U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

94–272 PDF 2016

S. Hrg. 114–412 

PROTECTING AMERICA FROM CYBER ATTACKS: 

THE IMPORTANCE OF INFORMATION SHARING 

HEARING 

BEFORE THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

ONE HUNDRED FOURTEENTH CONGRESS 

FIRST SESSION 

JANUARY 28, 2015 

Available via the World Wide Web: http://www.fdsys.gov/ 

Printed for the use of the 

Committee on Homeland Security and Governmental Affairs 

( 
(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

RON JOHNSON, Wisconsin Chairman 

JOHN MCCAIN, Arizona 

ROB PORTMAN, Ohio 

RAND PAUL, Kentucky 

JAMES LANKFORD, Oklahoma 

MICHAEL B. ENZI, Wyoming 

KELLY AYOTTE, New Hampshire 

JONI ERNST, Iowa 

BEN SASSE, Nebraska 

THOMAS R. CARPER, Delaware 

CLAIRE MCCASKILL, Missouri 

JON TESTER, Montana 

TAMMY BALDWIN, Wisconsin 

HEIDI HEITKAMP, North Dakota 

CORY A. BOOKER, New Jersey 

GARY C. PETERS, Michigan 

KEITH B. ASHDOWN, Staff Director 

WILLIAM H.W. MCKENNA, Investigative Counsel 

SEAN C. CASEY, Senior Professional Staff Member 

GABRIELLE A. BATKIN. Minority Staff Director 

JOHN P. KILVINGTON, Minority Deputy Staff Director 

STEPHEN R. VIN ̃ A, Minority Chief Counsel for Homeland Security 

MATTHEW R. GROTE, Senior Professional Staff Member 

LAURA W. KILBRIDE, Chief Clerk 

LAUREN M. CORCORAN, Hearing Clerk 
(III) 

C O N T E N T S 

Opening statements: Page 

Senator Johnson ............................................................................................... 1 

Senator Carper ................................................................................................. 3 

Senator Lankford .............................................................................................. 14 

Senator Booker ................................................................................................. 16 

Senator Ernst .................................................................................................... 18 

Senator Baldwin ............................................................................................... 19 

Senator McCain ................................................................................................ 20 

Senator Ayotte .................................................................................................. 22 

Prepared statements: 

Senator Johnson ............................................................................................... 33 

Senator Carper ................................................................................................. 34 

WITNESSES 

WEDNESDAY, JANUARY 28, 2015 

Marc D. Gordon, Executive Vice President and Chief Information Officer, 

American Express ................................................................................................ 2 

Scott Charney, Corporate Vice President, Trustworthy Computing, Microsoft 

Corporation ........................................................................................................... 4 

Peter J. Beshar, Executive Vice President and General Counsel, Marsh and 

McLennan Companies ......................................................................................... 6 

Richard Bejtlich, Chief Security Strategist, FireEye ............................................ 7 

Gregory T. Nojeim, Senior Counsel and Director of the Freedom, Security 

and Technology Project, Center for Democracy and Technology ...................... 9 

ALPHABETICAL LIST OF WITNESSES

Bejtlich, Richard: 

Testimony .......................................................................................................... 7 

Prepared statement .......................................................................................... 61 

Beshar, Peter J.: 

Testimony .......................................................................................................... 6 

Prepared statement .......................................................................................... 54 

Charney, Scott: 

Testimony .......................................................................................................... 4 

Prepared statement .......................................................................................... 44 

Gordon, Marc D.: 

Testimony .......................................................................................................... 2 

Prepared statement .......................................................................................... 37 

Nojeim, Gregory T.: 

Testimony .......................................................................................................... 9 

Prepared statement .......................................................................................... 65 

APPENDIX 

Additional statements for the Record: 

Chamber of Commerce ..................................................................................... 77 

ICBA .................................................................................................................. 80 

NACFU .............................................................................................................. 82 

TIA ..................................................................................................................... 85 

(1) 

PROTECTING AMERICA FROM CYBER 

ATTACKS: THE IMPORTANCE OF 

INFORMATION SHARING 

WEDNESDAY, JANUARY 28, 2015 

U.S. SENATE,

COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS, 

Washington, DC. 

The Committee met, pursuant to notice, at 1:34 p.m., in room 

SD–342, Dirksen Senate Office Building, Hon. Ron Johnson, Chairman of the Committee, presiding. 

Present: Senators Johnson, McCain, Lankford, Ayotte, Ernst, 

Sasse, Carper, Baldwin, Booker and Peters. 

OPENING STATEMENT OF CHAIRMAN JOHNSON 

Chairman JOHNSON. This hearing will come to order. Senator 

Carper is on his way, but we have just been told we can get going 

here. 

I want to keep my opening remarks very brief because we do 

have votes and I want to make sure we get to the testimony. But 

I want to thank the witnesses for their very well thought out, wellprepared testimony, certainly the written testimony. I am looking 

forward to your oral testimony. I want to thank you for your flexibility. We have obviously moved the hearing up. 

We have in this Committee agreed upon a mission, and the mission is pretty simple: to enhance the economic and national security of America. If we focus on that goal, a goal that we all share— 

whether you are Republican or Democrat, we really share that. 

And particularly when it comes to this cybersecurity hearing about 

sharing information to protect our cyber assets, it is also a goal we 

share. So if we concentrate on that, recognizing there are different 

viewpoints on this, I think we have a far better chance of actually 

succeeding. So when Senator Carper gets here, we will give him a 

chance to have an opening statement. 

The tradition of this Committee is to swear in witnesses, so I 

would ask the witnesses to stand and raise their right hands. Do 

you swear that the testimony you will give before this Committee 

will be the truth, the whole truth, and nothing but the truth, so 

help you, God? 

Mr. GORDON. I do. 

Mr. CHARNEY. I do. 

Mr. BESHAR. I do. 

Mr. BEJTLICH. I do. 
2 

1The prepared statement of Mr. Gordon appears in the Appendix on page 37. 

Mr. NOJEIM. I do. 

Chairman JOHNSON. Thank you. 

What I would like to do is get right into testimony then, and I 

will start with Marc Gordon. He is the Executive Vice President 

and Chief Information Officer (CIO) of American Express. He previously served as CIO of Bank of America and Best Buy. Mr. Gordon, your testimony, please. 

TESTIMONY OF MARC D. GORDON,1 EXECUTIVE VICE PRESIDENT AND CHIEF INFORMATION OFFICER, AMERICAN EXPRESS 

Mr. GORDON. Thank you, Chairman Johnson and Members of the 

Committee. As you heard, my name is Marc Gordon. I am the Executive Vice President and CIO at American Express. I oversee the 

global technology organization for our company, as well as information security, and I really appreciate the opportunity to testify before this Committee on information sharing. It is a topic that I am 

very passionate about. 

Based on my experiences as CIO across both the retail sector and 

the financial services sector in Fortune 100 companies, I would 

strongly urge the Committee to move forward swiftly with information-sharing legislation. I believe that effective information sharing 

may actually be the single highest-impact, lowest-cost, fastest-toimplement capability we have at hand as a sector and as a Nation 

to raise the level of capability against the many and varied threats 

that we face. The way I like to think about it is an attack against 

a single company can be the entire sector’s and Nation’s defense, 

quickly shared. 

I realize you are familiar with the threat landscape, and we have 

included many examples in my written testimony on the nature 

and the scale of the threats we face. I will not go through those 

now. What I would emphasize here is that while cyber crime is 

growing meaningfully for us and across industries, we are increasingly concerned about what appears to be the convergence of players, capabilities, and intentions—namely, nation-state players or 

those with nation-State capabilities with a particular attention 

around destructive intent across industries. 

In response to these threats, the financial services industry has 

invested literally billions of dollars to protect our networks. But 

there are steps that we can take together within and across industries and with the government to make the total ecosystem more 

secure. 

And while there is some sharing of information today, I would 

characterize it as highly variable within industries, and especially 

highly variable across industries. And meaningful legislation I believe would expand both the quality and volume of cyber information sharing and raise the security level overall for all of us. 

But legal barriers and the threat of lawsuits are obstacles to information sharing today, and that is where legislation that provides targeted protections from liability and disclosure is sorely 

needed. 
3 

There are a few notable items that I would also emphasize today 

in terms of attributes of information sharing that we believe are 

particularly important for effective information sharing and to have 

the desired results. 

First is an emphasis on real-time sharing. 

Second is liability and disclosure protection, not just for sharing 

but also for acting within one’s own network on the information 

that is shared. 

Third, that the protections that are afforded in terms of liability 

and disclosure and so forth are extended not just to governmentsanctioned entities but to private entities, businesses sharing 

among themselves. We feel that is actually very important. 

And, finally, that the sharing needs to be bi-directional, that is 

to say, we believe the government should be directed to share in 

the right way classified indicators only known and knowable from 

the government. We think that is a big value add to this proposition for the private sector as we protect our customers’ information. 

Finally, we are committed to protecting the privacy of our customers’ information and believe that concerns around privacy protection should be discussed but can be effectively addressed in the 

legislation. 

Again, I just want to thank you for asking me to be here today. 

I look forward to working with this Committee and other Members 

of the Senate and House, and I look forward to helping in any way 

that we can. 

That concludes my prepared remarks, and I would be happy to 

answer questions. 

Chairman JOHNSON. Well, thank you, Mr. Gordon. 

Our Ranking Member has arrived, so, Senator Carper, do you 

have some opening comments? 

OPENING STATEMENT OF SENATOR CARPER 

Senator CARPER. As we say in Delaware, bienvenido. [Laughter.] 

Bienvenido. We are happy you are here, looking forward to this 

hearing. This is a timely, important topic. Let us see what we can 

learn from all of you. 

Thank you. 

Chairman JOHNSON. Thank you for that. 

Our next witness is Scott Charney. He is the Corporate Vice 

President of Microsoft’s Trustworthy Computing Group where he 

focuses on the security and privacy of Microsoft’s products. Scott 

has also worked for PricewaterhouseCoopers and as Chief of the 

Justice Department’s Computer Crime and Intellectual Property 

Section. 

Mr. Charney, you have the floor. 
4 

1The prepared statement of Mr. Charney appears in the Appendix on page 44. 

TESTIMONY OF SCOTT CHARNEY,1 CORPORATE VICE PRESIDENT, TRUSTWORTHY COMPUTING, MICROSOFT CORPORATION 

Mr. CHARNEY. Chairman Johnson, Ranking Member Carper, and 

Members of the Committee, thank you for the opportunity to appear today at this important hearing. My name is Scott Charney, 

and I am the Corporate Vice President for Trustworthy Computing 

at Microsoft. It is good to see the Committee’s first hearing of the 

114th Congress focuses on cybersecurity. I commend this Committee and the Members of the Senate for addressing one of America’s most complex challenges. 

Let me start by describing the cyber threat. The threat comes in 

two forms: 

First, there are opportunistic criminals who, like burglars testing 

doorknobs, do not care who falls prey as long as someone does. 

Second, there are actors described as advance persistent threats 

because they are intent on compromising a particular victim. 

These two different types of threats require somewhat different 

responses. Basic computer hygiene—such as running the latest 

version of software, applying updates, and using antivirus products—can thwart many opportunistic threats. Addressing advanced 

persistent threats, however, requires much more. Computer security professionals must prevent, detect, and respond to sophisticated attacks. 

Knowing about threats, vulnerabilities, and incidents can help 

computer security professionals and others take the right action. So 

how does such information sharing occur in practice. Simply put, 

a party collects information, identifies a computer security issue, 

and then shares it with those who can act on it. The recipient uses 

that information to prevent, detect, or respond to the event, normally collecting more data and sharing it in return. Often parties 

are added to the process as the evidence dictates. Throughout this 

process, all parties will maintain the data responsibly, protecting 

its confidentiality as appropriate. 

Does this work? Absolutely. For example, Microsoft has 

partnered with other companies and law enforcement agencies to 

take down two botnets which had infected millions of computers 

around the world and were each responsible for over $500 million 

in financial fraud. 

So if information sharing is so important and so helpful, why is 

such sharing limited? The short answer is that those with critical 

information are often unable or unwilling to share it. They may be 

unable to share it due to law, regulation, or contract, all of which 

create binding obligations of secrecy and expose a company to legal 

risk if information is shared. 

There are also other risks. For example, a company that discloses 

its vulnerabilities may suffer reputational risk, and such a disclosure may even make security matters worse if hackers leverage 

that information for further attacks against that company or anyone else. 

In light of these issues, how can information sharing be encouraged? While my written testimony detailed six core tenets that 
5 

must guide any information-sharing proposal, let me describe the 

most important tenets here. 

First, privacy is a fundamental value and must be protected 

when sharing information. While users around the world may have 

different views about privacy, they want assurances that the information they entrust to others is used properly and protected. It is 

also important that governments adhere to legal processes for law 

enforcement and national security requests and do not use computer security information-sharing mechanisms to advance law enforcement and national security objectives. 

Second, government and industry policies on information sharing 

should take into account international implications. Many U.S. 

businesses are multinational companies. If not properly constructed, rules in the United States can discourage foreign markets 

from using U.S. technology products and services, as well as lead 

to reciprocal requirements that could undermine U.S. security. 

Third, while information sharing has benefits, it also poses business risks that must be mitigated. As noted, sharing information 

can expose an organization to legal, regulatory, contractual, and 

reputational risks. Any information-sharing regime must attempt 

to reduce these risks by providing appropriate liability protections. 

Finally, information sharing need not follow a single structure or 

model, and governments should not be the interface for all sharing. 

Information sharing already occurs through both formal and informal processes, within industry and between industry and government, and sometimes across national borders. There is no single 

model because situations and desired outcomes differ. Flexibility is 

critical. 

With current practices and those tenets in mind, how should we 

think about information-sharing legislation? In a nutshell, Congress should ensure that existing information-sharing arrangements are left undisturbed, ensure the protection of civil liberties, 

and reduce disincentives to sharing. This can be done in the following three ways: 

First, the legislation should be scoped to cover information that 

reasonably enables defenders to address cyber threats. 

Second, the legislation should be designed to protect privacy and 

civil liberties by requiring data be anonymized, restricting secondary uses, protecting against inappropriate disclosure, and requiring the government to seek a court order when attempting to 

pierce the veil of anonymity. 

Third, the legislation should grant appropriate liability protection for sharing information while recognizing that companies must 

fulfill their contractual obligations to their customers. 

Thank you for the opportunity to testify, and I look forward to 

working with the Committee on this effort. 

Chairman JOHNSON. Thank you, Mr. Charney. 

Our next witness is Peter Beshar. He is the Executive Vice President and General Counsel of Marsh & McLennan Companies. Before joining Marsh, Mr. Beshar was a partner in Gibson, Dunn & 

Crutcher. Mr. Beshar. 
6 

1The prepared statement of Mr. Beshar appears in the Appendix on page 54. 

TESTIMONY OF PETER J. BESHAR,1 EXECUTIVE VICE PRESIDENT AND GENERAL COUNSEL, MARSH & MCLENNAN COMPANIES 

Mr. BESHAR. Thank you, Chairman Johnson, Ranking Member 

Carper, and Members of the Committee. 

The evolution in the sophistication and intensity of cyber attacks 

in 2014 was astonishing. And as bad as it was in 2014, it got worse 

in the last month. In December, the German Government reported 

that hackers had caused massive damage to an iron plant by disabling the electronic shut-off systems that turned off the furnaces. 

And this escalation of cyber attacks reflects a troubling threat 

posed to our critical infrastructure. 

I would like to focus my remarks this afternoon on cyber insurance. Some of you may be saying, ‘‘What relevance does cyber insurance have to this issue?’’ And we would say it has a lot, that 

cyber insurance has the potential to create powerful incentives that 

drive behavioral change in the marketplace and that fundamentally that is what this Committee, what the Congress, and all of 

us are trying to accomplish. 

The simple act of applying for cyber insurance forces companies 

to conduct meaningful gap assessments of their own capabilities because insurers will want to know: Do you have an incident response plan? Do you have good protocols for patching software? Are 

you regularly monitoring your vendor network? And this process in 

and of itself is an important risk mitigation tool. 

Once a cyber policy is purchased, the incentive then shifts to the 

insurer to try to assist the policy holders to the greatest extent possible to avoid or mitigate attacks. And so you are seeing many insurers now offering an array of services like monitoring and behavioral analytics and rapid response that help policy holders, and the 

market is really responding. So in 2014, the number of our clients 

that purchased stand-alone cyber coverage increased by 32 percent 

over the prior year. And we tracked specifically which sectors of the 

economy the cyber take-up rates were the highest, and so they are 

sectors like health care, education, and hospitality and gaming. 

Each of these industries handles a substantial volume of sensitive 

data. We also saw meaningful increases in the power and utility 

sector. 

We also tracked pricing trends on the premiums for cyber insurance, and if you read the headlines alone, you would assume that 

premiums went up meaningfully. And, in fact, year-over-year pricing was really quite stable. Some industries were up, some industries were down. What we did witness in the fourth quarter of 2014 

was in the retailing sector in particular, premium prices went up 

for obvious reasons. And underwriters really began differentiating 

between those retailers that were implementing the most sophisticated defenses on point-of-sale systems—end-to-end encryption, for 

example—and those retailers that were not doing so. And, thus, 

you are seeing insurance market forces really begin to drive incentives and create meaningful reasons to make the type of investments in cyber defense that we would want. And this phenomenon, 

Chairman, has occurred many times in many industries—workers’ 
7 

1The prepared statement of Mr. Bejtlich appears in the Appendix on page 61. 

compensation, for example. Insurers were part of the bold work to 

really identify safety protocols that would improve the security of 

workers in the workplace. And over the last two decades, you have 

seen the number of fatalities in the workplace drop by over 35 percent. And this is the type of dynamic that we would like to see unleashed in the cyber insurance arena where carriers begin to give 

companies specific credit for implementing two-factor authentication or other meaningful protections like detonation software. In 

sum, cyber insurance is one element of many in a holistic risk mitigation strategy. 

A second key element, as this Committee has recognized, is information sharing between industry and government. To accelerate 

the identification and detection of emerging threats, there needs to 

be greater trust and greater real-time threat information sharing, 

and it should be, as other witnesses have commented, more reciprocal. 

Accordingly, we support the sharing of cyber threat indicators, 

like malware threat signatures and known malicious Internet Protocol (IP) addresses, provided that reasonable liability protections 

and privacy considerations are addressed. We believe that the dual 

considerations of national security and privacy can be fairly and 

appropriately balanced. 

Thank you, Mr. Chairman. 

Chairman JOHNSON. Thank you, Mr. Beshar. 

Our next witness is Richard Bejtlich. He is the Chief Security 

Strategist at FireEye. He is also a non-resident senior fellow at 

Brookings and previously directed General Electric’s Computer Incident Response Team. Mr. Bejtlich. 

TESTIMONY OF RICHARD BEJTLICH,1 CHIEF SECURITY 

STRATEGIST, FIREEYE 

Mr. BEJTLICH. Thank you, Chairman Johnson, Ranking Member 

Carper, Members of the Committee. I appreciate the opportunity to 

testify today. I am Richard Bejtlich, Chief Security Strategist at 

FireEye. Our Mandiant consulting service, known for its 2013 report on Chinese PLA Unit 61398, helps companies identify and recover from intrusions. 

So who is the threat? 

We have discovered and countered nation-state actors from 

China, Russia, Iran, North Korea, and other countries. The Chinese and Russians tend to hack for commercial and geopolitical 

gain. The Iranians and North Koreans extend these activities to include disruption via denial of service and sabotage using destructive malware. We have helped companies counter organized crime 

syndicates in Eastern Europe and elsewhere. Our recent report on 

a group we call ‘‘FIN4’’ described intrusions to facilitate insider 

trading. We have also encountered hacker teams for hire and others who develop and sell malicious software, or malware. 

How active is this threat? 

In March 2014, the Washington Post reported that in 2013, Federal agents, often the Federal Bureau of Investigations (FBI), notified more than 3,000 U.S. companies that their computer systems 
8 

had been hacked. This count represents clearly identified breach 

victims, and many were likely compromised more than once. 

In my 17 years of doing this work, this is the single best statistic 

I have ever seen as far as just how bad the problem is. 

Serious intruders target more than the government, defense, and 

financial sectors. No sector is immune. 

But how do victims learn of a breach? In 70 percent of cases— 

and this has held up through our own consulting and also through 

other companies that we work with—someone else, usually the 

FBI, tells a victim about a serious compromise. Only 30 percent of 

the time do victims identify intrusions on their own. The median 

amount of time from when an intruder initially compromises a victim to when the victim learns about the breach—and, remember, 

most of the time they are being told by someone else. That time, 

according to our research for 2014, is 205 days. This number is better than last year’s count, which was 229 days and the year before, 

in 2012, which was 243 days. So we are making progress, but intruders still spend about 7 months inside a victim network before 

anyone notices. 

So what is the answer? 

Well, as Mr. Chairman mentioned, so-called network hygiene 

only gets you so far. We need more strategy here, and in my opinion, the best strategy is to prevent as many intrusions as possible, 

clearly; but we need to quickly detect attackers who evade regular 

defenses, respond appropriately, before the adversary accomplishes 

his mission. Strategically significant intrusions do not occur at the 

speed of light. It takes intruders time, from hours to weeks, to 

move from their initial foothold to the information that they seek. 

So defenders win when they stop intruders from achieving their 

objectives. I recommend two metrics that we could track to see 

whether this is the case, to include the Federal Government. 

The first metric is tracking simply the number of intrusions or 

the types of intrusions that occur in a given year. There are many 

companies I visit, and I ask that simple question. They cannot answer that question. 

The second metric is to measure the amount of time that elapses 

from when the intruder gets into your network and you notice. We 

want that number to be as small as possible. 

Well, how does threat intelligence play into this? 

‘‘Threat intelligence’’ refers to the tactics, tools, and procedures 

used by intruders to abuse software and networks. It does not depend upon sensitive information about U.S. persons. And I will 

note that the President’s proposal is compatible with this definition 

of ‘‘threat intelligence.’’ 

Will that help? 

Threat intelligence will help defenders more quickly resist, identify, and respond to intrusions, but only if the organization is postured to succeed. Unless you have a sound strategy, the right technology, people, and processes, no amount of threat intelligence will 

help you. 

There are usually three cases for sharing threat intelligence: 

from the government to the private sector; within the private sector, and from the private sector to the government. And all three 

face challenges. 
9 

1The prepared statement of Mr. Nojeim appears in the Appendix on page 65. 

In the government-to-private scenario, I recommend or I encourage the government to grant clearances to private security teams 

who are not working on government contracts. The government 

should also augment their narrative style reports—in other words, 

text and sentences—with appendices that are in machine-readable 

format so we could facilitate that real-time sharing that was mentioned by my colleagues. 

In the private-to-private case, I would second the idea of having 

more information-sharing organizations in the private sector. 

And now we get to the toughest case, and this is the private-togovernment case, and it is contentious, for two reasons. 

First, companies are reluctant to publicize they have breaches 

besides what is necessary to comply with laws. So the private sector fears penalties if they disclose. So I would recommend that they 

not be held liable simply for notifying the government that they 

have been compromised. 

Second, some privacy advocates fear that liability protection will 

let companies submit customer data to the government. If you 

properly format threat intelligence, this will not be a problem. In 

my written testimony, I have an example of a pilot program in the 

government involving the Department of Energy that we think is 

doing a decent job working with this sort of information, but I will 

leave that to your questions. 

Again, I thank you for the opportunity to testify. 

Chairman JOHNSON. Thank you, Mr. Bejtlich. 

Our next witness is Gregory Nojeim. He is the Senior Counsel 

and Director of the Freedom, Security & Technology Project at the 

Center for Democracy & Technology. Greg previously served as Associate Director and Chief Legislative Counsel in the ACLU’s 

Washington legislative office. 

Mr. Nojeim. 

TESTIMONY OF GREGORY T. NOJEIM,1 SENIOR COUNSEL AND 

DIRECTOR OF THE FREEDOM, SECURITY & TECHNOLOGY 

PROJECT, CENTER FOR DEMOCRACY & TECHNOLOGY 

Mr. NOJEIM. Thank you, Senator Johnson, Senator Carper, Members of the Committee. I am pleased to testify on behalf of the Center for Democracy and Technology (CDT). We are nonpartisan, nonprofit technology policy organization dedicated to protecting civil 

liberties and human rights on the Internet. We applaud the Committee for holding the first hearing of the 114th Congress on 

cybersecurity. It is an important issue. It should be a particularly 

important issue for this Committee. It can play a key role in addressing the information-sharing problem. 

I am going to explain today the role that information sharing can 

play in countering the threat of cyber attacks. I will identify different approaches to encouraging information sharing as well as 

the essential civil liberties attributes of a successful informationsharing policy. 

Other panelists have already described very well the direct 

harms of cyber attacks. I will just add one: Major cyber attacks on 

Target, JPMorgan Chase, Home Depot, and Sony Pictures com-
10 

mand the headlines so much that, in addition to direct harms, 

these large-scale attacks also threaten to chill use of online services 

and of the Internet itself. 

There is no silver bullet that will wipe away the danger of cyber 

attacks. As my colleagues have noted, many cyber attacks could be 

stopped by basic digital hygiene, and Congress should be encouraging that. And a good way for doing that also is the Cybersecurity 

Insurance Program. 

On the other hand, other attacks, the advanced persistent attacks, they will often require the sharing of information about potential threats and how to defend against them. 

Cybersecurity information sharing also poses risks to civil liberties. After all, it does involve the sharing of some communications content and of some personally identifiable attributes of communications. As Mr. Bejtlich mentioned, the flow of this information to the government triggers concerns that cybersecurity information sharing could evolve into a surveillance program, and the 

concern is particularly acute when the permission to share trumps 

all laws. 

We favor a more focused approach: Create specific exceptions to 

the laws that inhibit information sharing. Start with the Wiretap 

Act and with the Electronic Communications Privacy Act. They 

permit communications service providers to share communications 

information to protect their own networks. But they do not permit 

them to share information to protect others. That can be fixed with 

straightforward amendments that we would be happy to work with 

you on. As other laws that inhibit necessary information sharing 

are identified, cybersecurity exceptions could be created to them as 

well. 

The broader, riskier approach of trumping all laws that might 

otherwise stand in the way of information sharing requires exacting civil liberties protections to prevent abuse. All of the major 

cybersecurity proposals take what we think is the riskier approach 

of trumping all laws. The White House bill does it; the Cyber Intelligence Sharing and Protection Act (CISPA) did it; and so did 

Cybersecurity Information Sharing Act (CISA), the Senate Intelligence Committee’s bill from last year. 

What are those civil liberties protections that need to be incorporated? 

First, narrowly define the information that can be shared and include only that which is necessary to describe a threat. 

Second, prioritize company-to-company sharing because the private sector owns most of the critical infrastructure that must be 

protected against cyber attack and because private-to-private information sharing does not create some of the fears about the flow of 

information to the government. 

Third, apply privacy protections prior to any level of information 

sharing, whether by a private entity or a governmental entity. 

Fourth, ensure continued civilian control of the government’s 

cybersecurity program for the civilian sector. 

Fifth, require that information shared for cybersecurity reasons 

be used for cybersecurity, with limited exceptions for law enforcement use to counter imminent threats of bodily harm, and to prosecute cyber crime. 
11 

Sixth, be careful about authorizing countermeasures. Countermeasures that could amount to hacking back against an individual 

or entity suspected of hacking into one’s own system should not be 

authorized. They create more problems. They open a Pandora’s 

Box. 

And, seventh, create strong privacy procedures governing the 

sharing of information by governmental entities. 

With respect to these seven factors, I think the White House bill 

does a better job on all of them except for prioritizing the companyto-company sharing. We have specific concerns with the White 

House bill. It could be a lot better. But it was a significant improvement over the Senate’s last look at information sharing, 

which was CISA. 

I close by observing that today is Data Privacy Day. It is a day 

observed around the world for promoting data privacy. Let us work 

together to ensure that cybersecurity information respects data privacy, even when it is shared, and helps preserve the Internet as 

a great engine of communication, innovation, and prosperity. 

Thank you. 

Chairman JOHNSON. Well, thank you, Mr. Nojeim. Again, thank 

you to all the witnesses for your thoughtful testimony. 

To give more Members a chance to ask questions, we are going 

to limit the time for questions to 5 minutes each. Also, to remind 

veteran Members and let the new Members know what the tradition of this Committee is in terms of order of questioning—it is the 

people here in attendance when the gavel drops. It will be in order 

of seniority, rotating between sides. And then after the gavel falls, 

just in order of appearance. 

So, with that, I am not going to ask questions so that more Members have a chance to ask questions. I will turn it over to our 

Ranking Member, Senator Carper. 

Senator CARPER. I want to thank the Chairman for yielding his 

time to his Ranking Member. 

We do a lot of oversight work here. We do a lot of asking of studies by the Government Accountability Office (GAO) and others. 

Sometimes we just send letters, and I noted a change of behavior, 

and sometimes we legislate. Last year, when we were in the 113th 

Congress, we legislated in three or four different Bills with respect 

to cybersecurity. We sought really to bolster the capabilities of the 

Department of Homeland Security (DHS) on that front. 

We passed three or four modest bills, but I think together they 

are very meaningful. One was to make the Cyber Ops Center of 

DHS real and meaningful, codified it. I think that is a very good 

thing. We also have enabled them to strengthen their workforce. 

And a third area that we have worked in is to better enable them 

to protect the dot.gov domain. And so those three things taken together I think are helpful. 

We tried to pass information-sharing legislation, as you know, in 

the House and the Senate. We got it out of Committee in the Senate but not through the full Senate. 

We have shared jurisdiction on that issue, and some would say 

we actually have maybe more jurisdictional claim on information 

sharing than other committees. But we are going to be working 

fairly hard in this vineyard very soon. 
12 

We have three places to look—maybe more than three. Your job 

is going to find more places to look in terms of developing good policy, but, one, the Administration’s proposal; two, the Senate Committee’s bill, the Intel Committee bill from last year; and then the 

work that the House has done. 

I am going to ask each of you, if you would, using those three 

as maybe a touchstone for us in cobbling together smart legislative 

policy on cyber, especially on information sharing, what would be 

one or two major points that you would have us take into mind to 

consider as we do our work. Mr. Gordon. 

Mr. GORDON. Thank you very much, Senator. I agree there was 

great progress last year. I would love to see that bill with information sharing. 

If I look across the bills—CISA, CISPA, and the President’s proposal—the areas that I would highlight as—first, there are many 

in common, so I am not going to cover those, but the differences 

or the areas that I would highlight, one, I think there is greater 

or lesser emphasis on real-time sharing, and I would propose that 

that is very significant in terms of the speed at which attacks cascade across—within industries and across industries. I believe that 

real time is very important. 

Second—and a number of people have mentioned it here—I think 

it is important that the construct not just protect in terms of liability entities sanctioned by the government, but also that it encourages and facilitates company-to-company sharing, that is to say 

that the liability protections would extend to companies sharing 

among themselves, not just with another entity. 

The third and fourth I would highlight very quickly. One is protecting sharing. Liability in terms of sharing is important. But I 

also believe protecting acting within one’s own network is also important. So it is not enough simply to share, but one has to be able 

to actually act on what is shared, and I would emphasize that. 

And then the final one, which a number of folks I think have 

mentioned as well, that for us is very important is the bi-directional nature of sharing. I believe that as I reflect on it, both the 

CISA and CISPA bills did have a great deal of focus on basically 

requiring the government to get more active in sharing, particularly in classified indicators, shared in the right way; whereas, I 

believe the President’s proposal is silent on that. And I believe that 

bi-directional sharing I feel is very important, and for us there are 

the threats that we experience that we can share across the private 

sector. Typically those occur while we are under attack, so what we 

are sharing is essentially information about an attack that is unfolding. What the government has access to that simply is not 

known to us are the attacks that could take place and the nature 

of those attacks. I think that would be a tremendous value-add. So 

I would include the bi-directional sharing in terms of emphasis. 

Senator CARPER. OK. Thanks. Mr. Charney. 

Mr. CHARNEY. I agree with the points made. I think certain bills 

did not go far enough on the civil liberties side. I worry a little with 

the Administration proposal that we not impact current industryto-industry sharing that is really working well. Marc’s points were 

spot on. The only other thing I would add is the international flavor of this. As a company that has customers all over the world and 
13 

who is constantly combating international threats, it is very important to recognize that whatever the Congress does, others may 

emulate. 

And so, for example, the U.S. Government could say, ‘‘Tell us 

about every vulnerability you know about,’’ and you could say, 

‘‘Well, that would be really interesting to know.’’ And then every 

other government in the world will ask for the same thing, and 

suddenly things can become very difficult. And so thinking about 

the international implications of what is done here is super important. 

Senator CARPER. All right. Thanks. My time has expired. 

Chairman JOHNSON. No; go ahead. 

Senator CARPER. Mr. Beshar, and maybe I would ask you to just 

short it up just a little bit, if you will, please. 

Mr. BESHAR. Very briefly, Senator Carper, two points. 

First, there is a hierarchy of data that would be of interest to the 

government that sits in these companies’ hands. And if you try to 

focus on the cyber threat indicators and begin this journey there 

as opposed to trying to go deeper on the data that is part of this 

exchange, I think that will be a very fruitful step. 

Second, the idea that in the President’s bill there are obligations 

that all of our companies have to try to strip out the personally 

identifiable data, I think that is a very constructive step forward, 

as Greg has identified. 

Senator CARPER. All right. Thanks. 

Mr. BEJTLICH. Senator Carper, briefly, I would encourage whatever resources are necessary to help the FBI with its notification 

mission. Speaking as the spokesperson for the intel community, 

that third-party notification is just very valuable. 

And, second, I would encourage whatever is required to get more 

prosecutions. I do not think it is necessary to lengthen prison times 

and that sort of thing. I think we just need to make better use of 

the laws that are there and to get more of these bad guys. 

Senator CARPER. Good. Thank. 

Last, but not least? 

Mr. NOJEIM. So I think I am going to focus just on three issues: 

Stripping out irrelevant personally identifiable information (PII) 

before you share a cyber threat indicator. The White House bill 

does a pretty good job of that. CISA did not require that. 

Second, on use restrictions, making sure that if a company 

shares information for cybersecurity reasons, it is used for 

cybersecurity. There are some national security uses that are 

cybersecurity uses. Those should be allowed. There are some law 

enforcement uses that are cybersecurity uses. If you want to prosecute a cyber crime, that serves a cybersecurity purpose. That 

should be allowed. 

Countering an imminent threat to a person, that should be allowed, but not much more. And I think the White House bill did 

a much better job on that score than did CISA. 

And, finally, on hacking back, making sure that if countermeasures are going to be authorized, they can only operate on your 

own network. You do not want a countermeasure that could, when 

stolen from your network and placed on somebody else’s computer, 
14 

including a victim’s computer, encrypt or damage data on that computer. 

Senator CARPER. Thank you all very much. That was very helpful. Thanks. 

Chairman JOHNSON. Thank you. And now we will stay more on 

time. Senator Lankford. 

OPENING STATEMENT OF SENATOR LANKFORD 

Senator LANKFORD. Thank you all for being here and being a 

part of this. Let me ask some cost questions and the gain from this. 

We are talking about between a hundred—estimates of $100 billion 

to $450 billion in costs a year somewhere right now on the cyber 

attacks. Give me a rough ballpark on the breakdown of that between damages that are paid out that are preventable if we have 

this enhanced information sharing and those that are not preventable because of a zero-day attack and we are stuck, we are at the 

beginning of it. 

So what I am trying to affirm is we get this in motion, we get 

better information sharing. What difference does it make economically? And anyone can attack that. 

Mr. GORDON. That is a great question. I am not sure I can answer it directly in terms of a percentage. But what comes to mind 

for me is what percentage of those losses are repeat attacks, meaning they happen more than once. And I would say in the right construct of information sharing, bi-directional real time, a very high 

percentage of repeats—that is back to my comment earlier, which 

is one company’s attack can become the Nation’s defense if we do 

it the right way. It will not prevent that first attack, but it can prevent all the ones that follow potentially. 

So I cannot answer specifically the dollar amounts. I do not know 

how to break that down. 

Senator LANKFORD. So the guess here is to try to figure out how 

many attacks that are out there are repeat attacks. 

Mr. GORDON. That might be a way to look at it. 

Senator LANKFORD. So any ballpark on that you would see from 

just what you have seen or anyone has seen on cyber attacks out 

there that are known threats, or were they just not known to you 

or to those companies? 

Mr. BEJTLICH. Senator, at Mandiant, just even our own customer 

base, when we do a response, depending on who the actor is, if it 

is the Chinese or the Russians, they are going to be back. In some 

cases, their recidivism rate is as high as a third. So that is just 

against one company is hit, and then they are hit again by the 

same group after we leave. 

Senator LANKFORD. OK. Let me ask a question. What is next on 

this? Information sharing, I think there is fairly common agreement we need to have some level of information sharing. It is how 

to protect personally identifiable information and such. What is the 

next level on this? Where does this go? 

Mr. CHARNEY. I can take that. I think to deal with advanced persistent threats, you need a very robust security program that has 

three elements: you need high-level protections in place; you need 

great detective capabilities, because the bad guys will keep attacking; and you need very fast response processes. And what we have 
15 

found, of course, in many of the hacks that occur today, even if 

they are called ‘‘advanced persistent threats,’’ they are not all that 

advanced. People attack unpatched systems. People are running old 

operating systems and old software. And we need to get all boats 

to rise. 

The challenge has been, of course, that for 20 to 30 years people 

have built networks with tough, hard perimeters, but the middles 

are really soft. And in these advanced persistent threats, the bad 

guy comes in and gets a foothold in the network and then moves 

across the network. 

So the information technology (IT) industry and users of IT are 

all focused on a few core things that are starting to happen. 

First, you need multi-factor authentication. You need to get rid 

of user names and passwords because they are just too easy to 

guess or calculate and break in. 

Second, we need what we call ‘‘domain isolation.’’ If someone attacks and gets in somewhere, they should not be able to move everywhere. 

And, third, we have to do a much better job, as people say, of 

detecting things so we can respond quickly. So hopefully with more 

information sharing you put the detections in place, and then you 

can act much more quickly and prevent a lot of the damage. 

Senator LANKFORD. OK. Let me ask a followup question to that. 

With a lot of the issues based on the fact that companies are not 

doing basic patches, they are not doing some of the things that are 

commonplace, then we have this extra layer that we are adding to 

this with personally identifiable information that they have got to 

be able to secure that, sequester that away, and so that does not 

get out as well. If they are not doing patches, how diligent are they 

going to be to make sure they are also protecting the information 

once it gets shared that people truly have their privacy protected 

as well? 

Mr. CHARNEY. Well, so it is absolutely clear that if you do not 

have a good protection program, you are going to lose valuable 

data—— 

Senator LANKFORD. Right. 

Mr. CHARNEY [continuing]. Whether it is economic data or personally—— 

Senator LANKFORD. But that is happening right now. 

Mr. CHARNEY. That is happening right now, and you need to— 

there are two things to think about. One is raising the protections, 

which is what information sharing is supposed to help do, so that 

you can prevent that. But the second thing is that the security 

model is changing across the industry in two respects. One is in 

some cases you actually do not need that personally identifiable information to engage in a transaction. 

So, for example, in the credit card arena, there are companies 

who are looking at—and PayPal does this already—not giving the 

credit card to every merchant in the world, but just passing an authentication code to authorize the payment. And if you do things 

like that, then it is much harder—even if you steal the information, 

you are not getting anything that is replayable and reusable, and 

you will see that coming in many new ways because we are going 

to start attaching identities to particular devices. People have tab-
16 

lets. They have phones. They have portable PCs. And if we can tie 

your credential to that device, then if someone else tries to use that 

credential from another device, it will not work. 

So there is a lot of preventative things we can do from protecting 

networks to thinking about information differently and how we protect it. 

Senator LANKFORD. Thank you, Mr. Chairman. 

Chairman JOHNSON. The remaining order will be Senator Booker, Senator Baldwin, Senator McCain and then Senator Ayotte. 

Senator Booker. 

OPENING STATEMENT OF SENATOR BOOKER 

Senator BOOKER. I want to thank the Chairman. This is a fantastic and very important hearing that we are having. I appreciate 

your leadership, and I want to thank my Ranking Member as well. 

Gentlemen, it is the balance, again, between privacy and security, and I think that there is a huge tension in this area. The degree and nature of the attacks are startling and stunning. And I 

just have really quick questions that should be very brief. But the 

first is: What role does the government have, being that so many 

mistakes are being made in what is called the hygiene area? It is 

remarkable to me how many mistakes we make, and I sat with my 

staff and realized even for my own passwords I was not using dual 

authentication methods and the like. But so many businesses out 

there just are not doing the basic common sense that would prevent a lot of this from going on. 

And so I am wondering, in just the idea of the role of government, what could we be doing to either incentivize or mandate levels of hygiene? Or is that, in some of your opinion, not the role of 

government at all? 

Mr. NOJEIM. I am going to start with that. I do not think it is 

a good idea to mandate levels of hygiene. I think that the mandates 

will rapidly grow outdated, and they will become the floor instead 

of the ceiling. Companies are going to innovate. They are going to 

come up with new ways to protect data, and I think that you want 

to encourage them to do that. Give them tax credits, give them 

other assistance, but I do not think you should try to mandate exactly what they do. 

Mr. BEJTLICH. I would concur with that, Senator. The insurance 

example is a great one. If someone keeps breaking into my house, 

it is going to be tougher for me to get a premium because they can 

tell I do not lock my doors and that sort of thing. 

The government should restrict itself to the things that it will 

not let the private sector do, which is hack other people, or prosecute or do those sorts of things. So I think the role of the government should be to do those things that are unique to the government, to do the threat mitigation by either deterrence or by prosecution or that sort of thing, and the private sector can work on 

the things that we are good at. 

Senator BOOKER. Yes? 

Mr. CHARNEY. I would add one more point. The government can 

lead by example. The government is a large enterprise, and it has 

customers, too, but their customers are called ‘‘citizens.’’ And citizens file taxes online and file for benefits online and want informa-
17 

tion from the government. So the government could do a better job, 

I think, of adopting the latest technologies, managing their systems 

really well, and leading by example. 

Senator BOOKER. OK. Let me just shift for a second. 

And, by the way, 14 months in the U.S. Senate, we are not leading by example with a lot of the practices I see. But I just want 

to then to the perverse business incentives and the idea that you 

provide some kind of full liability or when it comes to information 

sharing with the government, are we creating an environment 

where we are going to promote oversharing with government some 

of the privacy information? And I am really worried about that. In 

many ways, it is just giving the government access to another level 

of domestic surveillance by creating perverse business incentives 

for oversharing. Is that a concern? 

Mr. GORDON. The way we look at sharing, if we actually look at 

both what we share and what is shared with us and what we 

would like to amplify over time in terms of sharing, what we are 

essentially talking about are things called ‘‘cryptographic hashes’’ 

or pieces of software code. There is nothing associated with customers in any shape or form in terms of essentially what is effective for sharing. And so I think even the way the prior legislation 

speaks to pulling out PII, our view is—and I went back and looked 

at what we have shared and what we like to share more of—it is 

indicators of attack, indicators of compromise, and the like that we 

do not see that there is any real issue at the end of the day as long 

as we focus on sharing that type of information. 

Mr. BESHAR. Senator Booker, we would concur with that, that 

even in the last year, the extent of the threat has intensive; that 

if there are going to be attacks on critical infrastructure and it is 

less graffiti and financial crime and more threatening of power 

grids and the like, then that balance has to at least be calibrated. 

And as the other witnesses have said, I think by stripping out the 

personally identifiable data, you legitimately address the privacy 

concerns that are there, at least with respect to cyber threat indicators. 

Mr. GORDON. I would like to add one more thing and think about 

it this way: If somebody broke into our data center and started attacking our computers with an axe, we would report the fact that 

they have done that. If they broke into our data centers and started siphoning off customer information, we would report the same 

thing. The analog for me here is I am reporting the axe that got 

used and the fact that siphoning is occurring. I am not even reporting because I do not know in most cases who it is. 

So that is the nature of what we are talking about sharing essentially, is the fact that an axe was taken to our data center. 

Mr. NOJEIM. Senator, there are three steps here. 

First, you narrowly define the information that can be shared. It 

has to be necessary to describe the threat. 

Second, you require companies to look for and strip out any personally identifiable information that is not relevant to the threat. 

And, third, you make it so the liability protections only operate 

when the companies play by those rules. That would do the trick. 

Mr. CHARNEY. Can I add one point to that? There are times when 

we do need to do attribution and find source. So if you only share 
18 

anonymous data, you can protect and detect, but you cannot deter. 

And that is why in our testimony, one of the things we point out 

is when you need to get identifying information so you can do attribution and take action, we have legal processes, court orders, and 

other things that are designed to protect civil liberties and strike 

the right balance. 

Senator BOOKER. Thank you. 

Thank you, Chairman. 

Chairman JOHNSON. Senator Ernst has returned, so we will go 

to you next, and then Senator Baldwin. 

OPENING STATEMENT OF SENATOR ERNST 

Senator ERNST. Thank you, Mr. Chairman. Gentlemen, thank 

you for being here today. We greatly appreciate your expertise in 

this area. 

Iowa just in recent years has really become a tech hub. We have 

Google located there, Facebook. We have Microsoft coming soon to 

West Des Moines. We also have many financial institutions, insurance companies, both large and small. We have a lot of small business. 

So when we are talking about this, we largely think about those 

larger entities, but what can we do through a voluntary process to 

assist and encourage small businesses to voluntarily share information and do it in a way that is not cost prohibitive or time prohibitive for those smaller groups? I would love to hear your thoughts 

on that. Thank you. 

Mr. BEJTLICH. Senator Ernst, this may sound counterintuitive 

because a lot of people have worries about the cloud. But to tell you 

the truth, the cloud may be—assuming you use a worthy cloud provider who has their act together, the cloud is of great benefit. I advise many small startups, and they do not build out networks the 

way we did 10 or even 15 years ago. They do everything on the 

cloud. 

So if the cloud providers—Google, Microsoft, Amazon, and these 

others—have a robust security program and they protect—or the 

users protect how they access those services using two-factor and 

other methods, that is actually a pretty good scenario. It takes the 

IT duty away from that mom-and-pop shop and puts it in the 

hands of some professionals. 

Mr. BESHAR. Senator Ernst, I am proud to report that we have 

1,500 employees in Urbandale, and it is a terrific workforce and a 

great asset for our company. 

Senator ERNST. Yes. Thank you. 

Mr. BESHAR. It is similar to Senator Lankford’s question, that it 

is difficult to visit burdens on small and mid-sized enterprises that 

are perhaps customary and commonplace for the larger companies. 

At the same time, one of the real takeaways from 2014 is that 

the security of the larger organizations is really dependent upon 

smaller enterprises, that many of the companies that have been in 

the news have been attacked not through the front door but 

through the side door of the back door of the vendor network. So 

things like the Administration’s cybersecurity framework, the National Institute for Standards and Technology (NIST) framework, I 

think is a helpful, relatively straightforward tool to try to assist 
19 

small and medium enterprises to go through some of the steps that 

we are talking about. 

Senator ERNST. Any other thoughts? 

[No response.] 

Thank you, Mr. Chairman. 

Chairman JOHNSON. Senator Baldwin. 

OPENING STATEMENT OF SENATOR BALDWIN 

Senator BALDWIN. Thank you, Mr. Chairman and Ranking Member, for holding this hearing. I really appreciate it. 

I have a couple questions I want to get out there, but I wanted 

to actually start, having heard the response to Senator Booker’s 

first question about the appropriate government role, and I just 

want to make sure I understand your responses as really coming 

from the business enterprises that you have the expertise in, because, as I have looked at it, I have seen perhaps areas where we 

should have a more robust government role when we deal with 

things like—I know, Mr. Beshar, you mentioned the electrical grid, 

critical transportation infrastructure, some of our infrastructure. Is 

that fair that you are really answering for your industries and 

not—or is this advice throughout no matter what type of attack we 

are looking at? I just want to clarify that for the record. Do you 

want to just go down the—Mr. Gordon? 

Mr. GORDON. The role of the government question, in the context 

of hygiene, which I think was a substantial part of it, I would concur. I feel that, first of all, the definition of ‘‘hygiene’’ is very dynamic. I mean, it literally changes day to day. I do not think the 

government should have much of a role in that. And I would say 

the market has very quickly taken care of that in terms of boards 

paying attention to hygiene. I think that is an increasingly smaller 

problem. 

The other dimension, which I think is outside the purview of this 

discussion, but I do think the question of the role of the government in preventative action and in deterrence, I think that is still 

unclear probably to some greater or lesser degree, not the role of 

the private sector. 

Mr. CHARNEY. In my written testimony, I talked about the four 

roles of government relative to IT, because in addition to being a 

large enterprise with customers, they also do have a traditional 

public safety and national security responsibility. And, I am a big 

fan of market forces, and they work great for innovation, but it is 

hard to make a market case for the cold war. When you have a national security imperative, the government often has a major role 

to play, and part of that is that, as a large enterprise, they are attacked a lot. As former Chief of the Computer Crime and Intellectual Property Section, I can tell you that, in the early days, the two 

most attacked agencies were the Department of Defense (DOD) and 

the National Aeronautics and Space Administration (NASA) because NASA had cool stuff. And the government has this information and often knows of threats and shares it with industry, which 

makes us more effective in protecting the ecosystem and our customers. 

And then there is also the question of how to deter particularly 

these nation-state attacks. Microsoft has been very vocal that we 
20 

need norms for the Internet. We have norms for State behavior in 

a range of areas, like money laundering and weapon of mass destruction. We actually do not have norms for cyber activity. And so 

we see nation-state activity that would be very hard for the private 

sector to fend off. I mean, nation states can put spies in your organization. It is well known that a Russian spy was arrested at 

Microsoft. How does a private company fend off a well-funded, persistent nation-state attack? 

And so the government can help by helping establish those 

norms and in the right places taking steps to help, regulate the behavior of others, so to speak. 

Senator BALDWIN. OK. I am hoping to get to another question, 

so either real quick, or—— 

Mr. BESHAR. Please. 

Senator BALDWIN. OK. For Mr. Nojeim, you talked—I really appreciate your analysis of the three principal proposals and your recommendations to strengthen them. Just narrowing in on the 

Obama Administration’s cybersecurity proposal, obviously critical 

details have yet to be finalized in that, including for privacy guidelines. So I am wondering what are your recommendations for, first, 

defining what constitutes personally identifiable information; and, 

second, for sharing cyber threat data that includes such personally 

identifiable data. 

Mr. NOJEIM. So we went through an exercise of trying to list all 

the types of personally identifiable data that we are talking about. 

I do not think that Congress should try to go down that road. We 

did not know years ago that IP addresses could become personally 

identifiable with the additional information. Maybe some people 

knew it; maybe some people did not. But the fact of the matter is 

that sometimes the aggregation of information can make it personally identifiable when people thought it was not before. 

So rather than going down the road of trying to list the particular categories of personally identifiable information, I think it 

is better to require that personally identifiable information be 

stripped out and then task DHS with coming up with the list 

through a Notice and Comment process, and that list will change 

over time, and everybody will know it will change over time. So I 

do not think you want to go down the road of trying to list that 

in the statute. 

And then when it comes to removing it when it is not necessary 

to describe a threat, I think that is going to happen naturally in 

the automated process of sharing threat information. Companies 

are going to develop systems that other companies will buy that 

they will use to share this threat information. They will have to be 

able to describe the threat. And those same systems that describe 

the threat can be used to filter out the irrelevant information. 

Chairman JOHNSON. Senator McCain. 

OPENING STATMENT OF SENATOR MCCAIN 

Senator MCCAIN. Thank you, Mr. Chairman. I thank the witnesses. 

A week ago or a couple weeks ago, the Armed Forces Network 

was hacked into and not only did radical messages show up on the 

screen, but also names and addresses of individuals. And I do not 
21 

think a lot of Americans know that Armed Forces Network is at 

every base, every ship, every defense installation of any size, not 

only in the United States but in all our bases all around the world. 

So it was a pretty clever action on their part and I think pretty 

sophisticated, and not only did it give them a propaganda coup, but 

most people believe that Armed Forces Network is run by the 

Armed Forces. It is not. It is contracted out to a commercial organization. And it not only was propaganda, but also when names and 

addresses of people are put out, it obviously poses a direct threat 

to literally their lives. 

What happened? What could we have done to prevent it? And 

what do we need to prevent something like that in the future? Is 

that you, Mr. Charney, or Mr. Gordon? Whoever wants to take 

that. 

Mr. CHARNEY. Well, first and foremost, many large organizations 

outsource IT functions, and it is absolutely crucial that their 

outsourcing contracts have requirements for security and privacy 

that meet the needs of the party that is hiring the contractor. 

Senator MCCAIN. So the Pentagon should have been smarter. 

Mr. CHARNEY. I have a lot of friends in the Pentagon. I think 

they are great. But certainly their contracts should require that the 

information be protected at the right level, and now with things 

like the NIST framework, the International Organization for 

Standardization (ISO) standards, there are more and more ways to 

audit and measure the security controls in an environment. 

And so, for example, for a lot of our cloud-based customers, they 

now ask to see our audit reports, which we share, because they 

want to make sure before they entrust their data to us that we are 

taking the necessary steps to protect it. And we have to enforce 

that through contracts with customers. 

Senator MCCAIN. So, again, whoever in the Pentagon let that 

contract did not let the right contract. 

Mr. CHARNEY. Either that or the term was in the contract but 

no one evaluated whether the contractual terms were being followed. 

Senator MCCAIN. Mr. Gordon, do you have any comment? 

Mr. GORDON. Not a lot to add other than when you look at the 

most common attack factors, websites is one. One of the most 

prominent is websites, so companies put a lot of energy into a set 

of controls around that. I am not familiar with actually what the 

vulnerabilities were that were breached, but I agree with Scott. I 

think that the right third parties and businesses put those controls 

in place to prevent those kinds of breaches. 

Mr. BEJTLICH. Senator McCain, I think on paper almost anyone 

looks good, but the proof is when you can test it and find out if 

your defenses are strong. I am sure you are familiar with the term 

‘‘red-teaming.’’ If someone had red-teamed against that user account or a system or a network and found, wow, it is very easy for 

me to get in here, I am not going to cause any damage, I am going 

to report back to the owner, it took me 5 minutes to break into this 

system, and you fix the problem before the bad guy finds out. That 

is one way to avoid it. 

Senator MCCAIN. Anyone else? 

[No response.] 
22 

Well, it was interesting that General Dempsey, our Chairman of 

the Joint Chiefs of Staff, recently said that we have a technological 

advantage in every form of warfare over our potential adversaries 

except for one, and that is the issue that we are discussing today. 

I thank you. 

OPENING STATEMENT OF SENATOR AYOTTE 

Senator CARPER [presiding]. Senator Ayotte. 

Senator AYOTTE. Thank you, Chairman. 

Senator CARPER You are welcome. [Laughter.] 

Senator AYOTTE. I wanted to followup on a comment that Mr. 

Bejtlich made about law enforcement capacity here, and you had 

said we do not need more laws, what we need is greater prosecutions and an ability of the FBI and other law enforcement agencies 

to prosecute these individuals. 

I was Attorney General of our State, and in the limited cases 

that I was involved in on these issues, the prosecutions are very 

challenging. As you know, often the actor can be from another 

country, and we are not even talking about nation-state actors 

there, just the location. 

What thoughts do you have as to how we can better help our law 

enforcement agencies have the right tools to pursue appropriate 

cases, so that we have some examples that we are not just allowing 

these things to happen? 

Mr. BEJTLICH. Thank you for the question, Senator. I think there 

are a couple angles to it. One of them is, as you mentioned with 

overseas actors, international cooperation. If you are a hacker and 

you are in the United Kingdom and you are attacking the United 

States, that is a bad situation for that hacker. We are going to 

work with our partners and are going to get them back. If you are 

in an Eastern European country or some other location—so international cooperation is first. 

Second is training. You need to be trained to do this sort of work. 

You need to know how to carry off a successful prosecution, what 

are the defenses that could be there, and how to collect the information properly. It is very similar to what we saw in the intel 

world in warfare. Guys used to go in, smash the computers, and 

then they would bring back fragments, and you realize you could 

not use it. You had to teach them how to collect evidence and that 

sort of thing. 

And the third part is you have to make it a career path. We saw 

this with the turnaround in the FBI now where it is now a career 

path to be an intel person; it is a career path to be a cyber person. 

You need to have that sort of recognition and success for following 

those. 

Senator AYOTTE. Thank you. I was very interested in the discussion we had that Senator Ernst asked about, the challenges for 

smaller and mid-sized businesses. Having been briefed, for example, on the Sony hack—that obviously was a nation-state actor, but, 

frankly, SONY is a larger company and even some of our larger 

companies do not have all the protections in place that need to be 

there. And so, there are challenges for smaller and mid-sized businesses. You have talked about the use of the cloud-based system 

in terms of resource efficiency for smaller companies. 
23 

As we look at more of our companies moving to that, what are 

the security challenges we are going to have to be aware of with 

the cloud-based system that we should be focusing on? Because, as 

you know, getting into the system from the smaller connection is 

probably the easier way to do things. 

Mr. CHARNEY. So Microsoft, of course, offers large-scale cloud 

services, and people often ask me, ‘‘Is the cloud good or bad for security?’’ The answer is yes. 

It is good for security because, as mentioned earlier, because it 

is core to our business and we have a lot of security expertise. We 

probably are more rigorous about security than many companies 

might be. 

At the same time, it is important to understand that in the cloud 

model you have a multi-tenanted environment. You have a lot of 

customers using the same cloud service, which makes it a very rich 

target. 

Senator AYOTTE. Right. 

Mr. CHARNEY. And so we do things to make sure that our customers’ data is segmented from one another and prevent that lateral movement. 

But the other important thing is that, even when you use the 

cloud, security becomes a shared responsibility. What I mean by 

that is a small business might issue its user names and passwords 

to its employees, and if an employee loses that password to a bad 

person, that person can log on as that employee. The cloud will not 

know. 

Senator AYOTTE. Right. 

Mr. CHARNEY. It looks like an authorized use. 

So we have been committed for quite some time to providing 

more security technologies that are just secure by default in our 

newer products—and I talked about this a little earlier—identities 

that cannot be stolen because they are bound to machines. We have 

to get to a place—I am all for user education. It is a wonderful 

thing. But I think we put too much of a burden on end users to 

manage security when it is actually a complex undertaking. 

Senator AYOTTE. You have all talked about what you see as a 

problem with the Administration’s proposal not allowing sharing 

and liability protection among companies. So in a cloud-based system, is that the way the legislation drafted is particularly acute? 

Or does that not matter because you are thinking about transmitting the information at a higher level? 

Mr. CHARNEY. So for us, we have to be clear. We have two types 

of information. We have our information about our network that we 

can share as we see fit, even if we take some risk in sharing. And 

Microsoft actually does a lot of sharing today. We have programs 

where we share threat and vulnerability information with customers, with governments, and others. We share our source code 

with governments as well. So we can accept that risk. 

At the same time we have customer information, and they have 

expectations, usually enforced through contractual terms, that they 

do not want us using their data in any way without their permission and consent. 

And so when we look at some of this information sharing, we 

want to make sure that the information we share today, which is 
24 

substantial, is not disrupted by a new regulation or regime that 

says, for example, you can only give data to DHS. Well, no, we 

want to share data with our partners all the time, and we do, so 

do not disrupt that. It does not solve the problem of sharing customer information. That we will not do without the customer’s permission, and we want to make sure that any regulatory regime respects that contractual obligation, because the biggest problem we 

have, as a global company, I go overseas all the time, and customers in other countries say, ‘‘Will you turn over our data to the 

U.S. Government?’’ That is what they are worried about. And when 

the answer is sometimes yes because we could get a court order or 

other things—we are fighting a case like this right now involving 

a U.S. order to turn over data from our Irish data center, a customer e-mail. it is not our data. It is the customer’s data. And if 

we do not protect the privacy of that information, then what happens all over the world is people say, ‘‘So I should use a local provider, right? Because if I use your cloud service, you are a global 

company; you are headquartered in the United States. You are just 

going to give all our data to the U.S. Government.’’ And what will 

happen over time is American information technology products and 

services that have been so successful around the world, well, in all 

those other parts of the world people will say, ‘‘Whoa, maybe we 

are better off with local technology, not being compelled by the U.S. 

Government.’’ And that in the long term for America would be a 

terrible thing. 

Senator AYOTTE. Thank you very much for clarifying this. I appreciate it. 

Senator CARPER. Senator Ayotte, I think we are going to wrap 

it right there. Would you all just stay in place, and, Senator, we 

are going to take a real quick recess. Senator Johnson has run to 

vote. He will be right back, and when he does, he will resume, and 

I know he has some questions. And I might join you back again, 

too. Thank you very much. 

Senator BOOKER. Mr. Chairman, is the vote imminent, or do we 

have a chance for one more round? 

Senator CARPER. The vote started 11 minutes ago. I think we 

have 3 or 4 minutes left on the clock. 

Senator BOOKER. Being that I cannot come back, may I ask one 

more? 

Senator CARPER. You may go ahead, and when you have finished, 

just recess unless Senator Johnson is back. 

Senator BOOKER. That is a lot of power you are leaving me with, 

sir. [Laughter.] 

Senator CARPER. I have every confidence in you. 

Senator BOOKER [presiding]. Thank you very much. 

Gentlemen, just real quick. I have seen how perception problems 

with private business affect those businesses’ abilities to operate 

overseas. And I have seen comments by high-level officials here 

that then make other countries demand that our American companies have servers located in their country as well. 

Do you have any concerns about us sharing information, companies sharing information with the Federal Government agencies, 

then making foreign countries more concerned about those companies operating in their nations? 
25 

Mr. BESHAR. I think it is a legitimate consideration, Senator 

Booker, so the draft legislation really speaks about exempting company that provide information from U.S. civil and criminal liability. 

If there is data from Europe or other parts of the world that is embedded in some of the information, a question at least arises of the 

scope of that liability protection. 

Senator BOOKER. OK. Any other thoughts of the child that it 

could be creating or something we should worry about? 

Mr. CHARNEY. Well, we have had to grapple with this problem 

post the Snowden disclosures where government and customers all 

over the world have expressed concern about relying on U.S. technology. And we have been very clear that we do defense, not offense. We do not put the back doors in products. We do not turn 

over encryption keys. 

Where you can get stuck at the end of that discussion is if the 

U.S. Government does compel the production of data and does it 

with a non-disclosure order, there is some risk to the foreign enterprise that their data will be turned over to the United States without notice. 

Senator BOOKER. Right. 

Mr. CHARNEY. And that does worry them. What we have tried to 

do is explain to them, because I think this is true, government access is a business risk. It is really what it is. I was with a group 

of chief security officers in France, and I knew some of them were 

running very old technology and were not current on their patching 

and hygiene. And they started talking to me about U.S. Government access if they put their data in our cloud. And I said, OK, 

so you have networks that are wide open and hackers can get in 

and steal all your stuff, but you are worried about putting it in my 

more secure cloud because the U.S. Government might get it. Who 

are you more worried about—hackers or the U.S. Government? 

What business are you in? I mean, if you are in the terrorism business, you should be worried about the U.S. Government. But it still 

does create friction in the system. 

Mr. NOJEIM. After the Snowden disclosures, a number of U.S. 

companies said, ‘‘We are not going to voluntarily turn over customer information to the National Security Agency (NSA).’’ OK? 

Now along comes cybersecurity legislation, and some of the 

iterations of the legislation say it is all voluntary, companies will 

voluntarily share information; some of the information is going to 

be from their customers. So if a company is going to play by those 

rules, how can it promise that it is not going to share information 

with the NSA if the legislation says anything you share with a government agency for cybersecurity reasons must immediately be 

shared with all these other agencies, including the NSA? 

That was a problem in the CISA bill, the Senate bill that never 

came to the floor, that I do not think you want to repeat. 

Mr. GORDON. I come back to the nature of what we are sharing, 

which is attack and threat information, and the sharing of that information only enhances our security for our customers in the 

United States and around the world. That is how we think about 

it. 

Chairman JOHNSON. [presiding]. Thank you for holding down the 

fort there, Senator Booker. 
26 

I do have a number of questions I would like to put forward until 

the next vote is called, and then we will wrap up the hearing. So, 

again, I just want to thank all of you for coming here and taking 

time and really preparing some very thoughtful testimony and, I 

thought, really good responses to questions. 

Mr. Nojeim, let me test my theory in terms of us all sharing the 

same goal. I think it is just true that if we do not get this under 

control, if we allow cyber attacks to continue, the threat in terms 

of loss of privacy really is even greater, correct? 

Mr. NOJEIM. I think that if there was a major cyber attack like 

the scale of what triggered the attack on—it is the cyber equivalent 

of the attacks on the Twin Towers, that we would end up with a 

cyber PATRIOT Act. 

Chairman JOHNSON. So we share the same goal. Here in government we can pass a law that can help. It is not going to be a panacea. It is not going to solve all the problems. But I think if everybody on all sides of this issue, if we work together, focus on that 

goal, let us face it, another—I hate to single out instances, but another Target instance. Their privacy is just destroyed. So we do 

share that same goal of trying to get to a particular result. 

Mr. NOJEIM. We do. 

Chairman JOHNSON. I want to ask all of you this. When you take 

a look at the White House proposal, what is coming out of the Senate Intelligence Committee, that is what we are going to be dealing 

with here in the Senate, either of those two proposals or some kind 

of combination. 

What is going to be the biggest threat in terms of us crossing the 

goal line with a piece of legislation? I will start with you, Mr. 

Nojeim. 

Mr. NOJEIM. The biggest threat that you are trying to avoid or 

the biggest problem in the bill? 

Chairman JOHNSON. I would say the biggest problem in the bill 

as well as the outside interests in terms of attacking whatever is 

presented. In other words, what are the poison pills in some of 

these bills? What do we need to be worried about? What do we 

need to work on? 

Mr. NOJEIM. Here is what I think you need to work on: 

First is ensuring that you properly define the information that 

can be shared and that you ensure that any irrelevant personally 

identifiable information is removed prior to the share. 

Second, make sure that whatever legislation, whatever rules govern the sharing of information within agencies of the government, 

that those procedures are clear and that they are strong and that 

they protect privacy. 

Third, I think you should prioritize company-to-company sharing—do more on that score. And I think also that you have to be 

mindful of the role that the intelligence agencies are going to play 

in the information-sharing scheme. 

I think you want to ensure civilian control, and the best way to 

do that is to ensure that the shares, the initial information shares, 

go from the private sector to DHS, and that DHS then applies privacy procedures to the data before any of it is reshared with any 

other agency. 

Chairman JOHNSON. OK. Well, thank you. 
27 

Mr. Charney, I will give everybody a chance to answer that question, but we had an interesting conversation in terms of the necessity of sharing personal information in terms of what information 

we are talking about sharing. And you said there is no need whatsoever in terms of sharing personal information if we are just trying to prevent attacks. In other words, if we are sharing those 

threat signatures, no personal information is required. But if you 

want to go solve the crime, if you want to go find the bad actors, 

that is where you might need personal information. Is that correct? 

Mr. CHARNEY. Yes, that is correct, and also just to be clear, 

sometimes an attack indicator is an IP address, like attacks are 

coming from this IP address, so we will go look at our network to 

see if that IP address is reaching out to us. And in some places, 

IP addresses alone are considered personally identifiable information. 

I think in the United States we more try to focus not on the IP 

address, but does it combine with other information to point to a 

person. And I think the way to solve this problem generally about 

using PII is to make sure that when the government wants to get 

personally identifiable information, it uses the transparent, judicial 

procedures already in place with which we are all familiar and balance the competing interests between government access to PII and 

privacy. 

Chairman JOHNSON. In other words, you go to the court system, 

you get a warrant in order to do that. Mr. Nojeim, does that—— 

Mr. GORDON. There is—— 

Chairman JOHNSON. I just want to ask Mr. Nojeim, does that 

comport with what you would be willing to do or agree to? 

Mr. NOJEIM. You do not need a warrant for the IP addresses. It 

is a lesser process. 

Scott, I am not sure that it is going to work that way. At the end 

of the day, IP addresses are often needed to investigate a cyber attack to find out where it is coming from. Companies are going to 

want to do that. The private sector information-sharing entities 

that the White House envisions, I think they are going to get IP 

addresses that are relevant to the cyber attacks. 

Mr. CHARNEY. They are going to get the IP address, and you can 

do an IP lookup and open source. But if we turn over information 

about an attack and the government says, OK, we now want to see 

account information and subscriber information, we require a judicial process. It may be a subpoena, it may be a 2703(d) court order, 

or it may be a search warrant. My point is it reached a point where 

the government wants more, and we require a legal process to be 

followed so that our customers know we are protecting their privacy and not just giving away the data voluntarily. 

Mr. NOJEIM. I agree. 

Chairman JOHNSON. Mr. Gordon. 

Mr. GORDON. I think there is an important subtlety with IP addresses because that does tend to be the place that this conversation converges, and an IP address in the context in which we see 

it is not a customer’s IP address. It is not affiliated in any shape 

or form with a customer. When we see an IP address in the context 

of sharing, it is a place from which an attack is unfolding, or it is 
28 

a place from which stolen data has been sent. That is all we know 

and, frankly, all in our context we care to know. 

And so sharing that would enable someone else to in turn block 

an attack from that same location without ever knowing who it is 

on the other end. I think the law enforcement attribution, that is 

where there are other dimensions to this, but I do not think it is 

a yes-no. I think there is a context to sharing. We would never 

share information related to our customers. This is information related to an attack. 

Chairman JOHNSON. Mr. Charney, real quick. 

Mr. CHARNEY. Yes, that is true for you, and it is true for us. But 

if one of us was with a phone company or a cable provider that provided the Internet access and the government said here is the IP 

address, who is the customer, for them IP address is more than 

just an attack factor. It might be a customer’s name and address. 

Mr. GORDON. Sure, but they would require a subpoena for that. 

Chairman JOHNSON. Now you almost start answering another 

question I had. Does the White House proposal contain adequate 

liability protection to induce the private sector to share with the 

government, to induce the private sector to share within the private sector? I think a number of you have testified that is really 

one of the primary information-sharing platforms we want. 

Mr. GORDON. From what I understand, it does not cover company-to-company sharing at all, so it will not incentivize that. 

Likewise, it does not cover, as I understand it, the acting from 

the sharing, even within your own network. And I think those appear to be two gaps. 

Chairman JOHNSON. So how important is the company-to-company? And what level are we at right now? What level do we want 

to be at? 

Mr. GORDON. I think it is very important. I think there is a tremendous amount of company-to-company sharing that happens 

today, and this essentially would potentially incent us away from 

that and toward this more structured into the government sharing. 

And there are numerous instances that I have been involved in 

where we have information that pertains only to a single company, 

it is very specific. And so sharing that through some hub-and-spoke 

context I think would be inappropriate. 

Mr. NOJEIM. To be fair to the White House proposal, it does 

allow for the sharing—you could call this private-to-private, right? 

You can share to a private hub, and then that hub can share out 

back to the private sector. It does not allow the company-to-company sharing. It does not incentivize the company-to-company sharing that we all think is necessary. But it does allow the sharing 

to the hub. 

The trick with the company-to-company sharing is to create a 

mechanism that ensures that the companies are playing by the information-sharing rules. So far, the mechanisms that have been 

discussed have all been rejected by the companies. They include 

things like creating a private right of action if the company does 

not play by the rules, and things like audits. They have all been 

rejected. So the question is: How do you ensure that the companies 

play by the rules? I do not think that we have gotten to that point 
29 

yet, and I think that is why the White House went with this huband-spoke model. 

Chairman JOHNSON. Mr. Beshar, I am intrigued by the role that 

insurance can play and quite honestly, being a manufacturer, having been ISO certified, I can see a role that things like ISO certification can play, just simply private sector, here are the standards 

that can be created, that can be revised and updated very rapidly. 

Can you just kind of speak to that? 

Mr. BESHAR. Sure. I think that is really the power of insurance, 

Mr. Chairman, that it can drive behavior change across large 

swaths of the people that is not driven by the government. It is just 

because there is a creation of the appropriate set of incentives that 

each one of these actors—large companies, small, mid-sized companies, even individuals—they take it upon themselves to say here 

are the steps that I can take to position myself as a better risk or 

I just think are prudent under the circumstances. So I think it has 

a tremendous power. 

I think the Administration’s proposal has actually struck quite a 

nice compromise that there are clear liability protections from civil 

and criminal exposure. There is the idea that it will not be used, 

the information, for extraneous purposes by regulators, and it will 

not be subject to FOIA requests or similar State laws. But then at 

the same time, there is an obligation on the companies to try to 

take out and strip out the personally identifiable information. So 

I think that is the path to go down. 

Chairman JOHNSON. Mr. Bejtlich, can you kind of chime in on 

this? I was really struck by your testimony in terms of really what 

percentage of companies do not even know they have been hacked. 

So can you just speak to me in terms of where you think the hole 

is there? 

Mr. BEJTLICH. Well, Senator, I think part of the problem is that 

many companies measure the wrong things. The example I like to 

use is you have a football team, and imagine if the way you determined how you were doing was to measure how tall all your players were, how fast they ran the 40, where they went to college, and 

then you took a look at them on paper and said, ‘‘Oh, that is how 

good we are,’’ when really you need to find out how they play in 

a game. And that is where these metrics of how long has it been 

since someone broke in and to when you discovered it, and what 

steps can you take—technology diagnostic, process diagnostic, what 

are the steps you can take to reduce that count? 

I see this in the Federal Government. With the continuous diagnostic monitoring, all the emphasis is on make sure we are 

patched, make sure we are configured properly. That is all great, 

but that is hygiene. That does not tell you what the score is going 

to be when you get on the field and you encounter the adversary. 

Chairman JOHNSON. Let us continue going down the row here 

just in terms of looking at these proposals that are out there. What 

are going to be the impediments to putting something together and 

actually get it passed? I will start with you, again, Mr. Bejtlich. 

Mr. BEJTLICH. Senator, one of the biggest issues I see is the deficit of trust in the security community. The security community up 

to the Snowden revelations, things were getting better. I mean, you 

had General Alexander appear at a hacker conference, DEF CON. 
30 

There was real good will being built there. And then the Snowden 

revelations came out, and now we have this real trust deficit. 

I think one of the ways to perhaps address that would be to take 

a look at the Computer Fraud and Abuse Act. Some of the changes 

that have been proposed to that have really scared the security 

community into thinking that just being a researcher and trying to 

do the right thing and find vulnerabilities and report them so that 

they can be fixed could be a prosecutable event in and of itself. 

So maybe one of the ways to approach this is to pair reforming 

the CFAA so that it is friendlier to good hackers with this information sharing and try to address that trust deficit. 

Chairman JOHNSON. OK. Mr. Beshar. 

Mr. BESHAR. I think the focus, Senator, should really be on information sharing and the rebuilding of trust between industry and 

government. Personally, I think the intercompany issues should be 

pushed somewhat to the side. 

Chairman JOHNSON. Mr. Charney. 

Mr. CHARNEY. I agree that industry and government sharing is 

important. The other party I would think about is the customers, 

because the privacy concerns stem from the customers who want 

to entrust their information to third parties, and I think the discussion we have had today about how could we provide privacy protections for the data that is shared but ensure that the data could be 

used with less risk of liability is the right formulation. 

Chairman JOHNSON. Mr. Gordon. 

Mr. GORDON. I agree. I think that is the one issue that looms 

around this. Otherwise, I think there is, at least for the private sector, tremendous support for this. And I think the conversation 

about removing PII in the way that we share information is a very 

reasonable approach that really would solve this. 

Chairman JOHNSON. That is a real critical aspect of this. One 

thing we really have not talked too much about—unless it was 

asked when I was gone—is really breach notification. Can you just 

kind of speak to the necessity for that and what problems that creates for any organization that is going to be required to do so? We 

will start with you, Mr. Gordon. 

Mr. GORDON. I think that having a national breach notification 

standard is appropriate and would actually be helpful, and especially one that supersedes because, as you know, every State has 

a version of it and it is very complicated to navigate. I think it is 

appropriate and we should do it. 

Chairman JOHNSON. Is that the only level we are at right now, 

is just State? Have there been smaller jurisdictions that have offered any? 

Mr. GORDON. I am only aware of State at this point. 

Chairman JOHNSON. OK, Mr. Charney. 

Mr. CHARNEY. I agree with that. The only other thing I would 

pay attention to is when breach notification has to be given. There 

have been some proposals, for example, that there should be a definitive timeline. But very often when you are investigating these 

cases, it takes awhile to figure out exactly what has happened and 

who has been breached, and you do not want to give out partial notifications. You want to understand the scope of the adversary’s ac-
31 

tivity and whether he is still in. And once you start giving notification, you have told the adversary that you are on to them. 

So there should be some reasonable time to give breach notification, but a time fixed in stone, like 48 hours, is not flexible enough. 

Chairman JOHNSON. What would be a reasonable timeframe? 

And, again, that looks to me like any kind of timeframe is somewhat of a conundrum. 

Mr. CHARNEY. It is a little bit of a conundrum, and it certainly 

should not be open ended. But in all sorts of places, the law requires reasonableness and a reasonable-man standard, so to speak. 

And the reality is these cases can be very complex, and it can take 

awhile to figure out exactly what happened and who should be notified. And what you do not want to end up is notifying too soon 

and actually compromising the investigation, and maybe even a 

law enforcement investigation. 

Chairman JOHNSON. I am assuming you are not going to give me 

a timeframe. 

Mr. CHARNEY. I am not going to give you—— 

Chairman JOHNSON. And that is actually reasonable. Mr. 

Beshar—— 

Mr. GORDON. I would completely support that. I think putting 

any time against it is nonsensical, because every instance is different, and I think reasonable is the right standard. 

Mr. BESHAR. We strongly support a uniform Federal breach notification standard, and our hope, Mr. Chairman, would be that it 

preempts the State regimes. 

Chairman JOHNSON. OK. Mr. Bejtlich. 

Mr. BEJTLICH. Mr. Chairman, the one thing—I would concur 

with my colleagues, but the one caution I would add is that breach 

has to be properly defined. There are many low-level things that 

get caught, stopped, and so forth. If you had to somehow report on 

all of those, it would be a disaster. 

Chairman JOHNSON. Can you kind of typify some sort of level? 

We were talking about data breach. Now you are talking about 

when personal information is lost and people really need to understand that so they can either cancel your credit card or—— 

Mr. BEJTLICH. That is right. You would not want to define a 

breach as someone broke into a computer. You would want to define it as they stole PII, something that the person who is affected 

would not know otherwise and they need to—— 

Chairman JOHNSON. Going back to your testimony, where 67 percent of the businesses that you are potentially auditing do not even 

know they have been breached. 

Mr. BEJTLICH. That is right. 

Chairman JOHNSON. So how do you account for that? Is it the 

point where they actually are aware of it? Is that when the data 

breach notification requirement would hit in? I mean, you also 

have to account for that as well, right? 

Mr. BEJTLICH. Right. There needs to be some time—because you 

can receive a notification and it may not actually represent a real 

problem. I have been involved with some of those as well. You do 

need some time to identify yes, this notification does point to something real and—for example, if someone stole dummy data that 

was not actually real and the bureau noticed it, there is no problem 
32 

there. It was dummy data for testing or whatever. But if you get 

the notification, you see this is real data, now I have to report. 

Chairman JOHNSON. Mr. Nojeim. 

Mr. NOJEIM. So the biggest obstacle to passing information-sharing legislation is failure to pass legislation to deal with the NSA’s 

bulk collection program. I think you have to do that before you get 

to cybersecurity information sharing, because everybody knows 

that some of this information shared under the cybersecurity program is going to end up at the NSA. Unless you do something to 

reform NSA, I do not think you can do the cyber first. 

The biggest obstacle to the data breach notification legislation is 

the way, for example, the White House bill preempts State laws 

that protect data that the White House bill does not protect. So, 

for example, California protects health information, but the White 

House bill explicitly carves that protection out. But it would preempt that California protection anyway. I think that is a problem 

that needs to be fixed. 

Chairman JOHNSON. OK. We have the second vote called, so I am 

going to have to be closing this hearing. But I want to ask one 

more question because I want to go back to the data breach notification. 

When you are not even aware that you have been hacked and 

some of that information is already flowing, I mean, how do we address that to make sure that companies are not unfairly penalized? 

Mr. BESHAR. I would just say, Mr. Chairman, it has to flow from 

discovery. 

Chairman JOHNSON. Discovery, OK. Very good. Well, again, I 

just want to thank all the witnesses for your, again, thoughtful testimony and answers to our questions. 

The hearing record will remain open for 15 days until February 

12 at 5 p.m. for the submission of statements and questions for the 

record. 

This hearing is adjourned. 

[Whereupon, at 3:07 p.m., the Committee was adjourned.] 
(33) 

A P P E N D I X 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 
49 
50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 
79 
80 
81 
82 
83 
84 
85 
86 

Æ