```

[Senate Hearing 106-838]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 106-838

         ``CYBER ATTACK: IMPROVING PREVENTION AND PROSECUTION''

=======================================================================

                                HEARING

                               before the

                 SUBCOMMITTEE ON TECHNOLOGY, TERRORISM,
                       AND GOVERNMENT INFORMATION

                                 of the

                       COMMITTEE ON THE JUDICIARY
                          UNITED STATES SENATE

                       ONE HUNDRED SIXTH CONGRESS

                             SECOND SESSION

                                   on

   EXAMINING HOW TO COMBAT CYBER ATTACKS BY IMPROVING PREVENTION AND 
                              PROSECUTION

                               __________

                             SCOTTSDALE, AZ

                               __________

                             APRIL 21, 2000

                               __________

                          Serial No. J-106-79

                               __________

         Printed for the use of the Committee on the Judiciary

                    U.S. GOVERNMENT PRINTING OFFICE
69-335                      WASHINGTON : 2001

                       COMMITTEE ON THE JUDICIARY

                     ORRIN G. HATCH, Utah, Chairman

STROM THURMOND, South Carolina       PATRICK J. LEAHY, Vermont
CHARLES E. GRASSLEY, Iowa            EDWARD M. KENNEDY, Massachusetts
ARLEN SPECTER, Pennsylvania          JOSEPH R. BIDEN, Jr., Delaware
JON KYL, Arizona                     HERBERT KOHL, Wisconsin
MIKE DeWINE, Ohio                    DIANNE FEINSTEIN, California
JOHN ASHCROFT, Missouri              RUSSELL D. FEINGOLD, Wisconsin
SPENCER ABRAHAM, Michigan            ROBERT G. TORRICELLI, New Jersey
JEFF SESSIONS, Alabama               CHARLES E. SCHUMER, New York
BOB SMITH, New Hampshire

             Manus Cooney, Chief Counsel and Staff Director

                 Bruce A. Cohen, Minority Chief Counsel

                                 ______

   Subcommittee on Technology, Terrorism, and Government Information

                       JON KYL, Arizona, Chairman

ORRIN G. HATCH, Utah                 DIANNE FEINSTEIN, California
CHARLES E. GRASSLEY, Iowa            JOSEPH R. BIDEN, Jr., Delaware
MIKE DeWINE, Ohio                    HERBERT KOHL, Wisconsin

           Stephen Higgins, Chief Counsel and Staff Director

        Neil Quinter, Minority Chief Counsel and Staff Director

                                  (ii)

                            C O N T E N T S

                              ----------                              

                    STATEMENTS OF COMMITTEE MEMBERS

                                                                   Page

Kyl, Hon. Jon, U.S. Senator From the State of Arizona............     1

                    CHRONOLOGICAL LIST OF WITNESSES

Panel consisting of Janet Napolitano, Attorney General, State of 
  Arizona; and Guadalupe, Gonzalez, Special Agent In Charge, 
  Phoenix Field Investigation, Federal Bureau of Investigation...     3
Panel consisting of David W. Aucsmith, chief security architect, 
  Intel Corp.; and Jose Grando, senior manager, Ernst & Young 
  LLP, Houston, TX...............................................    89

                ALPHABETICAL LIST AND MATERIAL SUBMITTED

Aucsmith, David W.:
    Testimony....................................................    89
    Prepared statement...........................................    93
Gonzalez, Guadalupe:
    Testimony....................................................    66
    Prepared statement...........................................    71
Granado, Jose:
    Testimony....................................................   102
    Prepared statement...........................................   104
Napolitano, Janet:
    Testimony....................................................     3
    Prepared statement...........................................     5
        Letter from the Attorney General.........................    11
        Summary..................................................    13
        Computer Crimes Act of 2000..............................    15
        Attorney General's Website...............................    54
        News Articles............................................    57

 
         ``CYBER ATTACK: IMPROVING PREVENTION AND PROSECUTION''

                              ----------                              

                         FRIDAY, APRIL 21, 2000

                           U.S. Senate,    
         Subcommittee on Technology, Terrorism,    
                        and Government Information,
                                Committee on the Judiciary,
                                                    Scottsdale, AZ.
    The subcommittee met, pursuant to notice, at 9 a.m., in 
City Council Chambers, Scottsdale, AZ, Hon. Jon Kyl (chairman 
of the subcommittee) presiding.

  OPENING STATEMENT OF HON. JON KYL, A U.S. SENATOR FROM THE 
                        STATE OF ARIZONA

    Senator Kyl. This hearing will please come to order.
    Let me first welcome everyone to this field hearing of the 
Subcommittee on Technology, Terrorism, and Government 
Information of the U.S. Senate Judiciary Committee. It is 
encouraging to see so many people who are interested in this 
critical subject. Before we begin, I want to thank the Mayor of 
Scottsdale, Sam Campana, for hosting us here at the Scottsdale 
City Council chambers and for the assistance of Peggy Carpenter 
from the city of Scottsdale, who helped set up this hearing. I 
also want to thank Ed Denison from the Arizona Software 
Association for his assistance in spreading the word about the 
hearing, and, finally, to say hello to the people watching this 
hearing on the city of Scottsdale's Cable Television channel.
    The danger from cyber attack has recently received a lot of 
attention. The denial-of-service attacks against popular 
Internet sites like Yahoo, eBay, and CNN and the arrest earlier 
this week of a Canadian teenager in the case brought home to 
Americans just how vulnerable we are. This is the seventh 
hearing I have held on the subject in the past 3 years, and it 
won't be the last.
    In examining how to combat cyber attacks, it is important 
to reflect on how the Information Age is rapidly transforming 
our society. Today, virtually every key service is dependent 
upon computers--from electrical power grids, to phone systems, 
air traffic control, banking, military early-warning networks. 
The list goes on and on. Unfortunately, most of these critical 
computer networks were not designed with good security measures 
in mind.
    America's increased dependence on computer networks must 
also be viewed in context of our changing role in the post-cold 
war world. The United States is the world's only superpower, 
and our armed forces enjoy technological superiority on the 
battlefield. I sit on the Senate Intelligence Committee, and I 
receive a lot of briefings from the CIA and others about 
threats facing our country. The overriding trend in these 
briefings is that nations and terrorist groups that are hostile 
to our interests are increasingly choosing not to confront our 
military strengths directly--that is, by trying to field fleets 
of advanced fighter planes or aircraft carriers on a par with 
ours--but, rather, are seeking to exploit our vulner-
abilities, looking hard for our Achilles heel. As the ancient 
Chinese military strategist Sun Tzu said, ``You can be sure of 
succeeding in your attacks if you only attack places which are 
undefended.''
    China's current military strategists appear to have taken 
this lesson to heart. A recent article in the official 
Liberation Army Daily stated that China is considering creating 
a fourth branch of the military for information warriors and 
said ``Internet warfare'' should be equated with air, land, and 
sea combat operations.
    Russia is another country of concern in this area. Last 
year, a series of widespread intrusions were detected on 
computer networks operated by the Defense Department, other 
Federal agencies, and the private sector. The FBI traced these 
intrusions to Russia in an operation dubbed Moonlight Maze. 
According to the FBI, the attacks resulted in the theft of vast 
quantities of unclassified, but still sensitive information 
about defense technological 
research matters. Although the details of the case are 
classified, according to Newsweek Magazine, the primary 
suspects in the intrusions, which have since terminated, are 
``crack cyber spooks from the Russian Academy of Sciences, a 
government-supported organization that interacts with Russia's 
top military labs.'' And Russia and China are not the only 
countries of concern. According to the National Security 
Agency, over a dozen countries are working on information 
warfare techniques.
    U.S. military planners have also begun to try to assess how 
cyber attacks could affect our military's performance and to 
take steps to close those vulnerabilities. In 1997, the Joint 
Chiefs of Staff conducted an exercise called Eligible Receiver 
to find out how easy it would be for an enemy to attack U.S. 
military communication systems and other critical 
infrastructures. During the exercise, a small team of 2 dozen 
people used readily available computer hacking tools to attack 
the military's critical infrastructures and within 4 days 
crippled our ability to respond to a simulated crisis in the 
Pacific theater. They also broke into networks that control the 
electric power grid for the entire United States.
    In addition to being conscious of the threat from foreign 
countries and the need to take steps to improve the security of 
the critical computer networks, we need to combat computer 
hacking by criminals here in the United States, which can also 
have very serious consequences. The number of computer crimes 
is rapidly increasing, and we need to be sure that Federal, 
State, and local law enforcement agencies have the tools they 
need to investigate and prosecute violators.
    Catching and punishing those who commit cyber crimes is 
essential for deterring future attacks. When a cyber attack 
occurs, it is not initially apparent whether the perpetrator is 
a mischievous teenager, a professional hacker, a terrorist 
group, or even a hostile nation. Law enforcement must be 
equipped with the resources and authorities necessary to 
swiftly trace a cyber attack back to its source and 
appropriately prosecute criminals.
    Finally, it is important to recognize that private 
companies own and operate the vast majority of the computer 
networks used to operate our critical infrastructure. We must 
raise awareness in industry about cyber threats, encourage 
companies to take responsible steps to protect themselves, and 
remove roadblocks to effective industry cooperation. For 
example, protection from attack necessitates that information 
about cyber vulnerabilities and threats be communicated among 
companies and with government agencies. Antitrust laws that 
were created to prevent collusion among competitors in an 
industry need to be updated to allow companies to cooperate in 
establishing good cyber security. Furthermore, the Freedom of 
Information Act may need to be updated to encourage companies 
to share information with the Federal Government. Communication 
is critical for protection, and these roadblocks need to be 
removed.
    Our witnesses are well suited to address these issues. On 
our second panel, David Aucsmith, the Intel Corporation's top 
security specialist, will discuss some of the trends and 
challenges in cyber security, and Jose Granado, a senior 
manager of Ernst & Young, will conduct a live computer hacking 
demonstration. Guadalupe Gonzalez, the special agent in charge 
of the FBI's Phoenix Office, will provide the Federal law 
enforcement perspective on cyber crime.
    Before we hear from these three experts, I would like to 
introduce our first witness, Arizona Attorney General Janet 
Napolitano. Ms. Napolitano has served as attorney general since 
January 1999, and prior to her election to this post, she 
served for over 4 years as the U.S. attorney for Arizona.
    Attorney General Napolitano, thank you very much for 
testifying at today's hearing. Your full statement and that of 
all of the witnesses will be included in the record, and I 
would invite you to make any summary remarks at this time.

 PANEL CONSISTING OF JANET NAPOLITANO, ATTORNEY GENERAL, STATE 
 OF ARIZONA; AND GUADALUPE GONZALEZ, SPECIAL AGENT IN CHARGE, 
  PHOENIX FIELD INVESTIGATION, FEDERAL BUREAU OF INVESTIGATION

                 STATEMENT OF JANET NAPOLITANO

    Ms. Napolitano. Thank you, Mr. Chairman, and thank you for 
inviting me to be here today and for your long-time interest in 
the cyber area. You have truly been a national leader in this 
regard, and we are grateful.
    Arizona is one of the leading States, I believe, in 
prosecuting computer crime. In the Attorney General's office, 
we have established a Technology Crimes Unit. The head of that 
unit is with me today, Gail Thackery, who is one of the 
Nation's leading prosecutors in this emerging area.
    We also now have one of the most comprehensive computer 
crime statutes in the country that was passed by the 
legislature this past session, was recently signed into law by 
Governor Jane Hull, and had broad bipartisan support.
    Let me, if I might, divide my summary remarks into three 
brief categories, and I understand my full statement will be 
admitted into the record. But the three categories are what 
kinds of things we're seeing at the State level in Arizona, 
what is in our cyber crime legislation that supports and 
augments what is in some of the proposed Federal legislation, 
and, finally, what we as State prosecutors would like to see 
from the Federal Government.
    But, very briefly, lest we think that all cyber crime takes 
place internationally or in cyberspace somewhere else, we have 
a great deal of it here in Arizona, and it really doesn't 
matter whether you are in urban Arizona or rural Arizona. 
Anywhere you have a PC you have the potential of a cyber crime.
    Currently, we have cases in our office pending involving 
the five following kinds of cyber crime: cyber stalking, online 
school threats, infrastructure attacks and hacker offenses, 
fraud--in fact, in our Consumer Fraud Division in the Attorney 
General's office, we have now created a separate way to track 
the Internet fraud cases so that we can follow the trend line 
more accurately as to what kinds of fraud we are seeing on the 
Internet--and child sexual exploitation cases. We currently 
have task forces involving child sexual exploitation in Tucson 
and Phoenix, and our office is helping Arizona post the 
training agency for law enforcement train investigators and 
prosecutors in this area.
    So you can see we have quite a panoply of different types 
of computer crimes. Some are old kinds of crime committed in 
new ways, i.e., fraud. Some are new crimes that we could not 
have imagined 20 years ago.
    To deal with this, our office proposed the Computer Crime 
Act of 2000 in Arizona, and briefly, Senator, that statute, 
which is attached to part of my testimony, has six parts. One 
is cyber terrorism, and it raises the penalties for disrupting 
operations of things like utilities, emergency services, 
medical institutions, traffic control and the like.
    It contains cyber tools for law enforcement. For the first 
time, for example, our office has the ability to seek the 
source of e-mails through desk subpoenas rather than having to 
go continually to court, a concept I think that the FBI is 
supporting federally.
    It has sections on forgery, fraud, and theft, and 
acknowledges that people have online identities that themselves 
can be the subject of the theft of identity.
    It has a new felony for cyber stalking because the current 
laws were not adequate to deal with the prosecution of those 
offenses.
    It has a felony for computer use and disruption. The denial 
of service attacks you mentioned in your opening statement are 
now felonies in Arizona. I think we are one of the few 
jurisdictions in the country that actually has that.
    And, finally, it has provisions related to child 
pornography on the Internet, and it adds the offense of 
luring--l-u-r-i-n-g--meaning that the offense of sexual 
solicitation of a minor is committed with the solicitation 
itself. It doesn't require any further act in furtherance of 
the crime of meeting the minor in order to be able to charge 
the higher felony. We make the solicitation itself, the luring, 
a crime on the Internet. So that is the new Arizona bill.
    Now, we have a Technology Crimes Unit, as I mentioned, and 
I might like to say that this year the legislature, under the 
leadership of Representative Jim Wyers from the northwest part 
of the valley, passed a bill that provides some monetary 
resources both to the Attorney General's office and to the 
Department of Public Safety to help us meet the increasing 
need. And as good a bill as that is, it is only a first step in 
terms of the resources that State and local prosecutors are 
going to need. The chief thing we need from the Feds, if I can 
use the nickname, right now is training and resources.
    Attorneys, investigators, and prosecutors with computer 
skills are in incredible demand. We are unable to hire people 
with this expertise because State and local public salaries 
simply are not competitive in the current marketplace. That 
means what we need to do and what we are doing is training 
people who are already in public service on how to deal with 
these new kinds of crime. That means training is very, very 
key. It is expensive, and it also requires equipment that is 
continually updated to match what is out there in the field.
    As I have already indicated, the bulk of prosecuting these 
crimes, the bulk of these crimes, be it identity theft, be it a 
child pornography case, be it a luring case, are going to end 
up being prosecuted by State and local authorities because that 
is where the bulk of prosecutions in this country occurs in any 
area. And the same is holding true in cyber crime.
    So we would like to emphasize the need for training 
resources, and there are existing vehicles already in place to 
deliver that training, both through the National District 
Attorneys Association and the National Association of Attorneys 
General. NAAG, by the way, has made cyber crime one of its top 
priorities, and I would ask that the Senate and that you 
consider how we make those training resources available on a 
continual basis, not a one-time thing but continual, because 
the technology keeps changing.
    The other idea I would like to offer to you, Sir, is 
something that is reminiscent of what the Senate and the 
Congress did in the 1970's when they provided seed money to 
Attorneys General to open up or to start antitrust units or 
economic competition units within their offices to handle those 
kinds of cases. Seed money for every Attorney General to have a 
cyber crime unit such as we have in Arizona, or to build on one 
if they already have one, I think would provide a very big bang 
for the buck in the sense of expanding our reach, expanding our 
prosecutorial resources, and expanding what we can do working 
with these new technologies to make sure and to ensure that 
basic law enforcement is being carried out, be it in cyberspace 
or be it on the ground.
    Thank you very much.
    [The prepared statement of Ms. Napolitano follows:]

                 Prepared Statement of Janet Napolitano

    Mr. Chairman, thank you for the opportunity to address your 
subcommittee today. As the Attorney General of Arizona, I am here to 
report on our state's activities in combating and prosecuting 
cybercrime. Cybercrime is an emerging issue in law enforcement as an 
increasing number of crimes are committed using computers and other 
technologies. In fact, while we have seen a decline in violent crime, 
cybercrime has increased exponentially. As crime migrates to the 
Internet and other frontiers of technology, law enforcement must be 
adequately prepared to apprehend and prosecute the criminals.
    Instead, law enforcement has had a difficult time keeping up with 
cybercrime. Laws have been found to be inadequate in dealing with new 
technologies. The speed with which technology advances demands rapid 
and innovative solutions to complex problems. Lastly, there is a 
desperate lack of resources for cybercrime law enforcement. There are 
three issues I want to discuss today--legislation, emerging issues in 
cybercrime and current challenges facing law enforcement.

          ARIZONA LEGISLATION--THE COMPUTER CRIMES ACT OF 2000
    The Office of the Attorney General drafted the Computer Crime Act 
of 2000, which was sponsored and passed by a bi-partisan coalition of 
legislators. HB 2428, recently signed into law by Governor Jane Dee 
Hull, is designed to better protect Arizona citizens from cybercrime, 
which is a threat to private citizens, public infrastructure, 
businesses, and government, as these incidents prove:

     In 1998 a computer user in Arizona hacked his way onto a 
billing database of a public utility, looking to cancel someone's 
account. Once in the system, he gained high-level access to the canal 
controlling system, putting the system at serious risk.
     Just this past year, a young man, angry at his ex-
girlfriend, posted pictures of her and assumed her identity on the 
Internet. Through sexually explicit e-mail with other users, he put the 
young woman in great danger to potentially become a victim of sexual 
assault or worse by inviting people to her home and workplace.
     Phoenix man hacked into the computer of an Internet 
Service Provider in Canada and crashed the server, disabling the entire 
network, including all e-mail services, for a week. Numerous businesses 
and individuals lost valuable information, time and money.

    There are six parts to this legislation:
Cyberterrorism
    We must use every means available to crack-down on attacks on our 
high-tech infrastructure. This section raises judicial penalties for 
disrupting operations of utilities, emergency services, medical 
institutions, traffic control, etc.
Cybertools for law enforcement
    Cybertools strengthen law enforcement's ability to preserve 
electronic evidence and to trace rapidly criminal activity on the 
Internet.
Forgery, fraud and theft
    Private individuals and businesses must be protected from 
electronic forgery, fraud and theft. New provisions such as these 
update our laws, demonstrating that individuals and companies have an 
``online'' identity that can be used by others in criminal or malicious 
activity. Fraud statutes must protect Internet consumers and businesses 
against crimes such as theft of trade secrets, credit card fraud, 
identity theft and forgery.
Cyberstalking
    Current statutes did not provide adequate protection from 
cyberstalking, where physical contact between the victim and stalker 
may never occur. The new legislation includes the unique and technical 
aspect of cyberstalking and provides an effective tool for prosecution 
and prevention.
Computer use and disruption
    When a company or an individual loses their access to the Internet, 
they can lose contact to their customers, business records, financial 
information, and other materials hindering their ability to work, 
retrieve data, and communicate. This section is designed to deter 
several forms of disruption which have not been covered by the current 
statute.
Child pornography
    The section protects computer repair technicians and others who 
report child pornography to the police. It also adds the offense of 
``luring,'' to attack effectively the online solicitation or offering 
of a child with an intent of sexual exploitation. Individuals would be 
held criminally liable for any sexually explicit material knowingly 
transmitted to a school or minor.
    The Computer Crimes Act of 2000 goes into effect July 18, 2000.

                            EMERGING ISSUES
    Law enforcement and the public at large have raised several issues 
that Congress and the states will have to come to terms with in the 
near future. Two of the ones my office is working on are Privacy and 
the Theft of Intellectual Property.
Privacy
    The public is becoming increasingly concerned over the collection 
and ownership of personal identifying information. The traditional 
American model is that organizations that gather information about 
individuals become the owners of that information, and can use it for 
their own purposes or even sell it to others. The phrase seen in hacker 
chat rooms currently is, ``You have no privacy now--get over it.''
    On the other hand, for 25 years or more, many countries have had 
strong privacy protections including transborder data flow statutes 
prohibiting the transfer of personal data across national boundaries, 
and others laws forbidding the ``secondary use'' of personal data 
without permission of the individual. In fact, American corporations 
have just agreed to honor European Union privacy rules which are much 
more stringent than any they observe in this country, in connection 
with our own citizens' data.
    We have made tremendous advances with the use of the Internet in 
numerous fields. But at the same time, the Internet poses a threat to 
individual privacy--and security--on a scale never imaginable in 
earlier times, when records pertaining to individuals were maintained 
by corporations and public agencies in separate files scattered across 
the business and government landscapes.
    The time has come for a comprehensive assessment of our nation's 
business practices with regard to the collection and use of personal 
data. The national epidemic of Identity Theft crimes is proof that we 
also need to establish industry standards for maintaining the security 
and accuracy of information that is collected about individuals. I 
intend to work with Arizona business, consumer and privacy groups in 
the next legislative session to craft legislation that will offer our 
citizens reasonable assurance that they know what information is being 
collected about them, have an opportunity to correct inaccuracies, and 
have some say in what is done with their personal data. I believe that, 
working together, Arizona citizens and businesses can establish a 
reasonable framework for protecting individual privacy in a world where 
all records are online, all the time.
Theft of intellectual property
    The Internet has also caused another revolution--the quick and 
rapid distribution of many perfect copies of the same original. 
Arizona's ``Silicon Desert'' is an important and fast-growing part of 
our economy, and the protection of our information resources is 
critical. Currently, the Federal copyright statute preempts the states 
from enforcing thefts of intellectual property such as software, video 
and music, yet the Federal agencies only have the resources to pursue a 
tiny fraction of the reported offenses. This situation robs our 
American businesses of billions of dollars a year, and allows the 
thieves to flourish.
    As a former United States Attorney, I understand the limitations of 
resources among the Federal agencies. However, every year a number of 
business victims come to our office for help, but the Federal 
preemption of copyright theft leaves us powerless to help them. I know 
that industry would support a change in the copyright law to permit 
enforcement at the state level, and I urge Congress to amend the 
copyright laws to permit enforcement by both Federal and State 
agencies. A strong information economy requires strong protection for 
our information assets.

                     CONCLUSION--CURRENT CHALLENGES
    The Arizona Attorney General's Office is charging ahead in 
partnership with various groups to address Arizona's state of emergency 
regarding cybercrime.

     Law Enforcement--we have created a three-tiered training 
program:

    1. A two-day comprehensive evidence seizure and crime scene 
procedure class. This will be certified by AZ POST and taught by the 
Department of Public Safety, the Attorney General's Office and other 
agencies. The goal is to create regional expert teams, similar to the 
meth lab multi-agency teams, and certify 200 officers in the State.
    2. Police officers training to teach various tools and programs for 
extracting computer evidence and creating a case ready for prosecution.
    3. Detective training to teach the special skills necessary to 
perform investigations in cyberspace.

     Communication Industry--We are working with on-line 
providers to develop standardized policies and forms for legal 
procedures necessary to obtain computer evidence.
     Business--We are working with corporations to assist in 
raising awareness on computer security issues and using their expertise 
to help train law enforcement.
     Schools--We are working closely with schools and school 
districts to deal with the increasing problem of school online threats.
     Public--We are conducting townhalls throughout Arizona to 
educate the public at large particularly seniors and parents, to 
potential dangers on the Internet.

    In addition to the work being done in Arizona, other states have 
also been active: California has established regional task forces; the 
Attorney General of Illinois has established a state level unit to 
investigate and prosecute computer crimes; and the Attorney General of 
South Carolina has, with the assistance of the Office of Juvenile 
Justice and Delinquency Programs in the U.S. Department of Justice, 
created a task force to investigate and prosecute child pornographers 
and pedophiles. In fact, Attorneys General from around the country have 
made cybercrime a high priority for the National Association of 
Attorneys General.
    But like Arizona, states face two major obstacles in setting up 
units or task forces to address computer crimes: staff and equipment. 
Attorneys, investigators and prosecutors with computer skills are in 
high demand. Unable to hire and retain these skilled professionals at 
state salaries, states have turned to grooming these professionals 
within current ranks. Training, however, is expensive and not enough 
police and prosecutors are receiving it. Equipment to investigate these 
crimes is also expensive and must be constantly updated to keep pace 
with technology.
    Participation of the states in protecting the nation's 
infrastructure by investigating and prosecuting computer crimes is 
critical. As in other areas of criminal law, the states will 
undoubtedly carry the bulk of the computer crime investigations and 
prosecutions and, in the area of juvenile prosecutions, the states will 
have the full burden of those cases. This burden is likely to be 
considerable because computers have become ubiquitous in almost every 
type of crime.
    The efforts of Arizona and other states to address computer crimes 
must be nurtured by the Federal Government. The states need direct 
Federal funding to establish computer forensic laboratories.
    The development of a basic curriculum for prosecutors is underway. 
The means to execute the training and to provide ongoing technical 
assistance exists through the National Association of Attorneys General 
and the National District Attorneys Association. Unfortunately, we are 
missing the funding to implement the training and assistance. 
Approximately $1 million a year for 5 years would allow over 100 
prosecutors to be trained each year.
    To combat cybercrime, states need a program to provide seed money 
to assist with hiring knowledgeable staff and buying much needed 
equipment should be established on the Federal level. This program 
would need to provide a minimum of $500,000 per year per state for at 
least 3 years to allow the states to establish programs and begin 
funding them.
    Updates to the law, such as Arizona's Computer Crimes Act 2000, is 
a powerful first step in the battle against cybercriminals. But 
resources, applied intelligently, would revolutionize law enforcement's 
ability to respond swiftly and effectively to cybercrime.
    I look forward to working with this Subcommittee and other Federal 
entities to ensure that we have a coordinated Federal-State effort to 
combat cybercrime.
    Once again, thank you for inviting me to present the perspective of 
the Arizona Attorney General's Office and I would be pleased to answer 
any questions from Subcommittee members.
[GRAPHIC] [TIFF OMITTED] T9335.001

[GRAPHIC] [TIFF OMITTED] T9335.002

[GRAPHIC] [TIFF OMITTED] T9335.003

[GRAPHIC] [TIFF OMITTED] T9335.004

[GRAPHIC] [TIFF OMITTED] T9335.005

[GRAPHIC] [TIFF OMITTED] T9335.006

[GRAPHIC] [TIFF OMITTED] T9335.007

[GRAPHIC] [TIFF OMITTED] T9335.008

[GRAPHIC] [TIFF OMITTED] T9335.009

[GRAPHIC] [TIFF OMITTED] T9335.010

[GRAPHIC] [TIFF OMITTED] T9335.011

[GRAPHIC] [TIFF OMITTED] T9335.012

[GRAPHIC] [TIFF OMITTED] T9335.013

[GRAPHIC] [TIFF OMITTED] T9335.014

[GRAPHIC] [TIFF OMITTED] T9335.015

[GRAPHIC] [TIFF OMITTED] T9335.016

[GRAPHIC] [TIFF OMITTED] T9335.017

[GRAPHIC] [TIFF OMITTED] T9335.018

[GRAPHIC] [TIFF OMITTED] T9335.019

[GRAPHIC] [TIFF OMITTED] T9335.020

[GRAPHIC] [TIFF OMITTED] T9335.021

[GRAPHIC] [TIFF OMITTED] T9335.022

[GRAPHIC] [TIFF OMITTED] T9335.023

[GRAPHIC] [TIFF OMITTED] T9335.024

[GRAPHIC] [TIFF OMITTED] T9335.025

[GRAPHIC] [TIFF OMITTED] T9335.026

[GRAPHIC] [TIFF OMITTED] T9335.027

[GRAPHIC] [TIFF OMITTED] T9335.028

[GRAPHIC] [TIFF OMITTED] T9335.029

[GRAPHIC] [TIFF OMITTED] T9335.030

[GRAPHIC] [TIFF OMITTED] T9335.031

[GRAPHIC] [TIFF OMITTED] T9335.032

[GRAPHIC] [TIFF OMITTED] T9335.033

[GRAPHIC] [TIFF OMITTED] T9335.034

[GRAPHIC] [TIFF OMITTED] T9335.035

[GRAPHIC] [TIFF OMITTED] T9335.036

[GRAPHIC] [TIFF OMITTED] T9335.037

[GRAPHIC] [TIFF OMITTED] T9335.038

[GRAPHIC] [TIFF OMITTED] T9335.039

[GRAPHIC] [TIFF OMITTED] T9335.040

[GRAPHIC] [TIFF OMITTED] T9335.041

[GRAPHIC] [TIFF OMITTED] T9335.042

[GRAPHIC] [TIFF OMITTED] T9335.043

[GRAPHIC] [TIFF OMITTED] T9335.044

[GRAPHIC] [TIFF OMITTED] T9335.045

[GRAPHIC] [TIFF OMITTED] T9335.046

[GRAPHIC] [TIFF OMITTED] T9335.047

[GRAPHIC] [TIFF OMITTED] T9335.048

[GRAPHIC] [TIFF OMITTED] T9335.049

[GRAPHIC] [TIFF OMITTED] T9335.050

[GRAPHIC] [TIFF OMITTED] T9335.051

[GRAPHIC] [TIFF OMITTED] T9335.052

[GRAPHIC] [TIFF OMITTED] T9335.053

[GRAPHIC] [TIFF OMITTED] T9335.054

[GRAPHIC] [TIFF OMITTED] T9335.055

[GRAPHIC] [TIFF OMITTED] T9335.056

[GRAPHIC] [TIFF OMITTED] T9335.057

    Senator Kyl. Thank you very much. That is very helpful, and 
I have got several questions that I have noted.
    But let me first turn to our next witness, Mr. Guadalupe 
Gonzalez, the special agent in charge of the FBI's Phoenix 
Field Office. Mr. Gonzalez has served in his post since August 
1998. Prior to coming to Phoenix, he was the special agent in 
charge of organized crime, drugs, and violent crimes in the 
FBI's Los Angeles office.
    Mr. Gonzalez, thank you very much for testifying at today's 
hearing. As I noted before, your full written statement will be 
placed in the record. I would like to invite you to make any 
summary remarks at this time, and I would note to the people 
who are here, in the hearing that we held a couple of weeks ago 
in Washington, DC, on this same subject, the FBI Director Louis 
Freeh presented his testimony, and in asking him how best to 
relate that testimony to people in Arizona, he suggested that 
we ask Mr. Gonzalez to be his representative here. And we are 
delighted to do that, so thank you.

                STATEMENT OF GUADALUPE GONZALEZ

    Mr. Gonzalez. Good morning, Mr. Chairman. Thank you for 
inviting me to the field hearing to discuss the growing problem 
of cyber crime and our response to it. Our ability in the field 
to deal with this crime problem requires the support of 
Congress. The recent denial-of-service attacks against Yahoo, 
Amazon.com, eBay, CNN, Buy.com, and other e-commerce websites 
have thrust the security of our information infrastructure into 
the spotlight. But they are only one example of a large and 
growing problem of criminal activity in cyberspace. I would 
like to discuss with you the national challenge of battling 
computer intrusions.
    The cyber revolution has permeated virtually every facet of 
our lives, and we see its effects all around us in the way we 
communicate, do business, and even in the way Government 
operates. Unfortunately, that revolution has affected the 
nature of criminal activity as well. Criminals are increasingly 
seeing the utility of cyber tools to facilitate traditional 
crimes such as fraud, extortion, and dissemination of child 
pornography. And they are also inventing new forms of crime 
which make computers and the information stored on them the 
targets of the crime. Thus, we see criminals intruding into 
computers to steal credit card numbers, to abscond with 
proprietary information, and to shut down e-commerce sites. And 
this is not just a criminal problem. It is also a national 
security problem. This is because our Nation's critical 
infrastructures, by which I mean those services that are vital 
to our economy and national security, such as electrical 
energy, telecommunications, banking and finance, 
transportation, and government operations, are now dependent on 
computer technology for their very operations. And this very 
dependence makes them vulnerable to an attack which, if 
successful, could deny service on a broad scale.
    The same basic types of cyber attack tools, therefore, 
become attractive not only to criminals interested in illicit 
financial gain, but also to foreign intelligence services 
seeking new ways to obtain sensitive government or industry 
information and to terrorists of hostile foreign nations bent 
on attacking U.S. interests.
    The difficulty of dealing with this challenge stems from 
the nature of the cyber environment. The cyber environment is 
borderless, afford easy anonymity and methods of concealment to 
bad actors, and provides new tools to allow for remote access 
to targeted computers. A criminal sitting on the other side of 
the planet is now capable of stealthily infiltrating a computer 
network in Arizona to steal money, abscond with proprietary 
information, or shut down 
e-commerce sites.
    To deal with this problem, law enforcement has retooled its 
workforce, its equipment, and its own information 
infrastructure. It must also forge new partnerships with 
private industry, other agencies, and our international 
counterparts.
    We at the FBI have been doing all of these things for the 
last 2 years, but we must continue to build upon our progress 
to ensure that we can perform our responsibilities to protect 
public safety and national security in the information age.
    My written statement provides an overview of the broad 
spectrum of cyber threats which gives a flavor of the 
incredibly varied nature of the threats we face. The examples 
range from insiders bent on revenge against their employers, to 
hackers seeking bragging rights in the hacking community, to 
criminal groups stealing credit card numbers or money, to 
foreign intelligence agencies or foreign military services who 
target U.S. interests.
    The most common threats we face are from hackers and 
criminals stealing for profit. For example, in March, 
authorities in the United Kingdom, acting in coordination with 
the FBI, arrested two individuals for alleged intrusions into 
e-commerce sites in several countries and the theft of credit 
card information on over 26,000 accounts. One subject used the 
Internet alias ``CURADOR.'' Losses from this case could exceed 
$3 million. The FBI cooperated closely with the Dyfed-Powys 
Police Department in the United Kingdom and the Royal Canadian 
Mounted Police in Canada and private industry.
    Here in Arizona, we are investigating a computer intrusion 
case in which a private enterprise was defrauded of several 
hundred thousand dollars in fraudulent telephone calls that 
were placed to a foreign country.
    We are also concerned about the terrorist threat. Terrorist 
groups are increasingly using new information technology and 
the Internet to formulate plans, raise funds, spread 
propaganda, and to communicate securely. Director of Central 
Intelligence George Tenet has testified that terrorist groups, 
``including Hizbollah, Hamas, the Abu Nidal organization, and 
Bin Laden's al Qa'ida organization are using computerized 
files, e-mail, and encryption to support their operations.''
    While we have not yet seen these groups employ cyber tools 
as a weapon to use against critical infrastructures, their 
reliance on information technology and acquisition of computer 
expertise are clear warning signs.
    Finally, given the presence of military research facilities 
in Arizona, we must be concerned with national security 
threats. As you know, the FBI has observed a series of 
intrusions into numerous Department of Defense and other 
Federal Government computer networks and private sector 
entities. An investigation last year determined that the 
intrusions appear to have originated in Russia. The intruder 
successfully accessed U.S. Government networks and took large 
amounts of unclassified but sensitive information, including 
defense technical research information.
    Here in Arizona, we have seen scans of military computer 
systems by outside intruders. Some of the logs indicate that 
the source of some of these scans may be foreign.
    The recent distributed denial-of-service attacks have 
garnered a tremendous amount of interest in the public. Because 
the FBI is actively investigating these attacks, I cannot 
provide a detailed briefing on the status of our efforts. 
However, I can tell you that all FBI field offices, including 
the Phoenix Division, have been asked to assist on a case to 
the extent that entities in our jurisdiction are involved in 
the matter or to the extent that we can cover leads within our 
jurisdiction.
    In February 1998, the National Infrastructure Protection 
Center, NIPC, was established as a focal point for the Federal 
Government's efforts to protect the critical infrastructures. 
On October 2, 1998, the center was designated a branch of the 
FBI's National Security Division, and the National 
Infrastructure Protection and Computer Intrusion Program was 
approved as an investigative program. This program is a tier 
one priority under the FBI's strategic plan and serves as the 
FBI's vehicle for performing the infrastructure protection 
mission assigned to the NIPC under Presidential Decision 
Directive 63. In October 1999, the program was moved to a 
newly-formed Counterterrorism Division of the FBI, reflecting 
the FBI's high priority on protecting the infrastructures from 
terrorist threats.
    At headquarters, the NIPC has a budget of approximately $21 
million. This is not slated to increase in fiscal year 2001. 
There are currently 193 agents in the field devoted to NIPC 
matters as well as 101 personnel at FBI headquarters. The NIPC 
at headquarters also houses 19 interagency detailees, mainly 
from the law enforcement, defense, and intelligence 
communities. The NIPC works closely with foreign counterparts 
on case-related matters.
    Beyond the NIPC at FBI headquarters, a cyber crime 
investigative program has been created in all FBI field 
offices, including the Phoenix Division. We have special agents 
here who are responsible for investigating computer intrusions, 
viruses, or denial-of-service attacks, and for conducting 
critical liaison activities with private industry. Given the 
amount of work we have and the fact that Phoenix is the sixth 
largest city in the United States, we are seeking to establish 
a full computer intrusion squad in the Phoenix Division by the 
year 2002.
    One major difficulty that distinguishes cyber threats from 
physical threats is determining who is attacking your system, 
why, how, and from where. This difficulty stems from the ease 
with which individuals can hide or disguise their tracks by 
manipulating logs and directing their attacks through networks 
in many countries before hitting their ultimate target. This 
will continue to pose a problem as long as the Internet remains 
rife with vulnerabilities and allows easy anonymity and 
concealment.
    Another significant challenge we face is intrusions 
involving multiple jurisdictions. A typical investigation 
involves victim sites in multiple States and often many 
countries. This is the case even when the hacker and the victim 
are both located in the United States. In the United States, we 
can subpoena records, engage in judicially approved electronic 
surveillance, and execute search warrants on suspects' homes, 
seize evidence, and examine it. We can do none of these things 
ourselves overseas; rather, we depend on the local authorities 
to assist us.
    The most difficult situation will arise, however, when a 
foreign country with interests adverse to our own simply 
refuses to cooperate. In such a situation, we could find that 
an investigation is stymied unless we can find an alternative 
method of tracing the activity back to its source.
    Our challenge lies in continuing to expand our computer 
investigative, analytic, training, and outreach programs. Given 
the explosive and continued growth of computer intrusions, the 
Infrastructure Protection and Computer Intrusion Program needs 
to more than double the current number of field investigative 
personnel and headquarters analysts. In addition, we need to 
leverage our resources by expanding our training programs to 
reach more State, local, and international investigators. 
Finally, NIPC investigators need high-speed computer processing 
and large-capacity storage for investigations.
    I have tried to review with you some of the threats and 
challenges we face. Some of the challenges stem from the 
structure of the present loss governing computer crime. For 
example, we should ask whether the sentencing guidelines for 
computer crime are adequate and whether the $5,000 threshold 
for damage is a useful benchmark, because in many cases the 
true damage cannot be measured in monetary terms. Examples of 
damage difficult to measure monetarily are impairment of 
medical diagnosis, threat to public safety, or damage to 
national security, national defense, or administration-of-
justice computers.
    Another problem we face is having to obtain multiple trap 
and trace orders for different jurisdictions. The Kyl-Schumer 
bill addresses these concerns and other concerns. We support 
the goal of Senate bill 2092 to strengthen the general 
deterrence aspects of the Computer Fraud and Abuse Act and to 
provide some needed procedural enhancements to help us confront 
the expanding criminal threat in this dynamic and important 
part of our national economy, while continuing to protect 
individual privacy interests. The FBI looks forward to working 
with this committee on this important legislation.
    Addressing the threat of cyber crime requires teamwork--
teamwork among Government agencies, teamwork between Federal, 
State, and local law enforcement, and teamwork between the 
Government and the private sector. We have made much progress 
in establishing this sort of teamwork on all three fronts over 
the last 2 years. The FBI is also developing cyber crime task 
forces in partnership with State and local law enforcement 
entities within their jurisdiction to leverage the limited 
resources in this area. The first one was founded in Pittsburgh 
in March. We hope that one can be established in our 
jurisdiction in the next few years as the program expands.
    The partnerships we have established with the private 
sector are particularly important for several reasons. Most of 
the victims of cyber crimes are private companies; therefore, 
successful investigation and prosecution of cyber crimes 
depends on private victims reporting incidents to law 
enforcement and cooperating with investigators. Second, the 
network administrator, who alone knows the intricacies of his 
or her network, often must provide critical assistance to the 
investigation leading him to the evidence of the intruder's 
activity.
    Much has been said over the last few years about the 
importance of information sharing. Here in the Phoenix 
Division, we have an excellent working relationship with our 
private sector counterparts and the community in general. We 
share information on a number of areas, including 
infrastructure protection, and receive information from the 
private sector that greatly assists in protecting the 
community.
    As a result of our close working relationship with the 
private sector, we can detect criminal activity in its initial 
stages and in some cases prevent criminal incidents. The NIPC 
also provides the private sector with warning information which 
also lessens their vulnerability. These warnings assist field 
offices like Phoenix to be better prepared and better protect 
our community. They further allow us the opportunity to respond 
quickly and efficiently to cyber threats. I believe that as 
companies continue to gain experience in dealing with the NIPC 
and the FBI field offices, as we continue to provide them with 
important and useful threat information, and as companies 
recognize that cyber crime requires a joint effort by industry 
and Government together, we will continue to make real progress 
in the area.
    Our Key Asset Initiative facilitates response to threats 
and intrusion incidents by building liaison and communication 
links with the owners and operators of individual companies in 
the critical infrastructure sectors and enabling contingency 
planning. The Key Asset Initiative initially will involve 
determining which assets are key within the jurisdiction of 
each FBI field office and obtaining 24-hour points of contact 
at each asset in cases of emergency. Eventually, if future 
resources permit, the initiative will include the development 
of contingency plans to respond to attacks on each asset, 
exercises to test response plans, and modeling to determine the 
effects of an attack on particular assets.
    Here in the Phoenix Division, we have identified dozens of 
key assets around the State for including in the national list. 
These assets include power generation facilities, water storage 
and distribution centers, transportation assets, military 
installations, research institutions, and key public emergency 
service entities.
    The second is the InfraGard initiative. This is an 
initiative that we have developed in concert with private 
companies and academia to encourage information sharing about 
cyber intrusions, exploited vulnerabilities, and physical 
infrastructure threats. A vital component of InfraGard is the 
ability of industry to provide information on intrusions to the 
local FBI field offices using secure e-mail communications in 
both a sanitized and detailed format. We can use the detailed 
version to initiate an investigation, while NIPC headquarters 
can analyze that information in conjunction with other 
information we obtain to determine if the intrusion is part of 
a broader attack on numerous sites. The NIPC can simultaneously 
use the sanitized version to inform other members of the 
intrusion without compromising the confidentiality of the 
reporting company.
    Here in Phoenix, we are planning to roll out our InfraGard 
Chapter on May 9. We expect to have representatives from in-
state universities, businesses, and some of the critical 
infrastructures on hand.
    We look forward to working with Congress to ensure that law 
enforcement can continue to address the cyber crime problem in 
the year ahead.
    Thank you.
    [The prepared statement of Mr. Gonzalez follows:]

                Prepared Statement of Guadalupe Gonzalez

                              INTRODUCTION
    Mr. Chairman, Members of the Subcommittee: Thank you for inviting 
me to discuss the threats to our Nation's critical infrastructures and 
the FBI's approach in the field to meeting those challenges. In 
February 1998 the National Infrastructure Protection Center (NIPC) was 
established as a focal point for the federal government's efforts to 
protect the critical infrastructures. Following the founding of the 
Center, the National Infrastructure Protection and Computer Intrusion 
Program (NIPCIP) was approved as an FBI investigative program. NIPCIP 
is a Tier One priority under the FBI Strategic Plan and serves as the 
FBI vehicle for performing the NIPC's missions under PDD-63. In October 
1999 the NIPCIP was moved to the newly-formed Counterterrorism Division 
of the FBI, reflecting the FBI's high priority on protecting the 
infrastructures from terrorist threats.
    With the support of Congress and in particular the leadership of 
this committee, the NIPCI program has rapidly developed in FBI field 
offices across the United States, including here in Arizona. Today I 
will focus on the nature of the national security and criminal threats 
we face in cyberspace, the progress we have made in meeting those 
threats in the field, and the continuing challenges we face.

                                THE NIPC
    The NIPC is an interagency Center located at the FBI. Created in 
1998, the NIPC serves as the focal point for the government's efforts 
to warn of and respond to cyber attacks, particularly those that are 
directed at our nation's ``critical infrastructures.'' These 
infrastructures include telecommunications and information, energy, 
banking and finance, transportation, government operations, and 
emergency services. Presidential Decision Directive (PDD) 63 directed 
that the NIPC serve as a ``national critical infrastructure threat 
assessment, warning, vulnerability, and law enforcement investigation 
and response entity.'' The PDD further states that the mission of the 
NIPC ``will include providing timely warnings of intentional threats, 
comprehensive analyses and law enforcement investigation and 
response.''
    In field offices such as Phoenix, we have created a cyber crime 
investigative program called the National Infrastructure Protection and 
Computer Intrusion (NIPCI) Program. This program, managed by the NIPC, 
consists of special agents in each FBI Field Office who are responsible 
for investigating computer intrusions, viruses, or denial of service 
attacks, for implementing our key asset initiative, and for conducting 
critical liaison activities with private industry. Cyber crime task 
forces are being developed in partnership with state and local law 
enforcement entities within their jurisdiction to leverage the limited 
resources in this area. The first one opened in Pittsburgh last month.

                     THE BROAD SPECTRUM OF THREATS
Cybercrime threats faced by law enforcement
    Before discussing the FBI's programs and requirements with respect 
to cybercrime, let me take a few minutes to discuss the dimensions of 
the problem. The FBI's case load is increasing dramatically. In fiscal 
year 1998, it opened 547 computer intrusion cases; in fiscal year 1999, 
that had jumped to 1,154. At the same time, because of the opening the 
National Infrastructure Protection Center (NIPC) in February 1998, and 
improving ability to fight cyber crime, more cases were closed. In 
fiscal year 1998, 399 intrusion cases were closed, and in fiscal year 
1999, 912 such cases were closed. However, given the exponential 
increase in the number of cases opened, cited above, the actual number 
of pending cases has increased by 39 percent, from 601 at the end of 
fiscal year 1998, to 834 at the end of fiscal year 1999. In short, even 
though the FBI has markedly improved its capabilities to fight cyber 
intrusions, the problem is growing even faster.
    A few days ago the Computer Security Institute released its fifth 
annual ``Computer Crime and Security Survey.'' The results only confirm 
what we had already suspected given our burgeoning case load, that more 
companies surveyed are reporting intrusions, that dollar losses are 
increasing, that insiders remain a serious threat, and that more 
companies are doing more business on the Internet than ever before.
    The statistics tell the story. Ninety percent of respondents 
detected security breaches over the last 12 months. At least 74 percent 
of respondents reported security breaches including theft of 
proprietary information, financial fraud, system penetration by 
outsiders, data or network sabotage, or denial of service attacks. 
Information theft and financial fraud caused the most severe financial 
losses, put at $68 million and $56 million respectively. The losses 
from 273 respondents totaled just over $265 million. Losses traced to 
denial of service attacks were only $77,000 in 1998, and by 1999 had 
risen to just $116,250. Further, the new survey reports on numbers 
taken before the high-profile February attacks against Yahoo, Amazon 
and eBay. Finally, many companies are experiencing multiple attacks; 19 
percent of respondents reported 10 or more incidents.
    Over the past several years the FBI has seen a range of computer 
crimes from defacement of websites by juveniles to sophisticated 
intrusions that we suspect may be sponsored by foreign powers, and 
everything in between. Some of these are obviously more significant 
than others. The theft of national security information from a 
government agency or the interruption of electrical power to a major 
metropolitan area have greater consequences for national security, 
public safety, and the economy than the defacement of a web-site. But 
even the less serious categories have real consequences and, 
ultimately, can undermine confidence in e-commerce and violate privacy 
or property rights. A website hack that shuts down an e-commerce site 
can have disastrous consequences for a business. An intrusion that 
results in the theft of credit card numbers from an online vendor can 
result in significant financial loss and, more broadly, reduce 
consumers' willingness to engage in e-commerce. Because of these 
implications, it is critical that we have in place the programs and 
resources to investigate and, ultimately, to deter these sorts of 
crimes.
    The following are some of the categories of cyber threats that we 
confront today.
    Insiders. The disgruntled insider (a current or former employee of 
a company) is a principal source of computer crimes for many companies. 
Insiders' knowledge of the target companies' network often allows them 
to gain unrestricted access to cause damage to the system or to steal 
proprietary data. The just-released 2000 survey by the Computer 
Security Institute and FBI reports that 71 percent of respondents 
detected unauthorized access to systems by insiders.
    In January and February 1999 the National Library of Medicine (NLM) 
computer system, relied on by hundreds of thousands of doctors and 
medical professionals from around the world for the latest information 
on diseases, treatments, drugs, and dosage units, suffered a series of 
intrusions where system administrator passwords were obtained, hundreds 
of files were downloaded which included sensitive medical ``alert'' 
files and programming files that kept the system running properly. The 
intrusions were a significant threat to public safety and resulted in a 
monetary loss in excess of $25,000. FBI investigation identified the 
intruder as Montgomery Johns Gray, III, a former computer programmer 
for NLM, whose access to the computer system had been revoked. Gray was 
able to access the system through a ``backdoor'' he had created in the 
programming code. Due to the threat to public safety, a search warrant 
was executed for Gray's computers and Gray was arrested by the FBI 
within a few days of the intrusions. Subsequent examination of the 
seized computers disclosed evidence of the intrusion as well as images 
of child pornography. Gray was convicted by a jury in December 1999 on 
three counts for violation of Title 18 U.S.C. Sec. 1030. Subsequently, 
Gray pleaded guilty to receiving obscene images through the Internet, 
in violation of 47 U.S.C. 223.
    Hackers. Hackers (or ``crackers'') are also a common threat. They 
sometimes crack into networks simply for the thrill of the challenge or 
for bragging rights in the hacker community. Recently, however, we have 
seen more cases of hacking for illicit financial gain or other 
malicious purposes.
    While remote cracking once required a fair amount of skill or 
computer knowledge, hackers can now download attack scripts and 
protocols from the World Wide Web and launch them against victim sites. 
Thus while attack tools have become more sophisticated, they have also 
become easier to use. The distributed denial-of-service (DDOS) attacks 
last month are only the most recent illustration of the economic 
disruption that can be caused by tools now readily available on the 
Internet.
    Another recent case illustrates the scope of the problem. In March, 
authorities in the United Kingdom, acting in coordination with the FBI, 
arrested two individuals for alleged intrusions into e-commerce sites 
in several countries and the theft of credit card information on over 
26,000 accounts. One subject used the Internet alias ``CURADOR.'' 
Losses from this case could exceed $3,000,000. The FBI cooperated 
closely with the Dyfed-Powys Police Service in the United Kingdom, the 
Royal Canadian Mounted Police in Canada, and private industry. This 
investigation involved the Philadelphia Division, seven other FBI field 
offices, our Legal Attache in London, and the NIPC. This case 
demonstrates the close partnerships that we have built with our foreign 
law enforcement counterparts and with private industry.
    We are making some progress in convicting hackers. For example, on 
March 8, 2000, FBI Boston Division and New Hampshire Police arrested 
Dennis M. Moran, aka COOLIO, in association with the unauthorized 
intrusion and changes made to the Drug Abuse Resistance Education's 
(DARE) Web site, violating New Hampshire State Laws 638: 17 and 638: 
18(I), unauthorized access into a computer system, unauthorized changes 
to a computer system and damage to a computer system exceeding 
$1,000.00. It is anticipated that the New Hampshire State Attorney's 
Office will prosecute Moran, who is 17, as an adult. The United States 
Attorney's Office for the District of New Hampshire has therefore 
deferred prosecution of Moran to the State.
    In April, Patrick Gregory, the co-founder of the hacker group known 
as ``Global Hell,'' was convicted of a single count of conspiracy to 
commit telecommunications wire fraud and computer hacking in Texas U.S. 
District Court. He currently awaits sentencing.
    Virus Writers. Virus writers are posing an increasingly serious 
threat to networks and systems worldwide. Last year saw the 
proliferation of several destructive computer viruses or ``worms,'' 
including the Melissa Macro Virus, the Explore.Zip worm, and the CIH 
(Chernobyl) Virus. The NIPC frequently sends out warnings or advisories 
regarding particularly dangerous viruses, which can allow potential 
victims to take protective steps and minimize the destructive 
consequences of a virus.
    The Melissa Macro Virus was a good example of the NIPC's two-fold 
response--encompassing both warning and investigation--to a virus 
spreading in the networks. The NIPC sent out warnings as soon as it had 
solid information on the virus and its effects; these warnings helped 
alert the public and reduce the potential destructive impact of the 
virus. On the investigative side, the NIPC acted as a central point of 
contact for the field offices who worked leads on the case. A tip 
received by the New Jersey State Police from America Online, and their 
follow-up investigation with the FBI's Newark Division, led to the 
April 1, 1999 arrest of David L. Smith. Mr. Smith pleaded guilty to one 
count of violating 18 U.S.C. Sec. 1030 in Federal Court, and to four 
state felony counts. As part of his guilty plea, Smith stipulated to 
affecting one million computer systems and causing $80 million in 
damage. Smith is awaiting sentencing.
    Criminal Groups. We are also seeing the increased use of cyber 
intrusions by criminal groups who attack systems for purposes of 
monetary gain. In September, 1999, two members of a group dubbed the 
``Phonemasters'' were sentenced after their conviction for theft and 
possession of unauthorized access devices (18 USC Sec. 1029) and 
unauthorized access to a federal interest computer (18 USC Sec. 1030). 
The ``Phonemasters'' were an international group of criminals who 
penetrated the computer systems of MCI, Sprint, AT&T, Equifax, and even 
the National Crime Information Center. Under judicially approved 
electronic surveillance orders, the FBI's Dallas Division made use of 
new technology in the investigation. One suspect, Mr. Calvin Cantrell, 
downloaded thousands of Sprint calling card numbers, which he sold to a 
Canadian individual, who passed them on to someone in Ohio. These 
numbers made their way to an individual in Switzerland and eventually 
ended up in the hands of organized crime groups in Italy. Cantrell was 
sentenced to two years as a result of his guilty plea, while one of his 
associates, Cory Lindsay, was sentenced to 41 months.
    The Phonemasters' methods included ``dumpster diving'' to gather 
old phone books and technical manuals for systems. They used this 
information to trick employees into giving up their logon and password 
information. The group then used this information to break into victim 
systems. It is important to remember that often ``cyber crimes'' are 
facilitated by old fashioned guile, such as calling employees and 
tricking them into giving up passwords. Good cyber security practices 
must therefore address personnel security and ``social engineering'' in 
addition to instituting electronic security measures.
    Beyond criminal threats in cyber space, we also face a variety of 
significant national security threats
    Terrorists. Terrorists groups are increasingly using new 
information technology and the Internet to formulate plans, raise 
funds, spread propaganda, and to communicate securely. In his statement 
on the worldwide threat in 2000, Director of Central Intelligence 
George Tenet testified that terrorists groups, ``including Hizbollah, 
HAMAS, the Abu Nidal organization, and Bin Laden's al Qa'ida 
organization are using computerized files, e-mail, and encryption to 
support their operations.'' In one example, convicted terrorist Ramzi 
Yousef, the mastermind of the World Trade Center bombing, stored 
detailed plans to destroy United States airliners on encrypted files on 
his laptop computer. While we have not yet seen these groups employ 
cyber tools as a weapon to use against critical infrastructures, their 
reliance on information technology and acquisition of computer 
expertise are clear warning signs. Moreover, we have seen other 
terrorist groups, such as the Internet Black Tigers (who are reportedly 
affiliated with the Tamil Tigers), engage in attacks on foreign 
government websites and e-mail servers. ``Cyber terrorism''--by which I 
mean the use of cyber tools to shut down critical national 
infrastructures (such as energy, transportation, or government 
operations) for the purpose of coercing or intimidating a government or 
civilian population--is thus a very real, though still largely 
potential, threat.
    Foreign intelligence services. Not surprisingly, foreign 
intelligence services have adapted to using cyber tools as part of 
their espionage tradecraft. Even as far back as 1986, before the 
worldwide surge in Internet use, the KGB employed West German hackers 
to access Department of Defense systems in the well-known ``Cuckoo's 
Egg'' case. Foreign intelligence services increasingly view computer 
intrusions as a useful tool for acquiring sensitive U.S. Government and 
private sector information.
    More recently, we observed a series of intrusions into numerous 
Department of Defense and other federal government computer networks 
and private sector entities. Investigation last year determined that 
the intrusions appear to have originated in Russia. The intruder 
successfully accessed U.S. Government networks and took large amounts 
of unclassified but sensitive information, including defense technical 
research information. The NIPC coordinated a multi-agency 
investigation, working closely with FBI field offices, the Department 
of Defense, and the Intelligence Community.
    Information Warfare. The prospect of ``information warfare'' by 
foreign militaries against our critical infrastructures is perhaps the 
greatest potential cyber threat to our national security. We know that 
several foreign nations are developing information warfare doctrine, 
programs, and capabilities for use against the United States or other 
nations. Knowing that they cannot match our military might with 
conventional or ``kinetic'' weapons, some nations see cyber attacks on 
our critical infrastructures or military operations as a way to hit 
what they perceive as America's Achilles heel--our growing dependence 
on information technology in government and commercial operations. For 
example, two Chinese military officers recently published a book that 
called for the use of unconventional measures, including the 
propagation of computer viruses, to counterbalance the military power 
of the United States. And a Russian official has also commented that an 
attack on a national infrastructure could, ``by virtue of its 
catastrophic consequences, completely overlap with the use of [weapons] 
of mass destruction.''
Distributed denial of service tools
    The recent distributed denial of service (DDOS) attacks on e-
commerce sites have garnered a tremendous amount of interest in the 
public and in the Congress. While we do not yet have official damage 
estimates, the Yankee Group, a research firm, estimates the impact of 
the attacks at $1.2 billion due to lost capitalization losses, lost 
revenues, and security upgrades. Because we are actively investigating 
these attacks, I cannot provide a detailed briefing on the status of 
our efforts. However, I can provide an overview of our activities to 
deal with the DDOS threat beginning last year and of our investigative 
efforts. These attacks illustrate the growing availability of 
destructive, yet easy-to-use, exploits that are widely available on the 
Internet. They also demonstrate the NIPC's two-fold mission: sharing 
information with the private sector and warning of possible threats, 
and responding to actual attacks.
    In the fall of last year, the NIPC began receiving reports about a 
new set of ``exploits'' or attack tools collectively called distributed 
denial of service (or DDOS) tools. DDOS variants include tools known as 
``Trin00,'' ``Tribal Flood Net'' (TFN), ``TFN2K,'' and ``Stacheldraht'' 
(German for ``barbed wire''). These tools essentially work as follows: 
hackers gain unauthorized access to a computer system(s) and place 
software code on it that renders that system a ``master'' (or a 
``handler''). The hackers also intrude into other networks and place 
malicious code which makes those systems into agents (also known as 
``zombies'' or ``daemons'' or ``slaves''). Each Master is capable of 
controlling multiple agents. In both cases, the network owners normally 
are not aware that dangerous tools have been placed and reside on their 
systems, thus becoming third-party victims to the intended crime.
    The ``Masters'' are activated either remotely or by internal 
programming (such as a command to begin an attack at a prescribed time) 
and are used to send information to the agents, activating their DDOS 
ability. The agents then generate numerous requests to connect with the 
attack's ultimate target(s), typically using a fictitious or 
``spoofed'' IP (Internet Protocol) address, thus providing a falsified 
identity as to the source of the request. The agents act in unison to 
generate a high volume of traffic from several sources. This type of 
attack is referred to as a SYN flood, as the SYN is the initial effort 
by the sending computer to make a connection with the destination 
computer. Due to the volume of SYN requests the destination computer 
becomes overwhelmed in its efforts to acknowledge and complete a 
transaction with the sending computers, degrading or denying its 
ability to complete service with legitimate customers--hence the term 
``Denial of Service''. These attacks are especially damaging when they 
are coordinated from multiple sites--hence the term Distributed Denial 
of Service.
    An analogy would be if someone launched an automated program to 
have hundreds of phone calls placed to the Capitol switchboard at the 
same time. All of the good efforts of the staff would be overcome. Many 
callers would receive busy signals due to the high volume of telephone 
traffic.
    In November and December, the NIPC received reports that 
universities and others were detecting the presence of hundreds of 
agents on their networks. The number of agents detected clearly could 
have been only a small subset of the total number of agents actually 
deployed. In addition, we were concerned that some malicious actors 
might choose to launch a DDOS attack around New Year's Eve in order to 
cause disruption and gain notoriety due to the great deal of attention 
that was being paid to the Y2K rollover. Accordingly, we decided to 
issue a series of alerts in December to government agencies, industry, 
and the public about the DDOS threat.
    Moreover, in late December, it was determined that a detection tool 
that was developed by the NIPC for investigative purposes might also be 
used by network operators to detect the presence of DDOS agents or 
masters on their operating systems, and thus would enable them to 
remove an agent or master and prevent the network from being 
unwittingly utilized in a DDOS attack. Moreover, at that time there 
was, to our knowledge, no similar detection tool available 
commercially. The NIPC therefore decided to take the unusual step of 
releasing the tool to the Department of Defense, other government 
agencies, and to the public in an effort to reduce the level of the 
threat. The first variant of our software was made available on the 
NIPC web site on December 30, 1999. To maximize the public awareness of 
this tool, we announced its availability in an FBI press release that 
same date. Since the first posting of the tool, we have posted three 
updated versions that have perfected the software and made it 
applicable to different operating systems.
    The public has downloaded these tools tens of thousands of times 
from the web site, and has responded by reporting many installations of 
the DDOS software, thereby preventing their networks from being used in 
attacks and leading to the opening of criminal investigations both 
before and after the widely publicized attacks of the last few weeks. 
The work with private companies has been so well received that the 
trade group SANS awarded their yearly Security Technology Leadership 
Award to members of the NIPC's Special Technologies Applications Unit.
    In February, reports were received that a new variation of DDOS 
tools was being found on Windows operating systems. One victim entity 
provided us with the object code to the tool found on its network. On 
February 18 the binaries were made available to anti-virus companies 
(through an industry association) and the Computer Emergency Response 
Team (CERT) at Carnegie Mellon University for analysis and so that 
commercial vendors could create or adjust their products to detect the 
new DDOS variant. Given the attention that DDOS tools have received in 
recent weeks, there are now numerous detection and security products to 
address this threat, so it was determined that the NIPC could be most 
helpful by giving them the necessary code rather than deploying a 
detection tool ourselves.
    Unfortunately, the warnings that we and others in the security 
community had issued about DDOS tools last year, while alerting many 
potential victims and reducing the threat, did not eliminate the 
threat. Quite frequently, even when a threat is known and patches or 
detection tools are available, network operators either remain unaware 
of the problem or fail to take necessary protective steps. In addition, 
in the cyber equivalent of an arms race, exploits evolve as hackers 
design variations to evade or overcome detection software and filters. 
Even security-conscious companies that put in place all available 
security measures therefore are not invulnerable. And, particularly 
with DDOS tools, one organization might be the victim of a successful 
attack despite its best efforts, because another organization failed to 
take steps to keep itself from being made the unwitting participant in 
an attack.
    On February 7, 2000, the NIPC received reports that Yahoo had 
experienced a denial of service attack. In a display of the close 
cooperative relationship that we have developed with the private 
sector, in the days that followed, several other companies (including 
Cable News Network, eBay, Amazon.com, Buy.com, and ZDNET), also 
reported denial of service outages to the NIPC or FBI field offices. 
These companies cooperated with us by providing critical logs and other 
information. Still, the challenges to apprehending the suspects are 
substantial. In many cases, the attackers used ``spoofed'' IP 
addresses, meaning that the address that appeared on the target's log 
was not the true address of the system that sent the messages. In 
addition, many victims do not keep complete network logs.
    The resources required in an investigation of this type are 
substantial. Companies have been victimized or used as ``hop sites'' in 
numerous places across the country, meaning that we must deploy special 
agents nationwide to work leads. We currently have seven FBI field 
offices with cases opened and all the remaining offices are supporting 
the offices that have opened cases. Agents from these offices are 
following up literally hundreds of leads. The NIPC is coordinating the 
nationwide investigative effort, performing technical analysis of logs 
from victims sites and Internet Service Providers (ISP's), and 
providing all-source analytical assistance to field offices. Moreover, 
parts of the evidentiary trail have led overseas, requiring us to work 
with our foreign counterparts in several countries through our Legal 
Attaches (Legats) in U.S. embassies. Here in Phoenix we followed up on 
leads resulting from the DDOS attacks.
    While the crime may be high tech, investigating it involves a 
substantial amount of traditional investigative work as well as highly 
technical work. Interviews of network operators and confidential 
sources can provide very useful information, which leads to still more 
interviews and leads to follow-up. And victim sites and ISP's provide 
an enormous amount of log information that needs to be processed and 
analyzed by human analysts.

                CHALLENGES IN COMBATING CYBER INTRUSIONS
    The burgeoning problem of cyber intrusions, viruses, and denial of 
service attacks poses unique challenges to the NIPC. These challenges 
require novel solutions, close teamwork among agencies and with the 
private sector, and adequate human and technical resources.
    Identifying the Intruder. One major difficulty that distinguishes 
cyber threats from physical threats is determining who is attacking 
your system, why, how, and from where. This difficulty stems from the 
ease with which individuals can hide or disguise their tracks by 
manipulating logs and directing their attacks through networks in many 
countries before hitting their ultimate target. The ``Solar Sunrise'' 
case illustrates this point. This will continue to pose a problem as 
long as the Internet remains rife with vulnerabilities and allows easy 
anonymity and concealment.
    Jurisdictional Issues. Another significant challenge we face is 
intrusions involving multiple jurisdictions. A typical investigation 
involves victim sites in multiple states and often many countries. This 
is the case even when the hacker and victim are both located in the 
United States. In the United States, we can subpoena records, engage in 
judicially approved electronic surveillance, and execute search 
warrants on suspects' homes, seize evidence, and examine it. We can do 
none of those things ourselves overseas; rather, we depend on the local 
authorities to assist us. However, some local police forces do not have 
the technical resources or expertise to provide assistance. In other 
cases, these nations may not have laws against computer intrusions and 
are therefore limited in their ability to help us. FBI Legal Attaches 
in 35 embassies abroad provide critical help in building bridges with 
local law enforcement to enhance cooperation on cyber crime and in 
working leads on investigations. As the Internet spreads to even more 
countries, we will see greater demands placed on the Legats to support 
computer crime investigations. The NIPC also has held international 
computer crime conferences and offered cyber crime training classes to 
foreign law enforcement officials to develop liaison contacts and bring 
these officials up to speed on cyber crime issues.
    The most difficult situation will arise, however, in which a 
foreign country with interests adverse to our own simply refuses to 
cooperate. In such a situation, we could find that an investigation is 
stymied unless we find an alternative method of tracing the activity 
back to its source.

                          THE LEGAL LANDSCAPE
    To deal with this crime problem, we must look at whether changes to 
the legal procedures governing investigation and prosecution of cyber 
crimes are warranted. The problem of Internet crime has grown at such a 
rapid pace that the laws have not kept up with the technology. The FBI 
is working with the Department of Justice to propose a legislative 
package for your review to help keep our laws in step with these 
advances.
    One example of some of the problems law enforcement is facing is 
the jurisdictional limitation of pen registers and trap-and-trace 
orders issued by federal district courts. These orders allow only the 
capturing of tracing information, not the content of communications. 
Currently, in order to track back a hacking episode in which a single 
communication is purposely routed through a number of Internet Service 
Providers that are located in different states, we generally have to 
get multiple court orders. This is because, under current law, a 
federal court can order communications carriers only within its 
district to provide tracing information to law enforcement. As a result 
of the fact that investigators typically have to apply for numerous 
court orders to trace a single communication, there is a needless waste 
of time and resources, and a number of important investigations are 
either hampered or derailed entirely in those instances where law 
enforcement gets to a communications carrier after that carrier has 
already discarded the necessary information. For example, Kevin Mitnick 
evaded attempts to trace his calls by moving around the country and by 
using cellular phones, which routed calls through multiple carriers on 
their way to the final destination. It was impossible to get orders 
quickly enough in all the jurisdictions to trace the calls.
    Finally, we should consider whether current sentencing provisions 
for computer crimes provide an adequate deterrence. Given the degree of 
harm that can be caused by a virus, intrusion, or a denial of service--
in terms of monetary loss to business and consumers, infringement of 
privacy, or threats to public safety when critical infrastructures are 
affected--it would be appropriate to consider, as S. 2092 does, whether 
penalties established years ago remain adequate.
    Evaluation of the effectiveness of 18 U.S.C. Sec. 1030 and the 
tools to enforce it under both current law and under S. 2092.--
Generally, 18 U.S.C. Sec. 1030 has enabled the FBI and other law 
enforcement agencies to investigate and prosecute persons who would use 
the power of the Internet and computers for criminal purposes. 
Nonetheless, just as computer crime has evolved over the years, so too 
must our laws and procedures evolve to meet the changing nature of 
these crimes.
    One persistent problem is the need under current law to demonstrate 
at least $5,000 in damage for certain hacking offenses enumerated by 18 
U.S.C. Sec. 1030(a)(5). In some of the cases investigated by the FBI, 
damages in excess of $5,000 on a particular system are difficult to 
prove. In other cases, the risk of harm to individuals or to the public 
safety posed by breaking into numerous systems and obtaining root 
access, with the ability to destroy the confidentiality or accuracy of 
crucial--perhaps lifesaving information--is very real and very serious 
even if provable monetary damages never approach the $5,000 mark. In 
investigations involving the dissemination or importation of a virus or 
other malicious code, the $5,000 threshold could potentially delay or 
hinder early intervention by Federal law enforcement.
    S. 2092 significantly adjusts the $5,000 threshold and other 
provisions in the current law by: (1) creating a misdemeanor offense 
for those cases where damages are below $5,000, while simultaneously 
adjusting the minimum mandatory sentences under the Sentencing 
Guidelines; and (2) moving the aggravating factors previously included 
in the definition of``damage'' under 18 U.S.C. Sec. 1030(e)(8) (such as 
impairment of medical diagnosis, physical injury to any person, threat 
to public health or safety or damage to nation security, national 
defense or administration of justice computers) to the general 
sentencing provisions of Sec. 1030(c) (where they will be on par in 
serious cases with the existing $5,000 threshold requirement and will 
expose offenders to an enhanced 10-year period of imprisonment up from 
the current maximum of 5 years). The critical element here is that the 
criminal intended to cause damage, not the specific amount of damage he 
intended to cause
    Another issue involves the alarming number of computer hackers 
encountered in our investigations who are juveniles. Under current law, 
Federal authorities are not able to prosecute juveniles for any 
computer violations of 18 U.S.C. Sec. 1030. S. 2092 would authorize 
(but not require) the Attorney General to certify for juvenile 
prosecution in Federal court youthful offenders who commit the more 
serious felony violations of section 1030. Recognizing that this change 
will, over time, result in the prosecution of repeat offenders, S. 2092 
also defines the term ``conviction'' under Sec. 1030 to include prior 
adjudications of juvenile delinquency for violations of that section. 
This is intended to provide greater specific deterrence to juveniles 
who are adjudicated delinquent for computer hacking. Similarly, a 
majority of the States have enacted criminal statutes prohibiting 
unauthorized computer access analogous to the provisions of section 
1030. As State prosecutions for these offenses increase, the likelihood 
of encountering computer offenders in Federal investigations who have 
prior State convictions will similarly rise. The Department is studying 
whether prior state adult convictions for comparable computer crimes 
justify enhanced penalties for violations of section 1030, just as 
prior State convictions for drug offenses trigger enhanced penalties 
for comparable Federal drug violations.
    Law enforcement also needs updated tools to investigate, identify, 
apprehend and successfully prosecute computer offenders. Today's 
electronic crimes, which occur at the speed of light, cannot be 
effectively investigated with procedural devices forged in the last 
millennium during the infancy of the information technology age. 
Statutes need to be rendered technology neutral so that they can be 
applied regardless of whether a crime is committed with pen and paper, 
e-mail, telephone or geosynchronous orbit satellite personal 
communication devices.
    As discussed above, a critical factor in the investigation of 
computer hacking cases is law enforcement's ability to swiftly identify 
the source and the direction of a hacker's communications. Like all law 
enforcement agencies, the FBI relies upon the pen register and trap and 
trace provisions contained in 18 U.S.C. Sec. 3121 et seq. to seek court 
approval to acquire data identifying non-content information relating 
to a suspect's communications. Our ability to identify the perpetrators 
of crimes like computer hacking is directly proportional to our ability 
to quickly acquire the necessary court orders and quickly serve them 
upon one or more service providers in a communications chain. Under 
current law, however, valuable time is consumed in acquiring individual 
court orders in the name of each communications company for each newly 
discerned link in the communications chain even though the legal 
justification for the disclosure remains unchanged and undiminished. S. 
2092 would amend 18 U.S.C. Sec. 3123(a) to authorize Federal courts to 
issue one nation-wide order which may then be served upon one or more 
service providers thereby substantially reducing the time necessary to 
identify the complete pathway of a suspect's communication. Second, S. 
2092 makes the statute more technology neutral by, among other things, 
inserting the terms ``or other facility'' wherever ``telephone'' 
appears. This change codifies Federal court decisions that apply the 
statute's provisions not merely to traditional telephone, but to an 
ever expanding array of other, communications facilities. Together, 
these are important changes that do not alter or lower the showing 
necessary for the issuance of the court order but which do enhance the 
order's usefulness to law enforcement.
    We support the goal of S. 2092 to strengthen the general deterrence 
aspects of the Computer Fraud and Abuse Act, and to provide some needed 
procedural enhancements to help us confront the expanding criminal 
threat in this dynamic and important part of our national economy while 
continuing to protect individual privacy interests. The FBI looks 
forward to working with the Committee on this important legislation.

                        INTERAGENCY COOPERATION
    The broad spectrum of cyber threats described earlier, ranging from 
hacking to foreign espionage and information warfare, requires not just 
new technologies and skills on the part of investigators, but new 
organizational constructs as well. In most cyber attacks, the identity, 
location, and objective of the perpetrator are not immediately 
apparent. Nor is the scope of his attack--i.e., whether an intrusion is 
isolated or part of a broader pattern affecting numerous targets. This 
means it is often impossible to determine at the outset if an intrusion 
is an act of cyber vandalism, organized crime, domestic or foreign 
terrorism, economic or traditional espionage, or some form of strategic 
military attack. The only way to determine the source, nature, and 
scope of the incident is to gather information from the victim sites 
and intermediate sites such as ISP's and telecommunications carriers. 
Under our constitutional system, such information typically can be 
gathered only pursuant to criminal investigative authorities. This is 
why the NIPC is part of the FBI, allowing us to utilize the FBI's legal 
authorities to gather and retain information and to act on it, 
consistent with constitutional and statutory requirements.
    But the dimension and varied nature of the threats also means that 
this is an issue that concerns not just the FBI and law enforcement 
agencies, but also the Department of Defense, the Intelligence 
Community, and civilian agencies with infrastructure-focused 
responsibility such as the Departments of Energy and Transportation. It 
also is a matter that greatly affects state and local law enforcement. 
This is why the NIPC is an interagency center, with representatives 
detailed to the FBI from numerous federal agencies and representation 
from state and local law enforcement as well. These representatives 
operate under the direction and authority of the FBI, but bring with 
them expertise and skills from their respective home agencies that 
enable better coordination and cooperation among all relevant agencies, 
consistent with applicable laws.
    In Phoenix, we work closely with the U.S. military as well as other 
government agencies. For example, we have worked with U.S. military 
installations located in Arizona on attempted intrusions into their 
systems. The expansion of cyber task forces, such as the one just 
started in Pittsburgh, to other field divisions such as Phoenix, should 
assist us with interagency cooperation.

                       PRIVATE SECTOR COOPERATION
    Our success in battling cyber crime also depends on close 
cooperation with private industry. This is the case for several 
reasons. First, most of the victims of cyber crimes are private 
companies. Therefore, successful investigation and prosecution of cyber 
crimes depends on private victims reporting incidents to law 
enforcement and cooperating with the investigators. Contrary to press 
statements by cyber security companies that private companies won't 
share information with law enforcement, many private companies have 
reported incidents and threats to the NIPC or FBI field offices. While 
there are undoubtedly companies that would prefer not to report a crime 
because of the subsequent loss of consumer confidence, the situation 
has improved markedly. Companies increasingly realize that deterrence 
of crime depends on effective law enforcement, and that the long-term 
interests of industry depend on establishing a good working 
relationship with government to prevent and investigate crime.
    Second, the network administrator at a victim company or ISP is 
critical to the success of an investigation. Only that administrator 
knows the unique configuration of their system, and the administrator 
typically must work with an investigator to find critical transactional 
data that will yield evidence of a criminal's activity.
    Third, the private sector has the technical expertise that is often 
critical to resolving an investigation. It would be impossible for us 
to retain experts in every possible operating system or network 
configuration, so private sector assistance is critical. In addition, 
many investigations require the development of unique technical tools 
to deal with novel problems. Private sector assistance has been 
critical there as well.
    We have several other initiatives devoted to private sector 
outreach that bear mentioning here. The first is called ``InfraGard.'' 
This is an initiative that we have developed in concert with private 
companies and academia to encourage information-sharing about cyber 
intrusions, exploited vulnerabilities, and physical infrastructure 
threats. A vital component of InfraGard is the ability of industry to 
provide information on intrusions to the local FBI field office using 
secure e-mail communications in both a ``sanitized'' and detailed 
format. The local FBI field offices can, if appropriate, use the 
detailed version to initiate an investigation; while NIPC Headquarters 
can analyze that information in conjunction with other information we 
obtain to determine if the intrusion is part of a broader attack on 
numerous sites. The NIPC can simultaneously use the sanitized version 
to inform other members of the intrusion without compromising the 
confidentiality of the reporting company. The key to this system is 
that whether, and what, to report is entirely up to the reporting 
company. A secure web site also contains a variety of analytic and 
warning products that we make available to the InfraGard community. The 
success of InfraGard is premised on the notion that sharing is a two-
way street: the NIPC will provide threat information that companies can 
use to protect their systems, while companies will provide incident 
information that can be used to initiate an investigation and to warn 
other companies.
    Here in Phoenix, we are planning to roll-out our InfraGard Chapter 
on May 9. We expect to have representatives from in state universities, 
businesses, and some of the critical infrastructures on hand.
    Our Key Asset Initiative (KAI) is focused more specifically on the 
owners and operators of critical components of each of the 
infrastructure sectors. It facilitates response to threats and 
incidents by building liaison and communication links with the owners 
and operators of individual companies and enabling contingency 
planning. The KAI began in the 1980's and focused on physical 
vulnerabilities to terrorism. Under the NIPC, the KAI has been 
reinvigorated and expanded to focus on cyber vulnerabilities as well. 
The KAI currently involves determining which assets are key within the 
jurisdiction of each FBI Field Office and obtaining 24-hour points of 
contact at each asset in cases of emergency. Eventually, if future 
resources permit, the initiative will include the development of 
contingency plans to respond to attacks on each asset, exercises to 
test response plans, and modeling to determine the effects of an attack 
on particular assets. FBI field offices are responsible for developing 
a list of the assets within their respective jurisdictions, while the 
NIPC maintains the national database. The KAI is being developed in 
coordination with DOD and other agencies. Currently the database has 
about 2,600 entries. This represents 2,600 contacts with key private 
sector nodes made by the NIPC and FBI field offices.
    Here in the Phoenix Division, we have identified dozens of key 
assets around the state for inclusion in the national list. These 
assets include power generation facilities, water storage and 
distribution centers, transportation assets, military installations, 
research institutions, and key public emergency service entities.
    Much has been said over the last few years about the importance of 
information sharing. Here in the Phoenix Division, we have an excellent 
working relationship with our private sector counterparts and the 
community in general. We share information on a number of areas, 
including infrastructure protection, and receive information from the 
private sector that greatly assist us in protecting the community. As a 
result of our close working relationship with the private sector we can 
detect criminal activity in its initial stages and in some cases 
prevent criminal incidents. The NIPC also provides the private sector 
with warning information which also lessens their vulnerability. These 
warnings assist field offices like Phoenix to be better prepared and 
better protect our community. They further allow us the opportunity to 
respond quickly and efficiently to cyber threats. I believe that as 
companies continue to gain experience in dealing with the NIPC and FBI 
field offices, as we continue to provide them with important and useful 
threat information, and as companies recognize that cyber crime 
requires a joint effort by industry and government together, we will 
continue to make real progress in this area.

                    MEETING THE GROWING CYBER THREAT
    As Internet use continues to soar, the number of cyber attacks is 
also increasing exponentially. Nationally there are over 1000 open 
computer intrusion cases. Further, this figure does not count computer 
facilitated crimes such as Internet fraud, child pornography, or e-mail 
extortion efforts. In these cases, the NIPC and NIPCI squads often 
provide technical assistance to traditional investigative programs 
responsible for these categories of crime.
    We can clearly expect these upward trends to continue, and for the 
threats to become more serious. While insiders, hackers, and criminal 
groups make up much of our case load at the moment, we can anticipate a 
growing number of national security cases in the near future. To meet 
this challenge, we must ensure that we have adequate resources, 
including both personnel and equipment, both at the NIPC and in FBI 
field offices. We currently have 193 agents nationwide dedicated to 
investigating computer intrusion and virus cases. In order to maximize 
investigative resources the FBI has taken the approach of creating 
regional squads in 16 field offices that have sufficient size to work 
complex intrusion cases and to assist those field offices without a 
NIPCI squad. In those field offices without squads, the FBI is building 
a baseline capability by having one or two agents work NIPC matters, 
i.e. computer intrusions (criminal and national security), viruses, 
InfraGard, state and local liaison, etc.
    The Phoenix office has a three agent team working on infrastructure 
protection and computer intrusion matters. Three agents are assigned to 
investigate cyber child pornography, and additional four agents are 
assigned to the Computer Assisted Response Team (CART), which is 
responsible to provide cyber forensics in support of all the cyber 
investigations in the Phoenix office. Since January 1, 2000 the Phoenix 
office has opened 9 new computer intrusion cases. This represents an 
almost 100 percent increase in computer intrusion cases opened in 1999.
    Currently, at NIPC Headquarters, there are 101 personnel on board, 
including 82 FBI employees and 19 detailees from other government 
agencies. This cadre of investigators, computer scientists, and 
analysts perform the numerous and complex tasks outlined above, and 
provide critical coordination and support to field office 
investigations. As the crime problem grows, we need to make sure that 
we keep pace by bringing on board additional personnel, including from 
other agencies and the private sector.
    In addition to putting in place the requisite number of agents, 
analysts, and computer scientists in the NIPC and in FBI field offices, 
we must fill those positions by recruiting and retaining personnel who 
have the appropriate technical, analytical, and investigative skills. 
This includes personnel who can read and analyze complex log files, 
perform all-source analysis to look for correlations between events or 
attack signatures and glean indications of a threat, develop technical 
tools to address the constantly changing technological environment, and 
conduct complex network investigations. There is a very tight market 
for information technology professionals. The Federal Government needs 
to be able to recruit the very best people into its programs. 
Fortunately, we can offer exciting, cutting-edge work in this area and 
can offer agents, analysts, and computer scientists the opportunities 
to work on issues that no one else addresses, and to make a difference 
to our national security and public safety. In addition, Congress 
provided the FBI with a pilot program that exempts certain technical 
personnel from the Title V civil service rules, which allows us to pay 
more competitive salaries and recruit and retain top notch personnel. 
Unfortunately, this pilot is scheduled to expire in November unless 
extended
    Training and continuing education are also critical, and we have 
made this a top priority at the NIPC. In fiscal year 1999, we trained 
383 FBI and other-government-agency students in NIPC sponsored training 
classes on network investigations and infrastructure protection. The 
emphasis for 2000 is on continuing to train federal personnel while 
expanding training opportunities for state and local law enforcement 
personnel. During fiscal year 2000, we plan to train approximately 740 
personnel from the FBI, other federal agencies, and state and local law 
enforcement.
    Developing and deploying the best equipment in support of the 
mission is also very important. Not only do investigators and analysts 
need the best equipment to conduct investigations in the rapidly 
evolving cyber system but the NIPC must be on the cutting edge of cyber 
research and development. Conducting a network intrusion or denial-of-
service investigation often requires analysis of voluminous amounts of 
data. For example, one network intrusion case involving an espionage 
matter currently being investigated has required the analysis of 17.5 
Terabytes of data. To place this into perspective, the entire 
collection of the Library of Congress, if digitized, would comprise 
only 10 Terabytes. The Yahoo DDOS attack involved approximately 630 
Gigabytes of data, which is equivalent to enough printed pages to fill 
630 pickup trucks with paper. Technical analysis requires high capacity 
equipment to store, process, analyze, and display data. Again, as the 
crime problem grows, we must ensure that our technical capacity keeps 
pace. We are also working closely with other agencies to ensure that we 
leverage existing resources to the fullest extent possible.

                      THE ROLE OF LAW ENFORCEMENT
    Finally, I would like to conclude by emphasizing two key points. 
The first is that our role in combating cyber crime is essentially two-
fold: (1) preventing cyber attacks before they occur or limiting their 
scope by disseminating warnings and advisories about threats so that 
potential victims can protect themselves; and (2) responding to attacks 
that do occur by investigating and identifying the perpetrator. This is 
very much an operational role. Our role is not to determine what 
security measures private industry should take, or to ensure that 
companies or individuals take them. It is the responsibility of 
industry to ensure that appropriate security tools are made available 
and are implemented. We certainly can assist industry by alerting them 
to the actual threats that they need to be concerned about, and by 
providing information about the exploits that we are seeing criminals 
use. But network administrators, whether in the private sector or in 
government, are the first line of defense.
    Second, in gathering information as part of our warning and 
response missions, we rigorously adhere to constitutional and statutory 
requirements. Our conduct is strictly limited by the Fourth Amendment, 
statutes such as Title III and ECPA, and the Attorney General 
Guidelines. These rules are founded first and foremost on the 
protection of privacy inherent in our constitutional system. Respect 
for privacy is thus a fundamental tenet in all of our activities.

                               CONCLUSION
    I want to thank the subcommittee again for giving me the 
opportunity to testify here today. The cyber threat is real, 
multifarious, and growing. The FBI is moving aggressively to meet this 
challenge by training investigators and analysts to investigate 
computer intrusion cases, equipping them with the latest technology, 
developing our analytic capabilities and warning mechanisms to head off 
or mitigate attacks, and closely cooperating with the private sector. 
We have already made considerable progress in developing our 
capabilities to protect public safety and national security in the 
Information Age. I look forward to working with Congress to ensure that 
we continue to be able to meet the threat as it evolves and grows. 
Thank you.

    Senator Kyl. Thank you very much, Mr. Gonzalez.
    Let me begin by asking both of you a question. Mr. 
Gonzalez, you mentioned the multiple trap and trace issue, and 
I would like to ask both of you a question about that. For the 
benefit of those who aren't familiar with it, currently Federal 
law requires that law enforcement obtain a separate court order 
for trap and trace authority in each jurisdiction through which 
a cyber attack travels. Obviously, it is important for law 
enforcement to be able to quickly trace a source of an attack, 
as both witnesses have mentioned.
    Could either of you give some examples of how 
investigations have been bogged down by the need to get this 
trap and trace authority in each jurisdiction and how the 
legislation that Senator Schumer and I have introduced, which 
would provide for national trap and trace authority, would 
resolve that issue? Mr. Gonzalez.
    Mr. Gonzalez. Yes, Sir. Well, in terms of the ability to 
obtain the national trap and trace orders, as you mentioned, 
timeliness is of the essence. And because of the different 
nature of how companies involved in information technology deal 
with their records and their record systems, some records are 
destroyed faster than others, it is imperative that we be able 
to get those orders in a timely fashion and be able to get out 
to the place where we need to deliver the orders to recoup the 
information.
    If in the cases we mentioned--we talked about a case, for 
example, where the hacker's victims are in three different 
States and to get there we go through, say, multiple providers 
of either communications services or Internet technology 
services in different jurisdictions, we have to individually go 
to each one of those areas, provide the necessary information 
to get the court order. If we were able to do it at one time, 
it would save us a tremendous amount of time, and we could 
almost simultaneously be at all those different locations at 
one time and obtaining the information we need.
    Senator Kyl. Attorney General Napolitano.
    Ms. Napolitano. Yes, Senator, in response to your question, 
there is a very big need for a Federal hot pursuit statute in 
cyberspace, and the bill that you and Senator Schumer have put 
forward I think is going to be very, very valuable in that 
respect for many of the problems that Special Agent Gonzalez 
has mentioned.
    Let me give you two examples of cases where we have gotten 
bogged down and have had to do an inordinate amount of work to 
get a result.
    One is the very recent case in Scottsdale where a juvenile 
sent a threat via e-mail and basically shut down one of the 
middle schools in Scottsdale while the police department and 
the bomb dogs came out and looked to see whether there was 
anything to the threat. While that was going on, our office was 
tracking down and working with law enforcement to track down 
the source of the 
e-mail, and we were trying to do it very, very quickly both 
because of the school disruptions and because we didn't know 
whether it was a serious threat or not a serious threat.
    To do that, we ultimately in the course of that 
investigation had to obtain separate court orders in both 
California and Virginia to identify the source of the e-mail. 
It would have been much better as a State if we had access to a 
Federal hot pursuit law that would have allowed us to get 
basically nationwide service of an order to track that source.
    A second example is one you may be familiar with, and it 
involved hacking into a local utility company. That ultimately 
required the prosecutors to get orders in very many States all 
over the country to identify the source of the hacking into a 
utility company here.
    So two concrete examples where we have been slowed down, 
have had to do a lot of extra work, and it illustrates the need 
for us to be able to speed up the process.
    Senator Kyl. And just to ensure that there is no invasion 
of privacy or inhibition of exercise of constitutional rights, 
would this nationwide trap and trace authority in any way 
diminish the constitutional rights of any of the entities from 
whom you are trying to obtain information?
    Ms. Napolitano. No, it would not. You would still have to 
comply with the fourth amendment.
    Senator Kyl. And the fourth amendment requirements would 
require that the law enforcement officials do what with respect 
to obtaining an order?
    Ms. Napolitano. In terms of getting a trap and trace order?
    Senator Kyl. Yes.
    Ms. Napolitano. You would still have to get an order issued 
by a court. The difference would be it would have nationwide 
application.
    Senator Kyl. So you would still have to prove the same kind 
of probable cause to a judge for the issuance of the warrant 
that would exist in any other situation?
    Ms. Napolitano. Yes. I assume the basic statutory and 
constitutional requirements for obtaining orders for traps and 
traces would apply. The difference would be that we wouldn't 
have to do it over and over again for basically the same 
search.
    Senator Kyl. Right. This is a good example, it seems to me, 
of the law needing to evolve with technology, or technology is 
going to get way ahead of law enforcement's ability to protect 
the citizens of the country.
    Ms. Napolitano. That is right, because even a delay of a 
few hours while you go to another courthouse in Virginia or 
California can be very critical in these kinds of cases.
    Senator Kyl. Now, I gather it would be safe to say, from 
what both of you have testified, that in Arizona you have seen 
a significant increase in the amount of cyber crime. Would that 
be fair, Mr. Gonzalez?
    Mr. Gonzalez. Yes, Sir. We have had a significant increase, 
in fact, specifically since the beginning of this year. Our 
caseload has increased probably 5 times, and we suspect it will 
continue to increase.
    Senator Kyl. One of the cases that I believe you alluded to 
in your prepared testimony but you didn't mention in your 
summary was a situation involving a very potentially dangerous 
situation with the dams in the State of Arizona. Could you 
describe that in just a little bit of detail?
    Ms. Napolitano. Yes. This is a case--I believe it happened 
in 1995. There is a typo in the testimony. But what happened in 
this instance was a computer user hacked his way into the 
billing database of the Salt River Project. He was looking to 
cancel someone's account. He then thereafter gained access, 
high-level access to the canal controlling system.
    Now, when that crime occurred, we didn't have the bill I 
was describing to you, Senator. He was actually, I think, 
charged with a class III computer fraud felony. He subsequently 
provided a great deal of cooperation in some other cases, and 
so he pled down to a probation-eligible offense. And I believe, 
ironically, he is working in computer security in the private 
sector now, be that as it may.
    Under the new law in Arizona, such hacking into a vital 
infrastructure, which is a defined term in the law, would be a 
class II felony. Under our statutory scheme, that is the next 
most serious offense to a first-degree murder.
    Senator Kyl. And when will this new law take effect?
    Ms. Napolitano. July 18.
    Senator Kyl. OK. Great.
    Just a few more questions here. Are there any--I alluded to 
this in my opening statement, the possibility that there are 
legal impediments to the sharing of information, particularly 
by the private sector, with law enforcement. How would you 
characterize the cooperation between industry and law 
enforcement during the investigation of cyber crimes? And are 
there any disincentives that you are aware of that need to be 
removed for companies to come forward once they have 
experienced an attack? I will address that to both of you.
    Mr. Gonzalez. Well, Sir, I think the cooperation is good. 
It is getting better. There is a tendency sometimes on the part 
of the private sector to be a little hesitant, maybe, in say 
reporting either attempted intrusions or intrusions because of 
the fear of the impact that it may have on their status in the 
community where they are working. However, I think as part of 
the InfraGard program that we talked about where we are 
basically being able to--we are starting to form partnerships 
with the private sector to where they have an ability to 
anonymously join that program and provide us information that 
we can either use specifically with detail to initiate case or 
sanitize for NIPC to use to disseminate to other members of the 
program in terms of potential either attempted intrusions or 
intrusions. I think as we work more through that system and 
basically show and convince the industry that it is a viable 
system and it can only help in terms of deterring attempted 
intrusions and in the case of where the intrusions are 
successful prosecuting the offenders, I think as we develop 
more of a track record in that area the industry will be much 
more willing to continue and move forward with that cooperative 
effort.
    Senator Kyl. Now, some people in industry have expressed a 
concern that their computers could be confiscated or critical 
components of their operations could be brought down during the 
course of an investigation, which would essentially paralyze 
their ability to do business. What kind of assurance can you 
give them that this would not occur?
    Mr. Gonzalez. Actually, it would be almost the opposite. 
What we need from the industry is, first of all, if they have 
either an attempted intrusion or an intrusion, we need a timely 
notification almost immediately so that we can respond. And the 
other thing is we need their assistance in terms of whether it 
be their systems administrators or people from their companies 
or businesses that have the expertise in their systems to help 
us go through their system and identify the information and the 
evidence that can either provide leads for us, investigative 
leads, or determine how the intrusion occurred.
    We do not seize their computers. We will not seize their 
computers, and we do our best to be as unobtrusive in terms of 
affecting their business operations. But we need their help and 
assistance in doing that, one, in the timeliness of the 
reporting of the 
intrusions and, two, in the use of their technical expertise 
for their systems to get us through the investigative process.
    Senator Kyl. Now, another related concern is going public 
with information, and, General Napolitano, let me ask you as 
well as Mr. Gonzalez this. Let's say a classic bank fraud 
intrusion occurs, or, as you say, somebody hacks into the 
utility to cancel out their bill, but let's say it is a bank 
and there is a suggestion here that the bank is potentially 
exposed to lose hundreds of millions of dollars as a result of 
this intrusion. They discover that internally. They obviously 
don't want the evening news to carry the story: ABC Bank losing 
hundreds of millions of dollars to a hacker. That would suggest 
to their customers that it is not a safe place to keep their 
money and so on.
    How can the law enforcement and prosecution authorities 
ensure that that won't happen and, therefore, provide a good 
incentive for people to cooperate with law enforcement as soon 
as possible to get the critical information to law enforcement 
so that the perpetrators can be brought to justice?
    Ms. Napolitano. Senator, that is a difficult question 
because we find it in a lot of different areas where entities 
that are actually the victims of crime are reluctant to report 
it because of likely media attention. And certainly you 
sometimes cannot control the media. I know this will come as a 
shock, but sometimes they find their own things of interest.
    But a couple of very concrete things can be done to 
increase, I think, the security that a business can have in 
working with law enforcement. One is to make greater use of and 
have the ability to make greater use of sealing orders in court 
to protect things like trade secret information, proprietary, 
computer security information, and the like. After all, the 
long-term damage to an institution or a business is not the 
one-day news story. It is having the actual data put into the 
public domain that would enable someone else to commit a 
similar crime. The new bill in Arizona that I described 
actually has some express statutory provisions in that regard. 
I believe in terms of sealing trade secret information, Federal 
law already had a provision. Most States don't have something 
similar.
    Senator Kyl. Mr. Gonzalez, anything to add?
    Mr. Gonzalez. I would offer a couple of comments, Sir. In 
terms of publicity and public awareness, generally speaking, 
with the FBI and with the numerous Attorney General guidelines 
we have regarding the contacts with the media, information that 
is relayed to us or is reported to us a potential crime does 
not necessarily intimate that it is going to be made public any 
time soon or any time in the near future.
    Senator Kyl. Well, they would need a lot better assurance 
than that, though.
    Mr. Gonzalez. That is generally--that is our process.
    The other thing that I would intimate is there is a 
particular case that I am pretty sure has been resolved where a 
bank, in fact, was defrauded of about 10 or so million dollars, 
and we were able to recover all that money based on the 
company's willingness to report. I think we recovered all but 
$800,000 of the $10 million or so that were taken.
    So I think the upside or the benefits to private industry 
and to these companies that have the potential of being 
defrauded is much better in joining forces with law enforcement 
to try to resolve the issue as opposed to not reporting.
    Senator Kyl. I believe that, you believe that, and it makes 
intuitively good sense. Obviously, it is going to be necessary 
to continue to operate in a way that assures the public that 
this kind of protection of their sensitive information will 
occur with law enforcement so that they will have an incentive 
to fully cooperate.
    Let me ask you about the arrest earlier this year. Maybe 
you are not totally familiar with the inside details of it, but 
perhaps you could share some information with us here about the 
Canadian law enforcement officials' arrest of the young man in 
Canada, a 15-year-old teenager, as I understand it, who is 
suspected of being at least one of the people responsible for 
the recent denial-of-service attacks on the Internet sites in 
the United States. Can you tell us a little bit more about how 
the investigation of that case was conducted by the FBI and 
what the status of it is?
    Mr. Gonzalez. I can tell you in general terms the processes 
that we went through that I think resulted in some of the 
successes.
    First of all, there was an almost immediate reporting of 
the intrusions or the denial-of-service attacks by the 
companies affected, which obviously triggered a response from 
the FBI. With the FBI's structure as it is nationwide, where we 
have nationwide offices, in each of those offices we may not 
have fully fledged computer intrusion squads, but we have 
agents that are assigned to those matters across the country. 
We were able to almost simultaneously develop information that 
had leads, as we call them, all over the country and able to 
address those simultaneously with the use of the National 
Infrastructure Protection Center, which one of their roles is 
the coordination of these types of investigations because of 
their national scope and international scope.
    So all those things occurred almost, again, I will use the 
term simultaneously, because once it was reported, it put 
several processes into action, including the coordination 
efforts by NIPC, the individual field divisions getting out and 
addressing the particular leads they had, which we had some in 
Phoenix, and at the same time, once it was determined that 
there was a nexus to Canada, our legal attache office in Canada 
was able to have liaison with the RCMP and able to make the 
information either available or pass it and a lot for the 
successful processing of the information to the Canadian 
authorities so they could make the arrest.
    But as you can see, it is a multifaceted process that we 
went through. It would be extremely difficult to do that if we 
didn't have the national resources available and on hand to 
conduct the adequate investigation.
    Senator Kyl. It sounds like another good example for the 
need for a multiple or nationwide trap and trace authority as 
well.
    Mike Vatis in Washington, DC, in our hearing there, the 
Director of the FBI's National Information Protection Center, 
the NIPC----
    Mr. Gonzalez. Infrastructure.
    Senator Kyl. Yes, I misstated that. He discussed two 
programs called InfraGard and Key Asset Initiative. Can you 
describe those two programs and how they are being carried out 
here?
    Mr. Gonzalez. Yes, Sir. The Key Asset Initiative involves 
each field division of the FBI within their jurisdiction in 
identifying key assets that are involved, whether it be 
providing infrastructure services, whether it be 
communications, transportation, academia, identifying these 
assets and making contact with them and obtaining--and setting 
up with them a system whereby we have 24-hour points of contact 
with those different assets so that in the event there is 
either an intrusion or an attempted intrusion, that we can be--
we will have access to those different entities.
    The InfraGard program involves an information-sharing 
initiative that is coming out--that is actually in place in a 
lot of areas. We are getting ready to implement it in Arizona. 
But what we do is, we offer anonymity to any company that wants 
to join us, and it will do things. It will give them the 
ability to provide the FBI and NIPC with information regarding 
either intrusions or potential--or attempted intrusions into 
their system through an encrypted e-mail capability, and also 
as being part of that program, it will allow them to receive 
warnings or threat warnings or intrusion warnings from NIPC as 
they are doing their national review of these particular 
incidents.
    So the Key Asset Initiative identifies areas in industry 
and in business that have potential for being either attacked 
or have potential of affecting our infrastructure and our 
commerce, and then the InfraGard initiative includes those 
entities and other entities in private business, private 
enterprise, that have a need to be advised of either threats or 
potential threats through the encrypted e-mail system.
    Senator Kyl. So are you actually going out to industry and 
visiting with them about their potential participation?
    Mr. Gonzalez. Yes, Sir. We are currently in the process of 
doing that.
    Senator Kyl. Let me ask each of you a last question just to 
indicate to the audience here we have to conclude the hearing 
by 11 o'clock. We have two more witnesses. So even though I 
can--I love getting information from these folks, and I could 
sit here all day. But we will have to close it off and move on 
to our next witnesses here.
    But let me ask both of you, Attorney General Napolitano, 
you mentioned desk subpoenas in your testimony, and Director 
Louis Freeh testified about administrative subpoenas necessary 
to effectively track cyber crime. Could you describe what those 
are and how that relates to our need for modifying law or 
procedures?
    Mr. Gonzalez. In terms of the FBI, they are referred to as 
administrative subpoenas. The FBI currently has that and some 
other Federal law enforcement agencies have that ability in 
drug investigations, in health care fraud investigations, and 
in crimes against children investigations. It basically allows 
the head of an office or one of his designees to issue a 
subpoena for information when it regards one of those types of 
investigations.
    What that does, it is actually two-fold: Again, it goes to 
the timeliness. We have an ability to do that almost at a 
moment's notice if needed in a particular investigation; and, 
No. 2, the information we gain from those subpoenas, there are 
no restraints in terms of us sharing it with other State and 
local law enforcement agencies or anyone else that would have a 
need to know in terms of getting that information as opposed to 
comparing it to a Federal grand jury.
    Senator Kyl. Is there a difference between an 
administrative subpoena and a desk subpoena?
    Ms. Napolitano. Well, we use the term desk subpoena as 
shorthand for a subpoena that a prosecutor signs as opposed to 
continually going back to the grand jury to get another 
subpoena duces tecum. So what Arizona law will provide when 
this provision takes effect is that on the certification of the 
prosecutor that this is relevant to an ongoing criminal 
investigation, we can issue based on that signature on a 
subpoena duces tecum to a service provider without having to 
continually go back to the grand jury and get a subpoena. It is 
very important because in a lot of these cases, as you see, we 
are following, say, for example, an e-mail to its source, and 
we can literally go around the country and end up in Glendale. 
But this way we can do it very quickly. We can do it at night. 
We can do it on weekends when the grand jury is not in session, 
and oftentimes we need to be able to do that.
    Senator Kyl. And the legal protection is that the evidence 
is obviously not usable if it has exceeded the probable cause 
requirements that you would ordinarily have to seek from a 
judge.
    Ms. Napolitano. Right. And the purpose is not to get the 
content of the e-mail. This is simply to be able to track where 
it--the chain of where it is coming from. So that is the 
primary purpose of this, not to get the actual content but to 
be able to find out the source of the e-mail. And as I 
mentioned earlier, Senator, many times we have to do that at 
night and over the weekends where continually going back to get 
a subpoena is impossible.
    Senator Kyl. I hope if our viewers have picked up anything 
from this hearing, they will appreciate the challenge that law 
enforcement is faced with in investigating these kinds of 
crimes because of the huge technological challenges that are 
presented and the very limited resources that you alluded to, 
Ms. Napolitano, and some of the legal--the very strict legal 
requirements that we impose in this country to make sure that 
people's constitutional rights are not in any way invaded, and 
that sets up some very high barriers for law enforcement but 
that obviously we intend to continue to abide by those 
requirements. It makes it tough for law enforcement, but you 
can still get your job done if you have adequate cooperation 
with the people who are reporting the crimes, and from the 
Congress perhaps and the State legislature, as you have noted, 
in providing the kind of legal authority and resources 
necessary to do the job.
    It is a very difficult challenge. It will evolve as time 
goes on, and I commend both of you and your offices for the way 
that you have jumped on this very quickly. And certainly as you 
have pointed out, General Napolitano, Arizona being the leader 
in developing both the legal authority and within your office 
the ability to quickly deal with these kinds of cyber attacks.
    I commend you both, and I appreciate you testifying here. 
We will have the record open for a period of time for any other 
comments you would like to make, and naturally I am always 
appreciative of your advice on the subject. So thank you very, 
very much.
    Mr. Gonzalez. Thank you.
    Ms. Napolitano. Thank you, Senator.
    Senator Kyl. Our next witness is David Aucsmith, the chief 
security architect for the Intel Corporation. Mr. Aucsmith is a 
recognized expert in the computer security field and will be 
making the U.S. industry presentation at the upcoming G-8 
summit on cyber crime in May in Paris, France.
    Mr. Aucsmith, your full statement will be placed in the 
record, and I would invite you to make summary remarks at this 
time. And, again, I very much appreciate your presence here.

     PANEL CONSISTING OF DAVID W. AUCSMITH, CHIEF SECURITY 
ARCHITECT, INTEL CORP.; AND JOSE GRANADO, SENIOR MANAGER, ERNST 
                    & YOUNG LLP, HOUSTON, TX

                 STATEMENT OF DAVID W. AUCSMITH

    Mr. Aucsmith. Thank you very much, Senator.
    The purpose, I think, of my presentation is to talk about 
the technological trends and challenges facing the protection 
of critical infrastructures as we move forward.
    Intel's former CEO, Andy Grove, was very fond of starting a 
lot of his presentations with the statement that we are rapidly 
approaching a time of a billion connected computers. That is 
actually a fairly fantastic statement. He said there are 
roughly a billion connected computers simultaneously exchanging 
data. And the computers that we are talking about are not just 
PC's. As was mentioned earlier, we are talking about the 
controls to an irrigation system. We are talking about national 
power grids, airline reservations, financial information from 
Wall Street, accessible by a billion connected computers.
    Why is this done? The obvious reason is to improve cost and 
efficiency. It lowers the cost if there are common 
infrastructures 
allowing communications and information to take place, and it 
significantly raises the efficiency. In fact, a year or so ago, 
the Department of Commerce credited that efficiency with 
keeping the level of inflation a whole percentage point lower 
than it would have been otherwise.
    However, this same efficiency also created quite a number 
of vulnerabilities, which is what this hearing is basically 
about. Those efficiencies mean that we have just-in-time 
inventory management, we have just-in-time commission and 
movement. That leaves very, very little room for error when 
that system is disrupted. That just-in-time inventory also 
applies to critical components of the national power grid and 
transportation sectors.
    Basically what we have seen so far is vandals on the 
Internet, as another way of putting it. That is the majority of 
the cases. If you have a billion connected computers, one way 
to look at that is you have a billion minus one potential 
attackers to your particular computer system.
    Another way from my end that we look at this is that we 
basically have a billion connected computers each of which has 
a billion different security policies. We actually can't seem 
to agree on precisely what is the right way to defend or to 
state even how we should defend each of the individuals sites.
    The statistics are rather frightening. It includes major 
companies such as Intel and others attacked somewhere around 
the neighborhood of 6,000 a day. You have cable modem users who 
would reflect around 250 attacks or so a week. And it is a 
fairly phenomenal amount.
    Now, most of these attacks are the equivalent of vandalism. 
I like to point out it is somewhat like spray painting in 
cyberspace. It is about the same equivalent. The problem, of 
course, is that you really can't tell which of those are 
potential spray painters and which of those are potentially 
serious fraud or an intelligence-
gathering operation.
    One way to look at it is if you were a business you 
wouldn't tolerate a few thousand people a day walking up and 
rattling your front doors or trying to see if there is an open 
window where they could come into your business, yet in 
cyberspace, we have sort of grown up and accept these just as a 
matter of fact. We can't live with this as a basic problem. In 
fact, when vandalism gets out of hand, you end up with the 
distributed denial-of-service attacks that we have just had. 
That's what happens if several thousand people show up at your 
front door at once.
    There are other problems which is just essentially the 
cascading destruction that occurs when one part of the system 
fails due to a vandalism or a malicious attack or a terrorist 
incident or whatever. The interconnectivity causes a great deal 
of things to happen all through.
    But I don't want to dwell on vandalism. There is a great 
statement from the bank robber of the 1950's, Willie Sutton. 
When he was asked why did he rob banks, he said, ``Because 
that's where the money is.'' Well, right now e-commerce is 
where the money is. In fact, it is very likely that we will see 
serious criminals--and we are beginning to see them--move into 
cyberspace because that is where the money is.
    We have seen this in the case of credit card theft and a 
number of others. Basically cyberspace offers precisely the two 
things that criminals need: anonymity and mobility. Those 
happen to be the things that generally e-commerce also needs, 
but they do facilitate the bad guys.
    Most security domains as they are set up now approach what 
we call the nougat method of security, which is they have a 
very hard shell on the outside and they are soft and chewy on 
the inside. So all you have to do is break through that outer 
barrier and people do not practice defense in depth in general.
    That is not to say that people aren't trying. There is a 
great deal of standards development going on within the 
industry. The international standards is essentially the glue 
that binds cyberspace together, and there is a lot of work, 
including IP security standards for telecommunications, use of 
better identification methods like smart cards and biometrics. 
All of those things are happening, but it is important to 
stress that standards development is extremely slow. Because it 
is an international endeavor, it does not move at cyber speed.
    Also, security is traditionally a form of insurance. We 
didn't put up metal detectors in airports until after airlines 
were hijacked. We are unlikely to put in strong security in 
cyberspace until after major incidents. It is just very hard to 
get people motivated otherwise.
    One of the perhaps best things that we can do is to provide 
some assistance for law enforcement and others in dealing with 
the current problems. The technology that we deal with is 
extremely complex. Its very efficiencies frequently frustrate 
the ability to catch criminals in cyberspace. It is complex and 
esoteric. Experts typically are hard to find and have to be 
paid a great deal. It is very difficult for law enforcement to 
deal with that.
    Intel might be regarded as being at the forefront of this 
technological revolution, certainly one of the companies, and 
it is very difficult for us to keep up with the technology, and 
we dedicate a great number of people to doing that.
    The best thing that we can do is to have good cooperation 
amongst industry components and with governments to help make 
the Internet a safer place and to protect the critical 
infrastructures. There are several good examples of that 
cooperative effort. Some of them have already been alluded to. 
There are others such as the information technology study 
group, which is a joint industry and FBI initiative to look at 
strategic directions in solving these problems.
    However, there are problems with that cooperation. Some of 
them have been alluded to. We are now having a collection of 
industry competitors coming together to share information. That 
brings up antitrust issues. Certainly from the strategic 
standpoint, we have companies disclosing vulnerabilities and 
other intellectual property about their products that is 
subject to discovery and may end up in a court of law. That is 
not something generally wanted by industry.
    There are problems with funding of those cooperative 
efforts. Industry is pretty much consenting to do this on a pro 
bono basis, gratis, if you will, but the government sectors of 
those require funding in order to do the Administration and 
make the best use of that.
    Congress also will have to address other problems. The 
biggest problem looming on the horizon is that having to do 
with jurisdictional issues. Cyber crime occurs all over the 
world. It is very difficult to figure out who exactly has 
jurisdiction and in what cases. Some of that is being 
addressed.
    So, basically, in closing, though I don't want to leave you 
with too bleak a view here, the technology is basically amoral. 
It is just moving at a very rapid pace. It is being used for 
good and, of course, bad guys will move in, too. Traditionally, 
law enforcement and national security interests have been able 
to adapt to changes in technology from the automobile, the 
telephone, and others over time. I am sure that in time we will 
be able to adapt to create effective order in the new 
technologies. It is perhaps fitting, if you will, that this is 
being held in Arizona. It somewhat resembles the Wild West at 
this point of view, and it is merely a need to slowly but 
surely civilize it. That is one way to look at it.
    Thank you very much, Senator.
    [The prepared statement of Mr. Aucsmith follows:]
    [GRAPHIC] [TIFF OMITTED] T9335.058
    
    [GRAPHIC] [TIFF OMITTED] T9335.059
    
    [GRAPHIC] [TIFF OMITTED] T9335.060
    
    [GRAPHIC] [TIFF OMITTED] T9335.061
    
    [GRAPHIC] [TIFF OMITTED] T9335.062
    
    [GRAPHIC] [TIFF OMITTED] T9335.063
    
    [GRAPHIC] [TIFF OMITTED] T9335.064
    
    [GRAPHIC] [TIFF OMITTED] T9335.065
    
    [GRAPHIC] [TIFF OMITTED] T9335.066
    
    Senator Kyl. Well, thank you very much, Mr. Aucsmith. Of 
course, we wanted to put one of our premier corporations on 
display as well, and since you are a leading technology expert 
in the area, we thought this would be a good forum in which to 
discuss this. I am not sure whether we should have had you 
before or after our next witness, though, because our next 
witness is going to demonstrate to us how this hacking is done.
    Now, I have some assurances that with the law enforcement 
officials here, this will all be done in a quasi-legal way, but 
I take no--I give no assurances in that regard. Let me properly 
introduce to you Jose Granado. He is a senior manager at Ernst 
& Young, a highly qualified accounting firm in the country, no 
fly-by-night hacking outfit, I would hasten to point out. And 
recently it was named as the outstanding information security 
organization, as I understand it, by the Information Systems 
Security Association. So Jose also comes by his expertise 
rightly.
    He has been involved with information security for the last 
12 years. He is a frequent speaker on the topic. We thank you 
for testifying today, and as I have mentioned to the others, 
your full statement will be placed in the record, and we would 
appreciate a summary of your remarks at this time.

                   STATEMENT OF JOSE GRANADO

    Mr. Granado. Good morning, Mr. Chairman. Thank you for the 
opportunity to testify today regarding improving prevention and 
prosecution against cyber attacks. As you mentioned, I am a 
senior manager with Ernst & Young's eSecurity Services group. I 
direct a team of ``white hat hackers'' who perform network 
assessments on client networks. Their objective is to identify 
existing weaknesses in computer systems that will lead to 
unauthorized access. My perspective comes from having led over 
100 network security assessments over the past several years. 
Assisting me today is Ron Nguyen, a manager with our eSecurity 
Services group. Today we will describe and demonstrate the 
process we utilize to perform these assessments.
    When performing these assessments, we obtain a snapshot in 
time of an organization's network security posture. This 
snapshot allows us to identify potential points of entry to 
gain unauthorized access to a network. The demand for these 
assessments has been generated by several factors: increased e-
commerce initiatives, increased Internet dependency, which has 
generated a need for independent security reviews, increased 
discovery of operating system and application level 
vulnerabilities, and increased publicity, as we have seen 
recently with the denial-of-service attacks on eBay, Yahoo, and 
others.
    Although our team is extremely skilled, over 75 percent of 
our initial access into client networks is gained via 
relatively simple methods and techniques. Our success is 
facilitated by three factors: poor selection of user ID's and 
passwords, poor system configuration from a security 
perspective, and the inability for organizations to implement 
solutions on a realtime basis to existing vulnerabil-
ities.
    Hundreds of websites exist that contain system security 
information. The network used to exchange this type of 
information transcends physical, geographical, and cultural 
boundaries. Internet chat sites, informal gatherings, and 
conferences also help to facilitate the flow of information.
    During today's online demonstration, we will identify a 
live computer system, scan the computer system for potential 
entry points, gain access to the system, eavesdrop and control 
the system remotely, crack the password file, and, finally, 
execute a denial-of-service attack.
    Our demonstration network is comprised of two Windows NT 
laptop computers. The computer labeled ``attack,'' the one on 
the larger screen, will be performing the hacking activity. The 
computer labeled ``victim,'' the one on the smaller screen, 
will be the recipient of the attacks. Although these computers 
comprise their own mini network, the techniques demonstrated 
today can be performed against any live computer on the 
Internet that is in a similar security state as our victim 
system.
    An attacker can run a ping utility to randomly identify a 
range of targets on the Internet. The attacker can also target 
a specific victim to attack. For our demonstration, we will 
ping www.
victim.com.
    The ping utility has identified one live system on our 
network designated by the IP address 192.168.10.10. An IP 
address is a numerical designation that identifies a computer 
on a network. Once we identify a live target, there are a 
number of freely available vulnerability scanning tools that 
can be used to identify potential entry points. For our 
demonstration, we will use the freeware tool called 
``Superscan'' on our attack system to scan our victim.
    The scanner has identified potential entry points on our 
target system--specifically, ports 21, 80, 135, and 139. A port 
is a numerical designation for a specific network function. 
Part of the system access process is mapping vulnerabilities 
associated with these open ports to exploit tools. Our scan 
identified port 80, which is associated with Web browsing, as 
open. For our demonstration, we will launch the iishack tool on 
our attack system to gain access to our victim.
    We now have gained access to our victim system. The attack 
was successful. The iishack tool the attacker used exploited a 
buffer overflow vulnerability on the target system. A buffer 
overflow condition is caused by the transmission of unexpected 
data to a target system, causing it to accept commands from an 
attack system. The hack tool launched a listening service that 
the attacker can now use to remotely control the system. This 
listening service allows the attacker to eavesdrop on the 
victim system by using a standard Web browser. For our 
demonstration, the attack system will monitor a letter being 
typed by the victim system.
    As you can see, the attack system now actually has the 
screen of the victim system displayed on it. The victim 
computer is typing a letter with the notepad function, and what 
he is typing keystroke by keystroke is now appearing on the 
bigger screen, which is the attack system.
    With remote control access, the attacker can leverage the 
target system as a launchpad to attack other systems, start 
programs, access and view files. For our demonstration, we will 
access and view files on the victim system from our attack 
system.
    As you can see, the attack system here is going through the 
contents of the C drive on the victim system and actually 
bringing up documents that are on the victim system and 
actually appearing on the screen of the attack system. The 
documents, as you can see, appear in their complete entirety.
    Now that the attacker has full control of the target 
system, one of the most popular activities is password 
cracking. The attacker can download the password file from the 
remote system and run a password cracker to discover user 
passwords. For our demonstration, we will download the password 
file to our attack system and using the lopht crack program 
demonstrate how quickly passwords can be cracked.
    We have located the password file on the victim system. We 
have dragged it to the desktop of our attack system. We are now 
bringing up the lopht crack tool and feeding that password file 
to the cracking tool. And as you can see, in a matter of 
seconds 18 of 21 passwords were cracked, and that took probably 
2 or 3 seconds.
    If the attacker is simply looking for targets to crash, 
they can easily launch a denial-of-service attack directed 
specifically at the target system. For our demonstration today, 
we will launch a denial-of-service attack on our attack system 
to disable our victim.
    The IP address of the victim system is being inputted into 
the denial-of-service tool, and after pressing the nuke button, 
we see that our victim system has been disabled as evidenced by 
the blue screen with all the error messages that are on it. And 
now that that system is disabled, it needs to be restarted to 
get back to its original state.
    Thank you for the opportunity to testify today at this 
hearing, and subject to your questions, this concludes our 
quick demonstration.
    [The prepared statement of Mr. Granado follows:]

                   Prepared Statement of Jose Granado

                         POWERPOINT TITLE SLIDE
Introduction
    Mr. Chairman and distinguished members of the Subcommittee, thank 
you for the opportunity to testify today regarding improving prevention 
and prosecution against Cyber Attacks.
    My name is Jose Granado. I am a Senior Manager with Ernst & Young's 
eSecurity Services group. I direct a team of ``white hat hackers'' who 
perform network assessments on client networks. Their objective is to 
identify existing weaknesses in computer systems that will lead to 
unauthorized access. My perspective comes from having led over 100 
network security assessments over the past several years. Assisting me 
today is Ron Nguyen, a manager with our eSecurity Services group. Today 
we will describe and demonstrate the process we utilize to perform 
these assessments.
                          POWERPOINT SLIDE ONE
Introduction to White Hat Hacking
    When performing these assessments we obtain a ``snapshot'' in time 
of an organization's network security posture. This snapshot allows us 
to identify potential points of entry to gain unauthorized access to a 
network. The demand for these assessments has been generated by several 
factors:

     Increased eCommerce initiatives.
     Increased Internet dependency--which has generated a need 
for independent security reviews.
     Increased discovery of operating system and application 
level vulnerabilities.
     Increased publicity--as we have seen recently with the 
Denial of Service Attacks on eBay, Yahoo and others.

    Although our team is extremely skilled, over 75 percent of our 
initial access into client networks is gained via relatively simple 
methods and techniques. Our success is facilitated by three factors:

     Poor selection of userids and passwords.
     Poor system configuration from a security perspective.
     Challenges organizations face in keeping up the large 
volume of vulnerabilities discovered on a daily basis.
                          POWERPOINT SLIDE TWO
    Hundreds of web sites exist that contain system security 
information. The network used to exchange this type of information 
transcends physical, geographical, and cultural boundaries. Internet 
Chat sites, informal gatherings and conferences also help to facilitate 
the flow of information.
                         POWERPOINT SLIDE THREE
    During today's online demonstration we will:

     Identify a ``live'' computer system.
     Scan the computer system for potential entry points.
     Gain access to the system.
     Eavesdrop and control the system remotely.
     Crack the password file.
     Execute a denial of service attack.
                               START DEMO
Demonstration
    Our demonstration network is comprised of 2 Windows NT laptop 
computers. The computer labeled ``attack'' will be performing the 
hacking activity. The computer labeled ``victim'' will be the recipient 
of the attacks. Although these computers comprise their own mini 
network, the techniques demonstrated today can be performed against any 
``live'' computer on the Internet that is in a similar security state 
as our victim system.
Identifying a ``live system''
    An attacker can run a ping utility to randomly identify a range of 
targets on the Internet. The attacker can also target a specific victim 
to attack. For our demonstration we will ping www.victim.com.
Scanning a system for potential vulnerabilities
    The ping utility has identified one live system on our network 
designated by the IP address 192.168.10. 10 An IP address is the 
numerical designation that identifies a computer on a network. Once we 
identify a live target, there are a number of freely available 
vulnerability scanning tools that can be used to identify potential 
entry points. For our demonstration, we will use the freeware tool 
``Superscan'' on our attack system to scan our victim.
Gaining access to a system
    The scanner has identified potential entry points on our target 
system. Specifically, ports 21, 80, 135 and 139. A port is a numerical 
designation for a specific 
network function. Part of the system access process is mapping 
vulnerabilities associated with these open ports to exploit tools. Our 
scan identified port 80 which is associated with web browsing as open. 
For our demonstration we will launch the iishack tool on our attack 
system to gain access to our victim.
Eavesdropping on a system remotely
    The iishack tool the attacker used exploited a buffer overflow 
vulnerability on the target system. A buffer overflow condition is 
caused by the transmission of unexpected data to a target system, 
causing it to accept commands from an attack system. The hack tool 
launched a listening service that the attacker can now use to remotely 
control the system. This listening service allows the attacker to 
eavesdrop on the victim system by using a standard web browser. For our 
demonstration the attack system will monitor a letter typed by the 
victim system.
Controlling a system remotely
    With remote control access, the attacker can leverage the target 
system as a launchpad to attack other systems, start programs, access 
and view files. For our demonstration we will access and view files on 
the victim system from our attack system.
Cracking passwords
    Now that the attacker has full control of the target system, one of 
the most popular activities is password cracking. The attacker can 
download the password file from the remote system, and run a password 
cracker to discover user passwords. For our demonstration we will 
download the password file to our attack system and using the lopht 
crack program demonstrate how quickly the passwords are cracked.
Executing a Denial of Service Attack
    If the attacker is simply looking for targets to crash, they can 
easily launch a denial of service attack directed specifically at the 
target system. For our demonstration, we will launch a denial of 
service attack on our attack system to disable our victim.
    Subject to any questions this concludes the presentation.

    Senator Kyl. Thank you very much.
    Did the FBI get all of that down? [Laughter.]
    You were taking good notes.
    Obviously, this simulation attack is designed to illustrate 
how people with a little bit of expertise--and I know that our 
witness here has a lot of expertise, but I am going to ask him 
as kind of a first question how much expertise you need to do 
this--can quickly get into, can disable, can secure information 
from or deface a system, whether it be a business or commercial 
system, a government computer, a research or university 
computer, or certainly a private computer.
    Let me begin by asking, Mr. Granado, just how experienced 
do you have to be to be able to do the kind of thing that you 
just now did?
    Mr. Granado. The experience is not what one would think. We 
often find that individuals involved in this kind of activity 
have a love for technology. These are folks that stay up until 
2, 3 or 4 a.m. reading everything they can get their hands on 
on systems and vulnerabilities and things of that nature. These 
kind of folks aren't individuals that have to go to Harvard to 
get this kind of experience. So the love for technology, a 
basic understanding of computer systems and networks is really 
at the foundation level all that is required.
    Now, as I mentioned during my testimony, the voluminous 
amount of information that is out there on the Internet on how 
to go at these systems actually helps to facilitate the 
knowledge process for folks that want to get involved in this 
kind of activity. But the experience needed to do this is not 
great. It is just a general understanding of computers and 
networks, and then all the information that is available out 
there kind of helps snowball your experience level so that you 
can perform these kind of activities.
    Senator Kyl. I think illustrative of that is the fact that 
the first person arrested in connection with the denial of 
service of the various sites in the United States, the young 
Canadian, was 15 years old. And I will mention another 
operation. During the time the United States was preparing an 
attack on Iraq, there was an intrusion into some U.S. 
Government computers that was serious enough that it got the 
highest levels of our Government. We dubbed the exercise 
``Solar Sunrise.'' We eventually found that there were three 
people under the age of 20 in I think two different countries 
that were involved in that attack. They were fortunately 
brought to justice.
    But the point is that this seems to be coming a lot from 
young people who obviously don't have the college degree you 
are speaking of but have acquired the capability to cause great 
mischief.
    Mr. Granado. Absolutely.
    Senator Kyl. Let me ask Mr. Aucsmith, at our hearing in 
Washington, DC, Harris Miller, who I am sure you know--he is 
president of the Information Technology Association of 
America--testified and he said one of the inhibitions of 
sharing information between the private sector and the 
Government regarding these vulnerabilities and threats is that 
companies naturally don't want their vulnerabilities and the 
attacks that have actually occurred against them to be publicly 
known since this could easily impact on consumer confidence in 
their particular sites and people then might not want to use 
their website. He said that unless companies are given an 
exemption from the Freedom of Information Act so that 
information they disclose to the Government can't be obtained 
by any other person that files the paperwork, that they would 
not want to voluntarily submit information to the Government in 
the name of cyber security.
    Do you share this view? Do you think we need that kind of 
protection of private information from being acquired under the 
Freedom of Information Act?
    Mr. Aucsmith. Yes, Sir, I actually do, very much so. There 
are two issues at stake here, and it depends on for what the 
information is being used. If it is tactical information, the 
FBI may be needed to solve the problem.
    Senator Kyl. Meaning on how to--sort of to understand the 
kind of thing that Mr. Granado just now did, how does this 
system work so that we can track back the perpetrator.
    Mr. Aucsmith. Right. And for that, our concern is if we 
share that information, we may end up as a witness in a 
discovery process. No company wants to end up in a criminal 
proceeding with their product. The second, somewhat longer 
range, has to do with we are aware--as much as we may try, we 
can't produce perfectly secure systems. It is just not 
economically feasible. In many cases, it is not even 
technically feasible. So we are made aware of vulnerabilities, 
but we are sort of constantly trying to fix those 
vulnerabilities in each new product revolution. So what you 
basically have is a sliding window of vulnerabilities that go 
along, and industry is very reluctant to make that public 
because, clearly, that is only helping the bad guy. It 
certainly could be used by your competition to weaken your 
product. So there is some need--there is a need to come up with 
some solution for allowing--sharing the strategic 
vulnerabilities, helping your practical situation with 
knowledge that we have in a way that doesn't adversely affect 
the security of a company or the infrastructure that are built 
off of those products. Something needs to be done.
    Senator Kyl. Well, Congress is looking--I was involved in 
the Y2K legislation which gave some temporary time-outs for 
liability on sharing of information in order to ensure that in 
that run-up to the Y2K turnover that we wouldn't have an excess 
of problems. And that seemed to work pretty well.
    So you would be supportive of Congress looking into the 
Freedom of Information Act, the potential for class action 
liability, antitrust liability, in a way to try to balance the 
need to share this information with the protections needed if 
the information is shared.
    Mr. Aucsmith. That is correct. Clearly, we are not 
advocating removal of FOIA. But what we are advocating is 
giving some level of protection where such vulnerabilities are 
so terribly sensitive.
    Senator Kyl. Now, Mr. Granado, one of the issues here is 
insider threat. In addition to hacking in from the outside, 
clearly there are some problems of the insiders. Could you 
comment a little bit about your concern there?
    Mr. Granado. Yes, Sir, absolutely. I mentioned during my 
testimony that our access into computer networks 75 percent of 
the time is through simple methods and techniques, and that 
specific statistic was for attacks from the outside in. When we 
are invited into an organization to perform our assessments, 
our success rate is 100 percent. The reasoning there is 
obviously there is a certain level of trust that is assumed 
when an individual or a group of individuals are inside an 
organization, the security problem I think becomes twice as 
difficult because of that assumed level of trust, and the 
security controls that an organization implements, they need to 
be perimeter-based for external threat, but there also needs to 
be auditing and monitoring tools on the inside so that the 
activities of users on the inside could be monitored so that if 
any weird activities are occurring they can be flagged and 
acted upon.
    Senator Kyl. This is the so-called defense in depth concept 
that Mr. Aucsmith mentioned.
    Mr. Granado. So there is no question that the insider 
threat is greater from my perspective than the outside threat. 
Again, that assumed level of trust of someone that you let 
inside your facility, they have already beaten one hurdle. They 
now just have to get to your network and access systems.
    Senator Kyl. I want to ask both of you a question here, and 
this goes right to the point Mr. Aucsmith made a minute ago. 
Maybe neither one of you want to reveal this nasty little 
secret to the public here, but I think it is important to do so 
in order to help do the job that both of you do.
    I would like for you to describe just how vulnerable anyone 
on the Internet is, and let me put it in this context. Suppose 
I buy one of the new encryption products and let's call it 
pretty good security, and I buy that and I think, great, I am 
encrypted now, and unless some organization like the CIA tried 
to crack it, it is not going to be crackable. So I am home free 
here.
    How foolish is that attitude? Just how vulnerable is anyone 
on the Internet? How easy is it and how many different ways are 
there to break into these kind of systems?
    Mr. Aucsmith. You have actually gone a reasonable step 
towards achieving security from a particular type of threat. 
That particular type of threat is collecting tactics at some 
intermediate point. What you have done nothing for is to 
protect the endpoint systems where that information originates 
or the destination of where it goes. In fact, given most 
encryption systems, the vulnerability is actually to break into 
the system and record the information before it is ever 
encrypted, which basically could be done in the attack you just 
saw here, or to go hunting around in the computer itself for 
the keystrokes that were used to invoke the unknown--or the 
key, the encryption key. You would solve one of the problems, 
but probably not the hardest one, quite frankly. And how 
vulnerable are they? If you were to take this scenario that I 
just went through here, and instead of launching the particular 
attack I did, but start downloading the swap file, which is 
where the operating system puts intermediate material as it is 
being processed for efficiency, and then scan that for the 
invocation of your particular encryption program and the 
keystrokes that were used to invoke it, you will most likely 
recover the key.
    Senator Kyl. Can you describe this in terms of an analogy? 
I know you used the analogy of leaving the window open in the 
home. But can you think of a good analogy to bring home to 
people how you may have provided security at points D through 
F, but that is not all the way from A to Z.
    Mr. Aucsmith. The analogy that we frequently talk about is 
putting an armory on a screen door. I think basically you have 
armored the front door and left all the windows open.
    Senator Kyl. Mr. Granado, do you want to add anything to 
that?
    Mr. Granado. Sure. The way I would like to comment on that, 
Senator, Ernst & Young is very active in providing this kind of 

information to the IT community. We have a website, www. 
esecurityonline.com, which provides vulnerability information 
for IT folks who are interested on what the latest threats are. 
And we also provide a separate section for clients. We give 
them customized vulnerability information based on the types of 
computers they have.
    Anyway, my point is, for anyone to think that if they have 
a security product that they just purchased today and that 
makes them secure for the rest of time, it is extremely 
foolish. From a statistical perspective, we discover about 7 to 
10 vulnerabilities a day that we either discover through our 
research labs or that we just gain information from other 
folks.
    So as you can see, you think you are secure today, 
tomorrow, and the next day, but next week you may not be. You 
know, this issue is something that organizations need to 
consider a more proactive approach versus a reactive approach 
to security. And security is a process. It is not a matter of 
plugging a hole and then you are done. It is a process where 
you need to test, you need to implement solutions, and then you 
need to monitor those solutions. And that needs to be 
recurring. And that is the only way that we are going to be 
able to get ahead of the game with respect to these kinds of 
attacks.
    Mr. Aucsmith. Senator, one more follow-up to that. What the 
people from Ernst & Young are talking about is exactly correct. 
But I think we need to emphasize that the scenario they just 
painted is that for an IT organization or business. The same 
scenario is very difficult to work when you are talking about a 
home user. And one of our problems is my industry has been 
pushing very much to get everybody online all the time, always 
connected. We have been a little bit behind on sharing with 
them the vulnerabilities of being online and always connected. 
And the same set of methodologies that work for businesses are 
unlikely to work in the home users. I can't imagine my mother 
being able to discern the information required to make a system 
secure.
    So what we have to do as an industry is make security 
somewhat more seamless and automatic and easier to deal with. 
We have a ways to go on that. We are working very hard, but it 
is a very hard problem.
    Senator Kyl. I think that is a very candid and excellent 
statement of the state of play right now in the industry coming 
from one of the leading industry drivers here, acknowledging 
that in making this wonderful new tool so available to so many 
people so fast, we have got to catch up in terms of security 
and that that is going to require a significant degree of 
effort.
    I think that our hearing today, if it will do nothing else, 
will be to demonstrate to people that there is a significant 
lack of security, but that shouldn't deter people from using 
the Internet, but that they should be very, very careful to the 
extent that what they have on there is private and they want to 
keep it private, and that industry generally and individuals 
are going to have to make good recommendations to the 
Government about what kind of protections they need in order to 
provide the fullest possible cooperation with law enforcement 
for law enforcement to do its job.
    This is something that we want to do our best to cooperate 
on, and I just would reiterate to the audience here, my 
subcommittee deals with three subjects, and in this one area 
they all tie together: technology, terrorism, and Government 
information. And so we are right on the cusp of this. I have 
introduced several pieces of legislation, some of which have 
already been signed into law, some of which are pending, as you 
heard before, and designed to try to begin to resolve these 
issues. But perhaps the biggest point that I would make--and I 
would like to have the witnesses comment on this, and then we 
will--again, I could talk to these guys all day long. I 
wouldn't understand a lot of what they say, but I can at least 
appreciate the point they are trying to make. But we will need 
to cut our hearing off here in a moment.
    We need to create an atmosphere of understanding and mutual 
commitment and trust that will enable private users, the 
private commercial sector, and the Government policymakers and 
Government law enforcement people to work together in order to 
ensure that there is the maximum protection so that there can 
be the maximum use. And if we do that, I think we will continue 
to lead the world and improve the quality of life in this 
country dramatically.
    But to the extent that there continues to be a residue of 
mistrust and an unwillingness to work together, it inhibits 
this wonderful opportunity that we have.
    Actually, there is one last question I would like to ask 
both of you because I think it is important for particularly 
our viewers and people who came to this hearing to appreciate. 
If you want to know more about how to make your own systems 
secure, let's say you are a small business here in Arizona, 
what is the best advice you have to individuals or small 
businesses? I am sure big businesses have found their way to 
your doorstep, but how does a small business do the best it can 
in an economic way to provide the security that it needs?
    Mr. Granado. There are a lot of organizations that folks 
and small businesses can join--Information Systems Security 
Organization is just one--where members of small businesses can 
join these organizations, and they have monthly meetings of 
security professionals within that specific community to 
discuss vulnerability issues, strategic issues, tactical issues 
with respect to systems security. So that would be one good 
economic avenue to gain knowledge on this issue.
    Then the other point, again, what I alluded to earlier, the 
Internet is just full of information that is free and easily 
accessible. You know, I described today the hacking-related 
information. There is just as much information out there on how 
to secure your system, and step by step how to secure it, that 
people can just do searches on the Internet, pull that 
information, pull out what is specific to their machines, and 
work on securing their systems, again, free and all that is 
required is Internet access.
    Mr. Aucsmith. And that is the nice thing about the 
Internet, its opportunities. There are bad guys out there, but 
there are also good guys. You can find lists of places to go 
for the good guys. There is a variety of sources for finding 
that, just a general search will probably help, but you can 
start with CERT, which is an organization at Carnegie Mellon. 
The Computer Emergency Response Team has a wide range of links 
that you can go to where the good guys are. The problem with 
all of that is it is necessary to have the technical competence 
to make that a reality in small business, and many small 
businesses lack that resource, in which case, much as you might 
call a locksmith or a burglar alarm company to help protect 
your physical security, you may very well need to make the 
investment of contacting a security professional to help you 
with your cyber security.
    Senator Kyl. And probably one of the most important points 
is, even though you develop what you think is a secure system, 
always understand that there are numerous vulnerabilities, and 
you have got to constantly be alert to the little things, you 
know, leaving your password taped to the top of your computer, 
as I saw one time, by the way--I mean, it sounds silly, but 
there are a lot of vulnerabilities that people just don't stop 
to think, basically, about what they need to do to make their 
systems secure.
    Mr. Aucsmith. We put them underneath the keyboards.
    Senator Kyl. Yes, right. [Laughter.]
    That is a good metaphor for the need to always be alert 
that there could be a problem, even though you have secured 
what you think is a pretty good system. But the first step is 
to try to take advantage of this.
    I am informed and we learned at our hearing in Washington 
that this Carnegie Mellon entity which Mr. Aucsmith alluded to 
had developed good counter-software to the kind of denial-of-
service attack that occurred against some of the sites that we 
have been referring to today. Some entities took advantage of 
that software. Some did not. Those that did didn't experience 
that denial of service.
    So take advantage of that which is available to you as has 
been described and remain alert to the possibility that even 
that won't necessarily deter a determined hacker. I guess those 
would be the two watch words.
    I really appreciate your demonstration, Mr. Granado, and, 
Mr. Aucsmith, your expertise in this. I will hope to continue 
to plumb the depths of that expertise as we try to fashion the 
kind of national policy and legislative solution to develop 
this cooperation that is going to be so essential to the 
future, and I look forward to continuing to cooperate with you.
    I thank all of you who have joined us at this hearing 
today. As I said at the beginning, this is an official hearing 
of the U.S. Senate Judiciary Committee's subcommittee which I 
chair, and anyone who wishes to communicate with us, we can put 
your comments in the record if they are appropriate. If you 
have questions, obviously submit them through me, and perhaps 
we will have an opportunity to share those with our witnesses 
here today.
    If there is nothing further, then I will declare this 
meeting adjourned.
    [Whereupon, at 10:30 a.m., the subcommittee was adjourned.]
  

                                

```