U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

86–850 PDF 2003

RECOVERY AND RENEWAL: PROTECTING

THE CAPITAL MARKETS AGAINST

TERRORISM POST 9/11

HEARING

BEFORE THE

SUBCOMMITTEE ON

CAPITAL MARKETS, INSURANCE, AND

GOVERNMENT SPONSORED ENTERPRISES

OF THE

COMMITTEE ON

FINANCIAL SERVICES

U.S. HOUSE OF REPRESENTATIVES

ONE HUNDRED EIGHTH CONGRESS

FIRST SESSION

FEBRUARY 12, 2003

Printed for the use of the Committee on Financial Services

Serial No. 108–2

(

(II)

HOUSE COMMITTEE ON FINANCIAL SERVICES

MICHAEL G. OXLEY, Ohio, Chairman

JAMES A. LEACH, Iowa

DOUG BEREUTER, Nebraska

RICHARD H. BAKER, Louisiana

SPENCER BACHUS, Alabama

MICHAEL N. CASTLE, Delaware

PETER T. KING, New York

EDWARD R. ROYCE, California

FRANK D. LUCAS, Oklahoma

ROBERT W. NEY, Ohio

SUE W. KELLY, New York, Vice Chairman

RON PAUL, Texas

PAUL E. GILLMOR, Ohio

JIM RYUN, Kansas

STEVEN C. LATOURETTE, Ohio

DONALD A. MANZULLO, Illinois

WALTER B. JONES, JR., North Carolina

DOUG OSE, California

JUDY BIGGERT, Illinois

MARK GREEN, Wisconsin

PATRICK J. TOOMEY, Pennsylvania

CHRISTOPHER SHAYS, Connecticut

JOHN B. SHADEGG, Arizona

VITO FOSELLA, New York

GARY G. MILLER, California

MELISSA A. HART, Pennsylvania

SHELLEY MOORE CAPITO, West Virginia

PATRICK J. TIBERI, Ohio

MARK R. KENNEDY, Minnesota

TOM FEENEY, Florida

JEB HENSARLING, Texas

SCOTT GARRETT, New Jersey

TIM MURPHY, Pennsylvania

GINNY BROWN-WAITE, Florida

J. GRESHAM BARRETT, South Carolina

KATHERINE HARRIS, Florida

RICK RENZI, Arizona

BARNEY FRANK, Massachusetts

PAUL E. KANJORSKI, Pennsylvania

MAXINE WATERS, California

CAROLYN B. MALONEY, New York

LUIS V. GUTIERREZ, Illinois

NYDIA M. VELA ́ ZQUEZ, New York

MELVIN L. WATT, North Carolina

GARY L. ACKERMAN, New York

DARLENE HOOLEY, Oregon

JULIA CARSON, Indiana

BRAD SHERMAN, California

GREGORY W. MEEKS, New York

BARBARA LEE, California

JAY INSLEE, Washington

DENNIS MOORE, Kansas

CHARLES A. GONZALEZ, Texas

MICHAEL E. CAPUANO, Massachusetts

HAROLD E. FORD, JR., Tennessee

RUBE ́ N HINOJOSA, Texas

KEN LUCAS, Kentucky

JOSEPH CROWLEY, New York

WM. LACY CLAY, Missouri

STEVE ISRAEL, New York

MIKE ROSS, Arkansas

CAROLYN MCCARTHY, New York

JOE BACA, California

JIM MATHESON, Utah

STEPHEN F. LYNCH, Massachusetts

BRAD MILLER, North Carolina

RAHM EMANUEL, Illinois

DAVID SCOTT, Georgia

ARTUR DAVIS, Alabama

BERNARD SANDERS, Vermont

Robert U. Foster, III, Staff Director

(III)

SUBCOMMITTEE ON CAPITAL MARKETS, INSURANCE, AND

GOVERNMENT SPONSORED ENTERPRISES

RICHARD H. BAKER, Louisiana, Chairman

DOUG OSE, California, Vice Chairman

CHRISTOPHER SHAYS, Connecticut

PAUL E. GILLMOR, Ohio

SPENCER BACHUS, Alabama

MICHAEL N. CASTLE, Delaware

PETER T. KING, New York

FRANK D. LUCAS, Oklahoma

EDWARD R. ROYCE, California

DONALD A. MANZULLO, Illinois

SUE W. KELLY, New York

ROBERT W. NEY, Ohio

JOHN B. SHADEGG, Arizona

JIM RYUN, Kansas

VITO FOSSELLA, New York

JUDY BIGGERT, Illinois

MARK GREEN, Wisconsin

GARY G. MILLER, California

PATRICK J. TOOMEY, Pennsylvania

SHELLEY MOORE CAPITO, West Virginia

MELISSA A. HART, Pennsylvania

MARK R. KENNEDY, Minnesota

PATRICK J. TIBERI, Ohio

GINNY BROWN-WAITE, Florida

KATHERINE HARRIS, Florida

RICK RENZI, Arizona

PAUL E. KANJORSKI, Pennsylvania

GARY L. ACKERMAN, New York

DARLENE HOOLEY, Oregon

BRAD SHERMAN, California

GREGORY W. MEEKS, New York

JAY INSLEE, Washington

DENNIS MOORE, Kansas

CHARLES A. GONZALEZ, Texas

MICHAEL E. CAPUANO, Massachusetts

HAROLD E. FORD, JR., Tennessee

RUBE ́ N HINOJOSA, Texas

KEN LUCAS, Kentucky

JOSEPH CROWLEY, New York

STEVE ISRAEL, New York

MIKE ROSS, Arkansas

WM. LACY CLAY, Missouri

CAROLYN MCCARTHY, New York

JOE BACA, California

JIM MATHESON, Utah

STEPHEN F. LYNCH, Massachusetts

BRAD MILLER, North Carolina

RAHM EMANUEL, Illinois

DAVID SCOTT, Georgia

(V)

C O N T E N T S

Page

Hearing held on:

February 12, 2003 ............................................................................................ 1

Appendix:

February 12, 2003 ............................................................................................ 33

WITNESSES

WEDNESDAY, FEBRUARY 12, 2003

Britz, Robert G., President and Co-Chief Operating Officer, New York Stock

Exchange ............................................................................................................... 24

Colby, Robert L. D., Deputy Director, Division of Market Regulation, Securities and Exchange Commission .......................................................................... 4

D’Agostino, Davi M., Director, Financial Markets and Community Investment, U.S. General Accounting Office ................................................................ 2

Green, Micah S., President, The Bond Market Association ................................. 28

Ketchum, Richard, President, NASDAQ Stock Market ........................................ 22

Kittell, Donald D., Executive Vice President, Securities Industry Association .. 26

APPENDIX

Prepared statements:

Clay, Hon. Wm. Lacy ....................................................................................... 34

Israel, Hon. Steve ............................................................................................. 35

Kanjorski, Hon. Paul E. ................................................................................... 36

Maloney, Hon. Carolyn B. ................................................................................ 38

Royce, Hon. Ed .................................................................................................. 39

Britz, Robert G. ................................................................................................ 40

Colby, Robert L. D. ........................................................................................... 48

D’Agostino, Davi M. (with attachments) ........................................................ 56

Green, Micah S. ................................................................................................ 185

Ketchum, Richard G. ........................................................................................ 278

Kittell, Donald D. ............................................................................................. 290

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

NYSE response to questions posed by Hon. Richard Baker ................................ 298

(1)

RECOVERY AND RENEWAL: PROTECTING

THE CAPITAL MARKETS AGAINST

TERRORISM POST-9/11

Wednesday, February 12, 2003

U.S. HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON CAPITAL MARKETS, INSURANCE

AND GOVERNMENT SPONSORED ENTERPRISES,

COMMITTEE ON FINANCIAL SERVICES,

Washington, D.C.

The subcommittee met, pursuant to call, at 3 p.m., in Room 2128,

Rayburn House Office Building, Hon. Richard H. Baker [chairman

of the subcommittee] presiding.

Present: Representatives Baker, Ose, Manzullo, Hart, BrownWaite, Harris, Renzi, Kanjorski, Sherman, Inslee, Moore, Israel,

Capuano, Lucas of Kentucky, Clay, McCarthy, Matheson, Miller of

North Carolina, Emanuel, Scott, and Maloney.

Chairman BAKER. I would like to call this meeting of the Capital

Markets Subcommittee to order. It is my understanding that Mr.

Kanjorski is on his way and will join us momentarily. I would first

like to say—as I speak, here comes Mr. Kanjorski.

This is our first meeting of the new session, and we will have a

very busy agenda over the coming weeks and months. March and

April are particularly going to be time-consuming for Members. But

I think we have a lot of important work to do. Today is certainly

exemplary of the types of issues with which the committee will be

engaged.

We will be in receipt today of a report from the General Accounting Office relative to their assessments of market participants’ capabilities to help preclude or, in the adverse consequence, respond

to another economic terrorist assault on American soil. And from

the initial reading of the report and comments of those who will

participate today, although all answers have not been found, it

does appear that successful improvements have been in the making. And we look forward to having the committee’s assistance in

helping the regulators and market participants achieve the level of

security needed to ensure that no one can bring our economic system to its knees, an extraordinarily important matter, and I am

certain that the committee will return to it on many occasions as

circumstances require.

But I extend my welcome to the Members and certainly to the

Ranking Member Mr. Kanjorski, I look forward to working with

you again this session. And the gentleman is recognized for any

opening statement he might make.

2

Mr. KANJORSKI. Thank you, Mr. Chairman. I think I will move

that my full remarks be made part of the record.

Mr. Chairman, first of all, I prize the relationship for the last 8

years that you and I have had as chairman and Ranking Member

of this subcommittee, and really take great pleasure in the fact

that we were able to rise to the occasion in providing terrorism reinsurance and restoring investor confidence in corporate America to

some degree in the last Congress.

Today we are here to examine the physical problems that may

exist in a future terrorist attack on the United States and what actions and efforts we should take and what legislation will be necessary to accomplish that end. Also, as I suggested in my amendment to our policy consideration of the committee, we not only

should take into consideration the physical effects of a terrorist attack on our economy and our markets, but also what economic disasters could befall the United States, and to start looking at some

of the necessary actions to prevent that or to provide the legal authority for appropriate action. And some of the witnesses that are

here today representing the various and sundry areas would be instrumental in examining that, because, in my estimation, I believe

that terrorism can cause unreasonable and untold loss of life in

America, it can cause tremendous physical damage in America, but

cannot threaten the national security of America. On the other

hand, economic destruction or events could bring down the American economy and, in fact, America in its entirety.

So I think that not only do we have the opportunity to look at

the physical effects on the markets and what we can do to shore

them up, but also anticipating what economic occurrences may

occur over the next several years that could really threaten the

economy of the United States. And I look forward to working very

closely with you in that end, and I move that my remarks be made

part of the record.

[The prepared statement of Hon. Paul E. Kanjorski can be found

on page 36 in the appendix.]

Chairman BAKER. Without objection, in their entirety.

Does any other Member wish to make any opening statement at

this time? If not, then I would proceed to our first panel of witnesses, and welcome Ms. Davi D’Agostino, who is the Director of

the Financial Markets and Community investment Division of the

U.S. General Accounting Office.

I think all Members have been provided a copy of your report.

Please feel free to summarize and give us any perspectives you

think would be helpful to the committee. Welcome.

STATEMENT OF DAVI M. D’AGOSTINO, DIRECTOR, FINANCIAL

MARKETS AND COMMUNITY INVESTMENT, U.S. GENERAL ACCOUNTING OFFICE

Ms. D’AGOSTINO. Thank you very much, Mr. Chairman. With

your permission, I would like to submit my full written statement

for the record, and I would summarize my remarks orally.

Chairman BAKER. Without objection. And all witnesses’ testimony will be made part of the official record. Thank you.

Ms. D’AGOSTINO. Thank you very much.

3

Mr. Chairman, members of the subcommittee, I am pleased to be

here today before you to discuss GAO’s work on the readiness of

the U.S. Financial markets to respond to potential terrorist attacks. The markets are vitally important to our Nation’s financial

system and to our economy. The devastating attacks on the World

Trade Center on September 11th revealed that our markets could

be vulnerable to such events.

Today I will talk about, one, how the markets recovered from

these attacks; two, the limitations that existed in participants’

readiness to recover; and, three, steps that regulators have taken

to assure that U.S. markets are better prepared for such attacks

and what more needs to be done.

First, because the attacks occurred in the heart of Wall Street,

over 70 percent of the nearly 2,800 people who lost their lives

worked at financial firms such as broker/dealers and banks. The attacks damaged or destroyed over 400 buildings, and electricity and

telephone services were also severely disrupted. Facing enormous

obstacles, the utilities, exchanges, and firms worked around the

clock and used creative solutions to reopen the markets within

days of the attacks. Our report has numerous examples of the

amazing efforts behind the market restoration. Still, by that Friday, September 14th, broker/dealers that normally provide 40 percent of market liquidity were not fully ready to trade, and the industry and regulators chose to test the newly established telecommunications over the weekend. On September 17th, the markets reopened, trading record volumes. In retrospect, the markets

probably would not have been able to open so quickly if certain organizations had been directly hit.

Second, the attacks also revealed limitations in the disaster planning of many market participants. In some cases firms did not

have backup facilities, and others had located their backups too

close to their primary sites. Some firms also found that the backup

telephone lines they bought from different providers were routed

down the same pipes or through the same switches as their primary lines. Our reviews of 15 important exchanges, clearing organizations, ECNs, and payment system processors from February

through June 2002 showed that they had taken many steps to prevent disruptions to their operations from physical or electronic attacks. Most had also invested in backup facilities or other measures

to be able to recover from such attacks, but many of these 15 organizations still faced increased risk to their operations.

For example, most organizations did not have complete plans to

continue operations if the staff at their primary sites were incapacitated. Some of these organizations also faced increased risk of

disruption from widescale disasters because their backup facilities

were nearby.

Third, the financial regulators have taken some important steps

to improve the resiliency of the financial markets to recover from

future disasters, but these efforts are not complete. Banking and

securities regulators issued a white paper that proposed recovery

practices for crucial clearing and settling functions, but they have

not made a similar proposal for trading activities. To better assure

that trading can also recover in a smooth and timely manner following a disaster, we recommended that SEC take a leadership

4

role and work with the industry to develop goals and strategies to

resume trading. Such strategies could be based on likely disaster

scenarios and should identify the organizations that are able to

trade in the event that others cannot. SEC also needs to work with

the industry to identify sound recovery practices for organizations

to adopt—to better assure they can trade after another disaster.

There will be a need to balance the business decisions and risk

management trade-offs that individual market participants make

with the need for a sound, viable plan for assuring the U.S. markets can resume important trading activities when appropriate.

The 9/11 attacks showed that the market’s ability to reopen depends on the readiness of key broker/dealers. The plans SEC develops will have to assure that sufficient firms are available to trade,

and that customers’ accounts at firms unable to operate can be

transferred to others who can.

We also recommended that SEC improve its program to oversee

operations risks at exchanges, clearing organizations, and ECNs.

These improvements included making its voluntary program rulebased, and using a portion of any future budget increases to expand and retain its experienced staff and technical resources.

Mr. Chairman, this concludes my prepared remarks, and I would

be happy to answer questions at any time.

Chairman BAKER. Thank you very much.

[The prepared statement of Davi M. D’Agostino can be found on

page 56 in the appendix.]

Chairman BAKER. Our next witness is Mr. Robert Colby, Deputy

Director, Division of Market Regulation, from the Securities and

Exchange Commission. Welcome, Mr. Colby.

STATEMENT OF ROBERT L.D. COLBY, DEPUTY DIRECTOR, DIVISION OF MARKET REGULATION, SECURITIES AND EXCHANGE COMMISSION

Mr. COLBY. Thank you. Chairman Baker, Ranking Member Kanjorski, and members of the subcommittee, I appreciate the opportunity to testify before you today regarding the efforts since the

September 11th terrorist attacks to better protect U.S. financial

markets and institutions, and to address issues raised in the report

released today by the General Accounting Office.

As the GAO recognizes in its reports, participants in the United

States financial markets made heroic efforts to recover from the

devastation of the September 11th attacks, with the result that all

markets reopened successfully within a week after those tragic

events. Nevertheless, the Commission and other regulators in the

industry have engaged in wide-ranging and intensive efforts to consider the lessons learned from the events of September 11th and

strengthen the resiliency of the financial sector so that we are better prepared going forward.

Immediately after the September 11th attacks, the securities industry recognized the need to develop more rigorous business continuity plans that addressed problems of wider geographic scope

and longer duration. Market participants have taken a number of

significant steps to improve their resiliency, including establishing

more robust and geographically disbursed backup facilities for opVerDate 11-MAY-2000 11:23 Jun 05, 2003 Jkt 000000 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 C:\DOCS\86850.TXT HBANK1 PsN: HBANK1
5

erations in data recovery, improving crisis management procedures, and seeking telecommunications diversity.

The Commission and other financial regulators have also been

devoting substantial resources to projects designed to strengthen

the resilience of the financial sector. For example, the Commission,

working with the Federal Reserve Board and the Office of the

Comptroller of the Currency, are in an effort to identify sound

practices for business continuity planning for key market participants.

This past August we published for comment a draft white paper

that focused on a small but critical group of participants in the

U.S. clearance and settlement system. The goal of this project is to

minimize the immediate systemic effects of a widescale disruption

by assuring that the key payment settlement systems can resume

operation promptly following a widescale disaster, and major participants in those systems can recover sufficiently to complete

pending transactions. The agencies expect to issue the final white

paper next month after an additional amount of consultation with

the industry, and then incorporate the sound practices into their

respective forms of supervisory guidance.

In addition, Commission staff has been reviewing on an ongoing

basis the efforts of the organized markets to strengthen their resiliency in the post-September 11th environment. These markets have

taken a variety of steps to improve their physical security, information system protections and business continuity capabilities, and

Commission staff continue to work with them to further increase

the robustness of their individual plans. In addition, we have been

exploring with the markets the possibility of mutual backup arrangements.

As to the resilience of securities firms, the New York Stock Exchange and the NASD have proposed rules that would require all

broker/dealers to have business continuity plans that address a

number of important areas. We have also been working with the

relevant industry associations, the SIA and the Bond Market Association, on their members’ business continuity disaster recovery efforts.

To date, the Commission’s intensive efforts have focused on

measuring and ensuring the resilience of the U.S. clearance and

settlement system because, in our view, that infrastructure is the

single most important element of the securities markets. As a practical matter, securities transactions cannot be completed in the absence of a functioning clearance and settlement system. Accordingly, the Commission has given priority to initiatives that assure

the prompt implementation of vigorous business continuity plans

by critical participants in the clearance and settlement system.

The GAO report recommends that the Commission do more to assure the resumption of trading by securities markets and broker/

dealers following a major disaster. We share the GAO’s views regarding the importance of emergency preparedness of the financial

markets, and generally agree with the report’s principle: that the

financial market should be prepared to resume trading in a timely,

fair, and orderly fashion following a catastrophe. But we believe

that different, in some cases more complex, policy considerations

apply to the resumption of trading than to the resumption of clearVerDate 11-MAY-2000 11:23 Jun 05, 2003 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 C:\DOCS\86850.TXT HBANK1 PsN: HBANK1
6

ance and settlement activities. Because trading activities is relatively fungible across markets and market participants, we are of

the view that individual markets and securities firms are less critical to the securities markets than the key clearance and settlement utilities. Were any single securities market to become incapacitated, for example, we believe that trading could be shifted to

one or more of the remaining markets. We recognize that sufficient

advanced preparation is required for such an arrangement to work

smoothly and promptly, and, as I indicated earlier, Commission

staff is in the midst of just such an effort.

As to the resumption of trading by securities firms, in our view,

strong business incentives exist for broker/dealers to develop robust

business continuity plans for their trading operations. Trading operations, of course, are in—at least in good markets, are a source

of significant revenue for securities firms, and few would risk a situation where their competitors are in a position to trade and they

are not.

I also note that as a provision of liquidity to the market by securities firm is voluntary; they cannot be compelled to resume trading

activities.

Finally, there are critical policy considerations relating to the reopening of trading markets following a major disaster that could

suggest not compelling the speediest reopening. Difficult judgments

may be required to strike the appropriate balance between the desire to resume trading as soon as possible and the practical necessity of waiting long enough to minimize the risks that, when trading resumes, it will be of inferior quality or interrupted by further

problems.

For example, in the aftermath of the September 11th events,

many praised the decision to wait until Monday, September 17th,

to reopen the equity markets as it allowed market participants the

preceding weekend to test connectivity in systems and thereby better assure the smooth resumption of trading.

Despite these policy concerns, we nevertheless agree with the

GAO that more needs to be done to prepare the securities markets

for the resumption of trading in the event of a crisis. Specifically,

the Commission intends to consider whether it should identify a

time frame against which markets should plan to resume trading

following a widescale regional disaster. We also will continue to

work with the New York Stock Exchange, NASDAQ, and other organized securities markets to develop and test mutual backup arrangements for various scenarios, and we will pursue efforts to increase the resilience of important shared information systems such

as the consolidated market data stream generated for equity and

options markets. Any timing goal established for the resumption of

trading markets could serve as a useful resumption benchmark for

securities firms as well.

In addition, the Commission will consider developing standards

in conjunction with the self-regulatory organizations to help assure

that broker/dealers are able to provide customers prompt access to

their funds and securities even in the face of widescale regional

disturbance.

The GAO report also recommends that the Commission improve

its oversight of operations risk by issuing a rule to require exVerDate 11-MAY-2000 11:23 Jun 05, 2003 Jkt 000000 PO 00000 Frm 00012 Fmt 6633 Sfmt 6633 C:\DOCS\86850.TXT HBANK1 PsN: HBANK1
7

changes and clearing organizations to engage in practices consistent with the Commission’s automation review policy, or ARP

program, and by expanding the resources dedicated to that program. The Commission recognizes the critical role that technology

plays in the securities industry and specifically the importance of

having in place adequate safeguards and controls over information

resources to ensure reliable and timely trading services to investors.

The events of September 11th underscored the financial markets’

critical and increasing dependence on the integrity of their systems’

infrastructure. In light of the GAO’s recommendations, we will consider alternative mechanisms to improve the effectiveness of the

Commission’s automation oversight, including the appropriateness

of rulemaking. We will also assess the additional resources that

may be necessary to accomplish the objectives of the ARP program

and the GAO report.

Thank you for the opportunity to testify, and I would be happy

to answer any questions.

Chairman BAKER. Thank you, Mr. Colby.

[The prepared statement of Robert L.D. Colby can be found on

page 48 in the appendix.]

Chairman BAKER. Ms. D’Agostino, it appears from the basic recommendations, there were principally two things I found of interest. One was the resource limitation on ARP staffing and their ability to only review perhaps 7 of 32 particular agencies on an annual

basis, which means 4-1/2 years before you would make the full

cycle. So resource allocation for the technical folks we need to make

that system work is essential.

But number two, and I think Mr. Colby’s closing comments spoke

to it briefly, is the advisability of having rulemaking as opposed to

voluntary participation as a result of the ARP program findings.

It would appear to me that most of what I have read from the

industry perspective is that we should be careful not to mandate

something, a particular standard or a particular time line or particular steps to be taken, because each shop is different, each conducts its business in a slightly different manner. But would it not

be consistent with the report that we at least by rule adopt goals;

that first, after whatever event may occur—and that obviously is

the difficult thing to predict—that efforts should be made for an

immediate operability, but subject to some period of time to test?

I think the lessons of September 11 was the Monday, September

17th success. Had it opened and stumbled, I think the repercussions would have been significant. Can’t we get to a—could we not

construct a goal, an operational plan that would not so constrain

individual companies or participant, but yet set a standard in place

that would be mandatory?

Ms. D’AGOSTINO. Actually the ARP program and the ARP policy

is sort of like a goal. It does not have very specific technical standards to which an organization must live up, and it is not with a

huge amount of specificity that programs are reviewed. It is more

of a performance-based-type policy and program that they operate

with now, and that would be consistent with what we are recommending.

8

We acknowledge, I think, in our conclusions in our report the

need for flexibility and for technology to continue to evolve and to

have the opportunity to avoid—well, to ensure avoidance of a onesize-fits-all or a cookie cutter approach where everybody has to do

the same thing, because of course there are many technology paths

just as there are for physical security solutions and other issues.

Chairman BAKER. But you do believe that the ARP findings or

recommendations should be in the form of a mandatory requirement as opposed to voluntary participation?

Ms. D’AGOSTINO. Actually they are mandatory on the ECNs now.

SEC did pass a rule that makes compliance with the ARP by the

ECNs required. So if we made that an across-the-board requirement for all organizations subject to ARP, it would simply even it

out.

Chairman BAKER. Right.

Mr. Colby, listening to our exchange, do you have a concern or

caution about mandatory ARP compliance or not?

Mr. COLBY. Let me drop back and explain why the ARP program

is the way it is. It was developed a number of years ago, and it

is a little different for the Commission, because it was a program

of looking at the computer resources and the process of examining,

assessing, evaluating computer resources is something that has

been developing as automation has grown. So we did it on a voluntary basis in part because we didn’t want to freeze into place

something that was still in an evolving state, and it stayed voluntary because on the whole, given our influence over the self-regulatory organizations that it applies to, it has worked quite effectively.

Now, within the ARP process, it assesses, processes, and controls

the system development mechanisms. There is room for differing of

opinions. So our people might come in and say, we think that there

is this weakness in your process, and the SROs may come back and

say, well, we disagree.

I think the sort of rule that the GAO is talking about is one that

mandates the process, in compliance with the process, as opposed

to any particular result that would come out of that evaluation.

Chairman BAKER. But the compliance for the ECNs which is

mandatory was principally centered, as I understand it, on the reality that they were not open outcry systems, they were a communications-based marketplace. And as I view the markets today, we

are clearly moving rapidly to emulate that structure. And it would

seemed to me that verification by someone that the communication

skills and abilities, whatever the platforms may be, can have

functionality even after the aftermath of one of these events would

be advisable.

Mr. COLBY. We absolutely agree. The ARP rules that applied to

ECNs were applied in part because of their structure, but in part

because they are not in the same regulatory state as the self-regulatory organizations which we examine, review their rules, and

have a lot of interaction. But the ECNs are typically private organizations, for-profit organizations, and so in that sense it seems it

needed to be mandatory.

9

It also is a process-based approach, and so I think what they are

recommending could be transferred over to the self-regulatory organizations.

Chairman BAKER. I have exhausted my time, but just one more

quick question about the funding levels for the ARP program.

Mr. COLBY. Funding levels.

Chairman BAKER. Yes. Where are we? What has the Congress

done in relation to that issue? And where is the agency with regard

to requests for this year?

Mr. COLBY. As you know very well, we have had a funding problem over the years, and the ARP program is one of the things that

has been constrained by those funds. Another practical problem

that constrains that process is—and this committee by moving to

address it—that hiring the sort of people that go into the ARP

process is quite difficult, partly because the government process for

hiring is sort of skilled automation experts that we need is protracted, and partly because with the dot.com boom, these people

were just not available.

Chairman BAKER. Well, your ringing endorsement of the OxleyBaker bill has been duly noted. Thank you.

Mr. COLBY. And that is what I intended.

Chairman BAKER. Thank you very much.

Mr. Kanjorski.

Mr. KANJORSKI. Thank you very much, Mr. Chairman.

Most of your concentration has been on physical damage and a

physical terrorist attack and what the implications of that are in

the marketplace; is that correct?

Mr. COLBY. Our program both looks at physical and at information vulnerabilities.

Mr. KANJORSKI. But as a result of physical damage.

Mr. COLBY. Not necessarily. It also looks at the security measures that are taken with respect to cyberthreats and the like.

Cyberthreats are quite difficult, of course, to predict and respond

to, but it does intend to look at that, and it has been a focus of

the ARP process.

Mr. KANJORSKI. If the attack on September 11th had, in fact, not

taken place against the World Trade Center buildings in New York

but in the Sears building in Chicago, has anyone done a study as

to what the disruption of the market, if any, and the economic effect of the terrorist attack on the market, if any, would have been

relative to what did happen?

Mr. COLBY. There is a very high concentration of critical financial markets in the Chicago area, and it is something that we have

been focused on. Our agency, of course, is only the securities markets.

Mr. KANJORSKI. I guess I’m not directing myself, because that

again goes to the question of physical damage. I am trying to say,

has anybody said what the physical damage in the delay of opening

the markets and functioning in a physical way in the market as

compared to the economic impact of a terrorist attack was on the

economy of the United States? In other words, I would like to know

in that September period after—September through October after

the attack when we had the tremendous downturn in the market,

was that a result of the economy, or was that just a result of fear

10

in the marketplace and the failure and the time required to open

the markets and get back to an orderly operation?

Mr. COLBY. I think it is indisputable that the immediate drop—

there was a 3 percent drop on the day after the markets opened,

was clearly a result of concern about what the terrorist attack

meant. I don’t think that the rest of the fall in the markets can

be attributed to that directly. We have participated, but not been

chiefly responsible, in economic studies done by what is now the

Homeland Security Department about the economic consequences

of a terrorist attack in trying to assess how the September 11th

and how a possible future attack might affect the economy.

Mr. KANJORSKI. And have you participated in those, or should

you participate?

Mr. COLBY. We have participated to provide our expertise, to try

to give them a sense of what the impact on the markets would be.

And then—

Mr. KANJORSKI. If you can answer: The CIA Director today testified that the untested potential exists for an ICBM to—with an

atomic warhead to hit the cities on the west coast of the United

States. Making the assumption that two 20-kiloton bombs were to

hit either San Diego, Los Angeles, San Francisco, Portland, or Seattle, what would be the ramifications to the economy of the United

States? And are we looking at that in terms of—are we just being

functional and physical here in looking at how to handle the marketplace as opposed to what we have to think about the disruption

of the economy?

Mr. COLBY. This level of response is the functional and physical.

There are elements of the government that are looking at the

broader consequences. It is being conducted in the context of the

Homeland Security Department, and there is an entire community

of which we are one small member whose title is The Economic

Consequences of An Attack, and they are trying to both scope out

what those sort of consequences would be and also what sort of

steps might be necessary to respond to them.

Mr. KANJORSKI. So this committee should start thinking in terms

of not only the physical consequences of terrorism, but the economic consequences of terrorism and other economic circumstances

unrelated to terrorism as to what kind of structures and processes

should be put in place in an anticipatory way in order to keep the

economy sufficiently existing so that we don’t really lose the war.

Mr. COLBY. The physical and functional is just the beginning of

the process of trying to address what the consequence of a terrorist

attack would be.

Chairman BAKER. Thank you, Mr. Kanjorski.

I want to recognize the gentleman from California and welcome

him to his new capacity as vice chair of the capital market subcommittee. Mr. Ose.

Mr. OSE. Thank you, Mr. Chairman. Your wish is my command.

Mr. Colby, my questions really relate to the alternative means by

which liquidity and transparency can be provided to the marketplace in the event of a catastrophe. If I understand the testimony

of yourself and Ms. D’Agostino and the others who are going to follow, there is a certain level of redundancy between, say, New York,

the Pacific, and the American and the NASDAQ and some of the

11

other ECNs to the extent that New York Stock Exchange is prepared to trade the top 250 volumewise companies traded on

NASDAQ. And I imagine there are similar relationships elsewhere.

It is my—I am aware that the NASDAQ folks have come forward

seeking to have—I am trying to remember the language that they

used, but to have the SEC designate NASDAQ as an approved

marketplace for any number of reasons, one of which might be to

facilitate liquidity and transparency in the event of a catastrophe.

Now, I have been working on this for 2 or 3 years. I am still interested in it. I am going to keep sending letters. I would like to

know what the status is on the application that was filed in November of 2001 by the advocates for NASDAQ in terms of their application.

Mr. COLBY. NASDAQ’s exchange application is still being processed. There were both practical, legal, and policy concerns. The

most fundamental policy concern emanated from a concern of what

an exchange should be. One of the first things we expect to do with

our new chairman when he is confirmed is to move this application

forward.

May I drop back and address the first part of your question,

which is that we believe—and I hope that NASDAQ will confirm—

that from an operational standpoint, that they are just as prepared

to address the sort of concerns about redundancy in their current

status as they would be as an exchange. And so while there are

very good reasons to be forwarding the exchange application, I am

hopeful, and I think Rick Ketchum could confirm it, that the question of backing up the New York Stock Exchange and other markets is not one of the things that turns on an exchange application

registration.

Mr. OSE. So what are the conditions that have yet to be resolved

on this? I mean, 2 or 3 years is a long time.

Mr. COLBY. Two or three years is a long time. This is a monumental enterprise. The rules and rule changes that they submitted

would fill half of this table.

Mr. OSE. Do all the rule changes still need to be vetted, or have

you narrowed it down to a few?

Mr. COLBY. We have narrowed it down to a few major and a larger number of minor changes, but the minor are more minor. The

sort of things that are still at issue besides the question of how

much, what the nature of the market has to be, is a question of

what is the scope of the registered exchange? What sort of representation must members be provided in the governance of the exchange? Because there is a statutory requirement for fair representation of members, and that has to be reconciled to a corporate, forprofit, ownership structure. Those are the primary issues.

The minor issues involve such things as what sort of short sale

rules should apply, whether the exchange requirements about separation of member trading should apply to this sort of an exchange

when it applies to all other sorts of exchanges. And there is a list

of smaller issues, but those are the key ones.

Mr. OSE. It is my understanding that the governance issue had

been resolved. And if I read, I think it was Mr. Ketchum’s next testimony, they are, if I read this correctly, prepared to abide by the

short sale rules that exist in NYSE today.

12

So, my time has expired, Mr. Chairman, but I would be following

up in writing because I intend to get this thing resolved. No is an

answer. But if it is no, let us get to it. All right?

Mr. COLBY. We agree. We hope to be moving it forward.

Mr. OSE. Thank you, Mr. Chairman.

Chairman BAKER. Thank you, Mr. Ose.

Chairman BAKER. Mrs. McCarthy?

Mrs. MCCARTHY. Thank you. This is my first day on this committee, so I don’t know whether my questions are going to be that

intelligent. But just listening to—well, you both have been talking

about, and then obviously with the heightened security on Friday,

are we better off today than we were on September 11th? And how

are we going to handle it? And just listening to the debate, and I

know government runs very slowly, but just God forbid something

did happen, and we are still waiting almost a year and three-quarters on waiting for some rules to come through so we can be ready

to go the following day, hopefully, if we had an attack. Where are

we today if something happened by the end of this weekend?

Mr. COLBY. We are much better off today than we were on September 11th, and I can give you some specific examples of things

that have changed. There is still work to be done, and I think what

you see is the GAO’s pointing out that there is work to be done,

but let us not minimize the work that has been done.

All the major markets have dropped back and looked at their resiliency and what they can be doing to continue trading in the case

of a problem with their main trading site. The New York Stock Exchange will detail for you their plans for a backup trading site.

NASDAQ has long had two separate locations. There are efforts

well under way in the clearance and settlement system in order to

create more diversity. The main processing sites have been relocated. And there—each of the major securities firms, and I believe

it is true for banks, though that is not our responsibility, have been

spending the time since September 11th completely revising their

business continuity plans to take into account the new realities,

and many of them have already put in place more resilient operation centers. There are vastly improved coordination mechanisms

between—within the firm. Don Kittell will talk about the SIA’s efforts with respect to command centers and business continuity

planning.

And so I think—I don’t know if you would agree, Davi—that we

have come a very long way, but there is room to go farther.

Mrs. MCCARTHY. Because my only concern is, and this will be my

final question, that when we had a heightened security on Friday,

then the market, I believe, dropped quite a few points on Monday

and Tuesday, if I am correct. My concern is obviously the security

firms, they can only do as well as the confidence of the people that

are buying their stocks. So obviously they are going to do everything possible to make sure that people feel confident. And I

haven’t seen anything, you know, out there to the general public

on talking about how well we have done and how well we came

back.

I was down on Wall Street a few days after September 11th, and

to me it was amazing how everybody worked together. To me it

was amazing how everybody just came together to get this up, beVerDate 11-MAY-2000 11:23 Jun 05, 2003 Jkt 000000 PO 00000 Frm 00018 Fmt 6633 Sfmt 6633 C:\DOCS\86850.TXT HBANK1 PsN: HBANK1
13

cause we certainly—as horrible experience it was, and I lost an

awful lot of people from Camp Fitzgerald in my district, but the

bottom line is, we can’t let the terrorist win, because whether they

are going to attack us or not, the majority of people do believe it

is going to be New York or D.C. Whether it is true or not, that is

what people believe in. And we have to do—I personally think we

have to do a better job on just getting it out to the normal consumer that we are ready, and it is not going to affect us the way

it did on September 11th.

Thank you for your testimony.

Chairman BAKER. Thank you, Mrs. McCarthy.

I didn’t announce earlier, but it is a general understanding that

the recognition of Members for questions will proceed based on seniority by time of arrival. So the short message is if you are here

on time when the meeting starts, you have got a good chance of

getting recognized early.

Mrs. MALONEY. Point of personal privilege?

Chairman BAKER. Certainly.

Mrs. MALONEY. I am not a member of the committee, but may

I ask unanimous consent to place into the record a statement? I

have a conflict with another meeting, and I wanted to thank my

constituents, Rick Ketchum from NASDAQ and Robert Britz from

New York Stock Exchange, for appearing today and for all of their

work in combating terrorism and getting our financial markets

ready.

Chairman BAKER. Without objection, and certainly appreciate

their efforts.

Mrs. MALONEY. Thank you, Mr. Chairman, and thank you for

having this hearing.

Chairman BAKER. Certainly.

Ms. Hart.

Ms. HART. Thank you, Mr. Chairman. I missed, unfortunately, a

big piece of the GAO testimony, so I am going to ask Ms.

D’Agostino a question that she may have answered already, so bear

with me.

I understand the concern, I was on the committee when we went

through September 11th and all the aftermath, the concern that

everybody had about everybody being able to get back to work and

everything going again. As far as recommendations that the GAO

has made, do you rank the actual physical proximity of the alternative place where they would work if they can’t be where they are

supposed to be of any high importance at all, the physical proximity of sort of the alternative? You mentioned something in the

testimony about the—sort of always having an alternative place to

be. Is that relevant, or is that something that is important?

Ms. D’AGOSTINO. I think we would say that it is very important

to have backup facilities, particularly if you are a critical organization and no alternatives exist for your services and functions. And

again, we do not—GAO hasn’t developed a position on the right

number of miles between a primary and backup facility. I mean,

we haven’t even considered that. But clearly from our lessons

learned from the 9/11 experience, having a backup facility to handle your operations or to take you far enough away from a

widescale incident is a good idea. So I think that is about where

14

we stand on it. But we think it is important to have backup facilities.

Ms. HART. Okay. You are not going to micromanage where and

how and all those sorts of things, or you have no suggestions that

are really specific in that way?

Ms. D’AGOSTINO. Not about mileage, but about functionality, yes,

it is a good idea to have a backup facility that can perform your

critical operations in full.

Ms. HART. There was an—I was just reading the testimonies—

a mention of 60 percent wasn’t enough; 60 percent of your operations wasn’t enough.

Ms. D’AGOSTINO. I believe 60 percent of the market liquidity was

ready to trade represented by broker/dealers.

Ms. HART. Okay.

Ms. D’AGOSTINO. Forty percent was not ready to trade on Friday,

the 14th of September. That 40 percent was not fully ready.

Ms. HART. So would you expect them all to be fully ready?

Should they all be able to be fully ready with an alternative facility?

Ms. D’AGOSTINO. I think that is a question for the SEC and the

industry to work out in its strategy and plan for restoring market

operations or trading operations after a disaster.

Ms. HART. Since the SEC is here, what do you think about that?

Mr. COLBY. Well, I don’t think you can plan or try to compel everyone to be able to come back, because you don’t know what the

consequences could be. And, frankly, we don’t need to because we

have multiple competing providers of services. There are two positive consequences from that. The first is that many clients can just

move. If one broker is not operational, they use another broker.

And because of that, the brokers have very strong incentive not to

have their customers leave them, so they have strong business incentives that align with the government objectives in order to be

able to continue operating. And it is most true with respect to the

securities firms. It is also true with respect to securities markets,

because there are very few products, publicly-traded products, in

this country that are traded only in one location, which gives a

built-in resilience to the system.

Ms. HART. Are you hopeful then that as this issue is being—continues to be examined, that most organizations involved will certainly, as a matter of their own survival, make the best plan they

possibly can and expend whatever resources they have at their fingertips to be able to do that? It is going to be a huge cost to them.

Mr. COLBY. It will be a huge cost, and I think we have to keep

those costs in mind particularly in an environment where there is

not just one central utility that is providing the service, but a number of competing entities.

It is said that the shelf life of a securities firm must be measured

in weeks. If they are not operational and their competitors are,

their business is gone very quickly, and it may never return. And

so securities firms have an incentive to operate—which is not to

say we don’t need to set guidelines and objectives and standards,

but I think the incentives are aligned.

Ms. HART. Thank you, Mr. Chairman.

Chairman BAKER. Thank you, Ms. Hart.

15

Mr. Emanuel?

Mr. EMANUEL. Thank you, Mr. Chairman.

As somebody representing Chicago, and as a former board member of the Chicago Mercantile Exchange, as I listen to your testimony and read the report, more and more what you seem to have

talked about was the physical location. And given that more and

more trading is going electronic, away from the open outcry—talking about my area—we have the options exchange and the clearinghouse most specifically that has been a concentration. I kind of recognize the problem of dealing with cyberterrorism. But given where

the markets are going every day increasingly—I do think you have

to worry about physical location, backup facilities, dealing with the

clearinghouse—my bigger concern is the electronic piece of this

market, where the market really is going tomorrow, and less about

the physical locations.

I am not—given that we have the Board of Trade, the options,

and the Merc and the stock exchange in Chicago, I do care about

the physical locations, but if you just look at the trading future of

where they are going, where handhelds are now on the floor, I am

more and more interested about the electronic piece of this business and not the physical location of it.

I may have to go into a witness protection plan now that Chicago

hears I could care less about the physical. I don’t care less about

it, but what I care about is what is going on electronically and

what you are doing to protect that. And as you said, it is the most

difficult part of what we have to do, and yet if you look at where

trading is today and how it is moving tomorrow, it is almost purely

electronic, and you could do that by each of the exchanges and go

through them and talk about what their futures are like. And having sat on the Merc board, that was the preoccupation of the board

for a long time, and that is where the exchange is going now.

Mr. COLBY. You are right in pointing out that the physical

threats are less significant if you have an electronic market, because as long as you have dispersion between your operating centers, the market can continue. In fact, some of the markets that

have physical floors, have as their backup plans an electronic market. So they recognize that, though that is not where they want to

go to, but if they have to maintain their operations, they can do

it electronically, which then puts a premium on cybersecurity. And

this is something that it is very much a focus. It is a focus for the

government, from the President’s Committee on Infrastructure Protection right on through down to our level. And there have been a

lot of measures taken by the various markets and clearance and

settlement systems to try to assess and protect their information

security.

Mr. EMANUEL. Well, I want to drive this point home, because as

I look at this report, obviously you have the shadow of September

11th that hangs on it, but the truth is I don’t want to protect for

September 11th alone. They are not going to just do a repetition

of September 11th. We have to actually prepare for the next attack

that is going to be, in my view, a lot different than September 11th.

And we have to deal with where our exchanges are going, where

our trades are going.

16

And my one last comment as well as question is given that a lot

of these functions today—the clearinghouse in Chicago is really a

consolidation for the different exchanges. That consolidation actually makes it at one level economically efficient and another level

a far greater target for—and easier to disrupt for a terrorist organization. And I don’t even know if that—that is more of a statement

than a question. So, given the trends of what is going on in the industry, I want us to be thinking about the future not so much

about laying in place the protections about what happened in the

past and only the past. Thank you.

Chairman BAKER. Thank you, Mr. Emanuel.

Ms. Brown-Waite.

Ms. BROWN-WAITE. Thank you, Mr. Chairman. I apologize for not

being here sooner; I had some constituents from my district.

This question may have already been answered, but have the

agencies actually reviewed the inter-agency white paper that set a

goal that may be so costly and unreasonable that it would be

unachievable? Have you done an economic analysis of what this

recommendation would mean to the industry? And I think I would

ask this to Mr. Colby.

Mr. COLBY. We have tried to do an economic analysis. We received comments on the one that was initially put out. We are in

the process of revising it. We plan a process of consulting with the

firms to try to assess what the impact of the revised statement

would be in order to try to take into account the cost impacts.

Ms. BROWN-WAITE. But do you actually have an estimate of what

the cost impacts are?

Mr. COLBY. We have a sense from the people, the firms that

would be affected, of what the costs were. These are, of course, proprietary expenses. We have not made them public, but we have

been pursuing with them what the costs would be.

Frankly, a lot of the cost depends on the implementation schedule, because if it is something that can be worked into their computer planning and automation development, it is much less expensive than if it has to be done immediately.

Ms. BROWN-WAITE. Thank you, Mr. Chairman. I yield the rest of

my time.

Chairman BAKER. Thank you very much.

Mr. Scott?

Mr. SCOTT. Yes. Thank you, Mr. Chairman.

In the wake of 9/11, of course, we have put together the Department of Homeland Security. I would be interested in knowing both

of your opinions.

What do you see the role that the new Homeland Security Department will play in ensuring that we have continuity in the

event of another terrorist attack and in preparation, particularly as

it relates to business continuity and investor confidence?

Mr. COLBY. The topic of business continuity and investor confidence is one that is important to the homeland security. To date,

they have been interacting with the group that was set up before

the Homeland Security Department called the Financial and Banking Information Infrastructure Committee, chaired by the Treasury

Department, of which we, the bank regulators and a number of

other agencies, are part.

17

They have been working through this group in order to try to coordinate policies and improve the development. But from our interaction with them, it is very clear that this is a matter that is of

concern to that Department.

Mr. SCOTT. Are you satisfied with what the Department of

Homeland Security is doing or projected to be doing to ensure that

our markets will continue to operate? Is there anything else you

would recommend?

Mr. COLBY. My sense is that they are taking this very seriously,

and it is going to be one of the important items on their agenda.

Mr. SCOTT. Okay. Thank you Mr. Chairman.

Chairman BAKER. Thank you, Mr. Scott.

Ms. Harris.

Ms. HARRIS. Thank you, Mr. Chairman.

With a follow-up to Ms. Brown-Waite’s question concerning technology, is there an overall assessment concerning cyberterrorism

and how this would affect the financial markets?

And then secondly, how would you characterize the state of preparedness with regard to future terrorist attacks and how they will

affect our financial markets?

Mr. COLBY. I did not hear the last question, I’m sorry.

Ms. HARRIS. How would you characterize the state of preparedness of our financial markets with respect to future terrorist attacks?

Mr. COLBY. Cybersecurity is, obviously, more amorphous than

physical threats because with physical threats you can assess a

particular location or building and say, what happens if that was

damaged?

Threats can come in a variety of different shapes and forms, but

there are very active efforts on the part of the financial institutions

and the self-reporting organizations that are dependent on information—and the securities markets are, at base, an information business—to protect themselves from the threats that could disable

their operations or create polluted information flows within the system.

So our sense is—and we are not alone in looking at this, but a

number of consultants and advisers have looked at it—it is something that you need to stay focused all the time, but the efforts

that have been dedicated to it have been very extensive and effective.

The overall state of preparedness has come a long way. We are

in much better shape than we were on September 11, but there is

more to be done. I think that both the agencies that are in charge

of it, the self-regulatory organizations that operate trading markets

and oversee members, and the financial firms themselves, are all

very focused on preparedness at the very highest levels of their institutions. It went from being one more cost item to being a critical

matter for each of these institutions.

Chairman BAKER. Thank you, Ms. Harris.

Mr. Inslee?

Mr. INSLEE. Thank you.

I wanted to ask about your findings on the automated review

group, the ARP. You seemed to suggest that—and I missed your

oral testimony, I am just reading here, I am sorry—but you seem

18

to suggest that there were inadequate resources to really complete

some fundamental reviews. I think you noted that there were only

7 out of 32, if I read your testimony right, that have been completed, which to me was a pretty glaring failure given the risk to

these markets.

Is that—from your review, is that simply a result of lack of resources and appropriations to the SEC? Is there some other inhibition? What is the reason for that failure?

Ms. D’AGOSTINO. The resources—the automation program could

use more resources and more experience levels. The problem is—

and this is true pretty much throughout the government, it is not

unique to the SEC; even GAO has some challenges in this area of

human capital—getting good technical people and being able to pay

them enough to retain them.

In saying that, I don’t mean to belittle our recommendation. It

is not just an SEC problem, but it is an important program, we

think, from the standpoint of the markets. It is the only oversight

program going that does what it does. It has been particularly challenged in terms of being able to handle high turnover rates, low

staffing levels, sometimes as low as three to four people. They are

now up to 10, I believe, to handle 32 market organizations.

As I think our report mentioned, Federal standards recommend

reviewing high-risk organizations once every year or two. This puts

the SEC program in a kind of straits.

Mr. INSLEE. This is one of the reasons we were concerned when

the administration tried to cut the SEC budget, at least below what

it was promised. We hope at the end of this budget cycle that sanity is restored and we get resources for getting this done. Thank

you for letting us know about that.

Ms. D’AGOSTINO. Thank you.

Chairman BAKER. Mr. Renzi?

Mr. RENZI. Thank you, Mr. Chairman.

Thank you, Ms. D’Agostino and Mr. Colby. I appreciate your time

and the detail and the professionalism of your report.

I come from the wildlands of Flagstaff, Arizona, and recently I

had an opportunity to sit in on a contingency where a regional attack was simulated at the Northern Arizona University dome. We

had the firemen and we had the police out there, and we had helicopter crews come in. It was a regional attack.

I learned that the rail runs through Flagstaff and the major

highways run through Flagstaff, and a big gas oil line runs through

Flagstaff. I also learned that a communications hub is in that area,

one that goes all the way to communicate to the east coast.

I said to myself, if we had a regional attack and it knocked out

the ability of L.A. to trade in New York, and we set up this

bicoastal confrontation between the L.A. investors not being able to

invest if the market stayed open—or would it close? What would

happen if all of a sudden we had this East-West conflict based

upon regional attacks, particularly in the West, if you don’t mind?

Ms. D’AGOSTINO. From a telecommunications standpoint?

Mr. RENZI. Telecommunications, and a communications hub.

Ms. D’AGOSTINO. The telecommunications infrastructure network

involves more than single paths for communications to go through,

and many different options for switching. So it is not clear that—

19

Mr. RENZI. That one would be knocked out—

Ms. D’AGOSTINO. You would have to really know where everything is.

Mr. RENZI. When you look at the manufacturing industry and

you look at upstream suppliers—I am sure you look at upstream

suppliers or vendors who provide you with integral portions of

what it takes for you to do business—have you looked from a contingency standpoint at all those integral nodes; not only communications, then, since we are able to go on a different path, but all

the upstream providers that are integral to your operation from a

contingency standpoint, like a manufacturer operation would look

upstream?

Ms. D’AGOSTINO. GAO has not done such a review, to my knowledge.

Mr. COLBY. You as the securities markets are supported by a lot

of suppliers that provide various services. Some of them are regulated, some are not.

We have been looking at the regulated ones within the limitations of our resources, and we have been talking to the securities

firms about themselves checking about the resilience of their providers, their service providers, because they rely on vendors of various types. So since September 11 there has been an extensive

amount of back-checking about resilience.

Mr. RENZI. Right. Any great organization has an Achilles’ heel.

That is what I am going for here. I am just a small businessman

from Arizona is all, but my instincts tell me that if we look at the

stock market and we look at other avenues to attack the stock markets, which is in the direct crosshairs of the terrorists, that next

time they are going to be smart enough to attack somewhere that

directly affects the stock market without attacking New York. So

in your course of discussions and development on this, I would urge

you to maybe take a look upstream. Thank you.

Chairman BAKER. Thank you, sir.

Mr. Israel?

Mr. ISRAEL. Thank you, Mr. Chairman. I apologize for being late.

The Committee on Armed Services has a hearing in conflict with

this, so I have been shuffling back and forth.

Several weeks ago I visited with a local company in my district

called Applied Visions. They are working with the Defense Advanced Research Projects Agency to develop software that would

protect financial institutions and others against a cyberattack, and

helps people assess the likelihood of a cyberattack.

One of the things that I learned at that meeting was that some

financial institutions in the New York area, I believe the New York

Stock Exchange and others, have created a kind of voluntary association, a kind of collective self-defense pact against cyberterrorism.

They work together to monitor potential attacks, and then they

alert each other if they believe an attack is imminent against any

of those that are included in that group.

The problem is that if they are aware of a potential attack

against a financial institution outside of that group, there is not

much that they can do about it. They do not necessarily share that

data. So here you have a group that has the potential of protecting

a large number of financial institutions against a cyberattack, but

20

does not have the wherewithal or the ability or willingness to alert

the broader community.

I was wondering whether in your research you were aware of

that group, and whether you can make specific suggestions on how

it can be broadened to provide the greatest extent of protection to

the largest number of financial institutions, rather than a select

few.

Mr. COLBY. That is not the only group operating, fortunately.

There are other channels to get the information out. There are a

variety of information dissemination groups, ISACs they are called.

There is one in the securities world operated by SIAC.

Also, on the government level there is a process developed

through this FBIIC channel so when a regulator learns of something that affects a regulated entity, they communicate it up so

that at a much higher level you can look and see, if there is a pattern here. Once the pattern is identified, the threat can be communicated back down to all people that might be potentially threatened.

Mr. ISRAEL. Are they required to communicate that threat?

Mr. COLBY. There is not a specific rule that requires it, but in

practice it is expected and it does happen, because there is a interconnection between the securities firms and their self-regulators;

maybe not quite daily, but a very close interaction beyond that; so

this sort of communication is expected to be communicated into the

channels and made—and it has happened. It has happened where

the firm will say, look, we have just had a problem. The regulators

then say a firm has just had a problem. We think it is internal,

but we then canvass and check and see if anyone else is having the

problems in order to identify whether it is a generalized problem

or infectious, or an internal glitch.

Mr. ISRAEL. One final question. Do either of you believe that the

current systems that are available to assess threat are effective, or

do we need to improve the software or improve other systems so

that we are better equipped to assess a potential cyberattack

against financial institutions?

Ms. D’AGOSTINO. I know there are a number of software options

out there. I know some very large multinational corporations have

even developed their own threat and risk assessment and risk

management software.

The important thing is the inputs into the decision-making models that the software represents. That would involve some good intelligence information about the threats and who is targeting you

and what kinds of possible scenarios. It is development of reasonable and, I guess, viable scenarios for you to play out, then,

through the software.

So just as important as software solutions are getting that good

data and those viable scenarios to input through those models and

get you some reasonable outputs to assess then, and to make decisions on your security solutions.

Mr. ISRAEL. Very good. Thank you. I yield back, Mr. Chairman.

Chairman BAKER. Thank you, Mr. Israel.

I want to express to each of you and the agencies you represent

my appreciation for your appearance and your work.

Mr. MANZULLO. Mr. Chairman.

21

Chairman BAKER. Sorry. You are recognized. I apologize.

Mr. MANZULLO. Thank you.

Thank you for coming. I am sorry I was not here for the testimony.

Ms. D’Agostino, as I read the testimony, on page 4 it is absolutely startling that companies that are professionals in back-ups

and redundancy systems for the purpose of security and storage of

equipment in many cases never took the time to track the path or

switches, so that a company’s main path or switch would also be

the same path or switch of the company hired for the redundant

system.

That is pretty dumb. I don’t understand how a security company

could hold itself out as being an expert—and I see some guys back

there nodding their heads, ′′Yes, maybe we got ripped off.′′ ask for

your money back.

But even under a situation where there had been, for example,

a fire in the building and not an act of terrorism, this statement

is absolutely startling. I am not one big into licensing for professionals, but in your investigation, the people that install these redundant systems for backup of material, et cetera, are they held to

a particular licensing standard or a degree of education? Is there

some kind of a professional path, or do they just have a nice white

business card with a nice emblem and their name is printed in

gold?

Ms. D’AGOSTINO. We don’t really have any information. We didn’t

do any work on that. I think in some cases, as was relayed to us,

the backup or alternate providers of telecommunications actually

did have at one time separate lines and paths; but then later after

the contract, sometime later and without notifying the client,

moved the paths into the same lines as Verizon.

Mr. MANZULLO. That would be a breach of contract, as far as I

am concerned.

Ms. D’AGOSTINO. We—

Mr. MANZULLO. That is none of your—but that is extremely serious, because the companies hired to do this are—boy, I woke you

government employees up there, didn’t I? Everybody is nodding

and saying yes.

I don’t have a very technical background and don’t understand

a lot of these terms that are used in communications, but I just—

what I see here is a good-faith effort on the part of these houses

to back up their system. You don’t anticipate an emergency such

as September 11, but they do anticipate somebody getting into

their system and screwing up their lines. They do anticipate, you

know, a flood or water getting into the basement, or a lightning

strike, or a surge, or a fire on their premises.

Here in good faith they hire these firms, and initially, as you

said, there are separate lines. Then the lines get merged by the security firms. I consider that to be a very serious breach, and there

has to be a tremendous amount of responsibility that is placed

upon those companies before setting up a system like that.

You don’t have to respond to that. This is more of a comment.

Mr. COLBY. I would just say this is something that came as a

surprise to many, including the firms that believed that they had

built redundancy. Apparently, as Davi said, they contracted for difVerDate 11-MAY-2000 11:23 Jun 05, 2003 Jkt 000000 PO 00000 Frm 00027 Fmt 6633 Sfmt 6633 C:\DOCS\86850.TXT HBANK1 PsN: HBANK1
22

ferent systems. They were told by the contract providers what the

routes were. The routes were different when they contracted for

them, but apparently there was a freedom under the contracts to

subcontract, and sometimes in the course of the subcontracting,

they got routed through paths that were not diverse—but now

steps have been taken to help address this. One includes development by the Securities Information Automation Corporation of its

own network. Bob Britz, who is testifying later, is a co-president

of that organization and may be able to give you more information

on that.

But realizing in hindsight this was a problem, there have been

proactive steps taken to create diverse alternatives to the existing

telecommunications—

Mr. MANZULLO. But it would be hindsight by the houses. They

are not charged with that type of knowledge, and certainly how

could it be hindsight by the people putting in the security systems

when it does not take but a second grade education to figure out

that you have a separate path? I am a pilot, I am not current in

my license, but in large aircraft you always have a redundancy system so if something breaks down, you can go onto something else

without depending upon those lines.

Maybe I am being hard on these companies, but perhaps I am

not. If you contract for security, and you get two lines, and then

somebody brings those two lines into one to save some money, I

just think that is a very serious breach of ethics. Thank you.

Chairman BAKER. Thank you, Mr. Manzullo.

I do appreciate your appearance here today, the work you have

done, but also wish to make it clear that from the committee perspective we understand this is an ongoing and continual responsibility.

In the scope of your services if you identify things that the Congress should respond to, whether it be legislative authority, and

certainly matters relating to necessary funds to conduct these activities, the committee would like to continually be informed of

those needs so we may be appropriately responsive. We certainly

don’t want to do anything that contributes to exacerbating a very

difficult circumstance when this eventually may reoccur. Thank

you very much for both being here.

At this time, I would ask that panelists from the second panel

come up to the table. Good afternoon and welcome. I certainly appreciate each of your appearances here this afternoon.

In order to move us along, I would begin by introducing our first

witness, Mr. Richard Ketchum, President of the NASDAQ. We certainly welcome your participation here this afternoon.

STATEMENT OF RICHARD G. KETCHUM, PRESIDENT, NASDAQ

STOCK MARKET

Mr. KETCHUM. Thank you, Mr. Chairman. Thank you, members

of the subcommittee. I want to congratulate you on having this

hearing. It is clearly timely, and I think the oversight this committee provides on this critical issue is very, very important. I appreciate this opportunity to describe the steps that NASDAQ has

taken to ensure our business continuity in the event of another catastrophic event.

23

Any analysis of industry preparedness must first review the market’s response to the 9/11 attacks. Because our main and backup

technology centers are located outside Manhattan, it is important

to note at the outset that at no time following the disaster that occurred on September 11 were NASDAQ’s systems inoperative. At

the time of the 9/11 attacks, trading was suspended, but NASDAQ

systems and network continued to operate, and indeed provided an

opportunity for testing for the firms that operate in our marketplace. Therefore, our primary concern regarding reopening the markets after 9/11 related to our ability to connect with the firms that

are active in NASDAQ and bring liquidity and ordered flow to our

marketplace.

Following the 9/11 attack, we worked closely with the SEC,

Treasury, Federal Reserve, the NASD and the New York Stock Exchange, as well as key member firms, to resume trading as soon

as possible. That cooperation was an important factor in reopening

the markets and restoring investor confidence. I am very proud of

the efforts of so many talented people at NASDAQ who worked

tirelessly with so many others in the financial services community

to bring our markets back on that Monday, 9/17, safely and without incident.

While the events of September 11 did not fundamentally change

NASDAQ’s understanding of the potential range of threats to the

financial services sector, they amplified awareness of the potential

reach that could be exerted by such threats. NASDAQ has implemented a fully developed business continuity disaster recovery plan

that will allow the continued trading of NASDAQ securities in the

event that one of the NASDAQ data facilities is rendered inoperative.

In short, we believe that disasters are managed not only by hardening potential points of failure, but also by building redundancies

wherever possible into the entire trading network, and by regular

testing of those backup capabilities.

Geographic diversification of redundant facilities is a core component of NASDAQ’s business continuity strategy. Our redundant

data facilities are located hundreds of miles from one another in

differing geologic and climatic zones, so that the same natural

event has a low likelihood of impacting both sides. NASDAQ also

decreases its vulnerability by operating from separate utilities and

local telecommunications services.

While we are confident that our system’s designs and contingency plans contain appropriate levels of redundancy, NASDAQ appropriately works with member firms to support them in enhancing

their backup capabilities as well. In that connection, NASDAQ,

working with the NASD, has submitted a ruling filing, as has the

New York Stock Exchange, that would require broker/dealers trading in NASDAQ securities to engage in appropriate business continuity planning. As a result of each of these ongoing efforts, I am

sure that our equities markets are more resilient than they were

on September 11, 2001.

We have also worked closely with the GAO as it evaluated

NASDAQ’s preparedness and developed its findings and recommendations. We generally share their view on the need to develop goals, strategies, and sound practices to improve the resilVerDate 11-MAY-2000 11:23 Jun 05, 2003 Jkt 000000 PO 00000 Frm 00029 Fmt 6633 Sfmt 6633 C:\DOCS\86850.TXT HBANK1 PsN: HBANK1
24

iency of trading functions and enhance the SEC’s funding for technology and staff.

We are also working with the SEC and the New York Stock Exchange to develop a plan under which NASDAQ and the New York

Stock Exchange can trade each other’s securities in the event of a

disaster that rendered either market inoperable.

It is important to emphasize that these plans are only a final

layer of protection for the U.S. Securities markets. The first line of

defense for stock markets will always be their own backup systems,

and the continued operation of each market has to be the first priority.

In conclusion, following September 11, the U.S. Financial industry demonstrated its resilience and resolve to maintain the most

liquid and stable markets in the face of terrible challenges. Truly,

NASDAQ’s trading network has demonstrated its unique value as

part of that infrastructure. However, our work is not done.

NASDAQ, the government, and the financial services industry will

need to continue to work in concert to ensure that trading can resume following a catastrophic event.

Thank you again for providing me this opportunity to describe

the steps NASDAQ has taken, and I would, of course, be happy to

answer any questions from the committee.

Chairman BAKER. Thank you, Mr. Ketchum.

[The prepared statement of Richard G. Ketchum can be found on

page 278 in the appendix.]

Chairman BAKER. Our next witness is Mr. Robert Britz, president and chief operating officer, New York Stock Exchange.

STATEMENT OF ROBERT G. BRITZ, PRESIDENT AND CO-CHIEF

OPERATING OFFICER, NEW YORK STOCK EXCHANGE

Mr. BRITZ. Thank you, Mr. Chairman. I appreciate the opportunity to be here before you and before the distinguished members

of this committee.

As the president of the Exchange, I lead the Exchange’s Equities

Group, which is responsible for the day-to-day operation of our

trading floor, our data processing sites, our technical infrastructure, software development, and our information business. I also

head the Exchange’s International Group, which is responsible for

maintaining relationships with international non-U.S. Companies,

as well as securing new non-U.S. Listings.

In addition to that, I am chairman and CEO of the Securities Information Automation Corporation, or SIAC, which has been referred to once or twice already today.

On behalf of the NYSE and our chairman, Dick Grasso, I thank

the subcommittee for providing this forum to discuss business continuity and contingency planning in conjunction with the release

this afternoon of the report of the GAO on that issue.

The report released by the GAO today is the result of more than

17 months of work that included reviewing business continuity

plans and the physical and information security measures of the

NYSE and SIAC. GAO conducted a dozen visits and follow-up telephone calls with us. We would like to thank the GAO staff for their

professionalism throughout this important review.

25

The NYSE has developed forward-looking business continuity

strategies that harden our physical and information technology infrastructure and improve our ability to withstand or recover from

a disaster.

Our approach consists of three components: to prevent an attack

or natural catastrophe, to withstand them, and to recover from

them. In close cooperation with Federal, State, and local law enforcement, the Exchange has expanded its physical security perimeter. We have also taken measures to increase the screening of all

people, package delivery, and mail that enters the NYSE or our

data centers, and we have instituted a more restrictive policy on

visitors and deliveries.

The NYSE employs a rigorous information technology structure

to ensure the reliability of all information we receive, process, and

disseminate to the world every day. We employ external perimeters, firewalls, intrusion detection, and international access controls, and we conduct penetration testing using so-called friendly

hackers.

SIAC chairs the Financial Services Information-Sharing Analysis

Center, which was referred to earlier, and that works with government agencies to identify and assess potential threats. All of our

facilities have emergency generator backup and store water on site

to enable continued operations after the loss of power or water. If

we lose natural gas service, we can operate on fuel oil.

Our primary trading floor is actually five distinct trading floors

located in four different buildings. Trading can be moved from one

location to another as may be necessary, a so-called compaction exercise.

Our plans include redundant, active data centers served by different power grids and multiple telecom central offices, with each

site sharing the daily processing load generated by trading about

1.4 billion shares a day. All of our facilities have backup power

generators and UPS. We have a backup trading floor that was instituted post-9/11, developed at a cost of approximately $25 million.

This alternative venue would support the trading of all NYSE-listed securities in a very conventional market structure model on a

next-day basis after an event that disabled the primary trading

floor.

The NYSE and SIAC have launched Secure Financial Transaction Infrastructure, SFTI. That has been referenced once or twice

already today. It is a primary extranet servicing the financial industry. It provides diverse, fully redundant routing to the SIAC

data centers for member firms, national market participants that

are connected to the NYSE, to the American Stock Exchange, the

National Market System, and DTCC’s IT infrastructure as well.

Following September 11, 2001, U.S. equity trading was interrupted because many broker/dealers lost their connectivity to the

markets due to the damage suffered by a major central telecommunications switching facility at Ground Zero. SFTI addresses

this by enabling member firms to connect to the NYSE’s data centers via private fiberoptic connections to multiple access centers,

so-called carrier hotels, throughout the New York metropolitan

area, as well as in Boston and Chicago.

26

SFTI possesses no single point of failure. All of SFTI’s equipment, connections, power supplies, network links, and access centers are redundant, and its architecture features independent, selfhealing fiberoptic rings. If a SFTI fiber pathway is compromised,

financial data traffic is simply rerouted.

The NYSE is ready to trade the top NASDAQ stocks, approximately 250, which account for, we believe, 80 percent of the average daily volume in the unlisted market. All NYSE systems have

been modified and can support the four character symbols used by

such unlisted stocks so that there is no need for modification of the

broker/dealer systems. Because the NYSE’s capacity is today about

five times our average daily volume, the incremental volume associated with trading these NASDAQ stocks can well be absorbed.

The NYSE is committed to ensuring that the U.S. capital markets remain the envy of the world, and to insulate them from interruption by attack or natural catastrophe by protecting them from

threats, by creating an infrastructure that can withstand attack or

catastrophe, and by developing contingency plans that enable quick

recovery.

In the event a terrorist attack or catastrophe achieves penetration and takes out our real-time infrastructure, the NYSE is able

to resume trading in a timely, fair, and orderly fashion that will

ensure that every single one of America’s 85 million investors has

access to our member firms and to us.

Mr. Chairman, I want to thank you for the opportunity to

present this testimony, and I would be happy to answer any questions you or the committee members may have.

Chairman BAKER. Thank you, Mr. Britz.

[The prepared statement of Robert G. Britz can be found on page

40 in the appendix.]

Chairman BAKER. Our next participant is Mr. Donald Kittell, executive vice president, Securities Industry Association.

STATEMENT OF DONALD D. KITTELL, EXECUTIVE VICE

PRESIDENT, SECURITIES INDUSTRY ASSOCIATION

Mr. KITTELL. Thank you, sir. Thank you, Mr. Chairman and

Ranking Member Kanjorski, and members of the committee. I appreciate the opportunity to describe for you the significant progress

that securities firms have made in response to 9/11.

The most significant outcome of 9/11, in my mind, was the realization that we are under attack. 9/11 did not occur in our own

backyard, it occurred in our own front yard. What has been the impact of that realization? We now know that the danger is real. We

assume that additional attacks will happen. We are sensitive to the

expanded range of potential scenarios impacting both physical and

cybersecurity that exist. We agree with the comments of the earlier

discussion about cybersecurity.

We have established industry command centers which are linked

with other centers in municipal, State, and Federal Government,

homeland security, as well as other industry sectors. We are engaged in a long-term strategy to disperse industry infrastructure.

We are making significant investments in effective backup facilities

which are currently being tested. We have recognized that disaster

recovery is the responsibility of the entire enterprise of a firm and

27

not just its information technology or operations groups. We recognize that we are dependent on external critical service providers,

such as telecom, transportation, power, and municipal services

such as police and fire.

We cannot say that we can defend against any and all attacks;

we can say that we understand the threat and have taken significant steps towards prevention and recovery.

I would like to highlight three aspects of the industry’s efforts.

First, the financial services sector is sharing resources through the

Financial Services Sector Coordinating Council. This group represents over 20 trade associations and industry organizations,

many of whom did not speak to each other prior to 9/11, but are

now sharing continuity planning resources.

An example of the effectiveness of this group is the coordination

of efforts across the sector with financial services regulators, so we

have 15 financial services regulators with a single point of contact

to 20 or more industry associations.

A third example is the coordination of the Financial Services Information Sharing and Analysis Center, which Bob Britz just

talked about, which addresses cybersecurity attacks, which gives us

the ability to communicate with each other in a rapid fashion.

The second important aspect I would highlight is the positive relationship between the private sector and the financial services sector. This relationship was remarkably effective in the immediate

response to 9/11, and it continues to be so in the industry’s efforts

to strengthen resiliency over the last year and a half.

An example of that is the dialogue on the Financial and Banking

Information Infrastructure Committee, or FBIIC, that Bob Colby

referred to earlier; the financial services regulators, chaired by the

U.S. Treasury and the FSSC that I referred to earlier representing

the private sector.

The second example is the white paper dialogue between the regulators and the industry on clearance and settlement infrastructure, which was discussed earlier. There were actually two papers

on clearance and settlement, both which raised significant questions and industry participants referred to with thoughtful comments. There is continuing dialogue on this. I think Mr. Colby said

the next version of the second white paper would be out within a

month, and we look forward to continuing that dialogue with the

regulators.

The third important aspect that I would highlight is the positive

contribution of the GAO. We worked with the GAO, notably on

Y2K 2 years ago. We found their input to be extremely constructive. We have had the opportunity to review a draft of the report

released today, and although I have not had the opportunity to review this with our member firms, I do want to make the following

comments.

First, we agree with the GAO findings that business continuity

plans need to be improved over the pre-9/11 status. I also note that

the period of the GAO study was, I believe, February to June of

2002, and a great deal has happened since that time.

We also agree with the specific areas for improvement highlighted in the GAO report, such things as improved backup facilities, greater geographic dispersion, and so on.

28

Secondly, SIA agrees that the clearance and settlement facilities

are critical to an effective resiliency plan. We forwarded our comments on the white paper, and we are very pleased with the results

so far of the organizations involved in clearance and settlement.

We also agree with GAO that the trading facilities are also critical to an effective resiliency plan. There is no better example than

the effort to open the market following 9/11.

We also agree with the SEC’s comments that the regulatory environment around the trading function is different than the regulatory environment around clearance and settlement. However, we

are very confident that those issues can be resolved, and that the

firms certainly do not believe that there should be any less emphasis on trading facilities than on clearance and settlement.

Finally, SIA supports additional funding for the SEC as a general matter, but particularly including its oversight of business continuity.

The securities industry has built on its commitment to operational recovery, its experience on Y2K, and other industrywide

projects to effectively address the threats posed by terrorist attacks. The efforts of individual organizations, the coordination of

activities across all the sectors in the financial services sector, the

positive relationship with the regulators, with the oversight of the

Congress and the GAO, is a strong combination for an effective response to terrorism.

We have accomplished a great deal in the last year and a half.

We understand there is more to be done. We are committed to the

task ahead.

Thank you.

Chairman BAKER. Thank you very much, sir.

[The prepared statement of Donald D. Kittell can be found on

page 290 in the appendix.]

Chairman BAKER. Our next witness is Mr. Micah Green, president of the Bond Market Association. Welcome, Mr. Green.

STATEMENT OF MICAH S. GREEN, PRESIDENT, THE BOND

MARKET ASSOCIATION

Mr. GREEN. Thank you, Mr. Chairman and Mr. Kanjorski.

Mr. Chairman, I want to thank you for the opportunity for us to

give our testimony, and really congratulate you for the leadership

you have shown on this issue, and for the work of the SEC and

other regulators in working with the industry to try to move on

this important issue.

I will touch briefly on the business continuity issue, but want to

spend most of my oral remarks telling you about the bond markets

and how they responded at the time of 9/11, beyond, and then looking to proposals that could affect the future.

Briefly on business continuity plans, I would frankly associate

myself with the remarks of Mr. Kittell. We have worked very closely with the SIA to provide the bond market perspective on the

issue of business continuity, and we have been participating in the

coordinating councils.

We, too, have set up a management council within our organizations working with our members to create redundancy, and frankly

working within the association to create the ability to communicate

29

with our membership, because what we learned at that time is that

communicating within the breadth of the industry was almost as

important as the industry itself communicating with its customer

base. So I would really stand by what our colleagues at SIA said

about business continuity planning.

But let me relate it to the bond markets, because the bond markets are very different in the way they operate versus the equity

market.

Unlike the centralized, exchange-traded New York Stock Exchange and other equity markets, the bond markets are inherently

a decentralized, over-the-counter market, which means it is a dealer-to-dealer marketplace. People buy and sell bonds when they

want to buy them, where they want to buy them. There are hours

of trading, but frankly, it is a 24-hour marketplace.

The New York marketplace right now is starting to wind down.

The Japan and other Asian marketplaces are starting to crank up.

About 11 hours from now, the London and other European markets

will crank up. It is a never-ending cycle.

In fact, an interesting thing to remember in 9/11, much of the

trading that occurs in the bond markets, particularly in the repurchase agreement market, which is the funding mechanism for

many of the trades, actually occurs before 9 o’clock in the morning.

So when that first plane hit the World Trade tower at 8:46 a.m.

And hit the largest inter-dealer/broker of all, Cantor Fitzgerald,

there were hundreds of billions of dollars of transactions that had

already occurred that day. In fact, daily volume in the bond markets is over $600 billion a day. There are almost $20 trillion of bonds outstanding, and it is

a very actively traded market. So when those planes hit, it was not

just about getting the markets back open; it was also about figuring out what took place that went down with those towers, so the

effect on the clearance and settlement process. And figuring out

how to get the bond markets back open was as much about trying

to reconcile what had occurred so those trades could be completed

and those trades could be closed.

Interestingly, while the stock markets were able to open up

through these heroic events on Monday, September 17, the bond

markets, because of their decentralized character, were able to get

back up and running on an orderly basis at 8 a.m. on Thursday

morning, September 13. Interestingly, though, bonds never stopped

trading. There were trades done in the afternoon of 9/11. The Fed,

the Federal Reserve, in its exercising of monetary policy, came to

the marketplace to provide liquidity to the marketplace in the government securities market on 9-12.

So, as you see, the bond markets can operate differently. Because

of their role in the financial system, keeping markets open is crucially important.

It is a good segue into a proposal that is now pending coming out

of the Municipal Securities Rulemaking Board in their post-9/11 efforts. They have recommended to grant them the authority—the

Municipal Securities Rulemaking Board, a self-regulatory organization governing just the municipal securities market—to grant them

the authority in the case of an emergency to, by regulation, halt

trading in those markets.

30

The reaction of our association has been one of strong opposition

to that, because we believe, frankly, in the time of an emergency

is when you want markets open. You want capital to flow as

smoothly and as easily as possible, so we oppose it philosophically.

We do understand, though, that policymakers such as yourselves

or the SEC or other regulators may want some degree of authority

if the worst, the unthinkable, God forbid, ever happens again,

much worse than 9/11. So the Bond Market Association, while we

have a philosophical opposition to a self-regulatory organization, or

frankly, any authority, saying decentralized debt markets should

be halted by law, we realize you may have an interest in having

some Federal authority.

We could live with a governmental authority, not a self-regulatory authority but a governmental authority, at the highest possible level to deal with emergencies—we can’t tell you what authority that is because of the unique nature of the regulatory scheme

covering the bond markets generally, frankly—working with the

President’s Working Group, which includes the SEC, the Treasury,

the Fed, including the Chicago markets, so that there is a coordinated response, and that authority should be narrowly defined so

that it is absolutely under a severe catastrophe. It is not about a

breakdown of any computer system or a breakdown of any trading

system, but it really has to be a catastrophe, because in times of

stress, we need markets open. In times of stress, we need capital

to flow. Because of the unique, decentralized nature of the bond

markets, they are able to more naturally operate in those circumstances. We believe they should be open as much as possible.

That would really conclude my oral remarks. I would be happy

to answer any questions you would have.

Chairman BAKER. Thank you, Mr. Green.

[The prepared statement of Micah S. Green can be found on page

185 in the appendix.]

Chairman BAKER. I would ask the counsel and members, my side

has pretty much decided. I have just a few questions that I would

pose for the record for a written response. Mr. Kanjorski may have

a comment or two.

In order to use our time efficiently, I would conclude our hearing,

because we have a series of three votes which would keep us for

a bit.

Does anyone have any objection?

Mr. Kanjorski?

Mr. KANJORSKI. No, Mr. Chairman.

Chairman BAKER. If I may, let me just pose a few questions.

Also, the record will remain open for Members to, in writing,

submit further inquiries at their leisure. That certainly would be

preserved.

Chairman BAKER. Mr. Scott, do you have any comment?

Mr. SCOTT. Just one question, sir.

Chairman BAKER. One second, and we will try to get to you.

I noted in the GAO report, Mr. Britz, that there is a comment

that the SEC has asked the New York Stock Exchange and

NASDAQ to take steps to ensure their information systems can

conduct transactions and securities that the other organizations

trade. However, under this strategy the NYSE does not plan to

31

trade all NASDAQ securities, and neither exchange has fully tested

its own or its members’ abilities to trade the other exchange’s

deals.

Given our time constraints, I don’t expect a discussion on it at

the moment, but if you can address that section of that report and

tell us what is planned; or perhaps since the date of the report has

that been addressed.

Secondly, I would like each of your opinions concerning the

GAO’s observation that the SEC did not make mandatory the ARP

program rules, but expected the changes that they recommended

and the clearing organizations to comply with the various information technology and operations practices voluntarily.

I would like to get back from you a statement if there is a problem with mandatory compliance, the reasons therefore; or if there

isn’t, is there some general review by your respective bodies as to

when or if the SEC should adopt such mandatory compliance?

And then thirdly, the presentation of the white paper expected

in a month, I don’t know if we will have another hearing on the

matter, but certainly we would like to have industry communication to us about the outcomes of modifications made and agreements reached as a result of the next white paper.

Chairman BAKER. Mr. Kanjorski.

Mr. KANJORSKI. Mr. Chairman, I want to congratulate the panel

for a great report to us.

The only thing, Mr. Britz, I recently visited the chairman’s office

in October. I am worried about the electronic controls on the thermostat.

Chairman BAKER. Mr. Scott.

Mr. SCOTT. One of the things—one of the conclusions that was

reached in a report released today was the length of time that our

markets could stay down, that we could absorb certain lengths of

times. I want to say with that how proud I think all America was

that we were able to get back up and running so quickly after that

devastating hit. But it did go on to say that there is a certain

amount of time before the economy will be affected.

Do we have any idea of how long that delay would be before the

economy is really affected in terms of days, that it would be negatively affected?

Mr. BRITZ. I am not an economist, Congressman, so I would be

very loath to say it is 2 days, 4 days, or 6 days. I will say, coming

out of 9/11, we were down from the 11th until the 17th. If we were

to have the same kind of circumstance occur again, I am very confident that our markets would be up in a day or two; or let me put

it this way, technically they would be able to be up in a day or two.

There may be policy considerations as to why that is not a good

idea.

From an infrastructure point of view, I think we have put in

place the kind of backup and contingency planning and infrastructure that would not give rise to the 4- or 5-day kind of outage that

we had on September 11, 2001.

Mr. GREEN. I would just add that if the system of payments is

affected, Congressman—and, for example, if the Federal Reserve

cannot come to market to add liquidity because the marketplace is

closed, that has an immediate effect on the macroeconomy. But in

32

the microeconomy, an investor who wants to sell security because

they need cash to pay a kid’s tuition bill, that affects them immediately when they need that money, so you need to open markets

as quickly as possible.

Chairman BAKER. Thank you each for your participation. There

will be further follow-up questions in the offing, but we do request

your continued information flow to the committee to help us understand our circumstance. Thank you.

[Whereupon, at 4:53 p.m., the subcommittee was adjourned.]

(33)

A P P E N D I X

February 12, 2003

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304