U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

27–809 PDF 2006

THE STATE OF SMALL BUSINESS SECURITY IN

A CYBER ECONOMY

HEARING

BEFORE THE

SUBCOMMITTEE ON REGULATORY REFORM AND 

OVERSIGHT

OF THE

COMMITTEE ON SMALL BUSINESS 

HOUSE OF REPRESENTATIVES

ONE HUNDRED NINTH CONGRESS

SECOND SESSION

WASHINGTON, DC, MARCH 16, 2006

Serial No. 109–44

Printed for the use of the Committee on Small Business

(

Available via the World Wide Web: http://www.access.gpo.gov/congress/house 

COMMITTEE ON SMALL BUSINESS 

DONALD A. MANZULLO, Illinois, Chairman 

ROSCOE BARTLETT, Maryland, Vice 

Chairman 

SUE KELLY, New York 

STEVE CHABOT, Ohio 

SAM GRAVES, Missouri 

TODD AKIN, Missouri 

BILL SHUSTER, Pennsylvania 

MARILYN MUSGRAVE, Colorado 

JEB BRADLEY, New Hampshire 

STEVE KING, Iowa 

THADDEUS MCCOTTER, Michigan 

RIC KELLER, Florida 

TED POE, Texas 

MICHAEL SODREL, Indiana 

JEFF FORTENBERRY, Nebraska 

MICHAEL FITZPATRICK, Pennsylvania 

LYNN WESTMORELAND, Georgia 

LOUIE GOHMERT, Texas 

NYDIA VELA ́ ZQUEZ, New York 

JUANITA MILLENDER-MCDONALD, 

California 

TOM UDALL, New Mexico 

DANIEL LIPINSKI, Illinois 

ENI FALEOMAVAEGA, American Samoa 

DONNA CHRISTENSEN, Virgin Islands 

DANNY DAVIS, Illinois 

ED CASE, Hawaii 

MADELEINE BORDALLO, Guam 

RAU ́ L GRIJALVA, Arizona 

MICHAEL MICHAUD, Maine 

LINDA SA ́ NCHEZ, California 

JOHN BARROW, Georgia 

MELISSA BEAN, Illinois 

GWEN MOORE, Wisconsin 

J. MATTHEW SZYMANSKI, Chief of Staff 

PHIL ESKELAND, Deputy Chief of Staff/Policy Director 

MICHAEL DAY, Minority Staff Director

SUBCOMMITTEE ON REGULATORY REFORM AND OVERSIGHT 

W. TODD AKIN, Missouri Chairman 

MICHAEL SODREL, Indiana 

LYNN WESTMORELAND, Georgia 

LOUIE GOHMERT, Texas 

SUE KELLY, New York 

STEVE KING, Iowa 

TED POE, Texas 

MADELEINE BORDALLO, Guam 

ENI F. H. FALEOMAVAEGA, American 

Samoa 

DONNA CHRISTENSEN, Virgin Islands 

ED CASE, Hawaii 

LINDA SA ́ NCHEZ, California 

GWEN MOORE, Wisconsin

CHRISTOPHER SZYMANSKI, Professional Staff

(II) 

C O N T E N T S 

WITNESSES

Page 

Furlani, Ms. Cita M., Acting Director, Information Technology Laboratory, 

National Institute of Standards and Technology .............................................. 3

Parnes, Ms. Lydia, Director of Bureau of Consumer Protection, Federal Trade 

Commission ........................................................................................................... 5

Johnson, Mr. Larry D., Special Agent in Charge, Criminal Investigative Division, U.S. Secret Service ...................................................................................... 7

Martinez, Mr. Steven M., Deputy Assistant Director Cyber Division, Federal 

Bureau of Investigations ..................................................................................... 9

Schwartz, Mr. Ari, Deputy Director, Center for Democracy and Technology ..... 17

Salem, Mr. Enrique, Senior Vice President, Security Products & Solutions, 

Symantec Corporation ......................................................................................... 18

Kaliski, Dr. Burton S., Jr., Vice President of Research, RSA Security, Chief 

Scientist, RSA Laboratories ................................................................................ 20

Cochetti, Mr. Roger, Group Director—U.S. Public Policy, Computing Technology Industry Association ................................................................................ 22

Schmidt, Mr. Howard, President & CEO, R & H Security Consulting, LLC. .... 24

APPENDIX

Opening statements: 

Akin, Hon. W. Todd .......................................................................................... 34

Prepared statements: 

Furlani, Ms. Cita M., Acting Director, Information Technology Laboratory, National Institute of Standards and Technology .............................. 35

Parnes, Ms. Lydia, Director of Bureau of Consumer Protection, Federal 

Trade Commission ........................................................................................ 42

Johnson, Mr. Larry D., Special Agent in Charge, Criminal Investigative 

Division, U.S. Secret Service ........................................................................ 59

Martinez, Mr. Steven M., Deputy Assistant Director Cyber Division, Federal Bureau of Investigations ....................................................................... 64

Schwartz, Mr. Ari, Deputy Director, Center for Democracy and Technology ............................................................................................................. 68

Salem, Mr. Enrique, Senior Vice President, Security Products & Solutions, Symantec Corporation ........................................................................ 75

Kaliski, Dr. Burton S., Jr., Vice President of Research, RSA Security, 

Chief Scientist, RSA Laboratories ............................................................... 80

Cochetti, Mr. Roger, Group Director—U.S. Public Policy, Computing 

Technology Industry Association ................................................................. 92

Schmidt, Mr. Howard, President & CEO, R & H Security Consulting, 

LLC. ............................................................................................................... 103

Additional Material: 

National Small Business Association 2006 Malware Survey ........................ 116

(III) 

(1)

THE STATE OF SMALL BUSINESS SECURITY 

IN A CYBER ECONOMY 

THURSDAY, MARCH 16, 2006

HOUSE OF REPRESENTATIVES

SUBCOMMITTEE ON REGULATORY REFORM AND

OVERSIGHT

COMMITTEE ON SMALL BUSINESS

Washington, DC 

The Subcommittee met, pursuant to call, at 2:00 p.m. in Room 

2360 Rayburn House Office Building, Hon. W. Todd Akin [Chairman of the Subcommittee] presiding. 

Present: Representatives Akin, Kelly, Bordallo. 

Chairman AKIN. The hearing will come to order. Good afternoon 

and welcome everybody to today’s hearing, ‘‘The State of Small 

Business Security in a Cyber Economy.’’ I want to especially thank 

those witnesses who have traveled long distances to participate at 

this important hearing. 

Today this Subcommittee seeks to better understand the impact 

small business cyber security has on the well-being of the economy. 

This Subcommittee also seeks to determine the types of threats 

that small businesses encounter on a daily basis. According to the 

Small Business Technology Institute Report released in July 2005: 

‘‘If small businesses are not made fully aware of the economic impact of information security incidents, they will continue to underinvest in information security protection, and their exposure will 

continue to increase as their infrastructures become more complex. 

This increasing individual exposure, when aggregated across the 

many millions of small businesses in the U.S., supporting more 

than half of the Nation’s GDP, represents an extremely high and 

worsening point of exposure for the U.S. economy as a whole.’’ 

Businesses do not have to sell their products online to be at risk 

of a security breech. They are exposed simply by being connected 

to the internet. The Government and large firms have dedicated information technology professionals who protect their electronic infrastructure. 

Small businesses seldom have either dedicated IT professionals 

or the resources necessary to provide adequate levels of protection. 

I look forward to hearing the testimony of your witnesses to learn 

more of what we can do to protect small business from cyber security threats. I now yield to the gentlelady from Guam, Madame 

Bordallo. 

[Chairman Akin’s opening statement may be found in the appendix.] 

2

Ms. BORDALLO. Thank you very much, Mr. Chairman Before I 

begin my opening remarks, I would like to recognize a very young 

witness in our audience today and that is Mr. Andrew Cochetti. He 

is here on an assignment with his social studies class. Welcome, 

Andrew. He is the son of Roger. 

Internet and telecommunication technologies have a profound 

impact on our daily lives. They have changed how we communicate 

with friends and family and how we interact with our Government. 

America’s 23 million small businesses are some of the savviest 

users of telecommunication technology using the internet to access 

new markets to grow and to diversify. In fact, American small businesses have a strong record of being the driving forces behind further technological innovation and the development of innovative 

business models that we now take for granted. 

Along with being connected comes being exposed to new threats. 

The risks associated with turning more of our lives and business 

into digital i’s and o’s and burst of light over fiber optic cables are 

significant and require vigilant management. A single individual 

can design computer viruses that can be spread across continents 

in milliseconds. 

Identity theft compromises credit records, businesses and, sadly, 

lives. Destructive computer viruses and other malicious Internet 

activities pose severe problems for small business owners that are 

not prepared to mitigate this kind of a risk. This exposure can even 

result in thousands of hard-earned revenues being lost. 

An FBI-conducted survey of computer related crimes including viruses, spyware, and theft revealed that a total of nearly $70 billion in 2005 alone was lost with companies incurring an average 

of $24,000 in losses. Losses like this are make or break for some 

businesses, and sadly some small companies and computer users 

fail to recognize the benefit of cyber risk mitigation as an investment until it is too late. 

The Federal Trade Commission, the FBI, the Secret Service, and 

the National Institute of Standards and Technology have all embarked on efforts to offer federal programs designed to educate the 

public on computer security. In fact, federal cyber security spending has increased from $5.6 billion in 2004 to more than $6 billion 

in 2007 and is expected to hit $7 billion by 2009. 

I am concerned that despite the rise in cyber attacks over the 

past few years and the growing impact they have had on small 

businesses in America, the Small Business Administration, the sole 

agency charged with aiding America’s entrepreneurs, does not have 

updated internet security information readily accessible on its 

website. 

Like all of us, small firms are exposed to cyber attacks and vulnerable to their malicious affects. Today’s hearing will give us an 

opportunity to review whether the increases in federal investment, 

both human and financial resources, have had or can have an impact on small firm’s ability to mitigate their cyber risk. 

The testimony that we hear today I hope will both help us to better understand what role the Congress and the Federal Government can play in educating the American public and the business 

community to the risks that they face from cyber crimes and what 

recommendations Congress can act on to protect Americans and 

3

their businesses from this growing threat. I thank you, Mr. Chairman. 

Chairman AKIN. Thank you for the opening statement. Also, I 

would like to recognize another one of our colleagues, Sue Kelly, 

who also comes from a very businesslike area, New York. If you 

would like to make an opening statement. I understand you have 

a vote pending in another committee and may join us later. You 

are welcome to proceed. 

Ms. KELLY I thank you very much. I represent the New York 

Hudson Valley and I have been meeting recently with a number of 

small businesses in the Hudson Valley and this issue of cyber security and cyber economy is very high on their list. I must add that 

we create the IBM computers in the Hudson Valley in the district 

I represent. We also have the research labs for not only Phillips 

Electronics but IBM. This is a highly sophisticated group of people 

in the Hudson Valley and yet my small businesses in that area are 

worried even though they have access to highly sophisticated people who are actually building some of the systems so it is extremely 

important that you are here today. This is an issue of extreme importance for our small businesses in this nation and I look forward 

to your testimony. I do have a vote in another committee. I will 

have to go but I intend to come back to keep listening to what you 

have to say. Thank you very much. 

Chairman AKIN. Thank you. We have got a little bit of a challenge for the Chairman today. Aside from running a little late from 

too many meetings, I usually like to keep things running on time 

but we have got a double panel so this is a double header today. 

Those of you who need your cups of coffee need to be forewarned. 

Our first panel, as you can see, there are four people that have 

joined us here. It is really a Government panel and the first witness is Cita Furlani. Did I get that pretty close, Cita? You are the 

Acting Director of Information Technology Laboratory from the National Institute of Standards and Technology from Gaithersburg, 

Maryland. Is that correct? 

Ms. FURLANI. Correct. 

Chairman AKIN. We have the right person. What we are going 

to do is take five-minute statements. I would prefer to take a fiveminute statement from each of you and then open up with some 

questions afterwards if that is okay. I think probably some of you 

are pros in here. You know the little light in red means that somebody is going to throw the hammer at you. Keep it within five if 

we could, please. 

You can submit written statements for the record if you would 

like. I think most of us would prefer to hear you talk to us about 

what you think are the most important things you can communicate in five minutes. Thank you very much. Proceed, Cita. 

STATEMENT OF CITA FURLANI, NATIONAL INSTITUTE OF 

STANDARDS AND TECHNOLOGY 

Ms. FURLANI. Thank you. I appreciate this opportunity to be here 

today. We recognize that small businesses play an important role 

in the U.S. economy. Since use of the Internet is critical in the delivery of goods and services for all businesses, the importance of addressing risks associated with doing business in a cyber environVerDate 0ct 09 2002 14:47 Oct 05, 2006 Jkt 000000 PO 00000 Frm 00007 Fmt 6633 Sfmt 6633 G:\HEARINGS\27809.TXT MIKE
4

ment cannot be overstated. Today I will focus my testimony on 

NIST’s cyber security programs, the National Institute of Standards and Technology, and our programs and activities that can assist small businesses. 

NIST has long worked effectively with industry and federal agencies to help protect the confidentiality, integrity, and availability of 

information systems. Ensuring that business-related information is 

secure is essential to the functioning of our economy and indeed to 

our democracy. Our broader work in the areas of information security, trusted networks, and software quality is applicable to a wide 

variety of users, from small and medium enterprises to large private and public organizations including agencies of the federal government. 

Since small businesses are nearly 99 percent of all U.S. businesses, a vulnerability common to a large percentage of these organizations could indeed pose a significant threat to the Nation’s 

economy and overall security. In the interconnected environment in 

which we all operate, it is vital that this important sector of our 

economy be aware of the risks and take appropriate steps to ensure 

their systems are secure. 

Under the Federal Information Security Management Act 

(FISMA), NIST was assigned the responsibility to develop IT standards and guidelines to secure federal systems. While targeted primarily toward federal agencies, these security standards and guidelines are also used widely by other organizations including small 

businesses. 

These documents are available on our web-based Computer Security Resource Center. I brought two or three of them today to show 

that they really do exist but they can be downloaded. The website 

provides a wide range of security materials and information and 

has over 20 million hits annually. 

In 2002 NIST partnered with the Small Business Administration 

and the Federal Bureau of Investigation’s InfraGard program to 

sponsor computer security workshops and provide online support 

for small businesses. We have developed a small business outreach 

site where small businesses may find information on local workshops. 

NIST also is raising the awareness of the importance of cyber security among small manufacturers. The NIST Hollings Manufacturing Extension Partnership was created to improve the competitiveness of America’s smaller manufacturers and now provides the 

eScan Security Assessment. This diagnostic tool was designed specifically for small businesses to determine how well their IT systems are protected against failure or intrusion. 

NIST with support from the Department of Homeland Security 

recently developed the National Vulnerability Database that integrates all publicly available U.S. Government computer vulnerability resources and provides references to industry resources. It 

contains information on almost 16,000 vulnerabilities and is also 

available on our website. 

Small business, indeed all organizations, rely on the software 

used on their information system. We continue to work with industry to improve the security and reliability of software. For example, 

we develop standards and test suites for interoperable, robust, 

5

quality web applications and products. We conduct research to improve the quality of software including software trustworthiness. 

NIST works with industry and other Government agencies in research to improve the interoperability, scalability, and performance 

of new Internet security systems, to expedite the development of 

Internet infrastructure protection technologies, and to protect the 

core infrastructure of the Internet. 

Meeting the challenge of securing our nation’s IT infrastructure 

demands a greater emphasis on the development of security-related 

metrics, models, datasets, and testbeds so that new products and 

best practices can be evaluated. The President’s FY ’07 proposed 

budget will support NIST’s collaborations with industry and academia to develop the necessary metrics and measurement techniques to provide an assessment of overall system vulnerability. 

In summary, Mr. Chairman, the IT security challenge facing 

small businesses is indeed great. Systems managed by small businesses are part of a large, interconnected community enable by extensive networks and increased computing power. Certainly, there 

is great potential for malicious activity against non-secured or poorly secured systems or for accidental unauthorized disclosure of sensitive information or breach of privacy. 

We believe the programs and activities described today in this 

testimony demonstrate our commitment to a more effective national cyber security environment as we assist small enterprises 

and protecting their assets. 

Detailed information can be found in my written testimony which 

I hope you will add to the meeting minutes. 

Chairman AKIN. Without objection. 

Ms. FURLANI. Thank you, Mr. Chairman, for the opportunity to 

present NIST’s views regarding security challenges facing small 

businesses. I will be pleased to answer any questions. 

[Ms. Furlani’s testimony may be found in the appendix.] 

Chairman AKIN. Thank you, Cita. 

Next is Lydia Parnes. Did I get the last name right? 

Ms. PARNES. It is Parnes. 

Chairman AKIN. Parnes. Excuse me. Parnes. Director of the Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. You didn’t have to travel too far. 

Ms. PARNES. No, I didn’t. Just down the block. 

Chairman AKIN. Thank you, Lydia. Same thing, five minutes, 

please. 

Ms. PARNES. Thank you. 

STATEMENT OF LYDIA PARNES, FEDERAL TRADE 

COMMISSION 

Ms. PARNES. Mr. Chairman and members of the Subcommittee, 

I appreciate the opportunity to appear before you today to discuss 

the challenges consumers and small businesses face in protecting 

their computer systems, as well as the Commission’s efforts to promote a culture of security among all Internet users. 

The views in my written testimony are those of the Commission. 

My oral remarks and responses to questions represent my own 

views and not necessarily those of the Commission or any individual Commissioner. 

6

For more than a decade protecting the privacy of American consumers as been a top FTC priority. The explosive growth of the 

Internet and the development of sophisticated computer systems 

have made it easier than ever for companies to gather and use information about their customers. 

Small businesses once limited to consumers walking into their 

stores on main street now reach consumers across the globe and 

complete transactions entirely online. These information systems 

provide enormous benefits. At the same time they can have serious 

vulnerabilities that threaten the security of information stored in 

them. 

Securing these systems against an ever changing array of threats 

is challenging, particularly for small businesses. For several years 

the FTC has engaged in a broad outreach campaign to educate 

businesses and consumers about information security and the precautions they can take to protect or minimize risks to personal information. 

Last September the FTC unveiled a cyber security campaign 

called OnGuard Online. Our campaign is built around seven online 

safety tips presented in modules with information on specific topics 

such as phishing, spyware, and spam. Each module includes articles, videos, and engaging interactive quizzes in English and in 

Spanish. Numerous firms including many small businesses are now 

using OnGuard Online materials in their own security training 

programs. 

The FTC created OnGuard Online with consumers in mind but 

it is a valuable tool for small businesses as well. In many ways 

computer users and small firms are like home users. They employ 

similar applications to participate in e-commerce, send e-mail, 

build spreadsheets, and create presentations. And, as in the typical 

household, often there is no information technology professional on 

site. 

Unlike most consumer users, however, small businesses may 

maintain records on hundreds, if not thousands of consumers making their computers especially attractive to information thieves. If 

consumers are to have confidence in our information economy, it is 

essential that these records be adequately protected. 

The Commission recognizes that the key to developing an effective cyber security program is flexibility. The Commission Safeguards Rule, for example, requires covered financial institutions to 

develop written information security plans. The rule gives each 

company the flexibility to develop a plan that takes into account its 

size and complexity, the nature and scope of its activities, and the 

sensitivity of the consumer information it handles. 

The Commission follows a similar flexible approach to its enforcement actions under Section 5 of the FTC Act. To date we have 

brought 12 data security cases enforcing the FTC Act and the Safeguards Rule. 

The Commission also recently issued the Disposal Rule which requires all users of credit reports to dispose of them properly and 

not, for example, by leaving them lying in a dumpster available to 

identity thieves. Like the Safeguards Rule the Disposal Rule contains a flexible standard, reasonable measures to protect against 

unauthorized access to the information being disposed of. 

7

Safeguarding customer information is not just the law. It also 

makes good business sense. When small businesses show that they 

care about the security of customer’s personal information, they increase their customer’s confidence in the company in order to help 

businesses of all sizes comply with both the Safeguards and Disposal Rules the FTC has issued business education materials which 

are available on our website. 

Providing adequate security for consumer information presents 

challenges for everyone in the global information based economy. 

The Commission recognizes that this can be particularly challenging for small businesses. The Commission is committed to continuing its work promoting security awareness and sound information practices through education, enforcement, and international 

cooperation. 

I appreciate the opportunity to testify today and look forward to 

the Committee’s questions. Thank you. 

Chairman AKIN. Thank you, Lydia. Right on time. Next witness 

is Larry Johnson, Special Agent in Charge of Criminal Investigative Division, United States Secret Service, Washington, D.C. 

Larry, thank you. 

[Ms. Parnes’ testimony may be found in the appendix.] 

STATEMENT OF LARRY JOHNSON, U.S. SECRET SERVICE 

Mr. JOHNSON. Good afternoon, Mr. Chairman The Secret Service 

was established in 1865 to protect our fledgling financial infrastructure through the investigation of counterfeiting and counterfeit currency. The Secret Service has adapted its investigated methodologies to accommodate the increasingly sophisticated systems 

we protect. 

With the passage of federal laws in 1984, the Secret Service was 

provided the statutory authority to investigate a wide range of financial crimes to include false identification, 18 U.S.C. 1028, access 

device fraud, 18 U.S.C. 1029, and computer fraud, 1030. 

These three statutes encompass the core violations that constitute the technology-based identity crimes that affect small businesses every day. Over the last two decades the Secret Service has 

conducted more than 733,000 financial fraud and identity theft investigations involving these statutes mostly involving small businesses. 

Additionally, the Secret Service and the Computer Emergency 

Response Team, CERT, located in Carnegie Mellon University, collaborated on a project called the Insider Threat Study which was 

a behavioral and technical analysis of computer intrusions by organization insiders in various critical infrastructure sectors. 

The Insider Threat Study provided insight to both the activities 

of the insiders and the vulnerabilities which they exploited. The results of this study are available on the Secret Service public 

website. 

In 1995 in response to the ever-increasing tide of electronic 

crimes, the Secret Service developed a highly effective formula for 

combating high-tech crime. It was the Electronic Crime Task 

Forces, ECTF. They are an information-sharing conduit where 

state, local, and federal law enforcement, private industry, and financial sector, academia work together in a collaborative crimeVerDate 0ct 09 2002 14:47 Oct 05, 2006 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 G:\HEARINGS\27809.TXT MIKE
8

fighting environment. Participation includes every major federal, 

state, and local law enforcement agency in the region. 

In 2001 the USA PATRIOT Act authorized the Secret Service to 

‘‘develop a nationwide network of electronic crime task forces based 

on the New York Electronic Crimes Task Force model throughout 

the United States for the purpose of preventing, detecting, and investigating various forms of electronic crimes, including potential 

terrorist attacks against critical infrastructure and financial payment systems.’’ 

The Secret Service has since launched 15 ECTFs based upon the 

New York model. We also have nine electronic crimes task force 

working groups and 24 financial crime task forces. In 2005 the Secret Service also established the Criminal Intelligence Section. This 

Criminal Intelligence Section provided coordination and oversight 

to every significant cyber case with international ties in 2003 and 

4. 

During this case Secret Service agents uncovered significant 

vulnerabilities within the computer systems of a number of Fortune 500 companies and their smaller company counterparts without alarming the public quietly notifying each of these companies 

of their findings, thus preventing an estimated $53 million in 

losses. 

Estimated exposure to the U.S. financial institutions based on this case were nearly $1 billion. The success of this undercover operation led to the establishment of numerous other online undercover operations which are currently ongoing today. The Secret 

Service is convinced that building trusted partnerships with the 

private sector, and specifically small business in an effort to educate the public on how they can reduce the threats of data breaches 

and improve their system security is the model for combating electronic crimes in the information age. 

Though a large percentage of the private sector breaches to 

which the Secret Service provides investigative assistance and support are large data brokers, corporations or financial institutions, 

we do not differentiate based upon the size of the victim or the 

amount of potential loss. We are equally concerned with compromises being experienced by small companies or independent 

service organizations or ISOs, and will respond with the appropriately trained personnel when notified of a suspected compromise. This is why we believe so strongly in a proactive educational platform as a preventative measure. Bottom line, if you 

are victimized, we will respond. 

Through the use of company best practices you can reduce the 

risk of Internet crime. Some actions we recommend to small and 

large businesses alike include establishing internal policies and 

communicate them to your customers, provide a method for customers to confirm the authenticity of their e-mails, employ stronger 

authentication methods at websites using information other than 

Social Security numbers. If Social Security numbers aren’t solicited 

on websites, this information will not be at risk. Also, monitor the 

Internet for phishing websites that spoof your company’s legitimate 

sites. 

Chairman AKIN. Larry, I need to stop you. You are way over here 

and we have got votes going on right now so I am going to try and 

9

quickly slip you in, Steve, if we could. Then I think I am going to 

let Ms. Bordallo ask some questions. I am going to be gone close 

to half an hour voting and we will resume following that. 

[Mr. Johnson’s testimony may be found in the appendix.] 

STATEMENT OF STEVEN MARTINEZ, FEDERAL BUREAU OF 

INVESTIGATION 

Mr. MARTINEZ. Thank you. Good afternoon, Chairman Akin, 

Ranking Member Bordallo, and members of the Committee. I want 

to thank you for this opportunity to testify before you today about 

Small Business Cyber-Security Issues. 

As retail business moves to the world of e-commerce, cyber crime 

will follow. In 2000 e-commerce accounted for 1 percent of all retail 

sales. Today it accounts for 2.4 percent of all sales. this upward 

trend will undoubtedly continue. Adding to this the revenue generated by non-retail Internet businesses, such as media and entertainment, e-commerce will soon dominate all commercial activity 

worldwide. The FBI is committed to investigating threats at all levels against this major force in our economy. 

Small business forms a vital link in the overall security of the 

Internet. First, small business accounts for a significant portion of 

the retail business occurring on the Internet. Many online businesses and e-retailers are small businesses, many small businesses 

are customers of online businesses, and still other small businesses 

support the IT and Internet operations of large businesses and the 

government. Second, the integrity of Internet-connected small business systems has an impact on security of the Internet as a whole. 

The FBI has recognized that the best way to combat the growing 

threat of cyber crime is to form a partnership with businesses and 

industries that rely on the Internet for their success. By teaming 

up with the private sector the FBI is able to find out what issues 

affect business and what problems are causing the most harm. This 

has allowed us to focus our efforts on the major problems affecting 

the Internet. 

Further, through our outreach and information-sharing initiatives we are able to share our experiences with the business community so that they can better protect and defend themselves 

against new and evolving cyber threats. The education of small 

businesses about the scope and nature of cyber threats is an important first step in protecting those businesses. 

The FBI has two initiatives focused on building a partnership 

with business: The National Cyber-Forensics and Training Alliance 

(NCFTA) and InfraGard. The NCFTA is a first-of-its-kind publicprivate alliance located in Pittsburgh, PA. At the NCFTA members 

of law enforcement work side-by-side with representatives from 

business on addressing the latest and most significant cyber 

threats. Through this collaboration the FBI has been able to identify and prosecute some of the most serious cyber criminals including those who distribute computer viruses, operate large networks 

of compromised computers (known as botnets), and perpetrate 

fraud schemes such as phishing scams. The NCFTA is strategically 

located near Carnegie Mellon University’s Computer Emergency 

and Response Team/ Coordination Center (CERT/CC) and is also 

10

within driving distance of the FBI’s Internet Crime Complaint Center (1C3). 

As an example on how we address cyber complaints, the NCFTA 

was recently contacted by a small bank in New Jersey. The bank 

was the victim of a phishing attack. In this type of attack the 

criminal creates a fake website that is identical to the real bank 

site and uses the fake site to steal credit card and other identity 

information from the bank’s customers. 

With the victim bank to help them, the NCFTA traced the attack 

to its source and identified what measures they could take to mitigate the effects of this attack. With the help of the NCFTA, the 

bank was able to send ‘‘cease and desist’’ letters to the Internet 

service providers hosting the fake sites in order to have the sites 

shut down. 

InfraGard is an alliance between the FBI and the public whose 

mission is to prevent attacks, both physical and electronic, against 

critical infrastructure including, but not limited to banks, hospitals, 

telecommunications systems and the Internet. InfraGard has over 

14,800 private sector members spread across 84 local chapters 

throughout the United States. These private sector partners represent the full spectrum of infrastructure experts in their local 

communities. 

FBI Agents assigned to each chapter bring meaningful news and 

information to the table such as threat alerts and warnings, 

vulnerabilities, investigative updates, overall threat assessments 

and case studies. The FBI’s private sector partners, who own and 

operate some 85 percent of the nation’s critical infrastructures, 

share expertise, strategies, and most importantly information and 

leads that help the FBI track down criminals and terrorists. 

The Internet Crime Complaint Center, IC3, is a joint initiative 

between the FBI and the National White Collar Crime Center 

(NW3C). Located in West Virginia, a short distance from the 

NCFTA facility in Pittsburgh, the IC3 serves as a clearing house 

for cyber crime incidents reported by both individuals and business. 

The 1C3 receives, on average, 25,000 reports of cyber crime incidents each month. By analyzing these complaints for commonalities and trends the 1C3 is able to develop cases that have a national impact. These cases are then referred to local, state, or federal law enforcement agencies for investigation. As with the 

NCFTA, the 1C3 also focuses on partnerships with business as the 

most efficient and effective way to combat cyber crime. 

In 2002 the 1C3 began an initiative online retailers combat fraud 

from re-shipping scams. The initiative known as Retailers and Law 

Enforcement Against Fraud (RELEAF) brought together teams of 

analysts at the 1C3 and e-commerce businesses to identify fraudulent online purchase which were being shipped by domestic re-shippers to destinations overseas.

In one 30-day period, the RELEAF initiative resulted in 17 arrests, 14 controlled deliveries, the recovery of $340,000 in stolen 

merchandise, and the recovery of over $115,000 in counterfeit cashier’s checks. 

Chairman AKIN. Steve, you are about out of time. 

11

Mr. MARTINEZ. Okay. Thank you. I would be happy to answer 

any other questions about our initiatives. 

[Mr. Martinez’s testimony may be found in the appendix.] 

Chairman AKIN. Thank you. Because of the vote being called, I 

am going to have to scoot out. I would like to start by asking a 

question. I do have some staff here that can take a few notes. I 

guess the first thing that I am interested in, and all of you are immersed in this whole situation on a day-to-day basis, we just touch 

on it and run to lots of other things. 

I would like to know your assessment of how big a problem we 

have, first of all, and how do you measure that. Then the second 

thing is within the scope of where we have a problem, do those 

things tend to cluster in certain areas? Are there a couple of certain particular places such as identity theft or something where 

that is the majority of what we are concerned with. So I am interested in scoping the problem and getting a little bit of a sense as 

to what categories those things are in. If you could answer that. 

Then I am going to turn the chair over to Ms. Bordallo. I have 

got probably about half an hour of voting or so so I would expect 

you will adjourn and we will call a second panel at that time. 

Thank you very much. 

Ms. BORDALLO. Thank you very much, Mr. Chairman Since I represent the territory of Guam we don’t vote on the floor. That is one 

thing I wish we could but the territories do not have that privilege. 

We vote in committee but not on the floor. 

I think we will take the two questions that the Chairman presented and we will begin with Mr. Larry Johnson. What would 

your answer to those two concerns that he has. 

Mr. JOHNSON. What the Secret Service has seen a large percentage of the time is that attacks on businesses, whether small or 

large, are typically for financial gain. What we have also seen is 

identity theft being a component of not only assuming someone’s 

identity through intrusions, social engineering and other methods. 

That is very prevalent of the major attack. 

However, a recent trend is that if you can bypass the identity 

theft and go right to an institution that stores financial data. We 

have seen that now more common than ever that if you can bypass 

the identity theft and steal credit card numbers and other financial 

data, account takeovers. We have seen alarming rate of account 

takeovers, specifically retirement accounts because that is where 

the largest amount of money people usually have. 

Ms. BORDALLO. So you would consider that the biggest problem? 

Mr. JOHNSON. Yes. 

Ms. BORDALLO. All right. Next would be Mr. Steven Martinez. 

Can you answer the question that the Chairman presented? 

Mr. MARTINEZ. Sure. I think what we are seeing in the FBI is 

we are looking at cyber crime across the entire spectrum is a convergence of the hackers on the one side that we used to see as kind 

of stovepiped in doing their own thing for bragging rights and that 

type of thing, and the cyber frauders on the other. 

They are now meeting in the middle. They are now leveraging 

each other’s knowledge and it is all for profit just like Mr. Johnson 

mentioned. That is really a change that we have seen over the last 

12

couple of years and it isbeing facilitated by automation in the way 

that these hacks are conducted. 

I mentioned botnets in my testimony. They give a standoff capability to cyber fraudsters and hackers where they can perpetrate 

frauds against Americans from anywhere in the world. It provides 

an additional challenge for us because we really have to have an 

international scope, international reach, in order to address these 

things. 

But, on the other hand, small businesses have a huge part to 

play in this. I briefed on a very successful case targeting a botnet 

that was brought to us by a relatively small business in the Los 

Angeles area. This case was expanded and we determined that it 

impacted on large ISPs across the nation but the nexus of this was 

an attack on a small business and they brought that information 

forward. Outreach is an important part of this because there are 

some disincentives to reporting that you have been attacked and 

have a problem. It might put you at a competitive disadvantage. 

We are working very, very hard on outreach in order to get the information in. As far as the scope goes, are best estimate is we probably only see maybe a quarter at best of the reporting that we 

would hope to get as far as the nature of the problem. There are 

a lot of reasons for that. Again, there are some financial disincentives for bringing that information forward. As businesses small 

and large get used to the fact that the FBI and law enforcement 

agencies know how to work these investigations without disrupting 

their operations, I think we can create more good will and get more 

of the reporting we need to address the problem better. 

Ms. BORDALLO. Thank you. Thank you. Now Lydia Parnes. What 

do you feel is the biggest problem facing you? 

Ms. PARNES. Well, the Commission really looks at this issue from 

the perspective of information security across the Board. I think it 

would be difficult for us to kind of single out how big the problem 

is for small businesses but we know that information security is a 

major issue. The issue that we have a particular focus on is identity theft. 

The Commission is charged with maintaining an ID theft clearing house and so we get the consumer complaints and the inquiries 

from consumers who have been subjected to identity theft. I think 

ultimately that is the real concern about information security. We 

want to promote a culture of security and we want to do it because 

when security is lacking, identity theft can be the result with all 

of the resulting injury. 

Ms. BORDALLO. Thank you. Cita Furlani. 

Ms. FURLANI. Thank you. I think there are a few more aspects 

that should be considered. One I mentioned was just the sheer 

complexity of how you provide security. There are too many ways 

that things can be breached. The things that I think small businesses and any other business need to consider is that they are frequently partnering with others. They need to have some way of determining whether their partners are maintaining secure environments. They frequently outsource and are provided some kind of 

software or supporting structure by other businesses and how do 

they measure that whether they are meeting the same level of requirements that they have set inhouse. 

13

The whole aspect of an always on Internet, always able to be on 

and connected adds a complexity of understanding of how you provide the firewalls and the patches. Everything that has to be done 

is a difficult problem. 

Ms. BORDALLO. Thank you very much. Now for my round of questions. I have one for Mr. Johnson first. I was particularly interested in a point you made near the end of your prepared testimony 

that Secret Service Electronic Crime Special Agent Program Officers are committed to taking preventative action to guard industry 

from crime in addition to their responsibilities to investigate following a crime. I would encourage the Secret Service to review 

ways in which its technical expertise can be shared with SBA client 

firms. What existing partnerships, Mr. Johnson, does the Secret 

Service have with SBA on cyber security? 

Mr. JOHNSON. With the Electronic Crime Special Agent Program, 

I’ll just address that first. That is a training situation that the Secret Service has probably been involved in in the last couple years. 

We train our agents in three levels of cyber investigators. First, the 

No. 1 level is the forensic investigator that actually looks at the 

hard drives and determines the vulnerabilities based on the electronic evidence. 

The middle level of cyber investigator is the network intrusion 

expert who is very involved and has extensive training in network 

intrusions. Then that lowest level is the basic cyber investigator 

training program where we try to have all of our special agents go 

through this type of training. Obviously they cycle into other assignments but eventually in the next couple of years we hope to 

have all special agents in the Secret Service trained as cyber investigators. 

As far as the affiliations of small businesses and large businesses, we have numerous members to our Electronic Crimes Task 

Forces and they are located, like my testimony indicated, throughout the United States. That’s where the sharing of the information 

is from one small company to another and they basically talk about 

what is the security concern of the day. What keeps their CEO up 

at night. 

These discussions a lot of times bring out a lot of information 

that they would not otherwise talk about what was previously not 

spoken about because I don’t want to admit to you my 

vulnerabilities. Now we have gotten companies both large and 

small to talk about what their security problems are and we think 

that has been beneficial. 

Ms. BORDALLO. So what you are telling me then about these programs, the various programs that you explained, you are 

partnering with the SBA? Is that what you’re telling me or thinking about it? 

Mr. JOHNSON. Well, I probably have to get back to you on whether or not specifically we have a partnership or an MOU. I believe 

they are a members of one or more than one of our task force but 

I can let you know for sure. 

Ms. BORDALLO. I think that is the basis of my question. I think 

it is important that we partnership. 

Mr. JOHNSON. Okay. 

14

Ms. BORDALLO. All right. The next question I have is for Mr. 

Martinez. I am concerned, Mr. Martinez, that after reviewing the 

SBA website this morning I was unable to find any information on 

it regarding cyber crime and small business or information on how 

small businesses can contact law enforcement in the event of a suspected cyber crime. 

I wonder whether a small business owner or an entrepreneur 

knows that it should consider contacting the FBI regarding potential cyber crime. Has the FBI ever done any coordination with the 

SBA to educate small companies on cyber security issues? What 

kinds of outreach and training programs does your agency have for 

small business or would such a program need to be developed? 

Mr. MARTINEZ. Well, the FBI does have a formal arrangement 

with the SBA through a memorandum of understanding to provide 

support leveraging our InfraGard program and the membership to 

assist with a series of very specifically targeted cyber security is 

good business. That is what these training sessions are called that 

target small businesses specifically across the country. 

In fact, recently there have been, or will be sessions in places 

from San Diego, California, Sioux Falls, Minneapolis, Casper, Wyoming, places where you might likely find smaller businesses. Again, 

this is an effort to leverage what we have built with InfraGard, 

provide both access to the membership because a lot of the best information is held in the private sector, but also to provide subject 

matter experts within the FBI, investigators, whatever the case 

may be, to participate in these training sessions if need be. 

Ms. BORDALLO. I certainly think that both the FBI and the Secret Service these are partnerships and I think they should be included on the website, the SBA website. We don’t find anything 

and I think this would be extremely helpful if you could work with 

them and see that this be included. 

I have a question for Ms. Furlani. What are the two most important lessons you teach small business owners on computer security? 

Ms. FURLANI. Vigilance. How to determine whether they are—we 

provide checklists and ways to understand the issue and what they 

need to do. Frequently they have the kinds of people that can understand what needs to be done but it is a matter of resources, how 

much time can be spent. We try to find simpler ways to describe 

what can be done and give them checklists that they can go down 

and determine whether all the various patches have been done and 

the intrusion detection zone and all these things that they need to 

do. 

Most important is mainly being aware and being vigilant. That 

is probably the most important because all the other things change 

as the threats change. It is more important to be aware of it and 

be understanding of what and access to where the resources are to 

understand how to deal with the changing environment. 

Ms. BORDALLO. And, Lydia, I have a couple of questions for you. 

To what extent has the FDC attempted to involve the Small Business Administration in cyber security efforts that are targeted at 

small businesses? 

Ms. PARNES. We actually have a history of working with the SBA 

on frauds that are directed to small businesses and we have had 

a number of real successes. We have not kind of dealt with them 

15

specifically on cyber security but we would be delighted to have 

them participate in OnGuard Online which is our online cyber security information. 

The OnGuard Online is not marked as an FTC site particularly. 

You can get it through our site but we encourage others to use it 

and put it out there and we will definitely contact the SBA. They 

can take the site. They can link to it or just put it on their site 

as well. I think it would give small businesses very good information. 

Ms. BORDALLO. But this, again, hasn’t happened as yet. 

Ms. PARNES. No, it hasn’t. I would add that we do have federal 

agencies who partner on OnGuard Online as well as private industry. It is up there and it is available to anybody who wants to use 

it and we will seek out the SBA. 

Ms. BORDALLO. Another question. Under what circumstances 

should a small business owner report cyber attacks to FTC? What 

would be the extent of the problem before they contact you? What 

would the circumstances be? 

Ms. PARNES. Well, certainly the FTC is one place that a small 

business can contact about a cyber security attack. The information 

that we get goes into a database that is available and actually is 

downloaded onto the FBI database that Mr. Martinez talked to. 

The Secret Service has access to our database as well. 

A small business could easily contact the FTC. We would take all 

of the information. We would put it in our database and it would 

be available to law enforcers, both federal law enforcers and also 

law enforcers on the local and state level. The FTC does not have 

any criminal authority, however. So many of these attacks are 

criminal in nature. 

Ms. BORDALLO. What would you say the frequency of inquiries 

are? Any of you could answer that. 

Mr. MARTINEZ. On the IC3, the Internet Crime Complaint Center 

complaint intake runs about 25,000 complaints a month. That is 

individual consumer complaints. That doesn’t include aggregated 

information that we get from private sector partners. 

Ms. BORDALLO. That is a staggering number. Let me see here. I 

think that is pretty much all the questions. We are trying to extend 

this before we call up the second panel. Oh, yes. I have one for the 

FBI. What is the most common roadblock you encounter when 

tracking down cyber criminals? 

Mr. MARTINEZ. I think the biggest challenge for us right now is 

the international nature of cyber crime because going across the 

world you have different relationships with different countries and 

different levels of cooperation so we put an awful lot of effort into 

developing and firming up those relationships in places where we 

haven’t had a presence before. 

You know, former Soviet states, the Far East. We have a legal 

attache program where we have a presence in many, many foreign 

countries but we found that we actually have to put people on the 

ground to work with some of these countries that haven’t developed 

their legal systems or their capabilities to address cyber crime so 

that has been a huge challenge. It is really a change in the way 

we do business because we used to focus mostly on domestic crime 

16

problems but it really is a completely international global crime 

problem now. 

Ms. BORDALLO. Secret Service, how would they respond? 

Mr. JOHNSON. I would agree with Mr. Martinez. The only thing 

I would add is that there is a different scam every day. I become 

briefed on the latest and greatest and it is always something added 

to an existing scam on the Internet. It is a more sophisticated from 

phishing to pharming more sophisticated and that is just one example of trying to stay one step ahead or at least equal with the 

bad guys. 

Ms. BORDALLO. Can you share with us what is the latest scam 

so we are ready for it? 

Mr. JOHNSON. I think I kind of mentioned the account takeovers 

are very prevalent. You kind of put me on the spot with the latest. 

Ms. BORDALLO. You know we have to be up to date here. 

Mr. JOHNSON. I understand. 

Ms. BORDALLO. Thank you very much. I think we spoke about 

that, the small businesses to protect against inside. You mentioned 

vigilance which is very importance. 

Ms. FURLANI. And how best to apply their scare resources. Which 

vulnerability should they work on? Some kind of prioritization. 

Ms. BORDALLO. Can small businesses employ adequate security 

measures with their limited resources? What would the cost of that 

be? You are talking very limited resources. 

Ms. FURLANI. Again, if you know—if you have access to how to 

do it you can make choices as to what is the most important way 

to close the door and where you apply your resources. Obviously it 

is easier when you have a larger budget. You are using a smaller 

percentage of it but education and awareness and I think that is 

what you are focused on today is where the resources are that they 

can make use of. 

Ms. BORDALLO. And who provides—who can provide that? 

Ms. FURLANI. Our website has a lot of information and I think 

each of the other agencies do. 

Ms. BORDALLO. But technical assistance? 

Ms. FURLANI. Technical assistance is generally where they are 

going to be getting it from a vendor of some sort. There again, they 

need to have enough understanding of what they are hiring and 

what risk they are taking there with partners, vendors. Every time 

you add someone else there is another vulnerability risk. 

Ms. BORDALLO. That is correct. 

Ms. FURLANI. Being aware of that. 

Ms. BORDALLO. We want to thank all of you for appearing before 

the Committee today and we appreciate all your testimony and certainly we take it into account. I would like to excuse you and bring 

on the second panel. Oh, we will recess for a short time until we 

bring up the second panel. 

[Whereupon, at 3:04 the Subcommittee adjourned until 3:24 p.m.] 

Chairman AKIN. The Committee will come to order. Sorry about 

breaking things up here. I think we are prepared to go with our 

second panel if I am not mistaken. Ari Schwartz. Is that correct? 

Mr. SCHWARTZ. Ari, yes. 

17

Chairman AKIN. Ari. Okay. Deputy Director of Center for Democracy and Technology, Washington, D.C. You have five minutes, 

please, Ari. 

Mr. SCHWARTZ. Thank you. 

STATEMENT OF ARI SCHWARTZ, CENTER FOR DEMOCRACY 

AND TECHNOLOGY 

Mr. SCHWARTZ. Thank you. Mr. Chairman, Madam Ranking 

Member, thank you for holding this hearing on cyber security and 

inviting the Center for Democracy and Technology to testify. CDT 

hopes that this marks the beginning of the Subcommittee’s interest 

in the important issues of information security and its impact on 

small business and consumers. 

Much as been written and said about the Internet as a revolutionary platform for human interaction. Indeed, the Internet levels 

the playing field for individual speakers and small businesses. It 

is a cheap and effective way to reach around the world. 

There are many factors that make the Internet unique among 

communications tools but its strength has always been it is open, 

decentralized, and user-controlled nature. As such, the medium inherently has the potential that promotes democracy and entrepreneurial ideas. However, the Internet’s strength is also one of its 

weaknesses. 

Just as networking and interconnectivity allows for unprecedented sharing of ideas, those factors also expose the medium to 

a growing number of threats such as viruses and spam and 

phishing spyware. Individually these attacks are dangerous enough 

but taken together they have begun to chip away at the trust Internet users have in the medium. 

A recent survey done by Consumer’s Union has indicated that 25 

percent of consumers have stopped making purchases online and 

another 29 percent have cut back on their online shopping because 

of concerns about identity theft alone. 

To address these dangers we must ensure both that our proposed 

solutions get to the root of the problem and that those solutions 

don’t inadvertently harm the essential nature of the medium. To 

reach these goals we must understand the motivation and character of the threats. Although popular portrayals of Internet criminals continue to focus on young hackers, vandalizing websites, or 

launching denial of service attacks to gain notoriety among their 

peers. Most of the real threats today are driven by financial gain, 

as we said, by the FBI and the Secret Service in the earlier panel. 

It is easy to get lulled into the belief that these are new threats 

because of the new terminology like phishing with a ‘‘ph’’ or 

spyware, but in reality they are for the most part typical fraud 

cases that we have seen offline for years and years. In our research 

into consumer complaints EDTS found these attacks are generally 

driven by five types of financial motivation. 

(1) Identify theft to consumers and businesses. 

(2) Corporate espionage, that is, taking confidential information. 

(3) Advertising software that provides pop-ups financially motivated because companies are paying affiliates to install software 

onto users computers and often do so without consent. 

18

(4) Fraudulent marketing schemes like those that we become 

used to in our e-mail boxes every day. And, 

(5) Extortion where consumers or business data or an entire machine is held ransom in one way or another. 

We are also seeing more attacks that rely on multiple techniques 

also known as blended threats that are uniquely targeted to a specific type of user. The New York Times recently reported that large 

gangs of criminals in Brazil and Russia are using virus-like techniques to install password crackers that only work on certain banking websites. This demonstrates not only the new skill of the criminals but also the international nature of the threat. 

These attacks have magnified impact on small business because 

many small businesses suffer from those attacks of the consumers 

as well as those aimed at businesses. Also, while large enterprises 

can afford spare capacity in the form of additional computers and 

servers, many small businesses do not have that luxury. 

Because of the changing nature of the threats, it is important 

that security programs continue to improve. Computer security 

companies have become experts at finding problems and distributing information about whatever malicious programs caused the 

problem, but they are only just beginning to build and test programs that stop malicious software at the first signs of bad behavior even before the names of those programs are known. 

Finally, it is essential that we address the financial motivation 

of these threats as we have in offline fraud. This is not as easy as 

it sounds because the Internet models pass information to the 

hands of so many players and across borders as well. CDT is currently in the process of documenting how large and respected companies are unsuspectingly supporting unfair and deceptive practices of their partners. Yet, we must get beyond all these difficulties and find the sources of funding and cut it off or risk losing the 

potential of the Internet for future generations. 

Thank you again for having me here and I look forward to your 

questions. 

[Mr. Schwartz’s testimony may be found in the appendix.] 

Chairman AKIN. Thank you, Ari. Right on time there. Next we 

have Enrique Salem, Senior Vice President, Security Products & 

Solutions from Symantec Corporation from California. Thank you 

for coming the distance here, Enrique. 

STATEMENT OF ENRIQUE SALEM, SYMANTEC CORPORATION 

Mr. SALEM. Thank you, Chairman Akin, and Ranking Member 

Bordallo for giving me the opportunity to testify at today’s hearing 

on the state of small business security and cyber economy. I am 

hopeful that my remarks will provide the Committee with a comprehensive overall of the U.S. small business cyber threat landscape. I also hope to give you some thoughtful insights on the many 

security challenges small business owners face in today’s growing 

digital economy. I look forward to responding to the Committee’s 

questions following my remarks. 

I come before you today representing Symantec Corporation. We 

are the fourth largest software company in the world and we help 

our customers to protect their information and we provide them solutions around security and availability and integrity of their data. 

19

As the Senior Vice President for Consumer Products Business 

Unit I am responsible for both the consumer market and the small 

business segment. Prior to joining Symantec I was the CEO of 

Brightmail, Inc., a leading provider of anti-spam solutions so I am 

able to talk to you about some of the key challenges that small 

businesses face when they try to deal with spam. I also provided 

comments to Congress on the issues surrounding the CAN SPAM 

Act. 

Last week Symantec released its ninth Internet Security Threat 

Report which is widely acknowledged to be the most comprehensive 

analysis of information regarding security activity for today’s economy. The report includes an analysis of network based attacks including those on small businesses with a review of known threats, 

vulnerabilities, and security risks. We have been providing this report on a semi-annual basis since 2002. 

The last two Internet security threat reports found that small 

businesses have consistently been in the top three most targeted 

groups for cyber attacks. Cyber criminals have found that small 

businesses are less likely to have a well-established security infrastructure making them more vulnerable to attacks. 

Symantec has also sponsored the first comprehensive study of its 

kind analyzing the state of information security readiness in the 

U.S. small business market. The July 2005 study conducted by the 

Small Business Technology Institute surveyed more than 1,000 

businesses and found that information security is a high priority 

for small business owners. But it also showed a lack of appreciation 

of the true economic impact of information security incidents and 

a lack of knowledge around cyber threats. 

I would like to submit this report with the Chairman’s permission. 

Chairman AKIN. Without objection. 

Mr. SALEM. Some key findings that we found in the report are 

as followed. While over 70 percent of small businesses consider information security a very high priority, they are not increasing 

their investment and protection. The study revealed that small 

businesses demonstrate an alarmingly complacent and passive attitude to information security. 

A majority of small businesses, 56 percent, have experienced at 

least one security incident in the past year and small businesses 

make overwhelmingly reactive purchase decisions when it comes to 

Internet security with 35 percent increasing spending on security 

products only after their business has been compromised or attacked resulting in a loss of data or corruption. 

It is difficult to quantify the impact of cyber crime but according to the FBI’s 2005 Cyber Crime Survey costs today are around $67 

billion to U.S. firms over the last year. Additionally, the FTC found 

that the identity thief cost businesses $48 billion and last year consumers $680 million in losses. 

But more damaging than the loss of money is the loss of trust 

and confidence by consumers in the Internet economy. With so 

much of the nation’s small businesses depending upon the Internet, 

we can’t risk losing the public’s confidence in doing online transactions with small businesses as it is essential that they have the 

right resources to protect themselves. 

20

Symantec continues to play an instrumental role in protecting 

small businesses through the security solutions we offer and our 

education and awareness efforts. 

For example, Symantec is a major sponsor of the National Cyber 

Security Alliance, or the NCSA, a non-profit which educates small 

businesses and consumers how to stay safe online. The NCSA 

website, staysafeonline.org, is a useful resource for small businesses and partners with the Department of Homeland Security, 

FTC, Small Business Administration, NIST, and many others on 

several initiatives including the small business training workshops 

lead by NIST. 

In addition to its sponsorship of the NCSA, Symantec has created several tools, including educational books and CD-ROMs to 

address the unique needs of small businesses. We have copies of 

these materials available at today’s hearing that Symantec has also 

developed in a wide-range of areas to help protect data that small 

businesses find critical to run their businesses. 

We must focus on increasing cyber security awareness, educating 

and enabling small businesses to properly assess their true level of 

risk and encouraging them to take the necessary and preventative 

and corrective measures. 

Symantec looks forward to continuing to work in partnership 

with the private sector and Congress to conduct research and create tools that lead the way in providing U.S. small businesses with 

the right resources they need and deserve to truly secure and prosper in today’s high-tech global economy. 

Thank you again, Chairman Akin, and Ranking Member 

Bordallo, allowing me to testify today in front of the House Small 

Business Subcommittee on Regulatory Reform and Oversight. 

[Mr. Salem’s testimony may be found in the appendix.] 

Chairman AKIN. Thank you very much, Enrique. Appreciate your 

perspective. 

Next is Dr. Burton KALISKI. Is that right? 

Dr. KALISKI. Kaliski, sir. 

Chairman AKIN. Kaliski. You are the Vice President of Research 

for RSA Security, Chief Scientist, RSA Laboratories from Bedford, 

Massachusetts. 

STATEMENT OF DR. BURTON S. KALISKI, JR., RSA 

LABORATORIES, RSA SECURITY 

Dr. KALISKI. Chairman Akin and Ranking Member Bordallo, I 

am honored to be with you today. You might wonder what the 

three letters RSA stand for. They are the initials of three inventors 

of a very widely-used encryption algorithm developed in 1977 at 

MIT with federal research funding. 

We have a conference held annually on the west coast which now 

attracts 14,000 attendees and at the most recent conference Robert 

Muller spoke and said that, ‘‘While the Internet has become a 

growth engine for business, it has also become a global target for 

cyber criminals.’’ He is exactly right and this is a dilemma for 

small businesses because, on the one hand, you want to go online 

to expand your business opportunity. On the other hand, when you 

go online you face tremendous threats and small businesses don’t 

have the IT security departments to help them but there is hope. 

21

We need to look at what is an adequate level of security for a 

small business or any business. We believe that security ought to 

be commensurate with the value of the data as well as the resource 

being protected. Just as you don’t shred every piece of paper, you 

don’t need to encrypt every file but you need to be shredding and 

encrypting sensitive information. Just as you don’t lock every door, 

you don’t need to have strong access controls to every file but those 

that are sensitive need that appropriate level of protection. 

Now, traditionally the protection for access to information has 

been a password and it is recently that across many industries people have realized it is finally time to do something better. But what 

is there that is better than a password? 

Well, at the RSA conference this year Bill Gates was one of the 

speakers and he said, to paraphrase, that the era of passwords is 

over. Organizations are looking at many technologies for making it 

easier to use stronger security but we again have a dilemma. If you 

have strong security that is very strong but not easy to use, you 

really have no improvement at all. Great security is good to have 

if you can use it. 

There has been a substantial increase in the focus on usability 

and I would like to highlight several ways that is taking place. One 

is that vendors are finding ways to make security more usable 

across the industry as a whole. You may have different interfaces 

on every site you interact with, a different way of providing your 

password, a different way of answering questions about your account. 

You may have ways that you can reset your password in one case 

and in another case it is different but industry is working to standardize and harmonize these approaches so that users have a consistent experience. Users also have many opportunities to increase 

their security with the devices that they already have. 

We are all carrying mobile phones. Couldn’t that be used someway to enhance our security experience if we could just connect 

that with the places at which we do business. That would certainly 

simplify the situation for a small business rather than having to 

find some unique solution to put security in the user’s hands. And 

vendors including my company are looking at many ways like this. 

Now, the third point, though, is that you basically need it to be 

a crypto-engineer, and I wish I could tell you more about that career because it is fascinating. You needed to be a crypto-engineer 

to put security in your products. Up until recently you had to know 

details of every algorithm and acronym and so forth. Well, that is 

changing. Vendors are finding ways so that you can put encryption 

in and other features of security just based on policy. You say, 

‘‘Here is the kind of data I have. Please encrypt it,’’ and it is done 

and it is managed well. 

Security appliances are another example. You don’t need an IT 

security department to enhance your security. You can plug in a 

device that is ready to go into your network and it enhances your 

security. Finally, IT vendors are working on improvements to the 

user interface because, after all, that is the last and the weakest 

link. How does the user know that he or she is more secure? Well, 

there are improvements on web interfaces that help you to see 

when you are secure and when you are not. 

22

In all of this the public and private partnership is essential. As 

my colleague mentioned, the National Cyber Security Alliance is an 

important player. RSA Security has also been invested in that organization. We encourage others to take part in it. 

We are also interested in the area of breach notification legislation. I understand that the House and the Senate are both working 

in that area. We consider it important as an incentive and reward 

to businesses that apply best practices, that those best practices 

are recognized in terms of a safe harbor provision. 

To conclude, just because you are a small business doesn’t mean 

the criminals aren’t out to get you as well. You have valuable resources. Just because you are a small business doesn’t mean you 

can’t do anything about it. There are tools, the built-in security into 

many products, the tools for encrypting data more easily. 

You know, RSA Security used to be a small business and at RSA 

Laboratories we maintain that entrepreneurial perspective. We 

look forward to working with this Committee on Small Businesses 

for a safety and more secure economy. 

[Dr. Kaliski’s testimony may be found in the appendix.] 

Chairman AKIN. Thank you. Very well done. Thank you very 

much. 

Our next guest is Roger Cochetti? 

Mr. COCHETTI. Cochetti. 

Chairman AKIN. Cochetti. Your son Andrew is supervising this 

operation as well I understand. 

Mr. COCHETTI. Thank you very much. 

Chairman AKIN. You the Group Director of U.S. Public Policy, 

Computing Technology Industry Association from Arlington. 

Mr. COCHETTI. Yes, sir. 

Chairman AKIN. Thank you, Roger. 

STATEMENT OF ROGER COCHETTI, U.S. PUBLIC POLICY, 

COMPUTING TECHNOLOGY INDUSTRY ASSOCIATION 

Mr. COCHETTI. Thank you, Mr. Chairman Thank you Ranking 

Member Bordallo. Thank you both for your warm welcome for my 

13-year-old son Andrew for whom the subject of cyber security I 

can assure you is not a theoretical issue. 

My name is Roger Cochetti and I am Group Director of U.S. Public Policy for the Computing Technology Industry Association 

(CompTIA). I am here today on behalf of our 20,000 member companies. 

Mr. Chairman, I want to thank you and the members of your 

Subcommittee for holding this important hearing on the State of 

Small Business Security in the Cyber Economy. We believe that 

your efforts to focus public attention on cyber security and small 

business will help American small business avoid cyber threats. 

Before I continue, Mr. Chairman, I would like to ask that my 

written statement be submitted for the record. 

Chairman AKIN. Without objection. 

Mr. COCHETTI. Mr. Chairman, the Computing Technology Industry Association is the nation’s oldest and largest trade association 

representing the information technology or IT industry. For 24 

years CompTIA has provided research, networking, and partnering 

opportunities to its 20,000 mostly American member companies. 

23

While we represent nearly every major computer hardware manufacturer, software publisher, and systems integrator, nearly 75 

percent of our membership is made up of the small American computer companies who themselves provide integrated computer systems to small businesses which I will explain more in a moment. 

As this Subcommittee knows, small business is the backbone of 

the American economy. Some 23 million small businesses generate 

over half of our GDP and employ most of the private sector workforce. Today nearly all American small businesses are dependent 

upon information technology and most are increasingly dependent 

upon the Internet. Failures in the IT infrastructure or in the Internet threaten the viability of American small business and their vulnerability to cyber threats is America’s vulnerability. 

The IT needs of small businesses are mainly addressed by an important segment of the computer industry called Value-Added Resellers, or VARs. These small system integrators, which are the 

bulk of our members, set up and maintain computer systems and 

networks for small businesses. VARs create and maintain the computer systems in your dentist office, in your doctor’s office, for your 

corner store, and for your local plumber. 

VARs are the front line in America’s defense against cyber security threats. An estimated 32,000 VARs sell about one-third of all 

computer hardware sold in the United States today and most of 

that to small business. Because of our unique role representing 

America’s VARs CompTIA has done a great deal to address the 

issue of cyber security for a small business, much of it in conjunction with governments. 

We recently launched a series of regional educational programs 

on cyber security expressly for VARs and through them the small 

businesses whom they serve. In 2002 we introduced these security 

plus professional certification for IT professionals. It validates an 

IT professional’s abilities in the area of cyber security and to date 

over 23,000 IT pros, many working for small businesses, have 

taken and passed CompTIA’s security plus exam. 

Over the past few years we have commissioned an annual survey 

of the state of IT security. Two-thirds of the participants in these 

surveys are small businesses and the results tell us a lot about the 

cyber threat to small business. Almost 40 percent experienced a 

major IT security breach within the last six months. 

Human error, either alone or in combination with a technical 

malfunction, caused four out of every five IT security breaches. 

More than half do not have written IT security policies. One half 

have no plans to implement security awareness training for their 

employees outside of the IT department, nor have they even considered it. About two-thirds have no plans to hire IT security personnel and just a quarter require IT security training and a 10th 

require professional certification. 

With our permission, Mr. Chairman, I would like to submit our 

most recent study for the record of this hearing. It talks a lot about 

what is happening in small business. 

Chairman AKIN. Without objection. 

Mr. COCHETTI. Based on our studies it is clear that more needs 

to be done to raise cyber security awareness, education training, 

and professional certification within the small business community. 

24

It is also clear to anyone who understands how small businesses 

operate in the United States that VARs must play the central role 

in any effort to reach out to small business in this area. What is 

most needed is a Government industry partnership that takes advantage of the unique access and perspective of thousands of VARs 

who IT enable small business in the U.S. 

Mr. Chairman, let me emphasize at this point that the most effective solutions to nearly all cyber security threats, to small business or any other IT users, do not rely on new federal or other regulations. The nature of the Internet in particular is a global network of networks that is dynamic and rapidly changing is such 

that Government regulations will have a limited impact. 

Much more effective in dealing with threats like cyber security 

are technology tools, industry best practices, and consumer and 

business education backed up by strong law enforcement. The key 

role that Government agencies can and should play, aside from arresting and prosecuting criminals, is to work with industry and 

consumers on education, technology tools, and best practices. 

We look forward to working with this Subcommittee and the relevant agencies in such a cooperative effort. Thank you, Mr. Chairman. 

[Mr. Cochetti’s testimony may be found in the appendix.] 

Chairman AKIN. Thank you, Roger. Appreciate your testimony. 

Our last witness is Howard Schmidt, President and CEO of R & 

H Security Consulting LLC, and former White House Cyber Security Adviser from the State of Washington. 

Howard. 

STATEMENT OF HOWARD SCHMIDT, R & H SECURITY 

CONSULTING, LLC. 

Mr. SCHMIDT. Thank you very much, Mr. Chairman and Ranking 

Member Bordallo. Thank you for the opportunity to appear before 

you this afternoon. 

My colleagues have done a very good job of sort of laying out the 

problems. I would like to spend my five minutes sort of talking 

about some of the things that we have seen which actually have 

helped improve it and some of the things that are either low cost 

or no cost that small and medium businesses can work with. 

First I would like to frame it in saying when I look at a small 

business we see in three categories their IT capabilities. First, we 

are basically aware that their IT system is also their home computer system, the mom and pop operation, so to speak. 

We have others where small and medium enterprises have dedicated computer systems, relatively small staff that basically work 

really hard to make the IT system run but no special expertise in 

security. Then the third category, the ones that actually outsource 

this to a service provider that basically provides them a turnkey 

operation. 

With these categories in mind, their success depends on four 

things, technology, awareness and training, information sharing 

and, of course, we heard from the earlier panel the law enforcement capabilities. 

From a technology perspective we have seen software developers 

invest heavily in tools and processes to reduce the number of 

25

vulnerabilities which then make us much safer in the software we 

are running today. There is also now automated tools available to 

identify vulnerabilities, effectively the unlocked door on a computer 

system that can be found automatically, once again, for a low price. 

The automatic updating of anti-virus applications, spyware, operating systems, things of this nature, once again, are being built 

into the computer systems we are running. We now see a new generation of toolbars for web browsers that turn red, green, or yellow 

depending on whether the site is trusted, unknown, or untrusted. 

We also see new technology that is very affordable for the consumer and the small and medium enterprise with the all-in-one device where you have a hardware device that is your cable modem, 

firewall, wireless router, anti-spyware built in that is managed just 

like it would be for a large enterprise. 

As Burt talked about, two factor authentication, a concept like an 

ATM card, something you have, something you know. It is very important for us to help secure our systems today. Also the 

encryption technologies are much more affordable, easier to use 

than ever before, and more widely accepted. 

For the awareness and training, one of the issues I see with the 

small and medium businesses is the fact that they don’t often times 

recognize they are and can be a target. Clearly recognizing that 

takes place is one of the key issues for awareness and training. 

The Treasury Department released a DVD called ‘‘Identity Theft: 

Outsmarting the Crooks’’ which includes, of course, information for 

SNBs, The FTC, USPS, USSS, my role as a reservist with Army 

CID as well as other private sector groups helped put this together. 

It is available free of charge on the Treasury website. I might note 

here, if I could, I have a number of URLs or weblinks in my written testimony. I would like to just point that out. I won’t repeat 

these things. 

Of course, FTC with the Online OnGuard site, National Cyber 

Security Alliance, also for state and local governments working 

with the local Chamber of Commerce, the multi-state ISAC, Information Sharing Analysis Center, led by Will Pelgrin out of Governor Pataki’s office, have put together state and territory-wide information sharing analysis. 

The US-CERT provides services free of charge. The National 

Cyber Security Partnership was also mentioned earlier. Also there 

is a special guide called, ‘‘Common Sense Guide to Cyber Security’’ 

for small and medium businesses given out by the US-CERT 

ready.gov website, as well as the U.S. Chamber of Commerce. 

On the sharing earlier we mentioned the InfraGard and the Electronic Crimes Task Force working with the local folks that actually 

are doing the work on a day-to-day basis. We also see information 

and training also take place during those organizational meetings 

they have. 

The last piece I would like to cover briefly is the law enforcement 

efforts. Like any other effort, there is going to be bad actors out 

there. We can’t escape that. With the technology, the awareness 

and information sharing we can help reduce the threats against the 

small and medium businesses but they still will see some out there. 

The very nature of the crimes make them difficult to investigate 

so we need to make sure we currently fund particularly small, local 

26

jurisdictions which don’t have the resources to conduct these investigations without some assistance. 

The International White Collar Crime Center actually is an NIJ 

funded project designed to help state and local law enforcement investigators investigate all types of cyber crimes, particularly, once 

again, targeting the audience of the small and medium enterprises. 

Lastly, some quick recommendations in my last 30 seconds or so. 

We have seen since we have released the President’s National 

Strategy to Secure Cyber Space that a lot of these efforts have 

taken place but we still see some areas. The idea of pulling the 

technology websites doesn’t really cut it. We need to be able to provide this information. Maybe the Small Business Administration 

working with the U.S. Chamber and the local Chamber of Commerce to hold in-person type events to be very, very helpful. 

We also basically need to make sure that when the Small Business Administration works with the loaning process you have to 

submit a business plan and things of this nature. Also a cyber security plan would be very helpful 

With that I will wrap up my verbal comments. Once again, thank 

you for the opportunity and look forward to any questions that you 

may have. Thank you. 

[Mr. Schmidt’s testimony may be found in the appendix.] 

Chairman AKIN. Thank you very much, Howard. You have really 

led into my first question. As a hard to get along with crusty old 

conservative, I have a natural inclination to wonder whether the 

Government is going to do any good and maybe make the process 

worse. I guess one of the things that we are investigating here, the 

first set of questions which I really left to be asked when I was 

gone was, one, how big is the problem and where is the problem? 

Can we define what the problem is? 

Second of all, what we are looking at is is there someway we can 

be constructive and help and in certain places maybe we should get 

out of the way. I wanted to let anybody who wants a shot at that 

question to make recommendations because we are going to be taking notes. If there are some logical places for us to put some legislation together, we probably have a good chance of getting something done. Maybe there are some places we want to stay away 

from and just let industry work with it. Have at it, my friends. 

Mr. SCHMIDT. If I may on the issue of scoping, just my local law 

enforcement as well as my experience with the FBI we don’t do a 

good job on capturing what is really computer crime or cyber crime, 

particularly as it relates to the smaller organizations. We have 

these broad categories which don’t especially do it. Fraud whether 

using a computer or a typewriter is still a fraud and we don’t differentiate that very well. 

As far as the regulation piece, once again, it is in the same category. I don’t think regulation itself helps but what you do is make 

sure the resources are available to the Small Business Administration to do not pull technology but push technology to the constituents they work with. 

Chairman AKIN. Your idea that if somebody wants an SBA loan 

or something, you say, ‘‘Well, if you want that, then maybe what 

you need to is at least ensure some level of security in your system.’’ That seems to be kind of an incentive, I suppose, that you 

27

could use. Is that a good idea, other gentlemen, or is that just making it harder? Our last hearing that we had was how people are 

having trouble getting SBA loans. They said it is taking a lot of red 

tape and hassle. Do we want to add another step to that or not? 

You tell me. 

Mr. COCHETTI. Mr. Chairman, if I could go back to the broader 

question and then touch on the SBA loan qualification question, I 

think it is important to keep in mind the scale of the problem and 

the scale of the problem is enormous and we believe serious. All of 

the surveys, ours in particular, suggest that well over half of the 

23 million small businesses in the United States have very little 

preparation for cyber threats and well over half. Half would be a 

modest way of looking at it. 

There are many things that are needed to be prepared. Technology tools are one, training is another, and procedures are another. There are others but those are typically the three main 

things. You train people, need the technology, and you need the 

procedures. Most small businesses have none of these. 

Clearly from our point of view the starting point in any discussion about what to do is awareness, education, and training. Small 

business until they are aware of this problem are not going to do 

much about it and aware of the seriousness of it and the impact 

it could have on them. 

The outreach issue consequently is the fundamental issue, we believe, that needs to be addressed. If you think about the size of the 

small business segment to the American economy, however, reaching out to 23 million small businesses is not something that is 

going to be done through putting up another website. We have got 

a dozen very well organized websites that provide a lot of information. How many small business men or women do you know who 

spend their time searching websites to learn more about cyber security? 

We need a proactive outreach effort. The fact is, however, that 

if we were to put on a conference a month with 100 small businesses participating in each conference, it would take us several 

thousand years before we would reach the small business in the 

United States. It is for that reason, Mr. Chairman, that we believe 

that the intermediaries, the VARs, are really the key to the solution. 

If you go to a dentist, the next time you talk to your dentist ask 

him, ‘‘Who handles your computer system in this office?’’ The odds 

are almost certain that he or she will not say, ‘‘I do it myself.’’ Almost certain they will not say some big multi-national company 

that we have all heard of. 

He or she will say, ‘‘It is Joe’s Computers down the street. These 

are the people who are the IT departments for small business. 

These are the people who have to raise the bar on the awareness. 

These are the education outreach programs that we believe are 

needed, Mr. Chairman Thank you. 

Chairman AKIN. Are you saying that the Government should 

fund education outreach programs? Is that what you are saying, 

Roger? 

Mr. COCHETTI. I think the Government should use every tool at 

its disposal and we wouldn’t be adverse to Government funding for 

28

these programs but it would not be a wise use of Government resources to try to do a conference for small business because after 

3,000 or 4,000 years you might have gotten two-thirds of the way 

through the small business community in the United States. 

Chairman AKIN. Maybe we ought to publish a couple of really 

good juicy scandals and scare everybody. Maybe that would be the 

way to do it. 

Mr. COCHETTI. That unfortunately sometimes helps. 

Chairman AKIN. Anybody else want to take a shot at anything 

that we need to do legislatively or governmentally that could be 

helpful? 

Dr. KALISKI. Sir, a couple of comments. First on the scope of the 

problem, Chairman Our report clearly shows that small businesses 

are increasingly being targeted now by cyber criminals so the scope 

of the problem is only going to continue to increase. I think the second point is— 

Chairman AKIN. You talked about the fact that it is increasing. 

Do you have a sentence or two on what the scope is itself? 

Dr. KALISKI. Yes. So what we are seeing is specifically that there 

has been at least one incident at about 56 percent of all small businesses where their data or security has been compromised so that 

is more than half have had an incident in the last year so that is 

pretty significant. 

I think the second point is we do need to provide incentives for 

small businesses to take action to protect themselves. You mentioned this notion of small business loans. I think that may be an 

incentive but we should look for other mechanisms that we can use 

to encourage them to secure their businesses. 

I think the other thing is, as Mr. Cochetti said, I don’t think we 

need new websites. There already are existing ones such as 

staysafeonline.org which I think is a fine website to leverage for 

providing information to small businesses. Lastly, I think the SBA 

just needs to take a stronger role in helping small businesses to secure their businesses. 

Mr. SCHWARTZ. The one area where I think there has been some 

discussion about legislative initiatives is in terms of international 

cooperation among law enforcement. We have seen a lot of the 

cases we track go to the border. Some of them are simply routed 

through foreign servers to make it look as though it is becoming 

foreign because the bad guys know that law enforcement goes up 

to the border and that’s where they end their hunt because we 

don’t have this kind of cooperation even though they are actually 

located in the United States. 

Although some really are, there are a growing number of threats 

that really are outside of the U.S. and come in and work across 

borders, multi-national partners in these schemes because they 

really are money-making schemes these days. That means they will 

work with whoever is willing to partner with them to make money. 

We have seen schemes that involve seven or eight countries sometimes. 

Chairman AKIN. Thank you very much. I’ll turn the questioning 

over now to Ranking Member. 

Ms. BORDALLO. Thank you very much, Mr. Chairman My first 

question is to Mr. Kaliski. I got mixed signals here in listening to 

29

some of the comments. Who do you think is best situated to handle 

cyber security threats, the Federal Government or private industry? 

Dr. KALISKI. In think it has to be a combination of both. I don’t 

think it should be an ‘‘or’’ situation. I think we definitely have to 

raise awareness. I think there is some knowledge out there but I 

think it is both private sector and Congress that need to work together. 

As we mentioned, there are resources today available for small 

businesses. We just need to make sure that folks understand that 

they are there and can take advantage of them. I also think the 

SBA needs to take a strong role in working with the private sector 

and small businesses to make sure that they have the staffing and 

resources necessary to protect themselves. 

Ms. BORDALLO. It is unfortunate, I guess, that we don’t have an 

SBA representative here today but certainly I did hear you all 

speak about what you have up on your websites but when you look 

into the SBA website there just isn’t anything that deal with this 

problem so it is something we are going to have to work on. 

Is there is a representative from SBA? Is there anyone in the audience? Do you wish to make any comments on this? Please come 

forward and identify yourself for the record, please. 

Ms. THRASHER. Good afternoon. I am Ellen Trasher. I am with 

the Office of Entrepreneurial Development at the Small Business 

Administration. My colleague who is here is Antonio Doss also with 

the Small Business Administration. 

Chairman AKIN. Thank you for joining us. 

Ms. THRASHER. It is our pleasure and we welcome the opportunity to be here and also to hear so many of the comments, many 

of which we share and understand. The dynamics within the small 

business community has changed dramatically over the last couple 

of years. The whole idea of e-commerce, doing business online, 

while at the same time trying to open and sustain a small business 

is a challenge. 

Our role within Entrepreneurial Development is to educate, inform, counsel, and train small businesses to make smart business 

decision. We do this in a variety of ways. We work in public/private 

partnerships. For example, we are very active in the National 

Cyber Security Alliance. We work with NIST, the FBI InfraGard 

in offering training, and online counseling and training. 

Through our resource partners such as SCORE and SBDCs we 

offer counseling and training both face-to-face and online. For example, SCORE has an online counseling service and if you go to 

www.score.org you can find at least 140 online cyber counselors 

with an expertise in computer security that are available 24/7 to 

provide you counseling and training. 

We are aware of the problem. We are trying to collaborate as 

best we can in avenues to, again, outreach, as we were talking 

about. We do the training, the counseling, the awareness, and we 

hope to refer people to the areas for deterrents, enforcement, and 

remediation. Thank you. 

Ms. BORDALLO. You say that this then, Ellen, is all on your 

website now? 

30

Ms. THRASHER. Much of it is. In fact, I just provided the Committee with brochures that we give out. We have a collaborative 

agreement with Hartford and have published a whole series on risk 

management, of course, which cyber security is part of. The brochure and the training is available both in English and Spanish 

and it is on site. We are also launching a webinar that will be a 

self-styled tutorial training course on what we call business catastrophe of which anything, of course, that would happen to your 

cyber security is part. 

Ms. BORDALLO. Very good. Thank you. It has been very informative and I have the material here in front of me. Thank you, 

Ellen. 

I have a question now for Mr. Cochetti and that is you spoke 

about the outreach program, the education outreach. Who should 

head the education outreach program that you described? 

Mr. COCHETTI. Delegate Bordallo, there is no question, I think, 

in the minds of anyone on this panel that it is that educational outreach program which is the most important thing that needs to be 

done. If nothing else happens, without that there will be little 

progress. I think certainly in our view, and I suspect most of the 

panelists here would agree, is that this really needs to be a Government/industry partnership. 

There is simply no way the industry is going to mount an effective outreach program on its own, nor is there anyway the Government could do it effectively on its own so a partnership is what is 

needed. I would say there are a number of federal agencies that are 

already active. They have modest programs underway right now. 

Most of the programs that exist today are responsive. In other 

words, I have a website. 

If anybody feels like coming to it, I have information available. 

What really is needed is a proactive program that goes out and it 

is, again, for that reason that we think these VARs are what the 

military planners call sort of forced multiplier. Each VAR is the IT 

department for about 200 small businesses. You get a VAR and you 

reach 200 small businesses and it is a way to deal directly with the 

problem. I think the fact is there are a number of federal agencies, 

many who are here and some who are not here, who have an interest in some programs in this area. They need to work together— 

Ms. BORDALLO. With private industry. 

Mr. COCHETTI. Yes. 

Ms. BORDALLO. Thank you. Mr. Schwartz, in your mind should 

the Federal Government be focusing on enforcement of existing 

laws or should we be looking at new laws? If new laws and regulations are needed, what recommendation do you have? 

Mr. SCHWARTZ. Well, in terms of the existing laws there are several existing laws where they should be enforced more diligently 

and where we need greater oversight. The Computer Fraud and 

Abuse Act, for example, is one that we see regularly broken, criminal statute where action can be taken. 

The FTC has started to take greater actions in unfair and deceptive practices cases. We started to see more action in that area. 

And the Secret Service has talked about in their statute the number of places where they can bring cases under current identity 

theft laws. 

31

All of those pieces need to be enforced more strongly than they 

are today and with an international focus. There is definitely room 

there. The one area where we have focused on regulation where we 

think it is necessary goes back to the basic Internet privacy question. 

There is a general question of Internet trust and of consumer 

trust on the Internet today. A lot of that goes back to the fact that 

consumers don’t understand what happened to their information 

and how it is shared on the Internet. There is a patchwork of laws 

right now for consumer information and how it is used online behind the scenes for consumers that happens online and offline as 

well. But in the online world consumers have this fear and they 

don’t understand what happens to their information. In some ways 

it is justified. We have all sorts of different standards. There are 

lawyers out there that do not understand the Gramm-Leach-Bliley 

Banking Law and privacy when they read those privacy notices 

that they are sent. When you are given the privacy notices in your 

doctor’s office, a completely different kind of notice than the financial notice that you got before. We just have this patchwork of laws 

out there all over the map and consumers just don’t understand 

where their information is going and how it flows and that is starting to show up online. 

That is one thing that we would like to see is sort of a leveling 

and understanding, a baseline standard for privacy that basically 

the good companies out there are following but the other companies 

out there that are sort of outliers are taking advantage of. 

Ms. BORDALLO. That is an excellent point. Mr. Kaliski, new developments in cyber security certainly will enhance small businesses. We have all been talking about that. Are these protections 

affordable? 

Dr. KALISKI. That is an excellent question, ma’am. the important 

part to look at is that as technology is developed and standardize 

it becomes widely available, very effectively for a large group of 

people. Consider the Internet as an example and over time the 

higher speed Internet access that has been made available to all 

kinds of businesses. 

We are seeing a similar trend in security technology. As I mentioned, vendors are producing security tools that can be used across 

multiple companies so that you are able to leverage the investment 

that your users have already made to be secure in other places. An 

example, there are security tokens that are issued by banks that 

can potentially be used at other banks just as you would use a 

credit card at multiple places. The affordability will come from the 

common solutions available through industry standards. 

Ms. BORDALLO. Thank you. Mr. Schmidt, I have just one last 

question. It seems to me that SBA should be playing a larger role 

given that if there is any agency small firms would turn to for advice it should be SBA. Would you agree with this assessment and 

what additional programs should the SBA sponsor to better fulfill 

their responsibilities to the American small businesses? 

Mr. SCHWARTZ. I agree with that perspective because the small 

business that I talk to the first thing I do is look to where the SBA 

is saying, ‘‘How can I be successful?’’ which is what is said to do. 

Part of the SBA’s responsibility to due diligence, as the Chairman 

32

mentioned a few moments ago, about making it less complicated. 

That due diligence also goes to the cyber piece. 

Some of the things they can do is not so much focus on how to 

investigate these things because that is often times too late for a 

small business. They are already out of business at that juncture 

so maybe working with the Internet Association Chiefs of Police 

and the Crime Prevention Associations to take that good material 

that they have just passed out to you and make sure that those are 

provided. 

For example, if you were to call up your local police department 

and say, ‘‘I would like you to come to my house and my business 

and do a crime survey,’’ they will come out and do it. Ask them to 

do that on your computer business and they won’t have a clue what 

to do. The SBA has the expertise, the resources to work with them 

and provide that as a resource to local business as well as a crime 

prevention effort. 

Ms. BORDALLO. Thank you very much. Thank you all for the information you provided. 

Chairman AKIN. I just had one or two quick questions. I have got 

a meeting that started at 4:00 so I am going to have to scoot before 

long. Just a couple of thoughts. First of all, is there anybody that 

provides insurance to small businesses to protect them against 

these kinds of problems? 

Mr. SCHMIDT. As a matter of fact there are. When we released 

the National Strategies to Secure Cyberspace a number of the 

major organizations, AIG, Chubb, you name them, not only provide 

data insurance for the data that they protect, fire and damage, all 

the things relative to that at relatively low cost for small business 

as well. The policies are there. The underwriting capabilities are 

there and it is just a matter of asking for it from the insurance 

companies. 

Chairman AKIN. So if I have got a small business, I might normally have, I would think, some sort of insurance on the building 

if the small business were in a building that I owned. It would be 

sort of like the equivalent of homeowner’s insurance. I might have 

some liability in case an employee gets in trouble. Would any of 

those policies typically have insurance that would protect against 

data security or questions that involve the cyber security in general? 

Mr. SCHMIDT. As an addendum, yes. 

Chairman AKIN. You have to add it? It is an extra? 

Mr. SCHMIDT. You have to add it. Yes, sir. 

Chairman AKIN. Okay. And then I guess I would think that if 

somebody is offering me insurance, then they would have an interest in seeing whether or not you have the right software installed 

to protect yourself, right? 

Mr. SCHMIDT. That is correct, yes. 

Chairman AKIN. Okay. Then I guess the second question was in 

terms of the VARs, they seem to be covering a lot of the sort of 

small business data processing side of things. Would it make any 

sense to give them some sort of a rating in terms of whether or not 

they have taken proper precautions in terms of data security? 

Mr. COCHETTI. Mr. Chairman, I think a program like that would 

probably make sense. We have pursued programs of sort of VAR 

33

certification or best practices, you know, VARs who are proven to 

be competent. It is a nonregulated, nonlicensed industry so certification of that sort is certainly an attractive idea that we have 

looked at and we would be more than happy to talk with the SBA 

or others about sort of how to pursue it but, yes. And since they 

are just important intermediaries thinking about that is, I think, 

an important aspect of this. 

Chairman AKIN. Some of us would prefer to see it maybe done 

on an industry basis as opposed to Government basis because we 

have got more confidence, especially with something that is moving 

as fast as this is the Government has a terrible track record at 

being able to move quickly and keep current. 

Mr. COCHETTI. Let me assure you we are 100 percent private sector and when I mention that we have been looking at certification 

programs for VARs, that would be an entirely private sector certification for VARs. 

Chairman AKIN. Thank you all so much for coming in. Because 

some of you have come a long way, I want to give you the last 

word. Is there anybody that has something else they want to add 

in? We do questions but we do answers as well so anybody who 

wants to make a comment. 

[Whereupon, at 4:15 p.m. the Subcommittee was adjourned.]

34


27809.001
35


27809.002
36


27809.003
37


27809.004
38


27809.005
39


27809.006
40


27809.007
41


27809.008
42


27809.009
43


27809.010
44


27809.011
45


27809.012
46


27809.013
47


27809.014
48


27809.015
49


27809.016
50


27809.017
51


27809.018
52


27809.019
53


27809.020
54


27809.021
55


27809.022
56


27809.023
57


27809.024
58


27809.025
59


27809.026
60


27809.027
61


27809.028
62


27809.029
63


27809.030
64


27809.031
65


27809.032
66


27809.033
67


27809.034
68


27809.035
69


27809.036
70


27809.037
71


27809.038
72


27809.039
73


27809.040
74


27809.041
75


27809.042
76


27809.043
77


27809.044
78


27809.045
79


27809.046
80


27809.047
81


27809.048
82


27809.049
83


27809.050
84


27809.051
85


27809.052
86


27809.053
87


27809.054
88


27809.055
89


27809.056
90


27809.057
91


27809.058
92


27809.072
93


27809.073
94


27809.074
95


27809.075
96


27809.076
97


27809.077
98


27809.078
99


27809.079
100


27809.080
101


27809.081
102


27809.082
103


27809.059
104


27809.060
105


27809.061
106


27809.062
107


27809.063
108


27809.064
109


27809.065
110


27809.066
111


27809.067
112


27809.068
113


27809.069
114


27809.070
115


27809.071
116


27809.083
117

Æ


27809.084