security and not real protection for 
consumers.
            Sincerely,
                                        James C. Ballentine
  Attachment.--Preventing Data Breaches: Smart Security in a Changing 
                            Threat Landscape
                  dynamic cybersecurity for the future
    Recent high-profile data breaches at retailers like Target and Home 
Depot underscore the critical need for stronger and more innovative 
security solutions that protect consumers.
    Dynamic solutions, not rigid one-size-fits-all mandates. Mandates 
stifle innovation in the private sector and hinder the ability to adapt 
and react to evolving threats. While the federal government may believe 
technology mandates are a way to ensure a level of security, the 
private sector--and more importantly, consumers--will be saddled with 
static technology that ultimately makes them vulnerable.
    Investing in security. Banks and payment networks continue to 
invest heavily in the development and implementation of promising new 
technologies capable of protecting consumers everywhere purchases are 
made.
    A common enemy. Both banks and retailers have a role to play in 
fighting criminal hackers who will never stop looking for new ways to 
steal consumers' data.
                     chip technology: why it works
    Debit and credit cards with EMV (Europay MasterCard Visa) or 
``chip'' technology have a microprocessor that protects your personal 
information through encryption--a process that scrambles personal and 
financial data to make it virtually useless to criminals. Whether the 
consumer signs for a purchase or enters a PIN, it is the chip 
technology that enables a more secure payment. Chip technology cards 
are:
    More secure than magnetic stripe cards, because the chip generates 
unique data for each transaction. If that information is stolen, it 
won't be traceable back to the account.
    Nearly impossible to replicate, thanks to the chip's ability to 
create a new, random number for each transaction.
    Coming to a checkout terminal near you. Banks are already issuing 
chip cards, with 120 million cards expected to be in the hands of U.S. 
consumers by the end of 2014, and 575 million cards issued by the end 
of 2015. Javelin Strategy and Research estimates only 10 percent of 
merchants currently have terminals that accept EMV chips. By October 
2015, banks must issue cards with chip capability and retailers must 
have terminals to accept them or they will be liable for fraudulent 
purchases made on the card.
                       it's the chip that matters
    For cards with EMV chip technology, it's the chip that makes the 
card more secure.
    A mandate, such as one requiring chip-enabled cards or PINs, does 
not prevent on-line or mobile fraud. Americans spent $263 billion on-
line last year (most often without a PIN) and that dollar number is 
expected to grow to $414 billion by 2018. Less than 30 percent of 
merchants in the U.S.--both on-line and traditional storefronts--are 
currently equipped to accept a PIN: And some merchants prefer not to. 
As mobile technologies emerge, device passcodes and thumbprints are 
being introduced to benefit the consumer. Security should be dynamic, 
useful and address the realities of an increasingly digital economy, 
not be mandated to a single method.
    A mandate could not have prevented the massive data breaches at 
Target, caused by hackers using malware to steal credentials through 
the company's heating, ventilating, and air conditioning (HVAC) 
contractor. It also would not have prevented breaches at Home Depot, 
and Neiman Marcus, caused by malware installed in checkout terminals. 
However, chip cards would have reduced the value of the compromised 
data by inhibiting the creation of counterfeit cards.
    Criminals will always seek the weakest link. No single security 
feature is fail-proof. Creating a mandate around one static technology 
gives hackers an open invitation to exploit loopholes in the payments 
system.
    No technology is fail-proof. Magnetic stripes have become more 
vulnerable over the years as criminals have found ways to skim the data 
stored in the stripe and replicate it to make fraudulent purchases. 
PINs have their own flaws. A report by the Federal Reserve Bank of 
Atlanta published in 2012 found that PIN debit fraud rates have 
increased more than threefold since 2004. When a PIN is compromised, it 
can open a backdoor for criminals to access and drain consumers' bank 
accounts at an ATM.
      beyond plastic: better security, wherever purchases are made
    EMV chip technology will help protect customers at the register, 
but it's not a silver bullet. Expecting a single technology to 
successfully prevent all fraud is unrealistic, which is why banks and 
payment networks are implementing new technologies that can adapt and 
deploy in a changing threat landscape:
    End-to-end encryption is helping make payments more secure, by 
encoding consumers' information into unreadable formats as it makes its 
way from checkout to card network to the bank and back.
    Tokenization technology replaces sensitive consumer account 
information at the cash register or on-line with a random ``token,'' 
rendering the information useless to criminals. This technology is an 
important feature for some mobile wallets, such as Apple Pay, and can 
be used on-line.
    24/7 fraud protection is already a hallmark of banks, which employ 
teams of experts using advanced computer systems to monitor 
transactions and detect unusual activity indicating a customer's 
account has been hacked.
          the bottom line: fewer mandates, more collaboration
    Mandates hurt consumers because they funnel valuable time and 
resources into static technologies that will become obsolete as cyber 
threats change.
    A mandate could drive up the cost of doing business without 
addressing the fundamental cause of most future data breaches--
inconsistent and outdated security practices within the retailers, 
which was the source of recent high-profile breaches at Target, Home 
Depot, and others.
    The security threat facing the payment card industry is a complex 
problem that cannot be solved by any single technology, standard, 
mandate, or regulation. It cannot be solved by a single sector of 
society--businesses, standards-setting bodies, policymakers, and law 
enforcement--must work together to protect the financial and privacy 
interests of consumers.
    To borrow a concept from Moore's Law of Innovation, every new 
technology is obsolete within 18 months. Data security technologies are 
no exception. Winning the war against cybercrime will take a forward-
looking approach to preventing data breaches anywhere they occur--at 
the register, with a mobile phone or on-line. Money and resources 
should flow to the best technologies to fight these cyber attacks. 
Focusing on just one technology gives a false sense of security at a 
cost that everyone bears.
                                 ______
                                 
          Letter From the Retail Industry Leaders Association
                                 February 25, 2015.
The Honorable Michael McCaul,
Chairman, House Committee on Homeland Security, United States House of 
        Representatives, Washington, DC 20515.
The Honorable Bennie Thompson,
Ranking Member, House Committee on Homeland Security, United States 
        House of Representatives, Washington, DC 20515.

Dear Chairman McCaul and Ranking Member Thompson: On behalf of the 
Retail Industry Leaders Association (RILA), I write to thank you for 
holding today's hearing entitled, ``Examining the President's 
Cybersecurity Information-Sharing Proposal.'' Retailers greatly 
appreciate the Committee's leadership in seeking to find a sensible 
path to address critical cybersecurity issues.
    RILA is the trade association of the world's largest and most 
innovative retail companies. RILA members include more than 200 
retailers, product manufacturers, and service suppliers, which together 
are responsible for more than $1.5 trillion in annual sales, millions 
of American jobs and more than 100,000 stores, manufacturing facilities 
and distribution centers domestically and abroad.
    Retailers embrace innovative technology to provide American 
consumers with unparalleled services and products on-line, through 
mobile applications, and in our stores. While technology presents great 
opportunity, nation states, criminal organizations, and other bad 
actors also are using it to attack businesses, institutions, and 
governments. As we have seen, no organization is immune from attacks 
and no security system is invulnerable. Retailers understand that 
defense against cyber attacks must be an on-going effort, evolving to 
address the changing nature of the threat. RILA is committed to working 
with Congress to give government and retailers the tools necessary to 
thwart this unprecedented attack on the United States (U.S.) economy 
and bring the fight to cyber criminals around the globe.
    As leaders in the retail community, we are taking new and 
significant steps to enhance cybersecurity throughout the industry. To 
that end, RILA formed the Retail Cyber Intelligence Sharing Center (R-
CISC), one component of which is a Retail ISAC, in 2014 in partnership 
with America's most recognized retailers. The Center has opened a 
steady flow of information sharing between retailers, law enforcement 
and other relevant stakeholders. These efforts already have helped 
prevent data breaches, protected millions of American customers and 
saved retailers millions of dollars. The R-CISC is open to all 
retailers regardless of their membership in RILA.
    For years, RILA members have been developing and deploying new 
technologies to achieve pioneering levels of security and service. The 
cyber-attacks that our industry faces change every day and our members 
are building layered and resilient systems to meet these threats. Key 
to this effort is the ability to design systems to meet actual threats 
rather than potentially outdated cybersecurity standards that may be 
enshrined in law. That is why development of any technical 
cybersecurity standards, beyond a mandate for reasonable security, must 
be voluntary and industry-led such as the standards embodied in the 
National Institute of Standards and Technology Cybersecurity Framework. 
RILA members using the Framework have found it to be a helpful tool in 
evaluating their cybersecurity posture and support the continued use of 
voluntary, industry-led processes as a key method of addressing dynamic 
technology challenges.
    One area of cybersecurity that needs immediate attention is payment 
card technology. RILA members have long supported the adoption of 
stronger debit and credit card security protections. The woefully 
outdated magnetic stripe technology used on cards today is the chief 
vulnerability in the payments ecosystem. This 1960s-era technology 
allows cyber criminals to create counterfeit cards and commit fraud 
with ease. Retailers continue to press banks and card networks to 
provide U.S. consumers with the same Chip and PIN technology that has 
proven to dramatically reduce fraud when it has been deployed elsewhere 
around the world. According to the Federal Reserve, PINs on debit cards 
make them 700 percent more secure than transactions authorized by 
signature.\1\
---------------------------------------------------------------------------
    \1\ Federal Reserve, ``2011 Interchange Fee Revenue, Covers Issuer 
Costs, and Covered Issuer and Merchant Fraud Losses Related to Debit 
Card Transactions,'' (March 5, 2013).
---------------------------------------------------------------------------
    Increasing cyber threat information sharing is also vital to 
defeating sophisticated and coordinated cyber actors. RILA strongly 
supports cybersecurity information sharing legislation that provides 
liability protections for participating organizations. That liability 
protection should protect companies that share with appropriate federal 
law enforcement partners like the Secret Service and the FBI to help 
bring cybercriminals to justice. Legislation also should increase 
funding for government-sponsored research into next generation security 
controls and enhance law enforcement capabilities to investigate and 
prosecute criminals internationally. The cyber-attacks faced by every 
sector of our economy constitute a grave national security threat that 
should be addressed from all angles.
    RILA thanks the Committee for holding this important hearing 
examining cyber information sharing legislation and cybersecurity more 
broadly. We look forward to working with you on these vital issues. 
Should you have any additional questions regarding this matter, please 
feel free to contact Nicholas Ahrens, Vice President, Privacy and 
Cybersecurity.
            Sincerely,
                                      Jennifer M. Safavian,
                      Executive Vice President, Government Affairs.
                                 ______
                                 
  Statement of the Financial Services Information Sharing & Analysis 
  Center and the National Council of Information Sharing and Analysis 
                                Centers
                             March 4, 2015
                           fs-isac background
    Chairman Ratcliffe and Members of the subcommittee, my name is 
Denise Anderson. I am vice president, FS-ISAC, government and cross 
sector programs at the Financial Services Information Sharing & 
Analysis Center (FS-ISAC) and chair of the National Council of ISACs 
(NCI). I want to thank you for this opportunity to address the 
Cybersecurity, Infrastructure Protection and Security Technologies 
Subcommittee about the industry perspective on ``Cybersecurity and 
Information Sharing''. I am submitting this testimony for the record as 
I am on travel and regret my inability to take part in this proceeding.
    The FS-ISAC was formed in 1999 in response to the 1998 Presidential 
Decision Directive 63 (PDD 63), which called for the public and private 
sectors to work together to address cyber threats to the Nation's 
critical infrastructures. After 9/11, in response to Homeland Security 
Presidential Directive 7 (its 2013 successor, Presidential Policy 
Directive 21) and the Homeland Security Act, the FS-ISAC expanded its 
role to encompass physical threats to the sector.
    The FS-ISAC is a 501(c)6 nonprofit organization and is funded 
entirely by its member firms and sponsors. In 2004, there were only 68 
members of the FS-ISAC, mostly larger financial services firms. Since 
that time the membership has expanded to almost 5,500 organizations 
including commercial banks and credit unions of all sizes, markets and 
equities firms, brokerage firms, insurance companies, payments 
processors, and 24 trade associations representing virtually all of the 
U.S. financial services sector. The FS-ISAC is a global organization 
and has members in 38 different countries.
                             NCI Background
    The NCI is a voluntary organization of ISACs formed in 2003 in 
recognition of the need for the ISACs to share information with each 
other about common threats and issues. The mission of the NCI is to 
advance the physical and cyber security of the critical infrastructure 
of North America by establishing and maintaining a framework for 
valuable interaction among and between the ISACs and with Government. 
The membership of the NCI is the 18 individual ISACs that represent 
their respective sectors or sub-sectors. The NCI also works closely 
with the other critical infrastructure sectors (CI) that have 
operational arms including chemical, (reforming its ISAC) automotive 
(currently forming an ISAC) and critical manufacturing, among others. 
The NCI has made it a goal to be inclusive of each critical 
infrastructure sector and sub-sector's operational arm.
    The ISACs collaborate with each other daily through the NCI daily 
operations centers cyber call, the NCI secure portal and the NCI 
listserver. The NCI also hosts a weekly operations centers physical 
call and meets monthly to discuss issues and threats. The organization 
is a true cross-sector partnership engaged in sharing cyber and 
physical threats, mitigation strategies and working together and with 
government partners during incidents requiring cross-sector response as 
well as addressing issues affecting industry. In addition to the secure 
portal, the NCI hosts an ISAC threat level dash board, conducts and 
participates in cross-sector exercises, works with the National 
Infrastructure Coordinating Center (NICC) and the National 
Cybersecurity and Communications Integration Center (NCCIC) during 
steady-state and incidents, holds emergency calls as needed and 
develops joint white papers around threats. The ISACs have been 
instrumental in embracing, developing and advancing the automatic 
exchange of data within their memberships and across the ISACs, as well 
as with government as possible.
                   isacs and government partnerships
    ISACs, which are not-for-profit organizations, work closely with 
various Government agencies including their respective Sector Specific 
Agencies (SSAs) where they exist, intelligence agencies, law 
enforcement, and State and local governments. In partnership with the 
Department of Homeland Security (DHS), several ISACs participate in the 
National Cybersecurity and Communications Integration Center (NCCIC) 
watch floor. ISAC representatives, cleared at the Top Secret/Sensitive 
Compartmented Information (TS/SCI) level, attend the daily briefs and 
other NCCIC meetings to share information on threats, vulnerabilities, 
incidents, and potential or known impacts to the critical 
infrastructure sectors. Having ISACs on the floor has allowed for 
effective collaboration on threats and incidents and there have been 
many examples of successful information sharing. The ISACs also serve 
as liaisons to the National Infrastructure Coordinating Center (NICC) 
and play a vital role in incident response and collaboration under the 
Critical Infrastructure Partner Annex to the Incident Management Plan.
    In addition, ISAC representatives sit on the Cyber Unified 
Coordination Group (Cyber UCG). This group was set up under authority 
of the National Cyber Incident Response Plan (NCIRP) and has been 
actively engaged in incident response.
    Finally, it should be noted that the ISACs collaborate with their 
sector coordinating councils as applicable and work with other critical 
infrastructure partners during steady state and incidents.
              the february 2015 executive order and isaos
    The Executive Order, Promoting Private Sector Cybersecurity 
Information Sharing, signed February 15, 2013 by President Obama and 
recently-announced information-sharing legislative proposal are 
commendable in their intent to foster information sharing. Information 
Sharing and Analysis Organizations (ISAOs) were first defined in the 
Homeland Security Act of 2002. ISACs were created under Presidential 
Decision Directive 63 (PDD-63). Effectively ISACs were the original 
ISAOs, are the subject-matter experts in information sharing and a 
majority of ISACs have been in existence for over a decade or more.
    Indeed there is a need for many groups that may not fall in with 
the critical infrastructure sectors such as legal and media and 
entertainment organizations, who are increasingly becoming targets for 
cyber incidents and attacks, to share information. The private sector 
is already organizing efforts in this area and as an example; the FS-
ISAC has been working with the legal industry for almost a year now to 
form an ISAO. Many of the other ISACs, such as the Multi-State ISAC 
(MS-ISAC) and Information Technology ISAC (IT-ISAC) have also been 
engaging industries that do not have established information-sharing 
forums such as the Retail sector, which is actively forming an ISAC.
    However ISACs are much more than ISAOs. They serve a special role 
in critical infrastructure protection and resilience and play a unique 
role in the sector partnership model. While the White House has noted 
that the EO seeks to ``not limit effective existing relationships that 
exist between the Government and the private sector'' the recent EO and 
prominent coverage of ISAOs has led to some confusion within industry 
as to the impacts to ISACs. It is absolutely essential that the 
successful efforts that the ISACs have established over the years 
should not be disrupted. It is clear that the ISACs by their success 
meet the distinct and unique needs of each of their sectors and the 
owner and operator members of those sectors.
    The solution to easing this confusion is very simple. The White 
House, SSAs--including DHS--and other relevant agencies need to call 
out, recognize, and support the unique role ISACs play in critical 
infrastructure protection and resilience. For instance, ISACs have the 
responsibility to maintain sector-wide threat awareness within their 
respective sectors. It is critical that our Federal partners continue 
to respect and support that role to avoid undermining one of the main 
duties of ISACs to their members and sectors. It is vital that the 
process is not diluted and remains streamlined to facilitate effective 
situational awareness and response activities particularly when an 
incident occurs.
    One of the greatest strengths of ISACs is the productive 
information sharing that occurs by having robust trusted networks of 
members. Government should support private-sector efforts to form ISACs 
in those very few critical infrastructure sectors where ISACs do not 
currently exist, and where they do, regularly and consistently 
encourage owner/operators to join their respective ISACs. This has been 
very effective in the financial sector where the United States 
Department of the Treasury, the regulators, and State agencies have 
been strongly encouraging membership in the FS-ISAC as a best practice. 
Currently, not all of the SSAs support their sector-designated ISACs in 
the same manner.
    Attached is an appendix, which lists out some 20 points as to why 
ISACs are more than ISAOs.
                      creating standards for isaos
    The Executive Order also calls for the drafting of a set of 
voluntary standards. The NCI believes that having an established set of 
capabilities is important and currently has a baseline set of criteria 
that ISACs must meet in order to be members of the Council. But it is 
essential that information-sharing organizations have the flexibility 
and ability to meet the unique needs of its sector and members. 
Although all ISACs have similar missions, no two ISACs are exactly 
alike.
    Any criteria that are developed must be done in concert with the 
private sector and must be upheld by the private sector in order to be 
effective. ISACs and ensuing ISAOs are private-sector organizations. 
Any attempt by Government to oversee or mandate what these 
organizations produce and how they collaborate would eliminate 
information sharing and almost two decades of progress. In the face of 
growing, targeted and sophisticated threats, rendering proven 
information-sharing efforts ineffective would not only be a grave 
consequence, it would run contrary to the spirit of the drafting of the 
EO: To promote private-sector cybersecurity information sharing.
    The NCI has a strong history of mentoring and supporting the 
establishment of several new ISACs such as Aviation, Retail, and 
Automotive and the re-formation of the Oil and Gas ISAC. ISACs fostered 
by activities developed and sponsored by the NCI are robustly sharing 
among their peer ISACs and partners, items such as best practice guides 
and toolkits that ISACs can replicate and provide to their members for 
free.
    These activities reflect a powerful force in organizational 
information sharing and collaboration that the EO fails to contemplate 
and appears to attempt to recreate through the development of a 
standards organization. Any focus on ISAOs and ISAO standards must be 
implemented carefully as not only to encourage and foster information 
sharing and analytical maturity among newly-established organizations, 
but also clearly publish, highlight, and fully leverage and emulate 
aspects of the status quo that are working and have been working for 
quite some time.
                     effective information sharing
    It is important to note that the goal of information sharing is not 
to share information in and of itself but to create situational 
awareness in order to inform risk-based decisions as well as allow 
operational components within owner/operation organizations that have 
direct actionable control over the content they are sharing, to perform 
an action. The focus needs to be on enhancing the ability of 
operational groups to work closely with each other.
    The ISACs are successful organizations with almost two decades of 
proven cases studies of information sharing and collaboration. They are 
the subject-matter experts on information sharing. In order for 
information sharing to be effective it must be:
   Voluntary--not mandated or regulated
   Industry Driven
   Actionable, Timely and Relevant
   Bi-directional and Collaborative

    Government can help this effort by:
   Recognizing ISACs and the special operational role that they 
        play in critical infrastructure protection and resilience;
   Supporting private-sector efforts to form ISACs in the very 
        few critical infrastructure sectors where they do not currently 
        exist;
   Encourage owners and operators of critical infrastructure to 
        join their respective sector ISACs;
   Facilitate getting all of the ISACs on the NCCIC floor. 
        After 4 years this still has not been accomplished;
   Recognize the NCI as the coordinating body for the ISACs.
    This concludes my written statement for the record. Thank you again 
for the opportunity to present this testimony and I look forward to 
your questions.
           Appendix: 20 Reasons Why ISACS are More Than ISAOS
   ISACs are all-hazards and address both cyber and physical 
        threats and incidents
   ISACs are the designated operational arms of their sectors
   ISACs play a critical industry- and Government-recognized 
        role in critical infrastructure incident response
   ISACs have reach into their sectors and in many cases are 
        relied upon as the threat and incident communications channel 
        for their respective sectors
   ISACs provide annonymization and aggregation of data for 
        their sectors
   ISACs provide a sector perspective on threats and incidents 
        and provide sector-specific analysis
   ISACs set or manage threat levels for their respective 
        sectors
   ISACs perform structured collaboration across the sectors
   ISACs conduct joint analysis to develop joint products on 
        specific threats and incidents
   ISACs serve an operational role in the National partnership 
        framework
   Many ISACs have security operations centers that monitor 
        threats, vulnerabilities, and incidents and provide analysis 
        for sector threat potential and impact
   ISACs are not-for-profit organizations that are not in the 
        business to sell information but to facilitate it
   ISACs meet the unique needs of their respective members/
        sectors
   Most ISACs are global and are not just focused on the United 
        States. Many have global partnerships
   ISACs have a vetting process for members to qualify to join
   ISACs are organized and run by the owners and operators of 
        critical infrastructure
   ISACs have a formal governance structure
   ISACS facilitate bi-directional information sharing on 
        incidents, information, and intelligence within and among the 
        sectors.
   ISACs are designated operational entities within sectors to 
        enhance efficiency and coordination of information sharing and 
        incident response.

    Mr. Ratcliffe. The Chairman now recognizes the gentleman 
from Rhode Island, Mr. Langevin, for an opening statement.
    Mr. Langevin. Thank you, Mr. Chairman.
    I know that Ranking Member Richmond is on his way, and on 
his behalf I will just welcome our witnesses.
    In particular, I want to acknowledge Greg Garcia, whom I 
worked with when I chaired this subcommittee many years ago and 
when you had the Department of Homeland Security.
    I thank all of you for your work. I know in one way or 
another I have had the opportunity to interact with all of our 
witnesses. Thank you for the work you are doing to better 
protect our country. I look forward to hearing your perspective 
here today.
    Mr. Chairman, I especially want to commend you for holding 
this hearing today. Thank you for giving the information-
sharing and data breach issues the attention that it needs and 
deserves. Hearing from expert witnesses I know will move this 
issue ahead further.
    Obviously, there is no one answer to solving our 
cybersecurity challenges. It is never a problem to be solved, 
as I have said many times, but it is a problem to be managed, 
and we have to do a much better job of getting to a place where 
we are much better protected in cyber space than where we are. 
We can close that air of vulnerability down to something much 
more manageable.
    It won't be just a Government answer, of course, and it is 
not going to be just private sector. It is going to take that 
collaboration of us working together to solve this and deal 
with this incredible challenge.
    So, with that, I will yield back.
    I thank our witnesses in advance for being here and what 
they are about to say.
    Thank you, Mr. Chairman. I yield back.
    Mr. Ratcliffe. I thank the gentleman. I remind other 
Members that additional statements may be submitted for the 
record.
    [The statement of Ranking Member Richmond follows:]
             Statement of Ranking Member Cedric L. Richmond
                             March 4, 2015
    Our infrastructure is more digitally interconnected than ever. Our 
country's reliance on cyber systems and networks covers everything from 
power plants to pipelines, and hospitals to highways. Yet for all the 
advantages interconnectivity offers, our Nation's critical 
infrastructure is also increasingly vulnerable to attack from an array 
of cyber threats.
    We are to hear testimony today on how we can be better prepared for 
these threats. The President has proposed an updated package of 
legislative initiatives to frame the issues, and hopefully spur 
Congress to action on cybersecurity. Last year this subcommittee was 
the author of important authorizations that gave the Department sound 
footing to carry out its mission as the central civilian portal for 
information sharing between critical infrastructure sectors and the 
Government.
    It is widely recognized that more is needed, and the President's 
initiatives do indeed go further. Senator Carper, Ranking Member on the 
Senate Homeland Security and Government Affairs Committee, has already 
introduced almost a word-for-word version of the White House 
information-sharing language as S. 456, The Cyber Threat Sharing Act of 
2015.
    Hacks on major businesses and financial institutions continue to 
dominate headlines. Just a few weeks after Anthem insurance announced 
that account information of as many as 80 million customers had been 
stolen, we are all waiting for the next shoe to fall.
    The President's proposal seeks to create a friendlier atmosphere 
for companies to swap certain types of computer data with each other 
and the Government, in order to identify potential cyber threats and 
isolate security flaws. To persuade companies to buy into the proposed 
system, the White House bill would provide assurances that the sharing 
of indicators--which could include things like IP addresses, routing 
information, and date and time stamps deemed important to identifying 
potential cyber threats or security vulnerabilities--would be exempt 
from legal or regulatory punishment. The President's proposals contain 
some new ideas about the formation of information-sharing organizations 
that would set sharing standards and privacy requirements.
    Since the `90s, firms have shared information directly on an ad hoc 
basis and through private-sector, nonprofit organizations, such as 
Information Sharing and Analysis Centers, or ISACs that can analyze and 
disseminate information. The White House proposal requires the 
Secretary of Homeland Security to form a new type of organization, the 
Information Sharing and Analysis Organizations, or ISAOs.
    We need to know what kinds of barriers to information sharing exist 
today, and how we on this subcommittee can help make this cyber tool 
more effective. For our side, information sharing must be structured in 
the public and private sectors to ensure that the risks to privacy 
rights and civil liberties of individual citizens be recognized, and 
how those rights and liberties can best be protected. Today, hopefully 
we'll find answers to some of these questions.
    We live in a post-Snowden world, and we are all much more aware of 
the powerful abilities of our surveillance agencies. Information 
sharing is not a zero-sum game. As policy makers we can step back and 
take stock of how best to protect our citizen's privacy rights, while 
finding effective and powerful tools to combat the cyber threats before 
us.

    Mr. Ratcliffe. We are pleased to have with us a 
distinguished panel of witnesses today on this very important 
topic. I would ask all of you to stand, if you would, and raise 
your right hand.
    [Witnesses sworn.]
    Mr. Ratcliffe. Thank you. You may be seated.
    Our witnesses today--we have with us Mr. Matthew Eggers. He 
is the senior director for national security and emergency 
preparedness at the U.S. Chamber of Commerce.
    Mr. Eggers, good to see you again.
    Mr. Eggers. Good to see you.
    Mr. Ratcliffe. Also with us is Ms. Mary Ellen Callahan. She 
is a partner at Jenner & Block and is the former chief privacy 
officer at the Department of Homeland Security.
    Welcome, Ms. Callahan.
    Also with us is Mr. Greg Garcia. He is the executive 
director of the Financial Services Sector Coordinating Council.
    Mr. Garcia, we appreciate you coming to see us today.
    Then, finally, last, but not least, Dr. Martin Libicki is 
the senior management scientist at The RAND Corporation.
    Dr. Libicki, thank you for being here as well.
    The witnesses' full statements will appear in the record.
    The Chairman now recognizes Mr. Eggers for 5 minutes to 
testify.

   STATEMENT OF MATTHEW J. EGGERS, SENIOR DIRECTOR, NATIONAL 
 SECURITY AND EMERGENCY PREPAREDNESS, U.S. CHAMBER OF COMMERCE

    Mr. Eggers. Good afternoon, Chairman Ratcliffe and other 
distinguished Members of the subcommittee.
    My name is Matthew Eggers. I lead the U.S. Chamber 
Cybersecurity Working Group, which has about 200 members, and 
it is growing virtually daily. Before talking about the cyber 
information-sharing proposals, I want to note that my written 
statement highlights the successful roll-out of the NIST 
framework.
    The Chamber's proudly launched its own cyber campaign under 
the banner of improving today, protecting tomorrow. In 2014, we 
organized several roundtables across the country. The events 
featured State and local chambers and principals from the White 
House, DHS, NIST, as well as local FBI and Secret Service 
officials. More roundtables are being planned this year.
    The framework would be incomplete without enacting 
legislation that removes legal and regulatory barriers to 
quickly exchanging data about threats to U.S. companies. Let's 
consider CISA and the White House proposal or the Carper bill, 
S. 456.
    First, the draft Cybersecurity Information Sharing Act of 
2015, or CISA. In January, 35 associations, including the 
Chamber, urged the Senate to quickly pass the cyber info-
sharing bill modeled after the bipartisan CISA bill that 
Senators Feinstein and Chambliss championed last year.
    The first version of CISA stalled, unfortunately. A draft 
CISA, 2.0, if you will, sponsored by Senators Burr and 
Feinstein, is expected to be marked up soon. It reflects 
practical compromises among many stakeholders. We need to focus 
our collective legislative negotiations on CISA.
    CISA would give businesses legal certainty that they have 
safe harbor against frivolous lawsuits when voluntarily sharing 
and receiving cyber threat indicators, or CTIs, and 
countermeasures in real time with private and public entities 
and when monitoring information systems to mitigate cyber 
attacks.
    CISA would also offer protections related to public 
disclosure, (direct) regulatory, and anti-trust matters. Under 
CISA, businesses must remove personal information from threat 
indicators before sharing them.
    Second, the White House cybersecurity legislative proposal, 
or S. 456, the Cyber Threat Sharing Act of 2015. Senator Tom 
Carper introduced S. 456 about 3 weeks ago. I focus, in part, 
on this bill because it is very similar to the White House's 
January 13 cyber information-sharing proposal and it has been 
introduced.
    In contrast to CISA, White House/Carper would grant 
liability protections to companies only when sharing CTIs with 
DHS's NCCIC and ISAOs, or Information Sharing and Analysis 
Organizations, that have self-certified that they are following 
certain information-sharing practices which have not yet been 
established and won't be for some time.
    DHS is to sponsor an outside organization to determine what 
would constitute cyber info-sharing standards or best 
practices, even though leading sectors tell us that they 
already have them. The bottom line: The ISAOs-plus-standards-
setting effort warrants scrutiny before our organization 
supports it.
    Also, unlike CISA, businesses would not be protected under 
White House/Carper when monitoring information systems and 
sharing and receiving countermeasures. The White House/Carper 
bill would not write anti-trust protections into the Federal 
law.
    The lack of safeguards and protections in all of these 
areas would deter industry from participating in these 
information-sharing programs for fear of litigation or 
liability, whether at the Federal or the State levels.
    CISA and White House/Carper do share some common features 
especially in the area of privacy and civil liberties 
protection. Both CISA and the White House/Carper proposal 
narrowly define what cyber threat indicators may be shared 
among private and Government entities.
    CISA and White House/Carper require that businesses remove 
personal information from CTIs before sharing them. Like CISA, 
the White House/Carper bill would tightly limit how the Federal 
Government could use threat indicators that agencies receive.
    In sum, when comparing CISA with White House/Carper, CISA 
offers a more dynamic way to share cyber threat data among many 
businesses and Government entities, coupled with strong 
liability and related protections.
    CISA would go the furthest in helping businesses, including 
critical infrastructure, defend information systems against 
cyber attacks while protecting privacy.
    CISA is meant to help counter serious malicious attacks 
aimed at America that are being launched from threats like 
organized crime and state-sponsored groups.
    Getting an information-sharing bill signed into law this 
year, one that would actually incentivize industry to 
participate, not back away, is the Chamber's top cyber 
legislative priority.
    Again, thank you for inviting me to be here today. I would 
be happy to answer any questions. Thank you.
    [The prepared statement of Mr. Eggers follows:]
                Prepared Statement of Matthew J. Eggers
                             March 4, 2015
    Good morning, Chairman Ratcliffe, Ranking Member Richmond, and 
other distinguished Members of the committee. My name is Matthew 
Eggers, and I am a senior director of the U.S. Chamber's National 
Security and Emergency Preparedness Department. On behalf of the 
Chamber, I welcome the opportunity to testify before the Subcommittee 
on Cybersecurity, Infrastructure Protection, and Security Technologies 
regarding industry's perspectives on the President's cybersecurity 
information-sharing proposal.
    The Chamber's National Security and Emergency Preparedness 
Department was established in 2003 to develop and implement the 
Chamber's homeland and National security policies. The department works 
through the National Security Task Force, a policy committee composed 
of roughly 200 Chamber members representing practically every sector of 
the American economy. The task force's Cybersecurity Working Group, 
which I lead, identifies current and emerging issues, crafts policies 
and positions, and provides analysis and direct advocacy to Government 
and business leaders. Industry's interest in cybersecurity is healthy 
and expanding--individuals join the working group almost daily.
    The need to address increasingly sophisticated threats against U.S. 
and global businesses has gone from an IT issue to a top priority for 
the C-suite and the boardroom. Chamber President and CEO Thomas J. 
Donohue recently said, ``In an interconnected world, economic security 
and national security are linked. To maintain a strong and resilient 
economy, we must protect against the threat of cyberattacks.''
    My statement highlights the successful rollout of the National 
Institute of Standards and Technology's (NIST's) Framework for 
Improving Critical Infrastructure Cybersecurity (the framework)\1\ and 
the positive collaboration that many businesses and Government entities 
have developed over the past several months, including the Chamber's 
cybersecurity campaign--Improving Today. Protecting 
TomorrowTM.
---------------------------------------------------------------------------
    \1\ See www.nist.gov/cyberframework.
---------------------------------------------------------------------------
    I am also going to focus on policy issues--information-sharing 
legislation being the top legislative priority--that lawmakers and the 
administration need to diligently address. The information-sharing 
discussion puts too little emphasis on improving Government-to-business 
sharing. The Chamber wants to expand Government-to-business information 
sharing, which is progressing but needs improvement.\2\
---------------------------------------------------------------------------
    \2\ The Chamber submitted in October 2014 similar comments to the 
National Institute of Standards and Technology (NIST) related to 
businesses' awareness and use of the framework. See http://
csrc.nist.gov/cyberframework/rfi_comments_10_2014.html.
---------------------------------------------------------------------------
    The framework is a good start, but more work is needed to push back 
against skilled attackers. Most small and mid-size businesses (SMBs) 
tend to lack the money and personnel to beat back highly-advanced and 
nefarious actors, such as organized criminal gangs and groups carrying 
out state-sponsored attacks. No single strategy can prevent advanced 
and persistent threats--popularly known as APTs in cybersecurity 
jargon--from breaching an organization's cyber defenses.
    Policymakers have not sufficiently acknowledged this expensive, 
practical reality. American companies should not be expected to 
shoulder the substantial costs of cyber attacks emanating from well-
resourced bad actors such as criminal syndicates or nation-states--
costs typically absorbed by national governments. Nation-states or 
their proxies and other sophisticated actors are apparently hacking 
businesses with impunity--and that has got to stop.
    In addition to having policymakers acknowledge cost concerns, the 
Chamber would welcome working with the administration and Congress on 
establishing an intelligent and forceful deterrence strategy, utilizing 
an array of U.S. policy tools, which the United States currently lacks. 
U.S. policymakers need to focus on pushing back against illicit actors 
and not on blaming the victims of cybersecurity incidents.\3\
---------------------------------------------------------------------------
    \3\ The Chamber submitted comments to the Department of Homeland 
Security (DHS) on cybersecurity solutions for small and mid-size 
businesses (SMBs) in April 2014.
---------------------------------------------------------------------------
 the framework is an excellent example of an effective public-private 
  partnership. critical infrastructure awareness of the framework is 
         strong, and sector activities are robust and maturing
    The Chamber believes that the framework--which was released last 
February--has been a success. The framework represents one of the best 
examples of public-private partnerships in action. NIST and 
stakeholders in the public and private sectors should have a great 
sense of accomplishment. The Chamber, sector-based coordinating 
councils and associations, companies, and other entities collaborated 
closely with NIST in developing the framework since the first workshop 
was held in April 2013.
    Critical infrastructure sectors are keenly aware of and supportive 
of the framework. The Chamber understands that critical infrastructures 
at ``greatest risk'' have been identified and engaged by administration 
officials under the terms of the cyber executive order (EO).\4\ 
Government officials ought to ensure that all resources, particularly 
the latest cyber threat indicators (CTIs), are available to these 
enterprises to counter increasing and advanced threats.
---------------------------------------------------------------------------
    \4\ Executive Order (EO) 13636, Improving Critical Infrastructure 
Cybersecurity, is available at www.gpo.gov/fdsys/pkg/FR-2013-02-19/pdf/
2013-03915.pdf.
---------------------------------------------------------------------------
    Further, important elements of U.S. industry are aware of the 
framework and are using it or similar risk management tools. Indeed, 
the Chamber welcomed an assessment from Michael Daniel, White House 
special assistant to the President and cybersecurity coordinator, who 
remarked on September 23, 2014, at the Chamber's third cyber roundtable 
in Everett, Washington, that industry's response to the framework has 
been ``phenomenal.''
    A second White House official, Ari Schwartz, senior director for 
cybersecurity, noted on October 1, 2014, that business support for the 
framework has ``exceeded expectations.'' Such recognition is 
constructive and helps keep the private sector engaged in using the 
framework and promoting it with business partners.\5\
---------------------------------------------------------------------------
    \5\ See ``At eight-month mark, industry praises framework and eyes 
next steps,'' Inside Cybersecurity, October 6, 2014, http://
insidecybersecurity.com/Cyber-Daily-News/Daily-News/at-eight-month-
mark-industry-praises-framework-and-eyes-next-steps/menu-id-1075.html.
---------------------------------------------------------------------------
    Much of industry's favorable reaction is owed in large measure to 
NIST, which tackled the framework's development in ways that ought to 
serve as a model for other agencies and departments. In May 2014, the 
administration sent the business community a powerful message, saying 
that the framework should remain collaborative, voluntary, and 
innovative over the long term.\6\ Interestingly, public focus on the 
framework has created visibility into industry's long-standing efforts 
to address cyber risks and threats--constant, dedicated, and mostly 
silent efforts that preceded the creation of the framework.\7\
---------------------------------------------------------------------------
    \6\ The Chamber agrees with Michael Daniel's May 22 blog, Assessing 
Cybersecurity Regulations, at www.whitehouse.gov/blog/2014/05/22/
assessing-cybersecurity-regulations. The blog says that business and 
Government ``must build equally agile and responsive capabilities not 
bound by outdated and inflexible rules and procedures.'' The Chamber 
and industry partners especially urge independent agencies and Congress 
to adhere to the dynamic approach advocated by the administration and 
embodied in the nonregulatory, public-private framework. See June 11, 
2014, multiassociation letter, which is available at www.uschamber.com/
sites/default/files/documents/files/11June14GroupLetterT-
YReplytoDanielCyberBlog_Final_0.pdf.
    \7\ The on-line publication Inside Cybersecurity provides an 
excellent catalog of industry initiatives to implement data- and 
network-security best practices. See http://insidecybersecurity.com/
Sectors/menu-id-1149.html.
---------------------------------------------------------------------------
    Most notable, since the framework's release, industry has 
demonstrated its commitment to using it. Many associations are creating 
resources for their members and holding events across the country and 
taking other initiatives to promote cybersecurity education and 
awareness of the framework. Some examples are listed here. Associations 
are planning and exploring additional activities as well.
   The Alliance of Automobile Manufacturers and the Association 
        of Global Automakers have initiated a process to establish an 
        automobile industry sector information-sharing and analysis 
        center (Auto-ISAC) to voluntarily collect and share information 
        about existing or potential threats to the cybersecurity of 
        motor vehicle electronics and in-vehicle networks.
   The American Chemistry Council (ACC) is developing sector-
        specific guidance based on the NIST cyber framework to further 
        enhance and implement the council's Responsible Care Security 
        Code. ACC's Chemical Information Technology Center (ChemITC) is 
        also piloting an ISAC for the chemical sector.
   The American Gas Association (AGA) has hosted a series of 
        webinars on control system cybersecurity, is collaborating with 
        small utilities to develop robust cybersecurity programs, and 
        is working with companies to review and enhance their 
        cybersecurity posture using the Oil and Natural Gas Subsector 
        Cybersecurity Capability Maturity Model (ONG-C2M2) from the 
        Department of Energy (DOE). Among other activities, AGA has 
        stood up the Downstream Natural Gas Information and Analysis 
        Center (DNG-ISAC), an ISAC designed to help support the 
        information-sharing interests of downstream natural gas 
        utilities.
   The American Hotel & Lodging Association (AH&LA) has 
        conducted a series of widely-attended cyber and data security 
        webinars to assist small, medium, and large hotel and lodging 
        businesses with implementing key information security measures 
        and risk assessments.
   The American Water Works Association (AWWA) has created 
        cybersecurity guidance and a use-case tool to aid water and 
        wastewater utilities' implementation of the framework. The 
        guidance is cross-referenced to the framework. This tool serves 
        as implementation guidance for the framework in the water and 
        wastewater systems sector.
   Members of the Communications Sector Coordinating Council 
        (CSCC)--made up of broadcasting, cable, wireline, wireless, and 
        satellite segments--have participated in multiple NIST, 
        Department of Homeland Security (DHS), and industry 
        association-sponsored programs, webinars, and panels. The 
        sector is completing a year-long effort within the Federal 
        Communication Commission's (FCC's) Communications Security 
        Reliability and Interoperability Council (CSRIC), which 
        involves more than 100 professionals who have worked to adapt 
        the NIST framework to the sector segments and provide guidance 
        to the industry.
   The Electricity Subsector Coordinating Council has worked 
        with DOE to develop sector-specific guidance for using the 
        framework. The guidance leverages existing subsector-specific 
        approaches to cybersecurity, including DOE's Electricity 
        Subsector Cybersecurity Risk Management Process Guideline, the 
        Electricity Subsector Cybersecurity Capability Maturity Model, 
        NIST's Guidelines for Smart Grid Cyber Security, and the North 
        American Electric Reliability Corporation's (NERC's) Critical 
        Infrastructure Protection Cybersecurity Standards.
   The mutual fund industry, represented by the Investment 
        Company Institute (ICI), has added to its committee roster a 
        Chief Information Security Officer Advisory Committee. The 
        committee's mission is to collaborate on cybersecurity issues 
        and information sharing in the financial services industry and 
        provide a cyber threat protection resource for ICI members.
   The Information Technology Industry Council (ITI) visited 
        Korea and Japan in May 2014 and shared with these countries' 
        governments and business leaders the benefits of a public-
        private partnership-based approach to developing globally 
        workable cybersecurity policies. ITI highlighted the framework 
        as an example of an effective policy developed in this manner, 
        reflecting global standards and industry-driven practices. ITI 
        principals also spoke at a U.S.-European Union (EU) workshop in 
        Brussels in November 2014, comparing U.S. and E.U. policy 
        approaches with cybersecurity and emphasizing the positive 
        attributes of the framework and its development.
   The National Association of Manufacturers (NAM) has 
        spearheaded the D.A.T.A. (Driving the Agenda for Technology 
        Advancement) Policy Center, providing manufacturers with a 
        forum to understand the latest cybersecurity policy trends, 
        threats, and best practices. The D.A.T.A. Center focuses on 
        working with small and medium-size manufacturers to help them 
        secure their assets.
   Through the American Petroleum Institute (API), the oil and 
        natural gas sector has worked with DOE to complete the Oil and 
        Natural Gas Subsector Cybersecurity Capability Maturity Model 
        (ONG-C2M2). The oil and natural gas sector in 2014 established 
        an Oil and Natural Gas Information Sharing and Analysis Center 
        (ONG-ISAC) to provide shared intelligence on cyber incidents, 
        threats, vulnerabilities, and responses throughout the 
        industry.
   The Retail Industry Leaders Association (RILA), in 
        partnership with the National Retail Federation (NRF), created 
        the Retail Cyber Intelligence Sharing Center (R-CISC), 
        featuring information sharing, research, and education and 
        training. This ISAC enables retailers to share threat data 
        among themselves and to receive threat information from 
        Government and law enforcement partners.
   The U.S. Chamber of Commerce has launched its National 
        roundtable series, Improving Today. Protecting 
        TomorrowTM, recommending that businesses of all 
        sizes and sectors adopt fundamental internet security 
        practices.
 policymakers need to focus on passing information-sharing legislation 
 and deterring foreign attackers. the chamber's cybersecurity campaign 
                         enters its second year
    The NIST framework is designed to help start a cybersecurity 
program or improve an existing one. The framework puts cybersecurity 
into a common language for organizations to better understand their 
cybersecurity posture, set goals for cybersecurity improvements, 
monitor their progress, and foster communications with internal and 
external stakeholders. Looking ahead to 2015, the Chamber's 
cybersecurity campaign intends to focus on several areas, including the 
following:
    Improving information sharing is job No. 1. The framework would be 
incomplete without enacting information-sharing legislation that 
removes legal and regulatory barriers to quickly exchanging data about 
threats to U.S. companies.
   Draft Cybersecurity Information Sharing Act (CISA) of 
        2015.--On January 27, 35 associations, including the Chamber, 
        urged the Senate to quickly pass a cybersecurity information-
        sharing bill.\8\ The Senate Intelligence Committee passed in 
        July 2014 S. 2588, the Cybersecurity Information Sharing Act 
        (CISA) of 2014, a smart and workable bill, which earned broad 
        bipartisan support.
---------------------------------------------------------------------------
    \8\ The coalition letter is available at www.uschamber.com/sites/
default/files/150127_multi-association_cyber_info-
sharing_legislation_senate.pdf.
---------------------------------------------------------------------------
    The committee released in February a new draft bill--CISA 2015--for 
        stakeholder review. Recent cyber incidents underscore the need 
        for legislation to help businesses improve their awareness of 
        cyber threats and enhance their protection and response 
        capabilities.
    The Chamber urges Congress to send a bill to the President that 
        gives businesses legal certainty that they have safe harbor 
        against frivolous lawsuits when voluntarily sharing and 
        receiving threat indicators and countermeasures in real time 
        with multiple private and public entities, as well as when 
        monitoring information systems to mitigate cyberattacks.
    The legislation also needs to offer protections related to public 
        disclosure, regulatory, and anti-trust matters in order to 
        increase the timely exchange of technical CTIs and 
        countermeasures among public and private entities.
    The Chamber further believes that legislation needs to safeguard 
        privacy and civil liberties and establish appropriate roles for 
        civilian and intelligence agencies. For example, businesses 
        must remove personal information from CTIs before sharing them. 
        Private entities must share ``electronic mail or media, an 
        interactive form on an internet website, or a real time, 
        automated process between information systems'' with DHS--a 
        civilian entity--if they are to be offered protection from 
        liability.
    CISA, which is sponsored by Sens. Richard Burr and Dianne 
        Feinstein, reflects practical compromises among many 
        stakeholders on these issues. At the time of this writing, the 
        measure is expected to be marked up the week of March 9. The 
        Chamber looks forward to reviewing the bill following the mark-
        up to determine its support for the base measure and any 
        amendments. Industry is likely to strongly support CISA.
   White House cybersecurity legislative proposal (S. 456, the 
        Cyber Threat Sharing Act of 2015).--On February 11, S. 456, the 
        Cyber Threat Sharing Act of 2015, was introduced in the Senate 
        by Sen. Tom Carper. It makes sense to refer to S. 456 because 
        it is very similar to the White House's cybersecurity 
        information-sharing proposal, which was discussed at last 
        week's House Homeland Security Committee hearing, and released 
        by the administration on January 13.\9\
---------------------------------------------------------------------------
    \9\ http://homeland.house.gov/hearing/hearing-administration-s-
cybersecurity-legislative-proposal-information-sharing; 
www.whitehouse.gov/omb/legislative_letters (see January 13, 2015).
---------------------------------------------------------------------------
    CISA offers strong protections and flexible avenues for sharing 
        with public and private entities. In contrast, S. 456 would 
        grant liability protections to companies only when sharing CTIs 
        with (1) DHS' National Cybersecurity and Communications 
        Integration Center (NCCIC)--excluding law enforcement agencies, 
        among others--or with (2) information-sharing and analysis 
        organizations (ISAOs) that have self-certified that they are 
        following information-sharing best practices. (The implications 
        of the ISAOs and the new White House executive order \10\ 
        related to promoting cybersecurity information sharing, which 
        directs DHS to sponsor an ISAO standards organization to 
        establish a common set of voluntary standards for creating and 
        operating ISAOs, have not been fully assessed by industry.)
---------------------------------------------------------------------------
    \10\ www.whitehouse.gov/the-press-office/2015/02/13/executive-
order-promoting-private-sector-cybersecurity-information-shari.
---------------------------------------------------------------------------
    These two protected avenues for sharing CTIs are far too narrow and 
        limiting and do not reflect the information-sharing 
        relationships that businesses have built up over time, for 
        instance, with DHS, the Departments of Energy and Treasury, and 
        law enforcement agencies.
    Unlike CISA, businesses would not be protected under S. 456 when 
        monitoring information systems and sharing or receiving 
        countermeasures. The lack of safeguards in these areas is a 
        fundamental weakness of the White House proposal and S. 456.
    Under S. 456, cyber threat data shared with the NCCIC would 
        seemingly be protected from public disclosure and may not be 
        used as evidence in a regulatory action against the entity that 
        shared CTIs, which is welcome. However, S. 456 neither codifies 
        antitrust protections in Federal law nor preempts State law. 
        The bill simply references via a sense-of-Congress provision a 
        policy statement that was issued in April 2014 by the 
        Department of Justice and the Federal Trade Commission.\11\ 
        While this provision is constructive, anti-trust protections 
        need to be written into law to be meaningful to industry.
---------------------------------------------------------------------------
    \11\ www.justice.gov/opa/pr/justice-department-federal-trade-
commission-issue-antitrust-policy-statement-sharing.
---------------------------------------------------------------------------
    Similar to CISA, S. 456 includes strong privacy protections. Both 
        bills narrowly define what CTIs may be shared among private 
        sector and Federal Government entities.\12\ CISA and S. 456 
        require that businesses remove personal information from CTIs 
        before sharing them. The Chamber urges businesses to share 
        cybersecurity threat data with industry partners and the 
        Government. Still, the mandate to scrub personal information 
        would almost certainly sideline smaller businesses, because the 
        provision assumes that businesses would have the technical 
        know-how or the resources to scrub data. To be sure, this 
        outcome is not the intent of the bills' writers, but it is 
        important to note that this is the likely response many 
        businesses would have to such provisions.
---------------------------------------------------------------------------
    \12\ CISA 2015 and S. 456 define cyber threat indicators (CTIs) in 
section 2 of their respective bills.
---------------------------------------------------------------------------
    And, like CISA, S. 456 would also tightly limit how the Federal 
        Government could use CTIs that agencies receive. However, 
        unlike CISA, S. 456 would sunset after 5 years. A sunset 
        provision would almost certainly inhibit businesses' ability to 
        make long-term planning decisions related to risk management 
        and information-sharing investments.
    It is necessary to highlight that the Chamber supports CISA. 
        Compared with S. 456, CISA offers a more dynamic approach to 
        sharing cybersecurity threat data among multiple business and 
        Government partners, coupled with stronger protections. CISA 
        would go the furthest in helping businesses, including critical 
        infrastructure, defend information systems against cyber 
        attacks. Businesses would likely share and receive CTIs and 
        countermeasures and monitor their networks on a broader scale 
        and more confidently because CISA grants stronger liability 
        protections and better policy tools.
    Organizing roundtables with local chambers and growing market 
solutions. The Chamber is planning more cyber roundtables in 2015. Last 
year, the Chamber organized roundtable events with State and local 
chambers in Chicago, Illinois (May 22); Austin, Texas (July 10); 
Everett, Washington (September 23); and Phoenix, Arizona (October 8) 
prior to the Chamber's Third Annual Cybersecurity Summit on October 28.
    Leading member sponsors of the campaign were American Express, 
Dell, and Splunk. Other sponsors were the American Gas Association, 
Boeing, the Edison Electric Institute, Exelon, HID Global, Microsoft, 
Oracle, and Pepco Holdings, Inc., and The Wall Street Journal.
    Each roundtable featured cybersecurity principals from the White 
House, DHS, NIST, and local FBI and Secret Service officials. The 
Chamber and its partners urged businesses to adopt fundamental internet 
security practices to reduce network and system weaknesses and make the 
price of successful hacking increasingly steep. The Chamber also urged 
businesses to improve their cyber risk management processes.
    All businesses should understand common on-line threats that can 
lead them to become victims of cyber crime. Using the framework and 
similar risk management tools, such as the Chamber's Internet Security 
Essentials for Business 2.0 guidebook,\13\ is ultimately about making 
your business more secure and resilient. The Chamber encourages 
businesses to report cyber incidents. Perfect on-line security is 
unattainable, even for large businesses. Innovative solutions are 
regularly being brought to market because cyber threats are always 
changing. Businesses should report cyber incidents and on-line crime to 
their FBI or Secret Service field offices.
---------------------------------------------------------------------------
    \13\ The booklet is available free for downloading at 
www.uschamber.com/issue-brief/internet-security-essentials-business-20.
---------------------------------------------------------------------------
    Increasing public awareness of the framework. The Chamber urges 
policymakers to commit greater resources over the next several years to 
growing awareness of the framework and risk-based solutions through a 
National education campaign. A broad-based campaign involving Federal, 
State, and local governments and multiple sectors of the U.S. economy 
would spur greater awareness of cyber threats and aggregate demand for 
market-driven cyber solutions.
    The Chamber believes that Government--particularly independent 
agencies--should devote their limited time and resources to assisting 
resource-strapped enterprises, not trying to flex their existing 
regulatory authority. After all, while businesses are working to 
detect, prevent, and mitigate cyber attacks originating from 
sophisticated criminal syndicates or foreign powers, they should not 
have to worry about regulatory or legal sanctions.
    Engaging law enforcement. The Chamber plans to continue its close 
contact with the FBI and the Secret Service to build trusted public-
private relationships, which are essential to confirming a crime and 
beginning criminal investigations. The Chamber encourages businesses to 
partner with law enforcement before, during, and after a cyber 
incident. FBI and Secret Service officials have participated in each of 
the Chamber's roundtables.
    Harmonizing cybersecurity regulations. Information-security 
requirements should not be cumulative. The Chamber believes it is 
valuable that agencies and departments are urged under the E.O. to 
report to the Office of Management and Budget any critical 
infrastructure subject to ``ineffective, conflicting, or excessively 
burdensome cybersecurity requirements.'' The Chamber urges the 
administration and Congress to prioritize eliminating burdensome 
regulations on businesses. One solution could entail giving businesses 
credit for information security regimes that exist in their respective 
sectors.\14\ It is positive that Michael Daniel, the administration's 
lead cyber official, has made harmonizing existing cyber regulations 
with the framework a priority.
---------------------------------------------------------------------------
    \14\ The business community already complies with multiple 
information security rules. Among the regulatory requirements impacting 
businesses of all sizes are the Chemical Facilities Anti-Terrorism 
Standards (CFATS), the Federal Energy Regulatory Commission--North 
American Reliability Corporation Critical Information Protection (FERC-
NERC CIP) standards, the Gramm-Leach-Bliley Act (GLBA), the Health 
Insurance Portability and Accountability Act (HIPAA), and the Sarbanes-
Oxley (SOX) Act. The Securities and Exchange Commission (SEC) issued 
guidance in October 2011 outlining how and when companies should report 
hacking incidents and cybersecurity risks. Corporations also comply 
with many non-U.S. requirements, which add to the regulatory mix.
---------------------------------------------------------------------------
    Raising adversaries' costs through deterrence. The Chamber is 
reviewing actions that businesses and Government can take to deter 
nefarious actors that threaten to empty bank accounts, steal trade 
secrets, or damage vital infrastructures. While our organization has 
not formally endorsed the report, the U.S. Department of State's 
International Security Advisory Board (ISAB) issued in July draft 
recommendations regarding cooperation and deterrence in cyberspace.
    The ISAB's recommendations--including cooperating on crime as a 
first step, exploring global consensus on the rules of the road, 
enhancing governments' situational awareness through information 
sharing, combating IP theft, expanding education and capacity building, 
promoting attribution and prosecution, and leading by example--are 
sensible and worthy of further review by cybersecurity 
stakeholders.\15\
---------------------------------------------------------------------------
    \15\ The ISAB report is available at www.state.gov/documents/
organization/229235.pdf.
---------------------------------------------------------------------------
    The Chamber believes that the United States needs to coherently 
shift the costs associated with cyber attacks in ways that are legal, 
swift, and proportionate relative to the risks and threats. 
Policymakers need to help the law enforcement community, which is a key 
asset to the business community but numerically overmatched compared 
with illicit hackers.\16\
---------------------------------------------------------------------------
    \16\ The Chamber argued for a clear cyber deterrence strategy in 
its December 2013 letter to NIST on the framework. See http://
csrc.nist.gov/cyberframework/framework_comments/
20131213_ann_beauchesne_uschamber.pdf.
---------------------------------------------------------------------------
    Making incentives work. In an April 2013 letter to NIST regarding 
businesses' use of the framework and the role of incentives, the 
Chamber provides its views on extending liability protections related 
to information-sharing legislation, a safe harbor related to using the 
framework, SAFETY Act applicability to the framework; eliminating 
cybersecurity regulations, leveraging Federal procurement, and making 
the research and development (R&D) tax credit permanent.\17\
---------------------------------------------------------------------------
    \17\ The letter is available at www.ntia.doc.gov/files/ntia/
29apr13_chamber_comments.pdf.
---------------------------------------------------------------------------
    The Chamber appreciates that the administration is assessing a mix 
of incentives that could induce businesses to use the framework.\18\ 
However, in the Chamber's view, it is imperative that the 
administration, independent agencies, and lawmakers extend to companies 
the assurance that the cybersecurity framework and any actions taken in 
relation to it remain collaborative, flexible, and innovative over the 
long term. The Chamber believes that the presence of these qualities, 
or the lack thereof, would be a key determinant to use of the framework 
by U.S. critical infrastructure as well as businesses generally.
---------------------------------------------------------------------------
    \18\ See www.whitehouse.gov/blog/2013/08/06/incentives-support-
adoption-cybersecurity-framework.
---------------------------------------------------------------------------
         roadmap for the future of the cybersecurity framework
    In February 2014, NIST released a Roadmap to accompany the 
framework. The Roadmap outlines further areas for possible 
``development, alignment, and collaboration.''\19\ The Chamber noted in 
an October 2014 letter to NIST some key areas that it sees as needing 
more attention. The Chamber would highlight for the committee the 
importance of aligning international cybersecurity regimes with the 
framework.
---------------------------------------------------------------------------
    \19\ The Roadmap is available at www.nist.gov/cyberframework/
upload/roadmap-021214.pdf.
---------------------------------------------------------------------------
    Many Chamber members operate globally and appreciate that NIST has 
been actively meeting with foreign governments urging them to embrace 
the framework. Like NIST, the Chamber believes that efforts to improve 
the cybersecurity of the public and private sectors should reflect the 
borderless and interconnected nature of our digital environment.
    Standards, guidance, and best practices relevant to cybersecurity 
are typically industry-driven and adopted on a voluntary basis; they 
are most effective when developed and recognized globally. Such an 
approach would avoid burdening multinational enterprises with the 
requirements of multiple, and often conflicting, jurisdictions.\20\ The 
administration should organize opportunities for stakeholders to 
participate in multinational discussions. The Chamber encourages the 
Federal Government to work with international partners and believes 
that these discussions should be stakeholder-driven and occur on a 
routine basis.
---------------------------------------------------------------------------
    \20\ The Chamber sent a letter in September 2013 to Dr. Andreas 
Schwab, member of the European Parliament's Internal Market and 
Consumer Protection Committee, recommending amendments to the proposed 
European Union (E.U.) cybersecurity directive. The Chamber argues that 
cybersecurity and resilience are best achieved when organizations 
follow voluntary global standards and industry-driven practices.
---------------------------------------------------------------------------
passing an industry-supported information-sharing bill is the chamber's 
                   top cyber legislative goal in 2015
    Cyber attacks aimed at U.S. businesses and Government entities are 
being launched from various sources, including sophisticated hackers, 
organized crime, and state-sponsored groups. These attacks are 
advancing in scope and complexity. Most policymakers and practitioners 
appreciate that the intent of legislation is not to spur more 
information sharing for its own sake. Rather, the goal is to help 
companies achieve timely and actionable situational awareness to 
improve the business community's and the Nation's detection, 
mitigation, and response capabilities.
    Additional positive side effects of enacting cyber information-
sharing legislation include strengthening the security of personal 
information that is maintained on company networks and systems and 
increasing costs on nefarious actors. The bill would also complement 
the NIST framework, which many industry associations and companies are 
embracing and promoting with their business partners. Congressional 
action on cybersecurity information-sharing legislation cannot come 
quickly enough.

    Mr. Ratcliffe. Thank you, Mr. Eggers.
    It is my understanding that votes have been called. We 
expect to return roughly 10 minutes after the last vote. So, 
without objection, the subcommittee is in recess subject to the 
call of the Chairman.
    [Recess.]
    Mr. Ratcliffe. Appreciate everyone's patience. We're 
accommodating with the weather, and I think we're going to have 
some Members return. But I want to continue with everyone's 
testimony.
    So I appreciate, Mr. Eggers, your testimony.
    Next we would love to hear from Ms. Callahan.

TESTIMONY OF MARY ELLEN CALLAHAN, JENNER & BLOCK, FORMER CHIEF 
     PRIVACY OFFICER, U.S. DEPARTMENT OF HOMELAND SECURITY

    Ms. Callahan. Thank you, sir.
    Good afternoon, Chairman Ratcliffe. Thank you for the 
opportunity to appear before you today.
    My name is Mary Ellen Callahan, and I'm a partner at the 
law firm of Jenner & Block, where I chair the privacy and 
information governance practice. From 2009 to 2012, I served as 
the Chief Privacy Officer of the U.S. Department of Homeland 
Security. I'm appearing before this committee in my personal 
capacity.
    Cybersecurity information sharing is vital to protect 
private- and public-sector assets. In order to prepare for 
disclosing cybersecurity threat indicators, however, to the 
other entities in the cybersecurity ecosystem, the information 
sharing with the Government must meet certain standards to 
address industry interests and needs.
    There are six factors that are crucial for establishing 
robust effective private-sector information sharing with the 
Government:
    First, the Government must establish and implement 
legitimate privacy safeguards.
    Second, clearly-established controls must be placed on what 
the Government does with that shared information.
    Third, the controls must include civilian interface with 
the private sector, not just as an intake center, but for all 
communications and coordination related to cybersecurity 
information sharing.
    Fourth, a value proposition for the information sharing 
must be established.
    Fifth, liability limitations must be provided both civilly 
and criminally.
    Finally, the Congress should expressly provide the Privacy 
and Civil Liberties Oversight Board with oversight authority 
over cybersecurity, including information sharing.
    It is unfortunate that the 2015 Executive Order did not 
elaborate on the necessary privacy and civil liberties 
protections, particularly with regard to private-sector 
information sharing.
    Nonetheless, the DHS Privacy Officer and Office for Civil 
Rights and Civil Liberties can address those private-sector 
concerns, including with the intersection of the Information 
Sharing and Analysis Organizations, or ISAOs.
    DHS has been quite transparent about its cybersecurity 
capacities and privacy protections starting from the time when 
Mr. Garcia was at Homeland Security. This work will assist DHS 
in establishing deeper relations with the new and existing 
ISAOs.
    In addition, as this subcommittee knows, the DHS Chief 
Privacy Officer has unique investigatory authorities. 
Therefore, in the event that something went awry in the future, 
the Chief Privacy Officer can investigate these activities. 
That authority may be of interest to the private companies and 
ISAOs as more private information starts to flow into the 
Government.
    There are three categories of information that companies 
may provide when sharing cybersecurity threat indicators: 
Information directly associated the cyber threat; information 
related to the cyber threat; and information incidentally 
retained when sharing the threat indicators themselves.
    To limit the amount of incidentally retained and related 
information being shared, companies should implement strict 
data minimization standards. Frequently, however, it may not be 
evident upon initial sharing which information is directly 
associated with the threat and which information is either 
incidentally retained or only related to the cyber threat. 
Therefore, more information than necessary may be shared.
    As a result, the Federal Government should implement a 
secondary data minimization review and limit any sharing of 
information only to the information directly associated with 
the threat.
    In certain discussions, there have been recommendations to 
share all cybersecurity threat information, including the 
related and incidentally-retained information, as soon as 
possible with all Government entities. This is ill-advised.
    If such sharing were to occur, each agency would need to 
re-analyze the information to determine what is relevant and 
what is not. If there is a requirement to immediately share, 
then more information than necessary will be shared throughout 
the Government.
    Wide-spread sharing of related or incidentally-retained 
information will chill information sharing generally. Companies 
will not want their non-cyber-threat information shared widely, 
even if there are use limitations. To be clear, use limitations 
must be placed to provide guidance to the Government and 
necessary comfort to the sharing companies.
    The use of private-sector shared information must be 
cabined to only include use for cybersecurity threat and 
response. Relatedly, the Federal Government, including 
intelligence agencies, should have limitations on what agencies 
can retain and for how long with regard to the shared 
information from companies.
    Ensuring civilian control of the life cycle of 
cybersecurity information from the private sector is critical 
to comfort private companies before they share cybersecurity 
threat indicators in volume.
    Critical infrastructure sectors in companies have had 
reservations about information being shared that may not only 
be used for informing other vulnerable entities, but also would 
have been used for investigations or National security without 
concomitant benefit.
    The liability limitation is also important. Companies and 
ISAOs need to be comforted that the information they share will 
be appropriately protected.
    Finally, the Privacy and Civil Liberties Oversight Board 
authority should be expanded to include oversight of 
cybersecurity activities, including information sharing with 
and from the private sector.
    Thank you.
    [The prepared statement of Ms. Callahan follows:]
               Prepared Statement of Mary Ellen Callahan
                             March 4, 2015
    Chairman Ratcliffe, Ranking Member Richmond, distinguished Members 
of the subcommittee, thank you for the opportunity to appear before you 
today. My name is Mary Ellen Callahan. I am a partner at the law firm 
of Jenner & Block, where I chair the Privacy and Information Governance 
Practice and counsel private-sector clients on integrating privacy and 
cybersecurity. From March 2009 to August 2012, I served as the chief 
privacy officer at the U.S. Department of Homeland Security (DHS or 
Department). I have worked as a privacy professional for 17 years and 
have National and international experience in integrating privacy into 
business and Government operations. I am appearing before this 
subcommittee in my personal capacity and not on behalf of any other 
entity.
    Cybersecurity information sharing is vital to protect the private 
and public-sector assets. In order to prepare for disclosing 
cybersecurity threat indicators to other entities in the cybersecurity 
ecosystem, however, the information sharing with the Government must 
meet certain standards to address industry interests and needs.
    In my testimony, I will address six factors that are crucial to 
establishing robust, effective private-sector information sharing with 
the Government. First and foremost, to encourage and facilitate 
private-sector information sharing, the Government must develop and 
implement legitimate privacy safeguards. Second, clearly-established 
controls must be placed on what the Government does with the shared 
information. Third, those controls must include identifying and 
empowering a civilian interface with the private sector on information 
sharing--not just as an intake center, but for all communications 
related to cybersecurity information sharing. The fourth necessary step 
is to establish the value proposition for information sharing; 
information sharing must be at an acceptable cost and provide minimal 
risk for the participants. Its companion point is to define clear and 
objective limitations on liability for companies that participate in 
information sharing--both civilly and criminally. And finally, Congress 
should expressly provide the Privacy and Civil Liberties Oversight 
Board with oversight authority over cybersecurity, including 
information sharing.
     privacy safeguards are essential to effective private sector 
                          information sharing
    As Apple CEO Tim Cook noted at the Cybersecurity Summit last month, 
we have to protect our privacy rights or we will all face dire 
consequences. At the same Summit, President Obama concurred, saying, 
``When people go on-line, we shouldn't have to forfeit the basic 
privacy we're entitled to as Americans.'' However, the Executive Order 
on Promoting Private Sector Cybersecurity Information Sharing does not 
include a comprehensive privacy and civil liberties framework relating 
to private-sector sharing, instead focusing only on the intra-
Government sharing, instructing agencies to work with their Senior 
Agency Officials for Privacy (SAOPs) to ensure that appropriate 
internal privacy protections are in place.
    This decentralized and Government-only approach is flawed in two 
ways. Following the 2013 Executive Order on Improving Cybersecurity, 
each of the SAOPs for the major agencies prepared their assessments of 
how they were complying with privacy and civil liberties protections in 
department-to-department sharing. The detail and level of analysis by 
the SAOPs differed greatly. Having a decentralized assessment of 
privacy impacts, including how to intersect with the private sector, 
will delay the implementation of adequate privacy protections, and will 
not instill confidence from the private sector. Furthermore, this 
decentralized approach does not need to take place under the 2015 
Executive Order--because DHS has already has an existing infrastructure 
in place, and it has been identified as the key department in this 
private-sector information-sharing exercise.
    It is unfortunate that the 2015 Executive Order did not elaborate 
on the necessary privacy and civil liberties protections, particularly 
with regard to private-sector information sharing. Nonetheless, the DHS 
Privacy Office and Office for Civil Rights and Civil Liberties can lead 
these inter-agency efforts to address private-sector concerns, 
including with the intersection of Information Sharing and Analysis 
Organizations (ISAOs).
    Without a White House-based privacy policy official, the DHS Chief 
Privacy Officer frequently serves as de facto privacy policy leadership 
between and among the departments and agencies. As I testified before 
this subcommittee in April 2013, DHS has taken multiple steps to 
integrate cybersecurity and privacy as part of the Department's 
cybersecurity mission. DHS has thoroughly integrated the Fair 
Information Practice Principles (FIPPs) into its cybersecurity 
programs. The FIPPS are the ``widely accepted framework of defining 
principles to be used in the evaluation and consideration of systems, 
processes, or programs that affect individual privacy.''\1\
---------------------------------------------------------------------------
    \1\ The Fair Information Practice Principles as articulated in 
National Strategy for Trusted Identities in Cyberspace, April 2011, 
available at: http://www.whitehouse.gov/sites/default/files/rss_viewer/
NSTICstrategy_041511.pdf
---------------------------------------------------------------------------
    DHS has been quite transparent about its cybersecurity 
capabilities. As discussed below, transparency is an important tenet 
under the FIPPs and an important cornerstone to encourage industry 
participation. DHS has published several Privacy Impact Assessments 
(PIAs) detailing pilot programs and information sharing among and 
between Government entities as well as with private companies that have 
signed Cooperative Research and Development Agreements (CRADAs). This 
work will assist DHS in establishing deeper relationships with new and 
existing ISAOs.
    The Department already has skilled, dedicated privacy professionals 
who can help navigate the privacy protections needed for effective 
information sharing, with multiple cyber privacy professionals on 
staff. These individuals focus on integrating the FIPPs of purpose 
specification, data minimization, use limitation, data quality and 
integrity and security systematically into all DHS cybersecurity 
activities.
    As part of its mission to implement the FIPPs and to integrate 
privacy protections into DHS cybersecurity activities, DHS privacy 
professionals review and provide comments and insight into 
cybersecurity Standard Operating Procedures (SOPs) (including protocols 
for human analysis and retention of cyber alerts, signatures, and 
indicators for minimization of information that could be personally 
identifiable information), statements of work, contracts, and 
international cyber information-sharing agreements. The DHS cyber 
privacy professionals review all of the CRADAs signed with private 
companies.
    An important tenet of the FIPPs is the concept of accountability--
periodically reviewing and confirming that the privacy protections 
initially embedded into any program remain relevant and that those 
protections are implemented.
    While I was DHS Chief Privacy Officer, I instituted ``Privacy 
Compliance Reviews'' (PCRs) to confirm the accountability of several of 
DHS's programs.\2\ We designed the PCR to improve a program's ability 
to comply with assurances made in PIAs, System of Records Notices, and 
formal information-sharing agreements. The Office conducts PCRs of on-
going DHS programs with program staff to ascertain how required privacy 
protections are being implemented and to identify areas for 
improvement.
---------------------------------------------------------------------------
    \2\ See DHS Privacy Office Annual Report, July 2011-June 2012 at 
39-40 for a detailed discussion of Privacy Compliance Reviews.
---------------------------------------------------------------------------
    Given the importance of the DHS mission in cybersecurity, the DHS 
Privacy Office conducted a Privacy Compliance Review in late 2011, 
publishing it in early 2012.\3\ The DHS Privacy Office found the DHS 
cybersecurity entities generally complied with the privacy requirements 
in the relevant Privacy Impact Assessments. Specifically, the DHS 
cybersecurity entities fully complied with collecting information, 
using information, internal and external sharing with Federal agencies 
and accountability requirements.
---------------------------------------------------------------------------
    \3\ Privacy Compliance Review of the EINSTEIN Program, January 3, 
2012, available at: http://www.dhs.gov/xlibrary/assets/privacy/
privacy_privcomrev_nppd_ein.pdf.
---------------------------------------------------------------------------
    In addition, as this subcommittee knows, the DHS chief privacy 
officer has unique investigatory authorities. Therefore, in the 
unlikely event that something went awry in the future, the Chief 
Privacy Officer can investigate those activities.\4\ This investigatory 
authority may be of interest to the private companies and ISAOs as more 
private information starts to flow into the Government.
---------------------------------------------------------------------------
    \4\ 6 U.S.C.  142(b). See DHS Privacy Office Annual Report, July 
2011-June 2012 at 40 for a discussion of the DHS chief privacy officer 
investigatory authorities.
---------------------------------------------------------------------------
    The procedures, staffing, accountability and integration into the 
relationships with private-sector entities through CRADAs demonstrate 
the way in which privacy protections are integrated throughout the DHS 
cybersecurity program. A framework is in place to address privacy and 
civil liberties issues for private-sector information sharing, and DHS 
is well-positioned to extend those privacy protections to private-
sector information sharing on a larger scale.
        establish appropriate limitations on information sharing
    Consistent with the FIPPs and private-sector company expectations, 
there must be clearly-defined controls associated with the 
cybersecurity threat indicators and the related information.
    As the DHS portion of the 2013 Executive Order report noted, there 
are at least three categories of information that companies may provide 
when sharing cybersecurity threat indicators--information directly 
associated with the cybersecurity threat, information related to the 
cyber threat, and information incidentally retained when sharing the 
threat indicators themselves.\5\
---------------------------------------------------------------------------
    \5\ Executive Order 13636 Privacy and Civil Liberties Assessment 
Report 2014, available at: http://www.dhs.gov/sites/default/files/
publications/2014-privacy-and-civil-liberties-assessment-report.pdf
---------------------------------------------------------------------------
    To limit the amount of incidentally retained and related 
information being shared, companies should implement strict data 
minimization standards. Frequently, however, it may not be evident upon 
initial sharing--especially because time may be of the essence--which 
information is directly associated with the cybersecurity threat and 
which information is either incidentally retained or only related to 
the cyber threat. Therefore, more information than necessary may be 
shared. As a result, the Federal Government/DHS should implement a 
secondary data minimization review and limit any sharing of information 
only to the information directly associated with the cyber threat.
    In certain discussions, there are recommendations to share all 
cybersecurity threat information--including the related and 
incidentally-retained information--as soon as possible with all 
Government entities. This is ill-advised, for a few reasons. First, 
this approach does not assist the other entities in identifying the 
relevant information and requires each agency to re-analyze the 
information to determine what is relevant and what is not. That is 
inefficient. Instead, sharing immediately shifts the burden of 
implementation and analysis to every entity and decentralizes the skill 
set. If there is a requirement to immediately share, then more 
information than necessary--and possibly inaccurate information--will 
be shared throughout the Government. For these two reasons, the experts 
at DHS should first parse the information and apply data minimization 
principles to allow other agencies to respond quickly to the threat 
itself, rather than weeding through potentially disparate layers of 
information. The same principle of double data minimization applies to 
information sharing between and among companies.
    Wide-spread sharing of related or incidentally-retained information 
will chill information sharing generally. Companies will not want their 
non-cyber information shared widely, even if there are use limitations. 
Providing anonymity for producers (especially private companies)--
allowing them an environment to share safely without fear of backlash 
regarding their vulnerabilities--is vital to encourage cooperation. 
Companies are legitimately concerned that their valuable trade secrets 
or business-sensitive information may be available to the Government 
and their competitors if the non-cyber threat indicators are not 
minimized.
    Even if cyber threat indicators are judiciously shared, use 
limitations related to the shared information must be in place. In 
addition to the liability limitations discussed below, the use of 
private sector-shared information must be cabined to include only use 
for cybersecurity threat and response. Relatedly, the Federal 
Government (including intelligence agencies) should have limitations on 
what agencies can retain and for how long with regard to the unique 
information from companies, rather than the distilled threat 
indicators.
civilian control of the cybersecurity information sharing is crucial to 
                 encourage private information sharing
    Ensuring civilian control of the life cycle of cybersecurity 
information from the private sector is critical to comfort private 
companies before they share cyber threat indicators in volume. Critical 
infrastructure sectors and companies have reservations that information 
being shared may not only be used to inform other vulnerable entities, 
but also would be used for investigations or National security, without 
any other concomitant benefit. The Executive Order is silent on the 
issue of civilian control for the life cycle of the private-sector 
relationship, but that control is crucial to the development of 
repeatable, consistent information sharing.
    Identifying DHS as the private-sector interface is vital to placate 
these concerns. This committee began this process with the legislative 
establishment of the National Cybersecurity and Communications 
Integration Center (NCCIC) in 2014 through the National Cybersecurity 
Protection Act. DHS must continue to be the primary interface with the 
private sector, and must not just be seen as a pass-through to the 
intelligence community.
    As noted above, DHS has been transparent about its cybersecurity 
activities, which is imperative to develop credentials and credibility 
with the private sector. Now that NCCIC has been identified as the 
leading agency, any information sharing must go through it. As 
Assistant Secretary Andy Ozment reported to this committee in February, 
NCCIC received 97,000 incident reports, released 12,000 actionable 
cyber alerts or warnings and responded to 115 cyber incidents last 
year. These statistics demonstrate that DHS is maturing. As a civilian 
agency, it is well-positioned to liaise between private companies and 
the Government.
            information sharing must not threaten companies
    Information sharing must be at an acceptable cost and, therefore, 
provide minimal risk for the participants. If participants believe they 
will be targeted by attackers by sharing information, such as 
configurations, vulnerabilities, or even the fact that they have been 
targeted, they will not be willing to share information.
    DHS has received thorough advice--including from private-sector 
representatives and advocates--as part of its Federal Advisory 
Committee Act privacy committee, the Data Privacy and Integrity 
Advisory Committee. The DPIAC issued a significant advisory paper for 
DHS to consider when implementing information-sharing pilots and 
programs with other entities, including the private sector.\6\ The 
report addresses two important questions in privacy and cybersecurity: 
``What specific privacy protections should DHS consider when sharing 
information from a cybersecurity pilot project with other agencies?'' 
and ``What privacy considerations should DHS include in evaluating the 
effectiveness of cybersecurity pilots?'' This type of advice helps DHS 
design systems to avoid antagonizing companies and ISAOs and comfort 
them they will not somehow be punished for participating.
---------------------------------------------------------------------------
    \6\ Report from the Cyber Subcommittee to the Data Privacy and 
Integrity Advisory Committee (DPIAC) on Privacy and Cybersecurity 
Pilots, Submitted by the DPIAC Cybersecurity Subcommittee, November 
2012, available at: http://www.dhs.gov/sites/default/files/
publications/privacy/DPIAC/dpiac_cyberpilots_10_29_2012.pdf.
---------------------------------------------------------------------------
            limitations on liability must be clearly defined
    The issue of liability limitations has been discussed at length 
during the pendency of the cybersecurity legislation. It obviously is 
an important issue for companies, and it needs to be resolved 
appropriately in order to encourage information sharing. With that 
said, having clearly-defined limitations may help companies even more 
than having a ``notwithstanding any other law'' blanket exception.
    The liability limitation must address at least two aspects 
directly. First, the shared information cannot be shared with other 
agencies and then used in a civil or criminal enforcement action 
against the sharing company. That is crucial. Furthermore, the shared 
information should not be used in civil or criminal enforcement actions 
against a third party who is not the cyber attacker--namely, if shared 
information contains damning information either about the sharing 
company or a third-party company, the Government's awareness of that 
information cannot lead to enforcement.
    Furthermore, companies and ISAOs need to be comforted that the 
information they share will be appropriately protected. The DHS 
transparency on its systems will hopefully ameliorate that concern.
    The anti-trust concerns raised in earlier Congresses have waned in 
light of the Joint Department of Justice/Federal Trade Commission 
Statement Antitrust Policy Statement on Sharing of Cybersecurity 
Information.\7\ Nonetheless, more clarity, particularly vis-a-vis 
inter-company sharing, will induce more information sharing.
---------------------------------------------------------------------------
    \7\ http://www.justice.gov/atr/public/guidelines/305027.pdf.
---------------------------------------------------------------------------
privacy and civil liberties oversight board should be granted oversight 
            authority over cybersecurity information sharing
    The Privacy and Civil Liberties Oversight Board (PCLOB) serves an 
important oversight function on intelligence and National security 
activities related to terrorism. The PCLOB's authority should be 
expanded to include oversight on cybersecurity activities, including 
information sharing with and from the private sector. This addition 
will further bolster the FIPPs throughout the cyber information-sharing 
life cycle, and will provide additional oversight capacity over the 
collection, use, sharing, and retention of private-sector information.
    Thank you for the opportunity to appear before this subcommittee 
this afternoon. I would be happy to take any questions you may have.

    Mr. Ratcliffe. Thank you, Ms. Callahan.
    The Chairman now recognizes Mr. Garcia to testify.

 TESTIMONY OF GREGORY T. GARCIA, EXECUTIVE DIRECTOR, FINANCIAL 
              SERVICES SECTOR COORDINATING COUNCIL

    Mr. Garcia. Thank you, Mr. Chairman. Thanks for the 
opportunity to address the subcommittee about the President's 
information-sharing Executive Order.
    The Financial Services Sector Coordinating Council, or 
FSSCC, was establishes in 2002. It involves 65 of the largest 
financial services providers and their industry associations. 
Its mission is to coordinate sector-wide efforts to strengthen 
the resiliency of the financial services sector against threats 
to the Nation's critical infrastructure. So we're focused on 
the critical infrastructure sector.
    In practice, this means that we work with Government and 
other partners to address information-sharing content and 
procedures, incident response, cyber and operational risk 
management best practices, and appropriate policy enhancements 
to support the above objectives.
    We've learned over the years that strong risk management 
requires participating in communities of trust that share 
information on cyber and physical threats, vulnerabilities, and 
incidents. This is based on the simple concept of strength in 
numbers, the neighborhood watch, shared situational awareness.
    While the FSSCC focuses on longer-term trends and strategy, 
our sector's operational arm is the Financial Services 
Information Sharing and Analysis Center, or FS-ISAC. The FS-
ISAC participates in many information-sharing programs. One key 
partner that you mentioned in your opening statement is the 
National Cybersecurity and Communications Integration Center, 
or NCCIC.
    The NCCIC is a hub for sharing information about cyber and 
communications incidents across sectors, and the financial 
sector has a seat on the NCCIC watch floor. The industry-sector 
officials that serve on the NCCIC are cleared at the Top Secret 
level. So they attend daily briefs and other NCCIC meetings 
about threats, vulnerabilities, and incidents affecting the 
financial sector.
    Within the sector, FS-ISAC manages a formal structure for 
collecting, analyzing, and sharing actionable intelligence and 
best practices among members and the sector, as well as with 
our industry, Government, and law enforcement partners. I'll be 
happy to talk about all of that in detail during Q and A about 
how we do that.
    The sector continues to make progress on the speed and 
reliability of its information-sharing efforts. Late last year, 
for example, the financial sector announced a new automated 
threat-sharing capability called Soltra Edge. This uses open 
standards funded by DHS that facilitate automated machine-to-
machine information sharing.
    It helps our industry increase the speed, scale, and 
accuracy of information sharing, and it accelerates the time to 
resolution. It can be used by any sectors and with any sectors 
or information-sharing groups. So this is a way of 
complimenting human-to-human sharing by using machine-to-
machine whenever possible.
    So the point is the financial sector has a very robust 
information-sharing environment among ourselves and with the 
Government and we're always working to improve it.
    So let me just spend the final moments of my statement 
discussing the President's Executive Order on private-sector 
information sharing.
    In our view, the administration's Executive Action is a 
positive step. We expect it has the potential to increase the 
volume and quality of actionable and timely cybersecurity 
information. We offer a few observations that can inform 
implementation of the order.
    First, as the sharing and use of Classified information can 
improve our response capability, it's important that the 
clearance process for critical sectors like ours is fast and 
efficient. The Executive Order supports this goal by enhancing 
DHS's involvement in the clearance process. This can help 
accelerate the security clearance process for critical sector 
owners and operators.
    Also, in general, we support the creation of the ISAOs, 
Information Sharing Analysis Organizations. This can be a way 
for noncritical sector groups to share cybersecurity 
information and coordinate analysis and response.
    We understand that the impetus for the ISAO proposal was to 
raise awareness for stakeholder groups looking to coalesce 
around joint information-sharing objectives, and we believe 
that the ISAO standards development process should build on the 
strong foundation laid by the ISACs.
    We caveat, however, that ISACs, as distinct from ISAOs, 
must retain their special partnership status with the 
Government, given their broad sector representation and a 
strong cadre of operational support with security clearances.
    Certain important principles need to be kept in mind for 
the standards development process. Sharing is successful within 
communities of trust when there are clear and enforced 
information-handling rules.
    Information sharing is not a competitive sport. Operational 
standards should incentivize federated information-sharing. 
Intelligence needs to be fused across trust communities, not 
diffused or siloed.
    Government processes for collecting, analyzing, and 
packaging intelligence for private-sector consumption must be 
streamlined and transparent. Indeed, the 2013 Executive Order 
directs the Government to do just that.
    In anticipating the potential for heavy demands from a 
proliferation of ISAOs, the NCCIC should prioritize its 
resources and engagements according to established criteria. 
They'll need to consider Government capacity to effectively 
serve critical sector constituents in steady-state and surge 
mode. They need to consider the reach those stakeholders have 
into their sectors and the effectiveness of their capabilities.
    It's also important that the ISAO standards development 
process be collaborative, open, and transparent. The process 
managed during the development of the NIST cybersecurity 
framework, for example, is an excellent example of this 
principle.
    Okay. Mr. Chairman, that concludes my oral remarks. I'll be 
happy to answer questions.
    [The prepared statement of Mr. Garcia follows:]
                Prepared Statement of Gregory T. Garcia
                             March 4, 2015
    Chairman Ratcliffe, Ranking Member Richmond, and Members of the 
subcommittee, thank you for this opportunity to address the 
subcommittee about the President's information sharing Executive Order.
    My name is Gregory T. Garcia. I am executive director of the 
Financial Services Sector Coordinating Council (FSSCC), which was 
established in 2002 and involves 65 of the largest financial services 
providers and industry associations representing clearinghouses, 
commercial banks, credit card networks and credit rating agencies, 
exchanges/electronic communication networks, financial advisory 
services, insurance companies, financial utilities, Government-
sponsored enterprises, investment banks, merchants, retail banks, and 
electronic payment firms.
                             fsscc mission
    The mission of the FSSCC is to strengthen the resiliency of the 
financial services sector against attacks and other threats to the 
Nation's critical infrastructure by proactively identifying threats and 
promoting protection, driving preparedness, collaborating with the 
Federal Government, and coordinating crisis response for the benefit of 
the financial services sector, consumers and the Nation's economic 
security. During the past decade, this strategic partnership has 
continued to grow, in terms of both the size and commitment of its 
membership and the breadth of issues it addresses. Members volunteer 
their time and resources to FSSCC with a sense of responsibility to the 
broader sector, financial consumers and the Nation.
    In simplest terms, members of the FSSCC assess security and 
resiliency trends and policy developments affecting our critical 
financial infrastructure, and coordinate among ourselves and with our 
partners to develop a consolidated point of view and coherent strategy 
for dealing with those issues.
    Accordingly, our sector's primary objectives are to:
    1. Implement and maintain structured routines for sharing timely 
        and actionable information related to cyber and physical 
        threats and vulnerabilities among firms, across sectors of 
        industry, and between the private sector and Government.
    2. Improve risk management capabilities and the security posture of 
        firms across the financial sector and the service providers 
        they rely on by encouraging the development and use of common 
        approaches and best practices.
    3. Collaborate with homeland security, law enforcement and 
        intelligence communities, financial regulatory authorities, 
        other sectors of industry, and international partners to 
        respond to and recover from significant incidents.
    4. Discuss policy and regulatory initiatives that advance 
        infrastructure resiliency and security priorities through 
        robust coordination between Government and industry.
    To achieve these objectives we partner with the Department of 
Treasury, DHS, law enforcement, and financial regulatory agencies 
forming our Government Coordinating Council counterpart--called the 
Financial and Banking Information Infrastructure Committee (FBIIC).
    Rolling up into those broad objectives are numerous initiatives 
undertaken collaboratively within this public-private partnership, 
including committee-organized workstreams to, for example:
   improve information-sharing content and procedures between 
        Government and the sector;
   conduct joint exercises to test our resiliency and 
        information-sharing procedures under differing scenarios;
   prioritize critical infrastructure protection research and 
        development funding needs;
   engage with other critical sectors and international 
        partners to better understand and leverage our 
        interdependencies;
   advocate broad adoption of the NIST Cybersecurity Framework, 
        including among small and mid-sized financial institutions 
        across the country;
   develop best practices guidance for operational risk issues 
        involving third-party risk, supply chain, and cyber insurance 
        strategies.
    We have learned over the years that a foundational element of any 
strong risk management strategy for cyber and physical protection 
involves participation in communities of trust that share information 
related to threats, vulnerabilities, and incidents affecting those 
communities. That foundation is based on the simple concepts of 
strength in numbers, the neighborhood watch, and shared situational 
awareness.
    To achieve this goal, public and private-sector partners exchange 
data and contextual information about specific incidents and longer-
term trends and developments. Sharing this information helps to prevent 
incidents from occurring and to reduce the risk of a successful 
incident at one firm later impacting another. These efforts 
increasingly focus on including smaller firms and include international 
partners.
    Financial-sector stakeholders participate in information-sharing 
programs operated by the Department of Homeland Security. For example, 
the financial sector and Treasury Department maintain a presence within 
the National Cybersecurity and Communications Integration Center 
(NCCIC), which serves as a hub for sharing information related to 
cybersecurity and communications incidents across sectors, among other 
roles and responsibilities. The sector also works closely with the 
National Infrastructure Coordinating Center (NICC), which is the 
dedicated 24/7 coordination and information-sharing operations center 
that maintains situational awareness of the Nation's critical 
infrastructure for the Federal Government.
    The financial sector benefits greatly from its close information-
sharing relationship with law enforcement partners, including the 
Federal Bureau of Investigations and the United States Secret Service.
          fs-isac information-sharing programs and operations
    For the financial sector, the primary community of trust for 
critical financial infrastructure protection is the Financial Services 
Information Sharing and Analysis Center, or FS-ISAC, which is the 
operational heartbeat of the FSSCC strategic body.
    The FS-ISAC was formed in 1999 in response to the 1998 Presidential 
Decision Directive 63 (PDD 63), which called for the public and private 
sectors to work together to address cyber threats to the Nation's 
critical infrastructures. After 9/11, and in response to Homeland 
Security Presidential Directive 7 (and its 2013 successor, Presidential 
Policy Directive 21) and the Homeland Security Act, the FS-ISAC 
expanded its role to encompass physical threats to our sector.
    The FS-ISAC is a 501(c)6 nonprofit organization and is funded 
entirely by its member firms and sponsors. In 2004, there were only 68 
members of the FS-ISAC, mostly larger financial services firms. Since 
that time the membership has expanded to more than 5,000 organizations 
including commercial banks and credit unions of all sizes, brokerage 
firms, insurance companies, data security payments processors, and 24 
trade associations representing virtually all of the U.S. financial 
services sector.
    Since its founding, the FS-ISAC's operations and culture of trusted 
collaboration have evolved into what we believe is a successful model 
for how other industry sectors can organize themselves around this 
security imperative. The overall objective of the FS-ISAC is to protect 
the financial services sector against cyber and physical threats and 
risk. It acts as a trusted third party that provides anonymity to allow 
members to share threat, vulnerability, and incident information in a 
non-attributable and trusted manner. The FS-ISAC provides a formal 
structure for valuable and actionable information to be shared amongst 
members, the sector, and its industry and Government partners, which 
ultimately benefits the Nation. FS-ISAC information-sharing activities 
include:
   delivery of timely, relevant, and actionable cyber and 
        physical email alerts from various sources distributed through 
        the FS-ISAC Security Operations Center (SOC);
   an anonymous on-line submission capability to facilitate 
        member sharing of threat, vulnerability, and incident 
        information in a non-attributable and trusted manner;
   operation of email listservs supporting attributable 
        information exchange by various special interest groups 
        including the Financial Services Sector Coordinating Council 
        (FSSCC), the FS-ISAC Threat Intelligence Committee, threat 
        intelligence sharing open to the membership, the Payment 
        Processors Information Sharing Council (PPISC), the Clearing 
        House and Exchange Forum (CHEF), the Business Resilience 
        Committee, and the Payments Risk Council;
   anonymous surveys that allow members to request information 
        regarding security best practices at other organizations;
   bi-weekly threat information sharing calls for members and 
        invited security/risk experts to discuss the latest threats, 
        vulnerabilities, and incidents affecting the sector;
   emergency threat or incident notifications to all members 
        using the Critical Infrastructure Notification System (CINS);
   emergency conference calls to share information with the 
        membership and solicit input and collaboration;
   engagement with private security companies to identify 
        threat information of relevance to the membership and the 
        sector;
   participation in various cyber exercises such as those 
        conducted by DHS (Cyber Storm I, II, and III) and support for 
        FSSCC exercises such as CyberFIRE and Quantum Dawn;
   development of risk mitigation best practices, threat 
        viewpoints and toolkits, and preparation of cybersecurity 
        briefings and white papers;
   administration of Subject Matter Expert (SME) committees 
        including the Threat Intelligence Committee and Business 
        Resilience Committee, which: Provide in-depth analyses of risks 
        to the sector, conduct technical, business, and operational 
        impact assessments; determine the sector's cyber and physical 
        threat level; and, recommend mitigation and remediation 
        strategies and tactics;
   special projects to address specific risk issues such as the 
        Account Takeover Task Force;
   document repositories for members to share information and 
        documentation with other members;
   development and testing of crisis management procedures for 
        the sector in collaboration with the FSSCC and other industry 
        bodies;
   semi-annual member meetings and conferences; and
   on-line webinar presentations and regional outreach programs 
        to educate organizations, including small- to medium-sized 
        regional financial services firms, on threats, risks, and best 
        practices.
                          fs-isac partnerships
    The FS-ISAC works closely with various Government agencies 
including the U.S. Department of Treasury, Department of Homeland 
Security (DHS), Federal Reserve, Federal Financial Institutions 
Examination Council (FFIEC) regulatory agencies, United States Secret 
Service, Federal Bureau of Investigation (FBI), the intelligence 
community, and State and local governments.
    In partnership with DHS, FS-ISAC 2 years ago became the third ISAC 
to participate in the National Cybersecurity and Communications 
Integration Center (NCCIC) watch floor. FS-ISAC representatives, 
cleared at the Top Secret/Sensitive Compartmented Information (TS/SCI) 
level, attend the daily briefs and other NCCIC meetings to share data 
information on threats, vulnerabilities, incidents, and potential or 
known impacts to the financial services sector. Our presence on the 
NCCIC floor has enhanced situational awareness and information sharing 
between the financial services sector and the Government, and there are 
numerous examples of success to illustrate this.
    As part of this partnership, the FS-ISAC set up an email listserv 
with U.S. CERT where actionable incident, threat, and vulnerability 
information is shared in near-real time. This listserv allows FS-ISAC 
members to share directly with U.S. CERT and further facilitates the 
information sharing that is already occurring between FS-ISAC members 
and with the NCCIC watch floor or with other Government organizations.
    In addition, FS-ISAC representatives sit on the Cyber Unified 
Coordination Group (Cyber UCG). This group was set up under authority 
of the National Cyber Incident Response Plan (NCIRP) and has been 
actively engaged in incident response. Cyber UCG's handling and 
communications with various sectors following the distributed denial of 
service (DDOS) attacks on the financial sector in late 2012 and early 
2013 is one example of how this group is effective in facilitating 
relevant and actionable information sharing.
    Consistent with the directives of Presidential Policy Directive 21 
and Executive Order 13636 of 2014, the Treasury established the Cyber 
Intelligence Group (CIG) as part of the Office of Critical 
Infrastructure Protection and Compliance Policy. The CIG was 
established in response to a need identified by the financial sector 
for the Government to have a focal point for sharing cyber threat-
related information with the sector. The CIG identifies and analyzes 
all-source intelligence on cyber threats to the financial sector; 
shares timely, actionable information that alerts the sector to threats 
and enables firms' prevention and mitigation efforts; and solicits 
feedback and information requirements from the sector.
    Finally, it should be noted that the FS-ISAC and FSSCC have worked 
closely with its Government partners to obtain security clearances for 
key financial services sector personnel. These clearances have been 
used to brief the sector on new information security threats and have 
provided useful information for the sector to implement effective risk 
controls to combat these threats.
    In addition, several membership subgroups meet regularly with their 
own circles of trust to share information, including: The Insurance 
Risk Council (IRC); the Community Institution Council (CIC) with 
hundreds of members from community banks and credit unions; and the 
Community Institution Toolkit Working Group with a mission to develop a 
framework and series of best practices to protect community 
institutions. This includes a mentoring program to assist community 
institutions just getting started with an IT security staff.
    The FS-ISAC also works very closely with the other critical 
infrastructure sectors on an ISAC-to-ISAC basis as well as through the 
National Council of ISACs. Information about threats, incidents, and 
best practices is shared daily among the ISACs via ISAC analyst calls, 
and a cross-sector information-sharing platform. The ISACs also come 
together during a crisis to coordinate information and mitigations as 
applicable.
                  automated threat information sharing
    The sector continues to make significant progress toward increasing 
the speed and reliability of its information-sharing efforts through 
expanded use of DHS-funded open specifications, including Structured 
Threat Information eXchange (STIXTM) and Trusted Automated 
eXchange of Indicator Information (TAXIITM).
    Late last year, the financial sector announced a new automated 
threat capability it created called ``Soltra Edge'', which is the 
result of a joint venture of the FS-ISAC and the Depository Trust and 
Clearing Corporation. This capability addresses a fundamental challenge 
in our information-sharing environment: Typically the time associated 
with chasing down any specific threat indicator is substantial. The 
challenge has been to help our industry increase the speed, scale, and 
accuracy of information sharing and accelerate time to resolution.
    The Soltra Edge capability developed by the sector removes a huge 
burden of work for both large and small financial organizations, 
including those that rely on third parties for monitoring and incident 
response. It is designed for use by many parts of the critical 
infrastructure ecosystem, including the financial services sector, the 
health care sector, the energy sectors, transportation sectors, other 
ISACs, National and regional CERTs (Computer Emergency Response Teams) 
and vendors and services providers that serve these sectors.
    Key goals of Soltra-Edge are to:
   Deliver an industry-created utility to automate threat 
        intelligence sharing;
   Reduce response time from days/weeks/months to seconds/
        minutes;
   Deliver 10 times reduction in effort and cost to respond;
   Operate on the tenets of at-cost model and open standards 
        (STIX, TAXII);
   Leverage DTCC scalability; FS-ISAC community & best 
        practices;
   Provide a platform that can be extended to all sizes of 
        financial services firms, other ISACs and industries;
   Enable integration with vendor solutions (firewalls, 
        intrusion detection, anti-virus, threat intelligence, etc.).
    With these advancements, one organization's incident becomes 
everyone's defense at machine speed. We expect this automated solution 
to be a ``go-to'' resource to speed incident response across thousands 
of organizations in many countries within the next few years.
                               exercises
    The sector regularly tests its resilience through exercises to 
identify gaps and exercise processes related to information sharing. 
Efforts such as the annual ``Cyber Attack against Payment Processes 
(CAPP)'', ``Quantum Dawn'' and public/private exercises provide 
essential insight into our ability individually and collaboratively to 
respond to various attack scenarios.
    In carrying out this information-sharing partnership, the financial 
sector and Government partners are committed to ensuring that 
individual privacy and civil liberties protections are incorporated 
into all activities, to include technical analysis, information sharing 
on threats, and incident response efforts.
      the president's executive order on promoting private-sector 
                   cybersecurity information sharing
    As discussed above, the Financial Services Sector Coordinating 
Council (FSSCC) considers strong collaboration and information sharing 
within the sector and with Government to be a critical element of 
cybersecurity risk management.
    Thus, in alignment with the FS-ISAC's statement for the record by 
Denise Anderson, vice president of the FS-ISAC and chair of the 
National Council of ISACs, we applaud this administration's efforts to 
improve our cybersecurity information-sharing environment so that we 
can better anticipate, protect against, and respond to cyber threats. 
The administration's Executive Action is a positive step toward 
increasing the volume and quality of actionable and timely 
cybersecurity information.
    With key Federal support from the Treasury Department as our 
Sector-Specific Agency, law enforcement and the Department of Homeland 
Security (DHS), our network defenders are better able to prepare for 
cyber threats when there is a consistent, reliable, and sustainable 
flow of actionable cybersecurity information and analysis, at both a 
Classified and Unclassified level.
    We are making some progress toward this goal, but it has become 
increasingly necessary for appropriately-cleared representatives of 
critical sectors such as financial services to have access, and provide 
contributions, to Classified information that enables analysts and 
operators to take timely action to defend essential systems. 
Accordingly, the Executive Order's enhancement of DHS's role in 
accelerating the security clearance process for critical sector owners 
and operators is a clear indication of the administration's support for 
this public-private partnership.
    In considering enhancements to this model, agility and innovation 
are essential for the operational resilience of critical sector 
functions. In this spirit, we support the creation of Information 
Sharing and Analysis Organizations (ISAOs) as a mechanism for all 
sectors, regions, and other stakeholder groups to share cybersecurity 
information and coordinate analysis and response.
    While ISACs must retain their status as the Government's primary 
critical infrastructure partners given their mandate for broad sectoral 
representation, the development of ISAOs should be facilitated for 
stakeholder groups that require a collaborative cyber and physical 
threat information-sharing capability that builds on the strong 
foundation laid by the ISACs.
    As the ISAO standards development process unfolds, the FSSCC 
believes certain principles must be upheld for structuring both the 
ISAOs themselves and the Government's interaction with them:
   Sharing of sensitive security information within and among 
        communities of trust is successful when operational standards 
        of practice establish clear and enforced information handling 
        rules.
   Information sharing is not a competitive sport: While 
        competition in innovation can improve technical capabilities, 
        operational standards should incentivize federated information 
        sharing. Threat and vulnerability intelligence needs to be 
        fused across trust communities, not diffused or siloed.
   Government internal processes for collecting, analyzing, and 
        packaging CIP intelligence for ISAC/ISAO consumption must be 
        streamlined and transparent to maximize timeliness, accuracy, 
        and relevance of actionable shared information. Indeed, Section 
        4 of EO 13636 directs the Government to improve its 
        dissemination of cyber threat intelligence to the private 
        sector, enabling entities to protect their networks. Full 
        implementation of this directive is necessary to achieve the 
        objectives of the President's information sharing Executive 
        Order.
   To manage scarce resources, Government information-sharing 
        mechanisms such as the National Cyber and Communications 
        Integration Center (NCCIC) and the Treasury Department's Cyber 
        Intelligence Group (CIG) should prioritize engagements with 
        ISACs and ISAOs according to transparently-established impact 
        criteria, such as Government capacity to effectively serve CIP 
        constituents in steady-state and surge mode, the reach those 
        CIP stakeholders have into their sectors, and the effectiveness 
        of their capabilities.
    It is also important that the process to develop the ISAO standards 
is collaborative, open, and transparent. The process managed by the 
National Institute of Standards and Technology (NIST) during the 
development of the NIST Cybersecurity Framework is an excellent example 
of the appropriate leveraging of private-sector input, knowledge, and 
experience to develop guidance that will primarily impact non-
Governmental entities. We encourage DHS, as the implementing authority 
of the President's EO, to emulate the engagement model that NIST used 
to create and adopt their Cybersecurity Framework. The process worked.
    Finally, for DHS to be successful implementing this EO and its many 
cybersecurity risk management and partnership authorities, it must be 
sufficiently resourced with the best analytical and technical 
capabilities, with a cadre of highly-qualified cybersecurity leaders 
and analytical teams to conduct its mission. There must be a concerted 
effort to recruit, retain, and maintain a world-class workforce that is 
able to assess cyber threats globally and help the private sector 
reduce risk to this Nation.
    The FSSCC believes that, with the application of the principles 
discussed in this statement, the creation of ISAOs and their 
partnership agreements with DHS have the potential to complement the 
ISAC foundation and measurably improve cyber risk reduction for 
critical infrastructure and the National economy.
    On the subject of legislation, Mr. Chairman, passing cyber threat 
information-sharing legislation that encourages more information 
sharing between the private sector and Government and within the 
private sector, with fewer concerns about liability, will have a 
positive operational impact on the security of the Nation's networks. 
This sector-wide position is articulated in detail in recent letters 
from leading financial services trade associations.
    Mr. Chairman and Members of the committee, this concludes my 
testimony.

    Mr. Ratcliffe. Thank you, Mr. Garcia.
    Mr. Ratcliffe. The Chairman now recognizes Dr. Libicki.

      STATEMENT OF MARTIN C. LIBICKI, THE RAND CORPORATION

    Mr. Libicki. Good afternoon, Chairman Ratcliffe, Ranking 
Member Richmond, and distinguished Members of the subcommittee. 
My name is Martin Libicki from The RAND Corporation.
    Thank you for the opportunity to testify today about the 
President's cybersecurity information-sharing proposal. As a 
general proposition, information sharing among defenders makes 
for a better defense.
    Nevertheless, two concerns merit note. First, the current 
proposals do not address and may even exacerbate a 
cybersecurity divide. Second, an enormous amount of political 
energy is being dedicated to a point solution to a broad 
problem.
    A cybersecurity divide exists between organizations, 
roughly speaking, large enough to afford their own chief 
information security officer and those that cannot.
    ISAOs, for their part, are oriented towards organizations 
that can afford the membership fees. Unless other mechanisms to 
share information with the smaller organizations are bolstered, 
the latter are going to be left out of whatever information-
sharing exists.
    As for the narrower focus, several weeks ago President 
Obama said, ``There's only one way to defend America from cyber 
threats, and that's Government and industry working together, 
sharing appropriate information.'' An associated Executive 
Order calls for ``fostering the development and adoption of 
automated mechanisms for the sharing of information.''
    However, cybersecurity is so complex a challenge that not 
only is information sharing not the ``only one way,'' but the 
model proposed for information sharing is not even the only one 
way to share information.
    To explain why, let's note three models of information 
sharing.
    In the first model, vulnerabilities in software are found 
by white hat hackers and the forensic specialists brought into 
the attention of the vendors. The vendors, when they receive 
this information, attack the vulnerabilities and generally fix 
them. This is a model that would lead to better software and 
can be encouraged by the Federal Government with a modest 
addition of funding and without having to pass any new laws.
    In a second model, the collection and analysis of cyber 
attacks can shed light on what organizations could have done 
differently to have prevented or at least mitigated the effects 
of such attacks. Such sharing permits evidence-based 
assessments of alternative cybersecurity tools, techniques, and 
practices. This model can be encouraged by empowering 
organizations, such as NIST, and funding various R&D entities, 
such as the ARPAs and NSF, to build and disseminate a 
systematic body of knowledge on cybersecurity.
    The first model results in better software. The second 
model results in better cybersecurity management. Organizations 
of all size can benefit from each.
    The third model of information sharing, organizations are 
asked to report details of the attacks they have suffered, such 
as malware samples, attacker modus operandi, IP addresses, 
attack vectors, induced anomalies, social engineering methods 
and so on. These are used to profile specific threat actors so 
that the signatures of their activity can be fed to intrusion 
detection and prevention systems of organizations that happen 
to have them.
    The usefulness of this third model, however, requires that 
four assumptions be true.
    The first assumption is that most serious attacks come from 
specific black hat hacker groups who repeat their attacks often 
enough so that evidence from early attacks can be used to 
detect later ones.
    The second assumption is that such groups maintain a 
consistent modus operandi that is constantly reused.
    The third assumption is that such signatures can be shared 
in a timely manner, something that is complicated by the length 
of time--several months to a year--between when a typical 
advanced attack starts and when it is discovered.
    The fourth assumption is that such signatures will not 
evolve over time, even if information sharing were to become so 
wide-spread that the failure to evolve on the part of hackers 
would doom their ability to compromise networks.
    An analogy may be made to the anti-virus industry. The 
majors run very large information-gathering networks fed by 
inputs from sensors placed throughout the internet, but the 
anti-virus model has lost viability in the face of ever-
shifting signatures and the tendency of attackers to test their 
malware against anti-virus suites before releasing them.
    Granted, the threat-based information-sharing model, if 
substantiated, would not be totally useless. Not every black 
hat hacker group will be conscientiously altering its modus 
operandi, and forcing such groups to cluster their attacks or 
shift their attack vectors does mean more work for them.
    Nevertheless, threat-based information sharing is no 
panacea, and, yet, efforts to achieve it have absorbed a 
disproportional share of the legislative and media bandwidth on 
the topic of cybersecurity policy, crowding out the 
consideration of alternative approaches. Hence, the basis for 
our concern.
    I appreciate the opportunity to discuss this important 
topic, and I look forward to your questions.
    [The prepared statement of Mr. Libicki follows:]
            Prepared Statement of Martin C. Libicki \1\ \2\
---------------------------------------------------------------------------
    \1\ The opinions and conclusions expressed in this testimony are 
the author's alone and should not be interpreted as representing those 
of RAND or any of the sponsors of its research. This product is part of 
the RAND Corporation testimony series. RAND testimonies record 
testimony presented by RAND associates to Federal, State, or local 
legislative committees; Government-appointed commissions and panels; 
and private review and oversight bodies. The RAND Corporation is a 
nonprofit research organization providing objective analysis and 
effective solutions that address the challenges facing the public and 
private sectors around the world. RAND's publications do not 
necessarily reflect the opinions of its research clients and sponsors.
    \2\ TThis testimony is available for free download at http://
www.rand.org/pubs/testimonies/CT425.html.
---------------------------------------------------------------------------
                             March 4, 2015
    Good morning, Chairman Ratcliffe, Ranking Member Richmond, and 
distinguished Members of the subcommittee. I thank you for the 
opportunity to testify today about the President's cybersecurity 
information-sharing proposal.
    The President's initiatives to improve cybersecurity through 
information sharing are laudable. Information sharing can and should be 
an important element in efforts to ensure that defenders learn from 
each other faster than attackers learn from each other. The fact that 
attackers do learn from each other is something that we know from 
research that RAND conducted for a report released last year on cyber 
crime markets (Markets for Cybercrime Tools and Stolen Data: Hackers' 
Bazaar).
    People have been calling for greater information sharing for almost 
20 years, dating back to the formation of Information Sharing and 
Analysis Centers (ISACs) in the late 1990s and continuing through the 
recent reformulation of ISACs into Information Sharing and Analysis 
Organizations (ISAOs). Although more information is being shared, the 
President's initiatives are prompted by the perception that information 
sharing is not advancing fast enough. Those asked to share gain little 
directly from sharing and believe they face financial, reputational, 
and legal risks in doing so. As a result, legislation has been 
repeatedly introduced to facilitate the increased exchange of 
information--notably, I would argue, threat information. Without going 
into a detailed assessment of the privacy implications of such 
legislation, apart from noting that concerns have been raised, its 
purposes are nevertheless sound and its passage can help improve 
cybersecurity.
    Two concerns, however, merit note. One is that the current 
proposals do not address, and may even exacerbate, the differences 
between the cybersecurity enjoyed by small- and medium-sized 
enterprises on the one hand and that enjoyed by large enterprises on 
the other: A cybersecurity divide. The second concern is that the 
current legislative proposals represent an enormous amount of political 
energy dedicated to what is actually a narrowly-focused point solution 
to the problem of cybersecurity when a much broader approach is 
required. Consider each concern in turn.
    The cybersecurity divide exists roughly at the boundary between 
those organizations that are large enough to afford their own chief 
information security officer (CISO) and those that cannot. As a very 
rough estimate, though this varies by sector, organizations with more 
than 1,000 employees can afford to hire a CISO, and those that are 
smaller cannot. Organizations that cannot afford to employ a CISO can 
usually offer only generalized cybersecurity training for their 
employees (if they do so at all); must rely on commodity hardware and 
software, often deployed with default settings; make do with commercial 
network offerings such as routers; and use off-the-shelf firewall 
tools. Organizations that can afford to employ a CISO can offer and 
customize specialized training, can afford to optimize their hardware 
and software for cybersecurity, can purchase sophisticated 
cybersecurity tools, can hire information security analysts, and 
contract with third parties for additional cybersecurity services. 
Fortunately, cloud offerings can be and are tailored for organizations 
of all sizes, but this only represents a partial approach to 
cybersecurity and may introduce a few additional security problems of 
their own.
    ISAOs, laudable as they may be, are oriented toward organizations 
that can afford their membership fees; at $10,000 a year, most small- 
and medium-sized organizations are priced out of that market. Consider 
the likelihood that these ISAO's become the primary--or worse, 
exclusive--conduit for information sharing between the Government and 
private organizations. If so--and in the absence of other mechanisms to 
share information with the broader public--the smaller organizations 
are going to be left out. Whatever advantage they reap from 
information-sharing rests on the hope that the existence of ISAOs as 
conduits for shared information does not detract from paths more suited 
to smaller enterprises.
    The risks of exacerbating the cybersecurity divide are related to 
the problem of an overly narrow focus for information sharing 
associated with pending legislation.
    Several weeks ago, during the Cybersecurity Summit, President Obama 
said, ``There's only one way to defend America from cyber threats, and 
that's Government and industry working together [and] sharing 
appropriate information.'' However, cybersecurity is not that 
elementary; there is no one unique way. Furthermore, the associated 
Executive Order calls for ``fostering the development and adoption of 
automated mechanisms for the sharing of information.'' That being so, 
not only is information sharing not the ``only one way'' to improve 
cybersecurity, but the model proposed for information sharing is also 
not the ``only one way'' to share information.
    To explain why requires stepping back to take a broader look at 
information sharing. Among the many types of information sharing, three 
merit note.
    First is the process by which software vulnerabilities are brought 
to the attention of those who make and maintain software. A large 
percentage of all networks--particularly the more diligently-defended 
ones--are penetrated because their software contains vulnerabilities 
that have not been fixed, notably because the vendors have not 
discovered them. These are ``zero-day vulnerabilities''; they permit 
``zero-day exploits.'' Software vulnerabilities in Java, Acrobat, 
Flash, and Microsoft Office products are commonly exploited to allow 
attackers to enter computer networks and systems (which is why users 
are warned not to click on suspect websites or open suspicious 
attachments). A large and growing community of researchers and white 
hat hackers are busy finding these vulnerabilities and reporting them 
to vendors. A related community examines actual cyber attacks to 
determine which vulnerabilities were exploited in order to serve the 
same end of fixing them. A world with fewer software vulnerabilities 
would be a safer world (although patches do no good until installed). 
Occasionally, software vendors confronted with a number of similar 
vulnerability reports about their products may find correlated 
architectural weaknesses in their offerings and make more fundamental 
changes. The Federal Government can do more to encourage and accelerate 
the process of finding software vulnerabilities with modest amounts of 
funding and without passing new legislation.
    Second is the use of information sharing to improve cybersecurity 
practice. The collection and analysis of cyber attacks, both those that 
succeed and those that may be termed near-misses, can shed light on 
what organizations could have done differently to have prevented or at 
least mitigated the effects of such attacks. Such analysis can provide 
evidence-based assessments of the cost-effectiveness of alternative 
cybersecurity tools and techniques. Such an activity is already 
informally carried out to some extent at the worker level, especially 
among the information security community and disseminated through 
professional interaction. This should continue to be encouraged, and 
should trickle up to the C-Suite and managers. Such activity can lead 
to insights that are scientifically validated (or refuted), which then 
become part of the cybersecurity canon, to be spread through the 
literature and other formal and informal exchanges within the 
information technology community, as well as taught in the various 
schoolhouses. The Government can aid this process by empowering 
organizations such as the National Institute of Standards and 
Technology (NIST) and funding the various Advanced Research Project 
Agencies (ARPAs) and the National Science Foundation (NSF) to build a 
systematic body of knowledge.
    These first two types of information sharing do not exacerbate the 
cybersecurity divide. The first should result in better software, which 
benefits everyone. The second should result in better cybersecurity 
practices, which also should benefit everyone, particularly those 
organizations that have at least one person who can think 
systematically about cybersecurity.
    This now leaves the third type of information sharing, one that is 
specific to the characterization of threats and the impetus behind the 
legislation. It calls for organizations to report attacks and provide 
relevant details of these attacks, such as malware samples, attacker 
modus operandi, IP addresses, attack vectors, induced anomalies, social 
engineering methods, etc. These instances, in turn, are used to create 
a profile of specific threat actors and infer signatures of their 
activities, which, in turn, would be circulated to other organizations 
so that they can better prepare themselves, notably by putting such 
signatures into their intrusion prevention/detection systems. The 
appendix of the 2013 Mandiant report (APT1: Exposing One of China's 
Cyber Espionage Units), for instance, was stuffed with many signatures 
that could be used by potential victims of APT1 (their name for a 
specific hacker group supported by China's Peoples Liberation Army) to 
recognize signs of threat activity infection. Although such signatures 
could, and in many cases, would also be supplemented by intelligence 
collection, the Classified nature of such additional material limits 
the number and type of machines on which they could reside.
    The usefulness of threat-based information sharing rests on four 
assumptions about the nature of the threat itself. Such assumptions 
would have to be largely or totally true before the value of 
establishing an information-sharing apparatus can justify the effort to 
operate it, persuade organizations to contribute to it, and offset the 
residual risks to privacy that such information transfer may entail.
    The first assumption is that a sufficient share of all serious 
attacks comes from specific black hat hacker groups and that each carry 
out enough attacks over a period of time so that their modus operandi 
can be characterized. Trivially, if every black hat hacker organization 
carried out just one attack, signatures derived from that one attack 
would inform no further attacks. In practice, each group must carry out 
enough attacks so those that are discovered can inform those that take 
place later on. Furthermore, for such signatures to be useful, there 
has to be time for the attack to be detected so that the signatures can 
be collected, shared, and inserted into the defensive systems of 
potential future victims while they are still useful. If all the 
attacks were bunched together in a short period, the information 
gathered from such attacks will not be gathered in time to be useful.
    The second assumption is that each attacker group generates a 
consistent set of signatures that recur in multiple attacks (and that 
can be used reliably by defenders to distinguish their attacks from 
benign activity). To wit, hacker signatures have to resemble 
fingerprints. The APT1 group's attacks did have such characteristics 
(similarly, those that attacked Sony Pictures Entertainment in late 
2014 used the same IP addresses as those who attacked South Korean 
banks and media firms in 2013). However, the possibilities of 
polymorphic malware (variations in the appearance of exploits) and 
fast-flux DNS (to permit shifting IP addresses) suggest that hackers 
have options for varying their signatures.
    The third assumption is that these signatures are detectable by 
organizations interested in sharing. The average attacks by 
sophisticated and advanced threats remain undetected for a year--and 
those are only the ones that have been discovered. Most such attacks 
are discovered not by their victims but by third parties and, for the 
most part, only because the information taken from several victims is 
funneled through the same intermediate servers used to hold the 
exfiltrated data. If these servers are discovered, evidence from 
attacks on multiple victims can be picked up at the same time. 
Attackers who are sensitive to being caught can explore alternative 
ways to route the data they bring home.
    The fourth assumption is that such signatures will not evolve 
(enough) over time--even if information sharing became so wide-spread 
that the failure to evolve would make it too hard for hacker groups to 
penetrate and compromise networks. Although Mandiant's publication of 
APT1 activities slowed the group's activities, it only took a few 
months before they were back in business using a new set of exploits 
and attack vectors, with brand-new signatures that had to be inferred.
    An analogy may be drawn to the anti-virus industry. The major 
players--Symantec, McAfee, Kaspersky, and Microsoft--run very large 
information-gathering networks fed by inputs from customers as well as 
sensors that they have placed throughout the internet. But the anti-
virus model has lost most of its viability over the past 5 years in the 
face of ever-shifting signatures and the practice of attackers testing 
malware against anti-virus suites before releasing them into the wild. 
Although threat-centric information-sharing deals with a broader range 
of indicators than anti-virus companies do, the same dynamic by which 
expensively-constructed measures beget relatively low-cost 
countermeasures argues against being terribly optimistic about the 
benefits from pushing a threat-centric information-sharing model.
    This is not to say that threat-centric information sharing is 
useless. Not every black hat hacker group will be conscientious about 
altering its modus operandi, and there may be features of their 
signatures that are not obvious to themselves (and hence would likely 
persist for later detection). Forcing such groups to cluster their 
attacks or to use multiple attack vectors, including obfuscation 
techniques and grouping methods, resulting in new or altered signatures 
over time, means more work for them. Some attackers will drop out; 
others may not be able to attack as many organizations in a given 
period. So, the effort to gather signatures would not be completely 
wasted. Furthermore, even if threat-centric information sharing does 
not work, the efforts that organizations would have to make to 
understand what is going on in their networks in order to share 
information effectively would, as a side benefit, also help them 
protect themselves absent any information-sharing whatsoever.
    Unfortunately, these recent efforts to promote a particular kind of 
information sharing have achieved the status of a panacea. They are 
absorbing a disproportional share of the legislative and elite media 
energy on the topic of cybersecurity. Many otherwise serious people 
assert that information sharing could have prevented many headline 
assaults on important networks. Yet, if one works through such attacks 
to understand if there were precedents that could have given us threat 
signatures, one often finds no good basis for such a belief. Quelling 
the Nation's cybersecurity problems is a complex, multi-faceted 
endeavor not subject to a silver bullet.
    In sum, there is nothing wrong with information sharing. It should 
be encouraged. The President's proposal may well do so--in which case 
it deserves our support. But there is something wrong with assuming 
that it solves most, much less all, of the cybersecurity problem. It 
only addresses one facet of a very complex space. It is therefore 
highly questionable whether efforts to achieve information sharing 
deserve the political energy that they are currently taking up.
    I appreciate the opportunity to discuss this important topic, and I 
look forward to your questions.

    Mr. Ratcliffe. Thank you, Dr. Libicki.
    I now recognize myself for 5 minutes for questions.
    Mr. Eggers, I'd like to start with you. In many respects, 
the Chamber of Commerce represents a single voice for 
stakeholders across many of the critical infrastructure 
sectors.
    So, in that respect and capacity, can you address whether 
industry supports the sharing of cyber threat indicators 
through civilian portals, such as the NCCIC, with established 
and transparent privacy protections?
    Mr. Eggers. Congressman, thank you for that question.
    I would say yes, we do. Just to give you an example, the 
NCCIC is a key portal through which businesses are sharing and 
will be sharing.
    One thing I might add to that is we want businesses to be 
sharing with their trusted partners, whether it's DHS, FBI, 
Secret Service, Department of Energy, Treasury, you name it. I 
think what we want to see is a bill that gives them the ability 
to voluntarily share cyber threat indicators with associated 
protections with some flexibility in terms of sharing with 
Government. So it would be DHS and other entities.
    Mr. Ratcliffe. Thank you, Mr. Eggers.
    Ms. Callahan, as I've listened to stakeholders across the 
spectrum here, including privacy groups, one of the recurring 
questions and concerns out there relates to the minimization of 
data, which you talked about in your testimony. As the former 
chief privacy officer at DHS, I know that you oversaw the 
processes and procedures on how DHS protects privacy when it 
comes to sharing cyber threat indicators.
    Could you walk us through that in a little more detail? The 
measures that are in place at NCCIC to ensure that personal 
information is not shared with the Government.
    Ms. Callahan. Thank you for that question.
    There are several steps and several procedures that DHS 
goes through, depending on how the threat is conveyed to 
Homeland Security, depending on how it's integrated and whether 
or not it's going to be shared.
    As you mentioned, data minimization and only having the 
directly associated threat information is the key element both 
because it protects privacy better, of course, but, also, it 
helps identify what people should really be looking at if, 
indeed, information is shared and they don't have to go through 
the chaff.
    At Homeland Security, there are multiple steps. First, when 
the threat comes in from the private sector, it can be reviewed 
by a human to go and look to see if it can be identified for 
what the specific threat is. It's then distilled down. It's 
very frequently often IP addresses, possibly URLs associated 
with it, and the very rate time associated with an email 
address.
    It's distilled down to that kind of core element, and then 
it's compared to whether or not we know anything about this 
threat, what else is happening, where is it going.
    To the extent that it's going to be shared, only that 
distilled element is going to be the purpose that it's shared. 
It also then, before sharing, is reviewed by a DHS privacy 
professional to confirm that minimization process.
    Mr. Ratcliffe. Terrific.
    So, from your experience, what is your opinion on whether 
the privacy community supports the privacy protections that are 
currently in place at NCCIC?
    Ms. Callahan. I think the privacy community very 
specifically wants to have civilian control over information 
sharing, and that's an important tenet for the privacy 
community.
    They also are very aware of the privacy protections that I 
described that are detailed in the multiple privacy impact 
assessments, privacy compliance reviews, and other public 
documents that have been detailed by the DHS privacy office.
    In addition, Homeland Security has a subcommittee that is 
Classified at the Top Secret/SCI level that has had even more 
detailed briefings, and those include advocates and members of 
the community. So I think that, to the extent the privacy 
advocates can be comfortable with the privacy protections of 
information sharing, Homeland Security has met that.
    Mr. Ratcliffe. Terrific. Thank you.
    Mr. Garcia, I think it's pretty well-known out there that 
the financial services sector has one of the most mature ISACs 
and is considered by many to be the gold standard for 
information sharing.
    I think that we all need to be cognizant and careful from 
the committee standpoint not to break something that's 
currently working well. So with that in mind, a two-part 
question for you.
    How would the President's legislative proposal affect the 
financial sector's current sharing of cyber threat information? 
Then, second, what recommendations do you have for other 
sectors, based on your experience, and what might be learned 
from the FS-ISAC model?
    Mr. Garcia. Thank you. That's a good question.
    I think the President's proposal is almost explicitly with 
us not targeted at the financial services sector or trying to 
make any improvements to it. There is a recognition that we 
have established a fairly robust and mature information-sharing 
trust community and that the proposal would really try to get 
at many of those noncritical sectors that have not yet engaged 
in this level of information sharing.
    So I would think that, on the edges, the proposal will help 
information sharing broadly and maybe the financial services as 
well, as long as the ISAO model is developed in a way that 
doesn't create too much confusion.
    As I mentioned in my opening statement, we need to have a 
federated information-sharing capability, not a competitive one 
where one ISAO is trying to get more members and, therefore, is 
withholding information from other ISAOs. That's really 
important. If we have Balkanized or siloed information sharing, 
we are defeating the purpose of trying to get broader 
comprehensive situational awareness.
    So for ISAOs standing up, I think we'll look forward to 
providing contributions to the standards development process 
for what constitutes a good information-sharing environment. I 
think key to that is we really started sharing robustly when we 
established a traffic light protocol--red, yellow, green, 
white--a cascade of different definitions of what information 
can be shared with whom and what information cannot be shared.
    That is enforced. It's enforceable and it is enforced. That 
really cements the trust, that you know that, when you're going 
to share this information, that it is not going to be released 
anywhere else where it is not permitted. So that gives a 
contributor some level of confidence that their information is 
going to be protected, but it's also going to be used by other 
members of that community. So that is a key element.
    The other element is having well-trained personnel who are 
able to analyze information and be able to assimilate and 
synthesize all the different feeds that are coming in and make 
sense of it in a way that can provide the users with some kind 
of a coherent guidance for what to do about it.
    Mr. Ratcliffe. Terrific. Thank you, Mr. Garcia.
    Mr. Eggers, I want to come back to you for a second. As I 
mentioned before, I've had listening sessions with different 
groups and one of the things that we've learned is that, you 
know, liability protections are clearly going to be necessary 
to incentivize this information sharing.
    Can you explain what types of liability protections are 
needed and why?
    Mr. Eggers. Sure. Let me just kind of give you a feel for 
the protections, in general, where that liability protection 
fits in.
    So when we look at, let's say, something like the CISA 
bill--which, you know, unless there's maybe hiccups at an 
upcoming mark-up which could happen soon, we will support that 
bill. But I think about liability in terms of kind of four key 
protections. Right? So liability's probably the first and 
foremost liability. Right?
    In the legislation, if you're acting within the terms of 
the bill, you will be getting liability protections for the 
ways in which you share with the private-sector and Government 
entities. There's a few nuances.
    The second is regulatory protection, and the third is FOIA, 
and the fourth is anti-trust. So, if anything, I would mention 
that the liability protection probably sits at the top and is 
probably the most important one of the bunch, if you had to 
single one out.
    Mr. Ratcliffe. So expounding on that, why is private-to-
private sharing so important----
    Mr. Eggers. Generally----
    Mr. Ratcliffe [continuing]. And the liability protections 
associated with that?
    Mr. Eggers. Sure. So within the construct of a voluntary 
program--right?--and I think it's important just to stress 
we're talking about a voluntary program where we're trying to 
create some legal certainty--businesses, when they are, let's 
say, fortunate to be able to identify, let's say, a breach, an 
incident, they've got those bits and pieces of technical data 
that they should share with business partners and the 
governments to provide everyone a better sense of real 
security.
    But a lot of times what we hear from businesses is, ``Hey, 
we want to do the right thing, but we're afraid that the 
information that we share will come back to bite us''--right?--
``It will have a boomerang effect.''
    So they want protections to be able to share that with 
peers, and we encourage that. Right? So if there's some attacks 
that you know of that you can share with others so other folks 
can benefit, stop those attacks, that's a good thing. We want 
them to share with their business partners.
    The FS-ISAC is a great example. But we also want businesses 
to share that narrow threat data with Government, too, so they 
can start to build a bigger picture and help others, Government 
and private sector.
    Mr. Ratcliffe. Terrific. Thank you, Mr. Eggers.
    Dr. Libicki, in addition to threat and indicator 
information sharing, you mentioned two others: The sharing of 
software vulnerabilities with the software vendor and 
information sharing to improve cybersecurity practices.
    In your opinion, what would you suggest as appropriate 
legislative actions to address or enable these two areas?
    Mr. Libicki. I am not sure that you really need that much 
legislative action apart from, you know, appropriations 
authorization sort of information. Let me give you an example.
    I think the total amount of money spent world-wide to 
reward people for finding vulnerabilities in software isn't 
much more than about $10 million a year. When you consider 
that, globally, $70 billion a year are spent on cybersecurity 
tools and services and if you believe that, in fact, reducing 
the number of vulnerabilities can make people safer, there is a 
certain amount of room to increase the amount of money being 
spent on finding vulnerabilities.
    If I had to make a guess, I would say $10 million, which is 
not particularly large in the context of, say, DHS's total 
cybersecurity spending, could do a lot to encourage that kind 
of discovery.
    In terms of the other type of information sharing, every 
particular attack in many ways can be associated with things 
that you could have done differently, better practices, best 
practices. Although we have a canon of best practices today, a 
lot of times our best practices can be described as belt and 
suspenders.
    When you talk to CISOs who cannot afford both belts and 
suspenders, they want some sort of guidance as to which one is 
more important, how important is isolating systems, for 
instance, how important is multi-factor authentication, how 
important is training, how important are a lot of the various 
way that organizations can improve their cybersecurity.
    A lot of the way that you learn how organizations can 
improve cybersecurity is to figure out when something got past 
these particular defenses.
    So where you would want to put more resources in is a 
consolidated effort to try to assess the relative efficacy of 
various cybersecurity measures in the context in which they are 
used, and empowering NIST is one way to do that.
    NIST tends not to want to make those sorts of, ``Well, A is 
better than B decisions.'' But that's the kind of knowledge 
you're going to need for cybersecurity and, I think, in terms 
of R&D funding from NSF and the various ARPAs, is a way to help 
systematize this learning and collect the lessons from this 
learning.
    Mr. Ratcliffe. Thank you, Dr. Libicki.
    Ms. Callahan, in listening sessions with privacy groups, 
I've heard that following the Fair Information Practice 
Principles is a key to protecting Americans' privacies.
    In your opinion, what more can NCCIC do to increase 
transparency and ensure that these principles are followed?
    Ms. Callahan. Thank you, sir.
    The Fair Information Practice Principles, or the FIPPs, are 
the cornerstone for any analysis of analyzing the privacy 
impact of certain considerations.
    As you note, the NCCIC has applied the FIPPs in their 
processes. However, we can always improve. The NCCIC can also 
have--the transparency and the discussion of the effectiveness 
of information sharing I think could be a very valuable tool in 
light of the fact that, you know, we hear a lot about 
information sharing and how does it work? Mr. Garcia has some 
examples that I believe he'll share with you. But I think it's 
also important to understand why this information's being 
shared, what's happening to it, and where is it going.
    Dr. Ozment's testimony earlier this month--or, I guess, in 
February does have some statistics, as does Under Secretary 
Spaulding's, but I think understanding the core elements would 
be an important factor.
    The data minimization that I talked about and the 
procedures that NCCIC and CSNC go through are useful, and I 
think it wouldn't be--it would be good to again describe those 
in more detail and try to get some understanding.
    Finally, the issue about security clearances is a difficult 
one, but at the same time I think we can get more information 
at an Unclassified level perhaps both to explain to the 
private-sector companies who are concerned as well as those 
advocates.
    Thank you.
    Mr. Ratcliffe. Thank you.
    So do you think that the sharing of cyber threat 
information should be exempt from FOIA?
    Ms. Callahan. I think that there are several factors to 
think about. Candidly, the information that I have seen that's 
been shared from private-sector companies or from DHS to other 
Government entities is difficult to parse if you're not a 
computer. You know, we're trying to identify the malware. We're 
trying to identify what the threat is specifically. From a FOIA 
perspective, to understand public policy issues I don't think 
is very helpful.
    Furthermore, I certainly think that companies would be very 
reticent to share that information if, indeed, it was exposed 
to FOIA. I think it probably still meets under the FOIA 
qualifications of Exemption (b)(3).
    So I don't know that we need necessarily new legislation on 
that, but I think that the FOIA exemption is both useful and 
getting the information wouldn't be all that helpful for the 
advocates themselves.
    Mr. Ratcliffe. Thank you, Ms. Callahan.
    Mr. Eggers, what's your perspective on that question?
    Mr. Eggers. I think the exemption from--thank you--the 
exemption from disclosure is a fundamental part of any bill. 
Right? Businesses want to be sharing. We want them to share. 
They don't want to see their names necessarily in the headlines 
because they were trying to do the right thing.
    Mr. Ratcliffe. Terrific. Thank you.
    Pleased to be joined by the gentleman from Florida, Mr. 
Clawson. I'd like to yield to him for questions.
    Mr. Clawson. So you all had the good luck or bad luck of 
coming when it turns out to be a fly-out day, weather day, 
votes at the last second. I mean, you know, you had everything 
going against you. I wouldn't take personal offense to a bunch 
of folks not being here because it is an unusual day up here.
    So I think I have a grasp on what we're trying to do and 
why we're trying to do it. But when I put myself, if I were a 
participating company, with so many different stakeholders, 
particularly if it was a multi-national, I don't know how you 
get this to work.
    It feels like the right thing that the anti-trust blocks 
could get thrown out of the way by the Government. Liability 
insurance feels like a good start, too. But there still feels 
to be a lot of other obstacles that, if I were running my 
company, would give me lots of pause here.
    There's a long list. Right? I mean, first of all, if I was 
and have operated in foreign countries and their governments 
wanted to do this to me, I know I'd just say no.
    So the foreign stakeholders, including security holders, I 
think also makes this a lot more complicated, particularly in 
former Soviet Bloc countries, by the way, where they don't like 
Government involved in their IT systems. So the multi-national 
nature of stakeholders is the first thing that comes to mind.
    The second thing that comes to mind is who's not going to 
participate. If you don't get a big block of people in my 
industry participating, I am not sure I'd want to.
    The third thing I'd say is, ``Isn't this going to slow me 
down?'' More important, the very tool that you seem to be 
putting in place here might help the bad guys. Because if the 
Government does get in the middle almost at any level, it slows 
down, I think what the point is, disseminating data to the 
people that understand the malware as quickly as possible. So I 
could keep going on and on here.
    So I kind of feel like I like the idea. The devil's in the 
details. If I were a business, you'd have to--you know, if I 
were running a business again, you'd have to lay out pretty 
clearly how we would get over some of these obstacles and me 
still keep my fiduciary responsibility to shareholders and the 
other stakeholders in the company.
    When I hear that not everybody wants to participate, I say 
to myself, ``Hmm. I can kind of understand that.'' Now, that's 
from a non-IT guy, by the way. So you all know more about these 
things than I do.
    So take up where I've left off here. Am I on shaky ground 
in terms of these kind of concerns or am I hitting on something 
that you all have already anticipated and addressed prior to 
this in your own studies and activities?
    Mr. Eggers. Congressman, if I may--and then others can join 
me--let me try to come at your questions this way. They're very 
good.
    We're talking about information sharing, but one of the 
things that's positive about the framework is you can be using 
the framework in any country, any province, any State. It's not 
mandatory. It's voluntary.
    So you don't have to come up specially-engineered cyber 
solutions to comply with, let's say, regulations of each 
country. That would not be good. That would be too costly even 
for big companies.
    No. 2, information sharing, voluntary at least under the 
bill that we are championing, the CISA bill currently in the 
Senate, at least in draft form.
    The information-sharing program we're looking to achieve is 
not about surveillance. It's about sharing threat data from 
business-to-business, business-to-government, and, hopefully, 
more and more business-to-government so that can stop future 
attacks.
    The Chamber--we were part of a letter that had----
    Mr. Clawson. Can I interrupt just for a second?
    Mr. Eggers. Sure.
    Mr. Clawson. Business-to-business I understand because, if 
the attack hits here, let's get at the information to--by the 
way, even my competitors. Right?--and so that they can be 
inoculated.
    Mr. Eggers. Uh-huh.
    Mr. Clawson. Why Government?
    Mr. Eggers. We can't fight the bad guys without working 
together. When I think about the threats out there, it's not 
the wayward kid down the street that's having fun, maybe, 
breaking into a computer system.
    It's nation-states. It's people working on their behalf. 
It's super criminal groups that I think Dr. Libicki points out 
is very costly.
    So if we're going to--and I like to think of an 
information-sharing bill. It's trying to knock the bad guys 
off-balance. Right? We need to push them off-balance. Right?
    We're going to share and be more resilient, meaning 
industry and Government. So we need to work together. We can't 
tackle nation-states or their proxies solo. We can't do it. So 
we need to work together, and we need to do it smartly.
    Mr. Clawson. Anybody else?
    Mr. Garcia. Sure. I agree with Mr. Eggers. I think, you 
know, when you look at this very complicated world of cyber 
threats, the industry has information that the Government does 
not have globally. We are located around the world. The 
Government has information that we do not have, Classified 
information, information about nation-state activities. If 
we're not fusing that together, we're really not getting a 
broad situational awareness. So we are not where we should be.
    The financial sector has been working closely with the 
Government to think about the ways to improve the bidirectional 
sharing of information between industry and Government, and the 
Government agencies recognize that internally they need to 
improve their processes or how do they process information 
within the Government and then what's the tear line, meaning 
what's the really critical information that can be sent to the 
private sector, leaving the sources and methods, which is 
Classified, out of it because we don't need that information.
    So we're working through that process of trying to improve 
content and procedures. It isn't easy. Government is not--
there's many agencies in the Government with different cultures 
and different ways of doing things. The same goes with the 
private sector. So----
    Mr. Clawson. Am I right to say that the further down you 
push the actual activity, meaning Government becomes an abler, 
facilitator, as opposed to active participant, there's an 
inverse relationship so you'll get more--if less Government's 
involved on a direct basis, more companies will voluntarily 
sign up.
    Am I right or wrong about that? You see, I know what I 
would feel. I know what I would think.
    Mr. Garcia. Yes. And----
    Mr. Clawson. It feels like it will be quicker without the 
Government being a direct participant, and it feels like it 
will be, you know, less risky in a lot of ways if I am doing 
this peer-to-peer with protection of the Government as opposed 
to the Government being the clearinghouse and interpreter of 
the data.
    Mr. Garcia. We wouldn't look at the Government as a 
clearinghouse or interpreter either, but we do see them as a 
partner that--again, they can provide information we don't have 
and vice versa.
    Yes, I think there will be companies and organizations out 
there that have less trust in working with the Government for 
the liability concerns that Mr. Eggers has articulated, but the 
same goes for company-to-company at times. We're dealing with 
competitors.
    In the financial sector, it's not quite the same thing. We 
are all competitors in financial services. But when it comes to 
cybersecurity, we're all in it together. It is not a 
competitive issue. So we've gotten over that hurdle.
    We understand that we have to proceed on the assumption 
that we are all under attack every day and we are all going to 
get hit at one point or another. So let's just come to the 
table with that and admit that. ``Now, what are we going to do 
about it together?''
    That's a trust relationship that has been building over 
time. Other industry sectors, not as much. Hopefully, this 
information-sharing and analysis organization model that the 
administration is trying to incentivize--maybe that will move 
other companies toward more trust-sharing models not just among 
themselves, but with the Government.
    Mr. Eggers. Congressman Clawson, if I may, let me add to 
that.
    So you had mentioned about business interest and 
information sharing. The Chamber was one of about 35 
associations representing--I don't know--back of the envelope, 
maybe 80 to 90 percent of the U.S. economy, stating that, ``We 
need a good bill that clears away the legal policy underbrush, 
gives us certainty that, when we are sharing, we are 
protected.''
    Mr. Clawson. That's easy. Right? I mean, we all agree on 
that. I mean----
    Mr. Eggers. So one thing I might add, if I just may--you 
mentioned slowing things down--one thing that we are looking 
at--and the jury's still out with respect to the Executive 
Order on cyber information sharing, at least February 13--is 
the standards/best practices element of standing up more 
ISAOs--right?--or at least having organizations declare that 
they've self-certified it at a future date, that they are 
following certain standards/best practices.
    One of the things that I think gives our members pause is 
not that you're going to be holding up an entity as a model for 
how to share well. What we're concerned about is, in that 
process of creating standards, highlighting best practices, 
that that could kind of gum up the information-sharing works.
    Mr. Clawson. Right. Right. I mean, look, if I wanted to get 
a good laugh out of my employees, two lines I could say: 
``We're from corporate and we're here to help''--that always 
got a chuckle--or ``We're from the Government and we're here to 
help.''
    You know, employee stakeholders have had long-time 
experience of hearing people say that and then it goes wrong on 
them. You know, that's the--for this to work, whether you're 
the Chamber or whoever we are, we would have to be able to 
convince the companies and, more importantly, the folks that 
are running the IT systems and the ERPs that both corporate 
and, you know, in this case, the Government, is really not 
going to slow them down.
    I think clearing out the underbrush, as you say--I mean, 
that's a no-brainer. Right? I mean, take away the anti-trust 
and take away the liability and we're much more likely to 
share.
    But then, after that, after many years in the private 
sector, this story gets more murky to me as, you know, good 
intentions where things could easily go wrong or not get enough 
companies to participate to make a difference.
    I'm glad that the financial sector is in that position, but 
having been involved in other sectors, I am really pretty sure 
that they're not nearly as organized and that their industries, 
by the way, are not nearly as consolidated.
    So, you know, in the financial--we still have got a lot of 
community banks left, but it's a much more consolidated 
environment than it is in a lot of other industries. Those 
unconsolidated environments are a different animal. I don't 
know if that's even a word or not. But that's a different 
animal than what you're talking about.
    I don't want to take all the time here. But give me a 
reaction on whether I'm all wet here.
    Mr. Garcia. Well, you know, you can see where there are 
times when information sharing has slowed down, for example, 
when something is subject to law enforcement investigation. 
Okay?
    Now no one can talk about it and you can't actually 
disseminate the facts about something that, if other potential 
victims had that information, they could shut down systems that 
might otherwise be attacked.
    So, yeah, there will be situations where trying to engage 
with the Government is going to slow things down. There are 
other situations where it's going to speed things up.
    For example, we had worked within the NCCIC cooperatively 
with DHS. There was a point-of-sale malware called Backoff that 
was infecting a lot of different retail outlets all over the 
country.
    Actually coming together, we fused information that DHS had 
and what the financial sector had, and we made sense of what 
this point-of-sale malware was doing. We pushed out a joint 
product, basically said, ``Here's the threat. Here's what it's 
trying to do. Here's what you need to do to fix it.''
    One of the participants in the activity had something like 
50 stores located in 24 different States where they actually 
took that advice and they made the correction before it----
    Mr. Clawson. Who identified the malware?
    Mr. Garcia. That could have been--I don't have the 
specifics. It could have been from law enforcement. Often law 
enforcement can find certain malware----
    Mr. Clawson. Or an outside contractor to----
    Mr. Garcia. It comes from many different places. It can 
come from security companies who are on contract. It can come 
from law enforcement that's doing their own investigative 
forensics work. It can come from a member company of the FS-
ISAC. It can come from an analyst at DHS or the intelligence 
community.
    It's a matter of having that automated phone tree, if you 
will, where we can bring all of those sources of intelligence 
together and make sense of it. Sometimes it's slow. Sometimes 
it's faster.
    We're trying to get ourselves to a point of more automated 
threat information sharing where we actually can take out some 
of the human dimension of having to pick up a phone and call 
somebody or send an email saying ``Did you see what I just 
saw?'' and, actually, the machines are recognizing these kinds 
of----
    Mr. Clawson. Looking for patterns.
    Mr. Garcia. Yeah.
    Mr. Clawson. Dr. Libicki.
    Mr. Libicki. Yes.
    Mr. Clawson. Anything to add?
    Mr. Libicki. Yes. I want to add to some of the comments.
    I think we have a common stake in better cybersecurity. 
Okay? In a world in which, say, one bank is subject to an 
attack that causes people to lose trust in the bank, their 
neighbor across the street isn't going to be better off. In 
many ways, they're going to be worse off.
    The attack that makes people wonder if they can give a 
credit card to one merchant isn't going to necessarily have 
them running to another merchant. It's going to complicate the 
response of everybody who wants to use credit cards in 
commerce. For that reason, there is going to be a common 
interest in information security, in cybersecurity, and 
improving it across the lot.
    To a large extent we shouldn't forget that the Government 
organizations themselves have an interest in their own 
cybersecurity and there's information on best practices, on how 
to make good decisions, that they can learn from the rest of 
the economy, or the benefits that they get from closing 
vulnerabilities in software used in business also helps the 
Government organizations preserve their own systems, preserve 
their own confidentiality in their systems and----
    Mr. Clawson. That's a good point.
    Mr. Libicki [continuing]. Authentication.
    Mr. Clawson. That's a good point.
    Ms. Callahan. If I may, sir, just to follow up, I think 
about information sharing both among the companies and, also, 
with and from the Government as kind of three-dimensional 
chess. You need to know where each of the different elements 
are, as Mr. Garcia and Dr. Libicki talked about, and you may 
not have the complete picture unless you get all of the 
information.
    I completely agree with you that you don't want the 
Government in your business dealing with what the threat is 
itself, but you do want to share the information that you've 
figured out or maybe a contractor figured out or maybe the 
Government figured out.
    So it's to share the information as broadly as possible, 
but not to have the Government come and, you know, deal with 
the information or address the cyber threat unless it's a 
critical scenario.
    Mr. Eggers. Congressman, if I may just add a quick point, 
one thing I think about or at least our members think about in 
terms of getting from Point A to Point B, A to Z, on an 
information-sharing bill, a bill that clears both Chambers and, 
hopefully, gets to the President's desk this year, is, even 
though it's important to protect privacy, that we not lose 
sight of the burdens that we could place on small and mid-sized 
businesses to scrub personal information.
    Those kinds of provisions will be in a bill, but I want to 
make sure that we not go too far that we're essentially, from a 
practical standpoint, having the small and mid-sized guys sit 
on the sidelines because they feel like they can't scrub 
personal information adequately or do it at least under the 
terms of any future bill.
    Mr. Clawson. Boy, that's a tough balance. I mean, I thought 
about this all day. We talked about it with our team. With 
small businesses that don't have a lot of dedicated resources 
and often outsource anything of any complexity with regards 
to--I mean, they even outsource their own ERP system. Right?
    You know, to get a bill which will convince those folks to 
participate in a voluntary program that could make their life 
more difficult and still get the bill through--because you're 
going to have folks like me that are going to say, ``I'm just 
not fond of the Government being in my cell or in my ERP, 
either one, really.''
    That's going to be a neat trick. Right? I mean, that just 
doesn't feel like it will be easy to do. I'm not trying to be 
critical. It just feels like a mountain to climb here to get it 
just right where you don't make it so onerous that no one signs 
up. But you have got to have something that has enough impact 
to get the bill passed.
    Am I making sense?
    Mr. Eggers. Yes. One quick brief note on that is, when I 
say small and mid-sized guys just generically, I'm thinking in 
a lot of ways some of the supply chain elements of, let's say, 
a bigger firm.
    If those smaller companies are hacked, we want them to have 
the confidence that they report, let's say, to the bigger 
company and a lot of times the Government won't necessarily 
have to be in their systems.
    What they will be doing is sharing those technical bits and 
pieces of information that the bigger company can use and, 
let's say, law enforcement can use to build a case against 
folks probably overseas.
    Mr. Clawson. Well, if I can help you--I mean, I'm playing 
devil's advocate here, obviously. But I'm doing it because I'm 
trying to--you know, I hope this works. I don't want it to 
fail. We want it to work.
    Mr. Eggers. Agreed.
    Mr. Clawson. So I think the more front-end conversations 
you have like this one--and I know you're doing that every day 
with people that are out there--the better your chances of 
getting people to participate.
    Because, if they don't come around, we're dead. Right? I 
mean, if it's a voluntary program and no one signs up, then 
it's not going to do us much good.
    Ms. Callahan. I think, for the small and medium-sized 
businesses, the automated sharing that Mr. Garcia talked about 
can really help facilitate that. Therefore, the more people can 
participate, the bigger the pie, so to speak, the more you can 
share, the less burden it is on the small and medium-sized 
enterprises.
    Mr. Clawson. I yield back.
    Thank you, everybody, for your patience with me.
    Mr. Ratcliffe. I thank the gentleman.
    I agree with the gentleman that weather has definitely 
affected attendance today. But I know that my colleagues on 
both sides of the aisle see this as a critically important 
issue, as evidenced by the fact that a number of them were with 
me earlier this morning and with the Chairman, touring the 
NCCIC.
    So, with that, I am very grateful to the witnesses for 
their valuable testimony. I know that it will inform this 
committee as we move forward.
    I thank my colleague for his questions.
    The Members of the committee may have some additional 
questions for witnesses, and we'll ask them to respond to these 
in writing. Pursuant to committee rule 7(e), the hearing record 
will be held open for 10 days.
    Without objection, the subcommittee stands adjourned.
    [Whereupon, at 4:08 p.m., the subcommittee was adjourned.]
                             
                             [all]
```