U.S. GOVERNMENT PRINTING OFFICE

74–495 DTP WASHINGTON : 2001

COMPUTER SECURITY REPORT CARD

HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

INFORMATION, AND TECHNOLOGY

OF THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SIXTH CONGRESS

SECOND SESSION

SEPTEMBER 11, 2000

Serial No. 106–260

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: (202) 512–1800 Fax: (202) 512–2250

Mail: Stop SSOP, Washington, DC 20402–0001

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

DAVID M. MCINTOSH, Indiana

MARK E. SOUDER, Indiana

JOE SCARBOROUGH, Florida

STEVEN C. LATOURETTE, Ohio

MARSHALL ‘‘MARK’’ SANFORD, South

Carolina

BOB BARR, Georgia

DAN MILLER, Florida

ASA HUTCHINSON, Arkansas

LEE TERRY, Nebraska

JUDY BIGGERT, Illinois

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

HELEN CHENOWETH-HAGE, Idaho

DAVID VITTER, Louisiana

HENRY A. WAXMAN, California

TOM LANTOS, California

ROBERT E. WISE, JR., West Virginia

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

CHAKA FATTAH, Pennsylvania

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

HAROLD E. FORD, JR., Tennessee

JANICE D. SCHAKOWSKY, Illinois

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

JAMES C. WILSON, Chief Counsel

ROBERT A. BRIGGS, Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY

STEPHEN HORN, California, Chairman

JUDY BIGGERT, Illinois

THOMAS M. DAVIS, Virginia

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

JIM TURNER, Texas

PAUL E. KANJORSKI, Pennsylvania

MAJOR R. OWENS, New York

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

BEN RITT, Professional Staff Member

BRYAN SISK, Clerk

TREY HENDERSON, Minority Counsel

(III)

C O N T E N T S

Page

Hearing held on September 11, 2000 ..................................................................... 1

Statement of:

Dyer, John R., Chief Information Officer, Social Security Administration . 142

Gilligan, John, Chief Information Officer, Department of Energy, cochair,

security, privacy and critical infrastructure committee, Chief Information Officers Council ..................................................................................... 116

Hobbs, Ira L., Deputy Chief Information Officer, Department of Agriculture ............................................................................................................ 184

Hugler, Edward, Deputy Assistant Secretary for Administration and

Management, Department of Labor ............................................................ 179

Singleton, Solveig, director of information studies for the CATO Institute 201

Spotila, John T., Administrator, Office of Information and Regulatory

Affairs, Office of Management and Budget ................................................. 27

Tanner, Mark A., Information Resources Manager, Federal Bureau of

Investigation, Department of Justice .......................................................... 193

White, Daryl W., Chief Information Officer, Department of the Interior .... 155

Willemssen, Joel, Director, Accounting and Information Management Division, U.S. General Accounting Office, accompanied by Robert Dayce,

Director for Computer Security Issues, General Accounting Office ......... 95

Letters, statements, etc., submitted for the record by:

Dyer, John R., Chief Information Officer, Social Security Administration,

prepared statement of ................................................................................... 145

Gilligan, John, Chief Information Officer, Department of Energy, cochair,

security, privacy and critical infrastructure committee, Chief Information Officers Council, prepared statement of .............................................. 120

Hobbs, Ira L., Deputy Chief Information Officer, Department of Agriculture, prepared statement of .................................................................... 186

Horn, Hon. Stephen, a Representative in Congress from the State of

California:

Letter dated July 27, 2000 ....................................................................... 46

Prepared statement of ............................................................................... 4

Hugler, Edward, Deputy Assistant Secretary for Administration and

Management, Department of Labor, prepared statement of ..................... 181

Singleton, Solveig, director of information studies for the CATO Institute,

prepared statement of ................................................................................... 204

Spotila, John T., Administrator, Office of Information and Regulatory

Affairs, Office of Management and Budget, prepared statement of ......... 31

Tanner, Mark A., Information Resources Manager, Federal Bureau of

Investigation, Department of Justice, prepared statement of ................... 196

Turner, Hon. Jim, a Representative in Congress from the State of Texas,

prepared statement of ................................................................................... 25

White, Daryl W., Chief Information Officer, Department of the Interior,

prepared statement of ................................................................................... 157

Willemssen, Joel, Director, Accounting and Information Management Division, U.S. General Accounting Office, prepared statement of ................ 97

(1)

COMPUTER SECURITY REPORT CARD

MONDAY, SEPTEMBER 11, 2000

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

INFORMATION, AND TECHNOLOGY,

COMMITTEE ON GOVERNMENT REFORM,

Washington, DC.

The subcommittee met, pursuant to notice, at 10 a.m., in room

2154, Rayburn House Office Building, Hon. Stephen Horn (chairman of the subcommittee) presiding.

Present: Representatives Horn and Turner.

Staff present: J. Russell George, staff director and chief counsel;

Randy Kaplan, counsel; Ben Ritt, professional staff member;

Bonnie Heald, director of communications; Bryan Sisk, clerk; Elizabeth Seong, staff assistant; George Fraser, intern; Michelle Ash

and Trey Henderson, minority counsels; and Jean Gosa, minority

assistant clerk.

Mr. HORN. The quorum being present, this hearing of the Subcommittee on Government Management, Information, and Technology will come to order.

We’re here today to discuss one of the Federal Government’s

most important and ongoing challenges, the security of government

computers. Computers and the Internet are revolutionizing the way

we do business, conduct research and communicate with friends

and associates. The benefits are enormous as vast amounts of information flow instantly from business to business and individual to

individual, but widespread access to computers and the Internet

also carries the significant risk that personal, financial or business

information can fall into the hands of computer hackers or others

with more malicious intent.

Similarly, as the Federal Government becomes increasingly dependent on computers and the Internet, the computer systems and

the sensitivity of information they contain come under an increasing number of attacks. Unlike the year 2000 or Y2K computer challenge, this threat has no deadline. Rather it is a day-to-day challenge created by an increasingly sophisticated technology. In order

to guarantee the integrity of the Federal programs and to protect

the personal privacy of all Americans, government leaders must

focus their attention on the security of their vital computer systems.

Today the subcommittee is releasing its first report card on the

status of the computer security at executive branch departments

and agencies. These grades are based on self-reported evaluation of

agency information, in addition to the results of audits conducted

2

by the General Accounting Office and the various agency inspectors

general. This is the first time such governmentwide information

has ever been compiled.

As you can see, only two agencies have made progress toward

protecting their computers against invasion. Although auditors

found some significant weaknesses at the Social Security Administration and National Science Foundation, both agencies received

Bs, the highest grade awarded. But the rest of the picture is very

dismal. Overall the government earned an average grade of D

minus. More than one-quarter of the 24 major Federal agencies received a failing F; the Department of Labor, charged with maintaining vital employment statistics, an F; the Department of the

Interior, which manages the Nation’s public lands, an F; the Department of Health and Human Services that holds personal information on every citizen who receives Medicare, another F; Agriculture and Justice, the Small Business Administration, the Office

of Personnel Management, the personnel office for the entire executive branch of the Federal Governments, all Fs.

Six other vital agencies nearly failed. The Department of Defense, whose computers carry some of the Nation’s most sensitive

secrets, earned only a D plus for its computer security program;

Veterans Affairs and Treasury, along with the Environmental Protection Agency, General Services Administration and National Aeronautics and Space Administration, more Ds.

Four other government agencies received grades of incomplete.

These vital agencies oversee key elements of the Nation’s infrastructure and emergency services. They are the Departments of

Energy and Transportation, the Nuclear Regulatory Commission

and the Federal Emergency Management Agency [FEMA]. These

agencies could not receive a grade because there has been insufficient auditor resources and scrutiny to validate the agencies’ selfevaluations.

Obviously there is a great deal of work ahead. Regardless of

grade, each agency must recognize that the daily challenges to

their computer systems will continue to grow in number and sophistication. They must take the necessary steps to mitigate those

threats. There is no room for complacency, for the stakes are simply too high.

We have with us today witnesses representing six of the agencies

that were graded. They will discuss their agency’s progress and

plans to develop acceptable computer security procedures.

Mr. John Gilligan from the Department of Energy will also testify on behalf of the Chief Information Officers Council. In addition,

we have the Honorable John Spotila from the Office of Management and Budget, which is charged with overseeing the agency’s

computer security efforts; and Mr. Joel Willemssen from the General Accounting Office, which works for the legislative branch,

headed the Comptroller General of the United States. And I want

to thank Comptroller General Walker and the staff for their excellent help in regard to the grades and everything else. I take the

responsibility for the grades, but they sat for hours with us on

making sure that we’ve been fair.

We have the ability, the government has the ability, to protect

the integrity of the vital computer systems. As I look back, this is

3

sort of where we were on Y2K in April 1996. There are a lot of Fs,

a lot of Ds, but the executive branch came through on midnight

January 1 where it counted, and I am confident that the executive

branch will do the same thing this time.

We welcome all of our witnesses, and we look forward to their

testimony.

I now yield to the ranking member for an opening statement, the

gentleman from Texas Mr. Turner.

[The prepared statement of Hon. Stephen Horn follows:]

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

Mr. TURNER. Thank you, Mr. Chairman.

As we all understand, our Federal agencies rely on computers

and electronic data to perform functions that are essential to our

national welfare and directly affect the lives of millions of Americans.

This technology greatly benefits Federal operations through the

speed and accessibility it provides, but it also creates vulnerability

to attack. Individuals, organizations and virtually anyone today

with a computer and a modem has the potential to interrupt and

to eavesdrop on government operations around the world. Many experts are predicting that future wars will be in the form of

cyberattacks and fought out over a computer grid rather than a

battlefield.

I want to commend the chairman for his interest and his work

on this important issue. Computer security is without a doubt one

of the most critical and difficult technical challenges facing our government. Like Y2K, this subcommittee has an important oversight

role in holding our Federal agencies accountable for implementing

computer security efforts, and while I commend the chairman’s efforts to reduce the task to a simple report card grade, I also realize

that improving computer security is a very complicated, timely and

costly process.

Additionally, I do understand that the subjective format of our

grading system could in some cases unfairly portray the significant

efforts an agency has made to take corrective actions. I realize that

some agency computer systems are critical to national security,

while others may not be. I also realize that this Congress has an

obligation to provide adequate funding to agencies so that they

might meet the requirement that we have imposed on them.

While I want to commend the agencies that are moving forward,

it is clear that the Federal Government has a long way to go before

an effective, comprehensive Federal computer security system is in

place. It is my hope that as a result of these hearings, we will be

closer to achieving our mutual goal. We want to make sure that the

Federal managers have the tools and the funds in place to be accountable for the protection of agency infrastructures.

Again, I thank the chairman for calling this hearing. I appreciate

the good work that the committee and the staff has done, and I

look forward to hearing from each of our witnesses.

Thank you, Mr. Chairman.

[The prepared statement of Hon. Jim Turner follows:]

25

26

27

Mr. HORN. Well, we thank you, and I agree with you. We need

to be talking to the authorizers and the appropriators to make sure

that what is needed will be there. So I imagine the next round we

should have some improvement.

We will now start with the witnesses, and along the agenda the

Honorable John Spotila is the Administrator, Office of Information

and Regulatory Affairs, Office of Management and Budget, part of

the President’s Executive Office of the President, and he is speaking on behalf of OMB today.

So, Mr. Spotila.

STATEMENT OF JOHN T. SPOTILA, ADMINISTRATOR, OFFICE

OF INFORMATION AND REGULATORY AFFAIRS, OFFICE OF

MANAGEMENT AND BUDGET

Mr. SPOTILA. Good morning, Mr. Chairman and members of the

committee. Thank you for inviting me here to discuss OMB’s efforts

in the vital area of computer security.

OMB policies build on a statutory framework requiring that Federal agencies adopt a set of risk-based management controls for all

Federal computer systems. The agencies must periodically review

their security controls to ensure continued effectiveness.

In an effort to identify strengths and weaknesses in agency security programs, OMB sought updated information from the agencies

in June 1999 on their risk management processes. We are now focusing on the security posture of 43 high-impact government programs where good security is particularly important. These programs include Medicare, Medicaid, the air traffic control system,

Social Security and Student Aid. In late May of this year, we asked

the agencies to send us specific information regarding the management, operational and technical controls in place for each application or general support system sustaining these programs.

Our preliminary findings are illuminating. We have made significant progress, but can still do better. Agencies are working to integrate security into their capital planning and investment control

processes. We have made this a high priority. Many agencies have

completed a security review of their systems and have updated

their security plans within the last 2 years. Many agencies develop

and share their security plans with their partner organizations and

other agencies. This promotes a comprehensive understanding of

the interconnections prevalent in a shared risk environment.

Due to their extensive Y2K work, most agencies have tested their

continuity of operations plans within the last 2 years. Most agencies have provided users and system administrators with IT security training within the last year. Most agencies update their virus

detection and elimination software on an ongoing basis and have

successfully implemented processes to confirm the testing and installation of software patches in a timely manner.

Nearly all agencies have documented incident handling procedures and have a formal incident response capability in place. More

agencies need to install firewalls at external entry points to exclude

unauthorized users and within their networks to ensure that authorized users do not exceed authorization.

Agencies can better protect the confidentiality of sensitive material through increased use of encryption for password files and perVerDate 11-MAY-2000 09:45 Sep 24, 2001 Jkt 000000 PO 00000 Frm 00031 Fmt 6633 Sfmt 6633 C:\DOCS\74495.TXT HGOVREF1 PsN: HGOVREF1
28

sonal information. Agencies should improve their intrusion detection capabilities and procedures. This should include increased involvement of agency privacy officers and legal counsel in reviewing

the monitoring activities.

More agencies should ensure that agency managers specifically

authorize the processing of each new or updated system before actual operations begin. More agencies should have independent review of their security plans.

We are working with the agencies on all of these areas. The

President, his chief of staff and the Director of OMB have all taken

a personal interest in enhancing security for our interconnected

systems. This has gone a long way to establish senior management

support at the agencies.

In February, OMB issued important guidance to the agencies on

incorporating security and privacy requirements in each of their

fiscal year 2002 information technology budget submissions.

A well-known computer security expert, Robert Courtney, once

said, ‘‘Good security is the ultimate non-event.’’ In that phrase, he

summarized the difficulty of measuring effective security. We face

a significant challenge. We must devise a method to assess security

for the whole of government, its thousands of vastly diverse systems and millions of desktop computers. No other organization

faces demands in this area that are as broad as those the government confronts.

Since last fall, OMB has worked with the CIO Council, NIST,

GAO and the agencies to develop security performance measures

against which agencies can assess their security programs. As you

know, CIO Council and NIST representatives have met with your

staff to discuss this effort. We have made great progress in a relatively short period of time, but, not surprisingly, there is more to

be done. Even the private sector is struggling with this challenge.

Mr. Chairman, clearly you are focused on the need to assess

agency security programs. While we appreciate your serious interest in security and your belief that grades will help the agencies

improve their performance, we do have some concerns with this approach. We look forward to working closely with you to develop better ways of measuring progress in this area. We learned much from

our collegial efforts with the committee, GAO and the agencies in

developing good Y2K measurements. Ideally, we should work together to develop a similar workable set of measurements for assessing agency security programs.

Measuring agency security effectiveness is at least as complex as

the Y2K measurement effort. We must assess programs and implementation at three different levels: the relatively uniform agency

management or executive level; the expansive mix of individual

programs where agency business operations take place; and at each

of the thousands of government information systems that support

actual agency program operations.

Cursory measurements can be misleading. A well-documented security program without the periodic evaluation of control effectiveness can give a false sense of security. A weak central organization

can obscure highly effective component, program or system-level security. We must take a comprehensive approach to evaluating security if we are to generate meaningful results.

29

Our assessment approach begins with the premise that all agency programs and systems must include a continuing cycle of risk

management, appropriate methods to evaluate and measure performance, and the ability to anticipate or quickly react to changes

in the risk environment.

We are putting great emphasis on agency self-assessment. This

fall all agencies will use a NIST-prepared questionnaire that focuses on overall agency programs as well as on specific management, operational and technical controls applied to each system or

group of systems. Assessing the effectiveness of the program and

the individual controls, not simply their existence, is vital to

achieving and maintaining adequate security.

The NIST questionnaire will help agencies identify whether the

program and controls are properly documented, implemented and

continuously tested and reviewed. We can then determine a security level for an individual system, an agency or component, or an

aggregated form, an entire agency.

Self-assessments improve security. They are less costly and can

be performed more frequently than compliance inspections and audits. They can be performed by system users, thereby helping to

promote buy-in and greater compliance. They promote openness

and cooperation among all participants. They can also give us good

information on a timely basis.

In seeking to measure security effectiveness, we should not

equate it to our Y2K experience. While Y2K was a complex management challenge, it was a relatively straightforward technical

one, and we could measure progress toward a known event. Security challenges, on the other hand, are unpredictable, ongoing,

ever-changing and multidimensional. Security threats often arise

from malicious parties who probe for vulnerabilities and risks.

These threats can strike at the confidentiality of our information,

the integrity of our systems and data, and our ability to ensure

that information in systems will be ready for use when needed.

These threats are ever-changing and our approach to security must

be equally dynamic.

While a general progress report at an agency level can be valuable when used in the proper context, it is but a snapshot taken

at a point in time. It may or may not even be a clear picture. Because a security program comprises physical, personnel, technical

and other controls, accurately assessing a program is an extremely

complex undertaking. In our view, the differences between the two

call for different responses. Just as we must resist the simplicity

of a one-size-fits-all security program for the wide variety of agency

systems, we must also avoid a one-size-fits-all approach to measuring successes and shortfalls.

If we are to improve the government’s approach to information

security, we need to work together. We very much appreciate the

committee’s interest in this important area and look forward to

continuing our close cooperation with you. We value our partnership with you and hope that this hearing will mark a further

strengthening of our joint efforts on behalf of the American people.

Thank you.

30

Mr. HORN. We thank you. And in courtesy to the executive

branch, we let you go beyond the 5-minute rule.

Mr. SPOTILA. Thank you.

[The prepared statement of Mr. Spotila follows:]

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

Mr. HORN. I will say for all the other witnesses after Mr.

Willemssen, who speaks for the General Accounting Office of the

legislative branch, that we would like you to summarize, and we

will bring the gavel down every 5 minutes now or we’re not going

to be out of here, and we want to be out of here by roughly 11:45.

I know a number of you have commitments.

What I would like to put in the record at this point for the hearing record—and tell me if there’s anything else that ought to go

into it, or some of these are classified, just to redact them, as the

saying goes—Presidential Directive 63; OMB–A130, the Budget Director Mr. Lew’s guidance, to agencies; the appendix 3 and associated NIST—what was once the Bureau of Standards and Security—guidance. And I would like these simply as appendices to

your testimony, and if there’s a problem, work it out with staff.

Mr. SPOTILA. That’s fine.

[The information referred to follows:]

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

Mr. HORN. So we will now move to have the oath since I didn’t

begin it that way. If you will all stand.

[Witnesses sworn.]

Mr. HORN. The clerk will note all the witnesses affirmed.

And we now go to the agent of the Comptroller General of the

United States, which is Joel Willemssen, Director, Accounting and

Information Management Division, U.S. General Accounting Office.

Mr. Willemssen.

STATEMENT OF JOEL WILLEMSSEN, DIRECTOR, ACCOUNTING

AND INFORMATION MANAGEMENT DIVISION, U.S. GENERAL

ACCOUNTING OFFICE, ACCOMPANIED BY ROBERT DAYCE,

DIRECTOR FOR COMPUTER SECURITY ISSUES, GENERAL ACCOUNTING OFFICE

Mr. WILLEMSSEN. Thank you, Mr. Chairman, Ranking Member

Turner. Thank you for inviting us to testify today. Accompanying

me is Robert Dayce, GAO’s Director for Computer Security Issues,

and as requested I’ll briefly summarize our statement.

Overall GAO and inspector general reviews done over the past

year continue to show that Federal agencies have serious and widespread computer security weaknesses. Our analysis of recently

issued GAO and inspector general reports revealed significant

weaknesses at each of the 24 major Federal agencies. As displayed

on the board, these weaknesses were reported in all six major

areas of general computer security controls.

For example, in the area of security program management, weaknesses were identified at 21 agencies. Security program management is fundamental to the appropriate selection and effectiveness

of the other categories of controls shown on the board. This area

covers a range of activities related to understanding risks, selecting

and implementing controls appropriate with risk levels, and ensuring the controls, once implemented, continue to operate effectively.

Another critical area where weaknesses have been found at each

of the 24 agencies is access controls. Weak controls over access to

sensitive data and systems make it possible for a person to inappropriately modify, destroy or disclose data or computer programs.

For the other highlighted areas of security controls, we’ve also

found significant weaknesses at most of the agencies in which

audit work has been done.

I think it’s noteworthy to point out that since our last analysis

of issued reports in 1998, the scope of audit work performed has

expanded to more fully cover all six major control areas at each

agency. Not surprisingly, this has led to the identification of additional areas of weakness. However, this does not necessarily mean

that security is getting worse, although it is clear that serious pervasive weaknesses persist. These serious weaknesses present substantial risk to Federal operations, assets and confidentiality.

Because virtually all Federal operations are supported by automated systems and electronic data, the risks are very high, and the

breadth of the potential impact is very wide. The risks cover areas

as diverse as taxpayer records, law enforcement, national defense,

and a wide range of benefit programs.

While a number of factors have distributed to weak Federal information security, I want to emphasize that we believe the key unVerDate 11-MAY-2000 09:45 Sep 24, 2001 Jkt 000000 PO 00000 Frm 00099 Fmt 6633 Sfmt 6633 C:\DOCS\74495.TXT HGOVREF1 PsN: HGOVREF1
96

derlying problem is ineffective security program management. With

that in mind, we have issued two executive guides that discuss

practices that leading organizations have employed to strengthen

the effectiveness of their security programs.

In conclusion, the expanded body of audit evidence that has become available shows that important operations at every major

Federal agency continue to be at risk as a result of weak controls.

Reducing these risks will require agencies to implement fundamental improvements in managing computer security.

Thank you, Mr. Chairman, and I would be pleased to address

any questions that you may have.

Mr. HORN. Well, thank you very much. We will have the questions after all the witnesses have made their presentation.

[The prepared statement of Mr. Willemssen follows:]

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

Mr. HORN. The next witness is John Gilligan, the Chief Information Officer for the Department of Energy, the cochair for Security,

Privacy and Critical Infrastructure Committee of the Chief Information Officers Council. I will give you another minute besides the

5 because you’re speaking for the Chief Information Officers Council. Mr. Gilligan, you’ve prepared a very thorough statement, but

we can’t obviously get over 25 pages into the record at this point,

but it is in the record, but not having been spoken.

So if Mr. Gilligan will proceed.

STATEMENT OF JOHN GILLIGAN, CHIEF INFORMATION OFFICER, DEPARTMENT OF ENERGY, COCHAIR, SECURITY, PRIVACY AND CRITICAL INFRASTRUCTURE COMMITTEE, CHIEF

INFORMATION OFFICERS COUNCIL

Mr. GILLIGAN. Thank you, Chairman Horn and Ranking Member

Turner. I want to thank you for the opportunity to appear before

this subcommittee to address the very important issue of improving

security of our Federal information systems. My remarks today will

focus on my perspectives as cochair of the CIO Council’s Security,

Privacy and Critical Infrastructure Committee.

Federal CIOs share the concerns that have been expressed by

Members of Congress, senior members in the administration, and

the public, that we need to improve the security of our government

information systems. Federal CIOs take their responsibility to

oversee agency efforts in cybersecurity very seriously. We share the

frustration of members of this committee that progress in securing

government systems has not been more rapid. Let me assure you

that Federal CIOs are not asleep at the wheel. Rather, they are laboring hard to get a handle on one of the Nation’s most complex

technological and management problems.

Perhaps it is useful to put the difficulty of cybersecurity into perspective. I recall an exchange I had with a military four-star general a few years ago. We were discussing his frustration with the

slow progress on an information technology project. This very successful commander with hundreds of thousands of troops under his

command was clearly exasperated. He commented to me after we

had discussed the project status, ‘‘John, after all, this is not rocket

science.’’ As I later examined his comment, it became clear that he

was right. The problem could not correctly be compared to rocket

science where we have literally hundreds of years of experience, including a well-defined set of engineering principles.

Due to the rapid pace of evolution of information technology, we

are typically faced with applying information technology solutions

that have been in existence for months or, at best, a few years. I

submit that the situation is acute for cybersecurity. It is not rocket

science. No, many aspects of cybersecurity are indeed much more

difficult than rocket science.

When I addressed this committee in March of this year, I stated

that the single biggest challenge that I saw for CIOs in

cybersecurity was making line management aware that

cybersecurity is not just a complex technological issue. At the core

cybersecurity is also a complex risk management issue.

Another challenge that I see facing CIOs is helping line management answer the question, ‘‘what is adequate security?’’ Security

117

experts tell us that no system is impenetrable if network access is

provided. However, the collective inexperience of government and

industry in applying security to a range of functions including public Web sites, financial data bases, procurement-sensitive data, citizen benefits and corporate-sensitive or government-sensitive research, makes this a hard problem.

The primary focus of the CIO Council efforts in this area has

been to help Federal organizations address the question of what is

adequate security. The CIO Council has sponsored a Web-based repository for sharing best practices. This repository can be found at

http://bsp.cio.gov.

We have developed sample security policies for use by agencies

in intrusion reporting and procuring security projects. We have

worked to improve governmentwide processes for reporting security

incidents and distributing warnings in a rapid fashion. An ongoing

effort is to develop a set of benchmark security practices for electronic services.

The Council has also sponsored a number of training and education forums addressing privacy and critical infrastructure protection.

The CIO Council is also leading efforts to establish a governmentwide encryption infrastructure using public key technology

called a public key infrastructure [PKI].

An additional CIO Council effort that is particularly relevant to

today’s hearing is the development of an Information Technology

Security Assessment Framework. This effort was initiated about 10

months ago to provide a tool to help guide security efforts within

Federal agencies. This framework has been developed largely with

the leadership of the National Institute of Standards and Technology and built upon existing policy and guidance from the Office

of Management and Budget, the General Accounting Office, and

the National Institutes of Standards and Technology.

The framework provides a road map for Federal organizations to

guide them in focusing and prioritizing their efforts to improve security. For each of five levels in the framework, a set of activities

is defined that should be undertaken to assure a sound and effective security program. The framework reinforces the importance of

a solid foundation for an organization security program and is

based on sound policy, clearly defined management responsibility,

and organizationwide coverage.

The CIO Council has completed a final draft of version one of the

Information Technology Security Assessment Framework and

hopes to publish this version in October. Following the example of

similar efforts by Carnegie Mellon University to develop security

frameworks for software and other disciplines, we plan to continue

to refine the framework over the upcoming months. With advice

and input from GAO, we have started working on enhancements to

the framework that would permit organizations to better assess the

effectiveness of the security programs that have been documented

and implemented.

The final area that I would like to address is the need for stronger funding support from Congress for a small set of cross-government security initiatives that serve as the foundation for governmentwide improvements in cybersecurity. The cochairs of the SecuVerDate 11-MAY-2000 09:45 Sep 24, 2001 Jkt 000000 PO 00000 Frm 00121 Fmt 6633 Sfmt 6633 C:\DOCS\74495.TXT HGOVREF1 PsN: HGOVREF1
118

rity, Privacy and Critical Committee of the CIO Council recently

sent a letter to all Members of Congress that highlighted our concern in this area. The letter points out that while there is almost

$2 billion identified in the administration’s fiscal year 2001 budget

request for cybersecurity-related items, only a very small portion of

this request totaling less than $50 million is requested for these essential governmentwide foundation programs. The efforts of this

group include the Federal Computer Incident Response Capability

[FEDCIRC], which is managed by GSA and provides alerts and

warnings of virus attacks to all Federal agencies.

It has become clear to the CIO Council that these necessary

foundation efforts to improve cybersecurity governmentwide are

being hampered by a patchwork of funding and oversight structures in both the executive and legislative branches. We cannot

hope to achieve robust governmentwide security without these programs. We urge the respective congressional committees who have

jurisdiction over these efforts not to view them as politically driven

projects, but as essential elements of a governmentwide foundation

for cybersecurity. Moreover, we believe that a $50 million investment for these efforts is a very small investment in view of the

great leverage that these efforts will provide.

I would like to enter into the record a copy of the letter entitled

‘‘Essential Programs for Ensuring Security of the Federal Cyber Infrastructure.’’

Mr. HORN. Without objection, it will be in the record at this point

in your testimony.

Mr. GILLIGAN. It is clear to Federal CIOs that the lack of a single

integrated budget for cybersecurity items—these foundation

cybersecurity items—keeps these efforts from getting the proper attention that they deserve and makes progress and governmentwide

efforts more difficult.

In similar fashion, the efforts of the CIO Council Security Committee and other CIO Council committees continue to be hampered

by lack of effective methods to fund these cross-government initiatives that we undertake. The synergistic benefit and opportunity

for savings across the government are enormous. However, due to

the use of pass-the-hat funding approaches for the CIO Council, for

example, funding for the best security practices efforts that was

mentioned earlier had to be limited to $200,000 and was received

9 months into the fiscal year. We will not be able to continue to

operate and expand this site or undertake other projects with operational demands without an adequate level of funding.

I would suggest that this committee, working with the administration, should examine ways to provide better methods to fund

and manage cross-government initiatives in the information technology area. As a taxpayer, I am dismayed by the difficulty of funding these efforts which have the ability to yield tremendous efficiencies. It is an area where our executive and legislative branches

are truly failing, unable to leverage the potential of information

technology.

In my written testimony, I’ve included descriptions of efforts

within the Department of Energy to improve the security of our

many security systems.

119

In summary, let me again express my appreciation for the opportunity to share my views on the important subject and encourage

the committee to continue to support the CIO Council-sponsored efforts, especially the Information Technology Security Assessment

Framework.

While our joint challenge to improve cybersecurity may be more

difficult than building rockets, chief information officers are committed to rapidly improving the protection afforded to information

systems managed by the Federal Government.

This concludes my remarks. Thank you.

[The prepared statement of Mr. Gilligan follows:]

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

Mr. HORN. Well, thank you very much. And I would hope that

when there is some budget negotiations going on toward the end,

that the President’s list will include this, and we hope that the

Speaker will include it.

The next witness is John R. Dyer, the Chief Information Officer

for the Social Security Administration.

Mr. Dyer.

STATEMENT OF JOHN R. DYER, CHIEF INFORMATION

OFFICER, SOCIAL SECURITY ADMINISTRATION

Mr. DYER. Good morning, Mr. Chair, Mr. Turner. Thank you very

much for inviting us to testify.

We, too, as this committee, consider security to be an actual vital

concern, particularly in this day as we move more into the systems

world.

At the onset let me emphasize that the Social Security Administration has always taken the responsibility to protect the privacy

of personal information in agency files very seriously. The Social

Security Board’s first regulation published in 1937 dealt with the

confidentiality of SSA records. For 65 years SSA has honored its

commitment to the American people to maintain the confidentiality

of the records in our possession. We understand in order to address

privacy concerns, we need a strong computer security program in

place. Today I would like to discuss where we are with computer

security, what improvements we’re making.

SSA approaches computer security on an entitywide basis. By

doing so we address all aspects of the SSA enterprise. Overall the

Chief Information Officer, who reports directly to the Commissioner and Deputy Commissioner, is responsible for information

system security. In my role as CIO, I assure that our security initiatives are enterprisewide in scope. At the Deputy Commissioner

level, Social Security’s Chief Financial Officer assures that all new

systems have the required financial controls to maintain sound

stewardship over the moneys entrusted to our care. We have also

placed our system security policy function with this Deputy Commissioner.

In order to meet the challenges of data security in today’s highly

technological environment, this agency has adopted an

enterprisewide approach to system security, financial information,

data integrity and prevention of fraud, waste and abuse. We have

full-time staff devoted to system security stationed throughout the

agency, in all regions and in the central office. We have established

centers for security and integrity in each Social Security region.

They provide day-to-day oversight control over our computer software. In addition, we have a Deputy Commissioner-level Office of

Systems which supports the operating system, develops new software and the related controls, and, in general, assures that Social

Security is taking advantage of the latest in effective systems technology.

SSA has been certifying its sensitive systems since the original

OMB requirement was published in 1991. Our process requires

Deputy Commissioners responsible for those systems to accredit

them. SSA’s planning and certification activity is now in full compliance with NIST 800–18 guidance.

143

SSA sensitive systems include all programmatic systems needed

to support programs administered by the agency as well as critical

personnel functions. They also include the network and the system

used to monitor Social Security’s data center operations.

As an independent agency we have our own inspector general

who can focus his efforts on the agency needs and concerns. The

IG is also very active working with other Federal, State and local

law enforcement agencies to assure all avenues for investigation

and prosecution are being pursued, especially for systems securityrelated issues.

In summary, we have in place the right authorities, the right

personnel, the right software controls to prevent penetration of our

systems and to address systems security issues as they surface.

As I mentioned, SSA has maintained an information security

program for many years. Key components, such as deploying new

security technology, integrating security into the business process,

and performing self-assessment of our security infrastructure, to

name a few, describe the goals and objectives that will touch every

SSA employee.

Of particular importance this year are the activities related to

the Presidential Decision Directive PDD–63 on cyberterrorism and

infrastructure protection and continuity of operations. We have recently completed an evaluation of all critical SSA assets. I am

pleased to note that SSA was one of the first agencies to do so.

Originally, SSA was not a tier I agency, but given the importance

of our ongoing monthly payments, we were elevated to this level by

the Critical Infrastructure Assurance Office. As part of this effort

we have completed an inventory of all critical assets and implemented an incidence response process for computer incidents. We

have also revised our physical security plans to assure our facilities

are properly secured.

An independent auditor, Pricewaterhouse Coopers, has evaluated

our security program over the last 4 years working with the IG.

They have given us many recommendations to strengthen our security program, and we have implemented 77 percent of their recommendations. We are addressing the remainder at this time. Most

of the ones that will take us to finish up over the next fiscal year

are facility-related, and that’s what takes a little bit of time.

In addition, we have ongoing site reviews, corrective actions, and

we also have another independent contractor, Deloitte and Touche,

reviewing our systems and overall management.

In the contingency area this year, we actually tested all of our

sites at one time, which was an area of recommendation that

Pricewaterhouse Coopers had recommended for us. And so we believe that when we get the next report from PwC, it will indicate

that we have made substantial progress.

In terms of the new increasing technology, and as we’re moving

toward Internet, we are putting in place all the latest security features from firewalls to filters to head off specific attacks.

So I would like to say in conclusion, Mr. Chairman, the Social

Security Administration has a longstanding tradition of assuring

the public that their personal records are secure. Both the Commissioner and the Deputy Commissioner give system security their

highest priority. We all recognize this is not a one-time task to be

144

accomplished, but rather it’s an ongoing mission that we can never

lose sight of. We know we cannot rest on past practice. We must

be vigilant every way we can to assure that these records remain

secure and that the public confidence in Social Security is maintained.

I want to thank the committee for the opportunity to testify at

this hearing, and I will be glad to answer any questions you might

have.

Mr. HORN. Thank you very much, Mr. Dyer.

[The prepared statement of Mr. Dyer follows:]

145

146

147

148

149

150

151

152

153

154

155

Mr. HORN. As usual, Social Security is at the top of the heap

even though it’s a B. So we’re used to you getting As under the

Y2K situation, and we look forward to you keeping ahead of the

pack, shall we say. Thank you very much for coming. Thanks to

your colleagues that led to a B grade.

We now go to Daryl W. White, the Chief Information Officer of

the Department of the Interior, who has presented us with quite

a full platter of documentation. We appreciate that. It’s all in the

record, and now you have 5 minutes to summarize it.

STATEMENT OF DARYL W. WHITE, CHIEF INFORMATION

OFFICER, DEPARTMENT OF THE INTERIOR

Mr. WHITE. Good morning, Mr. Chairman and Mr. Turner.

Thank you for the opportunity to appear before you today to discuss the status of computer security at the Department of the Interior. The Department of the Interior appreciates being afforded the

opportunity to complete the recent computer security questionnaire. We are pleased to report that we are making substantive

progress to improve our computer security posture.

The Department of the Interior recognizes that computer security

is of agencywide importance and is actively working to implement

a well-structured program to protect our information assets. It is

anticipated that the vast majority of issues identified in the questionnaire will be adequately addressed through implementations of

our program.

Let me summarize the steps that Interior has taken over the

past 14 months to improve our computer security posture. During

1999, Interior performed extensive work in Y2K readiness for mission-critical systems and major data centers. As a result of Y2K

preparation, policies and guidance for contingency planning and

physical security were issued and several implemented.

In September 1999, we acquired limited funding for contractor

services to perform automated vulnerability scanning of our most

critical systems. Based on the results of the scanning, remediation

was performed where needed.

January 2000, Interior accomplished priority filling of the Department Information Technology Security Manager position with

a well-qualified and experienced individual. We were fortunate to

have obtained Steve Schmidt from the State Department’s Bureau

of Diplomatic Security. Mr. Schmidt has brought a wealth of experience and practical knowledge to Interior. It is through his leadership and direction that we have seen a revitalizing of the Department IT Security Working Group.

Also in January 2000, $175,000 was allocated for computer security program development. Funding was obtained through an internal competitive process whereby senior Department managers

clearly chose computer security as a high priority issue in competition with other equally important issues. This funding was obligated to obtain contractor computer security services in program

development and limited as-needed vulnerability scanning.

February 2000, Interior was successful in including in the fiscal

year 2001 President’s budget request $175,000 for electronic data

security. The House and Senate omitted this funding from their

versions of the fiscal year 2001 appropriations bill. Interior continVerDate 11-MAY-2000 09:45 Sep 24, 2001 Jkt 000000 PO 00000 Frm 00159 Fmt 6633 Sfmt 6633 C:\DOCS\74495.TXT HGOVREF1 PsN: HGOVREF1
156

ues to clarify the urgent need for the funding to the Appropriations

Committee.

In May 2000, the Departmental Information Technology Security

Manager issued the Interior Information Technology Security Plan,

fully specifying the National Institute of Standards and Technology

[NIST], published generally accepted principles and practices for

securing Federal computer systems. This plan provides the basis

for ensuring a computer security program that meets or exceeds

the minimum Federal requirements as required by public laws,

Federal regulations and executive branch directions.

July 2000, the Department issued agencywide budget guidance

that further supported Office of Management and Budget instructions on incorporating computer security funding in all information

technology projects. This guidance advised that computer security

spending should average 5 percent of the total budget for information technology spending and placed a high priority on increasing

resources for security.

August 2000, a contract was awarded by the General Services

Administration under the SafeGuard program to Science Applications International Corp. to provide computer security program development services to the Department. This is significant to our approach to computer security, and I wish to elaborate further.

One of the primary means to improve IT security across the Department of the Interior is to establish proven structured and selfdocumenting methodologies for working through the security lifecycle process. I am pleased to report that realizing this goal has

begun through the award of the mentioned contract. The associated

statement of work divides the task into two phases. The first phase

tasks will provide Interior with the technical and administrative

assistance to put in place proven structured methodologies for information technology security development. The second phase will

produce minimum requirements for risk mitigation in the form of

policies for agencywide information technology security issues.

From here we will develop technology and product-specific implementation guides. Dependent upon the availability of resources, we

will then implement operating capabilities.

In August 2000, an additional $240,000 was obtained for computer security program development. This funding will be used to

accomplish the development and implementation of selected security practices.

In closing, it must be noted that our ability to completely implement an adequate computer security program is strongly dependent upon the availability of necessary resources.

This concludes my statement. I will be happy to respond to any

questions that you or any members of the committee may have.

Mr. HORN. Well, we thank you very much, Mr. White.

[The prepared statement of Mr. White follows:]

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

Mr. HORN. Our next presentation is from Edward Hugler, the

Deputy Assistant Secretary for Administration and Management,

Department of Labor.

STATEMENT OF EDWARD HUGLER, DEPUTY ASSISTANT SECRETARY FOR ADMINISTRATION AND MANAGEMENT, DEPARTMENT OF LABOR

Mr. HUGLER. Thank you, Mr. Chairman and Ranking Member

Turner. I will be brief, as you requested.

We share your view that computer security is a high priority, a

priority that the Department of Labor takes very seriously at the

highest levels. Quite frankly, I am disappointed at the grade we received today, and in some small measure dismayed by it.

Following a successful transition or the century date change, we

have directed significant attention to enhancing our security program and strengthening our security perimeter to defend against

its attack. While this surely is an ongoing and very complex task,

I am pleased to report that we have made solid progress to date

and are continuing to improve our ability to defend against cyber

attacks.

As we began the fiscal year, we had a number of security-related

issues identified by our Office of the Inspector General in their

audit of our financial statement. The issues encompassed work to

done in six areas of Department-wide security program planning

and management structure. The good news is, because computer

security is a high priority, we had already identified areas that

needed attention and had plans under way for corrective action.

This proactive posture was acknowledged by the OIG in their audit

findings.

At this stage we have resolved all of the audit report issues at

the departmental level and are working toward closing out the remaining issues with specific agency systems.

In addition to dealing with immediate day-to-day issues, such as

continued attempts to gain unauthorized access to our systems and

responding to malicious codes such as the I Love You virus, we

have invested substantial effort in planning ahead. Led by the Department’s Chief Information Officer, our strategy in this undertaking has been twofold: First, align our information technology investments with legislative mandates and other direction; and second, bring a departmental focus to our information technology investments where a unified approach and economies of scale are advantageous.

Information technology approaches that are common across the

Department, such as the implementation of a common architecture

and needed improvements in the infrastructure, lend themselves to

a common cross-cutting strategy. The use of a common strategy

then enables us to effectively leverage the use of individuals’ expertise and other scarce resources for the good of all at the Department of Labor.

Utilizing this approach for fiscal year 2001, the Department identified three cross-cutting areas for investment, one of which is computer security. The computer security cross-cut represents approximately 18 percent of the Department’s information technology

cross-cutting investment portfolio for fiscal year 2001. It includes

180

plans to ensure that the information security policies, procedures

and practices of the Department are adequate, as well as reflect

the first step toward implementing a multiyear plan for protecting

our critical infrastructure. Notably this will be a separate budget

activity, and the funds will be administered by the Department’s

Chief Information Officer to ensure an organized, disciplined approach to implementing a stronger security program.

Mr. Chairman, our plans for next year should not, however, overshadow what we’ve accomplished this year, 2000. I would like to

submit a brief highlight of those accomplishments for the record,

if I may.

Mr. HORN. Without objection, it will be in the record at this

point.

Mr. HUGLER. Thank you, Mr. Chairman.

Mr. Chairman, we concur with the need to assess the overall

state of the Federal Government’s computer security environment,

and we welcome the opportunity to work with you and the subcommittee to devise an instrument that will provide the flexibility

necessary to accurately assess agencies’ progress. We also recognize

that work remains to be done at the Department of Labor to further improve our computer security.

I share with you your confidence that we will come through as

we did with the year 2000 challenge. I am confident as well that

we have sound plans for making these improvements and the skill

on hand to do so. However, the key to our success, as has been

mentioned by other witnesses at the table this morning, will be

making the necessary funding available.

Thank you, Mr. Chairman. I appreciate the opportunity to be

here, and I will be happy to take your questions.

Mr. HORN. Well, thank you very much.

[The prepared statement of Mr. Hugler follows:]

181

182

183

184

Mr. HORN. And our next presenter is Ira L. Hobbs, the Deputy

Chief Information Officer for the Department of Agriculture.

Mr. Hobbs.

STATEMENT OF IRA L. HOBBS, DEPUTY CHIEF INFORMATION

OFFICER, DEPARTMENT OF AGRICULTURE

Mr. HOBBS. Thank you, Mr. Chairman. Good morning, Mr.

Chairman and Ranking Member Turner.

I am pleased to appear before the committee this morning to update you on the status of the computer security program of the U.S.

Department of Agriculture. With your permission, I will make a

few brief comments and submit my written testimony for the

record.

USDA’s programs touch the lives of every American every day.

We manage a diverse portfolio of over 200 Federal programs

throughout the Nation and the world at a cost of about $60 billion

annually.

The information we manage, which includes Federal payroll

data, market-sensitive data, geographical data, information on food

stamps and food safety, proprietary research data, is among

USDA’s greatest assets.

The Department is committed to protecting its information assets

as well as the privacy of its customers and its employees. Audit reports conducted by both USDA’s own Office of the Inspector General and the General Accounting Office have identified significant

weaknesses in our overall computer security program, which we

are working hard to correct. As an example, the Department is acquiring and installing necessary equipment to upgrade security at

our highest priority Internet access points, and we are strengthening our intrusion detection capabilities. We are working diligently

to correct all of the deficiencies that have been identified by the reports and hope to be able give you a much more expanded impact

in terms of the changes that we have made.

Reports such as those cited above, as well as internal security reviews mandated by the Secretary of Agriculture in July 1999, made

it clear that the Department requires an overall coordinated and

corporate approach to cybersecurity if it is to succeed.

The USDA agencies include some security funding in their respective budgets. Departmental funding is critical to ensuring the

creation of a standard security infrastructure, and departmental

leadership is required to ensure that we have a comprehensive set

of policies and guidelines.

The Secretary’s security review also resulted in a multiyear action plan to strengthen USDA’s information security, which addresses program organization, staffing needs, policy and program

operations, and security and telecommunications technical infrastructure. When fully enacted our plan will align USDA security

practices with those of leading organizations.

Our recent focus primarily has been upon building upon the competency and skill of our security staff. We are extremely fortunate

working with the Secretary to establish the first Associate Chief Information Officer for Cybersecurity at the Department of Agriculture and able to select a senior level executive, Mr. William

Hadesty, formerly with the Internal Revenue Service, as our first

185

CIO for Cybersecurity. With the recent addition of Mr. Hadesty, we

have already started to implement the priority actions in our action

plan. The Congress provided a $500,000 budget increase for the Office

of the Chief Information Officer for security in fiscal year 2000.

With these funds and existing resources, we are assembling a wellqualified staff of security experts to lead the Department’s efforts.

Since joining with us in February 2000, the Associate CIO for

Cybersecurity has carefully analyzed and made adjustments to our

ongoing program. In addition, our most critical information resources, including the National Information Technology Center in

Kansas City and the National Finance Center in New Orleans,

have been or are now undergoing critical review. We recognize,

though, that we still have a long way to go.

The Office of the Chief Information Officer’s fiscal year 2001

budget request included an increase in funding for cybersecurity of

approximately $6.5 million. If enacted as requested, our security

budget will provide the resources to complete the development of

a USDA risk management program, continue to expand our

cybersecurity office, increase our capacity to conduct onsite reviews,

and provide training and hands-on assistance to augment the skills

of our agency’s security staff. Additionally our project plans call for

a major effort in 2001 to further define requirements for a security

architecture and begin its redesign and implementation.

In fiscal year 2002, we will continue to develop and implement

our USDA-wide computer security program. The information survivability program and the sensitive systems certification program

we plan to establish will complete USDA’s computer security umbrella.

Mr. Chairman, we believe that fulfillment of our cybersecurity

action plan will position the Department to comply with Federal

computer security guidelines and best management practices. The

reality is, though, that until our computer security program is fully

funded, we will remain much too vulnerable.

I appreciate the opportunity to speak to the committee. I look

forward to being able to answer any questions you may have.

Mr. HORN. Thank you very much, Mr. Hobbs.

[The prepared statement of Mr. Hobbs follows:]

186

187

188

189

190

191

192

193

Mr. HORN. Our next presenter is Mark A. Tanner, Information

Resources Manager, Federal Bureau of Investigation, Department

of Justice.

Mr. Tanner.

STATEMENT OF MARK A. TANNER, INFORMATION RESOURCES

MANAGER, FEDERAL BUREAU OF INVESTIGATION, DEPARTMENT OF JUSTICE

Mr. TANNER. Good morning, Mr. Chairman, Mr. Turner and

other members of the audience. I thank you for inviting us here to

discuss computer security at the FBI. The FBI shares your conviction that computer security is a vital concern. That concern is

manifested in a variety of levels: First, the concern within the FBI

as to how the FBI collects and handles sensitive personal information; the concern as a member of the U.S. intelligence community

where there is a growing awareness and desire to achieve a collaborative sharing of intelligence information while at the same time

securing highly sensitive and classified sources and techniques; the

concern as a member of the law enforcement community often

called upon to investigate, identify and apprehend those responsible for hacking into government systems and critical infrastructures of this Nation; and the concern as a Federal law enforcement

agency called upon to investigate computer and computer-related

crimes as diverse as a pedophile seeking to prey on a youngster,

Internet fraud crimes which victimize all elements of our society,

including persons and businesses, and those who would seek to enrich themselves by manipulating stock prices.

The FBI’s internal computer policies and practices present a

somewhat unusual picture as far as Federal agencies are concerned. The FBI is, as I have stated, an agency charged with investigating many computer-related crimes and it is charged with the

conduct of all counterintelligence activities in the United States.

In addition, the FBI operates several systems on which State and

local law enforcement agencies have come to rely as a necessity. As

such, the FBI must operate both classified and unclassified systems, and many of those unclassified systems have strong requirements for the protection of personal data about American citizens

as well as a need to maintain instant availability.

In addition, the nature of some of these, some of these systems

presents special requirements in that the data represents information gathered through a variety of methods, each requiring its own

specialized method of handling and protecting the information.

These methods includes Federal grand jury subpoenas which are

subject to the requirements of rule 6(e) of the Federal Rules of

Criminal Procedure, material identified as Federal taxpayer information, and thus, subject to specialized handling and disclosure requirements, as well as other many other specialized requirements.

Of course, the specific requirements of classified information such

as that obtained as a result of title 50, the Foreign Intelligence

Surveillance Act, activities or by other intelligence community

agencies, which must be respected.

To accomplish these tasks, the FBI operates 35 general support

systems and 12 major applications; 24 of the 35 general support

systems are classified and 6 of the 12 major applications are classiVerDate 11-MAY-2000 09:45 Sep 24, 2001 Jkt 000000 PO 00000 Frm 00197 Fmt 6633 Sfmt 6633 C:\DOCS\74495.TXT HGOVREF1 PsN: HGOVREF1
194

fied. In other words, the FBI operates 30 national security systems.

It should be noted that the vast majority of the FBI’s classified systems are currently internal systems and thus do not have external

connections to nonsecure or unclassified systems.

The FBI’s information systems security policy is codified in our

Manual of Investigative Operations, section 35. A copy of this policy has previously been provided to this subcommittee. The policy

is a compilation of requirements which are outlined in section 35– 11 of this policy. In general, let me state that because of the variety of types of systems used by the FBI, our practice, where practical, involves using a hierarchical approach to any requirement

from these sources based on the selective system’s criticality and

risks. This is to avoid any possible confusion as to whether or not

a system should follow this or that set of rules and regulations. To

choose any other course of action would be folly.

The FBI’s policy is coordinated with the Information Systems Security Unit which is a part of our National Security Division. The

security unit works closely with the Department of Justice entities

which oversee classified and unclassified computer systems. In addition, they maintain a good working relationship with the national

entities responsible for computer security policy, such as the

NSTISSC and NIST and the Security Policy Board to ensure that

the latest information is available.

There are many challenges which face the FBI in today’s computerized world. One of the biggest challenges involves the rapidly

changing environment and the rapidly changing world in which we

all live. New technologies are moving into the marketplace at a frenetic pace; old technologies are undergoing metamorphosis. Each of

these new products presents particular problems and a careful and

thoughtful analysis to ensure that the FBI continues to maintain

a policy which recognizes the business needs of the computerized

world and still providing meaningful security practice.

The FBI is practicing risk management approach in its certification and accreditation of all computer system security. As I previously noted, most systems are internal and not connected to nonsecure unclassified systems. This isolation provides some sense of

comfort in that these systems are not connected to the outside and

far less vulnerable to compromise and attack. In this manner, our

approach has been to identify both systems which pose the largest

risk in terms of their data and sensitivity of the data. These systems are approached before systems which play a lesser role in either their data or sensitivity. The FBI is currently engaged in a series of activities which will hopefully lead to the speedy completion

of the certification and accreditations. Resources have been on loan

from the Department of Justice as well as other intelligence community under the ICAP program.

The FBI has undertaken a—an effort to make system owners

cognizant of system security requirements in their initial and lifecycle development of plans for systems, in that way ensuring that

systems security is built into all systems and that the continuing

costs are specifically identified as a separate line in each proposal.

In conclusion, let me just reiterate that the FBI appreciates the

interest of this subcommittee, indeed the interests of all parts of

Congress in this area where we share your interests and concern.

195

Our efforts will continue to ensure that all systems, including those

of the FBI, meet the expectations of the American public to appropriately protect that information which must be protected. The FBI

respects the trust placed in it by the American public and the Congress and will do the utmost to maintain that trust.

Thank you.

[The prepared statement of Mr. Tanner follows:]

196

197

198

199

200

201

Mr. HORN. Well, thank you Mr. Tanner. We appreciate very

much what the FBI has done in tracking down a lot of these hackers, and some I believe are in Federal prison now. So we thank you

for that effort, and I think you were very on top of the situation

in the Philippines when that occurred.

Our last presenter before questions is Solveig Singleton, Director

of Information Studies for the CATO Institute. Am I correct to say

the CATO Institute would be called a libertarian-based institute?

Ms. SINGLETON. Yes.

Mr. HORN. OK. Ms. Singleton, it’s all yours for 5 minutes.

STATEMENT OF SOLVEIG SINGLETON, DIRECTOR OF

INFORMATION STUDIES FOR THE CATO INSTITUTE

Ms. SINGLETON. Thank you, Mr. Chairman. My testimony today

is going to offer examples of some of the types of data bases maintained by Federal agencies and offer a big-picture perspective on

the significance of any security problems within those data bases.

With the power to command, powers of arrest, police, courts and

armies, the government has powers that the private sector lacks.

You can hang up on an annoying telemarketer but it’s hard to hang

up on the IRS. Recognizing that in the Constitution we have the

fourth amendment which limits the means by which government

may collect information and we also had the idea originally of a

government of relatively limited powers, and inherently a government of more limited power has less need for hundreds and hundreds of data bases than a government of broader powers.

Now, for better or for worse, we have drifted away from this concept of limited government, and there’s a natural consequence. The

amount of detailed information about private citizens in Federal

files has grown by leaps and bounds.

To underscore the importance of keeping this information secure,

I will offer an overview of the types of information that are held

by Federal agencies.

Essentially, Federal agencies collect an enormous array of information. The Federal Government will inexorably record, obviously,

your name, your address, your income, but also your race, details

of how you spend your money, your employer, updated quarterly,

whether you’ve asked for information from government agencies,

student records, whether your banker thinks you’ve engaged in any

suspicious activities like making an unusually large withdrawal or

deposit, and finally, of course, a surprising number of agencies hold

different types of medical records and not simply Health and

Human Services.

I am going to run down some of the departments that we looked

at very quickly and offer a very small number of examples of the

type of information that they hold. Let me start with the Commerce Department.

One file maintained by this Department keeps individual and

household statistical surveys which include individual’s names,

age, birth date, place of birth, sex, race, home business phone and

address, family size and composition, patterns of product use, drug

sensitivity data, medical, dental, and physical history and other information as they consider necessary.

202

The Department of Education has the national student loan data

system and, among other items, a registry of deaf-blind children

nationwide.

The Department of Energy maintains, among some very sensitive

counterintelligence data bases, records of human radiation experiments.

The Federal Bureau of Investigation, obviously, is home to the

FBI central records system, alien address reports, witness security

files and information on debt collection and parole records.

The Department of Health and Human Services has massive

quantities of medical record information, filling hundreds of data

bases. Some of these data bases include the personal Medicaid data

system and the national claims history billing and collection master records system.

Next comes the Department of Housing and Urban Development.

Now, this agency is perhaps best known among privacy advocates

over the last few years, urging that residents of Federal housing

agree to warrantless searches of their apartments in their lease

agreements. This agency holds data such as single family research

files, income certification evaluation data, and tenant eligibility

verification files.

The Department of Labor has a lot of data bases including a data

base with information on applicant race and national origin,

records from the workers’ compensation system and records from

the national longitudinal survey of youth, which is a longterm

study of certain individuals as they grew up over the past few decades.

Obviously the Social Security information collects information on

lifetime earnings, as well as information related to insurance and

health care and census data. What may be less well known is the

extent to which they share and match information with Health and

Human Services, the IRS, and other agencies. So, for example, one

data base at the Social Security Administration is—matches Internal Revenue Service and Social Security Administration data with

census survey data and records of Cuban and Indo-Chinese refugees.

The Department of Treasury, last but not least, holds a financing

data base which contains millions of reports of banking activities

of privately named U.S. citizens. They have also got the national

data base of new hires, which holds records of the income and employment of every working American, updated quarterly.

Now, to sum up, I don’t want to suggest that all this data is part

of some kind of sinister plot and we should all go around wearing

tinfoil hats on our head, nor do I want to denigrate the well-intentioned efforts that have been made to make many of these data

bases more secure, but what I would like to point out is that the

growth of these data bases makes security and the need for internal controls against unauthorized use by government employees a

systemic problem rather than an occasional problem, and it generally—the growth of these data bases threatens to shift the balance of power between individuals and the Federal Government. So

this really is a systemic issue and it will be become more and more

acute as we move away from a vision of limited government and

203

want the government to be involved more and more in our day-today lives.

Thank you.

[The prepared statement of Ms. Singleton follows:]

204

205

206

207

208

209

210

211

212

213

214

Mr. HORN. We thank you and now begin the questioning. What

we’ll do is alternate the questioning, 5 minutes for myself and 5

minutes for the ranking member and back and forth until we get

the questions out of our system.

I’m going to start with the Department of Agriculture. As I recall

in your statement, Agriculture repelled 250 hacker attacks. Were

any of these successful attacks, Mr. Hobbs, and if so what kind of

damage was done?

Mr. HOBBS. In some instances, Mr. Chairman, the attacks were

successful. They resulted in things like changes to Web pages. We

report all of our intrusions. Some of them like changes to Web

pages. We were able to identify where people had been able to access systems, but in no instance were there any major or significant damages done. In most instances we’ve taken the necessary

steps to shut down what we consider to be backdoor ways that people were getting into the systems, and are trying to be more vigilant in our monitoring and tracking of those activities and those

kinds of concerns.

Mr. HORN. On the Agriculture, you completed the security questionnaire and it states the Department doesn’t really feel that the

system accreditation is important. A lot of other agencies feel the

system accreditation, where possible, is important. Why isn’t accreditation that important to the Department of Agriculture?

Mr. HOBBS. I don’t think that we said that it was not important.

I believe that what we are doing is we have a prioritized program

that we are working toward completion of, with systems accreditation being a part of that. So I don’t think we said it was unimportant. I think what we said is we have a prioritized effect—direction

in terms of which we’re trying to proceed, and that we’re moving

with deliberate speed in that sense of looking at all aspects and all

phases of our security program.

Mr. HORN. Well let me ask Mr. Willemssen, on behalf of the General Accounting Office, as I understand, system accreditation is a

formal management process to test and accept the adequacy of the

system’s security before putting it into operations. So how important is it to an agency’s security computer programs that they’re

accredited; and could you explain that process and why most of the

Departments are doing that where they can?

Mr. WILLEMSSEN. We believe system accreditation is especially

critical, and it represents management’s judgment that they have

gone in, made an assessment of the risk of a particular system and

the associated data; that given the risk associated with the system

and data, appropriate controls have been put in place to fend off

any attacks that may occur, and that management is therefore

making a declaration that the appropriate controls are there to deflect or at least be aware of any such attacks that may happen. We

think it’s especially important. Most agencies agree. We do see at

times differences in nomenclature. Some agencies may actually be

doing something similar to accreditation but may call it something

else.

Mr. HORN. Moving to the Department of Labor, Mr. Hugler, as

I looked at the information, the computer security questionnaire indicated weaknesses in all six general control areas and the weaknesses were confirmed by the Inspector General’s audit results. So

215

I’m curious, what does the Department consider to be its most critical weaknesses?

Mr. HUGLER. Well, Mr. Chairman, I think you’re correct to state

what the Inspector General found last year and they did find weaknesses in all six areas. I think what’s important to recognize is that

we have now addressed all of those issues, and in fact the Inspector

General’s audit findings, as I recall, acknowledged that if we did

two important things, one is put out the rules for the Department’s

computer security and put out the rules for the Department, in

terms of systems development and life-cycle criterion rules, if we

did those two things, that we would have addressed all six of the

categories with which they found issues.

We have done that and, more importantly I think, we have gone

ahead aggressively with implementing those rules. And the example, I would cite to you, is our experience with the I-love-you virus.

We have incident response procedures now in place at the Department. We had some 33,000 attacks from that virus. A small number of computers, 243 as I recall, were infected. I think the most— the best measure of our response, however, was the fact that we

notified our employees of that virus and what to do with it 3 hours

in advance of the official Federal notification.

So I would commend your attention to that as an example of the

kind of things we’ve been able to do over the last year. So really

the OIG’s findings from last year are just that, a year old, and we

have improved dramatically since then.

Mr. HORN. And so you would say the corrective action for these

has been completed?

Mr. HUGLER. Yes, sir. At the Department level we have done

that and I am very comfortable with that.

Mr. HORN. I now yield 5 minutes to the gentleman from Texas,

Mr. Turner.

Mr. TURNER. Thank you, Mr. Chairman. As I listen to each of

you who come from your respective agencies, it causes me to come

back to a comment Mr. Gilligan made about the importance of

cross-government initiatives. As many of you know, I have been an

advocate of having a Federal CIO, a chief CIO for the Nation,

someone who had the expertise, the competence, the leadership

role, as well as the budgetary support necessary to be sure that we

can have stronger cross-government initiatives in the area of information technology and certainly in the area of computer security.

And I think I’d like to ask you, Mr. Gilligan, to expand upon your

assessment of the need for these cross-government initiatives, and

I would be interested in your insight on it, because not having

nearly the expertise in the area that you do nor the experience in

the area, I still am left, after hearing all this testimony, with the

conviction that the area of information technology certainly provides the potential for the expenditure of vast sums of Federal dollars in a very inefficient way. And I would be interested in your

comments on the idea of more emphasis on cross-governmental initiatives and what kind of leadership might be necessary to ensure

that happens.

Mr. GILLIGAN. Mr. Turner, I’d be happy to comment. What I have

found in my activities in the CIO Council is that the potential that

you allude to for enormous sufficiencies as a result of cross-governVerDate 11-MAY-2000 09:45 Sep 24, 2001 Jkt 000000 PO 00000 Frm 00219 Fmt 6633 Sfmt 6633 C:\DOCS\74495.TXT HGOVREF1 PsN: HGOVREF1
216

ment IT efforts is there, but that potential is difficult to realize because our fundamental government structures in the executive

branch and in the legislative branch tend to be stovepipe-oriented

on particular agencies and particular missions, and in fact, what

I have found is the most difficult efforts to get support for are

cross-government initiatives. And relatively small sums of money

that would have enormous benefits often fall through the cracks because there is no clear forum for advocacy. And individual committees, whether they be in the executive or the legislative branch,

tend to be very narrowly focused on that portfolio to which they’re

assigned responsibility.

In my testimony, I noted our best security practices effort. This

is an effort that is enormously compelling. The objective is to pull

together best security practices from across the Federal Government, provide a Web repository where they can be accessed easily,

and to share this wealth of experience that we have across the government.

We have found that getting small sums, hundreds of thousands

of dollars for this initiative, is very difficult, and it’s not that the

effort is not supported. It is supported. And when I talk to members in the administration and Members of Congress, it is supported. But the question is, ‘‘who should pay for it and where

should that funding come from?’’ The Federal incident response capability, FedCIRC, which is our

government’s central point for disseminating information on viruses and patch updates, is funded through a set of committees. It

is sponsored by Department of Defense, the FBI and GSA. We have

found in the recent remarks that the report has not been strong,

and again I don’t think it’s because the merits of this effort are not

supported in general. It’s that there is no central focus that helps

bring this together and to help identify that these individual, relatively small dollar items in individual budgets, are in fact of far

greater importance than their small dollars would indicate.

And so I think as you suggest, this is an area where we desperately need to focus attention. I think not only in the security

area will it help us improve security, but we can far better leverage

the enormous resources that we do have in attacking a whole range

of information technology issues.

Mr. TURNER. Thank you.

Mr. Spotila, I know you have worked in this area, and one of

your duties at OMB is to try to be sure that we move toward the

kind of things Mr. Gilligan is talking about. I know there is a Presidential directive that established two tiers of agencies. It strikes

me, and you might want to explain that a little bit, but it strikes

me that it is certainly appropriate to acknowledge that the importance of computer security may vary from agency to agency, and

that when we try to focus our resources, perhaps we should choose

certain agencies over another. If we did that, we would expect to

see different grades from the agencies because we would have

made a choice regarding where to place the initial dollars to improve security. But describe for us a little bit that Presidential directive that established those first, those two tiers.

Mr. SPOTILA. Yes, Mr. Turner. First of all, let me just mention

that OMB has been very supportive, as I’ve testified to the commitVerDate 11-MAY-2000 09:45 Sep 24, 2001 Jkt 000000 PO 00000 Frm 00220 Fmt 6633 Sfmt 6633 C:\DOCS\74495.TXT HGOVREF1 PsN: HGOVREF1
217

tee before, of these cross-cutting initiatives. We share Mr.

Gilligan’s belief that these are very important, that they would

make a great deal of difference, and that they do need support.

The President, in May 1998, put out a Presidential Decision Directive aimed at critical infrastructure protection. It was at that

time that he designated Mr. Richard Clark as his adviser on

counterterrorism. He’s worked with the committee and has been

very active. The Critical Infrastructure Assurance Office was then

established.

What we have tried to do in the administration is to prioritize

in this area. I mentioned in my testimony that OMB’s focus has

been on the same 43 high-impact programs that we focused on during the Y2K effort. We have more than 26,000 systems in the government. If we’re going to enhance our ability to serve the American people by promoting effective information security, we need to

prioritize. We need to start with the areas that have the greatest

impact, whether they be agency by agency, or, more accurately,

within agencies, program by program, system by system.

The Critical Infrastructure Assurance Office has tried to zero in

on those areas, those agencies, and those aspects within agencies

that have the greatest importance and perhaps would be at risk

the most. We’ve tried to work at OMB at focusing on the programs

that we think have the greatest impact on the American people; as

I’d mentioned, Medicare, Medicaid and the like. We think that we

have to begin with the most important things. That’s where we’re

going to have the most significant improvement and have the most

significant benefit, which is not to say that we ignore all the other

areas. We put out general guidance. We’re working with the agencies. We’re relying on the agencies to try to improve their efforts

in this regard across the board.

But in terms of White House attention, we’re obviously starting

with the things that matter the most.

Mr. TURNER. Thank you.

Mr. HORN. Let me add to that the following. This is the last

month of a fiscal year. This is the time Cabinet officers, deputy secretaries, assistant secretaries, all of them sit around and say, what

can we do with the surplus we have in our budget? And having

been in administration, I know exactly what they do, and this is

the time, if they’re serious about this, to reprogram some of that

money into what everybody’s saying, oh, we’ve got to have new

money. That isn’t the way we started with Y2K. We started when

I urged a lot of the people to start reprogramming.

When Dr. Raines came in as budget director, he said, You’re absolutely right, and that’s what I’m going to tell them. And he did,

and that’s how we got the job done. We also made sure Congress

provided the money. But if they’re serious in these various executive branch agencies, this is the time to get a few million here and

there.

And then besides that, let’s just talk about a few simple steps

such as policies requiring regular changing of passwords, safeguarding equipment, turning off computers. That doesn’t cost a

thing. That just costs doing it, if any. And I guess I would ask, because energy has certainly been in the papers for the last 2 years

218

on this, but I’d ask, is there in OMB the concern about policies to

just get those basic areas done?

Mr. SPOTILA. Let me respond in a couple of respects.

First of all, I agree with you, Mr. Chairman, that some agencies

are going to have discretionary funds available this September. We

would certainly hope that they would apply them to this area. I

know that the various CIOs at this table and others around government are going to do all they can to try to impress that upon their

agency heads. So I think that we do need to be serious; just as all

of us need to be serious, the executive and the legislative branch,

because this is a really important area.

We have a lot of policy out there, even things that you mentioned

about passwords, changing passwords and the like. The key is getting people to implement and follow the policy that may be out

there. One of the things I emphasized in my testimony today and

in my written testimony is that, in order to have effective security,

it is essential that nonsecurity people buy in, that they participate,

that they understand the significance and that they buy into it. Because we can have all the policies in the world and we can have

all the centralized supervision in the world, but if that person at

the desk doesn’t follow it, it doesn’t do any good.

You know, we tell the story about having very complex passwords that people write on little yellow sticky notes and paste to

their computer screen. You can’t have effective security without cooperation at all levels, and it’s a message that we’re trying to impart throughout the government. I think it will be an ongoing challenge to continue to do that.

Mr. HORN. I thank you very much.

Let me ask Mr. Dyer, who’s got the B grade, the social security

system, there is—apparently you’re farther along than most other

agencies now. Do you have a best practices that others might implement and what are they?

Mr. DYER. Mr. Chair, I think it’s just like when we approached

Y2K. Early on we saw it coming, and we institutionalized the process, the resources to deal with it. And we’ve done the same thing

with security. It’s part of our life cycle with our programs. Anytime

we think about bringing up a new system, we look at the security

aspects. Any modification to any system, we check the security all

the way through and how it could roll over into other security systems.

I pick up on what GAO said and what John Spotila said. The biggest challenge we’re finding is managing it. You can have good procedures, policies, rules in place, but you constantly have to be

working with your managers, your employees that they follow

them, and that’s where we’ve been putting a tremendous amount

of our effort.

We’ve had conferences across the country. We’ve set up centers

so that we’re able to make sure that we have people in place that

are doing the dogging and checking it. We change passwords every

month now. We found that it just didn’t happen the way it should.

So we have instituted it. We’re going through. We found out that

they change the passwords to something they could remember. We

now have software to check to see if it’s dates of birth or names

219

of family members or whatnot so you can start to screen those

things out.

So, to me, it’s a constant management challenge. You can do the

systems, but you’ve got be there, right there on top of it all the

time.

Mr. HORN. In my 26 seconds remaining, Mr. Willemssen, anything you want to add to that as to what might be done that isn’t

being done?

Mr. WILLEMSSEN. One thing that I would add, Mr. Chairman— and it somewhat extending off of Mr. Spotila’s comment—and that

is, it’s one thing for agencies to have the policies and procedures

which I think in many cases they do. It’s quite another to see

whether the accompanying practices have actually been put in

place.

That’s been particularly the case when we and Inspectors General go out and we test whether these policies and procedures are

actually being implemented. They often have not been. And that

really is a key distinction I think often between what the agencies

believe is going on and what may actually be happening, although

I think there is clearly many of the agencies are on the road for

improvement in that direction, also.

Mr. HORN. I now yield 5 minutes to the gentleman from Texas,

Mr. Turner.

Mr. TURNER. Thank you, Mr. Chairman.

The designation of the Presidential directive—is it tier 1, tier 2,

phase 1, phase 2, whatever it’s called—I’m curious as to what kind

of impact that has and how is that designation significant; and I’d

like, Mr. Hugler, if you would, to comment on that because I know

Department of Labor is a tier 2 designation.

Mr. HUGLER. Yes, sir. Thank you, Mr. Turner.

It is an important distinction, because it is important to recognize that some agencies handle more sensitive information and

have more sensitive systems than others do. We certainly believe

that our mission is important to American workers, but, frankly,

we do not have critical information that directly implicates national

security. So, as such, if we are going to prioritize funding and implementation priorities, I think it is appropriate for the Department of Labor to be a phase 2 agency or tier 2 agency.

I think it’s also important to note, though, that we take those responsibilities as a tier 2 agency as important and that we meet

them and we are on target to meet all the milestones for which we

are accountable.

Mr. TURNER. Mr. Spotila, when you think about funding for these

various agencies to be sure they move forward in the area of computer security, do you make budgetary recommendations based on

this phase 1, phase 2 designation?

Mr. SPOTILA. What we do in the first instance is to actually have

the agencies themselves come to OMB with their own determinations as to what they’d like to accomplish and what they feel they

need in the information security area. They do so within their overall budget submissions when they go through the OMB review

process.

With the guidance that OMB put out earlier this year, focusing

on the next budget year, we’ve made it very clear that information

220

security needs to be part of that agency initial analysis. It needs

to be integrated within the entire area of information technology

planning for budget purposes because we don’t believe that doing

it as an add-on is effective at all.

Within the budget review process, obviously if an agency is a

higher priority, if the need is greater, that will be recognized in the

process. Very often, the budget issues turn more on whether or not

the proposal has been well thought out, whether it is likely to be

a good use of money and a good expenditure of money and one that

is likely to contribute not only to increased security but the agency’s performance of its mission. Those are the kinds of factors that

OMB takes into account, just as later on the Congress will take

that into account.

And your comment earlier about the risk, that money could be

wasted in this area, is also something that we take very seriously.

You can’t just fund a proposal because it sounds good or because

the agency is an important agency or the area is an important

area. You have to make certain that the proposal will work, that

it will contribute something that will add value and will involve

money well spent. And so this analysis is actually a very comprehensive and thorough one.

We think in the next budget cycle we’re going to get better submissions from the agencies. We’ve been working with the agencies

directly one on one to get them to understand the change. We’re

expecting that in the IT area we are going to receive budget submissions that are better thought out and that will have better justifications.

Mr. TURNER. Mr. Gilligan made a strong case for greater emphasis on cross-agency initiatives. What has OMB done to promote

greater cross-agency efforts?

Mr. SPOTILA. We’ve actually been doing a variety of things. We’ve

worked closely with the CIO council, which I’ve chaired since last

year until their DDM was confirmed. We’ve worked closely with

John and his committee in that regard trying to identify areas.

We’ve worked closely with Dick Clark and the Critical Infrastructure Assurance Office and the national security community and

with others throughout OMB and the agencies trying to identify

areas where crosscutting initiatives would help.

John mentioned public infrastructure which would enable us to

authenticate signatures. We think that’s an important area. We

know we need better intrusion detection capability. We think we

need expert review teams that can get out onsite in the various

agencies and help them not only assess security but try to improve

their efforts in security. We think we need more efforts in the R&D

area. We need scholarships for people to start learning this area so

that the Federal Government can get the kind of personnel it needs

with the kind of experience and educational background it needs to

work in this area over the long term.

So we have tried to identify areas of need, working closely with

all these other parties, and then within the budget process we’ve

actually given it a huge amount of support to try to help develop

proposals that make sense, that will have credibility with the Congress, that will work once implemented.

221

I think that the reality is we do start with a stovepipe approach.

We all need to think outside of the box. We need to make certain

that, as we do crosscutting initiatives, that they work so that we

can buildup credibility and support for further efforts in the future.

That’s something we take very seriously, and I think that will be

an ever-growing need in the future.

Mr. TURNER. How many dollars have you expended on crossagency initiatives and how many of them have been accomplished?

Mr. SPOTILA. Well, I think the reality is that in the past, as John

has said, when there have been efforts like crosscutting initiatives,

for example, support of the CIO Council and its efforts, we’ve done

that by what John indicates is passing the hat. Under the ClingerCohen Act, we have some ability to do that, to have agencies contribute toward support of crosscutting measures.

The President’s budget, as I outlined in my testimony, not only

includes an increase for computer security in general, but it highlights crosscutting initiatives that we think are very important.

John mentioned that for $50 million an awful lot can be accomplished. I think the President’s request is actually greater than

that in this area because we’re also focusing on research and development and on cyberscholarships and the like. Still, we’re looking at a relatively small amount of money. $150 million would make

a huge impact in this area. The key is to get it appropriated.

And so when we talk about past crosscutting initiatives it’s hard

to track because we haven’t had the kind of appropriations in large

numbers that we’re talking about here. We have used relatively

small amounts of money to support the CIO Council and some

other developmental areas along these lines. The GITS Board, for

example, worked on the PKI—public key infrastructure— issue for

some time. The Board has now been rolled into the CIO Council.

We’ve identified a need to do much more of this going forward. I

think the key now will be to see what happens in the appropriations process this fall.

Mr. TURNER. You’ve requested how many dollars for cross-agency

initiatives?

Mr. SPOTILA. We have a list in my testimony that I can just mention, highlight real quickly.

Mr. TURNER. Where would that be found?

Mr. SPOTILA. In my written testimony?

Mr. TURNER. I mean in the budget itself. Is it appropriations in

OMB? Is that where the money would reside currently?

Mr. SPOTILA. No. Actually, although these are crosscutting initiatives in the budget, they appear in the departmental submissions.

So, for example, the Department of Commerce is seeking $5 million

for NIST to establish an expert security review team that can then

go to agencies, to a number of different agencies outside of Commerce. That’s an example. When we talk about crosscutting initiatives, because of the nature of the appropriations process, it needs

to appear in an individual agency’s budget. Part of the difficulty

is—not to single out Commerce—if that particular appropriations

committee or subcommittee doesn’t think it a priority, that an expert security review team at Commerce will be helping 25 other

agencies, they might give it less support. That’s where the difficulty comes in the budget process.

222

So all of these so-called crosscutting initiatives still appear in individual agency budget submissions.

Mr. TURNER. I think that’s one of the things that I have concern

about, that perhaps we need some central location, some leadership

for this that would flow through our Federal CIOs to be sure that

these things happen. Because I think what you’re left with, even

after you secure the appropriations agency by agency, you’re still

in the pass-the-hat mode, which I think is one of the problems that

we perhaps face in the area that we are discussing.

Thank you, Mr. Chairman. I know my time’s expired.

Mr. HORN. Thank you.

Let me followup on that again. There’s obviously a concern when

you have these cross—the boundaries, if you will, initiatives. Now,

can—on reprogramming, you know, $5 million, that’s chicken feed

to any agency. They have got the—they can reprogram that.

So you don’t really need to worry too much. But you’re right. If

they’re trying to help four or five other agencies, the appropriations

and authorizers here might say, hey, not on my beat, put them

somewhere else. So—but, hopefully, that’s why OMB is there, to

sort of help straighten it out.

I am not going to embarrass any of the CIOs here, the chief information officers, but have the secretaries and heads of the agencies within the executive branch been responsive to the efforts to

strengthen computer security? And I just—perhaps Mr. Gilligan on

behalf of the CIO Council, Chief Information Council, do you get

a feeling in those meetings that some of them just—these are not,

obviously, here. They’re other places. But do you get a feeling that

they’re not getting good backing from the top executives in the

agency?

Mr. GILLIGAN. It’s my clear sense that the senior executives

across the agencies are getting the message. It’s a complex issue,

and I think the difficulty, as I addressed in my testimony, is understanding both that cybersecurity is important, and understanding

what to do about it are two different things, and I think that’s, in

many cases, where agencies are stuck. It is not an issue that can

be delegated down. It has to be undertaken and aggressive leadership has to be provided by senior management, as we found with

Y2K.

So I reiterate, I think the actions of the senior levels of the administration, and of this committee and others are going to be important in helping to get that message across. While there are complex technical issues that equate to rocket science, there is a foundation that must be built that is just good sound management

practice that requires aggressive involvement at the senior levels.

Mr. HORN. Let me move to another question, that when we had

this discussion a few minutes ago on the libertarian suggestions,

what message do the grades that we have given you send to the

American people regarding the security of the citizens’ personal information? Should we have a special category in that as to how

that’s dealt with in an agency and on those files that such as the

census and others are the obvious one over in Commerce? Should

we have a category as to how high in the agenda and hierarchy of

things to be done that you first protect the information of the

American citizen from getting out for people making use of those

223

data and, therefore, perhaps as we’ve seen what’s happened in

credit card operations is some of these idiots take exactly the whole

name and number and all the rest of it, and the result is that those

poor souls can never get a loan again because somebody’s running

around the country with their credit card. Well, isn’t that also true

in some of the agencies here? What do you think, Mr. Spotila?

Mr. SPOTILA. Well, let me start by saying that we take very seriously the importance of preserving the confidentiality of information that the government holds. As we’ve been discussing throughout this morning, we recognize that, although a lot of progress has

been made, we are not done. We cannot afford to be complacent because the challenge in this area is a dynamic one. The threat

changes; new technology, new threats can appear. And so, on a

day-by-day basis, we need to continue to do the best we can and

to improve our efforts.

Without getting into the grades themselves, we all agree here

that there is room for improvement. I’m perhaps more sanguine in

the sense that I think that the information that we’re talking about

here is not at great risk. I think the agencies are very careful about

protecting that information, as John Dyer indicated at Social Security. They take it very seriously and realize the importance of it.

This is not to say that we’re complacent. A new threat could

emerge tomorrow that hasn’t been anticipated, and a part of what

you need in the security area is the ability to detect intrusions and

to react to them and to correct problems when they surface.

So I would say to the American people that we take security very

seriously and that we all need to work together on behalf of the

American people in this area.

Mr. HORN. Mr. Willemssen, you’ve looked at a lot of agencies

over the years. What is your answer to that question and how worried should the American people be about this situation?

Mr. WILLEMSSEN. Well, I think—point one, Mr. Chairman, I

think it’s imperative to point out that absolute protection is not

possible, and so we’ve got to look at this from a risk perspective.

And in doing those risk assessments, the higher the sensitivity of

systems and data, then the more rigid and tight the controls need

to be and agencies need to make that up-front judgment on how

much risk for particular systems and data they’re willing to accept

and, given that acceptance of risk, then put in the appropriate controls.

And I think in many cases we still have agencies who haven’t

done the in-depth risk assessments of systems and data in order

to come to those judgments because not all systems and data are

created equal. There has to be some judgments up front on what

we absolutely have to protect as best as possible, again recognizing

that there is no absolute as it pertains to protection but that we

can narrow the margin significantly.

Mr. HORN. Ms. Singleton, would you like to get your licks in,

shall we say?

Ms. SINGLETON. I’d like to offer one additional comment along

those lines, which is to say that part of the problem that I think

the American people might perceive with this system as a whole

is that in the private sector if you leak a document—say you work

in a law firm and you leak a document about a client. The law firm

224

stands a good chance of losing its client and you stand a good

chance of losing your job. But there’s a greater perception I think

on the part of the American people—and partly it’s correct that, in

a Federal Government agency, if there’s a leak or a mistake or an

error, that there will be relatively lesser consequences for the agency as a whole and for the employee of that agency than there would

be in the private sector.

For example, if somebody in the agency does lose your file or give

it to the wrong person, you still have to deal with that agency. You

can’t go to say another Department of Agriculture or another Department of Labor and find a, you know, better security practice

there. So I think that also goes to the issue of some of the expense

involved, is that it would be very helpful for the perception of the

American people to have an understanding that if these policies are

violated that there will be real consequences for the agency and for

the employees involved.

Mr. HORN. Well, we thank you on that.

I’m going to have a few closing words, and I want to thank the

staff and tell you what we’re doing tomorrow here.

It’s clear that a great deal of attention must be focused on this

vital issue. There’s a lot of computer security policy out there, but

it isn’t necessarily being followed by some agencies and others. And

when we look at all of the State governments you’ve got another

matter there in terms of privacy. What does it take, legislation?

You can be assured if it does we will continue to monitor the government’s progress in this area.

This report card sets a baseline for the future oversight. It also

is a wake-up call for Federal departments and agencies to begin

taking the necessary steps to ensure that the sensitive information

contained in the computers will be protected.

Tomorrow at 10 a.m. the subcommittee will hold a related hearing to examine two proposals that would establish the position of

a Federal chief information officer. The gentleman from Texas has

proposed that. Among other responsibilities, this governmentwide

position would be responsible for the government’s computer security efforts, and that’s one approach, and that’s in essence what we

asked the President to do in the summer of 1997, was get somebody to put them in charge.

Now, they didn’t move for about a year, but when they did move

that was exactly what was needed to get the coordination, somebody to be assistant to the President as Mr. Constant was when

he was brought back into government, and he did a very fine job

of pulling all the pieces together. Because I would ask, has the

President brought this up at a Cabinet meeting?

And, Mr. Spotila, I don’t know if you know the answer to that,

but in the Eisenhower administration, that thing would have been

up there 10 years before. That’s what Social Security was under

the Y2K. They were on their own. There was no administration.

They went through three of them in that period that didn’t really

face up to it until the bells were really ringing.

So that’s one of our concerns. But I think the next round we’ll

have a better feel for how accurately and diligently the agencies

are doing it.

225

I want to thank each of these witnesses today, and I want to

thank the staff on both the minority and majority: J. Russell

George, staff director, chief counsel of the subcommittee; Randy

Kaplan, counsel; on my left, your right, Ben Ritt, professional staff

member on loan from the GAO and the one that has had a lot of

effort on putting this particular hearing together; Bonnie Heald, director of communications; Bryan Sisk, clerk; Elizabeth Seong, staff

assistant; Earl Pierce, also a professional staff member; and George

Fraser, intern.

On Mr. Turner’s side, Trey Henderson, minority counsel; and

Jean Gosa, minority clerk.

Court reporters, Colleen Lynch and Melinda Walker.

May I say that we’re now going to end this, and I know the

media have wanted to have some questions, and those of you that

would like to stay, please, gentlemen, and Ms. Singleton, you’re

welcome to stay. You’re the experts in a lot of these, and I’m sure

they’d like to ask you a few questions, but we won’t do it in a formal hearing, and we—I don’t know how the oath spreads over to

a press conference, but we’re in recess here. So—till tomorrow anyhow.

[Whereupon, at 11:50 a.m., the subcommittee was adjourned.]

Æ