```

[Senate Hearing 107-1070]
[From the U.S. Government Publishing Office]

                                                       S. Hrg. 107-1070

     S. 2037, S. 2182, HOMELAND SECURITY AND THE TECHNOLOGY SECTOR

=======================================================================

                                HEARING

                               before the

             SUBCOMMITTEE ON SCIENCE, TECHNOLOGY, AND SPACE

                                 OF THE

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                      ONE HUNDRED SEVENTH CONGRESS

                             SECOND SESSION

                               __________

                             APRIL 24, 2002

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

                    U.S. GOVERNMENT PRINTING OFFICE
90-267                      WASHINGTON : DC
____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800  
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                      ONE HUNDRED SEVENTH CONGRESS

                             SECOND SESSION

              ERNEST F. HOLLINGS, South Carolina, Chairman
DANIEL K. INOUYE, Hawaii             JOHN McCAIN, Arizona
JOHN D. ROCKEFELLER IV, West         TED STEVENS, Alaska
    Virginia                         CONRAD BURNS, Montana
JOHN F. KERRY, Massachusetts         TRENT LOTT, Mississippi
JOHN B. BREAUX, Louisiana            KAY BAILEY HUTCHISON, Texas
BYRON L. DORGAN, North Dakota        OLYMPIA J. SNOWE, Maine
RON WYDEN, Oregon                    SAM BROWNBACK, Kansas
MAX CLELAND, Georgia                 GORDON SMITH, Oregon
BARBARA BOXER, California            PETER G. FITZGERALD, Illinois
JOHN EDWARDS, North Carolina         JOHN ENSIGN, Nevada
JEAN CARNAHAN, Missouri              GEORGE ALLEN, Virginia
BILL NELSON, Florida
               Kevin D. Kayes, Democratic Staff Director
                  Moses Boyd, Democratic Chief Counsel
      Jeanne Bumpus, Republican Staff Director and General Counsel
                                 ------                                

             Subcommittee on Science, Technology, and Space

                      RON WYDEN, Oregon, Chairman
JOHN D. ROCKEFELLER IV, West         GEORGE ALLEN, Virginia
    Virginia                         TED STEVENS, Alaska
JOHN F. KERRY, Massachusetts         CONRAD BURNS, Montana
BYRON L. DORGAN, North Dakota        TRENT LOTT, Mississippi
MAX CLELAND, Georgia                 KAY BAILEY HUTCHISON, Texas
JOHN EDWARDS, North Carolina         SAM BROWNBACK, Kansas
JEAN CARNAHAN, Missouri              PETER G. FITZGERALD, Illinois
BILL NELSON, Florida

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held April 24, 2002......................................     1
Statement of Senator Allen.......................................     3
Statement of Senator Edwards.....................................     5
Statement of Senator Wyden.......................................     1

                               Witnesses

Boehlert, Hon. Sherwood, U.S. House of Representatives...........     6
Hira, Ronil, Institute of Electrical and Electronics Engineers 
  (EEE)-USA......................................................    21
    Prepared statement...........................................    22
Hoffman, Dr. Lance, Department of Computer Science, the George 
  Washington University..........................................    13
    Prepared statement...........................................    14
Logan, Effrey, Business Development Manager, M/A-COM, Inc., 
  Wireless Systems...............................................    24
    Prepared statement...........................................    25
Starnes, W. Wyatt, President and Chief Executive Officer, 
  Tripwire, Inc..................................................    17
    Prepared statement...........................................    19
Strawn, Dr. George, Assistant Director (Acting), Directorate for 
  Computer Information Science & Engineering (CISE), National 
  Science Foundation.............................................     9
    Prepared statement...........................................    11

                                Appendix

Response to written questions submitted by Hon. John McCain to:
    Dr. George Strawn............................................    43
Graham, James W., Chief Operating Officer, Emergency Asset 
  Management Systems, prepared statement.........................    41
Vargo, Franklin J., Vice President, International Economic 
  Policy, letter dated April 8, 2002, to Hon. Wyden and Hon. 
  Allen..........................................................    42
Vargo, Franklin J., Vice President, International Economic 
  Policy, letter dated April 19, 2002, to Hon. Wyden.............    43

 
     S. 2037, S. 2182, HOMELAND SECURITY AND THE TECHNOLOGY SECTOR

                              ----------                              

                       WEDNESDAY, APRIL 24, 2002

                                       U.S. Senate,
            Subcommittee on Science, Technology, and Space,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Subcommittee met, pursuant to notice, at 2:30 p.m. in 
room SR-253, Russell Senate Office Building, Hon. Ron Wyden, 
Chairman of the Subcommittee, presiding.

             OPENING STATEMENT OF HON. RON WYDEN, 
                    U.S. SENATOR FROM OREGON

    Senator Wyden. The Subcommittee will come to order. Today, 
the Subcommittee on Science, Technology, and Space convenes the 
third in a series of hearings on improving America's homeland 
security through technology. We are also going to look in 
detail at two pieces of legislation, S. 2037 and S. 2182. It is 
my intention, working closely with my friend and colleague, 
Senator Allen and, of course, the chairman of the full 
committee, Senator Hollings, and the Ranking Minority Member, 
Senator McCain--it is our intention to work very closely with 
the Administration so that it will be possible at the next 
mark-up of the full Commerce Committee on May 16 to process 
both pieces of legislation.
    I did have a very constructive conversation this morning 
with Mitch Daniels, the head of the Office of Management and 
Budget. He made it very clear that he wanted to work with our 
Committee on a bipartisan basis to address both of these 
important pieces of legislation, and I appreciate Director 
Daniels' constructive effort. We are going to work closely with 
the Administration so it will be possible to move these two 
important pieces of legislation, and I believe it will be 
possible to do that on May 16.
    As this country mobilizes to protect itself from terrorism 
and other threats, a key weapon in our defensive arsenal is 
this country's great technological prowess. Many of the most 
promising technologies for improving security reside outside 
the government in the dynamic arena of private sector 
entrepreneurship, but the government can supply some key 
ingredients to make the technology sector's homeland security 
efforts more effective. Therefore, it is important to forge a 
strong partnership between the government and the technology 
sector in order to provide the best protection and response 
possible for the American public from high-tech cyber attacks 
to more conventional threats.
    Many of the solutions for reducing this country's 
vulnerabilities are rooted in technology. Sophisticated hacker 
attacks on crucial computer networks must be dealt with by 
developing technology that can detect and prevent intrusion. 
More conventional low-tech threats like airplane hijacking 
likewise demand new technological responses. Better security 
screening and biometric devices are key to keeping terrorists 
off our planes, but when disasters do happen, technology can 
make a huge difference by enabling the first responders to 
communicate, by coordinating relief efforts to send resources 
where they are needed most, and by helping families locate 
loved ones.
    Today we will look at two pieces of legislation, S. 2037, 
the Science and Technology Emergency Mobilization Act, which I 
am proud to have authored with Senator Allen, the 
Subcommittee's distinguished Ranking Member. This legislation 
seeks to provide an organizational structure to quickly locate 
and mobilize private sector scientific and technology expertise 
in times of crisis.
    One pillar of that structure has been dubbed the National 
Emergency Technology Guard, or NET Guard. It would be a central 
part of a strategic technology reserve, much like this 
country's strategic petroleum reserve. The difference is, 
instead of oil the strategic technology reserve would be a deep 
well of private sector expertise and technological equipment 
that could be available around this country at a moment's 
notice.
    The country's best scientific minds, technology experts, 
and technology companies would be invited to participate, and 
these companies, in my view, by helping to assist on a 
volunteer basis could make a significant difference. We 
envisage these volunteers becoming part of a NET Guard, and 
this country would have a central data base where we could 
catalogue the company's people and resources such as computers, 
software, wireless devices, and biohazard detection equipment, 
that would be available on a moment's notice.
    The legislation has other objectives. One is to speed the 
evaluation of new products from the technology sector so that 
they can be matched with particular needs of federal security 
and response agencies. This seems to me to be particularly 
important, because with the federal government having been 
flooded with proposals, or various kinds of technologies, it is 
important that the government not buy outdated and antiquated 
equipment. This part of the legislation would make that 
possible.
    The second bill the Subcommittee is going to consider 
focuses more on the direct threat to our technology 
infrastructures and the dangers posed by cyber terrorism. This 
is S. 2182, the Cyber Security Research and Development Act, 
which seeks to build a foundation of basic cyber security 
research, and grow the ranks of scholars who can devise 
innovative security defenses.
    Since basic research is the soil out of which future cyber 
security advances grow, the government ought to support it. 
This legislation does so with a series of grants through the 
National Institute of Standards and Technology and the National 
Science Foundation. The awards are designed to encourage 
cutting-edge research today and to call more of the nation's 
brightest scientific minds to study the problem down the road. 
We are happy to have the opportunity to followup on our earlier 
work by examining and hearing testimony on legislative 
proposals with respect to both of these Senate bills.
    I would also like to thank all the companies, 
organizations, and individuals whose support and input has been 
so helpful in moving both pieces of legislation forward. I want 
to reiterate my interest in working closely with the 
Administration on a bipartisan basis. Senator Allen and I have 
done that consistently throughout our service on this 
Committee, and I want to welcome my colleague and invite him 
for any remarks he would like to make.

                STATEMENT OF HON. GEORGE ALLEN, 
                   U.S. SENATOR FROM VIRGINIA

    Senator Allen. Thank you, Mr. Chairman. I want to begin by 
thanking you so much for calling this hearing on this subject 
matter, but in particular the focus on these two bills, S. 
2037, the Science and Technology Energy Mobilization Act, and 
S. 2182, the Cyber Security Research and Development Act. I 
appreciate both your leadership and your cooperative spirit on 
these issues, and I look forward to working with you on it, and 
we will work with our colleagues--this is a bipartisan effort--
and certainly Chairman Hollings and Ranking Member Senator 
McCain, as well as the Bush Administration, in working together 
for all of our shared goals in these regards.
    I would like to thank all our witnesses for being here 
today, and in particular I do want to thank Mr. Jeff Logan from 
M/A-COM, Incorporated for testifying at today's hearing, and I 
look forward to reading your insights and all of your insights 
on both these bills.
    Both these bills that will be the main focus of today's 
Subcommittee hearing highlight the vital role that technology 
plays in our nation, in our war to protect our homeland from 
terrorism, as we have highlighted, and I agree wholeheartedly 
with every remark that you made, Mr. Chairman.
    And Senator Wyden, it's exactly my sentiments and 
philosophy in not just this hearing but in so many we have 
heard, whether in this Subcommittee, or as chairman of the 
Republican Senators High Tech Task Force, that there are so 
many technologies that are being developed or are actually 
currently developed that could help us in so many ways to save 
the lives of fire fighters, rescue workers, police officers, 
first responders.
    There are technologies being developed, or are developed 
that can help us detect chemicals or radiological or biological 
agents. They also could improve and protect our communications 
systems from attack, and obviously the key from a lot of these 
is the interoperability of communications from all of these 
various federal, state, and local agencies prior to an attack, 
or during an attack, or if, sadly, it befalls us again, after 
an attack.
    Now, S. 2037, the NET Guard bill, can play in my view a 
major role in preventing many of the problems that occurred 
during the attacks in New York City and at the Pentagon. The 
September 11 attacks taught us two things, one, how many 
technological improvements there are to help our security that 
are really, truly needed by our state, local, and federal 
services, and the second thing we learned from September 11 is 
that there is a great depth and reservoir of American goodwill 
to provide solutions.
    I like the fact that this bill calls upon the ideas of the 
best and brightest minds of America's technology work force to 
act as an all-volunteer force to help restore communications 
and infrastructure operations after a major national disaster. 
Like all Americans, we had heard earlier in this Subcommittee 
and, indeed, the full Committee, of the heartening volunteer 
efforts of companies like Verizon, Intel, Accenture, Cingular, 
and others that volunteered both staff and equipment to restore 
communications in New York City and in the Washington, D.C. 
area, and this bill I think will be a way of helping facilitate 
their efforts without dampening any voluntary spirit.
    Now, as you said, Mr. Chairman, there are many enterprises 
and commercial applications that can be adapted to meet 
governmental security or safety, public safety needs. I, along 
with Members--and I know Senator Edwards and everyone else has 
heard all sorts of ideas about companies, about products, their 
ideas, and how they will be able to help us, and every single 
one of them seems like a really good idea.
    In fact, I was reading in the newspaper and found it 
interesting about ideas--this did not have to do with homeland 
security, but how to fight this war on terrorism, and there was 
one suggestion that the Bush Administration had received about 
how to get the Al Qaeda terrorists out of the caves, put in 
hives of killer bees, and I was thinking, you know, we have 
heard that is not a very high tech idea, but it gives you the 
idea of the breadth of ideas and at first you may laugh at that 
idea and say, you know, who knows, that might work.
    The key, though--and I'm not suggesting we need killer bees 
for communication. I'm just trying to show you the breadth of 
ideas that we get as Senators, and I am sure the Bush 
administration gets, on how we could help.
    Now, the key to all of this is to have a method of 
accurately testing and evaluating these ideas so that when 
procurement is going forward, or if somebody has an idea, there 
is a way to have that test bed, and that is something that I 
think is vitally important, and an important part of this bill, 
and I really look forward to making sure that gets achieved.
    Now, the other bill in the Subcommittee that we are 
examining today, S. 2182, will address the important issue of 
cyber security. I will say that there is another cyber security 
bill that is not in this Committee, it is in Senator 
Lieberman's committee that Senator Bennett and others are 
pushing to make sure that there is the communication as far as 
cyber security, and I hope they will have a hearing on it. If 
you were in charge of that, we would have a hearing, but 
nevertheless, there are many concerns about our critical 
infrastructure in our country and the Internet. We have seen it 
in the past.
    The survey just last year by the Computer Security 
Institute and the FBI found that 85 percent of 538 respondents 
experience computer intrusions. According to the Computer 
Security Institute and FBI survey, the estimated economic loss 
in these attacks was $378 million, a 43 percent increase from 
the previous year.
    This Cyber Security Research and Development Act can, I 
believe, as you said, Mr. Chairman, play a major role in 
fostering greater research and methods to prevent future cyber 
attacks, and design more secure networks. The bill I think can 
very well harness and link the intellectual power of the 
National Science Foundation, NIST, our universities, and the 
private sector to develop new and improved computer 
cryptography and authentication, firewalls operations and 
control systems management and computer forensics.
    I reviewed this bill, and the merits of it, and I would 
certainly be proud to join you as a cosponsor of the Cyber 
Security Research and Development Act. I think it is very much 
needed for our education and for our security, and again I look 
forward to hearing the testimony.
    I will say, Mr. Chairman, I am on the Foreign Relations 
Committee and we are having a Top Secret briefing at 3 p.m. 
from Secretary Colin Powell on the Middle East situation, so I 
will have to read a lot of the testimony, but nevertheless we 
are going to work--although it will not be decided today. This 
is just one of those steps in the advancement of these good 
causes and good ideas.
    Thank you, Mr. Chairman.
    Senator Wyden. I thank my colleague for an excellent 
statement, for working closely with us, and of course, we were 
talking about both these pieces of legislation as recently as 
15 minutes ago, we are going to push very hard on a bipartisan 
basis with the Administration. I thank you for a fine statement 
and your leadership.
    Now, I want to recognize Senator Edwards, who has been very 
passionate about his interest in science policy. We are so 
pleased to have him on this Subcommittee. What is so striking 
between the three of us, our states 30 or 40 years ago would 
not have had a whole lot of technology. They were largely 
agricultural states, and all of them now, in addition to 
growing things, something we feel strongly about, have made a 
big push in technology. Senator Edwards brings great expertise 
to this field, and we are pleased to have you here, and make 
whatever statement you choose to.

                STATEMENT OF HON. JOHN EDWARDS, 
                U.S. SENATOR FROM NORTH CAROLINA

    Senator Edwards. Thanks, Mr. Chairman. I will be very 
brief. I think we are all very proud of the leadership that our 
three states have shown in the area of technology, and I am 
also proud, Senator Wyden, of the leadership you have shown in 
this area. Thank you very much for the work you have done, and 
my colleague from Virginia, thank you for the work you have 
done.
    I think we all know that cyber terrorism and cyber crime 
rank among very serious threats to American security and 
safety. They are threats that ought to be addressed, need to be 
addressed. Last fall, I began working on some proposals to 
address these issues. We collected a lot of very good ideas 
from leaders in government and academia and the private sector, 
and in January I introduced two bills, the Cyber Terrorism 
Preparedness Act, and the Cyber Security Research and Education 
Act, and my hope, Mr. Chairman, is that we will be able to work 
together to make sure that our legislation accomplishes all the 
things that we are interested in accomplishing, and I want to 
just briefly highlight three points that I think we need to 
make sure are included in any legislation.
    One, that we promote cyber security best practices. If you 
left your house without locking the door, you would expect to 
be robbed. Right now, government systems and private systems 
basically have a lot of their doors open. We need to change 
passwords regularly, but we do not always do it. We need to 
turn off certain dangerous computer applications, but we do not 
do it.
    The legislation that I introduced would first encourage 
research and public education to develop and encourage best 
practices and, second, require government to adopt these best 
practices and move toward requiring them for government 
contractors and grantees. This should be a priority in any 
legislation that we move.
    Second, we need to move some of the grant-making authority 
for cyber security research outside of the government. 
Government is full of terrific public servants, but the reality 
is that too often in this area we do not have the flexibility 
or the trust from the private sector that we need to lead in 
this area, so in our bill we propose funding a nonprofit, non-
government consortium to do a lot of grant-making. I think that 
is an important component of any legislation we move forward.
    And third, we want to encourage the development of cyber 
security experts in academia. Right now, the prestige in 
computer science is too often in other fields than cyber 
security. We need to get our best minds doing work that can 
protect our country and our economy. Our bill has a range of 
grants, fellowships, and sabbaticals for research in this 
field. I know that your legislation does the same thing. I 
think those are critical components of those bills.
    So with that, Mr. Chairman, I would yield back to you, and 
thank you for the work you are doing, and the leadership you 
and Senator Allen have shown.
    Senator Wyden. Well, I thank my colleague, and we are going 
to work very closely with you. I think there are a lot of areas 
where there is common ground, and between now and May 16 we 
will work through the proposals you have, and the 
Administration's proposals, and we will move forward, and thank 
you very much for coming today.
    We are also pleased to have Sherry Boehlert, an individual 
who has been a friend of mine for 20 years now, and we 
especially like the chance to partner with him. Chairman 
Boehlert, you have done a terrific job on the cyber security 
effort in the House. We appreciate your willingness to work 
with Senator Allen and I on the bill to mobilize volunteers in 
the private sector and science and information technology, and 
we are going to get both of these bills on the President's desk 
by working together and with the Administration, so you proceed 
as you choose to, and know that you have our welcome as usual.

             STATEMENT OF HON. SHERWOOD BOEHLERT, 
                 U.S. HOUSE OF REPRESENTATIVES

    Mr. Boehlert. Thank you very much. It is good to be back 
with friends, Senator Allen and you and Senator Edwards. I 
greatly appreciate your inviting me to testify today on the 
vital issue of cyber security, and I am pleased that our 
Committees have been able to work so well together. It is a 
critical matter. We are taking a bicameral, bipartisan approach 
to cyber security, the only approach that makes sense in 
dealing with such a massive, growing, and largely unappreciated 
threat.
    Indeed, it would be hard to exaggerate our nation's 
vulnerability to cyber attacks. We rely more every day on an 
open network of computer systems for the most basic activities 
of our daily lives, communications, business transactions, and 
utility transmissions, to name just a few, and even our more 
secure systems have turned out to be porous when tested.
    A computer attack by terrorists or common criminals or 
malicious teenagers, for that matter, could be monumentally 
disruptive and, indeed, life-threatening. So the obvious 
question is: What are we doing to prevent and prepare for such 
an attack? And, unfortunately the answer is just as obvious: 
Not enough.
    The Administration deserves enormous credit for the work 
Governor Tom Ridge and Dick Clarke are doing to address this 
threat, especially in the near term. That is a full-time job to 
put it mildly. I think that we in the Congress have to spend 
some of our time helping to take the somewhat longer-term steps 
to counter cyber terrorism--even though we are not usually 
accused around here of long-term thinking. Still, improving 
cyber security requires a long-term commitment. Our adversaries 
are going to get more and more skilled, and we must get smarter 
and smarter to counter them. Like the Cold War, the war against 
terrorism must be won in the laboratory as much as in the 
battlefield.
    With that in mind, I introduced H.R. 3394, the ``Cyber 
Security Research and Development Act,'' late last year, and 
the House in February passed it by an overwhelming vote of 400 
to 12. I am honored, Mr. Chairman, that you have introduced our 
bill in the Senate as S. 2182, and we have had some very 
promising conversations with other Senators of both parties, 
but I especially appreciate your leadership.
    This bill directly attacks several problems that we have 
uncovered in testimony before the House Science Committee, and 
that I am sure you will hear about here today. First, the 
nation invests a pitifully small amount in cyber security 
research, and that is true of both government and industry. 
Government underinvests in part because no single agency has 
responsibility for the problem, and industry underinvests 
because the market has generally not put a high value on 
security compared with speed and price and other attributes of 
software.
    Second, as a result of the minimal investment, few top 
researchers are engaged in cyber security research, and few 
students are attracted to the field.
    Third, as a result of that minimal focus, our basic 
approach to cyber security has not changed in decades, even 
though it is known to be riddled with holes. Bill Wulf, the 
president of the National Academy of Engineering, and a leading 
computer scientist, calls this current cyber security paradigm 
a ``Maginot Line'' defense. That is not good enough.
    So what does H.R. 3394 offer in response? It sets up 
programs at both the National Science Foundation and the 
National Institutes of Standards and Technology, two premier 
science and technology agencies. These programs will bring 
industry and academic experts together, fund new, more daring 
research, attract top researchers to the field, and recruit new 
students to the field. The legislation also tells NSF that it 
has the lead responsibility for eliminating our deficiencies in 
cyber security research. It is nice to know someone is going to 
be in charge.
    In short, the new research grants, education grants, and 
fellowships created by H.R. 3394 directly address every problem 
we have identified that hampers our ability to develop a long-
term strategy to counter cyber terrorism. As a result, the bill 
has been strongly endorsed by such groups as the Information 
Technology Association of America, and the National Association 
of Manufacturers and, indeed, by just about every leading high 
tech industry and academic organization. It has also been 
endorsed by the Administration, which I think is important to 
know.
    The bill is a targeted, thoughtful approach to solve a 
problem that endangers our nation, and it reflects the advice 
of a range of experts from government, industry, and academia. 
I commend it to your attention, and I look forward to working 
with you to enact it and get it funded.
    I also want to express my support for the thrust of your 
bill, Mr. Chairman, S. 2037, popularly known as ``NET Guard.'' 
We are working on introducing it in the House. The bill 
addresses another serious gap in our cyber security 
preparedness--ensuring that we have the ability to respond 
should an attack actually succeed.
    We saw after the World Trade Center attack just how 
important it was to get our communications and utilities up and 
running again, and Con Ed and Verizon and squadrons of 
volunteers did a magnificent job. It was little short of a 
miracle that the New York Stock Exchange was back in business 
so rapidly. We need to have a system in place to ensure that 
recovery can always proceed that quickly. That is the goal of 
Netguard, and we have to find the right language to ensure that 
we have the pieces in place to allow rapid recovery.
    So Mr. Chairman, I look forward to continuing to work with 
you and with your colleagues to address this most difficult 
problem of cyber security. It is one that remains somewhat 
invisible to the public, just as the reliance on computer 
systems is somewhat invisible. If we do our jobs now, maybe the 
problem can remain invisible forever.
    A note was just given me. Senator Allen has announced that 
he will cosponsor our bill, and that is a wonderful addition to 
the squad.
    Senator Wyden. Well, let me just say, Chairman Boehlert, 
you have given, as usual, just an excellent statement. I think 
you are absolutely right with respect to what you want to 
accomplish in S. 2182. I think, as you have stated, the 
Administration deserves substantial credit for their work on 
the legislation as well, and what it will do, what S. 2182 will 
do, is ensure that these two premier agencies, NSF and NIST, 
will have a permanent capability that will allow us to find 
those cutting edge strategies and technologies to fight 
terrorism, and I commend you for all your work. I thank you for 
agreeing to work with us on S. 2087, and since, Chairman 
Boehlert, you of course had the vote, let me just tell you a 
little bit of where we are and just sort of invite you to 
participate.
    I think it is our desire on May 16, Senator Allen and 
myself, working with Chairman Hollings and Senator McCain, to 
have, with your input and that of the Administration, the 
ability of the Senate to move forward on both of these bills at 
the May 16 mark-up. Obviously, there are issues that we need to 
work on to ensure that there is no duplication and that we 
maximize the efforts to coordinate what is going on in the 
private sector with what is going on in government, but I think 
the pieces are falling in place.
    Mitch Daniels, in my discussions with him this morning, was 
very positive in terms of working with us, and so we invite you 
and your staff to work with the Commerce Committee leadership 
on these issues. With a little luck, we will have both of these 
bills moving on May 16, and to a great extent that is possible, 
Sherry, because of all that you have done.
    Mr. Boehlert. Thank you, Mr. Chairman. It is always a 
pleasure to work with you. We have a longstanding relationship. 
It is just nice, as the years pass, to get a little extra 
seniority and a little extra influence around this town, and we 
are putting it to good use.
    Senator Wyden. Well, you are using your gavel well, and we 
will try to complement what you are doing on this side. Unless 
you have anything to add, we will excuse you, but know that we 
are very appreciative of all your leadership.
    Mr. Boehlert. Thank you very much.
    Senator Wyden. Our next panel is Mr. Ronil Hira, Institute 
of Electrical and Electronics Engineers; Dr. Lance Hoffman, 
Department of Computer Science, George Washington University; 
Mr. Jeffrey Logan, Business Development Manager, M/A-COM; and 
Mr. Wyatt Starnes, President and Chief Executive Officer of 
Tripwire in Portland, Oregon.
    Let me also apologize, Dr. Strawn, I was reading from the 
wrong column. I apologize. We are very glad that you are here. 
Please, all of you, sit down and be comfortable, and we will 
make up for the omissions in the introductions, Dr. Strawn, by 
starting with you, and we will make all of your prepared 
remarks a part of the hearing record in its entirety, and if 
you could take 5 minutes or so and summarize your principal 
concerns, that would be great.
    Dr. Strawn, welcome.

 STATEMENT OF DR. GEORGE STRAWN, ASSISTANT DIRECTOR (ACTING), 
  DIRECTORATE FOR COMPUTER INFORMATION SCIENCE & ENGINEERING 
                   (CISE), NATIONAL SCIENCE 
                           FOUNDATION

    Dr. Strawn. Chairman Wyden, thank you for the opportunity 
to testify at this hearing on homeland security and the 
technology sector, and on the cyber security research and 
development Act. I am George Strawn, the Acting Assistant 
Director for Computer and Information Science and Engineering 
at the National Science Foundation. Prior to coming to NSF, I 
was a faculty member in the university computer science 
department and the director of an academic computation center. 
As such, I have been concerned with issues like cyber security 
for a long time.
    As you know, the Administration has yet to take a position 
on S. 2182, and so I will confine my remarks to the need for 
cyber security research and development and provide you with an 
overview of NSF's involvement in this important area. The 
Administration would appreciate an opportunity to analyze S. 
2182 and submit written views on it prior to the Subcommittee's 
consideration of the bill. Cyber security is now understood to 
be a rather difficult problem. This is true for many reasons, 
including the fact that cyber security is the property of the 
total system, not system components, and those components 
include human and management elements as well as technology 
elements. This means that individually secure components and 
procedures can be put together and still comprise a system that 
is not secure, unless the proper attention is given to system 
level security considerations.
    Of course, the fact that the Internet makes one big system 
out of millions, soon to be billions of IT components is a 
major source of complexity and insecurity. As you know, NSF 
focuses on long-term fundamental research and education in all 
areas of science and engineering. Long-term fundamental 
research has as its goal increased understanding of the 
subjects under study, and it has been the experience of science 
and engineering research that increased understanding leads to 
technology developments that are then put to important uses by 
a society.
    We believe there are important reasons to increase the 
emphasis on cyber security research and development, that is, 
seeking a better understanding of cyber security, as NSF has 
recently been doing. A major problem in developing a robust 
cyber security research program is that the number of faculty 
members in academe doing research in cyber security has been 
quite small.
    This is perhaps the most important problem to be solved as 
we seek to increase the amount of long-term fundamental 
research in cyber security, and unless there is a sufficiently 
large-size community of cyber security researchers, there will 
never be a sufficient number of graduate students trained in 
this field. This translates into a shortage of next generation 
cyber security workers and faculty. It also means we will 
continue to lack the courses and curricula needed to educate 
more students, undergraduates and graduates alike, for the 
cyber security work force.
    Last September 5, NSF announced a new research program 
called Trusted Computing to focus our support for cyber 
security research. In addition to the estimated $20 million 
that we have been investing in cyber security-related research 
projects, we allocated $5 million for our Trusted Computing 
program. On December 5, we received about 120 proposals in 
response to that announcement requesting over $80 million of 
support.
    Our expert panelists who reviewed those proposals rated 
almost half of them as worthy of funding. We believe that 
Trusted Computing program and similar programs will motivate 
more faculty to turn their attention and expertise to cyber 
security, and that this will help create a vibrant research 
community that will attack and ultimately solve many of the 
difficult problems associated with cyber security.
    NSF also has considerable experience in supporting 
curriculum and academic program development and of 
administering graduate and undergraduate trainee programs such 
as scholarships for service, the Cyber Corps program. This 
program has been funded at approximately $11 million for the 
past 2 years, and the Administration is requesting $19.2 
million in supplemental funding to enhance the program in 
fiscal year 2002.
    Such activities also help accelerate developments in cyber 
security, especially when coupled with vibrant research support 
to attract research faculty into the area, as mentioned above.
    Thank you again for the opportunity to testify, and I would 
be happy to respond to any questions you may have.
    [The prepared statement of Dr. Strawn follows:]

 Prepared Statement of Dr. George Strawn, Assistant Director (Acting), 
  Directorate for Computer Information Science & Engineering (CISE), 
                      National Science Foundation

    Chairman Wyden, Senator Allen, Members of the Committee, thank you 
for the opportunity to testify at this hearing on Homeland Security and 
the Technology Sector and the Cyber Security Research and Development 
Act. I am George Strawn, acting Assistant Director for Computer and 
Information Science and Engineering at the National Science Foundation. 
Prior to coming to NSF, I was a faculty member in a University Computer 
Science department and the director of an Academic Computation Center. 
As such I have been concerned about issues such as cybersecurity for a 
long time. As you know, the Administration has yet to take a position 
on S. 2182 so I will confine my comments to the need for cybersecurity 
R&D and provide you with an overview of NSF involvement in this 
important area. The Administration would appreciate an opportunity to 
analyze S. 2182 and submit written views on it prior to the 
Subcommittee's consideration of the bill.
    Although cybersecurity has always been an important part of 
information technology (IT), over the last decade its importance has 
been greatly magnified. This is so because IT systems and services now 
are pervasive throughout society and because the Internet now ties 
together so many of our IT systems. While this interconnectedness of IT 
systems is enabling great productivity gains for the U.S. economy, it 
has also enabled great gains for IT mischief makers and outlaws. 
Clearly, there is much understanding yet to be gained if we are to 
avoid unpleasant surprises and to foil those who would attack the 
internet or use it for illegal purposes.
    Although the defense sector has always paid great attention to 
cybersecurity, the same cannot be said about many civilian applications 
of IT. Until recently, cybersecurity has been considered an ``optional 
add-on'' for many IT systems. As recently as two years ago, discussion 
at a President's IT Advisory Committee (PITAC) meeting indicated that 
the private sector ``was not being rewarded'' for cybersecurity 
products and services because they made IT systems more complicated and 
slower at a time when customers were wanting more simplicity and speed. 
Although these circumstances have begun to change, there is much to do 
before we will be able to achieve desired levels of cybersecurity.
    Cybersecurity is now understood to be a rather difficult problem. 
This is true for many reasons, including that fact that cybersecurity 
is a property of the ``total system'', not of the system components 
(and those components include human and management elements as well as 
technology). This means that individually secure components and/or 
procedures can be put together to comprise a system that is not 
secure--unless the proper attention is given to system-level security 
considerations. Of course, the fact that the Internet makes ``one big 
system'' out of millions (soon to be billions) of component IT systems 
is a major source of complexity and insecurity.
    Early research and development work on the Internet, as with many 
IT developments of the past, focused on ``making it work'', not 
necessarily on making it secure. And because cybersecurity is a systems 
property, trying to add it on as an afterthought is very problematic. 
It would be much better to recreate IT systems with cybersecurity as a 
major design criteria than to attempt to patch it in after the fact.
    Of course, we must and can attend to short-term needs and to long-
term improvements simultaneously. Short-term cybersecurity patches are 
not only possible but are in progress throughout the IT world. In fact, 
a major challenge is to get cybersecurity services and procedures that 
have been developed over the last few years into wide use. Although 
there may be useful tactical contributions to cybersecurity that NSF 
can make (such as cybersecurity emphases in our Digital Government 
program), I would like to focus on longer term issues in cybersecurity 
because that is where NSF's contributions can be the greatest.
    As you know, NSF focuses on long-term fundamental research and 
education in all science and engineering disciplines. This long-term 
fundamental research has as its goal increased understanding of the 
subjects under study. And it has been the experience of science and 
engineering research that increased understanding leads to technology 
developments that are then put to important uses by society. In many 
cases the societal uses that result from scientific understandings were 
not apparent at the time the scientific work was being done. For 
example, important applications to cybersecurity may arise out of 
scientific research in IT systems (or even in other sciences) that 
doesn't initially appear to be related to security. Nevertheless, there 
are important reasons to increase the emphasis on cybersecurity R&D as 
NSF has recently been doing.
    NSF has supported cybersecurity research for a number of years, 
recently at a level of approximately $20 million. A major problem in 
developing a robust cybersecurity research program is that the number 
of faculty members doing research in cybersecurity has been quite 
small. This is perhaps the most important problem to be solved as we 
seek to increase the amount of long term fundamental research in 
cybersecurity. Unless there is a sufficiently large-size community of 
cybersecurity researchers, there will never be a sufficient number of 
positions for graduate students to assist in the conduct of that 
research. This translates into a shortage of next-generation 
cybersecurity workers and faculty. It also means we will lack the 
courses and curricula needed to educate more students--undergraduates 
as well as graduates--ready to go into the cybersecurity workforce.
    NSF's Scholarships for Service/Cybercorp program is one way we are 
trying to address this issue. This program makes awards to qualified 
institutions to provide scholarships to undergraduate and graduate 
students studying computer security. In exchange, the recipients must 
serve in the federal government for at least two years. The program 
also provides capacity building grants to improve the quality and 
increase the production of computer security professionals. The program 
has been funded at approximately $11 million the past two years and the 
Administration is requesting $19.3 million in supplemental funding to 
enhance this program in FY 2002.
    Last September 5th, NSF announced a new research program, Trusted 
Computing, to focus our support for cybersecurity research. In addition 
to the estimated $20 million that we anticipate as our ongoing 
investment in distributed cybersecurity research projects, we allocated 
an additional $5 million for the Trusted Computing program. On December 
5th, we received about 120 proposals in response to that announcement 
requesting over $80 million of support. Our expert panelists who 
reviewed those proposals rated about 10 percent of them as ``highly 
competitive'' (high praise from the ever-critical research community) 
and rated almost half of them as worthy of funding. We will award 
funding to the highly competitive proposals. We believe that this 
program will motivate more faculty to turn their attention and 
expertise to cybersecurity. It will be necessary to focus attention on 
programs like Trusted Computing over the next several years if we are 
to help create a vibrant research community that will attack, and 
ultimately solve, many of the difficult problems associated with 
cybersecurity.
    In addition to individual research awards, NSF has recently 
increased the number of large project interdisciplinary awards it has 
made in areas of IT research. Under the Information Technology Research 
(ITR) priority area initiated in 2000, NSF began a major invigoration 
of its IT research activities, including a focus on large, 
interdisciplinary research projects. We believe that this focus has 
already begun to show extremely valuable results by enabling computer 
scientists and engineers to work collaboratively on problems that 
require expertise from many areas to solve. I believe that many 
cybersecurity problems will also benefit from interdisciplinary groups 
or centers working collaboratively on their solutions. One important 
goal of fundamental long term research in cybersecurity will be to 
produce agreement on what, in fact, constitutes as secure system. When 
such an agreement is in hand, it will be possible to formulate 
important cybersecurity standards that, like all important standards, 
will facilitate their realization.
    NSF also has considerable experience in supporting curriculum and 
academic program development and of administering graduate traineeship 
programs. Such activities could also help accelerated academic 
developments in cybersecurity as long as they are coupled with vibrant 
research support to attract the research faculty into the area as 
mentioned above.
    NSF focuses on people, ideas, and tools as it pursues its goals of 
helping to keep the U.S. in a world-leadership position in science and 
engineering research and education. Increasingly IT tools and services 
are required by all academic disciplines to achieve these goals. 
Therefore our efforts to contribute to cybersecurity research and 
development are increasingly required for our science and engineering 
community as well as by society at large. As IT continues to transform 
society, cybersecurity continues to increase in importance and is of 
increasing priority on our list of important scientific and engineering 
activities.
    Thank you again for the opportunity to testify, and I would be 
happy to respond to any questions you may have.

    Senator Wyden. Very good. Let us move on now to Dr. 
Hoffman.

         STATEMENT OF DR. LANCE HOFFMAN, DEPARTMENT OF 
            COMPUTER SCIENCE, THE GEORGE WASHINGTON 
                           UNIVERSITY

    Dr. Hoffman. Thank you, Chairman Wyden. It is an honor to 
have this opportunity to appear before you today to comment on 
S. 2037, the Science and Technology Emergency Mobilization Act, 
and S. 2182, the Cyber Security Research and Development Act. 
My name is Lance Hoffman. I am professor of computer science at 
the George Washington University here in Washington, D.C., 
where I lead the computer security graduate program in computer 
science. I am a fellow of the Association for Computing 
Machinery, the ACM, an organization of 75,000 computer 
professionals with active professional and student chapters in 
Oregon, Virginia, and most states throughout the nation.
    This statement today has been endorsed by the ACM's 
Committee on Computer Security and Privacy and the U.S. Public 
Policy Committee of the ACM, the USACM. I will summarize it in 
the interest of time. My entire statement has been submitted 
for the record.
    First, let me address S. 2182. This bill takes important 
steps to develop the cadre of scientists, engineers, and 
computer specialists who understand current information 
assurance problems and can ameliorate them while also 
developing long-term solutions based on improved, smarter 
technologies. It does this by new research and education 
programs at the National Science Foundation and the National 
Institutes of Standards and Technology.
    Computer security and information assurance have had 
trouble in the past competing with more established 
disciplines. Students and faculty have been driven by available 
funding opportunities to work on problems that are better known 
and whose solutions are in some cases more developed, but less 
important and critical to the nation than the security of its 
infrastructure. This bill will help remedy that situation.
    I especially like the inclusion of privacy and 
vulnerability assessments, also known as risk analysis, as 
important areas of study, since innovative technical solutions 
will fail if they do not take into consideration the 
surrounding constraints. These constraints include politics, 
cost, legal liability, and other technologies like battery 
life.
    I very much support the bill. The Committee may wish to 
consider a few minor improvements. First of all, there is an 
intense nation-wide competition for the current small number of 
recent Ph.D graduates interested in a faculty position in 
computer security and information assurance. Explicitly 
allowing funds for faculty recruitment from outside, for 
example, from retirees, might provide another source of 
qualified people to buildup the training cadre more rapidly.
    Second, program managers at NIST and NSF should be allowed 
a bit more discretion in funding extraordinary projects with 
high risk and high potential. Setting aside a small percentage 
of the funds of this bill for innovative projects that address 
evolving and emergency research issues will allow researchers 
to fund a planning workshop or encourage an add-on specialty 
day at an existing conference in a hurry, without encountering 
a lot of red tape.
    Finally, I respectfully suggest that universities be 
allowed to concentrate first on curriculum development and 
student recruitment. Later, universities could be required to 
collect appropriate placement data from students as they exit 
the program. The bill as written I believe currently requires 
placement data up front, and I think this competes with getting 
these new programs off to a good start.
    Let me now turn to S. 2037. S. 2037 establishes pilot 
programs aimed at achieving the interoperability of 
communications systems used by emergency response agencies. It 
is good as far as it goes,but it is incomplete. It is also 
necessary to improve the integrity, assurance, and security of 
these systems. Standards bodies, including NIST, should work to 
develop better wireless standards to ensure security and 
utility of such systems.
    Also, while this legislation takes necessary steps to 
require expertise checks, it lacks similar safeguards requiring 
background checks, potentially allowing the introduction of 
technically competent, malevolent individuals into the nation's 
infrastructure defense. We must verify both the technical 
credibility and the personal background of individuals selected 
for the National Emergency Technology Guard that is envisioned 
in this bill.
    A final point. If and when utilized, the virtual technology 
reserve data base should only be used, and not misused by those 
responsible. The data base must be designed and tested properly 
and vetted by experts in data bases, privacy, and security.
    A final word on the chilling effects of the Digital 
Millennium Copyright Act. I would be remiss if I did not 
mention these. The DMCA's restrictions have the potential to 
cripple the very security advancements that S. 2037 and S. 2182 
are intended to generate, and its limited exemptions have not 
provided a safe harbor for researchers. I urge you to reexamine 
it and similar laws.
    Thank you, Mr. Chairman, for the opportunity to appear 
before you today. I would be pleased to answer any questions 
you might have.
    [The prepared statement of Dr. Hoffman follows:]

    Prepared Statement of Dr. Lance Hoffman, Department of Computer 
               Science, the George Washington University

    Thank you, Chairman Wyden, Senator Allen, and other distinguished 
members of the Science, Technology, and Space Subcommittee. It is an 
honor to have this opportunity to appear before you today and to assist 
in your efforts to strengthen our nation's information infrastructure 
and improve our capability to respond and recover from terrorist 
attacks and other emergencies.
    I am Lance J. Hoffman, Professor of Computer Science at the George 
Washington University here in Washington, D.C. I lead the computer 
security graduate program in computer science and the Computer Security 
and Information Assurance Graduate Certificate Program. This academic 
year, I taught information policy and information warfare courses to 
students of computer science, international affairs, political science, 
and other fields. In 1993, I founded the School of Engineering's 
Cyberspace Policy Institute to examine the relationship between the 
technical and other factors that affect security, privacy, and related 
aspects of computer and information systems.
    I am a Fellow of the Association for Computing Machinery (ACM), the 
nation's oldest and largest professional society of computer 
scientists, educators and other computer professionals committed to the 
open interchange of information concerning computing and related 
disciplines. The ACM has 75,000 individual members, including active 
professional and student chapters in Oregon, Virginia, and most states 
throughout the nation.
    To underscore the importance of today's hearing this statement has 
been endorsed by the ACM's Committee on Computer Security and Privacy 
and the U.S. Public Policy Committee of the ACM (USACM).
    I appreciate this opportunity to comment on S. 2037, the Science 
and Technology Emergency Mobilization Act, and S. 2182, the Cyber 
Security Research and Development Act, two significant pieces of 
legislation designed to address our nation's information assurance 
needs.
S. 2182
    First, let me address S. 2182. This bill takes important steps to 
develop the cadre of scientists, engineers, and computer specialists 
who understand current information assurance problems and can 
ameliorate them while also developing long-term solutions based on 
improved, smarter technologies. To date, despite the fact that an 
increasing amount of daily life involves reliance on computer systems 
and networks, there is a remarkably small amount of long-term, ongoing 
funding available for computer security and information assurance 
research and development designed to solve these problems. This bill 
may remedy these concerns by providing the incentives and human 
resources necessary to meet some of today's security challenges and to 
take on tomorrow's. It does this in several ways, notably by the new 
research and education programs it calls for at the National Science 
Foundation (NSF) and the National Institute of Standards and Technology 
(NIST).
    These programs will promote more innovative research in information 
assurance by attracting technically competent researchers into this 
field of national need. The bill is written in such a way that everyone 
from a senior faculty member wishing to focus his or her attention on 
computer security to a bright undergraduate student will be encouraged 
to work in this field. It will help to address the critical shortage of 
Ph.Ds and graduates in the security field that limits opportunities for 
research and solving the critical challenges we face.
    Computer security and information assurance have had trouble in the 
past competing with more established disciplines. Students and faculty 
have been driven by available funding opportunities to work on problems 
that are better known and whose solutions are in some cases more 
developed, but less important and critical to the nation than the 
security of its infrastructure. This bill will help to remedy that 
situation.
    I especially like the inclusion of privacy and risk analysis as 
important areas of study, in addition to what some might consider more 
purely technical areas. Since innovative technical solutions developed 
in a vacuum without taking into consideration the surrounding 
constraints related to politics, cost, and legal liability will fail, 
the inclusion of these areas will guarantee that the pure technological 
solutions that come out of the programs that this bill funds will 
actually have a good chance of being implemented, working, and 
ultimately improving the security of the nation's infrastructure.
    I also appreciate the foresight of the bill in recognizing and 
supporting not only traditional undergraduate and graduate fields of 
study, but also certificate programs in the area. I direct a 
certification program where working professionals come in after a full 
day at work, and devote an additional five hours toward a certification 
in security and information assurance. In the program we have just 
started, more than a quarter of the students have been motivated to go 
back to school and pursue more advanced master's and doctoral studies 
in this area, and to apply the graduate credits earned with their 
certificate to those higher degrees.
    The bill is excellent as written, but the Committee may wish to 
consider a couple of minor changes that would improve it even further. 
For instance, it currently provides funds for faculty retraining in 
this area. But in many cases, this may not be a viable option since 
many universities are stretched thin in trying to properly cover the 
currently recognized core areas of computer science. It is hard enough 
to get established faculty members in one field to change specialties, 
and recruiting across departments is almost impossible.
    There are only a limited number of faculty members in the U.S. who 
have significant background in security research. As my colleague 
Professor Eugene Spafford of Purdue University pointed out in his 
testimony last fall to the House Committee on Science, an informal 
survey of 23 preeminent U.S. universities with information security 
programs found that they graduated a combined total of 20 Ph.Ds in 
security over the last three years. As you can imagine, there is an 
intense competition for the even smaller number of graduates interested 
in a faculty position. Explicitly allowing funds for faculty 
recruitment from outside (for example, from retiring federal government 
and contractor security experts who have appropriate credentials, 
teaching skills, and the motivation to work as part-time or full-time 
faculty but would not otherwise have the opportunity) might provide 
another solution to this problem of building up the training cadre more 
rapidly.
    While I am very encouraged with the funds authorized by this 
legislation, I would also suggest that program managers at NIST and NSF 
be allowed a bit more discretion in funding extraordinary projects with 
high risk and high potential. Setting aside a small percentage of the 
funds of this bill for small, innovative projects that address evolving 
and emerging research issues will allow researchers to, for example, 
fund a planning workshop or to encourage an add-on specialty day at an 
existing conference without a lot of red tape. These opportunities for 
research and information dissemination may lead to new innovative 
solutions and other advances in information security.
    My final remark on S. 2182 relates to the requirement for placement 
data in fields related to computer and network security. A study of 
potential enrollment and placement for students enrolled in a proposed 
computer and network security program may be hard for many universities 
to generate at the same time they are starting these programs and 
assimilating the additional students generated by this and other 
programs. As a result, the development and growth of these programs 
could be unnecessarily impeded. I respectfully suggest that 
universities be allowed to concentrate on curriculum development and 
student recruitment up front. If you wish, universities could be 
required to collect appropriate placement data from students as they go 
through and exit the program. But requiring this up front is 
counterproductive.
S. 2037
    Turning my attention to S. 2037, the Science and Technology 
Emergency Mobilization Act, I wish to commend the members of this 
Subcommittee for their noble attempt to harness the outstanding 
capabilities of our nation's science and technology community, 
especially in times of national crisis. Faced with the realities of 
September 11, many members of the computing community wished to provide 
their technical assistance towards safeguarding our nation's 
infrastructure and in recovering from the attacks. S. 2037 would 
provide opportunities to match security experts where their services 
are most needed.
    I wish to offer the following recommendations to build upon the 
many fine provisions of S. 2037. First, in establishing pilot programs 
aimed at achieving the interoperability of communications systems used 
by emergency response agencies, it is also necessary to achieve the 
integrity, assurance, and security of the communications. In attempting 
to improve emergency communications, it would be shortsighted to 
sacrifice security to achieve utility, particularly if it leads to 
vulnerable emergency communication systems. Wireless standards, where 
they exist, are known to be weak. Standards bodies, including NIST, 
should work to develop better wireless standards to ensure security and 
utility of such systems.
    While the legislation takes necessary steps to require expertise 
checks, it lacks similar safeguards requiring background checks. This 
vulnerability might allow the introduction of technically competent 
malevolent individuals into risk equation. If we don't verify both the 
technical credibility and the personal background of individuals, we 
risk doing more harm than good.
    Authentication precautions and other security mechanisms, combined 
with privacy policy guidelines, will be necessary so that if and when 
utilized, the ``virtual technology reserve'' database is only used by 
those responsible and is not misused (e.g., by an enemy attacking using 
a form of information warfare and polluting the database or identifying 
and harassing or impeding the responders identified therein).
    The database will need to be designed and tested properly; possibly 
using competing designs with rapid prototyping. Both database and 
security experts should work on system design to insure appropriate 
access and security balances, speed of responsiveness, update ability, 
and accuracy.
    While S. 2037 will help our nation respond to acts of terror and 
other emergencies, we must simultaneously engage in a more proactive 
approach that focuses on prevention. ``Emergency prevention and 
response'' is stated as an objective but it is much easier to 
demonstrate response than prevention [it's hard to have a demonstration 
if nothing is happening].
Chilling Effects of the Digital Millennium Copyright Act
    One last but critical point that I wish to leave you with is that 
laws like the Digital Millennium Copyright Act (DMCA) inhibit the 
ability of individuals to engage in critical research in computer 
security and related fields. Unfortunately, this has certain 
implications for national security. For instance, researchers who study 
or teach encryption, computer security, or otherwise reverse engineer 
technical measures and who report the results of their research in this 
area face new risks of legal liability under the DMCA. As University of 
California at Berkeley Law Professor Pamela Samuelson has noted, the 
limited exemptions carved-out in the DMCA have been found to be of 
little value to the research community. I encourage you to re-examine 
laws that prohibit or restrict computing technology instead of 
undesirable behavior. DMCA-like restrictions have the potential to 
cripple the very security advancements S. 2037 and S. 2182 are intended 
to advance.
    In summary, I commend the members of the subcommittee for their 
legislative efforts to enhance the security of our nation's 
infrastructure and our ability to respond to national emergencies. 
Thank you for the opportunity to appear before you today. I would be 
pleased to answer any questions you might have.

    Senator Wyden. Dr. Hoffman, thank you. I think the DMCA 
proposal may be a little much for us to get into in legislation 
that we would like to have moving in a month or so, but I think 
you know we very much value the work you are doing, and your 
organization. We will have some questions in a moment. We would 
welcome Mr. Starnes, and we are glad once again Oregon is 
pioneering in this area, and we welcome you, Wyatt, and you may 
proceed.

 STATEMENT OF W. WYATT STARNES, PRESIDENT AND CHIEF EXECUTIVE 
                    OFFICER, TRIPWIRE, INC.

    Mr. Starnes. Thank you, Mr. Chairman. My name is Wyatt 
Starnes, founder and CEO and president of Tripwire, 
Incorporated. I would like to start by commending this 
Subcommittee, led by Senator Wyden, Senator Allen, and their 
staff in directing focus on critical issues of cyber security. 
I appreciate the opportunity to testify orally before the 
Committee today. I have also submitted expanded written 
comments for the record.
    For the past decade, the technology that is Tripwire has 
focused on data integrity assurance as a means to achieve 
higher levels of security, control, availability, and 
reliability of computing systems. Our focus has been on 
protecting critical computing infrastructure within the 
commercial and government sectors.
    Tripwire software has been deployed on hundreds of 
thousands of critical systems worldwide, including many in this 
building. It is as an information security professional and a 
business leader, as well as a citizen, that I am here before 
you today to discuss the security and control of our nation's 
cyber infrastructure, and why I've concluded that both Senate 
Bill 2182, the Cyber Security Research and Development Act, as 
well as Senate Bill 2037, the Science and Technology Emergency 
Mobilization Act, represent very positive steps forward to 
safeguard our nation's somewhat fragile digital infrastructure.
    The development of Tripwire's technology was supported 
entirely with commercial funding as a part of Purdue's center-
based long-term research efforts, which have no federal 
support. They are almost entirely funded by corporate 
contributions. Recently, market pressures, including the 
economic downturn, have put a damper on commercial funding, 
reducing the capacity of many academic programs. It may even 
threaten the existence of a few at a time when they are just 
beginning to realize their full value.
    We support Senate Bill 2182 as it provides a means to 
address these issues by creating and funding programs to 
stimulate new cyber research and development. They should help 
to prime the pump, enhancing our ability to stay ahead in the 
development of critical cyber protection technologies. The 
problem, however, extends beyond federal funding issues. We 
must enhance the coordination among the state-federal 
government as well as the academic community and private 
industry.
    As a CEO of a commercial company, I routinely see the 
desire and need for government and commercial entities to 
enhance their security procedures, in many cases especially 
within the government sector. These requirements come months, 
or even years before the funding becomes available. It is in 
these critical gaps that our cyber vulnerability as a nation is 
the greatest. Somehow we need to find ways for the government 
to operate in Internet time when faced with bridging these 
gaps, and expedite approvals of funding to address them.
    Turning my attention to Senate Bill 2037, the Science and 
Technology Emergency Mobilization Act, I believe this 
legislation can help by establishing a structure within the 
national Netguard framework to enable public and private 
sectors to work together more effectively when cyber events 
threaten our country's electronic infrastructure. This act 
intends to create an organized process and control structure to 
allow the private sector to provide the appropriate assistance 
in times of need, as well as a mechanism for the government to 
quickly locate and request assistance from qualified 
individuals within the private sector. These capabilities are 
useful to enable the country to react quickly and appropriately 
to cyber security issues, particularly when they impact our 
national infrastructure.
    While I am supportive of the concept reflected in Senate 
bill 2037, I urge the Committee to think and act carefully in 
defining who and how the Netguard members are qualified and 
enlisted. We must be certain that the mechanism created to 
assist does not introduce new vulnerabilities, competitions or 
confusion. The urgency to get this infrastructure in place must 
be tempered with the need to get it right.
    Within the great State of Oregon, industry and government 
are working together to create a consortium called Oregon 
RAINS, which stands for the Regional Alliance for Information 
and Network Security. I believe this effort could serve as a 
model for other states to organize their cyber resources. 
Oregon RAINS will be hosting Richard Clarke and other officials 
for a review of this important program in Oregon in early June.
    In summary, I am in strong support of both these important 
acts as they enhance the underpinnings required to address many 
of these obstacles and challenges. They will enable us to work 
together more effectively to improve our cyber security 
capabilities, as well as to ensure we continue to advance the 
state-of-the-art development of our cyber capability.
    Thank you, Mr. Chairman, and I would welcome any questions.
    [ The prepared statement of Mr. Starnes follows:]

         Prepared Statement of W. Wyatt Starnes, President and 
                Chief Executive Officer, Tripwire, Inc.

    Good afternoon Mr. Chairman and Members of the Committee. My name 
is Wyatt Starnes, a founder, CEO and president of Tripwire, Inc. I have 
followed with great interest the activities of the federal government 
at this very critical time in our nation's history. I would like to 
commend this Subcommittee, led by Senator Wyden and Senator Allen, and 
their staff, in directing focus on the critical issues of Cyber-risk 
and Cyber-security.
    I appreciate the opportunity to present before this Committee 
today.
    For the past decade, the technology that is Tripwire has focused on 
data integrity assurance as a means to achieve higher levels of 
security, control, availability, and reliability of computing systems. 
Our focus has been on protecting critical computing infrastructure 
within the commercial and government sectors. Tripwire software has 
been deployed on hundreds of thousands of systems worldwide, including 
many inside of this building.
    At Tripwire, we understand the importance of being able to rapidly 
detect, assess, and appropriately respond to threats, risks and even 
accidental changes to critical systems. Intrusions, computer viruses, 
logic bombs, hackers, ``worm'' programs, and badly written software can 
all lead to compromise, alteration and destruction of crucial 
information. Assuring the integrity and control of the ever-expanding 
digital infrastructure is crucial to our nation's financial viability 
as well as its safety and security. We understand that to fully manage 
the risks associated with maintaining information resources requires 
exerting positive control: our products enable that level of control.
    It is as an information security professional and business leader--
as well as a citizen--that I am here before you today to discuss the 
security and control of our nation's cyber-infrastructure, and why I 
have concluded that both Senate bill 2182, the ``Cyber Security 
Research and Development Act'' and Senate bill 2037, the ``Science and 
Technology Emergency Mobilization Act'' represent positive steps 
forward to safeguard our nation's somewhat fragile digital 
infrastructure.
    Relative to Senate bill 2182, our company understands the 
importance of supporting and funding research within the university 
system. After all, our core technology was initially developed at 
Purdue University almost ten years ago under the direction of Professor 
Eugene Spafford. We later obtained the commercial rights to the 
technology and have built upon the Purdue work to create high-quality, 
commercial data integrity assurance solutions that are in wide use 
around the world, including prominent usage within most branches of the 
U.S. Government. Other fundamental information security technology, 
including security scanners, firewalls, VPNs, and intrusion detection 
systems all have roots in academic research at Purdue and elsewhere.
    It is important to note that a considerable amount of this 
technology was developed without federal support, and often without any 
external support at all. Research efforts over the last decade 
conducted at leading universities such as Purdue have been supported 
almost entirely by small corporate contributions. Unfortunately, there 
has been no federal support for the kind of long-term and center-based 
research that is being conducted. We can only speculate at the 
solutions we might have in hand for today's problems had these 
researchers been supported at a more appropriate level.
    Because of market pressures, including the recent economic 
downturn, industry support for leading academic programs with long-term 
vision has suffered. This scarcity of dollars has reduced the capacity 
of most academic programs, and may even threaten the existence of a few 
at a time when we are beginning to realize their importance. The small 
quantity of funds available, and their dominance by industry, tends to 
cause researchers to focus on ``quick fix'' patches instead of more 
fundamental solutions to society's cyber-weaknesses.
Consider:
   There are too few students studying cyber-security needs and 
        issues;

   Too little is being spent to drive the technological 
        research required to fight a war on the cyber-battle ground;

   There are too few researchers advancing the state of 
        technology within the university system.

   There are not enough trained professors to develop and teach 
        the courses to train a new generation of information security 
        professionals.

    Unless something significant changes, these problems may continue 
or worsen despite the best efforts of those of us working in cyber-
security.
    It is also necessary to provide mechanisms to allow public 
universities to accept equity from private industry in order to 
effectively capitalize on technology developed with public funding. 
Some states, including Oregon, currently limit or prohibit these 
transactions. Oregon is moving aggressively to remove these 
restrictions with a ballot initiative to change the states 
constitution. This effort has been largely driven by the private 
sector. We urge other states to begin the important processes to 
reverse restrictive provisions relating to technology transfer by and 
between public Universities and the private sector.
    We support Senate bill 2182 as it provides a means to address these 
issues by creating and funding programs to stimulate new cyber-research 
and development. This should help to ``prime the pump'' enhancing our 
ability as a nation to stay ahead in the development of critical cyber-
protection technologies.
    There is no doubt that leading firms such as Tripwire will respond 
to immediate security needs by government and society at large. But we 
also believe it is vital that government take a role in ensuring that 
the creative minds in leading universities such as Purdue have the 
resources to work on the solutions we will need a decades from now, 
too.
    Does this solve all our problems? No. The problem extends beyond 
university funding. We must enhance the coordination among state and 
federal government, the academic community, and private industry.
    From my perspective as the CEO of a commercial company, we 
routinely see the desire and need for government and commercial 
entities to enhance their security processes. In many cases, especially 
within the government sector, the requirements to `upgrade' critical 
systems come months or even years before the funding becomes available. 
It is in these critical gaps that our cyber-vulnerability as a nation 
is the greatest.
    I urge the Congress to be aware of these gaps. Somehow, we need to 
find ways for government to operate in ``Internet Time'' when faced 
with bridging these gaps and expedite approvals and funding to address 
them.
    Another area I would like to comment on are the issues of National 
and local coordination and cooperation. During the aftermath of the 
events of September 11, we've all heard stories of companies and 
organizations with the desire and expertise to help government 
agencies. However, they found there were limited cross-agency 
mechanisms to coordinate this interest and well-intended response.
    I am convinced we should learn from these experiences as the same 
sorts of challenges exist when dealing with threats and incidents of a 
``cyber'' nature.
    This leads me to offer my comments on Senate bill 2037, the 
``Science and Technology Emergency Mobilization Act''. I believe that 
this legislation can help by establishing a structure within the 
``National NetGuard'' framework to enable the public and private 
sectors to work together more effectively when cyber-events threaten 
our country's electronic infrastructure.
    This act intends to create an organized process and control 
structure to allow private sector to provide the appropriate assistance 
in times of need, as well as a mechanism for the government to quickly 
locate and request assistance from qualified individuals within the 
private sector.
    These capabilities are useful to enable the country to react 
quickly and appropriately to cyber-security issues, particularly when 
they impact our national infrastructure.
    While I am supportive of the concept reflected in Senate bill 2037 
I urge the Committee to think and act carefully in defining who and how 
the NetGuard members are qualified and enlisted. We must be certain 
that the mechanism created to assist does not introduce new 
vulnerabilities, competitions, or confusion. The urgency to get this 
infrastructure in place must be tempered by the need to `get it right'.
    Within our great state of Oregon the Private Sector is marshaling 
its resources to address these gaps at a local level. The Oregon 
Regional Alliance for Information and Network Security, or RAINS, is a 
consortium of private and public sector organizations and individuals 
forming around the following mission:

   To contribute to U.S. defense and Homeland Security by 
        providing solutions to critical cyber-security problems, and

   To expand Oregon's cyber-security cluster, creating jobs, 
        cultivating technical innovation and education, and improving 
        the state's economy.

    I believe that this model can be extended nationally and dovetail 
with the initiatives proposed in Senate bill 2037. The Oregon RAINS 
project will be hosting Richard Clarke and other federal officials in 
Oregon to present this project on June 5-6, 2002.
Comments on Homeland Security
    What the Committee is addressing today could be included under the 
rubric `Homeland Security'. I think it important to remember that many 
of the weaknesses in our infrastructures that we are concerned about 
today were identified by experts in academia, industry and government 
decades ago. Those warnings were not heeded because they involved 
additional appropriations and regulation that were not seen as having 
an immediate effect. Thus, we are now faced with an urgent need and 
much larger economic and social cost to retrofit solutions--including 
some of dubious effectiveness--into everything from communication to 
transportation to power distribution.
    Experts have likewise been warning for years that our information 
infrastructure is at risk and that insufficient investment is being 
made in research, education, and deployment of safeguards. I believe 
that proactively allocating and expediting significant funding to 
enhance our National digital infrastructure before there is a major 
breach would be very prudent.
Summary
    In summary, I am in strong support of this important legislation as 
it enhances the underpinnings required to address many of these 
obstacles and challenges. It will enable us to work together more 
effectively to improve our cyber-security capabilities, as well as 
ensure that we continue to advance the state-of-the-art with regard to 
protecting our cyber-infrastructure.
    Thank you and I welcome any questions from the Committee.

    Senator Wyden. Wyatt, thank you. That is very helpful. I 
commend you for all of the innovative work you all have done, 
and of course, Oregon RAINS really is a pioneering effort. As 
you know, we have worked very closely with them in our efforts 
to try to move the legislation we are considering today. We are 
glad you are here. We will have some questions.
    Mr. Hira, welcome.

     STATEMENT OF RONIL HIRA, INSTITUTE OF ELECTRICAL AND 
                ELECTRONICS ENGINEERS (EEE)-USA

    Mr. Hira. Thank you, Mr. Chairman. Good afternoon. I wanted 
to thank you, the Ranking Member, and distinguished 
Subcommittee Members for inviting me here today. My name is 
Ronil Hira, and I am here on behalf of the 235,000 U.S. members 
of the Institute of Electrical and Electronics Engineers.
    I am the chair of the IEEE-USA, which is our acronym here, 
the IEEE-USA's Research and Development Policy Committee. Our 
members are electrical, electronics, computer and software 
engineers who work in government, industry, as private 
consultants, as well as professors and students in 
universities.
    We at IEEE-USA applaud the Subcommittee's efforts to 
address shortfalls in two critical areas related to homeland 
security today, disaster response and mobilization, and cyber 
security research and development. I think it is pretty 
axiomatic that technology is driving society, but it is also 
becoming pervasive within society in making things more and 
more complex. At the same time, we have an increase in terms of 
the threats and vulnerabilities to outside threats.
    Fortunately, the United States has the largest and best-
qualified pool of technological experts and the most 
sophisticated technology and communications equipment in the 
world. The challenge, however, is in coordinating the response, 
finding the necessary experts and supplies, and getting them 
into play as quickly as possible. For this reason, IEEE-USA 
strongly endorses the objectives of S. 2037, the Science and 
Technology Emergency Mobilization Act.
    Technology evaluation and standards are important elements 
in any implementation, but they are really critical elements in 
any disaster recovery program, and I am glad to see that is 
being addressed here. In addition, interoperability is 
obviously critical in those disaster recovery programs. I do 
not think you have to be an American politics scholar of Alexis 
de Tocqueville to know and recognize the degree to which 
volunteerism and voluntary organizations are important in the 
U.S., so I am glad that S. 2037 does address that.
    In regard to S. 2182, the Cyber Security Research and 
Development Act, we were supporters of the legislation when it 
was introduced the House, H.R. 3394. A couple of points on 
that. It is not the case that cyber security and computer 
security has not been going on. Really, the issue is the scale 
in which it has been going on. There are clients such as 
military, financial services, who are very concerned about it 
and have addressed computer security to whatever degrees.
    The real issue becomes, to what degree is computer security 
impacting all of technology development, software development, 
and so on and so forth, and we believe that this bill will help 
to address that.
    The point is not just to advance the state-of-the-art, but 
is to advance the state of the market and the state of the 
practice that is out there, and we believe S. 2182 is 
comprehensive enough to get us in the right direction moving 
toward that. It includes industry, government, and universities 
working together. You are going to get incremental gains, but 
you are also going to push the frontiers of cyber security. For 
those reasons, we are pleased to support S. 2182, and I look 
forward to any questions you might have.
    [The prepared statement of Mr. Hira follows:]

     Prepared Statement of Ronil Hira, Institute of Electrical and 
                    Electronics Engineers (EEE)-USA

    I would like to thank the Chairman, Ranking Member and 
distinguished Subcommittee Members for inviting me here today. My name 
is Ronil Hira, I am here on behalf of the more than 235,000 U.S. 
members of The Institute of Electrical and Electronics Engineers. I am 
the chair of IEEE-USA's Research and Development Policy Committee. Our 
members are electrical, electronics, computer and software engineers 
who work in government and industry, as private consultants and are 
professors and students in our universities.
    We at IEEE-USA applaud the Subcommittee's efforts to address 
shortfalls in two critical areas related to homeland security: disaster 
response and mobilization, and cyber security research and development. 
As the nation becomes more dependent upon technology in nearly every 
aspect of our lives, the level of vulnerability to technological 
disruption rises accordingly, as does the potential impact that 
disruption has on our lives. As we saw with the problems that became 
apparent following the attacks of September 11, the promptness and 
quality of the technological response to terrorist attacks or natural 
disasters could mean the difference between life and death.
    Fortunately, the United States has the largest and best-qualified 
pool of technological experts and the most sophisticated technology and 
communications equipment in the world. The challenge, however, is in 
coordinating the response, finding the necessary experts and supplies 
and getting them into place as quickly as possible.
    For this reason, IEEE-USA strongly endorses the objectives of the 
S. 2037, the Science and Technology Mobilization Act. The concept of 
organizing to focus the nation's technology resources to address the 
response to terrorist attacks and other emergencies is an important 
ingredient in a robust homeland defense. As a result of the attacks, 
local governments are renewing their efforts to design disaster-
recovery plans. Many entities have put in place emergency communication 
plans and have taken steps to ensure optimal use of other technologies. 
For example, uninterruptible power supplies are now coming into common 
usage.
    We strongly concur with Office of Science and Technology Policy 
Director, Dr. John Marburger's recommendation encouraging voluntary 
preparedness among organizations, including implementing IT disaster-
recovery procedures as well as promoting standards for coordinating 
disaster-recovery responses. This may well fit into the charter of the 
National Institute of Standards and Technology; however, IEEE-USA does 
not take a position on which governmental agency should be charged with 
overseeing the overall program envisioned by the legislation We do feel 
that NIST, if designated, and industry can work within the framework of 
a center for civilian homeland security technology evaluation as 
envisioned by the legislation to develop standards and protocols to 
serve as models for local disaster-recovery programs. The standards can 
not only enable optimal use of technology within a local environment, 
but can allow for sharing of resources to respond to a regional 
disaster.
    The infrastructure reliability advisory board as described in the 
legislation can work with the center to define best practices on how to 
make technology and communications infrastructure less vulnerable. This 
will enable the board to make recommendations on all aspects of 
deployment of emergency response and recovery of technological and 
communications systems.
    We urge caution in proceeding to establish the National Emergency 
Technology Response Teams. It is important to recognize that 
communication and other technological systems can be extremely 
complicated, requiring not only general knowledge of the technical 
factors but also specific knowledge of the system under stress. This 
may only be available in the company and its vendors that installed the 
system originally. Furthermore, if a local government has a sound 
disaster-recovery program, it may not be feasible, and could be 
counter-productive, to attempt to bring in teams that have not been 
integrated into the established program.
    One valuable service that the U.S. government can perform is to 
evaluate and critique local disaster-recovery programs. This could 
consist of plan review and test observation. The government has many 
agencies with expertise in this kind of service.
    In regard to S. 2182, the Cyber Security Research and Development 
Act, IEEE-USA has been a strong supporter of this legislation since the 
companion bill was introduced in the House of Representatives. There 
are many excellent provisions in this bill. I would like to highlight 
one in particular. The Chairman, and author of the legislation, has 
done a remarkable job in understanding the richness of our research 
enterprise and symbiotic relationships. Specifically, the bill includes 
research that will be conducted in universities, government and 
industry. Each of these institutions brings something important to the 
table when it comes to research.
    In addition, the bill recognizes the importance of training future 
professionals. While some of these folks will become cyber security 
researchers and professors, many will become cyber security 
practitioners. The purpose of research is not only to advance the state 
of the art, but also to ultimately advance its application in the 
marketplace. Only through all of the mechanisms in this bill will we be 
able to achieve both. In order to advance the state of the art and the 
state of the market, we need to advance the state of the science in 
cyber security. Systematic research is the way in which the cyber 
security profession can codify its lessons learned, develop its common 
language, and most importantly, advance the practice of cyber security.
    IEEE-USA is pleased to support S. 2182, which will pay dividends 
not only for protection against cyber terrorism, but also for commerce 
and personal privacy.
    Thank you very much.

    Senator Wyden. Mr. Logan.

 STATEMENT OF JEFFREY LOGAN, BUSINESS DEVELOPMENT MANAGER, M/A-
                  COM, INC., WIRELESS SYSTEMS

    Mr. Logan. Thank you, Chairman Wyden, Senator Allen, and 
other distinguished members of the Science, Technology, & Space 
Subcommittee. It is an honor to have this opportunity to appear 
before you today and assist your efforts in strengthening our 
nation's information infrastructure and improve our capability 
to respond and recover from terrorist attacks and other 
emergencies.
    I am Jeffrey Logan, business development manager for M/A-
COM Wireless, Incorporated. M/A-COM Wireless Systems is 
currently deploying fully interoperable statewide public safety 
radio systems in Pennsylvania and Florida. We have recently 
been selected to provide county communications systems in the 
Oakland County, Michigan, and city communications for San 
Antonio and Oklahoma City.
    Our company is a world leader in the development and global 
manufacture of radio components and network solutions for the 
wireless telecommunications industry. I appreciate this 
opportunity comment on S. 2037, the Science and Technology 
Emergency Mobilization Act, regarding recommendations for 
ensuring that emergency officials and first responders have 
access to effective and reliable wireless communications 
capability, and the establishment of state pilot projects aimed 
at achieving interoperability for emergency preparedness.
    One of the key concerns for first responders is 
interoperability. Lack of interoperability occurs when public 
safety personnel respond to the same emergency but cannot 
communicate with each other because they have an incompatible 
radio system, or they are on different frequencies. Lack of 
interoperability wastes time, wastes effort, and it can risk 
lives. Safety of life and property can only be assured when 
public safety agencies can easily communicate with each other. 
All too often the different systems they use would preclude 
them from communicating at all.
    Agencies must have high-quality communications at their 
disposal to ensure effective and timely coordination during a 
disaster. Recent high profile incidents, coupled with the 
events of September 11, have drawn into sharp focus the need 
for voice radio interoperability. Interoperability is both a 
technology and management challenge. S. 2037 should include 
consideration of training, organization, coverage, funding, 
frequency availability, and incident coordination.
    It is our recommendation that state pilot projects should 
include both technical and nontechnical considerations, as well 
as new approaches to policy in the development of interoperable 
solutions. A number of states have already made significant 
headway toward interoperability. The establishment of state 
pilot programs should build on many of the innovative 
communication technology advances already achieved in states 
such as Pennsylvania, Maryland, and Florida.
    What is the best way to achieve interoperability for our 
nation's first responders? One solution would be to require 
state and local government to replace today's fully functioning 
radios and infrastructure with new equipment that would be 
based on a single standard. FEMA has estimated the cost to 
pursue this course to replace all our nation's public safety 
radios to be in excess of $40 billion. Creating a single radio 
system standard does not necessarily solve interoperability. 
Several operational issues, including sufficient communications 
spectrum and channel management, would still be needed to be 
resolved.
    We do agree, Dr. Hoffman, however, that standards should be 
encouraged, particularly in the area of networking standards, 
such as established Ethernet and TCIP protocols. An alternate 
approach, we feel the best approach to our interoperability is 
to connect existing systems into regional, statewide, and 
national systems which would provide multiagency 
interoperability without requiring different agencies to 
purchase new radio equipment. This could be done for a fraction 
of the cost.
    Interconnecting or networking existing systems is the 
quickest and most cost-effective way to deploy. This is because 
the network supports all existing radio infrastructure, 
allowing agencies to use radios, repeaters, and frequencies 
already in place. We think this makes sense in order to 
optimize the President's $1.3 billion first responder 
interoperability budget, leveraging this money to as many 
communities as possible.
    A good example of pioneering interoperability is underway 
right now in a statewide system in Pennsylvania. In 1995, 
Governor Tom Ridge and Lieutenant Governor Mark Schweiker came 
into office. They inherited an antiquated radio system. The 
existing network was more than 20 years old, and becoming 
impossible to maintain. In fact, it really was a patchwork of 
several incompatible systems. As a result, Governor Ridge has 
replaced this with a fully interoperability statewide 
communications system.
    In conclusion, I would like to commend to the Members of 
the Subcommittee for their legislative efforts to enhance the 
security of the nation's infrastructure and our ability to 
respond to national emergencies. Lack of communications 
interoperability is not a new condition. We have two ways to 
address interoperability. One solution would be to replace 
today's fully functional radios and infrastructure with a cost-
prohibitive solution. A second and alternate approach would be 
to connect existing systems in a way that we could leverage 
fully functional systems to our benefit.
    Thank you for the opportunity to appear before you today. I 
would be pleased to answer any questions you may have.
    [The prepared statement of Mr. Logan follows:]

  Prepared Statement of Jeffrey Logan, Business Development Manager, 
                    M/A-COM, Inc., Wireless Systems

    Thank you, Chairman Wyden, Senator Allen, and other distinguished 
Members of the Science, Technology, and Space Subcommittee. It is an 
honor to have this opportunity to appear before you today and to assist 
in your efforts to strengthen our nation's information infrastructure 
and improve our capability to respond and recover from terrorist 
attacks and other emergencies.
    I am Jeffrey M. Logan, Business Development Manager for M/A-COM 
Wireless Systems Inc. M/A-COM Wireless Systems is currently deploying 
fully interoperable statewide public safety radio systems in 
Pennsylvania and Florida. We have also recently been selected to 
provide county communications systems for Oakland County Michigan, and 
city communications for San Antonio and Oklahoma City. Our company is a 
world leader in the development and global manufacture of radio 
components and network solutions for the wireless telecommunications 
industry. Additionally, M/A-COM Wireless Systems is supported as a 
wholly owned unit of Tyco International, the world's largest 
manufacturer and servicer of electrical and electronic components.
    I appreciate this opportunity to comment on S. 2037, the Science 
and Technology Emergency Mobilization Act, regarding recommendations 
for ensuring that emergency officials and first responders have access 
to effective and reliable wireless communications capabilities and the 
establishment of state pilot projects aimed at achieving 
interoperability for emergency preparedness agencies.
The Pursuit of Interoperability
    One of the key concerns for the first responders (police, fire, 
EMS) is interoperability. Lack of interoperability occurs when public 
safety personnel respond to the same emergency but cannot communicate 
with each other because they operate on incompatible radio systems or 
on different frequency bands. Lack of interoperability wastes time, 
wastes effort, and can risk lives. Safety of life and property can only 
be assured when public safety agencies can easily communicate with one 
another. All too often, the different systems they use preclude them 
from communicating at all. Agencies must have high-quality, 
interoperable communications at their disposal to ensure effective and 
timely coordination of disaster responses. Recent high-profile 
incidents, coupled with the events of September 11, have drawn into 
sharp focus the need for voice radio interoperability both for routine 
day-to-day use and during emergencies.
    ``So poor were communications that on one side of the trade center 
complex, in the city's emergency management headquarters, a city 
engineer warned officials that the towers were at risk of ``near 
imminent collapse,'' but those he told could not reach the highest-
ranking fire chief by radio. Instead, a messenger was sent across 
acres, dodging flaming debris and falling bodies, to deliver this 
assessment in person. He arrived with the news less than a minute 
before the first tower fell.'' \1\
---------------------------------------------------------------------------
    \1\ Jim Dwyer and Kevin Flynn ``Before the Towers Fell, Fire Dept. 
Fought Chaos'' The New York Times, January 30, 2002, pp. 1.
---------------------------------------------------------------------------
Achieving Interoperability
    Interoperability is both a technology and a management challenge. 
Consideration should include training, organization, coverage, funding, 
frequency availability and incident coordination. It is our 
recommendations that state pilot projects should include both technical 
and non-technical considerations, as well as new approaches to policy, 
in the development of interoperability solutions. A number of states 
have already made significant headway toward interoperability. The 
establishment of state pilot programs should build on many of the 
innovative communication technology advances already achieved in states 
such as Pennsylvania, Maryland and Florida.

What is the best way to achieve interoperability for our nations First 
        Responders?
    One solution would be to require state and local governments to 
replace today's fully functional radios and infrastructure with new 
equipment that would be based on a single radio system standard. FEMA 
has estimated the cost to pursue this course to replace all our 
nation's public safety radio systems to be in excess of $40 billion. 
Creating a single radio system standard does not necessarily solve 
interoperability. Several operational issues including sufficient 
communications spectrum and channel management would still be needed to 
be resolved. However, networking standards such as established Ethernet 
and TCIP protocols should be leveraged to enable network-to-network 
communications and voice over IP applications. An alternate approach to 
interoperability is to interconnect existing systems into regional, 
statewide or national systems, which would provide multi-agency 
interoperability without requiring different agencies to purchase new 
radio equipment--for a fraction of the cost to replace all in-service 
radio systems. Interconnecting or networking existing systems is the 
quickest and most cost effective to deploy. This is because the network 
supports all existing radio infrastructure, allowing agencies to use 
radios, repeaters and frequency allocations that are already in place. 
We think this makes sense in order to optimize the President's proposed 
$1.3 billion first responder interoperability budget to as many 
communities as possible.

Best Practices
    A good example of pioneering interoperability is underway right now 
on a statewide system in Pennsylvania. Back in 1995, when Governor Tom 
Ridge and Lt. Governor Mark Schweiker came to office, they inherited an 
antiquated radio system. The existing radio network was more than 20 
years old and was becoming impossible to maintain. In fact, it really 
was a patchwork of several incompatible networks serving 23 state 
agencies. Former Governor Ridge recognized that the outmoded, stand-
alone radio systems limited communications between state agencies and 
local government, particularly during emergencies. It also squandered 
opportunities for cost savings through shared equipment purchases and 
mutual aid agreements.
    As a result, in 1996, Governor Ridge launched a multi-year project 
to modernize and unify state agencies' two-way radio systems. M/A-COM 
was selected to provide the radio equipment for the project utilizing 
IP network technology.
    This year, when the new system is fully deployed, it will tie 
Commonwealth agencies and participating local governments into a 
single, more reliable, high-capacity radio network. A key advantage of 
the new radio network is that state and local government will be able 
to communicate with each other through voice over IP networking 
technology. Additionally, system elements, such as radio towers and 
transmitters, will be shared across state agencies, thereby holding 
down costs. Most importantly, the new system will greatly enhance first 
responders' ability to respond to emergencies quickly and in a 
coordinated manner. In fact, Pennsylvania's new radio network, 
completed under Governor Mark Schweiker, will be the first truly 
interoperable statewide voice and data public safety radio system in 
the entire country.

Conclusion
    In summary, I commend the Members of the Subcommittee for their 
legislative efforts to enhance the security of our nation's 
infrastructure and our ability to respond to national emergencies. Lack 
of communications interoperability is not a new condition. We have two 
ways to address lack of interoperability. One solution would be to 
replace today's fully functional radios and infrastructure with new 
equipment at a prohibitive cost and years of deployment. An alternate 
approach is to connect existing systems together using voice over IP 
networking technology, immediately and affordably. M/A-COM Wireless 
Systems, Inc. stands ready to support government research and 
development in this area.
    Thank you for the opportunity to appear before you today. I would 
be pleased to answer any questions you might have.

    Senator Wyden. Thank you, Mr. Logan. Let me start with you, 
if I could, Dr. Strawn. Some of the information security 
experts today are painting a bleak picture. They paint a dire 
picture of the current state of the discipline. They say there 
are only about 100 professors. There are only a few centers. 
There are only a handful of Ph.D's in information sciences, and 
suffice it to say, this is what the Congress is seeking to 
address.
    Now, you discuss the need for more researchers in the area 
of course in your testimony. S. 2182 addresses the problem by 
increasing the investments in research and training generally. 
This relates to information security. In your view, how long 
would it take, with this legislation, to start seeing some 
tangible improvements in these numbers?
    Dr. Strawn. I think several years would show some pretty 
good progress. We have the experience of this first year of our 
Trusted Computer program, small as it is, which did show that 
the professoriate in computer science responded to turn its 
attention increasingly to this area, and so I think additional 
support and focus can be a very valuable way of building up the 
size of the professoriate and the size of the student body that 
will attack these problems.
    Senator Wyden. And how long do you think it will take 
before our country sees tangible improvements in the research 
that is undertaken in the information security field? There are 
two things we have to do here. We have to deal with the 
shortage of professors, and we have to beef up the research 
that is undertaken in the field. Tell me about tangible 
improvements.
    Dr. Strawn. I think there are opportunities both for short-
term research benefits and for the long-term research benefits. 
As the words express, of course, it will take longer for the 
long-term understanding to filter into technologies and 
services that I think will ultimately provide the best 
solutions, but I think we have observed that already there are 
developments in the private sector and by the professoriate 
some very good steps, intermediate steps, let us say, to 
improve our security; and solutions range all the way from 
broader education to train new work force members to putting 
into place services and security products and processes that we 
already know about but have not had as much success getting 
into broad use as we would like.
    In a certain sense, that requires a certain amount of 
social science research as well to understand better how we can 
put what we know into practice more quickly.
    Senator Wyden. Tell me what you believe to be the most 
important areas that warrant further research and examination, 
and why. Take two or three, for example, of the areas that you 
think are the most important from the standpoint of research 
and information security, tell me what those areas are, and 
why.
    Dr. Strawn. I will do that with the caveat that NSF's 
approach usually is to ask the research professors who we work 
with what are the most promising areas they find, and then when 
their peers are able to look at those proposals and tell us 
that these are the really promising areas, then we feel very 
comfortable that, having the smartest friends in the world, we 
know what we are talking about.
    Some of the things we have already been told and that I 
certainly agree with is the importance of looking at the whole 
picture. As I said before, secure components do not a secure 
system make; and science has very frequently progressed in 
great ways by dividing and conquering, looking at small 
portions of a subject and knowing more and more about it.
    Security is really a different sort of a beast, in that we 
must keep a system focus. We must develop the science of the 
whole system in order to make sure that secure systems will 
result from secure components, and so I think that is probably 
one of the most important technical areas.
    I think a second is the interdisciplinary problem of 
finding how we can more rapidly introduce advances once we have 
made them: enabling our organizations to accept beneficial 
changes more rapidly. We have been working with our social 
scientists quite a bit in the last several years looking at 
these types of interdisciplinary problems. I think in the short 
term that could be a very valuable step.
    Senator Wyden. Any other areas?
    Dr. Strawn. Those are the first two that come to mind.
    Senator Wyden. Dr. Hoffman, do you want to try that one, 
too? What are the most important areas, in your view, for 
information security research? Give me, if you would, two or 
three, and tell me why you think that is the case.
    Dr. Hoffman. Well, you are asking a tough question when you 
say limit it to two or three, but I will attempt to limit it to 
two or three.
    I would agree that absolutely the most important is to have 
a big picture, and to look at interdisciplinary research, 
because when you are dealing with computer security you are 
tying together disciplines of computer science, electrical 
engineering, management, forensics, law, and various practices, 
and all sorts of other things, so it is not only a 
technological solution. Computer security involves a lot of 
areas, and they are not only technological, so the 
interdisciplinary part, including public acceptance, including 
market acceptance, is very important, so that is one, okay.
    You said two or three. I will give you two others. 
Architecture. I think we have been using the same computer 
architecture effectively linked together in networks, for about 
50 or 60 years. There may be other architectures that could be 
looked at that could help protect--separate data from programs 
in a way that would very much enhance security, so computer 
architecture is another area.
    Finally, as I mentioned in my testimony, wireless. In the 
not-too-distant future we are going to have very many more 
wireless devices than we do now, and, as usual, utility is 
going to trump security the way we are going now. 
Unfortunately, this is going to lead to some security problems, 
unless we really get a handle on the existing wireless 
situation and deal with it whether it is in the wireless 
devices or in network protocols, or whatever.
    Senator Wyden. So what do you think the wireless issues 
are?
    Dr. Hoffman. What do I think the wireless issues are? There 
are a bunch of them. For one thing, the existing protocols have 
been shown to be not sufficient for security. In addition, when 
they are connected together you have all sorts of applications 
that are going to be developed using wireless. Take one 
example, intelligent vehicle systems. If people are driving 
along or being transported along in squadrons of intelligent 
vehicles, and the vehicles are communicating with each other, 
they have to be authenticated, authorized, and at the same time 
there are privacy issues involved as well. That is just one 
example.
    Senator Wyden. Let us return, then, to you Dr. Strawn, and 
compare, if you would, the cyber security program that you have 
now against S. 2182. The program that you have now, research 
includes a scholarship for service program that provides 
scholarships to undergraduates and graduate students that study 
computer security. Then they have to serve the federal 
government, obviously, for a couple of years. What do you see 
as the big differences between your current program, the 
scholarship for service program, and what is envisaged in the 
Senate and House bills?
    Dr. Strawn. I would say that what we are doing now has some 
great similarities to what is proposed in the bills, and the 
major difference is scope and size. The work that we are doing, 
as I mentioned in my testimony, is on the order of $10 million 
a year investment, and I observe that the bills propose roughly 
an order of magnitude increase.
    Senator Wyden. Tell me what you think the lessons are with 
respect to what science and technology can do in emergency 
response and homeland security after September 11. I mean, my 
sense, and what has really drawn me into this cause, is that 
there is a chance to mobilize a generation, a generation that 
was raised on digital technologies that wants to contribute, 
wants to help. We have been struck by how many companies and 
individuals are willing to come forward and say, as long as the 
government does not waste my time, I am going to pitch-in.
    People from Intel, for example, do not want to spend a lot 
of time standing around, and unfortunately, in the effort to 
respond on September 11, some of those private sector efforts 
were wasted. So, one of the lessons I have learned from 
September 11 is that I think there is a chance to mobilize a 
huge number of people with expertise in IT and expertise in 
various scientific areas, and harness that energy and talent 
and bring it to bear. But, I would like to have you tell me 
what you think the lessons with respect to the role of 
government can play now in science and technology policy to 
both prevent and respond to the kinds of problems we faced on 
September 11.
    Dr. Strawn. First of all, I agree with everything you have 
said in terms of some lessons to be taken away from it, that we 
have had a terrible wake-up call, and it focused the energies 
of the nation in a way that we now must turn to positive 
results.
    One of the areas, as I mentioned previously, that we are 
concerned about is that not enough faculty have been 
specializing in security research. I think this situation has 
produced in students and faculty alike more of a focus on the 
importance of cyber security, and if we can respond properly to 
that increased interest, it will be much to our benefit to do 
so.
    I would also mention in support of Professor Hoffman's 
comment about computer architecture, and as mentioned in my 
written testimony, computer security was an add-on to the 
original design of information processing systems. We weren't 
thinking as much about that in the early fifties as we are now, 
50 years later, and many of our researchers have suggested that 
a great, fundamental research opportunity would be to go back 
and rethink the fundamental design of information processing 
systems with security as a design criterion and requirement, 
rather than a later add-on to be patched on the side.
    Senator Wyden. That is what you would call a big lesson. 
That will be a big exercise, but I think you are right. I think 
that is really something that the government ought to be 
researching, and I think that is a thoughtful answer. Why do we 
not just go down the panel at this point, and I would be 
interested--we can start with you, Dr. Hoffman, then go to 
Wyatt, but tell us, if you would, what you think the experience 
of September 11 says in terms of lessons for science and 
technology policy as we try to both respond and prevent these 
terrorism problems.
    Dr. Hoffman. Well, one thing it indicated to me was the 
importance of thinking ahead, and the importance of then acting 
on the lessons. To give you one example, we routinely teach 
exercises, and the George Washington University has about seven 
courses in the Computer Science Department, and another seven 
or eight in the Engineering Management and Systems Engineering 
department dealing with computer security information 
assurance, and related topics.
    Many of these courses deal with vulnerability assessment, 
and we do scenarios. We actually run--one of my favorites is 
one developed by the Rand Corporation called The Day After, 
where you basically sit up a situation, say, 2 years hence, in 
2004. You say, here is the situation on the ground. One bad 
thing happens, another bad thing happens, and you expose 
students to this, and in essence they cannot deal with it. It 
is sort of a classic in-box exercise, although worse, and then 
they go back to 2002, to today, and say, okay, what should we 
do now, and that is in essence what you are doing.
    I think the most important thing learned is, if we had been 
able to more put into effect those actions which we had dealt 
with in the classroom in real life on September 11, then 
September 12 we would have been much better off, so just 
getting people to think that way is the first step, and then 
getting action plans developed is the next one.
    Senator Wyden. Mr. Starnes.
    Mr. Starnes. Yes, Mr. Chairman. I think there are a number 
of issues that came as a result of learning from September 11. 
Speaking to the positive side of technology for a moment, there 
were many systems, Internet systems, wireless systems that were 
still operable and played a very important role throughout the 
unfolding of September 11, even with that as a factor.
    Senator Wyden. I think it is striking none of the satellite 
systems had problems. All of the satellite systems worked.
    Mr. Starnes. And a fair amount of interconnect was still in 
place, and for a while the only communication some people had 
was via the electronic non-analog infrastructure, which I think 
is striking. There were also major vulnerability points, major 
hubs of connectivity that even though we thought they were 
redundant hubs, we did not plan for the magnitude of the damage 
that was done.
    But speaking to the broader issue of the short-term issues, 
long-term issues, I am coming at this from a commercial angle, 
which is a slightly different angle than my colleagues on the 
academic side. The way we see spending in cyber security, it is 
sort of the spray paint, the moving car problem. In other 
words, we are trying to get to a destination, and we are trying 
to get their fast, but we have got to get paint on the car 
along the way. In other words, we have to protect ourselves 
while we are getting there, so we really need to divide our 
thinking into two areas.
    We have some short-term issues we need to deal with, and 
there are evolving technologies in the form of data integrity 
assurance and intrusion detection and other technologies that 
play a valuable role. At the same time, we need to develop a 
longer-term view of how technology should be constructed in a 
world where we have the bigger security issues now than we 
anticipated when the original designs were done, as Dr. Strawn 
said, many years ago.
    So I think we have to move in parallel. We have to give 
money to government, to commercial industry to protect 
themselves now. At the same time, we feed money to universities 
to begin to reverse the course of the attrition we have seen in 
the cyber research and cyber security arena, and I think both 
of those paths have to be moved on in parallel.
    Senator Wyden. Mr. Hira.
    Mr. Hira. Mr. Chairman, I think the major thing that came 
to my mind was really the vulnerability, but also the human 
dimensions that are involved in technology and how dependent 
that we have, really the average person has become on 
technology, and the fact that we open the cell phone and we 
expect it to work, and so I really think that the major lesson 
there was that the systems were not designed for this kind of 
event in mind, and we have to rethink the way we design these 
products so that we accommodate new criteria. It has really 
changed the criteria to which we have to design these products.
    Senator Wyden. Mr. Logan.
    Mr. Logan. Mr. Chairman, I believe--three major areas of 
lessons learned with regard to wireless. We are also a private 
company, and certainly recognize the President's budget that is 
being proposed for first responders, as many private companies 
do, but we also recognize there is a lot of competition for 
that money, and we have to be very smart in how we apply those 
funds to curing the problems.
    With regard to interoperability, we could certainly apply 
money in a way that would maybe have new equipment, but the 
equipment in the end still could not talk to each other. We 
need to consider how we can interconnect our existing 
infrastructures in a way that people can communicate. We have 
to look very hard at training and invest in training, because 
when these events happen, as all the first responders' reports 
have said, training, and preparation upfront, the technology 
alone will not provide the answer. It has to work in concert 
with the technology.
    I guess the third item would be where we have various first 
responders showing up to an event, trying to communicate with 
each other, not having the ability to have coverage, so I think 
as we look at this bill, as we can apply moneys to providing 
mobile coverage, bringing communication to the site and the 
scene of an incident would go a long way in solving future 
problems.
    Senator Wyden. Very good points, and we are struck by what 
both you and Mr. Hira have talked about, the human dimension of 
all of this. I think our hearing where we heard from the head 
of the fire fighting effort at the Pentagon, and we had people 
hand-carrying messages in to firemen, little snippets of paper, 
hand-carrying them in. I am glad you two brought it back to 
people, because it is important, and wireless can make a real 
difference in that area.
    Let me, if I might, turn to this question of how we are 
going to mobilize the volunteers, and Dr. Strawn, you are 
welcome to participate in this as well. You have heard me 
comment on this, that the Administration is being very helpful 
in terms of working with us. It has not fully developed a 
position, but you are welcome nonetheless to offer your ideas 
and thoughts here on the strategic technology reserve. I will 
initially direct this to Dr. Hoffman and Mr. Starnes.
    What we want to do is say, ``Look, in this country we have 
got a strategic petroleum reserve, so that when there is a 
crunch with respect to energy, we are in a position to address 
that.'' What I envisage is something along the lines of a 
strategic technology reserve, so all across this country, when 
faced with bioterrorism efforts or other sorts of dire kinds of 
threats and problems, it is possible to mobilize people and 
equipment fairly readily, and some of this does not strike me 
as particularly hard and cumbersome to do.
    For example, we were struck how in most communities, for 
example, there is not even a list of people who would have some 
expertise in these various health agencies. Say that a 
community, say Portland, or another community, was hit by a 
bioterrorism agent. It ought to be possible to fairly quickly 
turn to a list of medical experts and others that you could 
call on for help. What we would like to do is develop that kind 
of data base of volunteers and experts, and virtually everyone 
we have talked to in terms of municipalities, first responders 
and others, said absolutely we think it would be very useful to 
have that on hand, and this would involve a pretty modest role 
for government.
    This is essentially making sure that you have this group 
available when you face these kinds of calamities. I think the 
points that you are making with respect to authentication and 
security mechanisms and making sure the data base is not 
misused or, as you said, Mr. Starnes, taken over by people with 
malevolent intentions--I want to make it clear, I think that is 
significant.
    I think it is important, but I assume, just so we are clear 
for the record, you two do not think those kinds of issues are 
insurmountable. What you think is they are issues that Congress 
has got to get right. Congress has got to work with the private 
sector in order to get them right, but you certainly do not see 
this as creating some kind of insurmountable burden that would 
keep us from having a data base of technology and expertise and 
equipment around the country, do you?
    Mr. Starnes. Mr. Chairman, I will take that first. 
Absolutely not. One of the things we definitely were struck 
with post 9/11 is the amazing spirit and patriotism of the 
American people, as well as their just creativity and drive, 
and really that is the response that motivated both private and 
local government sectors within our State of Oregon to get 
together and see if we could organize better and prepare better 
in advance, and it was striking to us on the organizing 
Committee how poorly prepared we really are in terms of, as you 
point out, even knowing who to go to in the case of a potential 
cyber terrorism issue, and what the resources are.
    So the first set of procedures we are going through is 
essentially inventorying our intellectual skills within the 
state, and the next part of that exercise will be determining 
how we catalyze those and how we interconnect those in a useful 
and effective fashion. Absolutely these problems can be taken 
care of over the long haul.
    I do believe that private industry needs to be heavily 
involved in that process. We need to think about issues of data 
base redundancy and network vulnerabilities and so on to make 
sure that we plan and build the network that has to support the 
people involved in advance, and contemplating a number of the 
different threats that might be present.
    Senator Wyden. Dr. Hoffman.
    Dr. Hoffman. Mr. Chairman, I agree with everything Mr. 
Starnes has said. I agree that it is not an insurmountable 
problem. I also want to point out that we will never solve the 
problem perfectly, but if we can get a solution that is 90 
percent further along than where we are today, I think we would 
have made obviously great progress.
    One thing that is important to realize--I take some of this 
from my experience serving in my local town where I reside, in 
Chevy Chase, Maryland, yet we had a committee for Y2K, which I 
served on, and just knowing the local resources and going up to 
the county level and so forth on up is very important.
    So I think rather than having one grand system defined, 
this might be an excellent opportunity to have a number of 
local systems deployed, tried out, tried out in the laboratory 
of the states or even at a lower level of government, and keep 
the communication system flowing between all the levels of 
government and the private sector, that would be, I think, a 
better way to architect it than put all of your eggs in one 
basket.
    Senator Wyden. I think those are thoughtful points. We are 
going to work with you, because I think you are right. You 
cannot come up with any ideal kind of approach that ensures 
that you never have a bug anywhere at any time, but I really do 
see a strategic technology reserve as an insurance policy for 
this country. Given how many people have said they would help, 
major companies in this country have said, ``Look, we will get 
people and equipment when the country's national security 
interest and well-being are affected by these terrorist 
attacks.'' It just seems a shame to not try to address some of 
these issues I advance and not just have all these well-meaning 
people basically in a position of heading to some disaster site 
and kind of standing around. That is what some have told us 
happened in New York, and it is not because New York did a 
crummy job. Quite the opposite. New York City did a terrific 
job. How they accomplished so much so quickly is an 
extraordinary success story.
    What else could have been done is what I think we want to 
look at, and of course, most communities are not in a position 
to have the resources you had in New York City. We are going to 
work very closely with you to iron out these questions of 
authentication and privacy and making sure you do not have a 
system that gets hijacked by the very people you are trying to 
deal with in terms of the overall effort.
    It was interesting you mentioned Y2K, Dr. Hoffman, because 
that was an area we wanted to look at, and maybe we can bring 
you back into this.
    Dr. Strawn, I was very involved in the Y2K efforts that 
this Committee tackled under the leadership of Chairman 
Hollings and Senator McCain, and obviously, a lot of those paid 
off. That concerted effort to have people working together and 
preparing for a wide variety of potential threats to this 
country paid big dividends. I would be curious if this panel 
thinks there were any parallels to be drawn or any lessons 
between the Y2K effort and what we are doing now to try to 
improve cyber security.
    Dr. Strawn. I would be happy to take a crack at that. I had 
the good fortune of also being involved in the Y2K efforts at 
NSF. I had an interesting assignment. NSF undertook, as part of 
its public knowledge and public education of science tasks, to 
run a series of surveys, polls of the public to find out what 
their knowledge was and what their concerns were about the Y2K 
issue as it went forward; I had the good fortune of serving as 
NSF's spokesperson during that time on that subject.
    We observed that, number one, as Y2K approached, it focused 
the attention and the efforts of the country very greatly 
toward solving the problem. Number two, the more information 
that was made available to the public and the more they 
understood what was going on, the less concern they had, and 
the more they understood what was happening, and that was a 
general, very good benefit of education.
    If I may add one other subject relating to a government 
analog of the volunteerism that you were discussing a moment 
ago. I observed that since September 11, there has been a very 
vital and vigorous interaction between the defense community 
and the civilian research community, we are working together to 
make sure that research results that have been developed in 
universities and the civilian sector are available to the 
defense and security activities that need advanced research and 
development. That is not quite volunteerism, but it has the 
same very beneficial effects of propelling these advances 
forward.
    Senator Wyden. Other panel members, parallels between Y2K 
and what we are trying to do here?
    Mr. Starnes. I think that is a very interesting and 
relevant question. One of the advantages of the Y2K issue is 
that we had a specific and imminent date to work toward, and in 
the few years ahead of Y2K--the industry estimates range a bit 
on this, but the upward estimates are that there was almost 
$300 billion spent on Y2K preparedness.
    I think it is very interesting to sort of compare that with 
the industry spending for security technologies in the last 3 
years, the composite industry spending, which has been about, 
somewhat under $20 billion, so on a single incident, that was a 
very known and measured incident as an industry, as a country 
we spent almost $300 billion, and cumulatively over the last 3 
years we have spent about $20 billion, so I think that really 
points to a gap, still, in the way we need to look at funding 
these really important vulnerabilities that we have.
    Senator Wyden. Okay. Let's move back to the topic, if we 
could, of the strategic technology reserve. Mr. Hira, I would 
like to ask you a question, because, of course, your 
organization represents a large number of technology experts, 
and I think it would be helpful to get your sense of whether 
there would be a lot of those individuals and companies that 
would be willing to volunteer.
    My sense is that they are looking for a chance to help and 
participate, and in a situation like this say, if there is a 
problem in my area, or a problem in my region of the country, 
we are anxious to be there. We will volunteer; we are sending 
our name and saying we want to participate in something like 
the strategic technology reserve. What is your sense about 
whether the people you work with would say if their expertise 
is needed emergency officials could know where to find them?
    Mr. Hira. I am glad you asked that question, actually, 
because we are a volunteer-driven organization. We do not have 
industrial membership. Our membership is as individuals. We are 
structured along a couple of different dimensions, but the two 
important dimensions that are relevant to this are, one, based 
on your technical expertise, or your subdiscipline. So, for 
example, my area is control systems. Somebody else's is 
antennas and propagation, and so on and so forth, and so there 
is a technology and technical dimension, but we are also 
organized geographically via regions and sections.
    I do not see any reason why something like this could not 
or should not appeal to many of our members that are out there.
    Senator Wyden. Let me turn now to the part of our 
legislation that calls for setting up a clearinghouse or test 
bed, and maybe we can hear from Mr. Starnes and Mr. Logan, I 
think both would be good for this question.
    What we are dealing with here is this: the federal 
government has received thousands and thousands of ideas and 
proposals to fund various technologies and products. In effect, 
it is a new deluge. Thousands of them have come from across the 
country, and what Senator Allen and I are trying to do is to 
make sure that we can perform a service for agencies, help them 
to identify new technologies, figure out if the proposed 
technologies can meet the specifications needed by the 
agencies.
    We do not want new mandates, picking winners and losers and 
all of this sort of thing, but I think we can begin this round, 
Mr. Starnes and Mr. Logan, with whether you think the current 
emergency response agencies are doing enough to harness the 
potential of new technological developments, and whether we 
need to do a better job of trying to be open to new 
technologies so that we can use all of this talent.
    Mr. Starnes. Mr. Chairman, I will take that one first.
    Clearly, I think we can be doing a better job. I think 
there are some wonderful agencies, certainly in the area of 
security awareness. CERT has done an admirable job for the 
amount of funding and support that they have received, but we 
are dealing with a really big issue here, and we really have 
not, as a nation, been under a coordinated attack. The attacks 
that we have seen that get headlines every other day are often 
15-year-olds in their basement, so it sort of creates a concern 
in our minds that we have a pretty big gap here, so certainly 
at Tripwire we have talked about this at a strategic level, and 
we are very supportive of, in fact pretty involved already with 
a number of governmental agencies in several different areas, 
certainly from more of a tactical standpoint in terms of 
providing them products and capabilities and services and so 
on, but also from a strategic standpoint there is some 
extremely good work going on between private industry and 
government around digital fingerprinting and understanding the 
security and stability of computer systems at a very 
fundamental level, and the National Drug Intelligence Agency 
and many other agencies have been positively involved in that.
    So we are starting to see the kind of activity that is 
moving, I think, the nation to a higher level of overall 
security, but it worries us that it is not moving as quickly as 
it probably could or should, and so we certainly welcome 
additional leadership from you and your bills in those areas.
    Senator Wyden. Mr. Logan, let us have you comment on this 
as well. You have got an innovative technology, a product out 
there that you are excited about, that you think makes sense. 
You have spent a lot of time toiling away on it, but you are 
not exactly sure where in government to bring it. What Senator 
Allen and I have said is, you could bring it to a clearinghouse 
within NIST. That would be where you would go, and the 
clearinghouse would basically share that information with an 
agency that expresses a need.
    Now, that is our sort of bipartisan thinking about how you 
could streamline this and build on something that we think 
would not involve a lot of red tape and bureaucracy. Do you by 
and large feel that is heading in the right direction?
    Mr. Logan. Yes, I do. In fact, our current process of 
trying to evaluate new technology standards, the mechanics of 
that would be a federal government, state government, local 
government. It can be very cumbersome and time-consuming only 
to, at the end, to make a decision or arrive at a certain 
standards level, and now the technology has passed us by.
    I believe that through a clearinghouse as you have 
suggested, that would give companies a chance to bring to the 
table innovative products, see how do they meet the needs of 
the users, today's needs of the users in a way that could help 
through enabling grantees to look to these various test beds, 
to say, well, it works for them, this is our need, our needs 
are aligned with the test beds, and to make that a part, to 
enable these grants--I mean, the big concern, obviously, with 
the user groups is, what are the mechanics associated with the 
grants that will be coming out, and so to the degree that we 
can show and demonstrate products and technologies that will 
enable first responders to better do their job, I think that is 
absolutely the way to go.
    Senator Wyden. Well, our hope is that taken together the 
test bed and the clearinghouse would really accelerate the 
adoption of new technology by government emergency and security 
agencies. Again, we would welcome your ideas on some of the 
specifics about how to address this, but I would hope that we 
could get agreement on those two areas, because I am struck by 
how many times private sector companies say, ``Look, I do not 
know where to turn.'' Clearly there is a governmental interest 
at a minimum in not buying outdated stuff, and making sure that 
when you are making these purchases, that you are buying in a 
cost-effective way for citizens and taxpayers.
    Just a couple of other areas, one for you, Mr. Logan, with 
respect to the wireless area, which we do think is especially 
important. Our hope is that the pilot program that we envisage 
would be a helpful start. Clearly, this is going to require 
some very significant expenditures.
    There are some exciting things going on around the country, 
as Mr. Starnes noted, where he is involved in some of them in 
the State of Oregon, in my home state, but our theory is that 
we could provide grants to states to at least pioneer some 
innovative efforts and communications interoperability, and 
these could be shared around the country. We see that as one 
way to at least make a start and jump-start the effort to come 
up with some good models. Are you comfortable that is headed in 
the right direction?
    Mr. Logan. Yes. I think that is a very good idea, 
especially working with States that may have already made 
significant advances in the area of interoperable technology, 
communications improvements. In fact, a thought we had was in 
working with these test beds, maybe creating a solution whereby 
we can not only demonstrate the technologies at that location, 
but put those technologies on the road in a mobile setting much 
like FEMA and others, first responders.
    Usually the event is not going to happen, maybe, right next 
door or where they think it is going to happen, but if we can 
develop through those test beds the ability to have those 
solutions mobile so we can bring them to various communities in 
other states, I think that could be very beneficial.
    Senator Wyden. Another area, last area that we were 
interested in that goes back to S. 2182, and maybe we can start 
with you, Dr. Strawn, is, I think the theory of this bill is to 
buildup what has been certainly heretofore an underdeveloped 
intellectual infrastructure in the cyber security field. Take 
your academic hat off for a moment, and give me your thoughts 
on what you think the practical effects of underinvestment, 
what is happening now, the current underinvestment in cyber 
security research and personnel would be.
    Dr. Strawn. I think underinvestment has put us in somewhat 
of a pickle already, and that the citizens of our country are 
right not to have trust in their computing and information 
technology systems.
    We do not have a high enough level of assurance that our 
systems are safe from being hijacked, are safe from being 
abused; and now computer hardware and computer software are 
going into almost all products and services that society uses 
these days. We just have to have a higher level of security and 
a higher level of reliability in these systems, and the public 
will have to remain doubtful until we take it to a higher 
level.
    Senator Wyden. Gentlemen, anybody else, practical effects 
of underinvestment?
    Dr. Hoffman. Following up on those earlier comments, I 
would only add that we have a system where the critical 
infrastructures are all connected, so in fact what affects 
computing does not only affect computing. Computing drives 
energy and water and a number of other infrastructures more and 
more, so if we do not have secure computing systems, we really 
do not have a secure infrastructure at all, and it just gets 
worse as a practical effect.
    Also, I would like to followup on one comment made a minute 
ago. When you talk about a test bed, I think it is important to 
realize--and I agree with the observation that these things can 
more and more be taken on the road, so you do not need a big 
lab with lots of rooms out at NIST or somewhere else. The 
people nowadays come and ask at the university, they say, let 
us see your lab, and I say, well, where do you want me to bring 
it, because often for many systems three laptops and a good 
mobile wireless network is all you need to demonstrate 
something, and you have much more of an effect when it is there 
in the right place.
    Senator Wyden. I think that is a very good point. I was 
concerned initially when we started talking about the strategic 
technology reserve people would think about some gigantic 
building, and there you would store all of these laptops, and 
they would just be getting dusty and the like, and then you 
would have your test bed, which would be a similar sort of 
building hooked up to all kinds of jumper cables and 
contraptions, and that would be supposed to be in charge of 
testing.
    I think you are absolutely right. What we are looking at is 
trying to use existing laboratories and others to the greatest 
extent possible, and we are going to take that counsel to 
heart. I am glad you made that point, because I think people 
are already starting to envisage how this would work, and it is 
helpful to have this kind of testimony on the record.
    Others on that, underinvestment?
    Mr. Starnes. I cannot resist that one. I think we are 
actually seeing first-hand the practical effect of 
underinvestment right now. Customers have been taught to buy 
based on features, and the number of colors on their screen and 
other issues, and have not really been taught to understand the 
issues of security and interconnectedness and various other 
important areas for infrastructure, so the commercial instincts 
kick in, which is a part of our democratic process, so somehow 
we have to find a balance, and sort of back to the issue of 
test bed clearinghouse again, which is a concept we certainly 
endorse.
    The key issue, a couple of the key issues that distinguish 
the commercial sector from the government sector is speed, so 
not only does the funding have to be allocated both in terms of 
internal budgets for agencies, but it has to be made available, 
and it has to be made available, as I said in my oral 
testimony, on a faster basis than we currently have the ability 
to do. That certainly does impact commercial entities, because 
commercial entities are forced to go out to the venture capital 
market, and when the venture capital market is strong, as it 
has been over the last few years, that was a viable option.
    The fact of the matter is now that the venture capital 
markets for the most part are weak, and so you are actually 
seeing a decline of commercial innovation, and government 
really has not stepped forward in our view to really deal with 
that yet.
    Senator Wyden. Well, I really do not have any questions in 
addition. You all have been excellent, and my hope is that 
these two bills can, in effect, provide a very solid response 
to what happened on September 11, and really constitute a new 
and more targeted effort by government to deal with cyber 
security issues and the threats that were presented on 
September 11.
    It seems to me with the cyber security legislation that 
passed the House, we have got a chance to make a very effective 
and well-targeted investment in NIST and the National Science 
Foundation, and ensuring that we are training tomorrow's 
leaders. That is essentially what that legislation is all 
about.
    I support it strongly, and the Administration's efforts in 
that area with respect to S. 2037. I think what we would like 
to say is that while government clearly can make a very 
significant difference, it would just be a tragedy not to 
harness and mobilize all of this energy and talent in the 
private sector that wants to help and pitch-in and make a 
difference. I am convinced that over the next month, working 
closely with the Administration, and with all of you in the 
private sector, we can move this forward.
    There are not many months left in this session of Congress, 
and I think it would be a real shame to go home without passing 
these two bills, bills that are going to allow us to maximize 
an effective role of tax dollars, particularly in education and 
research, and a small amount of additional government money 
basically to ensure that the volunteers and people in science 
and IT who want to help can have a chance to do so and make a 
difference.
    So, if there is nothing that any of you would like to add 
further, we will adjourn, but I can give each of you the last 
crack. Anything that our panel would like to add?
    [No response.]
    Senator Wyden. All right. We are adjourned.
    [Whereupon, at 4:15 p.m., the Subcommittee adjourned.]
                                APPENDIX

    Prepared Statement of James W. Graham, Chief Operating Officer, 
                   Emergency Asset Management Systems

    Mr. Chairman, Members of the Committee, thank you for this 
opportunity to submit testimony in support of S. 2037, the Science and 
Technology Emergency Mobilization Act.
    My name is James W. Graham, Chief Operating Officer of Emergency 
Asset Management System, a division of GBUCS, LLC. GBUCS is a Chicago-
based developer of web-based software solutions for private industry 
and government, specializing in asset management systems.
    I am here today to express our strong support for S. 2037.
    Overseas, our Armed Forces are unbeatable not only because of their 
training, patriotism and bravery, but also because they are equipped 
with unsurpassed technological superiority. Here on the home front--
where terrorism must be fought and the safety of our communities and 
workplaces ensured--we too must equip ourselves with unsurpassed 
homeland security technology.
    In recent months, our company has dedicated itself to learning 
about the technology needs of emergency managers nationwide. Based on 
our experience I must report to you that there are serious and 
substantial shortcomings in the technologies now utilized by emergency 
management agencies. Much has been said about the need to make 
communications systems between emergency response agencies 
interoperable. Technology needs on the home front do not stop there.
    Emergency managers at every level of government in this country are 
certified and dedicated professionals who typically graduate to their 
important positions after gaining experience in the military, on police 
forces and as firefighters. These federal, state and local agencies 
play a critical role in responding to terrorist attacks. They 
coordinate and mobilize all available regional, state and federal 
assets in times of disaster. These include police, fire, National 
Guard, hazardous materials units, public health and infectious disease 
professionals, volunteers, donors and many others. Little noticed when 
there is no emergency, these emergency response professionals took on 
critical importance when terrorists struck Oklahoma City, New York, 
Washington and elsewhere. They will play such roles again, and we must 
equip them with the best tools and technologies available.
    Seven months after September 11, 2001, many of these emergency 
managers remain under funded, understaffed and unequipped with the 
technology they need. State government budgets took a direct hit when 
the economy crashed, and as much as state legislators and governors 
wish to invest in homeland security, they often lack the means to do 
so.
    To illustrate one of the gaps we discovered, consider that 
emergency management agencies make little or no use of Internet 
technologies even though their central function is to gather critical 
information in emergencies and communicate instructions to needed 
emergency responders. In other words, although information management 
and communications is central to their role, they make almost no use of 
the Internet, the greatest information and communications invention of 
the past century.
    In several disasters of the past decade, people by the thousands 
who wanted to volunteer had to try to get through on the phone; there 
were no web sites to visit with instructions and information gathering 
capabilities. On September 11th, 15,000 unsolicited volunteers showed 
up in Manhattan, forcing authorities to help feed and shelter them. In 
other disasters, people who wanted to donate filled truckloads and even 
jumbo jets with unneeded goods, leaving emergency responders with the 
added burden of sorting through or disposing of inappropriate 
donations. No web site told donors what was needed nor was the web used 
to facilitate the logistics of moving and warehousing donations. Public 
confidence in the official disaster response was thus undermined. No 
private business facing similar logistical challenges would think of 
doing so without Internet tools of some kind.
    A National Emergency Technology Guard would be an important and 
useful added force in guarding against terrorist attacks here at home. 
Technology professionals across the country will be willing to 
volunteer in an emergency. We ourselves volunteered and donated our own 
donations management software to the Manhattan Chamber of Commerce for 
use after September 11th. They have found it useful as they help 
businesses recover from that disaster.
    A Center for Civilian Homeland Security Technology Evaluation would 
help identify needs and solutions such as those I have pointed out here 
today.
    But state and local emergency managers need help now. If the 
federal government is to lend that helping hand, let there be money in 
the palm of that hand. Volunteer programs like a NET Guard and Citizen 
Corps can do great good, but they must be managed at the local and 
state level. That costs money and it requires logistical management 
tools they do not now have.
    In times like these, the states lack the financial might of the 
federal government. But the strength of our defense against domestic 
terrorism depends upon the might of state and local emergency managers. 
They need new technology to be effective, and they need financial 
backing to acquire those technologies.
    We support S. 2037, but we also call upon you to do more for those 
who are at the front line of terrorism defense at the state and local 
level. Thank you.
                                 ______
                                 
                                                      April 8, 2002
Hon. Ron Wyden,
Chairman,
Hon. George Allen,
Ranking Minority Member,
Senate Committee on Commerce, Science, and Transportation,
Subcommittee on Science, Technology, and Space,
Washington, DC.

Dear Chairman Wyden and Senator Allen:

    The National Association of Manufacturers (NAM) writes to support 
your new legislation, S. 2037, the Science and Technology Emergency 
Mobilization Act (or NETGuard bill). The NAM is the nation's largest 
industrial trade association and represents 14,000 members (including 
10,000 small and mid-sized companies) and 350 member associations 
serving manufacturers and employees in every industrial sector and all 
50 states.
    Homeland security is an area of significant new endeavor for the 
NAM in 2002. Governor Ridge, General Magaw and Representative Chambliss 
have addressed NAM audiences, including the NAM Board of Directors. 
Furthermore, the NAM has dedicated a major new segment of its Web site 
to the issue.
    Your legislation would afford an organized way for industry to 
express its support, and to channel its involvement, in the homeland 
security effort. Even without such legislation, many U.S. firms, 
including many NAM-member companies, rushed to offer assistance in 
numerous ways following the terrorist attacks of September 11th. As 
encouraging as that response was, a greater degree of organization in 
the future can be expected to make industry contributions even more 
effective.
    Among other provisions, the bill also would create a new unit at 
the National Institute of Standards and Technology to evaluate new 
technologies for their applications to homeland security and to serve 
as a clearinghouse. The NAM recently wrote to the director of NIST to 
call attention to a NIST project that we believe has higher homeland 
security-relevance than was previously appreciated. Our experience 
suggests, again, that a formal structure for such evaluations is a 
worthwhile idea.
    David Peyton would be pleased to provide further information at 
(202) 637-3147.
        Sincerely,
                                         Franklin J. Vargo,
                     Vice President, International Economic Policy.
                                 ______
                                 
                                                     April 19, 2002
Hon. Ron Wyden,
Chairman,
Senate Commerce, Science, and Transportation Committee,
Science, Technology and Space Subcommittee,
Washington, DC.

Dear Mr. Chairman:

    The National Association of Manufacturers wishes to express its 
support for S. 2182, your cyber security research legislation. We 
strongly supported the counterpart legislation, H.R. 3394, as passed by 
the House of Representatives with 400 votes. The National Association 
of Manufacturers (NAM) is the nation's largest industrial trade 
association. The NAM represents 14,000 members (including 10,000 small 
and mid-sized companies) and 350 member associations serving 
manufacturers and employees in every industrial sector and all 50 
states.
    Since 1998, the NAM has led the effort to increase industry support 
for science funding generally, given the need to maintain the flow of 
new discoveries upon which industry can carry out product and process 
development, the need to produce more U.S. graduates in technical 
fields, and the need to defend the country against attack, including 
cyber attack. The NAM supported the broad research authorization bills 
issuing from this subcommittee (S. 2217, S. 296, S. 2046) that the 
Senate passed three times by unanimous consent starting in 1998. Today, 
the NAM is pleased to support the new specific bill, S. 2182, which 
addresses the most important topic not included in previous 
legislation: computer security.
    The sobering hearing held by the House Science Committee last 
October 10, to be supplemented by your hearing on April 24, afforded 
evidence for the need for the legislation. Too little money is going 
into computer security research, too few graduates are being produced, 
and too little progress is being made. Computer users remain almost 
totally reliant on passive defenses such as virus filters and firewalls 
that afford no meaningful defense against distributed denial of service 
(DDOS) attacks. At Carnegie-Mellon University, the Computer Emergency 
Response Team's statistics on reported attacks show that malicious 
attacks are doubling annually, to a rate of over 50,000. Even the NAM 
itself, as a small business, receives about ten attempts at penetration 
each day.
    The NAM views S. 2182 as one important piece of an evolving 
strategy to bring together the joint strengths of government, industry, 
and academe to meet the undeniable shared threat of cyber attack, along 
with the pending Critical Infrastructure Information Security Act, S. 
1456. S. 2182 will have our support as it moves forward.
        Sincerely,
                                         Franklin J. Vargo,
                     Vice President, International Economic Policy.
                                 ______
                                 
    Response to Written Questions Submitted by Hon. John McCain to 
                           Dr. George Strawn

    Question 1. One concern that has been raised about S. 2182 is that 
many of the grants established by this program will be used to develop 
evolutionary technologies, such as a next generation firewall. How does 
NSF plan to ensure that it funds research programs that are truly 
revolutionary?
    Answer. ``Evolutionary'' and ``revolutionary'' are terms often 
associated with research proposals. They can be thought of as the ends 
of a spectrum of research contributions ranging from ``pure'' 
evolutionary (only a modest or incremental increase in understanding is 
likely to occur from undertaking the proposed research) through various 
blends of ``part evolutionary, part revolutionary'', to ``pure 
revolutionary'' (a very large increase in understanding, often in 
unexpected directions, is proposed). The other side of the same coin is 
proposal risk. If only incremental understanding is sought, reviewers 
can be relatively sure that the proposer will be successful (i.e., the 
proposal is of lower risk). On the other hand, if large increases in 
understanding are sought, the reviewers will be less sure that the 
proposer will succeed (i.e., the proposal is of higher risk). When 
scientists speak of ``the quality'' of a proposed research project, 
part of the determination of quality is how revolutionary the proposed 
project appears to be.
    NSF selects proposals for funding by merit review. Usually this 
merit review includes proposal review by scientific experts familiar 
with the subject material of the proposal. The review focuses on two 
questions: what is the scientific merit of the proposed research? And 
what are the broader implications of the proposed research? The NSF 
program officer in charge of the review then makes awards as possible, 
utilizing the advice of the expert reviewers. At all stages of the NSF 
proposal process, revolutionary research is sought. Proposers are told 
that NSF is interested in funding revolutionary research; reviewers are 
encouraged by NSF to regard revolutionary proposals highly during the 
peer review; and program officers are encouraged by NSF to ``take the 
chance'' on higher risk, revolutionary proposals while making their 
funding decisions. All of these steps are intended to counter 
tendencies along the process to lower risks by settling for more 
evolutionary proposals with higher probabilities of success. One 
implication of this is that if some proposals funded by NSF don't fail, 
we aren't taking big enough risks.

    Question 2. A number of different federal agencies, include the 
NSF, NIST, and DoD all fund cyber security projects. Is there a guiding 
organization or established working group that shares information about 
federal cyber security research and will ensure that the grant and 
research programs established by this bill will not fund duplicative 
research?
    Answer. There is an interagency organization, the Networking and 
Information Technology Research and Development working group (NITRD), 
which includes the federal agencies supporting IT research. This 
working group has been in existence for more the ten years and has a 
history of providing excellent coordination among the various federal 
IT research programs. NITRD is under the auspices of OSTP and OMB.

    Question 3. You have testified that ``the most important problem'' 
in cyber security research is that there is such a small number of 
faculty doing research in this field.

        a)  What created this shortage?

        b)  Do you believe S. 2182 will reduce this shortage and 
        increase the number of faculty involved in this field?

        c)  Is the shortage of Ph.D's and graduates in the cyber 
        security research area any worse than in other engineering and 
        science fields?

    Answer. It is a matter of speculation as to why the cohort of 
researchers working in the cybersecurity area is so small. One clear 
cause is that until very recently (coinciding with the rise in the use 
of the Internet) very few organizations worried about cybersecurity. In 
the absence of identification of serious, challenging problems, hardly 
any faculty chose to work in the area, meaning that almost no new 
researchers were produced.
    Researchers choose their areas of study based on personal interest, 
funding availability, and various other reasons. Perhaps the academic 
values that include ``free and open access to information'' have been 
at odds with the ``secure and controlled access to information'' 
requirements of cybersecurity research. Perhaps there just hasn't been 
enough funding available. For example, NSF funding levels in various 
areas are often determined in a bottom up fashion (by so-called 
``proposal pressure''). In any event, increasing the amount of research 
funding is an important and usually successful way increasing the 
number of researchers working in an area.
    Additional disincentives to working in security include the fact 
that until recently the only employer was the Department of Defense, so 
it is likely that many academic advisors did not encourage their 
students to go into this area. In the private sector, employers are 
interested in program features, not security.
    In FY02, NSF initiated a program in cybersecurity (called ``Trusted 
Computing'') and one result has been an increase in the number of 
cybersecurity proposals received by NSF. The shortage of computer 
scientists working and trained in high-demand areas such as 
cybersecurity and networking is greater than in some traditional areas 
such as programming languages and operating systems. Other areas of 
science and engineering exhibit a similar variation between high-demand 
and lower-demand sub areas.

    Question 4. You stated that cyber security is a property of the 
``total system,'' not of the system components, which includes human 
and management elements.
    Do you believe that the bill, S. 2182, as introduced, does an 
adequate job of providing funding for this ``total system'' approach? 
Is there a need for additional multi-disciplinary research in this 
area?
    Answer. Cybersecurity is a system characteristic, not a component 
characteristic. This means that researchers have to study the 
interrelationships among system components as well as the components 
themselves. Since, broadly speaking, some of the system components are 
humans and organizations interdisciplinary research arises naturally in 
this area. S. 2182 addresses these needs because the researchers (and 
NSF and other federal agencies) are well aware of these 
characteristics. NSF strives to be as general as possible in its 
program announcements and solicitations because many of the best 
proposal ideas ``bubble up'' from the research community itself as 
opposed to being specified in the announcement. Once an area such as 
cybersecurity is marked for additional support, over specification can 
deter, rather than enhance community proposal response.

    Question 5. You mentioned the research and other education programs 
that NSF is currently conducting. Can NSF conduct the type of research 
and education activities called for in the Cyber Security Research and 
Development Act within their existing statutory authority?
    Answer. We believe that the research and education called for in S. 
2182 can be supported (and indeed is already being supported) within 
NSF's current statutory authority.

    Question 6. Your written testimony highlighted the NSF's Cybercorps 
program, which provides scholarships to undergraduate and graduate 
students studying computer security and in return the students will 
serve in the federal government for a least two years. Have you had any 
problems placing students of the Cybercorps program into summer 
internships positions within the federal government?
    Answer. The Federal Cyber Service: Scholarship for Service (SFS) 
program has placed more than 24 students in internships in various 
federal agencies this past summer--the first such opportunity provided 
for students within the program. As in any new undertaking, there have 
been challenges associated with (a) moving awareness that SFS students 
are available for internships beyond agency personnel offices to 
various agencies, (b) achieving understanding that though these 
students are available for less than 640 hours of employment in a 
summer, they may be still be incorporated within existing agency 
provisions for Federal Student Career Experience Program, and (c) 
overcoming agency concerns that though they may go through a very 
expensive clearance process, students are not committed to service only 
within the federal agency within which they have served their 
internship. The Office of Personnel Management is the lead agency 
addressing these issues and is working with the hiring agencies, and 
the grantees institutions to resolve these issues.

    Question 7. On April 22, Matt Bishop, a computer science professor 
at the University of California--Davis, and Blaine Burnham, founding 
director of the Nebraska University Consortium on Information 
Assurance, detailed concerns about the Cybercorps program at the 
Infotec 2002 Conference.
    One criticism raised by these speakers is that government salaries 
are so low that students prefer to apply for student loans and repay 
them with private industry jobs instead of joining the Cybercorps 
program. Another critique of other science-targeted scholarship 
programs is that students with federal scholarships are able to get out 
of service requirements, because private companies will re-pay the 
scholarship as part of their employment package. What has NSF done with 
the Cybercorps program to attract students to the program and ensure 
that students that receive scholarships under the program will actually 
perform the required government service?
    Another criticism that was raised by the speakers is that graduates 
of the Cybercorps program are required to only work for civilian 
agencies. The speakers recommended that graduates of the program be 
allowed to work for the Department of Defense and its research 
agencies. What is NSF's position on this recommendation?
    Answer. Working through its grantees, NSF has been very active in 
increasing awareness of the program and its requirements. We have been 
gratified by the level of press attention devoted to the program and 
the student interest as demonstrated by direct inquiries to NSF. The 
program's requirements are explicitly communicated to our grantee 
institutions and, through them, to participating students. Although the 
criticisms about low government salaries and private industry options 
may be valid, they are not widespread. In fact, we have noted an 
enthusiastic response on the part of participating students. The main 
deterrence here is in the recruitment of students with the proper 
mindset and attitude about federal service.
    The vast majority of students currently enrolled in SFS are not 
planning to make a lot of money in private industry job by abusing a 
government scholarship program. On the contrary, they are in SFS 
because they sincerely want to give back to America and contribute to 
the ongoing war on terrorism. They are motivated by patriotism and a 
desire to serve in much the same way that young people volunteer for 
military service. This is the attitude frequently expressed by the 
student participants, drawn from among all grantee institutions, at the 
recent Cybercorps Symposium held July 20-24, 2002 at the University of 
Tulsa.
    In order to avoid unnecessary duplication with a similar program 
being run by the National Security Agency (NSA) which provides 
placement in Department of Defense agencies, NSF would like to see its 
SFS graduates be placed at federal civilian agencies. However, we do 
currently permit SFS graduates to be placed at DoD agencies and have 
done so. NSA and the U.S. Air Force--Rome Laboratory already have SFS 
graduates placed there and the Defense Computer Forensic Laboratory is 
scheduled to receive an intern.

    Question 8. In your written testimony, you stated that ``one 
important goal of fundamental long term research in cyber security will 
be to produce an agreement on what . . . constitutes a secure system.'' 
Could you please discuss why it so hard to reach an agreement on this 
issue, and what factors are involved in determining a ``secure system''
    Answer. The definition of a ``secure system'' depends on ``how 
big'' a system is being considered (see answer to question 4). That is, 
if the personnel who operate the computers and networks are thought of 
as part of the system, then cybersecurity melds with physical security, 
and issues of insider crime, etc, must be considered. And as with any 
discussion of security, perfection is not available and we must come to 
terms with levels of risk. Measuring risk in the computers and networks 
of a big system is a newer challenge, and less well understood than 
risk in pre-cyber systems.

    Question 9. In your view, how vulnerable is the United States to 
the threat of cyber attack? Do we currently have the resources to 
prevent and respond to a cyber attack?
    Answer. Research organizations such as NSF may not be in the best 
position to evaluate the current threat levels or response and 
prevention capabilities of the U.S. to cyber attack. Nevertheless, it 
can be said that today's cybersystems are poorly understood and poorly 
constructed relative to desired scientific and engineering standards. 
It is the goal of research to achieve better understanding of 
cybersystems and to create better engineering approaches for 
constructing such systems

    Question 10. Would you consider America as a leader in cyber 
security research? If not, which countries are?
    Answer. The U.S. remains the world leader in IT research and 
development, including cybersecurity. In cybersecurity, however, there 
is much to be learned and to be applied to a society increasingly 
dependent on computer technology. In some areas of cybersecurity, 
Israel is very advanced and may actually lead the U.S., due, perhaps, 
to their long-time need for security.

                                  

```