U.S. GOVERNMENT PRINTING OFFICE

69–335 WASHINGTON : 2001

S. HRG. 106–838

‘‘CYBER ATTACK: IMPROVING PREVENTION AND

PROSECUTION’’

HEARING

BEFORE THE

SUBCOMMITTEE ON TECHNOLOGY, TERRORISM,

AND GOVERNMENT INFORMATION

OF THE

COMMITTEE ON THE JUDICIARY

UNITED STATES SENATE

ONE HUNDRED SIXTH CONGRESS

SECOND SESSION

ON

EXAMINING HOW TO COMBAT CYBER ATTACKS BY IMPROVING

PREVENTION AND PROSECUTION

SCOTTSDALE, AZ

APRIL 21, 2000

Serial No. J–106–79

Printed for the use of the Committee on the Judiciary

(

COMMITTEE ON THE JUDICIARY

ORRIN G. HATCH, Utah, Chairman

STROM THURMOND, South Carolina

CHARLES E. GRASSLEY, Iowa

ARLEN SPECTER, Pennsylvania

JON KYL, Arizona

MIKE DEWINE, Ohio

JOHN ASHCROFT, Missouri

SPENCER ABRAHAM, Michigan

JEFF SESSIONS, Alabama

BOB SMITH, New Hampshire

PATRICK J. LEAHY, Vermont

EDWARD M. KENNEDY, Massachusetts

JOSEPH R. BIDEN, JR., Delaware

HERBERT KOHL, Wisconsin

DIANNE FEINSTEIN, California

RUSSELL D. FEINGOLD, Wisconsin

ROBERT G. TORRICELLI, New Jersey

CHARLES E. SCHUMER, New York

MANUS COONEY, Chief Counsel and Staff Director

BRUCE A. COHEN, Minority Chief Counsel

SUBCOMMITTEE ON TECHNOLOGY, TERRORISM, AND GOVERNMENT INFORMATION

JON KYL, Arizona, Chairman

ORRIN G. HATCH, Utah

CHARLES E. GRASSLEY, Iowa

MIKE DEWINE, Ohio

DIANNE FEINSTEIN, California

JOSEPH R. BIDEN, JR., Delaware

HERBERT KOHL, Wisconsin

STEPHEN HIGGINS, Chief Counsel and Staff Director

NEIL QUINTER, Minority Chief Counsel and Staff Director

(II)

(III)

C O N T E N T S

STATEMENTS OF COMMITTEE MEMBERS

Page

Kyl, Hon. Jon, U.S. Senator From the State of Arizona ...................................... 1

CHRONOLOGICAL LIST OF WITNESSES

Panel consisting of Janet Napolitano, Attorney General, State of Arizona;

and Guadalupe, Gonzalez, Special Agent In Charge, Phoenix Field Investigation, Federal Bureau of Investigation .......................................................... 3

Panel consisting of David W. Aucsmith, chief security architect, Intel Corp.;

and Jose Grando, senior manager, Ernst & Young LLP, Houston, TX ........... 89

ALPHABETICAL LIST AND MATERIAL SUBMITTED

Aucsmith, David W.:

Testimony .......................................................................................................... 89

Prepared statement .......................................................................................... 93

Gonzalez, Guadalupe:

Testimony .......................................................................................................... 66

Prepared statement .......................................................................................... 71

Granado, Jose:

Testimony .......................................................................................................... 102

Prepared statement .......................................................................................... 104

Napolitano, Janet:

Testimony .......................................................................................................... 3

Prepared statement .......................................................................................... 5

Letter from the Attorney General ............................................................ 11

Summary .................................................................................................... 13

Computer Crimes Act of 2000 .................................................................. 15

Attorney General’s Website ...................................................................... 54

News Articles ............................................................................................. 57

(1)

‘‘CYBER ATTACK: IMPROVING PREVENTION

AND PROSECUTION’’

FRIDAY, APRIL 21, 2000

U.S. SENATE, SUBCOMMITTEE ON TECHNOLOGY, TERRORISM, AND GOVERNMENT INFORMATION, COMMITTEE ON THE JUDICIARY, Scottsdale, AZ.

The subcommittee met, pursuant to notice, at 9 a.m., in City Council Chambers, Scottsdale, AZ, Hon. Jon Kyl (chairman of the

subcommittee) presiding.

OPENING STATEMENT OF HON. JON KYL, A U.S. SENATOR

FROM THE STATE OF ARIZONA

Senator KYL. This hearing will please come to order. Let me first welcome everyone to this field hearing of the Sub- committee on Technology, Terrorism, and Government Information

of the U.S. Senate Judiciary Committee. It is encouraging to see so

many people who are interested in this critical subject. Before we

begin, I want to thank the Mayor of Scottsdale, Sam Campana, for

hosting us here at the Scottsdale City Council chambers and for

the assistance of Peggy Carpenter from the city of Scottsdale, who

helped set up this hearing. I also want to thank Ed Denison from

the Arizona Software Association for his assistance in spreading

the word about the hearing, and, finally, to say hello to the people

watching this hearing on the city of Scottsdale’s Cable Television

channel.

The danger from cyber attack has recently received a lot of attention. The denial-of-service attacks against popular Internet sites

like Yahoo, eBay, and CNN and the arrest earlier this week of a

Canadian teenager in the case brought home to Americans just

how vulnerable we are. This is the seventh hearing I have held on

the subject in the past 3 years, and it won’t be the last.

In examining how to combat cyber attacks, it is important to reflect on how the Information Age is rapidly transforming our society. Today, virtually every key service is dependent upon computers—from electrical power grids, to phone systems, air traffic control, banking, military early-warning networks. The list goes on

and on. Unfortunately, most of these critical computer networks

were not designed with good security measures in mind.

America’s increased dependence on computer networks must also

be viewed in context of our changing role in the post-cold war

world. The United States is the world’s only superpower, and our

armed forces enjoy technological superiority on the battlefield. I sit

2

on the Senate Intelligence Committee, and I receive a lot of briefings from the CIA and others about threats facing our country. The

overriding trend in these briefings is that nations and terrorist

groups that are hostile to our interests are increasingly choosing

not to confront our military strengths directly—that is, by trying

to field fleets of advanced fighter planes or aircraft carriers on a

par with ours—but, rather, are seeking to exploit our vulnerabilities, looking hard for our Achilles heel. As the ancient Chinese

military strategist Sun Tzu said, ‘‘You can be sure of succeeding in

your attacks if you only attack places which are undefended.’’ China’s current military strategists appear to have taken this

lesson to heart. A recent article in the official Liberation Army

Daily stated that China is considering creating a fourth branch of

the military for information warriors and said ‘‘Internet warfare’’ should be equated with air, land, and sea combat operations.

Russia is another country of concern in this area. Last year, a

series of widespread intrusions were detected on computer networks operated by the Defense Department, other Federal agencies, and the private sector. The FBI traced these intrusions to

Russia in an operation dubbed Moonlight Maze. According to the

FBI, the attacks resulted in the theft of vast quantities of unclassified, but still sensitive information about defense technological

research matters. Although the details of the case are classified, according to Newsweek Magazine, the primary suspects in the intrusions, which have since terminated, are ‘‘crack cyber spooks from

the Russian Academy of Sciences, a government-supported organization that interacts with Russia’s top military labs.’’ And Russia

and China are not the only countries of concern. According to the

National Security Agency, over a dozen countries are working on

information warfare techniques.

U.S. military planners have also begun to try to assess how cyber

attacks could affect our military’s performance and to take steps to

close those vulnerabilities. In 1997, the Joint Chiefs of Staff conducted an exercise called Eligible Receiver to find out how easy it

would be for an enemy to attack U.S. military communication systems and other critical infrastructures. During the exercise, a small

team of 2 dozen people used readily available computer hacking

tools to attack the military’s critical infrastructures and within 4

days crippled our ability to respond to a simulated crisis in the Pacific theater. They also broke into networks that control the electric

power grid for the entire United States.

In addition to being conscious of the threat from foreign countries and the need to take steps to improve the security of the critical computer networks, we need to combat computer hacking by

criminals here in the United States, which can also have very serious consequences. The number of computer crimes is rapidly increasing, and we need to be sure that Federal, State, and local law

enforcement agencies have the tools they need to investigate and

prosecute violators.

Catching and punishing those who commit cyber crimes is essential for deterring future attacks. When a cyber attack occurs, it is

not initially apparent whether the perpetrator is a mischievous

teenager, a professional hacker, a terrorist group, or even a hostile

nation. Law enforcement must be equipped with the resources and

3

authorities necessary to swiftly trace a cyber attack back to its

source and appropriately prosecute criminals.

Finally, it is important to recognize that private companies own

and operate the vast majority of the computer networks used to operate our critical infrastructure. We must raise awareness in industry about cyber threats, encourage companies to take responsible

steps to protect themselves, and remove roadblocks to effective industry cooperation. For example, protection from attack necessitates that information about cyber vulnerabilities and threats be

communicated among companies and with government agencies.

Antitrust laws that were created to prevent collusion among competitors in an industry need to be updated to allow companies to

cooperate in establishing good cyber security. Furthermore, the

Freedom of Information Act may need to be updated to encourage

companies to share information with the Federal Government.

Communication is critical for protection, and these roadblocks need

to be removed.

Our witnesses are well suited to address these issues. On our

second panel, David Aucsmith, the Intel Corporation’s top security

specialist, will discuss some of the trends and challenges in cyber

security, and Jose Granado, a senior manager of Ernst & Young,

will conduct a live computer hacking demonstration. Guadalupe

Gonzalez, the special agent in charge of the FBI’s Phoenix Office,

will provide the Federal law enforcement perspective on cyber

crime.

Before we hear from these three experts, I would like to introduce our first witness, Arizona Attorney General Janet Napolitano.

Ms. Napolitano has served as attorney general since January 1999,

and prior to her election to this post, she served for over 4 years

as the U.S. attorney for Arizona.

Attorney General Napolitano, thank you very much for testifying

at today’s hearing. Your full statement and that of all of the witnesses will be included in the record, and I would invite you to

make any summary remarks at this time.

PANEL CONSISTING OF JANET NAPOLITANO, ATTORNEY GENERAL, STATE OF ARIZONA; AND GUADALUPE GONZALEZ,

SPECIAL AGENT IN CHARGE, PHOENIX FIELD INVESTIGATION, FEDERAL BUREAU OF INVESTIGATION

STATEMENT OF JANET NAPOLITANO

Ms. NAPOLITANO. Thank you, Mr. Chairman, and thank you for

inviting me to be here today and for your long-time interest in the

cyber area. You have truly been a national leader in this regard,

and we are grateful.

Arizona is one of the leading States, I believe, in prosecuting

computer crime. In the Attorney General’s office, we have established a Technology Crimes Unit. The head of that unit is with me

today, Gail Thackery, who is one of the Nation’s leading prosecutors in this emerging area.

We also now have one of the most comprehensive computer crime

statutes in the country that was passed by the legislature this past

session, was recently signed into law by Governor Jane Hull, and

had broad bipartisan support.

4

Let me, if I might, divide my summary remarks into three brief

categories, and I understand my full statement will be admitted

into the record. But the three categories are what kinds of things

we’re seeing at the State level in Arizona, what is in our cyber

crime legislation that supports and augments what is in some of

the proposed Federal legislation, and, finally, what we as State

prosecutors would like to see from the Federal Government.

But, very briefly, lest we think that all cyber crime takes place

internationally or in cyberspace somewhere else, we have a great

deal of it here in Arizona, and it really doesn’t matter whether you

are in urban Arizona or rural Arizona. Anywhere you have a PC

you have the potential of a cyber crime.

Currently, we have cases in our office pending involving the five

following kinds of cyber crime: cyber stalking, online school threats,

infrastructure attacks and hacker offenses, fraud—in fact, in our

Consumer Fraud Division in the Attorney General’s office, we have

now created a separate way to track the Internet fraud cases so

that we can follow the trend line more accurately as to what kinds

of fraud we are seeing on the Internet—and child sexual exploitation cases. We currently have task forces involving child sexual

exploitation in Tucson and Phoenix, and our office is helping Arizona post the training agency for law enforcement train investigators and prosecutors in this area.

So you can see we have quite a panoply of different types of computer crimes. Some are old kinds of crime committed in new ways,

i.e., fraud. Some are new crimes that we could not have imagined

20 years ago.

To deal with this, our office proposed the Computer Crime Act

of 2000 in Arizona, and briefly, Senator, that statute, which is attached to part of my testimony, has six parts. One is cyber terrorism, and it raises the penalties for disrupting operations of things

like utilities, emergency services, medical institutions, traffic control and the like.

It contains cyber tools for law enforcement. For the first time, for

example, our office has the ability to seek the source of e-mails

through desk subpoenas rather than having to go continually to

court, a concept I think that the FBI is supporting federally.

It has sections on forgery, fraud, and theft, and acknowledges

that people have online identities that themselves can be the subject of the theft of identity.

It has a new felony for cyber stalking because the current laws

were not adequate to deal with the prosecution of those offenses.

It has a felony for computer use and disruption. The denial of

service attacks you mentioned in your opening statement are now

felonies in Arizona. I think we are one of the few jurisdictions in

the country that actually has that.

And, finally, it has provisions related to child pornography on the

Internet, and it adds the offense of luring—l-u-r-i-n-g—meaning

that the offense of sexual solicitation of a minor is committed with

the solicitation itself. It doesn’t require any further act in furtherance of the crime of meeting the minor in order to be able to charge

the higher felony. We make the solicitation itself, the luring, a

crime on the Internet. So that is the new Arizona bill.

5

Now, we have a Technology Crimes Unit, as I mentioned, and I

might like to say that this year the legislature, under the leadership of Representative Jim Wyers from the northwest part of the

valley, passed a bill that provides some monetary resources both to

the Attorney General’s office and to the Department of Public Safety to help us meet the increasing need. And as good a bill as that

is, it is only a first step in terms of the resources that State and

local prosecutors are going to need. The chief thing we need from

the Feds, if I can use the nickname, right now is training and resources.

Attorneys, investigators, and prosecutors with computer skills

are in incredible demand. We are unable to hire people with this

expertise because State and local public salaries simply are not

competitive in the current marketplace. That means what we need

to do and what we are doing is training people who are already in

public service on how to deal with these new kinds of crime. That

means training is very, very key. It is expensive, and it also requires equipment that is continually updated to match what is out

there in the field.

As I have already indicated, the bulk of prosecuting these crimes,

the bulk of these crimes, be it identity theft, be it a child pornography case, be it a luring case, are going to end up being prosecuted by State and local authorities because that is where the

bulk of prosecutions in this country occurs in any area. And the

same is holding true in cyber crime.

So we would like to emphasize the need for training resources,

and there are existing vehicles already in place to deliver that

training, both through the National District Attorneys Association

and the National Association of Attorneys General. NAAG, by the

way, has made cyber crime one of its top priorities, and I would

ask that the Senate and that you consider how we make those

training resources available on a continual basis, not a one-time

thing but continual, because the technology keeps changing.

The other idea I would like to offer to you, Sir, is something that

is reminiscent of what the Senate and the Congress did in the

1970’s when they provided seed money to Attorneys General to

open up or to start antitrust units or economic competition units

within their offices to handle those kinds of cases. Seed money for

every Attorney General to have a cyber crime unit such as we have

in Arizona, or to build on one if they already have one, I think

would provide a very big bang for the buck in the sense of expanding our reach, expanding our prosecutorial resources, and expanding what we can do working with these new technologies to make

sure and to ensure that basic law enforcement is being carried out,

be it in cyberspace or be it on the ground.

Thank you very much.

[The prepared statement of Ms. Napolitano follows:]

PREPARED STATEMENT OF JANET NAPOLITANO

Mr. Chairman, thank you for the opportunity to address your subcommittee today.

As the Attorney General of Arizona, I am here to report on our state’s activities in

combating and prosecuting cybercrime. Cybercrime is an emerging issue in law enforcement as an increasing number of crimes are committed using computers and

other technologies. In fact, while we have seen a decline in violent crime, cybercrime

has increased exponentially. As crime migrates to the Internet and other frontiers

6

of technology, law enforcement must be adequately prepared to apprehend and prosecute the criminals.

Instead, law enforcement has had a difficult time keeping up with cybercrime.

Laws have been found to be inadequate in dealing with new technologies. The speed

with which technology advances demands rapid and innovative solutions to complex

problems. Lastly, there is a desperate lack of resources for cybercrime law enforcement. There are three issues I want to discuss today—legislation, emerging issues

in cybercrime and current challenges facing law enforcement.

ARIZONA LEGISLATION—THE COMPUTER CRIMES ACT OF 2000

The Office of the Attorney General drafted the Computer Crime Act of 2000,

which was sponsored and passed by a bi-partisan coalition of legislators. HB 2428,

recently signed into law by Governor Jane Dee Hull, is designed to better protect

Arizona citizens from cybercrime, which is a threat to private citizens, public infrastructure, businesses, and government, as these incidents prove:

• In 1998 a computer user in Arizona hacked his way onto a billing database of

a public utility, looking to cancel someone’s account. Once in the system, he gained

high-level access to the canal controlling system, putting the system at serious risk.

• Just this past year, a young man, angry at his ex-girlfriend, posted pictures of

her and assumed her identity on the Internet. Through sexually explicit e-mail with

other users, he put the young woman in great danger to potentially become a victim

of sexual assault or worse by inviting people to her home and workplace.

• Phoenix man hacked into the computer of an Internet Service Provider in Canada and crashed the server, disabling the entire network, including all e-mail services, for a week. Numerous businesses and individuals lost valuable information,

time and money.

There are six parts to this legislation:

Cyberterrorism

We must use every means available to crack-down on attacks on our high-tech

infrastructure. This section raises judicial penalties for disrupting operations of utilities, emergency services, medical institutions, traffic control, etc.

Cybertools for law enforcement

Cybertools strengthen law enforcement’s ability to preserve electronic evidence

and to trace rapidly criminal activity on the Internet.

Forgery, fraud and theft

Private individuals and businesses must be protected from electronic forgery,

fraud and theft. New provisions such as these update our laws, demonstrating that

individuals and companies have an ‘‘online’’ identity that can be used by others in

criminal or malicious activity. Fraud statutes must protect Internet consumers and

businesses against crimes such as theft of trade secrets, credit card fraud, identity

theft and forgery.

Cyberstalking

Current statutes did not provide adequate protection from cyberstalking, where

physical contact between the victim and stalker may never occur. The new legislation includes the unique and technical aspect of cyberstalking and provides an effective tool for prosecution and prevention.

Computer use and disruption

When a company or an individual loses their access to the Internet, they can lose

contact to their customers, business records, financial information, and other materials hindering their ability to work, retrieve data, and communicate. This section

is designed to deter several forms of disruption which have not been covered by the

current statute.

Child pornography

The section protects computer repair technicians and others who report child pornography to the police. It also adds the offense of ‘‘luring,’’ to attack effectively the

online solicitation or offering of a child with an intent of sexual exploitation. Individuals would be held criminally liable for any sexually explicit material knowingly

transmitted to a school or minor.

The Computer Crimes Act of 2000 goes into effect July 18, 2000.

7

EMERGING ISSUES

Law enforcement and the public at large have raised several issues that Congress

and the states will have to come to terms with in the near future. Two of the ones

my office is working on are Privacy and the Theft of Intellectual Property.

Privacy

The public is becoming increasingly concerned over the collection and ownership

of personal identifying information. The traditional American model is that organizations that gather information about individuals become the owners of that information, and can use it for their own purposes or even sell it to others. The phrase

seen in hacker chat rooms currently is, ‘‘You have no privacy now—get over it.’’

On the other hand, for 25 years or more, many countries have had strong privacy

protections including transborder data flow statutes prohibiting the transfer of personal data across national boundaries, and others laws forbidding the ‘‘secondary

use’’ of personal data without permission of the individual. In fact, American corporations have just agreed to honor European Union privacy rules which are much

more stringent than any they observe in this country, in connection with our own

citizens’ data.

We have made tremendous advances with the use of the Internet in numerous

fields. But at the same time, the Internet poses a threat to individual privacy—and

security—on a scale never imaginable in earlier times, when records pertaining to

individuals were maintained by corporations and public agencies in separate files

scattered across the business and government landscapes.

The time has come for a comprehensive assessment of our nation’s business practices with regard to the collection and use of personal data. The national epidemic

of Identity Theft crimes is proof that we also need to establish industry standards

for maintaining the security and accuracy of information that is collected about individuals. I intend to work with Arizona business, consumer and privacy groups in

the next legislative session to craft legislation that will offer our citizens reasonable

assurance that they know what information is being collected about them, have an

opportunity to correct inaccuracies, and have some say in what is done with their

personal data. I believe that, working together, Arizona citizens and businesses can

establish a reasonable framework for protecting individual privacy in a world where

all records are online, all the time.

Theft of intellectual property

The Internet has also caused another revolution—the quick and rapid distribution

of many perfect copies of the same original. Arizona’s ‘‘Silicon Desert’’ is an important and fast-growing part of our economy, and the protection of our information

resources is critical. Currently, the Federal copyright statute preempts the states

from enforcing thefts of intellectual property such as software, video and music, yet

the Federal agencies only have the resources to pursue a tiny fraction of the reported offenses. This situation robs our American businesses of billions of dollars

a year, and allows the thieves to flourish.

As a former United States Attorney, I understand the limitations of resources

among the Federal agencies. However, every year a number of business victims

come to our office for help, but the Federal preemption of copyright theft leaves us

powerless to help them. I know that industry would support a change in the copyright law to permit enforcement at the state level, and I urge Congress to amend

the copyright laws to permit enforcement by both Federal and State agencies. A

strong information economy requires strong protection for our information assets.

CONCLUSION—CURRENT CHALLENGES

The Arizona Attorney General’s Office is charging ahead in partnership with various groups to address Arizona’s state of emergency regarding cybercrime.

• Law Enforcement—we have created a three-tiered training program:

1. A two-day comprehensive evidence seizure and crime scene procedure class.

This will be certified by AZ POST and taught by the Department of Public Safety,

the Attorney General’s Office and other agencies. The goal is to create regional expert teams, similar to the meth lab multi-agency teams, and certify 200 officers in

the State.

2. Police officers training to teach various tools and programs for extracting computer evidence and creating a case ready for prosecution.

3. Detective training to teach the special skills necessary to perform investigations

in cyberspace.

8

• Communication Industry—We are working with on-line providers to develop

standardized policies and forms for legal procedures necessary to obtain computer

evidence.

• Business—We are working with corporations to assist in raising awareness on

computer security issues and using their expertise to help train law enforcement.

• Schools—We are working closely with schools and school districts to deal with

the increasing problem of school online threats.

• Public—We are conducting townhalls throughout Arizona to educate the public

at large particularly seniors and parents, to potential dangers on the Internet.

In addition to the work being done in Arizona, other states have also been active:

California has established regional task forces; the Attorney General of Illinois has

established a state level unit to investigate and prosecute computer crimes; and the

Attorney General of South Carolina has, with the assistance of the Office of Juvenile

Justice and Delinquency Programs in the U.S. Department of Justice, created a task

force to investigate and prosecute child pornographers and pedophiles. In fact, Attorneys General from around the country have made cybercrime a high priority for

the National Association of Attorneys General.

But like Arizona, states face two major obstacles in setting up units or task forces

to address computer crimes: staff and equipment. Attorneys, investigators and prosecutors with computer skills are in high demand. Unable to hire and retain these

skilled professionals at state salaries, states have turned to grooming these professionals within current ranks. Training, however, is expensive and not enough police

and prosecutors are receiving it. Equipment to investigate these crimes is also expensive and must be constantly updated to keep pace with technology.

Participation of the states in protecting the nation’s infrastructure by investigating and prosecuting computer crimes is critical. As in other areas of criminal law,

the states will undoubtedly carry the bulk of the computer crime investigations and

prosecutions and, in the area of juvenile prosecutions, the states will have the full

burden of those cases. This burden is likely to be considerable because computers

have become ubiquitous in almost every type of crime.

The efforts of Arizona and other states to address computer crimes must be nurtured by the Federal Government. The states need direct Federal funding to establish computer forensic laboratories.

The development of a basic curriculum for prosecutors is underway. The means

to execute the training and to provide ongoing technical assistance exists through

the National Association of Attorneys General and the National District Attorneys

Association. Unfortunately, we are missing the funding to implement the training

and assistance. Approximately $1 million a year for 5 years would allow over 100

prosecutors to be trained each year.

To combat cybercrime, states need a program to provide seed money to assist with

hiring knowledgeable staff and buying much needed equipment should be established on the Federal level. This program would need to provide a minimum of

$500,000 per year per state for at least 3 years to allow the states to establish programs and begin funding them.

Updates to the law, such as Arizona’s Computer Crimes Act 2000, is a powerful

first step in the battle against cybercriminals. But resources, applied intelligently,

would revolutionize law enforcement’s ability to respond swiftly and effectively to

cybercrime.

I look forward to working with this Subcommittee and other Federal entities to

ensure that we have a coordinated Federal-State effort to combat cybercrime.

Once again, thank you for inviting me to present the perspective of the Arizona

Attorney General’s Office and I would be pleased to answer any questions from Subcommittee members.

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

Senator KYL. Thank you very much. That is very helpful, and I

have got several questions that I have noted.

But let me first turn to our next witness, Mr. Guadalupe Gonzalez, the special agent in charge of the FBI’s Phoenix Field Office.

Mr. Gonzalez has served in his post since August 1998. Prior to

coming to Phoenix, he was the special agent in charge of organized

crime, drugs, and violent crimes in the FBI’s Los Angeles office.

Mr. Gonzalez, thank you very much for testifying at today’s hearing. As I noted before, your full written statement will be placed

in the record. I would like to invite you to make any summary remarks at this time, and I would note to the people who are here,

in the hearing that we held a couple of weeks ago in Washington,

DC, on this same subject, the FBI Director Louis Freeh presented

his testimony, and in asking him how best to relate that testimony

to people in Arizona, he suggested that we ask Mr. Gonzalez to be

his representative here. And we are delighted to do that, so thank

you.

STATEMENT OF GUADALUPE GONZALEZ

Mr. GONZALEZ. Good morning, Mr. Chairman. Thank you for inviting me to the field hearing to discuss the growing problem of

cyber crime and our response to it. Our ability in the field to deal

with this crime problem requires the support of Congress. The recent denial-of-service attacks against Yahoo, Amazon.com, eBay,

CNN, Buy.com, and other e-commerce websites have thrust the security of our information infrastructure into the spotlight. But they

are only one example of a large and growing problem of criminal

activity in cyberspace. I would like to discuss with you the national

challenge of battling computer intrusions.

The cyber revolution has permeated virtually every facet of our

lives, and we see its effects all around us in the way we communicate, do business, and even in the way Government operates. Unfortunately, that revolution has affected the nature of criminal activity as well. Criminals are increasingly seeing the utility of cyber

tools to facilitate traditional crimes such as fraud, extortion, and

dissemination of child pornography. And they are also inventing

new forms of crime which make computers and the information

stored on them the targets of the crime. Thus, we see criminals intruding into computers to steal credit card numbers, to abscond

with proprietary information, and to shut down e-commerce sites.

And this is not just a criminal problem. It is also a national security problem. This is because our Nation’s critical infrastructures,

by which I mean those services that are vital to our economy and

national security, such as electrical energy, telecommunications,

banking and finance, transportation, and government operations,

are now dependent on computer technology for their very operations. And this very dependence makes them vulnerable to an attack which, if successful, could deny service on a broad scale.

The same basic types of cyber attack tools, therefore, become attractive not only to criminals interested in illicit financial gain, but

also to foreign intelligence services seeking new ways to obtain sensitive government or industry information and to terrorists of hostile foreign nations bent on attacking U.S. interests.

67

The difficulty of dealing with this challenge stems from the nature of the cyber environment. The cyber environment is borderless, afford easy anonymity and methods of concealment to bad actors, and provides new tools to allow for remote access to targeted

computers. A criminal sitting on the other side of the planet is now

capable of stealthily infiltrating a computer network in Arizona to

steal money, abscond with proprietary information, or shut down

e-commerce sites.

To deal with this problem, law enforcement has retooled its

workforce, its equipment, and its own information infrastructure. It

must also forge new partnerships with private industry, other

agencies, and our international counterparts.

We at the FBI have been doing all of these things for the last

2 years, but we must continue to build upon our progress to ensure

that we can perform our responsibilities to protect public safety

and national security in the information age.

My written statement provides an overview of the broad spectrum of cyber threats which gives a flavor of the incredibly varied

nature of the threats we face. The examples range from insiders

bent on revenge against their employers, to hackers seeking bragging rights in the hacking community, to criminal groups stealing

credit card numbers or money, to foreign intelligence agencies or

foreign military services who target U.S. interests.

The most common threats we face are from hackers and criminals stealing for profit. For example, in March, authorities in the

United Kingdom, acting in coordination with the FBI, arrested two

individuals for alleged intrusions into e-commerce sites in several

countries and the theft of credit card information on over 26,000

accounts. One subject used the Internet alias ‘‘CURADOR.’’ Losses

from this case could exceed $3 million. The FBI cooperated closely

with the Dyfed–Powys Police Department in the United Kingdom

and the Royal Canadian Mounted Police in Canada and private industry.

Here in Arizona, we are investigating a computer intrusion case

in which a private enterprise was defrauded of several hundred

thousand dollars in fraudulent telephone calls that were placed to

a foreign country.

We are also concerned about the terrorist threat. Terrorist

groups are increasingly using new information technology and the

Internet to formulate plans, raise funds, spread propaganda, and to

communicate securely. Director of Central Intelligence George

Tenet has testified that terrorist groups, ‘‘including Hizbollah,

Hamas, the Abu Nidal organization, and Bin Laden’s al Qa’ida organization are using computerized files, e-mail, and encryption to

support their operations.’’

While we have not yet seen these groups employ cyber tools as

a weapon to use against critical infrastructures, their reliance on

information technology and acquisition of computer expertise are

clear warning signs.

Finally, given the presence of military research facilities in Arizona, we must be concerned with national security threats. As you

know, the FBI has observed a series of intrusions into numerous

Department of Defense and other Federal Government computer

networks and private sector entities. An investigation last year deVerDate 11-MAY-2000 15:11 Jan 26, 2001 Jkt 000000 PO 00000 Frm 00071 Fmt 6633 Sfmt 6602 69335.XXX SJUD2 PsN: SJUD2
68

termined that the intrusions appear to have originated in Russia.

The intruder successfully accessed U.S. Government networks and

took large amounts of unclassified but sensitive information, including defense technical research information.

Here in Arizona, we have seen scans of military computer systems by outside intruders. Some of the logs indicate that the source

of some of these scans may be foreign.

The recent distributed denial-of-service attacks have garnered a

tremendous amount of interest in the public. Because the FBI is

actively investigating these attacks, I cannot provide a detailed

briefing on the status of our efforts. However, I can tell you that

all FBI field offices, including the Phoenix Division, have been

asked to assist on a case to the extent that entities in our jurisdiction are involved in the matter or to the extent that we can cover

leads within our jurisdiction.

In February 1998, the National Infrastructure Protection Center,

NIPC, was established as a focal point for the Federal Government’s efforts to protect the critical infrastructures. On October 2,

1998, the center was designated a branch of the FBI’s National Security Division, and the National Infrastructure Protection and

Computer Intrusion Program was approved as an investigative program. This program is a tier one priority under the FBI’s strategic

plan and serves as the FBI’s vehicle for performing the infrastructure protection mission assigned to the NIPC under Presidential

Decision Directive 63. In October 1999, the program was moved to

a newly-formed Counterterrorism Division of the FBI, reflecting

the FBI’s high priority on protecting the infrastructures from terrorist threats.

At headquarters, the NIPC has a budget of approximately $21

million. This is not slated to increase in fiscal year 2001. There are

currently 193 agents in the field devoted to NIPC matters as well

as 101 personnel at FBI headquarters. The NIPC at headquarters

also houses 19 interagency detailees, mainly from the law enforcement, defense, and intelligence communities. The NIPC works

closely with foreign counterparts on case-related matters.

Beyond the NIPC at FBI headquarters, a cyber crime investigative program has been created in all FBI field offices, including the

Phoenix Division. We have special agents here who are responsible

for investigating computer intrusions, viruses, or denial-of-service

attacks, and for conducting critical liaison activities with private

industry. Given the amount of work we have and the fact that

Phoenix is the sixth largest city in the United States, we are seeking to establish a full computer intrusion squad in the Phoenix Division by the year 2002.

One major difficulty that distinguishes cyber threats from physical threats is determining who is attacking your system, why, how,

and from where. This difficulty stems from the ease with which individuals can hide or disguise their tracks by manipulating logs

and directing their attacks through networks in many countries before hitting their ultimate target. This will continue to pose a problem as long as the Internet remains rife with vulnerabilities and

allows easy anonymity and concealment.

Another significant challenge we face is intrusions involving multiple jurisdictions. A typical investigation involves victim sites in

69

multiple States and often many countries. This is the case even

when the hacker and the victim are both located in the United

States. In the United States, we can subpoena records, engage in

judicially approved electronic surveillance, and execute search warrants on suspects’ homes, seize evidence, and examine it. We can

do none of these things ourselves overseas; rather, we depend on

the local authorities to assist us.

The most difficult situation will arise, however, when a foreign

country with interests adverse to our own simply refuses to cooperate. In such a situation, we could find that an investigation is stymied unless we can find an alternative method of tracing the activity back to its source.

Our challenge lies in continuing to expand our computer investigative, analytic, training, and outreach programs. Given the explosive and continued growth of computer intrusions, the Infrastructure Protection and Computer Intrusion Program needs to

more than double the current number of field investigative personnel and headquarters analysts. In addition, we need to leverage our

resources by expanding our training programs to reach more State,

local, and international investigators. Finally, NIPC investigators

need high-speed computer processing and large-capacity storage for

investigations.

I have tried to review with you some of the threats and challenges we face. Some of the challenges stem from the structure of

the present loss governing computer crime. For example, we should

ask whether the sentencing guidelines for computer crime are adequate and whether the $5,000 threshold for damage is a useful

benchmark, because in many cases the true damage cannot be

measured in monetary terms. Examples of damage difficult to

measure monetarily are impairment of medical diagnosis, threat to

public safety, or damage to national security, national defense, or

administration-of-justice computers.

Another problem we face is having to obtain multiple trap and

trace orders for different jurisdictions. The Kyl-Schumer bill addresses these concerns and other concerns. We support the goal of

Senate bill 2092 to strengthen the general deterrence aspects of the

Computer Fraud and Abuse Act and to provide some needed procedural enhancements to help us confront the expanding criminal

threat in this dynamic and important part of our national economy,

while continuing to protect individual privacy interests. The FBI

looks forward to working with this committee on this important

legislation.

Addressing the threat of cyber crime requires teamwork—teamwork among Government agencies, teamwork between Federal,

State, and local law enforcement, and teamwork between the Government and the private sector. We have made much progress in

establishing this sort of teamwork on all three fronts over the last

2 years. The FBI is also developing cyber crime task forces in partnership with State and local law enforcement entities within their

jurisdiction to leverage the limited resources in this area. The first

one was founded in Pittsburgh in March. We hope that one can be

established in our jurisdiction in the next few years as the program

expands.

70

The partnerships we have established with the private sector are

particularly important for several reasons. Most of the victims of

cyber crimes are private companies; therefore, successful investigation and prosecution of cyber crimes depends on private victims reporting incidents to law enforcement and cooperating with investigators. Second, the network administrator, who alone knows the

intricacies of his or her network, often must provide critical assistance to the investigation leading him to the evidence of the intruder’s activity.

Much has been said over the last few years about the importance

of information sharing. Here in the Phoenix Division, we have an

excellent working relationship with our private sector counterparts

and the community in general. We share information on a number

of areas, including infrastructure protection, and receive information from the private sector that greatly assists in protecting the

community.

As a result of our close working relationship with the private sector, we can detect criminal activity in its initial stages and in some

cases prevent criminal incidents. The NIPC also provides the private sector with warning information which also lessens their vulnerability. These warnings assist field offices like Phoenix to be

better prepared and better protect our community. They further

allow us the opportunity to respond quickly and efficiently to cyber

threats. I believe that as companies continue to gain experience in

dealing with the NIPC and the FBI field offices, as we continue to

provide them with important and useful threat information, and as

companies recognize that cyber crime requires a joint effort by industry and Government together, we will continue to make real

progress in the area.

Our Key Asset Initiative facilitates response to threats and intrusion incidents by building liaison and communication links with the

owners and operators of individual companies in the critical infrastructure sectors and enabling contingency planning. The Key

Asset Initiative initially will involve determining which assets are

key within the jurisdiction of each FBI field office and obtaining

24-hour points of contact at each asset in cases of emergency.

Eventually, if future resources permit, the initiative will include

the development of contingency plans to respond to attacks on each

asset, exercises to test response plans, and modeling to determine

the effects of an attack on particular assets.

Here in the Phoenix Division, we have identified dozens of key

assets around the State for including in the national list. These assets include power generation facilities, water storage and distribution centers, transportation assets, military installations, research

institutions, and key public emergency service entities.

The second is the InfraGard initiative. This is an initiative that

we have developed in concert with private companies and academia

to encourage information sharing about cyber intrusions, exploited

vulnerabilities, and physical infrastructure threats. A vital component of InfraGard is the ability of industry to provide information

on intrusions to the local FBI field offices using secure e-mail communications in both a sanitized and detailed format. We can use

the detailed version to initiate an investigation, while NIPC headquarters can analyze that information in conjunction with other inVerDate 11-MAY-2000 15:11 Jan 26, 2001 Jkt 000000 PO 00000 Frm 00074 Fmt 6633 Sfmt 6602 69335.XXX SJUD2 PsN: SJUD2
71

formation we obtain to determine if the intrusion is part of a

broader attack on numerous sites. The NIPC can simultaneously

use the sanitized version to inform other members of the intrusion

without compromising the confidentiality of the reporting company. Here in Phoenix, we are planning to roll out our InfraGard Chap- ter on May 9. We expect to have representatives from in-state universities, businesses, and some of the critical infrastructures on

hand.

We look forward to working with Congress to ensure that law en- forcement can continue to address the cyber crime problem in the

year ahead.

Thank you.

[The prepared statement of Mr. Gonzalez follows:]

PREPARED STATEMENT OF GUADALUPE GONZALEZ

INTRODUCTION

Mr. Chairman, Members of the Subcommittee: Thank you for inviting me to discuss the threats to our Nation’s critical infrastructures and the FBI’s approach in

the field to meeting those challenges. In February 1998 the National Infrastructure

Protection Center (NIPC) was established as a focal point for the federal government’s efforts to protect the critical infrastructures. Following the founding of the

Center, the National Infrastructure Protection and Computer Intrusion Program

(NIPCIP) was approved as an FBI investigative program. NIPCIP is a Tier One priority under the FBI Strategic Plan and serves as the FBI vehicle for performing the

NIPC’s missions under PDD–63. In October 1999 the NIPCIP was moved to the

newly-formed Counterterrorism Division of the FBI, reflecting the FBI’s high priority on protecting the infrastructures from terrorist threats.

With the support of Congress and in particular the leadership of this committee,

the NIPCI program has rapidly developed in FBI field offices across the United

States, including here in Arizona. Today I will focus on the nature of the national

security and criminal threats we face in cyberspace, the progress we have made in

meeting those threats in the field, and the continuing challenges we face.

THE NIPC

The NIPC is an interagency Center located at the FBI. Created in 1998, the NIPC

serves as the focal point for the government’s efforts to warn of and respond to cyber

attacks, particularly those that are directed at our nation’s ‘‘critical infrastructures.’’

These infrastructures include telecommunications and information, energy, banking

and finance, transportation, government operations, and emergency services. Presidential Decision Directive (PDD) 63 directed that the NIPC serve as a ‘‘national critical infrastructure threat assessment, warning, vulnerability, and law enforcement

investigation and response entity.’’ The PDD further states that the mission of the

NIPC ‘‘will include providing timely warnings of intentional threats, comprehensive

analyses and law enforcement investigation and response.’’

In field offices such as Phoenix, we have created a cyber crime investigative program called the National Infrastructure Protection and Computer Intrusion (NIPCI)

Program. This program, managed by the NIPC, consists of special agents in each

FBI Field Office who are responsible for investigating computer intrusions, viruses,

or denial of service attacks, for implementing our key asset initiative, and for conducting critical liaison activities with private industry. Cyber crime task forces are

being developed in partnership with state and local law enforcement entities within

their jurisdiction to leverage the limited resources in this area. The first one opened

in Pittsburgh last month.

THE BROAD SPECTRUM OF THREATS

Cybercrime threats faced by law enforcement

Before discussing the FBI’s programs and requirements with respect to

cybercrime, let me take a few minutes to discuss the dimensions of the problem. The

FBI’s case load is increasing dramatically. In fiscal year 1998, it opened 547 computer intrusion cases; in fiscal year 1999, that had jumped to 1,154. At the same

time, because of the opening the National Infrastructure Protection Center (NIPC)

in February 1998, and improving ability to fight cyber crime, more cases were

72

closed. In fiscal year 1998, 399 intrusion cases were closed, and in fiscal year 1999,

912 such cases were closed. However, given the exponential increase in the number

of cases opened, cited above, the actual number of pending cases has increased by

39 percent, from 601 at the end of fiscal year 1998, to 834 at the end of fiscal year

1999. In short, even though the FBI has markedly improved its capabilities to fight

cyber intrusions, the problem is growing even faster. A few days ago the Computer Security Institute released its fifth annual ‘‘Computer Crime and Security Survey.’’ The results only confirm what we had already suspected given our burgeoning case load, that more companies surveyed are reporting intrusions, that dollar losses are increasing, that insiders remain a serious

threat, and that more companies are doing more business on the Internet than ever

before.

The statistics tell the story. Ninety percent of respondents detected security breaches over the last 12 months. At least 74 percent of respondents reported security breaches including theft of proprietary information, financial fraud, system penetration by outsiders, data or network sabotage, or denial of service attacks. Information theft and financial fraud caused the most severe financial losses, put at $68

million and $56 million respectively. The losses from 273 respondents totaled just

over $265 million. Losses traced to denial of service attacks were only $77,000 in

1998, and by 1999 had risen to just $116,250. Further, the new survey reports on

numbers taken before the high-profile February attacks against Yahoo, Amazon and

eBay. Finally, many companies are experiencing multiple attacks; 19 percent of respondents reported 10 or more incidents.

Over the past several years the FBI has seen a range of computer crimes from defacement of websites by juveniles to sophisticated intrusions that we suspect may

be sponsored by foreign powers, and everything in between. Some of these are obviously more significant than others. The theft of national security information from

a government agency or the interruption of electrical power to a major metropolitan

area have greater consequences for national security, public safety, and the economy

than the defacement of a web-site. But even the less serious categories have real

consequences and, ultimately, can undermine confidence in e-commerce and violate

privacy or property rights. A website hack that shuts down an e-commerce site can

have disastrous consequences for a business. An intrusion that results in the theft

of credit card numbers from an online vendor can result in significant financial loss

and, more broadly, reduce consumers’ willingness to engage in e-commerce. Because of these implications, it is critical that we have in place the programs and resources

to investigate and, ultimately, to deter these sorts of crimes. The following are some of the categories of cyber threats that we confront today.

Insiders. The disgruntled insider (a current or former employee of a company) is a principal source of computer crimes for many companies. Insiders’ knowledge of the target companies’ network often allows them to gain unrestricted access to cause

damage to the system or to steal proprietary data. The just-released 2000 survey

by the Computer Security Institute and FBI reports that 71 percent of respondents

detected unauthorized access to systems by insiders.

In January and February 1999 the National Library of Medicine (NLM) computer

system, relied on by hundreds of thousands of doctors and medical professionals

from around the world for the latest information on diseases, treatments, drugs, and

dosage units, suffered a series of intrusions where system administrator passwords

were obtained, hundreds of files were downloaded which included sensitive medical

‘‘alert’’ files and programming files that kept the system running properly. The intrusions were a significant threat to public safety and resulted in a monetary loss

in excess of $25,000. FBI investigation identified the intruder as Montgomery Johns

Gray, III, a former computer programmer for NLM, whose access to the computer

system had been revoked. Gray was able to access the system through a ‘‘backdoor’’

he had created in the programming code. Due to the threat to public safety, a search

warrant was executed for Gray’s computers and Gray was arrested by the FBI within a few days of the intrusions. Subsequent examination of the seized computers disclosed evidence of the intrusion as well as images of child pornography. Gray was

convicted by a jury in December 1999 on three counts for violation of Title 18 U.S.C.

§ 1030. Subsequently, Gray pleaded guilty to receiving obscene images through the

Internet, in violation of 47 U.S.C. 223.

Hackers. Hackers (or ‘‘crackers’’) are also a common threat. They sometimes crack

into networks simply for the thrill of the challenge or for bragging rights in the

hacker community. Recently, however, we have seen more cases of hacking for illicit

financial gain or other malicious purposes.

While remote cracking once required a fair amount of skill or computer knowledge, hackers can now download attack scripts and protocols from the World Wide

Web and launch them against victim sites. Thus while attack tools have become

73

more sophisticated, they have also become easier to use. The distributed denial-ofservice (DDOS) attacks last month are only the most recent illustration of the economic disruption that can be caused by tools now readily available on the Internet. Another recent case illustrates the scope of the problem. In March, authorities in

the United Kingdom, acting in coordination with the FBI, arrested two individuals

for alleged intrusions into e-commerce sites in several countries and the theft of

credit card information on over 26,000 accounts. One subject used the Internet alias

‘‘CURADOR.’’ Losses from this case could exceed $3,000,000. The FBI cooperated

closely with the Dyfed-Powys Police Service in the United Kingdom, the Royal Canadian Mounted Police in Canada, and private industry. This investigation involved

the Philadelphia Division, seven other FBI field offices, our Legal Attache in London, and the NIPC. This case demonstrates the close partnerships that we have

built with our foreign law enforcement counterparts and with private industry. We are making some progress in convicting hackers. For example, on March 8, 2000, FBI Boston Division and New Hampshire Police arrested Dennis M. Moran,

aka COOLIO, in association with the unauthorized intrusion and changes made to

the Drug Abuse Resistance Education’s (DARE) Web site, violating New Hampshire State Laws 638: 17 and 638: 18(I), unauthorized access into a computer system, unauthorized changes to a computer system and damage to a computer system exceeding $1,000.00. It is anticipated that the New Hampshire State Attorney’s Office will

prosecute Moran, who is 17, as an adult. The United States Attorney’s Office for

the District of New Hampshire has therefore deferred prosecution of Moran to the

State.

In April, Patrick Gregory, the co-founder of the hacker group known as ‘‘Global

Hell,’’ was convicted of a single count of conspiracy to commit telecommunications wire fraud and computer hacking in Texas U.S. District Court. He currently awaits

sentencing.

Virus Writers. Virus writers are posing an increasingly serious threat to networks and systems worldwide. Last year saw the proliferation of several destructive computer viruses or ‘‘worms,’’ including the Melissa Macro Virus, the Explore.Zip worm, and the CIH (Chernobyl) Virus. The NIPC frequently sends out warnings or

advisories regarding particularly dangerous viruses, which can allow potential victims to take protective steps and minimize the destructive consequences of a virus.

The Melissa Macro Virus was a good example of the NIPC’s two-fold response— encompassing both warning and investigation—to a virus spreading in the net- works. The NIPC sent out warnings as soon as it had solid information on the virus

and its effects; these warnings helped alert the public and reduce the potential destructive impact of the virus. On the investigative side, the NIPC acted as a central

point of contact for the field offices who worked leads on the case. A tip received

by the New Jersey State Police from America Online, and their follow-up investigation with the FBI’s Newark Division, led to the April 1, 1999 arrest of David L.

Smith. Mr. Smith pleaded guilty to one count of violating 18 U.S.C. § 1030 in Federal Court, and to four state felony counts. As part of his guilty plea, Smith stipulated to affecting one million computer systems and causing $80 million in damage.

Smith is awaiting sentencing.

Criminal Groups. We are also seeing the increased use of cyber intrusions by

criminal groups who attack systems for purposes of monetary gain. In September,

1999, two members of a group dubbed the ‘‘Phonemasters’’ were sentenced after

their conviction for theft and possession of unauthorized access devices (18 USC

§ 1029) and unauthorized access to a federal interest computer (18 USC § 1030). The

‘‘Phonemasters’’ were an international group of criminals who penetrated the computer systems of MCI, Sprint, AT&T, Equifax, and even the National Crime Information Center. Under judicially approved electronic surveillance orders, the FBI’s

Dallas Division made use of new technology in the investigation. One suspect, Mr.

Calvin Cantrell, downloaded thousands of Sprint calling card numbers, which he

sold to a Canadian individual, who passed them on to someone in Ohio. These numbers made their way to an individual in Switzerland and eventually ended up in

the hands of organized crime groups in Italy. Cantrell was sentenced to two years

as a result of his guilty plea, while one of his associates, Cory Lindsay, was sentenced to 41 months.

The Phonemasters’ methods included ‘‘dumpster diving’’ to gather old phone books

and technical manuals for systems. They used this information to trick employees

into giving up their logon and password information. The group then used this information to break into victim systems. It is important to remember that often ‘‘cyber

crimes’’ are facilitated by old fashioned guile, such as calling employees and tricking

them into giving up passwords. Good cyber security practices must therefore address personnel security and ‘‘social engineering’’ in addition to instituting electronic

security measures.

74

Beyond criminal threats in cyber space, we also face a variety of significant na- tional security threats

Terrorists. Terrorists groups are increasingly using new information technology and the Internet to formulate plans, raise funds, spread propaganda, and to communicate securely. In his statement on the worldwide threat in 2000, Director of Central Intelligence George Tenet testified that terrorists groups, ‘‘including Hizbollah, HAMAS, the Abu Nidal organization, and Bin Laden’s al Qa’ida organization are using computerized files, e-mail, and encryption to support their operations.’’ In one

example, convicted terrorist Ramzi Yousef, the mastermind of the World Trade Center bombing, stored detailed plans to destroy United States airliners on encrypted

files on his laptop computer. While we have not yet seen these groups employ cyber

tools as a weapon to use against critical infrastructures, their reliance on information technology and acquisition of computer expertise are clear warning signs. Moreover, we have seen other terrorist groups, such as the Internet Black Tigers (who

are reportedly affiliated with the Tamil Tigers), engage in attacks on foreign government websites and e-mail servers. ‘‘Cyber terrorism’’—by which I mean the use of cyber tools to shut down critical national infrastructures (such as energy, transportation, or government operations) for the purpose of coercing or intimidating a government or civilian population—is thus a very real, though still largely potential, threat.

Foreign intelligence services. Not surprisingly, foreign intelligence services have

adapted to using cyber tools as part of their espionage tradecraft. Even as far back

as 1986, before the worldwide surge in Internet use, the KGB employed West German hackers to access Department of Defense systems in the well-known ‘‘Cuckoo’s

Egg’’ case. Foreign intelligence services increasingly view computer intrusions as a

useful tool for acquiring sensitive U.S. Government and private sector information.

More recently, we observed a series of intrusions into numerous Department of

Defense and other federal government computer networks and private sector entities. Investigation last year determined that the intrusions appear to have originated in Russia. The intruder successfully accessed U.S. Government networks and

took large amounts of unclassified but sensitive information, including defense technical research information. The NIPC coordinated a multi-agency investigation,

working closely with FBI field offices, the Department of Defense, and the Intelligence Community.

Information Warfare. The prospect of ‘‘information warfare’’ by foreign militaries

against our critical infrastructures is perhaps the greatest potential cyber threat to

our national security. We know that several foreign nations are developing information warfare doctrine, programs, and capabilities for use against the United States

or other nations. Knowing that they cannot match our military might with conventional or ‘‘kinetic’’ weapons, some nations see cyber attacks on our critical infrastructures or military operations as a way to hit what they perceive as America’s

Achilles heel—our growing dependence on information technology in government

and commercial operations. For example, two Chinese military officers recently published a book that called for the use of unconventional measures, including the propagation of computer viruses, to counterbalance the military power of the United

States. And a Russian official has also commented that an attack on a national infrastructure could, ‘‘by virtue of its catastrophic consequences, completely overlap

with the use of [weapons] of mass destruction.’’

Distributed denial of service tools

The recent distributed denial of service (DDOS) attacks on e-commerce sites have

garnered a tremendous amount of interest in the public and in the Congress. While

we do not yet have official damage estimates, the Yankee Group, a research firm,

estimates the impact of the attacks at $1.2 billion due to lost capitalization losses,

lost revenues, and security upgrades. Because we are actively investigating these attacks, I cannot provide a detailed briefing on the status of our efforts. However, I

can provide an overview of our activities to deal with the DDOS threat beginning

last year and of our investigative efforts. These attacks illustrate the growing availability of destructive, yet easy-to-use, exploits that are widely available on the Internet. They also demonstrate the NIPC’s two-fold mission: sharing information with

the private sector and warning of possible threats, and responding to actual attacks.

In the fall of last year, the NIPC began receiving reports about a new set of ‘‘exploits’’ or attack tools collectively called distributed denial of service (or DDOS)

tools. DDOS variants include tools known as ‘‘Trin00,’’ ‘‘Tribal Flood Net’’ (TFN),

‘‘TFN2K,’’ and ‘‘Stacheldraht’’ (German for ‘‘barbed wire’’). These tools essentially

work as follows: hackers gain unauthorized access to a computer system(s) and

place software code on it that renders that system a ‘‘master’’ (or a ‘‘handler’’). The

hackers also intrude into other networks and place malicious code which makes

75

those systems into agents (also known as ‘‘zombies’’ or ‘‘daemons’’ or ‘‘slaves’’). Each

Master is capable of controlling multiple agents. In both cases, the network owners

normally are not aware that dangerous tools have been placed and reside on their

systems, thus becoming third-party victims to the intended crime. The ‘‘Masters’’ are activated either remotely or by internal programming (such as a command to begin an attack at a prescribed time) and are used to send information to the agents, activating their DDOS ability. The agents then generate numerous requests to connect with the attack’s ultimate target(s), typically using a fictitious or ‘‘spoofed’’ IP (Internet Protocol) address, thus providing a falsified identity as to the source of the request. The agents act in unison to generate a high volume

of traffic from several sources. This type of attack is referred to as a SYN flood, as

the SYN is the initial effort by the sending computer to make a connection with the

destination computer. Due to the volume of SYN requests the destination computer

becomes overwhelmed in its efforts to acknowledge and complete a transaction with

the sending computers, degrading or denying its ability to complete service with legitimate customers—hence the term ‘‘Denial of Service’’. These attacks are especially damaging when they are coordinated from multiple sites—hence the term Distributed Denial of Service.

An analogy would be if someone launched an automated program to have hun- dreds of phone calls placed to the Capitol switchboard at the same time. All of the

good efforts of the staff would be overcome. Many callers would receive busy signals

due to the high volume of telephone traffic. In November and December, the NIPC received reports that universities and others were detecting the presence of hundreds of agents on their networks. The number of agents detected clearly could have been only a small subset of the total number of agents actually deployed. In addition, we were concerned that some malicious

actors might choose to launch a DDOS attack around New Year’s Eve in order to

cause disruption and gain notoriety due to the great deal of attention that was being

paid to the Y2K rollover. Accordingly, we decided to issue a series of alerts in December to government agencies, industry, and the public about the DDOS threat. Moreover, in late December, it was determined that a detection tool that was developed by the NIPC for investigative purposes might also be used by network operators to detect the presence of DDOS agents or masters on their operating systems,

and thus would enable them to remove an agent or master and prevent the network

from being unwittingly utilized in a DDOS attack. Moreover, at that time there was,

to our knowledge, no similar detection tool available commercially. The NIPC therefore decided to take the unusual step of releasing the tool to the Department of Defense, other government agencies, and to the public in an effort to reduce the level

of the threat. The first variant of our software was made available on the NIPC web

site on December 30, 1999. To maximize the public awareness of this tool, we announced its availability in an FBI press release that same date. Since the first posting of the tool, we have posted three updated versions that have perfected the software and made it applicable to different operating systems.

The public has downloaded these tools tens of thousands of times from the web

site, and has responded by reporting many installations of the DDOS software,

thereby preventing their networks from being used in attacks and leading to the

opening of criminal investigations both before and after the widely publicized attacks of the last few weeks. The work with private companies has been so well received that the trade group SANS awarded their yearly Security Technology Leadership Award to members of the NIPC’s Special Technologies Applications Unit.

In February, reports were received that a new variation of DDOS tools was being

found on Windows operating systems. One victim entity provided us with the object

code to the tool found on its network. On February 18 the binaries were made available to anti-virus companies (through an industry association) and the Computer

Emergency Response Team (CERT) at Carnegie Mellon University for analysis and

so that commercial vendors could create or adjust their products to detect the new

DDOS variant. Given the attention that DDOS tools have received in recent weeks,

there are now numerous detection and security products to address this threat, so

it was determined that the NIPC could be most helpful by giving them the necessary code rather than deploying a detection tool ourselves.

Unfortunately, the warnings that we and others in the security community had

issued about DDOS tools last year, while alerting many potential victims and reducing the threat, did not eliminate the threat. Quite frequently, even when a threat

is known and patches or detection tools are available, network operators either remain unaware of the problem or fail to take necessary protective steps. In addition,

in the cyber equivalent of an arms race, exploits evolve as hackers design variations

to evade or overcome detection software and filters. Even security-conscious companies that put in place all available security measures therefore are not invulnerable.

76

And, particularly with DDOS tools, one organization might be the victim of a successful attack despite its best efforts, because another organization failed to take

steps to keep itself from being made the unwitting participant in an attack.

On February 7, 2000, the NIPC received reports that Yahoo had experienced a

denial of service attack. In a display of the close cooperative relationship that we

have developed with the private sector, in the days that followed, several other companies (including Cable News Network, eBay, Amazon.com, Buy.com, and ZDNET),

also reported denial of service outages to the NIPC or FBI field offices. These companies cooperated with us by providing critical logs and other information. Still, the

challenges to apprehending the suspects are substantial. In many cases, the

attackers used ‘‘spoofed’’ IP addresses, meaning that the address that appeared on

the target’s log was not the true address of the system that sent the messages. In

addition, many victims do not keep complete network logs.

The resources required in an investigation of this type are substantial. Companies

have been victimized or used as ‘‘hop sites’’ in numerous places across the country,

meaning that we must deploy special agents nationwide to work leads. We currently

have seven FBI field offices with cases opened and all the remaining offices are supporting the offices that have opened cases. Agents from these offices are following

up literally hundreds of leads. The NIPC is coordinating the nationwide investigative effort, performing technical analysis of logs from victims sites and Internet

Service Providers (ISP’s), and providing all-source analytical assistance to field offices. Moreover, parts of the evidentiary trail have led overseas, requiring us to

work with our foreign counterparts in several countries through our Legal Attaches

(Legats) in U.S. embassies. Here in Phoenix we followed up on leads resulting from

the DDOS attacks.

While the crime may be high tech, investigating it involves a substantial amount

of traditional investigative work as well as highly technical work. Interviews of network operators and confidential sources can provide very useful information, which

leads to still more interviews and leads to follow-up. And victim sites and ISP’s provide an enormous amount of log information that needs to be processed and analyzed by human analysts.

CHALLENGES IN COMBATING CYBER INTRUSIONS

The burgeoning problem of cyber intrusions, viruses, and denial of service attacks

poses unique challenges to the NIPC. These challenges require novel solutions, close

teamwork among agencies and with the private sector, and adequate human and

technical resources.

Identifying the Intruder. One major difficulty that distinguishes cyber threats

from physical threats is determining who is attacking your system, why, how, and

from where. This difficulty stems from the ease with which individuals can hide or

disguise their tracks by manipulating logs and directing their attacks through networks in many countries before hitting their ultimate target. The ‘‘Solar Sunrise’’

case illustrates this point. This will continue to pose a problem as long as the Internet remains rife with vulnerabilities and allows easy anonymity and concealment.

Jurisdictional Issues. Another significant challenge we face is intrusions involving

multiple jurisdictions. A typical investigation involves victim sites in multiple states

and often many countries. This is the case even when the hacker and victim are

both located in the United States. In the United States, we can subpoena records,

engage in judicially approved electronic surveillance, and execute search warrants

on suspects’ homes, seize evidence, and examine it. We can do none of those things

ourselves overseas; rather, we depend on the local authorities to assist us. However,

some local police forces do not have the technical resources or expertise to provide

assistance. In other cases, these nations may not have laws against computer intrusions and are therefore limited in their ability to help us. FBI Legal Attaches in

35 embassies abroad provide critical help in building bridges with local law enforcement to enhance cooperation on cyber crime and in working leads on investigations.

As the Internet spreads to even more countries, we will see greater demands placed

on the Legats to support computer crime investigations. The NIPC also has held

international computer crime conferences and offered cyber crime training classes

to foreign law enforcement officials to develop liaison contacts and bring these officials up to speed on cyber crime issues.

The most difficult situation will arise, however, in which a foreign country with

interests adverse to our own simply refuses to cooperate. In such a situation, we

could find that an investigation is stymied unless we find an alternative method of

tracing the activity back to its source.

77

THE LEGAL LANDSCAPE

To deal with this crime problem, we must look at whether changes to the legal procedures governing investigation and prosecution of cyber crimes are warranted.

The problem of Internet crime has grown at such a rapid pace that the laws have

not kept up with the technology. The FBI is working with the Department of Justice

to propose a legislative package for your review to help keep our laws in step with

these advances.

One example of some of the problems law enforcement is facing is the jurisdic- tional limitation of pen registers and trap-and-trace orders issued by federal district

courts. These orders allow only the capturing of tracing information, not the content

of communications. Currently, in order to track back a hacking episode in which a

single communication is purposely routed through a number of Internet Service Providers that are located in different states, we generally have to get multiple court

orders. This is because, under current law, a federal court can order communications carriers only within its district to provide tracing information to law enforcement. As a result of the fact that investigators typically have to apply for numerous

court orders to trace a single communication, there is a needless waste of time and

resources, and a number of important investigations are either hampered or derailed entirely in those instances where law enforcement gets to a communications

carrier after that carrier has already discarded the necessary information. For example, Kevin Mitnick evaded attempts to trace his calls by moving around the country and by using cellular phones, which routed calls through multiple carriers on

their way to the final destination. It was impossible to get orders quickly enough

in all the jurisdictions to trace the calls.

Finally, we should consider whether current sentencing provisions for computer

crimes provide an adequate deterrence. Given the degree of harm that can be

caused by a virus, intrusion, or a denial of service—in terms of monetary loss to

business and consumers, infringement of privacy, or threats to public safety when

critical infrastructures are affected—it would be appropriate to consider, as S. 2092

does, whether penalties established years ago remain adequate.

Evaluation of the effectiveness of 18 U.S.C. § 1030 and the tools to enforce it under

both current law and under S. 2092.—Generally, 18 U.S.C. § 1030 has enabled the

FBI and other law enforcement agencies to investigate and prosecute persons who

would use the power of the Internet and computers for criminal purposes. Nonetheless, just as computer crime has evolved over the years, so too must our laws and

procedures evolve to meet the changing nature of these crimes.

One persistent problem is the need under current law to demonstrate at least

$5,000 in damage for certain hacking offenses enumerated by 18 U.S.C. § 1030(a)(5).

In some of the cases investigated by the FBI, damages in excess of $5,000 on a particular system are difficult to prove. In other cases, the risk of harm to individuals

or to the public safety posed by breaking into numerous systems and obtaining root

access, with the ability to destroy the confidentiality or accuracy of crucial—perhaps

lifesaving information—is very real and very serious even if provable monetary

damages never approach the $5,000 mark. In investigations involving the dissemination or importation of a virus or other malicious code, the $5,000 threshold could

potentially delay or hinder early intervention by Federal law enforcement.

S. 2092 significantly adjusts the $5,000 threshold and other provisions in the current law by: (1) creating a misdemeanor offense for those cases where damages are

below $5,000, while simultaneously adjusting the minimum mandatory sentences

under the Sentencing Guidelines; and (2) moving the aggravating factors previously

included in the definition of‘‘damage’’ under 18 U.S.C. § 1030(e)(8) (such as impairment of medical diagnosis, physical injury to any person, threat to public health or

safety or damage to nation security, national defense or administration of justice

computers) to the general sentencing provisions of § 1030(c) (where they will be on

par in serious cases with the existing $5,000 threshold requirement and will expose

offenders to an enhanced 10-year period of imprisonment up from the current maximum of 5 years). The critical element here is that the criminal intended to cause

damage, not the specific amount of damage he intended to cause

Another issue involves the alarming number of computer hackers encountered in

our investigations who are juveniles. Under current law, Federal authorities are not

able to prosecute juveniles for any computer violations of 18 U.S.C. § 1030. S. 2092

would authorize (but not require) the Attorney General to certify for juvenile prosecution in Federal court youthful offenders who commit the more serious felony violations of section 1030. Recognizing that this change will, over time, result in the

prosecution of repeat offenders, S. 2092 also defines the term ‘‘conviction’’ under

§ 1030 to include prior adjudications of juvenile delinquency for violations of that

section. This is intended to provide greater specific deterrence to juveniles who are

78

adjudicated delinquent for computer hacking. Similarly, a majority of the States

have enacted criminal statutes prohibiting unauthorized computer access analogous

to the provisions of section 1030. As State prosecutions for these offenses increase,

the likelihood of encountering computer offenders in Federal investigations who

have prior State convictions will similarly rise. The Department is studying whether

prior state adult convictions for comparable computer crimes justify enhanced penalties for violations of section 1030, just as prior State convictions for drug offenses

trigger enhanced penalties for comparable Federal drug violations.

Law enforcement also needs updated tools to investigate, identify, apprehend and

successfully prosecute computer offenders. Today’s electronic crimes, which occur at

the speed of light, cannot be effectively investigated with procedural devices forged

in the last millennium during the infancy of the information technology age. Statutes need to be rendered technology neutral so that they can be applied regardless

of whether a crime is committed with pen and paper, e-mail, telephone or geosynchronous orbit satellite personal communication devices.

As discussed above, a critical factor in the investigation of computer hacking cases

is law enforcement’s ability to swiftly identify the source and the direction of a hacker’s communications. Like all law enforcement agencies, the FBI relies upon the pen

register and trap and trace provisions contained in 18 U.S.C. § 3121 et seq. to seek

court approval to acquire data identifying non-content information relating to a suspect’s communications. Our ability to identify the perpetrators of crimes like computer hacking is directly proportional to our ability to quickly acquire the necessary

court orders and quickly serve them upon one or more service providers in a communications chain. Under current law, however, valuable time is consumed in acquiring individual court orders in the name of each communications company for each

newly discerned link in the communications chain even though the legal justification for the disclosure remains unchanged and undiminished. S. 2092 would amend

18 U.S.C. § 3123(a) to authorize Federal courts to issue one nation-wide order which

may then be served upon one or more service providers thereby substantially reducing the time necessary to identify the complete pathway of a suspect’s communication. Second, S. 2092 makes the statute more technology neutral by, among other

things, inserting the terms ‘‘or other facility’’ wherever ‘‘telephone’’ appears. This

change codifies Federal court decisions that apply the statute’s provisions not merely to traditional telephone, but to an ever expanding array of other, communications

facilities. Together, these are important changes that do not alter or lower the showing necessary for the issuance of the court order but which do enhance the order’s

usefulness to law enforcement.

We support the goal of S. 2092 to strengthen the general deterrence aspects of

the Computer Fraud and Abuse Act, and to provide some needed procedural enhancements to help us confront the expanding criminal threat in this dynamic and

important part of our national economy while continuing to protect individual privacy interests. The FBI looks forward to working with the Committee on this important legislation.

INTERAGENCY COOPERATION

The broad spectrum of cyber threats described earlier, ranging from hacking to

foreign espionage and information warfare, requires not just new technologies and

skills on the part of investigators, but new organizational constructs as well. In

most cyber attacks, the identity, location, and objective of the perpetrator are not

immediately apparent. Nor is the scope of his attack—i.e., whether an intrusion is

isolated or part of a broader pattern affecting numerous targets. This means it is

often impossible to determine at the outset if an intrusion is an act of cyber vandalism, organized crime, domestic or foreign terrorism, economic or traditional espionage, or some form of strategic military attack. The only way to determine the

source, nature, and scope of the incident is to gather information from the victim

sites and intermediate sites such as ISP’s and telecommunications carriers. Under

our constitutional system, such information typically can be gathered only pursuant

to criminal investigative authorities. This is why the NIPC is part of the FBI, allowing us to utilize the FBI’s legal authorities to gather and retain information and to

act on it, consistent with constitutional and statutory requirements.

But the dimension and varied nature of the threats also means that this is an

issue that concerns not just the FBI and law enforcement agencies, but also the Department of Defense, the Intelligence Community, and civilian agencies with infrastructure-focused responsibility such as the Departments of Energy and Transportation. It also is a matter that greatly affects state and local law enforcement. This

is why the NIPC is an interagency center, with representatives detailed to the FBI

from numerous federal agencies and representation from state and local law enforceVerDate 11-MAY-2000 15:11 Jan 26, 2001 Jkt 000000 PO 00000 Frm 00082 Fmt 6633 Sfmt 6621 69335.XXX SJUD2 PsN: SJUD2
79

ment as well. These representatives operate under the direction and authority of the

FBI, but bring with them expertise and skills from their respective home agencies

that enable better coordination and cooperation among all relevant agencies, consistent with applicable laws.

In Phoenix, we work closely with the U.S. military as well as other government

agencies. For example, we have worked with U.S. military installations located in

Arizona on attempted intrusions into their systems. The expansion of cyber task

forces, such as the one just started in Pittsburgh, to other field divisions such as

Phoenix, should assist us with interagency cooperation.

PRIVATE SECTOR COOPERATION

Our success in battling cyber crime also depends on close cooperation with private

industry. This is the case for several reasons. First, most of the victims of cyber

crimes are private companies. Therefore, successful investigation and prosecution of

cyber crimes depends on private victims reporting incidents to law enforcement and

cooperating with the investigators. Contrary to press statements by cyber security

companies that private companies won’t share information with law enforcement,

many private companies have reported incidents and threats to the NIPC or FBI

field offices. While there are undoubtedly companies that would prefer not to report

a crime because of the subsequent loss of consumer confidence, the situation has improved markedly. Companies increasingly realize that deterrence of crime depends

on effective law enforcement, and that the long-term interests of industry depend

on establishing a good working relationship with government to prevent and investigate crime.

Second, the network administrator at a victim company or ISP is critical to the

success of an investigation. Only that administrator knows the unique configuration

of their system, and the administrator typically must work with an investigator to

find critical transactional data that will yield evidence of a criminal’s activity.

Third, the private sector has the technical expertise that is often critical to resolving an investigation. It would be impossible for us to retain experts in every possible

operating system or network configuration, so private sector assistance is critical.

In addition, many investigations require the development of unique technical tools

to deal with novel problems. Private sector assistance has been critical there as

well.

We have several other initiatives devoted to private sector outreach that bear

mentioning here. The first is called ‘‘InfraGard.’’ This is an initiative that we have

developed in concert with private companies and academia to encourage information-sharing about cyber intrusions, exploited vulnerabilities, and physical infrastructure threats. A vital component of InfraGard is the ability of industry to provide information on intrusions to the local FBI field office using secure e-mail communications in both a ‘‘sanitized’’ and detailed format. The local FBI field offices

can, if appropriate, use the detailed version to initiate an investigation; while NIPC

Headquarters can analyze that information in conjunction with other information

we obtain to determine if the intrusion is part of a broader attack on numerous

sites. The NIPC can simultaneously use the sanitized version to inform other members of the intrusion without compromising the confidentiality of the reporting company. The key to this system is that whether, and what, to report is entirely up

to the reporting company. A secure web site also contains a variety of analytic and

warning products that we make available to the InfraGard community. The success

of InfraGard is premised on the notion that sharing is a two-way street: the NIPC

will provide threat information that companies can use to protect their systems,

while companies will provide incident information that can be used to initiate an

investigation and to warn other companies.

Here in Phoenix, we are planning to roll-out our InfraGard Chapter on May 9.

We expect to have representatives from in state universities, businesses, and some

of the critical infrastructures on hand.

Our Key Asset Initiative (KAI) is focused more specifically on the owners and operators of critical components of each of the infrastructure sectors. It facilitates response to threats and incidents by building liaison and communication links with

the owners and operators of individual companies and enabling contingency planning. The KAI began in the 1980’s and focused on physical vulnerabilities to terrorism. Under the NIPC, the KAI has been reinvigorated and expanded to focus on

cyber vulnerabilities as well. The KAI currently involves determining which assets

are key within the jurisdiction of each FBI Field Office and obtaining 24-hour points

of contact at each asset in cases of emergency. Eventually, if future resources permit, the initiative will include the development of contingency plans to respond to

attacks on each asset, exercises to test response plans, and modeling to determine

80

the effects of an attack on particular assets. FBI field offices are responsible for developing a list of the assets within their respective jurisdictions, while the NIPC

maintains the national database. The KAI is being developed in coordination with

DOD and other agencies. Currently the database has about 2,600 entries. This represents 2,600 contacts with key private sector nodes made by the NIPC and FBI

field offices.

Here in the Phoenix Division, we have identified dozens of key assets around the

state for inclusion in the national list. These assets include power generation facilities, water storage and distribution centers, transportation assets, military installations, research institutions, and key public emergency service entities.

Much has been said over the last few years about the importance of information

sharing. Here in the Phoenix Division, we have an excellent working relationship

with our private sector counterparts and the community in general. We share information on a number of areas, including infrastructure protection, and receive information from the private sector that greatly assist us in protecting the community.

As a result of our close working relationship with the private sector we can detect

criminal activity in its initial stages and in some cases prevent criminal incidents.

The NIPC also provides the private sector with warning information which also

lessens their vulnerability. These warnings assist field offices like Phoenix to be better prepared and better protect our community. They further allow us the opportunity to respond quickly and efficiently to cyber threats. I believe that as companies continue to gain experience in dealing with the NIPC and FBI field offices, as

we continue to provide them with important and useful threat information, and as

companies recognize that cyber crime requires a joint effort by industry and government together, we will continue to make real progress in this area.

MEETING THE GROWING CYBER THREAT

As Internet use continues to soar, the number of cyber attacks is also increasing

exponentially. Nationally there are over 1000 open computer intrusion cases. Further, this figure does not count computer facilitated crimes such as Internet fraud,

child pornography, or e-mail extortion efforts. In these cases, the NIPC and NIPCI

squads often provide technical assistance to traditional investigative programs responsible for these categories of crime.

We can clearly expect these upward trends to continue, and for the threats to become more serious. While insiders, hackers, and criminal groups make up much of

our case load at the moment, we can anticipate a growing number of national security cases in the near future. To meet this challenge, we must ensure that we have

adequate resources, including both personnel and equipment, both at the NIPC and

in FBI field offices. We currently have 193 agents nationwide dedicated to investigating computer intrusion and virus cases. In order to maximize investigative resources the FBI has taken the approach of creating regional squads in 16 field offices that have sufficient size to work complex intrusion cases and to assist those

field offices without a NIPCI squad. In those field offices without squads, the FBI

is building a baseline capability by having one or two agents work NIPC matters,

i.e. computer intrusions (criminal and national security), viruses, InfraGard, state

and local liaison, etc.

The Phoenix office has a three agent team working on infrastructure protection

and computer intrusion matters. Three agents are assigned to investigate cyber

child pornography, and additional four agents are assigned to the Computer Assisted Response Team (CART), which is responsible to provide cyber forensics in

support of all the cyber investigations in the Phoenix office. Since January 1, 2000

the Phoenix office has opened 9 new computer intrusion cases. This represents an

almost 100 percent increase in computer intrusion cases opened in 1999.

Currently, at NIPC Headquarters, there are 101 personnel on board, including 82

FBI employees and 19 detailees from other government agencies. This cadre of investigators, computer scientists, and analysts perform the numerous and complex

tasks outlined above, and provide critical coordination and support to field office investigations. As the crime problem grows, we need to make sure that we keep pace

by bringing on board additional personnel, including from other agencies and the

private sector.

In addition to putting in place the requisite number of agents, analysts, and computer scientists in the NIPC and in FBI field offices, we must fill those positions

by recruiting and retaining personnel who have the appropriate technical, analytical, and investigative skills. This includes personnel who can read and analyze complex log files, perform all-source analysis to look for correlations between events or

attack signatures and glean indications of a threat, develop technical tools to address the constantly changing technological environment, and conduct complex netVerDate 11-MAY-2000 15:11 Jan 26, 2001 Jkt 000000 PO 00000 Frm 00084 Fmt 6633 Sfmt 6621 69335.XXX SJUD2 PsN: SJUD2
81

work investigations. There is a very tight market for information technology professionals. The Federal Government needs to be able to recruit the very best people

into its programs. Fortunately, we can offer exciting, cutting-edge work in this area

and can offer agents, analysts, and computer scientists the opportunities to work on

issues that no one else addresses, and to make a difference to our national security

and public safety. In addition, Congress provided the FBI with a pilot program that

exempts certain technical personnel from the Title V civil service rules, which allows us to pay more competitive salaries and recruit and retain top notch personnel.

Unfortunately, this pilot is scheduled to expire in November unless extended Training and continuing education are also critical, and we have made this a top priority at the NIPC. In fiscal year 1999, we trained 383 FBI and other-governmentagency students in NIPC sponsored training classes on network investigations and

infrastructure protection. The emphasis for 2000 is on continuing to train federal

personnel while expanding training opportunities for state and local law enforcement personnel. During fiscal year 2000, we plan to train approximately 740 personnel from the FBI, other federal agencies, and state and local law enforcement. Developing and deploying the best equipment in support of the mission is also very important. Not only do investigators and analysts need the best equipment to

conduct investigations in the rapidly evolving cyber system but the NIPC must be

on the cutting edge of cyber research and development. Conducting a network intrusion or denial-of-service investigation often requires analysis of voluminous amounts

of data. For example, one network intrusion case involving an espionage matter currently being investigated has required the analysis of 17.5 Terabytes of data. To

place this into perspective, the entire collection of the Library of Congress, if

digitized, would comprise only 10 Terabytes. The Yahoo DDOS attack involved approximately 630 Gigabytes of data, which is equivalent to enough printed pages to

fill 630 pickup trucks with paper. Technical analysis requires high capacity equipment to store, process, analyze, and display data. Again, as the crime problem

grows, we must ensure that our technical capacity keeps pace. We are also working

closely with other agencies to ensure that we leverage existing resources to the fullest extent possible.

THE ROLE OF LAW ENFORCEMENT

Finally, I would like to conclude by emphasizing two key points. The first is that our role in combating cyber crime is essentially two-fold: (1) preventing cyber attacks before they occur or limiting their scope by disseminating warnings and

advisories about threats so that potential victims can protect themselves; and (2) responding to attacks that do occur by investigating and identifying the perpetrator.

This is very much an operational role. Our role is not to determine what security

measures private industry should take, or to ensure that companies or individuals

take them. It is the responsibility of industry to ensure that appropriate security

tools are made available and are implemented. We certainly can assist industry by

alerting them to the actual threats that they need to be concerned about, and by

providing information about the exploits that we are seeing criminals use. But network administrators, whether in the private sector or in government, are the first

line of defense.

Second, in gathering information as part of our warning and response missions,

we rigorously adhere to constitutional and statutory requirements. Our conduct is

strictly limited by the Fourth Amendment, statutes such as Title III and ECPA, and

the Attorney General Guidelines. These rules are founded first and foremost on the

protection of privacy inherent in our constitutional system. Respect for privacy is

thus a fundamental tenet in all of our activities.

CONCLUSION

I want to thank the subcommittee again for giving me the opportunity to testify

here today. The cyber threat is real, multifarious, and growing. The FBI is moving

aggressively to meet this challenge by training investigators and analysts to investigate computer intrusion cases, equipping them with the latest technology, developing our analytic capabilities and warning mechanisms to head off or mitigate attacks, and closely cooperating with the private sector. We have already made considerable progress in developing our capabilities to protect public safety and national

security in the Information Age. I look forward to working with Congress to ensure

that we continue to be able to meet the threat as it evolves and grows. Thank you.

Senator KYL. Thank you very much, Mr. Gonzalez.

Let me begin by asking both of you a question. Mr. Gonzalez, you

mentioned the multiple trap and trace issue, and I would like to

82

ask both of you a question about that. For the benefit of those who

aren’t familiar with it, currently Federal law requires that law enforcement obtain a separate court order for trap and trace authority in each jurisdiction through which a cyber attack travels. Obviously, it is important for law enforcement to be able to quickly

trace a source of an attack, as both witnesses have mentioned.

Could either of you give some examples of how investigations

have been bogged down by the need to get this trap and trace authority in each jurisdiction and how the legislation that Senator

Schumer and I have introduced, which would provide for national

trap and trace authority, would resolve that issue? Mr. Gonzalez.

Mr. GONZALEZ. Yes, Sir. Well, in terms of the ability to obtain

the national trap and trace orders, as you mentioned, timeliness is

of the essence. And because of the different nature of how companies involved in information technology deal with their records and

their record systems, some records are destroyed faster than others, it is imperative that we be able to get those orders in a timely

fashion and be able to get out to the place where we need to deliver

the orders to recoup the information.

If in the cases we mentioned—we talked about a case, for example, where the hacker’s victims are in three different States and to

get there we go through, say, multiple providers of either communications services or Internet technology services in different jurisdictions, we have to individually go to each one of those areas, provide the necessary information to get the court order. If we were

able to do it at one time, it would save us a tremendous amount

of time, and we could almost simultaneously be at all those different locations at one time and obtaining the information we need.

Senator KYL. Attorney General Napolitano.

Ms. NAPOLITANO. Yes, Senator, in response to your question,

there is a very big need for a Federal hot pursuit statute in cyberspace, and the bill that you and Senator Schumer have put forward

I think is going to be very, very valuable in that respect for many

of the problems that Special Agent Gonzalez has mentioned.

Let me give you two examples of cases where we have gotten

bogged down and have had to do an inordinate amount of work to

get a result.

One is the very recent case in Scottsdale where a juvenile sent

a threat via e-mail and basically shut down one of the middle

schools in Scottsdale while the police department and the bomb

dogs came out and looked to see whether there was anything to the

threat. While that was going on, our office was tracking down and

working with law enforcement to track down the source of the

e-mail, and we were trying to do it very, very quickly both because

of the school disruptions and because we didn’t know whether it

was a serious threat or not a serious threat.

To do that, we ultimately in the course of that investigation had

to obtain separate court orders in both California and Virginia to

identify the source of the e-mail. It would have been much better

as a State if we had access to a Federal hot pursuit law that would

have allowed us to get basically nationwide service of an order to

track that source.

A second example is one you may be familiar with, and it involved hacking into a local utility company. That ultimately reVerDate 11-MAY-2000 15:11 Jan 26, 2001 Jkt 000000 PO 00000 Frm 00086 Fmt 6633 Sfmt 6602 69335.XXX SJUD2 PsN: SJUD2
83

quired the prosecutors to get orders in very many States all over

the country to identify the source of the hacking into a utility company here.

So two concrete examples where we have been slowed down,

have had to do a lot of extra work, and it illustrates the need for

us to be able to speed up the process.

Senator KYL. And just to ensure that there is no invasion of privacy or inhibition of exercise of constitutional rights, would this nationwide trap and trace authority in any way diminish the constitutional rights of any of the entities from whom you are trying

to obtain information?

Ms. NAPOLITANO. No, it would not. You would still have to comply with the fourth amendment.

Senator KYL. And the fourth amendment requirements would require that the law enforcement officials do what with respect to obtaining an order?

Ms. NAPOLITANO. In terms of getting a trap and trace order?

Senator KYL. Yes.

Ms. NAPOLITANO. You would still have to get an order issued by

a court. The difference would be it would have nationwide application.

Senator KYL. So you would still have to prove the same kind of

probable cause to a judge for the issuance of the warrant that

would exist in any other situation?

Ms. NAPOLITANO. Yes. I assume the basic statutory and constitutional requirements for obtaining orders for traps and traces would

apply. The difference would be that we wouldn’t have to do it over

and over again for basically the same search.

Senator KYL. Right. This is a good example, it seems to me, of

the law needing to evolve with technology, or technology is going

to get way ahead of law enforcement’s ability to protect the citizens

of the country.

Ms. NAPOLITANO. That is right, because even a delay of a few

hours while you go to another courthouse in Virginia or California

can be very critical in these kinds of cases.

Senator KYL. Now, I gather it would be safe to say, from what

both of you have testified, that in Arizona you have seen a significant increase in the amount of cyber crime. Would that be fair, Mr.

Gonzalez?

Mr. GONZALEZ. Yes, Sir. We have had a significant increase, in

fact, specifically since the beginning of this year. Our caseload has

increased probably 5 times, and we suspect it will continue to increase.

Senator KYL. One of the cases that I believe you alluded to in

your prepared testimony but you didn’t mention in your summary

was a situation involving a very potentially dangerous situation

with the dams in the State of Arizona. Could you describe that in

just a little bit of detail?

Ms. NAPOLITANO. Yes. This is a case—I believe it happened in

1995. There is a typo in the testimony. But what happened in this

instance was a computer user hacked his way into the billing database of the Salt River Project. He was looking to cancel someone’s

account. He then thereafter gained access, high-level access to the

canal controlling system.

84

Now, when that crime occurred, we didn’t have the bill I was describing to you, Senator. He was actually, I think, charged with a

class III computer fraud felony. He subsequently provided a great

deal of cooperation in some other cases, and so he pled down to a

probation-eligible offense. And I believe, ironically, he is working in

computer security in the private sector now, be that as it may.

Under the new law in Arizona, such hacking into a vital infrastructure, which is a defined term in the law, would be a class II

felony. Under our statutory scheme, that is the next most serious

offense to a first-degree murder.

Senator KYL. And when will this new law take effect?

Ms. NAPOLITANO. July 18.

Senator KYL. OK. Great.

Just a few more questions here. Are there any—I alluded to this

in my opening statement, the possibility that there are legal impediments to the sharing of information, particularly by the private

sector, with law enforcement. How would you characterize the cooperation between industry and law enforcement during the investigation of cyber crimes? And are there any disincentives that you

are aware of that need to be removed for companies to come forward once they have experienced an attack? I will address that to

both of you.

Mr. GONZALEZ. Well, Sir, I think the cooperation is good. It is

getting better. There is a tendency sometimes on the part of the

private sector to be a little hesitant, maybe, in say reporting either

attempted intrusions or intrusions because of the fear of the impact

that it may have on their status in the community where they are

working. However, I think as part of the InfraGard program that

we talked about where we are basically being able to—we are starting to form partnerships with the private sector to where they have

an ability to anonymously join that program and provide us information that we can either use specifically with detail to initiate

case or sanitize for NIPC to use to disseminate to other members

of the program in terms of potential either attempted intrusions or

intrusions. I think as we work more through that system and basically show and convince the industry that it is a viable system and

it can only help in terms of deterring attempted intrusions and in

the case of where the intrusions are successful prosecuting the offenders, I think as we develop more of a track record in that area

the industry will be much more willing to continue and move forward with that cooperative effort.

Senator KYL. Now, some people in industry have expressed a

concern that their computers could be confiscated or critical components of their operations could be brought down during the course

of an investigation, which would essentially paralyze their ability

to do business. What kind of assurance can you give them that this

would not occur?

Mr. GONZALEZ. Actually, it would be almost the opposite. What

we need from the industry is, first of all, if they have either an attempted intrusion or an intrusion, we need a timely notification almost immediately so that we can respond. And the other thing is

we need their assistance in terms of whether it be their systems

administrators or people from their companies or businesses that

have the expertise in their systems to help us go through their sysVerDate 11-MAY-2000 15:11 Jan 26, 2001 Jkt 000000 PO 00000 Frm 00088 Fmt 6633 Sfmt 6602 69335.XXX SJUD2 PsN: SJUD2
85

tem and identify the information and the evidence that can either

provide leads for us, investigative leads, or determine how the intrusion occurred.

We do not seize their computers. We will not seize their computers, and we do our best to be as unobtrusive in terms of affecting

their business operations. But we need their help and assistance in

doing that, one, in the timeliness of the reporting of the

intrusions and, two, in the use of their technical expertise for their

systems to get us through the investigative process.

Senator KYL. Now, another related concern is going public with

information, and, General Napolitano, let me ask you as well as

Mr. Gonzalez this. Let’s say a classic bank fraud intrusion occurs,

or, as you say, somebody hacks into the utility to cancel out their

bill, but let’s say it is a bank and there is a suggestion here that

the bank is potentially exposed to lose hundreds of millions of dollars as a result of this intrusion. They discover that internally.

They obviously don’t want the evening news to carry the story:

ABC Bank losing hundreds of millions of dollars to a hacker. That

would suggest to their customers that it is not a safe place to keep

their money and so on.

How can the law enforcement and prosecution authorities ensure

that that won’t happen and, therefore, provide a good incentive for

people to cooperate with law enforcement as soon as possible to get

the critical information to law enforcement so that the perpetrators

can be brought to justice?

Ms. NAPOLITANO. Senator, that is a difficult question because we

find it in a lot of different areas where entities that are actually

the victims of crime are reluctant to report it because of likely

media attention. And certainly you sometimes cannot control the

media. I know this will come as a shock, but sometimes they find

their own things of interest.

But a couple of very concrete things can be done to increase, I

think, the security that a business can have in working with law

enforcement. One is to make greater use of and have the ability to

make greater use of sealing orders in court to protect things like

trade secret information, proprietary, computer security information, and the like. After all, the long-term damage to an institution

or a business is not the one-day news story. It is having the actual

data put into the public domain that would enable someone else to

commit a similar crime. The new bill in Arizona that I described

actually has some express statutory provisions in that regard. I believe in terms of sealing trade secret information, Federal law already had a provision. Most States don’t have something similar.

Senator KYL. Mr. Gonzalez, anything to add?

Mr. GONZALEZ. I would offer a couple of comments, Sir. In terms

of publicity and public awareness, generally speaking, with the FBI

and with the numerous Attorney General guidelines we have regarding the contacts with the media, information that is relayed to

us or is reported to us a potential crime does not necessarily intimate that it is going to be made public any time soon or any time

in the near future.

Senator KYL. Well, they would need a lot better assurance than

that, though.

Mr. GONZALEZ. That is generally—that is our process.

86

The other thing that I would intimate is there is a particular

case that I am pretty sure has been resolved where a bank, in fact,

was defrauded of about 10 or so million dollars, and we were able

to recover all that money based on the company’s willingness to report. I think we recovered all but $800,000 of the $10 million or

so that were taken.

So I think the upside or the benefits to private industry and to

these companies that have the potential of being defrauded is much

better in joining forces with law enforcement to try to resolve the

issue as opposed to not reporting.

Senator KYL. I believe that, you believe that, and it makes intuitively good sense. Obviously, it is going to be necessary to continue

to operate in a way that assures the public that this kind of protection of their sensitive information will occur with law enforcement

so that they will have an incentive to fully cooperate.

Let me ask you about the arrest earlier this year. Maybe you are

not totally familiar with the inside details of it, but perhaps you

could share some information with us here about the Canadian law

enforcement officials’ arrest of the young man in Canada, a 15-

year-old teenager, as I understand it, who is suspected of being at

least one of the people responsible for the recent denial-of-service

attacks on the Internet sites in the United States. Can you tell us

a little bit more about how the investigation of that case was conducted by the FBI and what the status of it is?

Mr. GONZALEZ. I can tell you in general terms the processes that

we went through that I think resulted in some of the successes.

First of all, there was an almost immediate reporting of the intrusions or the denial-of-service attacks by the companies affected,

which obviously triggered a response from the FBI. With the FBI’s

structure as it is nationwide, where we have nationwide offices, in

each of those offices we may not have fully fledged computer intrusion squads, but we have agents that are assigned to those matters

across the country. We were able to almost simultaneously develop

information that had leads, as we call them, all over the country

and able to address those simultaneously with the use of the National Infrastructure Protection Center, which one of their roles is

the coordination of these types of investigations because of their

national scope and international scope.

So all those things occurred almost, again, I will use the term simultaneously, because once it was reported, it put several processes into action, including the coordination efforts by NIPC, the

individual field divisions getting out and addressing the particular

leads they had, which we had some in Phoenix, and at the same

time, once it was determined that there was a nexus to Canada,

our legal attache office in Canada was able to have liaison with the

RCMP and able to make the information either available or pass

it and a lot for the successful processing of the information to the

Canadian authorities so they could make the arrest.

But as you can see, it is a multifaceted process that we went

through. It would be extremely difficult to do that if we didn’t have

the national resources available and on hand to conduct the adequate investigation.

Senator KYL. It sounds like another good example for the need

for a multiple or nationwide trap and trace authority as well.

87

Mike Vatis in Washington, DC, in our hearing there, the Director

of the FBI’s National Information Protection Center, the NIPC——

Mr. GONZALEZ. Infrastructure.

Senator KYL. Yes, I misstated that. He discussed two programs

called InfraGard and Key Asset Initiative. Can you describe those

two programs and how they are being carried out here?

Mr. GONZALEZ. Yes, Sir. The Key Asset Initiative involves each

field division of the FBI within their jurisdiction in identifying key

assets that are involved, whether it be providing infrastructure

services, whether it be communications, transportation, academia,

identifying these assets and making contact with them and obtaining—and setting up with them a system whereby we have 24-hour

points of contact with those different assets so that in the event

there is either an intrusion or an attempted intrusion, that we can

be—we will have access to those different entities.

The InfraGard program involves an information-sharing initiative that is coming out—that is actually in place in a lot of areas.

We are getting ready to implement it in Arizona. But what we do

is, we offer anonymity to any company that wants to join us, and

it will do things. It will give them the ability to provide the FBI

and NIPC with information regarding either intrusions or potential—or attempted intrusions into their system through an

encrypted e-mail capability, and also as being part of that program,

it will allow them to receive warnings or threat warnings or intrusion warnings from NIPC as they are doing their national review

of these particular incidents.

So the Key Asset Initiative identifies areas in industry and in

business that have potential for being either attacked or have potential of affecting our infrastructure and our commerce, and then

the InfraGard initiative includes those entities and other entities

in private business, private enterprise, that have a need to be advised of either threats or potential threats through the encrypted

e-mail system.

Senator KYL. So are you actually going out to industry and visiting with them about their potential participation?

Mr. GONZALEZ. Yes, Sir. We are currently in the process of doing

that.

Senator KYL. Let me ask each of you a last question just to indicate to the audience here we have to conclude the hearing by 11

o’clock. We have two more witnesses. So even though I can—I love

getting information from these folks, and I could sit here all day.

But we will have to close it off and move on to our next witnesses

here.

But let me ask both of you, Attorney General Napolitano, you

mentioned desk subpoenas in your testimony, and Director Louis

Freeh testified about administrative subpoenas necessary to effectively track cyber crime. Could you describe what those are and

how that relates to our need for modifying law or procedures?

Mr. GONZALEZ. In terms of the FBI, they are referred to as administrative subpoenas. The FBI currently has that and some other

Federal law enforcement agencies have that ability in drug investigations, in health care fraud investigations, and in crimes against

children investigations. It basically allows the head of an office or

88

one of his designees to issue a subpoena for information when it

regards one of those types of investigations.

What that does, it is actually two-fold: Again, it goes to the timeliness. We have an ability to do that almost at a moment’s notice

if needed in a particular investigation; and, No. 2, the information

we gain from those subpoenas, there are no restraints in terms of

us sharing it with other State and local law enforcement agencies

or anyone else that would have a need to know in terms of getting

that information as opposed to comparing it to a Federal grand

jury.

Senator KYL. Is there a difference between an administrative

subpoena and a desk subpoena?

Ms. NAPOLITANO. Well, we use the term desk subpoena as shorthand for a subpoena that a prosecutor signs as opposed to continually going back to the grand jury to get another subpoena duces

tecum. So what Arizona law will provide when this provision takes

effect is that on the certification of the prosecutor that this is relevant to an ongoing criminal investigation, we can issue based on

that signature on a subpoena duces tecum to a service provider

without having to continually go back to the grand jury and get a

subpoena. It is very important because in a lot of these cases, as

you see, we are following, say, for example, an e-mail to its source,

and we can literally go around the country and end up in Glendale.

But this way we can do it very quickly. We can do it at night. We

can do it on weekends when the grand jury is not in session, and

oftentimes we need to be able to do that.

Senator KYL. And the legal protection is that the evidence is obviously not usable if it has exceeded the probable cause requirements that you would ordinarily have to seek from a judge.

Ms. NAPOLITANO. Right. And the purpose is not to get the content of the e-mail. This is simply to be able to track where it—the

chain of where it is coming from. So that is the primary purpose

of this, not to get the actual content but to be able to find out the

source of the e-mail. And as I mentioned earlier, Senator, many

times we have to do that at night and over the weekends where

continually going back to get a subpoena is impossible.

Senator KYL. I hope if our viewers have picked up anything from

this hearing, they will appreciate the challenge that law enforcement is faced with in investigating these kinds of crimes because

of the huge technological challenges that are presented and the

very limited resources that you alluded to, Ms. Napolitano, and

some of the legal—the very strict legal requirements that we impose in this country to make sure that people’s constitutional rights

are not in any way invaded, and that sets up some very high barriers for law enforcement but that obviously we intend to continue

to abide by those requirements. It makes it tough for law enforcement, but you can still get your job done if you have adequate cooperation with the people who are reporting the crimes, and from

the Congress perhaps and the State legislature, as you have noted,

in providing the kind of legal authority and resources necessary to

do the job.

It is a very difficult challenge. It will evolve as time goes on, and

I commend both of you and your offices for the way that you have

jumped on this very quickly. And certainly as you have pointed out,

89

General Napolitano, Arizona being the leader in developing both

the legal authority and within your office the ability to quickly deal

with these kinds of cyber attacks.

I commend you both, and I appreciate you testifying here. We

will have the record open for a period of time for any other comments you would like to make, and naturally I am always appreciative of your advice on the subject. So thank you very, very much.

Mr. GONZALEZ. Thank you.

Ms. NAPOLITANO. Thank you, Senator.

Senator KYL. Our next witness is David Aucsmith, the chief security architect for the Intel Corporation. Mr. Aucsmith is a recognized expert in the computer security field and will be making the

U.S. industry presentation at the upcoming G–8 summit on cyber

crime in May in Paris, France.

Mr. Aucsmith, your full statement will be placed in the record,

and I would invite you to make summary remarks at this time.

And, again, I very much appreciate your presence here.

PANEL CONSISTING OF DAVID W. AUCSMITH, CHIEF SECURITY

ARCHITECT, INTEL CORP.; AND JOSE GRANADO, SENIOR

MANAGER, ERNST & YOUNG LLP, HOUSTON, TX

STATEMENT OF DAVID W. AUCSMITH

Mr. AUCSMITH. Thank you very much, Senator.

The purpose, I think, of my presentation is to talk about the

technological trends and challenges facing the protection of critical

infrastructures as we move forward.

Intel’s former CEO, Andy Grove, was very fond of starting a lot

of his presentations with the statement that we are rapidly approaching a time of a billion connected computers. That is actually

a fairly fantastic statement. He said there are roughly a billion

connected computers simultaneously exchanging data. And the

computers that we are talking about are not just PC’s. As was

mentioned earlier, we are talking about the controls to an irrigation system. We are talking about national power grids, airline reservations, financial information from Wall Street, accessible by a

billion connected computers.

Why is this done? The obvious reason is to improve cost and

efficiency. It lowers the cost if there are common infrastructures

allowing communications and information to take place, and it significantly raises the efficiency. In fact, a year or so ago, the Department of Commerce credited that efficiency with keeping the level

of inflation a whole percentage point lower than it would have been

otherwise.

However, this same efficiency also created quite a number of

vulnerabilities, which is what this hearing is basically about. Those

efficiencies mean that we have just-in-time inventory management,

we have just-in-time commission and movement. That leaves very,

very little room for error when that system is disrupted. That justin-time inventory also applies to critical components of the national

power grid and transportation sectors.

Basically what we have seen so far is vandals on the Internet,

as another way of putting it. That is the majority of the cases. If

you have a billion connected computers, one way to look at that is

90

you have a billion minus one potential attackers to your particular

computer system.

Another way from my end that we look at this is that we basically have a billion connected computers each of which has a billion

different security policies. We actually can’t seem to agree on precisely what is the right way to defend or to state even how we

should defend each of the individuals sites.

The statistics are rather frightening. It includes major companies

such as Intel and others attacked somewhere around the neighborhood of 6,000 a day. You have cable modem users who would reflect

around 250 attacks or so a week. And it is a fairly phenomenal

amount.

Now, most of these attacks are the equivalent of vandalism. I

like to point out it is somewhat like spray painting in cyberspace.

It is about the same equivalent. The problem, of course, is that you

really can’t tell which of those are potential spray painters and

which of those are potentially serious fraud or an intelligencegathering operation.

One way to look at it is if you were a business you wouldn’t tolerate a few thousand people a day walking up and rattling your front

doors or trying to see if there is an open window where they could

come into your business, yet in cyberspace, we have sort of grown

up and accept these just as a matter of fact. We can’t live with this

as a basic problem. In fact, when vandalism gets out of hand, you

end up with the distributed denial-of-service attacks that we have

just had. That’s what happens if several thousand people show up

at your front door at once.

There are other problems which is just essentially the cascading

destruction that occurs when one part of the system fails due to a

vandalism or a malicious attack or a terrorist incident or whatever.

The interconnectivity causes a great deal of things to happen all

through.

But I don’t want to dwell on vandalism. There is a great statement from the bank robber of the 1950’s, Willie Sutton. When he

was asked why did he rob banks, he said, ‘‘Because that’s where

the money is.’’ Well, right now e-commerce is where the money is.

In fact, it is very likely that we will see serious criminals—and we

are beginning to see them—move into cyberspace because that is

where the money is.

We have seen this in the case of credit card theft and a number

of others. Basically cyberspace offers precisely the two things that

criminals need: anonymity and mobility. Those happen to be the

things that generally e-commerce also needs, but they do facilitate

the bad guys.

Most security domains as they are set up now approach what we

call the nougat method of security, which is they have a very hard

shell on the outside and they are soft and chewy on the inside. So

all you have to do is break through that outer barrier and people

do not practice defense in depth in general.

That is not to say that people aren’t trying. There is a great deal

of standards development going on within the industry. The international standards is essentially the glue that binds cyberspace together, and there is a lot of work, including IP security standards

for telecommunications, use of better identification methods like

91

smart cards and biometrics. All of those things are happening, but

it is important to stress that standards development is extremely

slow. Because it is an international endeavor, it does not move at

cyber speed.

Also, security is traditionally a form of insurance. We didn’t put

up metal detectors in airports until after airlines were hijacked. We

are unlikely to put in strong security in cyberspace until after

major incidents. It is just very hard to get people motivated otherwise.

One of the perhaps best things that we can do is to provide some

assistance for law enforcement and others in dealing with the current problems. The technology that we deal with is extremely complex. Its very efficiencies frequently frustrate the ability to catch

criminals in cyberspace. It is complex and esoteric. Experts typically are hard to find and have to be paid a great deal. It is very

difficult for law enforcement to deal with that.

Intel might be regarded as being at the forefront of this technological revolution, certainly one of the companies, and it is very difficult for us to keep up with the technology, and we dedicate a

great number of people to doing that.

The best thing that we can do is to have good cooperation

amongst industry components and with governments to help make

the Internet a safer place and to protect the critical infrastructures.

There are several good examples of that cooperative effort. Some of

them have already been alluded to. There are others such as the

information technology study group, which is a joint industry and

FBI initiative to look at strategic directions in solving these problems.

However, there are problems with that cooperation. Some of

them have been alluded to. We are now having a collection of industry competitors coming together to share information. That

brings up antitrust issues. Certainly from the strategic standpoint,

we have companies disclosing vulnerabilities and other intellectual

property about their products that is subject to discovery and may

end up in a court of law. That is not something generally wanted

by industry.

There are problems with funding of those cooperative efforts. Industry is pretty much consenting to do this on a pro bono basis,

gratis, if you will, but the government sectors of those require funding in order to do the Administration and make the best use of

that.

Congress also will have to address other problems. The biggest

problem looming on the horizon is that having to do with jurisdictional issues. Cyber crime occurs all over the world. It is very difficult to figure out who exactly has jurisdiction and in what cases.

Some of that is being addressed.

So, basically, in closing, though I don’t want to leave you with

too bleak a view here, the technology is basically amoral. It is just

moving at a very rapid pace. It is being used for good and, of

course, bad guys will move in, too. Traditionally, law enforcement

and national security interests have been able to adapt to changes

in technology from the automobile, the telephone, and others over

time. I am sure that in time we will be able to adapt to create effective order in the new technologies. It is perhaps fitting, if you

92

will, that this is being held in Arizona. It somewhat resembles the

Wild West at this point of view, and it is merely a need to slowly

but surely civilize it. That is one way to look at it.

Thank you very much, Senator.

[The prepared statement of Mr. Aucsmith follows:]

93

94

95

96

97

98

99

100

101

102

Senator KYL. Well, thank you very much, Mr. Aucsmith. Of course, we wanted to put one of our premier corporations on display as well, and since you are a leading technology expert in the

area, we thought this would be a good forum in which to discuss

this. I am not sure whether we should have had you before or after

our next witness, though, because our next witness is going to demonstrate to us how this hacking is done.

Now, I have some assurances that with the law enforcement officials here, this will all be done in a quasi-legal way, but I take no— I give no assurances in that regard. Let me properly introduce to

you Jose Granado. He is a senior manager at Ernst & Young, a

highly qualified accounting firm in the country, no fly-by-night

hacking outfit, I would hasten to point out. And recently it was

named as the outstanding information security organization, as I

understand it, by the Information Systems Security Association. So

Jose also comes by his expertise rightly.

He has been involved with information security for the last 12

years. He is a frequent speaker on the topic. We thank you for testifying today, and as I have mentioned to the others, your full

statement will be placed in the record, and we would appreciate a

summary of your remarks at this time.

STATEMENT OF JOSE GRANADO

Mr. GRANADO. Good morning, Mr. Chairman. Thank you for the

opportunity to testify today regarding improving prevention and

prosecution against cyber attacks. As you mentioned, I am a senior

manager with Ernst & Young’s eSecurity Services group. I direct

a team of ‘‘white hat hackers’’ who perform network assessments

on client networks. Their objective is to identify existing weaknesses in computer systems that will lead to unauthorized access.

My perspective comes from having led over 100 network security

assessments over the past several years. Assisting me today is Ron

Nguyen, a manager with our eSecurity Services group. Today we

will describe and demonstrate the process we utilize to perform

these assessments.

When performing these assessments, we obtain a snapshot in

time of an organization’s network security posture. This snapshot

allows us to identify potential points of entry to gain unauthorized

access to a network. The demand for these assessments has been

generated by several factors: increased e-commerce initiatives, increased Internet dependency, which has generated a need for independent security reviews, increased discovery of operating system

and application level vulnerabilities, and increased publicity, as we

have seen recently with the denial-of-service attacks on eBay,

Yahoo, and others.

Although our team is extremely skilled, over 75 percent of our

initial access into client networks is gained via relatively simple

methods and techniques. Our success is facilitated by three factors:

poor selection of user ID’s and passwords, poor system configuration from a security perspective, and the inability for organizations

to implement solutions on a realtime basis to existing vulnerabilities.

Hundreds of websites exist that contain system security information. The network used to exchange this type of information tranVerDate 11-MAY-2000 15:11 Jan 26, 2001 Jkt 000000 PO 00000 Frm 00106 Fmt 6633 Sfmt 6602 69335.XXX SJUD2 PsN: SJUD2
103

scends physical, geographical, and cultural boundaries. Internet

chat sites, informal gatherings, and conferences also help to facilitate the flow of information.

During today’s online demonstration, we will identify a live computer system, scan the computer system for potential entry points,

gain access to the system, eavesdrop and control the system remotely, crack the password file, and, finally, execute a denial-ofservice attack.

Our demonstration network is comprised of two Windows NT

laptop computers. The computer labeled ‘‘attack,’’ the one on the

larger screen, will be performing the hacking activity. The computer labeled ‘‘victim,’’ the one on the smaller screen, will be the

recipient of the attacks. Although these computers comprise their

own mini network, the techniques demonstrated today can be performed against any live computer on the Internet that is in a similar security state as our victim system.

An attacker can run a ping utility to randomly identify a range

of targets on the Internet. The attacker can also target a specific

victim to attack. For our demonstration, we will ping www.

victim.com.

The ping utility has identified one live system on our network

designated by the IP address 192.168.10.10. An IP address is a numerical designation that identifies a computer on a network. Once

we identify a live target, there are a number of freely available vulnerability scanning tools that can be used to identify potential

entry points. For our demonstration, we will use the freeware tool

called ‘‘Superscan’’ on our attack system to scan our victim.

The scanner has identified potential entry points on our target

system—specifically, ports 21, 80, 135, and 139. A port is a numerical designation for a specific network function. Part of the system

access process is mapping vulnerabilities associated with these

open ports to exploit tools. Our scan identified port 80, which is associated with Web browsing, as open. For our demonstration, we

will launch the iishack tool on our attack system to gain access to

our victim.

We now have gained access to our victim system. The attack was

successful. The iishack tool the attacker used exploited a buffer

overflow vulnerability on the target system. A buffer overflow condition is caused by the transmission of unexpected data to a target

system, causing it to accept commands from an attack system. The

hack tool launched a listening service that the attacker can now

use to remotely control the system. This listening service allows the

attacker to eavesdrop on the victim system by using a standard

Web browser. For our demonstration, the attack system will monitor a letter being typed by the victim system.

As you can see, the attack system now actually has the screen

of the victim system displayed on it. The victim computer is typing

a letter with the notepad function, and what he is typing keystroke

by keystroke is now appearing on the bigger screen, which is the

attack system.

With remote control access, the attacker can leverage the target

system as a launchpad to attack other systems, start programs, access and view files. For our demonstration, we will access and view

files on the victim system from our attack system.

104

As you can see, the attack system here is going through the contents of the C drive on the victim system and actually bringing up

documents that are on the victim system and actually appearing on

the screen of the attack system. The documents, as you can see, appear in their complete entirety.

Now that the attacker has full control of the target system, one

of the most popular activities is password cracking. The attacker

can download the password file from the remote system and run

a password cracker to discover user passwords. For our demonstration, we will download the password file to our attack system and

using the lopht crack program demonstrate how quickly passwords

can be cracked.

We have located the password file on the victim system. We have

dragged it to the desktop of our attack system. We are now bringing up the lopht crack tool and feeding that password file to the

cracking tool. And as you can see, in a matter of seconds 18 of 21

passwords were cracked, and that took probably 2 or 3 seconds.

If the attacker is simply looking for targets to crash, they can

easily launch a denial-of-service attack directed specifically at the

target system. For our demonstration today, we will launch a denial-of-service attack on our attack system to disable our victim.

The IP address of the victim system is being inputted into the

denial-of-service tool, and after pressing the nuke button, we see

that our victim system has been disabled as evidenced by the blue

screen with all the error messages that are on it. And now that

that system is disabled, it needs to be restarted to get back to its

original state.

Thank you for the opportunity to testify today at this hearing,

and subject to your questions, this concludes our quick demonstration.

[The prepared statement of Mr. Granado follows:]

PREPARED STATEMENT OF JOSE GRANADO

POWERPOINT TITLE SLIDE

Introduction

Mr. Chairman and distinguished members of the Subcommittee, thank you for the

opportunity to testify today regarding improving prevention and prosecution against

Cyber Attacks.

My name is Jose Granado. I am a Senior Manager with Ernst & Young’s

eSecurity Services group. I direct a team of ‘‘white hat hackers’’ who perform network assessments on client networks. Their objective is to identify existing weaknesses in computer systems that will lead to unauthorized access. My perspective

comes from having led over 100 network security assessments over the past several

years. Assisting me today is Ron Nguyen, a manager with our eSecurity Services

group. Today we will describe and demonstrate the process we utilize to perform

these assessments.

POWERPOINT SLIDE ONE

Introduction to White Hat Hacking

When performing these assessments we obtain a ‘‘snapshot’’ in time of an organization’s network security posture. This snapshot allows us to identify potential

points of entry to gain unauthorized access to a network. The demand for these assessments has been generated by several factors:

• Increased eCommerce initiatives.

• Increased Internet dependency—which has generated a need for independent

security reviews.

• Increased discovery of operating system and application level vulnerabilities.

105

• Increased publicity—as we have seen recently with the Denial of Service At- tacks on eBay, Yahoo and others.

Although our team is extremely skilled, over 75 percent of our initial access into client networks is gained via relatively simple methods and techniques. Our success

is facilitated by three factors:

• Poor selection of userids and passwords. • Poor system configuration from a security perspective. • Challenges organizations face in keeping up the large volume of vulnerabilities discovered on a daily basis.

POWERPOINT SLIDE TWO

Hundreds of web sites exist that contain system security information. The net- work used to exchange this type of information transcends physical, geographical,

and cultural boundaries. Internet Chat sites, informal gatherings and conferences

also help to facilitate the flow of information.

POWERPOINT SLIDE THREE

During today’s online demonstration we will:

• Identify a ‘‘live’’ computer system. • Scan the computer system for potential entry points. • Gain access to the system. • Eavesdrop and control the system remotely. • Crack the password file. • Execute a denial of service attack.

START DEMO

Demonstration

Our demonstration network is comprised of 2 Windows NT laptop computers. The

computer labeled ‘‘attack’’ will be performing the hacking activity. The computer la- beled ‘‘victim’’ will be the recipient of the attacks. Although these computers com- prise their own mini network, the techniques demonstrated today can be performed

against any ‘‘live’’ computer on the Internet that is in a similar security state as

our victim system.

Identifying a ‘‘live system’’

An attacker can run a ping utility to randomly identify a range of targets on the

Internet. The attacker can also target a specific victim to attack. For our demonstration we will ping www.victim.com.

Scanning a system for potential vulnerabilities

The ping utility has identified one live system on our network designated by the

IP address 192.168.10. 10 An IP address is the numerical designation that identifies

a computer on a network. Once we identify a live target, there are a number of freely available vulnerability scanning tools that can be used to identify potential entry

points. For our demonstration, we will use the freeware tool ‘‘Superscan’’ on our attack system to scan our victim.

Gaining access to a system

The scanner has identified potential entry points on our target system. Specifically, ports 21, 80, 135 and 139. A port is a numerical designation for a specific

network function. Part of the system access process is mapping vulnerabilities associated with these open ports to exploit tools. Our scan identified port 80 which is

associated with web browsing as open. For our demonstration we will launch the

iishack tool on our attack system to gain access to our victim.

Eavesdropping on a system remotely

The iishack tool the attacker used exploited a buffer overflow vulnerability on the

target system. A buffer overflow condition is caused by the transmission of unexpected data to a target system, causing it to accept commands from an attack system. The hack tool launched a listening service that the attacker can now use to

remotely control the system. This listening service allows the attacker to eavesdrop

on the victim system by using a standard web browser. For our demonstration the

attack system will monitor a letter typed by the victim system.

Controlling a system remotely

With remote control access, the attacker can leverage the target system as a

launchpad to attack other systems, start programs, access and view files. For our

106

demonstration we will access and view files on the victim system from our attack

system.

Cracking passwords

Now that the attacker has full control of the target system, one of the most popular activities is password cracking. The attacker can download the password file

from the remote system, and run a password cracker to discover user passwords.

For our demonstration we will download the password file to our attack system and

using the lopht crack program demonstrate how quickly the passwords are cracked.

Executing a Denial of Service Attack

If the attacker is simply looking for targets to crash, they can easily launch a denial of service attack directed specifically at the target system. For our demonstration, we will launch a denial of service attack on our attack system to disable our

victim.

Subject to any questions this concludes the presentation.

Senator KYL. Thank you very much.

Did the FBI get all of that down? [Laughter.]

You were taking good notes.

Obviously, this simulation attack is designed to illustrate how

people with a little bit of expertise—and I know that our witness

here has a lot of expertise, but I am going to ask him as kind of

a first question how much expertise you need to do this—can quickly get into, can disable, can secure information from or deface a

system, whether it be a business or commercial system, a government computer, a research or university computer, or certainly a

private computer.

Let me begin by asking, Mr. Granado, just how experienced do

you have to be to be able to do the kind of thing that you just now

did?

Mr. GRANADO. The experience is not what one would think. We

often find that individuals involved in this kind of activity have a

love for technology. These are folks that stay up until 2, 3 or 4 a.m.

reading everything they can get their hands on on systems and

vulnerabilities and things of that nature. These kind of folks aren’t

individuals that have to go to Harvard to get this kind of experience. So the love for technology, a basic understanding of computer

systems and networks is really at the foundation level all that is

required.

Now, as I mentioned during my testimony, the voluminous

amount of information that is out there on the Internet on how to

go at these systems actually helps to facilitate the knowledge process for folks that want to get involved in this kind of activity. But

the experience needed to do this is not great. It is just a general

understanding of computers and networks, and then all the information that is available out there kind of helps snowball your experience level so that you can perform these kind of activities.

Senator KYL. I think illustrative of that is the fact that the first

person arrested in connection with the denial of service of the various sites in the United States, the young Canadian, was 15 years

old. And I will mention another operation. During the time the

United States was preparing an attack on Iraq, there was an intrusion into some U.S. Government computers that was serious

enough that it got the highest levels of our Government. We

dubbed the exercise ‘‘Solar Sunrise.’’ We eventually found that

there were three people under the age of 20 in I think two different

107

countries that were involved in that attack. They were fortunately

brought to justice.

But the point is that this seems to be coming a lot from young

people who obviously don’t have the college degree you are speaking of but have acquired the capability to cause great mischief.

Mr. GRANADO. Absolutely.

Senator KYL. Let me ask Mr. Aucsmith, at our hearing in Washington, DC, Harris Miller, who I am sure you know—he is president of the Information Technology Association of America—testified and he said one of the inhibitions of sharing information between the private sector and the Government regarding these

vulnerabilities and threats is that companies naturally don’t want

their vulnerabilities and the attacks that have actually occurred

against them to be publicly known since this could easily impact

on consumer confidence in their particular sites and people then

might not want to use their website. He said that unless companies

are given an exemption from the Freedom of Information Act so

that information they disclose to the Government can’t be obtained

by any other person that files the paperwork, that they would not

want to voluntarily submit information to the Government in the

name of cyber security.

Do you share this view? Do you think we need that kind of protection of private information from being acquired under the Freedom of Information Act?

Mr. AUCSMITH. Yes, Sir, I actually do, very much so. There are

two issues at stake here, and it depends on for what the information is being used. If it is tactical information, the FBI may be

needed to solve the problem.

Senator KYL. Meaning on how to—sort of to understand the kind

of thing that Mr. Granado just now did, how does this system work

so that we can track back the perpetrator.

Mr. AUCSMITH. Right. And for that, our concern is if we share

that information, we may end up as a witness in a discovery process. No company wants to end up in a criminal proceeding with

their product. The second, somewhat longer range, has to do with

we are aware—as much as we may try, we can’t produce perfectly

secure systems. It is just not economically feasible. In many cases,

it is not even technically feasible. So we are made aware of

vulnerabilities, but we are sort of constantly trying to fix those

vulnerabilities in each new product revolution. So what you basically have is a sliding window of vulnerabilities that go along, and

industry is very reluctant to make that public because, clearly, that

is only helping the bad guy. It certainly could be used by your competition to weaken your product. So there is some need—there is

a need to come up with some solution for allowing—sharing the

strategic vulnerabilities, helping your practical situation with

knowledge that we have in a way that doesn’t adversely affect the

security of a company or the infrastructure that are built off of

those products. Something needs to be done.

Senator KYL. Well, Congress is looking—I was involved in the

Y2K legislation which gave some temporary time-outs for liability

on sharing of information in order to ensure that in that run-up to

the Y2K turnover that we wouldn’t have an excess of problems.

And that seemed to work pretty well.

108

So you would be supportive of Congress looking into the Freedom

of Information Act, the potential for class action liability, antitrust

liability, in a way to try to balance the need to share this information with the protections needed if the information is shared.

Mr. AUCSMITH. That is correct. Clearly, we are not advocating removal of FOIA. But what we are advocating is giving some level

of protection where such vulnerabilities are so terribly sensitive.

Senator KYL. Now, Mr. Granado, one of the issues here is insider

threat. In addition to hacking in from the outside, clearly there are

some problems of the insiders. Could you comment a little bit about

your concern there?

Mr. GRANADO. Yes, Sir, absolutely. I mentioned during my testimony that our access into computer networks 75 percent of the

time is through simple methods and techniques, and that specific

statistic was for attacks from the outside in. When we are invited

into an organization to perform our assessments, our success rate

is 100 percent. The reasoning there is obviously there is a certain

level of trust that is assumed when an individual or a group of individuals are inside an organization, the security problem I think

becomes twice as difficult because of that assumed level of trust,

and the security controls that an organization implements, they

need to be perimeter-based for external threat, but there also needs

to be auditing and monitoring tools on the inside so that the activities of users on the inside could be monitored so that if any weird

activities are occurring they can be flagged and acted upon.

Senator KYL. This is the so-called defense in depth concept that

Mr. Aucsmith mentioned.

Mr. GRANADO. So there is no question that the insider threat is

greater from my perspective than the outside threat. Again, that

assumed level of trust of someone that you let inside your facility,

they have already beaten one hurdle. They now just have to get to

your network and access systems.

Senator KYL. I want to ask both of you a question here, and this

goes right to the point Mr. Aucsmith made a minute ago. Maybe

neither one of you want to reveal this nasty little secret to the public here, but I think it is important to do so in order to help do the

job that both of you do.

I would like for you to describe just how vulnerable anyone on

the Internet is, and let me put it in this context. Suppose I buy one

of the new encryption products and let’s call it pretty good security,

and I buy that and I think, great, I am encrypted now, and unless

some organization like the CIA tried to crack it, it is not going to

be crackable. So I am home free here.

How foolish is that attitude? Just how vulnerable is anyone on

the Internet? How easy is it and how many different ways are

there to break into these kind of systems?

Mr. AUCSMITH. You have actually gone a reasonable step towards

achieving security from a particular type of threat. That particular

type of threat is collecting tactics at some intermediate point. What

you have done nothing for is to protect the endpoint systems where

that information originates or the destination of where it goes. In

fact, given most encryption systems, the vulnerability is actually to

break into the system and record the information before it is ever

encrypted, which basically could be done in the attack you just saw

109

here, or to go hunting around in the computer itself for the keystrokes that were used to invoke the unknown—or the key, the

encryption key. You would solve one of the problems, but probably

not the hardest one, quite frankly. And how vulnerable are they?

If you were to take this scenario that I just went through here, and

instead of launching the particular attack I did, but start

downloading the swap file, which is where the operating system

puts intermediate material as it is being processed for efficiency,

and then scan that for the invocation of your particular encryption

program and the keystrokes that were used to invoke it, you will

most likely recover the key.

Senator KYL. Can you describe this in terms of an analogy? I

know you used the analogy of leaving the window open in the

home. But can you think of a good analogy to bring home to people

how you may have provided security at points D through F, but

that is not all the way from A to Z.

Mr. AUCSMITH. The analogy that we frequently talk about is putting an armory on a screen door. I think basically you have armored the front door and left all the windows open.

Senator KYL. Mr. Granado, do you want to add anything to that?

Mr. GRANADO. Sure. The way I would like to comment on that,

Senator, Ernst & Young is very active in providing this kind of

information to the IT community. We have a website, www.

esecurityonline.com, which provides vulnerability information for

IT folks who are interested on what the latest threats are. And we

also provide a separate section for clients. We give them customized vulnerability information based on the types of computers

they have.

Anyway, my point is, for anyone to think that if they have a security product that they just purchased today and that makes them

secure for the rest of time, it is extremely foolish. From a statistical

perspective, we discover about 7 to 10 vulnerabilities a day that we

either discover through our research labs or that we just gain information from other folks.

So as you can see, you think you are secure today, tomorrow, and

the next day, but next week you may not be. You know, this issue

is something that organizations need to consider a more proactive

approach versus a reactive approach to security. And security is a

process. It is not a matter of plugging a hole and then you are

done. It is a process where you need to test, you need to implement

solutions, and then you need to monitor those solutions. And that

needs to be recurring. And that is the only way that we are going

to be able to get ahead of the game with respect to these kinds of

attacks.

Mr. AUCSMITH. Senator, one more follow-up to that. What the

people from Ernst & Young are talking about is exactly correct.

But I think we need to emphasize that the scenario they just painted is that for an IT organization or business. The same scenario is

very difficult to work when you are talking about a home user. And

one of our problems is my industry has been pushing very much

to get everybody online all the time, always connected. We have

been a little bit behind on sharing with them the vulnerabilities of

being online and always connected. And the same set of methodologies that work for businesses are unlikely to work in the home

110

users. I can’t imagine my mother being able to discern the information required to make a system secure.

So what we have to do as an industry is make security somewhat

more seamless and automatic and easier to deal with. We have a

ways to go on that. We are working very hard, but it is a very hard

problem.

Senator KYL. I think that is a very candid and excellent statement of the state of play right now in the industry coming from one

of the leading industry drivers here, acknowledging that in making

this wonderful new tool so available to so many people so fast, we

have got to catch up in terms of security and that that is going to

require a significant degree of effort.

I think that our hearing today, if it will do nothing else, will be

to demonstrate to people that there is a significant lack of security,

but that shouldn’t deter people from using the Internet, but that

they should be very, very careful to the extent that what they have

on there is private and they want to keep it private, and that industry generally and individuals are going to have to make good

recommendations to the Government about what kind of protections they need in order to provide the fullest possible cooperation

with law enforcement for law enforcement to do its job.

This is something that we want to do our best to cooperate on,

and I just would reiterate to the audience here, my subcommittee

deals with three subjects, and in this one area they all tie together:

technology, terrorism, and Government information. And so we are

right on the cusp of this. I have introduced several pieces of legislation, some of which have already been signed into law, some of

which are pending, as you heard before, and designed to try to

begin to resolve these issues. But perhaps the biggest point that I

would make—and I would like to have the witnesses comment on

this, and then we will—again, I could talk to these guys all day

long. I wouldn’t understand a lot of what they say, but I can at

least appreciate the point they are trying to make. But we will

need to cut our hearing off here in a moment.

We need to create an atmosphere of understanding and mutual

commitment and trust that will enable private users, the private

commercial sector, and the Government policymakers and Government law enforcement people to work together in order to ensure

that there is the maximum protection so that there can be the

maximum use. And if we do that, I think we will continue to lead

the world and improve the quality of life in this country dramatically.

But to the extent that there continues to be a residue of mistrust

and an unwillingness to work together, it inhibits this wonderful

opportunity that we have.

Actually, there is one last question I would like to ask both of

you because I think it is important for particularly our viewers and

people who came to this hearing to appreciate. If you want to know

more about how to make your own systems secure, let’s say you are

a small business here in Arizona, what is the best advice you have

to individuals or small businesses? I am sure big businesses have

found their way to your doorstep, but how does a small business

do the best it can in an economic way to provide the security that

it needs?

111

Mr. GRANADO. There are a lot of organizations that folks and

small businesses can join—Information Systems Security Organization is just one—where members of small businesses can join these

organizations, and they have monthly meetings of security professionals within that specific community to discuss vulnerability

issues, strategic issues, tactical issues with respect to systems security. So that would be one good economic avenue to gain knowledge

on this issue.

Then the other point, again, what I alluded to earlier, the Internet is just full of information that is free and easily accessible. You

know, I described today the hacking-related information. There is

just as much information out there on how to secure your system,

and step by step how to secure it, that people can just do searches

on the Internet, pull that information, pull out what is specific to

their machines, and work on securing their systems, again, free

and all that is required is Internet access.

Mr. AUCSMITH. And that is the nice thing about the Internet, its

opportunities. There are bad guys out there, but there are also

good guys. You can find lists of places to go for the good guys.

There is a variety of sources for finding that, just a general search

will probably help, but you can start with CERT, which is an organization at Carnegie Mellon. The Computer Emergency Response

Team has a wide range of links that you can go to where the good

guys are. The problem with all of that is it is necessary to have

the technical competence to make that a reality in small business,

and many small businesses lack that resource, in which case, much

as you might call a locksmith or a burglar alarm company to help

protect your physical security, you may very well need to make the

investment of contacting a security professional to help you with

your cyber security.

Senator KYL. And probably one of the most important points is,

even though you develop what you think is a secure system, always

understand that there are numerous vulnerabilities, and you have

got to constantly be alert to the little things, you know, leaving

your password taped to the top of your computer, as I saw one

time, by the way—I mean, it sounds silly, but there are a lot of

vulnerabilities that people just don’t stop to think, basically, about

what they need to do to make their systems secure.

Mr. AUCSMITH. We put them underneath the keyboards.

Senator KYL. Yes, right. [Laughter.]

That is a good metaphor for the need to always be alert that

there could be a problem, even though you have secured what you

think is a pretty good system. But the first step is to try to take

advantage of this.

I am informed and we learned at our hearing in Washington that

this Carnegie Mellon entity which Mr. Aucsmith alluded to had developed good counter-software to the kind of denial-of-service attack that occurred against some of the sites that we have been referring to today. Some entities took advantage of that software.

Some did not. Those that did didn’t experience that denial of service.

So take advantage of that which is available to you as has been

described and remain alert to the possibility that even that won’t

112

necessarily deter a determined hacker. I guess those would be the

two watch words.

I really appreciate your demonstration, Mr. Granado, and, Mr.

Aucsmith, your expertise in this. I will hope to continue to plumb

the depths of that expertise as we try to fashion the kind of national policy and legislative solution to develop this cooperation

that is going to be so essential to the future, and I look forward

to continuing to cooperate with you.

I thank all of you who have joined us at this hearing today. As

I said at the beginning, this is an official hearing of the U.S. Senate Judiciary Committee’s subcommittee which I chair, and anyone

who wishes to communicate with us, we can put your comments in

the record if they are appropriate. If you have questions, obviously

submit them through me, and perhaps we will have an opportunity

to share those with our witnesses here today.

If there is nothing further, then I will declare this meeting adjourned.

[Whereupon, at 10:30 a.m., the subcommittee was adjourned.]

Æ