U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

71–412 PDF 2011

S. HRG. 112–167 

CYBER SECURITY: RESPONDING TO THE THREAT 

OF CYBER CRIME AND TERRORISM 

HEARING 

BEFORE THE

SUBCOMMITTEE ON CRIME AND TERRORISM 

OF THE

COMMITTEE ON THE JUDICIARY 

UNITED STATES SENATE 

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

APRIL 12, 2011 

Serial No. J–112–16 

Printed for the use of the Committee on the Judiciary 

( 

(II) 

COMMITTEE ON THE JUDICIARY 

PATRICK J. LEAHY, Vermont, Chairman 

HERB KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

CHUCK SCHUMER, New York 

DICK DURBIN, Illinois 

SHELDON WHITEHOUSE, Rhode Island 

AMY KLOBUCHAR, Minnesota 

AL FRANKEN, Minnesota 

CHRISTOPHER A. COONS, Delaware 

RICHARD BLUMENTHAL, Connecticut 

CHUCK GRASSLEY, Iowa 

ORRIN G. HATCH, Utah 

JON KYL, Arizona 

JEFF SESSIONS, Alabama 

LINDSEY GRAHAM, South Carolina 

JOHN CORNYN, Texas 

MICHAEL S. LEE, Utah 

TOM COBURN, Oklahoma 

BRUCE A. COHEN, Chief Counsel and Staff Director 

KOLAN DAVIS, Republican Chief Counsel and Staff Director 

SUBCOMMITTEE ON CRIME AND TERRORISM

SHELDON WHITEHOUSE, Rhode Island, Chairman 

HERB KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

DICK DURBIN, Illinois 

AMY KLOBUCHAR, Minnesota 

CHRISTOPHER A. COONS, Delaware 

JON KYL, Arizona 

ORRIN G. HATCH, Utah 

JEFF SESSIONS, Alabama 

LINDSEY GRAHAM, South Carolina 

STEPHEN LILLEY, Democratic Chief Counsel 

STEPHEN HIGGINS, Republican Chief Counsel 

(III) 

C O N T E N T S 

STATEMENTS OF COMMITTEE MEMBERS 

Page 

Kyl, Hon. Jon, a U.S. Senator from the State of Arizona .................................... 3 

Whitehouse, Hon. Sheldon, a U.S. Senator from the State of Rhode Island ...... 1 

WITNESSES 

Baker, Stewart A., Partner, Steptoe & Johnson, LLP, Washington, DC ............ 29 

Martinez, Pablo A., Deputy Special Agent In Charge, Criminal Investigation 

Division, U.S. Secret Service ............................................................................... 8 

Savage, John E., Professor of Computer Science, Brown University, Providence, Rhode Island ............................................................................................. 27 

Schneck, Phyllis, vice President and Chief Technology Officer, Global Public 

Sector, McAfee Inc., Reston, Virginia ................................................................. 24 

Snow, Gordon M., Assistant Director, Cyber Division, Federal Bureau of 

Investigation ......................................................................................................... 6 

Weinstein, Jason, Deputy Assistant Attorney General, Criminal Division, U.S. 

Department of Justice ......................................................................................... 4 

QUESTIONS AND ANSWERS 

Responses of Stewart A. Baker to questions submitted by Senator Hatch ........ 38 

Responses of Pablo A. Martinez to questions submitted by Senators Whitehouse and Feinstein ............................................................................................. 39 

Responses of Pablo A. Martinez and Gordon M. Snow to questions submitted 

by Senators Hatch and Klobuchar ...................................................................... 41 

Responses of Gordon M. Snow to questions submitted by Senators Feinstein, 

Whitehouse, Klobuchar and Hatch ..................................................................... 46 

Responses of John E. Savage to questions submitted by Senator Hatch ............ 56 

Responses of Phyllis Schneck to questions submitted by Senator Hatch ........... 59 

Responses of Jason Weinstein to questions submitted by Senators Hatch 

and Whitehouse .................................................................................................... 61 

SUBMISSIONS FOR THE RECORD 

Baker, Stewart A., Partner, Steptoe & Johnson, LLP, Washington, DC ............ 63 

Global Energy Cyberattacks: ‘‘Night Dragon’’, McAfee Foundstone, February 

10, 2011, report .................................................................................................... 70 

Martinez, Pablo A., Deputy Special Agent In Charge, Criminal Investigation 

Division, U.S. Secret Service ............................................................................... 89 

Savage, John E., Professor of Computer Science, Brown University, Providence, Rhode Island ............................................................................................. 98 

Schneck, Phyllis, Vice President and Chief Technology Officer, Global Public 

Sector, McAfee Inc., Reston, Virginia ................................................................. 106 

Snow, Gordon M., Assistant Director, Cyber Division, Federal Bureau of 

Investigation ......................................................................................................... 120 

Weinstein, Jason, Deputy Assistant Attorney General, Criminal Division, U.S. 

Department of Justice ......................................................................................... 130 

(1) 

CYBER SECURITY: RESPONDING TO THE 

THREAT OF CYBER CRIME AND TERRORISM 

TUESDAY, APRIL 12, 2011 

U.S. SENATE, SUBCOMMITTEE ON CRIME AND TERRORISM, COMMITTEE ON THE JUDICIARY, Washington, DC. 

The Committee met, pursuant to notice, at 2:38 p.m. in room 

SD–226, Dirksen Senate Office Building, Hon. Sheldon Whitehouse, Chairman of the Subcommittee, presiding. 

Present: Senators Whitehouse, Feinstein, Klobuchar, Coons, 

Blumenthal, Kyl, and Hatch. 

OPENING STATEMENT OF HON. SHELDON WHITEHOUSE, A U.S. 

SENATOR FROM THE STATE OF RHODE ISLAND 

Chairman WHITEHOUSE. Good afternoon, everyone. Thank you all 

for being here. Today’s hearing takes on a topic of vital importance: 

Cyber Security: Responding to the Threat of Cyber Crime and Terrorism. 

We live in the most connected and technologically advanced 

country in the world. Our electrical engineers, computer scientists, 

and technology companies have changed the way that the world 

does business, made our daily lives safer and more enjoyable, empowered free speech in repressive states, and brought the world 

closer together. These remarkable innovations unfortunately also 

have given criminals, terrorists, and hostile states new opportunities to steal American property, disrupt our way of life, and compromise our National security. 

American consumers are now subject to endless swindles 

achieved by spear phishing e-mails, malware that turns their computers into unwitting bots sending out malicious spam, or the 

many varieties of identity theft cooked up by cyber crooks to steal 

hard-working Americans’ privacy and money. 

Our country’s businesses likewise are under assault by foreign 

agents who seek to steal American intellectual property, a crime 

that has reportedly led to the loss of over $1 trillion of value to 

date; and by criminal hackers who seek to empty out corporate accounts or to blackmail companies by threatening to release stolen 

trade secrets. These crimes hurt companies’ bottom lines and they 

rob us of American jobs, shuttering small businesses by stealing 

their core intellectual property, making a new product line unprofitable by letting a foreign company reap the benefit of American research and development, or even preventing the next great American company from bringing the next great innovation to market. 

2 

Key elements of our Nation’s critical infrastructure such as our 

electrical grid, financial services system, and telecommunications 

networks have been probed by malicious actors and in some cases 

compromised, with the possibility that hostile state actors have 

buried latent attacks that they can trigger when it would hurt us 

most. Even our Government, civilian, and military networks are 

under constant and successful attack. 

We need to do more to defeat the massive and worsening cyber 

threat. I am not alone in this belief. The Majority Leader has recognized that the Senate should act on cyber security legislation. 

The Commerce, Homeland Security, Intelligence, and Armed Services Committees have been hard at work. This Committee, under 

Chairman Leahy’s leadership, has reported data breach legislation 

and last week held a hearing that has considered reform of the 

Electronic Communications Privacy Act. And we hope and expect 

the administration to weigh in shortly with its proposals to improve our Nation’s cyber security. 

The Senate has important work ahead. It may be hard and complicated work, but I believe that we can accomplish this task in a 

bipartisan and well-considered fashion. I particularly look forward 

to working on this vital national issue with the Ranking Member 

of this Committee, Senator Jon Kyl. 

I know that this is a topic of serious interest and prior work for 

you, Senator Kyl, and I believe we will make a lot of progress together. 

I am very happy, for example, to be working with you to improve 

public awareness of the cyber security threats facing our Nation on 

a bill that I hope we can file shortly, and to go on to work on legislation to provide a safe space for joint defense by our private industries to take place. 

Today’s hearing will explore the nature, scale, source, and sophistication of cyber attacks against consumers, Government agencies, and businesses and industries and compare that to the resources that our Government currently brings to bear on these attacks, as well as investigative and prosecutorial successes and limitations. And it will consider the ways in which the private sector 

is able to collaborate with law enforcement to defend against and 

respond to cyber attacks. 

We are lucky to have two very strong panels of expert witnesses 

from inside and outside the administration, including a distinguished professor from Brown University in my home State of 

Rhode Island, which I am happy to note is already at the forefront 

of the cyber security field. I thank all of the witnesses for being 

here today. 

Before I turn to Senator Kyl, let me flag my serious concern that 

our prosecutorial and investigative resources are not appropriately 

scaled to the threat we face. Even in this time of budget cutting, 

given the enormous stakes, the cyber threat is simply too dangerous to leave underresourced. 

Again, I thank the witnesses for being here and now turn to the 

Ranking Member, Senator Kyl, for his opening statement. Senator 

Kyl. 

3 

STATEMENT OF HON. JON KYL, A U.S. SENATOR FROM THE 

STATE OF ARIZONA 

Senator KYL. Thank you, Mr. Chairman, not only for holding this 

hearing today but for the remarks that you just made. 

As one former member of the Intelligence Committee to another, 

I have been deeply impressed by your commitment to cyber security and your command of the associated issues and look forward 

to what will be the first of many hearings on this subject before 

this Subcommittee. 

I am also pleased to have been able to work with you to draft 

the forthcoming legislation that you mentioned regarding cyber security awareness. While this bill may be considered chiefly a place 

holder for things to come, I think it is an important step because 

of the multitude of topics that it covers, and that multitude speaks 

to a larger point and problem. 

I know of your frustration that Congress has waited for so long 

to get cyber security legislative proposals from the White House. 

This delay has complicated the Congress’ task of passing comprehensive cyber security legislation. By my count, there are more 

than seven full committees on the Senate side alone, including the 

Judiciary Committee, that will be involved in drafting a comprehensive bill. This will take time, and we are long overdue for 

the President to share his proposals for cyber security legislation 

so that we can get started. 

I am eager to hear from our expert witnesses about how they 

think Congress should differentiate cyber crime and cyber warfare 

directed by a state or terrorist group, especially since, I would 

argue, it does not much matter if a crippling attack on our electric 

grid, banking system, or other critical infrastructure, or the wholesale theft of billions of dollars of U.S. intellectual property, defense 

related or purely commercial, is being directed by a cyber mafia or 

a cyber army. It is the responsibility of this Government to stop the 

attack either way. If we are just focusing on prosecuting these attacks of cyber crime, then I would say we have failed. 

So I look forward to the testimony of our witnesses, Mr. Chairman, and I hope there will be stimulating and informative rounds 

of questions thereafter. Thank you. 

Chairman WHITEHOUSE. Thank you, Senator Kyl. 

If I could ask the witnesses to stand for the oath. Do you affirm 

that the testimony you are about to give before this Committee will 

be the truth, the whole truth, and nothing but the truth, so help 

you God? 

Mr. WEINSTEIN. I do. 

Mr. SNOW. I do. 

Mr. MARTINEZ. I do. 

Chairman WHITEHOUSE. Thank you very much. Please be seated. 

We will just go right across the table with the witnesses, beginning with Jason Weinstein. Jason Weinstein currently serves as 

Deputy Assistant Attorney General in the Department of Justice’s 

Criminal Division where he oversees the Division’s efforts to combat computer crime and intellectual property crime, as well as antigang and violent crime efforts and human rights and human-smuggling programs. 

4 

Before joining the Criminal Division, Mr. Weinstein served as 

chief of the Violent Crimes Section of the U.S. Attorney’s Office in 

Baltimore and before that as an Assistant United States Attorney 

in the U.S. Attorney’s Office for the Southern District—the Sovereign District—of New York. We are delighted that he is here, and 

your full statement will be a matter of record, so if you could please 

make whatever statement you would like to make orally within the 

allotted time, I would appreciate that. 

STATEMENT OF JASON WEINSTEIN, DEPUTY ASSISTANT ATTORNEY GENERAL, CRIMINAL DIVISION, U.S. DEPARTMENT 

OF JUSTICE 

Mr. WEINSTEIN. Thank you, Mr. Chairman. The Sovereign District of New York jokes got a lot funnier after I moved to Baltimore. 

Good afternoon, Chairman Whitehouse, Ranking Member Kyl, 

and other members of the Subcommittee, and I thank you for the 

opportunity to appear before you today. 

As we all know, the explosive growth of the Internet and other 

modern forms of communication has revolutionized nearly every aspect of our daily lives. But at the same time, it has also revolutionized crime, and increasingly the Internet has being exploited by 

criminals throughout the world to commit a staggering array of 

crimes. 

From around the corner or around the globe, skilled hackers 

work every single day, and many times every day, to access the 

computer systems of Government agencies, of universities, banks, 

merchants, and credit card companies to steal large volumes of personal information and to perpetrate large-scale data breaches that 

leave tens of millions of Americans at risk of identity theft. 

Our information infrastructure is under constant attack from 

these criminals as well as from terrorists and nation states that 

seek to exploit our dependency on information technology to threaten both our economic and our National security. 

So for these reasons, now more than ever cyber security has to 

be a national priority. This administration is committed to implementing a comprehensive framework that will allow us to bring all 

appropriate tools, criminal and otherwise, to bear against cyber 

criminals, terrorists, and other malicious actors. And the Department of Justice plays a critical role in that effort. 

The Justice Department works closely with our partners 

throughout the Government to support the Nation’s efforts to support cyberspace, including by providing legal support and helping 

to ensure that we vigorously protect privacy and civil liberties. The 

Department also plays a leading role in counterintelligence and national security investigations that uncover threats to our computer 

networks from terrorists and state actors. 

But perhaps one of the Department’s most important contributions to the Nation’s overall cyber security is the investigation and 

prosecution of cyber criminals as we seek to incapacitate and punish the cyber criminals of today and to deter the cyber criminals 

of tomorrow. And in that important work, our prosecutors from the 

Criminal Division, from the National Security Division, and from 

the U.S. Attorney’s Offices enjoy very strong relationships with our 

5 

law enforcement agency partners, and in particular with the other 

two agencies represented on the panel with me today—the FBI and 

the Secret Service. 

Those strong relationships and the dedication and skill of our 

prosecutors and our agents have led to a number of major enforcement successes, including the following: 

In August of 2008, the Department, working with the Secret 

Service, announced one of the largest hacking and identity theft 

cases ever prosecuted, in which charges were brought by the U.S. 

Attorney’s Offices in three different districts—Massachusetts, 

Southern California, and Eastern New York—against 11 members 

of an international ring responsible for the theft and sale of more 

than 40 million credit and debit card numbers that had been stolen 

from major retailers. 

The defendants were from all over the world—from the U.S., 

from Estonia, Ukraine, China, and Belarus—and they included one 

of the world’s top hackers, Albert Gonzalez. Gonzalez pled guilty to 

the charges and was sentenced to 20 years in prison, which is one 

of the longest sentences ever imposed in a hacking case. 

In November 2009, following a year-long investigation led by the 

FBI, the Department announced the indictment in the Northern 

District of Georgia of a hacking ring responsible for executing a 

global fraud scheme involving defendants from Estonia, Russia, 

and Moldova. The defendants were charged with hacking into a 

network operated by the credit card processing company RBS 

WorldPay, compromising its data encryption and then providing a 

network of cashers throughout the world with counterfeit payroll 

debit cards. Those cashers used those cards to withdraw over $9 

million from more than 2,100 ATM machines in at least 280 cities 

worldwide, and they conducted that coordinated global cashing operation in less than 12 hours. 

Those cases as well as the others referred to in my written testimony illustrate the scope of the Department’s efforts to pursue 

cyber criminals. But, significantly, they also reveal the global nature and the global reach that cyber criminals can have. 

The criminals responsible for those and other large-scale intrusions often live in and operate from foreign jurisdictions. It is often 

literally impossible to identify, arrest, and prosecute the offenders 

or to obtain critical evidence that we need to prosecute the offenders without the assistance of foreign law enforcement. And for that 

reason, our work does not stop at our shores. 

Due to the transnational nature of most cyber security incidents, 

continued close coordination and cooperation with our foreign partners is critical to our success. And in that connection, we rely on 

the International Convention on Cyber Crime to provide a framework for efficient cooperation among nations involving electronic 

crime. 

The Department is proud of these cases and all of our cyber security efforts, but there should be no doubt, as the Chairman and the 

Ranking Member said, that the cyber threats to our Nation are 

growing and evolving, and we must remain vigilant and prepared 

to confront them, and we will continue to work with our Government and private sector partners and the Congress to meet that 

challenge. 

6 

Thank you for the opportunity to be here today to discuss this 

issue with you, and I would be pleased to answer your questions. 

[The prepared statement of Mr. Weinstein appears as a submission for the record.] 

Chairman WHITEHOUSE. Thank you very much. We are delighted 

to have you with us. 

We will go on next to Gordon Snow, who is the Assistant Director 

of the Cyber Division at the Federal Bureau of Investigation. He 

was named section chief of the Bureau’s Cyber Division on January 

2008 and now leads the Division’s Cyber National Security Section 

and the National Cyber Investigative Joint Task Force. From January 2008 to January 2009, he was detailed to the Director of National Intelligence on the National Counterintelligence Executive. 

During that assignment, he led the effort in drafting the 

goverment-wide Cyber Counterintelligence Plan under the Comprehensive National Cyber Initiative. 

Prior to that, Mr. Snow’s work with the FBI took him to Afghanistan as the FBI’s on-scene commander for the Counterterrorism Division, to Silicon Valley working on the High Value Computer 

Crimes Task Force, and to Yemen and East Africa. 

Thank you, Mr. Snow. Glad to have you with us. 

STATEMENT OF GORDON M. SNOW, ASSISTANT DIRECTOR, 

CYBER DIVISION, FEDERAL BUREAU OF INVESTIGATION 

Mr. SNOW. Good afternoon, Chairman Whitehouse, Ranking 

Member Kyl, and members of the Subcommittee. I am pleased to 

appear before you today to discuss the cyber threats facing our Nation and how the FBI and our partners are working together to respond to the threat of cyber crime and terrorism. 

As the Committee is aware, cyber attacks have increased over 

the past 5 years and are expected to grow. We have reached the 

point that, given enough time and motivation and funding, a determined adversary will likely be able to penetrate any system that 

is accessible directly from the Internet. The FBI has identified the 

most significant cyber threats to our Nation as those with high intent and high capability to inflict damage or death in the U.S., to 

illegally obtain sensitive or classified information, or to illicitly acquire assets. 

I would like to focus my remarks today on a few of the many 

threats facing the private sector, including threats against infrastructure, intellectual property, individual businesses, and our 

partnerships to address these threats. 

U.S. critical infrastructure faces a growing cyber threat due to 

the advancements in the availability and sophistication of malicious software tools. The recent security breach by unauthorized intruders into the parent company of NASDAQ is an example of the 

kind of breaches directed against important financial infrastructure. 

Industrial control systems, which operate the physical processes 

of the Nation’s pipelines, railroads, and other critical infrastructures, are at great risk of cyber exploitation. 

Similarly, new ‘‘smart grid’’ and ‘‘smart home’’ products could 

also be exploited by cyber criminals, nation states, and terrorists. 

7 

These systems need to be developed and implemented in ways that 

will provide protection from unauthorized use. 

Intellectual property rights violations, including theft of trade secrets, digital piracy, and trafficking in counterfeit goods, also represent high cyber criminal threats, resulting in losses of billions of 

dollars in profits annually. These threats pose significant risk to 

U.S. public health and safety via counterfeit pharmaceuticals, electrical components, aircraft parts, and automobile parts. 

Cyber criminals are forming private, trusted, and organized 

groups to conduct cyber crime. The adoption of specialized skill sets 

and professionalized business practices by these criminals is steadily increasing the complexity of cyber crime. 

One facet of this are botnets, or networks of compromised computers controlled remotely by an attacker. Criminals use botnets to 

facilitate online schemes that steal funds or data, to anonymize online activities, and to deny access by others to online resources. The 

botnets run by criminals could be used by cyber terrorists or nation 

states to steal sensitive data, raise funds, limit attribution of cyber 

attacks, or disrupt access to critical national infrastructure. 

The potential economic consequences are severe. Often businesses are unable to recover their losses, and it may be impossible 

to estimate the damage. Many companies prefer not to disclose that 

their systems have been compromised, making it impossible to accurately quantify. Consequently, these damages estimates have 

ranged from millions to hundreds of billions. 

Thanks to Congress and the administration, the FBI is devoting 

significant resources to this threat. Our partnerships with industry, academia, and across all of government have led to a dramatic 

improvement in our ability to combat this threat. 

The FBI’s statutory authority, expertise, and ability to combine 

resources across multiple programs make it uniquely situated to investigate, collect, and disseminate intelligence about and counter 

cyber threats from criminals, nation states, and terrorists. 

The FBI has cyber squads in each of its 56 field offices, with 

more than 1,000 advanced cyber-trained FBI agents, analysts, and 

forensic examiners. 

However, the FBI cannot combat the threat alone. Through the 

FBI-led National Cyber Investigative Joint Task Force, we coordinate our efforts with over a dozen Federal partners throughout the 

intelligence community and the Department of Defense. We also 

partner through NCIJTF with other Federal law enforcement agencies to include most prominently the United States Secret Service. 

The FBI has also embedded cyber staff in other intelligence community agencies through joint duty and detailee assignments. 

In addition to our 61 legal attaches overseas, we currently have 

FBI agents embedded full-time in five foreign police agencies to assist with cyber investigations. These cyber agents have identified 

organized crime groups, supported FBI investigations, and trained 

foreign law enforcement officers for more than 40 nations. 

InfraGard is a prime example of the success of public-private 

partnerships. Under this initiative, private industry leaders work 

with the FBI to ward off attacks against critical infrastructure. 

Over the last 15 years, this initiative has grown from a single 

8 

chapter to more than 86 chapters in 56 field offices with 42,000 

members. 

In addition to InfraGard, the FBI partners with the National 

White Collar Crime Center and the Internet Crime Complaint Center and the National Cyber Forensic and Training Alliance. We also 

partner with the information-sharing and analysis centers through 

the Department of Homeland Security and the National Center for 

Missing and Exploited Children. 

Chairman Whitehouse, Ranking Member Kyl, and members of 

the Subcommittee, in the interest of time today, I have touched 

upon a few of the more significant cyber threats facing our Nation. 

I appreciate the opportunity to come before you and share the work 

the FBI and our partners in the community are doing to address 

the cyber threat in this country and am happy to answer any questions you may have. 

[The prepared statement of Mr. Snow appears as a submission 

for the record.] 

Chairman WHITEHOUSE. Thank you, Assistant Director Snow. 

Our next witness, Pablo Martinez, is Deputy Special Agent in 

Charge of the Criminal Investigation Division, Cyber Crime Operations, at the United States Secret Service. In this capacity, he develops and implements policy for all cyber investigations conducted 

by the Secret Service. Mr. Martinez began his career at the Service 

in 1991, and in 1999 was transferred to the Presidential Protective 

Division. In 2003, Mr. Martinez was promoted to the supervisory 

ranks of the Criminal Investigative Division, where he was tasked 

with expanding the Service’s Electronic Crimes Task Force. During 

that time, he oversaw the first major cyber operation conducted by 

the Secret Service, Operation Firewall, in which over 30 online 

criminals were apprehended worldwide in a simultaneous roundup. 

Glad to have you with us, Agent Martinez. 

STATEMENT OF PABLO A. MARTINEZ, DEPUTY SPECIAL 

AGENT IN CHARGE, CRIMINAL INVESTIGATION DIVISION, 

U.S. SECRET SERVICE 

Mr. MARTINEZ. Good afternoon, Chairman Whitehouse, Ranking 

Member Kyl, and distinguished members of the Subcommittee. 

Thank you for the opportunity to testify on the role of the Secret 

Service in cyber investigations. 

On February 1, 2010, the Department of Homeland Security delivered the Quadrennial Homeland Security Review, which established a framework for homeland security missions and goals. I 

would like to share just a few sentences from the QHSR because 

it underscores the need for a safe and secure cyberspace: 

‘‘As we migrate more of our economic and societal transactions 

to cyberspace, these benefits come with increasing risk. We face a 

variety of adversaries who are working day and night to use our 

dependence on cyberspace against us. Sophisticated cyber criminals 

pose great cost and risk both to our economy and national security. 

They exploit vulnerabilities in cyberspace to steal money and information, and to destroy, disrupt, or threaten the delivery of critical 

services.’’ 

9 

In order to maintain a safe and secure cyberspace, we have to 

disrupt the criminal organizations and other malicious actors engaged in high consequence or wide-scale cyber crime. 

To address the threats posed by these transnational cyber criminals, the Secret Service has adopted a multi-faceted approach to investigate these crimes while working to prevent future attacks. A 

central component of our approach is the training provided through 

our Electronic Crimes Special Agent Program, which gives our special agents the tools they need to conduct computer forensic examinations on electronic evidence obtained from computers, personal 

data assistants, and other electronic devices. To date, more than 

1,400 special agents are ECSAP trained. In fact, the Secret Service 

values this training so highly that the basic level is now incorporated as a part of the curriculum that all special agent trainees 

receive at our James J. Rowley Training Center. 

In addition, since 2008, the Secret Service has provided similar 

training to 932 State and local law enforcement officials, prosecutors, and judges, through the National Computer Forensics Institute, located in Hoover, Alabama. The Secret Service’s commitment 

to sharing information and best practices with our partners, the 

private sector, and academia is perhaps best reflected through the 

work of our 31 Electronic Crime Task Forces, including two located 

overseas in Rome, Italy, and London, England. 

To coordinate these complex investigations at the headquarters 

level, the Secret Service has enhanced our cyber intelligence section to identify transnational cyber criminals involved in network 

intrusions, identity theft, credit card fraud, bank fraud, and other 

computer-related crimes. In the past 2 years, CIS has directly contributed to the arrest of 41 transnational cyber criminals who were 

responsible for the largest network intrusion cases ever prosecuted 

in the United States. These intrusions resulted in the theft of hundreds of millions of credit card numbers and the financial loss of 

approximately $600 million to financial and retail institutions. 

As an example, the partnerships developed through our ECTFs, 

the support provided by our CIS, the liaison established by our 

overseas offices, and the training provided to our special agents via 

ECSAP were all instrumental to the Secret Service’s successful investigation into the network intrusion of Heartland Payment Systems. The August 2009 indictment alleged that a transnational organized criminal group used various network intrusion techniques 

to breach security, navigate the credit card processing environment, and plant a collection device to capture payment transaction 

data. 

Our investigation revealed data from more than 130 million credit card accounts were at risk of being compromised and exfiltrated 

to a command and control server operated by an international 

group. Furthermore, the Secret Service uncovered that this international group committed other intrusions into multiple corporate 

networks to steal credit and debit card data. 

As a result of our investigation, the three suspects in the case 

were indicted for various computer-related crimes. The lead defendant in the indictment pled guilty and was sentenced to 20 years in 

Federal prison. This investigation is ongoing with over 100 additional victim companies identified. The Secret Service is working 

10 

with its law enforcement partners both domestically and overseas 

to apprehend the two defendants who are still at large. 

Chairman Whitehouse, Ranking Member Kyl, and distinguished 

members of the Subcommittee, the Secret Service is committed to 

our mission of safeguarding the Nation’s cyber infrastructure and 

will continue to aggressively investigate cyber and computer-related crimes to protect American consumers and institutions from 

harm. 

This concludes my prepared statement. Thank you again for this 

opportunity to testify on behalf of the Secret Service. 

[The prepared statement of Mr. Martinez appears as a submission for the record.] 

Chairman WHITEHOUSE. Thank you, Agent Martinez. I appreciate having you here. 

One of the purposes of this hearing is to look into the comparison 

between the size of the threat and the resource that is dedicated 

to it, and if I may, Mr. Weinstein, let me ask—I have some numbers here about Criminal Division deployment at the Department 

of Justice. And just by way of comparison, we have looked at 

OCDETF, the Organized Crime Drug Enforcement Task Force program; we have looked at the Organized Crime Task Force, dedicated to traditional Mafia organized crime; and we have looked at 

the cyber staff. And the numbers that I have are that there are 

just under 90 attorneys in the Criminal Division dedicated to traditional organized crime. There are 13 attorneys in the Criminal Division dedicated to the OCDETF program, but the OCDETF program is very much a field-based program, and so they are sort of 

the local touch point for over 1,000 staff out in the field, including 

more than 550 attorneys out in the field. So it is a pretty robust 

field program behind those 13 attorneys at Main Justice. 

In the context of that range, we have been told that there are 

40 attorneys in the Criminal Division who are dedicated to computer intrusions and other hacking cases. There are additional attorneys who are dedicated to child exploitation, to appellate cases, 

to other crimes that may have a computer component but are not 

the direct hacking cases. 

It strikes me that if the numbers are correct that there is as 

much as $1 trillion, I contend that we are on the losing end of the 

biggest transfer of wealth in the history of humankind through 

theft and piracy in this country right now, that it is being done 

through cyber crime, and that it is a very, very significant national 

security and economic challenge. 

Senator Feinstein and Senator Kyl and I all have also served on 

the Intelligence Committee, and while much of what we know from 

that Committee is classified, in the public hearing the Director of 

National Intelligence Jim Clapper listed the national security 

threats that he felt he was obliged to address as the new DNI, and 

he put cyber security No. 1 above everything else. 

And so that was kind of noteworthy, and in that context it 

strikes me that having fewer attorneys dedicated to computer intrusions at Main Justice than are dedicated to old-fashioned, traditional organized crime is a sign that we here in Congress need to 

provide you with more resources to focus on the cyber threat. 

What is your sense of that? 

11 

Mr. WEINSTEIN. Let me, before I answer your question, put those 

numbers in a little bit of context. 

You are right in observing that the OCDETF program is mostly 

a field-based program, so it is not unexpected that that is a relatively low number dedicated to that. 

The organized crime number which you quoted, which is about 

89 attorneys, actually it was organized crime broadly defined. That 

is to say, it is traditional organized crime like LCN, Mafia-type 

cases; it is gang cases; it is drug-related organized crime like drug 

cartel cases, which are pursued as enterprises; and it includes 

international organized crime. And in that sense, especially with 

international organized crime, there is some overlap with our cyber 

security and cyber crime efforts. 

I actually also, along with another Deputy AG, oversee the organized crime program, and increasingly the priority of our international organized crime program is to go after transnational crime 

groups that involve cyber threats. So there is some overlap. 

The other thing I would add is that the 40 attorneys that you 

quoted that are cyber specific, those are the attorneys who are in 

the Computer Crime and IP Section, which I have had the honor 

to supervise. There are a substantial number of other attorneys, 

like in the Fraud Section, who also in the course of their fraud 

work focus on fraud cases that have a cyber component. 

Having said all that, it is really undeniable that the scope of the 

problem, which is growing every day, far outpaces the resources 

that are available to pursue it currently. And so I think that this 

is the kind of problem that takes a dedicated stream of resources, 

but it also takes dedicated training and expertise so we can keep 

pace with the methods that our cyber actors are using. 

I would add that in the President’s 2011 budget, which I think 

now is a collector’s item, there was a request for four additional 

cyber attorneys. In the 2012, there is actually a request for six, and 

those six attorneys are CHIP prosecutors, computer hacking and IP 

prosecutors. But for the first time, they will be CHIP prosecutors 

who are placed overseas, I think to reflect the recognition that 

fighting this problem requires going beyond our borders to do it. 

The President’s proposal, the President’s budget proposal, would 

put six of these CHIPs, who we would call ICHIPs, international 

CHIPs, in regions throughout the world that have a high concentration of cyber crime and IP theft activity so that they can not 

only help American prosecutors at home on their cases but also 

help those contractors beef up their own capacity to pursue cyber 

criminals in their own borders. 

Chairman WHITEHOUSE. My time has expired, but let me ask 

just one more question before I turn to Senator Kyl because there 

is also field staff, attorneys out in the U.S. Attorneys’ Offices, who 

are dedicated to this. But it is my understanding that the—if you 

could confirm this, it is my understanding that the AUSAs who are 

your cyber designees are obliged to participate in conferences on 

cyber, be a point of contact for the office on cyber; if there are conference calls, they are the person for the office who would participate, but they need not direct their prosecutive attention to cyber 

cases. They are to be deployed as the U.S. Attorney and the first 

assistant and the head of the Criminal Division see fit, and in that 

12 

sense it is something of an overcount to describe them as fulltime—it would be something of an overcount to describe them as 

full-time cyber prosecutors, would it not? 

Mr. WEINSTEIN. I think, Senator, it depends on where—Mr. 

Chairman, it depends on where they are. In some districts, especially districts with very active FBI or Secret Service cyber squads 

in them, and with a heavy concentration of these cases, the CHIP 

prosecutors work exclusively on those cases. 

Chairman WHITEHOUSE. But in some they may not—— 

Mr. WEINSTEIN. Some districts they may not. And the role really 

has three or four aspects to it. One is to work on this case—— 

Chairman WHITEHOUSE. Well, since I am over my time—— 

Mr. WEINSTEIN. OK. 

Chairman WHITEHOUSE [continuing]. And since I have my Ranking Member waiting, let me—we can pursue that in the—— 

Mr. WEINSTEIN. OK. 

Chairman WHITEHOUSE [continuing]. Later discussion. 

Senator Kyl. 

Senator KYL. Well, thank you, Mr. Chairman. These are all 

right-on questions, and in a related area, it is not only resources 

but also authority. 

Agent Martinez, I would like to ask you a question about comments you made in your testimony in which you referred to going 

dark, the going-dark problem, whereby there is a gap between the 

legal authority that you have to intercept electronic communications and the provider’s practical ability to intercept those communications. And you quoted and endorsed the statement by the FBI 

Chief Counsel, who had testified in the House of Representatives, 

that there is—excuse me. She said, ‘‘There are significant law enforcement challenges in light of the pace of technological advancements.’’ 

Are there specific tools that you think Congress could provide 

you and your counterparts in domestic law enforcement and intelligence to better mitigate this problem? Can you share them with 

us today? If not, could I ask all three of you really to provide to 

this Committee your proposals for improving the authorities that 

all of you need to tackle the problems that you have identified here 

today? 

Mr. MARTINEZ. Yes, Senator Kyl, we did endorse Chief Counsel’s 

statements on that. We believe that cyber criminals are at the tip 

of the spear when it comes to exploiting technology. The types of 

communications that cyber criminals use or have been using for 

many years are now just starting to come into the forefront of 

crimes being committed by traditional criminals. So cyber criminals 

have been using instant message, have been using VOIP systems, 

have been communicating via the computer for many, many years, 

and we believe as technology continues to develop you are going to 

continue to see cyber criminals exploiting that capability because 

they seem to have the most knowledge when it comes to utilizing 

devices like that. 

I believe right now there are several working groups that have 

been established, you know, at the request of the administration, 

both at the legislative level and at the technical working group 

level. The Secret Service participates in a technical working group 

13 

being led by the FBI, and we are in the process right now of finalizing some of our recommendations that I believe the administration is looking to put forward. 

Senator KYL. Great. We will appreciate that, hearing from FBI, 

Justice Department, and Secret Service, whomever, to assist us in 

giving you the authority you need. 

Assistant Director Snow, I would like to ask you, could you explain the FBI’s role in the so-called Team Telecom? And then I’ve 

got a couple specific questions about what I understand that team 

is engaged in, the advisory role to the Federal Communications 

Commission by the FBI. Is that not a term you are familiar with? 

Mr. SNOW. Sir, I apologize. It is not a term I am familiar with. 

It usually runs out of our Operational Technology Division, which 

would, along with our Office of General Counsel—— 

Senator KYL. OK. Well, let me just ask you to generally describe 

concerns that you all have about telecommunications computers 

that have links to foreign governments or foreign militaries providing telecommunications equipment, software, network management services and the like here in the United States. 

Mr. SNOW. Sir, I guess the best way to answer that is in another 

forum we could probably go more in-depth, and I would be more 

than willing to provide you the personnel and myself and availability to address those questions. 

Senator KYL. Well, is it fair to say that there is a significant concern about this and that you do play a role, that the FBI does play 

a role along with other intelligence services in advising our Government departments with respect to these threats? 

Mr. SNOW. Yes, sir, absolutely. Always a concern from any facet, 

a country adversary that comes in and that would either manipulate or use our supply chain to our disadvantage. So if so many 

things in the supply chain, whether it is a counterfeit part, a counterfeit CHIP, something that could be implanted, an executable 

piece of malware, a piece of additional code that would be in our 

telecom system. 

Senator KYL. When you review the offer of such a company to 

open themselves up to third-party or independent review to deal 

with those supply chain kinds of problems, is it possible for you to 

go through millions of lines of software code to make 100 percent 

certain that there is not anything malicious built in that is capable 

of being activated at a moment of a cyber criminal’s or cyber warrior’s choosing? 

Mr. SNOW. I do not think, sir, that we have that capability right 

now in the U.S. Government to go through millions of lines of code. 

It is very work intensive. I think we know that code now is cobbled 

together from many pieces. I think sometimes even the programmers and people that design that code are not even sure what is 

in that code. They will use other pieces, freely available pieces on 

the outside to assemble that program. And we do provide under the 

CFIUS process counsel, guidance, direction, and information to the 

decisionmakers across the Government in order to make those decisions, along with the Department of Justice that runs the CFIUS 

program. 

Senator KYL. I appreciate it. Thank you. 

Chairman WHITEHOUSE. Senator Coons. 

14 

Senator COONS. Thank you, Senator, and thank you to both Senator Whitehouse and Senator Kyl for convening this hearing today, 

and to our panel. 

You have all testified to the different ways in which your respective agencies are working together with State and local law enforcement, and to some extent, the private sector, the intelligence 

agencies, and our armed forces to combat cyber crimes, and I am 

just interested initially in your opinion whether States and local 

law enforcement have the right resources, have the right training, 

have the right capabilities to buildup their investigative capabilities as well as their defensive capabilities. 

You made reference, Agent Martinez, in your testimony to the 

National Computer Forensics Institute and where the 900 folks 

have been trained. I think that is a great start. There was also a 

reference, I think by Mr. Snow, to 42,000 members of the FBI’s 

InfraGard. 

If you could, in order to speak to the training standards we are 

trying to hit, the resources State and local law enforcement and 

Government have, and what additional resources do we need in 

order to be able to develop a nationwide professional cadre of folks 

in law enforcement, in the intelligence community, and, frankly, in 

the private sector? Please. 

Mr. MARTINEZ. Thank you, Senator. From our perspective in law 

enforcement, what we have basically done is taken our ECSAP 

model—that is a three-tier model, BICEP, NITRO, and computer 

forensics—and we have mirrored that curriculum at the National 

Computer Forensics Institute where we not only teach law enforcement but also prosecutors and judges. We are firm believers that 

you not only have to train the agents or the law enforcement officers, but you have to make sure that they can explain or they can 

articulate in a layman’s term the case to a prosecutor who can then 

also explain the facts in layman fashion to a judge who you are 

going to have to get the warrants signed to. So that is why it has 

been—it is important for us to train all three aspects. 

So far, like I stated in my statement, we are over 900. We are 

looking to try to expand the amount of law enforcement personnel 

that we train. What we try to focus on, since we have the 31 Electronic Crime Task Forces, we try to focus on individuals who are 

members not only of our task force, but potentially a State and 

local cyber task force or an FBI task force because they are in the 

most need of having this specialized training. We believe that by 

doing that we are multiplying our resources, and we can force multiply and work investigations not only at the Federal level but at 

the State and local level. 

And like I said, we continue to work with these partners at the 

State and local level to try to get them a better understanding of 

some of the issues with cyber crime and some of the ways to tackle 

the problem. 

Senator COONS. Mr. Snow. 

Mr. SNOW. Sir, as Mr. Martinez talked about, the good news portion of the story is that we are making progress on trying to help 

assist and train those personnel. I think inwardly, though, if we 

are more reflective, it is a difficult task to make sure that all our 

personnel are trained, not only that they are trained but what is 

15 

the process that we used in order to make sure that we keep them 

current and how we retain those personnel. 

So I would not want to classify all State and local law enforcement officers as being in the position we were in about 10 years 

ago. We talked recently about the going-dark issue, and we also 

talk about how difficult it is to bring those people up to speed. But 

I would say—because I know we have very talented individuals 

from State and local entities that are in our regional computer forensic labs that are run nationally across the country. 

However, many of those departments and agencies, you know, 

hundreds of thousands of sworn law enforcement officers across the 

country, have a difficult time coming up with that money, that 

training, the availability of their personnel as they try just to meet 

hiring and payrolls. 

Senator COONS. And if I could, just a follow-on question to the 

Deputy Assistant Attorney General, Mr. Weinstein. One of the 

areas I am most concerned about is intellectual property theft, particularly trade secrets. American companies are some of the most 

innovative in the world. In your written testimony, there was an 

example of a successful theft from Dow Chemical that had significant long-term consequences for them. 

Where are we in terms of providing coordination, resources, and 

standards for training that will help the private sector understand 

how to defend against these threats and then the prosecutorial resources to, as you put it, once these better locks are broken, actually then capture the CMS who have broken them? 

Mr. WEINSTEIN. Well, Senator, perhaps in IP crime, unlike any 

other type of crime, we rely heavily on the victim companies to report the crimes to us and to be able to recognize them when they 

occur, then to provide us with access to the information we need 

to successfully investigate and prosecute them. 

One of the things that CCIPS does in conjunction with the CHIP 

prosecutors throughout the country is conduct extensive outreach 

with potential victim companies in various regions. In the Pacific 

Northwest it might be Microsoft, or computer companies in Delaware and other States, it may be, you know, companies that are 

the significant industries in those States. And what we try to do 

is explain to them where the risks are, how to recognize when 

there is a potential trade secret theft or other IP crime, and then 

how to make a referral to us, either to us directly or to the FBI 

or to the IPR Rights Center, which is jointly operated by ICE and 

by the FBI. 

So we do that nationally, and we do that regionally. We go region 

by region throughout the country to try to make sure that companies that are at the greatest risk are aware of what is going on out 

there and how to protect themselves from it; and then if they are 

violated, how to report it to us so we can pursue it. 

Senator COONS. Thank you. 

Chairman WHITEHOUSE. Senator Hatch. 

Senator HATCH. Well, thank you, Mr. Chairman, Chairman 

Whitehouse. I thank you and applaud you for your efforts in this 

area. 

The distinguished witnesses represent a balance of all those affected by cyber criminal and terrorism—Government, the private 

16 

sector, and, of course, academia. For successful cyber security policy, we must encourage partnerships among many sectors. This 

cannot be solely a Government-led initiative. 

Now, Mr. Snow, China is directing the single largest, most intensive foreign intelligence gathering effort since the cold war against 

the United States. Methods for conducting informational warfare to 

advance the goals of a nation state might also involve secretly 

sponsoring terrorists. 

Now, China is often cited as providing Government support to 

computer hackers, and as Richard Clarke, a former White House 

adviser for infrastructure protection and counterterrorism, discusses in his book, ‘‘Cyber War,’’ the Chinese military has placed 

a new emphasis on information warfare methods. Specifically, they 

have proposed to attack enemy financial markets, civilian electricity networks, and telecommunication networks by way of computer viruses and, of course, hacker detachments. 

Now, it remains very difficult to determine the true identity, purpose, or sponsor of a cyber attacker. Can you tell me, does the FBI 

have sufficient capability to identify an attack that is state sponsored versus a criminal enterprise? 

Mr. SNOW. Senator, obviously, once again, in a different forum 

we can go more in-depth to your question, but let me answer it in 

a form that I can today. 

Senator HATCH. Sure. 

Mr. SNOW. Through the National Cyber Investigative Joint Task 

Force, which I mentioned in my opening statement, we have 18 intelligence community agencies and others there. We use a concept 

that is called the threat focus cell concept where we bring all individuals from the community that would address a threat. The successes that we have had have been many. The problem with it is 

that there are still some very high profile cases that we have seen 

just by looking through the Wall Street Journal and any other 

media outlet we have out there where we still do not know to this 

day who the attacker is, what state we can attribute it to, or who 

that person behind the keyboard was, who that human person was 

that actually controlled that attack or directed that attack. 

Senator HATCH. Mr. Martinez, several months ago, as Chairman 

of the Senate Republican High-Tech Task Force, I requested that 

the Secret Service provide an extensive briefing on transnational 

organized crime and international cyber investigations. I thought 

that briefing was pretty helpful. Now, while that briefing was not 

classified, it certainly was law enforcement sensitive and provided 

the task force members a fantastic overview of the transnational 

crime groups, primarily located in Russia and Eastern Europe. 

During that briefing Secret Service officials profiled a particular 

hacker known as ‘‘BadB,’’ who was an accomplished hacker in Russian cyber crime circles. Fortunately, he was arrested overseas 

based on the investigative work of the Secret Service. 

Now, I want to take this opportunity to applaud you and the Secret Service for its work in that case and others, including the Nation’s largest identity theft case that occurred at TJX and Heartland Systems. That case had an extensive international cyber crime 

connection. 

17 

Now, No. 1, what presence does the Secret Service have overseas 

in countries such as China and Russia? And, No. 2, what other 

mechanisms does the Secret Service have in place to identify countries with the potential for cyber crime? 

Mr. MARTINEZ. Thank you, Senator Hatch. Yes, the Secret Service has, I believe—and it is in my written statement. I believe it 

is 22 overseas offices. And in countries where we do not have an 

office, we take a regional approach where we have agents that are 

specifically assigned to those countries. We do have an office in 

Russia, and I am glad to announce that 2 weeks ago we got our 

long-term visa to open up our office in Beijing, so we are very 

happy about that. 

In addition to that, though, we rely a lot on our foreign law enforcement partners, and as I stated earlier, we have two foreign 

electronic crime task forces. So what we have done is we have 

taken the concept of the domestic Electronic Crime Task Force that 

Congress enacted back in 2002, and we have used that same approach to our overseas offices. In doing so, we collaborate a lot with 

our foreign law enforcement partners. Just like the FBI does, we 

have agents embedded into cyber crime units, and specifically 

agencies in specific hot spots around the world. 

We believe it has been very successful, and we have capitalized 

on the relationships and partnerships with these law enforcement 

organizations in order to apprehend some of these high-value targets. 

But in addition to that, one of the things we have recently done, 

as we did last year, we did what is called the Verizon/Secret Service 2010 Data Breach Investigative Report, where we take information for our investigations and we publish that out to the private 

sector. Well, the 2011 study that is about to come out in 2 months 

not only includes data from Secret Service and Verizon investigations, but it also includes information from the National High-Tech 

Crimes Unit in Holland. 

So, once again, there we are leveraging the resources and the 

abilities of our foreign law enforcement partners, and the lessons 

learned, the best practices, and the information that we have obtained through our criminal investigations, we are pushing that out 

to the private sector through things such as the DBI Report. 

Senator HATCH. Mr. Chairman, could I just make a short set of 

remarks? 

Chairman WHITEHOUSE. Of course, Senator. 

Senator HATCH. Thank you very much, both of you. I did not 

have time to ask you any questions, Mr. Weinstein, but I appreciate the work you are doing. 

There is no doubt that we need to have a coordinated effort between Government and the private sector to address cyber crime 

abroad, and that is why last Congress I introduced, with my colleague Senator Gillibrand, an international cyber crime bill. 

Now, our common-sense approach was widely supported amongst 

those who are affected by these crimes on a daily basis. In the coming weeks we plan to introduce this bill which will improve and 

strengthen the Government’s response to international cyber crime. 

I would like you to look at that and tell us where we can make it 

better and what your suggestions are for us so that, when we introVerDate Nov 24 2008 13:23 Dec 21, 2011 Jkt 071412 PO 00000 Frm 00021 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\71412.TXT SJUD1 PsN: CMORC
18 

duce it, it will be truly something that will be bipartisan and everybody can support. 

Thank you, Mr. Chairman. I appreciate it. 

Chairman WHITEHOUSE. Of course, Senator. 

Our next questioner is not only a distinguished member of this 

Committee but also the Chairman of the Intelligence Committee. 

Senator Feinstein. 

Senator FEINSTEIN. Thank you very much. I want to thank you, 

Senator Whitehouse for your work in this area. As Chair of Intel, 

I asked you to head a cyber task force, along with Senator Mikulski 

and Senator Snowe, and I want everybody to know that the three 

of you did a wonderful job, and our information is much fuller and 

richer because of it. So thank you for the work. 

One of the things that apparently you accomplished was the declassification of a lot of material of some of the robberies that had 

taken place going back to 2008 that we on Intel knew about—excuse me, I have a cold—but could not talk about. And on January 

3rd of this year, the Director of National Intelligence wrote you a 

letter essentially saying that we have compiled unclassified and in 

some cases declassified material designed to explain the variety of 

cyber threats and to provide real-world examples of damage in nontechnical terms. 

This was provided to the Congress and other elements of the executive branch. I want to go over some of it which has now been 

declassified. 

In 2008, the Royal Bank of Scotland lost almost $10 million withdrawn from ATMs in 49 cities worldwide. 

Citibank, a cyber theft scheme resulted in over $10 million in 

losses. Now, that is according to news reports. 

Nationwide retailer T.J. Maxx, 45 million credit and debit cards 

stolen in 2007. 

Heartland Payment Systems, tens of millions of credit card numbers compromised in 2009. And it goes on and on and on. 

Mr. Snow, I believe in your testimony you indicated that in 2010 

you arrested 202 individuals for criminal intrusions, up from 159 

in 2009, and obtained a record level of financial judgments for 

cases amounting to $115 million compared to $85 million in 2009. 

Now, we have looked at some of this and seen a lot of attacks 

coming from Russia, from criminal elements in Russia, from China, 

and from other countries, but I think those were the two big ones. 

I would like to ask this question: Where do you see the majority 

of major attacks emanating from? And what is being done to stop 

this? 

Mr. SNOW. Senator, right now we see on the criminal side a majority of attacks coming from the individuals that are located in 

Russia, obviously different from the Russian state, and Eastern European countries. We see a very strong network of a cyber underground, very closely associated with almost an eBay or an Amazon 

type system where, you know, once you receive a service from one 

of these cyber criminals, which are able to just combine together 

in chat rooms in this cyber underground, which are allowed to buy 

different pieces that they need to carry out the attack, to execute 

the attack, to have the cashers, the mules to receive the funds from 

the attack. They are all graded and rated. 

19 

So we see that very large part of the world that is extremely connected being an area where a lot of the threat is coming from on 

the criminal side right now. 

Senator FEINSTEIN. How many arrests have been made? And how 

do they get made? And how do individuals get prosecuted? 

Mr. SNOW. They get prosecuted—and I will refer back to DOJ 

after I finish my statement, but they get prosecuted in different 

realms. Some countries, depending on what the MLAT or the extradition treaty is, will either agree to extradite an individual if we 

have provided the information for them. As Mr. Martinez talked 

about, with the collaboration that we are working with these other 

countries, some will abide by the extradition treaties that we have 

and bring the people back here to the United States. 

Senator FEINSTEIN. Are the Russians cooperative in that regard? 

Mr. SNOW. We have not had the Russians—they have been cooperative in the joint prosecution arena. 

Senator FEINSTEIN. Have any Russian Mafia people been arrested and prosecuted? 

Mr. SNOW. I would defer the Mafia side, but are you talking 

cyber organized crime? 

Senator FEINSTEIN. Yes. 

Mr. SNOW. Yes, ma’am. 

Senator FEINSTEIN. And has Russia cooperated with the United 

States in going after them? 

Mr. SNOW. Russia has helped in large part in many of the cases 

that we have been involved in. We have exchanged information 

with the Russian individuals that work cyber crime, and we are 

still working on those types of relationships with them. 

Senator FEINSTEIN. Thank you very much. Thank you. I am glad 

to hear that. 

Thanks, Mr. Chairman. 

Chairman WHITEHOUSE. Thank you, Chairman Feinstein. 

Next is Senator Klobuchar, then Senator Blumenthal. 

Senator KLOBUCHAR. Well, thank you very much, Chairman 

Whitehouse, for holding this hearing, and I truly believe that protecting our Nation’s cyber infrastructure is critical as we increasingly depend on it for everything from paying our utility bills to 

our financial services. 

The innovation surrounding a free and transparent Internet has 

been great for our economy, but we have also opened ourselves up 

to risks, and those are risks that, unfortunately, criminals try to 

exploit. 

I am working with Senator Hatch on a cloud computing bill, and 

we hope to introduce it soon. And I really do see that cloud computing has the potential to alleviate some of the concerns in the 

cyber security field, particularly by introducing economies of scale 

and making sophisticated protection available to all users on the 

cloud. However, it also raises some unique diplomatic issues because data is being stored in multiple countries. 

Could you talk, maybe Mr. Weinstein, about issues of international jurisdiction faced by your agencies when investigating 

cyber crime or, Deputy Director Snow, involving cloud computing? 

And would better international agreements be helpful to enforce 

the rules? 

20 

Mr. WEINSTEIN. We flipped and I won. 

Senator KLOBUCHAR. I noticed that, yes. 

Mr. WEINSTEIN. Senator, I cannot speak specifically to international issues involving cloud computing. It is a relatively new 

phenomenon, at least known by that name. But I can say that, as 

a general matter, it is increasingly important that we have strong 

agreements, international agreements, either multilateral or bilateral agreements, with our foreign law enforcement partners because so often the targets or the instrumentalities of the crime are 

located overseas, even if the data is not overseas. 

For example, in the cases that Senator Feinstein just mentioned, 

in the TJX intrusion, the servers that the data was stored on, the 

primary hacker was located in Florida. But the data was stored in 

Latvia and Ukraine. 

Senator KLOBUCHAR. Right. 

Mr. WEINSTEIN. In the Heartland case that Senator Feinstein 

mentioned, some of the servers were—there were three servers in 

the United States, or in three States of the United States; but servers were also in Latvia, Ukraine, and the Netherlands. In the RBS 

case, some of the targets and evidence was in eight different countries. 

What makes the RBS case useful, I think, as an example, 

though, is that the intrusion was reported to us by the victim company in December of 2008, and the indictment was brought in November 2009. So in less than 11 months, the FBI, working very 

closely with foreign law enforcement, managed to get the evidence 

we needed, even though it was across our borders, identify the targets, put fingers at the keyboard, and actually bring charges. And, 

in fact, BadB, the hacker that Senator Hatch made reference to, is 

now indicted in that case and is pending extradition. 

So when we have got those agreements in place and when the 

foreign country we are working with has the will, the capacity and 

the will—because you have got to have both—we can be very effective. Too often the countries have the will but not the capacity, and 

that we can deal with because we can devote resources, as we do, 

to training them and to helping them strengthen their own criminal laws and then to developing international agreements in which 

they work with us. If they do not have the will, there is a limit to 

how much we can do. 

One thing we do do throughout the world is try to get as many 

countries as possible to accede to the Convention on Cyber Crime, 

which we think is a very useful international framework, one that 

provides a very strong foundation for international cooperation in 

these cases. 

Senator KLOBUCHAR. Now, I know a lot of my colleagues have 

asked you about resources and how that would be helpful. How 

about legal changes? Are there changes that we could make to current law? What would you have on your top list of things that 

would be helpful as we battle this new-found crime? 

Mr. WEINSTEIN. Well, I can say that we have got some ideas 

about some potential changes to 1030 that we are discussing and 

working on, and as soon as they are done, we will be pleased to 

bring them to your attention and to work with you on them, as well 

as any other ideas that you have. 

21 

Obviously, we are watching and very eager to be engaged on the 

ECPA debate. I know you had a hearing on that where Mr. Baker 

and others testified last week because changes in ECPA actually— 

if standards are increased in such a way that puts information out 

of the reach of law enforcement, it makes it very difficult for us to 

investigate and prosecute cases against cyber criminals who threaten Americans’ privacy. So we are very eager to engage in that debate. 

And as you may know, there is an interagency process that is 

moving at a fever pitch to develop some cyber security legislation. 

I would not say it has been at a fever pitch throughout its life, but 

I can tell you that in the last 6 weeks it has. 

Senator KLOBUCHAR. When did it start, Mr. Weinstein? 

Mr. WEINSTEIN. It started a while ago. 

Senator KLOBUCHAR. OK. 

Mr. WEINSTEIN. The fever pitch started more recently. 

Senator KLOBUCHAR. OK. 

Mr. WEINSTEIN. But, you know, we have got people who are literally working around the clock, judging by the time at which they 

are e-mailing me in the middle of the night to try to get proposals 

ready to present to you, and so I think that will happen very soon. 

Senator KLOBUCHAR. Are you satisfied with the criminal penalties in place for engaging in cyber crime? 

Mr. WEINSTEIN. Well, one of the ideas we do have involves some 

streamlining and strengthening some of the penalties that are provided in 1030. As I said, that proposal is still baking, and when it 

is fully cooked, we will be pleased to bring it to you and talk to 

you about it further. 

Senator KLOBUCHAR. OK. I am out of time here, and I will just 

ask in writing Assistant Director Snow questions about the work 

with the private sector. Minnesota is home to Target and Best Buy 

and several major companies that deal with this all the time, and 

so I am interested in that issue. I actually visited McAfee, their offices in Minnesota, and the work that is being done there. 

And then I also will, for the record, Mr. Martinez, follow up on 

some questions with you as well. 

Mr. MARTINEZ. Absolutely. 

[The questions of Senator Klobuchar appears under questions 

and answers.] 

Senator KLOBUCHAR. Thank you very much. 

Chairman WHITEHOUSE. Senator Blumenthal. 

Senator BLUMENTHAL. Thank you, Mr. Chairman. 

I would like to join in thanking Senator Whitehouse for holding 

this hearing and for his interest and effective action in this area. 

You know, we have been talking a lot about enforcement and 

about potential changes in the law, and if I have time, I would like 

to return to that subject. But I was very interested in an observation made by one of the people who is going to follow you in talking 

to us today, John Savage, who is a professor at Brown, who says 

in his testimony, and I am going to quote, ‘‘Computer industry insiders have solutions to many cyber security problems, but the incentives to adopt them are weak, primarily because security is expensive and there is no requirement they be adopted until disaster 

strikes.’’ 

22 

Now, I have been involved in enforcement relating to this issue, 

and I do not mean to minimize your efforts. In fact, I think they 

have been heroic and remarkably effective, both at the Federal 

level where you work and often at the State level. But don’t the 

holders of this information—and I am thinking of Epsilon, for example, most recently the supposed victim of a major breach—have 

a greater obligation to do more to safeguard this information? And 

how do we create those incentives that Professor Savage mentions 

to make your job more effective? I will not say ‘‘easier’’ because 

nothing can make your job easier, and I have great admiration for 

what you do. But how do we create those incentives so that private 

companies are more partners of yours in this enforcement effort? 

And I ask that of all three of you, and I will let you go in whatever 

order you would like. 

Mr. MARTINEZ. I will take it. Senator—— 

Senator BLUMENTHAL. And, by the way, you may disagree with 

Professor Savage, too. I am not assuming that you will necessarily 

agree. 

Mr. MARTINEZ. Senator, I believe also Mr. Weinstein spoke about 

a proposed package that is forthcoming here to Congress regarding 

a comprehensive number of cyber bills that all three organizations 

sitting at this table have been involved in the crafting. 

One of those proposals involves data breach legislation, and I 

think it is important for us to create a national data breach bill so 

that we do not continue to have this myriad of—I believe right now 

there are 47 individual State data breach requirements, all of 

which are unique and all of which have different reporting requirements. So I think it is important that we do have a national data 

breach bill. 

As part of that national breach bill, I think it is incumbent and 

it should be required that if companies do have an intrusion, they 

not only notify the consumers or the victims whose information 

might have potentially been stolen, but that they also notify the 

Government and that the Government be notified of the fact that 

there has been an intrusion. 

To the point of the professor’s, the other part that I think is important in the legislation—and I think the administration is going 

to be addressing that—is that there also be a safe harbor for those 

computers that have protected the information in a proper way. So 

even though they have an intrusion but the information is protected, that they themselves be protected via some type of safe harbor so that civil action might not be taken. 

I think in the package of legislation that the administration is 

finalizing, you are going to see all three aspects of that in that legislation. 

Mr. SNOW. And, Senator, I would just add that I would echo Mr. 

Martinez’s comments, and I would also say that I do not think anything in the professor’s statement is wrong. I think the professor 

is exactly right. But a little bit closer scrutiny of this statement 

would say something that is really important, and that is that 

many of these people have many of the solutions for many of the 

problems and understand that it is a multi-layered, multi-faceted 

problem. To throw a few solutions at some of the problems does not 

solve all the problems. So we have to understand. 

23 

Right now I do not think there is any secure system out there. 

I think it takes a defense in-depth layering, and I think that is 

something that we have to work on. 

On his point of weak incentives, I think he is exactly on point. 

You know, I will go back to the bank robbery days that the FBI 

was going from place to place. Just getting somebody to put in a 

new VCR was extremely difficult because that was 60-odd-some 

dollars at the time, and that did not do anything but take away 

from the security budget. 

I think that is the same thing we see in businesses right now. 

That security that we layer that we think is essential is not really 

put in place until there is a tragic incident, an embarrassing incident, an incident that costs them close to a huge concern about 

them being a continuing entity or a going concern. 

Senator BLUMENTHAL. Mr. Weinstein. 

Mr. WEINSTEIN. I do not have anything to add to what Mr. Martinez and Assistant Director Snow said other than to emphasize 

that it has to be both incentives for companies to protect themselves against breaches—and I do think that most companies, especially those that operate in good faith and care about their business 

reputations, do want to protect themselves—but also, as Mr. Martinez said, to report the breaches when they do happen. 

I anticipate, although the shape of our package of proposals is 

still being formed, but I do anticipate there will be something about 

data breach reporting in that package, and we look forward to 

working with you on that. 

Senator BLUMENTHAL. Well, I would be eager to work with. As 

you may know, Connecticut is one of those States that has a reporting requirement. I have asked for Epsilon to provide credit reporting services as well as identity theft insurance, which has been 

standard in what Connecticut at least has asked the companies 

that had this information that may have been breached to do in the 

past and has also sought penalties. So I might just suggest, without commenting on Epsilon or any other particular instance, that 

providing these incentives for adoption of this technology is something that is worth your very serious and positive scrutiny. 

Thank you. 

Chairman WHITEHOUSE. We will go very shortly to the next 

group of witnesses, and I will excuse this panel. I do have a question for the record that I would like each of you to take with you 

and answer for me, and I think Senator Kyl will do his in writing. 

Assistant Director Snow mentioned the high level of activity of 

the sort of eBay type situation of the Russian-based hackers and 

criminals who are working on this, and I am reminded of the lawsuit that was brought by Microsoft against the Waledac botnet, 

which was able to obtain a court order involving the legitimate 

Internet world—the domain providers, the ISPs and so forth—to 

cut off service from the command-and-control nodes of that botnet 

so that it no longer was operative. And it strikes me that without 

actually doing criminal prosecutions of folks, we could be very aggressively hunting down these criminals and these attackers on the 

Web and disabling them with civil injunctive measures that require 

the ISPs, the domain registers, and so forth to stop providing service in certain components or to certain addresses or to certain types 

24 

of transmissions from addresses. And because virtually all of this 

flows through the United States at some point, jurisdiction should 

be fairly easy to get compared to an unknown hacker who is working through a server in Estonia that links to a server in the 

Ukraine that links to a server somewhere else before it even gets 

here. 

So I would like to hear from each of you as to what extent your 

organization’s cyber resources are empowered to support an active 

criminal defense that uses civil law to shut down some of these activities by authorizing the service providers to engage with court 

permission, protected from liability because of that, in a way that 

disables this. OK. Clear? 

[The information appears as a submission for the record.] 

Chairman WHITEHOUSE. And Senator Kyl will do his for the 

record. 

[The questions of Senator Kyl appear under questions and answers.] 

Chairman WHITEHOUSE. So with gratitude for your service and 

for your focus on this very significant problem, I will excuse this 

panel, and we will take a 2-minute recess while the next panel convenes. Gentlemen, thank you all very much. 

[Pause.] 

Chairman WHITEHOUSE. Let me call the new panel to order, and 

thank you all for being here. Let me first ask that you stand and 

be sworn. Do you affirm that the testimony you will give in this 

Committee will be the truth, the whole truth, and nothing but the 

truth, so help you God? 

Ms. SCHNECK. I do. 

Mr. SAVAGE. I do. 

Mr. BAKER. I do. 

Chairman WHITEHOUSE. Thank you. Please be seated. 

Welcome. We will begin with Phyllis Schneck, who comes to us 

from McAfee, where she is vice president and chief technology officer for their global public sector operations. Previously, she was 

vice president for threat intelligence for McAfee. She served as a 

commissioner and a working group co-chair on the public-private 

partnership for the CSIS Commission to Advise the 44th President 

on Cyber Security, which I am proud to say was a report co-authored by my colleague in the Rhode Island delegation, Congressman Jim Langevin. Ms. Schneck also served—Dr. Schneck, I 

should say, also served for eight years as Chairman of the National 

Board of Directors of the FBI’s InfraGard program, which has already been mentioned today, and vice president of research integration at Secure Computing. She has a Ph.D. in computer science 

from Georgia Tech. 

Ms. Schneck. 

STATEMENT OF PHYLLIS SCHNECK, PH.D., VICE PRESIDENT 

AND CHIEF TECHNOLOGY OFFICER, GLOBAL PUBLIC SECTOR, MCAFEE INC., RESTON, VIRGINIA 

Ms. SCHNECK. Chairman Whitehouse, Ranking Member Kyl, and 

other distinguished members of the Subcommittee, thank you for 

requesting McAfee’s views on responding to the threat of cyber 

crime and cyber terrorism. Your Subcommittee is playing a vital 

25 

role in cyber security, helping to investigate sophisticated syndicates of criminals and terrorists who deploy cyber attacks to finance their operations and undermine the security of our country. 

Thank you for your commitment. 

My testimony will focus on the following three areas: the evolution of the cyber security threat landscape, as that has changed 

over the past few decades; two major cyber security attacks—Operation Aurora and Night Dragon—McAfee’s technical response to 

the cyber crime challenge and the implications for national security 

from those attacks and others that look just like it as we look at 

the future of our cyber security and resilience in this country; 

McAfee’s commitment to partnering with law enforcement and the 

law enforcement community; and policy recommendations to support law enforcement and improved public-private collaboration 

and information sharing that is so vital to give the Government the 

capabilities that it needs to respond to this modern cyber security 

challenge. 

First, a rollback on McAfee and our definition of cyber crime for 

this testimony. McAfee protects businesses, consumers, and the 

public sector worldwide from cyber threat. Headquartered in Santa 

Clara, California; Plano, Texas; and a large operation in Minnesota, McAfee is the world’s largest pure dedicated cyber security 

company, and McAfee is a wholly owned subsidiary of Intel Corporation. 

Today we use the term ‘‘cyber crime’’ to cover the act of using 

electronic means to gain unauthorized access. As we heard in the 

last hearing, cyber crime covers the spectrum, from simply gaining 

notoriety to pooling funds, for organized crime, now to intellectual 

property, and destruction—destruction of critical infrastructure— 

with the very far end of the spectrum some are calling ‘‘cyber terrorism.’’ 

Our overall key challenge is that the profit model benefits the 

cyber adversary: very low barrier to entry, this stuff is easy for 

them; and very, very strong reward, often large amounts of money; 

often destruction; very, very little attribution. 

This adversary is fast. This adversary works faster than we do. 

They build relationships, they build trust. As was mentioned in the 

last hearing, the cyber underground, they know how to share information. They have no intellectual property boundaries, no legal 

boundaries, very often funded fully by their government. No problems to execution. 

As we have evolved in the cyber security threat landscape, the 

traditional model of defeating malware, which is basically an instruction that commands a machine to do now whatever the adversary desires, and whenever, and send back whatever the adversary 

desires, our traditional signature model does not work. 

For the past decade, the industry has looked at understanding 

what could come in, recognizing what is wrong, and blocking it, 

just like a vaccine would block a cold from your body or a disease. 

So we look at 50,000 new pieces of malware every day in McAfee 

labs. We have seen many of the sites that were described earlier 

in the cyber underground. We track the criminals. We see this adversary, and we propose two key technologies that we believe are 

the future to cyber security technology on the technical side, underVerDate Nov 24 2008 13:23 Dec 21, 2011 Jkt 071412 PO 00000 Frm 00029 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\71412.TXT SJUD1 PsN: CMORC
26 

standing that this is half a people problem, half a technology problem. These key technologies are: 

Whitelisting, which is very simply closing the door. If you are not 

an approved instruction, you do not run. It no longer matters how 

many bad-guy instructions are on a machine. If you are not known 

to be good, you simply do not run. 

The second one being global threat intelligence, behavioral understanding to build the cyber immune system, just like your body 

fights off a cold or disease without knowing its name automatically, 

we believe our networks should be a lot smarter and pull data from 

our companies and others across the financial field and the energy 

sector, across the critical infrastructure to block bad things from 

coming into networks. 

Two major attacks this year that McAfee led for investigation: 

Operation Aurora and Night Dragon. In January 2010, Operation 

Aurora was exposed for having compromised Google and 30 other 

companies. This year, Night Dragon. 

In Operation Aurora, the adversary was looking for intellectual 

property. Very large stores of IP and software, and they identified 

exactly who in those companies would have it, and they got it by 

social engineering their way in and getting those people to answer 

an instant message. 

In Night Dragon, they targeted the oil and gas industry across 

the world looking for architectural documents, pipelines, and looking at where the new oil exploration would occur. 

McAfee is fully committed to partnering with law enforcement. 

We have a long history, my own having run the FBI’s InfraGard 

program nationally on the private sector side for 8 years. I also 

chair the National Cyber Forensics and Training Alliance. My colleagues, thousands of them working in partnership with law enforcement every day at the Federal, state, and local levels, assisting with investigations, working closely with the intelligence community, also building strong relationships with the FBI and Secret 

Service across our partners. 

We recommend in policy more budget to fund our law enforcement colleagues, greater situational awareness in this data, and 

stronger global partnerships, protect the private sector so that we 

can release data very quickly without worrying about material benefits for shareholders. 

Thank you again for the opportunity to be a part of the process 

in fighting cyber crime with law enforcement and Government relationships. I look forward to your questions and continued discussion. 

[The prepared statement of Ms. Schneck appears as a submission 

for the record.] 

Chairman WHITEHOUSE. Thank you, Dr. Schneck. 

Before I go on to Dr. Savage, since you referenced the Night 

Dragon report, I would, first of all, like to compliment it. It is the 

clearest, most trenchant, accessible document I have yet read in a 

lot of reading that I have done about cyber security. Anybody who 

is watching this or listening to this and has not had a look at that, 

it is a really, really good document, both in terms of the overlay, 

the sort of contextualization of this as a rapidly emerging threat 

with rapidly increasing sophistication and multiplication of inciVerDate Nov 24 2008 13:23 Dec 21, 2011 Jkt 071412 PO 00000 Frm 00030 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\71412.TXT SJUD1 PsN: CMORC
27 

dents, but also as a quite clear layman’s description of how the attack takes place right down to showing the screens on the computer that you would see as you go through the attack. 

So what I will ask is unanimous consent that that report be 

made a matter of record for this Committee hearing, and we can 

provide a copy because I have got it. But I do applaud that. I think 

that is a very, very clear, useful document, and thank you very 

much for preparing that. 

[The report appears as a submission for the record.] 

Chairman WHITEHOUSE. Also, unlike most of the stuff that is put 

out here, it was unclassified and not kept proprietary. One of the 

real problems in this area is that we know so little about it because 

if it is the Government it is classified, if it is the private sector it 

is held proprietary, and the public is kept, unfortunately, ignorant 

of the actual threat. So I think you did a real service with that, 

and I thank you. 

Ms. SCHNECK. Thank you, Chairman Whitehouse. Would it be 

out of line for me to point out that report was written by my colleague, Dmitri Alperovich, in the row behind me. 

Chairman WHITEHOUSE. No, it would not be. It would be very appropriate, and I am glad that he is here for this. I guess I lucked 

out by saying nice things about it instead of bad things. 

[Laughter.] 

Chairman WHITEHOUSE. And now from the great State of Rhode 

Island, from a university we are very proud of, Brown University. 

I am delighted to have the chance to introduce Dr. Savage. He is 

a professor in the Department of Computer Science at Brown, currently conducting research on cyber security, computational nanotechnology, the performance of multi-core chips, and reliable computing with unreliable elements. 

It sounds like something we try to do here in Congress. 

Dr. Savage served as a Jefferson Science Fellow in the U.S. Department of State during the 2009–10 academic year. He earned 

his Ph.D. in electrical engineering at MIT, after which he joined 

Bell Labs and then the faculty at Brown where he co-founded the 

Department of Computer Science in 1979. He has multiple clearances and knows a lot about this. 

Dr. Savage, thank you. Please proceed. 

STATEMENT OF JOHN E. SAVAGE, PROFESSOR OF COMPUTER 

SCIENCE, BROWN UNIVERSITY, PROVIDENCE, RHODE ISLAND 

Mr. SAVAGE. Thank you, Chairman Whitehouse and Ranking 

Member Kyl and members of the Subcommittee. 

As you have heard, the Internet which is so important to our 

economy, also exposes us to great risks. I have a few statistics that 

highlight this, fact. Last year it was reported that more than half 

of all the computers worldwide were compromised. This means that 

each of these computers is not only capable of being used to steal 

personal, corporate, or Government data; they can also be marshalled into botnets and used for nefarious purposes. 

For example, the Mariposa botnet is reported to have controlled 

a remarkable 12.7 million computers, distributed across 190 countries, before it was silenced in early 2010. If a botnet of this size 

were used to launch a denial-of-service attack, it could wreak havoc 

28 

on the Internet. More importantly, if deployed to disrupt Internet 

routing tables using a technique discovered and announced in early 

February, experts say that routing on the Internet could be severely disrupted. 

I cite these examples to illustrate some of the damage that could 

be done via the Internet. If we add to the mix that some important 

control systems, such as those used for electrical power generation, 

can also be attacked, destroyed, or disabled by the Internet, we see 

that hazards lurk here that were unanticipated when the Internet 

was designed. The Internet, which has contributed so much to our 

economic strength, allows us to more tightly integrate segments of 

our economy; thus, attacking the Internet is a way to attack large 

portions of our economy. 

Because cyber crime and terrorism are international in nature, 

they both require a domestic and international response. We must 

elevate our domestic security standards in our hardware and software networks. We cannot tolerate having several times more 

botnets than any other nation, nor large numbers of compromised 

computers. We also need to better control the supply chain as well 

as strike international agreements to curb abuses that originate at 

foreign sites. 

So we ask: What steps can we take as a Nation? 

First, we should create the incentives and, if necessary, regulations to design and improve computer security. Any proposed regulations should be developed through a consultative process involving those being regulated. 

Second, the private sector and individual citizens need to be educated to the need to keep their systems current with security 

standards. 

Third, steps should be taken to make the domain name system 

more robust by accelerating the adoption of the domain name system security extensions. 

Fourth, understanding that our Nation faces a serious deficit, we 

must nevertheless maintain strategic and targeted funding for 

cyber R&D. In the policy dimension, we should engage in a national conversation on the types of international agreements that 

will best serve our cyber security interests. Many interesting ideas 

have been proposed that should be debated. Leading thinkers have 

said that the U.S. is not sufficiently engaged in international negotiations to our detriment. 

Some may ask: Can we manage these problems? Are these problems manageable? My answer is yes. I liken our computers to our 

homes. A determined attacker can easily break into them. So why 

aren’t most of our homes invaded more often? Apparently because 

the locks are good enough, the neighbors sufficiently vigilant, uniformed police officers are sufficiently visible, and the punishment 

if caught and convicted sufficiently onerous to deter attackers. We 

need to arrive at a similar state in cyberspace. 

Many of us are struggling to understand, from both policy and 

technological points of view, these issues. There are few technologists conversant with policy and few policymaker sufficiently 

knowledgeable about technology. Thus, there is an opportunity 

here to bring the two camps together. 

29 

In the early days of the cold war, strategy development is said 

to have lacked sophistication. However, once the insightful analysts 

studied the issues, a more mature approach to policy emerged. The 

same must be done for cyber security policy. 

In closing, let me say that cyber security research is very young. 

While some profoundly interesting results have been developed, 

many challenges remain. Since cyber security plays a central role 

in our economy and is an important branch of national security, it 

deserves to be given priority for strategic, targeted research funding in both the technological and policy realms. 

Thanks, and I am happy to answer your questions. 

[The prepared statement of Mr. Savage appears as a submission 

for the record.] 

Chairman WHITEHOUSE. Thank you, Dr. Savage. 

Our final witness is Stewart Baker, a partner in the law firm of 

Steptoe & Johnson, where his practice covers national and homeland security, cyber security, electronic surveillance, law enforcement, export control, encryption, and related technology issues. 

From 2005 to 2009, Mr. Baker served as the first Assistant Secretary for Policy at the Department of Homeland Security, where 

he oversaw the office responsible for department-wide policy analysis, international affairs, strategic planning, and relationships 

with the private sector. From 1992 to 1994, Mr. Baker was General 

Counsel of the National Security Agency. 

Thank you for being with us. 

STATEMENT OF STEWART A. BAKER, PARTNER, STEPTOE & 

JOHNSON, LLP, WASHINGTON, D.C. 

Mr. BAKER. Thank you, Mr. Chairman, Ranking Member Kyl, 

Senator Blumenthal. 

I should say the one other credential that was left off of my biography is that I am Brown Class of 1969. 

Chairman WHITEHOUSE. Very important credential to the Chairman. Thank you. 

Mr. BAKER. I would like to spend a little time on—I talked in my 

testimony about how bad this problem is. It is worse even than we 

have heard today because there really are very few barriers to a 

substantial increase in cyber attacks and cyber crime. I laid out in 

my testimony the many things that we had hoped will save us that 

will not. 

Blaming Microsoft is not going to save us because almost all of 

the software that is being used today has similar flaws. Trying to 

use tokens, which many of us believe would save us instead of 

passwords, increasingly have been compromised by hacking attacks 

and by realtime exfiltration of those token credentials. 

We are not even going to be able to save ourselves if we call people up and say, ‘‘Did you really send me this e-mail? ’’ Because that 

kind of out-of-band confirmation of the sort you get with your credit card is increasingly at risk as we move to IP telephony, which 

will have all of the problems that ordinarily computers have as 

well. 

Disconnecting from the Internet, which we also are not going to 

do, is not going to solve this problem because the agencies that 

have tried doing that—the Defense Department, the Iranian 

30 

Natanz centrifuge plant—have, nonetheless, been compromised by 

attacks that use thumb drives and other media as a way of transporting the compromising software. 

What many of us hope to rely on, the anonymity that nobody is 

really particularly looking for me, is also not going to save us because, increasingly, it is possible to essentially infect the world and 

then ask your malware to run in the background until you do 

something that the crooks think is interesting, like log on to a particular account with a private equity fund, which indicates you 

have enough money to be worth stealing from, at which point they 

will start stealing from you. 

All of those things are solutions that will not actually work. And 

perhaps most important for this Committee and this hearing, law 

enforcement is, in my view, almost entirely helpless at this point. 

Six more prosecutors are not going to address this issue in any significant way, and the principal reason for that is that—I thought 

Professor Savage got it right. We do feel safe in our houses, but it 

is not because the locks are perfect. The locks on our houses are 

much worse than the locks that are already on our computers. 

What is different is that there is a realistic possibility of being 

caught committing a crime if you try to break into somebody’s 

house and almost no possibility that you will be caught and prosecuted if you commit a cyber crime. 

I have suggested a bunch of rather tentative approaches to solutions in my testimony, but I would like to just focus on one, which 

is we really need to do a much better job of building in attribution 

and minimizing anonymity on the Internet, making it much more 

difficult for people to do business, send e-mails, transmit packets 

and the like, and be confident that they cannot be tracked back to 

their actual identity. 

This is a very difficult task. It is an architectural problem that 

is quite significant. But, in my view, we will not solve this problem 

if we cannot realistically threaten to punish the people who are 

carrying these attacks out. We will simply see more and more sophisticated, more and more elaborate, and more and more damaging attacks until we begin structuring the Internet and structuring the relationship that ISPs have with each other and with 

their customers so that it is much more difficult for people to avoid 

being identified when they commit these crimes. 

I will stop there. 

[The prepared statement of Mr. Baker appears as a submission 

for the record.] 

Chairman WHITEHOUSE. Thank you very much. 

We had General Alexander, who I think is a really remarkable 

individual, come to the University of Rhode Island yesterday. He 

came at the invitation of Congressman Langevin, who has a very 

significant role in this area on the House side, and Jim Langevin 

and I talk frequently about this issue because I have an interest 

on our side as well. 

During the course of the discussion, General Alexander said that 

we could—right now our stock markets, our financial markets 

could be taken down, our power grid could be taken down. If our 

power grid were taken down, it would not come up quickly. It 

would not be just like the branch fell on the wire outside your 

31 

house, but do not worry, when the truck comes, the power will be 

back on. It would be much more persistent and prolonged than 

that. He said that the entire financial sector is vulnerable and 

could be compromised, communications networks, and that they 

could interlock. So the scale of how bad this could be, if it really 

gets to the level of full-blown cyber war, is really very, very dramatic. 

I am interested—since we have private sector folks here, this 

may seem like a hypothetical question, but I would love to get your 

take on it. 

If you imagine that there is a universe of cyber threats out there 

and within that universe of cyber threats there is a group of them 

about which the Government has awareness—Mr. Baker, your old 

shop has pretty wide awareness, probably wider than anybody else 

in the world, into the criminal ecosystem of the cyber world. Within 

that larger awareness, there is an awareness that the private sector has at its best level, at the level of McAfee, at the level of 

Symantec, RSA, and so forth. 

I would love, starting with you, Dr. Schneck, to get your sense 

of what portion of the awareness that NSA has of the cyber threat 

you think the private sector has. Clearly, it is going to be a subset. 

But is it a tiny subset, or is it a significant portion? What is your 

guess on how much visibility McAfee and Symantec and the rest 

of the private sector defenders of our private sector corporations 

have compared to the NSA and to the overall picture? 

Ms. SCHNECK. Thank you, Chairman Whitehouse. I will steal 

some words from AD Snow earlier and ask that we could continue 

part of this answer in a different forum. So clearly there will be 

an overlap between what any Government entity, whether it is intelligence, community law enforcement, DHS—would know and 

what the private sector knows. I think we get our intelligence differently in some cases. We gets ours from protecting customers, so 

first and foremost, whether the threat is just to get a little money 

or whether it is to destroy the electric grid, we block that threat. 

We stand in front of the target; we make sure the threat does not 

get there. That is our first move. That is the in-line, speed-of-light 

work. 

The second line is the human work. The reason that is so hard 

is because we see all this data come together, and it paints a picture. This happened in Night Dragon. And as that picture came together, you realize that it is targeting the oil and gas sector. At 

what point can we in the private sector share that picture with the 

intelligence community, with the FBI and the Secret Service? 

Chairman WHITEHOUSE. Let me try to focus back on my question, and before I give the other two witnesses a chance to answer 

it, would you at least concede that the awareness that the cyber 

defense private sector community has of the threat is significantly 

smaller than the awareness that NSA has of the threat? 

Ms. SCHNECK. So it is hard to answer that question in this 

forum. I think the awareness is different. I do believe there is an 

overlap. I think there is a lot of data in the private sector that, if 

we were able to share that more readily with some legal protection, 

we would protect our country better. 

32 

Senator Whitehouse. Do you understand my question, Dr. Savage—— 

Ms. SCHNECK. I do, and I believe—— 

Chairman WHITEHOUSE. No, no. I am sorry. I am going on to the 

next witness. 

Ms. SCHNECK. OK. 

Mr. SAVAGE. I do understand your question, and I cannot answer 

it either because I do not represent either the private industry or 

the intelligence community. 

However, what I will say is I would not be surprised if the private sector had access to perhaps more data than the National Security Agency simply by virtue of the fact that have sold, they sell 

products to customers worldwide, monitor the state of computers 

worldwide. Although before I do not know for sure, I expect that 

the National Security Agency has a different focus. 

So I would not be surprised if the private sector had a great deal 

of very useful information. 

Chairman WHITEHOUSE. And, Mr. Baker, what is your take? 

Mr. BAKER. I would divide the problem into three possible kinds 

of attacks: there are attacks to steal money, there are attacks to 

steal secrets, and there are attacks to sabotage a system. 

When it is a question of stealing money, I would say the private 

sector is better informed and better protected than the U.S. Government or Government agencies generally. It affects the bottom 

line. They know how much to spend. They want to spend enough 

to stop losses that are equivalent to what they have spent. And 

they do a better job than the U.S. Government protecting themselves from that kind of an attack. 

Stealing secrets, I would say the U.S. Government has a better 

awareness and, by and large, I get more calls from people in the 

private sector who are alerted to their losses by the U.S. Government than the other way around. And there is a tendency, if you 

do not steal secrets for a living, as intelligence agencies do, not to 

believe that people are really doing that to you, and the private 

sector falls prey to that illusion. 

And then there is sabotage where I think the private sector is 

utterly clueless. They do not want to think about the possibility of 

sabotage because they have no idea what to do about that. They 

will end up spending money and getting nothing obvious back because they are running now—they have not been sabotaged yet, so 

all they get is a sense that maybe they would withstand an attack, 

but they do not even know that. 

And so they are reluctant to spend money or even to hear the 

message in the private sector, the electrical grid, or the pipeline 

companies and the like. The reluctance to hear that message is profound. 

Chairman WHITEHOUSE. Senator Kyl. 

Senator KYL. Thank you, Mr. Chairman. 

First, Mr. Baker, two questions for you. You discussed the supply 

chain vulnerabilities, including the new smart grid infrastructure. 

What is being done to ensure that the smart grid does not become 

in essence an electronic Trojan horse? 

Mr. BAKER. Well, some things are being done on paper. There are 

security standards being developed. Whether they are really suffiVerDate Nov 24 2008 13:23 Dec 21, 2011 Jkt 071412 PO 00000 Frm 00036 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\71412.TXT SJUD1 PsN: CMORC
33 

cient is open to question. But even if they were sufficient, there is 

not an obvious enforcement mechanism. The mechanisms for regulating power companies are deeply local and State, and both the 

power companies and the State PUCs like it that way, and they do 

not want the Federal Government to step in and start telling them 

anything about their business. And so while the Federal Government can recommend some security standards, the PUCs who have 

to enforce them, in my understanding, are not really doing much. 

Senator KYL. So we have still got a big problem there. 

Mr. BAKER. Yes. 

Senator KYL. Now, I think you are aware that last year Congress 

gave the Department of Defense some new powers to protect its information systems, and I wonder—regarding the supply chain, 

again. I am just wondering whether you think maybe Congress 

should use that kind of authority as a template for other agencies 

in the Federal Government. 

Mr. BAKER. Well, certainly other agencies beyond the Defense 

Department have to worry about the possibility that the supply 

chain will compromise them, and indeed, you know, anything that 

we think is a worry for the Defense Department is probably a 

worry for the New York Stock Exchange or Citibank, and we 

should not be encouraging them or allowing them, without knowing 

about the risk, to continue to rely on insecure material. 

Senator KYL. So we might take a look at that template in dealing 

with other agencies that have important issues like that. 

Mr. BAKER. Yes. 

Senator KYL. Now, for all of you, there is a sense here that there 

is no silver bullet except better enforcement, but better enforcement is really hard to do, well, primarily from a resource standpoint, but also a capability standpoint. So I presume that incremental changes, including creating incentives, is one of the answers here. And in terms of changing behavior, my question is with 

the private sector—in particular business but also individuals— 

whether a greater use of the concept of insurance as providing incentives would help the private sector develop better protections. 

Maybe we will start with you, Mr. Savage, and then Phyllis. 

Mr. SAVAGE. I agree. Cyber insurance to protect against fraud, 

theft, interruption of service, things of that sort would be very valuable, because I recall many years ago learning about workers’ 

compensation insurance where an insurance company would issue 

a policy but they would also provide experts to come into your place 

of business to help you improve it so that they could reduce the 

number of injuries and, therefore, the number of charges. 

When I was in the State Department, I sat on a NITRD panel 

that put together a set of recommendations, one of which was a 

cyber economics recommendation for funding in fiscal year 2012s 

budget, and the idea there being that if you offer insurance, you 

can invite companies who are going to purchase the insurance to 

provide you with incident information, which you can then collect 

and use to create actuarial tables reducing their costs, but also 

pooling these resources with other insurance companies. 

The good news is that when I was in the State Department, I received a call from a Brown grad who had seen I was a Jefferson 

Science Fellow. She works for an insurance company in the HartVerDate Nov 24 2008 13:23 Dec 21, 2011 Jkt 071412 PO 00000 Frm 00037 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\71412.TXT SJUD1 PsN: CMORC
34 

ford area that sells insurance of this kind, but they were at a little 

bit at sea because they could not really find the others and work 

with the others to do this kind of thing that I described. 

Senator KYL. Especially ways to help resolve that problem and 

whether the Government should be involved in this, Dr. Schneck? 

Ms. SCHNECK. So, thank you. We have looked at the insurance 

model for about 11 years that I remember. The key road block to 

that was the lack of the actuarial data, to Professor Savage’s point 

on the need for that data. So in the startup, we have plenty of data 

we can look back on in driving habits and other areas where things 

are insured, but in this arena so little is reported that we know 

what we know because we are out there protecting, but to Mr. 

Baker’s point, most of the private sector does not have this kind 

of knowledge. So that actuarial data to make the model work on 

the insurance would be exceedingly difficult. 

That is not to say it would not be a great idea to incentive, but 

we would have to make sure of two things: one is that the data is 

there so that nobody gets burnt, so the model fits; and the other 

is to ensure that we are not encouraging companies to be compliant, they have to be secure. There is a very big difference. Do not 

just check the box, but comprehensively protect your infrastructure. 

Senator KYL. Mr. Baker, any other thoughts? 

Mr. BAKER. Yes, very briefly. For insurance to work, people have 

to either expect a harm, an identifiable harm, or identifiable liability. The likelihood of liability in this area has so far been pretty 

minimal just because of the difficulty of tracking the attacks. And 

if all they steal is secrets, you are not going to be able to identify 

a harm that an insurance company will be comfortable reimbursing 

you for. 

So it is part of the solution, but it is not as good a solution as 

I would like. 

Senator KYL. Thank you. 

Chairman WHITEHOUSE. Senator Blumenthal. 

Senator BLUMENTHAL. Thank you. I would like to pursue that 

line of questioning, but first thank you, all three of you, for your 

very enlightening and useful testimony, and I would like to pursue 

some of the questions here outside the time that I have. 

But in terms of liability, that is something that corporations understand. If we talk about incentives, which is where I was going 

with the last panel—treble damages—we know how to impose liability, we know how to penalize. The courts do it all the time. 

They have to put estimates on that harm. It may be difficult to calculate, but, you know, we do it with pain and suffering. If we can 

do it with pain and suffering, then we can do it with the kind of 

commercial damage that people suffer, which is much easier in 

many respects to quantify. 

So for all of you—but it is a question raised by Dr. Savage’s testimony, and I am quoting again: ‘‘. . . the incentives to adopt 

them are weak’’—referring to the solutions to these cyber security 

problems—‘‘primarily because security is expensive and there is no 

requirement they be adopted until disaster strikes.’’ 

What can we require—and I invite you to supplement your answers here perhaps after you think about it some more. What can 

35 

we require, whether it is liability or Senator Kyl mentioned insurance—and I agree with you about all the difficulties raised by the 

insurance model. What can we do to really grow your business, Dr. 

Schneck? And I do not mean that altogether facetiously, I mean not 

just grow your business, but grow the interest and incentive to do 

the kinds of things that you advise your clients to do. 

Ms. SCHNECK. Thank you. I think the first might be to 

incentivize some innovation. So we have grown by finding ways 

around this adversary. We get them by going at the speed of light. 

That was a focus of necessity. That was market driven. 

If we can change our culture a bit to have companies incented 

to innovate around security and find models that work, find ways 

that make them money by being more secure—and the insurance 

models is a subset of that—I think that is one area. 

The other might be some tax incentives, and, again, not just 

being compliant but in doing it right and having that—again, the 

decade-old discussion but the top-down policy, the culture of security in the company. 

Senator BLUMENTHAL. But we want to measure results, not just 

that they put a better fence around the home—— 

Ms. SCHNECK. Correct. 

Senator BLUMENTHAL.—or a better fire alarm—which, by the 

way, insurance companies do reward so the insurance model does 

work—or other kinds of alarms on homes. 

Professor Savage or Mr. Baker. 

Mr. SAVAGE. I will say quickly, I continue to be troubled by enduser licensing agreements which state that the company selling me 

the software has no responsibility for it once it is in my hands. I 

cannot fix any bugs that exist or any security hazards that exist 

in that software myself. I cannot even keep it up to date quickly 

enough because, as we know, as we have heard, half of all the 

malware goes undetected. 

It is said that last year PandaLabs reported that half of the 

malware lived for 1 day. I am not sure to what extent that statement is correct, but that is what I read. 

Coming back to a point you made earlier, you asked about the 

technologies that could be incorporated, well, there are—you know, 

research is being done all the time, and it takes time, of course, 

for these results to appear in products. But there are ways to detect botnets. There are ways to defeat denial-of-service attacks and 

things of that sort. And if there were the right incentives—and I 

do not know what they are—maybe some of our companies would 

be more ready to adopt them. 

Now, having said that, there has been a lot of work done by a 

number of companies both in the software sector and financial 

services sector to introduce security techniques to teach their engineers to write code that is less easily attacked. And I think many 

of those efforts are actually terrific, and you can see it, I think, in 

the reporting rates of errors. 

So I want to applaud the industry for doing that. At the same 

time, I think they need to take responsibility for this issue. And as 

I say, many are, but not all. 

Senator BLUMENTHAL. Thank you. 

36 

Mr. BAKER. If I could just—I know you are deeply familiar with 

the data breach laws and the penalties for that, and I have good 

news and bad news about those laws. 

The good news is they have made a big difference in corporate 

behavior. The companies do not want to have to disclose that they 

have released a large amount of personal information about consumers, and they will take steps to prevent that from happening. 

The bad news is that that is where the security budgets have, 

by and large, gone. They are spending a lot of money to make sure 

that their hard drives are encrypted so that if they leave the computer, the laptop, at the airport, they do not have to disclose a 

breach. They are not, by and large, treating some of these more sophisticated attacks with the same kind of attention because they 

do not tend to produce a verifiable personal information breach. 

And so if you are going to go down that road, I would urge you 

to try to find an agency with a broader picture of the kinds of attacks that can adjust the incentives so people are actually responding to the worst kinds of attacks, the ones that are most dangerous 

to us as a country. 

Senator BLUMENTHAL. Thank you. 

Thank you, Mr. Chairman. 

Chairman WHITEHOUSE. Mr. Baker, as the lawyer on the panel, 

let me ask you two questions. 

One, in response to what Dr. Savage said, should we be concerned that significant players in this area are purporting, at least, 

in their contractual arrangements to relieve themselves of any liability, given that liability is often a motivating factor in human 

behavior? 

And, second, to follow up on my question to the earlier panel, I 

was very impressed by Microsoft’s lawsuit. I asked them to send 

me the complaint. I thought it was very well done. And they did 

not really have a hostile defendant. The defendant, the provider 

who was at stake, was perfectly happy to comply as long as they 

had a court order that gave them a reason to do it and protected 

them from any liability for what they did. And I am a little bit surprised that there does not seem to be more activity in that arena, 

somebody knows that there is a bot out there that they can disable, 

somebody knows that there is a worm out there, somebody knows 

that there is a piece of—a website that is—you know, whatever it 

is that they know about their risk posture, it seems very rare that 

somebody actually goes to a court and says, oh, by the way, let us 

bring in—again, the domain registrar, their ISP, or whoever—and 

say we want you, because of the threat to our welfare here, to 

make this change in your programming so that our threat is diminished. And then everybody sits around and says yes, the judge hits 

the gavel, everybody is happy. It seems to me to be—the Microsoft 

thing does not seem to be repeating itself as often as I would have 

expected. I am aware of a couple of others, but that seems to be 

the breakthrough one, and it does not seem to have created the 

sort of torrent I expected of people going out to the courts, to the 

ISPs, to the domain registrars, to help them clean up the environment. 

Mr. BAKER. Microsoft is in the unique position of seeing attacks 

around the world on their software and having the resources to 

37 

pursue creative solutions. And I agree with you, that was a very 

creative and constructive approach. 

I do think that it is worth exploring what could be done to allow 

companies that have an interest in doing more but need some reassurance that what they are doing is not going to result in liability. 

One of the great values of a civil injunction and a civil order is that 

you know that the people that you are going after are not going to 

turn around and file lawsuits against you, because you have already gotten prior approval. And finding ways to relieve ISPs, 

other companies, of their fear that doing the right thing will result 

in liability is worth looking at. I think that is a constructive approach. 

By and large, using the tort system to improve security is a pretty backward-looking approach; that is to say, by the time you get 

a judgment, you are 6 years past the problem, and it is probably—— 

Chairman WHITEHOUSE. You are back to my first question. 

Mr. BAKER. Yes, I am coming back to your first—— 

Chairman WHITEHOUSE. Yes, I am not sure it is the best way—— 

Mr. BAKER. So I—— 

Chairman WHITEHOUSE. I am also not sure that allowing a company to completely relieve itself of liability contractually is very 

helpful in this space either, because it takes their mind off it and 

they go on to other projects. 

Mr. BAKER. I do not disagree with you on that, and I support the 

idea of having at least agencies that understand what good security 

practices are, start to define those for companies, including software companies, to make sure that they are actually doing the 

things that they need to do. And if they say you need to do this 

and then the company does not do it, I do not think those contractual clauses are going to save them from liability. 

Chairman WHITEHOUSE. Senator Kyl? 

Senator KYL. Thank you very much. 

Chairman WHITEHOUSE. Anything further? 

Senator BLUMENTHAL. No. Thank you. 

Chairman WHITEHOUSE. All right. We will conclude this hearing. 

I thank all of the witnesses, and once again I very much appreciate 

the Night Dragon report that McAfee did. 

The hearing will stay open, the docket of the hearing will stay 

open for an additional week, and we will, of course, ask all of the 

witnesses to comply with the questions for the record that you will 

get in writing. 

Again, thank you very much. This has been instructive and helpful. 

The hearing is adjourned. 

[Whereupon, at 4:33 p.m., the Subcommittee was adjourned.] 

[Questions and answers and submissions for the record follow.] 

38 


71412.001
39 


71412.002
40 


71412.003
41 


71412.004
42 


71412.005
43 


71412.006
44 


71412.007
45 


71412.008
46 


71412.009
47 


71412.010
48 


71412.011
49 


71412.012
50 


71412.013
51 


71412.014
52 


71412.015
53 


71412.016
54 


71412.017
55 


71412.018
56 


71412.019
57 


71412.020
58 


71412.021
59 


71412.022
60 


71412.023
61 


71412.024
62 


71412.025
63 


71412.026
64 


71412.027
65 


71412.028
66 


71412.029
67 


71412.030
68 


71412.031
69 


71412.032
70 


71412.033
71 


71412.034
72 


71412.035
73 


71412.036
74 


71412.037
75 


71412.038
76 


71412.039
77 


71412.040
78 


71412.041
79 


71412.042
80 


71412.043
81 


71412.044
82 


71412.045
83 


71412.046
84 


71412.047
85 


71412.048
86 


71412.049
87 


71412.050
88 


71412.051
89 


71412.052
90 


71412.053
91 


71412.054
92 


71412.055
93 


71412.056
94 


71412.057
95 


71412.058
96 


71412.059
97 


71412.060
98 


71412.061
99 


71412.062
100 


71412.063
101 


71412.064
102 


71412.065
103 


71412.066
104 


71412.067
105 


71412.068
106 


71412.069
107 


71412.070
108 


71412.071
109 


71412.072
110 


71412.073
111 


71412.074
112 


71412.075
113 


71412.076
114 


71412.077
115 


71412.078
116 


71412.079
117 


71412.080
118 


71412.081
119 


71412.082
120 


71412.083
121 


71412.084
122 


71412.085
123 


71412.086
124 


71412.087
125 


71412.088
126 


71412.089
127 


71412.090
128 


71412.091
129 


71412.092
130 


71412.093
131 


71412.094
132 


71412.095
133 


71412.096
134 


71412.097
135 


71412.098
136 


71412.099
137 

Æ 


71412.100