This hearing compilation was prepared by the Homeland Security Digital Library,

Naval Postgraduate School, Center for Homeland Defense and Security.

MAY 18, 2000

‘I LOVE YOU’ COMPUTER VIRUS AND ITS IMPACT ON 

U.S. FINANCIAL SERVICES INDUSTRY

U.S. SENATE, COMMITTEE ON BANKING, SUBCOMMITTEE ON FINANCIAL INSTITUTIONS 

ONE HUNDRED SIXTH CONGRESS, SECOND SESSION 

HEARING CONTENTS:

Opening Statement

Bob Bennett [View PDF]

Chairman, Subcommittee on Financial Institutions, Committee on Banking

Witnesses Testimony

Jack Brock [View PDF]

Director of Government and Defense Information System, General Accounting 

Office

Gregory Baer [View PDF]

Assistant Secretary for Financial Institutions, Department of Treasury

Stephen Malphrus [View PDF]

Staff Director for Management, Board of Governors of the Federal Reserve

James Adams [View PDF]

CEO, iDefense

COMPILED FROM:

• http://banking.senate.gov/00_05hrg/051800/
Opening Statement - Subcommittee Chairman Bennett

http://banking.senate.gov/00_05hrg/051800/bennett.htm[6/24/2009 3:56:11 PM]

Opening Statements of Committee Members

Oversight Hearing on the "I Love You" Computer Virus

and its Impact on U.S. Financial Services Industry

Opening Statement of Senator Bob Bennett (R-UT)

10:00 a.m., Thursday, May 18, 2000

I am happy to hold my first hearing as chairman of this subcommittee on such an important issue. To borrow a phrase

from that great American, Yogi Berra, "It's Deja Vu all over again." A little more than three years ago, we began a

series of hearings in the Banking Committee which led to the creation of the Year 2000 Committee.

Our inquiry at that time focused on a mysterious programming flaw called the Year 2000 Bug. We quickly realized the

implications of the issue we were examining reached far beyond the financial services sector. That is why for today's

hearing I have asked the GAO to look into how the government reacted to this most recent virus, the Love Bug.

I want to begin to lay the foundation for a series of hearings on the subject of coordinated critical infrastructure

protection in the financial services area over the remainder of this Congress. The GAO interviewed 20 different

agencies and has discovered that the virus caused real, tangible problems for the federal government. Eight of the 20

agencies experienced computer problems which lasted more than one day. The GAO will tell us how one federal

agency lost connections to the Internet and its e-mail service for up to six days and a critical government agency

involved with public health stated that it would not have been able to coordinate an emergency response in case of a

biological incident. These agencies spent literally thousands of hours fixing their systems.

Now let's look specifically at the three unique features of the "I Love You" virus. One, it targeted Microsoft Outlook

users and propagated itself to everyone on the program user's address book. Two, it deleted picture and sound files and

attempted to steal the computer's passwords. Three, it used a "worm" to occupy unused system capacity, thereby

crashing servers in corporations around the globe. The thing that should make all of us sit-up and take notice is that if

this virus had targeted Microsoft Excel or Lotus spreadsheets, it could have wrought massive devastation on the

financial services industry.

The effect of the "I Love You" virus on the financial services industry and its regulators is a microcosm of the impact

it has had on the economy as a whole.

Within the last few years we have witnessed increasingly more severe cyber-attacks. Each new virus is to be an

integral part of an evolutionary process which seems to forewarn of the attacks yet to come. Each mutation is faster,

stronger, and more sophisticated than its predecessor. Some of the hackers with whom my staff has communicated

express extreme contempt for those who have spread these viruses, describing them as "unimaginative" and

"simplistic." Ladies and gentlemen, the implications of that are quite frightening.

The "I Love You" virus demonstrates several weaknesses in our government's ability to detect and respond to fastmoving cyber events in a coordinated and efficient manner. I have been asking the questions for sometime now about

what happens when our borders disappear. What does it mean to function in a borderless economy? The Virus

illustrates that global boundaries are disappearing for commerce; oceans still separate one federal agency from another.

The "I Love You" virus should occasion a careful review of out national capabilities. It is important that these

weaknesses be addressed now in order to reduce future risks.
Opening Statement - Subcommittee Chairman Bennett

http://banking.senate.gov/00_05hrg/051800/bennett.htm[6/24/2009 3:56:11 PM]

With worldwide estimates ranging from $950 million to $15 billion for the "I Love You" virus, the concept, that these

viruses were less virulent than "those in the know" expected them to be, concerns me greatly. With this evidence

mounting, do we have a national capacity to provide early warnings of coordinated cyber-attacks and if so how well

does it work? What does this mean for the government and our economy as a whole?

The private sector seems to be beginning to do its job. Microsoft has announced that it will provide a patch to its

Microsoft Outlook 1998 program, which was the target of the "I Love You" virus, and its Office 2000 products. The

pendulum is beginning to swing the market in the direction of greater safety. Microsoft has recognized that it must

reassess the balance between the user-friendliness of its products and their security. Regrettably, due to a very

important scheduling conflict, no representative from Microsoft was able to join us today.

As was the case with the Year 2000 problem, the ultimate responsibility for security rests with the CEO of the

corporation. And make no mistake, particularly in the financial services industry, the customer will act quickly to

punish an institution that has lost his or her faith. While many companies see system security as an unproductive

investment, basic computer security drops straight down to the bottom line. The good news, however, is that the private

financial services ISAC (Information Sharing and Analysis Center) had the earliest US warning and analysis of the "I

Love You" virus. It is clear that the government can learn something from the private sector.

One of the most confounding facts about viruses is that in many countries no legal barriers exist to prohibit their

creation or release. In the case of the "I Love You" virus, the Philippine school which Onel de Guzman attended

reprimanded him for his thesis–calling it illegal–but, in fact, it was not illegal according to the local laws. There is a

void in the legal systems of many countries which leaves computer vandals free to go about their destructive business,

without fear of legal recourse. The Internet is a ripe target for these individuals because its very structure requires the

absence of barriers which normally limit criminal enterprise. As these young people see pictures of other hackers

splashed across the front pages of national newspapers it feeds a frenzy. Some of these hackers are elevated to cult

figure status; urban legends spring up around them and their deeds.

Until laws are created and enforced internationally which make computer vandals liable for their misdeeds, the only

absolute protection from their misdeeds is a pair of wire clippers and a resignation to living in another era.
Subcommittee on Financial Institutions

Oversight Hearing on the "I Love You" Computer Virus

and its Impact on U.S. Financial Services Industry 

10:00 a.m., Thursday, May 18, 2000 ­ Dirksen 538

Prepared Testimony of Mr. Jack Brock

Director of Government and Defense Information System

General Accounting Office

Mr. Chairman and Members of the Subcommittee: 

Thank you for inviting me to participate in today's hearing on the "ILOVEYOU" computer virus. Accompanying me today is Keith Rhodes, Director of GAO's Office of 

Computer and Technology Assessment. As you know, ILOVEYOU is the latest in a series of Internet­based episodes that have caused serious disruptions to computerbased operations at both private businesses and government agencies. While the federal government is working to implement mechanisms that would help agencies to 

ward off such an attack, it was not effective at detecting this virus early on and warning agencies about the imminent threat. Consequently, most agencies were affected. 

Some incurred damage to systems and files and many others spent countless staff­hours fending off the attack and reestablishing e­mail service. Overall, however, once 

they learned of the virus, agencies responded promptly and appropriately. 

In addition to discussing the virus, I would like to address its impact on federal agencies as well as measures that can be taken to mitigate the effects of future attacks, 

which promise to be increasingly sophisticated and damaging and harder to detect. 

THE ILOVEYOU WORM/VIRUS

ILOVEYOU is both a "virus" and "worm." Worms propagate themselves through networks; viruses destroy files and replicate themselves by manipulating files. The 

damage resulting from this particular hybrid­which includes overwhelmed e­mail systems and lost files­­is limited to users of the Microsoft Windows operating system. 

ILOVEYOU typically comes in the form of an e­mail message from someone the recipient knows with an attachment called LOVE­LETTER­FOR­YOU.TXT.VBS. The 

attachment is a Visual Basic Script (VBS) file. 1 As long as recipients do not run the attached file, their systems will not be affected and they need only to delete the e­mail 

and its attachment. When opened and allowed to run, however, ILOVEYOU attempts to send copies of itself using Microsoft Outlook (an electronic mail software 

program) to all entries in all of the recipient's address books. It attempts to infect the Internet Relay Chat (IRC) program 2 so that the next time a user starts "chatting" on 

the Internet, the worm can spread to everyone who connects to the chat server. It searches for picture, video, and music files and attempts to overwrite or replace them 

with a copy of itself. In addition, the worm/virus further attempts to install a password­stealing program that would become active when the recipient opened Internet 

Explorer 3 and rebooted the computer. However, Internet accounts set up to collect to stolen passwords were reportedly disabled early in the attack. 

The worm/viruses also appeared in different guises­­labeled as "Mother's Day," "Joke," "Very Funny," among others. These variants retriggered disruptions because they 

allowed the worm/virus to bypass filters set up earlier to block ILOVEYOU. At least 14 different versions of the virus have been identified, according to DOD's Joint 

Task Force­Computer Network Defense. One, with the subject header "VIRUS ALERT!!!", was reportedly even more dangerous than the original because it was also 

able to overwrite system files critical to computing functions. 

The difference between ILOVEYOU and other recent viruses, such as the Melissa virus, which surfaced about this time last year, is the speed at which it spread. Soon 

after initial reports of the worm/virus surfaced in Asia on May 4, ILOVEYOU proliferated rapidly throughout the rest of the world. By 6 p.m. the same day, Carnegie ­

Mellon's CERT Coordination Center 4 had received over 400 direct reports involving more than 420,000 Internet hosts. One reason ILOVEYOU multiplied much faster 

than Melissa was that it came during the work week, not the weekend. Moreover, ILOVEYOU sent itself to everyone on the recipient's e­mail lists, rather than just the 

first 50 addressees as Melissa did. The following two figures provide a more detailed overview of the timelines associated with the introduction of the virus and the 

subsequent discovery and notification actions taken by various entities. 

Figure 1: Highlights of Events Relating to the ILOVEYOU Virus

l The virus began proliferating during business hours in the Far East, while the U.S.­a 12­hour time difference away­was still sleeping. The virus spread with 

unprecedented speed through Asia and Europe. By the time it was 3:00 p.m. in Hong Kong, it was 9:00 a.m. in Western Europe and the impact of the virus was 

becoming evident. 

l Meanwhile, a private sector group, the Financial Services Information Sharing and Analysis Center (FS/ ISAC), had also discovered the virus and, at 

approximately 3 a.m. EDT, posted an alert to its members. 

l At 5:45 a.m. EDT, a representative from private industry notified the National Infrastructure Protection Center (NIPC), located at the Federal Bureau of 

Investigation, of the problem. 

l The Department of Defense Joint Task Force for Computer Network Defense (JTF­CND), which operates a 24­hour global operation center, was first alerted 

that the virus had hit DOD at 6:40 a.m. EDT by one of the military services. After about an hour of analysis to determine the nature of the virus, JTF­CND began to 
that the virus had hit DOD at 6:40 a.m. EDT by one of the military services. After about an hour of analysis to determine the nature of the virus, JTF­CND began to 

notify the various DOD components individually. 

l By 7:18 a.m. EDT, the Telecommunications Information Sharing and Analysis Center (T/ISAC) received a message that one of its major carriers was "taking 

severe actions to close its e­mail gateways" because of the ILOVEYOU virus. 

l At 7:45 a.m. EDT­2 hours after it was first notified of the virus­­the NIPC notified FedCIRC of the rapidly spreading virus, and FedCIRC began notifying senior 

agency officials via phone and fax. 

l At 11:00 a.m. EDT, the NIPC posted a short alert paragraph on its home page warning about the ILOVEYOU virus. At about the same time, the CERT 

Coordination Center sent an e­mail to the media stating that it had received over 150 reports of the virus. 

In addition to hitting most federal agencies­discussed later in my statement­­the worm/virus affected large corporations, such as AT&T, TWA, and Ford Motor 

Company; media outlets, such as the Washington Post, Dow Jones, ABC news; state governments; school systems; and credit unions, among many others, forcing them 

to take their networks off­line for hours. Internationally, the virus affected businesses, organizations, and governments, including the International Monetary Fund, the 

British Parliament, Belgium's banking system, and companies in the Baltics, Denmark, Italy, Germany, Norway, the Netherlands, Sweden, and Switzerland. 

The bottom line in terms of damage is still uncertain. Initial estimates of damage from the outbreak ranged from $100 million to over $10 billion globally. We do not have a 

basis for commenting on overall loss. While press reports are full of anecdotal accounts from disparate sectors of the economy, it is difficult to reliably and precisely 

estimate factors such as loss of productivity, lost opportunity costs, reductions in customer confidence, slow down of technical staff, and loss of information. Furthermore, 

as with most security incidents, companies impacted are not likely to fully disclose the true extent of their losses. 

DESPITE EFFORTS TO ENHANCE FEDERAL RESPONSE

TO COMPUTER ATTACKS, AGENCIES WERE NOT

EFFECTIVELY WARNED ABOUT ILOVEYOU

Recognizing the increasing computer­based risks to our nation's critical infrastructures, the federal government has taken steps over the past several years to create 

capabilities for effectively detecting, analyzing, and responding to cyber­based attacks. However, the events and responses spawned by ILOVEYOU demonstrate both 

the challenge of providing timely warnings against information based threats and the increasing need for the development of national warning capabilities. 

The National Infrastructure Protection Center (NIPC), located in the Federal Bureau of Investigation, is responsible for serving as the focal point in the federal government 

for gathering information on threats as well as facilitating and coordinating the federal government's response to incidents impacting key infrastructures. Presidential 

Decision Directive 63 (PDD 63) which was signed in May 1998, also specifically charged the NIPC with issuing attack warnings as well as alerts to increases in threat 

condition. This includes warnings to private sector entities. 

Developing the capability to provide early warning of imminent cyber­based threats is complex and challenging but absolutely essential to the assigned NIPC mission. Data 

on possible threats­­ranging from viruses, to hoaxes, to random threats, to news events, and computer intrusions­­must be continually collected and analyzed from a wide 

spectrum of globally distributed sources. Moreover, once an imminent threat is identified, appropriate warnings and response actions must be effectively coordinated 

among federal agencies, the private sector, state and local governments, and even other nations. It is important that this function be carried out as effectively, efficiently, 

and quickly as possible in order to ensure continuity of operations as well as minimize disruptions. 

To date, the NIPC has had some success in providing early warning about impending threats. For example, in December 1999, it posted warnings about a rash of denial ­

of­service attacks prominently on its website and it offered a tool that could be downloaded to scan for the presence of the denial­of­service code. Two months later, the 

attack arrived in full force, compromising the services of Yahoo, E­Bay, and other Internet companies. 

However, the NIPC had less success with the ILOVEYOU virus. As noted earlier (in figure 1), the NIPC first learned of the virus at 5:45 a.m. EDT from an industry 

source. Over the next 2 hours, the NIPC checked other sources in attempts to verify the initial information with limited success. According to NIPC officials, no 

information had been produced by intelligence, Defense, and law enforcement sources, and only one reference was located in open sources, such as Internet websites. 

The NIPC considers assessment of virus reports to be an important step before issuing an alert because most viruses turn out to be relatively harmless or are detected and 

defeated by existing anti­virus software. According to the NIPC, the commercial anti­virus community identifies about 20 to 30 new viruses every day, and more than 

53,000 named viruses have been identified to date. At 7:40 a.m., two Department of Defense sources notified the NIPC that the virus was spreading through the 

department's computer systems, and the NIPC immediately notified FedCIRC and CERT­CC. FedCIRC then undertook a rigorous effort to notify agency officials via fax 

and phone. 

For many agencies, this was too late. In fact, only 2 of the 20 agencies we spoke with reported that they first learned of the virus from FedCIRC. Twelve first found out 

from their own users; three from vendors; two from news reports; and one from colleagues in Europe. NIPC did not issue an alert about ILOVEYOU on its own web 

page until 11 a.m., May 4­hours after many federal agencies were reportedly hit. This notice was a brief advisory; the NIPC website did not offer advice on dealing with 

the virus until 10 p.m. that evening. 

For the most part, agencies themselves responded promptly and appropriately once they learned about the virus. In some cases, however, getting the word out was 

difficult. At DOD, for example, the lack of teleconferencing capability slowed the JTF­CND response because Defense components had to be called individually. At the 

Department of Commerce, cleanup and containment efforts were delayed because many of the technical support staff had not yet arrived at work when users began 

reporting the virus. The National Aeronautics and Space Administration (NASA) also had difficulty communicating warnings when e­mail services disappeared. And while 

backup communication mechanisms are in place, NASA officials told us that they are rarely tested. Justice officials similarly learned that the department needed better 

alternative methods for communicating when e­mail systems are down. Additionally, many agencies initially tried to filter out reception of the malicious "ILOVEYOU" 

messages. However, in doing so, some also filtered out e­mail alerts and communications regarding incident handling efforts that referred to the virus by name. 

Lastly, we found that the few federal components that either discovered or were alerted to the virus early did not effectively warn others. For example, Treasury told us 

that the U.S. Customs Service received an Air Force Computer Emergency Response Team (AFCERT) advisory early in the morning of May 4, but that Customs did not 

share this information with other Treasury Bureaus. 
IMPACT OF THE ILOVEYOU OUTBREAK

ON FEDERAL AGENCIES

The lack of more effective early warning clearly affected most federal agencies. Only 7 of the 20 agencies we contacted were spared widespread infection, and this was 

largely because they relied on e­mail software other than Microsoft Outlook. Of the remaining agencies, the primary impact was e­mail disruption, which, in turn, slowed 

some agency operations and required agencies to divert technical staff toward stemming the virus' spread and cleaning "infected" computers. Of course, if an agency's 

business depends on e­mail for decision­making and service delivery, then the virus/worm probably had a significant impact on day­to­day operations in terms of lost 

productivity. While most agencies experienced disruptions of e­mail service for a day or less, 8 agencies or agency components reported experiencing disruptions of 

longer than 1 day. 

I would like to offer some highlights of our discussions with officials at individual agencies since they further complete the picture of the response efforts and damage 

resulting from ILOVEYOU. 

l The Department of Health and Human Services (HHS) was inundated with about 3 million malicious messages. Departmental components experienced disruptions 

in e­mail service ranging from a few hours to as many as 6 days, and departmentwide e­mail communication capability was not fully restored until May 9. An HHS 

official observed that "if a biological outbreak had occurred simultaneously with this 'Love Bug' infestation, the health and stability of the Nation would have been 

compromised with the lack of computer network communication." 

l At the Department of Defense, enormous efforts were expended containing and recovering from this virus. Military personnel from across the Department were 

pulled from their primary responsibilities to assist. One DOD official noted that, if such an attack were to occur over a substantial amount of time, reservists would 

have to be called for additional support. Some DOD machines required complete software reloads to overcome the extent of the damage. 

l At least 1,000 files at the NASA were damaged. While some files were recovered from backup media, others were not. 

l At the Department of Labor, recovery required over 1,600 employee hours and over 1,200 contractor hours. 

l The Social Security Administration required 5 days to become fully functional and completely remove the virus from its systems. 

l The Department of Energy experienced a slowdown in external e­mail traffic, but suffered no disruption of mission critical systems. Ten to 20 percent of DOE's 

machines nationwide required active cleanup. 

l A vendor's 7:46 a.m. EDT warning to the Federal Emergency Management Agency enabled officials there to mitigate damage by restricting the packet size allowed 

through its firewalls until the necessary virus prevention software could be upgraded. 

l As of May 10, the Veterans Health Administration (VHA) had received 7,000,000 "ILOVEYOU" messages, compared to a total of 750,000 received during the 

Melissa virus episode. VHA spent about 240 man­hours to recover from the virus. 

l The Department of Justice estimated spending 80 regular labor hours and 18 overtime hours for clean­up. 

l Some of Treasury's components required manual distribution of updated virus signature files because automated means for rollout of software updates were not in 

place. 

l The Department of Agriculture could not obtain the updated antivirus product it needed until after 1:00 p.m., in part because it had to compete with all of the 

vendor's other customers worldwide to obtain the updates. 

l Effective user awareness programs were cited at the Department of Commerce, Treasury's Bureau of Public Debt, and the Department of Justice, where many 

infected messages were received but few were executed because users tended to be suspicious of unexpected and unusual e­mail messages and were not likely to 

open them. 

FURTHER ACTIONS REQUIRED

Mr. Chairman, in many respects the federal government has been lucky. Even though ILOVEYOU and Melissa were disruptive, key government services remained 

largely operational through the events. However, the potential for more catastrophic damage is significant. Official estimates show that over 100 countries already have or 

are developing computer attack capabilities. Hostile nations or terrorists could use cyber­based tools and techniques to disrupt military operations, communications 

networks, and other information systems or networks. The National Security Agency has acknowledged that potential adversaries are developing a body of knowledge 

about U.S. systems and about methods to attack these systems. According to Defense officials, these methods, which include sophisticated computer viruses and 

automated attack routines, allow adversaries to launch untraceable attacks from anywhere in the world. According to a leading security software designer, viruses in 

particular are becoming more dangerous to computer users. In 1993 only about 10 percent of known viruses were considered destructive, harming files and hard drives. 

But now about 35 percent are regarded as harmful. 

Such concerns highlight the need to improve the government's capacity and capability for responding to virus attacks. Clearly, more needs to be done to enhance the 

government's ability to collect, analyze, and distribute timely information that can be used by agencies to protect their critical information systems from possible attack. In 

the ILOVEYOU incident, NIPC and FedCIRC, despite their efforts, had only a limited impact on agencies being able to mitigate the attack. 

At the same time, agencies can also take actions that would improve their ability to combat future virus attacks. For example, they can act to increase user awareness and 

understanding regarding unusual and suspicious e­mail and other computer­related activities. In particular, agencies can teach computer users that e­mail attachments are 

not always what they seem and that they should be careful when opening them. Users should never open attachments whose filenames end in ".exe" unless they are sure 

they know what they are doing. Users should also know that they should never start a personal computer with an unscanned floppy disk or CD­ROM in the computer 

drive. 

Strengthening intrusion detection capabilities may also help. Clearly, it is difficult to sniff out a single virus attached to an e­mail coming in but if 100 e­mails with the same 
Strengthening intrusion detection capabilities may also help. Clearly, it is difficult to sniff out a single virus attached to an e­mail coming in but if 100 e­mails with the same 

configuration suddenly arrive, an alert should be sounded. Furthermore, agencies can clarify policies and procedures for reporting and responding to unusual events and 

conduct "dry runs" on these procedures. They can ensure that up­to­date virus detection software has been installed on their systems. They can establish effective 

alternative communication mechanisms to be used when e­mail systems are not operating properly. And they can participate in interagency efforts to prepare for and share 

information on cyber threats, such as those sponsored by FedCIRC. 

While such actions can go a long way toward helping agencies to ward off future viruses, they will not result in fully effective and lasting improvements unless they are 

supported by strong security programs on the part of individual agencies and effective governmentwide mechanisms and requirements. As noted in previous testimonies 

and reports, almost every federal agency has poor computer security. Federal agencies are not only at risk from computer virus attacks, but are also at serious risk of 

having their key systems and information assets compromised or damaged from both computer hackers as well as unauthorized insiders. 

We have recommended that agencies address these concerns by managing security risks on an entitywide basis through a cycle of risk management activities that include: 

l assessing risks and determining protection needs; 

l selecting and implementing cost­effective policies to meet those needs; 

l promoting awareness of policies and controls; 

l and implementing a program of routine tests and examinations for evaluating the effectiveness of these tools. 

At the governmentwide level, this involves conducting routine periodic independent audits of agency security programs; developing more prescriptive guidance regarding 

the level of protection that is appropriate for their systems; and strengthening central leadership and coordination of information security related activities across 

government. 

­­ ­­ ­­ ­­

Mr. Chairman, this concludes my statement. The ILOVEYOU virus attack will not be our last incident. Hopefully, it will provide an opportunity to examine our processes 

for developing threat assessments and providing warnings as well as an opportunity to examine our overall security posture. 

We performed our review between May 8 through May 17, 2000, in accordance with generally accepted government auditing standards. For information about this 

testimony, please contact Jack L. Brock, Jr., at (202) 512­6240. Jean Boltz, Cristina Chaplain, Nancy DeFrancesco, Mike Gilmore, Danielle Hollomon, Paul Nicholas, 

and Alicia Sommers made key contributions to this testimony. 

1 ­­ VBS is a subset of Microsoft's Visual Basic program language intended for use in World Wide Web browsers and certain other applications. 

2 ­­ A program that enables people connected anywhere on the Internet to join in live discussions. Unlike older chat systems, IRC is not limited to just two participants. 

The IRC client sends the participant's messages to and receives messages from an IRC server. The IRC server is responsible for making sure that all messages are 

broadcast to everyone participating in a discussion. 

3 ­­ Microsoft's World Wide Web browser. 

4 ­­ Originally called the Computer Emergency Response Team, the center was established in 1988 by the Defense Advanced Research Projects Agency. It is charged 

with establishing a capability to quickly and effectively coordinate communication among experts in order to limit the damage associated with and respond to incidents and 

to build awareness of security issues across the Internet community. 

Home | Menu | Links | Info | Chairman's Page
Testimony -- Baer

http://banking.senate.gov/00_05hrg/051800/baer.htm[6/24/2009 4:02:57 PM]

Subcommittee on Financial Institutions

Oversight Hearing on the "I Love You" Computer Virus

and its Impact on U.S. Financial Services Industry

10:00 a.m., Thursday, May 18, 2000 - Dirksen 538

STATEMENT OF TREASURY ASSISTANT SECRETARY GREGORY A. BAER 

Chairman Bennett, Ranking Member Bryan, and Members of the Subcommittee, I am pleased to have this opportunity

to discuss with you Treasury's efforts to protect the critical infrastructures of the nation's financial services sector. Mr.

Chairman, I had the pleasure of joining you in launching one part of this effort, the BITS Financial Services Security

Laboratory. We are grateful for the leadership you have shown both on this issue and on Y2K.

Secretary Summers and the rest of us at Treasury view protection of the financial services sector as important work. If

electronic commerce, and in particular electronic finance, are to thrive, then consumers must feel confident that their

financial information and delivery systems are secure. Information in the financial services industry is particularly

susceptible to risk. Thus, the stakes here are very high.

Today, I will first provide background information on Treasury's role in critical infrastructure protection (CIP) and, in

particular, our relationship to the information sharing and analysis center recently established by the financial services

industry. Second, I will discuss other Treasury efforts to prevent disruption of computer systems in the industry.

Finally, I will discuss how the center performed during the recent Love Bug virus attack, and what effect that attack

had on the financial services industry.

Treasury's Role in Critical Infrastructure Protection

The Administration has been focused on the threat to our information systems for some time. In 1996, the President

commissioned a blue ribbon Commission on Critical Infrastructure Protection, which released its final report in

October 1997. That report identified banking and finance, information and communications, energy, transportation,

water supply, emergency services, and government services as sectors of the nation's economy both critical to national

well being and increasingly dependent on computer and information systems.

In response to the perceived vulnerability of these critical infrastructures to cyber attacks, and in recognition of their

overwhelmingly private sector ownership, the Commission recommended a comprehensive program based on publicprivate partnerships and information sharing to protect all such critical infrastructures against cyber threats. The

Commission's report was reviewed by an National Security Council working group and was used as the foundation for

Presidential Decision Directive 63 (PDD 63), issued in May 1998. 1 PDD-63 established the framework and

responsibilities for implementing the Commission's recommendations.

The focus of the Directive was rightly on national security, and the emerging risk that our enemies may use the United

States' dependence on information technology as a weapon against us. Of course, we recognize that the primary

concern of financial services firms is on the higher probability, lower impact risks posed by disgruntled employees or

idle teenagers. Fortunately, though, what serves to protect against lower impact risks is also one component of what is

needed to defend against other risks.

PDD 63 directed each federal department and agency to reduce its own exposure to cyber threats, and directed
Testimony -- Baer

http://banking.senate.gov/00_05hrg/051800/baer.htm[6/24/2009 4:02:57 PM]

government to work in partnership with the private sector in order to protect critical private sector infrastructures. In

the latter respect, PDD 63 assigned Treasury as the "lead agency" responsible for working with the banking and

finance sector of the economy. I have been designated by Secretary Summers as the liaison to the private sector for

this purpose. My counterpart, Steve Katz, the Chief Information Security Officer at Citigroup, serves as the private

sector coordinator.

As a first step toward the private sector outreach mandated by PDD-63, former Secretary Rubin convened a Treasury

information security conference on October 7, 1998. Attendees included a large number of industry information

security officers and representatives of the financial regulatory agencies and others with a direct interest in critical

infrastructure protection. We hoped that such a conference would, at a minimum, allow the best minds in the financial

services sector to meet each other, share expertise, and continue to network.

Industry reaction to the conference was extremely favorable. Industry representatives at the October 7 conference

readily agreed that the goals of PDD 63 (such as information sharing, education and outreach, vulnerability

assessment, and research and development) were worth pursuing, and they agreed to create and support what is now

known as the Banking and Finance Sector Coordinating Committee on Critical Infrastructure Protection (the

Coordinating Committee), chaired by Sector Coordinator Katz. The industry representatives also established four

subgroups to address the issue areas they considered to be of highest priority: vulnerability assessment; research and

development; CEO outreach; and information sharing. This blueprint has defined the activities of Treasury and the

industry since 1998.

The second meeting of the Coordinating Committee, on March 11, 1999, was a "nuts-and-bolts" type of meeting that

established specific agendas for each of the working groups going forward. At that meeting, it was also decided that the

creation of an industry information sharing and analysis center was especially important, largely because of impending

Y2K concerns among government and industry leaders and other signs of an increase in cyber threats. The third

meeting, held on April 10, 2000, focused on assessing the vulnerability of the financial services sector to attack and on

research and development priorities.

Each of the working groups is at a different stage. The R&D Working Group is consulting government, academic, and

industry experts to develop priorities for government- and private sector-funded research. The Vulnerability

Assessment Working Group is reviewing a vulnerability analysis prepared for the President's Commission, and the

Congress has authorized funding for a follow-up report based on their analysis, which we hope will be appropriated.

The CEO council has worked with the Critical Infrastructure Assurance Office at the Commerce Department to help

raise awareness of these issues.

The Financial Services Information Sharing and Analysis Center (FS/ISAC)

As noted earlier, one of the most important goals of PDD 63 was government encouragement of private sector

information sharing and analysis centers (ISACs). These centers would be designed to encourage information sharing

about actual or potential cyber attacks, and distribute alerts about, and suggested remedies for, such attacks to their

respective industry sponsors, the actual owners and operators of the critical infrastructures.

Dealing with a computer virus or new type of attack is both a technological and an administrative problem. Just as

combating the annual flu virus involves isolating and identifying the strain, developing a vaccine, and inoculating

millions of people, so too does combating a computer virus involve determining the strain, developing a fix (patch or

screen), notifying users of the need to protect themselves and delivering the fix. In the case of computer viruses, the

administrative problems can be a daunting task since it can involve large numbers of servers and stations.

For this reason, we believed from the outset that an information sharing center was an area where Treasury could add

value. The financial services sector already represents the state of the art in information technology. The sector spends

considerable resources, employs talented people, and retains respected consultants. Financial services firms, perhaps

more than non-financial services firms, have strong reputational, financial, and competitive incentives to safeguard

their information assets.

The incentives for competing financial services firms to share information, however, are not as strong. The first instinct
Testimony -- Baer

http://banking.senate.gov/00_05hrg/051800/baer.htm[6/24/2009 4:02:57 PM]

of a company under a debilitating attack is not to highlight its problems to the public and help its competitors avoid

the same fate. Thus, we believe that this area is one where government could profitably act as a facilitator.

The financial services industry was among the first to respond to PDD 63's call for the establishment of an ISAC. After

an arduous period of technical, legal, and organizational negotiations, approximately a dozen major financial services

firms and industry utilities established the Financial Services Information Sharing and Analysis Center - what they call

the FS/ISAC. Its official opening was announced by Treasury Secretary Summers on October 1, 1999, with the

participation of Chairman Arthur Levitt of the Securities and Exchange Commission, Vice Chairman Roger Ferguson

of the Federal Reserve Board, and Richard Clarke of the National Security Council and the new FS/ISAC Board

members.

Let me emphasize at the outset that the members of the Center and Treasury view this entity as an important

experiment, but still just an experiment. There will be other ways for firms to share or gather information: CarnegieMellon's Computer Emergency Response Team (CERT) (funded partly by the U.S. Government) currently performs a

valuable service in identifying and warning of threats to information security. The NIPC provides an important watch

and warning function and works closely with GSA's Federal Computer Incident Response Capability (FedCIRC) and

Carnegie-Mellon's Computer Emergency Response Team (CERT). The anti-virus firms themselves operate centers to

learn of new threats, develop fixes, and sell patches. Consulting firms now frequently offer a myriad of information

security services. I think it is too soon to know which of these efforts will succeed. It may be that some will eventually

be linked. But we thought that a sector-based, financial services center deserved a try.

It is important to understand what the Center is.

The FS/ISAC is most easily understood as a mechanism for developing and sharing a secure database of

information on cyber threats, incidents, vulnerabilities, resolutions and solutions. This information can be shared

in a voluntary authenticated and anonymous manner, so that member institutions can participate without taking

on reputational risk. The members were quite insistent on this point. Indeed, a majority of the members wish to

have even their membership kept confidential.

The Center is a limited liability company owned by its current 22 members, who include the largest banks,

securities firms, insurance companies, and investment companies in the country. Together, they hold nearly 22

percent of total U.S. financial assets, excluding the monetary authority. The Center is not in any way funded or

governed by the Treasury Department or any other governmental agency. My staff and I participate in board

meetings solely as observers.

Information comes into the Center either from its participating members or from the vendor that operates the

Center. Information contributed to the Center can come from publicly available sources, government sources

(local, state, and federal), members submitting anonymously, members submitting in an attributable manner, and

others. Importantly, no customer account information is shared. No one at Treasury or any other agency sees the

input or output of the Center since it is the property of the FS/ISAC membership.

We are hoping, however, to facilitate the sharing of information directly from the government to the Center, and

eventually from the Center to the government. The Center and the Pentagon's Joint Task Force/Computer

Network Defense, representing United States Space Command, are currently discussing an information exchange

agreement, and we hope that some information from Pentagon CERTs will flow to the Center. Once a trusted

relationship is established, we hope that sharing at the appropriate and approved levels will be reciprocal.

It is important that the Center be viewed as a sort of Internet start-up - albeit one that thus far has assets exceeding its

liabilities. It has been in full operation for fewer than eight months. Like other Internet start-ups, its success or failure

will hinge largely on its ability to scale up. The Center becomes more valuable as more members join and share

information.

That said, we believe that the FS/ISAC and other efforts to enhance the safety of electronic systems deserve the

attention of firms of all sizes. With respect to the FS/ISAC, small- and medium-sized firms would pay a $13,000

annual fee - small in comparison to almost any firm's security budget - and in return receive not only information
Testimony -- Baer

http://banking.senate.gov/00_05hrg/051800/baer.htm[6/24/2009 4:02:57 PM]

about nascent threats and warnings of particular incidents, but they can also call the Center's analysts at any time to

answer questions. This latter option may mean less to large firms with in-house expertise and extensive contacts with

vendors, but it should be especially valuable to smaller firms.

I want to emphasize that participation in the Center does not absolve any financial institution of its obligation to report

criminal activity. Indeed, the Treasury's Financial Crimes Enforcement Network (FinCEN) and the five federal bank

regulatory agencies (the Federal Reserve Board, the Office of the Comptroller of the Currency, the Federal Deposit

Insurance Corporation, the Office of Thrift Supervision and the National Credit Union Administration) have recently

revised their suspicious activity report for banking institutions with respect to computer activity. The new form will be

published on June 19th. The revised form includes an additional check box specifically for suspicious activity

involving computer intrusions. The new box should be used by banking institutions reporting suspicious activity when

access is gained to a computer system to:

Remove, steal, procure, or otherwise affect funds of the institution or its customers;

Remove, steal, procure, or otherwise affect critical information of the institution, including customer

information;

Damage, disable or otherwise affect critical systems of the institution.

The instructions to the revised form were carefully drafted to avoid imposing undue burdens on the banking industry,

which includes the only private sector firms under an obligation to report computer intrusions on this form. Thus,

under instructions to the form, computer intrusions do not include attempted intrusions of websites or other noncritical information systems of the institutions that provide no access to institution or customer financial or other

critical information.

Other Treasury Efforts to Prevent Disruptions of Computer Systems

Regulators have increasingly recognized that protecting the information assets of a financial institution is a crucial part

of safety and soundness. Thus, on May 16, the OCC issued updated guidance to national banks on how to prevent,

detect and respond to intrusions into their computer systems. The guidance supplements an OCC bulletin on cyberterrorism published last year and an alert on distributed denial of service attacks issued in February.

The updated guidance discusses controls that can be employed to prevent and detect intrusions, ranging from basic

security procedures, such as employee and contractor background checks, to technology-based tools, such as data

encryption and real-time intrusion detection software. The bulletin encourages national banks to perform intrusion risk

assessments, implement controls, establish intrusion response policies and procedures, and perform periodic testing.

The updated guidance also reminds national banks to report intrusions and other computer crimes to law enforcement

authorities and regulators by filing Suspicious Activity Reports. The bulletin provides guidance for gathering and

handling information on intrusions, and highlights three organizations that are primarily involved with the Federal

government's national information security initiatives: Carnegie Mellon University's CERT, the FS/ISAC, and the

FBI's NIPC.

Similarly, OTS has taken several specific actions to encourage thrift institutions to be proactive in addressing potential

security threats. Starting in October 1997, OTS issued detailed guidance to the thrift industry and its examiners in a

revised examination handbook section, which is continually updated as technology evolves.

In November 1998, OTS issued its electronic operations rule that is designed to facilitate safe, sound, and prudent

innovation in the use of emerging technologies. The rule requires management to identify, assess, and mitigate

potential risks, implement a strong system of internal controls, and monitor and update security procedures to keep

pace with changing industry standards.

OTS has also issued numerous policies and guidance that address information and technology security issues. These

include CEO memoranda concerning procedures for recovering information systems that may be damaged by
Testimony -- Baer

http://banking.senate.gov/00_05hrg/051800/baer.htm[6/24/2009 4:02:57 PM]

malicious activity; defining lines of responsibility to respond and report suspicious activity to appropriate law

enforcement authorities; training staff on information security precautions; and seeking out assistance from information

security organizations when appropriate.

The "Love Bug" Virus

On May 4, the Visual Basic Script (vbs) Love Letter worm - what some call the Love Bug computer virus - swept into

the United States through innumerable electronic mail messages.

Reports indicate that activity related to the Love Letter worm has now subsided, including activity resulting from

variations of that worm, such as "Very Funny.vbs" and "mothersday.vbs." However, there is no systematic reporting of

the effects of viruses or worms for any industry, including the financial services industry. Instead, we have anecdotal

reports from the bank regulators and individual institutions, from which it does not appear that this worm disrupted

any of the core functions of the financial services industry - for example, the payments system or any of the major

clearinghouses or exchanges. It did, however, cause substantial disruption to the e-mail servers of some financial

services firms, requiring them to shut down those servers for hours or even days. In the coming weeks, we will seek to

learn more about the effects of the Love Bug, and how information about it flowed through the industry.

As we understand it now, the first accounts of the Love Bug came into U.S. firms early on the morning of May 4th.

Those firms with Asian or European offices heard first, some as early as 3:00-4:00 a.m., as their overseas affiliates

reported trouble. Even for those who got early warning, however, the only immediate option was to warn employees

not to open certain e-mails and to stop all e-mail communications.

The distributed denial of service (DDOS) threat was the first major test for the FS/ISAC, which was successful in

terms of sharing critical information. The Love Bug was the second major test for the FS/ISAC and exposed some

flaws in its present operating procedures. Only a few firms reported the incident - either because they were too busy

resolving their own problems or because they assumed everyone was aware of the problem. Although the Center's

operator posted a threat notice early on the morning of the 4th, the paging system used to alert the members to an

urgent threat did not reach all the member contacts. The Center determined from this experience that it needs to

implement alternate notification procedures (e.g., a conventional telephone-line, fax-based notification system for

those times when e-mail or other Internet services are not working). We expect that the system will be better for these

reforms, and will induce even greater vigilance by the financial services industry.

Conclusion

Mr. Chairman, thank you for asking me to appear here today. I will be pleased to answer any questions you or

Members of the Subcommittee may have.

1 -- The Directive and the Commission report are both available on the Internet, at http//www.ciao.ncr.gov.

Home | Menu | Links | Info | Chairman's Page
Testimony -- Malphrus

http://banking.senate.gov/00_05hrg/051800/malphrus.htm[6/24/2009 4:03:37 PM]

Subcommittee on Financial Institutions

Oversight Hearing on the "I Love You" Computer Virus

and its Impact on U.S. Financial Services Industry

10:00 a.m., Thursday, May 18, 2000 - Dirksen 538

Statement of Stephen R. Malphrus 

Staff Director for Management 

Board of Governors of the Federal Reserve System 

Chairman Bennett and Members of the Subcommittee, I am pleased to have this opportunity to participate in today's

panel on our recent experience with the so-called "I love you," or "Love Bug," computer virus. First, Mr. Chairman, I

had the pleasure of working with you when I served as Chair of the Financial Sector Group of the President's Council

on Year 2000 Conversion. I am grateful for the leadership and support you provided to the work of the Financial Sector

Group and the President's Council. Clearly the public-private sector partnership you helped forge was key to our

nation's successful conversion to the new century.

As you know, the Love Bug virus was launched from the Far East, and it attacked computers around the world running

Microsoft Outlook for Windows. To review what we know, the Love Bug virus, or in the taxonomy of computer

science, the "worm," entered computers through e-mail messages. Once a message was opened, the virus was able to

reproduce itself by finding address lists stored by the computer's owner and then sending itself to the addressees. If an

addressee opened the attachment, a similar replication occurred, enabling the virus to spread rapidly. We understand

that the virus was designed to steal Internet passwords. The virus was able to modify operating system files as well as

certain sound and picture files residing in the infected computers. It had the effect of degrading network performance

by inundating e-mail server systems and some web pages. Variants of the virus in some cases had a major impact on

the data and program files of some computer networks, although we did not experience that in the Federal Reserve.

Like many organizations, the Federal Reserve System received hundreds of Love Bug e-mail messages. However, the

virus had no impact on our critical business functions or information systems. Indeed, the delivery of key financial and

central bank services by the Federal Reserve was unaffected. In the weeks following May 4, we contacted industry

trade organizations as well as a number of the institutions we supervise, and they reported the virus did not impair

critical retail or wholesale banking services. Indeed with the help of various public- and private-sector informationsharing programs, the virus was quickly detected, isolated, and immunized through a variety of standard operating

procedures that have been implemented by the Federal Reserve and financial institutions.

May 4 Love Bug Attacks

Because the virus started in the Far East, it was identified before most U.S. public and private institutions opened for

business. The Federal Reserve became aware of the virus on the morning of Thursday, May 4, through reports from

Microsoft. By approximately 8:30 a.m., major news wire services also contained fairly accurate details about how to

identify the virus, although the type of damage inflicted on computer hardware and files and the manner in which the

virus spread were still unclear. Throughout the day, we also received reports from the FBI's National Infrastructure

Protection Center (NIPC),1 from InfraGard, 2and from anti-virus software vendors.
Testimony -- Malphrus

http://banking.senate.gov/00_05hrg/051800/malphrus.htm[6/24/2009 4:03:37 PM]

Financial institutions that have foreign offices, particularly those with operations in Asia, had the earliest warning and

were able to take steps to inform employees worldwide and to shield their e-mail systems, in many cases before

opening for business. As a precaution, many institutions shut down external, and in some instances internal, e-mail

systems. These institutions also quickly alerted industry trade organizations and business partners about what they

knew of the virus. The global nature of commerce helped many financial institutions learn about the virus before many

of the monitoring services issued an alert.

At the Federal Reserve, we immediately began to implement our standard virus incident response procedures. The fact

that our employees were already trained to recognize and report suspicious e-mail messages, such as those that

typically are virus carriers, was a tremendous asset in limiting the spread of the virus internally - only a handful of

messages were opened. As a preventive measure, at about 9:30 a.m., we shut down our e-mail systems to incoming

mail from the Internet, and subsequently through our intranet, until we received and installed an anti-virus patch, or

antidote, from our software vendors. (An antidote cannot be produced until the particular virus is analyzed, and

systems are at risk until an antidote is installed.)

In accordance with Federal Reserve System policy, line management responsible for information security convened

Systemwide conference calls to discuss the virus and to coordinate actions to contain it. During the day, the CERT3

and other virus-response centers provided information about how the virus spread and measures to contain the virus.

We began installing anti-virus patches in the afternoon, and as an example, the Board of Governors re-opened its email systems to outside mail by 5:00 p.m. Financial institutions reported they were able to reopen e-mail systems at

various times during the day, and most e-mail systems were open by the beginning of business the following morning.

Federal Reserve's Procedures for Responding to Viruses and Other Malicious Attacks on Our Information

Systems

When the Love Bug struck, the Federal Reserve had state-of-the-art procedures and controls in place for responding to

and managing cyber-related incidents including computer viruses. The procedures were effective in managing this

incident and limiting the spread of the Love Bug virus.

In addition to training our employees in how to identify and deal with suspicious messages, the Federal Reserve has

implemented several layers of security protections. These include incident response teams, virus-detection software

that screens e-mail messages and mailboxes for viruses, and, on some systems, we are operating "integrity checking

tools" that detect changes in operating systems and software. We have an ongoing communications program with

senior executives regarding the operational risks associated with information systems. Effective lines of

communication are also in place linking IT professionals across the Federal Reserve System to each other and with our

vendors and organizations, such as the FBI and CERT.

Impact of Love Bug Virus on Federal Reserve and Financial Institutions

Other than impeding office communications and diminishing productivity because of the temporary halt in receiving

and sending e-mail messages, the virus had minimal impact on the Federal Reserve's business operations and no

impact on our critical financial and central bank services. Our electronic payment services are protected from e-mail

viruses because they do not operate on the automation systems that support our Internet and electronic mail services.

Our payment systems operate on proprietary software systems and use a closed network rather than the public Internet.

Fedwire - our large-value funds transfer application - and our other key payment systems are accessible only through

dedicated devices and require specific hardware, software, and communications facilities to process transactions.

Moreover, all of these communication systems are fully encrypted. If for some reason the Love Bug virus was able to

operate on a device linked to one of our payment system applications, the device might, at worst, be temporarily

disabled. An infected terminal, however, could be recovered by using contingency procedures.

The Federal Reserve did experience some negative effects from the Love Bug attack. While our e-mail systems were

disconnected, we used fax machines and telephones to complete routine communications. This proved to be

inconvenient for some employees. In addition, our Information Technology staff had to devote time to communicating

with employees and business partners about appropriate screening and containment measures and to perform work to
Testimony -- Malphrus

http://banking.senate.gov/00_05hrg/051800/malphrus.htm[6/24/2009 4:03:37 PM]

apply software patches to immunize our e-mail systems and recover machines that had been infected by the virus. In

short, a virus of this nature can be disruptive to an organization's electronic communications and knowledge-sharing

activities.

The financial institutions we supervise reported a similar experience. Word about the virus spread almost as quickly

around the globe as did the virus, and companies were able to alert employees and to shield e-mail systems early in

the business day. Even when e-mail systems became infected, the virus was not able to spread to critical banking

systems. Financial institutions conducted business as usual, and ATMs and other retail and wholesale payment and

settlement systems were unaffected.

Although there were some minor disruptions in commerce, we have not identified any measurable effect on the

economy - in large part because commercial transactions are not generally conducted using e-mail-based information

systems. Various news services have estimated the cost of the virus - in terms of lowered productivity and labor costs

to manage the virus and recover from damage - in the range of $5 billion to $15 billion worldwide. At this time,

however, we view those numbers as "guestimates." 4

Lessons Learned

Although the Federal Reserve's detection and response procedures were adequate and worked well, we see the incident

as an opportunity to identify lessons learned so that we can continue to improve our virus response processes. Our

information-security program is based on a process of continuous improvement and a post incident review is standard

practice in the Federal Reserve. We want to ensure that we operate in the most secure environment possible and that

we are prepared to respond to cyber-related incidents in a consistent, coordinated manner.

With respect to the financial institutions we supervise, the Federal Reserve is integrating our information technology

examination program into safety and soundness assessments to ensure the inherent business risks created by

technology are properly managed. One benefit of Y2K is that senior executives and board of directors of financial

institutions have a better understanding of the linkage between operations risk and credit, market, liquidity,

reputational, legal, and other forms of risk. This will serve the industry well in addressing new operational risks posed

by rogue software, such as viruses.

In addition, we are committed to participating in initiatives that promote information-system security and that assist in

the rapid identification and analysis of new viruses and other forms of cyber attacks. The Federal Reserve is an active

participant in numerous public- and private-sector activities to protect the critical infrastructure. For example, we

receive information from the NIPC and we will also be participating in the financial services information sharing and

assessment center. We also plan to work more closely with our anti-virus software vendors to convey the urgency of

producing antidotes to new viruses in an even more timely manner.

Our financial institutions report a renewed commitment to training, particularly institutions in which virus-screening

capabilities are somewhat limited because of lessor reliance on e-mail systems. Moreover, to avoid having to shut

down e-mail systems even briefly, some larger institutions plan to investigate more robust filters that can be deployed

in the period following the spread of a virus and before their anti-virus software vendors produce an antidote patch. As

a result of the Love Bug virus, there is an increased awareness in the financial sector that today's most commonly used

desktop products (web browsers, e-mail, and the like) are generally not designed to resist future virus strains. Financial

institutions also believe that the software industry needs to take additional steps to ensure that their products are

appropriately secure. It is essential that desktop products used to support critical business functions are secure and

engender confidence in their use. In the future, we anticipate that desktop products will increasingly be employed to

deliver retail financial services over the Internet.

Conclusion

Computer viruses and other malicious attacks by software hackers present an ongoing threat. Although the Love Bug

virus was limited in the damage that it caused, future viruses may be more difficult to contain. Because viruses put us

into a defensive mode, good information security processes and controls are critical - and those employed by the
Testimony -- Malphrus

http://banking.senate.gov/00_05hrg/051800/malphrus.htm[6/24/2009 4:03:37 PM]

Federal Reserve were effective in detecting and responding to the Love Bug virus.

In my opinion, if electronic commerce is to flourish, there must be a high degree of confidence by all parties to

transactions that the systems and networks are as secure as possible. There is a need to focus on measures that can be

implemented to contain viruses while antidotes are being developed. These include measures to share information

more effectively, to analyze new viruses quickly, to distribute fixes more efficiently, and to recognize new, innovative

viruses as they occur. Finally, public- and private-sector information-security initiatives, including early warning,

analysis, information on, and containment, should be supported and broadened.

Up to this point, much of the focus on new threats to computer systems has focused on national security and criminal

aspects of the problem. From my perspective, the discussion should be expanded to include the broader risks presented

by the growth of electronic commerce. One of the reasons our nation's Year 2000 efforts were so successful was that

leaders in the public and private sectors recognized that technology issues presented significant business risks and they

worked together to meet the challenge. The work of the Department of the Treasury in supporting the goals of

Presidential Decision Directive 63 is a good step in helping the financial sector to address new forms of operations risk.

Finally, in my view, the model implemented to address Y2K could be helpful in strengthening programs to address the

risks to the public infrastructure on which the financial services industry relies: telecommunications, power, water,

transportation, and public safety.

Mr. Chairman, this concludes my statement, and thank you for asking me to appear today. I would be happy to answer

any questions you or Members of the subcommittee may have.

1 -- ANSIR (Awareness of National Security Issues and Response) is the NIPC center that provides automated,

unclassified advisory, alert, and warning information concerning physical and cyber threats to private-sector security

professionals.

2 -- InfraGard is an FBI initiative to provide a private- and public-sector information-sharing mechanism in support of

critical infrastructure protection. The FBI plans to open InfraGard chapters in all fifty-six FBI field districts.

3 -- The CERT (Computer Emergency Response Team) coordination center was chartered in 1988 by the U.S.

Department of Defense to work with the Internet community to respond to computer security problems, raise

awareness of computer security issues, and prevent security breaches. CERT/CC is part of the Networked Systems

Survivability Program in the Software Engineering Institute, a federally funded research and development center at

Carnegie Mellon University.

4 -- See, for example, APBnews.com, "The Bug that Ate $10 Billion" (May 8, 2000); Kathleen Ohlson, Computer

World, " 'Love' Virus Costs Approaching $7 Billion" (May 9, 2000); Jesse J. Holland, Associated Press writer,

"Computer Virus Hits Fed Agencies" (May 11, 2000).

Home | Menu | Links | Info | Chairman's Page
Testimony -- Adams

http://banking.senate.gov/00_05hrg/051800/adams.htm[6/24/2009 4:03:54 PM]

Subcommittee on Financial Institutions

Oversight Hearing on the "I Love You" Computer Virus

and its Impact on U.S. Financial Services Industry

10:00 a.m., Thursday, May 18, 2000 - Dirksen 538

Prepared Testimony of Mr. James Adams

CEO

iDefense

Introduction

Chairman Bennett, members of the committee, good afternoon and thank you for including me on this distinguished

panel. I consider it an honor to share with you today my perspective on the LoveLetter experience and steps necessary

to proactively defend our nation's critical infrastructure from future cyber attack.

By way of brief background, my name is James Adams, and I am the CEO of Infrastructure Defense (iDEFENSE).

Founded in 1998, iDEFENSE provides intelligence-driven products, daily reports, consulting, and certification that

allow clients to mitigate or avoid computer network, Internet and information asset attacks before they occur. As an

example, iDEFENSE reported on the LoveLetter virus to its clients and provided countermeasures to mitigate the

damage from this virus as it quickly spread and evolved. I will comment more extensively on iDEFENSE's approach to

this virus in a moment.

Before I do so, I want to commend Chairman Bennett, and the committee, for its leadership and diligence on moving

the federal government forward on the Y2K issue and its potentially lethal electronic threats. As proven with the Y2K

experience, this committee has recognized the vital importance of computer security to the health of the nation, and it

continues to take a lead role in raising the right issues at the right time.

Double-Edged World

As a nation, and as a global community, we have been awed by the recent evolution of information technology. For

the first time in recorded history, we have a truly interactive media in the hands of the Everyman, and there pervades

an air of international exuberance that we have the ability to interact with persons of virtually any age, station, and

location at the touch of a button. And this exuberance is not unfounded we are truly in the midst of a Revolution one

that connects more and more of our global neighbors with each passing day, facilitating collaborations both academic

and economic that have and will change the way we live.

However, as with any great power, there comes a dark side and a grave responsibility. As we connect more and more

of the global community it is our duty to warn them of the risks involved. As Americans, we have approached the

Internet as we have so many challenging new frontiers: as we put down our roots, we have set about the business of

doing business. In so doing, we have raised the stakes exponentially: the Internet is no longer a place dedicated solely

to the exchange of ideas, but the exchange of currency and vital, proprietary information.

LoveLetter: A Review

Late in the afternoon of May 4, the LoveLetter virus was discovered in Hong Kong. In its wake, we stand reminded of
Testimony -- Adams

http://banking.senate.gov/00_05hrg/051800/adams.htm[6/24/2009 4:03:54 PM]

how much damage the dedicated minority can inflict on us all. Following closely last February's distributed denial of

service attacks; the LoveLetter virus is a clear sign that our current approach to dealing with the growing cyber threat

is simply inadequate. In fact, it is quite dangerous and irresponsible. We must do better if the current revolution is to

remain a positive influence on the global community.

Two important points regarding LoveLetter: One, it spreads primarily through technologies and vulnerabilities that

have been known within the industry for over a year, and that have been proven in several relatively prolific viruses.

Two, LoveLetter is not self-actuating - it can only be activated and passed to another computer if a recipient

consciously activates it. The inescapable conclusion is that the LoveLetter virus exploited human elements and lack of

user awareness as much or even more so than technology.

Had the general populace been taught to instinctively verify the source and content of email attachments, the virus

might never have reached such epidemic proportions. Had the average user been shown a few minor adjustments to the

configurations of their computers, the doors through which the virus entered could have been closed against it. Does

this impute to everyone from whose computer the virus propagated some responsibility for the damage that it caused?

To some extent, yes, it does, but to a greater extent, the fault lies in our consistently reactive approach to information

security.

As the CEO of iDEFENSE, I am privy to all of our ongoing operations, and I would offer some of our experiences and

procedures as further illustration of what I mean when I talk of a reactive approach. Since last year, our Intelligence

team worked closely with our computer scientists to pinpoint several viruses that appear to have been integrated into

the LoveLetter virus. When these earlier viruses were discovered, their less destructive payloads and less intrusive

propagation made them a low priority. In fact, many experts paid them very little attention. Not at iDEFENSE. In

addition to the timely intelligence regarding these virus's possible damaging effects, our clients also received careful

instruction as to how to secure their systems against such intrusions, whatever their purpose or origin. So, in the case

of the LoveLetter, persons who had implemented these countermeasures were not vulnerable to its damaging effects.

LoveLetter: Lessons Learned

There are at least four lessons to be learned here. The first, and potentially most troubling for managers of the growing

cyber threat, is that in this new world, there is no such thing as a minor threat. Earlier viruses in the LoveLetter virus

strain appear, in hindsight, to be much more than the harmless exercises of a bored hacker - they look very much like

proofs of concepts. They look like tests. Writers of malicious computer programs, it would seem, are strikingly similar

to any other engineer: they build a product, and then find it necessary to test that product on a suitable target.

A specific example, earlier this year a group of Internet-based activists noted for building their own cyber attack tools

went searching for a test target. After building a tool specifically for an upcoming attack, they unleashed it at what

amounted to a very low power setting on a government Web site chosen for its lack of defenses and monitoring. Had

our Intelligence analysts not discovered their plans, the test might never have been discovered. As it turned out, the

test was monitored not only by the attackers, but by the owners of the test site and iDEFENSE as well. Without

alerting the attackers to our presence, we were able to notify the tool's eventual target and help thwart the attack for

which it was built. Had the components of the LoveLetter virus been pursued with the tenacity with which we now

pursue the author of the LoveLetter virus itself, we might have been able to prevent much of the damage it caused.

The second lesson to be learned from our experience is the value of a central point of contact. Our clients are able to

react immediately to threats because they have no opinions to poll or conflicting advice to sort - they depend solely on

iDEFENSE for their intelligence. When our clients hear from us, they can act immediately. As most experts will freely

tell you, response time can make or break an organization in the face of a cyber threat.

This will become even more imperative as cyber threats evolve - we have already seen several viruses circulating in

the wild that are self-actuating: they require no user interaction whatsoever to infect a computer. Simply receiving

these viruses in an email can result in infection. While they have not yet carried any destructive payloads, the

astounding speed with which the LoveLetter virus was altered and re-released into the wild is more than enough

warning that it can only be a matter of time before they do. When this happens, information security professionals will
Testimony -- Adams

http://banking.senate.gov/00_05hrg/051800/adams.htm[6/24/2009 4:03:54 PM]

need immediate warnings of their existence and how to defend against them, or the results could be devastating.

The viruses of the future will not only be self-actuating, but they will travel on a whole new generation of hardware.

As those of you who are exposed to television with any regularity will already know, several vendors are now offering

Internet access via cellular telephones and even Personal Digital Assistants, such as the Palm Pilot. These new devices

are too new to be included in most security architectures, and the protocols on which they function are in many cases

rushed to market before they can be comprehensively evaluated.

There are already confirmed reports of automated attack tools with the capability to flood cellular networks, resulting

in a denial of cellular service. Suddenly, a workforce that maintains communication via any cellular devices could be

completely cut off. Theoretically, cellular-based Web communications could even be intercepted, altered, and then

sent on to their intended recipient. Suddenly, the prospect of trading stocks online via your cellular telephone takes on

a terrifying new light.

The third lesson to be learned is that as a global community, we face a constantly expanding enemy. While it is widely

known that established nations like Russia, China and even France are actively building their cyber attack capabilities,

the LoveLetter appears to have originated in the Philippines. Similarly, Serbia, Pakistan, and Taiwan have all

demonstrated significant hacker capabilities in recent months. These are all areas that boast significant concentrations

of relatively disenfranchised persons who have obviously turned to the Internet as a forum for their agendas. Where

during the Cold War there might have sprung up an armed insurrection, we now see cyber attacks carried out by

increasingly organized and technologically savvy militants. Even more dangerous, while most conventional terrorists

are intimately familiar with the capabilities of their assault rifles and pipe bombs, those responsible for viruses like the

LoveLetter may never have any idea of the full extent of the damages they unleash.

Finally, it is quite clear that cyberspace is the new frontier of war and that conflict in the virtual space is a reality. The

creator of the LoveLetter virus was an individual and not a nation state yet the power of the weapon that was created

was enormous. Following the sun, in the course of a single day the virus caused chaos in the public and private sectors

worldwide. A current CIA estimate suggests that the cost of the virus worldwide was $1 billion. Others suggest that

may have been the cost to the United States alone. A powerful weapon indeed.

The Way Out: Intelligence and Information Sharing

All three of these lessons point to a single conclusion: the only defenses we have against the hyper-evolving cyber

threat are intelligence and an established and effective procedure for its dissemination.

There is much in common between government and industry when it comes to the challenges - and the pportunities -

which the Information Revolution poses. Both sectors face common threats ranging from vandal hackers and hardened

criminals to foreign agents and natural disasters. Both sectors share common goals for the well being of America and

her people. Both employ technologies that are essentially identical. And both must work together to protect each other.

With common problems and common goals, there are opportunities for common solutions. One of the most important,

I believe - one that is too new to have been embraced by either the private or public sector - is the need for every

organization to incorporate a risk-mitigation process. A second priority is to build a comprehensive information sharing

system across all sectors on cyber threats and countermeasures. We cannot afford to allow important information to

grow stagnant within particular public or private entities. The rapid pace of technological change necessitates a

correspondingly robust response mechanism.

In conjunction with this private-public effort, it is vital that we empower a person or an entity to coordinate a

collective response to the growing cyber threat. This entity will draw on skill sets in many areas overlapping that of the

CIO, CFO, CSO, and most other officers or entities. I call this entity the Office of Business Assurance and its task

would be to continuously gather and synthesize infrastructure-related trends and events, to intelligently evaluate the

technological context within which the organization operates, to identify and assess potential threats, and then to

suggest defense action. Or, viewed from the positive side, to assess the technological revolution's opportunities and

propose effective offensive strategies. Most importantly, the OBA would be a proactive measure: it would endeavor as

much to prevent attacks as to defend against them or mitigate the damages resulting therefrom.
Testimony -- Adams

http://banking.senate.gov/00_05hrg/051800/adams.htm[6/24/2009 4:03:54 PM]

Defending our nation's infrastructure is as important as managing Health and Social Security, the Environment or

foreign affairs. In the virtual world, if we are not adequately protected, everything fails - and that includes many of the

government departments that were damaged by the LoveLetter virus. It is logical then that the Office of Business

Assurance is run by a government official with Cabinet level status who can cut across that stagnant bureaucracy and

drag it kicking and screaming into the 21st century. The nation deserves no less.

The one thing that has remained constant over our nation's history is the American pioneering spirit. However many

years ago, most of our ancestors left the safety of the known for the promise of opportunity in this, the New World. So

now we too enter a New World, and with it a host of new challenges, opportunities, and risks. I urge you now to come

together and work for the common good, the protection of our cyber pioneers, as our forefathers once circled their

wagons to defend their belongings against physical threats. Given her history, I have no doubt that America will

establish her place in the cyber world as she established her place on the planet - a haven for all who would enter.

Home | Menu | Links | Info | Chairman's Page